Merge m-i <-> m-c
authorPhil Ringnalda <philringnalda@gmail.com>
Sat, 24 Dec 2011 21:50:23 -0800
changeset 83349 798b00a6fe29e758b6f4d816092d5b751ade035d
parent 83321 9dfb1c2c558667a717074d349fa20e6c5b4d21e5 (current diff)
parent 83348 59b8d52229cde094c3e58695ed99877946f1cdc2 (diff)
child 83350 b85379036da21f1c6157d1443fc1bef983997a57
push id4356
push userphilringnalda@gmail.com
push dateSun, 25 Dec 2011 05:53:32 +0000
treeherdermozilla-inbound@798b00a6fe29 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone12.0a1
first release with
nightly linux32
798b00a6fe29 / 12.0a1 / 20111225031006 / files
nightly linux64
798b00a6fe29 / 12.0a1 / 20111225031006 / files
nightly mac
798b00a6fe29 / 12.0a1 / 20111225031006 / files
nightly win32
798b00a6fe29 / 12.0a1 / 20111225031006 / files
nightly win64
798b00a6fe29 / 12.0a1 / 20111225031006 / files
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
releases
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Merge m-i <-> m-c
dom/base/nsDOMWindowUtils.cpp
dom/interfaces/base/nsIDOMWindowUtils.idl
editor/libeditor/base/nsEditorController.cpp
js/jetpack/Handle.h
js/jetpack/JetpackActorCommon.cpp
js/jetpack/JetpackActorCommon.h
js/jetpack/JetpackChild.cpp
js/jetpack/JetpackChild.h
js/jetpack/JetpackParent.cpp
js/jetpack/JetpackParent.h
js/jetpack/JetpackProcessChild.cpp
js/jetpack/JetpackProcessChild.h
js/jetpack/JetpackProcessParent.cpp
js/jetpack/JetpackProcessParent.h
js/jetpack/JetpackService.cpp
js/jetpack/JetpackService.h
js/jetpack/Makefile.in
js/jetpack/PHandle.ipdl
js/jetpack/PJetpack.ipdl
js/jetpack/ipdl.mk
js/jetpack/nsIJetpack.idl
js/jetpack/nsIJetpackService.idl
js/jetpack/tests/Makefile.in
js/jetpack/tests/test_jetpack_crash.xul
js/jetpack/tests/unit/handle_tests.js
js/jetpack/tests/unit/head_jetpack.js
js/jetpack/tests/unit/impl.js
js/jetpack/tests/unit/impl_jetpack_ctypes.js
js/jetpack/tests/unit/impl_rooting.js
js/jetpack/tests/unit/test_jetpack.js
js/jetpack/tests/unit/test_jetpack_ctypes.js
js/jetpack/tests/unit/test_jetpack_sandbox.js
js/jetpack/tests/unit/test_rooting.js
js/jetpack/tests/unit/xpcshell.ini
js/src/jsobj.h
js/src/jsscope.cpp
js/xpconnect/src/XPCVariant.cpp
js/xpconnect/src/XPCWrappedNative.cpp
layout/base/nsPresShell.cpp
testing/xpcshell/xpcshell.ini
widget/src/qt/nsWindow.cpp
--- a/browser/app/blocklist.xml
+++ b/browser/app/blocklist.xml
@@ -1,10 +1,10 @@
 <?xml version="1.0"?>
-<blocklist xmlns="http://www.mozilla.org/2006/addons-blocklist" lastupdate="1321712096000">
+<blocklist xmlns="http://www.mozilla.org/2006/addons-blocklist" lastupdate="1324588296000">
   <emItems>
       <emItem  blockID="i41" id="{99079a25-328f-4bd4-be04-00955acaa0a7}">
                         <versionRange  minVersion="0.1" maxVersion="4.3.1.00" severity="1">
                     </versionRange>
                   </emItem>
       <emItem  blockID="i8" id="{B13721C7-F507-4982-B2E5-502A71474FED}">
                         <versionRange  minVersion=" " severity="1">
                     </versionRange>
@@ -65,23 +65,37 @@
                               <versionRange  minVersion="3.0a1" maxVersion="*" />
                           </targetApplication>
                     </versionRange>
                   </emItem>
       <emItem  blockID="i40" id="{28387537-e3f9-4ed7-860c-11e69af4a8a0}">
                         <versionRange  minVersion="0.1" maxVersion="4.3.1.00" severity="1">
                     </versionRange>
                   </emItem>
+      <emItem  blockID="i46" id="{841468a1-d7f4-4bd3-84e6-bb0f13a06c64}">
+                        <versionRange  minVersion="0.1" maxVersion="*">
+                      <targetApplication  id="{ec8030f7-c20a-464f-9b0e-13a3a9e97384}">
+                              <versionRange  minVersion="9.0a1" maxVersion="9.0" />
+                          </targetApplication>
+                    </versionRange>
+                  </emItem>
       <emItem  blockID="i23" id="firefox@bandoo.com">
                         <versionRange  minVersion="5.0" maxVersion="5.0" severity="1">
                       <targetApplication  id="{ec8030f7-c20a-464f-9b0e-13a3a9e97384}">
                               <versionRange  minVersion="3.7a1pre" maxVersion="*" />
                           </targetApplication>
                     </versionRange>
                   </emItem>
+      <emItem  blockID="i11" id="yslow@yahoo-inc.com">
+                        <versionRange  minVersion="2.0.5" maxVersion="2.0.5">
+                      <targetApplication  id="{ec8030f7-c20a-464f-9b0e-13a3a9e97384}">
+                              <versionRange  minVersion="3.5.7" maxVersion="*" />
+                          </targetApplication>
+                    </versionRange>
+                  </emItem>
       <emItem  blockID="i22" id="ShopperReports@ShopperReports.com">
                         <versionRange  minVersion="3.1.22.0" maxVersion="3.1.22.0">
                     </versionRange>
                   </emItem>
       <emItem  blockID="i2" id="fdm_ffext@freedownloadmanager.org">
                         <versionRange  minVersion="1.0" maxVersion="1.3.1">
                       <targetApplication  id="{ec8030f7-c20a-464f-9b0e-13a3a9e97384}">
                               <versionRange  minVersion="3.0a1" maxVersion="*" />
@@ -101,23 +115,18 @@
       <emItem  blockID="i12" id="masterfiler@gmail.com">
                         <versionRange  severity="3">
                     </versionRange>
                   </emItem>
       <emItem  blockID="i20" id="{AB2CE124-6272-4b12-94A9-7303C7397BD1}">
                         <versionRange  minVersion="0.1" maxVersion="5.2.0.7164" severity="1">
                     </versionRange>
                   </emItem>
-      <emItem  blockID="i11" id="yslow@yahoo-inc.com">
-                        <versionRange  minVersion="2.0.5" maxVersion="2.0.5">
-                      <targetApplication  id="{ec8030f7-c20a-464f-9b0e-13a3a9e97384}">
-                              <versionRange  minVersion="3.5.7" maxVersion="*" />
-                          </targetApplication>
-                    </versionRange>
-                  </emItem>
+      <emItem  blockID="i47" id="youtube@youtube2.com">
+                        </emItem>
       <emItem  blockID="i17" id="{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}">
                         <versionRange  minVersion="2.2" maxVersion="2.2">
                     </versionRange>
                   </emItem>
       <emItem  blockID="i45" id="{22119944-ED35-4ab1-910B-E619EA06A115}">
                         <versionRange  minVersion="0.1" maxVersion="7.6.1">
                       <targetApplication  id="{ec8030f7-c20a-464f-9b0e-13a3a9e97384}">
                               <versionRange  minVersion="8.0a1" maxVersion="*" />
--- a/browser/themes/gnomestripe/browser.css
+++ b/browser/themes/gnomestripe/browser.css
@@ -1236,17 +1236,18 @@ toolbar[iconsize="small"] #feed-button {
 #notification-popup-box {
   position: relative;
   background-color: #fff;
   background-clip: padding-box;
   padding-left: 4px;
   border-radius: 2.5px 0 0 2.5px;
   border-width: 0 8px 0 0;
   border-style: solid;
-  -moz-border-image: url("chrome://browser/skin/urlbar-arrow.png") 0 8 0 0 fill;  -moz-margin-end: -8px;
+  -moz-border-image: url("chrome://browser/skin/urlbar-arrow.png") 0 8 0 0 fill;
+  -moz-margin-end: -8px;
   margin-top: -1px;
   margin-bottom: -1px;
 }
 
 #notification-popup-box:not([hidden]) + #identity-box {
   -moz-padding-start: 10px;
   border-radius: 0;
 }
--- a/browser/themes/winstripe/browser.css
+++ b/browser/themes/winstripe/browser.css
@@ -2613,24 +2613,28 @@ panel[dimmed="true"] {
   border-top-style: solid;
   color: #333;
   text-shadow: none;
 }
 
 .statuspanel-label:-moz-locale-dir(ltr):not([mirror]),
 .statuspanel-label:-moz-locale-dir(rtl)[mirror] {
   border-right-style: solid;
+  /* disabled for triggering grayscale AA (bug 659213)
   border-top-right-radius: .3em;
+  */
   margin-right: 1em;
 }
 
 .statuspanel-label:-moz-locale-dir(rtl):not([mirror]),
 .statuspanel-label:-moz-locale-dir(ltr)[mirror] {
   border-left-style: solid;
+  /* disabled for triggering grayscale AA (bug 659213)
   border-top-left-radius: .3em;
+  */
   margin-left: 1em;
 }
 
 /* Highlighter */
 
 .highlighter-veil {
   background-color: rgba(25, 25, 25, 0.5);
 }
--- a/content/base/src/nsDOMFileReader.cpp
+++ b/content/base/src/nsDOMFileReader.cpp
@@ -71,21 +71,21 @@
 #include "nsIScriptGlobalObject.h"
 #include "nsCExternalHandlerService.h"
 #include "nsIStreamConverterService.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsLayoutStatics.h"
 #include "nsIScriptObjectPrincipal.h"
 #include "nsFileDataProtocolHandler.h"
 #include "mozilla/Preferences.h"
-#include "xpcprivate.h"
 #include "xpcpublic.h"
-#include "XPCQuickStubs.h"
+#include "nsIScriptSecurityManager.h"
+#include "nsDOMJSUtils.h"
+
 #include "jstypedarray.h"
-#include "nsDOMJSUtils.h"
 
 using namespace mozilla;
 
 #define LOAD_STR "load"
 #define LOADSTART_STR "loadstart"
 #define LOADEND_STR "loadend"
 
 using mozilla::dom::FileIOObject;
@@ -242,17 +242,17 @@ nsDOMFileReader::GetResult(JSContext* aC
       *aResult = OBJECT_TO_JSVAL(tmp);
     } else {
       *aResult = JSVAL_NULL;
     }
     return NS_OK;
   }
  
   nsString tmpResult = mResult;
-  if (!xpc_qsStringToJsval(aCx, tmpResult, aResult)) {
+  if (!xpc::StringToJsval(aCx, tmpResult, aResult)) {
     return NS_ERROR_FAILURE;
   }
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsDOMFileReader::GetError(nsIDOMFileError** aError)
 {
--- a/content/base/src/nsGenericElement.cpp
+++ b/content/base/src/nsGenericElement.cpp
@@ -1202,26 +1202,68 @@ nsINode::GetContextForEventHandlers(nsre
 
 /* static */
 void
 nsINode::Trace(nsINode *tmp, TraceCallback cb, void *closure)
 {
   nsContentUtils::TraceWrapper(tmp, cb, closure);
 }
 
+static bool
+IsBlackNode(nsINode* aNode)
+{
+  JSObject* o = aNode->GetWrapperPreserveColor();
+  return o && !xpc_IsGrayGCThing(o);
+}
+
+static bool
+IsXBL(nsINode* aNode)
+{
+  return aNode->IsElement() &&
+         aNode->AsElement()->IsInNamespace(kNameSpaceID_XBL);
+}
+
 /* static */
 bool
 nsINode::Traverse(nsINode *tmp, nsCycleCollectionTraversalCallback &cb)
 {
   nsIDocument *currentDoc = tmp->GetCurrentDoc();
   if (currentDoc &&
       nsCCUncollectableMarker::InGeneration(cb, currentDoc->GetMarkedCCGeneration())) {
     return false;
   }
 
+  if (nsCCUncollectableMarker::sGeneration) {
+    // If we're black no need to traverse.
+    if (IsBlackNode(tmp)) {
+      return false;
+    }
+
+    const PtrBits problematicFlags =
+      (NODE_IS_ANONYMOUS |
+       NODE_IS_IN_ANONYMOUS_SUBTREE |
+       NODE_IS_NATIVE_ANONYMOUS_ROOT |
+       NODE_MAY_BE_IN_BINDING_MNGR |
+       NODE_IS_INSERTION_PARENT);
+
+    if (!tmp->HasFlag(problematicFlags) && !IsXBL(tmp)) {
+      // If we're in a black document, return early.
+      if ((currentDoc && IsBlackNode(currentDoc))) {
+        return false;
+      }
+      // If we're not in anonymous content and we have a black parent,
+      // return early.
+      nsIContent* parent = tmp->GetParent();
+      if (parent && !IsXBL(parent) && IsBlackNode(parent)) {
+        NS_ABORT_IF_FALSE(parent->IndexOf(tmp) >= 0, "Parent doesn't own us?");
+        return false;
+      }
+    }
+  }
+
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mNodeInfo)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_RAWPTR(GetParent())
 
   nsSlots *slots = tmp->GetExistingSlots();
   if (slots) {
     slots->Traverse(cb);
   }
 
--- a/content/base/src/nsXMLHttpRequest.cpp
+++ b/content/base/src/nsXMLHttpRequest.cpp
@@ -64,18 +64,19 @@
 #include "nsICharsetAlias.h"
 #include "nsIScriptGlobalObject.h"
 #include "nsDOMClassInfoID.h"
 #include "nsIDOMElement.h"
 #include "nsIDOMWindow.h"
 #include "nsIMIMEService.h"
 #include "nsCExternalHandlerService.h"
 #include "nsIVariant.h"
-#include "xpcprivate.h"
-#include "XPCQuickStubs.h"
+#include "nsVariant.h"
+#include "nsIScriptError.h"
+#include "xpcpublic.h"
 #include "nsStringStream.h"
 #include "nsIStreamConverterService.h"
 #include "nsICachingChannel.h"
 #include "nsContentUtils.h"
 #include "nsEventDispatcher.h"
 #include "nsDOMJSUtils.h"
 #include "nsCOMArray.h"
 #include "nsIScriptableUConv.h"
@@ -1031,17 +1032,17 @@ NS_IMETHODIMP nsXMLHttpRequest::GetRespo
   switch (mResponseType) {
   case XML_HTTP_RESPONSE_TYPE_DEFAULT:
   case XML_HTTP_RESPONSE_TYPE_TEXT:
   case XML_HTTP_RESPONSE_TYPE_CHUNKED_TEXT:
     {
       nsString str;
       rv = GetResponseText(str);
       if (NS_FAILED(rv)) return rv;
-      NS_ENSURE_TRUE(xpc_qsStringToJsval(aCx, str, aResult),
+      NS_ENSURE_TRUE(xpc::StringToJsval(aCx, str, aResult),
                      NS_ERROR_OUT_OF_MEMORY);
     }
     break;
 
   case XML_HTTP_RESPONSE_TYPE_ARRAYBUFFER:
   case XML_HTTP_RESPONSE_TYPE_CHUNKED_ARRAYBUFFER:
     if ((mResponseType == XML_HTTP_RESPONSE_TYPE_ARRAYBUFFER &&
          mState & XML_HTTP_REQUEST_DONE) ||
--- a/content/canvas/src/CustomQS_Canvas2D.h
+++ b/content/canvas/src/CustomQS_Canvas2D.h
@@ -102,17 +102,17 @@ Canvas2D_GetStyleHelper(JSContext *cx, J
     nsCOMPtr<nsISupports> resultInterface;
     PRInt32 resultType;
     rv = (self->*getfunc)(resultString, getter_AddRefs(resultInterface), &resultType);
     if (NS_FAILED(rv))
         return xpc_qsThrowGetterSetterFailed(cx, rv, JSVAL_TO_OBJECT(*vp), id);
 
     switch (resultType) {
     case nsIDOMCanvasRenderingContext2D::CMG_STYLE_STRING:
-        return xpc_qsStringToJsval(cx, resultString, vp);
+        return xpc::StringToJsval(cx, resultString, vp);
 
     case nsIDOMCanvasRenderingContext2D::CMG_STYLE_PATTERN:
     {
         qsObjectHelper helper(resultInterface,
                               xpc_qsGetWrapperCache(resultInterface));
         return xpc_qsXPCOMObjectToJsval(lccx, helper,
                                         &NS_GET_IID(nsIDOMCanvasPattern),
                                         &interfaces[k_nsIDOMCanvasPattern], vp);
@@ -151,21 +151,21 @@ nsIDOMCanvasRenderingContext2D_SetFillSt
 static JSBool
 nsIDOMCanvasRenderingContext2D_GetFillStyle(JSContext *cx, JSObject *obj, jsid id, jsval *vp)
 {
     return Canvas2D_GetStyleHelper(cx, obj, id, vp, &nsIDOMCanvasRenderingContext2D::GetFillStyle_multi);
 }
 
 static bool
 CreateImageData(JSContext* cx,
-                uint32 w,
-                uint32 h,
+                uint32_t w,
+                uint32_t h,
                 nsIDOMCanvasRenderingContext2D* self,
-                int32 x,
-                int32 y,
+                int32_t x,
+                int32_t y,
                 jsval* vp)
 {
     using mozilla::CheckedInt;
 
     if (w == 0)
         w = 1;
     if (h == 0)
         h = 1;
@@ -276,21 +276,21 @@ nsIDOMCanvasRenderingContext2D_CreateIma
         return false;
 
     if (!NS_finite(width) || !NS_finite(height))
         return xpc_qsThrow(cx, NS_ERROR_DOM_NOT_SUPPORTED_ERR);
 
     if (!width || !height)
         return xpc_qsThrow(cx, NS_ERROR_DOM_INDEX_SIZE_ERR);
 
-    int32 wi = JS_DoubleToInt32(width);
-    int32 hi = JS_DoubleToInt32(height);
+    int32_t wi = JS_DoubleToInt32(width);
+    int32_t hi = JS_DoubleToInt32(height);
 
-    uint32 w = NS_ABS(wi);
-    uint32 h = NS_ABS(hi);
+    uint32_t w = NS_ABS(wi);
+    uint32_t h = NS_ABS(hi);
     return CreateImageData(cx, w, h, NULL, 0, 0, vp);
 }
 
 static JSBool
 nsIDOMCanvasRenderingContext2D_GetImageData(JSContext *cx, uintN argc, jsval *vp)
 {
     XPC_QS_ASSERT_CONTEXT_OK(cx);
 
@@ -318,24 +318,24 @@ nsIDOMCanvasRenderingContext2D_GetImageD
 
     if (!NS_finite(xd) || !NS_finite(yd) ||
         !NS_finite(width) || !NS_finite(height))
         return xpc_qsThrow(cx, NS_ERROR_DOM_NOT_SUPPORTED_ERR);
 
     if (!width || !height)
         return xpc_qsThrow(cx, NS_ERROR_DOM_INDEX_SIZE_ERR);
 
-    int32 x = JS_DoubleToInt32(xd);
-    int32 y = JS_DoubleToInt32(yd);
-    int32 wi = JS_DoubleToInt32(width);
-    int32 hi = JS_DoubleToInt32(height);
+    int32_t x = JS_DoubleToInt32(xd);
+    int32_t y = JS_DoubleToInt32(yd);
+    int32_t wi = JS_DoubleToInt32(width);
+    int32_t hi = JS_DoubleToInt32(height);
 
     // Handle negative width and height by flipping the rectangle over in the
     // relevant direction.
-    uint32 w, h;
+    uint32_t w, h;
     if (width < 0) {
         w = -wi;
         x -= w;
     } else {
         w = wi;
     }
     if (height < 0) {
         h = -hi;
@@ -378,32 +378,32 @@ nsIDOMCanvasRenderingContext2D_PutImageD
         !JS_ValueToNumber(cx, argv[2], &yd)) {
         return false;
     }
 
     if (!NS_finite(xd) || !NS_finite(yd)) {
         return xpc_qsThrow(cx, NS_ERROR_DOM_NOT_SUPPORTED_ERR);
     }
 
-    int32 x = JS_DoubleToInt32(xd);
-    int32 y = JS_DoubleToInt32(yd);
+    int32_t x = JS_DoubleToInt32(xd);
+    int32_t y = JS_DoubleToInt32(yd);
 
     // Grab width, height, and the dense array from the dataObject.
     js::AutoValueRooter tv(cx);
 
     uint32_t w, h;
     if (!GetImageDataDimensions(cx, dataObject, &w, &h))
         return JS_FALSE;
 
     // the optional dirty rect
     bool hasDirtyRect = false;
-    int32 dirtyX = 0,
-          dirtyY = 0,
-          dirtyWidth = w,
-          dirtyHeight = h;
+    int32_t dirtyX = 0,
+            dirtyY = 0,
+            dirtyWidth = w,
+            dirtyHeight = h;
 
     if (argc >= 7) {
         double dx, dy, dw, dh;
         if (!JS_ValueToNumber(cx, argv[3], &dx) ||
             !JS_ValueToNumber(cx, argv[4], &dy) ||
             !JS_ValueToNumber(cx, argv[5], &dw) ||
             !JS_ValueToNumber(cx, argv[6], &dh)) {
             return false;
--- a/content/events/src/nsDOMCloseEvent.cpp
+++ b/content/events/src/nsDOMCloseEvent.cpp
@@ -33,16 +33,17 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsDOMCloseEvent.h"
 #include "nsContentUtils.h"
+#include "DictionaryHelpers.h"
 
 NS_IMPL_ADDREF_INHERITED(nsDOMCloseEvent, nsDOMEvent)
 NS_IMPL_RELEASE_INHERITED(nsDOMCloseEvent, nsDOMEvent)
 
 DOMCI_DATA(CloseEvent, nsDOMCloseEvent)
 
 NS_INTERFACE_MAP_BEGIN(nsDOMCloseEvent)
   NS_INTERFACE_MAP_ENTRY(nsIDOMCloseEvent)
@@ -84,41 +85,24 @@ nsDOMCloseEvent::InitCloseEvent(const ns
   mWasClean = aWasClean;
   mReasonCode = aReasonCode;
   mReason = aReason;
 
   return NS_OK;
 }
 
 nsresult
-nsDOMCloseEvent::InitFromCtor(const nsAString& aType, nsISupports* aDict,
-                              JSContext* aCx, JSObject* aObj)
+nsDOMCloseEvent::InitFromCtor(const nsAString& aType,
+                              JSContext* aCx, jsval* aVal)
 {
-  nsCOMPtr<nsICloseEventInit> eventInit = do_QueryInterface(aDict);
-  bool bubbles = false;
-  bool cancelable = false;
-  bool wasClean = false;
-  PRUint16 code = 0;
-  nsAutoString reason;
-  if (eventInit) {
-    nsresult rv = eventInit->GetBubbles(&bubbles);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetCancelable(&cancelable);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetWasClean(&wasClean);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetCode(&code);
-    NS_ENSURE_SUCCESS(rv, rv);
-    JSBool found = JS_FALSE;
-    if (JS_HasProperty(aCx, aObj, "reason", &found) && found) {
-      rv = eventInit->GetReason(reason);
-      NS_ENSURE_SUCCESS(rv, rv);
-    }
-  }
-  return InitCloseEvent(aType, bubbles, cancelable, wasClean, code, reason);
+  mozilla::dom::CloseEventInit d;
+  nsresult rv = d.Init(aCx, aVal);
+  NS_ENSURE_SUCCESS(rv, rv);
+  return InitCloseEvent(aType, d.bubbles, d.cancelable, d.wasClean, d.code,
+                        d.reason);
 }
 
 nsresult
 NS_NewDOMCloseEvent(nsIDOMEvent** aInstancePtrResult,
                     nsPresContext* aPresContext,
                     nsEvent* aEvent) 
 {
   nsDOMCloseEvent* it = new nsDOMCloseEvent(aPresContext, aEvent);
--- a/content/events/src/nsDOMCloseEvent.h
+++ b/content/events/src/nsDOMCloseEvent.h
@@ -59,18 +59,17 @@ public:
                      
   NS_DECL_ISUPPORTS_INHERITED
 
   // Forward to base class
   NS_FORWARD_TO_NSDOMEVENT
 
   NS_DECL_NSIDOMCLOSEEVENT
 
-  virtual const nsIID& EventInitIID() { return NS_GET_IID(nsICloseEventInit); }
-  virtual nsresult InitFromCtor(const nsAString& aType, nsISupports* aDict,
-                                JSContext* aCx, JSObject* aObj);
+  virtual nsresult InitFromCtor(const nsAString& aType,
+                                JSContext* aCx, jsval* aVal);
 private:
   bool mWasClean;
   PRUint16 mReasonCode;
   nsString mReason;
 };
 
 #endif // nsDOMCloseEvent_h__
--- a/content/events/src/nsDOMCustomEvent.cpp
+++ b/content/events/src/nsDOMCustomEvent.cpp
@@ -32,16 +32,17 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsDOMCustomEvent.h"
 #include "nsContentUtils.h"
+#include "DictionaryHelpers.h"
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsDOMCustomEvent)
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsDOMCustomEvent, nsDOMEvent)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mDetail)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsDOMCustomEvent, nsDOMEvent)
@@ -74,32 +75,23 @@ nsDOMCustomEvent::InitCustomEvent(const 
   nsresult rv = nsDOMEvent::InitEvent(aType, aCanBubble, aCancelable);
   NS_ENSURE_SUCCESS(rv, rv);
 
   mDetail = aDetail;
   return NS_OK;
 }
 
 nsresult
-nsDOMCustomEvent::InitFromCtor(const nsAString& aType, nsISupports* aDict,
-                               JSContext* aCx, JSObject* aObj)
+nsDOMCustomEvent::InitFromCtor(const nsAString& aType,
+                               JSContext* aCx, jsval* aVal)
 {
-  nsCOMPtr<nsICustomEventInit> eventInit = do_QueryInterface(aDict);
-  bool bubbles = false;
-  bool cancelable = false;
-  nsCOMPtr<nsIVariant> detail;
-  if (eventInit) {
-    nsresult rv = eventInit->GetBubbles(&bubbles);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetCancelable(&cancelable);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetDetail(getter_AddRefs(detail));
-    NS_ENSURE_SUCCESS(rv, rv);
-  }
-  return InitCustomEvent(aType, bubbles, cancelable, detail);
+  mozilla::dom::CustomEventInit d;
+  nsresult rv = d.Init(aCx, aVal);
+  NS_ENSURE_SUCCESS(rv, rv);
+  return InitCustomEvent(aType, d.bubbles, d.cancelable, d.detail);
 }
 
 nsresult
 NS_NewDOMCustomEvent(nsIDOMEvent** aInstancePtrResult,
                      nsPresContext* aPresContext,
                      nsEvent* aEvent) 
 {
   nsDOMCustomEvent* e = new nsDOMCustomEvent(aPresContext, aEvent);
--- a/content/events/src/nsDOMCustomEvent.h
+++ b/content/events/src/nsDOMCustomEvent.h
@@ -54,16 +54,15 @@ public:
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsDOMCustomEvent, nsDOMEvent)
 
   NS_DECL_NSIDOMCUSTOMEVENT
 
   // Forward to base class
   NS_FORWARD_TO_NSDOMEVENT
 
-  virtual const nsIID& EventInitIID() { return NS_GET_IID(nsICustomEventInit); }
-  virtual nsresult InitFromCtor(const nsAString& aType, nsISupports* aDict,
-                                JSContext* aCx, JSObject* aObj);
+  virtual nsresult InitFromCtor(const nsAString& aType,
+                                JSContext* aCx, jsval* aVal);
 private:
   nsCOMPtr<nsIVariant> mDetail;
 };
 
 #endif // nsDOMCustomEvent_h__
--- a/content/events/src/nsDOMEvent.cpp
+++ b/content/events/src/nsDOMEvent.cpp
@@ -57,16 +57,17 @@
 #include "nsMutationEvent.h"
 #include "nsContentUtils.h"
 #include "nsIURI.h"
 #include "nsIScriptSecurityManager.h"
 #include "nsIScriptError.h"
 #include "nsDOMPopStateEvent.h"
 #include "mozilla/Preferences.h"
 #include "nsJSUtils.h"
+#include "DictionaryHelpers.h"
 
 using namespace mozilla;
 
 static const char* const sEventNames[] = {
   "mousedown", "mouseup", "click", "dblclick", "mouseenter", "mouseleave", "mouseover",
   "mouseout", "MozMouseHittest", "mousemove", "contextmenu", "keydown", "keyup", "keypress",
   "focus", "blur", "load", "popstate", "beforescriptexecute",
   "afterscriptexecute", "beforeunload", "unload",
@@ -404,46 +405,32 @@ nsDOMEvent::Initialize(nsISupports* aOwn
   if (!jsstr) {
     return NS_ERROR_DOM_SYNTAX_ERR;
   }
 
   JS::Anchor<JSString*> deleteProtector(jsstr);
 
   nsDependentJSString type;
   NS_ENSURE_STATE(type.init(aCx, jsstr));
-  
-  nsCOMPtr<nsISupports> dict;
-  JSObject* obj = nsnull;
-  if (aArgc >= 2 && !JSVAL_IS_PRIMITIVE(aArgv[1])) {
-    obj = JSVAL_TO_OBJECT(aArgv[1]);
-    nsContentUtils::XPConnect()->WrapJS(aCx, obj,
-                                        EventInitIID(),
-                                        getter_AddRefs(dict));
-  }
-  nsresult rv = InitFromCtor(type, dict, aCx, obj);
+
+  nsresult rv = InitFromCtor(type, aCx, aArgc >= 2 ? &(aArgv[1]) : nsnull);
   NS_ENSURE_SUCCESS(rv, rv);
 
   SetTrusted(trusted);
   return NS_OK;
 }
 
 nsresult
-nsDOMEvent::InitFromCtor(const nsAString& aType, nsISupports* aDict,
-                         JSContext* aCx, JSObject* aObj)
+nsDOMEvent::InitFromCtor(const nsAString& aType,
+                         JSContext* aCx, jsval* aVal)
 {
-  nsCOMPtr<nsIEventInit> eventInit = do_QueryInterface(aDict);
-  bool bubbles = false;
-  bool cancelable = false;
-  if (eventInit) {
-    nsresult rv = eventInit->GetBubbles(&bubbles);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetCancelable(&cancelable);
-    NS_ENSURE_SUCCESS(rv, rv);
-  }
-  return InitEvent(aType, bubbles, cancelable);
+  mozilla::dom::EventInit d;
+  nsresult rv = d.Init(aCx, aVal);
+  NS_ENSURE_SUCCESS(rv, rv);
+  return InitEvent(aType, d.bubbles, d.cancelable);
 }
 
 NS_IMETHODIMP
 nsDOMEvent::GetEventPhase(PRUint16* aEventPhase)
 {
   // Note, remember to check that this works also
   // if or when Bug 235441 is fixed.
   if (mEvent->currentTarget == mEvent->target ||
--- a/content/events/src/nsDOMEvent.h
+++ b/content/events/src/nsDOMEvent.h
@@ -222,19 +222,18 @@ public:
   NS_IMETHOD_(bool)    IsDispatchStopped();
   NS_IMETHOD_(nsEvent*)    GetInternalNSEvent();
   NS_IMETHOD    SetTrusted(bool aTrusted);
 
   // nsIJSNativeInitializer
   NS_IMETHOD Initialize(nsISupports* aOwner, JSContext* aCx, JSObject* aObj,
                         PRUint32 aArgc, jsval* aArgv);
 
-  virtual const nsIID& EventInitIID() { return NS_GET_IID(nsIEventInit); }
-  virtual nsresult InitFromCtor(const nsAString& aType, nsISupports* aDict,
-                                JSContext* aCx, JSObject* aObj);
+  virtual nsresult InitFromCtor(const nsAString& aType,
+                                JSContext* aCx, jsval* aVal);
 
   void InitPresContextData(nsPresContext* aPresContext);
 
   virtual void Serialize(IPC::Message* aMsg, bool aSerializeInterfaceType);
   virtual bool Deserialize(const IPC::Message* aMsg, void** aIter);
 
   static PopupControlState GetEventPopupControlState(nsEvent *aEvent);
 
--- a/content/events/src/nsDOMHashChangeEvent.cpp
+++ b/content/events/src/nsDOMHashChangeEvent.cpp
@@ -29,16 +29,17 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsDOMHashChangeEvent.h"
 #include "nsContentUtils.h"
+#include "DictionaryHelpers.h"
 
 NS_IMPL_ADDREF_INHERITED(nsDOMHashChangeEvent, nsDOMEvent)
 NS_IMPL_RELEASE_INHERITED(nsDOMHashChangeEvent, nsDOMEvent)
 
 DOMCI_DATA(HashChangeEvent, nsDOMHashChangeEvent)
 
 NS_INTERFACE_MAP_BEGIN(nsDOMHashChangeEvent)
   NS_INTERFACE_MAP_ENTRY(nsIDOMHashChangeEvent)
@@ -74,41 +75,23 @@ nsDOMHashChangeEvent::InitHashChangeEven
   NS_ENSURE_SUCCESS(rv, rv);
 
   mOldURL.Assign(aOldURL);
   mNewURL.Assign(aNewURL);
   return NS_OK;
 }
 
 nsresult
-nsDOMHashChangeEvent::InitFromCtor(const nsAString& aType, nsISupports* aDict,
-                                   JSContext* aCx, JSObject* aObj)
+nsDOMHashChangeEvent::InitFromCtor(const nsAString& aType,
+                                   JSContext* aCx, jsval* aVal)
 {
-  nsCOMPtr<nsIHashChangeEventInit> eventInit = do_QueryInterface(aDict);
-  bool bubbles = false;
-  bool cancelable = false;
-  nsAutoString oldURL;
-  nsAutoString newURL;
-  if (eventInit) {
-    nsresult rv = eventInit->GetBubbles(&bubbles);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetCancelable(&cancelable);
-    NS_ENSURE_SUCCESS(rv, rv);
-    JSBool found = JS_FALSE;
-    if (JS_HasProperty(aCx, aObj, "oldURL", &found) && found) {
-      rv = eventInit->GetOldURL(oldURL);
-      NS_ENSURE_SUCCESS(rv, rv);
-    }
-    found = JS_FALSE;
-    if (JS_HasProperty(aCx, aObj, "newURL", &found) && found) {
-      rv = eventInit->GetNewURL(newURL);
-      NS_ENSURE_SUCCESS(rv, rv);
-    }
-  }
-  return InitHashChangeEvent(aType, bubbles, cancelable, oldURL, newURL);
+  mozilla::dom::HashChangeEventInit d;
+  nsresult rv = d.Init(aCx, aVal);
+  NS_ENSURE_SUCCESS(rv, rv);
+  return InitHashChangeEvent(aType, d.bubbles, d.cancelable, d.oldURL, d.newURL);
 }
 
 nsresult NS_NewDOMHashChangeEvent(nsIDOMEvent** aInstancePtrResult,
                                 nsPresContext* aPresContext,
                                 nsEvent* aEvent)
 {
   nsDOMHashChangeEvent* event =
     new nsDOMHashChangeEvent(aPresContext, aEvent);
--- a/content/events/src/nsDOMHashChangeEvent.h
+++ b/content/events/src/nsDOMHashChangeEvent.h
@@ -53,17 +53,16 @@ public:
 
   virtual ~nsDOMHashChangeEvent();
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_NSIDOMHASHCHANGEEVENT
 
   NS_FORWARD_TO_NSDOMEVENT
 
-  virtual const nsIID& EventInitIID() { return NS_GET_IID(nsIHashChangeEventInit); }
-  virtual nsresult InitFromCtor(const nsAString& aType, nsISupports* aDict,
-                                JSContext* aCx, JSObject* aObj);
+  virtual nsresult InitFromCtor(const nsAString& aType,
+                                JSContext* aCx, jsval* aVal);
 protected:
   nsString mOldURL;
   nsString mNewURL;
 };
 
 #endif // nsDOMHashChangeEvent_h__
--- a/content/events/src/nsDOMMouseEvent.cpp
+++ b/content/events/src/nsDOMMouseEvent.cpp
@@ -36,16 +36,17 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsDOMMouseEvent.h"
 #include "nsGUIEvent.h"
 #include "nsIContent.h"
 #include "nsContentUtils.h"
+#include "DictionaryHelpers.h"
 
 nsDOMMouseEvent::nsDOMMouseEvent(nsPresContext* aPresContext,
                                  nsInputEvent* aEvent)
   : nsDOMUIEvent(aPresContext, aEvent ? aEvent :
                  new nsMouseEvent(false, 0, nsnull,
                                   nsMouseEvent::eReal))
 {
   // There's no way to make this class' ctor allocate an nsMouseScrollEvent.
@@ -140,68 +141,27 @@ nsDOMMouseEvent::InitMouseEvent(const ns
     default:
        break;
   }
 
   return NS_OK;
 }   
 
 nsresult
-nsDOMMouseEvent::InitFromCtor(const nsAString& aType, nsISupports* aDict,
-                              JSContext* aCx, JSObject* aObj)
+nsDOMMouseEvent::InitFromCtor(const nsAString& aType,
+                              JSContext* aCx, jsval* aVal)
 {
-  nsCOMPtr<nsIMouseEventInit> eventInit = do_QueryInterface(aDict);
-  bool bubbles = false;
-  bool cancelable = false;
-  nsCOMPtr<nsIDOMWindow> view;
-  PRInt32 detail = 0;
-  PRInt32 screenX = 0;
-  PRInt32 screenY = 0;
-  PRInt32 clientX = 0;
-  PRInt32 clientY = 0;
-  bool ctrl = false;
-  bool alt = false;
-  bool shift = false;
-  bool meta = false;
-  PRUint16 button = 0;
-  nsCOMPtr<nsIDOMEventTarget> relatedTarget;
-  if (eventInit) {
-    nsresult rv = eventInit->GetBubbles(&bubbles);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetCancelable(&cancelable);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetView(getter_AddRefs(view));
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetDetail(&detail);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetScreenX(&screenX);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetScreenY(&screenY);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetClientX(&clientX);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetClientY(&clientY);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetCtrlKey(&ctrl);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetShiftKey(&shift);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetAltKey(&alt);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetMetaKey(&meta);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetButton(&button);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetRelatedTarget(getter_AddRefs(relatedTarget));
-    NS_ENSURE_SUCCESS(rv, rv);
-  }
-  return InitMouseEvent(aType, bubbles, cancelable,
-                        view, detail, screenX, screenY, clientX, clientY, 
-                        ctrl, alt, shift, meta,
-                        button, relatedTarget);
+  mozilla::dom::MouseEventInit d;
+  nsresult rv = d.Init(aCx, aVal);
+  NS_ENSURE_SUCCESS(rv, rv);
+  return InitMouseEvent(aType, d.bubbles, d.cancelable,
+                        d.view, d.detail, d.screenX, d.screenY,
+                        d.clientX, d.clientY, 
+                        d.ctrlKey, d.altKey, d.shiftKey, d.metaKey,
+                        d.button, d.relatedTarget);
 }
 
 NS_IMETHODIMP
 nsDOMMouseEvent::InitNSMouseEvent(const nsAString & aType, bool aCanBubble, bool aCancelable,
                                   nsIDOMWindow *aView, PRInt32 aDetail, PRInt32 aScreenX,
                                   PRInt32 aScreenY, PRInt32 aClientX, PRInt32 aClientY,
                                   bool aCtrlKey, bool aAltKey, bool aShiftKey,
                                   bool aMetaKey, PRUint16 aButton, nsIDOMEventTarget *aRelatedTarget,
--- a/content/events/src/nsDOMMouseEvent.h
+++ b/content/events/src/nsDOMMouseEvent.h
@@ -55,19 +55,18 @@ public:
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIDOMMouseEvent Interface
   NS_DECL_NSIDOMMOUSEEVENT
 
   // Forward to base class
   NS_FORWARD_TO_NSDOMUIEVENT
 
-  virtual const nsIID& EventInitIID() { return NS_GET_IID(nsIMouseEventInit); }
-  virtual nsresult InitFromCtor(const nsAString& aType, nsISupports* aDict,
-                                JSContext* aCx, JSObject* aObj);
+  virtual nsresult InitFromCtor(const nsAString& aType,
+                                JSContext* aCx, jsval* aVal);
 protected:
   // Specific implementation for a mouse event.
   virtual nsresult Which(PRUint32* aWhich);
 };
 
 #define NS_FORWARD_TO_NSDOMMOUSEEVENT         \
   NS_FORWARD_NSIDOMMOUSEEVENT(nsDOMMouseEvent::) \
   NS_FORWARD_TO_NSDOMUIEVENT
--- a/content/events/src/nsDOMPageTransitionEvent.cpp
+++ b/content/events/src/nsDOMPageTransitionEvent.cpp
@@ -33,16 +33,17 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsDOMPageTransitionEvent.h"
 #include "nsContentUtils.h"
+#include "DictionaryHelpers.h"
 
 DOMCI_DATA(PageTransitionEvent, nsDOMPageTransitionEvent)
 
 NS_INTERFACE_MAP_BEGIN(nsDOMPageTransitionEvent)
   NS_INTERFACE_MAP_ENTRY(nsIDOMPageTransitionEvent)
   NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(PageTransitionEvent)
 NS_INTERFACE_MAP_END_INHERITING(nsDOMEvent)
 
@@ -65,32 +66,23 @@ nsDOMPageTransitionEvent::InitPageTransi
   nsresult rv = nsDOMEvent::InitEvent(aTypeArg, aCanBubbleArg, aCancelableArg);
   NS_ENSURE_SUCCESS(rv, rv);
 
   mPersisted = aPersisted;
   return NS_OK;
 }
 
 nsresult
-nsDOMPageTransitionEvent::InitFromCtor(const nsAString& aType, nsISupports* aDict,
-                                       JSContext* aCx, JSObject* aObj)
+nsDOMPageTransitionEvent::InitFromCtor(const nsAString& aType,
+                                       JSContext* aCx, jsval* aVal)
 {
-  nsCOMPtr<nsIPageTransitionEventInit> eventInit = do_QueryInterface(aDict);
-  bool bubbles = false;
-  bool cancelable = false;
-  bool persisted = false;
-  if (eventInit) {
-    nsresult rv = eventInit->GetBubbles(&bubbles);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetCancelable(&cancelable);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetPersisted(&persisted);
-    NS_ENSURE_SUCCESS(rv, rv);
-  }
-  return InitPageTransitionEvent(aType, bubbles, cancelable, persisted);
+  mozilla::dom::PageTransitionEventInit d;
+  nsresult rv = d.Init(aCx, aVal);
+  NS_ENSURE_SUCCESS(rv, rv);
+  return InitPageTransitionEvent(aType, d.bubbles, d.cancelable, d.persisted);
 }
 
 nsresult NS_NewDOMPageTransitionEvent(nsIDOMEvent** aInstancePtrResult,
                                       nsPresContext* aPresContext,
                                       nsEvent *aEvent) 
 {
   nsDOMPageTransitionEvent* it =
     new nsDOMPageTransitionEvent(aPresContext, aEvent);
--- a/content/events/src/nsDOMPageTransitionEvent.h
+++ b/content/events/src/nsDOMPageTransitionEvent.h
@@ -51,16 +51,15 @@ public:
 
   NS_DECL_ISUPPORTS_INHERITED
 
   NS_DECL_NSIDOMPAGETRANSITIONEVENT
 
   // Forward to base class
   NS_FORWARD_TO_NSDOMEVENT
 
-  virtual const nsIID& EventInitIID() { return NS_GET_IID(nsIPageTransitionEventInit); }
-  virtual nsresult InitFromCtor(const nsAString& aType, nsISupports* aDict,
-                                JSContext* aCx, JSObject* aObj);
+  virtual nsresult InitFromCtor(const nsAString& aType,
+                                JSContext* aCx, jsval* aVal);
 protected:
   bool mPersisted;
 };
 
 #endif // nsDOMPageTransitionEvent_h__
--- a/content/events/src/nsDOMPopStateEvent.cpp
+++ b/content/events/src/nsDOMPopStateEvent.cpp
@@ -32,16 +32,17 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsDOMPopStateEvent.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsDOMClassInfoID.h"
 #include "nsIClassInfo.h"
 #include "nsIXPCScriptable.h"
+#include "DictionaryHelpers.h"
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsDOMPopStateEvent)
 
 NS_IMPL_ADDREF_INHERITED(nsDOMPopStateEvent, nsDOMEvent)
 NS_IMPL_RELEASE_INHERITED(nsDOMPopStateEvent, nsDOMEvent)
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsDOMPopStateEvent, nsDOMEvent)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mState)
@@ -79,32 +80,23 @@ nsDOMPopStateEvent::InitPopStateEvent(co
   nsresult rv = nsDOMEvent::InitEvent(aTypeArg, aCanBubbleArg, aCancelableArg);
   NS_ENSURE_SUCCESS(rv, rv);
 
   mState = aStateArg;
   return NS_OK;
 }
 
 nsresult
-nsDOMPopStateEvent::InitFromCtor(const nsAString& aType, nsISupports* aDict,
-                                 JSContext* aCx, JSObject* aObj)
+nsDOMPopStateEvent::InitFromCtor(const nsAString& aType,
+                                 JSContext* aCx, jsval* aVal)
 {
-  nsCOMPtr<nsIPopStateEventInit> eventInit = do_QueryInterface(aDict);
-  bool bubbles = false;
-  bool cancelable = false;
-  nsCOMPtr<nsIVariant> state;
-  if (eventInit) {
-    nsresult rv = eventInit->GetBubbles(&bubbles);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetCancelable(&cancelable);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetState(getter_AddRefs(state));
-    NS_ENSURE_SUCCESS(rv, rv);
-  }
-  return InitPopStateEvent(aType, bubbles, cancelable, state);
+  mozilla::dom::PopStateEventInit d;
+  nsresult rv = d.Init(aCx, aVal);
+  NS_ENSURE_SUCCESS(rv, rv);
+  return InitPopStateEvent(aType, d.bubbles, d.cancelable, d.state);
 }
 
 nsresult NS_NewDOMPopStateEvent(nsIDOMEvent** aInstancePtrResult,
                                 nsPresContext* aPresContext,
                                 nsEvent* aEvent)
 {
   nsDOMPopStateEvent* event =
     new nsDOMPopStateEvent(aPresContext, aEvent);
--- a/content/events/src/nsDOMPopStateEvent.h
+++ b/content/events/src/nsDOMPopStateEvent.h
@@ -55,16 +55,15 @@ public:
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsDOMPopStateEvent, nsDOMEvent)
 
   NS_DECL_NSIDOMPOPSTATEEVENT
 
   NS_FORWARD_TO_NSDOMEVENT
 
-  virtual const nsIID& EventInitIID() { return NS_GET_IID(nsIPopStateEventInit); }
-  virtual nsresult InitFromCtor(const nsAString& aType, nsISupports* aDict,
-                                JSContext* aCx, JSObject* aObj);
+  virtual nsresult InitFromCtor(const nsAString& aType,
+                                JSContext* aCx, jsval* aVal);
 protected:
   nsCOMPtr<nsIVariant> mState;
 };
 
 #endif // nsDOMPopStateEvent_h__
--- a/content/events/src/nsDOMUIEvent.cpp
+++ b/content/events/src/nsDOMUIEvent.cpp
@@ -46,16 +46,17 @@
 #include "nsIDOMWindow.h"
 #include "nsIDOMNode.h"
 #include "nsIContent.h"
 #include "nsContentUtils.h"
 #include "nsEventStateManager.h"
 #include "nsIFrame.h"
 #include "nsLayoutUtils.h"
 #include "nsIScrollableFrame.h"
+#include "DictionaryHelpers.h"
 
 nsDOMUIEvent::nsDOMUIEvent(nsPresContext* aPresContext, nsGUIEvent* aEvent)
   : nsDOMEvent(aPresContext, aEvent ?
                static_cast<nsEvent *>(aEvent) :
                static_cast<nsEvent *>(new nsUIEvent(false, 0, 0)))
   , mClientPoint(0, 0), mLayerPoint(0, 0), mPagePoint(0, 0)
 {
   if (aEvent) {
@@ -201,35 +202,23 @@ nsDOMUIEvent::InitUIEvent(const nsAStrin
   
   mDetail = detailArg;
   mView = viewArg;
 
   return NS_OK;
 }
 
 nsresult
-nsDOMUIEvent::InitFromCtor(const nsAString& aType, nsISupports* aDict,
-                           JSContext* aCx, JSObject* aObj)
+nsDOMUIEvent::InitFromCtor(const nsAString& aType,
+                           JSContext* aCx, jsval* aVal)
 {
-  nsCOMPtr<nsIUIEventInit> eventInit = do_QueryInterface(aDict);
-  bool bubbles = false;
-  bool cancelable = false;
-  nsCOMPtr<nsIDOMWindow> view;
-  PRInt32 detail = 0;
-  if (eventInit) {
-    nsresult rv = eventInit->GetBubbles(&bubbles);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetCancelable(&cancelable);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetView(getter_AddRefs(view));
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = eventInit->GetDetail(&detail);
-    NS_ENSURE_SUCCESS(rv, rv);
-  }
-  return InitUIEvent(aType, bubbles, cancelable, view, detail);
+  mozilla::dom::UIEventInit d;
+  nsresult rv = d.Init(aCx, aVal);
+  NS_ENSURE_SUCCESS(rv, rv);
+  return InitUIEvent(aType, d.bubbles, d.cancelable, d.view, d.detail);
 }
 
 // ---- nsDOMNSUIEvent implementation -------------------
 nsIntPoint
 nsDOMUIEvent::GetPagePoint()
 {
   if (mPrivateDataDuplicated) {
     return mPagePoint;
--- a/content/events/src/nsDOMUIEvent.h
+++ b/content/events/src/nsDOMUIEvent.h
@@ -59,19 +59,18 @@ public:
   virtual void Serialize(IPC::Message* aMsg, bool aSerializeInterfaceType);
   virtual bool Deserialize(const IPC::Message* aMsg, void** aIter);
   
   // Forward to nsDOMEvent
   NS_FORWARD_TO_NSDOMEVENT
 
   NS_FORWARD_NSIDOMNSEVENT(nsDOMEvent::)
 
-  virtual const nsIID& EventInitIID() { return NS_GET_IID(nsIUIEventInit); }
-  virtual nsresult InitFromCtor(const nsAString& aType, nsISupports* aDict,
-                                JSContext* aCx, JSObject* aObj);
+  virtual nsresult InitFromCtor(const nsAString& aType,
+                                JSContext* aCx, jsval* aVal);
 protected:
   // Internal helper functions
   nsIntPoint GetClientPoint();
   nsIntPoint GetScreenPoint();
   nsIntPoint GetLayerPoint();
   nsIntPoint GetPagePoint();
 
   // Allow specializations.
--- a/content/events/test/test_eventctors.html
+++ b/content/events/test/test_eventctors.html
@@ -28,16 +28,42 @@ var ex = false;
 try {
   e = new Event();
 } catch(exp) {
   ex = true;
 }
 ok(ex, "First parameter is required!");
 ex = false;
 
+try {
+  e = new Event("foo", 123);
+} catch(exp) {
+  ex = true;
+}
+ok(ex, "2nd parameter should be an object!");
+ex = false;
+
+try {
+  e = new Event("foo", "asdf");
+} catch(exp) {
+  ex = true;
+}
+ok(ex, "2nd parameter should be an object!");
+ex = false;
+
+
+try {
+  e = new Event("foo", false);
+} catch(exp) {
+  ex = true;
+}
+ok(ex, "2nd parameter should be an object!");
+ex = false;
+
+
 e = new Event("hello");
 ok(e.type, "hello", "Wrong event type!");
 ok(!e.isTrusted, "Event shouldn't be trusted!");
 ok(!e.bubbles, "Event shouldn't bubble!");
 ok(!e.cancelable, "Event shouldn't be cancelable!");
 document.dispatchEvent(e);
 is(receivedEvent, e, "Wrong event!");
 
@@ -89,21 +115,16 @@ ok(!e.bubbles, "Event shouldn't bubble!"
 ok(!e.cancelable, "Event shouldn't be cancelable!");
 
 var dict = { get detail() { return document.body } };
 e = new CustomEvent("hello", dict);
 is(e.detail, dict.detail, "Wrong event.detail!");
 ok(!e.bubbles, "Event shouldn't bubble!");
 ok(!e.cancelable, "Event shouldn't be cancelable!");
 
-e = new CustomEvent("hello", 1234);
-is(e.detail, null, "Wrong event.detail!");
-ok(!e.bubbles, "Event shouldn't bubble!");
-ok(!e.cancelable, "Event shouldn't be cancelable!");
-
 var dict = { get detail() { throw "foo"; } };
 
 try {
   e = new CustomEvent("hello", dict);
 } catch (exp) {
   ex = true;
 }
 ok(ex, "Should have thrown an exception!");
--- a/content/html/content/src/nsHTMLInputElement.cpp
+++ b/content/html/content/src/nsHTMLInputElement.cpp
@@ -2620,16 +2620,22 @@ nsHTMLInputElement::GetControllers(nsICo
       NS_ENSURE_SUCCESS(rv, rv);
 
       nsCOMPtr<nsIController>
         controller(do_CreateInstance("@mozilla.org/editor/editorcontroller;1",
                                      &rv));
       NS_ENSURE_SUCCESS(rv, rv);
 
       mControllers->AppendController(controller);
+
+      controller = do_CreateInstance("@mozilla.org/editor/editingcontroller;1",
+                                     &rv);
+      NS_ENSURE_SUCCESS(rv, rv);
+
+      mControllers->AppendController(controller);
     }
   }
 
   *aResult = mControllers;
   NS_IF_ADDREF(*aResult);
 
   return NS_OK;
 }
--- a/content/html/content/src/nsHTMLTextAreaElement.cpp
+++ b/content/html/content/src/nsHTMLTextAreaElement.cpp
@@ -811,16 +811,22 @@ nsHTMLTextAreaElement::GetControllers(ns
     mControllers = do_CreateInstance(kXULControllersCID, &rv);
     NS_ENSURE_SUCCESS(rv, rv);
 
     nsCOMPtr<nsIController> controller = do_CreateInstance("@mozilla.org/editor/editorcontroller;1", &rv);
     if (NS_FAILED(rv))
       return rv;
 
     mControllers->AppendController(controller);
+
+    controller = do_CreateInstance("@mozilla.org/editor/editingcontroller;1", &rv);
+    if (NS_FAILED(rv))
+      return rv;
+
+    mControllers->AppendController(controller);
   }
 
   *aResult = mControllers;
   NS_IF_ADDREF(*aResult);
 
   return NS_OK;
 }
 
--- a/content/xbl/builtin/browser-base.inc
+++ b/content/xbl/builtin/browser-base.inc
@@ -1,15 +1,15 @@
       <handler event="keypress" key=" " modifiers="shift" command="cmd_scrollPageUp" />
       <handler event="keypress" key=" " command="cmd_scrollPageDown" />
 
-      <handler event="keypress" keycode="VK_UP" command="cmd_scrollLineUp" />
-      <handler event="keypress" keycode="VK_DOWN" command="cmd_scrollLineDown" />
-      <handler event="keypress" keycode="VK_LEFT" command="cmd_scrollLeft" />
-      <handler event="keypress" keycode="VK_RIGHT" command="cmd_scrollRight" />
+      <handler event="keypress" keycode="VK_UP" command="cmd_linePrevious" />
+      <handler event="keypress" keycode="VK_DOWN" command="cmd_lineNext" />
+      <handler event="keypress" keycode="VK_LEFT" command="cmd_charPrevious" />
+      <handler event="keypress" keycode="VK_RIGHT" command="cmd_charNext" />
 
       <handler event="keypress" key="x" command="cmd_cut" modifiers="accel"/>
       <handler event="keypress" key="c" command="cmd_copy" modifiers="accel"/>
       <handler event="keypress" key="v" command="cmd_paste" modifiers="accel"/>
       <handler event="keypress" key="z" command="cmd_undo" modifiers="accel"/>
       <handler event="keypress" key="z" command="cmd_redo" modifiers="accel,shift" />
       <handler event="keypress" key="a" command="cmd_selectAll" modifiers="accel"/>
 
--- a/content/xbl/builtin/emacs/platformHTMLBindings.xml
+++ b/content/xbl/builtin/emacs/platformHTMLBindings.xml
@@ -164,18 +164,18 @@
       <handler event="keypress" keycode="VK_PAGE_UP" modifiers="shift" command="cmd_selectPageUp"/>
       <handler event="keypress" keycode="VK_PAGE_DOWN" modifiers="shift" command="cmd_selectPageDown"/>
 
       <handler event="keypress" keycode="VK_DELETE" modifiers="shift" command="cmd_cut" /> 
       <handler event="keypress" keycode="VK_DELETE" modifiers="control" command="cmd_copy" /> 
       <handler event="keypress" keycode="VK_INSERT" modifiers="control" command="cmd_copy" /> 
       <handler event="keypress" keycode="VK_HOME" command="cmd_beginLine"/>
       <handler event="keypress" keycode="VK_END" command="cmd_endLine"/>
-      <handler event="keypress" keycode="VK_HOME" modifiers="control" command="cmd_scrollTop"/>
-      <handler event="keypress" keycode="VK_END" modifiers="control" command="cmd_scrollBottom"/>
+      <handler event="keypress" keycode="VK_HOME" modifiers="control" command="cmd_moveTop"/>
+      <handler event="keypress" keycode="VK_END" modifiers="control" command="cmd_moveBottom"/>
       <handler event="keypress" keycode="VK_HOME" modifiers="shift,control" command="cmd_selectTop" /> 
       <handler event="keypress" keycode="VK_END" modifiers="shift,control" command="cmd_selectBottom" /> 
 
       <handler event="keypress" keycode="VK_LEFT" modifiers="control" command="cmd_wordPrevious" />
       <handler event="keypress" keycode="VK_RIGHT" modifiers="control" command="cmd_wordNext" />
       <handler event="keypress" keycode="VK_LEFT" modifiers="control,shift" command="cmd_selectWordPrevious" />
       <handler event="keypress" keycode="VK_RIGHT" modifiers="control,shift" command="cmd_selectWordNext" />
       <handler event="keypress" keycode="VK_LEFT" modifiers="shift" command="cmd_selectCharPrevious" />
--- a/content/xbl/builtin/mac/platformHTMLBindings.xml
+++ b/content/xbl/builtin/mac/platformHTMLBindings.xml
@@ -101,18 +101,18 @@
       <handler event="keypress" keycode="VK_LEFT" modifiers="alt" command="cmd_wordPrevious" />
       <handler event="keypress" keycode="VK_RIGHT" modifiers="alt" command="cmd_wordNext" />
       <handler event="keypress" keycode="VK_LEFT" modifiers="alt,shift" command="cmd_selectWordPrevious" />
       <handler event="keypress" keycode="VK_RIGHT" modifiers="alt,shift" command="cmd_selectWordNext" />
       <handler event="keypress" keycode="VK_LEFT" modifiers="shift" command="cmd_selectCharPrevious" />
       <handler event="keypress" keycode="VK_RIGHT" modifiers="shift" command="cmd_selectCharNext" />
       <handler event="keypress" keycode="VK_UP" modifiers="shift" command="cmd_selectLinePrevious" />
       <handler event="keypress" keycode="VK_DOWN" modifiers="shift" command="cmd_selectLineNext" />
-      <handler event="keypress" keycode="VK_UP" modifiers="accel" command="cmd_scrollTop"/>
-      <handler event="keypress" keycode="VK_DOWN" modifiers="accel" command="cmd_scrollBottom"/>      
+      <handler event="keypress" keycode="VK_UP" modifiers="accel" command="cmd_moveTop"/>
+      <handler event="keypress" keycode="VK_DOWN" modifiers="accel" command="cmd_moveBottom"/>
 	</handlers>
   </binding>
 
   <binding id="editor">
     <handlers>
 #include ../editor-base.inc
       <handler event="keypress" key="a" command="cmd_selectAll" modifiers="accel"/>
       <handler event="keypress" keycode="VK_HOME" command="cmd_scrollTop" /> 
--- a/content/xbl/builtin/unix/platformHTMLBindings.xml
+++ b/content/xbl/builtin/unix/platformHTMLBindings.xml
@@ -36,18 +36,18 @@
       <handler event="keypress" keycode="VK_PAGE_UP" modifiers="shift" command="cmd_selectPageUp"/>
       <handler event="keypress" keycode="VK_PAGE_DOWN" modifiers="shift" command="cmd_selectPageDown"/>
 
       <handler event="keypress" keycode="VK_DELETE" modifiers="shift" command="cmd_cut" /> 
       <handler event="keypress" keycode="VK_DELETE" modifiers="control" command="cmd_copy" /> 
       <handler event="keypress" keycode="VK_INSERT" modifiers="control" command="cmd_copy" /> 
       <handler event="keypress" keycode="VK_HOME" command="cmd_beginLine"/>
       <handler event="keypress" keycode="VK_END" command="cmd_endLine"/>
-      <handler event="keypress" keycode="VK_HOME" modifiers="control" command="cmd_scrollTop"/>
-      <handler event="keypress" keycode="VK_END" modifiers="control" command="cmd_scrollBottom"/>
+      <handler event="keypress" keycode="VK_HOME" modifiers="control" command="cmd_moveTop"/>
+      <handler event="keypress" keycode="VK_END" modifiers="control" command="cmd_moveBottom"/>
       <handler event="keypress" keycode="VK_HOME" modifiers="shift,control" command="cmd_selectTop" /> 
       <handler event="keypress" keycode="VK_END" modifiers="shift,control" command="cmd_selectBottom" /> 
 
       <handler event="keypress" keycode="VK_LEFT" modifiers="control" command="cmd_wordPrevious" />
       <handler event="keypress" keycode="VK_RIGHT" modifiers="control" command="cmd_wordNext" />
       <handler event="keypress" keycode="VK_LEFT" modifiers="control,shift" command="cmd_selectWordPrevious" />
       <handler event="keypress" keycode="VK_RIGHT" modifiers="control,shift" command="cmd_selectWordNext" />
       <handler event="keypress" keycode="VK_LEFT" modifiers="shift" command="cmd_selectCharPrevious" />
--- a/content/xbl/builtin/win/platformHTMLBindings.xml
+++ b/content/xbl/builtin/win/platformHTMLBindings.xml
@@ -96,18 +96,18 @@
       <handler event="keypress" keycode="VK_PAGE_UP" modifiers="shift" command="cmd_selectPageUp"/>
       <handler event="keypress" keycode="VK_PAGE_DOWN" modifiers="shift" command="cmd_selectPageDown"/>
 
       <handler event="keypress" keycode="VK_DELETE" modifiers="shift" command="cmd_cut"/>
       <handler event="keypress" keycode="VK_DELETE" modifiers="control" command="cmd_deleteWordForward"/>
       <handler event="keypress" keycode="VK_INSERT" modifiers="control" command="cmd_copy"/>
       <handler event="keypress" keycode="VK_HOME" command="cmd_beginLine"/>
       <handler event="keypress" keycode="VK_END" command="cmd_endLine"/>
-      <handler event="keypress" keycode="VK_HOME" modifiers="control" command="cmd_scrollTop"/>
-      <handler event="keypress" keycode="VK_END" modifiers="control" command="cmd_scrollBottom"/>
+      <handler event="keypress" keycode="VK_HOME" modifiers="control" command="cmd_moveTop"/>
+      <handler event="keypress" keycode="VK_END" modifiers="control" command="cmd_moveBottom"/>
       <handler event="keypress" keycode="VK_HOME" modifiers="shift,control" command="cmd_selectTop" />
       <handler event="keypress" keycode="VK_END" modifiers="shift,control" command="cmd_selectBottom" />
 
       <handler event="keypress" keycode="VK_LEFT" modifiers="control" command="cmd_wordPrevious" />
       <handler event="keypress" keycode="VK_RIGHT" modifiers="control" command="cmd_wordNext" />
       <handler event="keypress" keycode="VK_LEFT" modifiers="control,shift" command="cmd_selectWordPrevious" />
       <handler event="keypress" keycode="VK_RIGHT" modifiers="control,shift" command="cmd_selectWordNext" />
       <handler event="keypress" keycode="VK_LEFT" modifiers="shift" command="cmd_selectCharPrevious" />
--- a/dom/base/nsDOMWindowUtils.cpp
+++ b/dom/base/nsDOMWindowUtils.cpp
@@ -1977,106 +1977,62 @@ nsDOMWindowUtils::GetFileReferences(cons
     }
   }
 
   *aRefCnt = *aDBRefCnt = *aSliceRefCnt = -1;
   *aResult = false;
   return NS_OK;
 }
 
-static inline JSContext *
-GetJSContext()
+NS_IMETHODIMP
+nsDOMWindowUtils::StartPCCountProfiling(JSContext* cx)
 {
-  nsCOMPtr<nsIXPConnect> xpc = nsContentUtils::XPConnect();
-
-  // get the xpconnect native call context
-  nsAXPCNativeCallContext *cc = nsnull;
-  xpc->GetCurrentNativeCallContext(&cc);
-  if(!cc)
-    return NULL;
-
-  // Get JSContext of current call
-  JSContext* cx;
-  nsresult rv = cc->GetJSContext(&cx);
-  if(NS_FAILED(rv) || !cx)
-    return NULL;
-
-  return cx;
-}
-
-NS_IMETHODIMP
-nsDOMWindowUtils::StartPCCountProfiling()
-{
-  JSContext *cx = GetJSContext();
-  if (!cx)
-    return NS_ERROR_FAILURE;
-
   js::StartPCCountProfiling(cx);
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsDOMWindowUtils::StopPCCountProfiling()
+nsDOMWindowUtils::StopPCCountProfiling(JSContext* cx)
 {
-  JSContext *cx = GetJSContext();
-  if (!cx)
-    return NS_ERROR_FAILURE;
-
   js::StopPCCountProfiling(cx);
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsDOMWindowUtils::PurgePCCounts()
+nsDOMWindowUtils::PurgePCCounts(JSContext* cx)
 {
-  JSContext *cx = GetJSContext();
-  if (!cx)
-    return NS_ERROR_FAILURE;
-
   js::PurgePCCounts(cx);
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsDOMWindowUtils::GetPCCountScriptCount(PRInt32 *result)
+nsDOMWindowUtils::GetPCCountScriptCount(JSContext* cx, PRInt32 *result)
 {
-  JSContext *cx = GetJSContext();
-  if (!cx)
-    return NS_ERROR_FAILURE;
-
   *result = js::GetPCCountScriptCount(cx);
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsDOMWindowUtils::GetPCCountScriptSummary(PRInt32 script, nsAString& result)
+nsDOMWindowUtils::GetPCCountScriptSummary(PRInt32 script, JSContext* cx, nsAString& result)
 {
-  JSContext *cx = GetJSContext();
-  if (!cx)
-    return NS_ERROR_FAILURE;
-
   JSString *text = js::GetPCCountScriptSummary(cx, script);
   if (!text)
     return NS_ERROR_FAILURE;
 
   nsDependentJSString str;
   if (!str.init(cx, text))
     return NS_ERROR_FAILURE;
 
   result = str;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsDOMWindowUtils::GetPCCountScriptContents(PRInt32 script, nsAString& result)
+nsDOMWindowUtils::GetPCCountScriptContents(PRInt32 script, JSContext* cx, nsAString& result)
 {
-  JSContext *cx = GetJSContext();
-  if (!cx)
-    return NS_ERROR_FAILURE;
-
   JSString *text = js::GetPCCountScriptContents(cx, script);
   if (!text)
     return NS_ERROR_FAILURE;
 
   nsDependentJSString str;
   if (!str.init(cx, text))
     return NS_ERROR_FAILURE;
 
--- a/dom/base/nsFocusManager.cpp
+++ b/dom/base/nsFocusManager.cpp
@@ -2452,24 +2452,16 @@ nsFocusManager::DetermineElementToMoveFo
         nsCOMPtr<nsIContent> endSelectionContent;
         GetSelectionLocation(doc, presShell,
                              getter_AddRefs(startContent),
                              getter_AddRefs(endSelectionContent));
         // If the selection is on the rootContent, then there is no selection
         if (startContent == rootContent) {
           startContent = nsnull;
         }
-        else if (startContent && startContent->HasFlag(NODE_IS_EDITABLE)) {
-          // Don't start from the selection if the selection is in a
-          // contentEditable region.
-          nsCOMPtr<nsIHTMLDocument> htmlDoc = do_QueryInterface(doc);
-          if (htmlDoc &&
-              htmlDoc->GetEditingState() == nsIHTMLDocument::eContentEditable)
-            startContent = nsnull;
-        }
 
         if (aType == MOVEFOCUS_CARET) {
           // GetFocusInSelection finds a focusable link near the caret.
           // If there is no start content though, don't do this to avoid
           // focusing something unexpected.
           if (startContent) {
             GetFocusInSelection(aWindow, startContent,
                                 endSelectionContent, aNextContent);
--- a/dom/base/nsGlobalWindowCommands.cpp
+++ b/dom/base/nsGlobalWindowCommands.cpp
@@ -71,22 +71,24 @@ const char * const sSelectNoneString = "
 const char * const sCopyImageLocationString = "cmd_copyImageLocation";
 const char * const sCopyImageContentsString = "cmd_copyImageContents";
 const char * const sCopyImageString = "cmd_copyImage";
 
 const char * const sScrollTopString = "cmd_scrollTop";
 const char * const sScrollBottomString = "cmd_scrollBottom";
 const char * const sScrollPageUpString = "cmd_scrollPageUp";
 const char * const sScrollPageDownString = "cmd_scrollPageDown";
+const char * const sMoveTopString = "cmd_moveTop";
+const char * const sMoveBottomString = "cmd_moveBottom";
 const char * const sMovePageUpString = "cmd_movePageUp";
 const char * const sMovePageDownString = "cmd_movePageDown";
-const char * const sScrollLineUpString = "cmd_scrollLineUp";
-const char * const sScrollLineDownString = "cmd_scrollLineDown";
-const char * const sScrollLeftString = "cmd_scrollLeft";
-const char * const sScrollRightString = "cmd_scrollRight";
+const char * const sLinePreviousString = "cmd_linePrevious";
+const char * const sLineNextString = "cmd_lineNext";
+const char * const sCharPreviousString = "cmd_charPrevious";
+const char * const sCharNextString = "cmd_charNext";
 
 // These are so the browser can use editor navigation key bindings
 // helps with accessibility (boolean pref accessibility.browsewithcaret)
 
 const char * const sSelectCharPreviousString = "cmd_selectCharPrevious";
 const char * const sSelectCharNextString = "cmd_selectCharNext";
 
 const char * const sWordPreviousString = "cmd_wordPrevious";
@@ -97,18 +99,18 @@ const char * const sSelectWordNextString
 const char * const sBeginLineString = "cmd_beginLine";
 const char * const sEndLineString = "cmd_endLine";
 const char * const sSelectBeginLineString = "cmd_selectBeginLine";
 const char * const sSelectEndLineString = "cmd_selectEndLine";
 
 const char * const sSelectLinePreviousString = "cmd_selectLinePrevious";
 const char * const sSelectLineNextString = "cmd_selectLineNext";
 
-const char * const sSelectPagePreviousString = "cmd_selectPagePrevious";
-const char * const sSelectPageNextString = "cmd_selectPageNext";
+const char * const sSelectPageUpString = "cmd_selectPageUp";
+const char * const sSelectPageDownString = "cmd_selectPageDown";
 
 const char * const sSelectTopString = "cmd_selectTop";
 const char * const sSelectBottomString = "cmd_selectBottom";
 
 
 #if 0
 #pragma mark -
 #endif
@@ -272,43 +274,51 @@ nsSelectMoveScrollCommand::DoSelectComma
 }
 
 nsresult
 nsSelectMoveScrollCommand::DoCommandBrowseWithCaretOn(const char *aCommandName,
                   nsIDOMWindow *aWindow, nsISelectionController *aSelectionController)
 {
   nsresult rv = NS_ERROR_NOT_IMPLEMENTED;
 
-  if (!nsCRT::strcmp(aCommandName, sScrollTopString))
+  // cmd_MoveTop/Bottom are used on Window/Unix. They move the caret
+  // in caret browsing mode.
+  if (!nsCRT::strcmp(aCommandName, sMoveTopString))
     rv = aSelectionController->CompleteMove(false, false);
+  else if (!nsCRT::strcmp(aCommandName,sMoveBottomString))
+    rv = aSelectionController->CompleteMove(true, false);
+  // cmd_ScrollTop/Bottom are used on Mac. They do not move the
+  // caret in caret browsing mode.
+  else if (!nsCRT::strcmp(aCommandName, sScrollTopString))
+    rv = aSelectionController->CompleteScroll(false);
   else if (!nsCRT::strcmp(aCommandName,sScrollBottomString))
-    rv = aSelectionController->CompleteMove(true, false);
+    rv = aSelectionController->CompleteScroll(true);
   // cmd_MovePageUp/Down are used on Window/Unix. They move the caret
   // in caret browsing mode.
   else if (!nsCRT::strcmp(aCommandName, sMovePageUpString))
     rv = aSelectionController->PageMove(false, false);
   else if (!nsCRT::strcmp(aCommandName, sMovePageDownString))
     rv = aSelectionController->PageMove(true, false);
   // cmd_ScrollPageUp/Down are used on Mac, and for the spacebar on all platforms.
   // They do not move the caret in caret browsing mode.
   else if (!nsCRT::strcmp(aCommandName, sScrollPageUpString))
     rv = aSelectionController->ScrollPage(false);
   else if (!nsCRT::strcmp(aCommandName, sScrollPageDownString))
     rv = aSelectionController->ScrollPage(true);
-  else if (!nsCRT::strcmp(aCommandName, sScrollLineUpString))
+  else if (!nsCRT::strcmp(aCommandName, sLinePreviousString))
     rv = aSelectionController->LineMove(false, false);
-  else if (!nsCRT::strcmp(aCommandName, sScrollLineDownString))
+  else if (!nsCRT::strcmp(aCommandName, sLineNextString))
     rv = aSelectionController->LineMove(true, false);
   else if (!nsCRT::strcmp(aCommandName, sWordPreviousString))
     rv = aSelectionController->WordMove(false, false);
   else if (!nsCRT::strcmp(aCommandName, sWordNextString))
     rv = aSelectionController->WordMove(true, false);
-  else if (!nsCRT::strcmp(aCommandName, sScrollLeftString))
+  else if (!nsCRT::strcmp(aCommandName, sCharPreviousString))
     rv = aSelectionController->CharacterMove(false, false);
-  else if (!nsCRT::strcmp(aCommandName, sScrollRightString))
+  else if (!nsCRT::strcmp(aCommandName, sCharNextString))
     rv = aSelectionController->CharacterMove(true, false);
   else if (!nsCRT::strcmp(aCommandName, sBeginLineString))
     rv = aSelectionController->IntraLineMove(false, false);
   else if (!nsCRT::strcmp(aCommandName, sEndLineString))
     rv = aSelectionController->IntraLineMove(true, false);
 
   if (NS_SUCCEEDED(rv))
   {
@@ -325,17 +335,25 @@ nsSelectMoveScrollCommand::DoCommandBrow
   return rv;
 }
 
 nsresult
 nsSelectMoveScrollCommand::DoCommandBrowseWithCaretOff(const char *aCommandName, nsISelectionController *aSelectionController)
 {
   nsresult rv = NS_ERROR_NOT_IMPLEMENTED;
 
-  if (!nsCRT::strcmp(aCommandName, sScrollTopString))   
+  // cmd_MoveTop/Bottom are used on Window/Unix. They move the caret
+  // in caret browsing mode.
+  if (!nsCRT::strcmp(aCommandName, sMoveTopString))
+    rv = aSelectionController->CompleteScroll(false);
+  else if (!nsCRT::strcmp(aCommandName,sMoveBottomString))
+    rv = aSelectionController->CompleteScroll(true);
+  // cmd_ScrollTop/Bottom are used on Mac. They do not move the
+  // caret in caret browsing mode.
+  else if (!nsCRT::strcmp(aCommandName, sScrollTopString))
     rv = aSelectionController->CompleteScroll(false);
   else if (!nsCRT::strcmp(aCommandName,sScrollBottomString))
     rv = aSelectionController->CompleteScroll(true);
 
   // cmd_MovePageUp/Down are used on Window/Unix. They move the caret
   // in caret browsing mode.
   else if (!nsCRT::strcmp(aCommandName, sMovePageUpString))
     rv = aSelectionController->ScrollPage(false);
@@ -343,26 +361,26 @@ nsSelectMoveScrollCommand::DoCommandBrow
     rv = aSelectionController->ScrollPage(true);
   // cmd_ScrollPageUp/Down are used on Mac. They do not move the
   // caret in caret browsing mode.
   else if (!nsCRT::strcmp(aCommandName, sScrollPageUpString))
     rv = aSelectionController->ScrollPage(false);
   else if (!nsCRT::strcmp(aCommandName, sScrollPageDownString))
     rv = aSelectionController->ScrollPage(true);
 
-  else if (!nsCRT::strcmp(aCommandName, sScrollLineUpString))
+  else if (!nsCRT::strcmp(aCommandName, sLinePreviousString))
     rv = aSelectionController->ScrollLine(false);
-  else if (!nsCRT::strcmp(aCommandName, sScrollLineDownString))
+  else if (!nsCRT::strcmp(aCommandName, sLineNextString))
     rv = aSelectionController->ScrollLine(true);
-  else if (!nsCRT::strcmp(aCommandName, sScrollLeftString))
+  else if (!nsCRT::strcmp(aCommandName, sCharPreviousString))
     rv = aSelectionController->ScrollHorizontal(true);
-  else if (!nsCRT::strcmp(aCommandName, sScrollRightString))
+  else if (!nsCRT::strcmp(aCommandName, sCharNextString))
     rv = aSelectionController->ScrollHorizontal(false);
   // cmd_beginLine/endLine with caret browsing off
-  // will act as cmd_scrollTop/Bottom
+  // will act as cmd_moveTop/Bottom
   else if (!nsCRT::strcmp(aCommandName, sBeginLineString))
     rv = aSelectionController->CompleteScroll(false);
   else if (!nsCRT::strcmp(aCommandName, sEndLineString))
     rv = aSelectionController->CompleteScroll(true);
 
   return rv;
 }
 
@@ -393,16 +411,20 @@ nsSelectCommand::DoSelectCommand(const c
   else if (!nsCRT::strcmp(aCommandName, sSelectBeginLineString))
     rv = selCont->IntraLineMove(false, true);
   else if (!nsCRT::strcmp(aCommandName, sSelectEndLineString))
     rv = selCont->IntraLineMove(true, true);
   else if (!nsCRT::strcmp(aCommandName, sSelectLinePreviousString))
     rv = selCont->LineMove(false, true);
   else if (!nsCRT::strcmp(aCommandName, sSelectLineNextString))
     rv = selCont->LineMove(true, true);
+  else if (!nsCRT::strcmp(aCommandName, sSelectPageUpString))
+    rv = selCont->PageMove(false, true);
+  else if (!nsCRT::strcmp(aCommandName, sSelectPageDownString))
+    rv = selCont->PageMove(true, true);
   else if (!nsCRT::strcmp(aCommandName, sSelectTopString))
     rv = selCont->CompleteMove(false, true);
   else if (!nsCRT::strcmp(aCommandName, sSelectBottomString))
     rv = selCont->CompleteMove(true, true);
 
   return rv;
 }
 
@@ -941,40 +963,41 @@ nsWindowCommandRegistration::RegisterWin
 {
   nsresult rv;
 
   // XXX rework the macros to use a loop is possible, reducing code size
   
   // this set of commands is affected by the 'browse with caret' setting
   NS_REGISTER_FIRST_COMMAND(nsSelectMoveScrollCommand, sScrollTopString);
   NS_REGISTER_NEXT_COMMAND(nsSelectMoveScrollCommand, sScrollBottomString);
+  NS_REGISTER_NEXT_COMMAND(nsSelectMoveScrollCommand, sMoveTopString);
+  NS_REGISTER_NEXT_COMMAND(nsSelectMoveScrollCommand, sMoveBottomString);
   NS_REGISTER_NEXT_COMMAND(nsSelectMoveScrollCommand, sWordPreviousString);
   NS_REGISTER_NEXT_COMMAND(nsSelectMoveScrollCommand, sWordNextString);
   NS_REGISTER_NEXT_COMMAND(nsSelectMoveScrollCommand, sBeginLineString);
   NS_REGISTER_NEXT_COMMAND(nsSelectMoveScrollCommand, sEndLineString);
   NS_REGISTER_NEXT_COMMAND(nsSelectMoveScrollCommand, sMovePageUpString);
   NS_REGISTER_NEXT_COMMAND(nsSelectMoveScrollCommand, sMovePageDownString);
   NS_REGISTER_NEXT_COMMAND(nsSelectMoveScrollCommand, sScrollPageUpString);
   NS_REGISTER_NEXT_COMMAND(nsSelectMoveScrollCommand, sScrollPageDownString);
-  NS_REGISTER_NEXT_COMMAND(nsSelectMoveScrollCommand, sScrollLineUpString);
-  NS_REGISTER_NEXT_COMMAND(nsSelectMoveScrollCommand, sScrollLineDownString);
-  NS_REGISTER_NEXT_COMMAND(nsSelectMoveScrollCommand, sScrollLeftString);
-  NS_REGISTER_LAST_COMMAND(nsSelectMoveScrollCommand, sScrollRightString);
+  NS_REGISTER_NEXT_COMMAND(nsSelectMoveScrollCommand, sLinePreviousString);
+  NS_REGISTER_NEXT_COMMAND(nsSelectMoveScrollCommand, sLineNextString);
+  NS_REGISTER_NEXT_COMMAND(nsSelectMoveScrollCommand, sCharPreviousString);
+  NS_REGISTER_LAST_COMMAND(nsSelectMoveScrollCommand, sCharNextString);
 
   NS_REGISTER_FIRST_COMMAND(nsSelectCommand, sSelectCharPreviousString);
   NS_REGISTER_NEXT_COMMAND(nsSelectCommand, sSelectCharNextString);
   NS_REGISTER_NEXT_COMMAND(nsSelectCommand, sSelectWordPreviousString);
   NS_REGISTER_NEXT_COMMAND(nsSelectCommand, sSelectWordNextString);
   NS_REGISTER_NEXT_COMMAND(nsSelectCommand, sSelectBeginLineString);
   NS_REGISTER_NEXT_COMMAND(nsSelectCommand, sSelectEndLineString);
   NS_REGISTER_NEXT_COMMAND(nsSelectCommand, sSelectLinePreviousString);
   NS_REGISTER_NEXT_COMMAND(nsSelectCommand, sSelectLineNextString);
-  // XXX these commands were never implemented. fix me.
-  // NS_REGISTER_NEXT_COMMAND(nsSelectCommand, sSelectPagePreviousString);
-  // NS_REGISTER_NEXT_COMMAND(nsSelectCommand, sSelectPageNextString);
+  NS_REGISTER_NEXT_COMMAND(nsSelectCommand, sSelectPageUpString);
+  NS_REGISTER_NEXT_COMMAND(nsSelectCommand, sSelectPageDownString);
   NS_REGISTER_NEXT_COMMAND(nsSelectCommand, sSelectTopString);
   NS_REGISTER_LAST_COMMAND(nsSelectCommand, sSelectBottomString);
 
   NS_REGISTER_ONE_COMMAND(nsClipboardCommand, "cmd_cut");
   NS_REGISTER_ONE_COMMAND(nsClipboardCommand, "cmd_copy");
   NS_REGISTER_ONE_COMMAND(nsClipboardCommand, "cmd_paste");
   NS_REGISTER_ONE_COMMAND(nsClipboardCopyLinkCommand, "cmd_copyLink");
   NS_REGISTER_FIRST_COMMAND(nsClipboardImageCommands, sCopyImageLocationString);
--- a/dom/indexedDB/IDBIndex.cpp
+++ b/dom/indexedDB/IDBIndex.cpp
@@ -43,18 +43,17 @@
 
 #include "nsIIDBKeyRange.h"
 #include "nsIJSContextStack.h"
 
 #include "nsDOMClassInfoID.h"
 #include "nsEventDispatcher.h"
 #include "nsThreadUtils.h"
 #include "mozilla/storage.h"
-#include "xpcprivate.h"
-#include "XPCQuickStubs.h"
+#include "xpcpublic.h"
 
 #include "AsyncConnectionHelper.h"
 #include "IDBCursor.h"
 #include "IDBEvents.h"
 #include "IDBKeyRange.h"
 #include "IDBObjectStore.h"
 #include "IDBTransaction.h"
 #include "DatabaseInfo.h"
@@ -393,30 +392,30 @@ IDBIndex::GetKeyPath(JSContext* aCx,
     if (!array) {
       NS_WARNING("Failed to make array!");
       return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;
     }
 
     for (PRUint32 i = 0; i < mKeyPathArray.Length(); ++i) {
       jsval val;
       nsString tmp(mKeyPathArray[i]);
-      if (!xpc_qsStringToJsval(aCx, tmp, &val)) {
+      if (!xpc::StringToJsval(aCx, tmp, &val)) {
         return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;
       }
 
       if (!JS_SetElement(aCx, array, i, &val)) {
         return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;
       }
     }
 
     *aVal = OBJECT_TO_JSVAL(array);
   }
   else {
     nsString tmp(mKeyPath);
-    if (!xpc_qsStringToJsval(aCx, tmp, aVal)) {
+    if (!xpc::StringToJsval(aCx, tmp, aVal)) {
       return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;
     }
   }
   return NS_OK;
 }
 
 NS_IMETHODIMP
 IDBIndex::GetUnique(bool* aUnique)
--- a/dom/indexedDB/IDBObjectStore.cpp
+++ b/dom/indexedDB/IDBObjectStore.cpp
@@ -50,18 +50,17 @@
 #include "nsDOMFile.h"
 #include "nsDOMLists.h"
 #include "nsEventDispatcher.h"
 #include "nsJSUtils.h"
 #include "nsServiceManagerUtils.h"
 #include "nsThreadUtils.h"
 #include "snappy/snappy.h"
 #include "test_quota.h"
-#include "xpcprivate.h"
-#include "XPCQuickStubs.h"
+#include "xpcpublic.h"
 
 #include "AsyncConnectionHelper.h"
 #include "IDBCursor.h"
 #include "IDBEvents.h"
 #include "IDBIndex.h"
 #include "IDBKeyRange.h"
 #include "IDBTransaction.h"
 #include "DatabaseInfo.h"
@@ -559,17 +558,17 @@ IDBObjectStore::IsValidKeyPath(JSContext
   while (tokenizer.hasMoreTokens()) {
     nsString token(tokenizer.nextToken());
 
     if (!token.Length()) {
       return false;
     }
 
     jsval stringVal;
-    if (!xpc_qsStringToJsval(aCx, token, &stringVal)) {
+    if (!xpc::StringToJsval(aCx, token, &stringVal)) {
       return false;
     }
 
     NS_ASSERTION(JSVAL_IS_STRING(stringVal), "This should never happen");
     JSString* str = JSVAL_TO_STRING(stringVal);
 
     JSBool isIdentifier = JS_FALSE;
     if (!JS_IsIdentifier(aCx, str, &isIdentifier) || !isIdentifier) {
@@ -1424,30 +1423,30 @@ IDBObjectStore::GetKeyPath(JSContext* aC
     if (!array) {
       NS_WARNING("Failed to make array!");
       return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;
     }
 
     for (PRUint32 i = 0; i < mKeyPathArray.Length(); ++i) {
       jsval val;
       nsString tmp(mKeyPathArray[i]);
-      if (!xpc_qsStringToJsval(aCx, tmp, &val)) {
+      if (!xpc::StringToJsval(aCx, tmp, &val)) {
         return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;
       }
 
       if (!JS_SetElement(aCx, array, i, &val)) {
         return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;
       }
     }
 
     *aVal = OBJECT_TO_JSVAL(array);
   }
   else {
     nsString tmp(mKeyPath);
-    if (!xpc_qsStringToJsval(aCx, tmp, aVal)) {
+    if (!xpc::StringToJsval(aCx, tmp, aVal)) {
       return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;
     }
   }
   return NS_OK;
 }
 
 NS_IMETHODIMP
 IDBObjectStore::GetTransaction(nsIIDBTransaction** aTransaction)
--- a/dom/indexedDB/IndexedDatabaseManager.cpp
+++ b/dom/indexedDB/IndexedDatabaseManager.cpp
@@ -51,17 +51,17 @@
 #include "mozilla/Preferences.h"
 #include "mozilla/Services.h"
 #include "mozilla/storage.h"
 #include "nsContentUtils.h"
 #include "nsThreadUtils.h"
 #include "nsXPCOM.h"
 #include "nsXPCOMPrivate.h"
 #include "test_quota.h"
-#include "xpcprivate.h"
+#include "xpcpublic.h"
 
 #include "AsyncConnectionHelper.h"
 #include "CheckQuotaHelper.h"
 #include "IDBDatabase.h"
 #include "IDBEvents.h"
 #include "IDBFactory.h"
 #include "LazyIdleThread.h"
 #include "OpenDatabaseHelper.h"
--- a/dom/indexedDB/Key.cpp
+++ b/dom/indexedDB/Key.cpp
@@ -37,18 +37,17 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "Key.h"
 #include "nsIStreamBufferAccess.h"
 #include "jsdate.h"
 #include "nsContentUtils.h"
 #include "nsJSUtils.h"
-#include "xpcprivate.h"
-#include "XPCQuickStubs.h"
+#include "xpcpublic.h"
 
 USING_INDEXEDDB_NAMESPACE
 
 /*
  Here's how we encode keys:
 
  Basic strategy is the following
 
@@ -238,17 +237,17 @@ Key::DecodeJSVal(const unsigned char*& a
                  "Should have found end-of-array marker");
     ++aPos;
 
     *aVal = OBJECT_TO_JSVAL(array);
   }
   else if (*aPos - aTypeOffset == eString) {
     nsString key;
     DecodeString(aPos, aEnd, key);
-    if (!xpc_qsStringToJsval(aCx, key, aVal)) {
+    if (!xpc::StringToJsval(aCx, key, aVal)) {
       return NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR;
     }
   }
   else if (*aPos - aTypeOffset == eDate) {
     jsdouble msec = static_cast<jsdouble>(DecodeNumber(aPos, aEnd));
     JSObject* date = JS_NewDateObjectMsec(aCx, msec);
     if (!date) {
       NS_WARNING("Failed to make date!");
--- a/dom/indexedDB/Makefile.in
+++ b/dom/indexedDB/Makefile.in
@@ -94,17 +94,16 @@ EXPORTS_mozilla/dom/indexedDB = \
 
 LOCAL_INCLUDES = \
   -I$(topsrcdir)/db/sqlite3/src \
   -I$(topsrcdir)/xpcom/build \
   -I$(topsrcdir)/dom/base \
   -I$(topsrcdir)/dom/src/storage \
   -I$(topsrcdir)/content/base/src \
   -I$(topsrcdir)/content/events/src \
-  -I$(topsrcdir)/js/xpconnect/src \
   $(NULL)
 
 DEFINES += -D_IMPL_NS_LAYOUT
 
 # Make sure to quickstub as much as possible here! See
 # js/xpconnect/src/dom_quickstubs.qsconf.
 XPIDLSRCS = \
   nsIIDBCursor.idl \
--- a/dom/interfaces/base/nsIDOMWindowUtils.idl
+++ b/dom/interfaces/base/nsIDOMWindowUtils.idl
@@ -64,17 +64,17 @@ interface nsIDOMHTMLCanvasElement;
 interface nsIDOMEvent;
 interface nsITransferable;
 interface nsIQueryContentEventResult;
 interface nsIDOMWindow;
 interface nsIDOMBlob;
 interface nsIDOMFile;
 interface nsIFile;
 
-[scriptable, uuid(3af3c5ce-6f2a-47e7-acd0-555ed576fa82)]
+[scriptable, uuid(9df58cf3-7094-4c8d-96f2-bebd765099fe)]
 interface nsIDOMWindowUtils : nsISupports {
 
   /**
    * Image animation mode of the window. When this attribute's value
    * is changed, the implementation should set all images in the window
    * to the given value. That is, when set to kDontAnimMode, all images
    * will stop animating. The attribute's value must be one of the
    * animationMode values from imgIContainer.
@@ -940,39 +940,45 @@ interface nsIDOMWindowUtils : nsISupport
                             [optional] out long aRefCnt,
                             [optional] out long aDBRefCnt,
                             [optional] out long aSliceRefCnt);
 
   /**
    * Begin opcode-level profiling of all JavaScript execution in the window's
    * runtime.
    */
+  [implicit_jscontext]
   void startPCCountProfiling();
 
   /**
    * Stop opcode-level profiling of JavaScript execution in the runtime, and
    * collect all counts for use by getPCCount methods.
    */
+  [implicit_jscontext]
   void stopPCCountProfiling();
 
   /**
    * Purge collected PC counters.
    */
+  [implicit_jscontext]
   void purgePCCounts();
 
   /**
    * Get the number of scripts with opcode-level profiling information.
    */
+  [implicit_jscontext]
   long getPCCountScriptCount();
 
   /**
    * Get a JSON string for a short summary of a script and the PC counts
    * accumulated for it.
    */
+  [implicit_jscontext]
   AString getPCCountScriptSummary(in long script);
 
   /**
    * Get a JSON string with full information about a profiled script,
    * including the decompilation of the script and placement of decompiled
    * operations within it, and PC counts for each operation.
    */
+  [implicit_jscontext]
   AString getPCCountScriptContents(in long script);
 };
--- a/dom/workers/File.cpp
+++ b/dom/workers/File.cpp
@@ -43,18 +43,16 @@
 
 #include "jsapi.h"
 #include "jsatom.h"
 #include "jscntxt.h"
 #include "jsfriendapi.h"
 #include "nsCOMPtr.h"
 #include "nsJSUtils.h"
 #include "nsStringGlue.h"
-#include "xpcprivate.h"
-#include "XPCQuickStubs.h"
 
 #include "Exceptions.h"
 #include "WorkerInlines.h"
 #include "WorkerPrivate.h"
 
 #define PROPERTY_FLAGS \
   JSPROP_ENUMERATE | JSPROP_SHARED
 
@@ -203,18 +201,18 @@ private:
 
     nsDependentJSString contentType;
     if (!contentType.init(aCx, jsContentType)) {
       return false;
     }
 
     PRUint8 optionalArgc = aArgc;
     nsCOMPtr<nsIDOMBlob> rtnBlob;
-    if (NS_FAILED(blob->MozSlice(xpc_qsDoubleToUint64(start),
-                                 xpc_qsDoubleToUint64(end),
+    if (NS_FAILED(blob->MozSlice(static_cast<PRUint64>(start),
+                                 static_cast<PRUint64>(end),
                                  contentType, optionalArgc,
                                  getter_AddRefs(rtnBlob)))) {
       ThrowFileExceptionForCode(aCx, FILE_NOT_READABLE_ERR);
       return false;
     }
 
     JSObject* rtnObj = file::CreateBlob(aCx, rtnBlob);
     if (!rtnObj) {
--- a/editor/composer/src/nsEditingSession.cpp
+++ b/editor/composer/src/nsEditingSession.cpp
@@ -179,18 +179,18 @@ nsEditingSession::MakeWindowEditable(nsI
   NS_ENSURE_SUCCESS(rv, rv);  
   
   // set the flag on the docShell to say that it's editable
   rv = editorDocShell->MakeEditable(aDoAfterUriLoad);
   NS_ENSURE_SUCCESS(rv, rv);  
 
   // Setup commands common to plaintext and html editors,
   //  including the document creation observers
-  // the first is an editor controller
-  rv = SetupEditorCommandController("@mozilla.org/editor/editorcontroller;1",
+  // the first is an editing controller
+  rv = SetupEditorCommandController("@mozilla.org/editor/editingcontroller;1",
                                     aWindow,
                                     static_cast<nsIEditingSession*>(this),
                                     &mBaseCommandControllerId);
   NS_ENSURE_SUCCESS(rv, rv);
 
   // The second is a controller to monitor doc state,
   // such as creation and "dirty flag"
   rv = SetupEditorCommandController("@mozilla.org/editor/editordocstatecontroller;1",
@@ -1430,17 +1430,17 @@ nsEditingSession::ReattachToWindow(nsIDO
   // Tells embedder that startup is in progress.
   mEditorStatus = eEditorCreationInProgress;
 
   // Adds back web progress listener.
   rv = PrepareForEditing(aWindow);
   NS_ENSURE_SUCCESS(rv, rv);
 
   // Setup the command controllers again.
-  rv = SetupEditorCommandController("@mozilla.org/editor/editorcontroller;1",
+  rv = SetupEditorCommandController("@mozilla.org/editor/editingcontroller;1",
                                     aWindow,
                                     static_cast<nsIEditingSession*>(this),
                                     &mBaseCommandControllerId);
   NS_ENSURE_SUCCESS(rv, rv);
 
   rv = SetupEditorCommandController("@mozilla.org/editor/editordocstatecontroller;1",
                                     aWindow,
                                     static_cast<nsIEditingSession*>(this),
--- a/editor/libeditor/base/nsEditorController.cpp
+++ b/editor/libeditor/base/nsEditorController.cpp
@@ -66,17 +66,17 @@
 
 #define NS_REGISTER_LAST_COMMAND(_cmdClass, _cmdName)                                     \
     inCommandTable->RegisterCommand(_cmdName,                                             \
                                    static_cast<nsIControllerCommand *>(theCmd));          \
   }
 
 
 // static
-nsresult nsEditorController::RegisterEditorCommands(nsIControllerCommandTable *inCommandTable)
+nsresult nsEditorController::RegisterEditingCommands(nsIControllerCommandTable *inCommandTable)
 {
   // now register all our commands
   // These are commands that will be used in text widgets, and in composer
 
   NS_REGISTER_ONE_COMMAND(nsUndoCommand, "cmd_undo");
   NS_REGISTER_ONE_COMMAND(nsRedoCommand, "cmd_redo");
   NS_REGISTER_ONE_COMMAND(nsClearUndoCommand, "cmd_clearUndo");
 
@@ -94,16 +94,31 @@ nsresult nsEditorController::RegisterEdi
   NS_REGISTER_FIRST_COMMAND(nsDeleteCommand, "cmd_delete");
   NS_REGISTER_NEXT_COMMAND(nsDeleteCommand, "cmd_deleteCharBackward");
   NS_REGISTER_NEXT_COMMAND(nsDeleteCommand, "cmd_deleteCharForward");
   NS_REGISTER_NEXT_COMMAND(nsDeleteCommand, "cmd_deleteWordBackward");
   NS_REGISTER_NEXT_COMMAND(nsDeleteCommand, "cmd_deleteWordForward");
   NS_REGISTER_NEXT_COMMAND(nsDeleteCommand, "cmd_deleteToBeginningOfLine");
   NS_REGISTER_LAST_COMMAND(nsDeleteCommand, "cmd_deleteToEndOfLine");
 
+  // Insert content
+  NS_REGISTER_ONE_COMMAND(nsInsertPlaintextCommand, "cmd_insertText");
+  NS_REGISTER_ONE_COMMAND(nsPasteQuotationCommand,  "cmd_pasteQuote");
+
+  return NS_OK;
+}
+
+
+// static
+nsresult nsEditorController::RegisterEditorCommands(nsIControllerCommandTable *inCommandTable)
+{
+  nsresult rv;
+
+  // These are commands that will be used in text widgets only.
+
   NS_REGISTER_FIRST_COMMAND(nsSelectionMoveCommands, "cmd_scrollTop");
   NS_REGISTER_NEXT_COMMAND(nsSelectionMoveCommands, "cmd_scrollBottom");
   NS_REGISTER_NEXT_COMMAND(nsSelectionMoveCommands, "cmd_moveTop");
   NS_REGISTER_NEXT_COMMAND(nsSelectionMoveCommands, "cmd_moveBottom");
   NS_REGISTER_NEXT_COMMAND(nsSelectionMoveCommands, "cmd_selectTop");
   NS_REGISTER_NEXT_COMMAND(nsSelectionMoveCommands, "cmd_selectBottom");
   NS_REGISTER_NEXT_COMMAND(nsSelectionMoveCommands, "cmd_lineNext");
   NS_REGISTER_NEXT_COMMAND(nsSelectionMoveCommands, "cmd_linePrevious");
@@ -124,17 +139,12 @@ nsresult nsEditorController::RegisterEdi
   NS_REGISTER_NEXT_COMMAND(nsSelectionMoveCommands, "cmd_scrollPageUp");
   NS_REGISTER_NEXT_COMMAND(nsSelectionMoveCommands, "cmd_scrollPageDown");
   NS_REGISTER_NEXT_COMMAND(nsSelectionMoveCommands, "cmd_scrollLineUp");
   NS_REGISTER_NEXT_COMMAND(nsSelectionMoveCommands, "cmd_scrollLineDown");
   NS_REGISTER_NEXT_COMMAND(nsSelectionMoveCommands, "cmd_movePageUp");
   NS_REGISTER_NEXT_COMMAND(nsSelectionMoveCommands, "cmd_movePageDown");
   NS_REGISTER_NEXT_COMMAND(nsSelectionMoveCommands, "cmd_selectPageUp");
   NS_REGISTER_LAST_COMMAND(nsSelectionMoveCommands, "cmd_selectPageDown");
-    
-  // Insert content
-  NS_REGISTER_ONE_COMMAND(nsInsertPlaintextCommand, "cmd_insertText");
-  NS_REGISTER_ONE_COMMAND(nsPasteQuotationCommand,  "cmd_pasteQuote");
-
 
   return NS_OK;
 }
 
--- a/editor/libeditor/base/nsEditorController.h
+++ b/editor/libeditor/base/nsEditorController.h
@@ -36,22 +36,26 @@
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef nsEditorController_h__
 #define nsEditorController_h__
 
 #define NS_EDITORCONTROLLER_CID \
 { 0x26fb965c, 0x9de6, 0x11d3, { 0xbc, 0xcc, 0x0, 0x60, 0xb0, 0xfc, 0x76, 0xbd } }
 
+#define NS_EDITINGCONTROLLER_CID \
+{ 0x2c5a5cdd, 0xe742, 0x4dfe, { 0x86, 0xb8, 0x06, 0x93, 0x09, 0xbf, 0x6c, 0x91 } }
+
 class nsIControllerCommandTable;
 
 
 // the editor controller is used for both text widgets, and basic text editing
 // commands in composer. The refCon that gets passed to its commands is an nsIEditor.
 
 class nsEditorController 
 {
 public:
   static nsresult RegisterEditorCommands(nsIControllerCommandTable* inCommandTable);
+  static nsresult RegisterEditingCommands(nsIControllerCommandTable* inCommandTable);
 };
 
 #endif /* nsEditorController_h__ */
 
--- a/editor/libeditor/base/tests/test_selection_move_commands.xul
+++ b/editor/libeditor/base/tests/test_selection_move_commands.xul
@@ -33,16 +33,17 @@ function execTests() {
   body.style.padding='0px';
   body.style.margin='0px';
   body.style.borderSize='0px';
 
   var sel = win.getSelection();
   doc.designMode='on';
   body.innerHTML = "1<br>2<br>3<br>4<br>5<br>6<br>7<br>8<br>9<br>10<br>11<br>12<br>";
   win.focus();
+  yield;
 
   function doCommand(cmd) {
     var controller = document.commandDispatcher.getControllerForCommand(cmd);
     if (controller) {
       controller.doCommand(cmd);
     }
   }
 
@@ -117,26 +118,16 @@ function execTests() {
   var pageHeight = -root.getBoundingClientRect().top;
   ok(pageHeight > 0, "cmd_scrollPageDown works");
   ok(pageHeight <= 100, "cmd_scrollPageDown doesn't scroll too much");
   doCommand("cmd_scrollBottom");
   doCommand("cmd_scrollPageUp");
   yield;
   testScrollCommand("cmd_scrollPageUp", root.scrollHeight - 100 - pageHeight);
 
-  doCommand("cmd_scrollTop");
-  doCommand("cmd_scrollLineDown");
-  yield;
-  var lineHeight = -root.getBoundingClientRect().top;
-  ok(lineHeight > 0, "Can scroll by lines");
-  doCommand("cmd_scrollBottom");
-  doCommand("cmd_scrollLineUp");
-  yield;
-  testScrollCommand("cmd_scrollLineUp", root.scrollHeight - 100 - lineHeight);
-
   var runSelectionTests = function(selectWordNextNode, selectWordNextOffset) {
     testMoveCommand("cmd_moveBottom", body, 23);
     testMoveCommand("cmd_moveTop", node(0), 0);
     testSelectCommand("cmd_selectBottom", body, 23);
     doCommand("cmd_moveBottom");
     testSelectCommand("cmd_selectTop", node(0), 0);
 
     doCommand("cmd_moveTop");
--- a/editor/libeditor/html/tests/test_bug549262.html
+++ b/editor/libeditor/html/tests/test_bug549262.html
@@ -16,17 +16,17 @@ https://bugzilla.mozilla.org/show_bug.cg
 </div>
 <pre id="test">
 <script type="application/javascript">
 
 /** Test for Bug 549262 **/
 
 SimpleTest.waitForExplicitFinish();
 var win = window.open("file_bug549262.html", "_blank", 
-                      "width=600,height=600");
+                      "width=600,height=600,scrollbars=yes");
 SimpleTest.waitForFocus(function() {
   // Make sure that pressing Space when a contenteditable element is not focused
   // will scroll the page.
   var ed = win.document.getElementById("editor");
   var sc = win.document.querySelector("a");
   sc.focus();
   is(win.scrollY, 0, "Sanity check");
   synthesizeKey(" ", {}, win);
@@ -53,18 +53,54 @@ SimpleTest.waitForFocus(function() {
           is(ed.textContent, "a bc", "The content of the editable element has not changed");
           ed.focus();
           win.getSelection().collapse(ed.firstChild, 3);
           synthesizeKey(" ", {shiftKey: true}, win);
           setTimeout(function() {
             isnot(win.scrollY, 0, "Page is not scrolled up");
             is(ed.textContent, "a b c", "The content of the editable element has changed");
 
-            win.close();
-            SimpleTest.finish();
+            // Now let's test the down/up keys
+            sc = document.body;
+            setTimeout(function() {
+              ed.blur();
+              sc.focus();
+              var oldY = win.scrollY;
+              synthesizeKey("VK_UP", {}, win);
+              setTimeout(function() {
+                ok(win.scrollY < oldY, "Page is scrolled up");
+                oldY = win.scrollY;
+                ed.focus();
+                win.getSelection().collapse(ed.firstChild, 3);
+                synthesizeKey("VK_UP", {}, win);
+                setTimeout(function() {
+                  is(win.scrollY, oldY, "Page is not scrolled up");
+                  is(win.getSelection().focusNode, ed.firstChild, "Correct element selected");
+                  is(win.getSelection().focusOffset, 0, "Selection should be moved to the beginning");
+                  win.getSelection().removeAllRanges();
+                  synthesizeMouse(sc, 300, 300, {}, win);
+                  synthesizeKey("VK_DOWN", {}, win);
+                  setTimeout(function() {
+                    ok(win.scrollY > oldY, "Page is scrolled down");
+                    ed.focus();
+                    win.getSelection().collapse(ed.firstChild, 3);
+                    oldY = win.scrollY;
+                    synthesizeKey("VK_DOWN", {}, win);
+                    setTimeout(function() {
+                      is(win.scrollY, oldY, "Page is not scrolled down");
+                      is(win.getSelection().focusNode, ed.firstChild, "Correct element selected");
+                      is(win.getSelection().focusOffset, ed.textContent.length, "Selection should be moved to the end");
+
+                      win.close();
+                      SimpleTest.finish();
+                    }, 0);
+                  }, 0);
+                }, 0);
+              }, 0);
+            }, 0);
           }, 0);
         }, 0);
       }, 0);
     }, 0);
   }, 0);
 }, win);
 
 </script>
--- a/extensions/spellcheck/hunspell/src/mozHunspell.cpp
+++ b/extensions/spellcheck/hunspell/src/mozHunspell.cpp
@@ -359,24 +359,16 @@ NS_IMETHODIMP mozHunspell::GetDictionary
   }
 
   *aDictionaries = ans.dics;
   *aCount = ans.count;
 
   return NS_OK;
 }
 
-static PLDHashOperator
-FindFirstString(const nsAString& aString, nsIFile* aFile, void* aClosure)
-{
-  nsAString *dic = (nsAString*) aClosure;
-  dic->Assign(aString);
-  return PL_DHASH_STOP;
-}
-
 void
 mozHunspell::LoadDictionaryList()
 {
   mDictionaries.Clear();
 
   nsresult rv;
 
   nsCOMPtr<nsIProperties> dirSvc =
--- a/ipc/ipdl/Makefile.in
+++ b/ipc/ipdl/Makefile.in
@@ -58,17 +58,16 @@ IPDLDIRS =  \
   dom/plugins/ipc  \
   dom/ipc  \
   dom/sms/src/ipc \
   dom/src/storage \
   gfx/layers/ipc \
   hal/sandbox \
   ipc/testshell  \
   js/ipc  \
-  js/jetpack \
   layout/ipc \
   netwerk/ipc  \
   netwerk/protocol/ftp \
   netwerk/protocol/http  \
   netwerk/protocol/wyciwyg \
   netwerk/protocol/websocket \
   netwerk/cookie  \
   uriloader/prefetch  \
deleted file mode 100644
--- a/js/jetpack/Handle.h
+++ /dev/null
@@ -1,374 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
- * vim: set ts=8 sw=4 et tw=80:
- *
- * ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is mozilla.org code.
- *
- * The Initial Developer of the Original Code is
- * The Mozilla Foundation.
- * Portions created by the Initial Developer are Copyright (C) 2010
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *   Ben Newman <mozilla@benjamn.com> (original author)
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either of the GNU General Public License Version 2 or later (the "GPL"),
- * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#ifndef mozilla_jetpack_HandleParent_h
-#define mozilla_jetpack_HandleParent_h
-
-#include "mozilla/jetpack/PHandleParent.h"
-#include "mozilla/jetpack/PHandleChild.h"
-
-#include "jsapi.h"
-#include "jsclass.h"
-#include "jscntxt.h"
-#include "jsfriendapi.h"
-
-#include "mozilla/unused.h"
-
-namespace mozilla {
-namespace jetpack {
-
-/**
- * BaseType should be one of PHandleParent or PHandleChild; see the
- * HandleParent and HandleChild typedefs at the bottom of this file.
- */
-template <class BaseType>
-class Handle
-  : public BaseType
-{
-  Handle(Handle* parent)
-    : mParent(parent)
-    , mObj(NULL)
-    , mCx(NULL)
-    , mRooted(false)
-  {}
-
-  BaseType* AllocPHandle() {
-    return new Handle(this);
-  }
-
-  bool DeallocPHandle(BaseType* actor) {
-    delete actor;
-    return true;
-  }
-
-public:
-
-  Handle()
-    : mParent(NULL)
-    , mObj(NULL)
-    , mCx(NULL)
-    , mRooted(false)
-  {}
-
-  ~Handle() { TearDown(); }
-
-  static Handle* FromJSObject(JSContext* cx, JSObject* obj) {
-    // TODO Convert non-Handles to Handles somehow?
-    return Unwrap(cx, obj);
-  }
-
-  static Handle* FromJSVal(JSContext* cx, jsval val) {
-    if (!JSVAL_IS_OBJECT(val))
-      return NULL;
-    return Unwrap(cx, JSVAL_TO_OBJECT(val));
-  }
-
-  void Root() {
-    NS_ASSERTION(mObj && mCx, "Rooting with no object unexpected.");
-    if (mRooted)
-      return;
-
-    if (!JS_AddNamedObjectRoot(mCx, &mObj, "Jetpack Handle")) {
-      NS_RUNTIMEABORT("Failed to add root.");
-    }
-    mRooted = true;
-  }
-
-  void Unroot() {
-    NS_ASSERTION(mCx, "Unrooting with no JSContext unexpected.");
-    if (!mRooted)
-      return;
-
-    JS_RemoveObjectRoot(mCx, &mObj);
-    mRooted = false;
-  }
-
-  JSObject* ToJSObject(JSContext* cx) {
-    if (!mObj && !mCx) {
-      JSClass* clasp = const_cast<JSClass*>(&sHandle_JSClass);
-      JSObject* obj = JS_NewObject(cx, clasp, NULL, NULL);
-      if (!obj)
-        return NULL;
-      js::AutoObjectRooter root(cx, obj);
-
-      JSPropertySpec* ps = const_cast<JSPropertySpec*>(sHandle_Properties);
-      JSFunctionSpec* fs = const_cast<JSFunctionSpec*>(sHandle_Functions);
-
-      if (JS_SetPrivate(cx, obj, (void*)this) &&
-          JS_DefineProperties(cx, obj, ps) &&
-          JS_DefineFunctions(cx, obj, fs)) {
-        mObj = obj;
-        mCx = cx;
-        Root();
-      }
-    }
-    return mObj;
-  }
-
-protected:
-
-  void ActorDestroy(typename Handle::ActorDestroyReason why) {
-    TearDown();
-  }
-
-private:
-
-  static bool IsParent(const PHandleParent* handle) { return true; }
-  static bool IsParent(const PHandleChild* handle) { return false; }
-
-  void TearDown() {
-    if (mCx) {
-      JSAutoRequest ar(mCx);
-
-      if (mObj) {
-        JS_SetPrivate(mCx, mObj, NULL);
-
-        js::AutoObjectRooter obj(mCx, mObj);
-        mObj = NULL;
-
-        // If we can't enter the compartment, we won't run onInvalidate().
-        JSAutoEnterCompartment ac;
-        if (ac.enter(mCx, obj.object())) {
-          JSBool hasOnInvalidate;
-          if (JS_HasProperty(mCx, obj.object(), "onInvalidate",
-                             &hasOnInvalidate) && hasOnInvalidate) {
-            js::AutoValueRooter r(mCx);
-            JSBool ok = JS_CallFunctionName(mCx, obj.object(), "onInvalidate", 0,
-                                            NULL, r.jsval_addr());
-            if (!ok)
-              JS_ReportPendingException(mCx);
-          }
-        }
-
-        // By not nulling out mContext, we prevent ToJSObject from
-        // reviving an invalidated/destroyed handle.
-      }
-
-      // Nulling out mObj effectively unroots the object, but we still
-      // need to remove the root, else the JS engine will complain at
-      // shutdown.
-      Unroot();
-    }
-  }
-
-  static const JSClass        sHandle_JSClass;
-  static const JSPropertySpec sHandle_Properties[];
-  static const JSFunctionSpec sHandle_Functions[];
-
-  Handle* const mParent;
-
-  // Used to cache the JSObject returned by ToJSObject, which is
-  // otherwise a const method.
-  JSObject*  mObj;
-  JSContext* mCx;
-  bool mRooted;
-
-  static Handle*
-  Unwrap(JSContext* cx, JSObject* obj) {
-    while (obj && Jsvalify(js::GetObjectClass(obj)) != &sHandle_JSClass)
-      obj = js::GetObjectProto(obj);
-
-    if (!obj)
-      return NULL;
-
-    Handle* self = static_cast<Handle*>(JS_GetPrivate(cx, obj));
-
-    NS_ASSERTION(!self || self->ToJSObject(cx) == obj,
-                 "Wrapper and wrapped object disagree?");
-
-    return self;
-  }
-
-  static JSBool
-  GetParent(JSContext* cx, JSObject* obj, jsid, jsval* vp) {
-    JS_SET_RVAL(cx, vp, JSVAL_NULL);
-
-    Handle* self = Unwrap(cx, obj);
-    if (!self)
-      return JS_TRUE;
-
-    Handle* parent = self->mParent;
-    if (!parent)
-      return JS_TRUE;
-
-    JSObject* pobj = parent->ToJSObject(cx);
-    JS_SET_RVAL(cx, vp, OBJECT_TO_JSVAL(pobj));
-
-    return JS_TRUE;
-  }
-
-  static JSBool
-  GetIsValid(JSContext* cx, JSObject* obj, jsid, jsval* vp) {
-    Handle* self = Unwrap(cx, obj);
-    JS_SET_RVAL(cx, vp, BOOLEAN_TO_JSVAL(!!self));
-    return JS_TRUE;
-  }
-
-  static JSBool
-  GetIsRooted(JSContext* cx, JSObject* obj, jsid, jsval* vp) {
-    Handle* self = Unwrap(cx, obj);
-    bool rooted = self ? self->mRooted : false;
-    JS_SET_RVAL(cx, vp, BOOLEAN_TO_JSVAL(rooted));
-    return JS_TRUE;
-  }
-
-  static JSBool
-  SetIsRooted(JSContext* cx, JSObject* obj, jsid, JSBool strict, jsval* vp) {
-    Handle* self = Unwrap(cx, obj);
-    JSBool v;
-    if (!JS_ValueToBoolean(cx, *vp, &v))
-      return JS_FALSE;
-
-    if (!self) {
-      if (v) {
-        JS_ReportError(cx, "Cannot root invalidated handle.");
-        return JS_FALSE;
-      }
-      return JS_TRUE;
-    }
-
-    if (v)
-      self->Root();
-    else
-      self->Unroot();
-
-    *vp = BOOLEAN_TO_JSVAL(v);
-    return JS_TRUE;
-  }
-
-  static JSBool
-  Invalidate(JSContext* cx, uintN argc, jsval* vp) {
-    if (argc > 0) {
-      JS_ReportError(cx, "invalidate takes zero arguments");
-      return JS_FALSE;
-    }
-
-    Handle* self = Unwrap(cx, JS_THIS_OBJECT(cx, vp));
-    if (self)
-      unused << BaseType::Send__delete__(self);
-
-    JS_SET_RVAL(cx, vp, JSVAL_VOID);
-
-    return JS_TRUE;
-  }
-
-  static JSBool
-  CreateHandle(JSContext* cx, uintN argc, jsval* vp) {
-    if (argc > 0) {
-      JS_ReportError(cx, "createHandle takes zero arguments");
-      return JS_FALSE;
-    }
-
-    Handle* self = Unwrap(cx, JS_THIS_OBJECT(cx, vp));
-    if (!self) {
-      JS_ReportError(cx, "Tried to create child from invalid handle");
-      return JS_FALSE;
-    }
-
-    BaseType* child = self->SendPHandleConstructor();
-    if (!child) {
-      JS_ReportError(cx, "Failed to construct child");
-      return JS_FALSE;
-    }
-
-    JSObject* obj = static_cast<Handle*>(child)->ToJSObject(cx);
-    JS_SET_RVAL(cx, vp, OBJECT_TO_JSVAL(obj));
-
-    return JS_TRUE;
-  }
-
-  static void
-  Finalize(JSContext* cx, JSObject* obj) {
-    Handle* self = Unwrap(cx, obj);
-    if (self) {
-      NS_ASSERTION(!self->mRooted, "Finalizing a rooted object?");
-      self->mCx = NULL;
-      self->mObj = NULL;
-      unused << BaseType::Send__delete__(self);
-    }
-  }
-};
-
-template <class BaseType>
-const JSClass
-Handle<BaseType>::sHandle_JSClass = {
-  "IPDL Handle", JSCLASS_HAS_PRIVATE,
-  JS_PropertyStub, JS_PropertyStub,
-  JS_PropertyStub, JS_StrictPropertyStub,
-  JS_EnumerateStub, JS_ResolveStub,
-  JS_ConvertStub, Handle::Finalize,
-  JSCLASS_NO_OPTIONAL_MEMBERS
-};
-
-#define HANDLE_PROP_FLAGS (JSPROP_PERMANENT | JSPROP_SHARED)
-
-template <class BaseType>
-const JSPropertySpec
-Handle<BaseType>::sHandle_Properties[] = {
-  { "parent",  0, HANDLE_PROP_FLAGS | JSPROP_READONLY, GetParent,  NULL },
-  { "isValid", 0, HANDLE_PROP_FLAGS | JSPROP_READONLY, GetIsValid, NULL },
-  { "isRooted", 0, HANDLE_PROP_FLAGS, GetIsRooted, SetIsRooted },
-  { 0, 0, 0, NULL, NULL }
-};
-
-#undef HANDLE_PROP_FLAGS
-
-#define HANDLE_FUN_FLAGS (JSPROP_READONLY |     \
-                          JSPROP_PERMANENT)
-
-template <class BaseType>
-const JSFunctionSpec
-Handle<BaseType>::sHandle_Functions[] = {
-  JS_FN("invalidate",   Invalidate,   0, HANDLE_FUN_FLAGS),
-  JS_FN("createHandle", CreateHandle, 0, HANDLE_FUN_FLAGS),
-  JS_FS_END
-};
-
-#undef HANDLE_FUN_FLAGS
-
-// The payoff for using templates is that these two implementations are
-// guaranteed to be perfectly symmetric:
-typedef Handle<PHandleParent> HandleParent;
-typedef Handle<PHandleChild> HandleChild;
-
-} // namespace jetpack
-} // namespace mozilla
-
-#endif
deleted file mode 100644
--- a/js/jetpack/JetpackActorCommon.cpp
+++ /dev/null
@@ -1,568 +0,0 @@
-/* -*- Mode: C++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 8 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla Firefox.
- *
- * The Initial Developer of the Original Code is
- * the Mozilla Foundation <http://www.mozilla.org>.
- * Portions created by the Initial Developer are Copyright (C) 2010
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *   Ben Newman <mozilla@benjamn.com> (original author)
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#include "base/basictypes.h"
-
-#include "jsapi.h"
-#include "jscntxt.h"
-#include "js/HashTable.h"
-
-#include "mozilla/jetpack/JetpackActorCommon.h"
-#include "mozilla/jetpack/PJetpack.h"
-#include "mozilla/jetpack/PHandleParent.h"
-#include "mozilla/jetpack/PHandleChild.h"
-#include "mozilla/jetpack/Handle.h"
-
-#include "nsJSUtils.h"
-
-using namespace mozilla::jetpack;
-
-class JetpackActorCommon::OpaqueSeenType
-{
-public:
-  typedef JSObject* KeyType;
-  typedef size_t IdType;
-  typedef js::HashMap<
-    KeyType, IdType,
-    js::DefaultHasher<KeyType>,
-    js::SystemAllocPolicy
-  > MapType;
-
-  OpaqueSeenType() {
-    (void) map.init(1);
-  }
-
-  bool ok() { return map.initialized(); }
-
-  // Reserving 0 as an invalid ID means starting the valid IDs at 1.  We
-  // could have reserved a dummy first element of rmap, but that would
-  // have wasted space.
-  static const IdType kInvalidId = 0;
-
-  bool add(KeyType obj, IdType* id) {
-    MapType::AddPtr ap = map.lookupForAdd(obj);
-    if (!ap) {
-      if (!rmap.AppendElement(obj) ||
-          !map.add(ap, obj, *id = rmap.Length()))
-        *id = kInvalidId;
-      return true;
-    }
-    *id = ap->value;
-    return false;
-  }
-
-  KeyType reverseLookup(IdType id) {
-    return rmap.SafeElementAt(id - 1, NULL);
-  }
-
-private:
-  MapType map;
-  nsAutoTArray<KeyType, 4> rmap;
-
-};
-
-bool
-JetpackActorCommon::jsval_to_PrimVariant(JSContext* cx, JSType type, jsval from,
-                                         PrimVariant* to)
-{
-  // A false return from this function just means the value couldn't be
-  // converted to a PrimVariant (i.e., it wasn't a primitive value).
-
-  switch (type) {
-  case JSTYPE_VOID:
-    *to = void_t();
-    return true;
-
-  case JSTYPE_NULL:
-    *to = null_t();
-    return true;
-
-  case JSTYPE_FUNCTION:
-    return false;
-
-  case JSTYPE_OBJECT: {
-    HandleParent* hp = HandleParent::FromJSVal(cx, from);
-    HandleChild* hc = HandleChild::FromJSVal(cx, from);
-    NS_ASSERTION(!hc || !hp, "Can't be both a parent and a child");
-    if (hp) {
-      *to = hp;
-      return true;
-    }
-    if (hc) {
-      *to = hc;
-      return true;
-    }
-    return false;
-  }
-
-  case JSTYPE_STRING:
-    {
-        nsDependentJSString depStr;
-        if (!depStr.init(cx, from))
-            return false;
-        *to = depStr;
-    }
-    return true;
-
-  case JSTYPE_NUMBER:
-    if (JSVAL_IS_INT(from))
-      *to = JSVAL_TO_INT(from);
-    else if (JSVAL_IS_DOUBLE(from))
-      *to = JSVAL_TO_DOUBLE(from);
-    else
-      return false;
-    return true;
-
-  case JSTYPE_BOOLEAN:
-    *to = !!JSVAL_TO_BOOLEAN(from);
-    return true;
-
-  case JSTYPE_XML:
-    return false;
-
-  default:
-    return false;
-  }
-}
-
-bool
-JetpackActorCommon::jsval_to_CompVariant(JSContext* cx, JSType type, jsval from,
-                                         CompVariant* to, OpaqueSeenType* seen)
-{
-  if (type != JSTYPE_OBJECT)
-    return false;
-
-  Maybe<OpaqueSeenType> lost;
-  if (!seen) {
-    lost.construct();
-    seen = lost.addr();
-    if (!seen->ok())
-      return false;
-  }
-
-  OpaqueSeenType::KeyType obj = JSVAL_TO_OBJECT(from);
-  OpaqueSeenType::IdType id;
-  if (!seen->add(obj, &id)) {
-    if (OpaqueSeenType::kInvalidId == id)
-      return false;
-    *to = CompVariant(id);
-    return true;
-  }
-
-  if (JS_IsArrayObject(cx, obj)) {
-    nsTArray<Variant> elems;
-    jsuint len;
-    if (!JS_GetArrayLength(cx, obj, &len) ||
-        !elems.SetCapacity(len))
-      return false;
-    for (jsuint i = 0; i < len; ++i) {
-      jsval val;
-      Variant* vp = elems.AppendElement();
-      if (!JS_GetElement(cx, obj, i, &val) ||
-          !jsval_to_Variant(cx, val, vp, seen))
-        *vp = void_t();
-    }
-    InfallibleTArray<Variant> outElems;
-    outElems.SwapElements(elems);
-    *to = outElems;
-    return true;
-  }
-
-  js::AutoIdArray ida(cx, JS_Enumerate(cx, obj));
-  if (!ida)
-    return false;
-
-  nsTArray<KeyValue> kvs;
-  for (size_t i = 0; i < ida.length(); ++i) {
-    jsval val; // reused for both key and value
-    if (!JS_IdToValue(cx, ida[i], &val))
-      return false;
-    JSString* idStr = JS_ValueToString(cx, val);
-    if (!idStr)
-      return false;
-    if (!JS_GetPropertyById(cx, obj, ida[i], &val))
-      return false;
-    KeyValue kv;
-    // Silently drop properties that can't be converted.
-    if (jsval_to_Variant(cx, val, &kv.value(), seen)) {
-      nsDependentJSString depStr;
-      if (!depStr.init(cx, idStr))
-          return false;
-      kv.key() = depStr;
-      // If AppendElement fails, we lose this property, no big deal.
-      kvs.AppendElement(kv);
-    }
-  }
-  InfallibleTArray<KeyValue> outKvs;
-  outKvs.SwapElements(kvs);
-  *to = outKvs;
-
-  return true;
-}
-
-bool
-JetpackActorCommon::jsval_to_Variant(JSContext* cx, jsval from, Variant* to,
-                                     OpaqueSeenType* seen)
-{
-  JSType type = JS_TypeOfValue(cx, from);
-  if (JSVAL_IS_NULL(from))
-    type = JSTYPE_NULL;
-
-  PrimVariant pv;
-  if (jsval_to_PrimVariant(cx, type, from, &pv)) {
-    *to = pv;
-    return true;
-  }
-
-  CompVariant cv;
-  if (jsval_to_CompVariant(cx, type, from, &cv, seen)) {
-    *to = cv;
-    return true;
-  }
-
-  return false;
-}
-
-bool
-JetpackActorCommon::jsval_from_PrimVariant(JSContext* cx,
-                                           const PrimVariant& from,
-                                           jsval* to)
-{
-  switch (from.type()) {
-  case PrimVariant::Tvoid_t:
-    *to = JSVAL_VOID;
-    return true;
-
-  case PrimVariant::Tnull_t:
-    *to = JSVAL_NULL;
-    return true;
-
-  case PrimVariant::Tbool:
-    *to = from.get_bool() ? JSVAL_TRUE : JSVAL_FALSE;
-    return true;
-
-  case PrimVariant::Tint:
-    *to = INT_TO_JSVAL(from.get_int());
-    return true;
-
-  case PrimVariant::Tdouble:
-    return !!JS_NewNumberValue(cx, from.get_double(), to);
-
-  case PrimVariant::TnsString: {
-    const nsString& str = from.get_nsString();
-    // TODO Use some sort of sharedstring/stringbuffer abstraction to
-    // exploit sharing opportunities more generally.
-    if (!str.Length()) {
-      *to = JS_GetEmptyStringValue(cx);
-      return true;
-    }
-    JSString* s =
-      JS_NewUCStringCopyN(cx, str.get(), str.Length());
-    if (!s)
-      return false;
-    *to = STRING_TO_JSVAL(s);
-    return true;
-  }
-
-  case PrimVariant::TPHandleParent: {
-    JSObject* hobj =
-      static_cast<HandleParent*>(from.get_PHandleParent())->ToJSObject(cx);
-    if (!hobj)
-      return false;
-    *to = OBJECT_TO_JSVAL(hobj);
-    return true;
-  }    
-
-  case PrimVariant::TPHandleChild: {
-    JSObject* hobj =
-      static_cast<HandleChild*>(from.get_PHandleChild())->ToJSObject(cx);
-    if (!hobj)
-      return false;
-    *to = OBJECT_TO_JSVAL(hobj);
-    return true;
-  }
-
-  default:
-    return false;
-  }
-}
-
-bool
-JetpackActorCommon::jsval_from_CompVariant(JSContext* cx,
-                                           const CompVariant& from,
-                                           jsval* to,
-                                           OpaqueSeenType* seen)
-{
-  Maybe<OpaqueSeenType> lost;
-  if (!seen) {
-    lost.construct();
-    seen = lost.addr();
-    if (!seen->ok())
-      return false;
-  }
-
-  JSObject* obj = NULL;
-
-  switch (from.type()) {
-  case CompVariant::TArrayOfKeyValue: {
-    if (!(obj = JS_NewObject(cx, NULL, NULL, NULL)))
-      return false;
-    js::AutoObjectRooter root(cx, obj);
-
-    OpaqueSeenType::IdType ignored;
-    if (!seen->add(obj, &ignored))
-      return false;
-
-    const nsTArray<KeyValue>& kvs = from.get_ArrayOfKeyValue();
-    for (PRUint32 i = 0; i < kvs.Length(); ++i) {
-      const KeyValue& kv = kvs.ElementAt(i);
-      js::AutoValueRooter toSet(cx);
-      if (!jsval_from_Variant(cx, kv.value(), toSet.jsval_addr(), seen) ||
-          !JS_SetUCProperty(cx, obj,
-                            kv.key().get(),
-                            kv.key().Length(),
-                            toSet.jsval_addr()))
-        return false;
-    }
-
-    break;
-  }
-
-  case CompVariant::TArrayOfVariant: {
-    const nsTArray<Variant>& vs = from.get_ArrayOfVariant();
-    nsAutoTArray<jsval, 8> jsvals;
-    jsval* elems = jsvals.AppendElements(vs.Length());
-    if (!elems)
-      return false;
-    for (PRUint32 i = 0; i < vs.Length(); ++i)
-      elems[i] = JSVAL_VOID;
-    js::AutoArrayRooter root(cx, vs.Length(), elems);
-
-    OpaqueSeenType::IdType ignored;
-    if (!seen->add(obj, &ignored))
-      return false;
-
-    for (PRUint32 i = 0; i < vs.Length(); ++i)
-      if (!jsval_from_Variant(cx, vs.ElementAt(i), elems + i, seen))
-        return false;
-
-    if (!(obj = JS_NewArrayObject(cx, vs.Length(), elems)))
-      return false;
-
-    break;
-  }
-
-  case CompVariant::Tsize_t:
-    if (!(obj = seen->reverseLookup(from.get_size_t())))
-      return false;
-    break;
-
-  default:
-    return false;
-  }
-
-  *to = OBJECT_TO_JSVAL(obj);
-  return true;
-}
-
-bool
-JetpackActorCommon::jsval_from_Variant(JSContext* cx, const Variant& from,
-                                       jsval* to, OpaqueSeenType* seen)
-{
-  switch (from.type()) {
-  case Variant::TPrimVariant:
-    return jsval_from_PrimVariant(cx, from, to);
-  case Variant::TCompVariant:
-    return jsval_from_CompVariant(cx, from, to, seen);
-  default:
-    return false;
-  }
-}
-
-bool
-JetpackActorCommon::RecvMessage(JSContext* cx,
-                                const nsString& messageName,
-                                const InfallibleTArray<Variant>& data,
-                                InfallibleTArray<Variant>* results)
-{
-  if (results)
-    results->Clear();
-
-  JSObject* implGlobal = JS_GetGlobalObject(cx);
-
-  JSAutoEnterCompartment ac;
-  if (!ac.enter(cx, implGlobal))
-    return false;
-
-  RecList* list;
-  if (!mReceivers.Get(messageName, &list))
-    return true;
-
-  nsAutoTArray<jsval, 4> snapshot;
-  if (!list->copyTo(cx, snapshot))
-    return false;
-  if (!snapshot.Length())
-    return true;
-  
-  nsAutoTArray<jsval, 4> args;
-  PRUint32 argc = data.Length() + 1;
-  jsval* argv = args.AppendElements(argc);
-  if (!argv)
-    return false;
-  for (PRUint32 i = 0; i < argc; ++i)
-    argv[i] = JSVAL_VOID;
-  js::AutoArrayRooter argvRooter(cx, argc, argv);
-
-  JSString* msgNameStr =
-    JS_NewUCStringCopyN(cx,
-                        messageName.get(),
-                        messageName.Length());
-  if (!msgNameStr)
-    return false;
-  argv[0] = STRING_TO_JSVAL(msgNameStr);
-
-  for (PRUint32 i = 0; i < data.Length(); ++i)
-    if (!jsval_from_Variant(cx, data.ElementAt(i), argv + i + 1))
-      return false;
-
-  js::AutoValueRooter rval(cx);
-  for (PRUint32 i = 0; i < snapshot.Length(); ++i) {
-    Variant* vp = results ? results->AppendElement() : NULL;
-    rval.set(JSVAL_VOID);
-    if (!JS_CallFunctionValue(cx, implGlobal, snapshot[i], argc, argv,
-                              rval.jsval_addr())) {
-      (void) JS_ReportPendingException(cx);
-      if (vp)
-        *vp = void_t();
-    } else if (vp && !jsval_to_Variant(cx, rval.jsval_value(), vp))
-      *vp = void_t();
-  }
-
-  return true;
-}
-
-JetpackActorCommon::RecList::~RecList()
-{
-  while (mHead) {
-    RecNode* old = mHead;
-    mHead = mHead->down;
-    delete old;
-  }
-}
-
-void
-JetpackActorCommon::RecList::add(jsval v)
-{
-  RecNode* node = mHead, *tail = NULL;
-  while (node) {
-    if (node->value() == v)
-      return;
-    node = (tail = node)->down;
-  }
-  node = new RecNode(mCx, v);
-  if (tail)
-    tail->down = node;
-  else
-    mHead = node;
-}
-
-void
-JetpackActorCommon::RecList::remove(jsval v)
-{
-  while (mHead && mHead->value() == v) {
-    RecNode* old = mHead;
-    mHead = mHead->down;
-    delete old;
-  }
-  if (!mHead)
-    return;
-  RecNode* prev = mHead, *node = prev->down;
-  while (node) {
-    if (node->value() == v) {
-      prev->down = node->down;
-      delete node;
-    } else
-      prev = node;
-    node = prev->down;
-  }
-}
-
-bool
-JetpackActorCommon::RecList::copyTo(JSContext *cx, nsTArray<jsval>& dst) const
-{
-  dst.Clear();
-  for (RecNode* node = mHead; node; node = node->down) {
-    jsval v = node->value();
-    if (!JS_WrapValue(cx, &v))
-      return false;
-    dst.AppendElement(v);
-  }
-  return true;
-}
-
-nsresult
-JetpackActorCommon::RegisterReceiver(JSContext* cx,
-                                     const nsString& messageName,
-                                     jsval receiver)
-{
-  if (JS_TypeOfValue(cx, receiver) != JSTYPE_FUNCTION)
-    return NS_ERROR_INVALID_ARG;
-
-  RecList* list;
-  if (!mReceivers.Get(messageName, &list)) {
-    list = new RecList(cx);
-    if (!list || !mReceivers.Put(messageName, list)) {
-      delete list;
-      return NS_ERROR_OUT_OF_MEMORY;
-    }
-  }
-
-  list->add(receiver);
-
-  return NS_OK;
-}
-
-void
-JetpackActorCommon::UnregisterReceiver(const nsString& messageName,
-                                       jsval receiver)
-{
-  RecList* list;
-  if (!mReceivers.Get(messageName, &list))
-    return;
-  list->remove(receiver);
-}
deleted file mode 100644
--- a/js/jetpack/JetpackActorCommon.h
+++ /dev/null
@@ -1,143 +0,0 @@
-/* -*- Mode: C++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 8 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla Firefox.
- *
- * The Initial Developer of the Original Code is
- * the Mozilla Foundation <http://www.mozilla.org>.
- * Portions created by the Initial Developer are Copyright (C) 2010
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *   Ben Newman <mozilla@benjamn.com> (original author)
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#ifndef mozilla_jetpack_JetpackActorCommon_h
-#define mozilla_jetpack_JetpackActorCommon_h
-
-#include "nsClassHashtable.h"
-#include "nsHashKeys.h"
-#include "nsTArray.h"
-#include "nsString.h"
-#include "nsAutoJSValHolder.h"
-
-struct JSContext;
-
-namespace mozilla {
-namespace jetpack {
-
-class KeyValue;
-class PrimVariant;
-class CompVariant;
-class Variant;
-
-class JetpackActorCommon
-{
-public:
-
-  bool
-  RecvMessage(JSContext* cx,
-              const nsString& messageName,
-              const InfallibleTArray<Variant>& data,
-              InfallibleTArray<Variant>* results);
-
-  nsresult
-  RegisterReceiver(JSContext* cx,
-                   const nsString& messageName,
-                   jsval receiver);
-
-  void
-  UnregisterReceiver(const nsString& messageName,
-                     jsval receiver);
-
-  void
-  UnregisterReceivers(const nsString& messageName) {
-    mReceivers.Remove(messageName);
-  }
-
-  void ClearReceivers() {
-    mReceivers.Clear();
-  }
-
-  class OpaqueSeenType;
-  static bool jsval_to_Variant(JSContext* cx, jsval from, Variant* to,
-                               OpaqueSeenType* seen = NULL);
-  static bool jsval_from_Variant(JSContext* cx, const Variant& from, jsval* to,
-                                 OpaqueSeenType* seen = NULL);
-
-protected:
-
-  JetpackActorCommon() {
-    mReceivers.Init();
-    NS_ASSERTION(mReceivers.IsInitialized(),
-                 "Failed to initialize message receiver hash set");
-  }
-
-private:
-
-  static bool jsval_to_PrimVariant(JSContext* cx, JSType type, jsval from,
-                                   PrimVariant* to);
-  static bool jsval_to_CompVariant(JSContext* cx, JSType type, jsval from,
-                                   CompVariant* to, OpaqueSeenType* seen);
-
-  static bool jsval_from_PrimVariant(JSContext* cx, const PrimVariant& from,
-                                     jsval* to);
-  static bool jsval_from_CompVariant(JSContext* cx, const CompVariant& from,
-                                     jsval* to, OpaqueSeenType* seen);
-
-  // Don't want to be memcpy'ing nsAutoJSValHolders around, so we need a
-  // linked list of receivers.
-  class RecList
-  {
-    JSContext* mCx;
-    class RecNode
-    {
-      nsAutoJSValHolder mHolder;
-    public:
-      RecNode* down;
-      RecNode(JSContext* cx, jsval v) : down(NULL) {
-        mHolder.Hold(cx);
-        mHolder = v;
-      }
-      jsval value() { return mHolder; }
-    }* mHead;
-  public:
-    RecList(JSContext* cx) : mCx(cx), mHead(NULL) {}
-   ~RecList();
-    void add(jsval v);
-    void remove(jsval v);
-    bool copyTo(JSContext *cx, nsTArray<jsval>& dst) const;
-  };
-
-  nsClassHashtable<nsStringHashKey, RecList> mReceivers;
-
-};
-
-} // namespace jetpack
-} // namespace mozilla
-
-#endif
deleted file mode 100644
--- a/js/jetpack/JetpackChild.cpp
+++ /dev/null
@@ -1,588 +0,0 @@
-/* -*- Mode: C++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 8 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla Firefox.
- *
- * The Initial Developer of the Original Code is
- * the Mozilla Foundation <http://www.mozilla.org>.
- * Portions created by the Initial Developer are Copyright (C) 2010
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#include "base/basictypes.h"
-#include "jscntxt.h"
-#include "jswrapper.h"
-#include "nsXULAppAPI.h"
-#include "nsNativeCharsetUtils.h"
-
-#include "mozilla/jetpack/JetpackChild.h"
-#include "mozilla/jetpack/Handle.h"
-#include "mozilla/IntentionalCrash.h"
-
-#include <stdio.h>
-
-namespace mozilla {
-namespace jetpack {
-
-JetpackChild::JetpackChild()
-{
-}
-
-JetpackChild::~JetpackChild()
-{
-}
-
-#define IMPL_METHOD_FLAGS (JSPROP_ENUMERATE | \
-                           JSPROP_READONLY | \
-                           JSPROP_PERMANENT)
-const JSFunctionSpec
-JetpackChild::sImplMethods[] = {
-  JS_FN("sendMessage", SendMessage, 3, IMPL_METHOD_FLAGS),
-  JS_FN("callMessage", CallMessage, 2, IMPL_METHOD_FLAGS),
-  JS_FN("registerReceiver", RegisterReceiver, 2, IMPL_METHOD_FLAGS),
-  JS_FN("unregisterReceiver", UnregisterReceiver, 2, IMPL_METHOD_FLAGS),
-  JS_FN("unregisterReceivers", UnregisterReceivers, 1, IMPL_METHOD_FLAGS),
-  JS_FN("createHandle", CreateHandle, 0, IMPL_METHOD_FLAGS),
-  JS_FN("createSandbox", CreateSandbox, 0, IMPL_METHOD_FLAGS),
-  JS_FN("evalInSandbox", EvalInSandbox, 2, IMPL_METHOD_FLAGS),
-  JS_FN("gc", GC, 0, IMPL_METHOD_FLAGS),
-#ifdef JS_GC_ZEAL
-  JS_FN("gczeal", GCZeal, 1, IMPL_METHOD_FLAGS),
-#endif
-  JS_FN("_noteIntentionalCrash", NoteIntentionalCrash, 0,
-        IMPL_METHOD_FLAGS),
-  JS_FS_END
-};
-
-#undef IMPL_METHOD_FLAGS
-
-const JSClass
-JetpackChild::sGlobalClass = {
-  "JetpackChild::sGlobalClass", JSCLASS_GLOBAL_FLAGS,
-  JS_PropertyStub,  JS_PropertyStub, JS_PropertyStub, JS_StrictPropertyStub,
-  JS_EnumerateStub, JS_ResolveStub,  JS_ConvertStub,  JS_FinalizeStub,
-  JSCLASS_NO_OPTIONAL_MEMBERS
-};
-
-#ifdef BUILD_CTYPES
-static char*
-UnicodeToNative(JSContext *cx, const jschar *source, size_t slen)
-{
-  nsCAutoString native;
-  nsDependentString unicode(source, slen);
-  nsresult rv = NS_CopyUnicodeToNative(unicode, native);
-  if (NS_FAILED(rv)) {
-    JS_ReportError(cx, "could not convert string to native charset");
-    return NULL;
-  }
-
-  char* result = static_cast<char*>(JS_malloc(cx, native.Length() + 1));
-  if (!result)
-    return NULL;
-
-  memcpy(result, native.get(), native.Length() + 1);
-  return result;
-}
-
-static JSCTypesCallbacks sCallbacks = {
-  UnicodeToNative
-};
-#endif
-
-bool
-JetpackChild::Init(base::ProcessHandle aParentProcessHandle,
-                   MessageLoop* aIOLoop,
-                   IPC::Channel* aChannel)
-{
-  if (!Open(aChannel, aParentProcessHandle, aIOLoop))
-    return false;
-
-  if (!(mRuntime = JS_NewRuntime(32L * 1024L * 1024L)) ||
-      !(mCx = JS_NewContext(mRuntime, 8192)))
-    return false;
-
-  JS_SetVersion(mCx, JSVERSION_LATEST);
-  JS_SetOptions(mCx, JS_GetOptions(mCx) |
-                JSOPTION_DONT_REPORT_UNCAUGHT |
-                JSOPTION_ATLINE);
-  JS_SetErrorReporter(mCx, ReportError);
-
-  {
-    JSAutoRequest request(mCx);
-    JS_SetContextPrivate(mCx, this);
-    JSObject* implGlobal =
-      JS_NewCompartmentAndGlobalObject(mCx, const_cast<JSClass*>(&sGlobalClass), NULL);
-    if (!implGlobal)
-        return false;
-
-    JSAutoEnterCompartment ac;
-    if (!ac.enter(mCx, implGlobal))
-        return false;
-
-    jsval ctypes;
-    if (!JS_InitStandardClasses(mCx, implGlobal) ||
-#ifdef BUILD_CTYPES
-        !JS_InitCTypesClass(mCx, implGlobal) ||
-        !JS_GetProperty(mCx, implGlobal, "ctypes", &ctypes) ||
-        !JS_SetCTypesCallbacks(mCx, JSVAL_TO_OBJECT(ctypes), &sCallbacks) ||
-#endif
-        !JS_DefineFunctions(mCx, implGlobal,
-                            const_cast<JSFunctionSpec*>(sImplMethods)))
-      return false;
-  }
-
-  return true;
-}
-
-void
-JetpackChild::CleanUp()
-{
-  ClearReceivers();
-  JS_DestroyContext(mCx);
-  JS_DestroyRuntime(mRuntime);
-  JS_ShutDown();
-}
-
-void
-JetpackChild::ActorDestroy(ActorDestroyReason why)
-{
-  XRE_ShutdownChildProcess();
-}
-
-bool
-JetpackChild::RecvSendMessage(const nsString& messageName,
-                              const InfallibleTArray<Variant>& data)
-{
-  JSAutoRequest request(mCx);
-
-  JSObject *global = JS_GetGlobalObject(mCx);
-  JSAutoEnterCompartment ac;
-  if (!ac.enter(mCx, global))
-    return false;
-
-  return JetpackActorCommon::RecvMessage(mCx, messageName, data, NULL);
-}
-
-bool
-JetpackChild::RecvEvalScript(const nsString& code)
-{
-  JSAutoRequest request(mCx);
-
-  JSObject *global = JS_GetGlobalObject(mCx);
-  JSAutoEnterCompartment ac;
-  if (!ac.enter(mCx, global))
-    return false;
-
-  jsval ignored;
-  (void) JS_EvaluateUCScript(mCx, global, code.get(),
-                             code.Length(), "", 1, &ignored);
-  return true;
-}
-
-PHandleChild*
-JetpackChild::AllocPHandle()
-{
-  return new HandleChild();
-}
-
-bool
-JetpackChild::DeallocPHandle(PHandleChild* actor)
-{
-  delete actor;
-  return true;
-}
-
-JetpackChild*
-JetpackChild::GetThis(JSContext* cx)
-{
-  JetpackChild* self =
-    static_cast<JetpackChild*>(JS_GetContextPrivate(cx));
-  JS_ASSERT(cx == self->mCx);
-  return self;
-}
-
-struct MessageResult {
-  nsString msgName;
-  InfallibleTArray<Variant> data;
-};
-
-static JSBool
-MessageCommon(JSContext* cx, uintN argc, jsval* vp,
-              MessageResult* result)
-{
-  if (argc < 1) {
-    JS_ReportError(cx, "Message requires a name, at least");
-    return JS_FALSE;
-  }
-
-  jsval* argv = JS_ARGV(cx, vp);
-
-  JSString* msgNameStr = JS_ValueToString(cx, argv[0]);
-  if (!msgNameStr) {
-    JS_ReportError(cx, "Could not convert value to string");
-    return JS_FALSE;
-  }
-
-  size_t length;
-  const jschar* chars = JS_GetStringCharsAndLength(cx, msgNameStr, &length);
-  if (!chars)
-      return JS_FALSE;
-
-  result->msgName.Assign(chars, length);
-
-  result->data.Clear();
-
-  if (!result->data.SetCapacity(argc)) {
-    JS_ReportOutOfMemory(cx);
-    return JS_FALSE;
-  }
-
-  for (uintN i = 1; i < argc; ++i) {
-    Variant* vp = result->data.AppendElement();
-    if (!JetpackActorCommon::jsval_to_Variant(cx, argv[i], vp)) {
-      JS_ReportError(cx, "Invalid message argument at position %d", i);
-      return JS_FALSE;
-    }
-  }
-
-  return JS_TRUE;
-}
-
-JSBool
-JetpackChild::SendMessage(JSContext* cx, uintN argc, jsval* vp)
-{
-  MessageResult smr;
-  if (!MessageCommon(cx, argc, vp, &smr))
-    return JS_FALSE;
-
-  if (!GetThis(cx)->SendSendMessage(smr.msgName, smr.data)) {
-    JS_ReportError(cx, "Failed to sendMessage");
-    return JS_FALSE;
-  }
-
-  return JS_TRUE;
-}
-
-JSBool
-JetpackChild::CallMessage(JSContext* cx, uintN argc, jsval* vp)
-{
-  MessageResult smr;
-  if (!MessageCommon(cx, argc, vp, &smr))
-    return JS_FALSE;
-
-  InfallibleTArray<Variant> results;
-  if (!GetThis(cx)->CallCallMessage(smr.msgName, smr.data, &results)) {
-    JS_ReportError(cx, "Failed to callMessage");
-    return JS_FALSE;
-  }
-
-  nsAutoTArray<jsval, 4> jsvals;
-  jsval* rvals = jsvals.AppendElements(results.Length());
-  if (!rvals) {
-    JS_ReportOutOfMemory(cx);
-    return JS_FALSE;
-  }
-  for (PRUint32 i = 0; i < results.Length(); ++i)
-    rvals[i] = JSVAL_VOID;
-  js::AutoArrayRooter root(cx, results.Length(), rvals);
-
-  for (PRUint32 i = 0; i < results.Length(); ++i)
-    if (!jsval_from_Variant(cx, results.ElementAt(i), rvals + i)) {
-      JS_ReportError(cx, "Invalid result from handler %d", i);
-      return JS_FALSE;
-    }
-
-  JSObject* arrObj = JS_NewArrayObject(cx, results.Length(), rvals);
-  if (!arrObj) {
-    JS_ReportOutOfMemory(cx);
-    return JS_FALSE;
-  }
-  JS_SET_RVAL(cx, vp, OBJECT_TO_JSVAL(arrObj));
-
-  return JS_TRUE;
-}
-
-struct ReceiverResult
-{
-  nsString msgName;
-  jsval receiver;
-};
-
-static JSBool
-ReceiverCommon(JSContext* cx, uintN argc, jsval* vp,
-               const char* methodName, uintN arity,
-               ReceiverResult* result)
-{
-  if (argc != arity) {
-    JS_ReportError(cx, "%s requires exactly %d arguments", methodName, arity);
-    return JS_FALSE;
-  }
-
-  // Not currently possible, but think of the future.
-  if (arity < 1)
-    return JS_TRUE;
-
-  jsval* argv = JS_ARGV(cx, vp);
-
-  JSString* str = JS_ValueToString(cx, argv[0]);
-  if (!str) {
-    JS_ReportError(cx, "%s expects a stringifiable value as its first argument",
-                   methodName);
-    return JS_FALSE;
-  }
-
-  size_t length;
-  const jschar* chars = JS_GetStringCharsAndLength(cx, str, &length);
-  if (!chars)
-      return JS_FALSE;
-
-  result->msgName.Assign(chars, length);
-
-  if (arity < 2)
-    return JS_TRUE;
-
-  if (JS_TypeOfValue(cx, argv[1]) != JSTYPE_FUNCTION) {
-    JS_ReportError(cx, "%s expects a function as its second argument",
-                   methodName);
-    return JS_FALSE;
-  }
-
-  // GC-safe because argv is rooted.
-  result->receiver = argv[1];
-
-  return JS_TRUE;
-}
-
-JSBool
-JetpackChild::RegisterReceiver(JSContext* cx, uintN argc, jsval* vp)
-{
-  ReceiverResult rr;
-  if (!ReceiverCommon(cx, argc, vp, "registerReceiver", 2, &rr))
-    return JS_FALSE;
-
-  JetpackActorCommon* actor = GetThis(cx);
-  nsresult rv = actor->RegisterReceiver(cx, rr.msgName, rr.receiver);
-  if (NS_FAILED(rv)) {
-    JS_ReportOutOfMemory(cx);
-    return JS_FALSE;
-  }
-
-  return JS_TRUE;
-}
-
-JSBool
-JetpackChild::UnregisterReceiver(JSContext* cx, uintN argc, jsval* vp)
-{
-  ReceiverResult rr;
-  if (!ReceiverCommon(cx, argc, vp, "unregisterReceiver", 2, &rr))
-    return JS_FALSE;
-
-  JetpackActorCommon* actor = GetThis(cx);
-  actor->UnregisterReceiver(rr.msgName, rr.receiver);
-  return JS_TRUE;
-}
-
-JSBool
-JetpackChild::UnregisterReceivers(JSContext* cx, uintN argc, jsval* vp)
-{
-  ReceiverResult rr;
-  if (!ReceiverCommon(cx, argc, vp, "unregisterReceivers", 1, &rr))
-    return JS_FALSE;
-
-  JetpackActorCommon* actor = GetThis(cx);
-  actor->UnregisterReceivers(rr.msgName);
-  return JS_TRUE;
-}
-
-JSBool
-JetpackChild::CreateHandle(JSContext* cx, uintN argc, jsval* vp)
-{
-  if (argc > 0) {
-    JS_ReportError(cx, "createHandle takes zero arguments");
-    return JS_FALSE;
-  }
-
-  HandleChild* handle;
-  JSObject* hobj;
-
-  PHandleChild* phc = GetThis(cx)->SendPHandleConstructor();
-  if (!(handle = static_cast<HandleChild*>(phc)) ||
-      !(hobj = handle->ToJSObject(cx))) {
-    JS_ReportError(cx, "Failed to construct Handle");
-    return JS_FALSE;
-  }
-
-  JS_SET_RVAL(cx, vp, OBJECT_TO_JSVAL(hobj));
-
-  return JS_TRUE;
-}
-
-JSBool
-JetpackChild::CreateSandbox(JSContext* cx, uintN argc, jsval* vp)
-{
-  if (argc > 0) {
-    JS_ReportError(cx, "createSandbox takes zero arguments");
-    return JS_FALSE;
-  }
-
-  JSObject* obj = JS_NewCompartmentAndGlobalObject(cx, const_cast<JSClass*>(&sGlobalClass), NULL);
-  if (!obj)
-    return JS_FALSE;
-
-  jsval rval = OBJECT_TO_JSVAL(obj);
-  if (!JS_WrapValue(cx, &rval))
-    return JS_FALSE;
-
-  JSAutoEnterCompartment ac;
-  if (!ac.enter(cx, obj))
-    return JS_FALSE;
-
-  JS_SET_RVAL(cx, vp, rval);
-  return JS_InitStandardClasses(cx, obj);
-}
-
-JSBool
-JetpackChild::EvalInSandbox(JSContext* cx, uintN argc, jsval* vp)
-{
-  if (argc != 2) {
-    JS_ReportError(cx, "evalInSandbox takes two arguments");
-    return JS_FALSE;
-  }
-
-  jsval* argv = JS_ARGV(cx, vp);
-
-  JSObject* obj;
-  if (!JSVAL_IS_OBJECT(argv[0]) ||
-      !(obj = JSVAL_TO_OBJECT(argv[0]))) {
-    JS_ReportError(cx, "The first argument to evalInSandbox must be a global object created using createSandbox.");
-    JS_ASSERT(JS_FALSE);
-    return JS_FALSE;
-  }
-
-  // Unwrap, and switch compartments
-  obj = js::UnwrapObject(obj);
-
-  JSAutoEnterCompartment ac;
-  if (!ac.enter(cx, obj))
-    return JS_FALSE;
-
-  if (&sGlobalClass != JS_GetClass(cx, obj) ||
-      obj == JS_GetGlobalObject(cx)) {
-    JS_ReportError(cx, "The first argument to evalInSandbox must be a global object created using createSandbox.");
-    JS_ASSERT(JS_FALSE);
-    return JS_FALSE;
-  }
-
-  if (!JS_WrapValue(cx, &argv[1]))
-    return JS_FALSE;
-
-  JSString* str = JS_ValueToString(cx, argv[1]);
-  if (!str)
-    return JS_FALSE;
-
-  size_t length;
-  const jschar* chars = JS_GetStringCharsAndLength(cx, str, &length);
-  if (!chars)
-      return JS_FALSE;
-
-  js::AutoValueRooter ignored(cx);
-  return JS_EvaluateUCScript(cx, obj, chars, length, "", 1, ignored.jsval_addr());
-}
-
-bool JetpackChild::sReportingError;
-
-/* static */ void
-JetpackChild::ReportError(JSContext* cx, const char* message,
-                          JSErrorReport* report)
-{
-  if (sReportingError) {
-    NS_WARNING("Recursive error reported.");
-    return;
-  }
-
-  sReportingError = true;
-
-  js::AutoObjectRooter obj(cx, JS_NewObject(cx, NULL, NULL, NULL));
-
-  if (report && report->filename) {
-    jsval filename = STRING_TO_JSVAL(JS_NewStringCopyZ(cx, report->filename));
-    JS_SetProperty(cx, obj.object(), "fileName", &filename);
-  }
-
-  if (report) {
-    jsval lineno = INT_TO_JSVAL(report->lineno);
-    JS_SetProperty(cx, obj.object(), "lineNumber", &lineno);
-  }
-
-  jsval msgstr = JSVAL_NULL;
-  if (report && report->ucmessage)
-    msgstr = STRING_TO_JSVAL(JS_NewUCStringCopyZ(cx, report->ucmessage));
-  else
-    msgstr = STRING_TO_JSVAL(JS_NewStringCopyZ(cx, message));
-  JS_SetProperty(cx, obj.object(), "message", &msgstr);
-
-  MessageResult smr;
-  Variant* vp = smr.data.AppendElement();
-  JetpackActorCommon::jsval_to_Variant(cx, OBJECT_TO_JSVAL(obj.object()), vp);
-  GetThis(cx)->SendSendMessage(NS_LITERAL_STRING("core:exception"), smr.data);
-
-  sReportingError = false;
-}
-
-JSBool
-JetpackChild::GC(JSContext* cx, uintN argc, jsval *vp)
-{
-  JS_GC(cx);
-  return JS_TRUE;
-}
-
-#ifdef JS_GC_ZEAL
-JSBool
-JetpackChild::GCZeal(JSContext* cx, uintN argc, jsval *vp)
-{
-  jsval* argv = JS_ARGV(cx, vp);
-
-  uint32 zeal;
-  if (!JS_ValueToECMAUint32(cx, argv[0], &zeal))
-    return JS_FALSE;
-
-  JS_SetGCZeal(cx, PRUint8(zeal), JS_DEFAULT_ZEAL_FREQ, JS_FALSE);
-  return JS_TRUE;
-}
-#endif
-
-JSBool
-JetpackChild::NoteIntentionalCrash(JSContext* cx, uintN argc, jsval *vp)
-{
-  mozilla::NoteIntentionalCrash("jetpack");
-  return JS_TRUE;
-}
-
-} // namespace jetpack
-} // namespace mozilla
deleted file mode 100644
--- a/js/jetpack/JetpackChild.h
+++ /dev/null
@@ -1,111 +0,0 @@
-/* -*- Mode: C++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 8 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla Firefox.
- *
- * The Initial Developer of the Original Code is
- * the Mozilla Foundation <http://www.mozilla.org>.
- * Portions created by the Initial Developer are Copyright (C) 2010
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#ifndef mozilla_jetpack_JetpackChild_h
-#define mozilla_jetpack_JetpackChild_h
-
-#include "mozilla/jetpack/PJetpackChild.h"
-#include "mozilla/jetpack/JetpackActorCommon.h"
-
-#include "nsTArray.h"
-
-namespace mozilla {
-namespace jetpack {
-
-class PHandleChild;
-
-class JetpackChild
-  : public PJetpackChild
-  , private JetpackActorCommon
-{
-public:
-  JetpackChild();
-  ~JetpackChild();
-
-  static JetpackChild* current();
-
-  bool Init(base::ProcessHandle aParentProcessHandle,
-            MessageLoop* aIOLoop,
-            IPC::Channel* aChannel);
-
-  void CleanUp();
-
-protected:
-  NS_OVERRIDE virtual void ActorDestroy(ActorDestroyReason why);
-
-  NS_OVERRIDE virtual bool RecvSendMessage(const nsString& messageName,
-                                           const InfallibleTArray<Variant>& data);
-  NS_OVERRIDE virtual bool RecvEvalScript(const nsString& script);
-
-  NS_OVERRIDE virtual PHandleChild* AllocPHandle();
-  NS_OVERRIDE virtual bool DeallocPHandle(PHandleChild* actor);
-
-private:
-  JSRuntime* mRuntime;
-  JSContext *mCx;
-
-  static JetpackChild* GetThis(JSContext* cx);
-
-  static const JSFunctionSpec sImplMethods[];
-  static JSBool SendMessage(JSContext* cx, uintN argc, jsval *vp);
-  static JSBool CallMessage(JSContext* cx, uintN argc, jsval *vp);
-  static JSBool RegisterReceiver(JSContext* cx, uintN argc, jsval *vp);
-  static JSBool UnregisterReceiver(JSContext* cx, uintN argc, jsval *vp);
-  static JSBool UnregisterReceivers(JSContext* cx, uintN argc, jsval *vp);
-  static JSBool CreateHandle(JSContext* cx, uintN argc, jsval *vp);
-  static JSBool CreateSandbox(JSContext* cx, uintN argc, jsval *vp);
-  static JSBool EvalInSandbox(JSContext* cx, uintN argc, jsval *vp);
-  static JSBool GC(JSContext* cx, uintN argc, jsval *vp);
-#ifdef JS_GC_ZEAL
-  static JSBool GCZeal(JSContext* cx, uintN argc, jsval *vp);
-#endif
-  static JSBool NoteIntentionalCrash(JSContext* cx, uintN argc, jsval *vp);
-
-  static void ReportError(JSContext* cx, const char* message,
-                          JSErrorReport* report);
-
-  static const JSClass sGlobalClass;
-  static bool sReportingError;
-
-  DISALLOW_EVIL_CONSTRUCTORS(JetpackChild);
-};
-
-} // namespace jetpack
-} // namespace mozilla
-
-
-#endif // mozilla_jetpack_JetpackChild_h
deleted file mode 100644
--- a/js/jetpack/JetpackParent.cpp
+++ /dev/null
@@ -1,334 +0,0 @@
-/* -*- Mode: C++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 8 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla Firefox.
- *
- * The Initial Developer of the Original Code is
- * the Mozilla Foundation <http://www.mozilla.org>.
- * Portions created by the Initial Developer are Copyright (C) 2010
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#include "mozilla/jetpack/JetpackParent.h"
-#include "mozilla/jetpack/Handle.h"
-#include "base/process_util.h"
-
-#include "nsIURI.h"
-#include "nsNetUtil.h"
-#include "nsIVariant.h"
-#include "nsIXPConnect.h"
-#include "nsIJSContextStack.h"
-
-#ifdef MOZ_CRASHREPORTER
-#include "nsExceptionHandler.h"
-#endif
-
-namespace mozilla {
-namespace jetpack {
-
-JetpackParent::JetpackParent(JSContext* cx)
-  : mSubprocess(new JetpackProcessParent())
-  , mContext(cx)
-  , mTaskFactory(this)
-{
-  mSubprocess->Launch();
-  Open(mSubprocess->GetChannel(),
-       mSubprocess->GetChildProcessHandle());
-}
-
-JetpackParent::~JetpackParent()
-{
-  if (mSubprocess)
-    Destroy();
-
-  if (OtherProcess())
-    base::CloseProcessHandle(OtherProcess());
-}
-
-NS_IMPL_ISUPPORTS1(JetpackParent, nsIJetpack)
-
-NS_IMETHODIMP
-JetpackParent::SendMessage(const nsAString& aMessageName)
-{
-  nsresult rv;
-  nsCOMPtr<nsIXPConnect> xpc(do_GetService(nsIXPConnect::GetCID(), &rv));
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  nsAXPCNativeCallContext* ncc = NULL;
-  rv = xpc->GetCurrentNativeCallContext(&ncc);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  JSContext* cx;
-  rv = ncc->GetJSContext(&cx);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  PRUint32 argc;
-  rv = ncc->GetArgc(&argc);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  jsval* argv;
-  rv = ncc->GetArgvPtr(&argv);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  nsTArray<Variant> data;
-  NS_ENSURE_TRUE(data.SetCapacity(argc), NS_ERROR_OUT_OF_MEMORY);
-
-  JSAutoRequest request(cx);
-
-  JSAutoEnterCompartment ac;
-  if (!ac.enter(cx, JS_GetGlobalObject(cx)))
-    return false;
-
-  for (PRUint32 i = 1; i < argc; ++i) {
-    if (!JS_WrapValue(cx, &argv[i]) ||
-        !jsval_to_Variant(cx, argv[i], data.AppendElement())) {
-      return NS_ERROR_INVALID_ARG;
-    }
-  }
-
-  InfallibleTArray<Variant> dataForSend;
-  dataForSend.SwapElements(data);
-  if (!SendSendMessage(nsString(aMessageName), dataForSend))
-    return NS_ERROR_FAILURE;
-
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-JetpackParent::RegisterReceiver(const nsAString& aMessageName,
-                                const jsval &aReceiver)
-{
-  return JetpackActorCommon::RegisterReceiver(mContext,
-                                              nsString(aMessageName),
-                                              aReceiver);
-}
-
-NS_IMETHODIMP
-JetpackParent::UnregisterReceiver(const nsAString& aMessageName,
-                                  const jsval &aReceiver)
-{
-  JetpackActorCommon::UnregisterReceiver(nsString(aMessageName),
-                                         aReceiver);
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-JetpackParent::UnregisterReceivers(const nsAString& aMessageName)
-{
-  JetpackActorCommon::UnregisterReceivers(nsString(aMessageName));
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-JetpackParent::EvalScript(const nsAString& aScript)
-{
-  if (!SendEvalScript(nsString(aScript)))
-    return NS_ERROR_FAILURE;
-
-  return NS_OK;
-}
-
-class AutoCXPusher
-{
-public:
-  AutoCXPusher(JSContext* cx)
-    : mCXStack(do_GetService("@mozilla.org/js/xpc/ContextStack;1"))
-  {
-    NS_ASSERTION(mCXStack, "No JS context stack?");
-    if (mCXStack)
-      mCXStack->Push(cx);
-  }
-  ~AutoCXPusher()
-  {
-    if (mCXStack)
-      mCXStack->Pop(NULL);
-  }
-
-private:
-  nsCOMPtr<nsIJSContextStack> mCXStack;
-};
-
-// We have to delete the JetpackProcessParent on the I/O thread after event
-// loop iteration in which JetpackParent::ActorDestroy runs is finished.
-static void
-DelayedDestroyProcess(JetpackProcessParent* o)
-{
-  XRE_GetIOMessageLoop()
-    ->PostTask(FROM_HERE, new DeleteTask<JetpackProcessParent>(o));
-}
-
-void
-JetpackParent::ActorDestroy(ActorDestroyReason why)
-{
-  switch (why) {
-    case AbnormalShutdown: {
-      nsAutoString dumpID;
-
-#ifdef MOZ_CRASHREPORTER
-      nsCOMPtr<nsILocalFile> crashDump;
-      TakeMinidump(getter_AddRefs(crashDump)) &&
-        CrashReporter::GetIDFromMinidump(crashDump, dumpID);
-#endif
-
-      MessageLoop::current()->
-        PostTask(FROM_HERE,
-                 mTaskFactory.NewRunnableMethod(
-                   &JetpackParent::DispatchFailureMessage,
-                   dumpID));
-      break;
-    }
-
-    case NormalShutdown:
-      break;
-
-    default:
-      NS_ERROR("Unexpected actordestroy reason for toplevel actor.");
-  }  
-
-  MessageLoop::current()->
-    PostTask(FROM_HERE, NewRunnableFunction(DelayedDestroyProcess, mSubprocess));
-  mSubprocess = NULL;
-}
-
-bool
-JetpackParent::RecvSendMessage(const nsString& messageName,
-                               const InfallibleTArray<Variant>& data)
-{
-  AutoCXPusher cxp(mContext);
-  JSAutoRequest request(mContext);
-
-  JSAutoEnterCompartment ac;
-  if (!ac.enter(mContext, JS_GetGlobalObject(mContext)))
-    return false;
-
-  return JetpackActorCommon::RecvMessage(mContext, messageName, data, NULL);
-}
-
-bool
-JetpackParent::AnswerCallMessage(const nsString& messageName,
-                                 const InfallibleTArray<Variant>& data,
-                                 InfallibleTArray<Variant>* results)
-{
-  AutoCXPusher cxp(mContext);
-  JSAutoRequest request(mContext);
-
-  JSAutoEnterCompartment ac;
-  if (!ac.enter(mContext, JS_GetGlobalObject(mContext)))
-    return false;
-
-  return JetpackActorCommon::RecvMessage(mContext, messageName, data, results);
-}
-
-NS_IMETHODIMP
-JetpackParent::CreateHandle(nsIVariant** aResult)
-{
-  HandleParent* handle =
-    static_cast<HandleParent*>(SendPHandleConstructor());
-  NS_ENSURE_TRUE(handle, NS_ERROR_OUT_OF_MEMORY);
-
-  nsresult rv;
-  nsCOMPtr<nsIXPConnect> xpc(do_GetService(nsIXPConnect::GetCID(), &rv));
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  JSAutoRequest request(mContext);
-
-  JSAutoEnterCompartment ac;
-  if (!ac.enter(mContext, JS_GetGlobalObject(mContext)))
-    return false;
-
-  JSObject* hobj = handle->ToJSObject(mContext);
-  if (!hobj)
-    return NS_ERROR_FAILURE;
-
-  return xpc->JSToVariant(mContext, OBJECT_TO_JSVAL(hobj), aResult);
-}
-
-NS_IMETHODIMP
-JetpackParent::Destroy()
-{
-  if (mSubprocess)
-    Close();
-
-  NS_ASSERTION(!mSubprocess, "ActorDestroy should have been called.");
-
-  ClearReceivers();
-
-  return NS_OK;
-}
-
-PHandleParent*
-JetpackParent::AllocPHandle()
-{
-  return new HandleParent();
-}
-
-bool
-JetpackParent::DeallocPHandle(PHandleParent* actor)
-{
-  delete actor;
-  return true;
-}
-
-void
-JetpackParent::OnChannelConnected(int32 pid) 
-{
-  ProcessHandle handle;
-  if (!base::OpenPrivilegedProcessHandle(pid, &handle))
-    NS_RUNTIMEABORT("can't open handle to child process");
-
-  SetOtherProcess(handle);
-}
-
-void
-JetpackParent::DispatchFailureMessage(const nsString& aDumpID)
-{
-#ifdef MOZ_CRASHREPORTER
-  CrashReporter::AnnotationTable notes;
-  notes.Init();
-  notes.Put(NS_LITERAL_CSTRING("ProcessType"), NS_LITERAL_CSTRING("jetpack"));
-  // TODO: Additional per-process annotations.
-  CrashReporter::AppendExtraData(aDumpID, notes);
-#endif
-
-  InfallibleTArray<KeyValue> keyvalues;
-  if (!aDumpID.IsEmpty()) {
-    KeyValue kv(NS_LITERAL_STRING("dumpID"), PrimVariant(aDumpID));
-    keyvalues.AppendElement(kv);
-  }
-
-  CompVariant object(keyvalues);
-
-  InfallibleTArray<Variant> arguments;
-  arguments.AppendElement(object);
-
-  RecvSendMessage(NS_LITERAL_STRING("core:process-error"), arguments);
-}
-
-} // namespace jetpack
-} // namespace mozilla
deleted file mode 100644
--- a/js/jetpack/JetpackParent.h
+++ /dev/null
@@ -1,95 +0,0 @@
-/* -*- Mode: C++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 8 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla Firefox.
- *
- * The Initial Developer of the Original Code is
- * the Mozilla Foundation <http://www.mozilla.org>.
- * Portions created by the Initial Developer are Copyright (C) 2010
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *   Ben Newman <mozilla@benjamn.com>
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#ifndef mozilla_jetpack_JetpackParent_h
-#define mozilla_jetpack_JetpackParent_h
-
-#include "mozilla/jetpack/PJetpackParent.h"
-#include "mozilla/jetpack/JetpackProcessParent.h"
-#include "mozilla/jetpack/JetpackActorCommon.h"
-#include "nsIJetpack.h"
-
-#include "nsTArray.h"
-
-struct JSContext;
-
-namespace mozilla {
-namespace jetpack {
-
-class PHandleParent;
-
-class JetpackParent
-  : public PJetpackParent
-  , public nsIJetpack
-  , private JetpackActorCommon
-{
-public:
-  NS_DECL_ISUPPORTS
-  NS_DECL_NSIJETPACK
-
-  JetpackParent(JSContext* cx);
-  ~JetpackParent();
-
-  void OnChannelConnected(int32 pid);
-
-protected:
-  NS_OVERRIDE virtual void ActorDestroy(ActorDestroyReason why);
-
-  NS_OVERRIDE virtual bool RecvSendMessage(const nsString& messageName,
-                                           const InfallibleTArray<Variant>& data);
-  NS_OVERRIDE virtual bool AnswerCallMessage(const nsString& messageName,
-                                             const InfallibleTArray<Variant>& data,
-                                             InfallibleTArray<Variant>* results);
-
-  NS_OVERRIDE virtual PHandleParent* AllocPHandle();
-  NS_OVERRIDE virtual bool DeallocPHandle(PHandleParent* actor);
-
-private:
-  JetpackProcessParent* mSubprocess;
-  JSContext* mContext;
-  ScopedRunnableMethodFactory<JetpackParent> mTaskFactory;
-
-  void DispatchFailureMessage(const nsString& aDumpID);
-
-  DISALLOW_EVIL_CONSTRUCTORS(JetpackParent);
-};
-
-} // namespace jetpack
-} // namespace mozilla
-
-#endif // mozilla_jetpack_JetpackParent_h
deleted file mode 100644
--- a/js/jetpack/JetpackProcessChild.cpp
+++ /dev/null
@@ -1,63 +0,0 @@
-/* -*- Mode: C++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 8 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla Firefox.
- *
- * The Initial Developer of the Original Code is
- * the Mozilla Foundation <http://www.mozilla.org>.
- * Portions created by the Initial Developer are Copyright (C) 2010
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#include "mozilla/ipc/IOThreadChild.h"
-
-#include "mozilla/jetpack/JetpackProcessChild.h"
-
-using mozilla::ipc::IOThreadChild;
-
-namespace mozilla {
-namespace jetpack {
-
-bool
-JetpackProcessChild::Init()
-{
-  mJetpack.Init(ParentHandle(),
-                IOThreadChild::message_loop(),
-                IOThreadChild::channel());
-  return true;
-}
-
-void
-JetpackProcessChild::CleanUp()
-{
-  mJetpack.CleanUp();
-}
-
-} // namespace jetpack
-} // namespace mozilla
deleted file mode 100644
--- a/js/jetpack/JetpackProcessChild.h
+++ /dev/null
@@ -1,79 +0,0 @@
-/* -*- Mode: C++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 8 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla Firefox.
- *
- * The Initial Developer of the Original Code is
- * the Mozilla Foundation <http://www.mozilla.org>.
- * Portions created by the Initial Developer are Copyright (C) 2010
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#ifndef mozilla_jetpack_JetpackProcessChild_h
-#define mozilla_jetpack_JetpackProcessChild_h
-
-#include "mozilla/ipc/ProcessChild.h"
-
-#include "mozilla/jetpack/JetpackChild.h"
-
-namespace mozilla {
-namespace jetpack {
-
-// The JetpackProcessChild class represents the thread where jetpack code is run;
-// the main() thread is the I/O thread of the jetpack process.
-
-class JetpackProcessChild : public mozilla::ipc::ProcessChild
-{
-  typedef mozilla::ipc::ProcessChild ProcessChild;
-
-public:
-  JetpackProcessChild(ProcessHandle aParentHandle)
-    : ProcessChild(aParentHandle)
-  { }
-
-  virtual ~JetpackProcessChild()
-  { }
-
-  NS_OVERRIDE virtual bool Init();
-  NS_OVERRIDE virtual void CleanUp();
-
-  static JetpackProcessChild* current() {
-    return static_cast<JetpackProcessChild*>(ProcessChild::current());
-  }
-
-private:
-  JetpackChild mJetpack;
-
-  DISALLOW_EVIL_CONSTRUCTORS(JetpackProcessChild);
-};
-
-}
-}
-
-#endif // mozilla_jetpack_JetpackProcessChild_h
deleted file mode 100644
--- a/js/jetpack/JetpackProcessParent.cpp
+++ /dev/null
@@ -1,61 +0,0 @@
-/* -*- Mode: C++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 8 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla Firefox.
- *
- * The Initial Developer of the Original Code is
- * the Mozilla Foundation <http://www.mozilla.org>.
- * Portions created by the Initial Developer are Copyright (C) 2010
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#include "mozilla/jetpack/JetpackProcessParent.h"
-
-#include "mozilla/ipc/BrowserProcessSubThread.h"
-
-namespace mozilla {
-namespace jetpack {
-
-JetpackProcessParent::JetpackProcessParent()
-  : mozilla::ipc::GeckoChildProcessHost(GeckoProcessType_Jetpack)
-{
-}
-
-JetpackProcessParent::~JetpackProcessParent()
-{
-}
-
-void
-JetpackProcessParent::Launch()
-{
-  AsyncLaunch();
-}
-
-} // namespace jetpack
-} // namespace mozilla
deleted file mode 100644
--- a/js/jetpack/JetpackProcessParent.h
+++ /dev/null
@@ -1,76 +0,0 @@
-/* -*- Mode: C++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 8 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla Firefox.
- *
- * The Initial Developer of the Original Code is
- * the Mozilla Foundation <http://www.mozilla.org>.
- * Portions created by the Initial Developer are Copyright (C) 2010
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#ifndef mozilla_jetpack_JetpackProcessParent_h
-#define mozilla_jetpack_JetpackProcessParent_h
-
-#include "base/basictypes.h"
-
-#include "base/file_path.h"
-#include "base/scoped_ptr.h"
-#include "base/thread.h"
-#include "base/waitable_event.h"
-#include "chrome/common/child_process_host.h"
-
-#include "mozilla/ipc/GeckoChildProcessHost.h"
-
-namespace mozilla {
-namespace jetpack {
-
-class JetpackProcessParent : mozilla::ipc::GeckoChildProcessHost
-{
-public:
-  JetpackProcessParent();
-  ~JetpackProcessParent();
-
-  /**
-   * Aynchronously launch the jetpack process.
-   */
-  void Launch();
-
-  using mozilla::ipc::GeckoChildProcessHost::GetShutDownEvent;
-  using mozilla::ipc::GeckoChildProcessHost::GetChannel;
-  using mozilla::ipc::GeckoChildProcessHost::GetChildProcessHandle;
-
-private:
-    DISALLOW_EVIL_CONSTRUCTORS(JetpackProcessParent);
-};
-
-} // namespace jetpack
-} // namespace mozilla
-
-#endif // mozilla_jetpack_JetpackProcessParent_h
deleted file mode 100644
--- a/js/jetpack/JetpackService.cpp
+++ /dev/null
@@ -1,103 +0,0 @@
-/* -*- Mode: C++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 8 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla Firefox.
- *
- * The Initial Developer of the Original Code is
- * the Mozilla Foundation <http://www.mozilla.org>.
- * Portions created by the Initial Developer are Copyright (C) 2010
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#include "base/basictypes.h"
-#include "mozilla/jetpack/JetpackService.h"
-
-#include "mozilla/jetpack/JetpackParent.h"
-#include "nsIJetpack.h"
-
-#include "mozilla/ModuleUtils.h"
-
-#include "nsIXPConnect.h"
-
-namespace mozilla {
-namespace jetpack {
-
-NS_IMPL_ISUPPORTS1(JetpackService,
-                   nsIJetpackService)
-
-NS_IMETHODIMP
-JetpackService::CreateJetpack(nsIJetpack** aResult)
-{
-  nsresult rv;
-  nsCOMPtr<nsIXPConnect> xpc(do_GetService(nsIXPConnect::GetCID(), &rv));
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  nsAXPCNativeCallContext* ncc = NULL;
-  rv = xpc->GetCurrentNativeCallContext(&ncc);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  JSContext* cx;
-  rv = ncc->GetJSContext(&cx);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  nsRefPtr<JetpackParent> j = new JetpackParent(cx);
-  *aResult = j.forget().get();
-
-  return NS_OK;
-}
-
-NS_GENERIC_FACTORY_CONSTRUCTOR(JetpackService)
-
-} // namespace jetpack
-} // namespace mozilla
-
-#define JETPACKSERVICE_CID \
-{ 0x4cf18fcd, 0x4247, 0x4388, \
-  { 0xb1, 0x88, 0xb0, 0x72, 0x2a, 0xc0, 0x52, 0x21 } }
-
-NS_DEFINE_NAMED_CID(JETPACKSERVICE_CID);
-
-static const mozilla::Module::CIDEntry kJetpackCIDs[] = {
-  { &kJETPACKSERVICE_CID, false, NULL, mozilla::jetpack::JetpackServiceConstructor },
-  { NULL }
-};
-
-static const mozilla::Module::ContractIDEntry kJetpackContracts[] = {
-  { "@mozilla.org/jetpack/service;1", &kJETPACKSERVICE_CID },
-  { NULL }
-};
-
-static const mozilla::Module kJetpackModule = {
-  mozilla::Module::kVersion,
-  kJetpackCIDs,
-  kJetpackContracts
-};
-
-NSMODULE_DEFN(jetpack) = &kJetpackModule;
-
deleted file mode 100644
--- a/js/jetpack/JetpackService.h
+++ /dev/null
@@ -1,56 +0,0 @@
-/* -*- Mode: C++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 8 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla Firefox.
- *
- * The Initial Developer of the Original Code is
- * the Mozilla Foundation <http://www.mozilla.org>.
- * Portions created by the Initial Developer are Copyright (C) 2010
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#ifndef mozilla_jetpack_JetpackService_h
-#define mozilla_jetpack_JetpackService_h
-
-#include "nsIJetpackService.h"
-
-namespace mozilla {
-namespace jetpack {
-
-class JetpackService : public nsIJetpackService
-{
-public:
-  NS_DECL_ISUPPORTS
-  NS_DECL_NSIJETPACKSERVICE
-};
-
-} // jetpack
-} // mozilla
-
-#endif // mozilla_jetpack_JetpackService_h
deleted file mode 100644
--- a/js/jetpack/Makefile.in
+++ /dev/null
@@ -1,89 +0,0 @@
-# ***** BEGIN LICENSE BLOCK *****
-# Version: MPL 1.1/GPL 2.0/LGPL 2.1
-#
-# The contents of this file are subject to the Mozilla Public License Version
-# 1.1 (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-# http://www.mozilla.org/MPL/
-#
-# Software distributed under the License is distributed on an "AS IS" basis,
-# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
-# for the specific language governing rights and limitations under the
-# License.
-#
-# The Original Code is Mozilla Firefox.
-#
-# The Initial Developer of the Original Code is
-# the Mozilla Foundation <http://www.mozilla.org>.
-# Portions created by the Initial Developer are Copyright (C) 2010
-# the Initial Developer. All Rights Reserved.
-#
-# Contributor(s):
-#
-# Alternatively, the contents of this file may be used under the terms of
-# either the GNU General Public License Version 2 or later (the "GPL"), or
-# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
-# in which case the provisions of the GPL or the LGPL are applicable instead
-# of those above. If you wish to allow use of your version of this file only
-# under the terms of either the GPL or the LGPL, and not to allow others to
-# use your version of this file under the terms of the MPL, indicate your
-# decision by deleting the provisions above and replace them with the notice
-# and other provisions required by the GPL or the LGPL. If you do not delete
-# the provisions above, a recipient may use your version of this file under
-# the terms of any one of the MPL, the GPL or the LGPL.
-#
-# ***** END LICENSE BLOCK *****
-
-DEPTH = ../..
-topsrcdir = @top_srcdir@
-srcdir = @srcdir@
-VPATH = @srcdir@
-
-include $(DEPTH)/config/autoconf.mk
-
-MODULE = jetpack
-LIBRARY_NAME = jetpack_s
-LIBXUL_LIBRARY = 1
-FORCE_STATIC_LIB = 1
-IS_COMPONENT = 1
-EXPORT_LIBRARY = 1
-MODULE_NAME = jetpack
-
-XPIDLSRCS = \
-  nsIJetpackService.idl \
-  nsIJetpack.idl \
-  $(NULL)
-
-EXPORTS_NAMESPACES = mozilla/jetpack
-EXPORTS_mozilla/jetpack = \
-  JetpackProcessChild.h \
-  JetpackProcessParent.h \
-  JetpackParent.h \
-  JetpackChild.h \
-  JetpackService.h \
-  JetpackActorCommon.h \
-  Handle.h \
-  $(NULL)
-
-CPPSRCS = \
-  JetpackParent.cpp \
-  JetpackChild.cpp \
-  JetpackProcessChild.cpp \
-  JetpackProcessParent.cpp \
-  JetpackService.cpp \
-  JetpackActorCommon.cpp \
-  $(NULL)
-
-# For nsDependentJSString
-LOCAL_INCLUDES += \
-  -I$(topsrcdir)/dom/base \
-  $(NULL)
-
-# Bug 629197: disabled jetpack service (and its tests).
-# ifdef ENABLE_TESTS
-# TOOL_DIRS += tests
-# endif
-
-include $(topsrcdir)/config/config.mk
-include $(topsrcdir)/ipc/chromium/chromium-config.mk
-include $(topsrcdir)/config/rules.mk
deleted file mode 100644
--- a/js/jetpack/PHandle.ipdl
+++ /dev/null
@@ -1,56 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
- * vim: set ts=8 sw=4 et tw=80:
- *
- * ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is mozilla.org code.
- *
- * The Initial Developer of the Original Code is
- * The Mozilla Foundation.
- * Portions created by the Initial Developer are Copyright (C) 2010
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *   Ben Newman <mozilla@benjamn.com> (original author)
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either of the GNU General Public License Version 2 or later (the "GPL"),
- * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-include protocol PJetpack;
-
-namespace mozilla {
-namespace jetpack {
-
-async protocol PHandle
-{
-  manager PJetpack or PHandle;
-  manages PHandle;
-both:
-  PHandle();
-  __delete__();
-};
-
-} // namespace jetpack
-} // namespace mozilla
deleted file mode 100644
--- a/js/jetpack/PJetpack.ipdl
+++ /dev/null
@@ -1,91 +0,0 @@
-/* -*- Mode: C++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 8 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla Firefox.
- *
- * The Initial Developer of the Original Code is
- * the Mozilla Foundation <http://www.mozilla.org>.
- * Portions created by the Initial Developer are Copyright (C) 2010
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-include protocol PHandle;
-
-using mozilla::void_t;
-using mozilla::null_t;
-
-namespace mozilla {
-namespace jetpack {
-
-struct KeyValue {
-  nsString key;
-  Variant value;
-};
-
-union PrimVariant {
-  void_t;
-  null_t;
-  bool;
-  int;
-  double;
-  nsString;
-  PHandle;
-};
-
-union CompVariant {
-  KeyValue[];
-  Variant[];
-  size_t; // reference
-};
-  
-union Variant {
-  PrimVariant;
-  CompVariant;
-};
-
-rpc protocol PJetpack
-{
-  manages PHandle;
-both:
-  async SendMessage(nsString messageName,
-                    Variant[] data);
-  async PHandle();
-
-child:
-  async EvalScript(nsString code);
-
-parent:
-  rpc CallMessage(nsString messageName,
-                  Variant[] data)
-    returns (Variant[] results);
-
-};
-
-} // namespace jetpack
-} // namespace mozilla
deleted file mode 100644
--- a/js/jetpack/ipdl.mk
+++ /dev/null
@@ -1,4 +0,0 @@
-IPDLSRCS = \
-  PJetpack.ipdl \
-  PHandle.ipdl \
-  $(NULL)
deleted file mode 100644
--- a/js/jetpack/nsIJetpack.idl
+++ /dev/null
@@ -1,61 +0,0 @@
-/* -*- Mode: C++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 8 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla Firefox.
- *
- * The Initial Developer of the Original Code is
- * the Mozilla Foundation <http://www.mozilla.org>.
- * Portions created by the Initial Developer are Copyright (C) 2010
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#include "nsISupports.idl"
-
-interface nsIVariant;
-
-[scriptable, uuid(61A5BE65-FAF2-4FD1-96DF-B13A7AD7D88D)]
-interface nsIJetpack : nsISupports
-{
-  void sendMessage(in AString aMessageName
-                   /* [optional] in jsval v1,
-                      [optional] in jsval v2,
-                      ... */);
-
-  void registerReceiver(in AString aMessageName,
-                        in jsval aReceiver);
-  void unregisterReceiver(in AString aMessageName,
-                          in jsval aReceiver);
-  void unregisterReceivers(in AString aMessageName);
-
-  void evalScript(in AString aScript);
-
-  nsIVariant createHandle();
-
-  void destroy();
-};
deleted file mode 100644
--- a/js/jetpack/nsIJetpackService.idl
+++ /dev/null
@@ -1,46 +0,0 @@
-/* -*- Mode: C++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 8 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla Firefox.
- *
- * The Initial Developer of the Original Code is
- * the Mozilla Foundation <http://www.mozilla.org>.
- * Portions created by the Initial Developer are Copyright (C) 2010
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#include "nsISupports.idl"
-
-interface nsIJetpack;
-
-[scriptable, uuid(2e097e3e-225f-42a3-87a8-c5c22659fef0)]
-interface nsIJetpackService : nsISupports
-{
-  nsIJetpack createJetpack();
-};
deleted file mode 100644
--- a/js/jetpack/tests/Makefile.in
+++ /dev/null
@@ -1,60 +0,0 @@
-# ***** BEGIN LICENSE BLOCK *****
-# Version: MPL 1.1/GPL 2.0/LGPL 2.1
-#
-# The contents of this file are subject to the Mozilla Public License Version
-# 1.1 (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-# http://www.mozilla.org/MPL/
-#
-# Software distributed under the License is distributed on an "AS IS" basis,
-# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
-# for the specific language governing rights and limitations under the
-# License.
-#
-# The Original Code is mozilla.org code.
-#
-# The Initial Developer of the Original Code is
-# The Mozilla Foundation.
-# Portions created by the Initial Developer are Copyright (C) 2010
-# the Initial Developer. All Rights Reserved.
-#
-# Contributor(s):
-#   Ben Newman <mozilla@benjamn.com> (original author)
-#
-# Alternatively, the contents of this file may be used under the terms of
-# either of the GNU General Public License Version 2 or later (the "GPL"),
-# or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
-# in which case the provisions of the GPL or the LGPL are applicable instead
-# of those above. If you wish to allow use of your version of this file only
-# under the terms of either the GPL or the LGPL, and not to allow others to
-# use your version of this file under the terms of the MPL, indicate your
-# decision by deleting the provisions above and replace them with the notice
-# and other provisions required by the GPL or the LGPL. If you do not delete
-# the provisions above, a recipient may use your version of this file under
-# the terms of any one of the MPL, the GPL or the LGPL.
-#
-# ***** END LICENSE BLOCK *****
-
-DEPTH     = ../../..
-topsrcdir = @top_srcdir@
-srcdir    = @srcdir@
-VPATH     = @srcdir@
-relativesrcdir = js/jetpack/tests
-
-include $(DEPTH)/config/autoconf.mk
-
-MODULE = test_jetpack
-
-XPCSHELL_TESTS = unit
-
-include $(topsrcdir)/config/config.mk
-include $(topsrcdir)/config/rules.mk
-
-ifneq (cocoa,$(MOZ_WIDGET_TOOLKIT)) # Disabled for bug 599475
-MOCHICHROME_FILES = \
-  test_jetpack_crash.xul \
-  $(NULL)
-
-libs:: $(MOCHICHROME_FILES)
-	$(INSTALL) $^ $(DEPTH)/_tests/testing/mochitest/chrome/$(relativesrcdir)
-endif
deleted file mode 100644
--- a/js/jetpack/tests/test_jetpack_crash.xul
+++ /dev/null
@@ -1,82 +0,0 @@
-<?xml version="1.0"?>
-<?xml-stylesheet href="chrome://global/skin/" type="text/css" ?>
-<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
-                 type="text/css" ?>
-
-<window title="Jetpack Crash Test"
-        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-  <script type="application/javascript"
-          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js" />
-
-  <description id="remoteScript">
-  <![CDATA[
-  registerReceiver("testCTypes", function(name, libfile) {
-    var library = ctypes.open(libfile);
-    var zero = new ctypes.intptr_t(8);
-    _noteIntentionalCrash();
-    var badptr = ctypes.cast(zero, ctypes.PointerType(ctypes.int32_t));
-    sendMessage("testCTypes:response", badptr.contents); // should crash here!
-  });
-  ]]>
-  </description>
-
-  <script class="testbody" type="application/javascript">
-  <![CDATA[
-    Components.utils.import("resource://gre/modules/ctypes.jsm");
-    const libURL = "chrome://mochitests/content/chrome/libraries/" +
-      ctypes.libraryName("jsctypes-test");
-
-    SimpleTest.waitForExplicitFinish();
-
-    var jp = Components.classes["@mozilla.org/jetpack/service;1"].
-      getService(Components.interfaces.nsIJetpackService).
-      createJetpack();
-
-    jp.registerReceiver("core:exception", function(msgName, e) {
-      ok(false, "Received exception from remote code: " + uneval(e));
-    });
-
-    jp.registerReceiver("testCTypes:response", function(msgName, v) {
-      ok(false, "Should not have received testCTypes response!");
-      jp.destroy();
-      jp = null;
-      SimpleTest.finish();
-    });
-
-    jp.registerReceiver("core:process-error", function(msgName, e) {
-      ok(true, "Received process-error notification.");
-
-      if ('nsICrashReporter' in Components.interfaces)
-        ok(e.dumpID, "Process error has a dumpID");
-
-      jp.destroy();
-      jp = null;
-
-      SimpleTest.executeSoon(SimpleTest.finish);
-    });
-
-    var remoteScript = document.getElementById('remoteScript').textContent;
-    jp.evalScript(remoteScript);
-
-    var downloadObserver = {
-      onDownloadComplete: function(downloader, request, cx, status, file) {
-        Components.utils.reportError("download status: " + status);
-        try {
-          file.permission = 0700;
-        }
-        catch (e) {
-          Components.utils.reportError(e);
-        }
-        jp.sendMessage('testCTypes', file.path);
-      }
-    };
-    var downloader = Components.classes["@mozilla.org/network/downloader;1"].
-      createInstance(Components.interfaces.nsIDownloader);
-    downloader.init(downloadObserver, null);
-    var channel = Components.classes["@mozilla.org/network/io-service;1"].
-      getService(Components.interfaces.nsIIOService).
-      newChannel(libURL, null, null);
-    channel.asyncOpen(downloader, null);
-  ]]>
-  </script>
-</window>
deleted file mode 100644
--- a/js/jetpack/tests/unit/handle_tests.js
+++ /dev/null
@@ -1,101 +0,0 @@
-function run_handle_tests() {
-  test_sanity();
-  test_safe_iteration();
-  test_local_invalidation();
-  test_long_parent_chain(100);
-  test_invalid_creation();
-}
-
-function test_sanity() {
-  var parent = createHandle(),
-      child = parent.createHandle(),
-      grandchild = child.createHandle();
-
-  do_check_neq(child, parent);
-  do_check_eq(child.parent, parent);
-  do_check_eq(parent.parent, null);
-  do_check_eq(grandchild.parent.parent, parent);
-
-  do_check_true(child.isValid);
-  do_check_true(parent.isValid);
-
-  parent.invalidate();
-}
-
-function test_safe_iteration() {
-  var handle = createHandle(),
-      keys = [];
-  handle.foo = 42;
-  handle.self = handle;
-  for (var k in handle)
-    keys[keys.length] = k;
-  do_check_eq(keys.sort().join("~"),
-              "foo~self");
-  handle.invalidate();
-}
-
-function test_local_invalidation() {
-  var parent = createHandle(),
-      child = parent.createHandle();
-
-  dump("test_local_invalidation\n");
-  
-  child.invalidate();
-  do_check_false(child.isValid);
-  do_check_true(parent.isValid);
-
-  child = parent.createHandle();
-  do_check_true(child.isValid);
-
-  parent.invalidate();
-  parent.invalidate();
-  do_check_false(child.isValid);
-  do_check_false(parent.isValid);
-
-  parent = createHandle();
-  child = parent.createHandle();
-  child = child.createHandle();
-
-  var uncle = parent.createHandle(),
-      sibling = child.parent.createHandle();
-
-  do_check_eq(child.parent.parent, parent);
-  do_check_true(child.parent.isValid);
-
-  child.parent.invalidate();
-  do_check_false(child.isValid);
-  do_check_true(parent.isValid);
-
-  do_check_false(sibling.isValid);
-  do_check_true(uncle.isValid);
-
-  parent.invalidate();
-}
-
-function test_long_parent_chain(len) {
-  const ancestor = createHandle();
-  for (var handle = ancestor, i = 0; i < len; ++i)
-    handle = handle.createHandle();
-  const child = handle;
-
-  while (handle != ancestor)
-    handle = handle.parent;
-
-  do_check_true(child.isValid);
-  ancestor.invalidate();
-  do_check_false(child.isValid);
-}
-
-function test_invalid_creation() {
-  var parent = createHandle(),
-      child = parent.createHandle();
-
-  parent.invalidate();
-
-  do_check_eq(child.parent, null);
-
-  var threw = false;
-  try { child.createHandle(); }
-  catch (x) { threw = true; }
-  do_check_true(threw);
-}
deleted file mode 100644
--- a/js/jetpack/tests/unit/head_jetpack.js
+++ /dev/null
@@ -1,46 +0,0 @@
-const Cc = Components.classes;
-const Ci = Components.interfaces;
-
-function createJetpack(args)
-{
-  var jp = Components.classes["@mozilla.org/jetpack/service;1"].
-    getService(Components.interfaces.nsIJetpackService).
-    createJetpack();
-
-  if (!args.skipRegisterCleanup)
-    do_register_cleanup(function() {
-      jp.destroy();
-    });
-
-  if (!args.skipRegisterError)
-    jp.registerReceiver("core:exception", function(msgName, e) {
-      dump("Received exception from remote code: " + uneval(e) + "\n");
-      do_check_true(false);
-    });
-
-  if (args.scriptFile)
-    jp.evalScript(read_file(args.scriptFile));
-  
-  return jp;
-}
-
-const PR_RDONLY = 0x1;
-
-function read_file(f)
-{
-  var fis = Cc["@mozilla.org/network/file-input-stream;1"]
-    .createInstance(Ci.nsIFileInputStream);
-  fis.init(f, PR_RDONLY, 0444, Ci.nsIFileInputStream.CLOSE_ON_EOF);
-
-  var lis = Cc["@mozilla.org/intl/converter-input-stream;1"]
-    .createInstance(Ci.nsIConverterInputStream);
-  lis.init(fis, "UTF-8", 1024, 0);
-
-  var data = "";
-
-  var r = {};
-  while (lis.readString(0x0FFFFFFF, r))
-    data += r.value;
-
-  return data;
-}
deleted file mode 100644
--- a/js/jetpack/tests/unit/impl.js
+++ /dev/null
@@ -1,87 +0,0 @@
-function echo() {
-  sendMessage.apply(this, arguments);
-}
-
-registerReceiver("echo", echo);
-
-registerReceiver("callback",
-                 function(msgName, data, handle) {
-                   sendMessage("sendback",
-                               callMessage("callback", data)[0],
-                               handle);
-                 });
-
-registerReceiver("gimmeHandle",
-                 function(msgName) {
-                   sendMessage("recvHandle", "ok", createHandle());
-                 });
-
-registerReceiver("kthx",
-                 function(msgName, data, child) {
-                   sendMessage("recvHandleAgain", data + data, child.parent);
-                 });
-
-registerReceiver("echo2", echo);
-
-registerReceiver("multireturn begin",
-                 function() {
-                   var results = callMessage("multireturn");
-                   sendMessage.apply(null, ["multireturn check"].concat(results));
-                 });
-
-registerReceiver("testarray",
-                 function(msgName, array) {
-                   sendMessage("testarray", array.reverse());
-                 });
-
-registerReceiver("test primitive types", echo);
-
-registerReceiver("drop methods", echo);
-
-registerReceiver("exception coping", echo);
-
-registerReceiver("duplicate receivers", echo);
-
-function ok(c, msg)
-{
-  sendMessage("test result", c, msg);
-}
-
-registerReceiver("test sandbox", function() {
-  var addon = createSandbox();
-  ok(typeof(addon) == "object", "typeof(addon)");
-  ok("Date" in addon, "addon.Date exists");
-  ok(addon.Date !== Date, "Date objects are different");
-
-  var fn = "var x; var c = 3; function doit() { x = 12; return 4; }";
-  evalInSandbox(addon, fn);
-
-  ok(addon.x === undefined, "x is undefined");
-  ok(addon.c == 3, "c is 3");
-  ok(addon.doit() == 4, "doit called successfully");
-  ok(addon.x == 12, "x is now 12");
-
-  var fn2 = "let function barbar{}";
-  try {
-    evalInSandbox(addon, fn2);
-    ok(false, "bad syntax should throw");
-  }
-  catch(e) {
-    ok(true, "bad syntax should throw");
-  }
-
-  var fn3 = "throw new Error('just kidding')";
-  try {
-    evalInSandbox(addon, fn3);
-    ok(false, "thrown error should be caught");
-  }
-  catch(e) {
-    ok(true, "thrown error should be caught");
-  }
-
-  sendMessage("sandbox done");
-});
-
-registerReceiver("throw", function(msgName) {
-  throw new Error("throwing on request");
-});
deleted file mode 100644
--- a/js/jetpack/tests/unit/impl_jetpack_ctypes.js
+++ /dev/null
@@ -1,7 +0,0 @@
-const CTYPES_TEST_LIB = ctypes.libraryName("jsctypes-test");
-
-registerReceiver("testCTypes", function(name, libdir) {
-  var library = ctypes.open(libdir + '/' + CTYPES_TEST_LIB);
-  let test_void_t = library.declare("test_void_t_cdecl", ctypes.default_abi, ctypes.void_t);
-  sendMessage("onCTypesTested", test_void_t() === undefined);
-});
deleted file mode 100644
--- a/js/jetpack/tests/unit/impl_rooting.js
+++ /dev/null
@@ -1,5 +0,0 @@
-registerReceiver("ReceiveGCHandle", function(name, handle) {
-  handle.onInvalidate = function() {
-    sendMessage("onInvalidateReceived", handle.isValid);
-  };
-});
deleted file mode 100644
--- a/js/jetpack/tests/unit/test_jetpack.js
+++ /dev/null
@@ -1,204 +0,0 @@
-var jetpack = null;
-
-load("handle_tests.js");
-function createHandle() {
-  return jetpack.createHandle();
-}
-
-function run_test() {
-  jetpack = createJetpack({
-    skipRegisterError: true,
-    scriptFile: do_get_file("impl.js")
-  });
-  run_handle_tests();
-
-  var circ1 = {},
-      circ2 = {},
-      circ3 = {},
-      ok = false;
-  ((circ1.next = circ2).next = circ3).next = circ1;
-  try {
-    jetpack.sendMessage("ignored", circ3, circ1);
-    ok = true;
-  } catch (x) {
-    do_check_false(x);
-  }
-  do_check_true(ok);
-
-  var echoHandle = jetpack.createHandle();
-  echoHandle.payload = { weight: 10 };
-  jetpack.registerReceiver("echo",
-                           function(msgName, data, handle) {
-                             do_check_eq(arguments.length, 3);
-                             do_check_eq(msgName, "echo");
-                             do_check_eq(data, "echo this");
-                             do_check_true(handle.isValid);
-                             do_check_eq(handle, echoHandle);
-                             do_check_eq(handle.payload.weight, 10);
-                             do_test_finished();
-                           });
-
-  jetpack.registerReceiver("callback",
-                           function(msgName, data) {
-                             do_check_eq(msgName, "callback");
-                             return "called back: " + data;
-                           });
-
-  var callbackHandle = echoHandle.createHandle();
-  jetpack.registerReceiver("sendback",
-                           function(msgName, data, handle) {
-                             do_check_eq(msgName, "sendback");
-                             do_check_eq(data, "called back: call me back");
-                             do_check_eq(handle, callbackHandle);
-                             do_test_finished();
-                           });
-
-  var obj;
-  jetpack.registerReceiver("recvHandle",
-                           function(msgName, data, handle) {
-                             handle.mark = obj = {};
-                             jetpack.sendMessage("kthx", data + data, handle.createHandle());
-                           });
-  jetpack.registerReceiver("recvHandleAgain",
-                           function(msgName, data, handle) {
-                             do_check_eq(data, "okokokok");
-                             do_check_eq(handle.mark, obj);
-                             do_test_finished();
-                           });
-  var obj1 = {
-    id: Math.random() + ""
-  }, obj2 = {
-    id: Math.random() + "",
-    obj: obj1
-  };
-  jetpack.registerReceiver("echo2",
-                           function(msgName, a, b) {
-                             do_check_neq(obj1, a);
-                             do_check_neq(obj2, b);
-                             do_check_eq(obj1.id, a.id);
-                             do_check_eq(obj2.id, b.id);
-                             do_check_eq(obj1.id, obj2.obj.id);
-                             do_test_finished();
-                           });
-
-  jetpack.registerReceiver("multireturn", function() { return obj1 });
-  jetpack.registerReceiver("multireturn", function() { return circ1 });
-  jetpack.registerReceiver("multireturn", function() { return obj2 });
-  jetpack.registerReceiver("multireturn check",
-                           function(msgName, rval1, rval2, rval3) {
-                             do_check_eq(rval1.id, obj1.id);
-                             do_check_eq(rval2.next.next.next, rval2);
-                             do_check_eq(rval3.id, obj2.id);
-                             do_check_eq(rval3.obj.id, obj1.id);
-                             do_test_finished();
-                           });
-
-  var testarray = [1, 1, 2, 3, 5, 8, 13];
-  jetpack.registerReceiver("testarray",
-                           function(msgName, reversed) {
-                             for (var i = 0; i < testarray.length; ++i)
-                               do_check_eq(testarray[i],
-                                           reversed[reversed.length - i - 1]);
-                             do_test_finished();
-                           });
-
-  var undefined;
-  jetpack.registerReceiver("test primitive types",
-                           function(msgName,
-                                    void_val, null_val,
-                                    bool_true, bool_false,
-                                    one, two, nine99,
-                                    one_quarter,
-                                    oyez_str)
-                           {
-                             do_check_true(void_val === undefined);
-                             do_check_true(null_val === null);
-                             do_check_true(bool_true === true);
-                             do_check_true(bool_false === false);
-                             do_check_eq(one, 1);
-                             do_check_eq(two, 2);
-                             do_check_eq(nine99, 999);
-                             do_check_eq(one_quarter, 0.25);
-                             do_check_eq(oyez_str, "oyez");
-
-                             do_test_finished();
-                           });
-
-  var drop = {
-    nested: {
-      method: function() { return this.value },
-      value: 42
-    }
-  };
-  jetpack.registerReceiver("drop methods",
-                           function(msgName, echoed) {
-                             do_check_true(!echoed.nested.method);
-                             do_check_eq(echoed.nested.value, 42);
-                             do_test_finished();
-                           });
-
-  var coped = "did not cope";
-  jetpack.registerReceiver("exception coping",
-                           function(msgName) { throw coped = "did cope" });
-  jetpack.registerReceiver("exception coping",
-                           function(msgName) {
-                             do_check_eq(coped, "did cope");
-                             do_test_finished();
-                           });
-
-  var calls = "";
-  function countCalls() { calls += "." }
-  jetpack.registerReceiver("duplicate receivers", countCalls);
-  jetpack.registerReceiver("duplicate receivers", countCalls);
-  jetpack.registerReceiver("duplicate receivers",
-                           function() { do_check_eq(calls, ".") });
-  jetpack.registerReceiver("duplicate receivers", countCalls);
-  jetpack.registerReceiver("duplicate receivers",
-                           function() {
-                             do_check_eq(calls, ".");
-                             jetpack.unregisterReceivers("duplicate receivers");
-                           });
-  jetpack.registerReceiver("duplicate receivers",
-                           function() { do_test_finished() });
-
-  jetpack.registerReceiver("test result", function(name, c, msg) {
-    dump("TEST-INFO | test_jetpack.js | remote check '" + msg + "' result: " + c + "\n");
-    do_check_true(c);
-  });
-  jetpack.registerReceiver("sandbox done", do_test_finished);
-
-  jetpack.registerReceiver("core:exception",
-			   function(msgName, e) {
-			       do_check_true(/throwing on request/.test(e.message));
-			       do_test_finished();
-			   });
-
-  do_test_pending();
-  do_test_pending();
-  do_test_pending();
-  do_test_pending();
-  do_test_pending();
-  do_test_pending();
-  do_test_pending();
-  do_test_pending();
-  do_test_pending();
-  do_test_pending();
-  do_test_pending();
-  do_test_pending();
-
-  jetpack.sendMessage("echo", "echo this", echoHandle);
-  jetpack.sendMessage("callback", "call me back", callbackHandle);
-  jetpack.sendMessage("gimmeHandle");
-  jetpack.sendMessage("echo2", obj1, obj2);
-  jetpack.sendMessage("multireturn begin");
-  jetpack.sendMessage("testarray", testarray);
-  jetpack.sendMessage("test primitive types",
-                      undefined, null, true, false, 1, 2, 999, 1/4, "oyez");
-  jetpack.sendMessage("drop methods", drop);
-  jetpack.sendMessage("exception coping");
-
-  jetpack.sendMessage("duplicate receivers");
-
-  jetpack.sendMessage("test sandbox");
-  jetpack.sendMessage("throw");
-}
deleted file mode 100644
--- a/js/jetpack/tests/unit/test_jetpack_ctypes.js
+++ /dev/null
@@ -1,12 +0,0 @@
-function run_test() {
-  var jetpack = createJetpack({
-    scriptFile: do_get_file("impl_jetpack_ctypes.js")
-  });
-  jetpack.registerReceiver("onCTypesTested", function(name, ok) {
-    do_check_true(ok, "onCTypesTested");
-    do_test_finished();
-  });
-  var jetpacktestdir = do_get_file('../../../../toolkit/components/ctypes/tests/unit').path;
-  jetpack.sendMessage("testCTypes", jetpacktestdir);
-  do_test_pending();
-}
deleted file mode 100644
--- a/js/jetpack/tests/unit/test_jetpack_sandbox.js
+++ /dev/null
@@ -1,19 +0,0 @@
-function run_test() {
-    var jetpack = createJetpack({ scriptFile: do_get_file("impl.js") });
-  
-  var sandbox = Components.utils.Sandbox("about:blank");
-  function registerReceiver(name, fn) {
-    jetpack.registerReceiver(name, fn);
-  }
-  sandbox.registerReceiver = registerReceiver;
-  sandbox.echoed = function(message, arg) {
-    do_check_eq(message, "echo");
-    do_check_eq(arg, "testdata");
-    jetpack.destroy();
-    sandbox = null;
-    do_test_finished();
-  };
-  Components.utils.evalInSandbox("registerReceiver('echo', function(message, arg){ echoed(message, arg); });", sandbox);
-  jetpack.sendMessage("echo", "testdata");
-  do_test_pending();
-}
deleted file mode 100644
--- a/js/jetpack/tests/unit/test_rooting.js
+++ /dev/null
@@ -1,16 +0,0 @@
-function run_test() {
-  return;
-  var jetpack = createJetpack({
-    scriptFile: do_get_file("impl_rooting.js")
-  });
-  jetpack.registerReceiver("onInvalidateReceived", function(name, isValid) {
-    do_check_false(isValid, "onInvalidateReceived: isValid");
-    do_test_finished();
-  });
-  var gchandle = jetpack.createHandle();
-  jetpack.sendMessage("ReceiveGCHandle", gchandle);
-  gchandle.isRooted = false;
-  gchandle = null;
-  do_execute_soon(gc);
-  do_test_pending();
-}
deleted file mode 100644
--- a/js/jetpack/tests/unit/xpcshell.ini
+++ /dev/null
@@ -1,8 +0,0 @@
-[DEFAULT]
-head = head_jetpack.js
-tail = 
-
-[test_jetpack.js]
-[test_jetpack_ctypes.js]
-[test_jetpack_sandbox.js]
-[test_rooting.js]
new file mode 100644
--- /dev/null
+++ b/js/public/MemoryMetrics.h
@@ -0,0 +1,104 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is about:memory glue.
+ *
+ * The Initial Developer of the Original Code is
+ * Ms2ger <ms2ger@gmail.com>.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef js_MemoryMetrics_h
+#define js_MemoryMetrics_h
+
+/*
+ * These declarations are not within jsapi.h because they are highly likely
+ * to change in the future. Depend on them at your own risk.
+ */
+
+#include "jspubtd.h"
+
+#include "js/Utility.h"
+
+namespace JS {
+
+/* Data for tracking analysis/inference memory usage. */
+struct TypeInferenceMemoryStats
+{
+    int64_t scripts;
+    int64_t objects;
+    int64_t tables;
+    int64_t temporary;
+};
+
+extern JS_PUBLIC_API(void)
+SizeOfCompartmentTypeInferenceData(JSContext *cx, JSCompartment *compartment,
+                                   TypeInferenceMemoryStats *stats,
+                                   JSMallocSizeOfFun mallocSizeOf);
+
+extern JS_PUBLIC_API(void)
+SizeOfObjectTypeInferenceData(/*TypeObject*/ void *object,
+                              TypeInferenceMemoryStats *stats,
+                              JSMallocSizeOfFun mallocSizeOf);
+
+extern JS_PUBLIC_API(size_t)
+SizeOfObjectDynamicSlots(JSObject *obj, JSMallocSizeOfFun mallocSizeOf);
+
+extern JS_PUBLIC_API(size_t)
+SizeOfCompartmentShapeTable(JSCompartment *c, JSMallocSizeOfFun mallocSizeOf);
+
+extern JS_PUBLIC_API(size_t)
+SizeOfCompartmentMjitCode(const JSCompartment *c);
+
+extern JS_PUBLIC_API(bool)
+IsShapeInDictionary(const void *shape);
+
+extern JS_PUBLIC_API(size_t)
+SizeOfShapePropertyTable(const void *shape, JSMallocSizeOfFun mallocSizeOf);
+
+extern JS_PUBLIC_API(size_t)
+SizeOfShapeKids(const void *shape, JSMallocSizeOfFun mallocSizeOf);
+
+extern JS_PUBLIC_API(size_t)
+SizeOfScriptData(JSScript *script, JSMallocSizeOfFun mallocSizeOf);
+
+#ifdef JS_METHODJIT
+extern JS_PUBLIC_API(size_t)
+SizeOfScriptJitData(JSScript *script, JSMallocSizeOfFun mallocSizeOf);
+#endif
+
+extern JS_PUBLIC_API(size_t)
+SystemCompartmentCount(const JSRuntime *rt);
+
+extern JS_PUBLIC_API(size_t)
+UserCompartmentCount(const JSRuntime *rt);
+
+} // namespace JS
+
+#endif // js_MemoryMetrics_h
--- a/js/src/Makefile.in
+++ b/js/src/Makefile.in
@@ -264,16 +264,17 @@ VPATH		+= \
 EXPORTS_NAMESPACES += js
 
 # If you add a header here, add it to js/src/jsapi-tests/testIntTypesABI.cpp so
 # that we ensure we don't over-expose our internal integer typedefs.  Note that
 # LegacyIntTypes.h below is deliberately exempted from this requirement.
 EXPORTS_js = \
 		HashTable.h \
 		LegacyIntTypes.h \
+		MemoryMetrics.h \
 		TemplateLib.h \
 		Utility.h \
 		Vector.h \
 		$(NULL)
 
 ###############################################
 # BEGIN include sources for low-level code shared with mfbt
 #
--- a/js/src/jsapi-tests/testIntTypesABI.cpp
+++ b/js/src/jsapi-tests/testIntTypesABI.cpp
@@ -13,16 +13,17 @@
 #include "jscpucfg.h"
 #include "jspubtd.h"
 #include "jsstdint.h"
 #include "jstypes.h"
 #include "jsval.h"
 #include "jsxdrapi.h"
 
 #include "js/HashTable.h"
+#include "js/MemoryMetrics.h"
 #include "js/TemplateLib.h"
 #include "js/Utility.h"
 #include "js/Vector.h"
 
 /*
  * Verify that our public (and intended to be public, versus being that way
  * because we haven't made them private yet) headers don't define
  * {u,}int{8,16,32,64} or JS{Ui,I}nt{8,16,32,64} types.  If any do, they will
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -81,16 +81,17 @@
 #include "jsweakmap.h"
 #include "jswrapper.h"
 #include "jstypedarray.h"
 
 #include "ds/LifoAlloc.h"
 #include "builtin/RegExp.h"
 #include "frontend/BytecodeCompiler.h"
 #include "frontend/BytecodeEmitter.h"
+#include "js/MemoryMetrics.h"
 
 #include "jsatominlines.h"
 #include "jsinferinlines.h"
 #include "jsobjinlines.h"
 #include "jsscopeinlines.h"
 #include "jsscriptinlines.h"
 
 #include "vm/RegExpObject-inl.h"
@@ -918,16 +919,40 @@ JS_GetRuntimePrivate(JSRuntime *rt)
 }
 
 JS_PUBLIC_API(void)
 JS_SetRuntimePrivate(JSRuntime *rt, void *data)
 {
     rt->data = data;
 }
 
+JS_PUBLIC_API(size_t)
+JS::SystemCompartmentCount(const JSRuntime *rt)
+{
+    size_t n = 0;
+    for (size_t i = 0; i < rt->compartments.length(); i++) {
+        if (rt->compartments[i]->isSystemCompartment) {
+            ++n;
+        }
+    }
+    return n;
+}
+
+JS_PUBLIC_API(size_t)
+JS::UserCompartmentCount(const JSRuntime *rt)
+{
+    size_t n = 0;
+    for (size_t i = 0; i < rt->compartments.length(); i++) {
+        if (!rt->compartments[i]->isSystemCompartment) {
+            ++n;
+        }
+    }
+    return n;
+}
+
 #ifdef JS_THREADSAFE
 static void
 StartRequest(JSContext *cx)
 {
     JSThread *t = cx->thread();
     JS_ASSERT(CURRENT_THREAD_IS_ME(t));
 
     if (t->data.requestDepth) {
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -43,22 +43,24 @@
 #include "jsgc.h"
 #include "jsgcmark.h"
 #include "jsiter.h"
 #include "jsmath.h"
 #include "jsproxy.h"
 #include "jsscope.h"
 #include "jswatchpoint.h"
 #include "jswrapper.h"
+
 #include "assembler/wtf/Platform.h"
-#include "yarr/BumpPointerAllocator.h"
+#include "js/MemoryMetrics.h"
 #include "methodjit/MethodJIT.h"
 #include "methodjit/PolyIC.h"
 #include "methodjit/MonoIC.h"
 #include "vm/Debugger.h"
+#include "yarr/BumpPointerAllocator.h"
 
 #include "jsgcinlines.h"
 #include "jsobjinlines.h"
 #include "jsscopeinlines.h"
 
 #if ENABLE_YARR_JIT
 #include "assembler/jit/ExecutableAllocator.h"
 #endif
@@ -137,27 +139,34 @@ JSCompartment::ensureJaegerCompartmentEx
     if (!jc->Initialize()) {
         cx->delete_(jc);
         return false;
     }
     jaegerCompartment_ = jc;
     return true;
 }
 
-void
-JSCompartment::sizeOfCode(size_t *method, size_t *regexp, size_t *unused) const
+size_t
+JSCompartment::sizeOfMjitCode() const
 {
-    if (jaegerCompartment_) {
-        jaegerCompartment_->execAlloc()->sizeOfCode(method, regexp, unused);
-    } else {
-        *method = 0;
-        *regexp = 0;
-        *unused = 0;
-    }
+    if (!jaegerCompartment_)
+        return 0;
+
+    size_t method, regexp, unused;
+    jaegerCompartment_->execAlloc()->sizeOfCode(&method, &regexp, &unused);
+    JS_ASSERT(regexp == 0);
+    return method + unused;
 }
+
+JS_PUBLIC_API(size_t)
+JS::SizeOfCompartmentMjitCode(const JSCompartment *c)
+{
+    return c->sizeOfMjitCode();
+}
+
 #endif
 
 bool
 JSCompartment::wrap(JSContext *cx, Value *vp)
 {
     JS_ASSERT(cx->compartment == this);
 
     uintN flags = 0;
@@ -735,8 +744,17 @@ JSCompartment::sweepBreakpoints(JSContex
 }
 
 GCMarker *
 JSCompartment::createBarrierTracer()
 {
     JS_ASSERT(!gcIncrementalTracer);
     return NULL;
 }
+
+JS_PUBLIC_API(size_t)
+JS::SizeOfCompartmentShapeTable(JSCompartment *c, JSMallocSizeOfFun mallocSizeOf)
+{
+    return c->baseShapes.sizeOfExcludingThis(mallocSizeOf)
+         + c->initialShapes.sizeOfExcludingThis(mallocSizeOf)
+         + c->newTypeObjects.sizeOfExcludingThis(mallocSizeOf)
+         + c->lazyTypeObjects.sizeOfExcludingThis(mallocSizeOf);
+}
--- a/js/src/jscompartment.h
+++ b/js/src/jscompartment.h
@@ -1,9 +1,9 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
@@ -230,17 +230,17 @@ struct JS_FRIEND_API(JSCompartment) {
 
     js::mjit::JaegerCompartment *jaegerCompartment() const {
         JS_ASSERT(jaegerCompartment_);
         return jaegerCompartment_;
     }
 
     bool ensureJaegerCompartmentExists(JSContext *cx);
 
-    void sizeOfCode(size_t *method, size_t *regexp, size_t *unused) const;
+    size_t sizeOfMjitCode() const;
 #endif
 
     /*
      * Shared scope property tree, and arena-pool for allocating its nodes.
      */
     js::PropertyTree             propertyTree;
 
 #ifdef DEBUG
--- a/js/src/jsfriendapi.cpp
+++ b/js/src/jsfriendapi.cpp
@@ -179,29 +179,20 @@ AutoSwitchCompartment::AutoSwitchCompart
 }
 
 AutoSwitchCompartment::~AutoSwitchCompartment()
 {
     /* The old compartment may have been destroyed, so we can't use cx->setCompartment. */
     cx->compartment = oldCompartment;
 }
 
-JS_FRIEND_API(size_t)
-js::GetObjectDynamicSlotSize(JSObject *obj, JSMallocSizeOfFun mallocSizeOf)
+JS_FRIEND_API(bool)
+js::IsSystemCompartment(const JSCompartment *c)
 {
-    return obj->dynamicSlotSize(mallocSizeOf);
-}
-
-JS_FRIEND_API(size_t)
-js::GetCompartmentShapeTableSize(JSCompartment *c, JSMallocSizeOfFun mallocSizeOf)
-{
-    return c->baseShapes.sizeOfExcludingThis(mallocSizeOf)
-         + c->initialShapes.sizeOfExcludingThis(mallocSizeOf)
-         + c->newTypeObjects.sizeOfExcludingThis(mallocSizeOf)
-         + c->lazyTypeObjects.sizeOfExcludingThis(mallocSizeOf);
+    return c->isSystemCompartment;
 }
 
 JS_FRIEND_API(bool)
 js::IsScopeObject(const JSObject *obj)
 {
     return obj->isInternalScope();
 }
 
@@ -219,16 +210,22 @@ js::GetGlobalForObjectCrossCompartment(J
 
 JS_FRIEND_API(uint32_t)
 js::GetObjectSlotSpan(const JSObject *obj)
 {
     return obj->slotSpan();
 }
 
 JS_FRIEND_API(bool)
+js::IsObjectInContextCompartment(const JSObject *obj, const JSContext *cx)
+{
+    return obj->compartment() == cx->compartment;
+}
+
+JS_FRIEND_API(bool)
 js::IsOriginalScriptFunction(JSFunction *fun)
 {
     return fun->script()->function() == fun;
 }
 
 JS_FRIEND_API(JSFunction *)
 js::DefineFunctionWithReserved(JSContext *cx, JSObject *obj, const char *name, JSNative call,
                                uintN nargs, uintN attrs)
--- a/js/src/jsfriendapi.h
+++ b/js/src/jsfriendapi.h
@@ -109,35 +109,16 @@ extern JS_FRIEND_API(void)
 JS_SetAccumulateTelemetryCallback(JSRuntime *rt, JSAccumulateTelemetryDataCallback callback);
 
 typedef void
 (* JSGCFinishedCallback)(JSRuntime *rt, JSCompartment *comp, const char *description);
 
 extern JS_FRIEND_API(void)
 JS_SetGCFinishedCallback(JSRuntime *rt, JSGCFinishedCallback callback);
 
-/* Data for tracking analysis/inference memory usage. */
-typedef struct TypeInferenceMemoryStats
-{
-    int64_t scripts;
-    int64_t objects;
-    int64_t tables;
-    int64_t temporary;
-} TypeInferenceMemoryStats;
-
-extern JS_FRIEND_API(void)
-JS_GetTypeInferenceMemoryStats(JSContext *cx, JSCompartment *compartment,
-                               TypeInferenceMemoryStats *stats,
-                               JSMallocSizeOfFun mallocSizeOf);
-
-extern JS_FRIEND_API(void)
-JS_GetTypeInferenceObjectStats(/*TypeObject*/ void *object,
-                               TypeInferenceMemoryStats *stats,
-                               JSMallocSizeOfFun mallocSizeOf);
-
 extern JS_FRIEND_API(JSPrincipals *)
 JS_GetCompartmentPrincipals(JSCompartment *compartment);
 
 /* Safe to call with input obj == NULL. Returns non-NULL iff obj != NULL. */
 extern JS_FRIEND_API(JSObject *)
 JS_ObjectToInnerObject(JSContext *cx, JSObject *obj);
 
 /* Requires obj != NULL. */
@@ -204,21 +185,18 @@ class JS_FRIEND_API(AutoSwitchCompartmen
     JS_DECL_USE_GUARD_OBJECT_NOTIFIER
 };
 
 #ifdef OLD_GETTER_SETTER_METHODS
 JS_FRIEND_API(JSBool) obj_defineGetter(JSContext *cx, uintN argc, js::Value *vp);
 JS_FRIEND_API(JSBool) obj_defineSetter(JSContext *cx, uintN argc, js::Value *vp);
 #endif
 
-extern JS_FRIEND_API(size_t)
-GetObjectDynamicSlotSize(JSObject *obj, JSMallocSizeOfFun mallocSizeOf);
-
-extern JS_FRIEND_API(size_t)
-GetCompartmentShapeTableSize(JSCompartment *c, JSMallocSizeOfFun mallocSizeOf);
+extern JS_FRIEND_API(bool)
+IsSystemCompartment(const JSCompartment *compartment);
 
 /*
  * Check whether it is OK to assign an undeclared property with name
  * propname of the global object in the current script on cx.  Reports
  * an error if one needs to be reported (in particular in all cases
  * when it returns false).
  */
 extern JS_FRIEND_API(bool)
@@ -428,16 +406,19 @@ JS_FRIEND_API(bool)
 GetPropertyNames(JSContext *cx, JSObject *obj, uintN flags, js::AutoIdVector *props);
 
 JS_FRIEND_API(bool)
 StringIsArrayIndex(JSLinearString *str, jsuint *indexp);
 
 JS_FRIEND_API(void)
 SetPreserveWrapperCallback(JSRuntime *rt, PreserveWrapperCallback callback);
 
+JS_FRIEND_API(bool)
+IsObjectInContextCompartment(const JSObject *obj, const JSContext *cx);
+
 /*
  * NB: these flag bits are encoded into the bytecode stream in the immediate
  * operand of JSOP_ITER, so don't change them without advancing jsxdrapi.h's
  * JSXDR_BYTECODE_VERSION.
  */
 #define JSITER_ENUMERATE  0x1   /* for-in compatible hidden default iterator */
 #define JSITER_FOREACH    0x2   /* return [key, value] pair rather than key */
 #define JSITER_KEYVALUE   0x4   /* destructuring for-in wants [key, value] */
@@ -458,11 +439,20 @@ GetPCCountScriptCount(JSContext *cx);
 
 JS_FRIEND_API(JSString *)
 GetPCCountScriptSummary(JSContext *cx, size_t script);
 
 JS_FRIEND_API(JSString *)
 GetPCCountScriptContents(JSContext *cx, size_t script);
 
 } /* namespace js */
+
+/*
+ * If protoKey is not JSProto_Null, then clasp is ignored. If protoKey is
+ * JSProto_Null, clasp must non-null.
+ */
+extern JS_FRIEND_API(JSBool)
+js_GetClassPrototype(JSContext *cx, JSObject *scope, JSProtoKey protoKey,
+                     JSObject **protop, js::Class *clasp = NULL);
+
 #endif
 
 #endif /* jsfriendapi_h___ */
--- a/js/src/jsgc.h
+++ b/js/src/jsgc.h
@@ -1225,16 +1225,22 @@ struct ArenaLists {
  * chunks with total capacity of 16MB to avoid buffer resizes during browser
  * startup.
  */
 const size_t INITIAL_CHUNK_CAPACITY = 16 * 1024 * 1024 / ChunkSize;
 
 /* The number of GC cycles an empty chunk can survive before been released. */
 const size_t MAX_EMPTY_CHUNK_AGE = 4;
 
+inline Cell *
+AsCell(JSObject *obj)
+{
+    return reinterpret_cast<Cell *>(obj);
+}
+
 } /* namespace gc */
 
 struct GCPtrHasher
 {
     typedef void *Lookup;
 
     static HashNumber hash(void *key) {
         return HashNumber(uintptr_t(key) >> JS_GCTHING_ZEROBITS);
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -51,16 +51,17 @@
 #include "jsobj.h"
 #include "jsscript.h"
 #include "jscntxt.h"
 #include "jsscope.h"
 #include "jsstr.h"
 #include "jsiter.h"
 
 #include "frontend/TokenStream.h"
+#include "js/MemoryMetrics.h"
 #include "methodjit/MethodJIT.h"
 #include "methodjit/Retcon.h"
 
 #include "jsatominlines.h"
 #include "jsgcinlines.h"
 #include "jsinferinlines.h"
 #include "jsobjinlines.h"
 #include "jsscriptinlines.h"
@@ -6289,30 +6290,30 @@ GetScriptMemoryStats(JSScript *script, T
     TypeResult *result = typeScript->dynamicList;
     while (result) {
         stats->scripts += mallocSizeOf(result, sizeof(TypeResult));
         result = result->next;
     }
 
     /*
      * This counts memory that is in the temp pool but gets attributed
-     * elsewhere.  See JS_GetTypeInferenceMemoryStats for more details.
+     * elsewhere.  See JS::SizeOfCompartmentTypeInferenceData for more details.
      */
     TypeSet *typeArray = typeScript->typeArray();
     for (unsigned i = 0; i < count; i++) {
         size_t bytes = typeArray[i].dynamicSize();
         stats->scripts += bytes;
         stats->temporary -= bytes;
     }
 }
 
-JS_FRIEND_API(void)
-JS_GetTypeInferenceMemoryStats(JSContext *cx, JSCompartment *compartment,
-                               TypeInferenceMemoryStats *stats,
-                               JSMallocSizeOfFun mallocSizeOf)
+JS_PUBLIC_API(void)
+JS::SizeOfCompartmentTypeInferenceData(JSContext *cx, JSCompartment *compartment,
+                                       TypeInferenceMemoryStats *stats,
+                                       JSMallocSizeOfFun mallocSizeOf)
 {
     /*
      * Note: not all data in the pool is temporary, and some will survive GCs
      * by being copied to the replacement pool. This memory will be counted
      * elsewhere and deducted from the amount of temporary data.
      */
     stats->temporary += compartment->typeLifoAlloc.sizeOfExcludingThis(mallocSizeOf);
 
@@ -6345,18 +6346,18 @@ JS_GetTypeInferenceMemoryStats(JSContext
 
             /* key.ids and values.types have the same length. */
             stats->tables += mallocSizeOf(key.ids, key.nslots * sizeof(jsid)) +
                              mallocSizeOf(value.types, key.nslots * sizeof(Type));
         }
     }
 }
 
-JS_FRIEND_API(void)
-JS_GetTypeInferenceObjectStats(void *object_, TypeInferenceMemoryStats *stats, JSMallocSizeOfFun mallocSizeOf)
+JS_PUBLIC_API(void)
+JS::SizeOfObjectTypeInferenceData(void *object_, TypeInferenceMemoryStats *stats, JSMallocSizeOfFun mallocSizeOf)
 {
     TypeObject *object = (TypeObject *) object_;
 
     if (object->singleton) {
         /*
          * Properties and associated type sets for singletons are cleared on
          * every GC. The type object is normally destroyed too, but we don't
          * charge this to 'temporary' as this is not for GC heap values.
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -77,16 +77,17 @@
 #include "jsdbgapi.h"
 #include "json.h"
 #include "jswatchpoint.h"
 #include "jswrapper.h"
 
 #include "frontend/BytecodeCompiler.h"
 #include "frontend/BytecodeEmitter.h"
 #include "frontend/Parser.h"
+#include "js/MemoryMetrics.h"
 
 #include "jsarrayinlines.h"
 #include "jsinterpinlines.h"
 #include "jsobjinlines.h"
 #include "jsscopeinlines.h"
 #include "jsscriptinlines.h"
 #include "jsstrinlines.h"
 
@@ -7125,16 +7126,22 @@ js::HandleNonGenericMethodClassMismatch(
         if (thisObj.isProxy())
             return Proxy::nativeCall(cx, &thisObj, clasp, native, args);
     }
 
     ReportIncompatibleMethod(cx, args, clasp);
     return false;
 }
 
+JS_PUBLIC_API(size_t)
+JS::SizeOfObjectDynamicSlots(JSObject *obj, JSMallocSizeOfFun mallocSizeOf)
+{
+    return obj->dynamicSlotSize(mallocSizeOf);
+}
+
 #ifdef DEBUG
 
 /*
  * Routines to print out values during debugging.  These are FRIEND_API to help
  * the debugger find them and to support temporarily hacking js_Dump* calls
  * into other code.
  */
 
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -1891,24 +1891,16 @@ CheckAccess(JSContext *cx, JSObject *obj
             js::Value *vp, uintN *attrsp);
 
 } /* namespace js */
 
 extern bool
 js_IsDelegate(JSContext *cx, JSObject *obj, const js::Value &v);
 
 /*
- * If protoKey is not JSProto_Null, then clasp is ignored. If protoKey is
- * JSProto_Null, clasp must non-null.
- */
-extern JS_FRIEND_API(JSBool)
-js_GetClassPrototype(JSContext *cx, JSObject *scope, JSProtoKey protoKey,
-                     JSObject **protop, js::Class *clasp = NULL);
-
-/*
  * Wrap boolean, number or string as Boolean, Number or String object.
  * *vp must not be an object, null or undefined.
  */
 extern JSBool
 js_PrimitiveToObject(JSContext *cx, js::Value *vp);
 
 /*
  * v and vp may alias. On successful return, vp->isObjectOrNull(). If vp is not
--- a/js/src/jsscope.cpp
+++ b/js/src/jsscope.cpp
@@ -54,16 +54,18 @@
 #include "jscntxt.h"
 #include "jsdbgapi.h"
 #include "jslock.h"
 #include "jsnum.h"
 #include "jsobj.h"
 #include "jsscope.h"
 #include "jsstr.h"
 
+#include "js/MemoryMetrics.h"
+
 #include "jsatominlines.h"
 #include "jsobjinlines.h"
 #include "jsscopeinlines.h"
 
 using namespace js;
 using namespace js::gc;
 
 bool
@@ -1469,8 +1471,26 @@ JSCompartment::sweepInitialShapeTable(JS
     if (initialShapes.initialized()) {
         for (InitialShapeSet::Enum e(initialShapes); !e.empty(); e.popFront()) {
             const InitialShapeEntry &entry = e.front();
             if (!entry.shape->isMarked() || (entry.proto && !entry.proto->isMarked()))
                 e.removeFront();
         }
     }
 }
+
+JS_PUBLIC_API(bool)
+JS::IsShapeInDictionary(const void *shape)
+{
+    return static_cast<const Shape*>(shape)->inDictionary();
+}
+
+JS_PUBLIC_API(size_t)
+JS::SizeOfShapePropertyTable(const void *shape, JSMallocSizeOfFun mallocSizeOf)
+{
+    return static_cast<const Shape*>(shape)->sizeOfPropertyTable(mallocSizeOf);
+}
+
+JS_PUBLIC_API(size_t)
+JS::SizeOfShapeKids(const void *shape, JSMallocSizeOfFun mallocSizeOf)
+{
+    return static_cast<const Shape*>(shape)->sizeOfKids(mallocSizeOf);
+}
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -63,16 +63,17 @@
 #include "jsscope.h"
 #include "jsscript.h"
 #if JS_HAS_XDR
 #include "jsxdrapi.h"
 #endif
 
 #include "frontend/BytecodeEmitter.h"
 #include "frontend/Parser.h"
+#include "js/MemoryMetrics.h"
 #include "methodjit/MethodJIT.h"
 #include "methodjit/Retcon.h"
 #include "vm/Debugger.h"
 
 #include "jsinferinlines.h"
 #include "jsinterpinlines.h"
 #include "jsobjinlines.h"
 #include "jsscriptinlines.h"
@@ -1306,16 +1307,22 @@ JSScript::dataSize(JSMallocSizeOfFun mal
 #if JS_SCRIPT_INLINE_DATA_LIMIT
     if (data == inlineData)
         return 0;
 #endif
 
     return mallocSizeOf(data, dataSize());
 }
 
+JS_PUBLIC_API(size_t)
+JS::SizeOfScriptData(JSScript *script, JSMallocSizeOfFun mallocSizeOf)
+{
+    return script->dataSize(mallocSizeOf);
+}
+
 /*
  * Nb: srcnotes are variable-length.  This function computes the number of
  * srcnote *slots*, which may be greater than the number of srcnotes.
  */
 uint32_t
 JSScript::numNotes()
 {
     jssrcnote *sn;
--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@@ -646,18 +646,18 @@ struct JSScript : public js::gc::Cell {
         void *addr = constructing ? jitArityCheckCtor : jitArityCheckNormal;
         if (addr == NULL)
             return JITScript_None;
         if (addr == JS_UNJITTABLE_SCRIPT)
             return JITScript_Invalid;
         return JITScript_Valid;
     }
 
-    /* Size of the JITScript and all sections.  (This method is implemented in MethodJIT.h.) */
-    JS_FRIEND_API(size_t) jitDataSize(JSMallocSizeOfFun mallocSizeOf);
+    /* Size of the JITScript and all sections.  (This method is implemented in MethodJIT.cpp.) */
+    size_t jitDataSize(JSMallocSizeOfFun mallocSizeOf);
 
 #endif
 
     /* Counter accessors. */
     js::OpcodeCounts getCounts(jsbytecode *pc) {
         JS_ASSERT(size_t(pc - code) < length);
         return pcCounters.counts[pc - code];
     }
--- a/js/src/methodjit/MethodJIT.cpp
+++ b/js/src/methodjit/MethodJIT.cpp
@@ -35,16 +35,17 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "MethodJIT.h"
 #include "Logging.h"
 #include "assembler/jit/ExecutableAllocator.h"
 #include "assembler/assembler/RepatchBuffer.h"
+#include "js/MemoryMetrics.h"
 #include "jsgcmark.h"
 #include "BaseAssembler.h"
 #include "Compiler.h"
 #include "MonoIC.h"
 #include "PolyIC.h"
 #include "TrampolineCompiler.h"
 #include "jscntxtinlines.h"
 #include "jscompartment.h"
@@ -1307,16 +1308,22 @@ JSScript::jitDataSize(JSMallocSizeOfFun 
     size_t n = 0;
     if (jitNormal)
         n += jitNormal->scriptDataSize(mallocSizeOf); 
     if (jitCtor)
         n += jitCtor->scriptDataSize(mallocSizeOf); 
     return n;
 }
 
+JS_PUBLIC_API(size_t)
+JS::SizeOfScriptJitData(JSScript *script, JSMallocSizeOfFun mallocSizeOf)
+{
+    return script->jitDataSize(mallocSizeOf);
+}
+
 /* Please keep in sync with Compiler::finishThisUp! */
 size_t
 mjit::JITScript::scriptDataSize(JSMallocSizeOfFun mallocSizeOf)
 {
     size_t computedSize =
         sizeof(JITScript) +
         sizeof(NativeMapEntry) * nNmapPairs +
         sizeof(InlineFrame) * nInlineFrames +
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -3820,21 +3820,19 @@ Deserialize(JSContext *cx, uintN argc, j
 }
 
 JSBool
 MJitCodeStats(JSContext *cx, uintN argc, jsval *vp)
 {
 #ifdef JS_METHODJIT
     JSRuntime *rt = cx->runtime;
     AutoLockGC lock(rt);
-    size_t n = 0, method, regexp, unused;
-    for (JSCompartment **c = rt->compartments.begin(); c != rt->compartments.end(); ++c)
-    {
-        (*c)->sizeOfCode(&method, &regexp, &unused);
-        n += method + regexp + unused;
+    size_t n = 0;
+    for (JSCompartment **c = rt->compartments.begin(); c != rt->compartments.end(); ++c) {
+        n += (*c)->sizeOfMjitCode();
     }
     JS_SET_RVAL(cx, vp, INT_TO_JSVAL(n));
 #else
     JS_SET_RVAL(cx, vp, JSVAL_VOID);
 #endif
     return true;
 }
 
--- a/js/xpconnect/src/Makefile.in
+++ b/js/xpconnect/src/Makefile.in
@@ -81,24 +81,24 @@ CPPSRCS		= \
 		XPCWrappedNativeJSOps.cpp \
 		XPCWrappedNativeProto.cpp \
 		XPCWrappedNativeScope.cpp \
 		XPCJSWeakReference.cpp \
 		XPCWrapper.cpp \
 		XPCQuickStubs.cpp \
 		dom_quickstubs.cpp \
 		dombindings.cpp \
+		DictionaryHelpers.cpp \
 		$(NULL)
 
 include $(topsrcdir)/config/config.mk
 
 LOCAL_INCLUDES = \
 		-I$(srcdir)/../wrappers \
 		-I$(srcdir)/../loader \
-		-I$(topsrcdir)/js/src \
 		-I$(topsrcdir)/caps/include \
 		-I$(topsrcdir)/content/base/src \
 		-I$(topsrcdir)/content/html/content/src \
 		-I$(topsrcdir)/content/html/document/src \
 		-I$(topsrcdir)/content/svg/content/src \
 		-I$(topsrcdir)/layout/style \
 		-I$(topsrcdir)/layout/base \
 		-I$(topsrcdir)/dom/base \
@@ -186,23 +186,68 @@ dombindings_gen.cpp: $(srcdir)/dombindin
 	  -I$(topsrcdir)/xpcom/idl-parser \
 	  $(srcdir)/dombindingsgen.py \
 	  --idlpath=$(DEPTH)/dist/idl \
 	  --cachedir=$(DEPTH)/xpcom/idl-parser/cache \
 	  --stub-output dombindings_gen.cpp \
 	  --makedepend-output $(MDDEPDIR)/dombindingsgen.pp \
 	  $(srcdir)/dombindings.conf
 
+DictionaryHelpers.$(OBJ_SUFFIX): DictionaryHelpers.h \
+                                 DictionaryHelpers.cpp
+
+DictionaryHelpers.h: $(srcdir)/dictionary_helper_gen.conf \
+                     $(srcdir)/dictionary_helper_gen.py \
+                     $(srcdir)/codegen.py \
+                     $(topsrcdir)/xpcom/idl-parser/header.py \
+                     $(topsrcdir)/xpcom/idl-parser/xpidl.py \
+                     $(DEPTH)/js/src/js-confdefs.h
+	$(PYTHON) $(topsrcdir)/config/pythonpath.py \
+	  -I$(topsrcdir)/other-licenses/ply \
+	  -I$(topsrcdir)/xpcom/idl-parser \
+	  $(srcdir)/dictionary_helper_gen.py \
+	  -I $(DEPTH)/dist/idl \
+	  --cachedir=$(DEPTH)/xpcom/idl-parser/cache \
+	  --header-output DictionaryHelpers.h \
+	  $(srcdir)/dictionary_helper_gen.conf
+
+DictionaryHelpers.cpp: $(srcdir)/dictionary_helper_gen.conf \
+                       $(srcdir)/dictionary_helper_gen.py \
+                       $(srcdir)/codegen.py \
+                       $(topsrcdir)/xpcom/idl-parser/header.py \
+                       $(topsrcdir)/xpcom/idl-parser/xpidl.py \
+                       $(DEPTH)/js/src/js-confdefs.h
+	$(PYTHON) $(topsrcdir)/config/pythonpath.py \
+	  -I$(topsrcdir)/other-licenses/ply \
+	  -I$(topsrcdir)/xpcom/idl-parser \
+	  $(srcdir)/dictionary_helper_gen.py \
+	  -I $(DEPTH)/dist/idl \
+	  --cachedir=$(DEPTH)/xpcom/idl-parser/cache \
+	  --header-output DictionaryHelpers.h \
+	  --stub-output DictionaryHelpers.cpp \
+	  --makedepend-output $(MDDEPDIR)/dictionary_helper_gen.pp \
+	  $(srcdir)/dictionary_helper_gen.conf
+
+_EXTRA_EXPORT_FILES = \
+  DictionaryHelpers.h \
+  $(NULL)
+
+libs:: $(_EXTRA_EXPORT_FILES)
+	$(INSTALL) $(foreach f,$^,"$f") $(DEPTH)/dist/include
+
 GARBAGE += \
 		dom_quickstubs.h \
 		dom_quickstubs.cpp \
 		dombindings_gen.h \
 		dombindings_gen.cpp \
+		DictionaryHelpers.h \
+		DictionaryHelpers.cpp \
 		xpidl_debug \
 		$(MDDEPDIR)/dom_qsgen.pp \
 		$(MDDEPDIR)/dombindingsgen.pp \
+		$(MDDEPDIR)/dictionary_helper_gen.pp \
 		$(wildcard $(topsrcdir)/other-licenses/ply/ply/*.pyc) \
 		$(wildcard $(topsrcdir)/xpcom/idl-parser/*.pyc) \
 		$(NULL)
 
 GARBAGE_DIRS += $(DEPTH)/xpcom/idl-parser/cache
 
 DEFINES += -D_IMPL_NS_LAYOUT
--- a/js/xpconnect/src/XPCConvert.cpp
+++ b/js/xpconnect/src/XPCConvert.cpp
@@ -142,75 +142,44 @@ AddXPCOMUCStringFinalizer()
 //static
 void
 XPCConvert::RemoveXPCOMUCStringFinalizer()
 {
     JS_RemoveExternalStringFinalizer(FinalizeXPCOMUCString);
     sXPCOMUCStringFinalizerIndex = -1;
 }
 
-
-#define FIT_U32(i)     ((i) <= JSVAL_INT_MAX                                  \
-                        ? INT_TO_JSVAL(i)                                     \
-                        : DOUBLE_TO_JSVAL(i))
-
-/*
- * Support for 64 bit conversions where 'long long' not supported.
- * (from John Fairhurst <mjf35@cam.ac.uk>)
- */
-
-#ifdef HAVE_LONG_LONG
-
-#define INT64_TO_DOUBLE(i)      ((jsdouble) (i))
-// Win32 can't handle uint64 to double conversion
-#define UINT64_TO_DOUBLE(u)     ((jsdouble) (int64) (u))
-
-#else
-
-inline jsdouble
-INT64_TO_DOUBLE(const int64 &v)
-{
-    jsdouble d;
-    LL_L2D(d, v);
-    return d;
-}
-
-// if !HAVE_LONG_LONG, then uint64 is a typedef of int64
-#define UINT64_TO_DOUBLE INT64_TO_DOUBLE
-
-#endif
-
 // static
 JSBool
 XPCConvert::NativeData2JS(XPCLazyCallContext& lccx, jsval* d, const void* s,
                           const nsXPTType& type, const nsID* iid, nsresult* pErr)
 {
     NS_PRECONDITION(s, "bad param");
     NS_PRECONDITION(d, "bad param");
 
    JSContext* cx = lccx.GetJSContext();
 
     // Allow wrong compartment or unset ScopeForNewObject when the caller knows
     // the value is primitive (viz., XPCNativeMember::GetConstantValue).
     NS_ABORT_IF_FALSE(type.IsArithmetic() ||
-                      cx->compartment == js::GetObjectCompartment(lccx.GetScopeForNewJSObjects()),
+                      js::IsObjectInContextCompartment(lccx.GetScopeForNewJSObjects(), cx),
                       "bad scope for new JSObjects");
 
     if (pErr)
         *pErr = NS_ERROR_XPC_BAD_CONVERT_NATIVE;
 
     switch (type.TagPart()) {
     case nsXPTType::T_I8    : *d = INT_TO_JSVAL(int32_t(*((int8_t*)s)));             break;
     case nsXPTType::T_I16   : *d = INT_TO_JSVAL(int32_t(*((int16_t*)s)));            break;
     case nsXPTType::T_I32   : *d = INT_TO_JSVAL(*((int32_t*)s));                     break;
-    case nsXPTType::T_I64   : *d = DOUBLE_TO_JSVAL(INT64_TO_DOUBLE(*((int64*)s)));   break;
-    case nsXPTType::T_U8    : *d = INT_TO_JSVAL(int32_t(*((uint8*)s)));              break;
+    case nsXPTType::T_I64   : *d = DOUBLE_TO_JSVAL(jsdouble(*((int64_t*)s)));        break;
+    case nsXPTType::T_U8    : *d = INT_TO_JSVAL(int32_t(*((uint8_t*)s)));            break;
     case nsXPTType::T_U16   : *d = INT_TO_JSVAL(int32_t(*((uint16_t*)s)));           break;
-    case nsXPTType::T_U32   : *d = FIT_U32(*((uint32_t*)s));                         break;
-    case nsXPTType::T_U64   : *d = DOUBLE_TO_JSVAL(UINT64_TO_DOUBLE(*((uint64*)s))); break;
+    case nsXPTType::T_U32   : *d = UINT_TO_JSVAL(*((uint32_t*)s));                   break;
+    case nsXPTType::T_U64   : *d = DOUBLE_TO_JSVAL(jsdouble(*((uint64_t*)s)));       break;
     case nsXPTType::T_FLOAT : *d = DOUBLE_TO_JSVAL(*((float*)s));                    break;
     case nsXPTType::T_DOUBLE: *d = DOUBLE_TO_JSVAL(*((double*)s));                   break;
     case nsXPTType::T_BOOL  :
         {
             bool b = *((bool*)s);
 
             NS_WARN_IF_FALSE(b == 1 || b == 0,
                              "Passing a malformed bool through XPConnect");
@@ -522,26 +491,21 @@ XPCConvert::JSData2Native(XPCCallContext
     case nsXPTType::T_U32    :
         if (!JS_ValueToECMAUint32(cx, s, (uint32_t*)d))
             return false;
         break;
     case nsXPTType::T_U64    :
         if (JSVAL_IS_INT(s)) {
             if (!JS_ValueToECMAUint32(cx, s, &tu))
                 return false;
-            *((int64_t*)d) = tu;
+            *((uint64_t*)d) = tu;
         } else {
             if (!JS_ValueToNumber(cx, s, &td))
                 return false;
-#ifdef XP_WIN
-            // Note: Win32 can't handle double to uint64 directly
-            *((uint64_t*)d) = uint64_t(int64_t(td));
-#else
             *((uint64_t*)d) = uint64_t(td);
-#endif
         }
         break;
     case nsXPTType::T_FLOAT  :
         if (!JS_ValueToNumber(cx, s, &td))
             return false;
         *((float*)d) = (float) td;
         break;
     case nsXPTType::T_DOUBLE :
@@ -964,17 +928,17 @@ XPCConvert::NativeInterface2JSObject(XPC
     // We used to have code here that unwrapped and simply exposed the
     // underlying JSObject. That caused anomolies when JSComponents were
     // accessed from other JS code - they didn't act like other xpconnect
     // wrapped components. So, instead, we create "double wrapped" objects
     // (that means an XPCWrappedNative around an nsXPCWrappedJS). This isn't
     // optimal -- we could detect this and roll the functionality into a
     // single wrapper, but the current solution is good enough for now.
     JSContext* cx = lccx.GetJSContext();
-    NS_ABORT_IF_FALSE(js::GetObjectCompartment(lccx.GetScopeForNewJSObjects()) == cx->compartment,
+    NS_ABORT_IF_FALSE(js::IsObjectInContextCompartment(lccx.GetScopeForNewJSObjects(), cx),
                       "bad scope for new JSObjects");
 
     JSObject *jsscope = lccx.GetScopeForNewJSObjects();
     XPCWrappedNativeScope* xpcscope =
         XPCWrappedNativeScope::FindInJSObjectScope(cx, jsscope);
     if (!xpcscope)
         return false;
 
@@ -1010,17 +974,17 @@ XPCConvert::NativeInterface2JSObject(XPC
                 return CreateHolderIfNeeded(ccx, flat, d, dest);
             }
         }
 
         if (!dest) {
             if (!flat) {
                 tryConstructSlimWrapper = true;
             } else if (IS_SLIM_WRAPPER_OBJECT(flat)) {
-                if (js::GetObjectCompartment(flat) == cx->compartment) {
+                if (js::IsObjectInContextCompartment(flat, cx)) {
                     *d = OBJECT_TO_JSVAL(flat);
                     return true;
                 }
             }
         }
     } else {
         flat = nsnull;
     }
@@ -1181,17 +1145,17 @@ XPCConvert::NativeInterface2JSObject(XPC
                 // the identity of this node.
                 wrapper->SetWrapper(sowWrapper);
             }
 
             flat = sowWrapper;
         } else {
             flat = JS_ObjectToOuterObject(cx, flat);
             NS_ASSERTION(flat, "bad outer object hook!");
-            NS_ASSERTION(js::GetObjectCompartment(flat) == cx->compartment,
+            NS_ASSERTION(js::IsObjectInContextCompartment(flat, cx),
                          "bad compartment");
         }
     }
 
     *d = OBJECT_TO_JSVAL(flat);
 
     if (dest) {
         // The strongWrapper still holds the original flat object.
@@ -1615,17 +1579,17 @@ XPCConvert::NativeArray2JS(XPCLazyCallCo
     NS_PRECONDITION(s, "bad param");
     NS_PRECONDITION(d, "bad param");
 
     XPCCallContext& ccx = lccx.GetXPCCallContext();
     if (!ccx.IsValid())
         return false;
 
     JSContext* cx = ccx.GetJSContext();
-    NS_ABORT_IF_FALSE(js::GetObjectCompartment(lccx.GetScopeForNewJSObjects()) == cx->compartment,
+    NS_ABORT_IF_FALSE(js::IsObjectInContextCompartment(lccx.GetScopeForNewJSObjects(), cx),
                       "bad scope for new JSObjects");
 
     // XXX add support for putting chars in a string rather than an array
 
     // XXX add support to indicate *which* array element was not convertable
 
     JSObject *array = JS_NewArrayObject(cx, count, nsnull);
 
--- a/js/xpconnect/src/XPCInlines.h
+++ b/js/xpconnect/src/XPCInlines.h
@@ -159,17 +159,17 @@ XPCCallContext::GetScopeForNewJSObjects(
     CHECK_STATE(HAVE_SCOPE);
     return mScopeForNewJSObjects;
 }
 
 inline void
 XPCCallContext::SetScopeForNewJSObjects(JSObject *scope)
 {
     NS_ABORT_IF_FALSE(mState == HAVE_CONTEXT, "wrong call context state");
-    NS_ABORT_IF_FALSE(js::GetObjectCompartment(scope) == mJSContext->compartment, "wrong compartment");
+    NS_ABORT_IF_FALSE(js::IsObjectInContextCompartment(scope, mJSContext), "wrong compartment");
     mScopeForNewJSObjects = scope;
     mState = HAVE_SCOPE;
 }
 
 inline JSObject*
 XPCCallContext::GetFlattenedJSObject() const
 {
     CHECK_STATE(HAVE_OBJECT);
--- a/js/xpconnect/src/XPCJSRuntime.cpp
+++ b/js/xpconnect/src/XPCJSRuntime.cpp
@@ -43,28 +43,27 @@
 
 #include "mozilla/Util.h"
 
 #include "xpcprivate.h"
 #include "xpcpublic.h"
 #include "WrapperFactory.h"
 #include "dom_quickstubs.h"
 
-#include "jscompartment.h"
-#include "jsgcchunk.h"
-#include "jsscope.h"
 #include "nsIMemoryReporter.h"
 #include "nsPrintfCString.h"
 #include "mozilla/FunctionTimer.h"
 #include "prsystem.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/Telemetry.h"
 
 #include "nsContentUtils.h"
 
+#include "js/MemoryMetrics.h"
+
 #ifdef MOZ_CRASHREPORTER
 #include "nsExceptionHandler.h"
 #endif
 
 using namespace mozilla;
 using namespace mozilla::xpconnect::memory;
 
 /***************************************************************************/
@@ -506,17 +505,17 @@ XPCJSRuntime::SuspectWrappedNative(JSCon
         return;
 
     NS_ASSERTION(NS_IsMainThread() || NS_IsCycleCollectorThread(),
                  "Suspecting wrapped natives from non-CC thread");
 
     // Only suspect wrappedJSObjects that are in a compartment that
     // participates in cycle collection.
     JSObject* obj = wrapper->GetFlatJSObjectPreserveColor();
-    if (!xpc::ParticipatesInCycleCollection(cx, obj))
+    if (!xpc::ParticipatesInCycleCollection(cx, js::gc::AsCell(obj)))
         return;
 
     // Only record objects that might be part of a cycle as roots, unless
     // the callback wants all traces (a debug feature).
     if (xpc_IsGrayGCThing(obj) || cb.WantAllTraces())
         cb.NoteRoot(nsIProgrammingLanguage::JAVASCRIPT, obj,
                     nsXPConnect::GetXPConnect());
 }
@@ -583,17 +582,17 @@ XPCJSRuntime::AddXPConnectRoots(JSContex
         cb.NoteXPCOMRoot(static_cast<XPCTraceableVariant*>(e));
 
     for (XPCRootSetElem *e = mWrappedJSRoots; e ; e = e->GetNextRoot()) {
         nsXPCWrappedJS *wrappedJS = static_cast<nsXPCWrappedJS*>(e);
         JSObject *obj = wrappedJS->GetJSObjectPreserveColor();
 
         // Only suspect wrappedJSObjects that are in a compartment that
         // participates in cycle collection.
-        if (!xpc::ParticipatesInCycleCollection(cx, obj))
+        if (!xpc::ParticipatesInCycleCollection(cx, js::gc::AsCell(obj)))
             continue;
 
         cb.NoteXPCOMRoot(static_cast<nsIXPConnectWrappedJS *>(wrappedJS));
     }
 
     Closure closure = { cx, true, &cb };
     if (mJSHolders.ops) {
         JS_DHashTableEnumerate(&mJSHolders, NoteJSHolder, &closure);
@@ -1235,36 +1234,34 @@ XPCJSRuntime::~XPCJSRuntime()
     XPCPerThreadData::ShutDown();
 }
 
 namespace {
 
 NS_MEMORY_REPORTER_MALLOC_SIZEOF_FUN(JsMallocSizeOf, "js")
 
 void
-CompartmentCallback(JSContext *cx, void *vdata, JSCompartment *compartment)
+CompartmentMemoryCallback(JSContext *cx, void *vdata, JSCompartment *compartment)
 {
     // Append a new CompartmentStats to the vector.
     IterateData *data = static_cast<IterateData *>(vdata);
     CompartmentStats compartmentStats(cx, compartment);
     CompartmentStats *curr =
         data->compartmentStatsVector.AppendElement(compartmentStats);
     data->currCompartmentStats = curr;
 
     // Get the compartment-level numbers.
 #ifdef JS_METHODJIT
-    size_t method, regexp, unused;
-    compartment->sizeOfCode(&method, &regexp, &unused);
-    JS_ASSERT(regexp == 0);     /* this execAlloc is only used for method code */
-    curr->mjitCode = method + unused;
+    curr->mjitCode = JS::SizeOfCompartmentMjitCode(compartment);
 #endif
-    JS_GetTypeInferenceMemoryStats(cx, compartment, &curr->typeInferenceMemory,
-                                   JsMallocSizeOf);
+    JS::SizeOfCompartmentTypeInferenceData(cx, compartment,
+                                           &curr->typeInferenceMemory,
+                                           JsMallocSizeOf);
     curr->shapesCompartmentTables =
-        js::GetCompartmentShapeTableSize(compartment, JsMallocSizeOf);
+        JS::SizeOfCompartmentShapeTable(compartment, JsMallocSizeOf);
 }
 
 void
 ChunkCallback(JSContext *cx, void *vdata, js::gc::Chunk *chunk)
 {
     // Nb: This function is only called for dirty chunks, which is why we
     // increment gcHeapChunkDirtyDecommitted.
     IterateData *data = static_cast<IterateData *>(vdata);
@@ -1301,63 +1298,62 @@ CellCallback(JSContext *cx, void *vdata,
         case JSTRACE_OBJECT:
         {
             JSObject *obj = static_cast<JSObject *>(thing);
             if (JS_ObjectIsFunction(cx, obj)) {
                 curr->gcHeapObjectsFunction += thingSize;
             } else {
                 curr->gcHeapObjectsNonFunction += thingSize;
             }
-            curr->objectSlots += js::GetObjectDynamicSlotSize(obj, JsMallocSizeOf);
+            curr->objectSlots += JS::SizeOfObjectDynamicSlots(obj, JsMallocSizeOf);
             break;
         }
         case JSTRACE_STRING:
         {
             JSString *str = static_cast<JSString *>(thing);
             curr->gcHeapStrings += thingSize;
             curr->stringChars += str->charsHeapSize(JsMallocSizeOf);
             break;
         }
         case JSTRACE_SHAPE:
         {
-            js::Shape *shape = static_cast<js::Shape *>(thing);
-            if (shape->inDictionary()) {
+            if (JS::IsShapeInDictionary(thing)) {
                 curr->gcHeapShapesDict += thingSize;
                 curr->shapesExtraDictTables +=
-                    shape->sizeOfPropertyTable(JsMallocSizeOf);
+                    JS::SizeOfShapePropertyTable(thing, JsMallocSizeOf);
             } else {
                 curr->gcHeapShapesTree += thingSize;
                 curr->shapesExtraTreeTables +=
-                    shape->sizeOfPropertyTable(JsMallocSizeOf);
+                    JS::SizeOfShapePropertyTable(thing, JsMallocSizeOf);
                 curr->shapesExtraTreeShapeKids +=
-                    shape->sizeOfKids(JsMallocSizeOf);
+                    JS::SizeOfShapeKids(thing, JsMallocSizeOf);
             }
             break;
         }
         case JSTRACE_BASE_SHAPE:
         {
             curr->gcHeapShapesBase += thingSize;
             break;
         }
         case JSTRACE_SCRIPT:
         {
             JSScript *script = static_cast<JSScript *>(thing);
             curr->gcHeapScripts += thingSize;
-            curr->scriptData += script->dataSize(JsMallocSizeOf);
+            curr->scriptData += JS::SizeOfScriptData(script, JsMallocSizeOf);
 #ifdef JS_METHODJIT
-            curr->mjitData += script->jitDataSize(JsMallocSizeOf);
+            curr->mjitData += JS::SizeOfScriptJitData(script, JsMallocSizeOf);
 #endif
             break;
         }
         case JSTRACE_TYPE_OBJECT:
         {
             js::types::TypeObject *obj = static_cast<js::types::TypeObject *>(thing);
             curr->gcHeapTypeObjects += thingSize;
-            JS_GetTypeInferenceObjectStats(obj, &curr->typeInferenceMemory,
-                                           JsMallocSizeOf);
+            JS::SizeOfObjectTypeInferenceData(obj, &curr->typeInferenceMemory,
+                                              JsMallocSizeOf);
             break;
         }
         case JSTRACE_XML:
         {
             curr->gcHeapXML += thingSize;
             break;
         }
     }
@@ -1459,37 +1455,23 @@ NS_MEMORY_REPORTER_IMPLEMENT(XPConnectJS
                              KIND_OTHER,
                              nsIMemoryReporter::UNITS_BYTES,
                              GetGCChunkTotalBytes,
                              "Memory used by the garbage-collected JavaScript heap.")
 
 static PRInt64
 GetJSSystemCompartmentCount()
 {
-    JSRuntime *rt = nsXPConnect::GetRuntimeInstance()->GetJSRuntime();
-    size_t n = 0;
-    for (size_t i = 0; i < rt->compartments.length(); i++) {
-        if (rt->compartments[i]->isSystemCompartment) {
-            n++;
-        }
-    }
-    return n;
+    return JS::SystemCompartmentCount(nsXPConnect::GetRuntimeInstance()->GetJSRuntime());
 }
 
 static PRInt64
 GetJSUserCompartmentCount()
 {
-    JSRuntime *rt = nsXPConnect::GetRuntimeInstance()->GetJSRuntime();
-    size_t n = 0;
-    for (size_t i = 0; i < rt->compartments.length(); i++) {
-        if (!rt->compartments[i]->isSystemCompartment) {
-            n++;
-        }
-    }
-    return n;
+    return JS::UserCompartmentCount(nsXPConnect::GetRuntimeInstance()->GetJSRuntime());
 }
 
 // Nb: js-system-compartment-count + js-user-compartment-count could be
 // different to the number of compartments reported by
 // XPConnectJSCompartmentsMultiReporter if a garbage collection occurred
 // between them being consulted.  We could move these reporters into
 // XPConnectJSCompartmentCount to avoid that problem, but then we couldn't
 // easily report them via telemetry, so we live with the small risk of
@@ -1519,28 +1501,30 @@ namespace xpconnect {
 namespace memory {
 
 CompartmentStats::CompartmentStats(JSContext *cx, JSCompartment *c)
 {
     memset(this, 0, sizeof(*this));
 
     if (c == cx->runtime->atomsCompartment) {
         name.AssignLiteral("atoms");
-    } else if (c->principals) {
-        if (c->principals->codebase) {
-            name.Assign(c->principals->codebase);
+    } else if (JSPrincipals *principals = JS_GetCompartmentPrincipals(c)) {
+        if (principals->codebase) {
+            name.Assign(principals->codebase);
 
             // If it's the system compartment, append the address.
             // This means that multiple system compartments (and there
             // can be many) can be distinguished.
-            if (c->isSystemCompartment) {
-                if (c->data &&
-                    !((xpc::CompartmentPrivate*)c->data)->location.IsEmpty()) {
+            if (js::IsSystemCompartment(c)) {
+                xpc::CompartmentPrivate *compartmentPrivate =
+                        static_cast<xpc::CompartmentPrivate*>(JS_GetCompartmentPrivate(cx, c));
+                if (compartmentPrivate &&
+                    !compartmentPrivate->location.IsEmpty()) {
                     name.AppendLiteral(", ");
-                    name.Append(((xpc::CompartmentPrivate*)c->data)->location);
+                    name.Append(compartmentPrivate->location);
                 }
 
                 // ample; 64-bit address max is 18 chars
                 static const int maxLength = 31;
                 nsPrintfCString address(maxLength, ", 0x%llx", PRUint64(c));
                 name.Append(address);
             }
 
@@ -1576,17 +1560,17 @@ CollectCompartmentStatsForRuntime(JSRunt
         data->gcHeapChunkCleanUnused =
             PRInt64(JS_GetGCParameter(rt, JSGC_UNUSED_CHUNKS)) *
             js::gc::ChunkSize -
             data->gcHeapChunkCleanDecommitted;
         data->gcHeapChunkTotal =
             PRInt64(JS_GetGCParameter(rt, JSGC_TOTAL_CHUNKS)) *
             js::gc::ChunkSize;
 
-        js::IterateCompartmentsArenasCells(cx, data, CompartmentCallback,
+        js::IterateCompartmentsArenasCells(cx, data, CompartmentMemoryCallback,
                                            ArenaCallback, CellCallback);
         js::IterateChunks(cx, data, ChunkCallback);
 
         data->runtimeObject = JsMallocSizeOf(rt, sizeof(JSRuntime));
 
         // Nb: we use sizeOfExcludingThis() because atomState.atoms is within
         // JSRuntime, and so counted when JSRuntime is counted.
         data->runtimeAtomsTable =
@@ -2159,22 +2143,22 @@ AccumulateTelemetryCallback(int id, uint
         break;
     }
 }
 
 bool XPCJSRuntime::gNewDOMBindingsEnabled;
 
 bool PreserveWrapper(JSContext *cx, JSObject *obj)
 {
-    JS_ASSERT(obj->getClass()->ext.isWrappedNative);
+    JS_ASSERT(IS_WRAPPER_CLASS(js::GetObjectClass(obj)));
     nsISupports *native = nsXPConnect::GetXPConnect()->GetNativeOfWrapper(cx, obj);
     if (!native)
         return false;
     nsresult rv;
-    nsCOMPtr<nsINode> node = nsQueryInterfaceWithError(native, &rv);
+    nsCOMPtr<nsINode> node = do_QueryInterface(native, &rv);
     if (NS_FAILED(rv))
         return false;
     nsContentUtils::PreserveWrapper(native, node);
     return true;
 }
 
 XPCJSRuntime::XPCJSRuntime(nsXPConnect* aXPConnect)
  : mXPConnect(aXPConnect),
@@ -2305,16 +2289,19 @@ XPCJSRuntime::newXPCJSRuntime(nsXPConnec
     }
 
     NS_RUNTIMEABORT("new XPCJSRuntime failed to initialize.");
 
     delete self;
     return nsnull;
 }
 
+// DefineStaticDictionaryJSVals is automatically generated.
+bool DefineStaticDictionaryJSVals(JSContext* aCx);
+
 JSBool
 XPCJSRuntime::OnJSContextNew(JSContext *cx)
 {
     NS_TIME_FUNCTION;
 
     // if it is our first context then we need to generate our string ids
     JSBool ok = true;
     if (JSID_IS_VOID(mStrIDs[0])) {
@@ -2330,16 +2317,20 @@ XPCJSRuntime::OnJSContextNew(JSContext *
                     ok = false;
                     break;
                 }
                 mStrJSVals[i] = STRING_TO_JSVAL(str);
             }
         }
 
         ok = mozilla::dom::binding::DefineStaticJSVals(cx);
+        if (!ok)
+            return false;
+        
+        ok = DefineStaticDictionaryJSVals(cx);
     }
     if (!ok)
         return false;
 
     XPCPerThreadData* tls = XPCPerThreadData::GetData(cx);
     if (!tls)
         return false;
 
--- a/js/xpconnect/src/XPCJSWeakReference.cpp
+++ b/js/xpconnect/src/XPCJSWeakReference.cpp
@@ -44,17 +44,17 @@ xpcJSWeakReference::xpcJSWeakReference()
 
 NS_IMPL_ISUPPORTS1(xpcJSWeakReference, xpcIJSWeakReference)
 
 nsresult xpcJSWeakReference::Init(JSContext* cx, const JS::Value& object)
 {
     JSAutoRequest ar(cx);
 
     if (!object.isObject())
-        return NS_ERROR_FAILURE;
+        return NS_OK;
 
     JSObject& obj = object.toObject();
 
     XPCCallContext ccx(NATIVE_CALLER, cx);
 
     nsRefPtr<nsXPCWrappedJS> wrapped;
     nsresult rv = nsXPCWrappedJS::GetNewOrUsed(ccx,
                                                &obj,
--- a/js/xpconnect/src/XPCQuickStubs.cpp
+++ b/js/xpconnect/src/XPCQuickStubs.cpp
@@ -1007,18 +1007,20 @@ xpc_qsJsvalToWcharStr(JSContext *cx, jsv
     const jschar *chars = JS_GetStringCharsZ(cx, str);
     if (!chars)
         return false;
 
     *pstr = static_cast<const PRUnichar *>(chars);
     return true;
 }
 
-JSBool
-xpc_qsStringToJsval(JSContext *cx, nsString &str, jsval *rval)
+namespace xpc {
+
+bool
+StringToJsval(JSContext *cx, nsString &str, JS::Value *rval)
 {
     // From the T_DOMSTRING case in XPCConvert::NativeData2JS.
     if (str.IsVoid()) {
         *rval = JSVAL_NULL;
         return true;
     }
 
     nsStringBuffer* sharedBuffer;
@@ -1029,16 +1031,18 @@ xpc_qsStringToJsval(JSContext *cx, nsStr
     if (sharedBuffer) {
         // The string was shared but ReadableToJSVal didn't addref it.
         // Move the ownership from str to jsstr.
         str.ForgetSharedBuffer();
     }
     return true;
 }
 
+} // namespace xpc
+
 JSBool
 xpc_qsStringToJsstring(JSContext *cx, nsString &str, JSString **rval)
 {
     // From the T_DOMSTRING case in XPCConvert::NativeData2JS.
     if (str.IsVoid()) {
         *rval = nsnull;
         return true;
     }
--- a/js/xpconnect/src/XPCQuickStubs.h
+++ b/js/xpconnect/src/XPCQuickStubs.h
@@ -35,16 +35,19 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef xpcquickstubs_h___
 #define xpcquickstubs_h___
 
+#include "xpcpublic.h"
+#include "xpcprivate.h"
+
 #include "nsINode.h"
 
 /* XPCQuickStubs.h - Support functions used only by quick stubs. */
 
 class XPCCallContext;
 
 #define XPC_QS_NULL_INDEX  ((size_t) -1)
 
@@ -226,65 +229,25 @@ xpc_qsThrowBadSetterValue(JSContext *cx,
 
 
 JSBool
 xpc_qsGetterOnlyPropertyStub(JSContext *cx, JSObject *obj, jsid id, JSBool strict, jsval *vp);
 
 /* Functions for converting values between COM and JS. */
 
 inline JSBool
-xpc_qsInt32ToJsval(JSContext *cx, PRInt32 i, jsval *rv)
-{
-    *rv = INT_TO_JSVAL(i);
-    return true;
-}
-
-inline JSBool
-xpc_qsUint32ToJsval(JSContext *cx, PRUint32 u, jsval *rv)
-{
-    if (u <= JSVAL_INT_MAX)
-        *rv = INT_TO_JSVAL(u);
-    else
-        *rv = DOUBLE_TO_JSVAL(u);
-    return true;
-}
-
-#ifdef HAVE_LONG_LONG
-
-#define INT64_TO_DOUBLE(i)      ((jsdouble) (i))
-// Win32 can't handle uint64 to double conversion
-#define UINT64_TO_DOUBLE(u)     ((jsdouble) (int64) (u))
-
-#else
-
-inline jsdouble
-INT64_TO_DOUBLE(const int64 &v)
-{
-    jsdouble d;
-    LL_L2D(d, v);
-    return d;
-}
-
-// if !HAVE_LONG_LONG, then uint64 is a typedef of int64
-#define UINT64_TO_DOUBLE INT64_TO_DOUBLE
-
-#endif
-
-inline JSBool
 xpc_qsInt64ToJsval(JSContext *cx, PRInt64 i, jsval *rv)
 {
-    double d = INT64_TO_DOUBLE(i);
-    return JS_NewNumberValue(cx, d, rv);
+    return JS_NewNumberValue(cx, static_cast<jsdouble>(i), rv);
 }
 
 inline JSBool
 xpc_qsUint64ToJsval(JSContext *cx, PRUint64 u, jsval *rv)
 {
-    double d = UINT64_TO_DOUBLE(u);
-    return JS_NewNumberValue(cx, d, rv);
+    return JS_NewNumberValue(cx, static_cast<jsdouble>(u), rv);
 }
 
 
 /* Classes for converting jsvals to string types. */
 
 template <class S, class T>
 class xpc_qsBasicString
 {
@@ -464,23 +427,16 @@ struct xpc_qsSelfRef
  */
 JSBool
 xpc_qsJsvalToCharStr(JSContext *cx, jsval v, JSAutoByteString *bytes);
 
 JSBool
 xpc_qsJsvalToWcharStr(JSContext *cx, jsval v, jsval *pval, const PRUnichar **pstr);
 
 
-/** Convert an nsString to jsval, returning true on success.
- *  Note, the ownership of the string buffer may be moved from str to rval.
- *  If that happens, str will point to an empty string after this call.
- */
-JSBool
-xpc_qsStringToJsval(JSContext *cx, nsString &str, jsval *rval);
-
 /** Convert an nsString to JSString, returning true on success. This will sometimes modify |str| to be empty. */
 JSBool
 xpc_qsStringToJsstring(JSContext *cx, nsString &str, JSString **rval);
 
 nsresult
 getWrapper(JSContext *cx,
            JSObject *obj,
            JSObject *callee,
@@ -717,47 +673,33 @@ xpc_qsValueToInt64(JSContext *cx,
         if (!JS_ValueToNumber(cx, v, &doubleval))
             return false;
         *result = static_cast<PRInt64>(doubleval);
     }
     return true;
 }
 
 /**
- * Convert a jsdouble to PRUint64. Needed for traceable quickstubs too.
- */
-inline PRUint64
-xpc_qsDoubleToUint64(jsdouble doubleval)
-{
-#ifdef XP_WIN
-    // Note: Win32 can't handle double to uint64 directly
-    return static_cast<PRUint64>(static_cast<PRInt64>(doubleval));
-#else
-    return static_cast<PRUint64>(doubleval);
-#endif
-}
-
-/**
  * Convert a jsval to PRUint64. Return true on success.
  */
 inline JSBool
 xpc_qsValueToUint64(JSContext *cx,
                     jsval v,
                     PRUint64 *result)
 {
     if (JSVAL_IS_INT(v)) {
         uint32_t intval;
         if (!JS_ValueToECMAUint32(cx, v, &intval))
             return false;
         *result = static_cast<PRUint64>(intval);
     } else {
         jsdouble doubleval;
         if (!JS_ValueToNumber(cx, v, &doubleval))
             return false;
-        *result = xpc_qsDoubleToUint64(doubleval);
+        *result = static_cast<PRUint64>(doubleval);
     }
     return true;
 }
 
 #ifdef DEBUG
 void
 xpc_qsAssertContextOK(JSContext *cx);
 
--- a/js/xpconnect/src/XPCVariant.cpp
+++ b/js/xpconnect/src/XPCVariant.cpp
@@ -461,17 +461,17 @@ XPCVariant::VariantDataToJS(XPCLazyCallC
     nsAutoString astring;
     nsCAutoString cString;
     nsUTF8String utf8String;
     PRUint32 size;
     xpctvar.flags = 0;
     JSBool success;
 
     JSContext* cx = lccx.GetJSContext();
-    NS_ABORT_IF_FALSE(js::GetObjectCompartment(lccx.GetScopeForNewJSObjects()) == cx->compartment,
+    NS_ABORT_IF_FALSE(js::IsObjectInContextCompartment(lccx.GetScopeForNewJSObjects(), cx),
                       "bad scope for new JSObjects");
 
     switch (type) {
         case nsIDataType::VTYPE_INT8:
         case nsIDataType::VTYPE_INT16:
         case nsIDataType::VTYPE_INT32:
         case nsIDataType::VTYPE_INT64:
         case nsIDataType::VTYPE_UINT8:
--- a/js/xpconnect/src/XPCWrappedNative.cpp
+++ b/js/xpconnect/src/XPCWrappedNative.cpp
@@ -3678,17 +3678,17 @@ ConstructSlimWrapper(XPCCallContext &ccx
     JSObject* plannedParent = parent;
     rv = classInfoHelper->PreCreate(identityObj, ccx, parent, &parent);
     if (rv != NS_SUCCESS_ALLOW_SLIM_WRAPPERS) {
         SLIM_LOG_NOT_CREATED(ccx, identityObj, "PreCreate hook refused");
 
         return false;
     }
 
-    if (ccx.GetJSContext()->compartment != js::GetObjectCompartment(parent)) {
+    if (!js::IsObjectInContextCompartment(parent, ccx.GetJSContext())) {
         SLIM_LOG_NOT_CREATED(ccx, identityObj, "wrong compartment");
 
         return false;
     }
 
     JSAutoEnterCompartment ac;
     if (!ac.enter(ccx, parent)) {
         SLIM_LOG_NOT_CREATED(ccx, identityObj, "unable to enter compartment");
--- a/js/xpconnect/src/codegen.py
+++ b/js/xpconnect/src/codegen.py
@@ -342,46 +342,48 @@ resultConvTemplates = {
         "    ${jsvalRef} = INT_TO_JSVAL(int32_t(result));\n"
         "    return JS_TRUE;\n",
 
     'short':
         "    ${jsvalRef} = INT_TO_JSVAL(int32_t(result));\n"
         "    return JS_TRUE;\n",
 
     'long':
-        "    return xpc_qsInt32ToJsval(cx, result, ${jsvalPtr});\n",
+        "    ${jsvalRef} = INT_TO_JSVAL(result);\n"
+        "    return JS_TRUE;\n",
 
     'long long':
         "    return xpc_qsInt64ToJsval(cx, result, ${jsvalPtr};\n",
 
     'unsigned short':
         "    ${jsvalRef} = INT_TO_JSVAL(int32_t(result));\n"
         "    return JS_TRUE;\n",
 
     'unsigned long':
-        "    return xpc_qsUint32ToJsval(cx, result, ${jsvalPtr});\n",
+        "    ${jsvalRef} = UINT_TO_JSVAL(result);\n"
+        "    return JS_TRUE;\n",
 
     'unsigned long long':
         "    return xpc_qsUint64ToJsval(cx, result, ${jsvalPtr});\n",
 
     'float':
         "    return JS_NewNumberValue(cx, result, ${jsvalPtr});\n",
 
     'double':
         "    return JS_NewNumberValue(cx, result, ${jsvalPtr});\n",
 
     'boolean':
         "    ${jsvalRef} = (result ? JSVAL_TRUE : JSVAL_FALSE);\n"
         "    return JS_TRUE;\n",
 
     '[astring]':
-        "    return xpc_qsStringToJsval(cx, result, ${jsvalPtr});\n",
+        "    return xpc::StringToJsval(cx, result, ${jsvalPtr});\n",
 
     '[domstring]':
-        "    return xpc_qsStringToJsval(cx, result, ${jsvalPtr});\n",
+        "    return xpc::StringToJsval(cx, result, ${jsvalPtr});\n",
 
     '[jsval]':
         # Here there's nothing to convert, because the result has already been
         # written directly to *rv. See the special case in outParamForm.
         "    return JS_TRUE;\n"
     }
 
 def writeResultConv(f, type, interfaceResultTemplate, jsvalPtr, jsvalRef):
new file mode 100644
--- /dev/null
+++ b/js/xpconnect/src/dictionary_helper_gen.conf
@@ -0,0 +1,22 @@
+# Dictionary interface name, interface file name
+dictionaries = [
+     [ 'nsIEventInit', 'nsIDOMEvent.idl' ],
+     [ 'nsICustomEventInit', 'nsIDOMCustomEvent.idl' ],
+     [ 'nsIPopStateEventInit', 'nsIDOMPopStateEvent.idl' ],
+     [ 'nsIHashChangeEventInit', 'nsIDOMHashChangeEvent.idl' ],
+     [ 'nsIPageTransitionEventInit', 'nsIDOMPageTransitionEvent.idl' ],
+     [ 'nsICloseEventInit', 'nsIDOMCloseEvent.idl' ],
+     [ 'nsIUIEventInit', 'nsIDOMUIEvent.idl' ],
+     [ 'nsIMouseEventInit', 'nsIDOMMouseEvent.idl' ]
+   ]
+
+# include file names
+special_includes = [
+    'nsContentUtils.h',
+    'nsIXPConnect.h'
+  ]
+
+# name of the type to not include using #include "typename.h"
+exclude_automatic_type_include = [
+    'nsISupports'
+  ]
new file mode 100644
--- /dev/null
+++ b/js/xpconnect/src/dictionary_helper_gen.py
@@ -0,0 +1,440 @@
+#!/usr/bin/env python
+# header.py - Generate C++ header files from IDL.
+#
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is mozilla.org code.
+#
+# The Initial Developer of the Original Code is
+#   Mozilla Foundation.
+# Portions created by the Initial Developer are Copyright (C) 2011
+# the Initial Developer. All Rights Reserved.
+#
+# Contributor(s):
+#   Olli Pettay <Olli.Pettay@helsinki.fi>
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either of the GNU General Public License Version 2 or later (the "GPL"),
+# or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+
+from codegen import *
+import sys, os.path, re, xpidl, itertools
+
+# --makedepend-output support.
+make_dependencies = []
+make_targets = []
+
+def strip_begin(text, suffix):
+    if not text.startswith(suffix):
+        return text
+    return text[len(suffix):]
+
+def strip_end(text, suffix):
+    if not text.endswith(suffix):
+        return text
+    return text[:-len(suffix)]
+
+# Copied from dombindingsgen.py
+def writeMakeDependOutput(filename):
+    print "Creating makedepend file", filename
+    f = open(filename, 'w')
+    try:
+        if len(make_targets) > 0:
+            f.write("%s:" % makeQuote(make_targets[0]))
+            for filename in make_dependencies:
+                f.write(' \\\n\t\t%s' % makeQuote(filename))
+            f.write('\n\n')
+            for filename in make_targets[1:]:
+                f.write('%s: %s\n' % (makeQuote(filename), makeQuote(make_targets[0])))
+    finally:
+        f.close()
+
+def findIDL(includePath, interfaceFileName):
+    for d in includePath:
+        # Not os.path.join: we need a forward slash even on Windows because
+        # this filename ends up in makedepend output.
+        path = d + '/' + interfaceFileName
+        if os.path.exists(path):
+            return path
+    raise BaseException("No IDL file found for interface %s "
+                        "in include path %r"
+                        % (interfaceFileName, includePath))
+
+def loadIDL(parser, includePath, filename):
+    if not filename in make_dependencies:
+        make_dependencies.append(filename)
+    idl = p.parse(open(findIDL(includePath, filename)).read(), filename)
+    idl.resolve(includePath, p)
+    return idl
+
+class Configuration:
+    def __init__(self, filename):
+        config = {}
+        execfile(filename, config)
+        self.dictionaries = config.get('dictionaries', [])
+        self.special_includes = config.get('special_includes', [])
+        self.exclude_automatic_type_include = config.get('exclude_automatic_type_include', [])
+
+def readConfigFile(filename):
+    return Configuration(filename)
+
+def firstCap(str):
+    return str[0].upper() + str[1:]
+
+def attributeGetterName(a):
+    binaryname = a.binaryname is not None and a.binaryname or firstCap(a.name)
+    return "Get%s" % (binaryname)
+
+def attributeParamlist(prefix, a):
+    if a.realtype.nativeType('in').endswith('*'):
+        l = ["getter_AddRefs(%s%s)" % (prefix, a.name.strip('* '))]
+    elif a.realtype.nativeType('in').count("nsAString"):
+        l = ["%s%s" % (prefix, a.name)]
+    else:
+        l = ["&(%s%s)" % (prefix, a.name)]
+
+    if a.implicit_jscontext:
+        l.insert(0, "aCx")
+
+    return ", ".join(l)
+
+def attributeVariableTypeAndName(a):
+    if a.realtype.nativeType('in').endswith('*'):
+        l = ["nsCOMPtr<%s> %s" % (a.realtype.nativeType('in').strip('* '),
+                   a.name)]
+    elif a.realtype.nativeType('in').count("nsAString"):
+        l = ["nsAutoString %s" % a.name]
+    elif a.realtype.nativeType('in').count("JS::Value"):
+        l = ["JS::Value %s" % a.name]
+    else:
+        l = ["%s%s" % (a.realtype.nativeType('in'),
+                       a.name)]
+
+    return ", ".join(l)
+
+def dict_name(iface):
+    return "%s" % strip_begin(iface, "nsI")
+
+def print_header(idl, fd, conf, dictname, dicts):
+    for p in idl.productions:
+        if p.kind == 'interface' and p.name == dictname:
+            interfaces = []
+            base = p.base
+            baseiface = p.idl.getName(p.base, p.location)
+            while base != "nsISupports" and not base in dicts:
+                dicts.append(base)
+                interfaces.append(baseiface)
+                base = baseiface.base
+                baseiface = baseiface.idl.getName(baseiface.base, baseiface.location)
+
+            interfaces.reverse()
+            for iface in interfaces:
+                write_header(iface, fd)
+
+            if not p.name in dicts:
+                dicts.append(p.name)
+                write_header(p, fd)
+
+def print_header_file(fd, conf):
+    fd.write("/* THIS FILE IS AUTOGENERATED - DO NOT EDIT */\n\n"
+             "#ifndef _gen_mozilla_idl_dictionary_helpers_h_\n"
+             "#define _gen_mozilla_idl_dictionary_helpers_h_\n\n")
+
+    fd.write("#include \"jsapi.h\"\n"
+             "#include \"nsString.h\"\n"
+             "#include \"nsCOMPtr.h\"\n\n")
+
+    forwards = []
+    attrnames = []
+    for d in conf.dictionaries:
+        idl = loadIDL(p, options.incdirs, d[1])
+        collect_names_and_non_primitive_attribute_types(idl, d[0], attrnames, forwards)
+    
+    for c in forwards:
+        fd.write("class %s;\n" % c)
+
+
+    fd.write("\n"
+             "namespace mozilla {\n"
+             "namespace dom {\n\n")
+
+    dicts = []
+    for d in conf.dictionaries:
+        if not d[0] in set(dicts):
+            idl = loadIDL(p, options.incdirs, d[1])
+            print_header(idl, fd, conf, d[0], dicts)
+    fd.write("}\n"
+             "}\n"
+             "#endif\n")
+
+def collect_names_and_non_primitive_attribute_types(idl, dictname, attrnames, forwards):
+    for p in idl.productions:
+        if p.kind == 'interface' and p.name == dictname:
+            interfaces = []
+            base = p.base
+            baseiface = p.idl.getName(p.base, p.location)
+            while base != "nsISupports":
+                interfaces.append(baseiface)
+                base = baseiface.base
+                baseiface = baseiface.idl.getName(baseiface.base, baseiface.location)    
+
+            interfaces.reverse()
+            interfaces.append(p)
+
+            for iface in interfaces:
+                collect_names_and_non_primitive_attribute_types_from_interface(iface, attrnames, forwards)
+
+def collect_names_and_non_primitive_attribute_types_from_interface(iface, attrnames, forwards):
+    for member in iface.members:
+        if isinstance(member, xpidl.Attribute):
+            if not member.name in attrnames:
+                attrnames.append(member.name)
+            if member.realtype.nativeType('in').endswith('*'):
+                t = member.realtype.nativeType('in').strip('* ')
+                if not t in forwards:
+                    forwards.append(t)
+
+def print_cpp(idl, fd, conf, dictname, dicts):
+    for p in idl.productions:
+        if p.kind == 'interface' and p.name == dictname:
+            interfaces = []
+            base = p.base
+            baseiface = p.idl.getName(p.base, p.location)
+            while base != "nsISupports" and not base in dicts:
+                dicts.append(base)
+                interfaces.append(baseiface)
+                base = baseiface.base
+                baseiface = baseiface.idl.getName(baseiface.base, baseiface.location)
+
+            interfaces.reverse()
+            for iface in interfaces:
+                write_cpp(iface, fd)
+
+            if not p.name in dicts:
+                dicts.append(p.name)
+                write_cpp(p, fd)
+
+def get_jsid(name):
+    return ("gDictionary_id_%s" % name)
+
+def print_cpp_file(fd, conf):
+    fd.write("/* THIS FILE IS AUTOGENERATED - DO NOT EDIT */\n\n")
+    fd.write('#include "DictionaryHelpers.h"\n')
+
+    includes = []
+    for s in conf.special_includes:
+        if not s in includes:
+            includes.append(strip_end(s, ".h"))
+    
+    for d in conf.dictionaries:
+        if not d[1] in includes:
+            includes.append(strip_end(d[1], ".idl"))
+
+    attrnames = []
+    for d in conf.dictionaries:
+        idl = loadIDL(p, options.incdirs, d[1])
+        collect_names_and_non_primitive_attribute_types(idl, d[0], attrnames, includes)
+    
+    for c in includes:
+      if not c in conf.exclude_automatic_type_include:
+            fd.write("#include \"%s.h\"\n" % c)
+
+    fd.write("\nusing namespace mozilla::dom;\n\n")
+
+    for a in attrnames:
+        fd.write("static jsid %s = JSID_VOID;\n"% get_jsid(a))
+
+    fd.write("\n"
+             "static bool\n"
+             "DefineStaticJSVal(JSContext* aCx, jsid &id, const char* aString)\n"
+             "{\n"
+             "  if (JSString* str = JS_InternString(aCx, aString)) {\n"
+             "    id = INTERNED_STRING_TO_JSID(aCx, str);\n"
+             "    return true;\n"
+             "  }\n"
+             "  return false;\n"
+             "}\n\n"
+             "bool\n"
+             "DefineStaticDictionaryJSVals(JSContext* aCx)\n"
+             "{\n"
+             "  JSAutoRequest ar(aCx);\n"
+             "  return\n")
+    for a in attrnames:
+        fd.write("    DefineStaticJSVal(aCx, %s, \"%s\") &&\n"
+                 % (get_jsid(a), a))
+
+    fd.write("    true;\n")
+    fd.write("}\n\n")
+
+    dicts = []
+    for d in conf.dictionaries:
+        if not d[0] in set(dicts):
+            idl = p.parse(open(findIDL(options.incdirs, d[1])).read(), d[1])
+            idl.resolve(options.incdirs, p)
+            print_cpp(idl, fd, conf, d[0], dicts)
+
+def init_value(attribute):
+    realtype = attribute.realtype.nativeType('in')
+    realtype = realtype.strip(' ')
+    if realtype.endswith('*'):
+        return "nsnull"
+    if realtype == "bool":
+        return "false"
+    if realtype.count("nsAString"):
+        return "EmptyString()"
+    if realtype.count("nsACString"):
+        return "EmptyCString()"
+    if realtype.count("JS::Value"):
+        return "JSVAL_VOID"
+    return "0"
+
+def write_header(iface, fd):
+    attributes = []
+    for member in iface.members:
+        if isinstance(member, xpidl.Attribute):
+            attributes.append(member)
+    
+    fd.write("class %s" % dict_name(iface.name))
+    if iface.base != "nsISupports":
+        fd.write(" : public %s" % dict_name(iface.base))
+    fd.write("\n{\npublic:\n")
+    fd.write("  %s()" % dict_name(iface.name))
+
+    if iface.base != "nsISupports" or len(attributes) > 0:
+        fd.write(" :\n")
+    
+    if iface.base != "nsISupports":
+        fd.write("    %s()" % dict_name(iface.base))
+        if len(attributes) > 0:
+            fd.write(",\n")
+
+    for i in range(len(attributes)):
+        fd.write("    %s(%s)" % (attributes[i].name, init_value(attributes[i])))
+        if i < (len(attributes) - 1):
+            fd.write(",")
+        fd.write("\n")
+
+    fd.write("  {}\n\n")
+
+    fd.write("  // If aCx or aVal is null, NS_OK is returned and \n"
+             "  // dictionary will use the default values. \n"
+             "  nsresult Init(JSContext* aCx, const jsval* aVal);\n")
+    
+    fd.write("\n")
+
+    for member in attributes:
+        fd.write("  %s;\n" % attributeVariableTypeAndName(member))
+
+    fd.write("};\n\n")
+
+def write_cpp(iface, fd):
+    attributes = []
+    for member in iface.members:
+        if isinstance(member, xpidl.Attribute):
+            attributes.append(member)
+
+    fd.write("static nsresult\n%s_InitInternal(%s& aDict, %s* aIfaceObject, JSContext* aCx, JSObject* aObj)\n" %
+             (dict_name(iface.name), dict_name(iface.name), iface.name))
+    fd.write("{\n")
+    if iface.base != "nsISupports":
+        fd.write("  nsresult rv = %s_InitInternal(aDict, aIfaceObject, aCx, aObj);\n" %
+                 dict_name(iface.base))
+        fd.write("  NS_ENSURE_SUCCESS(rv, rv);\n")
+
+    fd.write("  JSBool found = PR_FALSE;\n")
+    for a in attributes:
+        fd.write("  NS_ENSURE_STATE(JS_HasPropertyById(aCx, aObj, %s, &found));\n"
+                 % get_jsid(a.name))
+        fd.write("  if (found) {\n")
+        fd.write("    nsresult rv = aIfaceObject->%s(" % attributeGetterName(a))
+        fd.write("%s" % attributeParamlist("aDict.", a))
+        fd.write(");\n")
+        fd.write("    NS_ENSURE_SUCCESS(rv, rv);\n")
+        fd.write("  }\n")
+    fd.write("  return NS_OK;\n")
+    fd.write("}\n\n")
+    
+    fd.write("nsresult\n%s::Init(JSContext* aCx, const jsval* aVal)\n" % dict_name(iface.name))
+    fd.write("{\n"
+             "  if (!aCx || !aVal) {\n"
+             "    return NS_OK;\n"
+             "  }\n"
+             "  NS_ENSURE_STATE(JSVAL_IS_OBJECT(*aVal));\n\n"
+             "  JSObject* obj = JSVAL_TO_OBJECT(*aVal);\n"
+             "  nsCxPusher pusher;\n"
+             "  NS_ENSURE_STATE(pusher.Push(aCx, false));\n"
+             "  JSAutoRequest ar(aCx);\n"
+             "  JSAutoEnterCompartment ac;\n"
+             "  NS_ENSURE_STATE(ac.enter(aCx, obj));\n")
+    fd.write("  nsCOMPtr<%s> dict;\n" % iface.name)
+    fd.write("  nsContentUtils::XPConnect()->WrapJS(aCx, obj,\n")
+    fd.write("                                      NS_GET_IID(%s),\n" % iface.name)
+    fd.write("                                      getter_AddRefs(dict));\n")
+    fd.write("  NS_ENSURE_TRUE(dict, NS_OK);\n")
+
+    fd.write("  return %s_InitInternal(*this, dict, aCx, obj);\n}\n\n" %
+                 dict_name(iface.name))
+
+
+if __name__ == '__main__':
+    from optparse import OptionParser
+    o = OptionParser(usage="usage: %prog [options] configfile")
+    o.add_option('-I', action='append', dest='incdirs', default=['.'],
+                 help="Directory to search for imported files")
+    o.add_option('-o', "--stub-output",
+                 type='string', dest='stub_output', default=None,
+                 help="Quick stub C++ source output file", metavar="FILE")
+    o.add_option('--header-output', type='string', default=None,
+                 help="Quick stub header output file", metavar="FILE")
+    o.add_option('--makedepend-output', type='string', default=None,
+                 help="gnumake dependencies output file", metavar="FILE")
+    o.add_option('--cachedir', dest='cachedir', default='',
+                 help="Directory in which to cache lex/parse tables.")
+    (options, filenames) = o.parse_args()
+    if len(filenames) != 1:
+        o.error("Exactly one config filename is needed.")
+    filename = filenames[0]
+
+    if options.cachedir is not None:
+        if not os.path.isdir(options.cachedir):
+            os.mkdir(options.cachedir)
+        sys.path.append(options.cachedir)
+
+    # Instantiate the parser.
+    p = xpidl.IDLParser(outputdir=options.cachedir)
+
+    conf = readConfigFile(filename)
+
+    if options.header_output is not None:
+        outfd = open(options.header_output, 'w')
+        print_header_file(outfd, conf)
+        outfd.close()
+    if options.stub_output is not None:
+        make_targets.append(options.stub_output)
+        outfd = open(options.stub_output, 'w')
+        print_cpp_file(outfd, conf)
+        outfd.close()
+        if options.makedepend_output is not None:
+            writeMakeDependOutput(options.makedepend_output)
+
--- a/js/xpconnect/src/dombindings.cpp
+++ b/js/xpconnect/src/dombindings.cpp
@@ -35,26 +35,31 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "mozilla/Util.h"
 
 #include "dombindings.h"
+#include "xpcpublic.h"
 #include "xpcprivate.h"
 #include "XPCQuickStubs.h"
 #include "XPCWrapper.h"
 #include "WrapperFactory.h"
 #include "nsDOMClassInfo.h"
 #include "nsGlobalWindow.h"
-#include "jsiter.h"
 #include "nsWrapperCacheInlines.h"
 
-using namespace js;
+#include "jsapi.h"
+
+#include "jscntxt.h" // js::AutoIdVector
+
+using namespace JS;
+using js::AutoIdVector;
 
 namespace mozilla {
 namespace dom {
 namespace binding {
 
 
 static jsid s_constructor_id = JSID_VOID;
 static jsid s_prototype_id = JSID_VOID;
@@ -194,17 +199,17 @@ static inline bool
 Wrap(JSContext *cx, JSObject *scope, nsISupportsResult &result, jsval *vp)
 {
     return Wrap(cx, scope, result.mResult, result.mCache, vp);
 }
 
 static inline bool
 Wrap(JSContext *cx, JSObject *scope, nsString &result, jsval *vp)
 {
-    return xpc_qsStringToJsval(cx, result, vp);
+    return xpc::StringToJsval(cx, result, vp);
 }
 
 template<class T>
 bool
 Unwrap(JSContext *cx, jsval v, T **ppArg, nsISupports **ppArgRef, jsval *vp)
 {
     nsresult rv = xpc_qsUnwrapArg(cx, v, ppArg, ppArgRef, vp);
     if (NS_FAILED(rv))
@@ -346,17 +351,17 @@ ListBase<LC>::namedItem(JSContext *cx, J
                                xpc_qsDOMString::eDefaultUndefinedBehavior);
     if (!nameString.IsValid())
         return false;
     *hasResult = getNamedItem(getListObject(obj), nameString, result);
     return true;
 }
 
 JSBool
-interface_hasInstance(JSContext *cx, JSObject *obj, const js::Value *vp, JSBool *bp)
+interface_hasInstance(JSContext *cx, JSObject *obj, const JS::Value *vp, JSBool *bp)
 {
     if (vp->isObject()) {
         jsval prototype;
         if (!JS_GetPropertyById(cx, obj, s_prototype_id, &prototype) ||
             JSVAL_IS_PRIMITIVE(prototype)) {
             JS_ReportErrorFlagsAndNumber(cx, JSREPORT_ERROR, js_GetErrorMessage, NULL,
                                          JSMSG_THROW_TYPE_ERROR);
             return false;
@@ -545,30 +550,30 @@ GetArrayIndexFromId(JSContext *cx, jsid 
 
         jsuint i;
         return js::StringIsArrayIndex(JSID_TO_ATOM(id), &i) ? i : -1;
     }
     return IdToInt32(cx, id);
 }
 
 static void
-FillPropertyDescriptor(PropertyDescriptor *desc, JSObject *obj, jsval v, bool readonly)
+FillPropertyDescriptor(JSPropertyDescriptor *desc, JSObject *obj, jsval v, bool readonly)
 {
     desc->obj = obj;
     desc->value = v;
     desc->attrs = (readonly ? JSPROP_READONLY : 0) | JSPROP_ENUMERATE;
     desc->getter = NULL;
     desc->setter = NULL;
     desc->shortid = 0;
 }
 
 template<class LC>
 bool
 ListBase<LC>::getOwnPropertyDescriptor(JSContext *cx, JSObject *proxy, jsid id, bool set,
-                                       PropertyDescriptor *desc)
+                                       JSPropertyDescriptor *desc)
 {
     if (set) {
         if (hasIndexSetter) {
             int32_t index = GetArrayIndexFromId(cx, id);
             if (index >= 0) {
                 FillPropertyDescriptor(desc, proxy, JSVAL_VOID, false);
                 return true;
             }
@@ -624,17 +629,17 @@ ListBase<LC>::getOwnPropertyDescriptor(J
 
     desc->obj = NULL;
     return true;
 }
 
 template<class LC>
 bool
 ListBase<LC>::getPropertyDescriptor(JSContext *cx, JSObject *proxy, jsid id, bool set,
-                                    PropertyDescriptor *desc)
+                                    JSPropertyDescriptor *desc)
 {
     if (!getOwnPropertyDescriptor(cx, proxy, id, set, desc))
         return false;
     if (desc->obj)
         return true;
     if (xpc::WrapperFactory::IsXrayWrapper(proxy))
         return resolveNativeName(cx, proxy, id, desc);
     JSObject *proto = js::GetObjectProto(proxy);
@@ -678,17 +683,17 @@ ListBase<LC>::ensureExpandoObject(JSCont
         js::SetProxyExtra(obj, JSPROXYSLOT_EXPANDO, ObjectValue(*expando));
         JS_SetPrivate(cx, expando, js::GetProxyPrivate(obj).toPrivate());
     }
     return expando;
 }
 
 template<class LC>
 bool
-ListBase<LC>::defineProperty(JSContext *cx, JSObject *proxy, jsid id, PropertyDescriptor *desc)
+ListBase<LC>::defineProperty(JSContext *cx, JSObject *proxy, jsid id, JSPropertyDescriptor *desc)
 {
     if (hasIndexSetter) {
         int32_t index = GetArrayIndexFromId(cx, id);
         if (index >= 0) {
             nsCOMPtr<nsISupports> ref;
             IndexSetterType value;
             jsval v;
             return Unwrap(cx, desc->value, &value, getter_AddRefs(ref), &v) &&
@@ -868,17 +873,17 @@ ListBase<LC>::shouldCacheProtoShape(JSCo
         return true;
     }
 
     return Base::shouldCacheProtoShape(cx, protoProto, shouldCache);
 }
 
 template<class LC>
 bool
-ListBase<LC>::resolveNativeName(JSContext *cx, JSObject *proxy, jsid id, PropertyDescriptor *desc)
+ListBase<LC>::resolveNativeName(JSContext *cx, JSObject *proxy, jsid id, JSPropertyDescriptor *desc)
 {
     JS_ASSERT(xpc::WrapperFactory::IsXrayWrapper(proxy));
 
     for (size_t n = 0; n < ArrayLength(sProtoProperties); ++n) {
         if (id == sProtoProperties[n].id) {
             desc->attrs = JSPROP_ENUMERATE | JSPROP_SHARED;
             if (!sProtoProperties[n].setter)
                 desc->attrs |= JSPROP_READONLY;
@@ -945,17 +950,17 @@ ListBase<LC>::nativeGet(JSContext *cx, J
     }
 
     return Base::nativeGet(cx, proxy, protoProto, id, found, vp);
 }
 
 template<class LC>
 bool
 ListBase<LC>::getPropertyOnPrototype(JSContext *cx, JSObject *proxy, jsid id, bool *found,
-                                     js::Value *vp)
+                                     JS::Value *vp)
 {
     JSObject *proto = js::GetObjectProto(proxy);
     if (!proto)
         return true;
 
     bool hit;
     if (getProtoShape(proxy) != js::GetObjectShape(proto)) {
         if (!shouldCacheProtoShape(cx, proto, &hit))
--- a/js/xpconnect/src/dombindings.h
+++ b/js/xpconnect/src/dombindings.h
@@ -127,22 +127,22 @@ public:
 class NoBase {
 public:
     static JSObject *getPrototype(JSContext *cx, XPCWrappedNativeScope *scope);
     static bool shouldCacheProtoShape(JSContext *cx, JSObject *proto, bool *shouldCache)
     {
         *shouldCache = true;
         return true;
     }
-    static bool resolveNativeName(JSContext *cx, JSObject *proxy, jsid id, js::PropertyDescriptor *desc)
+    static bool resolveNativeName(JSContext *cx, JSObject *proxy, jsid id, JSPropertyDescriptor *desc)
     {
         return true;
     }
     static bool nativeGet(JSContext *cx, JSObject *proxy, JSObject *proto, jsid id, bool *found,
-                          js::Value *vp)
+                          JS::Value *vp)
     {
         *found = false;
         return true;
     }
 };
 
 template<class ListType, class IndexOps, class NameOps=NoOps>
 class ListClass : public DerivedListClass<ListType, NoBase, IndexOps, NameOps> {
@@ -198,48 +198,48 @@ private:
     static inline bool namedItem(JSContext *cx, JSObject *obj, jsval *name, NameGetterType &result,
                                  bool *hasResult);
 
     static inline bool getNamedItem(ListType *list, const nsAString& aName, NameGetterType &item);
     static inline bool setNamedItem(JSContext *cx, ListType *list, const nsAString& aName,
                                     NameSetterType item);
 
     static bool getPropertyOnPrototype(JSContext *cx, JSObject *proxy, jsid id, bool *found,
-                                       js::Value *vp);
+                                       JS::Value *vp);
     static bool hasPropertyOnPrototype(JSContext *cx, JSObject *proxy, jsid id);
 
 public:
     static JSObject *create(JSContext *cx, XPCWrappedNativeScope *scope, ListType *list,
                             nsWrapperCache* cache, bool *triedToWrap);
 
     static JSObject *getPrototype(JSContext *cx, XPCWrappedNativeScope *scope, bool *enabled);
 
     bool getPropertyDescriptor(JSContext *cx, JSObject *proxy, jsid id, bool set,
-                               js::PropertyDescriptor *desc);
+                               JSPropertyDescriptor *desc);
     bool getOwnPropertyDescriptor(JSContext *cx, JSObject *proxy, jsid id, bool set,
-                                  js::PropertyDescriptor *desc);
+                                  JSPropertyDescriptor *desc);
     bool defineProperty(JSContext *cx, JSObject *proxy, jsid id,
-                        js::PropertyDescriptor *desc);
+                        JSPropertyDescriptor *desc);
     bool getOwnPropertyNames(JSContext *cx, JSObject *proxy, js::AutoIdVector &props);
     bool delete_(JSContext *cx, JSObject *proxy, jsid id, bool *bp);
     bool enumerate(JSContext *cx, JSObject *proxy, js::AutoIdVector &props);
-    bool fix(JSContext *cx, JSObject *proxy, js::Value *vp);
+    bool fix(JSContext *cx, JSObject *proxy, JS::Value *vp);
 
     bool has(JSContext *cx, JSObject *proxy, jsid id, bool *bp);
     bool hasOwn(JSContext *cx, JSObject *proxy, jsid id, bool *bp);
-    bool get(JSContext *cx, JSObject *proxy, JSObject *receiver, jsid id, js::Value *vp);
+    bool get(JSContext *cx, JSObject *proxy, JSObject *receiver, jsid id, JS::Value *vp);
     bool getElementIfPresent(JSContext *cx, JSObject *proxy, JSObject *receiver,
-                             uint32 index, js::Value *vp, bool *present);
+                             uint32 index, JS::Value *vp, bool *present);
     bool set(JSContext *cx, JSObject *proxy, JSObject *receiver, jsid id, bool strict,
-             js::Value *vp);
+             JS::Value *vp);
     bool keys(JSContext *cx, JSObject *proxy, js::AutoIdVector &props);
-    bool iterate(JSContext *cx, JSObject *proxy, uintN flags, js::Value *vp);
+    bool iterate(JSContext *cx, JSObject *proxy, uintN flags, JS::Value *vp);
 
     /* Spidermonkey extensions. */
-    bool hasInstance(JSContext *cx, JSObject *proxy, const js::Value *vp, bool *bp);
+    bool hasInstance(JSContext *cx, JSObject *proxy, const JS::Value *vp, bool *bp);
     JSString *obj_toString(JSContext *cx, JSObject *proxy);
     void finalize(JSContext *cx, JSObject *proxy);
 
     static bool proxyHandlerIsList(js::ProxyHandler *handler) {
         return handler == &instance;
     }
     static bool objIsList(JSObject *obj) {
         return js::IsProxy(obj) && proxyHandlerIsList(js::GetProxyHandler(obj));
@@ -249,19 +249,19 @@ public:
     {
         return js::GetObjectClass(prototype) == &sInterfaceClass;
     }
     static ListType *getListObject(JSObject *obj);
 
     static JSObject *getPrototype(JSContext *cx, XPCWrappedNativeScope *scope);
     static bool shouldCacheProtoShape(JSContext *cx, JSObject *proto, bool *shouldCache);
     static bool resolveNativeName(JSContext *cx, JSObject *proxy, jsid id,
-                                  js::PropertyDescriptor *desc);
+                                  JSPropertyDescriptor *desc);
     static bool nativeGet(JSContext *cx, JSObject *proxy, JSObject *proto, jsid id, bool *found,
-                          js::Value *vp);
+                          JS::Value *vp);
     static ListType *getNative(JSObject *proxy);
 };
 
 struct nsISupportsResult
 {
     nsISupportsResult()
     {
     }
--- a/js/xpconnect/src/nsXPConnect.cpp
+++ b/js/xpconnect/src/nsXPConnect.cpp
@@ -42,21 +42,18 @@
 
 /* High level class and public functions implementation. */
 
 #include "xpcprivate.h"
 #include "XPCWrapper.h"
 #include "nsBaseHashtable.h"
 #include "nsHashKeys.h"
 #include "jsatom.h"
-#include "jsobj.h"
 #include "jsfriendapi.h"
-#include "jsfun.h"
 #include "jsgc.h"
-#include "jsscript.h"
 #include "nsThreadUtilsInternal.h"
 #include "dom_quickstubs.h"
 #include "nsNullPrincipal.h"
 #include "nsIURI.h"
 #include "nsJSEnvironment.h"
 #include "plbase64.h"
 
 #include "XrayWrapper.h"
@@ -733,17 +730,17 @@ UnmarkGrayChildren(JSTracer *trc, void *
 }
 
 void
 xpc_UnmarkGrayObjectRecursive(JSObject *obj)
 {
     NS_ASSERTION(obj, "Don't pass me null!");
 
     // Unmark.
-    obj->unmark(js::gc::GRAY);
+    js::gc::AsCell(obj)->unmark(js::gc::GRAY);
 
     // Tracing requires a JSContext...
     JSContext *cx;
     nsXPConnect* xpc = nsXPConnect::GetXPConnect();
     if (!xpc || NS_FAILED(xpc->GetSafeJSContext(&cx)) || !cx) {
         NS_ERROR("Failed to get safe JSContext!");
         return;
     }
@@ -914,19 +911,19 @@ nsXPConnect::Traverse(void *p, nsCycleCo
                 "BaseShape",
                 "TypeObject",
             };
             JS_STATIC_ASSERT(NS_ARRAY_LENGTH(trace_types) == JSTRACE_LAST + 1);
             JS_snprintf(name, sizeof(name), "JS %s", trace_types[traceKind]);
         }
 
         // Disable printing global for objects while we figure out ObjShrink fallout.
-        cb.DescribeGCedNode(isMarked, sizeof(JSObject), name);
+        cb.DescribeGCedNode(isMarked, sizeof(js::shadow::Object), name);
     } else {
-        cb.DescribeGCedNode(isMarked, sizeof(JSObject), "JS Object");
+        cb.DescribeGCedNode(isMarked, sizeof(js::shadow::Object), "JS Object");
     }
 
     // There's no need to trace objects that have already been marked by the JS
     // GC. Any JS objects hanging from them will already be marked. Only do this
     // if DEBUG_CC is not defined, else we do want to know about all JS objects
     // to get better graphs and explanations.
     if (!cb.WantAllTraces() && isMarked)
         return NS_OK;
@@ -1110,17 +1107,17 @@ CreateNewCompartment(JSContext *cx, JSCl
     JSObject *tempGlobal = JS_NewCompartmentAndGlobalObject(cx, clasp, principals);
     if (principals)
         JSPRINCIPALS_DROP(cx, principals);
 
     if (!tempGlobal)
         return false;
 
     *global = tempGlobal;
-    *compartment = tempGlobal->compartment();
+    *compartment = js::GetObjectCompartment(tempGlobal);
 
     js::AutoSwitchCompartment sc(cx, *compartment);
     JS_SetCompartmentPrivate(cx, *compartment, priv_holder.forget());
     return true;
 }
 
 #ifdef DEBUG
 struct VerifyTraceXPCGlobalCalledTracer
--- a/js/xpconnect/src/qsgen.py
+++ b/js/xpconnect/src/qsgen.py
@@ -636,46 +636,48 @@ resultConvTemplates = {
         "    ${jsvalRef} = INT_TO_JSVAL((int32) result);\n"
         "    return JS_TRUE;\n",
 
     'short':
         "    ${jsvalRef} = INT_TO_JSVAL((int32) result);\n"
         "    return JS_TRUE;\n",
 
     'long':
-        "    return xpc_qsInt32ToJsval(cx, result, ${jsvalPtr});\n",
+        "    ${jsvalRef} = INT_TO_JSVAL(result);\n"
+        "    return JS_TRUE;\n",
 
     'long long':
         "    return xpc_qsInt64ToJsval(cx, result, ${jsvalPtr});\n",
 
     'unsigned short':
         "    ${jsvalRef} = INT_TO_JSVAL((int32) result);\n"
         "    return JS_TRUE;\n",
 
     'unsigned long':
-        "    return xpc_qsUint32ToJsval(cx, result, ${jsvalPtr});\n",
+        "    ${jsvalRef} = UINT_TO_JSVAL(result);\n"
+        "    return JS_TRUE;\n",
 
     'unsigned long long':
         "    return xpc_qsUint64ToJsval(cx, result, ${jsvalPtr});\n",
 
     'float':
         "    return JS_NewNumberValue(cx, result, ${jsvalPtr});\n",
 
     'double':
         "    return JS_NewNumberValue(cx, result, ${jsvalPtr});\n",
 
     'boolean':
         "    ${jsvalRef} = (result ? JSVAL_TRUE : JSVAL_FALSE);\n"
         "    return JS_TRUE;\n",
 
     '[astring]':
-        "    return xpc_qsStringToJsval(cx, result, ${jsvalPtr});\n",
+        "    return xpc::StringToJsval(cx, result, ${jsvalPtr});\n",
 
     '[domstring]':
-        "    return xpc_qsStringToJsval(cx, result, ${jsvalPtr});\n",
+        "    return xpc::StringToJsval(cx, result, ${jsvalPtr});\n",
 
     '[jsval]':
         # Here there's nothing to convert, because the result has already been
         # written directly to *rv. See the special case in outParamForm.
         "    return JS_TRUE;\n"
     }
 
 def isVariantType(t):
--- a/js/xpconnect/src/xpcprivate.h
+++ b/js/xpconnect/src/xpcprivate.h
@@ -1480,21 +1480,23 @@ XPC_WN_JSOp_ThisObject(JSContext *cx, JS
         nsnull, /* fix            */                                          \
         XPC_WN_JSOp_ThisObject,                                               \
         XPC_WN_JSOp_Clear                                                     \
     }
 
 // Maybe this macro should check for class->enumerate ==
 // XPC_WN_Shared_Proto_Enumerate or something rather than checking for
 // 4 classes?
-#define IS_PROTO_CLASS(clazz)                                                 \
-    ((clazz) == &XPC_WN_NoMods_WithCall_Proto_JSClass ||                      \
-     (clazz) == &XPC_WN_NoMods_NoCall_Proto_JSClass ||                        \
-     (clazz) == &XPC_WN_ModsAllowed_WithCall_Proto_JSClass ||                 \
-     (clazz) == &XPC_WN_ModsAllowed_NoCall_Proto_JSClass)
+static inline bool IS_PROTO_CLASS(js::Class *clazz)
+{
+    return clazz == &XPC_WN_NoMods_WithCall_Proto_JSClass ||
+           clazz == &XPC_WN_NoMods_NoCall_Proto_JSClass ||
+           clazz == &XPC_WN_ModsAllowed_WithCall_Proto_JSClass ||
+           clazz == &XPC_WN_ModsAllowed_NoCall_Proto_JSClass;
+}
 
 /***************************************************************************/
 
 namespace XPCWrapper {
 
 enum WrapperType {
     UNKNOWN         = 0,
     NONE            = 0,
@@ -3652,18 +3654,16 @@ public:
 private:
     const nsTArray<XPCJSContextInfo> *mStack;
     PRUint32 mPosition;
 };
 
 /**************************************************************/
 // All of our thread local storage.
 
-#define BAD_TLS_INDEX ((PRUint32) -1)
-
 class XPCPerThreadData
 {
     typedef mozilla::Mutex Mutex;
 
 public:
     // Get the instance of this object for the current thread
     static inline XPCPerThreadData* GetData(JSContext *cx)
     {
@@ -3829,41 +3829,16 @@ public:
   {
   }
 
   virtual ~BackstagePass() { }
 
 private:
   nsCOMPtr<nsIPrincipal> mPrincipal;
 };
-
-class nsJSRuntimeServiceImpl : public nsIJSRuntimeService,
-                               public nsSupportsWeakReference
-{
- public:
-    NS_DECL_ISUPPORTS
-    NS_DECL_NSIJSRUNTIMESERVICE
-
-    // This returns an AddRef'd pointer. It does not do this with an out param
-    // only because this form  is required by generic module macro:
-    // NS_GENERIC_FACTORY_SINGLETON_CONSTRUCTOR
-    static nsJSRuntimeServiceImpl* GetSingleton();
-
-    static void FreeSingleton();
-
-    nsJSRuntimeServiceImpl();
-    virtual ~nsJSRuntimeServiceImpl();
-
-    static void InitStatics() { gJSRuntimeService = nsnull; }
- protected:
-    static nsJSRuntimeServiceImpl* gJSRuntimeService;
-    nsCOMPtr<nsIXPCScriptable> mBackstagePass;
-};
-
-/***************************************************************************/
 // 'Components' object
 
 class nsXPCComponents : public nsIXPCComponents,
                         public nsIXPCScriptable,
                         public nsIClassInfo,
                         public nsISecurityCheckedComponent
 {
 public:
--- a/js/xpconnect/src/xpcpublic.h
+++ b/js/xpconnect/src/xpcpublic.h
@@ -36,31 +36,36 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef xpcpublic_h
 #define xpcpublic_h
 
 #include "jsapi.h"
+#include "js/MemoryMetrics.h"
 #include "jsclass.h"
 #include "jsfriendapi.h"
 #include "jsgc.h"
 #include "jspubtd.h"
 #include "jsproxy.h"
 
 #include "nsISupports.h"
 #include "nsIPrincipal.h"
 #include "nsWrapperCache.h"
 #include "nsStringGlue.h"
 #include "nsTArray.h"
 
 class nsIPrincipal;
 struct nsDOMClassInfoData;
 
+#ifndef BAD_TLS_INDEX
+#define BAD_TLS_INDEX ((PRUint32) -1)
+#endif
+
 nsresult
 xpc_CreateGlobalObject(JSContext *cx, JSClass *clasp,
                        nsIPrincipal *principal, nsISupports *ptr,
                        bool wantXrays, JSObject **global,
                        JSCompartment **compartment);
 
 nsresult
 xpc_CreateMTGlobalObject(JSContext *cx, JSClass *clasp,
@@ -76,18 +81,20 @@ TraceXPCGlobal(JSTracer *trc, JSObject *
 
 // XXX where should this live?
 NS_EXPORT_(void)
 xpc_LocalizeContext(JSContext *cx);
 
 nsresult
 xpc_MorphSlimWrapper(JSContext *cx, nsISupports *tomorph);
 
-#define IS_WRAPPER_CLASS(clazz)                                               \
-    ((clazz)->ext.isWrappedNative)
+static inline bool IS_WRAPPER_CLASS(js::Class* clazz)
+{
+    return clazz->ext.isWrappedNative;
+}
 
 inline JSBool
 DebugCheckWrapperClass(JSObject* obj)
 {
     NS_ASSERTION(IS_WRAPPER_CLASS(js::GetObjectClass(obj)),
                  "Forgot to check if this is a wrapper?");
     return true;
 }
@@ -182,16 +189,27 @@ xpc_UnmarkGrayObject(JSObject *obj)
         xpc_UnmarkGrayObjectRecursive(obj);
 }
 
 // No JS can be on the stack when this is called. Probably only useful from
 // xpcshell.
 NS_EXPORT_(void)
 xpc_ActivateDebugMode();
 
+namespace xpc {
+
+/**
+ * Convert an nsString to jsval, returning true on success.
+ * Note, the ownership of the string buffer may be moved from str to rval.
+ * If that happens, str will point to an empty string after this call.
+ */
+bool StringToJsval(JSContext *cx, nsString &str, JS::Value *rval);
+
+} // namespace xpc
+
 class nsIMemoryMultiReporterCallback;
 
 namespace mozilla {
 namespace xpconnect {
 namespace memory {
 
 struct CompartmentStats
 {
@@ -219,17 +237,17 @@ struct CompartmentStats
     PRInt64 shapesExtraTreeShapeKids;
     PRInt64 shapesCompartmentTables;
     PRInt64 scriptData;
 
 #ifdef JS_METHODJIT
     PRInt64 mjitCode;
     PRInt64 mjitData;
 #endif
-    TypeInferenceMemoryStats typeInferenceMemory;
+    JS::TypeInferenceMemoryStats typeInferenceMemory;
 };
 
 struct IterateData
 {
     IterateData()
       : runtimeObject(0),
         runtimeAtomsTable(0),
         runtimeContexts(0),
new file mode 100644
--- /dev/null
+++ b/js/xpconnect/tests/unit/test_bug711404.js
@@ -0,0 +1,10 @@
+const Cc = Components.classes;
+const Ci = Components.interfaces;
+
+function run_test()
+{
+  var p = Cc["@mozilla.org/hash-property-bag;1"].
+          createInstance(Ci.nsIWritablePropertyBag2);
+  p.setPropertyAsInt64("a", -4000);
+  do_check_neq(p.getPropertyAsUint64("a"), -4000);
+}
--- a/js/xpconnect/tests/unit/test_js_weak_references.js
+++ b/js/xpconnect/tests/unit/test_js_weak_references.js
@@ -33,16 +33,24 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 /* See https://bugzilla.mozilla.org/show_bug.cgi?id=317304 */
 
 function run_test()
 {
+  // Bug 712649: Calling getWeakReference(null) should work.
+  try {
+    var nullWeak = Components.utils.getWeakReference(null);
+    do_check_true(nullWeak.get() === null);
+  } catch (e) {
+    do_check_true(false);
+  }
+
   var obj = { num: 5, str: 'foo' };
   var weak = Components.utils.getWeakReference(obj);
 
   do_check_true(weak.get() === obj);
   do_check_true(weak.get().num == 5);
   do_check_true(weak.get().str == 'foo');
 
   // Force garbage collection
--- a/js/xpconnect/tests/unit/xpcshell.ini
+++ b/js/xpconnect/tests/unit/xpcshell.ini
@@ -5,16 +5,17 @@ tail =
 [test_bogus_files.js]
 [test_bug408412.js]
 [test_bug451678.js]
 [test_bug596580.js]
 [test_bug604362.js]
 [test_bug608142.js]
 [test_bug641378.js]
 [test_bug677864.js]
+[test_bug711404.js]
 [test_bug_442086.js]
 [test_file.js]
 [test_import.js]
 [test_js_weak_references.js]
 [test_reflect_parse.js]
 [test_localeCompare.js]
 # Bug 676965: test fails consistently on Android
 fail-if = os == "android"
--- a/js/xpconnect/wrappers/WrapperFactory.cpp
+++ b/js/xpconnect/wrappers/WrapperFactory.cpp
@@ -432,17 +432,17 @@ WrapperFactory::WrapLocationObject(JSCon
 bool
 WrapperFactory::WaiveXrayAndWrap(JSContext *cx, jsval *vp)
 {
     if (JSVAL_IS_PRIMITIVE(*vp))
         return JS_WrapValue(cx, vp);
 
     JSObject *obj = js::UnwrapObject(JSVAL_TO_OBJECT(*vp));
     obj = GetCurrentOuter(cx, obj);
-    if (js::GetObjectCompartment(obj) == cx->compartment) {
+    if (js::IsObjectInContextCompartment(obj, cx)) {
         *vp = OBJECT_TO_JSVAL(obj);
         return true;
     }
 
     obj = WaiveXray(cx, obj);
     if (!obj)
         return false;
 
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -2403,17 +2403,22 @@ NS_IMETHODIMP
 PresShell::CharacterExtendForBackspace()
 {
   return mSelection->CharacterExtendForBackspace();
 }
 
 NS_IMETHODIMP 
 PresShell::WordMove(bool aForward, bool aExtend)
 {
-  return mSelection->WordMove(aForward, aExtend);  
+  nsresult result = mSelection->WordMove(aForward, aExtend);
+// if we can't go down/up any more we must then move caret completely to
+// end/beginning respectively.
+  if (NS_FAILED(result))
+    result = CompleteMove(aForward, aExtend);
+  return result;
 }
 
 NS_IMETHODIMP 
 PresShell::WordExtendForDelete(bool aForward)
 {
   return mSelection->WordExtendForDelete(aForward);  
 }
 
--- a/layout/build/nsLayoutModule.cpp
+++ b/layout/build/nsLayoutModule.cpp
@@ -159,70 +159,25 @@ using mozilla::dom::telephony::AudioMana
 #include "nsINodeInfo.h"
 #if defined(MOZ_WIDGET_ANDROID) || defined(MOZ_PLATFORM_MAEMO)
 #include "nsHapticFeedback.h"
 #endif
 
 #define NS_EDITORCOMMANDTABLE_CID \
 { 0x4f5e62b8, 0xd659, 0x4156, { 0x84, 0xfc, 0x2f, 0x60, 0x99, 0x40, 0x03, 0x69 }}
 
+#define NS_EDITINGCOMMANDTABLE_CID \
+{ 0xcb38a746, 0xbeb8, 0x43f3, { 0x94, 0x29, 0x77, 0x96, 0xe1, 0xa9, 0x3f, 0xb4 }}
+
 #define NS_HAPTICFEEDBACK_CID \
 { 0x1f15dbc8, 0xbfaa, 0x45de, \
 { 0x8a, 0x46, 0x08, 0xe2, 0xe2, 0x63, 0x26, 0xb0 } }
 
-static NS_DEFINE_CID(kEditorCommandTableCID, NS_EDITORCOMMANDTABLE_CID);
-
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsPlaintextEditor)
 
-// Constructor of a controller which is set up to use, internally, a
-// singleton command-table pre-filled with editor commands.
-static nsresult
-nsEditorControllerConstructor(nsISupports *aOuter, REFNSIID aIID,
-                                            void **aResult)
-{
-  nsresult rv;
-  nsCOMPtr<nsIController> controller = do_CreateInstance("@mozilla.org/embedcomp/base-command-controller;1", &rv);
-  if (NS_FAILED(rv)) return rv;
-
-  nsCOMPtr<nsIControllerCommandTable> editorCommandTable = do_GetService(kEditorCommandTableCID, &rv);
-  if (NS_FAILED(rv)) return rv;
-  
-  // this guy is a singleton, so make it immutable
-  editorCommandTable->MakeImmutable();
-  
-  nsCOMPtr<nsIControllerContext> controllerContext = do_QueryInterface(controller, &rv);
-  if (NS_FAILED(rv)) return rv;
-  
-  rv = controllerContext->Init(editorCommandTable);
-  if (NS_FAILED(rv)) return rv;
-  
-  return controller->QueryInterface(aIID, aResult);
-}
-
-
-// Constructor for a command-table pref-filled with editor commands
-static nsresult
-nsEditorCommandTableConstructor(nsISupports *aOuter, REFNSIID aIID,
-                                            void **aResult)
-{
-  nsresult rv;
-  nsCOMPtr<nsIControllerCommandTable> commandTable =
-      do_CreateInstance(NS_CONTROLLERCOMMANDTABLE_CONTRACTID, &rv);
-  if (NS_FAILED(rv)) return rv;
-  
-  rv = nsEditorController::RegisterEditorCommands(commandTable);
-  if (NS_FAILED(rv)) return rv;
-  
-  // we don't know here whether we're being created as an instance,
-  // or a service, so we can't become immutable
-
-  return commandTable->QueryInterface(aIID, aResult);
-}
-
-
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsTextServicesDocument)
 #ifdef ENABLE_EDITOR_API_LOG
 #include "nsHTMLEditorLog.h"
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsHTMLEditorLog)
 #else
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsHTMLEditor)
 #endif
 
@@ -249,18 +204,16 @@ class nsIDocumentLoaderFactory;
 /* 0ddf4df8-4dbb-4133-8b79-9afb966514f5 */
 #define NS_PLUGINDOCLOADERFACTORY_CID \
 { 0x0ddf4df8, 0x4dbb, 0x4133, { 0x8b, 0x79, 0x9a, 0xfb, 0x96, 0x65, 0x14, 0xf5 } }
 
 #define NS_WINDOWCOMMANDTABLE_CID \
  { /* 0DE2FBFA-6B7F-11D7-BBBA-0003938A9D96 */        \
   0x0DE2FBFA, 0x6B7F, 0x11D7, {0xBB, 0xBA, 0x00, 0x03, 0x93, 0x8A, 0x9D, 0x96} }
 
-static NS_DEFINE_CID(kWindowCommandTableCID, NS_WINDOWCOMMANDTABLE_CID);
-
 #include "nsIBoxObject.h"
 
 #ifdef MOZ_XUL
 #include "inDOMView.h"
 #endif /* MOZ_XUL */
 
 #include "inDeepTreeWalker.h"
 #include "inFlasher.h"
@@ -678,56 +631,16 @@ CreateHTMLAudioElement(nsISupports* aOut
     return NS_ERROR_NO_AGGREGATION;
   // Note! NS_NewHTMLAudioElement is special cased to handle a null nodeinfo
   nsCOMPtr<nsINodeInfo> ni;
   nsCOMPtr<nsIContent> inst(NS_NewHTMLAudioElement(ni.forget()));
   return inst ? inst->QueryInterface(aIID, aResult) : NS_ERROR_OUT_OF_MEMORY;
 }
 #endif
 
-static nsresult
-CreateWindowCommandTableConstructor(nsISupports *aOuter,
-                                    REFNSIID aIID, void **aResult)
-{
-  nsresult rv;
-  nsCOMPtr<nsIControllerCommandTable> commandTable =
-      do_CreateInstance(NS_CONTROLLERCOMMANDTABLE_CONTRACTID, &rv);
-  if (NS_FAILED(rv)) return rv;
-
-  rv = nsWindowCommandRegistration::RegisterWindowCommands(commandTable);
-  if (NS_FAILED(rv)) return rv;
-
-  return commandTable->QueryInterface(aIID, aResult);
-}
-
-static nsresult
-CreateWindowControllerWithSingletonCommandTable(nsISupports *aOuter,
-                                      REFNSIID aIID, void **aResult)
-{
-  nsresult rv;
-  nsCOMPtr<nsIController> controller =
-       do_CreateInstance("@mozilla.org/embedcomp/base-command-controller;1", &rv);
-
- if (NS_FAILED(rv)) return rv;
-
-  nsCOMPtr<nsIControllerCommandTable> windowCommandTable = do_GetService(kWindowCommandTableCID, &rv);
-  if (NS_FAILED(rv)) return rv;
-
-  // this is a singleton; make it immutable
-  windowCommandTable->MakeImmutable();
-
-  nsCOMPtr<nsIControllerContext> controllerContext = do_QueryInterface(controller, &rv);
-  if (NS_FAILED(rv)) return rv;
-
-  controllerContext->Init(windowCommandTable);
-  if (NS_FAILED(rv)) return rv;
-
-  return controller->QueryInterface(aIID, aResult);
-}
-
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsDOMScriptObjectFactory)
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsBaseDOMException)
 
 #define NS_GEOLOCATION_CID \
   { 0x1E1C3FF, 0x94A, 0xD048, { 0x44, 0xB4, 0x62, 0xD2, 0x9C, 0x7B, 0x4F, 0x39 } }
 
 NS_GENERIC_FACTORY_CONSTRUCTOR_INIT(nsGeolocation, Init)
 
@@ -865,17 +778,19 @@ NS_DEFINE_NAMED_CID(TELEPHONYRADIOINTERF
 NS_DEFINE_NAMED_CID(NS_AUDIOMANAGER_CID);
 #endif
 #ifdef ENABLE_EDITOR_API_LOG
 NS_DEFINE_NAMED_CID(NS_HTMLEDITOR_CID);
 #else
 NS_DEFINE_NAMED_CID(NS_HTMLEDITOR_CID);
 #endif
 NS_DEFINE_NAMED_CID(NS_EDITORCONTROLLER_CID);
+NS_DEFINE_NAMED_CID(NS_EDITINGCONTROLLER_CID);
 NS_DEFINE_NAMED_CID(NS_EDITORCOMMANDTABLE_CID);
+NS_DEFINE_NAMED_CID(NS_EDITINGCOMMANDTABLE_CID);
 NS_DEFINE_NAMED_CID(NS_TEXTSERVICESDOCUMENT_CID);
 NS_DEFINE_NAMED_CID(NS_GEOLOCATION_SERVICE_CID);
 NS_DEFINE_NAMED_CID(NS_GEOLOCATION_CID);
 NS_DEFINE_NAMED_CID(NS_FOCUSMANAGER_CID);
 NS_DEFINE_NAMED_CID(CSPSERVICE_CID);
 NS_DEFINE_NAMED_CID(NS_EVENTLISTENERSERVICE_CID);
 NS_DEFINE_NAMED_CID(NS_GLOBALMESSAGEMANAGER_CID);
 NS_DEFINE_NAMED_CID(NS_PARENTPROCESSMESSAGEMANAGER_CID);
@@ -897,16 +812,145 @@ NS_DEFINE_NAMED_CID(NS_STRUCTUREDCLONECO
 NS_DEFINE_NAMED_CID(NS_DEVICE_MOTION_CID);
 #endif
 #if defined(ANDROID) || defined(MOZ_PLATFORM_MAEMO)
 NS_DEFINE_NAMED_CID(NS_HAPTICFEEDBACK_CID);
 #endif
 #endif
 NS_DEFINE_NAMED_CID(NS_SMSSERVICE_CID);
 
+static nsresult
+CreateWindowCommandTableConstructor(nsISupports *aOuter,
+                                    REFNSIID aIID, void **aResult)
+{
+  nsresult rv;
+  nsCOMPtr<nsIControllerCommandTable> commandTable =
+      do_CreateInstance(NS_CONTROLLERCOMMANDTABLE_CONTRACTID, &rv);
+  if (NS_FAILED(rv)) return rv;
+
+  rv = nsWindowCommandRegistration::RegisterWindowCommands(commandTable);
+  if (NS_FAILED(rv)) return rv;
+
+  return commandTable->QueryInterface(aIID, aResult);
+}
+
+static nsresult
+CreateWindowControllerWithSingletonCommandTable(nsISupports *aOuter,
+                                      REFNSIID aIID, void **aResult)
+{
+  nsresult rv;
+  nsCOMPtr<nsIController> controller =
+       do_CreateInstance("@mozilla.org/embedcomp/base-command-controller;1", &rv);
+
+ if (NS_FAILED(rv)) return rv;
+
+  nsCOMPtr<nsIControllerCommandTable> windowCommandTable = do_GetService(kNS_WINDOWCOMMANDTABLE_CID, &rv);
+  if (NS_FAILED(rv)) return rv;
+
+  // this is a singleton; make it immutable
+  windowCommandTable->MakeImmutable();
+
+  nsCOMPtr<nsIControllerContext> controllerContext = do_QueryInterface(controller, &rv);
+  if (NS_FAILED(rv)) return rv;
+
+  controllerContext->Init(windowCommandTable);
+  if (NS_FAILED(rv)) return rv;
+
+  return controller->QueryInterface(aIID, aResult);
+}
+
+// Constructor of a controller which is set up to use, internally, a
+// singleton command-table pre-filled with editor commands.
+static nsresult
+nsEditorControllerConstructor(nsISupports *aOuter, REFNSIID aIID,
+                              void **aResult)
+{
+  nsresult rv;
+  nsCOMPtr<nsIController> controller = do_CreateInstance("@mozilla.org/embedcomp/base-command-controller;1", &rv);
+  if (NS_FAILED(rv)) return rv;
+
+  nsCOMPtr<nsIControllerCommandTable> editorCommandTable = do_GetService(kNS_EDITORCOMMANDTABLE_CID, &rv);
+  if (NS_FAILED(rv)) return rv;
+
+  // this guy is a singleton, so make it immutable
+  editorCommandTable->MakeImmutable();
+
+  nsCOMPtr<nsIControllerContext> controllerContext = do_QueryInterface(controller, &rv);
+  if (NS_FAILED(rv)) return rv;
+
+  rv = controllerContext->Init(editorCommandTable);
+  if (NS_FAILED(rv)) return rv;
+
+  return controller->QueryInterface(aIID, aResult);
+}
+
+// Constructor of a controller which is set up to use, internally, a
+// singleton command-table pre-filled with editing commands.
+static nsresult
+nsEditingControllerConstructor(nsISupports *aOuter, REFNSIID aIID,
+                                void **aResult)
+{
+  nsresult rv;
+  nsCOMPtr<nsIController> controller = do_CreateInstance("@mozilla.org/embedcomp/base-command-controller;1", &rv);
+  if (NS_FAILED(rv)) return rv;
+
+  nsCOMPtr<nsIControllerCommandTable> editingCommandTable = do_GetService(kNS_EDITINGCOMMANDTABLE_CID, &rv);
+  if (NS_FAILED(rv)) return rv;
+
+  // this guy is a singleton, so make it immutable
+  editingCommandTable->MakeImmutable();
+
+  nsCOMPtr<nsIControllerContext> controllerContext = do_QueryInterface(controller, &rv);
+  if (NS_FAILED(rv)) return rv;
+
+  rv = controllerContext->Init(editingCommandTable);
+  if (NS_FAILED(rv)) return rv;
+
+  return controller->QueryInterface(aIID, aResult);
+}
+
+// Constructor for a command-table pre-filled with editor commands
+static nsresult
+nsEditorCommandTableConstructor(nsISupports *aOuter, REFNSIID aIID,
+                                            void **aResult)
+{
+  nsresult rv;
+  nsCOMPtr<nsIControllerCommandTable> commandTable =
+      do_CreateInstance(NS_CONTROLLERCOMMANDTABLE_CONTRACTID, &rv);
+  if (NS_FAILED(rv)) return rv;
+
+  rv = nsEditorController::RegisterEditorCommands(commandTable);
+  if (NS_FAILED(rv)) return rv;
+
+  // we don't know here whether we're being created as an instance,
+  // or a service, so we can't become immutable
+
+  return commandTable->QueryInterface(aIID, aResult);
+}
+
+// Constructor for a command-table pre-filled with editing commands
+static nsresult
+nsEditingCommandTableConstructor(nsISupports *aOuter, REFNSIID aIID,
+                                              void **aResult)
+{
+  nsresult rv;
+  nsCOMPtr<nsIControllerCommandTable> commandTable =
+      do_CreateInstance(NS_CONTROLLERCOMMANDTABLE_CONTRACTID, &rv);
+  if (NS_FAILED(rv)) return rv;
+
+  rv = nsEditorController::RegisterEditingCommands(commandTable);
+  if (NS_FAILED(rv)) return rv;
+
+  // we don't know here whether we're being created as an instance,
+  // or a service, so we can't become immutable
+
+  return commandTable->QueryInterface(aIID, aResult);
+}
+
+
 static const mozilla::Module::CIDEntry kLayoutCIDs[] = {
   XPCONNECT_CIDENTRIES
 #ifdef DEBUG
   { &kNS_FRAME_UTIL_CID, false, NULL, CreateNewFrameUtil },
   { &kNS_LAYOUT_DEBUGGER_CID, false, NULL, CreateNewLayoutDebugger },
 #endif
   { &kNS_FRAMETRAVERSAL_CID, false, NULL, CreateNewFrameTraversal },
   { &kNS_PRESSHELL_CID, false, NULL, CreateNewPresShell },
@@ -1007,17 +1051,19 @@ static const mozilla::Module::CIDEntry k
   { &kNS_AUDIOMANAGER_CID, true, NULL, AudioManagerConstructor },
 #endif
 #ifdef ENABLE_EDITOR_API_LOG
   { &kNS_HTMLEDITOR_CID, false, NULL, nsHTMLEditorLogConstructor },
 #else
   { &kNS_HTMLEDITOR_CID, false, NULL, nsHTMLEditorConstructor },
 #endif
   { &kNS_EDITORCONTROLLER_CID, false, NULL, nsEditorControllerConstructor },
+  { &kNS_EDITINGCONTROLLER_CID, false, NULL, nsEditingControllerConstructor },
   { &kNS_EDITORCOMMANDTABLE_CID, false, NULL, nsEditorCommandTableConstructor },
+  { &kNS_EDITINGCOMMANDTABLE_CID, false, NULL, nsEditingCommandTableConstructor },
   { &kNS_TEXTSERVICESDOCUMENT_CID, false, NULL, nsTextServicesDocumentConstructor },
   { &kNS_GEOLOCATION_SERVICE_CID, false, NULL, nsGeolocationServiceConstructor },
   { &kNS_GEOLOCATION_CID, false, NULL, nsGeolocationConstructor },
   { &kNS_FOCUSMANAGER_CID, false, NULL, CreateFocusManager },
   { &kCSPSERVICE_CID, false, NULL, CSPServiceConstructor },
   { &kNS_EVENTLISTENERSERVICE_CID, false, NULL, CreateEventListenerService },
   { &kNS_GLOBALMESSAGEMANAGER_CID, false, NULL, CreateGlobalMessageManager },
   { &kNS_PARENTPROCESSMESSAGEMANAGER_CID, false, NULL, CreateParentMessageManager },
@@ -1143,17 +1189,17 @@ static const mozilla::Module::ContractID
   { NS_AUDIOMANAGER_CONTRACTID, &kNS_AUDIOMANAGER_CID },
 #endif
 #ifdef ENABLE_EDITOR_API_LOG
   { "@mozilla.org/editor/htmleditor;1", &kNS_HTMLEDITOR_CID },
 #else
   { "@mozilla.org/editor/htmleditor;1", &kNS_HTMLEDITOR_CID },
 #endif
   { "@mozilla.org/editor/editorcontroller;1", &kNS_EDITORCONTROLLER_CID },
-  { "", &kNS_EDITORCOMMANDTABLE_CID },
+  { "@mozilla.org/editor/editingcontroller;1", &kNS_EDITINGCONTROLLER_CID },
   { "@mozilla.org/textservices/textservicesdocument;1", &kNS_TEXTSERVICESDOCUMENT_CID },
   { "@mozilla.org/geolocation/service;1", &kNS_GEOLOCATION_SERVICE_CID },
   { "@mozilla.org/geolocation;1", &kNS_GEOLOCATION_CID },
   { "@mozilla.org/focus-manager;1", &kNS_FOCUSMANAGER_CID },
   { CSPSERVICE_CONTRACTID, &kCSPSERVICE_CID },
   { NS_EVENTLISTENERSERVICE_CONTRACTID, &kNS_EVENTLISTENERSERVICE_CID },
   { NS_GLOBALMESSAGEMANAGER_CONTRACTID, &kNS_GLOBALMESSAGEMANAGER_CID },
   { NS_PARENTPROCESSMESSAGEMANAGER_CONTRACTID, &kNS_PARENTPROCESSMESSAGEMANAGER_CID },
--- a/layout/generic/nsBulletFrame.cpp
+++ b/layout/generic/nsBulletFrame.cpp
@@ -50,55 +50,29 @@
 #include "nsILoadGroup.h"
 #include "nsIURL.h"
 #include "nsNetUtil.h"
 #include "prprf.h"
 #include "nsDisplayList.h"
 
 #include "imgILoader.h"
 #include "imgIContainer.h"
-#include "nsStubImageDecoderObserver.h"
 
 #include "nsIServiceManager.h"
 #include "nsIComponentManager.h"
 #include "nsContentUtils.h"
 
 #ifdef ACCESSIBILITY
 #include "nsAccessibilityService.h"
 #endif
 
 using namespace mozilla;
 
 NS_DECLARE_FRAME_PROPERTY(FontSizeInflationProperty, nsnull)
 
-class nsBulletListener : public nsStubImageDecoderObserver
-{
-public:
-  nsBulletListener();
-  virtual ~nsBulletListener();
-
-  NS_DECL_ISUPPORTS
-  // imgIDecoderObserver (override nsStubImageDecoderObserver)
-  NS_IMETHOD OnStartContainer(imgIRequest *aRequest, imgIContainer *aImage);
-  NS_IMETHOD OnDataAvailable(imgIRequest *aRequest, bool aCurrentFrame,
-                             const nsIntRect *aRect);
-  NS_IMETHOD OnStopDecode(imgIRequest *aRequest, nsresult status,
-                          const PRUnichar *statusArg);
-  NS_IMETHOD OnImageIsAnimated(imgIRequest *aRequest);
-
-  // imgIContainerObserver (override nsStubImageDecoderObserver)
-  NS_IMETHOD FrameChanged(imgIContainer *aContainer,
-                          const nsIntRect *dirtyRect);
-
-  void SetFrame(nsBulletFrame *frame) { mFrame = frame; }
-
-private:
-  nsBulletFrame *mFrame;
-};
-
 NS_IMPL_FRAMEARENA_HELPERS(nsBulletFrame)
 
 nsBulletFrame::~nsBulletFrame()
 {
 }
 
 void
 nsBulletFrame::DestroyFrom(nsIFrame* aDestructRoot)
@@ -108,18 +82,19 @@ nsBulletFrame::DestroyFrom(nsIFrame* aDe
     // Deregister our image request from the refresh driver
     nsLayoutUtils::DeregisterImageRequest(PresContext(),
                                           mImageRequest,
                                           &mRequestRegistered);
     mImageRequest->CancelAndForgetObserver(NS_ERROR_FAILURE);
     mImageRequest = nsnull;
   }
 
-  if (mListener)
-    reinterpret_cast<nsBulletListener*>(mListener.get())->SetFrame(nsnull);
+  if (mListener) {
+    mListener->SetFrame(nsnull);
+  }
 
   // Let base class do the rest
   nsFrame::DestroyFrom(aDestructRoot);
 }
 
 #ifdef NS_DEBUG
 NS_IMETHODIMP
 nsBulletFrame::GetFrameName(nsAString& aResult) const
@@ -151,22 +126,18 @@ nsBulletFrame::DidSetStyleContext(nsStyl
 {
   nsFrame::DidSetStyleContext(aOldStyleContext);
 
   imgIRequest *newRequest = GetStyleList()->GetListStyleImage();
 
   if (newRequest) {
 
     if (!mListener) {
-      nsBulletListener *listener = new nsBulletListener();
-      NS_ADDREF(listener);
-      listener->SetFrame(this);
-      listener->QueryInterface(NS_GET_IID(imgIDecoderObserver), getter_AddRefs(mListener));
-      NS_ASSERTION(mListener, "queryinterface for the listener failed");
-      NS_RELEASE(listener);
+      mListener = new nsBulletListener();
+      mListener->SetFrame(this);
     }
 
     bool needNewRequest = true;
 
     if (mImageRequest) {
       // Reload the image, maybe...
       nsCOMPtr<nsIURI> oldURI;
       mImageRequest->GetURI(getter_AddRefs(oldURI));
--- a/layout/generic/nsBulletFrame.h
+++ b/layout/generic/nsBulletFrame.h
@@ -40,20 +40,48 @@
 #ifndef nsBulletFrame_h___
 #define nsBulletFrame_h___
 
 #include "nsFrame.h"
 #include "nsStyleContext.h"
 
 #include "imgIRequest.h"
 #include "imgIDecoderObserver.h"
+#include "nsStubImageDecoderObserver.h"
 
 #define BULLET_FRAME_IMAGE_LOADING NS_FRAME_STATE_BIT(63)
 #define BULLET_FRAME_HAS_FONT_INFLATION NS_FRAME_STATE_BIT(62)
 
+class nsBulletFrame;
+
+class nsBulletListener : public nsStubImageDecoderObserver
+{
+public:
+  nsBulletListener();
+  virtual ~nsBulletListener();
+
+  NS_DECL_ISUPPORTS
+  // imgIDecoderObserver (override nsStubImageDecoderObserver)
+  NS_IMETHOD OnStartContainer(imgIRequest *aRequest, imgIContainer *aImage);
+  NS_IMETHOD OnDataAvailable(imgIRequest *aRequest, bool aCurrentFrame,
+                             const nsIntRect *aRect);
+  NS_IMETHOD OnStopDecode(imgIRequest *aRequest, nsresult status,
+                          const PRUnichar *statusArg);
+  NS_IMETHOD OnImageIsAnimated(imgIRequest *aRequest);
+
+  // imgIContainerObserver (override nsStubImageDecoderObserver)
+  NS_IMETHOD FrameChanged(imgIContainer *aContainer,
+                          const nsIntRect *dirtyRect);
+
+  void SetFrame(nsBulletFrame *frame) { mFrame = frame; }
+
+private:
+  nsBulletFrame *mFrame;
+};
+
 /**
  * A simple class that manages the layout and rendering of html bullets.
  * This class also supports the CSS list-style properties.
  */
 class nsBulletFrame : public nsFrame {
 public:
   NS_DECL_FRAMEARENA_HELPERS
 
@@ -124,17 +152,17 @@ protected:
                       nsRenderingContext *aRenderingContext,
                       nsHTMLReflowMetrics& aMetrics,
                       float aFontSizeInflation);
 
   void GetLoadGroup(nsPresContext *aPresContext, nsILoadGroup **aLoadGroup);
 
   nsMargin mPadding;
   nsCOMPtr<imgIRequest> mImageRequest;
-  nsCOMPtr<imgIDecoderObserver> mListener;
+  nsRefPtr<nsBulletListener> mListener;
 
   nsSize mIntrinsicSize;
   nsSize mComputedSize;
   PRInt32 mOrdinal;
   bool mTextIsRTL;
 
 private:
 
--- a/layout/generic/nsSelection.cpp
+++ b/layout/generic/nsSelection.cpp
@@ -4331,18 +4331,22 @@ nsTypedSelection::SelectAllFramesForCont
 
   return NS_ERROR_FAILURE;
 }
 
 //the idea of this helper method is to select, deselect "top to bottom" traversing through the frames
 nsresult
 nsTypedSelection::selectFrames(nsPresContext* aPresContext, nsIRange *aRange, bool aFlags)
 {
-  if (!mFrameSelection || !aPresContext || !aPresContext->GetPresShell())
+  if (!mFrameSelection || !aPresContext || !aPresContext->GetPresShell()) {
     return NS_OK; // nothing to do
+  }
+  if (!aRange) {
+    return NS_ERROR_NULL_POINTER;
+  }
 
   if (mFrameSelection->GetTableCellSelection()) {
     nsINode* node = aRange->GetCommonAncestor();
     nsCOMPtr<nsIContent> content = do_QueryInterface(node);
     nsIFrame* frame = content ? content->GetPrimaryFrame()
                               : aPresContext->FrameManager()->GetRootFrame();
     if (frame) {
       frame->InvalidateFrameSubtree();
--- a/layout/generic/test/test_movement_by_characters.html
+++ b/layout/generic/test/test_movement_by_characters.html
@@ -11,18 +11,23 @@
 <div id="content" style="display: block">
 <div contentEditable id="editor"></div>
 </div>
 <pre id="test">
 <script class="testbody" type="text/javascript;version=1.7">
 
 SimpleTest.waitForExplicitFinish();
 
-// This seems to be necessary because the selection is not set up properly otherwise
-setTimeout(test, 0);
+setTimeout(focusing, 0);
+
+function focusing() {
+  document.getElementById("editor").focus();
+  // This seems to be necessary because the selection is not set up properly otherwise
+  setTimeout(test, 0);
+}
 
 function test() {
   var sel = window.getSelection();
   var editor = document.getElementById("editor");
 
   function testRight(node, offset) {
     synthesizeKey("VK_RIGHT", {});
     is(sel.anchorNode, node, "Right movement broken in " + editor.innerHTML);
--- a/layout/generic/test/test_movement_by_words.html
+++ b/layout/generic/test/test_movement_by_words.html
@@ -13,18 +13,23 @@
 </div>
 <p id="catch">Catch-all
 <pre id="test"><script class="testbody" type="text/javascript;version=1.7">
 
 /** Test for Bug 384147 **/
 
 SimpleTest.waitForExplicitFinish();
 
-// This seems to be necessary because the selection is not set up properly otherwise
-setTimeout(test, 0);
+setTimeout(focusing, 0);
+
+function focusing() {
+  document.getElementById("editor").focus();
+  // This seems to be necessary because the selection is not set up properly otherwise
+  setTimeout(test, 0);
+}
 
 var eatSpace;
 
 function getPrefs() {
   const prefSvcContractID = "@mozilla.org/preferences-service;1";
   const prefSvcIID = Components.interfaces.nsIPrefService;
   return Components.classes[prefSvcContractID].getService(prefSvcIID)
                                                .getBranch("layout.word_select.");
@@ -186,39 +191,39 @@ function test() {
 
   setPrefs(true, true);
 
   // test basic word movement with eat_space_next_to_word true.
 
   editor.innerHTML = "Hello Kitty";
   sel.collapse(editor.firstChild, 0);
   testRight(editor.firstChild, 6);
-  testRight(afterEditorNode, 0);
+  testRight(editor.firstChild, 11);
   testLeft(editor.firstChild, 6);
   testLeft(editor.firstChild, 0);
 
   editor.innerHTML = "<b>Hello</b> Kitty";
   sel.collapse(editor.firstChild.firstChild, 0);
   testRight(editor.firstChild.nextSibling, 1);
-  testRight(afterEditorNode, 0);
+  testRight(editor.firstChild.nextSibling, 6);
   testLeft(editor.firstChild.nextSibling, 1);
   testLeft(editor.firstChild.firstChild, 0);
 
   editor.innerHTML = "<b>Hello </b>Kitty";
   sel.collapse(editor.firstChild.firstChild, 0);
   testRight(editor.firstChild.nextSibling, 0);
-  testRight(afterEditorNode, 0);
+  testRight(editor.firstChild.nextSibling, 5);
   testLeft(editor.firstChild.firstChild, 6);
   testLeft(editor.firstChild.firstChild, 0);
 
   editor.innerHTML = "<b>Log out</b>  roc";
   sel.collapse(editor.firstChild.firstChild, 0);
   testRight(editor.firstChild.firstChild, 4);
   testRight(editor.firstChild.nextSibling, 2);
-  testRight(afterEditorNode, 0);
+  testRight(editor.firstChild.nextSibling, 5);
   testLeft(editor.firstChild.nextSibling, 1);
   testLeft(editor.firstChild.firstChild, 4);
   testLeft(editor.firstChild.firstChild, 0);
 
   editor.innerHTML = "http://www.mozilla.org";
   sel.collapse(editor.firstChild, 0);
   testRight(editor.firstChild, 7);
   testRight(editor.firstChild, 11);
@@ -227,74 +232,74 @@ function test() {
   testLeft(editor.firstChild, 7);
   testLeft(editor.firstChild, 0);
 
   editor.innerHTML = "Set .rc to <b>'</b>quiz'";
   sel.collapse(editor.firstChild, 0);
   testRight(editor.firstChild, 4);
   testRight(editor.firstChild, 8);
   testRight(editor.firstChild.nextSibling.firstChild, 0);
-  testRight(afterEditorNode, 0);
+  testRight(editor.firstChild.nextSibling.nextSibling, 5);
   testLeft(editor.firstChild.nextSibling.firstChild, 1);
   testLeft(editor.firstChild, 10);
   testLeft(editor.firstChild, 8);
   testLeft(editor.firstChild, 5);
   testLeft(editor.firstChild, 3);
   testLeft(editor.firstChild, 0);
 
   editor.innerHTML = ChineseChars + HiraganaChars + ChineseChars;
   sel.collapse(editor.firstChild, 0);
   testRight(editor.firstChild, 2);
   testRight(editor.firstChild, 6);
-  testRight(afterEditorNode, 0);
+  testRight(editor.firstChild, 8);
   testLeft(editor.firstChild, 6);
   testLeft(editor.firstChild, 2);
   testLeft(editor.firstChild, 0);
 
   editor.innerHTML = ChineseChars + KatakanaChars + ChineseChars;
   sel.collapse(editor.firstChild, 0);
   testRight(editor.firstChild, 2);
   testRight(editor.firstChild, 6);
-  testRight(afterEditorNode, 0);
+  testRight(editor.firstChild, 8);
   testLeft(editor.firstChild, 6);
   testLeft(editor.firstChild, 2);
   testLeft(editor.firstChild, 0);
 
   editor.innerHTML = KatakanaChars + HiraganaChars + KatakanaChars;
   sel.collapse(editor.firstChild, 0);
   testRight(editor.firstChild, 4);
   testRight(editor.firstChild, 8);
-  testRight(afterEditorNode, 0);
+  testRight(editor.firstChild, 12);
   testLeft(editor.firstChild, 8);
   testLeft(editor.firstChild, 4);
   testLeft(editor.firstChild, 0);
 
   editor.innerHTML = HiraganaChars + JapaneseComma + HiraganaChars + JapaneseFullStop + HiraganaChars;
   sel.collapse(editor.firstChild, 0);
   testRight(editor.firstChild, 5);
   testRight(editor.firstChild, 10);
-  testRight(afterEditorNode, 0);
+  testRight(editor.firstChild, 14);
   testLeft(editor.firstChild, 10);
   testLeft(editor.firstChild, 5);
   testLeft(editor.firstChild, 0);
 
   editor.innerHTML = KatakanaChars + JapaneseComma + KatakanaChars + JapaneseFullStop + KatakanaChars;
   sel.collapse(editor.firstChild, 0);
   testRight(editor.firstChild, 5);
   testRight(editor.firstChild, 10);
-  testRight(afterEditorNode, 0);
+  testRight(editor.firstChild, 14);
   testLeft(editor.firstChild, 10);
   testLeft(editor.firstChild, 5);
   testLeft(editor.firstChild, 0);
 
   editor.innerHTML = ChineseChars + JapaneseComma + ChineseChars + JapaneseFullStop + ChineseChars;
   sel.collapse(editor.firstChild, 0);
   testRight(editor.firstChild, 3);
   testRight(editor.firstChild, 6);
-  testRight(afterEditorNode, 0);
+  testRight(editor.firstChild, 8);
   testLeft(editor.firstChild, 6);
   testLeft(editor.firstChild, 3);
   testLeft(editor.firstChild, 0);
 
   restorePrefs();
 
   SimpleTest.finish();
 }
--- a/testing/jetpack/jetpack-location.txt
+++ b/testing/jetpack/jetpack-location.txt
@@ -1,1 +1,1 @@
-http://hg.mozilla.org/projects/addon-sdk/archive/34b9f7aff342.tar.bz2
+http://hg.mozilla.org/projects/addon-sdk/archive/c4a695618bf8.tar.bz2
--- a/testing/xpcshell/xpcshell.ini
+++ b/testing/xpcshell/xpcshell.ini
@@ -43,17 +43,16 @@ skip-if = os == "android"
 [include:xpcom/tests/unit/xpcshell.ini]
 [include:modules/libpref/test/unit/xpcshell.ini]
 [include:intl/strres/tests/unit/xpcshell.ini]
 [include:intl/unicharutil/tests/unit/xpcshell.ini]
 [include:intl/uconv/tests/unit/xpcshell.ini]
 [include:netwerk/test/unit/xpcshell.ini]
 [include:netwerk/test/httpserver/test/xpcshell.ini]
 [include:js/ductwork/debugger/tests/xpcshell.ini]
-[include:js/jetpack/tests/unit/xpcshell.ini]
 [include:js/jsd/test/xpcshell.ini]
 [include:js/xpconnect/tests/unit/xpcshell.ini]
 [include:modules/libjar/test/unit/xpcshell.ini]
 [include:extensions/cookie/test/unit/xpcshell.ini]
 [include:storage/test/unit/xpcshell.ini]
 [include:rdf/tests/unit/xpcshell.ini]
 [include:gfx/tests/unit/xpcshell.ini]
 [include:widget/tests/unit/xpcshell.ini]
--- a/toolkit/content/tests/chrome/test_showcaret.xul
+++ b/toolkit/content/tests/chrome/test_showcaret.xul
@@ -27,24 +27,24 @@ function runTest()
 {
   var sel1 = frames[0].getSelection();
   sel1.collapse(frames[0].document.body, 0);
 
   var sel2 = frames[1].getSelection();
   sel2.collapse(frames[1].document.body, 0);
 
   window.frames[0].focus();
-  document.commandDispatcher.getControllerForCommand("cmd_scrollBottom").doCommand("cmd_scrollBottom");
+  document.commandDispatcher.getControllerForCommand("cmd_moveBottom").doCommand("cmd_moveBottom");
 
   ok(frames[0].scrollY > 0, "scrollY for non-showcaret");
   is(sel1.focusNode, frames[0].document.body, "focusNode for non-showcaret");
   is(sel1.focusOffset, 0, "focusOffset for non-showcaret");
 
   window.frames[1].focus();
-  document.commandDispatcher.getControllerForCommand("cmd_scrollBottom").doCommand("cmd_scrollBottom");
+  document.commandDispatcher.getControllerForCommand("cmd_moveBottom").doCommand("cmd_moveBottom");
 
   ok(frames[1].scrollY <
        frames[1].document.getElementById('s').getBoundingClientRect().top,
      "scrollY for showcaret");
   isnot(sel2.focusNode, frames[1].document.body, "focusNode for showcaret");
   ok(sel2.anchorOffset > 0, "focusOffset for showcaret");
 
   otherWindow = window.open("window_showcaret.xul", "_blank", "chrome,width=400,height=200");
@@ -59,17 +59,17 @@ function otherWindowFocused()
   var prefs = Components.classes["@mozilla.org/preferences-service;1"].
                 getService(Components.interfaces.nsIPrefBranch);
   prefs.setBoolPref("accessibility.browsewithcaret", true);
 
   var hbox = otherWindow.document.documentElement.firstChild;
   hbox.focus();
   is(otherWindow.document.activeElement, hbox, "hbox in other window is focused");
 
-  document.commandDispatcher.getControllerForCommand("cmd_scrollLineDown").doCommand("cmd_scrollLineDown");
+  document.commandDispatcher.getControllerForCommand("cmd_lineNext").doCommand("cmd_lineNext");
   is(otherWindow.document.activeElement, hbox, "hbox still focused in other window after down movement");
 
   prefs.setBoolPref("accessibility.browsewithcaret", false);
 
   otherWindow.close();
   SimpleTest.finish();
 }
 
--- a/toolkit/library/Makefile.in
+++ b/toolkit/library/Makefile.in
@@ -187,17 +187,16 @@ COMPONENT_LIBS += \
   txmgr \
   commandlines \
   toolkitcomps \
   pipboot \
   pipnss \
   appcomps \
   jsreflect \
   composer \
-  jetpack_s \
   telemetry \
   jsdebugger \
   storagecomps \
   rdf \
   windowds \
   $(NULL)
 
 ifdef BUILD_CTYPES
--- a/toolkit/library/nsStaticXULComponents.cpp
+++ b/toolkit/library/nsStaticXULComponents.cpp
@@ -113,23 +113,16 @@
 #endif
 
 #ifdef ENABLE_LAYOUTDEBUG
 #define LAYOUT_DEBUG_MODULE MODULE(nsLayoutDebugModule)
 #else
 #define LAYOUT_DEBUG_MODULE
 #endif
 
-#if defined(ENABLE_JETPACK_SERVICE)
-#define JETPACK_MODULES \
-    MODULE(jetpack)
-#else
-#define JETPACK_MODULES
-#endif
-
 #ifdef MOZ_JSDEBUGGER
 #define JSDEBUGGER_MODULES \
     MODULE(JavaScript_Debugger)
 #else
 #define JSDEBUGGER_MODULES
 #endif
 
 #if defined(MOZ_FILEVIEW) && defined(MOZ_XUL)
@@ -220,17 +213,16 @@
     MODULE(nsRDFModule)                      \
     MODULE(nsWindowDataSourceModule)         \
     MODULE(nsParserModule)                   \
     MODULE(nsGfxModule)                      \
     MODULE(nsProfilerModule)                 \
     WIDGET_MODULES                           \
     MODULE(nsImageLib2Module)                \
     ICON_MODULE                              \
-    JETPACK_MODULES                          \
     MODULE(nsPluginModule)                   \
     MODULE(nsLayoutModule)                   \
     MODULE(docshell_provider)                \
     MODULE(embedcomponents)                  \
     MODULE(Browser_Embedding_Module)         \
     ACCESS_MODULES                           \
     MODULE(appshell)                         \
     MODULE(nsTransactionManagerModule)       \
--- a/toolkit/toolkit-makefiles.sh
+++ b/toolkit/toolkit-makefiles.sh
@@ -82,17 +82,16 @@ MAKEFILES_dom="
   dom/src/offline/Makefile
   dom/src/notification/Makefile
   dom/src/storage/Makefile
   dom/system/Makefile
   dom/workers/Makefile
   dom/locales/Makefile
   dom/plugins/base/Makefile
   dom/plugins/ipc/Makefile
-  js/jetpack/Makefile
 "
 
 MAKEFILES_editor="
   editor/Makefile
   editor/public/Makefile
   editor/idl/Makefile
   editor/txmgr/Makefile
   editor/txmgr/idl/Makefile
--- a/toolkit/toolkit-tiers.mk
+++ b/toolkit/toolkit-tiers.mk
@@ -85,17 +85,17 @@ tier_platform_dirs += other-licenses/bsd
 endif
 
 tier_platform_dirs	+= gfx/qcms
 
 #
 # "gecko" - core components
 #
 
-tier_platform_dirs += ipc js/ipc js/jetpack
+tier_platform_dirs += ipc js/ipc
 
 tier_platform_dirs += \
 		hal \
 		js/xpconnect \
 		intl/chardet \
 		$(NULL)
 
 ifdef MOZ_ENABLE_GTK2
--- a/toolkit/xre/nsAppRunner.cpp
+++ b/toolkit/xre/nsAppRunner.cpp
@@ -759,17 +759,16 @@ nsXULAppInfo::GetWidgetToolkit(nsACStrin
 // xpcom/system/nsIXULRuntime.idl.
 #define SYNC_ENUMS(a,b) \
   PR_STATIC_ASSERT(nsIXULRuntime::PROCESS_TYPE_ ## a == \
                    static_cast<int>(GeckoProcessType_ ## b));
 
 SYNC_ENUMS(DEFAULT, Default)
 SYNC_ENUMS(PLUGIN, Plugin)
 SYNC_ENUMS(CONTENT, Content)
-SYNC_ENUMS(JETPACK, Jetpack)
 SYNC_ENUMS(IPDLUNITTEST, IPDLUnitTest)
 
 // .. and ensure that that is all of them:
 PR_STATIC_ASSERT(GeckoProcessType_IPDLUnitTest + 1 == GeckoProcessType_End);
 
 NS_IMETHODIMP
 nsXULAppInfo::GetProcessType(PRUint32* aResult)
 {
--- a/toolkit/xre/nsEmbedFunctions.cpp
+++ b/toolkit/xre/nsEmbedFunctions.cpp
@@ -91,17 +91,16 @@
 #include "chrome/common/notification_service.h"
 
 #include "mozilla/ipc/BrowserProcessSubThread.h"
 #include "mozilla/ipc/GeckoChildProcessHost.h"
 #include "mozilla/ipc/IOThreadChild.h"
 #include "mozilla/ipc/ProcessChild.h"
 #include "ScopedXREEmbed.h"
 
-#include "mozilla/jetpack/JetpackProcessChild.h"
 #include "mozilla/plugins/PluginProcessChild.h"
 #include "mozilla/dom/ContentProcess.h"
 #include "mozilla/dom/ContentParent.h"
 #include "mozilla/dom/ContentChild.h"
 
 #include "mozilla/jsipc/ContextWrapperParent.h"
 
 #include "mozilla/ipc/TestShellParent.h"
@@ -119,17 +118,16 @@ using mozilla::_ipdltest::IPDLUnitTestPr
 using namespace mozilla;
 
 using mozilla::ipc::BrowserProcessSubThread;
 using mozilla::ipc::GeckoChildProcessHost;
 using mozilla::ipc::IOThreadChild;
 using mozilla::ipc::ProcessChild;
 using mozilla::ipc::ScopedXREEmbed;
 
-using mozilla::jetpack::JetpackProcessChild;
 using mozilla::plugins::PluginProcessChild;
 using mozilla::dom::ContentProcess;
 using mozilla::dom::ContentParent;
 using mozilla::dom::ContentChild;
 
 using mozilla::jsipc::PContextWrapperParent;
 using mozilla::jsipc::ContextWrapperParent;
 
@@ -494,20 +492,16 @@ XRE_InitChildProcess(int aArgc,
       case GeckoProcessType_Plugin:
         process = new PluginProcessChild(parentHandle);
         break;
 
       case GeckoProcessType_Content:
         process = new ContentProcess(parentHandle);
         break;
 
-      case GeckoProcessType_Jetpack:
-        process = new JetpackProcessChild(parentHandle);
-        break;
-
       case GeckoProcessType_IPDLUnitTest:
 #ifdef MOZ_IPDL_TESTS
         process = new IPDLUnitTestProcessChild(parentHandle);
 #else 
         NS_RUNTIMEABORT("rebuild with --enable-ipdl-tests");
 #endif
         break;
 
--- a/widget/src/qt/nsScreenQt.cpp
+++ b/widget/src/qt/nsScreenQt.cpp
@@ -88,16 +88,19 @@ NS_IMPL_ISUPPORTS1(nsScreenQt, nsIScreen
 
 NS_IMETHODIMP
 nsScreenQt::GetRect(PRInt32 *outLeft,PRInt32 *outTop,
                     PRInt32 *outWidth,PRInt32 *outHeight)
 {
     QRect r = QApplication::desktop()->screenGeometry(mScreen);
 #ifdef MOZ_ENABLE_QTMOBILITY
     r = MozQOrientationSensorFilter::GetRotationTransform().mapRect(r);
+    // just rotating gives us weird negative coordinates, but we want to return
+    // sensible logical coordinates
+    r.moveTo(0, 0);
 #endif
 
     *outTop = r.x();
     *outLeft = r.y();
     *outWidth = r.width();
     *outHeight = r.height();
 
     return NS_OK;
--- a/widget/src/qt/nsWindow.cpp
+++ b/widget/src/qt/nsWindow.cpp
@@ -2377,19 +2377,23 @@ void
 nsWindow::NativeResize(PRInt32 aWidth, PRInt32 aHeight, bool    aRepaint)
 {
     LOG(("nsWindow::NativeResize [%p] %d %d\n", (void *)this,
          aWidth, aHeight));
 
     mNeedsResize = false;
 
     if (mIsTopLevel) {
-        QWidget *widget = GetViewWidget();
+        QGraphicsView *widget = qobject_cast<QGraphicsView*>(GetViewWidget());
         NS_ENSURE_TRUE(widget,);
-        widget->resize(aWidth, aHeight);
+        // map from in-scene widget to scene, from scene to view.
+        QRect r = widget->mapFromScene(mWidget->mapToScene(QRect(0, 0, aWidth, aHeight))).boundingRect();
+        // going from QPolygon to QRect includes the points, adding one to width and height
+        r.adjust(0, 0, -1, -1);
+        widget->resize(r.width(), r.height());
     }
     else {
         mWidget->r