--- a/accessible/base/NotificationController.cpp
+++ b/accessible/base/NotificationController.cpp
@@ -136,16 +136,17 @@ NotificationController::IsUpdatePending(
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // NotificationCollector: private
 
 void
 NotificationController::WillRefresh(mozilla::TimeStamp aTime)
 {
+  PROFILER_LABEL_FUNC(js::ProfileEntry::Category::OTHER);
   Telemetry::AutoTimer<Telemetry::A11Y_UPDATE_TIME> updateTimer;
 
   // If the document accessible that notification collector was created for is
   // now shut down, don't process notifications anymore.
   NS_ASSERTION(mDocument,
                "The document was shut down while refresh observer is attached!");
   if (!mDocument)
     return;

new file mode 100644
--- /dev/null
+++ b/accessible/base/TextRange-inl.h
@@ -0,0 +1,29 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_a11y_TextRange_inl_h__
+#define mozilla_a11y_TextRange_inl_h__
+
+#include "TextRange.h"
+#include "HyperTextAccessible.h"
+
+namespace mozilla {
+namespace a11y {
+
+inline Accessible*
+TextRange::Container() const
+{
+  uint32_t pos1 = 0, pos2 = 0;
+  nsAutoTArray<Accessible*, 30> parents1, parents2;
+  return CommonParent(mStartContainer, mEndContainer,
+                      &parents1, &pos1, &parents2, &pos2);
+}
+
+
+} // namespace a11y
+} // namespace mozilla
+
+#endif

--- a/accessible/base/TextRange.cpp
+++ b/accessible/base/TextRange.cpp
@@ -1,18 +1,17 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* vim: set ts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "TextRange.h"
+#include "TextRange-inl.h"
 
 #include "Accessible-inl.h"
-#include "HyperTextAccessible.h"
 #include "nsAccUtils.h"
 
 namespace mozilla {
 namespace a11y {
 
 ////////////////////////////////////////////////////////////////////////////////
 // TextPoint
 
@@ -54,90 +53,37 @@ TextPoint::operator <(const TextPoint& a
 TextRange::TextRange(HyperTextAccessible* aRoot,
                      HyperTextAccessible* aStartContainer, int32_t aStartOffset,
                      HyperTextAccessible* aEndContainer, int32_t aEndOffset) :
   mRoot(aRoot), mStartContainer(aStartContainer), mEndContainer(aEndContainer),
   mStartOffset(aStartOffset), mEndOffset(aEndOffset)
 {
 }
 
-Accessible*
-TextRange::Container() const
-{
-  if (mStartContainer == mEndContainer)
-    return mStartContainer;
-
-  // Build the chain of parents
-  Accessible* p1 = mStartContainer;
-  Accessible* p2 = mEndContainer;
-  nsAutoTArray<Accessible*, 30> parents1, parents2;
-  do {
-    parents1.AppendElement(p1);
-    p1 = p1->Parent();
-  } while (p1);
-  do {
-    parents2.AppendElement(p2);
-    p2 = p2->Parent();
-  } while (p2);
-
-  // Find where the parent chain differs
-  uint32_t pos1 = parents1.Length();
-  uint32_t pos2 = parents2.Length();
-  Accessible* parent = nullptr;
-  uint32_t len = 0;
-  for (len = std::min(pos1, pos2); len > 0; --len) {
-    Accessible* child1 = parents1.ElementAt(--pos1);
-    Accessible* child2 = parents2.ElementAt(--pos2);
-    if (child1 != child2)
-      break;
-
-    parent = child1;
-  }
-
-  return parent;
-}
-
 void
 TextRange::EmbeddedChildren(nsTArray<Accessible*>* aChildren) const
 {
   if (mStartContainer == mEndContainer) {
     int32_t startIdx = mStartContainer->GetChildIndexAtOffset(mStartOffset);
     int32_t endIdx = mStartContainer->GetChildIndexAtOffset(mEndOffset);
     for (int32_t idx = startIdx; idx <= endIdx; idx++) {
       Accessible* child = mStartContainer->GetChildAt(idx);
       if (nsAccUtils::IsEmbeddedObject(child))
         aChildren->AppendElement(child);
     }
     return;
   }
 
   Accessible* p1 = mStartContainer->GetChildAtOffset(mStartOffset);
   Accessible* p2 = mEndContainer->GetChildAtOffset(mEndOffset);
+
+  uint32_t pos1 = 0, pos2 = 0;
   nsAutoTArray<Accessible*, 30> parents1, parents2;
-  do {
-    parents1.AppendElement(p1);
-    p1 = p1->Parent();
-  } while (p1);
-  do {
-    parents2.AppendElement(p2);
-    p2 = p2->Parent();
-  } while (p2);
-
-  // Find deepest common container.
-  uint32_t pos1 = parents1.Length();
-  uint32_t pos2 = parents2.Length();
-  Accessible* container = nullptr;
-  for (uint32_t len = std::min(pos1, pos2); len > 0; --len) {
-    Accessible* child1 = parents1.ElementAt(--pos1);
-    Accessible* child2 = parents2.ElementAt(--pos2);
-    if (child1 != child2)
-      break;
-
-    container = child1;
-  }
+  Accessible* container =
+    CommonParent(p1, p2, &parents1, &pos1, &parents2, &pos2);
 
   // Traverse the tree up to the container and collect embedded objects.
   for (uint32_t idx = 0; idx < pos1 - 1; idx++) {
     Accessible* parent = parents1[idx + 1];
     Accessible* child = parents1[idx];
     uint32_t childCount = parent->ChildCount();
     for (uint32_t childIdx = child->IndexInParent(); childIdx < childCount; childIdx++) {
       Accessible* next = parent->GetChildAt(childIdx);
@@ -191,16 +137,105 @@ TextRange::Bounds(nsTArray<nsIntRect> aR
 }
 
 void
 TextRange::Normalize(ETextUnit aUnit)
 {
 
 }
 
+bool
+TextRange::Crop(Accessible* aContainer)
+{
+  uint32_t boundaryPos = 0, containerPos = 0;
+  nsAutoTArray<Accessible*, 30> boundaryParents, containerParents;
+
+  // Crop the start boundary.
+  Accessible* container = nullptr;
+  Accessible* boundary = mStartContainer->GetChildAtOffset(mStartOffset);
+  if (boundary != aContainer) {
+    CommonParent(boundary, aContainer, &boundaryParents, &boundaryPos,
+                 &containerParents, &containerPos);
+
+    if (boundaryPos == 0) {
+      if (containerPos != 0) {
+        // The container is contained by the start boundary, reduce the range to
+        // the point starting at the container.
+        aContainer->ToTextPoint(mStartContainer.StartAssignment(), &mStartOffset);
+        static_cast<Accessible*>(mStartContainer)->AddRef();
+      }
+      else {
+        // The start boundary and the container are siblings.
+        container = aContainer;
+      }
+    }
+    else if (containerPos != 0) {
+      // The container does not contain the start boundary.
+      boundary = boundaryParents[boundaryPos];
+      container = containerParents[containerPos];
+    }
+
+    if (container) {
+      // If the range start is after the container, then make the range invalid.
+      if (boundary->IndexInParent() > container->IndexInParent()) {
+        return !!(mRoot = nullptr);
+      }
+
+      // If the range starts before the container, then reduce the range to
+      // the point starting at the container.
+      if (boundary->IndexInParent() < container->IndexInParent()) {
+        container->ToTextPoint(mStartContainer.StartAssignment(), &mStartOffset);
+        mStartContainer.get()->AddRef();
+      }
+    }
+
+    boundaryParents.SetLengthAndRetainStorage(0);
+    containerParents.SetLengthAndRetainStorage(0);
+  }
+
+  boundary = mEndContainer->GetChildAtOffset(mEndOffset);
+  if (boundary == aContainer) {
+    return true;
+  }
+
+  // Crop the end boundary.
+  container = nullptr;
+  CommonParent(boundary, aContainer, &boundaryParents, &boundaryPos,
+               &containerParents, &containerPos);
+
+  if (boundaryPos == 0) {
+    if (containerPos != 0) {
+      aContainer->ToTextPoint(mEndContainer.StartAssignment(), &mEndOffset, false);
+      static_cast<Accessible*>(mEndContainer)->AddRef();
+    }
+    else {
+      container = aContainer;
+    }
+  }
+  else if (containerPos != 0) {
+    boundary = boundaryParents[boundaryPos];
+    container = containerParents[containerPos];
+  }
+
+  if (!container) {
+    return true;
+  }
+
+  if (boundary->IndexInParent() < container->IndexInParent()) {
+    return !!(mRoot = nullptr);
+  }
+
+  if (boundary->IndexInParent() > container->IndexInParent()) {
+    container->ToTextPoint(mEndContainer.StartAssignment(), &mEndOffset, false);
+    static_cast<Accessible*>(mEndContainer)->AddRef();
+  }
+
+  return true;
+}
+
 void
 TextRange::FindText(const nsAString& aText, EDirection aDirection,
                     nsCaseTreatment aCaseSensitive, TextRange* aFoundRange) const
 {
 
 }
 
 void
@@ -291,10 +326,51 @@ TextRange::TextInternal(nsAString& aText
 void
 TextRange::MoveInternal(ETextUnit aUnit, int32_t aCount,
                         HyperTextAccessible& aContainer, int32_t aOffset,
                         HyperTextAccessible* aStopContainer, int32_t aStopOffset)
 {
 
 }
 
+Accessible*
+TextRange::CommonParent(Accessible* aAcc1, Accessible* aAcc2,
+                        nsTArray<Accessible*>* aParents1, uint32_t* aPos1,
+                        nsTArray<Accessible*>* aParents2, uint32_t* aPos2) const
+{
+  if (aAcc1 == aAcc2) {
+    return aAcc1;
+  }
+
+  MOZ_ASSERT(aParents1->Length() == 0 || aParents2->Length() == 0,
+             "Wrong arguments");
+
+  // Build the chain of parents.
+  Accessible* p1 = aAcc1;
+  Accessible* p2 = aAcc2;
+  do {
+    aParents1->AppendElement(p1);
+    p1 = p1->Parent();
+  } while (p1);
+  do {
+    aParents2->AppendElement(p2);
+    p2 = p2->Parent();
+  } while (p2);
+
+  // Find where the parent chain differs
+  *aPos1 = aParents1->Length();
+  *aPos2 = aParents2->Length();
+  Accessible* parent = nullptr;
+  uint32_t len = 0;
+  for (len = std::min(*aPos1, *aPos2); len > 0; --len) {
+    Accessible* child1 = aParents1->ElementAt(--(*aPos1));
+    Accessible* child2 = aParents2->ElementAt(--(*aPos2));
+    if (child1 != child2)
+      break;
+
+    parent = child1;
+  }
+
+  return parent;
+}
+
 } // namespace a11y
 } // namespace mozilla

--- a/accessible/base/TextRange.h
+++ b/accessible/base/TextRange.h
@@ -126,16 +126,22 @@ public:
   void MoveEnd(ETextUnit aUnit, int32_t aCount)
     { MoveInternal(aUnit, aCount, *mEndContainer, mEndOffset); }
 
   /**
    * Move the range points to the closest unit boundaries.
    */
   void Normalize(ETextUnit aUnit);
 
+  /**
+   * Crops the range if it overlaps the given accessible element boundaries,
+   * returns true if the range was cropped successfully.
+   */
+  bool Crop(Accessible* aContainer);
+
   enum EDirection {
     eBackward,
     eForward
   };
 
   /**
    * Return range enclosing the found text.
    */
@@ -238,16 +244,24 @@ private:
   bool TextInternal(nsAString& aText, Accessible* aCurrent,
                     uint32_t aStartIntlOffset) const;
 
   void MoveInternal(ETextUnit aUnit, int32_t aCount,
                     HyperTextAccessible& aContainer, int32_t aOffset,
                     HyperTextAccessible* aStopContainer = nullptr,
                     int32_t aStopOffset = 0);
 
+  /**
+   * A helper method returning a common parent for two given accessible
+   * elements.
+   */
+  Accessible* CommonParent(Accessible* aAcc1, Accessible* aAcc2,
+                           nsTArray<Accessible*>* aParents1, uint32_t* aPos1,
+                           nsTArray<Accessible*>* aParents2, uint32_t* aPos2) const;
+
   RefPtr<HyperTextAccessible> mRoot;
   RefPtr<HyperTextAccessible> mStartContainer;
   RefPtr<HyperTextAccessible> mEndContainer;
   int32_t mStartOffset;
   int32_t mEndOffset;
 };
 
 

--- a/accessible/generic/Accessible.cpp
+++ b/accessible/generic/Accessible.cpp
@@ -2245,16 +2245,40 @@ Accessible::AnchorAt(uint32_t aAnchorInd
 
 already_AddRefed<nsIURI>
 Accessible::AnchorURIAt(uint32_t aAnchorIndex)
 {
   NS_PRECONDITION(IsLink(), "AnchorURIAt is called on not hyper link!");
   return nullptr;
 }
 
+void
+Accessible::ToTextPoint(HyperTextAccessible** aContainer, int32_t* aOffset,
+                        bool aIsBefore) const
+{
+  if (IsHyperText()) {
+    *aContainer = const_cast<Accessible*>(this)->AsHyperText();
+    *aOffset = aIsBefore ? 0 : (*aContainer)->CharacterCount();
+    return;
+  }
+
+  const Accessible* child = nullptr;
+  const Accessible* parent = this;
+  do {
+    child = parent;
+    parent = parent->Parent();
+  } while (parent && !parent->IsHyperText());
+
+  if (parent) {
+    *aContainer = const_cast<Accessible*>(parent)->AsHyperText();
+    *aOffset = (*aContainer)->GetChildOffset(
+      child->IndexInParent() + static_cast<int32_t>(!aIsBefore));
+  }
+}
+
 
 ////////////////////////////////////////////////////////////////////////////////
 // SelectAccessible
 
 void
 Accessible::SelectedItems(nsTArray<Accessible*>* aItems)
 {
   AccIterator iter(this, filters::GetSelected);

--- a/accessible/generic/Accessible.h
+++ b/accessible/generic/Accessible.h
@@ -753,16 +753,22 @@ public:
    */
   virtual Accessible* AnchorAt(uint32_t aAnchorIndex);
 
   /**
    * Returns an anchor URI at the given index.
    */
   virtual already_AddRefed<nsIURI> AnchorURIAt(uint32_t aAnchorIndex);
 
+  /**
+   * Returns a text point for the accessible element.
+   */
+  void ToTextPoint(HyperTextAccessible** aContainer, int32_t* aOffset,
+                   bool aIsBefore = true) const;
+
   //////////////////////////////////////////////////////////////////////////////
   // SelectAccessible
 
   /**
    * Return an array of selected items.
    */
   virtual void SelectedItems(nsTArray<Accessible*>* aItems);
 

--- a/accessible/generic/HyperTextAccessible.cpp
+++ b/accessible/generic/HyperTextAccessible.cpp
@@ -1764,17 +1764,17 @@ HyperTextAccessible::EnclosingRange(a11y
   } else {
     aRange.Set(mDoc, mDoc, 0, mDoc, mDoc->CharacterCount());
   }
 }
 
 void
 HyperTextAccessible::SelectionRanges(nsTArray<a11y::TextRange>* aRanges) const
 {
-  NS_ASSERTION(aRanges->Length() != 0, "TextRange array supposed to be empty");
+  MOZ_ASSERT(aRanges->Length() == 0, "TextRange array supposed to be empty");
 
   dom::Selection* sel = DOMSelection();
   if (!sel)
     return;
 
   aRanges->SetCapacity(sel->RangeCount());
 
   for (uint32_t idx = 0; idx < sel->RangeCount(); idx++) {

--- a/accessible/generic/HyperTextAccessible.h
+++ b/accessible/generic/HyperTextAccessible.h
@@ -253,17 +253,17 @@ public:
   /**
    * Return text offset of the given child accessible within hypertext
    * accessible.
    *
    * @param  aChild           [in] accessible child to get text offset for
    * @param  aInvalidateAfter [in, optional] indicates whether invalidate
    *                           cached offsets for next siblings of the child
    */
-  int32_t GetChildOffset(Accessible* aChild,
+  int32_t GetChildOffset(const Accessible* aChild,
                          bool aInvalidateAfter = false) const
   {
     int32_t index = GetIndexOf(aChild);
     return index == -1 ? -1 : GetChildOffset(index, aInvalidateAfter);
   }
 
   /**
    * Return text offset for the child accessible index.

--- a/accessible/interfaces/ia2/Makefile.in
+++ b/accessible/interfaces/ia2/Makefile.in
@@ -6,16 +6,17 @@ IA2DIR        = $(topsrcdir)/other-licen
 
 GARBAGE       += $(MIDL_GENERATED_FILES)
 
 # Please keep this list in sync with the moz.build file until the rest of this
 # Makefile is ported over.
 MIDL_INTERFACES = \
   Accessible2.idl \
   Accessible2_2.idl \
+  Accessible2_3.idl \
   AccessibleAction.idl \
   AccessibleApplication.idl \
   AccessibleComponent.idl \
   AccessibleDocument.idl \
   AccessibleEditableText.idl \
   AccessibleHyperlink.idl \
   AccessibleHypertext.idl \
   AccessibleHypertext2.idl \

--- a/accessible/interfaces/nsIAccessibleTextRange.idl
+++ b/accessible/interfaces/nsIAccessibleTextRange.idl
@@ -8,17 +8,17 @@
 interface nsIAccessible;
 interface nsIAccessibleText;
 interface nsIArray;
 interface nsIVariant;
 
 /**
  * A range representing a piece of text in the document.
  */
-[scriptable, uuid(525b3401-8a67-4822-b35d-661065767cd8)]
+[scriptable, uuid(c4515623-55f9-4543-a3d5-c1e9afa588f4)]
 interface nsIAccessibleTextRange : nsISupports
 {
   readonly attribute nsIAccessibleText startContainer;
   readonly attribute long startOffset;
   readonly attribute nsIAccessibleText endContainer;
   readonly attribute long endOffset;
 
   /**
@@ -77,16 +77,21 @@ interface nsIAccessibleTextRange : nsISu
   void moveEnd(in unsigned long aUnit, in long aCount);
 
   /**
    * Normalize the range to the closest unit of the given type.
    */
   void normalize(in unsigned long aUnit);
 
   /**
+   * Crops the range by the given accessible element.
+   */
+  boolean crop(in nsIAccessible aContainer);
+
+  /**
    * Return range enclosing the found text.
    */
   nsIAccessibleTextRange findText(in AString aText, in boolean aIsBackward,
                                   in boolean aIsIgnoreCase);
 
   /**
    * Text attributes. Used in conjunction with findAttrs().
    */

--- a/accessible/tests/mochitest/text.js
+++ b/accessible/tests/mochitest/text.js
@@ -468,16 +468,20 @@ function testTextRange(aRange, aRangeDes
            "Wrong start container of " + aRangeDescr);
   is(aRange.startOffset, aStartOffset,
      "Wrong start offset of " + aRangeDescr);
   isObject(aRange.endContainer, getAccessible(aEndContainer),
            "Wrong end container of " + aRangeDescr);
   is(aRange.endOffset, aEndOffset,
      "Wrong end offset of " + aRangeDescr);
 
+  if (aText === undefined) {
+    return;
+  }
+
   is(aRange.text, aText, "Wrong text of " + aRangeDescr);
 
   var children = aRange.embeddedChildren;
   is(children ? children.length : 0, aChildren ? aChildren.length : 0,
      "Wrong embedded children count of " + aRangeDescr);
 
   isObject(aRange.container, getAccessible(aCommonContainer),
            "Wrong container of " + aRangeDescr);

--- a/accessible/tests/mochitest/textrange/a11y.ini
+++ b/accessible/tests/mochitest/textrange/a11y.ini
@@ -1,3 +1,4 @@
 [DEFAULT]
 
 [test_general.html]
+[test_selection.html]

new file mode 100644
--- /dev/null
+++ b/accessible/tests/mochitest/textrange/test_selection.html
@@ -0,0 +1,120 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Text Range selection tests</title>
+  <link rel="stylesheet" type="text/css"
+        href="chrome://mochikit/content/tests/SimpleTest/test.css" />
+
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript"
+          src="../common.js"></script>
+  <script type="application/javascript"
+          src="../text.js"></script>
+  <script type="application/javascript"
+          src="../layout.js"></script>
+  <script type="application/javascript">
+
+    function doTest()
+    {
+      var sel = window.getSelection();
+      var p = getNode("p1");
+      var a = getNode("p2_a");
+
+      var range = document.createRange();
+      sel.addRange(range);
+
+      // the accessible is contained by the range
+      range.selectNode(p);
+
+      var a11yranges = getAccessible(document, [nsIAccessibleText]).selectionRanges;
+      var a11yrange = a11yranges.queryElementAt(0, nsIAccessibleTextRange);
+
+      testTextRange(a11yrange, "selection range #1", document, 3, document, 4);
+
+      ok(a11yrange.crop(getAccessible(a)), "Range failed to crop #1.");
+      testTextRange(a11yrange, "cropped range #1", a, 0, a, 5);
+
+      // the range is contained by the accessible
+      range.selectNode(a);
+      var a11yranges = getAccessible(document, [nsIAccessibleText]).selectionRanges;
+      var a11yrange = a11yranges.queryElementAt(0, nsIAccessibleTextRange);
+
+      testTextRange(a11yrange, "selection range #2", p, 5, p, 6);
+
+      ok(a11yrange.crop(getAccessible(p)), "Range failed to crop #2.");
+      testTextRange(a11yrange, "cropped range #2", p, 5, p, 6);
+
+      // the range starts before the accessible and ends inside it
+      range.setStart(p, 0);
+      range.setEndAfter(a.firstChild, 4);
+      var a11yranges = getAccessible(document, [nsIAccessibleText]).selectionRanges;
+      var a11yrange = a11yranges.queryElementAt(0, nsIAccessibleTextRange);
+
+      testTextRange(a11yrange, "selection range #3", p, 0, a, 4);
+
+      ok(a11yrange.crop(getAccessible(a)), "Range failed to crop #3.");
+      testTextRange(a11yrange, "cropped range #3", a, 0, a, 4);
+
+      // the range starts inside the accessible and ends after it
+      range.setStart(a.firstChild, 1);
+      range.setEndAfter(p);
+      var a11yranges = getAccessible(document, [nsIAccessibleText]).selectionRanges;
+      var a11yrange = a11yranges.queryElementAt(0, nsIAccessibleTextRange);
+
+      testTextRange(a11yrange, "selection range #4", a, 1, document, 4);
+
+      ok(a11yrange.crop(getAccessible(a)), "Range failed to crop #4.");
+      testTextRange(a11yrange, "cropped range #4", a, 1, a, 5);
+
+      // the range ends before the accessible
+      range.setStart(p.firstChild, 0);
+      range.setEnd(p.firstChild, 4);
+      var a11yranges = getAccessible(document, [nsIAccessibleText]).selectionRanges;
+      var a11yrange = a11yranges.queryElementAt(0, nsIAccessibleTextRange);
+
+      testTextRange(a11yrange, "selection range #5", p, 0, p, 4);
+      ok(!a11yrange.crop(getAccessible(a)), "Crop #5 succeeded while it shouldn't");
+
+      // the range starts after the accessible
+      range.setStart(p.lastChild, 0);
+      range.setEnd(p.lastChild, 4);
+      var a11yranges = getAccessible(document, [nsIAccessibleText]).selectionRanges;
+      var a11yrange = a11yranges.queryElementAt(0, nsIAccessibleTextRange);
+
+      testTextRange(a11yrange, "selection range #6", p, 6, p, 10);
+
+      ok(!a11yrange.crop(getAccessible(a)), "Crop #6 succeeded while it shouldn't");
+
+      // crop a range by a table
+      range.selectNode(getNode("c2"));
+      var a11yranges = getAccessible(document, [nsIAccessibleText]).selectionRanges;
+      var a11yrange = a11yranges.queryElementAt(0, nsIAccessibleTextRange);
+
+      testTextRange(a11yrange, "selection range #7", document, 4, document, 5);
+
+      ok(a11yrange.crop(getAccessible("table")), "Range failed to crop #7.");
+      testTextRange(a11yrange, "cropped range #7", "c2", 5, "c2", 6);
+
+      SimpleTest.finish();
+    }
+
+    SimpleTest.waitForExplicitFinish();
+    addA11yLoadEvent(doTest);
+  </script>
+</head>
+<body>
+
+  <a target="_blank"
+     title="Implement IAccessible2_3::selectionRanges"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=1233118">Bug 1233118</a>
+  <p id="display"></p>
+  <div id="content" style="display: none"></div>
+  <pre id="test">
+  </pre>
+
+  <p id="p1">text <a id="p2_a" href="www">link<img id="p2_img", src="../moz.png"></a> text</p>
+
+  <div id="c2">start<table id="table"><tr><td>cell</td></tr></table>end</div>
+</body>
+</html>

--- a/accessible/windows/ia2/ia2Accessible.cpp
+++ b/accessible/windows/ia2/ia2Accessible.cpp
@@ -3,26 +3,28 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "AccessibleWrap.h"
 
 #include "Accessible2_i.c"
 #include "Accessible2_2_i.c"
+#include "Accessible2_3_i.c"
 #include "AccessibleRole.h"
 #include "AccessibleStates.h"
 
 #include "Compatibility.h"
 #include "ia2AccessibleRelation.h"
 #include "IUnknownImpl.h"
 #include "nsCoreUtils.h"
 #include "nsIAccessibleTypes.h"
 #include "mozilla/a11y/PDocAccessible.h"
 #include "Relation.h"
+#include "TextRange-inl.h"
 #include "nsAccessibilityService.h"
 
 #include "nsIPersistentProperties2.h"
 #include "nsISimpleEnumerator.h"
 
 using namespace mozilla;
 using namespace mozilla::a11y;
 
@@ -35,17 +37,19 @@ template<typename String> static void Es
 STDMETHODIMP
 ia2Accessible::QueryInterface(REFIID iid, void** ppv)
 {
   if (!ppv)
     return E_INVALIDARG;
 
   *ppv = nullptr;
 
-  if (IID_IAccessible2_2 == iid)
+  if (IID_IAccessible2_3 == iid)
+    *ppv = static_cast<IAccessible2_3*>(this);
+  else if (IID_IAccessible2_2 == iid)
     *ppv = static_cast<IAccessible2_2*>(this);
   else if (IID_IAccessible2 == iid && !Compatibility::IsIA2Off())
     *ppv = static_cast<IAccessible2*>(this);
 
   if (*ppv) {
     (reinterpret_cast<IUnknown*>(*ppv))->AddRef();
     return S_OK;
   }
@@ -744,16 +748,68 @@ ia2Accessible::get_relationTargetsOfType
     (*aTargets)[i]->AddRef();
   }
 
   return S_OK;
 
   A11Y_TRYBLOCK_END
 }
 
+STDMETHODIMP
+ia2Accessible::get_selectionRanges(IA2Range** aRanges,
+                                   long *aNRanges)
+{
+  A11Y_TRYBLOCK_BEGIN
+
+  if (!aRanges || !aNRanges || aNRanges <= 0)
+    return E_INVALIDARG;
+
+  *aNRanges = 0;
+
+  AccessibleWrap* acc = static_cast<AccessibleWrap*>(this);
+  if (acc->IsDefunct())
+    return CO_E_OBJNOTCONNECTED;
+
+  nsAutoTArray<TextRange, 1> ranges;
+  acc->Document()->SelectionRanges(&ranges);
+  uint32_t len = ranges.Length();
+  for (uint32_t idx = 0; idx < len; idx++) {
+    if (!ranges[idx].Crop(acc)) {
+      ranges.RemoveElementAt(idx);
+    }
+  }
+
+  *aNRanges = ranges.Length();
+  *aRanges = static_cast<IA2Range*>(
+    ::CoTaskMemAlloc(sizeof(IA2Range) * *aNRanges));
+  if (!*aRanges)
+    return E_OUTOFMEMORY;
+
+  for (uint32_t idx = 0; idx < static_cast<uint32_t>(*aNRanges); idx++) {
+    AccessibleWrap* anchor =
+      static_cast<AccessibleWrap*>(ranges[idx].StartContainer());
+    (*aRanges)[idx].anchor = static_cast<IAccessible2*>(anchor);
+    anchor->AddRef();
+
+    (*aRanges)[idx].anchorOffset = ranges[idx].StartOffset();
+
+    AccessibleWrap* active =
+      static_cast<AccessibleWrap*>(ranges[idx].EndContainer());
+    (*aRanges)[idx].active = static_cast<IAccessible2*>(active);
+    active->AddRef();
+
+    (*aRanges)[idx].activeOffset = ranges[idx].EndOffset();
+  }
+
+  return S_OK;
+
+  A11Y_TRYBLOCK_END
+}
+
+
 ////////////////////////////////////////////////////////////////////////////////
 // Helpers
 
 template<typename String>
 static inline void
 EscapeAttributeChars(String& aStr)
 {
   int32_t offset = 0;

--- a/accessible/windows/ia2/ia2Accessible.h
+++ b/accessible/windows/ia2/ia2Accessible.h
@@ -4,23 +4,23 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef mozilla_a11y_ia2Accessible_h_
 #define mozilla_a11y_ia2Accessible_h_
 
 #include "nsISupports.h"
 
-#include "Accessible2_2.h"
+#include "Accessible2_3.h"
 
 namespace mozilla {
 namespace a11y {
 class Attribute;
 
-class ia2Accessible : public IAccessible2_2
+class ia2Accessible : public IAccessible2_3
 {
 public:
 
   // IUnknown
   STDMETHODIMP QueryInterface(REFIID, void**);
 
   // IAccessible2
   virtual /* [propget] */ HRESULT STDMETHODCALLTYPE get_nRelations(
@@ -99,16 +99,21 @@ public:
 
   virtual /* [propget] */ HRESULT STDMETHODCALLTYPE get_relationTargetsOfType(
     /* [in] */ BSTR type,
     /* [in] */ long maxTargets,
     /* [out, size_is(,*nTargets)] */ IUnknown*** targets,
     /* [out, retval] */ long* nTargets
   );
 
+  // IAccessible2_3
+  virtual /* [propget] */ HRESULT STDMETHODCALLTYPE get_selectionRanges(
+    /* [out, size_is(,*nRanges)] */ IA2Range** ranges,
+    /* [out, retval] */ long *nRanges);
+
   // Helper method
   static HRESULT ConvertToIA2Attributes(nsIPersistentProperties* aAttributes,
                                         BSTR* aIA2Attributes);
   static HRESULT ConvertToIA2Attributes(nsTArray<Attribute>* aAttributes,
                                         BSTR* aIA2Attributes);
 };
 
 } // namespace a11y

--- a/accessible/xpcom/xpcAccessibleTextRange.cpp
+++ b/accessible/xpcom/xpcAccessibleTextRange.cpp
@@ -1,17 +1,17 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* vim: set ts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "xpcAccessibleTextRange.h"
 
-#include "TextRange.h"
+#include "TextRange-inl.h"
 #include "xpcAccessibleDocument.h"
 
 #include "nsIMutableArray.h"
 #include "nsComponentManagerUtils.h"
 #include "nsQueryObject.h"
 
 using namespace mozilla;
 using namespace mozilla::a11y;
@@ -166,16 +166,26 @@ xpcAccessibleTextRange::MoveEnd(uint32_t
 
 NS_IMETHODIMP
 xpcAccessibleTextRange::Normalize(uint32_t aUnit)
 {
   return NS_OK;
 }
 
 NS_IMETHODIMP
+xpcAccessibleTextRange::Crop(nsIAccessible* aContainer, bool* aSuccess)
+{
+  Accessible* container = aContainer->ToInternalAccessible();
+  NS_ENSURE_TRUE(container, NS_ERROR_INVALID_ARG);
+
+  *aSuccess = mRange.Crop(container);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
 xpcAccessibleTextRange::FindText(const nsAString& aText, bool aIsBackward,
                                  bool aIsIgnoreCase,
                                  nsIAccessibleTextRange** aRange)
 {
   return NS_OK;
 }
 
 NS_IMETHODIMP

--- a/accessible/xpcom/xpcAccessibleTextRange.h
+++ b/accessible/xpcom/xpcAccessibleTextRange.h
@@ -44,16 +44,17 @@ public:
                               uint32_t aOtherRangeEndPoint,
                               int32_t* aResult) final override;
   NS_IMETHOD GetText(nsAString& aText) final override;
   NS_IMETHOD GetBounds(nsIArray** aRectList) final override;
   NS_IMETHOD Move(uint32_t aUnit, int32_t aCount) final override;
   NS_IMETHOD MoveStart(uint32_t aUnit, int32_t aCount) final override;
   NS_IMETHOD MoveEnd(uint32_t aUnit, int32_t aCount) final override;
   NS_IMETHOD Normalize(uint32_t aUnit) final override;
+  NS_IMETHOD Crop(nsIAccessible* aContainer, bool* aSuccess) final override;
   NS_IMETHOD FindText(const nsAString& aText, bool aIsBackward, bool aIsIgnoreCase,
                       nsIAccessibleTextRange** aRange) final override;
   NS_IMETHOD FindAttr(uint32_t aAttr, nsIVariant* aVal, bool aIsBackward,
                       nsIAccessibleTextRange** aRange) final override;
   NS_IMETHOD AddToSelection() final override;
   NS_IMETHOD RemoveFromSelection() final override;
   NS_IMETHOD Select() final override;
   NS_IMETHOD ScrollIntoView(uint32_t aHow) final override;

--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -1389,26 +1389,29 @@ pref("social.sidebar.unload_timeout_ms",
 pref("social.share.activationPanelEnabled", true);
 pref("social.shareDirectory", "https://activations.cdn.mozilla.net/sharePanel.html");
 
 pref("dom.identity.enabled", false);
 
 // Block insecure active content on https pages
 pref("security.mixed_content.block_active_content", true);
 
-// Show degraded UI for http pages with password fields
-#ifdef NIGHTLY_BUILD
+// Show degraded UI for http pages with password fields.
+// Only for Nightly and Dev Edition for not, not for beta or release.
+#ifndef RELEASE_BUILD
 pref("security.insecure_password.ui.enabled", true);
 #else
 pref("security.insecure_password.ui.enabled", false);
 #endif
 
 // 1 = allow MITM for certificate pinning checks.
 pref("security.cert_pinning.enforcement_level", 1);
 
+// NB: Changes to this pref affect CERT_CHAIN_SHA1_POLICY_STATUS telemetry.
+// See the comment in CertVerifier.cpp.
 // 0 = allow SHA-1
 pref("security.pki.sha1_enforcement_level", 0);
 
 // Required blocklist freshness for OneCRL OCSP bypass
 // (default is 1.25x extensions.blocklist.interval, or 30 hours)
 pref("security.onecrl.maximum_staleness_in_seconds", 108000);
 
 // Override the Gecko-default value of false for Firefox.

--- a/browser/base/content/test/general/browser_sanitizeDialog.js
+++ b/browser/base/content/test/general/browser_sanitizeDialog.js
@@ -549,17 +549,17 @@ add_task(function* test_offline_cache() 
 
   // Give www.example.com privileges to store offline data
   Services.perms.addFromPrincipal(principal, "offline-app", Ci.nsIPermissionManager.ALLOW_ACTION);
   Services.perms.addFromPrincipal(principal, "offline-app", Ci.nsIOfflineCacheUpdateService.ALLOW_NO_WARN);
 
   // Store something to the offline cache
   var appcacheserv = Cc["@mozilla.org/network/application-cache-service;1"]
                      .getService(Ci.nsIApplicationCacheService);
-  var appcachegroupid = appcacheserv.buildGroupID(makeURI(URL + "/manifest"), LoadContextInfo.default);
+  var appcachegroupid = appcacheserv.buildGroupIDForInfo(makeURI(URL + "/manifest"), LoadContextInfo.default);
   var appcache = appcacheserv.createApplicationCache(appcachegroupid);
   var storage = Services.cache2.appCacheStorage(LoadContextInfo.default, appcache);
 
   // Open the dialog
   let wh = new WindowHelper();
   wh.onload = function () {
     this.selectDuration(Sanitizer.TIMESPAN_EVERYTHING);
     // Show details

--- a/browser/components/search/test/browser.ini
+++ b/browser/components/search/test/browser.ini
@@ -9,42 +9,33 @@ support-files =
   test.html
   testEngine.xml
   testEngine_diacritics.xml
   testEngine_dupe.xml
   testEngine_mozsearch.xml
   webapi.html
 
 [browser_426329.js]
-skip-if = e10s # Bug ?????? - Test uses load event and checks event.target.
 [browser_483086.js]
 [browser_addEngine.js]
 [browser_amazon.js]
 [browser_amazon_behavior.js]
-skip-if = e10s # Bug ?????? - some issue with progress listeners [JavaScript Error: "req.originalURI is null" {file: "chrome://mochitests/content/browser/browser/components/search/test/browser_bing_behavior.js" line: 127}]
 [browser_bing.js]
 [browser_bing_behavior.js]
-skip-if = e10s # Bug ?????? - some issue with progress listeners [JavaScript Error: "req.originalURI is null" {file: "chrome://mochitests/content/browser/browser/components/search/test/browser_bing_behavior.js" line: 127}]
 [browser_contextmenu.js]
-skip-if = e10s # Bug ?????? - Test touches content (content.window.getSelection().QueryInterface(Ci.nsISelectionPrivate)....)
 [browser_eBay.js]
 [browser_eBay_behavior.js]
-skip-if = e10s # Bug ?????? - some issue with progress listeners [JavaScript Error: "req.originalURI is null" {file: "chrome://mochitests/content/browser/browser/components/search/test/browser_bing_behavior.js" line: 127}]
 [browser_google.js]
 [browser_google_behavior.js]
-skip-if = e10s # Bug ?????? - some issue with progress listeners [JavaScript Error: "req.originalURI is null" {file: "chrome://mochitests/content/browser/browser/components/search/test/browser_bing_behavior.js" line: 127}]
 [browser_healthreport.js]
 [browser_hiddenOneOffs_cleanup.js]
 [browser_hiddenOneOffs_diacritics.js]
 [browser_oneOffHeader.js]
-skip-if = e10s # bug ?????? - Test alters the searchbar textbox value which causes issues with other tests in e10s.
 [browser_private_search_perwindowpb.js]
-skip-if = e10s # Bug ?????? - Test uses load event and checks event.target.
 [browser_yahoo.js]
 [browser_yahoo_behavior.js]
-skip-if = e10s # Bug ?????? - some issue with progress listeners [JavaScript Error: "req.originalURI is null" {file: "chrome://mochitests/content/browser/browser/components/search/test/browser_bing_behavior.js" line: 127}]
 [browser_abouthome_behavior.js]
-skip-if = e10s || true # Bug ??????, Bug 1100301 - leaks windows until shutdown when --run-by-dir
+skip-if = true # Bug ??????, Bug 1100301 - leaks windows until shutdown when --run-by-dir
 [browser_searchbar_openpopup.js]
-skip-if = os == "linux" || e10s # Linux has different focus behaviours and e10s seems to have timing issues.
+skip-if = os == "linux" # Linux has different focus behaviours.
 [browser_searchbar_keyboard_navigation.js]
 [browser_searchbar_smallpanel_keyboard_navigation.js]
 [browser_webapi.js]

--- a/browser/components/search/test/browser_426329.js
+++ b/browser/components/search/test/browser_426329.js
@@ -1,19 +1,10 @@
-// Instead of loading ChromeUtils.js into the test scope in browser-test.js for all tests,
-// we only need ChromeUtils.js for a few files which is why we are using loadSubScript.
-var ChromeUtils = {};
-this._scriptLoader = Cc["@mozilla.org/moz/jssubscript-loader;1"].
-                     getService(Ci.mozIJSSubScriptLoader);
-this._scriptLoader.loadSubScript("chrome://mochikit/content/tests/SimpleTest/ChromeUtils.js", ChromeUtils);
-
 XPCOMUtils.defineLazyModuleGetter(this, "FormHistory",
   "resource://gre/modules/FormHistory.jsm");
-XPCOMUtils.defineLazyModuleGetter(this, "Promise",
-  "resource://gre/modules/Promise.jsm");
 
 function expectedURL(aSearchTerms) {
   const ENGINE_HTML_BASE = "http://mochi.test:8888/browser/browser/components/search/test/test.html";
   var textToSubURI = Cc["@mozilla.org/intl/texttosuburi;1"].
                      getService(Ci.nsITextToSubURI);
   var searchArg = textToSubURI.ConvertAndEscape("utf-8", aSearchTerms);
   return ENGINE_HTML_BASE + "?test=" + searchArg;
 }
@@ -48,216 +39,198 @@ function getMenuEntries() {
   var column = autocompleteMenu.tree.columns[0];
   var numRows = autocompleteMenu.tree.view.rowCount;
   for (var i = 0; i < numRows; i++) {
     entries.push(autocompleteMenu.tree.view.getValueAt(i, column));
   }
   return entries;
 }
 
-function* countEntries(name, value) {
-  let deferred = Promise.defer();
-  let count = 0;
-  let obj = name && value ? {fieldname: name, value: value} : {};
-  FormHistory.count(obj,
-                    { handleResult: function(result) { count = result; },
-                      handleError: function(error) { throw error; },
-                      handleCompletion: function(reason) {
-                        if (!reason) {
-                          deferred.resolve(count);
+function countEntries(name, value) {
+  return new Promise(resolve => {
+    let count = 0;
+    let obj = name && value ? {fieldname: name, value: value} : {};
+    FormHistory.count(obj,
+                      { handleResult: function(result) { count = result; },
+                        handleError: function(error) { throw error; },
+                        handleCompletion: function(reason) {
+                          if (!reason) {
+                            resolve(count);
+                          }
                         }
-                      }
-                    });
-  return deferred.promise;
+                      });
+  });
 }
 
 var searchBar;
 var searchButton;
 var searchEntries = ["test"];
-function* promiseSetEngine() {
-  let deferred = Promise.defer();
-  var ss = Services.search;
+function promiseSetEngine() {
+  return new Promise(resolve => {
+    var ss = Services.search;
 
-  function observer(aSub, aTopic, aData) {
-    switch (aData) {
-      case "engine-added":
-        var engine = ss.getEngineByName("Bug 426329");
-        ok(engine, "Engine was added.");
-        ss.currentEngine = engine;
-        break;
-      case "engine-current":
-        ok(ss.currentEngine.name == "Bug 426329", "currentEngine set");
-        searchBar = BrowserSearch.searchBar;
-        searchButton = document.getAnonymousElementByAttribute(searchBar,
-                           "anonid", "search-go-button");
-        ok(searchButton, "got search-go-button");
-        searchBar.value = "test";
+    function observer(aSub, aTopic, aData) {
+      switch (aData) {
+        case "engine-added":
+          var engine = ss.getEngineByName("Bug 426329");
+          ok(engine, "Engine was added.");
+          ss.currentEngine = engine;
+          break;
+        case "engine-current":
+          ok(ss.currentEngine.name == "Bug 426329", "currentEngine set");
+          searchBar = BrowserSearch.searchBar;
+          searchButton = document.getAnonymousElementByAttribute(searchBar,
+                             "anonid", "search-go-button");
+          ok(searchButton, "got search-go-button");
+          searchBar.value = "test";
 
-        Services.obs.removeObserver(observer, "browser-search-engine-modified");
-        deferred.resolve();
-        break;
-    }
-  };
+          Services.obs.removeObserver(observer, "browser-search-engine-modified");
+          resolve();
+          break;
+      }
+    };
 
-  Services.obs.addObserver(observer, "browser-search-engine-modified", false);
-  ss.addEngine("http://mochi.test:8888/browser/browser/components/search/test/426329.xml",
-               null, "data:image/x-icon,%00", false);
-
-  return deferred.promise;
+    Services.obs.addObserver(observer, "browser-search-engine-modified", false);
+    ss.addEngine("http://mochi.test:8888/browser/browser/components/search/test/426329.xml",
+                 null, "data:image/x-icon,%00", false);
+  });
 }
 
-function* promiseRemoveEngine() {
-  let deferred = Promise.defer();
-  var ss = Services.search;
+function promiseRemoveEngine() {
+  return new Promise(resolve => {
+    var ss = Services.search;
 
-  function observer(aSub, aTopic, aData) {
-    if (aData == "engine-removed") {
-      Services.obs.removeObserver(observer, "browser-search-engine-modified");
-      deferred.resolve();
-    }
-  };
+    function observer(aSub, aTopic, aData) {
+      if (aData == "engine-removed") {
+        Services.obs.removeObserver(observer, "browser-search-engine-modified");
+        resolve();
+      }
+    };
 
-  Services.obs.addObserver(observer, "browser-search-engine-modified", false);
-  var engine = ss.getEngineByName("Bug 426329");
-  ss.removeEngine(engine);
-
-  return deferred.promise;
+    Services.obs.addObserver(observer, "browser-search-engine-modified", false);
+    var engine = ss.getEngineByName("Bug 426329");
+    ss.removeEngine(engine);
+  });
 }
 
 
 var preSelectedBrowser;
 var preTabNo;
 function* prepareTest() {
   preSelectedBrowser = gBrowser.selectedBrowser;
   preTabNo = gBrowser.tabs.length;
   searchBar = BrowserSearch.searchBar;
 
-  let windowFocused = Promise.defer();
-  SimpleTest.waitForFocus(windowFocused.resolve, window);
-  yield windowFocused.promise;
+  yield SimpleTest.promiseFocus();
+
+  if (document.activeElement == searchBar)
+    return;
 
-  let deferred = Promise.defer();
-  if (document.activeElement != searchBar) {
-    searchBar.addEventListener("focus", function onFocus() {
-      searchBar.removeEventListener("focus", onFocus);
-      deferred.resolve();
-    });
-    gURLBar.focus();
-    searchBar.focus();
-  } else {
-    deferred.resolve();
-  }
-  return deferred.promise;
+  let focusPromise = BrowserTestUtils.waitForEvent(searchBar, "focus");
+  gURLBar.focus();
+  searchBar.focus();
+  yield focusPromise;
 }
 
 add_task(function* testSetupEngine() {
   yield promiseSetEngine();
 });
 
 add_task(function* testReturn() {
-  yield prepareTest();
+  yield* prepareTest();
   EventUtils.synthesizeKey("VK_RETURN", {});
-  let event = yield promiseOnLoad();
+  yield BrowserTestUtils.browserLoaded(gBrowser.selectedBrowser);
 
   is(gBrowser.tabs.length, preTabNo, "Return key did not open new tab");
-  is(event.originalTarget, preSelectedBrowser.contentDocument,
-     "Return key loaded results in current tab");
-  is(event.originalTarget.URL, expectedURL(searchBar.value), "testReturn opened correct search page");
+  is(gBrowser.currentURI.spec, expectedURL(searchBar.value), "testReturn opened correct search page");
 });
 
 add_task(function* testAltReturn() {
-  yield prepareTest();
-  EventUtils.synthesizeKey("VK_RETURN", { altKey: true });
-  let event = yield promiseOnLoad();
+  yield* prepareTest();
+  yield BrowserTestUtils.openNewForegroundTab(gBrowser, () => {
+    EventUtils.synthesizeKey("VK_RETURN", { altKey: true });
+  });
 
   is(gBrowser.tabs.length, preTabNo + 1, "Alt+Return key added new tab");
-  isnot(event.originalTarget, preSelectedBrowser.contentDocument,
-        "Alt+Return key loaded results in new tab");
-  is(event.originalTarget, gBrowser.contentDocument,
-     "Alt+Return key loaded results in foreground tab");
-  is(event.originalTarget.URL, expectedURL(searchBar.value), "testAltReturn opened correct search page");
+  is(gBrowser.currentURI.spec, expectedURL(searchBar.value), "testAltReturn opened correct search page");
 });
 
 //Shift key has no effect for now, so skip it
 add_task(function* testShiftAltReturn() {
   return;
 
-  yield prepareTest();
+  yield* prepareTest();
+
+  let url = expectedURL(searchBar.value);
+
+  let newTabPromise = BrowserTestUtils.waitForNewTab(gBrowser, url);
   EventUtils.synthesizeKey("VK_RETURN", { shiftKey: true, altKey: true });
-  let event = yield promiseOnLoad();
+  let newTab = yield newTabPromise;
 
   is(gBrowser.tabs.length, preTabNo + 1, "Shift+Alt+Return key added new tab");
-  isnot(event.originalTarget, preSelectedBrowser.contentDocument,
-        "Shift+Alt+Return key loaded results in new tab");
-  isnot(event.originalTarget, gBrowser.contentDocument,
-        "Shift+Alt+Return key loaded results in background tab");
-  is(event.originalTarget.URL, expectedURL(searchBar.value), "testShiftAltReturn opened correct search page");
+  is(gBrowser.currentURI.spec, url, "testShiftAltReturn opened correct search page");
 });
 
 add_task(function* testLeftClick() {
-  yield prepareTest();
+  yield* prepareTest();
   simulateClick({ button: 0 }, searchButton);
-  let event = yield promiseOnLoad();
+  yield BrowserTestUtils.browserLoaded(gBrowser.selectedBrowser);
   is(gBrowser.tabs.length, preTabNo, "LeftClick did not open new tab");
-  is(event.originalTarget, preSelectedBrowser.contentDocument,
-     "LeftClick loaded results in current tab");
-  is(event.originalTarget.URL, expectedURL(searchBar.value), "testLeftClick opened correct search page");
+  is(gBrowser.currentURI.spec, expectedURL(searchBar.value), "testLeftClick opened correct search page");
 });
 
 add_task(function* testMiddleClick() {
-  yield prepareTest();
-  simulateClick({ button: 1 }, searchButton);
-  let event = yield promiseOnLoad();
+  yield* prepareTest();
+  yield BrowserTestUtils.openNewForegroundTab(gBrowser, () => {
+    simulateClick({ button: 1 }, searchButton);
+  });
   is(gBrowser.tabs.length, preTabNo + 1, "MiddleClick added new tab");
-  isnot(event.originalTarget, preSelectedBrowser.contentDocument,
-        "MiddleClick loaded results in new tab");
-  is(event.originalTarget, gBrowser.contentDocument,
-     "MiddleClick loaded results in foreground tab");
-  is(event.originalTarget.URL, expectedURL(searchBar.value), "testMiddleClick opened correct search page");
+  is(gBrowser.currentURI.spec, expectedURL(searchBar.value), "testMiddleClick opened correct search page");
 });
 
 add_task(function* testShiftMiddleClick() {
-  yield prepareTest();
+  yield* prepareTest();
+
+  let url = expectedURL(searchBar.value);
+
+  let newTabPromise = BrowserTestUtils.waitForNewTab(gBrowser, url);
   simulateClick({ button: 1, shiftKey: true }, searchButton);
-  let event = yield promiseOnLoad();
+  let newTab = yield newTabPromise;
+
   is(gBrowser.tabs.length, preTabNo + 1, "Shift+MiddleClick added new tab");
-  isnot(event.originalTarget, preSelectedBrowser.contentDocument,
-        "Shift+MiddleClick loaded results in new tab");
-  isnot(event.originalTarget, gBrowser.contentDocument,
-        "Shift+MiddleClick loaded results in background tab");
-  is(event.originalTarget.URL, expectedURL(searchBar.value), "testShiftMiddleClick opened correct search page");
+  is(newTab.linkedBrowser.currentURI.spec, url, "testShiftMiddleClick opened correct search page");
 });
 
 add_task(function* testRightClick() {
   preTabNo = gBrowser.tabs.length;
-  content.location.href = "about:blank";
-  simulateClick({ button: 2 }, searchButton);
-  let deferred = Promise.defer();
-  setTimeout(function() {
-    is(gBrowser.tabs.length, preTabNo, "RightClick did not open new tab");
-    is(gBrowser.currentURI.spec, "about:blank", "RightClick did nothing");
-    deferred.resolve();
-  }, 5000);
-  yield deferred.promise;
+  gBrowser.selectedBrowser.loadURI("about:blank");
+  yield new Promise(resolve => {
+    setTimeout(function() {
+      is(gBrowser.tabs.length, preTabNo, "RightClick did not open new tab");
+      is(gBrowser.currentURI.spec, "about:blank", "RightClick did nothing");
+      resolve();
+    }, 5000);
+    simulateClick({ button: 2 }, searchButton);
+  });
   // The click in the searchbox focuses it, which opens the suggestion
   // panel. Clean up after ourselves.
   searchBar.textbox.popup.hidePopup();
 });
 
 add_task(function* testSearchHistory() {
   var textbox = searchBar._textbox;
   for (var i = 0; i < searchEntries.length; i++) {
     let count = yield countEntries(textbox.getAttribute("autocompletesearchparam"), searchEntries[i]);
     ok(count > 0, "form history entry '" + searchEntries[i] + "' should exist");
   }
 });
 
 add_task(function* testAutocomplete() {
   var popup = searchBar.textbox.popup;
-  let popupShownPromise = promiseEvent(popup, "popupshown");
+  let popupShownPromise = BrowserTestUtils.waitForEvent(popup, "popupshown");
   searchBar.textbox.showHistoryPopup();
   yield popupShownPromise;
   checkMenuEntries(searchEntries);
 });
 
 add_task(function* testClearHistory() {
   let controller = searchBar.textbox.controllers.getControllerForCommand("cmd_clearhistory")
   ok(controller.isCommandEnabled("cmd_clearhistory"), "Clear history command enabled");
@@ -266,11 +239,11 @@ add_task(function* testClearHistory() {
   ok(count == 0, "History cleared");
 });
 
 add_task(function* asyncCleanup() {
   searchBar.value = "";
   while (gBrowser.tabs.length != 1) {
     gBrowser.removeTab(gBrowser.tabs[0], {animate: false});
   }
-  content.location.href = "about:blank";
+  gBrowser.selectedBrowser.loadURI("about:blank");
   yield promiseRemoveEngine();
 });

--- a/browser/components/search/test/browser_abouthome_behavior.js
+++ b/browser/components/search/test/browser_abouthome_behavior.js
@@ -114,16 +114,19 @@ function test() {
     onStateChange: function onStateChange(webProgress, req, flags, status) {
       info("onStateChange");
       // Only care about top-level document starts
       let docStart = Ci.nsIWebProgressListener.STATE_IS_DOCUMENT |
                      Ci.nsIWebProgressListener.STATE_START;
       if (!(flags & docStart) || !webProgress.isTopLevel)
         return;
 
+      if (req.originalURI.spec == "about:blank")
+        return;
+
       info("received document start");
 
       ok(req instanceof Ci.nsIChannel, "req is a channel");
       is(req.originalURI.spec, gCurrTest.searchURL, "search URL was loaded");
       info("Actual URI: " + req.URI.spec);
 
       req.cancel(Components.results.NS_ERROR_FAILURE);
 

--- a/browser/components/search/test/browser_amazon_behavior.js
+++ b/browser/components/search/test/browser_amazon_behavior.js
@@ -131,16 +131,19 @@ function test() {
     onStateChange: function onStateChange(webProgress, req, flags, status) {
       info("onStateChange");
       // Only care about top-level document starts
       let docStart = Ci.nsIWebProgressListener.STATE_IS_DOCUMENT |
                      Ci.nsIWebProgressListener.STATE_START;
       if (!(flags & docStart) || !webProgress.isTopLevel)
         return;
 
+      if (req.originalURI.spec == "about:blank")
+        return;
+
       info("received document start");
 
       ok(req instanceof Ci.nsIChannel, "req is a channel");
       is(req.originalURI.spec, gCurrTest.searchURL, "search URL was loaded");
       info("Actual URI: " + req.URI.spec);
 
       req.cancel(Components.results.NS_ERROR_FAILURE);
 

--- a/browser/components/search/test/browser_bing_behavior.js
+++ b/browser/components/search/test/browser_bing_behavior.js
@@ -131,16 +131,19 @@ function test() {
     onStateChange: function onStateChange(webProgress, req, flags, status) {
       info("onStateChange");
       // Only care about top-level document starts
       let docStart = Ci.nsIWebProgressListener.STATE_IS_DOCUMENT |
                      Ci.nsIWebProgressListener.STATE_START;
       if (!(flags & docStart) || !webProgress.isTopLevel)
         return;
 
+      if (req.originalURI.spec == "about:blank")
+        return;
+
       info("received document start");
 
       ok(req instanceof Ci.nsIChannel, "req is a channel");
       is(req.originalURI.spec, gCurrTest.searchURL, "search URL was loaded");
       info("Actual URI: " + req.URI.spec);
 
       req.cancel(Components.results.NS_ERROR_FAILURE);
 

--- a/browser/components/search/test/browser_contextmenu.js
+++ b/browser/components/search/test/browser_contextmenu.js
@@ -1,111 +1,98 @@
 /* Any copyright is dedicated to the Public Domain.
  *  * http://creativecommons.org/publicdomain/zero/1.0/ */
 /*
  * Test searching for the selected text using the context menu
  */
 
-function test() {
-  waitForExplicitFinish();
-
+add_task(function* () {
   const ss = Services.search;
   const ENGINE_NAME = "Foo";
   var contextMenu;
 
   let envService = Cc["@mozilla.org/process/environment;1"].getService(Ci.nsIEnvironment);
   let originalValue = envService.get("XPCSHELL_TEST_PROFILE_DIR");
   envService.set("XPCSHELL_TEST_PROFILE_DIR", "1");
 
   let url = "chrome://mochitests/content/browser/browser/components/search/test/";
   let resProt = Services.io.getProtocolHandler("resource")
                         .QueryInterface(Ci.nsIResProtocolHandler);
   let originalSubstitution = resProt.getSubstitution("search-plugins");
   resProt.setSubstitution("search-plugins",
                           Services.io.newURI(url, null, null));
 
-  function observer(aSub, aTopic, aData) {
-    switch (aData) {
-      case "engine-added":
-        var engine = ss.getEngineByName(ENGINE_NAME);
-        ok(engine, "Engine was added.");
-        ss.currentEngine = engine;
-        envService.set("XPCSHELL_TEST_PROFILE_DIR", originalValue);
-        resProt.setSubstitution("search-plugins", originalSubstitution);
-        break;
-      case "engine-current":
-        is(ss.currentEngine.name, ENGINE_NAME, "currentEngine set");
-        startTest();
-        break;
-      case "engine-removed":
-        Services.obs.removeObserver(observer, "browser-search-engine-modified");
-        finish();
-        break;
-    }
-  }
-
-  Services.obs.addObserver(observer, "browser-search-engine-modified", false);
-  ss.addEngine("resource://search-plugins/testEngine_mozsearch.xml",
-               null, "data:image/x-icon,%00", false);
-
-  function startTest() {
-    contextMenu = document.getElementById("contentAreaContextMenu");
-    ok(contextMenu, "Got context menu XUL");
-
-    doOnloadOnce(testContextMenu);
-    let tab = gBrowser.selectedTab = gBrowser.addTab("data:text/plain;charset=utf8,test%20search");
-    registerCleanupFunction(function () {
-      gBrowser.removeTab(tab);
-    });
-  }
-
-  function testContextMenu() {
-    function rightClickOnDocument() {
-      info("rightClickOnDocument: " + content.window.location);
-      waitForBrowserContextMenu(checkContextMenu);
-      var clickTarget = content.document.body;
-      var eventDetails = { type: "contextmenu", button: 2 };
-      EventUtils.synthesizeMouseAtCenter(clickTarget, eventDetails, content);
+  let searchDonePromise;
+  yield new Promise(resolve => {
+    function observer(aSub, aTopic, aData) {
+      switch (aData) {
+        case "engine-added":
+          var engine = ss.getEngineByName(ENGINE_NAME);
+          ok(engine, "Engine was added.");
+          ss.currentEngine = engine;
+          envService.set("XPCSHELL_TEST_PROFILE_DIR", originalValue);
+          resProt.setSubstitution("search-plugins", originalSubstitution);
+          break;
+        case "engine-current":
+          is(ss.currentEngine.name, ENGINE_NAME, "currentEngine set");
+          resolve();
+          break;
+        case "engine-removed":
+          Services.obs.removeObserver(observer, "browser-search-engine-modified");
+          if (searchDonePromise) {
+            searchDonePromise();
+          }
+          break;
+      }
     }
 
-    // check the search menu item and then perform a search
-    function checkContextMenu() {
-      info("checkContextMenu");
-      var searchItem = contextMenu.getElementsByAttribute("id", "context-searchselect")[0];
-      ok(searchItem, "Got search context menu item");
-      is(searchItem.label, 'Search ' + ENGINE_NAME + ' for "test search"', "Check context menu label");
-      is(searchItem.disabled, false, "Check that search context menu item is enabled");
-      doOnloadOnce(checkSearchURL);
-      searchItem.click();
-      contextMenu.hidePopup();
-    }
+    Services.obs.addObserver(observer, "browser-search-engine-modified", false);
+    ss.addEngine("resource://search-plugins/testEngine_mozsearch.xml",
+                 null, "data:image/x-icon,%00", false);
+  });
+
+  contextMenu = document.getElementById("contentAreaContextMenu");
+  ok(contextMenu, "Got context menu XUL");
+
+  let tab = yield BrowserTestUtils.openNewForegroundTab(gBrowser, "data:text/plain;charset=utf8,test%20search");
 
-    function checkSearchURL(event) {
-      is(event.originalTarget.URL,
-         "http://mochi.test:8888/browser/browser/components/search/test/?test=test+search&ie=utf-8&channel=contextsearch",
-         "Checking context menu search URL");
-      // Remove the tab opened by the search
-      gBrowser.removeCurrentTab();
-      ss.removeEngine(ss.currentEngine);
-    }
+  yield ContentTask.spawn(tab.linkedBrowser, "", function*() {
+    return new Promise(resolve => {
+      content.document.addEventListener("selectionchange", function selectionChanged() {
+        content.document.removeEventListener("selectionchange", selectionChanged);
+        resolve();
+      });
+      content.document.getSelection().selectAllChildren(content.document.body);
+    });
+  });
+
+  var eventDetails = { type: "contextmenu", button: 2 };
+
+  let popupPromise = BrowserTestUtils.waitForEvent(contextMenu, "popupshown");
+  BrowserTestUtils.synthesizeMouseAtCenter("body", eventDetails, gBrowser.selectedBrowser);
+  yield popupPromise;
 
-    var selectionListener = {
-      notifySelectionChanged: function(doc, sel, reason) {
-        if (reason != Ci.nsISelectionListener.SELECTALL_REASON || sel.toString() != "test search")
-          return;
-        info("notifySelectionChanged: Text selected");
-        content.window.getSelection().QueryInterface(Ci.nsISelectionPrivate).
-                                      removeSelectionListener(selectionListener);
-        SimpleTest.executeSoon(rightClickOnDocument);
-      }
-    };
+  info("checkContextMenu");
+  var searchItem = contextMenu.getElementsByAttribute("id", "context-searchselect")[0];
+  ok(searchItem, "Got search context menu item");
+  is(searchItem.label, 'Search ' + ENGINE_NAME + ' for "test search"', "Check context menu label");
+  is(searchItem.disabled, false, "Check that search context menu item is enabled");
+
+  yield BrowserTestUtils.openNewForegroundTab(gBrowser, () => {
+    searchItem.click();
+  });
 
-    // Delay the select all to avoid intermittent selection failures.
-    setTimeout(function delaySelectAll() {
-      info("delaySelectAll: " + content.window.location.toString());
-      // add a listener to know when the selection takes effect
-      content.window.getSelection().QueryInterface(Ci.nsISelectionPrivate).
-                                    addSelectionListener(selectionListener);
-      // select the text on the page
-      goDoCommand('cmd_selectAll');
-    }, 500);
-  }
-}
+  is(gBrowser.currentURI.spec,
+     "http://mochi.test:8888/browser/browser/components/search/test/?test=test+search&ie=utf-8&channel=contextsearch",
+     "Checking context menu search URL");
+
+  contextMenu.hidePopup();
+
+  // Remove the tab opened by the search
+  gBrowser.removeCurrentTab();
+
+  yield new Promise(resolve => {
+    searchDonePromise = resolve;
+    ss.removeEngine(ss.currentEngine);
+  });
+
+  gBrowser.removeCurrentTab();
+});

--- a/browser/components/search/test/browser_eBay_behavior.js
+++ b/browser/components/search/test/browser_eBay_behavior.js
@@ -131,16 +131,19 @@ function test() {
     onStateChange: function onStateChange(webProgress, req, flags, status) {
       info("onStateChange");
       // Only care about top-level document starts
       let docStart = Ci.nsIWebProgressListener.STATE_IS_DOCUMENT |
                      Ci.nsIWebProgressListener.STATE_START;
       if (!(flags & docStart) || !webProgress.isTopLevel)
         return;
 
+      if (req.originalURI.spec == "about:blank")
+        return;
+
       info("received document start");
 
       ok(req instanceof Ci.nsIChannel, "req is a channel");
       is(req.originalURI.spec, gCurrTest.searchURL, "search URL was loaded");
       info("Actual URI: " + req.URI.spec);
 
       req.cancel(Components.results.NS_ERROR_FAILURE);
 

--- a/browser/components/search/test/browser_google_behavior.js
+++ b/browser/components/search/test/browser_google_behavior.js
@@ -129,16 +129,19 @@ function test() {
     onStateChange: function onStateChange(webProgress, req, flags, status) {
       info("onStateChange");
       // Only care about top-level document starts
       let docStart = Ci.nsIWebProgressListener.STATE_IS_DOCUMENT |
                      Ci.nsIWebProgressListener.STATE_START;
       if (!(flags & docStart) || !webProgress.isTopLevel)
         return;
 
+      if (req.originalURI.spec == "about:blank")
+        return;
+
       info("received document start");
 
       ok(req instanceof Ci.nsIChannel, "req is a channel");
       is(req.originalURI.spec, gCurrTest.searchURL, "search URL was loaded");
       info("Actual URI: " + req.URI.spec);
 
       req.cancel(Components.results.NS_ERROR_FAILURE);
 

--- a/browser/components/search/test/browser_private_search_perwindowpb.js
+++ b/browser/components/search/test/browser_private_search_perwindowpb.js
@@ -1,109 +1,73 @@
 // This test performs a search in a public window, then a different
 // search in a private window, and then checks in the public window
 // whether there is an autocomplete entry for the private search.
 
-function test() {
+add_task(function* () {
   // Don't use about:home as the homepage for new windows
   Services.prefs.setIntPref("browser.startup.page", 0);
   registerCleanupFunction(() => Services.prefs.clearUserPref("browser.startup.page"));
 
-  waitForExplicitFinish();
-
   let engineURL =
     "http://mochi.test:8888/browser/browser/components/search/test/";
   let windowsToClose = [];
-  registerCleanupFunction(function() {
-    let engine = Services.search.getEngineByName("Bug 426329");
-    Services.search.removeEngine(engine);
-    windowsToClose.forEach(function(win) {
-      win.close();
-    });
-  });
 
-  function onPageLoad(aWin, aCallback) {
-    aWin.gBrowser.addEventListener("DOMContentLoaded", function load(aEvent) {
-      let doc = aEvent.originalTarget;
-      info(doc.location.href);
-      if (doc.location.href.indexOf(engineURL) != -1) {
-        aWin.gBrowser.removeEventListener("DOMContentLoaded", load, false);
-        aCallback();
-      }
-    }, false);
-  }
-
-  function performSearch(aWin, aIsPrivate, aCallback) {
+  function performSearch(aWin, aIsPrivate) {
     let searchBar = aWin.BrowserSearch.searchBar;
     ok(searchBar, "got search bar");
-    onPageLoad(aWin, aCallback);
+
+    let loadPromise = BrowserTestUtils.browserLoaded(aWin.gBrowser.selectedBrowser);
 
     searchBar.value = aIsPrivate ? "private test" : "public test";
     searchBar.focus();
     EventUtils.synthesizeKey("VK_RETURN", {}, aWin);
+
+    return loadPromise;
   }
 
-  function addEngine(aCallback) {
-    let installCallback = {
-      onSuccess: function (engine) {
-        Services.search.currentEngine = engine;
-        aCallback();
-      },
-      onError: function (errorCode) {
-        ok(false, "failed to install engine: " + errorCode);
-      }
-    };
-    Services.search.addEngine(engineURL + "426329.xml", null,
-                              "data:image/x-icon,%00", false, installCallback);
+  function* testOnWindow(aIsPrivate) {
+    let win = yield BrowserTestUtils.openNewBrowserWindow({ private: aIsPrivate });
+    yield SimpleTest.promiseFocus(win);
+    windowsToClose.push(win);
+    return win;
   }
 
-  function testOnWindow(aIsPrivate, aCallback) {
-    let win = whenNewWindowLoaded({ private: aIsPrivate }, function() {
-      waitForFocus(aCallback, win);
-    });
-    windowsToClose.push(win);
-  }
+  yield promiseNewEngine("426329.xml", { iconURL: "data:image/x-icon,%00" });
+
+  let newWindow = yield* testOnWindow(false);
+  yield performSearch(newWindow, false);
 
-  addEngine(function() {
-    testOnWindow(false, function(win) {
-      performSearch(win, false, function() {
-        testOnWindow(true, function(win) {
-          performSearch(win, true, function() {
-            testOnWindow(false, function(win) {
-              checkSearchPopup(win, finish);
-            });
-          });
-        });
-      });
-    });
-  });
-}
+  newWindow = yield* testOnWindow(true);
+  yield performSearch(newWindow, true);
 
-function checkSearchPopup(aWin, aCallback) {
-  let searchBar = aWin.BrowserSearch.searchBar;
+  newWindow = yield* testOnWindow(false);
+
+  let searchBar = newWindow.BrowserSearch.searchBar;
   searchBar.value = "p";
   searchBar.focus();
 
   let popup = searchBar.textbox.popup;
-  popup.addEventListener("popupshowing", function showing() {
-    popup.removeEventListener("popupshowing", showing, false);
+  let popupPromise = BrowserTestUtils.waitForEvent(popup, "popupshown");
+  searchBar.textbox.showHistoryPopup();
+  yield popupPromise;
 
-    let entries = getMenuEntries(searchBar);
-    for (let i = 0; i < entries.length; i++) {
-      isnot(entries[i], "private test",
-            "shouldn't see private autocomplete entries");
-    }
+  let entries = getMenuEntries(searchBar);
+  for (let i = 0; i < entries.length; i++) {
+    isnot(entries[i], "private test",
+          "shouldn't see private autocomplete entries");
+  }
 
-    searchBar.textbox.toggleHistoryPopup();
-    searchBar.value = "";
-    aCallback();
-  }, false);
+  searchBar.textbox.toggleHistoryPopup();
+  searchBar.value = "";
 
-  searchBar.textbox.showHistoryPopup();
-}
+  windowsToClose.forEach(function(win) {
+    win.close();
+  });
+});
 
 function getMenuEntries(searchBar) {
   let entries = [];
   let autocompleteMenu = searchBar.textbox.popup;
   // Could perhaps pull values directly from the controller, but it seems
   // more reliable to test the values that are actually in the tree?
   let column = autocompleteMenu.tree.columns[0];
   let numRows = autocompleteMenu.tree.view.rowCount;

--- a/browser/components/search/test/browser_searchbar_keyboard_navigation.js
+++ b/browser/components/search/test/browser_searchbar_keyboard_navigation.js
@@ -376,30 +376,18 @@ add_task(function* test_tab_and_arrows()
 
   // Finally close the panel.
   let promise = promiseEvent(searchPopup, "popuphidden");
   searchPopup.hidePopup();
   yield promise;
 });
 
 add_task(function* test_open_search() {
-  let tab = gBrowser.addTab();
-  gBrowser.selectedTab = tab;
-
-  let deferred = Promise.defer();
-  let browser = gBrowser.selectedBrowser;
-  browser.addEventListener("load", function onload() {
-    browser.removeEventListener("load", onload, true);
-    deferred.resolve();
-  }, true);
-
   let rootDir = getRootDirectory(gTestPath);
-  content.location = rootDir + "opensearch.html";
-
-  yield deferred.promise;
+  let tab = yield BrowserTestUtils.openNewForegroundTab(gBrowser, rootDir + "opensearch.html");
 
   let promise = promiseEvent(searchPopup, "popupshown");
   info("Opening search panel");
   searchbar.focus();
   yield promise;
 
   let engines = getOpenSearchItems();
   is(engines.length, 2, "the opensearch.html page exposes 2 engines")

--- a/browser/components/search/test/browser_searchbar_openpopup.js
+++ b/browser/components/search/test/browser_searchbar_openpopup.js
@@ -408,17 +408,17 @@ add_task(function* refocus_window_doesnt
 // Clicking the search go button shouldn't open the popup
 add_no_popup_task(function* search_go_doesnt_open_popup() {
   gBrowser.selectedTab = gBrowser.addTab();
 
   gURLBar.focus();
   textbox.value = "foo";
   searchbar.updateGoButtonVisibility();
 
-  let promise = promiseOnLoad();
+  let promise = BrowserTestUtils.browserLoaded(gBrowser.selectedBrowser);
   EventUtils.synthesizeMouseAtCenter(goButton, {});
   yield promise;
 
   textbox.value = "";
   gBrowser.removeCurrentTab();
 });
 
 // Clicks outside the search popup should close the popup but not consume the click.

--- a/browser/components/search/test/browser_searchbar_smallpanel_keyboard_navigation.js
+++ b/browser/components/search/test/browser_searchbar_smallpanel_keyboard_navigation.js
@@ -304,30 +304,18 @@ add_task(function* test_tab_and_arrows()
 
   // Finally close the panel.
   let promise = promiseEvent(searchPopup, "popuphidden");
   searchPopup.hidePopup();
   yield promise;
 });
 
 add_task(function* test_open_search() {
-  let tab = gBrowser.addTab();
-  gBrowser.selectedTab = tab;
-
-  let deferred = Promise.defer();
-  let browser = gBrowser.selectedBrowser;
-  browser.addEventListener("load", function onload() {
-    browser.removeEventListener("load", onload, true);
-    deferred.resolve();
-  }, true);
-
   let rootDir = getRootDirectory(gTestPath);
-  content.location = rootDir + "opensearch.html";
-
-  yield deferred.promise;
+  let tab = yield BrowserTestUtils.openNewForegroundTab(gBrowser, rootDir + "opensearch.html");
 
   let promise = promiseEvent(searchPopup, "popupshown");
   info("Opening search panel");
   EventUtils.synthesizeMouseAtCenter(searchIcon, {});
   yield promise;
   is(searchPopup.getAttribute("showonlysettings"), "true", "Should show the small popup");
 
   let engines = getOpenSearchItems();

--- a/browser/components/search/test/browser_yahoo_behavior.js
+++ b/browser/components/search/test/browser_yahoo_behavior.js
@@ -131,16 +131,19 @@ function test() {
     onStateChange: function onStateChange(webProgress, req, flags, status) {
       info("onStateChange");
       // Only care about top-level document starts
       let docStart = Ci.nsIWebProgressListener.STATE_IS_DOCUMENT |
                      Ci.nsIWebProgressListener.STATE_START;
       if (!(flags & docStart) || !webProgress.isTopLevel)
         return;
 
+      if (req.originalURI.spec == "about:blank")
+        return;
+
       info("received document start");
 
       ok(req instanceof Ci.nsIChannel, "req is a channel");
       is(req.originalURI.spec, gCurrTest.searchURL, "search URL was loaded");
       info("Actual URI: " + req.URI.spec);
 
       req.cancel(Components.results.NS_ERROR_FAILURE);
 

--- a/browser/components/search/test/head.js
+++ b/browser/components/search/test/head.js
@@ -1,25 +1,11 @@
 /* Any copyright is dedicated to the Public Domain.
  * http://creativecommons.org/publicdomain/zero/1.0/ */
 
-XPCOMUtils.defineLazyModuleGetter(this, "Promise",
-  "resource://gre/modules/Promise.jsm");
-
-function whenNewWindowLoaded(aOptions, aCallback) {
-  let win = OpenBrowserWindow(aOptions);
-  let focused = SimpleTest.promiseFocus(win);
-  let startupFinished = TestUtils.topicObserved("browser-delayed-startup-finished",
-                                                subject => subject == win).then(() => win);
-  Promise.all([focused, startupFinished])
-    .then(results => executeSoon(() => aCallback(results[1])));
-
-  return win;
-}
-
 /**
  * Recursively compare two objects and check that every property of expectedObj has the same value
  * on actualObj.
  */
 function isSubObjectOf(expectedObj, actualObj, name) {
   for (let prop in expectedObj) {
     if (typeof expectedObj[prop] == 'function')
       continue;
@@ -48,87 +34,39 @@ function getLocalizedPref(aPrefName, aDe
     return Services.prefs.getComplexValue(aPrefName, Ci.nsIPrefLocalizedString).data;
   } catch (ex) {
     return aDefault;
   }
 
   return aDefault;
 }
 
-function waitForPopupShown(aPopupId, aCallback) {
-  let popup = document.getElementById(aPopupId);
-  info("waitForPopupShown: got popup: " + popup.id);
-  function onPopupShown() {
-    info("onPopupShown");
-    removePopupShownListener();
-    SimpleTest.executeSoon(aCallback);
-  }
-  function removePopupShownListener() {
-    popup.removeEventListener("popupshown", onPopupShown);
-  }
-  popup.addEventListener("popupshown", onPopupShown);
-  registerCleanupFunction(removePopupShownListener);
-}
-
 function promiseEvent(aTarget, aEventName, aPreventDefault) {
-  let deferred = Promise.defer();
-  aTarget.addEventListener(aEventName, function onEvent(aEvent) {
-    aTarget.removeEventListener(aEventName, onEvent, true);
+  function cancelEvent(event) {
     if (aPreventDefault) {
-      aEvent.preventDefault();
+      event.preventDefault();
     }
-    deferred.resolve();
-  }, true);
-  return deferred.promise;
-}
 
-function waitForBrowserContextMenu(aCallback) {
-  waitForPopupShown(gBrowser.selectedBrowser.contextMenu, aCallback);
-}
-
-function doOnloadOnce(aCallback) {
-  function doOnloadOnceListener(aEvent) {
-    info("doOnloadOnce: " + aEvent.originalTarget.location);
-    removeDoOnloadOnceListener();
-    SimpleTest.executeSoon(function doOnloadOnceCallback() {
-      aCallback(aEvent);
-    });
-  }
-  function removeDoOnloadOnceListener() {
-    gBrowser.removeEventListener("load", doOnloadOnceListener, true);
+    return true;
   }
-  gBrowser.addEventListener("load", doOnloadOnceListener, true);
-  registerCleanupFunction(removeDoOnloadOnceListener);
-}
 
-function* promiseOnLoad() {
-  return new Promise(resolve => {
-    gBrowser.addEventListener("load", function onLoadListener(aEvent) {
-      let cw = aEvent.target.defaultView;
-      let tab = gBrowser._getTabForContentWindow(cw);
-      if (tab) {
-        info("onLoadListener: " + aEvent.originalTarget.location);
-        gBrowser.removeEventListener("load", onLoadListener, true);
-        resolve(aEvent);
-      }
-    }, true);
-  });
+  return BrowserTestUtils.waitForEvent(aTarget, aEventName, false, cancelEvent);
 }
 
 function promiseNewEngine(basename, options = {}) {
   return new Promise((resolve, reject) => {
     //Default the setAsCurrent option to true.
     let setAsCurrent =
       options.setAsCurrent == undefined ? true : options.setAsCurrent;
     info("Waiting for engine to be added: " + basename);
     Services.search.init({
       onInitComplete: function() {
         let url = getRootDirectory(gTestPath) + basename;
         let current = Services.search.currentEngine;
-        Services.search.addEngine(url, null, "", false, {
+        Services.search.addEngine(url, null, options.iconURL || "", false, {
           onSuccess: function (engine) {
             info("Search engine added: " + basename);
             if (setAsCurrent) {
               Services.search.currentEngine = engine;
             }
             registerCleanupFunction(() => {
               if (setAsCurrent) {
                 Services.search.currentEngine = current;

--- a/browser/modules/DirectoryLinksProvider.jsm
+++ b/browser/modules/DirectoryLinksProvider.jsm
@@ -91,19 +91,16 @@ const DEFAULT_TOTAL_FREQUENCY_CAP = 10;
 const DEFAULT_PRUNE_TIME_DELTA = 10*24*60*60*1000;
 
 // The min number of visible (not blocked) history tiles to have before showing suggested tiles
 const MIN_VISIBLE_HISTORY_TILES = 8;
 
 // The max number of visible (not blocked) history tiles to test for inadjacency
 const MAX_VISIBLE_HISTORY_TILES = 15;
 
-// Divide frecency by this amount for pings
-const PING_SCORE_DIVISOR = 10000;
-
 // Allowed ping actions remotely stored as columns: case-insensitive [a-z0-9_]
 const PING_ACTIONS = ["block", "click", "pin", "sponsored", "sponsored_link", "unpin", "view"];
 
 // Location of inadjacent sites json
 const INADJACENCY_SOURCE = "chrome://browser/content/newtab/newTab.inadjacent.json";
 
 // Fake URL to keep track of last block of a suggested tile in the frequency cap object
 const FAKE_SUGGESTED_BLOCK_URL = "ignore://suggested_block";
@@ -561,60 +558,23 @@ var DirectoryLinksProvider = {
     let newtabEnhanced = false;
     let pingEndPoint = "";
     try {
       newtabEnhanced = Services.prefs.getBoolPref(PREF_NEWTAB_ENHANCED);
       pingEndPoint = Services.prefs.getCharPref(PREF_DIRECTORY_PING);
     }
     catch (ex) {}
 
-    // Only send pings when enhancing tiles with an endpoint and valid action
+    // Bug 1240245 - We no longer send pings, but frequency capping and fetching
+    // tests depend on the following actions, so references to PING remain.
     let invalidAction = PING_ACTIONS.indexOf(action) == -1;
     if (!newtabEnhanced || pingEndPoint == "" || invalidAction) {
       return Promise.resolve();
     }
 
-    let actionIndex;
-    let data = {
-      locale: this.locale,
-      tiles: sites.reduce((tiles, site, pos) => {
-        // Only add data for non-empty tiles
-        if (site) {
-          // Remember which tiles data triggered the action
-          let {link} = site;
-          let tilesIndex = tiles.length;
-          if (triggeringSiteIndex == pos) {
-            actionIndex = tilesIndex;
-          }
-
-          // Make the payload in a way so keys can be excluded when stringified
-          let id = link.directoryId;
-          tiles.push({
-            id: id || site.enhancedId,
-            pin: site.isPinned() ? 1 : undefined,
-            pos: pos != tilesIndex ? pos : undefined,
-            past_impressions: pos == triggeringSiteIndex ? pastImpressions : undefined,
-            score: Math.round(link.frecency / PING_SCORE_DIVISOR) || undefined,
-            url: site.enhancedId && "",
-          });
-        }
-        return tiles;
-      }, []),
-    };
-
-    // Provide a direct index to the tile triggering the action
-    if (actionIndex !== undefined) {
-      data[action] = actionIndex;
-    }
-
-    // Package the data to be sent with the ping
-    let ping = this._newXHR();
-    ping.open("POST", pingEndPoint + (action == "view" ? "view" : "click"));
-    ping.send(JSON.stringify(data));
-
     return Task.spawn(function* () {
       // since we updated views/clicks we need write _frequencyCaps to disk
       yield this._writeFrequencyCapFile();
       // Use this as an opportunity to potentially fetch new links
       yield this._fetchAndCacheLinksIfNecessary();
     }.bind(this));
   },
 

--- a/browser/modules/WindowsPreviewPerTab.jsm
+++ b/browser/modules/WindowsPreviewPerTab.jsm
@@ -366,18 +366,16 @@ XPCOMUtils.defineLazyGetter(PreviewContr
  *
  * @param win
  *        The nsIDOMWindow browser window
  */
 function TabWindow(win) {
   this.win = win;
   this.tabbrowser = win.gBrowser;
 
-  this.cacheDims();
-
   this.previews = new Map();
 
   for (let i = 0; i < this.tabEvents.length; i++)
     this.tabbrowser.tabContainer.addEventListener(this.tabEvents[i], this, false);
 
   for (let i = 0; i < this.winEvents.length; i++)
     this.win.addEventListener(this.winEvents[i], this, false);
 
@@ -389,28 +387,30 @@ function TabWindow(win) {
     this.newTab(tabs[i]);
 
   this.updateTabOrdering();
   AeroPeek.checkPreviewCount();
 }
 
 TabWindow.prototype = {
   _enabled: false,
+  _cachedWidth: 0,
+  _cachedHeight: 0,
   tabEvents: ["TabOpen", "TabClose", "TabSelect", "TabMove"],
   winEvents: ["resize"],
 
   destroy: function () {
     this._destroying = true;
 
     let tabs = this.tabbrowser.tabs;
 
     this.tabbrowser.removeTabsProgressListener(this);
 
-  for (let i = 0; i < this.winEvents.length; i++)
-    this.win.removeEventListener(this.winEvents[i], this, false);
+    for (let i = 0; i < this.winEvents.length; i++)
+      this.win.removeEventListener(this.winEvents[i], this, false);
 
     for (let i = 0; i < this.tabEvents.length; i++)
       this.tabbrowser.tabContainer.removeEventListener(this.tabEvents[i], this, false);
 
     for (let i = 0; i < tabs.length; i++)
       this.removeTab(tabs[i]);
 
     let idx = AeroPeek.windows.indexOf(this.win.gTaskbarTabGroup);

--- a/browser/modules/test/xpcshell/test_DirectoryLinksProvider.js
+++ b/browser/modules/test/xpcshell/test_DirectoryLinksProvider.js
@@ -711,123 +711,16 @@ add_task(function* test_frequencyCappedS
   // Cleanup.
   NewTabUtils.isTopPlacesSite = origIsTopPlacesSite;
   DirectoryLinksProvider._getCurrentTopSiteCount = origCurrentTopSiteCount;
   gLinks.removeProvider(DirectoryLinksProvider);
   DirectoryLinksProvider.removeObserver(gLinks);
   Services.prefs.setCharPref(kPingUrlPref, kPingUrl);
 });
 
-add_task(function* test_reportSitesAction() {
-  yield DirectoryLinksProvider.init();
-  let deferred, expectedPath, expectedPost;
-  let done = false;
-  server.registerPrefixHandler(kPingPath, (aRequest, aResponse) => {
-    if (done) {
-      return;
-    }
-
-    do_check_eq(aRequest.path, expectedPath);
-
-    let bodyStream = new BinaryInputStream(aRequest.bodyInputStream);
-    let bodyObject = JSON.parse(NetUtil.readInputStreamToString(bodyStream, bodyStream.available()));
-    isIdentical(bodyObject, expectedPost);
-
-    deferred.resolve();
-  });
-
-  function sendPingAndTest(path, action, index) {
-    deferred = Promise.defer();
-    expectedPath = kPingPath + path;
-    DirectoryLinksProvider.reportSitesAction(sites, action, index);
-    return deferred.promise;
-  }
-
-  // Start with a single pinned link at position 3
-  let sites = [,,{
-    isPinned: _ => true,
-    link: {
-      directoryId: 1,
-      frecency: 30000,
-      url: "http://directory1/",
-    },
-  }];
-
-  // Make sure we get the click ping for the directory link with fields we want
-  // and unwanted fields removed by stringify/parse
-  expectedPost = JSON.parse(JSON.stringify({
-    click: 0,
-    locale: "en-US",
-    tiles: [{
-      id: 1,
-      pin: 1,
-      pos: 2,
-      score: 3,
-      url: undefined,
-    }],
-  }));
-  yield sendPingAndTest("click", "click", 2);
-
-  // Try a pin click ping
-  delete expectedPost.click;
-  expectedPost.pin = 0;
-  yield sendPingAndTest("click", "pin", 2);
-
-  // Try a block click ping
-  delete expectedPost.pin;
-  expectedPost.block = 0;
-  yield sendPingAndTest("click", "block", 2);
-
-  // A view ping has no actions
-  delete expectedPost.block;
-  expectedPost.view = 0;
-  yield sendPingAndTest("view", "view", 2);
-
-  // Remove the identifier that makes it a directory link so just plain history
-  delete sites[2].link.directoryId;
-  delete expectedPost.tiles[0].id;
-  yield sendPingAndTest("view", "view", 2);
-
-  // Add directory link at position 0
-  sites[0] = {
-    isPinned: _ => false,
-    link: {
-      directoryId: 1234,
-      frecency: 1000,
-      url: "http://directory/",
-    }
-  };
-  expectedPost.tiles.unshift(JSON.parse(JSON.stringify({
-    id: 1234,
-    pin: undefined,
-    pos: undefined,
-    score: undefined,
-    url: undefined,
-  })));
-  expectedPost.view = 1;
-  yield sendPingAndTest("view", "view", 2);
-
-  // Make the history tile enhanced so it reports both id and url
-  sites[2].enhancedId = "id from enhanced";
-  expectedPost.tiles[1].id = "id from enhanced";
-  expectedPost.tiles[1].url = "";
-  yield sendPingAndTest("view", "view", 2);
-
-  // Click the 0th site / 0th tile
-  delete expectedPost.view;
-  expectedPost.click = 0;
-  yield sendPingAndTest("click", "click", 0);
-
-  // Click the 2th site / 1th tile
-  expectedPost.click = 1;
-  yield sendPingAndTest("click", "click", 2);
-
-  done = true;
-});
-
 add_task(function* test_fetchAndCacheLinks_local() {
   yield DirectoryLinksProvider.init();
   yield cleanJsonFile();
   // Trigger cache of data or chrome uri files in profD
   yield DirectoryLinksProvider._fetchAndCacheLinks(kTestURL);
   let data = yield readJsonFile();
   isIdentical(data, kURLData);
 });
@@ -1896,120 +1789,16 @@ add_task(function* test_inadjecentSites(
   gLinks.removeProvider(DirectoryLinksProvider);
   DirectoryLinksProvider._inadjacentSitesUrl = origInadjacentSitesUrl;
   NewTabUtils.isTopPlacesSite = origIsTopPlacesSite;
   NewTabUtils.getProviderLinks = origGetProviderLinks;
   DirectoryLinksProvider._getCurrentTopSiteCount = origCurrentTopSiteCount;
   yield promiseCleanDirectoryLinksProvider();
 });
 
-add_task(function* test_reportPastImpressions() {
-  let origIsTopPlacesSite = NewTabUtils.isTopPlacesSite;
-  NewTabUtils.isTopPlacesSite = () => true;
-  let origCurrentTopSiteCount = DirectoryLinksProvider._getCurrentTopSiteCount;
-  DirectoryLinksProvider._getCurrentTopSiteCount = () => 8;
-
-  let testUrl = "http://frequency.capped/link";
-  let targets = ["top.site.com"];
-  let data = {
-    suggested: [{
-      type: "affiliate",
-      frecent_sites: targets,
-      url: testUrl,
-      adgroup_name: "Test"
-    }]
-  };
-  let dataURI = "data:application/json," + JSON.stringify(data);
-  yield promiseSetupDirectoryLinksProvider({linksURL: dataURI});
-
-  // make DirectoryLinksProvider load json
-  let loadPromise = Promise.defer();
-  DirectoryLinksProvider.getLinks(_ => {loadPromise.resolve();});
-  yield loadPromise.promise;
-
-  // setup ping handler
-  let deferred, expectedPath, expectedAction, expectedImpressions;
-  let done = false;
-  server.registerPrefixHandler(kPingPath, (aRequest, aResponse) => {
-    if (done) {
-      return;
-    }
-
-    do_check_eq(aRequest.path, expectedPath);
-
-    let bodyStream = new BinaryInputStream(aRequest.bodyInputStream);
-    let bodyObject = JSON.parse(NetUtil.readInputStreamToString(bodyStream, bodyStream.available()));
-    let expectedActionIndex = bodyObject[expectedAction];
-    if (bodyObject.unpin) {
-      // unpin should not report past_impressions
-      do_check_false(bodyObject.tiles[expectedActionIndex].hasOwnProperty("past_impressions"));
-    }
-    else if (expectedImpressions) {
-      do_check_eq(bodyObject.tiles[expectedActionIndex].past_impressions.total, expectedImpressions);
-      do_check_eq(bodyObject.tiles[expectedActionIndex].past_impressions.daily, expectedImpressions);
-    }
-    else {
-      do_check_eq(expectedPath, "/ping/view");
-      do_check_false(bodyObject.tiles[expectedActionIndex].hasOwnProperty("past_impressions"));
-    }
-
-    deferred.resolve();
-  });
-
-  // setup ping sender
-  function sendPingAndTest(path, action, index) {
-    deferred = Promise.defer();
-    expectedPath = kPingPath + path;
-    expectedAction = action;
-    DirectoryLinksProvider.reportSitesAction(sites, action, index);
-    return deferred.promise;
-  }
-
-  // Start with a view ping first
-  let site = {
-    isPinned: _ => false,
-    link: {
-      directoryId: 1,
-      frecency: 30000,
-      frecent_sites: targets,
-      targetedSite: targets[0],
-      url: testUrl
-    }
-  };
-  let sites = [,
-    {
-      isPinned: _ => false,
-      link: {type: "history", url: "https://foo.com"}
-    },
-    site
-  ];
-
-  yield sendPingAndTest("view", "view", 2);
-  yield sendPingAndTest("view", "view", 2);
-  yield sendPingAndTest("view", "view", 2);
-
-  expectedImpressions = DirectoryLinksProvider._frequencyCaps[testUrl].totalViews;
-  do_check_eq(expectedImpressions, 3);
-
-  // now report pin, unpin, block and click
-  sites.isPinned = _ => true;
-  yield sendPingAndTest("click", "pin", 2);
-  sites.isPinned = _ => false;
-  yield sendPingAndTest("click", "unpin", 2);
-  sites.isPinned = _ => false;
-  yield sendPingAndTest("click", "click", 2);
-  sites.isPinned = _ => false;
-  yield sendPingAndTest("click", "block", 2);
-
-  // Cleanup.
-  done = true;
-  NewTabUtils.isTopPlacesSite = origIsTopPlacesSite;
-  DirectoryLinksProvider._getCurrentTopSiteCount = origCurrentTopSiteCount;
-});
-
 add_task(function* test_blockSuggestedTiles() {
   // Initial setup
   let suggestedTile = suggestedTile1;
   let topSites = ["site0.com", "1040.com", "site2.com", "hrblock.com", "site4.com", "freetaxusa.com", "site6.com"];
   let data = {"suggested": [suggestedTile1, suggestedTile2, suggestedTile3], "directory": [someOtherSite]};
   let dataURI = 'data:application/json,' + JSON.stringify(data);
 
   yield promiseSetupDirectoryLinksProvider({linksURL: dataURI});

--- a/build/autoconf/config.status.m4
+++ b/build/autoconf/config.status.m4
@@ -226,14 +226,14 @@ define([AC_CONFIG_HEADER],
 [m4_fatal([Use CONFIGURE_DEFINE_FILES in moz.build files to produce header files.])
 ])
 
 define([MOZ_BUILD_BACKEND],
 [
 BUILD_BACKENDS="RecursiveMake"
 
 MOZ_ARG_ENABLE_STRING(build-backend,
-[  --enable-build-backend={AndroidEclipse,CppEclipse,VisualStudio,FasterMake,CompileDB,ChromeMap}
+[  --enable-build-backend={$($(dirname ]$[0)/$1/mach python -c "from mozbuild.backend import backends; print ','.join(sorted(backends))")}
                          Enable additional build backends],
 [ BUILD_BACKENDS="RecursiveMake `echo $enableval | sed 's/,/ /g'`"])
 
 AC_SUBST_SET([BUILD_BACKENDS])
 ])

--- a/build/unix/elfhack/elf.cpp
+++ b/build/unix/elfhack/elf.cpp
@@ -253,26 +253,29 @@ Elf::Elf(std::ifstream &file)
         }
         if (phdr.p_type == PT_PHDR)
             segment->addSection(phdr_section);
         for (int j = 1; j < ehdr->e_shnum; j++)
             if (phdr.contains(sections[j]))
                 segment->addSection(sections[j]);
         // Make sure that our view of segments corresponds to the original
         // ELF file.
-        assert(segment->getFileSize() == phdr.p_filesz);
+        // GNU gold likes to start some segments before the first section
+        // they contain. https://sourceware.org/bugzilla/show_bug.cgi?id=19392
+        unsigned int gold_adjustment = segment->getAddr() - phdr.p_vaddr;
+        assert(segment->getFileSize() == phdr.p_filesz - gold_adjustment);
         // gold makes TLS segments end on an aligned virtual address, even
         // when the underlying section ends before that, while bfd ld
         // doesn't. It's fine if we don't keep that alignment.
         unsigned int memsize = segment->getMemSize();
         if (phdr.p_type == PT_TLS && memsize != phdr.p_memsz) {
             unsigned int align = segment->getAlign();
             memsize = (memsize + align - 1) & ~(align - 1);
         }
-        assert(memsize == phdr.p_memsz);
+        assert(memsize == phdr.p_memsz - gold_adjustment);
         segments.push_back(segment);
     }
 
     new (&eh_entry) ElfLocation(ehdr->e_entry, this);
 }
 
 Elf::~Elf()
 {

--- a/config/external/nss/nss.symbols
+++ b/config/external/nss/nss.symbols
@@ -687,11 +687,16 @@ VFY_DestroyContext
 VFY_End
 VFY_EndWithSignature
 VFY_Update
 VFY_VerifyData
 VFY_VerifyDataWithAlgorithmID
 VFY_VerifyDigestDirect
 _SGN_VerifyPKCS1DigestInfo
 __PK11_SetCertificateNickname
+# These symbols are not used by Firefox itself, but are used by Java's security
+# libraries, which in turn are used by Java applets/plugins/etc.  Provide them
+# to make Java code happy.
+NSS_VersionCheck
+NSS_Initialize
 #ifdef NSS_EXTRA_SYMBOLS_FILE
 #include @NSS_EXTRA_SYMBOLS_FILE@
 #endif

--- a/config/rules.mk
+++ b/config/rules.mk
@@ -1576,12 +1576,8 @@ default all:: $(PURGECACHES_FILES)
 
 #############################################################################
 # Derived targets and dependencies
 
 include $(MOZILLA_DIR)/config/makefiles/autotargets.mk
 ifneq ($(NULL),$(AUTO_DEPS))
   default all libs tools export:: $(AUTO_DEPS)
 endif
-
-export:: $(GENERATED_FILES)
-
-GARBAGE += $(GENERATED_FILES)

--- a/configure.in
+++ b/configure.in
@@ -134,17 +134,17 @@ EOF
   exit 1
   break
 fi
 MOZ_BUILD_ROOT=`pwd -W 2>/dev/null || pwd -P`
 DIST="$MOZ_BUILD_ROOT/dist"
 
 MOZ_PYTHON
 
-MOZ_BUILD_BACKEND
+MOZ_BUILD_BACKEND(.)
 
 MOZ_DEFAULT_COMPILER
 
 COMPILE_ENVIRONMENT=1
 MOZ_ARG_DISABLE_BOOL(compile-environment,
 [  --disable-compile-environment
                           Disable compiler/library checks.],
     COMPILE_ENVIRONMENT= )
@@ -2283,16 +2283,21 @@ ia64*-hpux*)
             # tree.  clang-cl doesn't support -fno-exceptions or equivalent,
             # so there doesn't seem to be any way to convince clang-cl to
             # declare |delete| differently.  Therefore, suppress this
             # warning.
             CXXFLAGS="$CXXFLAGS -Wno-implicit-exception-spec-mismatch"
             # At least one MSVC header and several headers in-tree have
             # unused typedefs, so turn this on.
             CXXFLAGS="$CXXFLAGS -Wno-unused-local-typedef"
+            # Several JS engine header files use __declspec(dllimport) on
+            # classes, and clang-cl helpfully warns about its non-support
+            # for such cases.  We're not particularly worried about that,
+            # so ignore that warning.
+            CXXFLAGS="$CXXFLAGS -Wno-ignored-attributes"
         fi
         # make 'foo == bar;' error out
         CFLAGS="$CFLAGS -we4553"
         CXXFLAGS="$CXXFLAGS -we4553"
         LIBS="$LIBS kernel32.lib user32.lib gdi32.lib winmm.lib wsock32.lib advapi32.lib secur32.lib netapi32.lib"
         MOZ_DEBUG_LDFLAGS='-DEBUG -DEBUGTYPE:CV'
         WARNINGS_AS_ERRORS='-WX'
         MOZ_OPTIMIZE_FLAGS='-O1 -Oi'

--- a/devtools/client/shared/browser-loader.js
+++ b/devtools/client/shared/browser-loader.js
@@ -65,16 +65,19 @@ function BrowserLoader(baseURI, window) 
 
       if (!uri.startsWith(baseURI) && !isBrowserDir) {
         return devtools.require(uri);
       }
 
       return require(uri);
     },
     globals: {
+      // Allow modules to use the window's console to ensure logs appear in a
+      // tab toolbox, if one exists, instead of just the browser console.
+      console: window.console,
       // Make sure 'define' function exists. This allows reusing AMD modules.
       define: function(callback) {
         callback(this.require, this.exports, this.module);
         return this.exports;
       }
     }
   };
 

--- a/devtools/shared/heapsnapshot/tests/gtest/DoesCrossZoneBoundaries.cpp
+++ b/devtools/shared/heapsnapshot/tests/gtest/DoesCrossZoneBoundaries.cpp
@@ -4,20 +4,22 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 // Test that heap snapshots cross zone boundaries when expected.
 
 #include "DevTools.h"
 
 DEF_TEST(DoesCrossZoneBoundaries, {
     // Create a new global to get a new zone.
+    JS::CompartmentOptions options;
     JS::RootedObject newGlobal(cx, JS_NewGlobalObject(cx,
                                                       getGlobalClass(),
                                                       nullptr,
-                                                      JS::FireOnNewGlobalHook));
+                                                      JS::FireOnNewGlobalHook,
+                                                      options));
     ASSERT_TRUE(newGlobal);
     JS::Zone* newZone = nullptr;
     {
       JSAutoCompartment ac(cx, newGlobal);
       ASSERT_TRUE(JS_InitStandardClasses(cx, newGlobal));
       newZone = js::GetContextZone(cx);
     }
     ASSERT_TRUE(newZone);

--- a/devtools/shared/heapsnapshot/tests/gtest/DoesntCrossZoneBoundaries.cpp
+++ b/devtools/shared/heapsnapshot/tests/gtest/DoesntCrossZoneBoundaries.cpp
@@ -4,20 +4,22 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 // Test that heap snapshots walk the zone boundaries correctly.
 
 #include "DevTools.h"
 
 DEF_TEST(DoesntCrossZoneBoundaries, {
     // Create a new global to get a new zone.
+    JS::CompartmentOptions options;
     JS::RootedObject newGlobal(cx, JS_NewGlobalObject(cx,
                                                       getGlobalClass(),
                                                       nullptr,
-                                                      JS::FireOnNewGlobalHook));
+                                                      JS::FireOnNewGlobalHook,
+                                                      options));
     ASSERT_TRUE(newGlobal);
     JS::Zone* newZone = nullptr;
     {
       JSAutoCompartment ac(cx, newGlobal);
       ASSERT_TRUE(JS_InitStandardClasses(cx, newGlobal));
       newZone = js::GetContextZone(cx);
     }
     ASSERT_TRUE(newZone);

--- a/dom/animation/EffectCompositor.cpp
+++ b/dom/animation/EffectCompositor.cpp
@@ -138,19 +138,20 @@ EffectCompositor::RequestRestyle(dom::El
   if (!mPresContext) {
     // Pres context will be null after the effect compositor is disconnected.
     return;
   }
 
   auto& elementsToRestyle = mElementsToRestyle[aCascadeLevel];
   PseudoElementHashKey key = { aElement, aPseudoType };
 
-  if (aRestyleType == RestyleType::Throttled &&
-      !elementsToRestyle.Contains(key)) {
-    elementsToRestyle.Put(key, false);
+  if (aRestyleType == RestyleType::Throttled) {
+    if (!elementsToRestyle.Contains(key)) {
+      elementsToRestyle.Put(key, false);
+    }
     mPresContext->Document()->SetNeedStyleFlush();
   } else {
     // Get() returns 0 if the element is not found. It will also return
     // false if the element is found but does not have a pending restyle.
     bool hasPendingRestyle = elementsToRestyle.Get(key);
     if (!hasPendingRestyle) {
       PostRestyleForAnimation(aElement, aPseudoType, aCascadeLevel);
     }

--- a/dom/animation/test/chrome.ini
+++ b/dom/animation/test/chrome.ini
@@ -1,8 +1,9 @@
 [DEFAULT]
 support-files =
   testcommon.js
   ../../imptests/testharness.js
   ../../imptests/testharnessreport.js
 [chrome/test_animation_observers.html]
+[chrome/test_restyles.html]
 [chrome/test_running_on_compositor.html]
 skip-if = buildapp == 'b2g'

new file mode 100644
--- /dev/null
+++ b/dom/animation/test/chrome/test_restyles.html
@@ -0,0 +1,328 @@
+<!doctype html>
+<head>
+<meta charset=utf-8>
+<title>Tests restyles caused by animations</title>
+<script src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+<script src="chrome://mochikit/content/tests/SimpleTest/EventUtils.js"></script>
+<script src="chrome://mochikit/content/tests/SimpleTest/SpawnTask.js"></script>
+<script src="chrome://mochikit/content/tests/SimpleTest/paint_listener.js"></script>
+<script src="../testcommon.js"></script>
+<link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css">
+<style>
+@keyframes opacity {
+  from { opacity: 1; }
+  to { opacity: 0; }
+}
+@keyframes background-color {
+  from { background-color: red; }
+  to { background-color: blue; }
+}
+@keyframes rotate {
+  from { transform: rotate(0deg); }
+  to { transform: rotate(360deg); }
+}
+div {
+  /* Element needs geometry to be eligible for layerization */
+  width: 100px;
+  height: 100px;
+  background-color: white;
+}
+</style>
+</head>
+<body>
+<script>
+'use strict';
+
+function observeStyling(frameCount, onFrame) {
+  var docShell = window.QueryInterface(SpecialPowers.Ci.nsIInterfaceRequestor)
+                       .getInterface(SpecialPowers.Ci.nsIWebNavigation)
+                       .QueryInterface(SpecialPowers.Ci.nsIDocShell);
+
+  docShell.recordProfileTimelineMarkers = true;
+  docShell.popProfileTimelineMarkers();
+
+  return new Promise(function(resolve) {
+    return waitForAnimationFrames(frameCount, onFrame).then(function() {
+      var markers = docShell.popProfileTimelineMarkers();
+      docShell.recordProfileTimelineMarkers = false;
+      var stylingMarkers = markers.filter(function(marker, index) {
+        return marker.name == 'Styles';
+      });
+      resolve(stylingMarkers);
+    });
+  });
+}
+
+SimpleTest.waitForExplicitFinish();
+
+const OMTAPrefKey = 'layers.offmainthreadcomposition.async-animations';
+var omtaEnabled = SpecialPowers.DOMWindowUtils.layerManagerRemote &&
+                  SpecialPowers.getBoolPref(OMTAPrefKey);
+
+function add_task_if_omta_enabled(test) {
+  if (!omtaEnabled) {
+    info(test.name + " is skipped because OMTA is disabled");
+    return;
+  }
+  add_task(test);
+}
+
+// We need to wait for all paints before running tests to avoid contaminations
+// from styling of this document itself.
+waitForAllPaints(function() {
+  add_task_if_omta_enabled(function* no_restyling_for_compositor_animations() {
+    var div = addDiv(null, { style: 'animation: opacity 100s' });
+    var animation = div.getAnimations()[0];
+
+    yield animation.ready;
+    ok(animation.isRunningOnCompositor);
+
+    var markers = yield observeStyling(5);
+    is(markers.length, 0,
+       'CSS animations running on the compositor should not update style ' +
+       'on the main thread');
+    div.remove(div);
+  });
+
+  add_task_if_omta_enabled(function* no_restyling_for_compositor_transitions() {
+    var div = addDiv(null, { style: 'transition: opacity 100s; opacity: 0' });
+    getComputedStyle(div).opacity;
+    div.style.opacity = 1;
+
+    var animation = div.getAnimations()[0];
+
+    yield animation.ready;
+    ok(animation.isRunningOnCompositor);
+
+    var markers = yield observeStyling(5);
+    is(markers.length, 0,
+       'CSS transitions running on the compositor should not update style ' +
+       'on the main thread');
+    div.remove(div);
+  });
+
+  add_task_if_omta_enabled(function* no_restyling_when_animation_duration_is_changed() {
+    var div = addDiv(null, { style: 'animation: opacity 100s' });
+    var animation = div.getAnimations()[0];
+
+    yield animation.ready;
+    ok(animation.isRunningOnCompositor);
+
+    div.animationDuration = '200s';
+
+    var markers = yield observeStyling(5);
+    is(markers.length, 0,
+       'Animations running on the compositor should not update style ' +
+       'on the main thread');
+    div.remove(div);
+  });
+
+  add_task_if_omta_enabled(function* only_one_restyling_after_finish_is_called() {
+    var div = addDiv(null, { style: 'animation: opacity 100s' });
+    var animation = div.getAnimations()[0];
+
+    yield animation.ready;
+    ok(animation.isRunningOnCompositor);
+
+    animation.finish();
+
+    var markers = yield observeStyling(5);
+    is(markers.length, 1,
+       'Animations running on the compositor should only update style ' +
+       'once after finish() is called');
+    div.remove(div);
+  });
+
+  add_task(function* no_restyling_mouse_movement_on_finished_transition() {
+    var div = addDiv(null, { style: 'transition: opacity 1ms; opacity: 0' });
+    getComputedStyle(div).opacity;
+    div.style.opacity = 1;
+
+    var animation = div.getAnimations()[0];
+    var initialRect = div.getBoundingClientRect();
+
+    yield animation.finished;
+
+    var mouseX = initialRect.left + initialRect.width / 2;
+    var mouseY = initialRect.top + initialRect.height / 2;
+    var markers = yield observeStyling(5, function() {
+      // We can't use synthesizeMouse here since synthesizeMouse causes
+      // layout flush.
+      synthesizeMouseAtPoint(mouseX++, mouseY++,
+                             { type: 'mousemove' }, window);
+    });
+
+    is(markers.length, 0,
+       'Bug 1219236: Finished transitions should never cause restyles ' +
+       'when mouse is moved on the animations');
+    div.remove(div);
+  });
+
+  add_task(function* no_restyling_mouse_movement_on_finished_animation() {
+    var div = addDiv(null, { style: 'animation: opacity 1ms' });
+    var animation = div.getAnimations()[0];
+
+    var initialRect = div.getBoundingClientRect();
+
+    yield animation.finished;
+
+    var mouseX = initialRect.left + initialRect.width / 2;
+    var mouseY = initialRect.top + initialRect.height / 2;
+    var markers = yield observeStyling(5, function() {
+      // We can't use synthesizeMouse here since synthesizeMouse causes
+      // layout flush.
+      synthesizeMouseAtPoint(mouseX++, mouseY++,
+                             { type: 'mousemove' }, window);
+    });
+
+    is(markers.length, 0,
+       'Bug 1219236: Finished animations should never cause restyles ' +
+       'when mouse is moved on the animations');
+    div.remove(div);
+  });
+
+  add_task_if_omta_enabled(function* no_restyling_compositor_animations_out_of_view_element() {
+    var div = addDiv(null,
+      { style: 'animation: opacity 100s; transform: translateY(-400px);' });
+    var animation = div.getAnimations()[0];
+
+    yield animation.ready;
+    ok(!animation.isRunningOnCompositor);
+
+    var markers = yield observeStyling(5);
+
+    todo_is(markers.length, 0,
+            'Bug 1166500: Animations running on the compositor in out of ' +
+            'view element should never cause restyles');
+    div.remove(div);
+  });
+
+  add_task(function* no_restyling_main_thread_animations_out_of_view_element() {
+    var div = addDiv(null,
+      { style: 'animation: background-color 100s; transform: translateY(-400px);' });
+    var animation = div.getAnimations()[0];
+
+    yield animation.ready;
+    var markers = yield observeStyling(5);
+
+    todo_is(markers.length, 0,
+            'Bug 1166500: Animations running on the main-thread in out of ' +
+            'view element should never cause restyles');
+    div.remove(div);
+  });
+
+  /*
+   Disabled for now since, on Android, the opacity animation runs on the
+   compositor even if it is scrolled out of view.
+   We will fix this in bug 1166500 or a follow-up bug
+  add_task_if_omta_enabled(function* no_restyling_compositor_animations_in_scrolled_out_element() {
+    var parentElement = addDiv(null,
+      { style: 'overflow-y: scroll; height: 20px;' });
+    var div = addDiv(null,
+      { style: 'animation: opacity 100s; position: relative; top: 100px;' });
+    parentElement.appendChild(div);
+    var animation = div.getAnimations()[0];
+
+    yield animation.ready;
+    ok(!animation.isRunningOnCompositor);
+
+    var markers = yield observeStyling(5);
+
+    todo_is(markers.length, 0,
+            'Bug 1166500: Animations running on the compositor in elements ' +
+            'which are scrolled out should never cause restyles');
+    parentElement.remove(div);
+  });
+  */
+
+  add_task(function* no_restyling_main_thread_animations_in_scrolled_out_element() {
+    var parentElement = addDiv(null,
+      { style: 'overflow-y: scroll; height: 20px;' });
+    var div = addDiv(null,
+      { style: 'animation: background-color 100s; position: relative; top: 100px;' });
+    parentElement.appendChild(div);
+    var animation = div.getAnimations()[0];
+
+    yield animation.ready;
+    var markers = yield observeStyling(5);
+
+    todo_is(markers.length, 0,
+            'Bug 1166500: Animations running on the main-thread in elements ' +
+            'which are scrolled out should never cause restyles');
+    parentElement.remove(div);
+  });
+
+  /*
+   Disabled for now since, on Android and B2G, the opacity animation runs on the
+   compositor even if the associated element has visibility:hidden.
+   We will fix this in bug 1237454 or a follow-up bug.
+  add_task_if_omta_enabled(function* no_restyling_compositor_animations_in_visiblily_hidden_element() {
+    var div = addDiv(null,
+     { style: 'animation: opacity 100s; visibility: hidden' });
+    var animation = div.getAnimations()[0];
+
+    yield animation.ready;
+    ok(!animation.isRunningOnCompositor);
+
+    var markers = yield observeStyling(5);
+
+    todo_is(markers.length, 0,
+            'Bug 1237454: Animations running on the compositor in ' +
+            'visibility hidden element should never cause restyles');
+    div.remove(div);
+  });
+  */
+
+  add_task(function* no_restyling_main_thread_animations_in_visiblily_hidden_element() {
+    var div = addDiv(null,
+     { style: 'animation: background-color 100s; visibility: hidden' });
+    var animation = div.getAnimations()[0];
+
+    yield animation.ready;
+    var markers = yield observeStyling(5);
+
+    todo_is(markers.length, 0,
+            'Bug 1237454: Animations running on the main-thread in ' +
+            'visibility hidden element should never cause restyles');
+    div.remove(div);
+  });
+
+  add_task_if_omta_enabled(function* no_restyling_compositor_animations_after_pause_is_called() {
+    var div = addDiv(null, { style: 'animation: opacity 100s' });
+    var animation = div.getAnimations()[0];
+
+    yield animation.ready;
+    ok(animation.isRunningOnCompositor);
+
+    animation.pause();
+
+    yield animation.ready;
+
+    var markers = yield observeStyling(5);
+    is(markers.length, 0,
+       'Bug 1232563: Paused animations running on the compositor should ' +
+       'never cause restyles once after pause() is called');
+    div.remove(div);
+  });
+
+  add_task(function* no_restyling_matn_thread_animations_after_pause_is_called() {
+    var div = addDiv(null, { style: 'animation: background-color 100s' });
+    var animation = div.getAnimations()[0];
+
+    yield animation.ready;
+
+    animation.pause();
+
+    yield animation.ready;
+
+    var markers = yield observeStyling(5);
+    is(markers.length, 0,
+       'Bug 1232563: Paused animations running on the main-thread should ' +
+       'never cause restyles after pause() is called');
+    div.remove(div);
+  });
+
+});
+
+</script>
+</body>

--- a/dom/animation/test/testcommon.js
+++ b/dom/animation/test/testcommon.js
@@ -36,23 +36,29 @@ function waitForFrame() {
   return new Promise(function(resolve, reject) {
     window.requestAnimationFrame(resolve);
   });
 }
 
 /**
  * Returns a Promise that is resolved after the given number of consecutive
  * animation frames have occured (using requestAnimationFrame callbacks).
+ *
+ * @param frameCount  The number of animation frames.
+ * @param onFrame  An optional function to be processed in each animation frame.
  */
-function waitForAnimationFrames(frameCount) {
+function waitForAnimationFrames(frameCount, onFrame) {
   return new Promise(function(resolve, reject) {
     function handleFrame() {
       if (--frameCount <= 0) {
         resolve();
       } else {
+        if (onFrame && typeof onFrame === 'function') {
+          onFrame();
+        }
         window.requestAnimationFrame(handleFrame); // wait another frame
       }
     }
     window.requestAnimationFrame(handleFrame);
   });
 }
 
 /**

--- a/dom/apps/Webapps.jsm
+++ b/dom/apps/Webapps.jsm
@@ -2046,17 +2046,17 @@ this.DOMApplicationRegistry = {
         },
         id: aApp.id
       });
       let appURI = NetUtil.newURI(aApp.origin, null, null);
       let principal =
         Services.scriptSecurityManager.createCodebasePrincipal(appURI,
                                                                {appId: aApp.localId});
       let cacheUpdate = updateSvc.scheduleAppUpdate(
-        appcacheURI, docURI, principal, aApp.localId, false, aProfileDir);
+        appcacheURI, docURI, principal, aProfileDir);
 
       // We save the download details for potential further usage like
       // cancelling it.
       let download = {
         cacheUpdate: cacheUpdate,
         appId: this._appIdForManifestURL(aApp.manifestURL),
         previousState: aIsUpdate ? "installed" : "pending"
       };
@@ -2200,17 +2200,17 @@ this.DOMApplicationRegistry = {
           new ManifestHelper(manifest, aData.origin, aData.manifestURL);
         debug("onlyCheckAppCache - launch updateSvc.checkForUpdate for " +
               helper.fullAppcachePath());
         let appURI = NetUtil.newURI(aApp.origin, null, null);
         let principal =
           Services.scriptSecurityManager.createCodebasePrincipal(appURI,
                                                                  {appId: aApp.localId});
         updateSvc.checkForUpdate(Services.io.newURI(helper.fullAppcachePath(), null, null),
-                                 principal, app.localId, false, updateObserver);
+                                 principal, updateObserver);
       });
       return;
     }
 
     // On xhr load request event
     function onload(xhr, oldManifest) {
       debug("Got http status=" + xhr.status + " for " + aData.manifestURL);
       let oldHash = app.manifestHash;
@@ -2474,18 +2474,17 @@ this.DOMApplicationRegistry = {
 
       let updateDeferred = Promise.defer();
       let appURI = NetUtil.newURI(aApp.origin, null, null);
       let principal =
         Services.scriptSecurityManager.createCodebasePrincipal(appURI,
                                                                {appId: aApp.localId});
 
       updateSvc.checkForUpdate(Services.io.newURI(manifest.fullAppcachePath(), null, null),
-                               principal, aApp.localId, false,
-                               (aSubject, aTopic, aData) => updateDeferred.resolve(aTopic));
+                               principal, (aSubject, aTopic, aData) => updateDeferred.resolve(aTopic));
 
       let topic = yield updateDeferred.promise;
 
       debug("updateHostedApp: updateSvc.checkForUpdate return for " +
             aApp.manifestURL + " - event is " + topic);
 
       let eventType =
         topic == "offline-cache-update-available" ? "downloadavailable"

--- a/dom/base/DOMMatrix.h
+++ b/dom/base/DOMMatrix.h
@@ -137,17 +137,17 @@ protected:
   virtual ~DOMMatrixReadOnly() {}
 
 private:
   DOMMatrixReadOnly() = delete;
   DOMMatrixReadOnly(const DOMMatrixReadOnly&) = delete;
   DOMMatrixReadOnly& operator=(const DOMMatrixReadOnly&) = delete;
 };
 
-class DOMMatrix final : public DOMMatrixReadOnly
+class DOMMatrix : public DOMMatrixReadOnly
 {
 public:
   explicit DOMMatrix(nsISupports* aParent)
     : DOMMatrixReadOnly(aParent)
   {}
 
   DOMMatrix(nsISupports* aParent, const DOMMatrixReadOnly& other)
     : DOMMatrixReadOnly(aParent, other)
@@ -239,16 +239,18 @@ public:
   DOMMatrix* RotateAxisAngleSelf(double aX,
                                  double aY,
                                  double aZ,
                                  double aAngle);
   DOMMatrix* SkewXSelf(double aSx);
   DOMMatrix* SkewYSelf(double aSy);
   DOMMatrix* InvertSelf();
   DOMMatrix* SetMatrixValue(const nsAString& aTransformList, ErrorResult& aRv);
-private:
+protected:
   void Ensure3DMatrix();
+
+  virtual ~DOMMatrix() {}
 };
 
 } // namespace dom
 } // namespace mozilla
 
 #endif /*MOZILLA_DOM_DOMMATRIX_H_*/

--- a/dom/base/Element.cpp
+++ b/dom/base/Element.cpp
@@ -2910,32 +2910,32 @@ Element::PreHandleEventForLinks(EventCha
   nsresult rv = NS_OK;
 
   // We do the status bar updates in PreHandleEvent so that the status bar gets
   // updated even if the event is consumed before we have a chance to set it.
   switch (aVisitor.mEvent->mMessage) {
   // Set the status bar similarly for mouseover and focus
   case eMouseOver:
     aVisitor.mEventStatus = nsEventStatus_eConsumeNoDefault;
-    // FALL THROUGH
+    MOZ_FALLTHROUGH;
   case eFocus: {
     InternalFocusEvent* focusEvent = aVisitor.mEvent->AsFocusEvent();
     if (!focusEvent || !focusEvent->isRefocus) {
       nsAutoString target;
       GetLinkTarget(target);
       nsContentUtils::TriggerLink(this, aVisitor.mPresContext, absURI, target,
                                   false, true, true);
       // Make sure any ancestor links don't also TriggerLink
       aVisitor.mEvent->mFlags.mMultipleActionsPrevented = true;
     }
     break;
   }
   case eMouseOut:
     aVisitor.mEventStatus = nsEventStatus_eConsumeNoDefault;
-    // FALL THROUGH
+    MOZ_FALLTHROUGH;
   case eBlur:
     rv = LeaveLink(aVisitor.mPresContext);
     if (NS_SUCCEEDED(rv)) {
       aVisitor.mEvent->mFlags.mMultipleActionsPrevented = true;
     }
     break;
 
   default:

--- a/dom/base/File.cpp
+++ b/dom/base/File.cpp
@@ -953,33 +953,33 @@ BlobImplFile::LookupAndCacheIsDirectory(
              "This should only be called when this object has been created "
              "from an nsIFile to note that the nsIFile is a directory");
   bool isDir;
   mFile->IsDirectory(&isDir);
   mDirState = isDir ? BlobDirState::eIsDir : BlobDirState::eIsNotDir;
 }
 
 ////////////////////////////////////////////////////////////////////////////
-// BlobImplEmptyFile implementation
+// EmptyBlobImpl implementation
 
-NS_IMPL_ISUPPORTS_INHERITED0(BlobImplEmptyFile, BlobImpl)
+NS_IMPL_ISUPPORTS_INHERITED0(EmptyBlobImpl, BlobImpl)
 
 already_AddRefed<BlobImpl>
-BlobImplEmptyFile::CreateSlice(uint64_t aStart, uint64_t aLength,
-                               const nsAString& aContentType,
-                               ErrorResult& aRv)
+EmptyBlobImpl::CreateSlice(uint64_t aStart, uint64_t aLength,
+                           const nsAString& aContentType,
+                           ErrorResult& aRv)
 {
   MOZ_ASSERT(!aStart && !aLength);
-  RefPtr<BlobImpl> impl = new BlobImplEmptyFile(aContentType);
+  RefPtr<BlobImpl> impl = new EmptyBlobImpl(aContentType);
   return impl.forget();
 }
 
 void
-BlobImplEmptyFile::GetInternalStream(nsIInputStream** aStream,
-                                     ErrorResult& aRv)
+EmptyBlobImpl::GetInternalStream(nsIInputStream** aStream,
+                                 ErrorResult& aRv)
 {
   nsresult rv = NS_NewCStringInputStream(aStream, EmptyCString());
   if (NS_WARN_IF(NS_FAILED(rv))) {
     aRv.Throw(rv);
     return;
   }
 }
 

--- a/dom/base/File.h
+++ b/dom/base/File.h
@@ -65,16 +65,17 @@ class Blob : public nsIDOMBlob
 public:
   NS_DECL_NSIDOMBLOB
   NS_DECL_NSIXHRSENDABLE
   NS_DECL_NSIMUTABLE
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_AMBIGUOUS(Blob, nsIDOMBlob)
 
+  // This creates a Blob or a File based on the type of BlobImpl.
   static Blob*
   Create(nsISupports* aParent, BlobImpl* aImpl);
 
   static already_AddRefed<Blob>
   Create(nsISupports* aParent, const nsAString& aContentType,
          uint64_t aLength);
 
   static already_AddRefed<Blob>
@@ -828,37 +829,37 @@ private:
   CreateSlice(uint64_t aStart, uint64_t aLength,
               const nsAString& aContentType, ErrorResult& aRv) override;
 
   nsCOMPtr<nsIFile> mFile;
   bool mWholeFile;
   bool mIsTemporary;
 };
 
-class BlobImplEmptyFile final : public BlobImplBase
+class EmptyBlobImpl final : public BlobImplBase
 {
 public:
   NS_DECL_ISUPPORTS_INHERITED
 
-  explicit BlobImplEmptyFile(const nsAString& aContentType)
-    : BlobImplBase(EmptyString(), aContentType, 0 /* aLength */)
+  explicit EmptyBlobImpl(const nsAString& aContentType)
+    : BlobImplBase(aContentType, 0 /* aLength */)
   {}
 
   virtual void GetInternalStream(nsIInputStream** aStream,
                                  ErrorResult& aRv) override;
 
   virtual already_AddRefed<BlobImpl>
   CreateSlice(uint64_t aStart, uint64_t aLength,
               const nsAString& aContentType, ErrorResult& aRv) override;
 
   virtual bool IsMemoryFile() const override
   {
     return true;
   }
 
 private:
-  ~BlobImplEmptyFile() {}
+  ~EmptyBlobImpl() {}
 };
 
 } // namespace dom
 } // namespace mozilla
 
 #endif // mozilla_dom_File_h

--- a/dom/base/FileReader.cpp
+++ b/dom/base/FileReader.cpp
@@ -93,64 +93,56 @@ public:
 void
 FileReader::RootResultArrayBuffer()
 {
   mozilla::HoldJSObjects(this);
 }
 
 //FileReader constructors/initializers
 
-FileReader::FileReader(nsPIDOMWindow* aWindow,
+FileReader::FileReader(nsIGlobalObject* aGlobal,
                        WorkerPrivate* aWorkerPrivate)
-  : DOMEventTargetHelper(aWindow)
+  : DOMEventTargetHelper(aGlobal)
   , mFileData(nullptr)
   , mDataLen(0)
   , mDataFormat(FILE_AS_BINARY)
   , mResultArrayBuffer(nullptr)
   , mProgressEventWasDelayed(false)
   , mTimerIsActive(false)
   , mReadyState(EMPTY)
   , mTotal(0)
   , mTransferred(0)
   , mTarget(do_GetCurrentThread())
   , mBusyCount(0)
   , mWorkerPrivate(aWorkerPrivate)
 {
-  MOZ_ASSERT_IF(!NS_IsMainThread(), mWorkerPrivate && !aWindow);
-  MOZ_ASSERT_IF(NS_IsMainThread(), !mWorkerPrivate);
+  MOZ_ASSERT(aGlobal);
+  MOZ_ASSERT(NS_IsMainThread() == !mWorkerPrivate);
   SetDOMStringToNull(mResult);
 }
 
 FileReader::~FileReader()
 {
   Shutdown();
   DropJSObjects(this);
 }
 
 /* static */ already_AddRefed<FileReader>
 FileReader::Constructor(const GlobalObject& aGlobal, ErrorResult& aRv)
 {
-  // The owner can be null when this object is used by chrome code.
-  nsCOMPtr<nsPIDOMWindow> owner = do_QueryInterface(aGlobal.GetAsSupports());
+  nsCOMPtr<nsIGlobalObject> global = do_QueryInterface(aGlobal.GetAsSupports());
   WorkerPrivate* workerPrivate = nullptr;
 
   if (!NS_IsMainThread()) {
     JSContext* cx = aGlobal.Context();
     workerPrivate = GetWorkerPrivateFromContext(cx);
     MOZ_ASSERT(workerPrivate);
   }
 
-  RefPtr<FileReader> fileReader = new FileReader(owner, workerPrivate);
-
-  if (!owner && nsContentUtils::ThreadsafeIsCallerChrome()) {
-    // Instead of grabbing some random global from the context stack,
-    // let's use the default one (junk scope) for now.
-    // We should move away from this Init...
-    fileReader->BindToOwner(xpc::NativeGlobal(xpc::PrivilegedJunkScope()));
-  }
+  RefPtr<FileReader> fileReader = new FileReader(global, workerPrivate);
 
   return fileReader.forget();
 }
 
 // nsIInterfaceRequestor
 
 NS_IMETHODIMP
 FileReader::GetInterface(const nsIID & aIID, void **aResult)
@@ -237,27 +229,17 @@ FileReader::DoOnLoadEnd(nsresult aStatus
 
   aSuccessEvent = NS_LITERAL_STRING(LOAD_STR);
   aTerminationEvent = NS_LITERAL_STRING(LOADEND_STR);
 
   nsresult rv = NS_OK;
   switch (mDataFormat) {
     case FILE_AS_ARRAYBUFFER: {
       AutoJSAPI jsapi;
-      nsCOMPtr<nsIGlobalObject> globalObject;
-
-      if (NS_IsMainThread()) {
-        globalObject = do_QueryInterface(GetParentObject());
-      } else {
-        MOZ_ASSERT(mWorkerPrivate);
-        MOZ_ASSERT(mBusyCount);
-        globalObject = mWorkerPrivate->GlobalScope();
-      }
-
-      if (!globalObject || !jsapi.Init(globalObject)) {
+      if (!jsapi.Init(GetParentObject())) {
         FreeFileData();
         return NS_ERROR_FAILURE;
       }
 
       RootResultArrayBuffer();
       mResultArrayBuffer = JS_NewArrayBufferWithContents(jsapi.cx(), mDataLen, mFileData);
       if (!mResultArrayBuffer) {
         JS_ClearPendingException(jsapi.cx());
@@ -360,16 +342,24 @@ FileReader::ReadFileContent(Blob& aBlob,
                             eDataFormat aDataFormat,
                             ErrorResult& aRv)
 {
   //Implicit abort to clear any other activity going on
   ErrorResult error;
   Abort(error);
   error.SuppressException();
 
+  if (mReadyState == LOADING) {
+    // A nested ReadAsSomething() as been called during one of the events
+    // dispatched by Abort(). We have to terminate this operation in order to
+    // continue the nested one.
+    aRv.Throw(NS_ERROR_ABORT);
+    return;
+  }
+
   mError = nullptr;
   SetDOMStringToNull(mResult);
   mTransferred = 0;
   mTotal = 0;
   mReadyState = EMPTY;
   FreeFileData();
 
   mBlob = &aBlob;

--- a/dom/base/FileReader.h
+++ b/dom/base/FileReader.h
@@ -41,17 +41,17 @@ class FileReader final : public DOMEvent
                          public nsSupportsWeakReference,
                          public nsIInputStreamCallback,
                          public nsITimerCallback,
                          public workers::WorkerFeature
 {
   friend class FileReaderDecreaseBusyCounter;
 
 public:
-  FileReader(nsPIDOMWindow* aWindow,
+  FileReader(nsIGlobalObject* aGlobal,
              workers::WorkerPrivate* aWorkerPrivate);
 
   NS_DECL_ISUPPORTS_INHERITED
 
   NS_DECL_NSITIMERCALLBACK
   NS_DECL_NSIINPUTSTREAMCALLBACK
   NS_DECL_NSIINTERFACEREQUESTOR
 

--- a/dom/base/FormData.cpp
+++ b/dom/base/FormData.cpp
@@ -18,42 +18,26 @@ using namespace mozilla::dom;
 FormData::FormData(nsISupports* aOwner)
   : nsFormSubmission(NS_LITERAL_CSTRING("UTF-8"), nullptr)
   , mOwner(aOwner)
 {
 }
 
 namespace {
 
-// Implements steps 3 and 4 of the "create an entry" algorithm of FormData.
-already_AddRefed<File>
-CreateNewFileInstance(Blob& aBlob, const Optional<nsAString>& aFilename,
-                      ErrorResult& aRv)
+already_AddRefed<Blob>
+GetBlobForFormDataStorage(Blob& aBlob, const Optional<nsAString>& aFilename,
+                          ErrorResult& aRv)
 {
-  // Step 3 "If value is a Blob object and not a File object, set value to
-  // a new File object, representing the same bytes, whose name attribute value
-  // is "blob"."
-  // Step 4 "If value is a File object and filename is given, set value to
-  // a new File object, representing the same bytes, whose name attribute
-  // value is filename."
-  nsAutoString filename;
-  if (aFilename.WasPassed()) {
-    filename = aFilename.Value();
-  } else {
-    // If value is already a File and filename is not passed, the spec says not
-    // to create a new instance.
-    RefPtr<File> file = aBlob.ToFile();
-    if (file) {
-      return file.forget();
-    }
-
-    filename = NS_LITERAL_STRING("blob");
+  if (!aFilename.WasPassed()) {
+    RefPtr<Blob> blob = &aBlob;
+    return blob.forget();
   }
 
-  RefPtr<File> file = aBlob.ToFile(filename, aRv);
+  RefPtr<File> file = aBlob.ToFile(aFilename.Value(), aRv);
   if (NS_WARN_IF(aRv.Failed())) {
     return nullptr;
   }
 
   return file.forget();
 }
 
 } // namespace
@@ -73,17 +57,17 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(Fo
   NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(FormData)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mOwner)
 
   for (uint32_t i = 0, len = tmp->mFormData.Length(); i < len; ++i) {
     ImplCycleCollectionTraverse(cb, tmp->mFormData[i].value,
-                                "mFormData[i].GetAsFile()", 0);
+                                "mFormData[i].GetAsBlob()", 0);
   }
 
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_SCRIPT_OBJECTS
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_TRACE_WRAPPERCACHE(FormData)
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(FormData)
@@ -111,59 +95,59 @@ FormData::Append(const nsAString& aName,
                  ErrorResult& aRv)
 {
   AddNameValuePair(aName, aValue);
 }
 
 void
 FormData::Append(const nsAString& aName, Blob& aBlob,
                  const Optional<nsAString>& aFilename,
-                   ErrorResult& aRv)
+                 ErrorResult& aRv)
 {
-  RefPtr<File> file = CreateNewFileInstance(aBlob, aFilename, aRv);
+  RefPtr<Blob> blob = GetBlobForFormDataStorage(aBlob, aFilename, aRv);
   if (NS_WARN_IF(aRv.Failed())) {
     return;
   }
 
-  AddNameFilePair(aName, file);
+  AddNameBlobPair(aName, blob);
 }
 
 void
 FormData::Delete(const nsAString& aName)
 {
   // We have to use this slightly awkward for loop since uint32_t >= 0 is an
   // error for being always true.
   for (uint32_t i = mFormData.Length(); i-- > 0; ) {
     if (aName.Equals(mFormData[i].name)) {
       mFormData.RemoveElementAt(i);
     }
   }
 }
 
 void
 FormData::Get(const nsAString& aName,
-              Nullable<OwningFileOrUSVString>& aOutValue)
+              Nullable<OwningBlobOrUSVString>& aOutValue)
 {
   for (uint32_t i = 0; i < mFormData.Length(); ++i) {
     if (aName.Equals(mFormData[i].name)) {
       aOutValue.SetValue() = mFormData[i].value;
       return;
     }
   }
 
   aOutValue.SetNull();
 }
 
 void
 FormData::GetAll(const nsAString& aName,
-                 nsTArray<OwningFileOrUSVString>& aValues)
+                 nsTArray<OwningBlobOrUSVString>& aValues)
 {
   for (uint32_t i = 0; i < mFormData.Length(); ++i) {
     if (aName.Equals(mFormData[i].name)) {
-      OwningFileOrUSVString* element = aValues.AppendElement();
+      OwningBlobOrUSVString* element = aValues.AppendElement();
       *element = mFormData[i].value;
     }
   }
 }
 
 bool
 FormData::Has(const nsAString& aName)
 {
@@ -172,22 +156,22 @@ FormData::Has(const nsAString& aName)
       return true;
     }
   }
 
   return false;
 }
 
 nsresult
-FormData::AddNameFilePair(const nsAString& aName, File* aFile)
+FormData::AddNameBlobPair(const nsAString& aName, Blob* aBlob)
 {
-  MOZ_ASSERT(aFile);
+  MOZ_ASSERT(aBlob);
 
   FormDataTuple* data = mFormData.AppendElement();
-  SetNameFilePair(data, aName, aFile);
+  SetNameBlobPair(data, aName, aBlob);
   return NS_OK;
 }
 
 FormData::FormDataTuple*
 FormData::RemoveAllOthersAndGetFirstFormDataTuple(const nsAString& aName)
 {
   FormDataTuple* lastFoundTuple = nullptr;
   uint32_t lastFoundIndex = mFormData.Length();
@@ -210,22 +194,22 @@ FormData::RemoveAllOthersAndGetFirstForm
 
 void
 FormData::Set(const nsAString& aName, Blob& aBlob,
               const Optional<nsAString>& aFilename,
               ErrorResult& aRv)
 {
   FormDataTuple* tuple = RemoveAllOthersAndGetFirstFormDataTuple(aName);
   if (tuple) {
-    RefPtr<File> file = CreateNewFileInstance(aBlob, aFilename, aRv);
+    RefPtr<Blob> blob = GetBlobForFormDataStorage(aBlob, aFilename, aRv);
     if (NS_WARN_IF(aRv.Failed())) {
       return;
     }
 
-    SetNameFilePair(tuple, aName, file);
+    SetNameBlobPair(tuple, aName, blob);
   } else {
     Append(aName, aBlob, aFilename, aRv);
   }
 }
 
 void
 FormData::Set(const nsAString& aName, const nsAString& aValue,
               ErrorResult& aRv)
@@ -246,17 +230,17 @@ FormData::GetIterableLength() const
 
 const nsAString&
 FormData::GetKeyAtIndex(uint32_t aIndex) const
 {
   MOZ_ASSERT(aIndex < mFormData.Length());
   return mFormData[aIndex].name;
 }
 
-const OwningFileOrUSVString&
+const OwningBlobOrUSVString&
 FormData::GetValueAtIndex(uint32_t aIndex) const
 {
   MOZ_ASSERT(aIndex < mFormData.Length());
   return mFormData[aIndex].value;
 }
 
 void
 FormData::SetNameValuePair(FormDataTuple* aData,
@@ -264,25 +248,25 @@ FormData::SetNameValuePair(FormDataTuple
                            const nsAString& aValue)
 {
   MOZ_ASSERT(aData);
   aData->name = aName;
   aData->value.SetAsUSVString() = aValue;
 }
 
 void
-FormData::SetNameFilePair(FormDataTuple* aData,
+FormData::SetNameBlobPair(FormDataTuple* aData,
                           const nsAString& aName,
-                          File* aFile)
+                          Blob* aBlob)
 {
   MOZ_ASSERT(aData);
-  MOZ_ASSERT(aFile);
+  MOZ_ASSERT(aBlob);
 
   aData->name = aName;
-  aData->value.SetAsFile() = aFile;
+  aData->value.SetAsBlob() = aBlob;
 }
 
 // -------------------------------------------------------------------------
 // nsIDOMFormData
 
 NS_IMETHODIMP
 FormData::Append(const nsAString& aName, nsIVariant* aValue)
 {
@@ -353,18 +337,31 @@ FormData::Constructor(const GlobalObject
 
 NS_IMETHODIMP
 FormData::GetSendInfo(nsIInputStream** aBody, uint64_t* aContentLength,
                       nsACString& aContentType, nsACString& aCharset)
 {
   nsFSMultipartFormData fs(NS_LITERAL_CSTRING("UTF-8"), nullptr);
 
   for (uint32_t i = 0; i < mFormData.Length(); ++i) {
-    if (mFormData[i].value.IsFile()) {
-      fs.AddNameFilePair(mFormData[i].name, mFormData[i].value.GetAsFile());
+    if (mFormData[i].value.IsBlob()) {
+      RefPtr<File> file = mFormData[i].value.GetAsBlob()->ToFile();
+      if (file) {
+        fs.AddNameBlobPair(mFormData[i].name, file);
+        continue;
+      }
+
+      ErrorResult rv;
+      file =
+        mFormData[i].value.GetAsBlob()->ToFile(NS_LITERAL_STRING("blob"), rv);
+      if (NS_WARN_IF(rv.Failed())) {
+        return rv.StealNSResult();
+      }
+
+      fs.AddNameBlobPair(mFormData[i].name, file);
     } else if (mFormData[i].value.IsUSVString()) {
       fs.AddNameValuePair(mFormData[i].name,
                           mFormData[i].value.GetAsUSVString());
     } else {
       MOZ_CRASH("This should no be possible.");
     }
   }