--- a/browser/base/content/aboutNetError.xhtml
+++ b/browser/base/content/aboutNetError.xhtml
@@ -72,22 +72,16 @@
         } catch (e) {
           // We probably tried to reload a URI that caused an exception to
           // occur;  e.g. a nonexistent file.
         }
 
         buttonEl.disabled = true;
       }
 
-      function doOverride(buttonEl) {
-        var event = new CustomEvent("AboutNetErrorOverride", {bubbles:true});
-        document.dispatchEvent(event);
-        retryThis(buttonEl);
-      }
-
       function toggleDisplay(node) {
         const toggle = {
           "": "block",
           "none": "block",
           "block": "none"
         };
         return (node.style.display = toggle[node.style.display]);
       }
@@ -102,20 +96,19 @@
         panel.style.display = "block";
         document.getElementById("netErrorButtonContainer").style.display = "none";
         document.getElementById("prefResetButton").addEventListener("click", function resetPreferences(e) {
           const event = new CustomEvent("AboutNetErrorResetPreferences", {bubbles:true});
           document.dispatchEvent(event);
         });
       }
 
-      function setupAdvancedButton(allowOverride) {
+      function setupAdvancedButton() {
         // Get the hostname and add it to the panel
-        var panelId = gIsCertError ? "badCertAdvancedPanel" : "weakCryptoAdvancedPanel";
-        var panel = document.getElementById(panelId);
+        var panel = document.getElementById("badCertAdvancedPanel");
         for (var span of panel.querySelectorAll("span.hostname")) {
           span.textContent = document.location.hostname;
         }
         if (!gIsCertError) {
           panel.replaceChild(document.getElementById("errorLongDesc"),
                              document.getElementById("advancedLongDesc"));
         }
 
@@ -133,22 +126,16 @@
 
           if (panel.style.display == "block") {
             // send event to trigger telemetry ping
             var event = new CustomEvent("AboutNetErrorUIExpanded", {bubbles:true});
             document.dispatchEvent(event);
           }
         });
 
-        if (allowOverride) {
-          document.getElementById("overrideWeakCryptoPanel").style.display = "flex";
-          var overrideLink = document.getElementById("overrideWeakCrypto");
-          overrideLink.addEventListener("click", () => doOverride(overrideLink));
-        }
-
         if (!gIsCertError) {
           return;
         }
 
         if (getCSSClass() == "expertBadCert") {
           toggleDisplay(document.getElementById("badCertAdvancedPanel"));
           // Toggling the advanced panel must ensure that the debugging
           // information panel is hidden as well, since it's opened by the
@@ -221,20 +208,16 @@
 
         if (err == "sslv3Used") {
           document.getElementById("learnMoreContainer").style.display = "block";
           let learnMoreLink = document.getElementById("learnMoreLink");
           learnMoreLink.href = "https://support.mozilla.org/kb/how-resolve-sslv3-error-messages-firefox";
           document.body.className = "certerror";
         }
 
-        if (err == "weakCryptoUsed") {
-          document.body.className = "certerror";
-        }
-
         // remove undisplayed errors to avoid bug 39098
         var errContainer = document.getElementById("errorContainer");
         errContainer.remove();
 
         var className = getCSSClass();
         if (className && className != "expertBadCert") {
           // Associate a CSS class with the root of the page, if one was passed in,
           // to allow custom styling.
@@ -260,27 +243,24 @@
         if (err == "cspBlocked") {
           // Remove the "Try again" button for CSP violations, since it's
           // almost certainly useless. (Bug 553180)
           document.getElementById("netErrorButtonContainer").style.display = "none";
         }
 
         window.addEventListener("AboutNetErrorOptions", function(evt) {
         // Pinning errors are of type nssFailure2
-          if (getErrorCode() == "nssFailure2" || getErrorCode() == "weakCryptoUsed") {
+          if (getErrorCode() == "nssFailure2") {
             document.getElementById("learnMoreContainer").style.display = "block";
             let learnMoreLink = document.getElementById("learnMoreLink");
             // nssFailure2 also gets us other non-overrideable errors. Choose
             // a "learn more" link based on description:
             if (getDescription().includes("mozilla_pkix_error_key_pinning_failure")) {
               learnMoreLink.href = "https://support.mozilla.org/kb/certificate-pinning-reports";
             }
-            if (getErrorCode() == "weakCryptoUsed") {
-              learnMoreLink.href = "https://support.mozilla.org/kb/how-resolve-weak-crypto-error-messages-firefox";
-            }
 
             var options = JSON.parse(evt.detail);
             if (options && options.enabled) {
               var checkbox = document.getElementById("automaticallyReportInFuture");
               showCertificateErrorReporting();
               if (options.automatic) {
                 // set the checkbox
                 checkbox.checked = true;
@@ -300,18 +280,18 @@
               "SSL_ERROR_NO_CYPHER_OVERLAP",
               "SSL_ERROR_NO_CIPHERS_SUPPORTED"
             ].some((substring) => getDescription().includes(substring));
             // If it looks like an error that is user config based
             if (getErrorCode() == "nssFailure2" && hasPrefStyleError && options && options.changedCertPrefs) {
               showPrefChangeContainer();
             }
           }
-          if (getErrorCode() == "weakCryptoUsed" || getErrorCode() == "sslv3Used") {
-            setupAdvancedButton(getErrorCode() == "weakCryptoUsed");
+          if (getErrorCode() == "sslv3Used") {
+            setupAdvancedButton();
           }
         }, true, true);
 
         var event = new CustomEvent("AboutNetErrorLoad", {bubbles:true});
         document.dispatchEvent(event);
 
         if (err == "inadequateSecurityError") {
           // Remove the "Try again" button for HTTP/2 inadequate security as it
@@ -332,17 +312,17 @@
         document.title = document.getElementById("captivePortalPageTitle").textContent;
 
         document.getElementById("openPortalLoginPageButton")
                 .addEventListener("click", () => {
           let event = new CustomEvent("AboutNetErrorOpenCaptivePortal", {bubbles:true});
           document.dispatchEvent(event);
         });
 
-        setupAdvancedButton(true);
+        setupAdvancedButton();
 
         addDomainErrorLinks();
 
         // When the portal is freed, an event is generated by the frame script
         // that we can pick up and attempt to reload the original page.
         window.addEventListener("AboutNetErrorCaptivePortalFreed", () => {
           document.location.reload();
         });
@@ -350,17 +330,17 @@
 
       function initPageCertError() {
         document.body.className = "certerror";
         document.title = document.getElementById("certErrorPageTitle").textContent;
         for (let host of document.querySelectorAll(".hostname")) {
           host.textContent = document.location.hostname;
         }
 
-        setupAdvancedButton(true);
+        setupAdvancedButton();
 
         document.getElementById("learnMoreContainer").style.display = "block";
 
         let checkbox = document.getElementById("automaticallyReportInFuture");
         checkbox.addEventListener("change", function({target: {checked}}) {
           document.dispatchEvent(new CustomEvent("AboutNetErrorSetAutomatic", {
             detail: checked,
             bubbles: true
@@ -484,18 +464,17 @@
          * The certificate is only valid for garage.maemo.org
          */
         if (thisHost.endsWith("." + okHost))
           link.href = proto + okHost;
 
         // If we set a link, meaning there's something helpful for
         // the user here, expand the section by default
         if (link.href && getCSSClass() != "expertBadCert") {
-          var panelId = gIsCertError ? "badCertAdvancedPanel" : "weakCryptoAdvancedPanel"
-          toggleDisplay(document.getElementById(panelId));
+          toggleDisplay(document.getElementById("badCertAdvancedPanel"));
           if (gIsCertError) {
             // Toggling the advanced panel must ensure that the debugging
             // information panel is hidden as well, since it's opened by the
             // error code link in the advanced panel.
             var div = document.getElementById("certificateErrorDebugInformation");
             div.style.display = "none";
           }
         }
@@ -540,17 +519,16 @@
         <h1 id="et_contentEncodingError">&contentEncodingError.title;</h1>
         <h1 id="et_unsafeContentType">&unsafeContentType.title;</h1>
         <h1 id="et_nssFailure2">&nssFailure2.title;</h1>
         <h1 id="et_nssBadCert">&certerror.longpagetitle1;</h1>
         <h1 id="et_cspBlocked">&cspBlocked.title;</h1>
         <h1 id="et_remoteXUL">&remoteXUL.title;</h1>
         <h1 id="et_corruptedContentErrorv2">&corruptedContentErrorv2.title;</h1>
         <h1 id="et_sslv3Used">&sslv3Used.title;</h1>
-        <h1 id="et_weakCryptoUsed">&weakCryptoUsed.title;</h1>
         <h1 id="et_inadequateSecurityError">&inadequateSecurityError.title;</h1>
       </div>
       <div id="errorDescriptionsContainer">
         <div id="ed_generic">&generic.longDesc;</div>
         <div id="ed_captivePortal">&captivePortal.longDesc2;</div>
         <div id="ed_dnsNotFound">&dnsNotFound.longDesc;</div>
         <div id="ed_fileNotFound">&fileNotFound.longDesc;</div>
         <div id="ed_fileAccessDenied">&fileAccessDenied.longDesc;</div>
@@ -570,17 +548,16 @@
         <div id="ed_contentEncodingError">&contentEncodingError.longDesc;</div>
         <div id="ed_unsafeContentType">&unsafeContentType.longDesc;</div>
         <div id="ed_nssFailure2">&nssFailure2.longDesc2;</div>
         <div id="ed_nssBadCert">&certerror.introPara;</div>
         <div id="ed_cspBlocked">&cspBlocked.longDesc;</div>
         <div id="ed_remoteXUL">&remoteXUL.longDesc;</div>
         <div id="ed_corruptedContentErrorv2">&corruptedContentErrorv2.longDesc;</div>
         <div id="ed_sslv3Used">&sslv3Used.longDesc2;</div>
-        <div id="ed_weakCryptoUsed">&weakCryptoUsed.longDesc2;</div>
         <div id="ed_inadequateSecurityError">&inadequateSecurityError.longDesc;</div>
       </div>
     </div>
 
     <!-- PAGE CONTAINER (for styling purposes only) -->
     <div id="errorPageContainer" class="container">
 
       <!-- Error Title -->
@@ -649,26 +626,16 @@
       <div id="certificateErrorReporting">
         <p class="toggle-container-with-text">
           <input type="checkbox" id="automaticallyReportInFuture" />
           <label for="automaticallyReportInFuture" id="automaticallyReportInFuture">&errorReporting.automatic2;</label>
         </p>
       </div>
 
       <div id="advancedPanelContainer">
-        <div id="weakCryptoAdvancedPanel" class="advanced-panel">
-          <div id="weakCryptoAdvancedDescription">
-            <p>&weakCryptoAdvanced.longDesc;</p>
-          </div>
-          <div id="advancedLongDesc" />
-          <div id="overrideWeakCryptoPanel">
-            <a id="overrideWeakCrypto" href="#">&weakCryptoAdvanced.override;</a>
-          </div>
-        </div>
-
         <div id="badCertAdvancedPanel" class="advanced-panel">
           <p id="badCertTechnicalInfo"/>
           <button id="exceptionDialogButton">&securityOverride.exceptionButtonLabel;</button>
         </div>
       </div>
 
     </div>
 

--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -2841,33 +2841,31 @@ var BrowserOnClick = {
     mm.addMessageListener("Browser:CertExceptionError", this);
     mm.addMessageListener("Browser:OpenCaptivePortalPage", this);
     mm.addMessageListener("Browser:SiteBlockedError", this);
     mm.addMessageListener("Browser:EnableOnlineMode", this);
     mm.addMessageListener("Browser:SendSSLErrorReport", this);
     mm.addMessageListener("Browser:SetSSLErrorReportAuto", this);
     mm.addMessageListener("Browser:ResetSSLPreferences", this);
     mm.addMessageListener("Browser:SSLErrorReportTelemetry", this);
-    mm.addMessageListener("Browser:OverrideWeakCrypto", this);
     mm.addMessageListener("Browser:SSLErrorGoBack", this);
 
     Services.obs.addObserver(this, "captive-portal-login-abort", false);
     Services.obs.addObserver(this, "captive-portal-login-success", false);
   },
 
   uninit() {
     let mm = window.messageManager;
     mm.removeMessageListener("Browser:CertExceptionError", this);
     mm.removeMessageListener("Browser:SiteBlockedError", this);
     mm.removeMessageListener("Browser:EnableOnlineMode", this);
     mm.removeMessageListener("Browser:SendSSLErrorReport", this);
     mm.removeMessageListener("Browser:SetSSLErrorReportAuto", this);
     mm.removeMessageListener("Browser:ResetSSLPreferences", this);
     mm.removeMessageListener("Browser:SSLErrorReportTelemetry", this);
-    mm.removeMessageListener("Browser:OverrideWeakCrypto", this);
     mm.removeMessageListener("Browser:SSLErrorGoBack", this);
 
     Services.obs.removeObserver(this, "captive-portal-login-abort");
     Services.obs.removeObserver(this, "captive-portal-login-success");
   },
 
   observe(aSubject, aTopic, aData) {
     switch (aTopic) {
@@ -2938,23 +2936,16 @@ var BrowserOnClick = {
         }
         Services.telemetry.getHistogramById("TLS_ERROR_REPORT_UI").add(bin);
       break;
       case "Browser:SSLErrorReportTelemetry":
         let reportStatus = msg.data.reportStatus;
         Services.telemetry.getHistogramById("TLS_ERROR_REPORT_UI")
           .add(reportStatus);
       break;
-      case "Browser:OverrideWeakCrypto":
-        let weakCryptoOverride = Cc["@mozilla.org/security/weakcryptooverride;1"]
-                                   .getService(Ci.nsIWeakCryptoOverride);
-        weakCryptoOverride.addWeakCryptoOverride(
-          msg.data.uri.host,
-          PrivateBrowsingUtils.isBrowserPrivate(gBrowser.selectedBrowser));
-      break;
       case "Browser:SSLErrorGoBack":
         goBackFromErrorPage();
       break;
     }
   },
 
   onSSLErrorReport(browser, uri, securityInfo) {
     if (!Services.prefs.getBoolPref("security.ssl.errorReporting.enabled")) {
@@ -6937,17 +6928,16 @@ var gIdentityHandler = {
 
     // Then, update the user interface with the available data.
     this.refreshIdentityBlock();
     // Handle a location change while the Control Center is focused
     // by closing the popup (bug 1207542)
     if (shouldHidePopup) {
       this._identityPopup.hidePopup();
     }
-    this.showWeakCryptoInfoBar();
 
     // NOTE: We do NOT update the identity popup (the control center) when
     // we receive a new security state on the existing page (i.e. from a
     // subframe). If the user opened the popup and looks at the provided
     // information we don't want to suddenly change the panel contents.
   },
 
   /**
@@ -7127,65 +7117,16 @@ var gIdentityHandler = {
     // Set cropping and direction
     this._identityIconLabel.crop = icon_country_label ? "end" : "center";
     this._identityIconLabel.parentNode.style.direction = icon_labels_dir;
     // Hide completely if the organization label is empty
     this._identityIconLabel.parentNode.collapsed = icon_label ? false : true;
   },
 
   /**
-   * Show the weak crypto notification bar.
-   */
-  showWeakCryptoInfoBar() {
-    if (!this._uriHasHost || !this._isBroken || !this._sslStatus.cipherName ||
-        this._sslStatus.cipherName.indexOf("_RC4_") < 0) {
-      return;
-    }
-
-    let notificationBox = gBrowser.getNotificationBox();
-    let notification = notificationBox.getNotificationWithValue("weak-crypto");
-    if (notification) {
-      return;
-    }
-
-    let brandBundle = document.getElementById("bundle_brand");
-    let brandShortName = brandBundle.getString("brandShortName");
-    let message = gNavigatorBundle.getFormattedString("weakCryptoOverriding.message",
-                                                      [brandShortName]);
-
-    let host = this._uri.host;
-    let port = 443;
-    try {
-      if (this._uri.port > 0) {
-        port = this._uri.port;
-      }
-    } catch (e) {}
-
-    let buttons = [{
-      label: gNavigatorBundle.getString("revokeOverride.label"),
-      accessKey: gNavigatorBundle.getString("revokeOverride.accesskey"),
-      callback(aNotification, aButton) {
-        try {
-          let weakCryptoOverride = Cc["@mozilla.org/security/weakcryptooverride;1"]
-                                     .getService(Ci.nsIWeakCryptoOverride);
-          weakCryptoOverride.removeWeakCryptoOverride(host, port,
-            PrivateBrowsingUtils.isBrowserPrivate(gBrowser.selectedBrowser));
-          BrowserReloadWithFlags(nsIWebNavigation.LOAD_FLAGS_BYPASS_CACHE);
-        } catch (e) {
-          Cu.reportError(e);
-        }
-      }
-    }];
-
-    const priority = notificationBox.PRIORITY_WARNING_MEDIUM;
-    notificationBox.appendNotification(message, "weak-crypto", null,
-                                       priority, buttons);
-  },
-
-  /**
    * Set up the title and content messages for the identity message popup,
    * based on the specified mode, and the details of the SSL cert, where
    * applicable
    */
   refreshIdentityPopup() {
     // Update "Learn More" for Mixed Content Blocking and Insecure Login Forms.
     let baseURL = Services.urlFormatter.formatURLPref("app.support.baseURL");
     this._identityPopupMixedContentLearnMore

--- a/browser/base/content/content.js
+++ b/browser/base/content/content.js
@@ -262,17 +262,16 @@ function getSerializedSecurityInfo(docSh
 
 var AboutNetAndCertErrorListener = {
   init(chromeGlobal) {
     addMessageListener("CertErrorDetails", this);
     addMessageListener("Browser:CaptivePortalFreed", this);
     chromeGlobal.addEventListener("AboutNetErrorLoad", this, false, true);
     chromeGlobal.addEventListener("AboutNetErrorOpenCaptivePortal", this, false, true);
     chromeGlobal.addEventListener("AboutNetErrorSetAutomatic", this, false, true);
-    chromeGlobal.addEventListener("AboutNetErrorOverride", this, false, true);
     chromeGlobal.addEventListener("AboutNetErrorResetPreferences", this, false, true);
   },
 
   get isAboutNetError() {
     return content.document.documentURI.startsWith("about:neterror");
   },
 
   get isAboutCertError() {
@@ -385,19 +384,16 @@ var AboutNetAndCertErrorListener = {
       this.onPageLoad(aEvent);
       break;
     case "AboutNetErrorOpenCaptivePortal":
       this.openCaptivePortalPage(aEvent);
       break;
     case "AboutNetErrorSetAutomatic":
       this.onSetAutomatic(aEvent);
       break;
-    case "AboutNetErrorOverride":
-      this.onOverride(aEvent);
-      break;
     case "AboutNetErrorResetPreferences":
       this.onResetPreferences(aEvent);
       break;
     }
   },
 
   changedCertPrefs() {
     for (let prefName of PREF_SSL_IMPACT) {
@@ -448,21 +444,16 @@ var AboutNetAndCertErrorListener = {
       let {host, port} = content.document.mozDocumentURIIfNotForErrorPages;
       sendAsyncMessage("Browser:SendSSLErrorReport", {
         uri: { host, port },
         securityInfo: getSerializedSecurityInfo(docShell),
       });
 
     }
   },
-
-  onOverride(evt) {
-    let {host, port} = content.document.mozDocumentURIIfNotForErrorPages;
-    sendAsyncMessage("Browser:OverrideWeakCrypto", { uri: {host, port} });
-  }
 }
 
 AboutNetAndCertErrorListener.init(this);
 
 
 var ClickEventHandler = {
   init: function init() {
     Cc["@mozilla.org/eventlistenerservice;1"]

--- a/browser/base/content/test/general/browser.ini
+++ b/browser/base/content/test/general/browser.ini
@@ -89,19 +89,16 @@ support-files =
   !/toolkit/mozapps/extensions/test/xpinstall/corrupt.xpi
   !/toolkit/mozapps/extensions/test/xpinstall/incompatible.xpi
   !/toolkit/mozapps/extensions/test/xpinstall/installtrigger.html
   !/toolkit/mozapps/extensions/test/xpinstall/redirect.sjs
   !/toolkit/mozapps/extensions/test/xpinstall/restartless-unsigned.xpi
   !/toolkit/mozapps/extensions/test/xpinstall/restartless.xpi
   !/toolkit/mozapps/extensions/test/xpinstall/theme.xpi
   !/toolkit/mozapps/extensions/test/xpinstall/slowinstall.sjs
-  file_about_child.html
-  file_about_parent.html
-  file_register_about_page.js
 
 [browser_aboutAccounts.js]
 skip-if = os == "linux" # Bug 958026
 support-files =
   content_aboutAccounts.js
 [browser_aboutCertError.js]
 [browser_aboutNetError.js]
 [browser_aboutSupport_newtab_security_state.js]
@@ -422,16 +419,19 @@ skip-if = true # Bug 1005420 - fails int
 skip-if = (os == "win" && !debug)
 [browser_web_channel.js]
 [browser_windowopen_reflows.js]
 [browser_zbug569342.js]
 skip-if = e10s || debug # Bug 1094240 - has findbar-related failures
 [browser_registerProtocolHandler_notification.js]
 [browser_addCertException.js]
 [browser_e10s_about_page_triggeringprincipal.js]
+support-files =
+  file_about_child.html
+  file_about_parent.html
 [browser_e10s_switchbrowser.js]
 [browser_e10s_about_process.js]
 [browser_e10s_chrome_process.js]
 [browser_e10s_javascript.js]
 [browser_blockHPKP.js]
 tags = psm
 [browser_windowactivation.js]
 [browser_contextmenu_childprocess.js]

--- a/browser/base/content/test/general/browser_e10s_about_page_triggeringprincipal.js
+++ b/browser/base/content/test/general/browser_e10s_about_page_triggeringprincipal.js
@@ -1,26 +1,24 @@
 "use strict";
-Cu.import("resource://gre/modules/Services.jsm");
+
+const kChildPage = getRootDirectory(gTestPath) + "file_about_child.html";
+const kParentPage = getRootDirectory(gTestPath) + "file_about_parent.html";
 
-registerCleanupFunction(function() {
-  Services.ppmm.broadcastAsyncMessage("AboutPrincipalTest:Unregister");
-  BrowserTestUtils.waitForMessage(Services.ppmm, "AboutPrincipalTest:Unregistered").then(
-    Services.ppmm.removeDelayedProcessScript(
-      "chrome://mochitests/content/browser/browser/base/content/test/general/file_register_about_page.js"
-    )
-  );
-});
+const kAboutPagesRegistered = Promise.all([
+  BrowserTestUtils.registerAboutPage(
+    registerCleanupFunction, "test-about-principal-child", kChildPage,
+    Ci.nsIAboutModule.URI_MUST_LOAD_IN_CHILD | Ci.nsIAboutModule.ALLOW_SCRIPT),
+  BrowserTestUtils.registerAboutPage(
+    registerCleanupFunction, "test-about-principal-parent", kParentPage,
+    Ci.nsIAboutModule.ALLOW_SCRIPT)
+]);
 
 add_task(function* test_principal_click() {
-  Services.ppmm.loadProcessScript(
-    "chrome://mochitests/content/browser/browser/base/content/test/general/file_register_about_page.js",
-    true
-  );
-
+  yield kAboutPagesRegistered;
   yield BrowserTestUtils.withNewTab("about:test-about-principal-parent", function*(browser) {
     let loadPromise = BrowserTestUtils.browserLoaded(browser, false, "about:test-about-principal-child");
     let myLink = browser.contentDocument.getElementById("aboutchildprincipal");
     myLink.click();
     yield loadPromise;
 
     yield ContentTask.spawn(gBrowser.selectedBrowser, {}, function*() {
       let channel = content.document.docShell.currentDocumentChannel;
@@ -39,16 +37,17 @@ add_task(function* test_principal_click(
       let loadingPrincipal = channel.loadInfo.loadingPrincipal;
       is(loadingPrincipal, null,
          "sanity check - load of TYPE_DOCUMENT must have a null loadingPrincipal");
     });
   });
 });
 
 add_task(function* test_principal_ctrl_click() {
+  yield kAboutPagesRegistered;
   yield SpecialPowers.pushPrefEnv({
     "set": [["security.sandbox.content.level", 1]],
   });
 
   yield BrowserTestUtils.withNewTab("about:test-about-principal-parent", function*(browser) {
     let loadPromise = BrowserTestUtils.waitForNewTab(gBrowser, "about:test-about-principal-child");
     // simulate ctrl+click
     BrowserTestUtils.synthesizeMouseAtCenter("#aboutchildprincipal",
@@ -75,16 +74,17 @@ add_task(function* test_principal_ctrl_c
       is(loadingPrincipal, null,
          "sanity check - load of TYPE_DOCUMENT must have a null loadingPrincipal");
     });
     yield BrowserTestUtils.removeTab(tab);
   });
 });
 
 add_task(function* test_principal_right_click_open_link_in_new_tab() {
+  yield kAboutPagesRegistered;
   yield SpecialPowers.pushPrefEnv({
     "set": [["security.sandbox.content.level", 1]],
   });
 
   yield BrowserTestUtils.withNewTab("about:test-about-principal-parent", function*(browser) {
     let loadPromise = BrowserTestUtils.waitForNewTab(gBrowser, "about:test-about-principal-child");
 
     // simulate right-click open link in tab

--- a/browser/base/content/test/general/browser_misused_characters_in_strings.js
+++ b/browser/base/content/test/general/browser_misused_characters_in_strings.js
@@ -13,24 +13,16 @@ let gWhitelist = [{
     key: "searchForSomethingWith",
     type: "single-quote"
   }, {
     file: "netError.dtd",
     key: "certerror.introPara",
     type: "single-quote"
   }, {
     file: "netError.dtd",
-    key: "weakCryptoAdvanced.longDesc",
-    type: "single-quote"
-  }, {
-    file: "netError.dtd",
-    key: "weakCryptoAdvanced.override",
-    type: "single-quote"
-  }, {
-    file: "netError.dtd",
     key: "inadequateSecurityError.longDesc",
     type: "single-quote"
   }, {
     file: "netError.dtd",
     key: "certerror.wrongSystemTime2",
     type: "single-quote"
   }, {
     file: "netError.dtd",

deleted file mode 100644
--- a/browser/base/content/test/general/file_register_about_page.js
+++ /dev/null
@@ -1,81 +0,0 @@
-const { interfaces: Ci, results: Cr, manager: Cm, utils: Cu } = Components;
-Cu.import("resource://gre/modules/Services.jsm");
-Cu.import("resource://gre/modules/XPCOMUtils.jsm");
-
-function AboutPage(chromeURL, aboutHost, classID, description, uriFlags) {
-  this.chromeURL = chromeURL;
-  this.aboutHost = aboutHost;
-  this.classID = Components.ID(classID);
-  this.description = description;
-  this.uriFlags = uriFlags;
-}
-
-AboutPage.prototype = {
-  QueryInterface: XPCOMUtils.generateQI([Ci.nsIAboutModule]),
-  getURIFlags(aURI) { // eslint-disable-line no-unused-vars
-    return this.uriFlags;
-  },
-
-  newChannel(aURI, aLoadInfo) {
-    let newURI = Services.io.newURI(this.chromeURL);
-    let channel = Services.io.newChannelFromURIWithLoadInfo(newURI,
-                                                            aLoadInfo);
-    channel.originalURI = aURI;
-
-    if (this.uriFlags & Ci.nsIAboutModule.URI_SAFE_FOR_UNTRUSTED_CONTENT) {
-      channel.owner = null;
-    }
-    return channel;
-  },
-
-  createInstance(outer, iid) {
-    if (outer !== null) {
-      throw Cr.NS_ERROR_NO_AGGREGATION;
-    }
-    return this.QueryInterface(iid);
-  },
-
-  register() {
-    Cm.QueryInterface(Ci.nsIComponentRegistrar).registerFactory(
-      this.classID, this.description,
-      "@mozilla.org/network/protocol/about;1?what=" + this.aboutHost, this);
-  },
-
-  unregister() {
-    Cm.QueryInterface(Ci.nsIComponentRegistrar).unregisterFactory(
-      this.classID, this);
-  }
-};
-
-/* exported AboutPrincipalTest */
-var AboutPrincipalTest = {};
-
-XPCOMUtils.defineLazyGetter(AboutPrincipalTest, "aboutChild", () =>
-  new AboutPage("chrome://mochitests/content/browser/browser/base/content/test/general/file_about_child.html",
-                "test-about-principal-child",
-                "{df6cbd19-c95b-4011-874b-315347c0832c}",
-                "About Principal Child Test",
-                Ci.nsIAboutModule.URI_MUST_LOAD_IN_CHILD |
-                Ci.nsIAboutModule.ALLOW_SCRIPT)
-
-);
-
-XPCOMUtils.defineLazyGetter(AboutPrincipalTest, "aboutParent", () =>
-  new AboutPage("chrome://mochitests/content/browser/browser/base/content/test/general/file_about_parent.html",
-                "test-about-principal-parent",
-                "{15e1a03d-9f94-4352-bfb8-94216140d3ab}",
-                "About Principal Parent Test",
-                Ci.nsIAboutModule.ALLOW_SCRIPT)
-);
-
-AboutPrincipalTest.aboutParent.register();
-AboutPrincipalTest.aboutChild.register();
-
-function onUnregisterMessage() {
-  removeMessageListener("AboutPrincipalTest:Unregister", onUnregisterMessage);
-  AboutPrincipalTest.aboutParent.unregister();
-  AboutPrincipalTest.aboutChild.unregister();
-  sendAsyncMessage("AboutPrincipalTest:Unregistered");
-}
-
-addMessageListener("AboutPrincipalTest:Unregister", onUnregisterMessage);

--- a/browser/components/search/test/browser.ini
+++ b/browser/components/search/test/browser.ini
@@ -23,16 +23,17 @@ support-files =
 [browser_bing_behavior.js]
 [browser_contextmenu.js]
 [browser_contextSearchTabPosition.js]
 skip-if = os == "mac" # bug 967013
 [browser_ddg.js]
 [browser_ddg_behavior.js]
 [browser_google.js]
 [browser_google_codes.js]
+[browser_google_nocodes.js]
 [browser_google_behavior.js]
 [browser_healthreport.js]
 [browser_hiddenOneOffs_cleanup.js]
 [browser_hiddenOneOffs_diacritics.js]
 [browser_oneOffContextMenu.js]
 [browser_oneOffContextMenu_setDefault.js]
 [browser_oneOffHeader.js]
 [browser_private_search_perwindowpb.js]

--- a/browser/components/search/test/browser_google_codes.js
+++ b/browser/components/search/test/browser_google_codes.js
@@ -2,16 +2,18 @@
  * http://creativecommons.org/publicdomain/zero/1.0/ */
 
 "use strict";
 
 const kUrlPref = "geoSpecificDefaults.url";
 const BROWSER_SEARCH_PREF = "browser.search.";
 
 var originalGeoURL;
+var originalCountryCode;
+var originalRegion;
 
 /**
  * Clean the profile of any cache file left from a previous run.
  * Returns a boolean indicating if the cache file existed.
  */
 function removeCacheFile() {
   const CACHE_FILENAME = "search.json.mozlz4";
 
@@ -84,40 +86,42 @@ add_task(function* preparation() {
   gEngineCount = Services.search.getVisibleEngines().length;
 
   waitForSearchNotification("uninit-complete", () => {
     // Verify search service is not initialized
     is(Services.search.isInitialized, false, "Search service should NOT be initialized");
 
     removeCacheFile();
 
+    // Make sure we get the new country/region values, but save the old
+    originalCountryCode = Services.prefs.getCharPref(BROWSER_SEARCH_PREF + "countryCode");
+    originalRegion = Services.prefs.getCharPref(BROWSER_SEARCH_PREF + "region");
+    Services.prefs.clearUserPref(BROWSER_SEARCH_PREF + "countryCode");
+    Services.prefs.clearUserPref(BROWSER_SEARCH_PREF + "region");
+
     // Geo specific defaults won't be fetched if there's no country code.
     Services.prefs.setCharPref("browser.search.geoip.url",
-                               'data:application/json,{"country_code": "US"}');
+                               'data:application/json,{"country_code": "DE"}');
 
     Services.prefs.setBoolPref("browser.search.geoSpecificDefaults", true);
 
-    // Make the new Google the only engine
+    // Avoid going to the server for the geo lookup. We take the defaults
     originalGeoURL = Services.prefs.getCharPref(BROWSER_SEARCH_PREF + kUrlPref);
-    let geoUrl = 'data:application/json,{"interval": 31536000, "settings": {"searchDefault": "Google", "visibleDefaultEngines": ["google"]}}';
+    let geoUrl = "data:application/json,{}";
     Services.prefs.getDefaultBranch(BROWSER_SEARCH_PREF).setCharPref(kUrlPref, geoUrl);
   });
 
   yield asyncReInit();
 
   yield new Promise(resolve => {
     waitForSearchNotification("write-cache-to-disk-complete", resolve);
   });
 });
 
 add_task(function* tests() {
-  let engines = Services.search.getEngines();
-  is(Services.search.currentEngine.name, "Google", "Search engine should be Google");
-  is(engines.length, 1, "There should only be one engine");
-
   let engine = Services.search.getEngineByName("Google");
   ok(engine, "Google");
 
   let base = "https://www.google.com/search?q=foo&ie=utf-8&oe=utf-8&client=firefox-b";
 
   // Keyword uses a slightly different code
   let keywordBase = base + "-ab";
 
@@ -143,16 +147,19 @@ add_task(function* cleanup() {
   waitForSearchNotification("uninit-complete", () => {
     // Verify search service is not initialized
     is(Services.search.isInitialized, false,
        "Search service should NOT be initialized");
     removeCacheFile();
 
     Services.prefs.clearUserPref("browser.search.geoip.url");
 
+    Services.prefs.setCharPref(BROWSER_SEARCH_PREF + "countryCode", originalCountryCode)
+    Services.prefs.setCharPref(BROWSER_SEARCH_PREF + "region", originalRegion)
+
     // We can't clear the pref because it's set to false by testing/profiles/prefs_general.js
     Services.prefs.setBoolPref("browser.search.geoSpecificDefaults", false);
 
     Services.prefs.getDefaultBranch(BROWSER_SEARCH_PREF).setCharPref(kUrlPref, originalGeoURL);
   });
 
   yield asyncReInit();
   is(gEngineCount, Services.search.getVisibleEngines().length,

new file mode 100644
--- /dev/null
+++ b/browser/components/search/test/browser_google_nocodes.js
@@ -0,0 +1,164 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+const kUrlPref = "geoSpecificDefaults.url";
+const BROWSER_SEARCH_PREF = "browser.search.";
+
+var originalGeoURL;
+var originalCountryCode;
+var originalRegion;
+
+/**
+ * Clean the profile of any cache file left from a previous run.
+ * Returns a boolean indicating if the cache file existed.
+ */
+function removeCacheFile() {
+  const CACHE_FILENAME = "search.json.mozlz4";
+
+  let file =  Services.dirsvc.get("ProfD", Ci.nsIFile);
+  file.append(CACHE_FILENAME);
+  if (file.exists()) {
+    file.remove(false);
+    return true;
+  }
+  return false;
+}
+
+/**
+ * Returns a promise that is resolved when an observer notification from the
+ * search service fires with the specified data.
+ *
+ * @param aExpectedData
+ *        The value the observer notification sends that causes us to resolve
+ *        the promise.
+ */
+function waitForSearchNotification(aExpectedData, aCallback) {
+  const SEARCH_SERVICE_TOPIC = "browser-search-service";
+  Services.obs.addObserver(function observer(aSubject, aTopic, aData) {
+    if (aData != aExpectedData)
+      return;
+
+    Services.obs.removeObserver(observer, SEARCH_SERVICE_TOPIC);
+    aCallback();
+  }, SEARCH_SERVICE_TOPIC, false);
+}
+
+function asyncInit() {
+  return new Promise(resolve => {
+    Services.search.init(function() {
+      ok(Services.search.isInitialized, "search service should be initialized");
+      resolve();
+    });
+  });
+}
+
+function asyncReInit() {
+  const kLocalePref = "general.useragent.locale";
+
+  let promise = new Promise(resolve => {
+    waitForSearchNotification("reinit-complete", resolve);
+  });
+
+  Services.search.QueryInterface(Ci.nsIObserver)
+          .observe(null, "nsPref:changed", kLocalePref);
+
+  return promise;
+}
+
+let gEngineCount;
+
+add_task(function* preparation() {
+  // ContentSearch is interferring with our async re-initializations of the
+  // search service: once _initServicePromise has resolved, it will access
+  // the search service, thus causing unpredictable behavior due to
+  // synchronous initializations of the service.
+  let originalContentSearchPromise = ContentSearch._initServicePromise;
+  ContentSearch._initServicePromise = new Promise(resolve => {
+    registerCleanupFunction(() => {
+      ContentSearch._initServicePromise = originalContentSearchPromise;
+      resolve();
+    });
+  });
+
+  yield asyncInit();
+  gEngineCount = Services.search.getVisibleEngines().length;
+
+  waitForSearchNotification("uninit-complete", () => {
+    // Verify search service is not initialized
+    is(Services.search.isInitialized, false, "Search service should NOT be initialized");
+
+    removeCacheFile();
+
+    // Make sure we get the new country/region values, but save the old
+    originalCountryCode = Services.prefs.getCharPref(BROWSER_SEARCH_PREF + "countryCode");
+    originalRegion = Services.prefs.getCharPref(BROWSER_SEARCH_PREF + "region");
+    Services.prefs.clearUserPref(BROWSER_SEARCH_PREF + "countryCode");
+    Services.prefs.clearUserPref(BROWSER_SEARCH_PREF + "region");
+
+    // Geo specific defaults won't be fetched if there's no country code.
+    Services.prefs.setCharPref("browser.search.geoip.url",
+                               'data:application/json,{"country_code": "US"}');
+
+    Services.prefs.setBoolPref("browser.search.geoSpecificDefaults", true);
+
+    // Avoid going to the server for the geo lookup. We take the defaults
+    originalGeoURL = Services.prefs.getCharPref(BROWSER_SEARCH_PREF + kUrlPref);
+    let geoUrl = "data:application/json,{}";
+    Services.prefs.getDefaultBranch(BROWSER_SEARCH_PREF).setCharPref(kUrlPref, geoUrl);
+  });
+
+  yield asyncReInit();
+
+  yield new Promise(resolve => {
+    waitForSearchNotification("write-cache-to-disk-complete", resolve);
+  });
+});
+
+add_task(function* tests() {
+  let engine = Services.search.getEngineByName("Google");
+  ok(engine, "Google");
+
+  let base = "https://www.google.com/search?q=foo&ie=utf-8&oe=utf-8";
+
+  let url;
+
+  // Test search URLs (including purposes).
+  url = engine.getSubmission("foo", null, "contextmenu").uri.spec;
+  is(url, base, "Check context menu search URL for 'foo'");
+  url = engine.getSubmission("foo", null, "keyword").uri.spec;
+  is(url, base, "Check keyword search URL for 'foo'");
+  url = engine.getSubmission("foo", null, "searchbar").uri.spec;
+  is(url, base, "Check search bar search URL for 'foo'");
+  url = engine.getSubmission("foo", null, "homepage").uri.spec;
+  is(url, base, "Check homepage search URL for 'foo'");
+  url = engine.getSubmission("foo", null, "newtab").uri.spec;
+  is(url, base, "Check newtab search URL for 'foo'");
+  url = engine.getSubmission("foo", null, "system").uri.spec;
+  is(url, base, "Check system search URL for 'foo'");
+});
+
+
+add_task(function* cleanup() {
+  waitForSearchNotification("uninit-complete", () => {
+    // Verify search service is not initialized
+    is(Services.search.isInitialized, false,
+       "Search service should NOT be initialized");
+    removeCacheFile();
+
+    Services.prefs.clearUserPref("browser.search.geoip.url");
+
+    Services.prefs.setCharPref(BROWSER_SEARCH_PREF + "countryCode", originalCountryCode)
+    Services.prefs.setCharPref(BROWSER_SEARCH_PREF + "region", originalRegion)
+
+    // We can't clear the pref because it's set to false by testing/profiles/prefs_general.js
+    Services.prefs.setBoolPref("browser.search.geoSpecificDefaults", false);
+
+    Services.prefs.getDefaultBranch(BROWSER_SEARCH_PREF).setCharPref(kUrlPref, originalGeoURL);
+  });
+
+  yield asyncReInit();
+  is(gEngineCount, Services.search.getVisibleEngines().length,
+     "correct engine count after cleanup");
+});

--- a/browser/extensions/webcompat-reporter/moz.build
+++ b/browser/extensions/webcompat-reporter/moz.build
@@ -15,8 +15,11 @@ FINAL_TARGET_FILES.features['webcompat-r
 
 FINAL_TARGET_PP_FILES.features['webcompat-reporter@mozilla.org'] += [
   'install.rdf.in'
 ]
 
 JAR_MANIFESTS += ['jar.mn']
 
 BROWSER_CHROME_MANIFESTS += ['test/browser/browser.ini']
+
+with Files('**'):
+    BUG_COMPONENT = ('Web Compatibility', 'General')

--- a/browser/locales/en-US/chrome/browser/browser.properties
+++ b/browser/locales/en-US/chrome/browser/browser.properties
@@ -813,21 +813,16 @@ userContextOpenLink.label = Open Link in
 
 muteTab.label = Mute Tab
 muteTab.accesskey = M
 unmuteTab.label = Unmute Tab
 unmuteTab.accesskey = m
 playTab.label = Play Tab
 playTab.accesskey = l
 
-# LOCALIZATION NOTE (weakCryptoOverriding.message): %S is brandShortName
-weakCryptoOverriding.message = %S recommends that you don’t enter your password, credit card and other personal information on this website.
-revokeOverride.label = Don’t Trust This Website
-revokeOverride.accesskey = D
-
 # LOCALIZATION NOTE (certErrorDetails*.label): These are text strings that
 # appear in the about:certerror page, so that the user can copy and send them to
 # the server administrators for troubleshooting.
 certErrorDetailsHSTS.label = HTTP Strict Transport Security: %S
 certErrorDetailsKeyPinning.label = HTTP Public Key Pinning: %S
 certErrorDetailsCertChain.label = Certificate chain:
 
 # LOCALIZATION NOTE (pendingCrashReports2.label): Semi-colon list of plural forms

--- a/browser/locales/en-US/chrome/overrides/appstrings.properties
+++ b/browser/locales/en-US/chrome/overrides/appstrings.properties
@@ -33,11 +33,9 @@ externalProtocolLaunchBtn=Launch applica
 malwareBlocked=The site at %S has been reported as an attack site and has been blocked based on your security preferences.
 unwantedBlocked=The site at %S has been reported as serving unwanted software and has been blocked based on your security preferences.
 deceptiveBlocked=This web page at %S has been reported as a deceptive site and has been blocked based on your security preferences.
 cspBlocked=This page has a content security policy that prevents it from being loaded in this way.
 corruptedContentErrorv2=The site at %S has experienced a network protocol violation that cannot be repaired.
 remoteXUL=This page uses an unsupported technology that is no longer available by default in Firefox.
 ## LOCALIZATION NOTE (sslv3Used) - Do not translate "%S".
 sslv3Used=Firefox cannot guarantee the safety of your data on %S because it uses SSLv3, a broken security protocol.
-## LOCALIZATION NOTE (weakCryptoUsed) - Do not translate "%S".
-weakCryptoUsed=The owner of %S has configured their website improperly. To protect your information from being stolen, Firefox has not connected to this website.
 inadequateSecurityError=The website tried to negotiate an inadequate level of security.

--- a/browser/locales/en-US/chrome/overrides/netError.dtd
+++ b/browser/locales/en-US/chrome/overrides/netError.dtd
@@ -184,24 +184,16 @@ was trying to connect. -->
 <!ENTITY remoteXUL.title "Remote XUL">
 <!ENTITY remoteXUL.longDesc "<p><ul><li>Please contact the website owners to inform them of this problem.</li></ul></p>">
 
 <!ENTITY sslv3Used.title "Unable to Connect Securely">
 <!-- LOCALIZATION NOTE (sslv3Used.longDesc2) - Do not translate
      "SSL_ERROR_UNSUPPORTED_VERSION". -->
 <!ENTITY sslv3Used.longDesc2 "Advanced info: SSL_ERROR_UNSUPPORTED_VERSION">
 
-<!ENTITY weakCryptoUsed.title "Your connection is not secure">
-<!-- LOCALIZATION NOTE (weakCryptoUsed.longDesc2) - Do not translate
-     "SSL_ERROR_NO_CYPHER_OVERLAP". -->
-<!ENTITY weakCryptoUsed.longDesc2 "Advanced info: SSL_ERROR_NO_CYPHER_OVERLAP">
-<!ENTITY weakCryptoAdvanced.title "Advanced">
-<!ENTITY weakCryptoAdvanced.longDesc "<span class='hostname'></span> uses security technology that is outdated and vulnerable to attack. An attacker could easily reveal information which you thought to be safe.">
-<!ENTITY weakCryptoAdvanced.override "(Not secure) Try loading <span class='hostname'></span> using outdated security">
-
 <!-- LOCALIZATION NOTE (certerror.wrongSystemTime2,
                         certerror.wrongSystemTimeWithoutReference) - The <span id='..' />
      tags will be injected with actual values, please leave them unchanged. -->
 <!ENTITY certerror.wrongSystemTime2 "<p> &brandShortName; did not connect to <span id='wrongSystemTime_URL'/> because your computer’s clock appears to show the wrong time and this is preventing a secure connection.</p> <p>Your computer is set to <span id='wrongSystemTime_systemDate'/>, when it should be <span id='wrongSystemTime_actualDate'/>. To fix this problem, change your date and time settings to match the correct time.</p>">
 <!ENTITY certerror.wrongSystemTimeWithoutReference "<p>&brandShortName; did not connect to <span id='wrongSystemTimeWithoutReference_URL'/> because your computer’s clock appears to show the wrong time and this is preventing a secure connection.</p> <p>Your computer is set to <span id='wrongSystemTimeWithoutReference_systemDate'/>. To fix this problem, change your date and time settings to match the correct time.</p>">
 
 <!ENTITY certerror.pagetitle1  "Insecure Connection">
 <!ENTITY certerror.whatShouldIDo.badStsCertExplanation "This site uses HTTP

--- a/caps/nsScriptSecurityManager.cpp
+++ b/caps/nsScriptSecurityManager.cpp
@@ -727,24 +727,58 @@ nsScriptSecurityManager::CheckLoadURIWit
     if (NS_FAILED(rv)) return rv;
 
     while (currentURI && currentOtherURI) {
         nsAutoCString scheme, otherScheme;
         currentURI->GetScheme(scheme);
         currentOtherURI->GetScheme(otherScheme);
 
         bool schemesMatch = scheme.Equals(otherScheme, stringComparator);
-        bool isSamePage;
+        bool isSamePage = false;
         // about: URIs are special snowflakes.
-        if (scheme.EqualsLiteral("about")) {
-            nsAutoCString module, otherModule;
-            isSamePage = schemesMatch &&
-                NS_SUCCEEDED(NS_GetAboutModuleName(currentURI, module)) &&
-                NS_SUCCEEDED(NS_GetAboutModuleName(currentOtherURI, otherModule)) &&
-                module.Equals(otherModule);
+        if (scheme.EqualsLiteral("about") && schemesMatch) {
+            nsAutoCString moduleName, otherModuleName;
+            // about: pages can always link to themselves:
+            isSamePage =
+              NS_SUCCEEDED(NS_GetAboutModuleName(currentURI, moduleName)) &&
+              NS_SUCCEEDED(NS_GetAboutModuleName(currentOtherURI, otherModuleName)) &&
+              moduleName.Equals(otherModuleName);
+            if (!isSamePage) {
+                // We will have allowed the load earlier if the source page has
+                // system principal. So we know the source has a content
+                // principal, and it's trying to link to something else.
+                // Linkable about: pages are always reachable, even if we hit
+                // the CheckLoadURIFlags call below.
+                // We punch only 1 other hole: iff the source is unlinkable,
+                // we let them link to other pages explicitly marked SAFE
+                // for content. This avoids world-linkable about: pages linking
+                // to non-world-linkable about: pages.
+                nsCOMPtr<nsIAboutModule> module, otherModule;
+                bool knowBothModules =
+                    NS_SUCCEEDED(NS_GetAboutModule(currentURI, getter_AddRefs(module))) &&
+                    NS_SUCCEEDED(NS_GetAboutModule(currentOtherURI, getter_AddRefs(otherModule)));
+                uint32_t aboutModuleFlags = 0;
+                uint32_t otherAboutModuleFlags = 0;
+                knowBothModules = knowBothModules &&
+                    NS_SUCCEEDED(module->GetURIFlags(currentURI, &aboutModuleFlags)) &&
+                    NS_SUCCEEDED(otherModule->GetURIFlags(currentOtherURI, &otherAboutModuleFlags));
+                if (knowBothModules) {
+                    isSamePage =
+                        !(aboutModuleFlags & nsIAboutModule::MAKE_LINKABLE) &&
+                        (otherAboutModuleFlags & nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT);
+                    if (isSamePage && otherAboutModuleFlags & nsIAboutModule::MAKE_LINKABLE) {
+                        //XXXgijs: this is a hack. The target will be nested
+                        // (with innerURI of moz-safe-about:whatever), and
+                        // the source isn't, so we won't pass if we finish
+                        // the loop. We *should* pass, though, so return here.
+                        // This hack can go away when bug 1228118 is fixed.
+                        return NS_OK;
+                    }
+                }
+            }
         } else {
             bool equalExceptRef = false;
             rv = currentURI->EqualsExceptRef(currentOtherURI, &equalExceptRef);
             isSamePage = NS_SUCCEEDED(rv) && equalExceptRef;
         }
 
         // If schemes are not equal, or they're equal but the target URI
         // is different from the source URI and doesn't always allow linking

--- a/caps/tests/mochitest/browser_checkloaduri.js
+++ b/caps/tests/mochitest/browser_checkloaduri.js
@@ -1,11 +1,48 @@
 "use strict";
 
 let ssm = Services.scriptSecurityManager;
+// This will show a directory listing, but we never actually load these so that's OK.
+const kDummyPage = getRootDirectory(gTestPath);
+
+const kAboutPagesRegistered = Promise.all([
+  BrowserTestUtils.registerAboutPage(
+    registerCleanupFunction, "test-chrome-privs", kDummyPage,
+    Ci.nsIAboutModule.ALLOW_SCRIPT),
+  BrowserTestUtils.registerAboutPage(
+    registerCleanupFunction, "test-chrome-privs2", kDummyPage,
+    Ci.nsIAboutModule.ALLOW_SCRIPT),
+  BrowserTestUtils.registerAboutPage(
+    registerCleanupFunction, "test-unknown-linkable", kDummyPage,
+    Ci.nsIAboutModule.MAKE_LINKABLE | Ci.nsIAboutModule.ALLOW_SCRIPT),
+  BrowserTestUtils.registerAboutPage(
+    registerCleanupFunction, "test-unknown-linkable2", kDummyPage,
+    Ci.nsIAboutModule.MAKE_LINKABLE | Ci.nsIAboutModule.ALLOW_SCRIPT),
+  BrowserTestUtils.registerAboutPage(
+    registerCleanupFunction, "test-unknown-unlinkable", kDummyPage,
+    Ci.nsIAboutModule.ALLOW_SCRIPT),
+  BrowserTestUtils.registerAboutPage(
+    registerCleanupFunction, "test-unknown-unlinkable2", kDummyPage,
+    Ci.nsIAboutModule.ALLOW_SCRIPT),
+  BrowserTestUtils.registerAboutPage(
+    registerCleanupFunction, "test-content-unlinkable", kDummyPage,
+    Ci.nsIAboutModule.URI_SAFE_FOR_UNTRUSTED_CONTENT | Ci.nsIAboutModule.ALLOW_SCRIPT),
+  BrowserTestUtils.registerAboutPage(
+    registerCleanupFunction, "test-content-unlinkable2", kDummyPage,
+    Ci.nsIAboutModule.URI_SAFE_FOR_UNTRUSTED_CONTENT | Ci.nsIAboutModule.ALLOW_SCRIPT),
+  BrowserTestUtils.registerAboutPage(
+    registerCleanupFunction, "test-content-linkable", kDummyPage,
+    Ci.nsIAboutModule.URI_SAFE_FOR_UNTRUSTED_CONTENT | Ci.nsIAboutModule.MAKE_LINKABLE |
+    Ci.nsIAboutModule.ALLOW_SCRIPT),
+  BrowserTestUtils.registerAboutPage(
+    registerCleanupFunction, "test-content-linkable2", kDummyPage,
+    Ci.nsIAboutModule.URI_SAFE_FOR_UNTRUSTED_CONTENT | Ci.nsIAboutModule.MAKE_LINKABLE |
+    Ci.nsIAboutModule.ALLOW_SCRIPT),
+]);
 
 const URLs = new Map([
   ["http://www.example.com", [
   // For each of these entries, the booleans represent whether the parent URI can:
   // - load them
   // - load them without principal inheritance
   // - whether the URI can be created at all (some protocol handlers will
   //   refuse to create certain variants)
@@ -17,65 +54,171 @@ const URLs = new Map([
     ["view-source:http://www.example2.com", false, false, true],
     ["view-source:https://www.example2.com", false, false, true],
     ["view-source:feed:http://www.example2.com", false, false, true],
     ["feed:view-source:http://www.example2.com", false, false, false],
     ["data:text/html,Hi", true, false, true],
     ["view-source:data:text/html,Hi", false, false, true],
     ["javascript:alert('hi')", true, false, true],
     ["moz://a", false, false, true],
+    ["about:test-chrome-privs", false, false, true],
+    ["about:test-unknown-unlinkable", false, false, true],
+    ["about:test-content-unlinkable", false, false, true],
+    ["about:test-content-linkable", true, true, true],
+    // Because this page doesn't have SAFE_FOR_UNTRUSTED, the web can't link to it:
+    ["about:test-unknown-linkable", false, false, true],
   ]],
   ["feed:http://www.example.com", [
     ["http://www.example2.com", true, true, true],
     ["feed:http://www.example2.com", true, true, true],
     ["https://www.example2.com", true, true, true],
     ["feed:https://www.example2.com", true, true, true],
     ["chrome://foo/content/bar.xul", false, false, true],
     ["feed:chrome://foo/content/bar.xul", false, false, false],
     ["view-source:http://www.example2.com", false, false, true],
     ["view-source:https://www.example2.com", false, false, true],
     ["view-source:feed:http://www.example2.com", false, false, true],
     ["feed:view-source:http://www.example2.com", false, false, false],
     ["data:text/html,Hi", true, false, true],
     ["view-source:data:text/html,Hi", false, false, true],
     ["javascript:alert('hi')", true, false, true],
     ["moz://a", false, false, true],
+    ["about:test-chrome-privs", false, false, true],
+    ["about:test-unknown-unlinkable", false, false, true],
+    ["about:test-content-unlinkable", false, false, true],
+    ["about:test-content-linkable", true, true, true],
+    // Because this page doesn't have SAFE_FOR_UNTRUSTED, the web can't link to it:
+    ["about:test-unknown-linkable", false, false, true],
   ]],
   ["view-source:http://www.example.com", [
     ["http://www.example2.com", true, true, true],
     ["feed:http://www.example2.com", false, false, true],
     ["https://www.example2.com", true, true, true],
     ["feed:https://www.example2.com", false, false, true],
     ["chrome://foo/content/bar.xul", false, false, true],
     ["feed:chrome://foo/content/bar.xul", false, false, false],
     ["view-source:http://www.example2.com", true, true, true],
     ["view-source:https://www.example2.com", true, true, true],
     ["view-source:feed:http://www.example2.com", false, false, true],
     ["feed:view-source:http://www.example2.com", false, false, false],
     ["data:text/html,Hi", true, false, true],
     ["view-source:data:text/html,Hi", true, false, true],
     ["javascript:alert('hi')", true, false, true],
     ["moz://a", false, false, true],
+    ["about:test-chrome-privs", false, false, true],
+    ["about:test-unknown-unlinkable", false, false, true],
+    ["about:test-content-unlinkable", false, false, true],
+    ["about:test-content-linkable", true, true, true],
+    // Because this page doesn't have SAFE_FOR_UNTRUSTED, the web can't link to it:
+    ["about:test-unknown-linkable", false, false, true],
   ]],
-  ["about:foo", [
-    ["about:foo?", true, true, true],
-    ["about:foo?bar", true, true, true],
-    ["about:foo#", true, true, true],
-    ["about:foo#bar", true, true, true],
-    ["about:foo?#", true, true, true],
-    ["about:foo?bar#baz", true, true, true],
-    ["about:bar", false, false, true],
-    ["about:bar?foo#baz", false, false, true],
-    ["about:bar?foo", false, false, true],
-    ["http://www.example.com/", true, true, true],
-    ["moz://a", false, false, true],
+  // about: related tests.
+  ["about:test-chrome-privs", [
+    ["about:test-chrome-privs", true, true, true],
+    ["about:test-chrome-privs2", true, true, true],
+    ["about:test-chrome-privs2?foo#bar", true, true, true],
+    ["about:test-chrome-privs2?foo", true, true, true],
+    ["about:test-chrome-privs2#bar", true, true, true],
+
+    ["about:test-unknown-unlinkable", true, true, true],
+
+    ["about:test-content-unlinkable", true, true, true],
+    ["about:test-content-unlinkable?foo", true, true, true],
+    ["about:test-content-unlinkable?foo#bar", true, true, true],
+    ["about:test-content-unlinkable#bar", true, true, true],
+
+    ["about:test-content-linkable", true, true, true],
+
+    ["about:test-unknown-linkable", true, true, true],
+  ]],
+  ["about:test-unknown-unlinkable", [
+    ["about:test-chrome-privs", false, false, true],
+
+    // Can link to ourselves:
+    ["about:test-unknown-unlinkable", true, true, true],
+    // Can't link to unlinkable content if we're not sure it's privileged:
+    ["about:test-unknown-unlinkable2", false, false, true],
+
+    ["about:test-content-unlinkable", true, true, true],
+    ["about:test-content-unlinkable2", true, true, true],
+    ["about:test-content-unlinkable2?foo", true, true, true],
+    ["about:test-content-unlinkable2?foo#bar", true, true, true],
+    ["about:test-content-unlinkable2#bar", true, true, true],
+
+    ["about:test-content-linkable", true, true, true],
+
+    // Because this page doesn't have SAFE_FOR_UNTRUSTED, the web can't link to it:
+    ["about:test-unknown-linkable", false, false, true],
+  ]],
+  ["about:test-content-unlinkable", [
+    ["about:test-chrome-privs", false, false, true],
+
+    // Can't link to unlinkable content if we're not sure it's privileged:
+    ["about:test-unknown-unlinkable", false, false, true],
+
+    ["about:test-content-unlinkable", true, true, true],
+    ["about:test-content-unlinkable2", true, true, true],
+    ["about:test-content-unlinkable2?foo", true, true, true],
+    ["about:test-content-unlinkable2?foo#bar", true, true, true],
+    ["about:test-content-unlinkable2#bar", true, true, true],
+
+    ["about:test-content-linkable", true, true, true],
+    ["about:test-unknown-linkable", false, false, true],
+  ]],
+  ["about:test-unknown-linkable", [
+    ["about:test-chrome-privs", false, false, true],
+
+    // Linkable content can't link to unlinkable content.
+    ["about:test-unknown-unlinkable", false, false, true],
+
+    ["about:test-content-unlinkable", false, false, true],
+    ["about:test-content-unlinkable2", false, false, true],
+    ["about:test-content-unlinkable2?foo", false, false, true],
+    ["about:test-content-unlinkable2?foo#bar", false, false, true],
+    ["about:test-content-unlinkable2#bar", false, false, true],
+
+    // ... but it can link to other linkable content.
+    ["about:test-content-linkable", true, true, true],
+
+    // Can link to ourselves:
+    ["about:test-unknown-linkable", true, true, true],
+
+    // Because this page doesn't have SAFE_FOR_UNTRUSTED, the web can't link to it:
+    ["about:test-unknown-linkable2", false, false, true],
+  ]],
+  ["about:test-content-linkable", [
+    ["about:test-chrome-privs", false, false, true],
+
+    // Linkable content can't link to unlinkable content.
+    ["about:test-unknown-unlinkable", false, false, true],
+
+    ["about:test-content-unlinkable", false, false, true],
+
+    // ... but it can link to itself and other linkable content.
+    ["about:test-content-linkable", true, true, true],
+    ["about:test-content-linkable2", true, true, true],
+
+    // Because this page doesn't have SAFE_FOR_UNTRUSTED, the web can't link to it:
+    ["about:test-unknown-linkable", false, false, true],
   ]],
 ]);
 
 function testURL(source, target, canLoad, canLoadWithoutInherit, canCreate, flags) {
+  function getPrincipalDesc(principal) {
+    if (principal.URI) {
+      return principal.URI.spec;
+    }
+    if (principal.isSystemPrincipal) {
+      return "system principal";
+    }
+    if (principal.isNullPrincipal) {
+      return "null principal";
+    }
+    return "unknown principal";
+  }
   let threw = false;
   let targetURI;
   try {
     targetURI = makeURI(target);
   } catch (ex) {
     ok(!canCreate, "Shouldn't be passing URIs that we can't create. Failed to create: " + target);
     return;
   }
@@ -86,24 +229,30 @@ function testURL(source, target, canLoad
   } catch (ex) {
     info(ex.message);
     threw = true;
   }
   let inheritDisallowed = flags & ssm.DISALLOW_INHERIT_PRINCIPAL;
   let shouldThrow = inheritDisallowed ? !canLoadWithoutInherit : !canLoad;
   ok(threw == shouldThrow,
      "Should " + (shouldThrow ? "" : "not ") + "throw an error when loading " +
-     target + " from " + source.URI.spec +
+     target + " from " + getPrincipalDesc(source) +
      (inheritDisallowed ? " without" : " with") + " principal inheritance.");
 }
 
 add_task(function* () {
+  yield kAboutPagesRegistered;
   let baseFlags = ssm.STANDARD | ssm.DONT_REPORT_ERRORS;
   for (let [sourceString, targetsAndExpectations] of URLs) {
-    let source = ssm.createCodebasePrincipal(makeURI(sourceString), {});
+    let source;
+    if (sourceString.startsWith("about:test-chrome-privs")) {
+      source = ssm.getSystemPrincipal();
+    } else {
+      source = ssm.createCodebasePrincipal(makeURI(sourceString), {});
+    }
     for (let [target, canLoad, canLoadWithoutInherit, canCreate] of targetsAndExpectations) {
       testURL(source, target, canLoad, canLoadWithoutInherit, canCreate, baseFlags);
       testURL(source, target, canLoad, canLoadWithoutInherit, canCreate,
               baseFlags | ssm.DISALLOW_INHERIT_PRINCIPAL);
     }
   }
 
   // Now test blob URIs, which we need to do in-content.

--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -14249,29 +14249,27 @@ nsDocShell::ShouldBlockLoadingForBackBut
   bool canGoForward = false;
   GetCanGoForward(&canGoForward);
   return canGoForward;
 }
 
 bool
 nsDocShell::PluginsAllowedInCurrentDoc()
 {
-  bool pluginsAllowed = false;
 
   if (!mContentViewer) {
     return false;
   }
 
   nsIDocument* doc = mContentViewer->GetDocument();
   if (!doc) {
     return false;
   }
 
-  doc->GetAllowPlugins(&pluginsAllowed);
-  return pluginsAllowed;
+  return doc->GetAllowPlugins();
 }
 
 //----------------------------------------------------------------------
 // Web Shell Services API
 
 // This functions is only called when a new charset is detected in loading a
 // document. Its name should be changed to "CharsetReloadDocument"
 NS_IMETHODIMP

--- a/dom/animation/ComputedTimingFunction.cpp
+++ b/dom/animation/ComputedTimingFunction.cpp
@@ -23,43 +23,48 @@ ComputedTimingFunction::Init(const nsTim
 }
 
 static inline double
 StepTiming(uint32_t aSteps,
            double aPortion,
            ComputedTimingFunction::BeforeFlag aBeforeFlag,
            nsTimingFunction::Type aType)
 {
-  MOZ_ASSERT(0.0 <= aPortion && aPortion <= 1.0, "out of range");
   MOZ_ASSERT(aType == nsTimingFunction::Type::StepStart ||
              aType == nsTimingFunction::Type::StepEnd, "invalid type");
 
-  if (aPortion == 1.0) {
-    return 1.0;
-  }
-
   // Calculate current step using step-end behavior
-  uint32_t step = uint32_t(aPortion * aSteps); // floor
+  int32_t step = floor(aPortion * aSteps);
 
   // step-start is one step ahead
   if (aType == nsTimingFunction::Type::StepStart) {
     step++;
   }
 
   // If the "before flag" is set and we are at a transition point,
-  // drop back a step (but only if we are not already at the zero point--
-  // we do this clamping here since |step| is an unsigned integer)
-  if (step != 0 &&
-      aBeforeFlag == ComputedTimingFunction::BeforeFlag::Set &&
+  // drop back a step
+  if (aBeforeFlag == ComputedTimingFunction::BeforeFlag::Set &&
       fmod(aPortion * aSteps, 1) == 0) {
     step--;
   }
 
   // Convert to a progress value
-  return double(step) / double(aSteps);
+  double result = double(step) / double(aSteps);
+
+  // We should not produce a result outside [0, 1] unless we have an
+  // input outside that range. This takes care of steps that would otherwise
+  // occur at boundaries.
+  if (result < 0.0 && aPortion >= 0.0) {
+    return 0.0;
+  }
+  if (result > 1.0 && aPortion <= 1.0) {
+    return 1.0;
+  }
+
+  return result;
 }
 
 double
 ComputedTimingFunction::GetValue(
     double aPortion,
     ComputedTimingFunction::BeforeFlag aBeforeFlag) const
 {
   if (HasSpline()) {
@@ -103,28 +108,16 @@ ComputedTimingFunction::GetValue(
       }
       // If we can't calculate a sensible tangent, don't extrapolate at all.
       return 1.0;
     }
 
     return mTimingFunction.GetSplineValue(aPortion);
   }
 
-  // Since we use endpoint-exclusive timing, the output of a steps(start) timing
-  // function when aPortion = 0.0 is the top of the first step. When aPortion is
-  // negative, however, we should use the bottom of the first step. We handle
-  // negative values of aPortion specially here since once we clamp aPortion
-  // to [0,1] below we will no longer be able to distinguish to the two cases.
-  if (aPortion < 0.0) {
-    return 0.0;
-  }
-
-  // Clamp in case of steps(end) and steps(start) for values greater than 1.
-  aPortion = clamped(aPortion, 0.0, 1.0);
-
   return StepTiming(mSteps, aPortion, aBeforeFlag, mType);
 }
 
 int32_t
 ComputedTimingFunction::Compare(const ComputedTimingFunction& aRhs) const
 {
   if (mType != aRhs.mType) {
     return int32_t(mType) - int32_t(aRhs.mType);

--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -3139,37 +3139,42 @@ nsDocument::GetContentType(nsAString& aC
 }
 
 void
 nsDocument::SetContentType(const nsAString& aContentType)
 {
   SetContentTypeInternal(NS_ConvertUTF16toUTF8(aContentType));
 }
 
-nsresult
-nsDocument::GetAllowPlugins(bool * aAllowPlugins)
+bool
+nsDocument::GetAllowPlugins()
 {
   // First, we ask our docshell if it allows plugins.
   nsCOMPtr<nsIDocShell> docShell(mDocumentContainer);
 
   if (docShell) {
-    docShell->GetAllowPlugins(aAllowPlugins);
+    bool allowPlugins = false;
+    docShell->GetAllowPlugins(&allowPlugins);
+    if (!allowPlugins) {
+      return false;
+    }
 
     // If the docshell allows plugins, we check whether
     // we are sandboxed and plugins should not be allowed.
-    if (*aAllowPlugins)
-      *aAllowPlugins = !(mSandboxFlags & SANDBOXED_PLUGINS);
-  }
-
-  if (*aAllowPlugins) {
-    FlashClassification classification = DocumentFlashClassification();
-    *aAllowPlugins = (classification != FlashClassification::Denied);
-  }
-
-  return NS_OK;
+    if (mSandboxFlags & SANDBOXED_PLUGINS) {
+      return false;
+    }
+  }
+
+  FlashClassification classification = DocumentFlashClassification();
+  if (classification == FlashClassification::Denied) {
+    return false;
+  }
+
+  return true;
 }
 
 bool
 nsDocument::IsElementAnimateEnabled(JSContext* aCx, JSObject* /*unused*/)
 {
   MOZ_ASSERT(NS_IsMainThread());
 
   return nsContentUtils::IsSystemCaller(aCx) ||
@@ -13136,16 +13141,19 @@ nsDocument::ComputeFlashClassification()
              "nsIDocShellTreeItem::GetSameTypeParent should never fail");
 
   bool isTopLevel = !parent;
   FlashClassification classification;
   if (isTopLevel) {
     classification = PrincipalFlashClassification(isTopLevel);
   } else {
     nsCOMPtr<nsIDocument> parentDocument = GetParentDocument();
+    if (!parentDocument) {
+      return FlashClassification::Denied;
+    }
     FlashClassification parentClassification =
       parentDocument->DocumentFlashClassification();
 
     if (parentClassification == FlashClassification::Denied) {
       classification = FlashClassification::Denied;
     } else {
       classification = PrincipalFlashClassification(isTopLevel);
 

--- a/dom/base/nsDocument.h
+++ b/dom/base/nsDocument.h
@@ -594,17 +594,17 @@ public:
    * shared among multiple presentation shells).
    */
   already_AddRefed<nsIPresShell> CreateShell(nsPresContext* aContext,
                                              nsViewManager* aViewManager,
                                              mozilla::StyleSetHandle aStyleSet)
     final;
   virtual void DeleteShell() override;
 
-  virtual nsresult GetAllowPlugins(bool* aAllowPlugins) override;
+  virtual bool GetAllowPlugins() override;
 
   static bool IsElementAnimateEnabled(JSContext* aCx, JSObject* aObject);
   static bool IsWebAnimationsEnabled(JSContext* aCx, JSObject* aObject);
   virtual mozilla::dom::DocumentTimeline* Timeline() override;
   virtual void GetAnimations(
       nsTArray<RefPtr<mozilla::dom::Animation>>& aAnimations) override;
   mozilla::LinkedList<mozilla::dom::DocumentTimeline>& Timelines() override
   {

--- a/dom/base/nsIDocument.h
+++ b/dom/base/nsIDocument.h
@@ -876,17 +876,17 @@ public:
   void SetParentDocument(nsIDocument* aParent)
   {
     mParentDocument = aParent;
   }
 
   /**
    * Are plugins allowed in this document ?
    */
-  virtual nsresult GetAllowPlugins (bool* aAllowPlugins) = 0;
+  virtual bool GetAllowPlugins () = 0;
 
   /**
    * Set the sub document for aContent to aSubDoc.
    */
   virtual nsresult SetSubDocumentFor(Element* aContent,
                                      nsIDocument* aSubDoc) = 0;
 
   /**

--- a/dom/base/nsPluginArray.cpp
+++ b/dom/base/nsPluginArray.cpp
@@ -306,19 +306,25 @@ nsPluginArray::Observe(nsISupports *aSub
   }
 
   return NS_OK;
 }
 
 bool
 nsPluginArray::AllowPlugins() const
 {
-  nsCOMPtr<nsIDocShell> docShell = mWindow ? mWindow->GetDocShell() : nullptr;
+  if (!mWindow) {
+    return false;
+  }
+  nsCOMPtr<nsIDocument> doc = mWindow->GetDoc();
+  if (!doc) {
+    return false;
+  }
 
-  return docShell && docShell->PluginsAllowedInCurrentDoc();
+  return doc->GetAllowPlugins();
 }
 
 static bool
 operator<(const RefPtr<nsPluginElement>& lhs,
           const RefPtr<nsPluginElement>& rhs)
 {
   // Sort plugins alphabetically by name.
   return lhs->PluginTag()->Name() < rhs->PluginTag()->Name();

--- a/dom/base/test/file_use_counter_svg_currentScale.svg
+++ b/dom/base/test/file_use_counter_svg_currentScale.svg
@@ -1,12 +1,9 @@
 <?xml version="1.0" standalone="no"?>
-
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
-  "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
 <svg width="4in" height="3in" version="1.1"
      xmlns="http://www.w3.org/2000/svg"
      xmlns:xlink="http://www.w3.org/1999/xlink">
   <desc>Test graphic for hitting currentScale
   </desc>
   <script type="text/javascript"> <![CDATA[
     document.documentElement.currentScale = document.documentElement.currentScale;
     ]]>

--- a/dom/base/test/file_use_counter_svg_fill_pattern.svg
+++ b/dom/base/test/file_use_counter_svg_fill_pattern.svg
@@ -1,11 +1,9 @@
 <?xml version="1.0" standalone="no"?>
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" 
-  "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
 <svg width="8cm" height="4cm" viewBox="0 0 800 400" version="1.1"
      xmlns="http://www.w3.org/2000/svg">
   <desc>Borrowed from http://www.w3.org/TR/SVG/pservers.html</desc>
   <!-- Outline the drawing area in blue -->
   <rect fill="none" stroke="blue" 
         x="1" y="1" width="798" height="398"/>
 
   <!-- The ellipse is filled using a triangle pattern paint server

--- a/dom/base/test/file_use_counter_svg_fill_pattern_data.svg
+++ b/dom/base/test/file_use_counter_svg_fill_pattern_data.svg
@@ -1,11 +1,9 @@
 <?xml version="1.0" standalone="no"?>
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" 
-  "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
 <svg width="8cm" height="4cm" viewBox="0 0 800 400" version="1.1"
      xmlns="http://www.w3.org/2000/svg">
   <desc>Borrowed from http://www.w3.org/TR/SVG/pservers.html</desc>
   <!-- Outline the drawing area in blue -->
   <rect fill="none" stroke="blue" 
         x="1" y="1" width="798" height="398"/>
 
   <!-- The ellipse is filled using a triangle pattern paint server

--- a/dom/base/test/file_use_counter_svg_fill_pattern_definition.svg
+++ b/dom/base/test/file_use_counter_svg_fill_pattern_definition.svg
@@ -1,11 +1,9 @@
 <?xml version="1.0" standalone="no"?>
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" 
-  "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
 <svg width="8cm" height="4cm" viewBox="0 0 800 400" version="1.1"
      xmlns="http://www.w3.org/2000/svg">
   <desc>Borrowed from http://www.w3.org/TR/SVG/pservers.html</desc>
   <defs>
     <pattern id="TrianglePattern" patternUnits="userSpaceOnUse"
              x="0" y="0" width="100" height="100"
              viewBox="0 0 10 10" >
       <path d="M 0 0 L 7 0 L 3.5 7 z" fill="red" fill-opacity="0.7" stroke="blue" />

--- a/dom/base/test/file_use_counter_svg_fill_pattern_internal.svg
+++ b/dom/base/test/file_use_counter_svg_fill_pattern_internal.svg
@@ -1,11 +1,9 @@
 <?xml version="1.0" standalone="no"?>
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" 
-  "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
 <svg width="8cm" height="4cm" viewBox="0 0 800 400" version="1.1"
      xmlns="http://www.w3.org/2000/svg">
   <desc>Borrowed from http://www.w3.org/TR/SVG/pservers.html</desc>
   <!-- Outline the drawing area in blue -->
   <rect fill="none" stroke="blue" 
         x="1" y="1" width="798" height="398"/>
 
   <defs>

--- a/dom/base/test/file_use_counter_svg_getElementById.svg
+++ b/dom/base/test/file_use_counter_svg_getElementById.svg
@@ -1,12 +1,9 @@
 <?xml version="1.0" standalone="no"?>
-
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
-  "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
 <svg width="4in" height="3in" version="1.1"
      xmlns="http://www.w3.org/2000/svg"
      xmlns:xlink="http://www.w3.org/1999/xlink">
   <desc>Test graphic for hitting getElementById
   </desc>
   <image id="i1" x="200" y="200" width="100px" height="80px">
   </image>
   <circle cx="100" cy="50" r="40" stroke="black" stroke-width="2" fill="red"/>

--- a/dom/base/test/w3element_traversal.svg
+++ b/dom/base/test/w3element_traversal.svg
@@ -1,9 +1,9 @@
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"  "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"
+<!DOCTYPE svg
 [
 <!ENTITY tree "<tspan id='first_element_child_entity'></tspan>">
 ]>
 
 <svg xmlns="http://www.w3.org/2000/svg"
      xmlns:xlink="http://www.w3.org/1999/xlink"
      xmlns:pickle="http://ns.example.org/pickle"
      version="1.1"

--- a/dom/html/HTMLMediaElement.cpp
+++ b/dom/html/HTMLMediaElement.cpp
@@ -7126,64 +7126,110 @@ HTMLMediaElement::MarkAsContentSource(Ca
   const bool isVisible = mVisibilityState != Visibility::APPROXIMATELY_NONVISIBLE;
 
   if (isVisible) {
     // 0 = ALL_VISIBLE
     Telemetry::Accumulate(Telemetry::VIDEO_AS_CONTENT_SOURCE, 0);
   } else {
     // 1 = ALL_INVISIBLE
     Telemetry::Accumulate(Telemetry::VIDEO_AS_CONTENT_SOURCE, 1);
+
+    if (IsInUncomposedDoc()) {
+      // 0 = ALL_IN_TREE
+      Telemetry::Accumulate(Telemetry::VIDEO_AS_CONTENT_SOURCE_IN_TREE_OR_NOT, 0);
+    } else {
+      // 1 = ALL_NOT_IN_TREE
+      Telemetry::Accumulate(Telemetry::VIDEO_AS_CONTENT_SOURCE_IN_TREE_OR_NOT, 1);
+    }
   }
 
   switch (aAPI) {
     case CallerAPI::DRAW_IMAGE: {
       if (isVisible) {
         // 2 = drawImage_VISIBLE
         Telemetry::Accumulate(Telemetry::VIDEO_AS_CONTENT_SOURCE, 2);
       } else {
         // 3 = drawImage_INVISIBLE
         Telemetry::Accumulate(Telemetry::VIDEO_AS_CONTENT_SOURCE, 3);
+
+        if (IsInUncomposedDoc()) {
+          // 2 = drawImage_IN_TREE
+          Telemetry::Accumulate(Telemetry::VIDEO_AS_CONTENT_SOURCE_IN_TREE_OR_NOT, 2);
+        } else {
+          // 3 = drawImage_NOT_IN_TREE
+          Telemetry::Accumulate(Telemetry::VIDEO_AS_CONTENT_SOURCE_IN_TREE_OR_NOT, 3);
+        }
       }
       break;
     }
     case CallerAPI::CREATE_PATTERN: {
       if (isVisible) {
         // 4 = createPattern_VISIBLE
         Telemetry::Accumulate(Telemetry::VIDEO_AS_CONTENT_SOURCE, 4);
       } else {
         // 5 = createPattern_INVISIBLE
         Telemetry::Accumulate(Telemetry::VIDEO_AS_CONTENT_SOURCE, 5);
+
+        if (IsInUncomposedDoc()) {
+          // 4 = createPattern_IN_TREE
+          Telemetry::Accumulate(Telemetry::VIDEO_AS_CONTENT_SOURCE_IN_TREE_OR_NOT, 4);
+        } else {
+          // 5 = createPattern_NOT_IN_TREE
+          Telemetry::Accumulate(Telemetry::VIDEO_AS_CONTENT_SOURCE_IN_TREE_OR_NOT, 5);
+        }
       }
       break;
     }
     case CallerAPI::CREATE_IMAGEBITMAP: {
       if (isVisible) {
         // 6 = createImageBitmap_VISIBLE
         Telemetry::Accumulate(Telemetry::VIDEO_AS_CONTENT_SOURCE, 6);
       } else {
         // 7 = createImageBitmap_INVISIBLE
         Telemetry::Accumulate(Telemetry::VIDEO_AS_CONTENT_SOURCE, 7);
+
+        if (IsInUncomposedDoc()) {
+          // 6 = createImageBitmap_IN_TREE
+          Telemetry::Accumulate(Telemetry::VIDEO_AS_CONTENT_SOURCE_IN_TREE_OR_NOT, 6);
+        } else {
+          // 7 = createImageBitmap_NOT_IN_TREE
+          Telemetry::Accumulate(Telemetry::VIDEO_AS_CONTENT_SOURCE_IN_TREE_OR_NOT, 7);
+        }
       }
       break;
     }
     case CallerAPI::CAPTURE_STREAM: {
       if (isVisible) {
         // 8 = captureStream_VISIBLE
         Telemetry::Accumulate(Telemetry::VIDEO_AS_CONTENT_SOURCE, 8);
       } else {
         // 9 = captureStream_INVISIBLE
         Telemetry::Accumulate(Telemetry::VIDEO_AS_CONTENT_SOURCE, 9);
+
+        if (IsInUncomposedDoc()) {
+          // 8 = captureStream_IN_TREE
+          Telemetry::Accumulate(Telemetry::VIDEO_AS_CONTENT_SOURCE_IN_TREE_OR_NOT, 8);
+        } else {
+          // 9 = captureStream_NOT_IN_TREE
+          Telemetry::Accumulate(Telemetry::VIDEO_AS_CONTENT_SOURCE_IN_TREE_OR_NOT, 9);
+        }
       }
       break;
     }
   }
 
   LOG(LogLevel::Debug,
       ("%p Log VIDEO_AS_CONTENT_SOURCE: visibility = %u, API: '%d' and 'All'",
        this, isVisible, aAPI));
+
+  if (!isVisible) {
+    LOG(LogLevel::Debug,
+        ("%p Log VIDEO_AS_CONTENT_SOURCE_IN_TREE_OR_NOT: inTree = %u, API: '%d' and 'All'",
+         this, IsInUncomposedDoc(), aAPI));
+  }
 }
 
 void
 HTMLMediaElement::UpdateCustomPolicyAfterPlayed()
 {
   OpenUnsupportedMediaWithExternalAppIfNeeded();
   if (mAudioChannelWrapper) {
     mAudioChannelWrapper->NotifyPlayStateChanged();

--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -183,16 +183,17 @@
 #include "nsHostObjectProtocolHandler.h"
 #include "nsICaptivePortalService.h"
 
 #include "nsIBidiKeyboard.h"
 
 #include "nsLayoutStylesheetCache.h"
 
 #include "ContentPrefs.h"
+#include "mozilla/Sprintf.h"
 
 #ifdef MOZ_WEBRTC
 #include "signaling/src/peerconnection/WebrtcGlobalParent.h"
 #endif
 
 #if defined(ANDROID) || defined(LINUX)
 #include "nsSystemInfo.h"
 #endif

--- a/dom/media/WebVTTListener.cpp
+++ b/dom/media/WebVTTListener.cpp
@@ -6,16 +6,17 @@
 #include "WebVTTListener.h"
 #include "mozilla/dom/TextTrackCue.h"
 #include "mozilla/dom/TextTrackRegion.h"
 #include "mozilla/dom/VTTRegionBinding.h"
 #include "mozilla/dom/HTMLTrackElement.h"
 #include "nsIInputStream.h"
 #include "nsIWebVTTParserWrapper.h"
 #include "nsComponentManagerUtils.h"
+#include "nsIAsyncVerifyRedirectCallback.h"
 
 namespace mozilla {
 namespace dom {
 
 NS_IMPL_CYCLE_COLLECTION(WebVTTListener, mElement, mParserWrapper)
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(WebVTTListener)
   NS_INTERFACE_MAP_ENTRY(nsIWebVTTListener)
@@ -72,16 +73,17 @@ NS_IMETHODIMP
 WebVTTListener::AsyncOnChannelRedirect(nsIChannel* aOldChannel,
                                        nsIChannel* aNewChannel,
                                        uint32_t aFlags,
                                        nsIAsyncVerifyRedirectCallback* cb)
 {
   if (mElement) {
     mElement->OnChannelRedirect(aOldChannel, aNewChannel, aFlags);
   }
+  cb->OnRedirectVerifyCallback(NS_OK);
   return NS_OK;
 }
 
 NS_IMETHODIMP
 WebVTTListener::OnStartRequest(nsIRequest* aRequest,
                                nsISupports* aContext)
 {
   VTT_LOG("WebVTTListener::OnStartRequest\n");

--- a/dom/xslt/xslt/txXPathResultComparator.cpp
+++ b/dom/xslt/xslt/txXPathResultComparator.cpp
@@ -4,18 +4,16 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "mozilla/FloatingPoint.h"
 
 #include "txXPathResultComparator.h"
 #include "txExpr.h"
 #include "txCore.h"
 #include "nsCollationCID.h"
-#include "nsILocale.h"
-#include "nsILocaleService.h"
 #include "nsIServiceManager.h"
 #include "prmem.h"
 
 #define kAscending (1<<0)
 #define kUpperFirst (1<<1)
 
 txResultStringComparator::txResultStringComparator(bool aAscending,
                                                    bool aUpperFirst,
@@ -30,35 +28,26 @@ txResultStringComparator::txResultString
     if (NS_FAILED(rv))
         NS_ERROR("Failed to initialize txResultStringComparator");
 }
 
 nsresult txResultStringComparator::init(const nsAFlatString& aLanguage)
 {
     nsresult rv;
 
-    nsCOMPtr<nsILocaleService> localeService =
-                    do_GetService(NS_LOCALESERVICE_CONTRACTID, &rv);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    nsCOMPtr<nsILocale> locale;
-    if (!aLanguage.IsEmpty()) {
-        rv = localeService->NewLocale(aLanguage,
-                                      getter_AddRefs(locale));
-    }
-    else {
-        rv = localeService->GetApplicationLocale(getter_AddRefs(locale));
-    }
-    NS_ENSURE_SUCCESS(rv, rv);
-
     nsCOMPtr<nsICollationFactory> colFactory =
                     do_CreateInstance(NS_COLLATIONFACTORY_CONTRACTID, &rv);
     NS_ENSURE_SUCCESS(rv, rv);
 
-    rv = colFactory->CreateCollation(locale, getter_AddRefs(mCollation));
+    if (aLanguage.IsEmpty()) {
+      rv = colFactory->CreateCollation(getter_AddRefs(mCollation));
+    } else {
+      rv = colFactory->CreateCollationForLocale(NS_ConvertUTF16toUTF8(aLanguage), getter_AddRefs(mCollation));
+    }
+
     NS_ENSURE_SUCCESS(rv, rv);
 
     return NS_OK;
 }
 
 nsresult
 txResultStringComparator::createSortableValue(Expr *aExpr,
                                               txIEvalContext *aContext,

--- a/dom/xul/templates/nsXULContentUtils.cpp
+++ b/dom/xul/templates/nsXULContentUtils.cpp
@@ -47,18 +47,16 @@
 #include "nsGkAtoms.h"
 #include "mozilla/Logging.h"
 #include "prtime.h"
 #include "rdf.h"
 #include "nsContentUtils.h"
 #include "nsIScriptableDateFormat.h"
 #include "nsICollation.h"
 #include "nsCollationCID.h"
-#include "nsILocale.h"
-#include "nsILocaleService.h"
 #include "nsIConsoleService.h"
 #include "nsEscape.h"
 
 using namespace mozilla;
 
 //------------------------------------------------------------------------
 
 nsIRDFService* nsXULContentUtils::gRDF;
@@ -120,37 +118,24 @@ nsXULContentUtils::Finish()
 
     return NS_OK;
 }
 
 nsICollation*
 nsXULContentUtils::GetCollation()
 {
     if (!gCollation) {
-        nsresult rv;
-
-        // get a locale service 
-        nsCOMPtr<nsILocaleService> localeService =
-            do_GetService(NS_LOCALESERVICE_CONTRACTID, &rv);
-        if (NS_SUCCEEDED(rv)) {
-            nsCOMPtr<nsILocale> locale;
-            rv = localeService->GetApplicationLocale(getter_AddRefs(locale));
-            if (NS_SUCCEEDED(rv) && locale) {
-                nsCOMPtr<nsICollationFactory> colFactory =
-                    do_CreateInstance(NS_COLLATIONFACTORY_CONTRACTID);
-                if (colFactory) {
-                    rv = colFactory->CreateCollation(locale, &gCollation);
-                    NS_ASSERTION(NS_SUCCEEDED(rv),
-                                 "couldn't create collation instance");
-                } else
-                    NS_ERROR("couldn't create instance of collation factory");
-            } else
-                NS_ERROR("unable to get application locale");
+        nsCOMPtr<nsICollationFactory> colFactory =
+            do_CreateInstance(NS_COLLATIONFACTORY_CONTRACTID);
+        if (colFactory) {
+            DebugOnly<nsresult> rv = colFactory->CreateCollation(&gCollation);
+            NS_ASSERTION(NS_SUCCEEDED(rv),
+                         "couldn't create collation instance");
         } else
-            NS_ERROR("couldn't get locale factory");
+            NS_ERROR("couldn't create instance of collation factory");
     }
 
     return gCollation;
 }
 
 //------------------------------------------------------------------------
 
 nsresult

--- a/intl/locale/mac/nsCollationMacUC.cpp
+++ b/intl/locale/mac/nsCollationMacUC.cpp
@@ -1,42 +1,36 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsCollationMacUC.h"
-#include "nsILocaleService.h"
 #include "nsIPrefBranch.h"
 #include "nsIPrefService.h"
 #include "nsIServiceManager.h"
 #include "prmem.h"
 #include "nsString.h"
 
 NS_IMPL_ISUPPORTS(nsCollationMacUC, nsICollation)
 
 nsCollationMacUC::nsCollationMacUC()
   : mInit(false)
   , mHasCollator(false)
-  , mLocaleICU(nullptr)
   , mLastStrength(-1)
   , mCollatorICU(nullptr)
 { }
 
 nsCollationMacUC::~nsCollationMacUC()
 {
 #ifdef DEBUG
   nsresult res =
 #endif
     CleanUpCollator();
   NS_ASSERTION(NS_SUCCEEDED(res), "CleanUpCollator failed");
-  if (mLocaleICU) {
-    free(mLocaleICU);
-    mLocaleICU = nullptr;
-  }
 }
 
 nsresult nsCollationMacUC::ConvertStrength(const int32_t aNSStrength,
                                            UCollationStrength* aICUStrength,
                                            UColAttributeValue* aCaseLevelOut)
 {
   NS_ENSURE_ARG_POINTER(aICUStrength);
   NS_ENSURE_TRUE((aNSStrength < 4), NS_ERROR_FAILURE);
@@ -63,53 +57,29 @@ nsresult nsCollationMacUC::ConvertStreng
   }
 
   *aICUStrength = strength;
   *aCaseLevelOut = caseLevel;
 
   return NS_OK;
 }
 
-nsresult nsCollationMacUC::ConvertLocaleICU(nsILocale* aNSLocale, char** aICULocale)
-{
-  NS_ENSURE_ARG_POINTER(aNSLocale);
-  NS_ENSURE_ARG_POINTER(aICULocale);
-
-  nsAutoString localeString;
-  nsresult res = aNSLocale->GetCategory(NS_LITERAL_STRING("NSILOCALE_COLLATE"), localeString);
-  NS_ENSURE_TRUE(NS_SUCCEEDED(res) && !localeString.IsEmpty(),
-                 NS_ERROR_FAILURE);
-  NS_LossyConvertUTF16toASCII tmp(localeString);
-  tmp.ReplaceChar('-', '_');
-  char* locale = (char*)malloc(tmp.Length() + 1);
-  if (!locale) {
-    return NS_ERROR_OUT_OF_MEMORY;
-  }
-  strcpy(locale, tmp.get());
-
-  *aICULocale = locale;
-
-  return NS_OK;
-}
-
 nsresult nsCollationMacUC::EnsureCollator(const int32_t newStrength)
 {
   NS_ENSURE_TRUE(mInit, NS_ERROR_NOT_INITIALIZED);
   if (mHasCollator && (mLastStrength == newStrength))
     return NS_OK;
 
   nsresult res;
   res = CleanUpCollator();
   NS_ENSURE_SUCCESS(res, res);
 
-  NS_ENSURE_TRUE(mLocaleICU, NS_ERROR_NOT_INITIALIZED);
-
   UErrorCode status;
   status = U_ZERO_ERROR;
-  mCollatorICU = ucol_open(mLocaleICU, &status);
+  mCollatorICU = ucol_open(mLocale.get(), &status);
   NS_ENSURE_TRUE(U_SUCCESS(status), NS_ERROR_FAILURE);
 
   UCollationStrength strength;
   UColAttributeValue caseLevel;
   res = ConvertStrength(newStrength, &strength, &caseLevel);
   NS_ENSURE_SUCCESS(res, res);
 
   status = U_ZERO_ERROR;
@@ -137,32 +107,22 @@ nsresult nsCollationMacUC::CleanUpCollat
   if (mHasCollator) {
     ucol_close(mCollatorICU);
     mHasCollator = false;
   }
 
   return NS_OK;
 }
 
-NS_IMETHODIMP nsCollationMacUC::Initialize(nsILocale* locale) 
+NS_IMETHODIMP nsCollationMacUC::Initialize(const nsACString& locale)
 {
   NS_ENSURE_TRUE((!mInit), NS_ERROR_ALREADY_INITIALIZED);
   nsCOMPtr<nsILocale> appLocale;
 
-  nsresult rv;
-  if (!locale) {
-    nsCOMPtr<nsILocaleService> localeService = do_GetService(NS_LOCALESERVICE_CONTRACTID, &rv);
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = localeService->GetApplicationLocale(getter_AddRefs(appLocale));
-    NS_ENSURE_SUCCESS(rv, rv);
-    locale = appLocale;
-  }
-
-  rv = ConvertLocaleICU(locale, &mLocaleICU);
-  NS_ENSURE_SUCCESS(rv, rv);
+  mLocale = locale;
 
   mInit = true;
   return NS_OK;
 }
 
 NS_IMETHODIMP nsCollationMacUC::AllocateRawSortKey(int32_t strength, const nsAString& stringIn,
                                                    uint8_t** key, uint32_t* outLen)
 {

--- a/intl/locale/mac/nsCollationMacUC.h
+++ b/intl/locale/mac/nsCollationMacUC.h
@@ -1,19 +1,20 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef nsCollationMacUC_h_
 #define nsCollationMacUC_h_
 
+#include "mozilla/Attributes.h"
 #include "nsICollation.h"
 #include "nsCollation.h"
-#include "mozilla/Attributes.h"
+#include "nsString.h"
 
 #include "unicode/ucol.h"
 
 class nsCollationMacUC final : public nsICollation {
 
 public:
   nsCollationMacUC();
 
@@ -21,24 +22,23 @@ public:
   NS_DECL_ISUPPORTS
 
   // nsICollation interface
   NS_DECL_NSICOLLATION
 
 protected:
   ~nsCollationMacUC();
 
-  nsresult ConvertLocaleICU(nsILocale* aNSLocale, char** aICULocale);
   nsresult ConvertStrength(const int32_t aStrength,
                            UCollationStrength* aStrengthOut,
                            UColAttributeValue* aCaseLevelOut);
   nsresult EnsureCollator(const int32_t newStrength);
   nsresult CleanUpCollator(void);
 
 private:
   bool mInit;
   bool mHasCollator;
-  char* mLocaleICU;
+  nsCString mLocale;
   int32_t mLastStrength;
   UCollator* mCollatorICU;
 };
 
 #endif  /* nsCollationMacUC_h_ */

--- a/intl/locale/nsCollation.cpp
+++ b/intl/locale/nsCollation.cpp
@@ -5,38 +5,49 @@
 
 #include "nsCollation.h"
 #include "nsCollationCID.h"
 #include "nsUnicharUtils.h"
 #include "prmem.h"
 #include "nsIUnicodeEncoder.h"
 #include "nsServiceManagerUtils.h"
 #include "mozilla/dom/EncodingUtils.h"
+#include "mozilla/intl/LocaleService.h"
 
 using mozilla::dom::EncodingUtils;
 
 ////////////////////////////////////////////////////////////////////////////////
 
 NS_DEFINE_CID(kCollationCID, NS_COLLATION_CID);
 
 NS_IMPL_ISUPPORTS(nsCollationFactory, nsICollationFactory)
 
-nsresult nsCollationFactory::CreateCollation(nsILocale* locale, nsICollation** instancePtr)
+nsresult nsCollationFactory::CreateCollation(nsICollation** instancePtr)
+{
+  nsAutoCString appLocale;
+  mozilla::intl::LocaleService::GetInstance()->GetAppLocale(appLocale);
+
+  return CreateCollationForLocale(appLocale, instancePtr);
+}
+
+nsresult
+nsCollationFactory::CreateCollationForLocale(const nsACString& locale, nsICollation** instancePtr)
 {
   // Create a collation interface instance.
   //
   nsICollation *inst;
   nsresult res;
-  
+
   res = CallCreateInstance(kCollationCID, &inst);
   if (NS_FAILED(res)) {
     return res;
   }
 
   inst->Initialize(locale);
+
   *instancePtr = inst;
 
   return res;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 
 nsCollation::nsCollation()

--- a/intl/locale/nsCollation.h
+++ b/intl/locale/nsCollation.h
@@ -9,26 +9,27 @@
 
 
 #include "nsICollation.h"
 #include "nsCOMPtr.h"
 #include "mozilla/Attributes.h"
 
 class nsIUnicodeEncoder;
 
-// Create a collation interface for an input locale.
+// Create a collation interface for the current app's locale.
 // 
 class nsCollationFactory final : public nsICollationFactory {
 
   ~nsCollationFactory() {}
 
 public: 
   NS_DECL_ISUPPORTS 
 
-  NS_IMETHOD CreateCollation(nsILocale* locale, nsICollation** instancePtr) override;
+  NS_IMETHOD CreateCollation(nsICollation** instancePtr) override;
+  NS_IMETHOD CreateCollationForLocale(const nsACString& locale, nsICollation** instancePtr) override;
 
   nsCollationFactory() {}
 };
 
 
 struct nsCollation {
 
 public: 

--- a/intl/locale/nsICollation.idl
+++ b/intl/locale/nsICollation.idl
@@ -6,27 +6,28 @@
 #include "nsILocale.idl"
 
 interface nsICollation;
 
 [scriptable, uuid(04971e14-d6b3-4ada-8cbb-c3a13842b349)]
 interface nsICollationFactory : nsISupports
 {
     /**
-     * Create the collation for a given locale.
-     *
-     * Use NULL as the locale parameter to use the user's locale preference
-     * from the operating system.
+     * Create a new collation for the current application locale.
      *
-     * @param locale
-     *        The locale for which to create the collation or null to use
-     *        user preference.
-     * @return A collation for the given locale.
+     * @return A new collation.
      */
-    nsICollation CreateCollation(in nsILocale locale);
+    nsICollation CreateCollation();
+
+    /**
+     * Create a new collation for a given locale.
+     *
+     * @return A new collation.
+     */
+    nsICollation CreateCollationForLocale(in ACString locale);
 };
 
 [scriptable, uuid(b0132cc0-3786-4557-9874-910d7def5f93)]
 interface nsICollation : nsISupports {
 
   // use the primary comparison for the given locale - no flags
   const long kCollationStrengthDefault = 0;
 
@@ -38,17 +39,17 @@ interface nsICollation : nsISupports {
 
   // case sensitive collation (default)
   const long kCollationCaseSensitive = kCollationStrengthDefault;
 
   // case insensitive collation
   const long kCollationCaseInSensitive = (kCollationCaseInsensitiveAscii | kCollationAccentInsenstive);
 
   // init this interface to a specified locale (should only be called by collation factory)
-  void initialize(in nsILocale locale);
+  void initialize(in ACString locale);
 
   // compare two strings
   // result is same as strcmp
   long compareString(in long strength, in AString string1, in AString string2);
 
   // allocate sort key from input string
   // returns newly allocated key, and its band its byte length
   [noscript] void allocateRawSortKey(in long strength, 

--- a/intl/locale/tests/unit/test_collation_mac_icu.js
+++ b/intl/locale/tests/unit/test_collation_mac_icu.js
@@ -15,21 +15,19 @@ function run_test()
     "¡viva España!",
     "Österreich",
     "中国",
     "日本",
     "한국",
   ];
 
   function test(locale, expected) {
-    var localeSvc = Cc["@mozilla.org/intl/nslocaleservice;1"].
-      getService(Ci.nsILocaleService);
     var collator = Cc["@mozilla.org/intl/collation-factory;1"].
       createInstance(Ci.nsICollationFactory).
-      CreateCollation(localeSvc.newLocale(locale));
+      CreateCollationForLocale(locale);
     var strength = Ci.nsICollation.kCollationStrengthDefault;
     var actual = input.sort((x, y) => collator.compareString(strength, x,y));
     deepEqual(actual, expected, locale);
   }
 
   // Locale en-US; default options.
   test("en-US", [
     "¡viva España!",

--- a/intl/locale/unix/nsCollationUnix.cpp
+++ b/intl/locale/unix/nsCollationUnix.cpp
@@ -3,17 +3,16 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include  <locale.h>
 #include "prmem.h"
 #include "nsCollationUnix.h"
 #include "nsIServiceManager.h"
 #include "nsIComponentManager.h"
-#include "nsILocaleService.h"
 #include "nsIPlatformCharset.h"
 #include "nsPosixLocale.h"
 #include "nsCOMPtr.h"
 #include "nsUnicharUtils.h"
 #include "nsCRT.h"
 //#define DEBUG_UNIX_COLLATION
 
 inline void nsCollationUnix::DoSetLocale()
@@ -39,65 +38,31 @@ nsCollationUnix::nsCollationUnix() : mCo
 nsCollationUnix::~nsCollationUnix() 
 {
   if (mCollation)
     delete mCollation;
 }
 
 NS_IMPL_ISUPPORTS(nsCollationUnix, nsICollation)
 
-nsresult nsCollationUnix::Initialize(nsILocale* locale) 
+nsresult nsCollationUnix::Initialize(const nsACString& locale) 
 {
 #define kPlatformLocaleLength 64
   NS_ASSERTION(!mCollation, "Should only be initialized once");
 
   nsresult res;
 
   mCollation = new nsCollation;
 
-  // default platform locale
-  mLocale.Assign('C');
-
-  nsAutoString localeStr;
-  NS_NAMED_LITERAL_STRING(aCategory, "NSILOCALE_COLLATE##PLATFORM");
-
-  // get locale string, use app default if no locale specified
-  if (locale == nullptr) {
-    nsCOMPtr<nsILocaleService> localeService = 
-             do_GetService(NS_LOCALESERVICE_CONTRACTID, &res);
+  nsCOMPtr <nsIPlatformCharset> platformCharset = do_GetService(NS_PLATFORMCHARSET_CONTRACTID, &res);
+  if (NS_SUCCEEDED(res)) {
+    nsAutoCString mappedCharset;
+    res = platformCharset->GetDefaultCharsetForLocale(NS_ConvertUTF8toUTF16(locale), mappedCharset);
     if (NS_SUCCEEDED(res)) {
-      nsCOMPtr<nsILocale> appLocale;
-      res = localeService->GetApplicationLocale(getter_AddRefs(appLocale));
-      if (NS_SUCCEEDED(res)) {
-        res = appLocale->GetCategory(aCategory, localeStr);
-        NS_ASSERTION(NS_SUCCEEDED(res), "failed to get app locale info");
-      }
-    }
-  }
-  else {
-    res = locale->GetCategory(aCategory, localeStr);
-    NS_ASSERTION(NS_SUCCEEDED(res), "failed to get locale info");
-  }
-
-  // Get platform locale and charset name from locale, if available
-  if (NS_SUCCEEDED(res)) {
-    // keep the same behavior as 4.x as well as avoiding Linux collation key problem
-    if (localeStr.LowerCaseEqualsLiteral("en_us")) { // note: locale is in platform format
-      localeStr.Assign('C');
-    }
-
-    nsPosixLocale::GetPlatformLocale(localeStr, mLocale);
-
-    nsCOMPtr <nsIPlatformCharset> platformCharset = do_GetService(NS_PLATFORMCHARSET_CONTRACTID, &res);
-    if (NS_SUCCEEDED(res)) {
-      nsAutoCString mappedCharset;
-      res = platformCharset->GetDefaultCharsetForLocale(localeStr, mappedCharset);
-      if (NS_SUCCEEDED(res)) {
-        mCollation->SetCharset(mappedCharset.get());
-      }
+      mCollation->SetCharset(mappedCharset.get());
     }
   }
 
   return NS_OK;
 }
 
 
 nsresult nsCollationUnix::CompareString(int32_t strength,

--- a/intl/locale/windows/nsCollationWin.cpp
+++ b/intl/locale/windows/nsCollationWin.cpp
@@ -2,17 +2,16 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
 #include "nsCollationWin.h"
 #include "nsIServiceManager.h"
 #include "nsIComponentManager.h"
-#include "nsILocaleService.h"
 #include "nsIPlatformCharset.h"
 #include "nsWin32Locale.h"
 #include "nsCOMPtr.h"
 #include "prmem.h"
 #include "plstr.h"
 #include <windows.h>
 
 #undef CompareString
@@ -25,59 +24,41 @@ nsCollationWin::nsCollationWin() : mColl
 }
 
 nsCollationWin::~nsCollationWin() 
 {
   if (mCollation)
     delete mCollation;
 }
 
-nsresult nsCollationWin::Initialize(nsILocale* locale) 
+nsresult nsCollationWin::Initialize(const nsACString& locale)
 {
   NS_ASSERTION(!mCollation, "Should only be initialized once.");
 
   nsresult res;
 
   mCollation = new nsCollation;
 
+  NS_ConvertASCIItoUTF16 wideLocale(locale);
+
   // default LCID (en-US)
   mLCID = 1033;
 
-  nsAutoString localeStr;
-
-  // get locale string, use app default if no locale specified
-  if (!locale) {
-    nsCOMPtr<nsILocaleService> localeService = 
-             do_GetService(NS_LOCALESERVICE_CONTRACTID);
-    if (localeService) {
-      nsCOMPtr<nsILocale> appLocale;
-      res = localeService->GetApplicationLocale(getter_AddRefs(appLocale));
-      if (NS_SUCCEEDED(res)) {
-        res = appLocale->GetCategory(NS_LITERAL_STRING("NSILOCALE_COLLATE"), 
-                                     localeStr);
-      }
-    }
-  }
-  else {
-    res = locale->GetCategory(NS_LITERAL_STRING("NSILOCALE_COLLATE"), 
-                              localeStr);
-  }
-
   // Get LCID and charset name from locale, if available
   LCID lcid;
-  res = nsWin32Locale::GetPlatformLocale(localeStr, &lcid);
+  res = nsWin32Locale::GetPlatformLocale(wideLocale, &lcid);
   if (NS_SUCCEEDED(res)) {
     mLCID = lcid;
   }
 
   nsCOMPtr <nsIPlatformCharset> platformCharset = 
       do_GetService(NS_PLATFORMCHARSET_CONTRACTID);
   if (platformCharset) {
     nsAutoCString mappedCharset;
-    res = platformCharset->GetDefaultCharsetForLocale(localeStr, mappedCharset);
+    res = platformCharset->GetDefaultCharsetForLocale(wideLocale, mappedCharset);
     if (NS_SUCCEEDED(res)) {
       mCollation->SetCharset(mappedCharset.get());
     }
   }
 
   return NS_OK;
 }
 

--- a/js/xpconnect/src/XPCLocale.cpp
+++ b/js/xpconnect/src/XPCLocale.cpp
@@ -121,31 +121,21 @@ private:
   }
 
   bool
   Compare(JSContext* cx, HandleString src1, HandleString src2, MutableHandleValue rval)
   {
     nsresult rv;
 
     if (!mCollation) {
-      nsCOMPtr<nsILocaleService> localeService =
-        do_GetService(NS_LOCALESERVICE_CONTRACTID, &rv);
+      nsCOMPtr<nsICollationFactory> colFactory =
+        do_CreateInstance(NS_COLLATIONFACTORY_CONTRACTID, &rv);
 
       if (NS_SUCCEEDED(rv)) {
-        nsCOMPtr<nsILocale> locale;
-        rv = localeService->GetApplicationLocale(getter_AddRefs(locale));
-
-        if (NS_SUCCEEDED(rv)) {
-          nsCOMPtr<nsICollationFactory> colFactory =
-            do_CreateInstance(NS_COLLATIONFACTORY_CONTRACTID, &rv);
-
-          if (NS_SUCCEEDED(rv)) {
-            rv = colFactory->CreateCollation(locale, getter_AddRefs(mCollation));
-          }
-        }
+        rv = colFactory->CreateCollation(getter_AddRefs(mCollation));
       }
 
       if (NS_FAILED(rv)) {
         xpc::Throw(cx, rv);
         return false;
       }
     }
 

--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@@ -3389,20 +3389,22 @@ nsLayoutUtils::ExpireDisplayPortOnAsyncS
       break;
     }
     nsIScrollableFrame* scrollAncestor = GetAsyncScrollableAncestorFrame(frame);
     if (!scrollAncestor) {
       break;
     }
     frame = do_QueryFrame(scrollAncestor);
     MOZ_ASSERT(frame);
+    if (!frame) {
+      break;
+    }
     MOZ_ASSERT(scrollAncestor->WantAsyncScroll() ||
       frame->PresContext()->PresShell()->GetRootScrollFrame() == frame);
-    if (nsLayoutUtils::AsyncPanZoomEnabled(frame) &&
-        nsLayoutUtils::HasDisplayPort(frame->GetContent())) {
+    if (nsLayoutUtils::HasDisplayPort(frame->GetContent())) {
       scrollAncestor->TriggerDisplayPortExpiration();
       // Stop after the first trigger. If it failed, there's no point in
       // continuing because all the rest of the frames we encounter are going
       // to be ancestors of |scrollAncestor| which will keep its displayport.
       // If the trigger succeeded, we stop because when the trigger executes
       // it will call this function again to trigger the next ancestor up the
       // chain.
       break;

--- a/layout/style/ServoCSSRuleList.cpp
+++ b/layout/style/ServoCSSRuleList.cpp
@@ -128,16 +128,20 @@ ServoCSSRuleList::InsertRule(const nsASt
   return rv;
 }
 
 nsresult
 ServoCSSRuleList::DeleteRule(uint32_t aIndex)
 {
   nsresult rv = Servo_CssRules_DeleteRule(mRawRules, aIndex);
   if (!NS_FAILED(rv)) {
+    uintptr_t rule = mRules[aIndex];
+    if (rule > kMaxRuleType) {
+      CastToPtr(rule)->Release();
+    }
     mRules.RemoveElementAt(aIndex);
   }
   return rv;
 }
 
 ServoCSSRuleList::~ServoCSSRuleList()
 {
   EnumerateInstantiatedRules([](css::Rule* rule) { rule->Release(); });

--- a/media/libvpx/moz.build
+++ b/media/libvpx/moz.build
@@ -34,17 +34,20 @@ elif CONFIG['CPU_ARCH'] == 'x86':
     elif CONFIG['OS_TARGET'] == 'Darwin':
         ASFLAGS += [ '-I%s/media/libvpx/config/mac/ia32/' % TOPSRCDIR ]
         CFLAGS += [ '-I%s/media/libvpx/config/mac/ia32/' % TOPSRCDIR ]
     else: # Android, Linux, BSDs, etc.
         ASFLAGS += [ '-I%s/media/libvpx/config/linux/ia32/' % TOPSRCDIR ]
         CFLAGS += [ '-I%s/media/libvpx/config/linux/ia32/' % TOPSRCDIR ]
 elif CONFIG['CPU_ARCH'] == 'arm':
     EXPORTS.vpx += files['ARM_EXPORTS']
-    ASFLAGS += [ '-I%s/media/libvpx/config/linux/arm/' % TOPSRCDIR ]
+    ASFLAGS += [
+        '-I%s/media/libvpx/config/linux/arm/' % TOPSRCDIR,
+        '-I%s/libvpx' % OBJDIR,
+    ]
     CFLAGS += [ '-I%s/media/libvpx/config/linux/arm/' % TOPSRCDIR ]
 
     arm_asm_files = files['ARM_SOURCES']
 
     if CONFIG['VPX_AS_CONVERSION']:
         SOURCES += sorted([
             "!%s.S" % f if f.endswith('.asm') else f for f in arm_asm_files
         ])
@@ -83,18 +86,16 @@ if CONFIG['OS_TARGET'] == 'Android':
     # the OS they're on, so do it for them.
     DEFINES['__linux__'] = True
 
     if not CONFIG['MOZ_WEBRTC']:
         SOURCES += [
             '%%%s/sources/android/cpufeatures/cpu-features.c' % CONFIG['ANDROID_NDK'],
         ]
 
-    ASFLAGS += ['-I%s/libvpx' % OBJDIR]
-
 if CONFIG['CLANG_CL'] or not CONFIG['_MSC_VER']:
     for f in SOURCES:
         if f.endswith('.c'):
             if 'sse2.c' in f:
                 SOURCES[f].flags += CONFIG['SSE2_FLAGS']
             if 'ssse3.c' in f:
                 SOURCES[f].flags += ['-mssse3']
             if 'sse4.c' in f:

--- a/mobile/android/base/java/org/mozilla/gecko/BrowserApp.java
+++ b/mobile/android/base/java/org/mozilla/gecko/BrowserApp.java
@@ -662,17 +662,16 @@ public class BrowserApp extends GeckoApp
                             // shut down (in which case trying to perform UI changes, such as showing
                             // fragments below, will crash).
                             return;
                         }
 
                         final TabHistoryFragment fragment = TabHistoryFragment.newInstance(historyPageList, toIndex);
                         final FragmentManager fragmentManager = getSupportFragmentManager();
                         GeckoAppShell.vibrateOnHapticFeedbackEnabled(getResources().getIntArray(R.array.long_press_vibrate_msec));
-                        if (BrowserApp.this.isForegrounded())
                         fragment.show(R.id.tab_history_panel, fragmentManager.beginTransaction(), TAB_HISTORY_FRAGMENT_TAG);
                     }
                 });
             }
         });
         mBrowserToolbar.setTabHistoryController(tabHistoryController);
 
         final String action = intent.getAction();

--- a/mobile/android/base/java/org/mozilla/gecko/customtabs/CustomTabsActivity.java
+++ b/mobile/android/base/java/org/mozilla/gecko/customtabs/CustomTabsActivity.java
@@ -1,23 +1,30 @@
 /* -*- Mode: Java; c-basic-offset: 4; tab-width: 4; indent-tabs-mode: nil; -*-
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 package org.mozilla.gecko.customtabs;
 
+import android.app.PendingIntent;
+import android.content.Intent;
+import android.graphics.Bitmap;
 import android.graphics.Color;
+import android.graphics.drawable.BitmapDrawable;
 import android.net.Uri;
 import android.os.Build;
 import android.os.Bundle;
+import android.support.annotation.VisibleForTesting;
+import android.support.v4.view.MenuItemCompat;
 import android.support.v7.app.ActionBar;
 import android.support.v7.widget.Toolbar;
 import android.text.TextUtils;
 import android.util.Log;
+import android.view.Menu;
 import android.view.MenuItem;
 import android.view.View;
 import android.view.Window;
 import android.view.WindowManager;
 import android.widget.TextView;
 
 import org.mozilla.gecko.AppConstants;
 import org.mozilla.gecko.GeckoApp;
@@ -30,17 +37,16 @@ import java.lang.reflect.Field;
 
 import static android.support.customtabs.CustomTabsIntent.EXTRA_TOOLBAR_COLOR;
 
 public class CustomTabsActivity extends GeckoApp implements Tabs.OnTabsChangedListener {
     private static final String LOGTAG = "CustomTabsActivity";
     private static final String SAVED_TOOLBAR_COLOR = "SavedToolbarColor";
     private static final String SAVED_TOOLBAR_TITLE = "SavedToolbarTitle";
     private static final int NO_COLOR = -1;
-    private Toolbar toolbar;
 
     private ActionBar actionBar;
     private int tabId = -1;
     private boolean useDomainTitle = true;
 
     private int toolbarColor;
     private String toolbarTitle;
 
@@ -194,25 +200,59 @@ public class CustomTabsActivity extends 
             final Tab tab = tabs.getTab(lastSelectedTabId);
             if (tab == null) {
                 finish();
             }
         }
         super.onResume();
     }
 
+    @Override
+    public boolean onPrepareOptionsMenu(Menu menu) {
+        insertActionButton(menu, getIntent());
+        return super.onPrepareOptionsMenu(menu);
+    }
+
     public boolean onOptionsItemSelected(MenuItem item) {
         switch (item.getItemId()) {
             case android.R.id.home:
                 finish();
                 return true;
+            case R.id.action_button:
+                onActionButtonClicked();
+                return true;
         }
         return super.onOptionsItemSelected(item);
     }
 
+    /**
+     * To insert a MenuItem (as an ActionButton) into Menu.
+     *
+     * @param menu   The options menu in which to place items.
+     * @param intent which to launch this activity
+     * @return the MenuItem which be created and inserted into menu. Otherwise, null.
+     */
+    @VisibleForTesting
+    MenuItem insertActionButton(Menu menu, Intent intent) {
+        if (!IntentUtil.hasActionButton(intent)) {
+            return null;
+        }
+
+        // TODO: Bug 1336373 - Action button icon should support tint
+        MenuItem item = menu.add(Menu.NONE,
+                R.id.action_button,
+                Menu.NONE,
+                IntentUtil.getActionButtonDescription(intent));
+        Bitmap bitmap = IntentUtil.getActionButtonIcon(intent);
+        item.setIcon(new BitmapDrawable(getResources(), bitmap));
+        MenuItemCompat.setShowAsAction(item, MenuItemCompat.SHOW_AS_ACTION_ALWAYS);
+
+        return item;
+    }
+
     private void updateActionBarWithToolbar(final Toolbar toolbar) {
         setSupportActionBar(toolbar);
         final ActionBar ab = getSupportActionBar();
         if (ab != null) {
             ab.setDisplayHomeAsUpEnabled(true);
         }
     }
 
@@ -224,9 +264,18 @@ public class CustomTabsActivity extends 
         toolbar.setBackgroundColor(toolbarColor);
 
         final Window window = getWindow();
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
             window.addFlags(WindowManager.LayoutParams.FLAG_DRAWS_SYSTEM_BAR_BACKGROUNDS);
             window.setStatusBarColor(ColorUtil.darken(toolbarColor, 0.25));
         }
     }
+
+    private void onActionButtonClicked() {
+        PendingIntent pendingIntent = IntentUtil.getActionButtonPendingIntent(getIntent());
+        try {
+            pendingIntent.send();
+        } catch (PendingIntent.CanceledException e) {
+            Log.w(LOGTAG, "Action Button clicked, but pending intent was canceled", e);
+        }
+    }
 }

--- a/mobile/android/base/java/org/mozilla/gecko/customtabs/IntentUtil.java
+++ b/mobile/android/base/java/org/mozilla/gecko/customtabs/IntentUtil.java
@@ -1,16 +1,18 @@
 /* -*- Mode: Java; c-basic-offset: 4; tab-width: 4; indent-tabs-mode: nil; -*-
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 package org.mozilla.gecko.customtabs;
 
+import android.app.PendingIntent;
 import android.content.Intent;
+import android.graphics.Bitmap;
 import android.os.Build;
 import android.os.Bundle;
 import android.support.annotation.NonNull;
 import android.support.customtabs.CustomTabsIntent;
 
 /**
  * A utility class for CustomTabsActivity to extract information from intent.
  * For example, this class helps to extract exit-animation resource id.
@@ -23,16 +25,85 @@ class IntentUtil {
     private static final String PREFIX = Build.VERSION.SDK_INT >= Build.VERSION_CODES.M
             ? "android:activity."
             : "android:";
     private static final String KEY_PACKAGE_NAME = PREFIX + "packageName";
     private static final String KEY_ANIM_ENTER_RES_ID = PREFIX + "animEnterRes";
     private static final String KEY_ANIM_EXIT_RES_ID = PREFIX + "animExitRes";
 
     /**
+     * To determine whether the intent has necessary information to build an Action-Button.
+     *
+     * @param intent which to launch a Custom-Tabs-Activity
+     * @return true, if intent has all necessary information.
+     */
+    static boolean hasActionButton(@NonNull Intent intent) {
+        return (getActionButtonBundle(intent) != null)
+                && (getActionButtonIcon(intent) != null)
+                && (getActionButtonDescription(intent) != null)
+                && (getActionButtonPendingIntent(intent) != null);
+    }
+
+    /**
+     * To extract bitmap icon from intent for Action-Button.
+     *
+     * @param intent which to launch a Custom-Tabs-Activity
+     * @return bitmap icon, if any. Otherwise, null.
+     */
+    static Bitmap getActionButtonIcon(@NonNull Intent intent) {
+        final Bundle bundle = getActionButtonBundle(intent);
+        return (bundle == null) ? null : (Bitmap) bundle.getParcelable(CustomTabsIntent.KEY_ICON);
+    }
+
+    /**
+     * To extract description from intent for Action-Button. This description is used for
+     * accessibility.
+     *
+     * @param intent which to launch a Custom-Tabs-Activity
+     * @return description, if any. Otherwise, null.
+     */
+    static String getActionButtonDescription(@NonNull Intent intent) {
+        final Bundle bundle = getActionButtonBundle(intent);
+        return (bundle == null) ? null : bundle.getString(CustomTabsIntent.KEY_DESCRIPTION);
+    }
+
+    /**
+     * To extract pending-intent from intent for Action-Button.
+     *
+     * @param intent which to launch a Custom-Tabs-Activity
+     * @return PendingIntent, if any. Otherwise, null.
+     */
+    static PendingIntent getActionButtonPendingIntent(@NonNull Intent intent) {
+        final Bundle bundle = getActionButtonBundle(intent);
+        return (bundle == null)
+                ? null
+                : (PendingIntent) bundle.getParcelable(CustomTabsIntent.KEY_PENDING_INTENT);
+    }
+
+    /**
+     * To know whether the Action-Button should be tinted.
+     *
+     * @param intent which to launch a Custom-Tabs-Activity
+     * @return true, if Action-Button should be tinted. Default value is false.
+     */
+    static boolean isActionButtonTinted(@NonNull Intent intent) {
+        return intent.getBooleanExtra(CustomTabsIntent.EXTRA_TINT_ACTION_BUTTON, false);
+    }
+
+    /**
+     * To extract extra Action-button bundle from an intent.
+     *
+     * @param intent which to launch a Custom-Tabs-Activity
+     * @return bundle for Action-Button, if any. Otherwise, null.
+     */
+    private static Bundle getActionButtonBundle(@NonNull Intent intent) {
+        return intent.getBundleExtra(CustomTabsIntent.EXTRA_ACTION_BUTTON_BUNDLE);
+    }
+
+    /**
      * To get package name of 3rd-party-app from an intent.
      * If the app defined extra exit-animation to use, it should also provide its package name
      * to get correct animation resource.
      *
      * @param intent which to launch a Custom-Tabs-Activity
      * @return package name, if the intent defined extra exit-animation bundle. Otherwise, null.
      */
     static String getAnimationPackageName(@NonNull Intent intent) {

--- a/mobile/android/base/java/org/mozilla/gecko/db/BrowserDatabaseHelper.java
+++ b/mobile/android/base/java/org/mozilla/gecko/db/BrowserDatabaseHelper.java
@@ -2073,17 +2073,17 @@ public final class BrowserDatabaseHelper
                 case 25:
                     upgradeDatabaseFrom24to25(db);
                     break;
 
                 case 26:
                     upgradeDatabaseFrom25to26(db);
                     break;
 
-                // case 27 occurs in UrlMetadataTable.onUpgrade
+                // case 27 occurs in URLImageDataTable.onUpgrade
 
                 case 28:
                     upgradeDatabaseFrom27to28(db);
                     break;
 
                 case 29:
                     upgradeDatabaseFrom28to29(db);
                     break;

--- a/mobile/android/base/java/org/mozilla/gecko/db/BrowserProvider.java
+++ b/mobile/android/base/java/org/mozilla/gecko/db/BrowserProvider.java
@@ -159,18 +159,18 @@ public class BrowserProvider extends Sha
     static final Map<String, String> THUMBNAILS_PROJECTION_MAP;
     static final Map<String, String> URL_ANNOTATIONS_PROJECTION_MAP;
     static final Map<String, String> VISIT_PROJECTION_MAP;
     static final Map<String, String> PAGE_METADATA_PROJECTION_MAP;
     static final Table[] sTables;
 
     static {
         sTables = new Table[] {
-            // See awful shortcut assumption hack in getURLMetadataTable.
-            new URLMetadataTable()
+            // See awful shortcut assumption hack in getURLImageDataTable.
+            new URLImageDataTable()
         };
         // We will reuse this.
         HashMap<String, String> map;
 
         // Bookmarks
         URI_MATCHER.addURI(BrowserContract.AUTHORITY, "bookmarks", BOOKMARKS);
         URI_MATCHER.addURI(BrowserContract.AUTHORITY, "bookmarks/#", BOOKMARKS_ID);
         URI_MATCHER.addURI(BrowserContract.AUTHORITY, "bookmarks/parents", BOOKMARKS_PARENT);
@@ -365,18 +365,18 @@ public class BrowserProvider extends Sha
     public void shutdown() {
         LocalBroadcastManager.getInstance(getContext()).unregisterReceiver(mShrinkMemoryReceiver);
 
         super.shutdown();
     }
 
     // Convenience accessor.
     // Assumes structure of sTables!
-    private URLMetadataTable getURLMetadataTable() {
-        return (URLMetadataTable) sTables[0];
+    private URLImageDataTable getURLImageDataTable() {
+        return (URLImageDataTable) sTables[0];
     }
 
     private static boolean hasFaviconsInProjection(String[] projection) {
         if (projection == null) return true;
         for (int i = 0; i < projection.length; ++i) {
             if (projection[i].equals(FaviconColumns.FAVICON) ||
                 projection[i].equals(FaviconColumns.FAVICON_URL))
                 return true;
@@ -2199,17 +2199,17 @@ public class BrowserProvider extends Sha
                 + " AND " + History.URL + " IS NOT NULL"
                 + " UNION ALL SELECT " + Bookmarks.URL
                 + " FROM " + TABLE_BOOKMARKS
                 + " WHERE " + Bookmarks.IS_DELETED + " = 0"
                 + " AND " + Bookmarks.URL + " IS NOT NULL)";
 
         return deleteFavicons(uri, faviconSelection, null) +
                deleteThumbnails(uri, thumbnailSelection, null) +
-               getURLMetadataTable().deleteUnused(getWritableDatabase(uri));
+               getURLImageDataTable().deleteUnused(getWritableDatabase(uri));
     }
 
     @Override
     public ContentProviderResult[] applyBatch (ArrayList<ContentProviderOperation> operations)
         throws OperationApplicationException {
         final int numOperations = operations.size();
         final ContentProviderResult[] results = new ContentProviderResult[numOperations];
 

--- a/mobile/android/base/java/org/mozilla/gecko/db/LocalURLMetadata.java
+++ b/mobile/android/base/java/org/mozilla/gecko/db/LocalURLMetadata.java
@@ -29,27 +29,27 @@ import android.util.Log;
 import android.util.LruCache;
 
 // Holds metadata info about URLs. Supports some helper functions for getting back a HashMap of key value data.
 public class LocalURLMetadata implements URLMetadata {
     private static final String LOGTAG = "GeckoURLMetadata";
     private final Uri uriWithProfile;
 
     public LocalURLMetadata(String mProfile) {
-        uriWithProfile = DBUtils.appendProfileWithDefault(mProfile, URLMetadataTable.CONTENT_URI);
+        uriWithProfile = DBUtils.appendProfileWithDefault(mProfile, URLImageDataTable.CONTENT_URI);
     }
 
     // A list of columns in the table. It's used to simplify some loops for reading/writing data.
     private static final Set<String> COLUMNS;
     static {
         final HashSet<String> tempModel = new HashSet<>(4);
-        tempModel.add(URLMetadataTable.URL_COLUMN);
-        tempModel.add(URLMetadataTable.TILE_IMAGE_URL_COLUMN);
-        tempModel.add(URLMetadataTable.TILE_COLOR_COLUMN);
-        tempModel.add(URLMetadataTable.TOUCH_ICON_COLUMN);
+        tempModel.add(URLImageDataTable.URL_COLUMN);
+        tempModel.add(URLImageDataTable.TILE_IMAGE_URL_COLUMN);
+        tempModel.add(URLImageDataTable.TILE_COLOR_COLUMN);
+        tempModel.add(URLImageDataTable.TOUCH_ICON_COLUMN);
         COLUMNS = Collections.unmodifiableSet(tempModel);
     }
 
     // Store a cache of recent results. This number is chosen to match the max number of tiles on about:home
     private static final int CACHE_SIZE = 9;
     // Note: Members of this cache are unmodifiable.
     private final LruCache<String, Map<String, Object>> cache = new LruCache<String, Map<String, Object>>(CACHE_SIZE);
 
@@ -83,17 +83,17 @@ public class LocalURLMetadata implements
                 ArrayList<Integer> sizes = new ArrayList<Integer>(icons.length());
                 while (keys.hasNext()) {
                     sizes.add(new Integer(keys.next()));
                 }
 
                 final int bestSize = LoadFaviconResult.selectBestSizeFromList(sizes, preferredSize);
                 final String iconURL = icons.getString(Integer.toString(bestSize));
 
-                data.put(URLMetadataTable.TOUCH_ICON_COLUMN, iconURL);
+                data.put(URLImageDataTable.TOUCH_ICON_COLUMN, iconURL);
             }
         } catch (JSONException e) {
             Log.w(LOGTAG, "Exception processing touchIconList for LocalURLMetadata; ignoring.", e);
         }
 
         return Collections.unmodifiableMap(data);
     }
 
@@ -164,39 +164,39 @@ public class LocalURLMetadata implements
             }
         }
 
         // If everything was in the cache, we're done!
         if (urlsToQuery.size() == 0) {
             return Collections.unmodifiableMap(data);
         }
 
-        final String selection = DBUtils.computeSQLInClause(urlsToQuery.size(), URLMetadataTable.URL_COLUMN);
+        final String selection = DBUtils.computeSQLInClause(urlsToQuery.size(), URLImageDataTable.URL_COLUMN);
         List<String> columns = requestedColumns;
         // We need the url to build our final HashMap, so we force it to be included in the query.
-        if (!columns.contains(URLMetadataTable.URL_COLUMN)) {
+        if (!columns.contains(URLImageDataTable.URL_COLUMN)) {
             // The requestedColumns may be immutable (e.g. if the caller used Collections.singletonList), hence
             // we have to create a copy.
             columns = new ArrayList<String>(columns);
-            columns.add(URLMetadataTable.URL_COLUMN);
+            columns.add(URLImageDataTable.URL_COLUMN);
         }
 
         final Cursor cursor = cr.query(uriWithProfile,
                                        columns.toArray(new String[columns.size()]), // columns,
                                        selection, // selection
                                        urlsToQuery.toArray(new String[urlsToQuery.size()]), // selectionargs
                                        null);
         try {
             if (!cursor.moveToFirst()) {
                 return Collections.unmodifiableMap(data);
             }
 
             do {
                 final Map<String, Object> metadata = fromCursor(cursor);
-                final String url = cursor.getString(cursor.getColumnIndexOrThrow(URLMetadataTable.URL_COLUMN));
+                final String url = cursor.getString(cursor.getColumnIndexOrThrow(URLImageDataTable.URL_COLUMN));
 
                 data.put(url, metadata);
                 cache.put(url, metadata);
             } while (cursor.moveToNext());
 
         } finally {
             cursor.close();
         }
@@ -225,16 +225,16 @@ public class LocalURLMetadata implements
 
             if (values.size() == 0) {
                 return;
             }
 
             Uri uri = uriWithProfile.buildUpon()
                                  .appendQueryParameter(BrowserContract.PARAM_INSERT_IF_NEEDED, "true")
                                  .build();
-            cr.update(uri, values, URLMetadataTable.URL_COLUMN + "=?", new String[] {
-                (String) data.get(URLMetadataTable.URL_COLUMN)
+            cr.update(uri, values, URLImageDataTable.URL_COLUMN + "=?", new String[] {
+                (String) data.get(URLImageDataTable.URL_COLUMN)
             });
         } catch (Exception ex) {
             Log.e(LOGTAG, "error saving", ex);
         }
     }
 }

rename from mobile/android/base/java/org/mozilla/gecko/db/URLMetadataTable.java
rename to mobile/android/base/java/org/mozilla/gecko/db/URLImageDataTable.java
--- a/mobile/android/base/java/org/mozilla/gecko/db/URLMetadataTable.java
+++ b/mobile/android/base/java/org/mozilla/gecko/db/URLImageDataTable.java
@@ -8,33 +8,33 @@ package org.mozilla.gecko.db;
 
 import org.mozilla.gecko.db.BrowserContract.Bookmarks;
 import org.mozilla.gecko.db.BrowserContract.History;
 
 import android.database.sqlite.SQLiteDatabase;
 import android.net.Uri;
 
 // Holds metadata info about urls. Supports some helper functions for getting back a HashMap of key value data.
-public class URLMetadataTable extends BaseTable {
-    private static final String LOGTAG = "GeckoURLMetadataTable";
+public class URLImageDataTable extends BaseTable {
+    private static final String LOGTAG = "GeckoURLImageDataTable";
 
     private static final String TABLE = "metadata"; // Name of the table in the db
     private static final int TABLE_ID_NUMBER = BrowserProvider.METADATA;
 
     // Uri for querying this table
     public static final Uri CONTENT_URI = Uri.withAppendedPath(BrowserContract.AUTHORITY_URI, "metadata");
 
     // Columns in the table
     public static final String ID_COLUMN = "id";
     public static final String URL_COLUMN = "url";
     public static final String TILE_IMAGE_URL_COLUMN = "tileImage";
     public static final String TILE_COLOR_COLUMN = "tileColor";
     public static final String TOUCH_ICON_COLUMN = "touchIcon";
 
-    URLMetadataTable() { }
+    URLImageDataTable() { }
 
     @Override
     protected String getTable() {
         return TABLE;
     }
 
     @Override
     public void onCreate(SQLiteDatabase db) {

--- a/mobile/android/base/java/org/mozilla/gecko/home/TopSitesPanel.java
+++ b/mobile/android/base/java/org/mozilla/gecko/home/TopSitesPanel.java
@@ -1,17 +1,17 @@
 /* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 package org.mozilla.gecko.home;
 
-import static org.mozilla.gecko.db.URLMetadataTable.TILE_COLOR_COLUMN;
-import static org.mozilla.gecko.db.URLMetadataTable.TILE_IMAGE_URL_COLUMN;
+import static org.mozilla.gecko.db.URLImageDataTable.TILE_COLOR_COLUMN;
+import static org.mozilla.gecko.db.URLImageDataTable.TILE_IMAGE_URL_COLUMN;
 
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.EnumSet;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.concurrent.Future;

--- a/mobile/android/base/moz.build
+++ b/mobile/android/base/moz.build
@@ -377,18 +377,18 @@ gbjar.sources += ['java/org/mozilla/geck
     'db/SearchHistoryProvider.java',
     'db/SharedBrowserDatabaseProvider.java',
     'db/SQLiteBridgeContentProvider.java',
     'db/SuggestedSites.java',
     'db/Table.java',
     'db/TabsAccessor.java',
     'db/TabsProvider.java',
     'db/UrlAnnotations.java',
+    'db/URLImageDataTable.java',
     'db/URLMetadata.java',
-    'db/URLMetadataTable.java',
     'delegates/BookmarkStateChangeDelegate.java',
     'delegates/BrowserAppDelegate.java',
     'delegates/BrowserAppDelegateWithReference.java',
     'delegates/OfflineTabStatusDelegate.java',
     'delegates/ScreenshotDelegate.java',
     'delegates/TabsTrayVisibilityAwareDelegate.java',
     'DevToolsAuthHelper.java',
     'distribution/Distribution.java',

--- a/mobile/android/base/resources/values/ids.xml
+++ b/mobile/android/base/resources/values/ids.xml
@@ -14,10 +14,11 @@
     <item type="id" name="recycler_view_click_support" />
     <item type="id" name="range_list"/>
     <item type="id" name="pref_header_general"/>
     <item type="id" name="pref_header_privacy"/>
     <item type="id" name="pref_header_search"/>
     <item type="id" name="updateServicePermissionNotification" />
     <item type="id" name="websiteContentNotification" />
     <item type="id" name="foregroundNotification" />
+    <item type="id" name="action_button"/>
 
 </resources>

--- a/mobile/android/geckoview/src/main/java/org/mozilla/gecko/util/HardwareUtils.java
+++ b/mobile/android/geckoview/src/main/java/org/mozilla/gecko/util/HardwareUtils.java
@@ -1,15 +1,16 @@
 /* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 package org.mozilla.gecko.util;
 
+import org.mozilla.gecko.AppConstants;
 import org.mozilla.gecko.SysInfo;
 
 import android.content.Context;
 import android.content.pm.PackageManager;
 import android.content.res.Configuration;
 import android.os.Build;
 import android.util.Log;
 
@@ -86,16 +87,22 @@ public final class HardwareUtils {
     public static boolean isX86System() {
         return Build.CPU_ABI != null && Build.CPU_ABI.equals("x86");
     }
 
     /**
      * @return false if the current system is not supported (e.g. APK/system ABI mismatch).
      */
     public static boolean isSupportedSystem() {
+        // We've had crash reports from users on API 10 (with minSDK==15). That shouldn't even install,
+        // but since it does we need to protect against it:
+        if (Build.VERSION.SDK_INT < AppConstants.Versions.MIN_SDK_VERSION) {
+            return false;
+        }
+
         // See http://developer.android.com/ndk/guides/abis.html
         final boolean isSystemARM = isARMSystem();
         final boolean isSystemX86 = isX86System();
 
         boolean isAppARM = BuildConfig.ANDROID_CPU_ARCH.startsWith("armeabi-v7a");
         boolean isAppX86 = BuildConfig.ANDROID_CPU_ARCH.startsWith("x86");
 
         // Only reject known incompatible ABIs. Better safe than sorry.

--- a/mobile/android/tests/background/junit4/src/org/mozilla/gecko/customtabs/TestCustomTabsActivity.java
+++ b/mobile/android/tests/background/junit4/src/org/mozilla/gecko/customtabs/TestCustomTabsActivity.java
@@ -1,26 +1,34 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 package org.mozilla.gecko.customtabs;
 
+import android.app.PendingIntent;
 import android.content.Context;
 import android.content.Intent;
+import android.content.res.Resources;
+import android.graphics.Bitmap;
+import android.graphics.BitmapFactory;
 import android.support.annotation.AnimRes;
 import android.support.customtabs.CustomTabsIntent;
+import android.view.Menu;
+import android.view.MenuItem;
 
 import junit.framework.Assert;
 
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.mockito.internal.util.reflection.Whitebox;
+import org.mozilla.gecko.R;
 import org.mozilla.gecko.background.testhelpers.TestRunner;
 import org.robolectric.RuntimeEnvironment;
+import org.robolectric.fakes.RoboMenu;
 
 import static org.mockito.Matchers.anyInt;
 import static org.mockito.Matchers.eq;
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.spy;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
 
@@ -37,16 +45,17 @@ public class TestCustomTabsActivity {
     private final int exitRes = 0x456; // arbitrary number as animation resource id
 
     @Before
     public void setUp() {
         spyContext = spy(RuntimeEnvironment.application);
         doReturn(THIRD_PARTY_PACKAGE_NAME).when(spyContext).getPackageName();
 
         spyActivity = spy(new CustomTabsActivity());
+        doReturn(RuntimeEnvironment.application.getResources()).when(spyActivity).getResources();
 
         final CustomTabsIntent.Builder builder = new CustomTabsIntent.Builder();
         builder.setExitAnimations(spyContext, enterRes, exitRes);
         final Intent i = builder.build().intent;
     }
 
     /**
      * Activity should not call overridePendingTransition if custom animation does not exist.
@@ -86,9 +95,36 @@ public class TestCustomTabsActivity {
         builder.setExitAnimations(spyContext, enterRes, exitRes);
         final Intent i = builder.build().intent;
 
         doReturn(i).when(spyActivity).getIntent();
         Whitebox.setInternalState(spyActivity, "usingCustomAnimation", true);
 
         Assert.assertEquals(THIRD_PARTY_PACKAGE_NAME, spyActivity.getPackageName());
     }
+
+    @Test
+    public void testInsertActionButton() {
+        // create properties for CustomTabsIntent
+        final String description = "Description";
+        final Intent actionIntent = new Intent(Intent.ACTION_VIEW);
+        final int reqCode = 0x123;
+        final PendingIntent pendingIntent = PendingIntent.getActivities(spyContext,
+                reqCode,
+                new Intent[]{actionIntent},
+                PendingIntent.FLAG_CANCEL_CURRENT);
+        final Bitmap bitmap = BitmapFactory.decodeResource(
+                spyContext.getResources(),
+                R.drawable.ic_action_settings); // arbitrary icon resource
+
+        // To create a CustomTabsIntent which is asking for ActionButton.
+        final CustomTabsIntent.Builder builder = new CustomTabsIntent.Builder();
+        builder.setActionButton(bitmap, description, pendingIntent, true);
+
+        // CustomTabsActivity should return a MenuItem with corresponding attributes.
+        Menu menu = new RoboMenu(spyContext);
+        MenuItem item = spyActivity.insertActionButton(menu, builder.build().intent);
+        Assert.assertNotNull(item);
+        Assert.assertEquals(item.getTitle(), description);
+        Assert.assertEquals(0, item.getOrder()); // should be the first one
+        Assert.assertTrue(item.isVisible());
+    }
 }
\ No newline at end of file

--- a/mobile/android/tests/background/junit4/src/org/mozilla/gecko/customtabs/TestIntentUtil.java
+++ b/mobile/android/tests/background/junit4/src/org/mozilla/gecko/customtabs/TestIntentUtil.java
@@ -1,41 +1,87 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 package org.mozilla.gecko.customtabs;
 
+import android.app.PendingIntent;
 import android.content.Context;
 import android.content.Intent;
+import android.graphics.Bitmap;
+import android.graphics.BitmapFactory;
 import android.support.annotation.AnimRes;
 import android.support.customtabs.CustomTabsIntent;
 
 import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
+import org.mozilla.gecko.R;
 import org.mozilla.gecko.background.testhelpers.TestRunner;
 import org.robolectric.RuntimeEnvironment;
 
+import java.util.Objects;
+
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.spy;
 
 @RunWith(TestRunner.class)
 public class TestIntentUtil {
 
     private static final String THIRD_PARTY_PACKAGE_NAME = "mozilla.unit.test";
     private Context spyContext;  // 3rd party app context
 
     @Before
     public void setUp() {
         spyContext = spy(RuntimeEnvironment.application);
         doReturn(THIRD_PARTY_PACKAGE_NAME).when(spyContext).getPackageName();
     }
 
     @Test
+    public void testIntentWithActionButton() {
+        // create properties for CustomTabsIntent
+        final String description = "Description";
+        final boolean tinted = true;
+        final Intent actionIntent = new Intent(Intent.ACTION_VIEW);
+        final int reqCode = 0x123;
+        final PendingIntent pendingIntent = PendingIntent.getActivities(spyContext,
+                reqCode,
+                new Intent[]{actionIntent},
+                PendingIntent.FLAG_CANCEL_CURRENT);
+
+        final Bitmap bitmap = BitmapFactory.decodeResource(
+                spyContext.getResources(),
+                R.drawable.ic_action_settings); // arbitrary icon resource
+
+        final CustomTabsIntent.Builder builder = new CustomTabsIntent.Builder();
+        builder.setActionButton(bitmap, description, pendingIntent, tinted);
+
+        Intent intent = builder.build().intent;
+        Assert.assertTrue(IntentUtil.hasActionButton(intent));
+        Assert.assertEquals(tinted, IntentUtil.isActionButtonTinted(intent));
+        Assert.assertEquals(bitmap, IntentUtil.getActionButtonIcon(intent));
+        Assert.assertEquals(description, IntentUtil.getActionButtonDescription(intent));
+        Assert.assertTrue(
+                Objects.equals(pendingIntent, IntentUtil.getActionButtonPendingIntent(intent)));
+    }
+
+    @Test
+    public void testIntentWithoutActionButton() {
+        final CustomTabsIntent.Builder builder = new CustomTabsIntent.Builder();
+
+        Intent intent = builder.build().intent;
+        Assert.assertFalse(IntentUtil.hasActionButton(intent));
+        Assert.assertFalse(IntentUtil.isActionButtonTinted(intent));
+        Assert.assertNull(IntentUtil.getActionButtonIcon(intent));
+        Assert.assertNull(IntentUtil.getActionButtonDescription(intent));
+        Assert.assertNull(IntentUtil.getActionButtonPendingIntent(intent));
+    }
+
+    @Test
     public void testIntentWithCustomAnimation() {
         @AnimRes final int enterRes = 0x123; // arbitrary number as animation resource id
         @AnimRes final int exitRes = 0x456; // arbitrary number as animation resource id
 
         final CustomTabsIntent.Builder builder = new CustomTabsIntent.Builder();
         builder.setExitAnimations(spyContext, enterRes, exitRes);
         final Intent i = builder.build().intent;
 

--- a/mobile/android/tests/browser/robocop/src/org/mozilla/gecko/tests/testBrowserProvider.java
+++ b/mobile/android/tests/browser/robocop/src/org/mozilla/gecko/tests/testBrowserProvider.java
@@ -11,17 +11,17 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Random;
 
 import org.mozilla.gecko.db.BrowserContract;
 import org.mozilla.gecko.db.BrowserContract.UrlAnnotations.SyncStatus;
 import org.mozilla.gecko.db.BrowserDB;
 import org.mozilla.gecko.db.URLMetadata;
-import org.mozilla.gecko.db.URLMetadataTable;
+import org.mozilla.gecko.db.URLImageDataTable;
 
 import android.content.ContentProviderOperation;
 import android.content.ContentProviderResult;
 import android.content.ContentUris;
 import android.content.ContentValues;
 import android.content.OperationApplicationException;
 import android.database.Cursor;
 import android.net.Uri;
@@ -193,20 +193,20 @@ public class testBrowserProvider extends
         thumbnailEntry.put(BrowserContract.Thumbnails.DATA, data.getBytes("UTF8"));
 
         return thumbnailEntry;
     }
 
     private ContentValues createUrlMetadataEntry(final String url, final String tileImage, final String tileColor,
                 final String touchIcon) {
         final ContentValues values = new ContentValues();
-        values.put(URLMetadataTable.URL_COLUMN, url);
-        values.put(URLMetadataTable.TILE_IMAGE_URL_COLUMN, tileImage);
-        values.put(URLMetadataTable.TILE_COLOR_COLUMN, tileColor);
-        values.put(URLMetadataTable.TOUCH_ICON_COLUMN, touchIcon);
+        values.put(URLImageDataTable.URL_COLUMN, url);
+        values.put(URLImageDataTable.TILE_IMAGE_URL_COLUMN, tileImage);
+        values.put(URLImageDataTable.TILE_COLOR_COLUMN, tileColor);
+        values.put(URLImageDataTable.TOUCH_ICON_COLUMN, touchIcon);
         return values;
     }
 
     private ContentValues createUrlAnnotationEntry(final String url, final String key, final String value,
                 final long dateCreated) {
         final ContentValues values = new ContentValues();
         values.put(BrowserContract.UrlAnnotations.URL, url);
         values.put(BrowserContract.UrlAnnotations.KEY, key);
@@ -256,18 +256,18 @@ public class testBrowserProvider extends
     private Cursor getUrlAnnotationByUrl(final String url) throws Exception {
         return mProvider.query(BrowserContract.UrlAnnotations.CONTENT_URI, null,
                 BrowserContract.UrlAnnotations.URL + " = ?",
                 new String[] { url },
                 null);
     }
 
     private Cursor getUrlMetadataByUrl(final String url) throws Exception {
-        return mProvider.query(URLMetadataTable.CONTENT_URI, null,
-                URLMetadataTable.URL_COLUMN + " = ?",
+        return mProvider.query(URLImageDataTable.CONTENT_URI, null,
+                URLImageDataTable.URL_COLUMN + " = ?",
                 new String[] { url },
                 null);
     }
 
     @Override
     public void setUp() throws Exception {
         super.setUp(sBrowserProviderCallable, BrowserContract.AUTHORITY, "browser.db");
 
@@ -1530,19 +1530,19 @@ public class testBrowserProvider extends
         final String url2 = "http://hello.org";
 
         private void testInsertionViaContentProvider() throws Exception {
             final String tileImage = "http://mozilla.org/tileImage.png";
             final String tileColor = "#FF0000";
             final String touchIcon = "http://mozilla.org/touchIcon.png";
 
             // We can only use update since the redirection machinery doesn't exist for insert
-            mProvider.update(URLMetadataTable.CONTENT_URI.buildUpon().appendQueryParameter(BrowserContract.PARAM_INSERT_IF_NEEDED, "true").build(),
+            mProvider.update(URLImageDataTable.CONTENT_URI.buildUpon().appendQueryParameter(BrowserContract.PARAM_INSERT_IF_NEEDED, "true").build(),
                     createUrlMetadataEntry(url1, tileImage, tileColor, touchIcon),
-                    URLMetadataTable.URL_COLUMN + "=?",
+                    URLImageDataTable.URL_COLUMN + "=?",
                     new String[] {url1}
             );
 
             final Cursor c = getUrlMetadataByUrl(url1);
             try {
                 mAsserter.is(c.getCount(), 1, "URL metadata inserted via Content Provider not found");
             } finally {
                 c.close();
@@ -1550,20 +1550,20 @@ public class testBrowserProvider extends
         }
 
         private void testInsertionViaUrlMetadata() throws Exception {
             final String tileImage = "http://hello.org/tileImage.png";
             final String tileColor = "#FF0000";
             final String touchIcon = "http://hello.org/touchIcon.png";
 
             final Map<String, Object> data = new HashMap<>();
-            data.put(URLMetadataTable.URL_COLUMN, url2);
-            data.put(URLMetadataTable.TILE_IMAGE_URL_COLUMN, tileImage);
-            data.put(URLMetadataTable.TILE_COLOR_COLUMN, tileColor);
-            data.put(URLMetadataTable.TOUCH_ICON_COLUMN, touchIcon);
+            data.put(URLImageDataTable.URL_COLUMN, url2);
+            data.put(URLImageDataTable.TILE_IMAGE_URL_COLUMN, tileImage);
+            data.put(URLImageDataTable.TILE_COLOR_COLUMN, tileColor);
+            data.put(URLImageDataTable.TOUCH_ICON_COLUMN, touchIcon);
 
             BrowserDB.from(getTestProfile()).getURLMetadata().save(mResolver, data);
 
             final Cursor c = getUrlMetadataByUrl(url2);
             try {
                 mAsserter.is(c.moveToFirst(), true, "URL metadata inserted via UrlMetadata not found");
             } finally {
                 c.close();
@@ -1581,53 +1581,53 @@ public class testBrowserProvider extends
             URLMetadata metadata = BrowserDB.from(getTestProfile()).getURLMetadata();
 
             Map<String, Map<String, Object>> results;
             Map<String, Object> urlData;
 
             // 1: retrieve just touch Icons for URL 1
             results = metadata.getForURLs(mResolver,
                     Collections.singletonList(url1),
-                    Collections.singletonList(URLMetadataTable.TOUCH_ICON_COLUMN));
+                    Collections.singletonList(URLImageDataTable.TOUCH_ICON_COLUMN));
 
             mAsserter.is(results.containsKey(url1), true, "URL 1 not found in results");
 
             urlData = results.get(url1);
-            mAsserter.is(urlData.containsKey(URLMetadataTable.TOUCH_ICON_COLUMN), true, "touchIcon column missing in UrlMetadata results");
+            mAsserter.is(urlData.containsKey(URLImageDataTable.TOUCH_ICON_COLUMN), true, "touchIcon column missing in UrlMetadata results");
 
             // 2: retrieve just tile color for URL 2
             results = metadata.getForURLs(mResolver,
                     Collections.singletonList(url2),
-                    Collections.singletonList(URLMetadataTable.TILE_COLOR_COLUMN));
+                    Collections.singletonList(URLImageDataTable.TILE_COLOR_COLUMN));
 
             mAsserter.is(results.containsKey(url2), true, "URL 2 not found in results");
 
             urlData = results.get(url2);
-            mAsserter.is(urlData.containsKey(URLMetadataTable.TILE_COLOR_COLUMN), true, "touchIcon column missing in UrlMetadata results");
+            mAsserter.is(urlData.containsKey(URLImageDataTable.TILE_COLOR_COLUMN), true, "touchIcon column missing in UrlMetadata results");
 
 
             // 3: retrieve all columns for both URLs
             final List<String> urls = Arrays.asList(url1, url2);
 
             results = metadata.getForURLs(mResolver,
                     urls,
-                    Arrays.asList(URLMetadataTable.TILE_IMAGE_URL_COLUMN,
-                            URLMetadataTable.TILE_COLOR_COLUMN,
-                            URLMetadataTable.TOUCH_ICON_COLUMN
+                    Arrays.asList(URLImageDataTable.TILE_IMAGE_URL_COLUMN,
+                            URLImageDataTable.TILE_COLOR_COLUMN,
+                            URLImageDataTable.TOUCH_ICON_COLUMN
                     ));
 
             mAsserter.is(results.containsKey(url1), true, "URL 1 not found in results");
             mAsserter.is(results.containsKey(url2), true, "URL 2 not found in results");
 
 
             for (final String url : urls) {
                 urlData = results.get(url);
-                mAsserter.is(urlData.containsKey(URLMetadataTable.TILE_IMAGE_URL_COLUMN), true, "touchIcon column missing in UrlMetadata results");
-                mAsserter.is(urlData.containsKey(URLMetadataTable.TILE_COLOR_COLUMN), true, "touchIcon column missing in UrlMetadata results");
-                mAsserter.is(urlData.containsKey(URLMetadataTable.TOUCH_ICON_COLUMN), true, "touchIcon column missing in UrlMetadata results");
+                mAsserter.is(urlData.containsKey(URLImageDataTable.TILE_IMAGE_URL_COLUMN), true, "touchIcon column missing in UrlMetadata results");
+                mAsserter.is(urlData.containsKey(URLImageDataTable.TILE_COLOR_COLUMN), true, "touchIcon column missing in UrlMetadata results");
+                mAsserter.is(urlData.containsKey(URLImageDataTable.TOUCH_ICON_COLUMN), true, "touchIcon column missing in UrlMetadata results");
             }
         }
     }
 
     private class TestCombinedView extends TestCase {
         @Override
         public void test() throws Exception {
             final String TITLE_1 = "Test Page 1";

--- a/moz.configure
+++ b/moz.configure
@@ -152,16 +152,27 @@ option('--build-backends', nargs='+', de
        choices=build_backends_choices, help='Build backends to generate')
 
 @depends('--build-backends')
 def build_backends(backends):
     return backends
 
 set_config('BUILD_BACKENDS', build_backends)
 
+# Determine whether to build the gtest xul. This happens in automation
+# on Desktop platforms with the exception of Windows PGO, where linking
+# xul-gtest.dll takes too long.
+@depends('MOZ_PGO', build_project, target, 'MOZ_AUTOMATION',
+         when='--enable-compile-environment')
+def build_gtest(pgo, build_project, target, automation):
+    if (automation and build_project == 'browser' and
+        not (pgo and target.os == 'WINNT')):
+        return True
+
+set_config('LINK_GTEST_DURING_COMPILE', build_gtest)
 
 # Awk detection
 # ==============================================================
 awk = check_prog('AWK', ('gawk', 'mawk', 'nawk', 'awk'))
 
 # Until the AWK variable is not necessary in old-configure
 @depends(awk)
 def awk_for_old_configure(value):

--- a/netwerk/base/nsDirectoryIndexStream.cpp
+++ b/netwerk/base/nsDirectoryIndexStream.cpp
@@ -17,18 +17,16 @@
 #include "nsEscape.h"
 #include "nsDirectoryIndexStream.h"
 #include "mozilla/Logging.h"
 #include "prtime.h"
 #include "nsISimpleEnumerator.h"
 #ifdef THREADSAFE_I18N
 #include "nsCollationCID.h"
 #include "nsICollation.h"
-#include "nsILocale.h"
-#include "nsILocaleService.h"
 #endif
 #include "nsIFile.h"
 #include "nsURLHelper.h"
 #include "nsNativeCharsetUtils.h"
 
 // NOTE: This runs on the _file transport_ thread.
 // The problem is that now that we're actually doing something with the data,
 // we want to do stuff like i18n sorting. However, none of the collation stuff
@@ -115,30 +113,22 @@ nsDirectoryIndexStream::Init(nsIFile* aD
         if (NS_SUCCEEDED(rv)) {
             nsCOMPtr<nsIFile> file = do_QueryInterface(elem);
             if (file)
                 mArray.AppendObject(file); // addrefs
         }
     }
 
 #ifdef THREADSAFE_I18N
-    nsCOMPtr<nsILocaleService> ls = do_GetService(NS_LOCALESERVICE_CONTRACTID,
-                                                  &rv);
-    if (NS_FAILED(rv)) return rv;
-
-    nsCOMPtr<nsILocale> locale;
-    rv = ls->GetApplicationLocale(getter_AddRefs(locale));
-    if (NS_FAILED(rv)) return rv;
-    
     nsCOMPtr<nsICollationFactory> cf = do_CreateInstance(NS_COLLATIONFACTORY_CONTRACTID,
                                                          &rv);
     if (NS_FAILED(rv)) return rv;
 
     nsCOMPtr<nsICollation> coll;
-    rv = cf->CreateCollation(locale, getter_AddRefs(coll));
+    rv = cf->CreateCollation(getter_AddRefs(coll));
     if (NS_FAILED(rv)) return rv;
 
     mArray.Sort(compare, coll);
 #else
     mArray.Sort(compare, nullptr);
 #endif
 
     mBuf.AppendLiteral("300: ");

--- a/netwerk/protocol/about/nsAboutCache.cpp
+++ b/netwerk/protocol/about/nsAboutCache.cpp
@@ -560,17 +560,17 @@ nsAboutCache::Channel::FlushBuffer()
     }
 
     return rv;
 }
 
 NS_IMETHODIMP
 nsAboutCache::GetURIFlags(nsIURI *aURI, uint32_t *result)
 {
-    *result = 0;
+    *result = nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT;
     return NS_OK;
 }
 
 // static
 nsresult
 nsAboutCache::Create(nsISupports *aOuter, REFNSIID aIID, void **aResult)
 {
     nsAboutCache* about = new nsAboutCache();

--- a/netwerk/protocol/about/nsAboutCacheEntry.cpp
+++ b/netwerk/protocol/about/nsAboutCacheEntry.cpp
@@ -107,17 +107,18 @@ nsAboutCacheEntry::NewChannel(nsIURI* ur
     channel.forget(result);
 
     return NS_OK;
 }
 
 NS_IMETHODIMP
 nsAboutCacheEntry::GetURIFlags(nsIURI *aURI, uint32_t *result)
 {
-    *result = nsIAboutModule::HIDE_FROM_ABOUTABOUT;
+    *result = nsIAboutModule::HIDE_FROM_ABOUTABOUT |
+              nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT;
     return NS_OK;
 }
 
 //-----------------------------------------------------------------------------
 // nsAboutCacheEntry::Channel
 
 nsresult
 nsAboutCacheEntry::Channel::Init(nsIURI* uri, nsILoadInfo* aLoadInfo)

--- a/netwerk/test/browser/browser.ini
+++ b/netwerk/test/browser/browser.ini
@@ -1,10 +1,11 @@
 [DEFAULT]
 support-files =
   dummy.html
 
+[browser_about_cache.js]
 [browser_NetUtil.js]
 [browser_child_resource.js]
 skip-if = e10s && debug && os == "linux" && bits == 64
 [browser_post_file.js]
 [browser_nsIFormPOSTActionChannel.js]
 skip-if = e10s # protocol handler and channel does not work in content process

new file mode 100644
--- /dev/null
+++ b/netwerk/test/browser/browser_about_cache.js
@@ -0,0 +1,71 @@
+"use strict";
+
+/**
+ * Open a dummy page, then open about:cache and verify the opened page shows up in the cache.
+ */
+add_task(function*() {
+  const kRoot = getRootDirectory(gTestPath).replace("chrome://mochitests/content/",
+                                                    "https://example.com/");
+  const kTestPage = kRoot + "dummy.html";
+  // Open the dummy page to get it cached.
+  let tab = yield BrowserTestUtils.openNewForegroundTab(gBrowser, kTestPage, true);
+  yield BrowserTestUtils.removeTab(tab);
+
+  tab = yield BrowserTestUtils.openNewForegroundTab(gBrowser, "about:cache", true);
+  let expectedPageCheck = function(uri) {
+    info("Saw load for " + uri);
+    // Can't easily use searchParms and new URL() because it's an about: URI...
+    return uri.startsWith("about:cache?") && uri.includes("storage=disk");
+  };
+  let diskPageLoaded = BrowserTestUtils.browserLoaded(tab.linkedBrowser, false, expectedPageCheck);
+  yield ContentTask.spawn(tab.linkedBrowser, null, function() {
+    ok(!content.document.nodePrincipal.isSystemPrincipal,
+       "about:cache should not have system principal");
+    let principalURI = content.document.nodePrincipal.URI;
+    let channel = content.document.docShell.currentDocumentChannel;
+    ok(!channel.loadInfo.loadingPrincipal, "Loading principal should be null.");
+    is(principalURI && principalURI.spec, content.document.location.href, "Principal matches location");
+    let links = [... content.document.querySelectorAll("a[href*=disk]")];
+    is(links.length, 1, "Should have 1 link to the disk entries");
+    links[0].click();
+  });
+  yield diskPageLoaded;
+  info("about:cache disk subpage loaded");
+
+  expectedPageCheck = function(uri) {
+    info("Saw load for " + uri);
+    return uri.startsWith("about:cache-entry") && uri.includes("dummy.html");
+  };
+  let triggeringURISpec = tab.linkedBrowser.currentURI.spec;
+  let entryLoaded = BrowserTestUtils.browserLoaded(tab.linkedBrowser, false, expectedPageCheck);
+  yield ContentTask.spawn(tab.linkedBrowser, kTestPage, function(kTestPage) {
+    ok(!content.document.nodePrincipal.isSystemPrincipal,
+       "about:cache with query params should still not have system principal");
+    let principalURI = content.document.nodePrincipal.URI;
+    is(principalURI && principalURI.spec, content.document.location.href, "Principal matches location");
+    let channel = content.document.docShell.currentDocumentChannel;
+    principalURI = channel.loadInfo.triggeringPrincipal.URI;
+    is(principalURI && principalURI.spec, "about:cache", "Triggering principal matches previous location");
+    ok(!channel.loadInfo.loadingPrincipal, "Loading principal should be null.");
+    let links = [... content.document.querySelectorAll("a[href*='" + kTestPage + "']")];
+    is(links.length, 1, "Should have 1 link to the entry for " + kTestPage);
+    links[0].click();
+  });
+  yield entryLoaded;
+  info("about:cache entry loaded");
+
+
+  yield ContentTask.spawn(tab.linkedBrowser, triggeringURISpec, function(triggeringURISpec) {
+    ok(!content.document.nodePrincipal.isSystemPrincipal,
+       "about:cache-entry should also not have system principal");
+    let principalURI = content.document.nodePrincipal.URI;
+    is(principalURI && principalURI.spec, content.document.location.href, "Principal matches location");
+    let channel = content.document.docShell.currentDocumentChannel;
+    principalURI = channel.loadInfo.triggeringPrincipal.URI;
+    is(principalURI && principalURI.spec, triggeringURISpec, "Triggering principal matches previous location");
+    ok(!channel.loadInfo.loadingPrincipal, "Loading principal should be null.");
+    ok(content.document.querySelectorAll("th").length,
+       "Should have several table headers with data.");
+  });
+  yield BrowserTestUtils.removeTab(tab);
+});