--- a/accessible/generic/DocAccessible.cpp
+++ b/accessible/generic/DocAccessible.cpp
@@ -2067,17 +2067,20 @@ DocAccessible::DoARIAOwnsRelocation(Acce
   }
 }
 
 bool
 DocAccessible::SeizeChild(Accessible* aNewParent, Accessible* aChild,
                           int32_t aIdxInParent)
 {
   Accessible* oldParent = aChild->Parent();
-  NS_PRECONDITION(oldParent, "No parent?");
+  if (!oldParent) {
+    NS_ERROR("No parent? The tree is broken!");
+    return false;
+  }
 
   int32_t oldIdxInParent = aChild->IndexInParent();
 
   RefPtr<AccReorderEvent> reorderEvent = new AccReorderEvent(oldParent);
   RefPtr<AccMutationEvent> hideEvent =
     new AccHideEvent(aChild, aChild->GetContent(), false);
   reorderEvent->AddSubMutationEvent(hideEvent);
 
@@ -2155,16 +2158,20 @@ DocAccessible::PutChildrenBack(nsTArray<
 {
   nsTArray<Accessible*> containers;
   for (auto idx = aStartIdx; idx < aChildren->Length(); idx++) {
     Accessible* child = aChildren->ElementAt(idx);
 
     // If the child is in the tree then remove it from the owner.
     if (child->IsInDocument()) {
       Accessible* owner = child->Parent();
+      if (!owner) {
+        NS_ERROR("Cannot put the child back. No parent, a broken tree.");
+        continue;
+      }
       RefPtr<AccReorderEvent> reorderEvent = new AccReorderEvent(owner);
       RefPtr<AccMutationEvent> hideEvent =
         new AccHideEvent(child, child->GetContent(), false);
       reorderEvent->AddSubMutationEvent(hideEvent);
 
       {
         AutoTreeMutation mut(owner);
         owner->RemoveChild(child);

--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@@ -1023,16 +1023,20 @@ pref("apz.fling_curve_function_x1", "0.4
 pref("apz.fling_curve_function_y1", "0.0");
 pref("apz.fling_curve_function_x2", "0.80");
 pref("apz.fling_curve_function_y2", "1.0");
 pref("apz.fling_curve_threshold_inches_per_ms", "0.01");
 pref("apz.fling_friction", "0.0019");
 pref("apz.max_velocity_inches_per_ms", "0.07");
 pref("apz.touch_start_tolerance", "0.1");
 
+#ifdef MOZ_WIDGET_GONK
+pref("apz.touch_move_tolerance", "0.03");
+#endif
+
 // Tweak default displayport values to reduce the risk of running out of
 // memory when zooming in
 pref("apz.x_skate_size_multiplier", "1.25");
 pref("apz.y_skate_size_multiplier", "1.5");
 pref("apz.x_stationary_size_multiplier", "1.5");
 pref("apz.y_stationary_size_multiplier", "1.8");
 pref("apz.enlarge_displayport_when_clipped", true);
 // Use "sticky" axis locking

--- a/dom/base/nsContentIterator.cpp
+++ b/dom/base/nsContentIterator.cpp
@@ -25,31 +25,32 @@ static nsINode*
 NodeToParentOffset(nsINode* aNode, int32_t* aOffset)
 {
   *aOffset = 0;
 
   nsINode* parent = aNode->GetParentNode();
 
   if (parent) {
     *aOffset = parent->IndexOf(aNode);
+    NS_WARN_IF(*aOffset < 0);
   }
 
   return parent;
 }
 
 ///////////////////////////////////////////////////////////////////////////
 // NodeIsInTraversalRange: returns true if content is visited during
 // the traversal of the range in the specified mode.
 //
 static bool
 NodeIsInTraversalRange(nsINode* aNode, bool aIsPreMode,
                        nsINode* aStartNode, int32_t aStartOffset,
                        nsINode* aEndNode, int32_t aEndOffset)
 {
-  if (!aStartNode || !aEndNode || !aNode) {
+  if (NS_WARN_IF(!aStartNode) || NS_WARN_IF(!aEndNode) || NS_WARN_IF(!aNode)) {
     return false;
   }
 
   // If a leaf node contains an end point of the traversal range, it is
   // always in the traversal range.
   if (aNode == aStartNode || aNode == aEndNode) {
     if (aNode->IsNodeOfType(nsINode::eDATA_NODE)) {
       return true; // text node or something
@@ -66,16 +67,17 @@ NodeIsInTraversalRange(nsINode* aNode, b
   }
 
   nsINode* parent = aNode->GetParentNode();
   if (!parent) {
     return false;
   }
 
   int32_t indx = parent->IndexOf(aNode);
+  NS_WARN_IF(indx == -1);
 
   if (!aIsPreMode) {
     ++indx;
   }
 
   return nsContentUtils::ComparePoints(aStartNode, aStartOffset,
                                        parent, indx) <= 0 &&
          nsContentUtils::ComparePoints(aEndNode, aEndOffset,
@@ -257,58 +259,70 @@ nsContentIterator::~nsContentIterator()
 /******************************************************
  * Init routines
  ******************************************************/
 
 
 nsresult
 nsContentIterator::Init(nsINode* aRoot)
 {
-  if (!aRoot) {
+  if (NS_WARN_IF(!aRoot)) {
     return NS_ERROR_NULL_POINTER;
   }
 
   mIsDone = false;
   mIndexes.Clear();
 
   if (mPre) {
     mFirst = aRoot;
     mLast  = GetDeepLastChild(aRoot);
+    NS_WARN_IF(!mLast);
   } else {
     mFirst = GetDeepFirstChild(aRoot);
+    NS_WARN_IF(!mFirst);
     mLast  = aRoot;
   }
 
   mCommonParent = aRoot;
   mCurNode = mFirst;
   RebuildIndexStack();
   return NS_OK;
 }
 
 nsresult
 nsContentIterator::Init(nsIDOMRange* aDOMRange)
 {
-  NS_ENSURE_ARG_POINTER(aDOMRange);
+  if (NS_WARN_IF(!aDOMRange)) {
+    return NS_ERROR_INVALID_ARG;
+  }
   nsRange* range = static_cast<nsRange*>(aDOMRange);
 
   mIsDone = false;
 
   // get common content parent
   mCommonParent = range->GetCommonAncestor();
-  NS_ENSURE_TRUE(mCommonParent, NS_ERROR_FAILURE);
+  if (NS_WARN_IF(!mCommonParent)) {
+    return NS_ERROR_FAILURE;
+  }
 
   // get the start node and offset
   int32_t startIndx = range->StartOffset();
+  NS_WARN_IF(startIndx < 0);
   nsINode* startNode = range->GetStartParent();
-  NS_ENSURE_TRUE(startNode, NS_ERROR_FAILURE);
+  if (NS_WARN_IF(!startNode)) {
+    return NS_ERROR_FAILURE;
+  }
 
   // get the end node and offset
   int32_t endIndx = range->EndOffset();
+  NS_WARN_IF(endIndx < 0);
   nsINode* endNode = range->GetEndParent();
-  NS_ENSURE_TRUE(endNode, NS_ERROR_FAILURE);
+  if (NS_WARN_IF(!endNode)) {
+    return NS_ERROR_FAILURE;
+  }
 
   bool startIsData = startNode->IsNodeOfType(nsINode::eDATA_NODE);
 
   // short circuit when start node == end node
   if (startNode == endNode) {
     // Check to see if we have a collapsed range, if so, there is nothing to
     // iterate over.
     //
@@ -322,27 +336,29 @@ nsContentIterator::Init(nsIDOMRange* aDO
     }
 
     if (startIsData) {
       // It's a character data node.
       mFirst   = startNode->AsContent();
       mLast    = mFirst;
       mCurNode = mFirst;
 
-      RebuildIndexStack();
+      nsresult rv = RebuildIndexStack();
+      NS_WARN_IF(NS_FAILED(rv));
       return NS_OK;
     }
   }
 
   // Find first node in range.
 
   nsIContent* cChild = nullptr;
 
   if (!startIsData && startNode->HasChildren()) {
     cChild = startNode->GetChildAt(startIndx);
+    NS_WARN_IF(!cChild);
   }
 
   if (!cChild) {
     // no children, must be a text node
     //
     // XXXbz no children might also just mean no children.  So I'm not
     // sure what that comment above is talking about.
 
@@ -351,131 +367,142 @@ nsContentIterator::Init(nsIDOMRange* aDO
       //      character in the cdata node, should we set mFirst to
       //      the next sibling?
 
       // If the node has no child, the child may be <br> or something.
       // So, we shouldn't skip the empty node if the start offset is 0.
       // In other words, if the offset is 1, the node should be ignored.
       if (!startIsData && startIndx) {
         mFirst = GetNextSibling(startNode);
+        NS_WARN_IF(!mFirst);
 
         // Does mFirst node really intersect the range?  The range could be
         // 'degenerate', i.e., not collapsed but still contain no content.
-        if (mFirst && !NodeIsInTraversalRange(mFirst, mPre, startNode,
-                                              startIndx, endNode, endIndx)) {
+        if (mFirst &&
+            NS_WARN_IF(!NodeIsInTraversalRange(mFirst, mPre, startNode,
+                                               startIndx, endNode, endIndx))) {
           mFirst = nullptr;
         }
       } else {
         mFirst = startNode->AsContent();
       }
     } else {
       // post-order
-      if (startNode->IsContent()) {
-        mFirst = startNode->AsContent();
-      } else {
+      if (NS_WARN_IF(!startNode->IsContent())) {
         // What else can we do?
         mFirst = nullptr;
+      } else {
+        mFirst = startNode->AsContent();
       }
     }
   } else {
     if (mPre) {
       mFirst = cChild;
     } else {
       // post-order
       mFirst = GetDeepFirstChild(cChild);
+      NS_WARN_IF(!mFirst);
 
       // Does mFirst node really intersect the range?  The range could be
       // 'degenerate', i.e., not collapsed but still contain no content.
 
-      if (mFirst && !NodeIsInTraversalRange(mFirst, mPre, startNode, startIndx,
-                                            endNode, endIndx)) {
+      if (mFirst &&
+          NS_WARN_IF(!NodeIsInTraversalRange(mFirst, mPre, startNode, startIndx,
+                                             endNode, endIndx))) {
         mFirst = nullptr;
       }
     }
   }
 
 
   // Find last node in range.
 
   bool endIsData = endNode->IsNodeOfType(nsINode::eDATA_NODE);
 
   if (endIsData || !endNode->HasChildren() || endIndx == 0) {
     if (mPre) {
-      if (endNode->IsContent()) {
+      if (NS_WARN_IF(!endNode->IsContent())) {
+        // Not much else to do here...
+        mLast = nullptr;
+      } else {
         // If the end node is an empty element and the end offset is 0,
         // the last element should be the previous node (i.e., shouldn't
         // include the end node in the range).
         if (!endIsData && !endNode->HasChildren() && !endIndx) {
           mLast = GetPrevSibling(endNode);
-          if (!NodeIsInTraversalRange(mLast, mPre, startNode, startIndx,
-                                      endNode, endIndx)) {
+          NS_WARN_IF(!mLast);
+          if (NS_WARN_IF(!NodeIsInTraversalRange(mLast, mPre,
+                                                 startNode, startIndx,
+                                                 endNode, endIndx))) {
             mLast = nullptr;
           }
         } else {
           mLast = endNode->AsContent();
         }
-      } else {
-        // Not much else to do here...
-        mLast = nullptr;
       }
     } else {
       // post-order
       //
       // XXX: In the future, if end offset is before the first character in the
       //      cdata node, should we set mLast to the prev sibling?
 
       if (!endIsData) {
         mLast = GetPrevSibling(endNode);
+        NS_WARN_IF(!mLast);
 
-        if (!NodeIsInTraversalRange(mLast, mPre, startNode, startIndx,
-                                    endNode, endIndx)) {
+        if (NS_WARN_IF(!NodeIsInTraversalRange(mLast, mPre,
+                                               startNode, startIndx,
+                                               endNode, endIndx))) {
           mLast = nullptr;
         }
       } else {
         mLast = endNode->AsContent();
       }
     }
   } else {
     int32_t indx = endIndx;
 
     cChild = endNode->GetChildAt(--indx);
 
-    if (!cChild) {
+    if (NS_WARN_IF(!cChild)) {
       // No child at offset!
       NS_NOTREACHED("nsContentIterator::nsContentIterator");
       return NS_ERROR_FAILURE;
     }
 
     if (mPre) {
       mLast  = GetDeepLastChild(cChild);
+      NS_WARN_IF(!mLast);
 
-      if (!NodeIsInTraversalRange(mLast, mPre, startNode, startIndx,
-                                  endNode, endIndx)) {
+      if (NS_WARN_IF(!NodeIsInTraversalRange(mLast, mPre,
+                                             startNode, startIndx,
+                                             endNode, endIndx))) {
         mLast = nullptr;
       }
     } else {
       // post-order
       mLast = cChild;
     }
   }
 
   // If either first or last is null, they both have to be null!
 
-  if (!mFirst || !mLast) {
+  if (NS_WARN_IF(!mFirst) || NS_WARN_IF(!mLast)) {
     mFirst = nullptr;
     mLast  = nullptr;
   }
 
   mCurNode = mFirst;
   mIsDone  = !mCurNode;
 
   if (!mCurNode) {
     mIndexes.Clear();
   } else {
-    RebuildIndexStack();
+    nsresult rv = RebuildIndexStack();
+    NS_WARN_IF(NS_FAILED(rv));
   }
 
   return NS_OK;
 }
 
 
 /******************************************************
  * Helper routines
@@ -494,17 +521,17 @@ nsContentIterator::RebuildIndexStack()
   current = mCurNode;
   if (!current) {
     return NS_OK;
   }
 
   while (current != mCommonParent) {
     parent = current->GetParentNode();
 
-    if (!parent) {
+    if (NS_WARN_IF(!parent)) {
       return NS_ERROR_FAILURE;
     }
 
     mIndexes.InsertElementAt(0, parent->IndexOf(current));
 
     current = parent;
   }
 
@@ -521,33 +548,33 @@ nsContentIterator::MakeEmpty()
   mIsDone       = true;
   mIndexes.Clear();
 }
 
 nsINode*
 nsContentIterator::GetDeepFirstChild(nsINode* aRoot,
                                      nsTArray<int32_t>* aIndexes)
 {
-  if (!aRoot || !aRoot->HasChildren()) {
+  if (NS_WARN_IF(!aRoot) || !aRoot->HasChildren()) {
     return aRoot;
   }
   // We can't pass aRoot itself to the full GetDeepFirstChild, because that
   // will only take nsIContent and aRoot might be a document.  Pass aRoot's
   // child, but be sure to preserve aIndexes.
   if (aIndexes) {
     aIndexes->AppendElement(0);
   }
   return GetDeepFirstChild(aRoot->GetFirstChild(), aIndexes);
 }
 
 nsIContent*
 nsContentIterator::GetDeepFirstChild(nsIContent* aRoot,
                                      nsTArray<int32_t>* aIndexes)
 {
-  if (!aRoot) {
+  if (NS_WARN_IF(!aRoot)) {
     return nullptr;
   }
 
   nsIContent* node = aRoot;
   nsIContent* child = node->GetFirstChild();
 
   while (child) {
     if (aIndexes) {
@@ -560,33 +587,33 @@ nsContentIterator::GetDeepFirstChild(nsI
 
   return node;
 }
 
 nsINode*
 nsContentIterator::GetDeepLastChild(nsINode* aRoot,
                                     nsTArray<int32_t>* aIndexes)
 {
-  if (!aRoot || !aRoot->HasChildren()) {
+  if (NS_WARN_IF(!aRoot) || !aRoot->HasChildren()) {
     return aRoot;
   }
   // We can't pass aRoot itself to the full GetDeepLastChild, because that will
   // only take nsIContent and aRoot might be a document.  Pass aRoot's child,
   // but be sure to preserve aIndexes.
   if (aIndexes) {
     aIndexes->AppendElement(aRoot->GetChildCount() - 1);
   }
   return GetDeepLastChild(aRoot->GetLastChild(), aIndexes);
 }
 
 nsIContent*
 nsContentIterator::GetDeepLastChild(nsIContent* aRoot,
                                     nsTArray<int32_t>* aIndexes)
 {
-  if (!aRoot) {
+  if (NS_WARN_IF(!aRoot)) {
     return nullptr;
   }
 
   nsIContent* node = aRoot;
   int32_t numChildren = node->GetChildCount();
 
   while (numChildren) {
     nsIContent* child = node->GetChildAt(--numChildren);
@@ -602,43 +629,45 @@ nsContentIterator::GetDeepLastChild(nsIC
   return node;
 }
 
 // Get the next sibling, or parent's next sibling, or grandpa's next sibling...
 nsIContent*
 nsContentIterator::GetNextSibling(nsINode* aNode,
                                   nsTArray<int32_t>* aIndexes)
 {
-  if (!aNode) {
+  if (NS_WARN_IF(!aNode)) {
     return nullptr;
   }
 
   nsINode* parent = aNode->GetParentNode();
-  if (!parent) {
+  if (NS_WARN_IF(!parent)) {
     return nullptr;
   }
 
   int32_t indx = 0;
 
   NS_ASSERTION(!aIndexes || !aIndexes->IsEmpty(),
                "ContentIterator stack underflow");
   if (aIndexes && !aIndexes->IsEmpty()) {
     // use the last entry on the Indexes array for the current index
     indx = (*aIndexes)[aIndexes->Length()-1];
   } else {
     indx = mCachedIndex;
   }
+  NS_WARN_IF(indx < 0);
 
   // reverify that the index of the current node hasn't changed.
   // not super cheap, but a lot cheaper than IndexOf(), and still O(1).
   // ignore result this time - the index may now be out of range.
   nsIContent* sib = parent->GetChildAt(indx);
   if (sib != aNode) {
     // someone changed our index - find the new index the painful way
     indx = parent->IndexOf(aNode);
+    NS_WARN_IF(indx < 0);
   }
 
   // indx is now canonically correct
   if ((sib = parent->GetChildAt(++indx))) {
     // update index cache
     if (aIndexes && !aIndexes->IsEmpty()) {
       aIndexes->ElementAt(aIndexes->Length()-1) = indx;
     } else {
@@ -663,22 +692,22 @@ nsContentIterator::GetNextSibling(nsINod
   return sib;
 }
 
 // Get the prev sibling, or parent's prev sibling, or grandpa's prev sibling...
 nsIContent*
 nsContentIterator::GetPrevSibling(nsINode* aNode,
                                   nsTArray<int32_t>* aIndexes)
 {
-  if (!aNode) {
+  if (NS_WARN_IF(!aNode)) {
     return nullptr;
   }
 
   nsINode* parent = aNode->GetParentNode();
-  if (!parent) {
+  if (NS_WARN_IF(!parent)) {
     return nullptr;
   }
 
   int32_t indx = 0;
 
   NS_ASSERTION(!aIndexes || !aIndexes->IsEmpty(),
                "ContentIterator stack underflow");
   if (aIndexes && !aIndexes->IsEmpty()) {
@@ -689,16 +718,17 @@ nsContentIterator::GetPrevSibling(nsINod
   }
 
   // reverify that the index of the current node hasn't changed
   // ignore result this time - the index may now be out of range.
   nsIContent* sib = parent->GetChildAt(indx);
   if (sib != aNode) {
     // someone changed our index - find the new index the painful way
     indx = parent->IndexOf(aNode);
+    NS_WARN_IF(indx < 0);
   }
 
   // indx is now canonically correct
   if (indx > 0 && (sib = parent->GetChildAt(--indx))) {
     // update index cache
     if (aIndexes && !aIndexes->IsEmpty()) {
       aIndexes->ElementAt(aIndexes->Length()-1) = indx;
     } else {
@@ -720,16 +750,17 @@ nsContentIterator::NextNode(nsINode* aNo
 {
   nsINode* node = aNode;
 
   // if we are a Pre-order iterator, use pre-order
   if (mPre) {
     // if it has children then next node is first child
     if (node->HasChildren()) {
       nsIContent* firstChild = node->GetFirstChild();
+      MOZ_ASSERT(firstChild);
 
       // update cache
       if (aIndexes) {
         // push an entry on the index stack
         aIndexes->AppendElement(0);
       } else {
         mCachedIndex = 0;
       }
@@ -738,16 +769,17 @@ nsContentIterator::NextNode(nsINode* aNo
     }
 
     // else next sibling is next
     return GetNextSibling(node, aIndexes);
   }
 
   // post-order
   nsINode* parent = node->GetParentNode();
+  NS_WARN_IF(!parent);
   nsIContent* sibling = nullptr;
   int32_t indx = 0;
 
   // get the cached index
   NS_ASSERTION(!aIndexes || !aIndexes->IsEmpty(),
                "ContentIterator stack underflow");
   if (aIndexes && !aIndexes->IsEmpty()) {
     // use the last entry on the Indexes array for the current index
@@ -760,16 +792,17 @@ nsContentIterator::NextNode(nsINode* aNo
   // cheap, but a lot cheaper than IndexOf(), and still O(1).  ignore result
   // this time - the index may now be out of range.
   if (indx >= 0) {
     sibling = parent->GetChildAt(indx);
   }
   if (sibling != node) {
     // someone changed our index - find the new index the painful way
     indx = parent->IndexOf(node);
+    NS_WARN_IF(indx < 0);
   }
 
   // indx is now canonically correct
   sibling = parent->GetChildAt(++indx);
   if (sibling) {
     // update cache
     if (aIndexes && !aIndexes->IsEmpty()) {
       // replace an entry on the index stack
@@ -801,16 +834,17 @@ nsContentIterator::NextNode(nsINode* aNo
 nsINode*
 nsContentIterator::PrevNode(nsINode* aNode, nsTArray<int32_t>* aIndexes)
 {
   nsINode* node = aNode;
 
   // if we are a Pre-order iterator, use pre-order
   if (mPre) {
     nsINode* parent = node->GetParentNode();
+    NS_WARN_IF(!parent);
     nsIContent* sibling = nullptr;
     int32_t indx = 0;
 
     // get the cached index
     NS_ASSERTION(!aIndexes || !aIndexes->IsEmpty(),
                  "ContentIterator stack underflow");
     if (aIndexes && !aIndexes->IsEmpty()) {
       // use the last entry on the Indexes array for the current index
@@ -819,21 +853,23 @@ nsContentIterator::PrevNode(nsINode* aNo
       indx = mCachedIndex;
     }
 
     // reverify that the index of the current node hasn't changed.  not super
     // cheap, but a lot cheaper than IndexOf(), and still O(1).  ignore result
     // this time - the index may now be out of range.
     if (indx >= 0) {
       sibling = parent->GetChildAt(indx);
+      NS_WARN_IF(!sibling);
     }
 
     if (sibling != node) {
       // someone changed our index - find the new index the painful way
       indx = parent->IndexOf(node);
+      NS_WARN_IF(indx < 0);
     }
 
     // indx is now canonically correct
     if (indx && (sibling = parent->GetChildAt(--indx))) {
       // update cache
       if (aIndexes && !aIndexes->IsEmpty()) {
         // replace an entry on the index stack
         aIndexes->ElementAt(aIndexes->Length()-1) = indx;
@@ -853,20 +889,22 @@ nsContentIterator::PrevNode(nsINode* aNo
       // this might be wrong, but we are better off guessing
       mCachedIndex = 0;
     }
     return parent;
   }
 
   // post-order
   int32_t numChildren = node->GetChildCount();
+  NS_WARN_IF(numChildren < 0);
 
   // if it has children then prev node is last child
   if (numChildren) {
     nsIContent* lastChild = node->GetLastChild();
+    NS_WARN_IF(!lastChild);
     numChildren--;
 
     // update cache
     if (aIndexes) {
       // push an entry on the index stack
       aIndexes->AppendElement(numChildren);
     } else {
       mCachedIndex = numChildren;
@@ -882,66 +920,58 @@ nsContentIterator::PrevNode(nsINode* aNo
 /******************************************************
  * ContentIterator routines
  ******************************************************/
 
 void
 nsContentIterator::First()
 {
   if (mFirst) {
-#ifdef DEBUG
-    nsresult rv =
-#endif
-    PositionAt(mFirst);
-
+    DebugOnly<nsresult> rv = PositionAt(mFirst);
     NS_ASSERTION(NS_SUCCEEDED(rv), "Failed to position iterator!");
   }
 
   mIsDone = mFirst == nullptr;
 }
 
 
 void
 nsContentIterator::Last()
 {
   NS_ASSERTION(mLast, "No last node!");
 
   if (mLast) {
-#ifdef DEBUG
-    nsresult rv =
-#endif
-    PositionAt(mLast);
-
+    DebugOnly<nsresult> rv = PositionAt(mLast);
     NS_ASSERTION(NS_SUCCEEDED(rv), "Failed to position iterator!");
   }
 
   mIsDone = mLast == nullptr;
 }
 
 
 void
 nsContentIterator::Next()
 {
-  if (mIsDone || !mCurNode) {
+  if (mIsDone || NS_WARN_IF(!mCurNode)) {
     return;
   }
 
   if (mCurNode == mLast) {
     mIsDone = true;
     return;
   }
 
   mCurNode = NextNode(mCurNode, &mIndexes);
 }
 
 
 void
 nsContentIterator::Prev()
 {
-  if (mIsDone || !mCurNode) {
+  if (NS_WARN_IF(mIsDone) || NS_WARN_IF(!mCurNode)) {
     return;
   }
 
   if (mCurNode == mFirst) {
     mIsDone = true;
     return;
   }
 
@@ -956,17 +986,17 @@ nsContentIterator::IsDone()
 }
 
 
 // Keeping arrays of indexes for the stack of nodes makes PositionAt
 // interesting...
 nsresult
 nsContentIterator::PositionAt(nsINode* aCurNode)
 {
-  if (!aCurNode) {
+  if (NS_WARN_IF(!aCurNode)) {
     return NS_ERROR_NULL_POINTER;
   }
 
   nsINode* newCurNode = aCurNode;
   nsINode* tempNode = mCurNode;
 
   mCurNode = aCurNode;
   // take an early out if this doesn't actually change the position
@@ -979,44 +1009,54 @@ nsContentIterator::PositionAt(nsINode* a
 
   nsINode* firstNode = mFirst;
   nsINode* lastNode = mLast;
   int32_t firstOffset = 0, lastOffset = 0;
 
   if (firstNode && lastNode) {
     if (mPre) {
       firstNode = NodeToParentOffset(mFirst, &firstOffset);
+      NS_WARN_IF(!firstNode);
+      NS_WARN_IF(firstOffset < 0);
 
       if (lastNode->GetChildCount()) {
         lastOffset = 0;
       } else {
         lastNode = NodeToParentOffset(mLast, &lastOffset);
+        NS_WARN_IF(!lastNode);
+        NS_WARN_IF(lastOffset < 0);
         ++lastOffset;
       }
     } else {
       uint32_t numChildren = firstNode->GetChildCount();
 
       if (numChildren) {
         firstOffset = numChildren;
+        NS_WARN_IF(firstOffset < 0);
       } else {
         firstNode = NodeToParentOffset(mFirst, &firstOffset);
+        NS_WARN_IF(!firstNode);
+        NS_WARN_IF(firstOffset < 0);
       }
 
       lastNode = NodeToParentOffset(mLast, &lastOffset);
+      NS_WARN_IF(!lastNode);
+      NS_WARN_IF(lastOffset < 0);
       ++lastOffset;
     }
   }
 
   // The end positions are always in the range even if it has no parent.  We
   // need to allow that or 'iter->Init(root)' would assert in Last() or First()
   // for example, bug 327694.
   if (mFirst != mCurNode && mLast != mCurNode &&
-      (!firstNode || !lastNode ||
-       !NodeIsInTraversalRange(mCurNode, mPre, firstNode, firstOffset,
-                               lastNode, lastOffset))) {
+      (NS_WARN_IF(!firstNode) || NS_WARN_IF(!lastNode) ||
+       NS_WARN_IF(!NodeIsInTraversalRange(mCurNode, mPre,
+                                          firstNode, firstOffset,
+                                          lastNode, lastOffset)))) {
     mIsDone = true;
     return NS_ERROR_FAILURE;
   }
 
   // We can be at ANY node in the sequence.  Need to regenerate the array of
   // indexes back to the root or common parent!
   nsAutoTArray<nsINode*, 8>     oldParentStack;
   nsAutoTArray<int32_t, 8>      newIndexes;
@@ -1035,17 +1075,17 @@ nsContentIterator::PositionAt(nsINode* a
   // for loop, and mIndexes only has entries for nodes from tempNode up through
   // an ancestor of tempNode that's a child of mCommonParent.
   for (int32_t i = mIndexes.Length() + 1; i > 0 && tempNode; i--) {
     // Insert at head since we're walking up
     oldParentStack.InsertElementAt(0, tempNode);
 
     nsINode* parent = tempNode->GetParentNode();
 
-    if (!parent) {
+    if (NS_WARN_IF(!parent)) {
       // this node has no parent, and thus no index
       break;
     }
 
     if (parent == mCurNode) {
       // The position was moved to a parent of the current position.  All we
       // need to do is drop some indexes.  Shortcut here.
       mIndexes.RemoveElementsAt(mIndexes.Length() - oldParentStack.Length(),
@@ -1055,22 +1095,23 @@ nsContentIterator::PositionAt(nsINode* a
     }
     tempNode = parent;
   }
 
   // Ok.  We have the array of old parents.  Look for a match.
   while (newCurNode) {
     nsINode* parent = newCurNode->GetParentNode();
 
-    if (!parent) {
+    if (NS_WARN_IF(!parent)) {
       // this node has no parent, and thus no index
       break;
     }
 
     int32_t indx = parent->IndexOf(newCurNode);
+    NS_WARN_IF(indx < 0);
 
     // insert at the head!
     newIndexes.InsertElementAt(0, indx);
 
     // look to see if the parent is in the stack
     indx = oldParentStack.IndexOf(parent);
     if (indx >= 0) {
       // ok, the parent IS on the old stack!  Rework things.  We want

--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -1493,23 +1493,29 @@ nsDocument::nsDocument(const char* aCont
 
   if (!sProcessingStack) {
     sProcessingStack.emplace();
     // Add the base queue sentinel to the processing stack.
     sProcessingStack->AppendElement((CustomElementData*) nullptr);
   }
 }
 
-static PLDHashOperator
-ClearAllBoxObjects(nsIContent* aKey, nsPIBoxObject* aBoxObject, void* aUserArg)
-{
-  if (aBoxObject) {
-    aBoxObject->Clear();
-  }
-  return PL_DHASH_NEXT;
+void
+nsDocument::ClearAllBoxObjects()
+{
+  if (mBoxObjectTable) {
+    for (auto iter = mBoxObjectTable->Iter(); !iter.Done(); iter.Next()) {
+      nsPIBoxObject* boxObject = iter.UserData();
+      if (boxObject) {
+        boxObject->Clear();
+      }
+    }
+    delete mBoxObjectTable;
+    mBoxObjectTable = nullptr;
+  }
 }
 
 nsIDocument::~nsIDocument()
 {
   MOZ_ASSERT(PR_CLIST_IS_EMPTY(&mDOMMediaQueryLists),
              "must not have media query lists left");
 
   if (mNodeInfoManager) {
@@ -1648,20 +1654,17 @@ nsDocument::~nsDocument()
   }
 
   if (mStyleImageLoader) {
     mStyleImageLoader->DropDocumentReference();
   }
 
   delete mHeaderData;
 
-  if (mBoxObjectTable) {
-    mBoxObjectTable->EnumerateRead(ClearAllBoxObjects, nullptr);
-    delete mBoxObjectTable;
-  }
+  ClearAllBoxObjects();
 
   mPendingTitleChangeEvent.Revoke();
 
   // We don't want to leave residual locks on images. Make sure we're in an
   // unlocked state, and then clear the table.
   SetImageLockingState(false);
   mImageTracker.Clear();
 
@@ -1741,49 +1744,16 @@ NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_END
 NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_IN_CC_BEGIN(nsDocument)
   return Element::CanSkipInCC(tmp);
 NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_IN_CC_END
 
 NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_THIS_BEGIN(nsDocument)
   return Element::CanSkipThis(tmp);
 NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_THIS_END
 
-static PLDHashOperator
-RadioGroupsTraverser(const nsAString& aKey, nsRadioGroupStruct* aData,
-                     void* aClosure)
-{
-  nsCycleCollectionTraversalCallback *cb =
-    static_cast<nsCycleCollectionTraversalCallback*>(aClosure);
-
-  NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(*cb,
-                                   "mRadioGroups entry->mSelectedRadioButton");
-  cb->NoteXPCOMChild(ToSupports(aData->mSelectedRadioButton));
-
-  uint32_t i, count = aData->mRadioButtons.Count();
-  for (i = 0; i < count; ++i) {
-    NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(*cb,
-                                       "mRadioGroups entry->mRadioButtons[i]");
-    cb->NoteXPCOMChild(aData->mRadioButtons[i]);
-  }
-
-  return PL_DHASH_NEXT;
-}
-
-static PLDHashOperator
-BoxObjectTraverser(nsIContent* key, nsPIBoxObject* boxObject, void* userArg)
-{
-  nsCycleCollectionTraversalCallback *cb =
-    static_cast<nsCycleCollectionTraversalCallback*>(userArg);
-
-  NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(*cb, "mBoxObjectTable entry");
-  cb->NoteXPCOMChild(boxObject);
-
-  return PL_DHASH_NEXT;
-}
-
 static const char* kNSURIs[] = {
   "([none])",
   "(xmlns)",
   "(xml)",
   "(xhtml)",
   "(XLink)",
   "(XSLT)",
   "(XBL)",
@@ -1850,22 +1820,37 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mScriptGlobalObject)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mListenerManager)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mDOMStyleSheets)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mStyleSheetSetList)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mScriptLoader)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mMasterDocument)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mImportManager)
 
-  tmp->mRadioGroups.EnumerateRead(RadioGroupsTraverser, &cb);
+  for (auto iter = tmp->mRadioGroups.Iter(); !iter.Done(); iter.Next()) {
+    nsRadioGroupStruct* radioGroup = iter.UserData();
+    NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(
+      cb, "mRadioGroups entry->mSelectedRadioButton");
+    cb.NoteXPCOMChild(ToSupports(radioGroup->mSelectedRadioButton));
+
+    uint32_t i, count = radioGroup->mRadioButtons.Count();
+    for (i = 0; i < count; ++i) {
+      NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(
+        cb, "mRadioGroups entry->mRadioButtons[i]");
+      cb.NoteXPCOMChild(radioGroup->mRadioButtons[i]);
+    }
+  }
 
   // The boxobject for an element will only exist as long as it's in the
   // document, so we'll traverse the table here instead of from the element.
   if (tmp->mBoxObjectTable) {
-    tmp->mBoxObjectTable->EnumerateRead(BoxObjectTraverser, &cb);
+    for (auto iter = tmp->mBoxObjectTable->Iter(); !iter.Done(); iter.Next()) {
+      NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mBoxObjectTable entry");
+      cb.NoteXPCOMChild(iter.UserData());
+    }
   }
 
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mChannel)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mStyleAttrStyleSheet)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mXPathEvaluator)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mLayoutHistoryState)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mOnloadBlocker)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mFirstBaseNodeWithHref)
@@ -1976,22 +1961,17 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(ns
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mImportManager)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mSubImportLinks)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mFontFaceSet)
 
   tmp->mParentDocument = nullptr;
 
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mPreloadingImages)
 
-
-  if (tmp->mBoxObjectTable) {
-   tmp->mBoxObjectTable->EnumerateRead(ClearAllBoxObjects, nullptr);
-   delete tmp->mBoxObjectTable;
-   tmp->mBoxObjectTable = nullptr;
- }
+  tmp->ClearAllBoxObjects();
 
   if (tmp->mListenerManager) {
     tmp->mListenerManager->Disconnect();
     tmp->UnsetFlags(NODE_HAS_LISTENERMANAGER);
     tmp->mListenerManager = nullptr;
   }
 
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mDOMStyleSheets)
@@ -3782,39 +3762,33 @@ nsIDocument::ShouldThrottleFrameRequests
     // platforms and is unlikely to be human-perceivable on non-APZ platforms.
     return true;
   }
 
   // We got painted during the last paint, so run at full speed.
   return false;
 }
 
-PLDHashOperator RequestDiscardEnumerator(imgIRequest* aKey,
-                                         uint32_t aData,
-                                         void* userArg)
-{
-  aKey->RequestDiscard();
-  return PL_DHASH_NEXT;
-}
-
 void
 nsDocument::DeleteShell()
 {
   mExternalResourceMap.HideViewers();
   if (IsEventHandlingEnabled() && !AnimationsPaused()) {
     RevokeAnimationFrameNotifications();
   }
   if (nsPresContext* presContext = mPresShell->GetPresContext()) {
     presContext->RefreshDriver()->CancelPendingEvents(this);
   }
 
   // When our shell goes away, request that all our images be immediately
   // discarded, so we don't carry around decoded image data for a document we
   // no longer intend to paint.
-  mImageTracker.EnumerateRead(RequestDiscardEnumerator, nullptr);
+  for (auto iter = mImageTracker.Iter(); !iter.Done(); iter.Next()) {
+    iter.Key()->RequestDiscard();
+  }
 
   // Now that we no longer have a shell, we need to forget about any FontFace
   // objects for @font-face rules that came from the style set.
   RebuildUserFontSet();
 
   mPresShell = nullptr;
 }
 
@@ -10562,83 +10536,60 @@ nsDocument::NotifyMediaFeatureValuesChan
     nsCOMPtr<nsIContent> content = iter.Get()->GetKey();
     if (content->IsHTMLElement(nsGkAtoms::img)) {
       auto* imageElement = static_cast<HTMLImageElement*>(content.get());
       imageElement->MediaFeatureValuesChanged();
     }
   }
 }
 
-PLDHashOperator LockEnumerator(imgIRequest* aKey,
-                               uint32_t aData,
-                               void*    userArg)
-{
-  aKey->LockImage();
-  return PL_DHASH_NEXT;
-}
-
-PLDHashOperator UnlockEnumerator(imgIRequest* aKey,
-                                 uint32_t aData,
-                                 void*    userArg)
-{
-  aKey->UnlockImage();
-  return PL_DHASH_NEXT;
-}
-
-
 nsresult
 nsDocument::SetImageLockingState(bool aLocked)
 {
   if (XRE_IsContentProcess() &&
       !Preferences::GetBool("image.mem.allow_locking_in_content_processes", true)) {
     return NS_OK;
   }
 
   // If there's no change, there's nothing to do.
   if (mLockingImages == aLocked)
     return NS_OK;
 
   // Otherwise, iterate over our images and perform the appropriate action.
-  mImageTracker.EnumerateRead(aLocked ? LockEnumerator
-                                      : UnlockEnumerator,
-                              nullptr);
+  for (auto iter = mImageTracker.Iter(); !iter.Done(); iter.Next()) {
+    imgIRequest* image = iter.Key();
+    if (aLocked) {
+      image->LockImage();
+    } else {
+      image->UnlockImage();
+    }
+  }
 
   // Update state.
   mLockingImages = aLocked;
 
   return NS_OK;
 }
 
-PLDHashOperator IncrementAnimationEnumerator(imgIRequest* aKey,
-                                             uint32_t aData,
-                                             void*    userArg)
-{
-  aKey->IncrementAnimationConsumers();
-  return PL_DHASH_NEXT;
-}
-
-PLDHashOperator DecrementAnimationEnumerator(imgIRequest* aKey,
-                                             uint32_t aData,
-                                             void*    userArg)
-{
-  aKey->DecrementAnimationConsumers();
-  return PL_DHASH_NEXT;
-}
-
 void
 nsDocument::SetImagesNeedAnimating(bool aAnimating)
 {
   // If there's no change, there's nothing to do.
   if (mAnimatingImages == aAnimating)
     return;
 
   // Otherwise, iterate over our images and perform the appropriate action.
-  mImageTracker.EnumerateRead(aAnimating ? IncrementAnimationEnumerator
-                                         : DecrementAnimationEnumerator,
-                              nullptr);
+  for (auto iter = mImageTracker.Iter(); !iter.Done(); iter.Next()) {
+    imgIRequest* image = iter.Key();
+    if (aAnimating) {
+      image->IncrementAnimationConsumers();
+    } else {
+      image->DecrementAnimationConsumers();
+    }
+  }
 
   // Update state.
   mAnimatingImages = aAnimating;
 }
 
 already_AddRefed<Touch>
 nsIDocument::CreateTouch(nsIDOMWindow* aView,
                          EventTarget* aTarget,

--- a/dom/base/nsDocument.h
+++ b/dom/base/nsDocument.h
@@ -1762,16 +1762,18 @@ private:
                                        bool aUpdateCSSLoader);
 
   // Revoke any pending notifications due to requestAnimationFrame calls
   void RevokeAnimationFrameNotifications();
   // Reschedule any notifications we need to handle
   // requestAnimationFrame, if it's OK to do so.
   void MaybeRescheduleAnimationFrameNotifications();
 
+  void ClearAllBoxObjects();
+
   // Returns true if the scheme for the url for this document is "about"
   bool IsAboutPage();
 
   // These are not implemented and not supported.
   nsDocument(const nsDocument& aOther);
   nsDocument& operator=(const nsDocument& aOther);
 
   // The layout history state that should be used by nodes in this

--- a/dom/base/nsGkAtomList.h
+++ b/dom/base/nsGkAtomList.h
@@ -289,16 +289,17 @@ GK_ATOM(del, "del")
 GK_ATOM(descendant, "descendant")
 GK_ATOM(descendantOrSelf, "descendant-or-self")
 GK_ATOM(descending, "descending")
 GK_ATOM(description, "description")
 GK_ATOM(destructor, "destructor")
 GK_ATOM(details, "details")
 GK_ATOM(deviceAspectRatio, "device-aspect-ratio")
 GK_ATOM(deviceHeight, "device-height")
+GK_ATOM(devicePixelRatio, "device-pixel-ratio")
 GK_ATOM(deviceWidth, "device-width")
 GK_ATOM(dfn, "dfn")
 GK_ATOM(dialog, "dialog")
 GK_ATOM(difference, "difference")
 GK_ATOM(digit, "digit")
 GK_ATOM(dir, "dir")
 GK_ATOM(dirAutoSetBy, "dirAutoSetBy")
 GK_ATOM(directionality, "directionality")

--- a/dom/base/test/test_bug976673.html
+++ b/dom/base/test/test_bug976673.html
@@ -21,16 +21,21 @@ https://bugzilla.mozilla.org/show_bug.cg
 <input id="input" onfocus="event.target.value = event.type;"
                   onblur="event.target.value = event.type;">
 <button id="button">set focus</button>
 <iframe id="iframe" src="http://example.org:80/tests/dom/base/test/iframe_bug976673.html"></iframe>
 <script>
 
 SimpleTest.waitForExplicitFinish();
 
+// In e10s mode, ContentCacheInChild tries to retrieve selected text and
+// caret position when IMEContentObserver notifies IME of focus.  At this time,
+// we hit assertion in nsContentIterator.
+SimpleTest.expectAssertions(0, 6);
+
 window.addEventListener("mousedown", function (aEvent) { aEvent.preventDefault(); }, false);
 
 function testSetFocus(aEventType, aCallback)
 {
   var description = "Setting focus from " + aEventType + " handler: ";
 
   var iframe = document.getElementById("iframe");
   iframe.contentWindow.focus();

--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@@ -130,16 +130,22 @@ ThrowMethodFailed(JSContext* cx, ErrorRe
 {
   if (rv.IsUncatchableException()) {
     // Nuke any existing exception on aCx, to make sure we're uncatchable.
     JS_ClearPendingException(cx);
     // Don't do any reporting.  Just return false, to create an
     // uncatchable exception.
     return false;
   }
+  if (rv.IsJSContextException()) {
+    // Whatever we need to throw is on the JSContext already.  We
+    // can't assert that there is a pending exception on it, though,
+    // because in the uncatchable exception case there won't be one.
+    return false;
+  }
   if (rv.IsErrorWithMessage()) {
     rv.ReportErrorWithMessage(cx);
     return false;
   }
   if (rv.IsJSException()) {
     rv.ReportJSException(cx);
     return false;
   }

--- a/dom/bindings/ErrorResult.h
+++ b/dom/bindings/ErrorResult.h
@@ -162,16 +162,27 @@ public:
   // passed to ThrowDOMException, the default message string for the given
   // nsresult will be used.  The passed-in string must be UTF-8.  The nsresult
   // passed in must be one we create DOMExceptions for; otherwise you may get an
   // XPConnect Exception.
   void ThrowDOMException(nsresult rv, const nsACString& message = EmptyCString());
   void ReportDOMException(JSContext* cx);
   bool IsDOMException() const { return ErrorCode() == NS_ERROR_DOM_DOMEXCEPTION; }
 
+  // Flag on the ErrorResult that whatever needs throwing has been
+  // thrown on the JSContext already and we should not mess with it.
+  void NoteJSContextException() {
+    mResult = NS_ERROR_DOM_EXCEPTION_ON_JSCONTEXT;
+  }
+  // Check whether the ErrorResult says to just throw whatever is on
+  // the JSContext already.
+  bool IsJSContextException() {
+    return ErrorCode() == NS_ERROR_DOM_EXCEPTION_ON_JSCONTEXT;
+  }
+
   // Report a generic error.  This should only be used if we're not
   // some more specific exception type.
   void ReportGenericError(JSContext* cx);
 
   // Support for uncatchable exceptions.
   void ThrowUncatchableException() {
     Throw(NS_ERROR_UNCATCHABLE_EXCEPTION);
   }
@@ -269,16 +280,18 @@ private:
     MOZ_ASSERT(aRv != NS_ERROR_TYPE_ERR, "Use ThrowTypeError()");
     MOZ_ASSERT(aRv != NS_ERROR_RANGE_ERR, "Use ThrowRangeError()");
     MOZ_ASSERT(!IsErrorWithMessage(), "Don't overwrite errors with message");
     MOZ_ASSERT(aRv != NS_ERROR_DOM_JS_EXCEPTION, "Use ThrowJSException()");
     MOZ_ASSERT(!IsJSException(), "Don't overwrite JS exceptions");
     MOZ_ASSERT(aRv != NS_ERROR_DOM_DOMEXCEPTION, "Use ThrowDOMException()");
     MOZ_ASSERT(!IsDOMException(), "Don't overwrite DOM exceptions");
     MOZ_ASSERT(aRv != NS_ERROR_XPC_NOT_ENOUGH_ARGS, "May need to bring back ThrowNotEnoughArgsError");
+    MOZ_ASSERT(aRv != NS_ERROR_DOM_EXCEPTION_ON_JSCONTEXT,
+               "Use NoteJSContextException");
     mResult = aRv;
   }
 
   void ClearMessage();
   void ClearDOMExceptionInfo();
 
   // ClearUnionData will try to clear the data in our
   // mMessage/mJSException/mDOMExceptionInfo union.  After this the union may be

--- a/dom/events/EventStateManager.cpp
+++ b/dom/events/EventStateManager.cpp
@@ -468,16 +468,24 @@ void
 EventStateManager::OnStopObservingContent(
                      IMEContentObserver* aIMEContentObserver)
 {
   aIMEContentObserver->DisconnectFromEventStateManager();
   NS_ENSURE_TRUE_VOID(mIMEContentObserver == aIMEContentObserver);
   mIMEContentObserver = nullptr;
 }
 
+void
+EventStateManager::TryToFlushPendingNotificationsToIME()
+{
+  if (mIMEContentObserver) {
+    mIMEContentObserver->TryToFlushPendingNotifications();
+  }
+}
+
 nsresult
 EventStateManager::PreHandleEvent(nsPresContext* aPresContext,
                                   WidgetEvent* aEvent,
                                   nsIFrame* aTargetFrame,
                                   nsIContent* aTargetContent,
                                   nsEventStatus* aStatus)
 {
   NS_ENSURE_ARG_POINTER(aStatus);

--- a/dom/events/EventStateManager.h
+++ b/dom/events/EventStateManager.h
@@ -142,16 +142,22 @@ public:
    * EventStateManager stores IMEContentObserver while it's observing contents.
    * Following mehtods are called by IMEContentObserver when it starts to
    * observe or stops observing the content.
    */
   void OnStartToObserveContent(IMEContentObserver* aIMEContentObserver);
   void OnStopObservingContent(IMEContentObserver* aIMEContentObserver);
 
   /**
+   * TryToFlushPendingNotificationsToIME() suggests flushing pending
+   * notifications to IME to IMEContentObserver.
+   */
+  void TryToFlushPendingNotificationsToIME();
+
+  /**
    * Register accesskey on the given element. When accesskey is activated then
    * the element will be notified via nsIContent::PerformAccesskey() method.
    *
    * @param  aContent  the given element
    * @param  aKey      accesskey
    */
   void RegisterAccessKey(nsIContent* aContent, uint32_t aKey);
 

--- a/dom/events/IMEContentObserver.cpp
+++ b/dom/events/IMEContentObserver.cpp
@@ -197,17 +197,16 @@ IMEContentObserver::IMEContentObserver()
   , mPreCharacterDataChangeLength(-1)
   , mSendingNotification(NOTIFY_IME_OF_NOTHING)
   , mIsObserving(false)
   , mIMEHasFocus(false)
   , mNeedsToNotifyIMEOfFocusSet(false)
   , mNeedsToNotifyIMEOfTextChange(false)
   , mNeedsToNotifyIMEOfSelectionChange(false)
   , mNeedsToNotifyIMEOfPositionChange(false)
-  , mIsFlushingPendingNotifications(false)
   , mIsHandlingQueryContentEvent(false)
 {
 #ifdef DEBUG
   mTextChangeData.Test();
 #endif
   if (!sIMECOLog) {
     sIMECOLog = PR_NewLogModule("IMEContentObserver");
   }
@@ -246,36 +245,66 @@ IMEContentObserver::Init(nsIWidget* aWid
   } else {
     if (!InitWithEditor(aPresContext, aContent, aEditor)) {
       Clear();
       return;
     }
   }
 
   if (firstInitialization) {
+    // Now, try to send NOTIFY_IME_OF_FOCUS to IME via the widget.
     MaybeNotifyIMEOfFocusSet();
+    // When this is called first time, IME has not received NOTIFY_IME_OF_FOCUS
+    // yet since NOTIFY_IME_OF_FOCUS will be sent to widget asynchronously.
+    // So, we need to do nothing here.  After NOTIFY_IME_OF_FOCUS has been
+    // sent, OnIMEReceivedFocus() will be called and content, selection and/or
+    // position changes will be observed
+    return;
+  }
 
-    // While Init() notifies IME of focus, pending layout may be flushed
-    // because the notification may cause querying content.  Then, recursive
-    // call of Init() with the latest content may be occur.  In such case, we
-    // shouldn't keep first initialization.
-    if (GetState() != eState_Initializing) {
-      return;
-    }
+  // When this is called after editor reframing (i.e., the root editable node
+  // is also recreated), IME has usually received NOTIFY_IME_OF_FOCUS.  In this
+  // case, we need to restart to observe content, selection and/or position
+  // changes in new root editable node.
+  ObserveEditableNode();
 
-    // NOTIFY_IME_OF_FOCUS might cause recreating IMEContentObserver
-    // instance via IMEStateManager::UpdateIMEState().  So, this
-    // instance might already have been destroyed, check it.
-    if (!mRootContent) {
-      return;
-    }
+  if (!NeedsToNotifyIMEOfSomething()) {
+    return;
   }
 
+  // Some change events may wait to notify IME because this was being
+  // initialized.  It is the time to flush them.
+  FlushMergeableNotifications();
+}
+
+void
+IMEContentObserver::OnIMEReceivedFocus()
+{
+  // While Init() notifies IME of focus, pending layout may be flushed
+  // because the notification may cause querying content.  Then, recursive
+  // call of Init() with the latest content may occur.  In such case, we
+  // shouldn't keep first initialization which notified IME of focus.
+  if (GetState() != eState_Initializing) {
+    return;
+  }
+
+  // NOTIFY_IME_OF_FOCUS might cause recreating IMEContentObserver
+  // instance via IMEStateManager::UpdateIMEState().  So, this
+  // instance might already have been destroyed, check it.
+  if (!mRootContent) {
+    return;
+  }
+
+  // Start to observe which is needed by IME when IME actually has focus.
   ObserveEditableNode();
 
+  if (!NeedsToNotifyIMEOfSomething()) {
+    return;
+  }
+
   // Some change events may wait to notify IME because this was being
   // initialized.  It is the time to flush them.
   FlushMergeableNotifications();
 }
 
 bool
 IMEContentObserver::InitWithEditor(nsPresContext* aPresContext,
                                    nsIContent* aContent,
@@ -399,16 +428,28 @@ IMEContentObserver::Clear()
 
 void
 IMEContentObserver::ObserveEditableNode()
 {
   MOZ_RELEASE_ASSERT(mSelection);
   MOZ_RELEASE_ASSERT(mRootContent);
   MOZ_RELEASE_ASSERT(GetState() != eState_Observing);
 
+  // If this is called before sending NOTIFY_IME_OF_FOCUS (it's possible when
+  // the editor is reframed before sending NOTIFY_IME_OF_FOCUS asynchronously),
+  // the update preference of mWidget may be different from after the widget
+  // receives NOTIFY_IME_OF_FOCUS.   So, this should be called again by
+  // OnIMEReceivedFocus() which is called after sending NOTIFY_IME_OF_FOCUS.
+  if (!mIMEHasFocus) {
+    MOZ_ASSERT(!mWidget || mNeedsToNotifyIMEOfFocusSet ||
+               mSendingNotification == NOTIFY_IME_OF_FOCUS,
+               "Wow, OnIMEReceivedFocus() won't be called?");
+    return;
+  }
+
   mIsObserving = true;
   if (mEditor) {
     mEditor->AddEditorObserver(this);
   }
 
   mUpdatePreference = mWidget->GetIMEUpdatePreference();
   if (mUpdatePreference.WantSelectionChange()) {
     // add selection change listener
@@ -663,19 +704,24 @@ IMEContentObserver::ReflowInterruptible(
   MaybeNotifyIMEOfPositionChange();
   return NS_OK;
 }
 
 nsresult
 IMEContentObserver::HandleQueryContentEvent(WidgetQueryContentEvent* aEvent)
 {
   // If the instance has cache, it should use the cached selection which was
-  // sent to the widget.
+  // sent to the widget.  However, if this instance has already received new
+  // selection change notification but hasn't updated the cache yet (i.e.,
+  // not sending selection change notification to IME, don't use the cached
+  // value.  Note that don't update selection cache here since if you update
+  // selection cache here, IMENotificationSender won't notify IME of selection
+  // change because it looks like that the selection isn't actually changed.
   if (aEvent->mMessage == eQuerySelectedText && aEvent->mUseNativeLineBreak &&
-      mSelectionData.IsValid()) {
+      mSelectionData.IsValid() && !mNeedsToNotifyIMEOfSelectionChange) {
     aEvent->mReply.mContentsRoot = mRootContent;
     aEvent->mReply.mHasSelection = !mSelectionData.IsCollapsed();
     aEvent->mReply.mOffset = mSelectionData.mOffset;
     aEvent->mReply.mString = mSelectionData.String();
     aEvent->mReply.mWritingMode = mSelectionData.GetWritingMode();
     aEvent->mReply.mReversed = mSelectionData.mReversed;
     aEvent->mSucceeded = true;
     MOZ_LOG(sIMECOLog, LogLevel::Debug,
@@ -1309,17 +1355,17 @@ IMEContentObserver::FlushMergeableNotifi
     return;
   }
 
   // Notifying something may cause nested call of this method.  For example,
   // when somebody notified one of the notifications may dispatch query content
   // event. Then, it causes flushing layout which may cause another layout
   // change notification.
 
-  if (mIsFlushingPendingNotifications) {
+  if (mQueuedSender) {
     // So, if this is already called, this should do nothing.
     MOZ_LOG(sIMECOLog, LogLevel::Debug,
       ("IMECO: 0x%p   IMEContentObserver::FlushMergeableNotifications(), "
        "FAILED, due to already flushing pending notifications", this));
     return;
   }
 
   if (!NeedsToNotifyIMEOfSomething()) {
@@ -1331,24 +1377,42 @@ IMEContentObserver::FlushMergeableNotifi
 
   // NOTE: Reset each pending flag because sending notification may cause
   //       another change.
 
   MOZ_LOG(sIMECOLog, LogLevel::Debug,
     ("IMECO: 0x%p IMEContentObserver::FlushMergeableNotifications(), "
      "creating IMENotificationSender...", this));
 
-  mIsFlushingPendingNotifications = true;
-  nsContentUtils::AddScriptRunner(new IMENotificationSender(this));
+  // If contents in selection range is modified, the selection range still
+  // has removed node from the tree.  In such case, nsContentIterator won't
+  // work well.  Therefore, we shouldn't use AddScriptRunnder() here since
+  // it may kick runnable event immediately after DOM tree is changed but
+  // the selection range isn't modified yet.
+  mQueuedSender = new IMENotificationSender(this);
+  NS_DispatchToCurrentThread(mQueuedSender);
 
   MOZ_LOG(sIMECOLog, LogLevel::Debug,
     ("IMECO: 0x%p IMEContentObserver::FlushMergeableNotifications(), "
      "finished", this));
 }
 
+void
+IMEContentObserver::TryToFlushPendingNotifications()
+{
+  if (!mQueuedSender || mSendingNotification != NOTIFY_IME_OF_NOTHING) {
+    return;
+  }
+
+  MOZ_LOG(sIMECOLog, LogLevel::Debug,
+    ("IMECO: 0x%p IMEContentObserver::TryToFlushPendingNotifications(), "
+     "performing queued IMENotificationSender forcibly", this));
+  mQueuedSender->Run();
+}
+
 /******************************************************************************
  * mozilla::IMEContentObserver::AChangeEvent
  ******************************************************************************/
 
 bool
 IMEContentObserver::AChangeEvent::CanNotifyIME(
                                     ChangeEventType aChangeEventType) const
 {
@@ -1405,28 +1469,56 @@ IMEContentObserver::AChangeEvent::IsSafe
 
 /******************************************************************************
  * mozilla::IMEContentObserver::IMENotificationSender
  ******************************************************************************/
  
 NS_IMETHODIMP
 IMEContentObserver::IMENotificationSender::Run()
 {
-  MOZ_ASSERT(mIMEContentObserver->mIsFlushingPendingNotifications);
+  if (NS_WARN_IF(mIsRunning)) {
+    MOZ_LOG(sIMECOLog, LogLevel::Error,
+      ("IMECO: 0x%p IMEContentObserver::IMENotificationSender::Run(), FAILED, "
+       "called recursively", this));
+    return NS_OK;
+  }
+
+  AutoRestore<bool> running(mIsRunning);
+  mIsRunning = true;
+
+  // This instance was already performed forcibly.
+  if (mIMEContentObserver->mQueuedSender != this) {
+    return NS_OK;
+  }
 
   // NOTE: Reset each pending flag because sending notification may cause
   //       another change.
 
   if (mIMEContentObserver->mNeedsToNotifyIMEOfFocusSet) {
     mIMEContentObserver->mNeedsToNotifyIMEOfFocusSet = false;
     SendFocusSet();
+    mIMEContentObserver->mQueuedSender = nullptr;
+    // If it's not safe to notify IME of focus, SendFocusSet() sets
+    // mNeedsToNotifyIMEOfFocusSet true again.  For guaranteeing to send the
+    // focus notification later,  we should put a new sender into the queue but
+    // this case must be rare.  Note that if mIMEContentObserver is already
+    // destroyed, mNeedsToNotifyIMEOfFocusSet is never set true again.
+    if (mIMEContentObserver->mNeedsToNotifyIMEOfFocusSet) {
+      MOZ_ASSERT(!mIMEContentObserver->mIMEHasFocus);
+      MOZ_LOG(sIMECOLog, LogLevel::Debug,
+        ("IMECO: 0x%p IMEContentObserver::IMENotificationSender::Run(), "
+         "posting IMENotificationSender to current thread", this));
+      mIMEContentObserver->mQueuedSender =
+        new IMENotificationSender(mIMEContentObserver);
+      NS_DispatchToCurrentThread(mIMEContentObserver->mQueuedSender);
+      return NS_OK;
+    }
     // This is the first notification to IME. So, we don't need to notify
     // anymore since IME starts to query content after it gets focus.
     mIMEContentObserver->ClearPendingNotifications();
-    mIMEContentObserver->mIsFlushingPendingNotifications = false;
     return NS_OK;
   }
 
   if (mIMEContentObserver->mNeedsToNotifyIMEOfTextChange) {
     mIMEContentObserver->mNeedsToNotifyIMEOfTextChange = false;
     SendTextChange();
   }
 
@@ -1449,26 +1541,26 @@ IMEContentObserver::IMENotificationSende
   if (!mIMEContentObserver->mNeedsToNotifyIMEOfTextChange &&
       !mIMEContentObserver->mNeedsToNotifyIMEOfSelectionChange) {
     if (mIMEContentObserver->mNeedsToNotifyIMEOfPositionChange) {
       mIMEContentObserver->mNeedsToNotifyIMEOfPositionChange = false;
       SendPositionChange();
     }
   }
 
+  mIMEContentObserver->mQueuedSender = nullptr;
+
   // If notifications caused some new change, we should notify them now.
-  mIMEContentObserver->mIsFlushingPendingNotifications =
-    mIMEContentObserver->NeedsToNotifyIMEOfSomething();
-  if (mIMEContentObserver->mIsFlushingPendingNotifications) {
+  if (mIMEContentObserver->NeedsToNotifyIMEOfSomething()) {
     MOZ_LOG(sIMECOLog, LogLevel::Debug,
       ("IMECO: 0x%p IMEContentObserver::IMENotificationSender::Run(), "
-       "posting AsyncMergeableNotificationsFlusher to current thread", this));
-    RefPtr<AsyncMergeableNotificationsFlusher> asyncFlusher =
-      new AsyncMergeableNotificationsFlusher(mIMEContentObserver);
-    NS_DispatchToCurrentThread(asyncFlusher);
+       "posting IMENotificationSender to current thread", this));
+    mIMEContentObserver->mQueuedSender =
+      new IMENotificationSender(mIMEContentObserver);
+    NS_DispatchToCurrentThread(mIMEContentObserver->mQueuedSender);
   }
   return NS_OK;
 }
 
 void
 IMEContentObserver::IMENotificationSender::SendFocusSet()
 {
   if (!CanNotifyIME(eChangeEventType_Focus)) {
@@ -1500,16 +1592,22 @@ IMEContentObserver::IMENotificationSende
 
   MOZ_RELEASE_ASSERT(mIMEContentObserver->mSendingNotification ==
                        NOTIFY_IME_OF_NOTHING);
   mIMEContentObserver->mSendingNotification = NOTIFY_IME_OF_FOCUS;
   IMEStateManager::NotifyIME(IMENotification(NOTIFY_IME_OF_FOCUS),
                              mIMEContentObserver->mWidget);
   mIMEContentObserver->mSendingNotification = NOTIFY_IME_OF_NOTHING;
 
+  // nsIMEUpdatePreference referred by ObserveEditableNode() may be different
+  // before or after widget receives NOTIFY_IME_OF_FOCUS.  Therefore, we need
+  // to guarantee to call ObserveEditableNode() after sending
+  // NOTIFY_IME_OF_FOCUS.
+  mIMEContentObserver->OnIMEReceivedFocus();
+
   MOZ_LOG(sIMECOLog, LogLevel::Debug,
     ("IMECO: 0x%p IMEContentObserver::IMENotificationSender::"
      "SendFocusSet(), sent NOTIFY_IME_OF_FOCUS", this));
 }
 
 void
 IMEContentObserver::IMENotificationSender::SendSelectionChange()
 {
@@ -1663,36 +1761,9 @@ IMEContentObserver::IMENotificationSende
                              mIMEContentObserver->mWidget);
   mIMEContentObserver->mSendingNotification = NOTIFY_IME_OF_NOTHING;
 
   MOZ_LOG(sIMECOLog, LogLevel::Debug,
     ("IMECO: 0x%p IMEContentObserver::IMENotificationSender::"
      "SendPositionChange(), sent NOTIFY_IME_OF_POSITION_CHANGE", this));
 }
 
-/******************************************************************************
- * mozilla::IMEContentObserver::AsyncMergeableNotificationsFlusher
- ******************************************************************************/
-
-NS_IMETHODIMP
-IMEContentObserver::AsyncMergeableNotificationsFlusher::Run()
-{
-  if (!CanNotifyIME(eChangeEventType_FlushPendingEvents)) {
-    MOZ_LOG(sIMECOLog, LogLevel::Debug,
-      ("IMECO: 0x%p IMEContentObserver::AsyncMergeableNotificationsFlusher::"
-       "Run(), FAILED, due to impossible to flush pending notifications",
-       this));
-    return NS_OK;
-  }
-
-  MOZ_LOG(sIMECOLog, LogLevel::Info,
-    ("IMECO: 0x%p IMEContentObserver::AsyncMergeableNotificationsFlusher::"
-     "Run(), calling FlushMergeableNotifications()...", this));
-
-  mIMEContentObserver->FlushMergeableNotifications();
-
-  MOZ_LOG(sIMECOLog, LogLevel::Debug,
-    ("IMECO: 0x%p IMEContentObserver::AsyncMergeableNotificationsFlusher::"
-     "Run(), called FlushMergeableNotifications()", this));
-  return NS_OK;
-}
-
 } // namespace mozilla

--- a/dom/events/IMEContentObserver.h
+++ b/dom/events/IMEContentObserver.h
@@ -98,30 +98,37 @@ public:
   nsIWidget* GetWidget() const { return mWidget; }
   nsIEditor* GetEditor() const { return mEditor; }
   void SuppressNotifyingIME();
   void UnsuppressNotifyingIME();
   nsPresContext* GetPresContext() const;
   nsresult GetSelectionAndRoot(nsISelection** aSelection,
                                nsIContent** aRoot) const;
 
+  /**
+   * TryToFlushPendingNotifications() should be called when pending events
+   * should be flushed.  This tries to run the queued IMENotificationSender.
+   */
+  void TryToFlushPendingNotifications();
+
 private:
   ~IMEContentObserver() {}
 
   enum State {
     eState_NotObserving,
     eState_Initializing,
     eState_StoppedObserving,
     eState_Observing
   };
   State GetState() const;
   bool InitWithEditor(nsPresContext* aPresContext, nsIContent* aContent,
                       nsIEditor* aEditor);
   bool InitWithPlugin(nsPresContext* aPresContext, nsIContent* aContent);
   bool IsInitializedWithPlugin() const { return !mEditor; }
+  void OnIMEReceivedFocus();
   void Clear();
   bool IsObservingContent(nsPresContext* aPresContext,
                           nsIContent* aContent) const;
   bool IsReflowLocked() const;
   bool IsSafeToNotifyIME() const;
   bool IsEditorComposing() const;
 
   void PostFocusSetNotification();
@@ -178,16 +185,73 @@ private:
   nsCOMPtr<nsIWidget> mFocusedWidget;
   nsCOMPtr<nsISelection> mSelection;
   nsCOMPtr<nsIContent> mRootContent;
   nsCOMPtr<nsINode> mEditableNode;
   nsCOMPtr<nsIDocShell> mDocShell;
   nsCOMPtr<nsIEditor> mEditor;
 
   /**
+   * Helper classes to notify IME.
+   */
+
+  class AChangeEvent: public nsRunnable
+  {
+  protected:
+    enum ChangeEventType
+    {
+      eChangeEventType_Focus,
+      eChangeEventType_Selection,
+      eChangeEventType_Text,
+      eChangeEventType_Position,
+      eChangeEventType_FlushPendingEvents
+    };
+
+    explicit AChangeEvent(IMEContentObserver* aIMEContentObserver)
+      : mIMEContentObserver(aIMEContentObserver)
+    {
+      MOZ_ASSERT(mIMEContentObserver);
+    }
+
+    RefPtr<IMEContentObserver> mIMEContentObserver;
+
+    /**
+     * CanNotifyIME() checks if mIMEContentObserver can and should notify IME.
+     */
+    bool CanNotifyIME(ChangeEventType aChangeEventType) const;
+
+    /**
+     * IsSafeToNotifyIME() checks if it's safe to noitify IME.
+     */
+    bool IsSafeToNotifyIME(ChangeEventType aChangeEventType) const;
+  };
+
+  class IMENotificationSender: public AChangeEvent
+  {
+  public:
+    explicit IMENotificationSender(IMEContentObserver* aIMEContentObserver)
+      : AChangeEvent(aIMEContentObserver)
+      , mIsRunning(false)
+    {
+    }
+    NS_IMETHOD Run() override;
+
+  private:
+    void SendFocusSet();
+    void SendSelectionChange();
+    void SendTextChange();
+    void SendPositionChange();
+
+    bool mIsRunning;
+  };
+
+  // mQueuedSender is, it was put into the event queue but not run yet.
+  RefPtr<IMENotificationSender> mQueuedSender;
+
+  /**
    * FlatTextCache stores flat text length from start of the content to
    * mNodeOffset of mContainerNode.
    */
   struct FlatTextCache
   {
     // mContainerNode and mNodeOffset represent a point in DOM tree.  E.g.,
     // if mContainerNode is a div element, mNodeOffset is index of its child.
     nsCOMPtr<nsINode> mContainerNode;
@@ -256,83 +320,16 @@ private:
   IMEMessage mSendingNotification;
 
   bool mIsObserving;
   bool mIMEHasFocus;
   bool mNeedsToNotifyIMEOfFocusSet;
   bool mNeedsToNotifyIMEOfTextChange;
   bool mNeedsToNotifyIMEOfSelectionChange;
   bool mNeedsToNotifyIMEOfPositionChange;
-  // mIsFlushingPendingNotifications is true between
-  // FlushMergeableNotifications() creates IMENotificationSender and
-  // IMENotificationSender sent all pending notifications.
-  bool mIsFlushingPendingNotifications;
   // mIsHandlingQueryContentEvent is true when IMEContentObserver is handling
   // WidgetQueryContentEvent with ContentEventHandler.
   bool mIsHandlingQueryContentEvent;
-
-
-  /**
-   * Helper classes to notify IME.
-   */
-
-  class AChangeEvent: public nsRunnable
-  {
-  protected:
-    enum ChangeEventType
-    {
-      eChangeEventType_Focus,
-      eChangeEventType_Selection,
-      eChangeEventType_Text,
-      eChangeEventType_Position,
-      eChangeEventType_FlushPendingEvents
-    };
-
-    explicit AChangeEvent(IMEContentObserver* aIMEContentObserver)
-      : mIMEContentObserver(aIMEContentObserver)
-    {
-      MOZ_ASSERT(mIMEContentObserver);
-    }
-
-    RefPtr<IMEContentObserver> mIMEContentObserver;
-
-    /**
-     * CanNotifyIME() checks if mIMEContentObserver can and should notify IME.
-     */
-    bool CanNotifyIME(ChangeEventType aChangeEventType) const;
-
-    /**
-     * IsSafeToNotifyIME() checks if it's safe to noitify IME.
-     */
-    bool IsSafeToNotifyIME(ChangeEventType aChangeEventType) const;
-  };
-
-  class IMENotificationSender: public AChangeEvent
-  {
-  public:
-    explicit IMENotificationSender(IMEContentObserver* aIMEContentObserver)
-      : AChangeEvent(aIMEContentObserver)
-    {
-    }
-    NS_IMETHOD Run() override;
-
-  private:
-    void SendFocusSet();
-    void SendSelectionChange();
-    void SendTextChange();
-    void SendPositionChange();
-  };
-
-  class AsyncMergeableNotificationsFlusher : public AChangeEvent
-  {
-  public:
-    explicit AsyncMergeableNotificationsFlusher(
-      IMEContentObserver* aIMEContentObserver)
-      : AChangeEvent(aIMEContentObserver)
-    {
-    }
-    NS_IMETHOD Run() override;
-  };
 };
 
 } // namespace mozilla
 
 #endif // mozilla_IMEContentObserver_h_

--- a/dom/events/IMEStateManager.cpp
+++ b/dom/events/IMEStateManager.cpp
@@ -510,16 +510,23 @@ IMEStateManager::OnChangeFocusInternal(n
   sPresContext = aPresContext;
   sContent = aContent;
 
   // Don't call CreateIMEContentObserver() here except when a plugin gets
   // focus because it will be called from the focus event handler of focused
   // editor.
   if (newState.mEnabled == IMEState::PLUGIN) {
     CreateIMEContentObserver(nullptr);
+    if (sActiveIMEContentObserver) {
+      MOZ_LOG(sISMLog, LogLevel::Debug,
+        ("ISM:   IMEStateManager::OnChangeFocusInternal(), an "
+         "IMEContentObserver instance is created for plugin and trying to "
+         "flush its pending notifications..."));
+      sActiveIMEContentObserver->TryToFlushPendingNotifications();
+    }
   }
 
   return NS_OK;
 }
 
 // static
 void
 IMEStateManager::OnInstalledMenuKeyboardListener(bool aInstalling)
@@ -679,16 +686,24 @@ IMEStateManager::OnFocusInEditor(nsPresC
         ("ISM:   IMEStateManager::OnFocusInEditor(), "
          "the editor is already being managed by sActiveIMEContentObserver"));
       return;
     }
     DestroyIMEContentObserver();
   }
 
   CreateIMEContentObserver(aEditor);
+
+  // Let's flush the focus notification now.
+  if (sActiveIMEContentObserver) {
+    MOZ_LOG(sISMLog, LogLevel::Debug,
+      ("ISM:   IMEStateManager::OnFocusInEditor(), new IMEContentObserver is "
+       "created, trying to flush pending notifications..."));
+    sActiveIMEContentObserver->TryToFlushPendingNotifications();
+  }
 }
 
 // static
 void
 IMEStateManager::OnEditorInitialized(nsIEditor* aEditor)
 {
   if (!sActiveIMEContentObserver ||
       sActiveIMEContentObserver->GetEditor() != aEditor) {
@@ -792,16 +807,19 @@ IMEStateManager::UpdateIMEState(const IM
 
   if (updateIMEState) {
     InputContextAction action(InputContextAction::CAUSE_UNKNOWN,
                               InputContextAction::FOCUS_NOT_CHANGED);
     SetIMEState(aNewIMEState, aContent, widget, action);
   }
 
   if (createTextStateManager) {
+    // XXX In this case, it might not be enough safe to notify IME of anything.
+    //     So, don't try to flush pending notifications of IMEContentObserver
+    //     here.
     CreateIMEContentObserver(aEditor);
   }
 }
 
 // static
 IMEState
 IMEStateManager::GetNewIMEState(nsPresContext* aPresContext,
                                 nsIContent*    aContent)

--- a/dom/media/VideoUtils.h
+++ b/dom/media/VideoUtils.h
@@ -149,19 +149,19 @@ CheckedInt64 TimeUnitToFrames(const medi
 
 // Converts from seconds to microseconds. Returns failure if the resulting
 // integer is too big to fit in an int64_t.
 nsresult SecondsToUsecs(double aSeconds, int64_t& aOutUsecs);
 
 // The maximum height and width of the video. Used for
 // sanitizing the memory allocation of the RGB buffer.
 // The maximum resolution we anticipate encountering in the
-// wild is 2160p - 3840x2160 pixels.
-static const int32_t MAX_VIDEO_WIDTH = 4000;
-static const int32_t MAX_VIDEO_HEIGHT = 3000;
+// wild is 2160p (UHD "4K") or 4320p - 7680x4320 pixels for VR.
+static const int32_t MAX_VIDEO_WIDTH = 8192;
+static const int32_t MAX_VIDEO_HEIGHT = 4608;
 
 // Scales the display rect aDisplay by aspect ratio aAspectRatio.
 // Note that aDisplay must be validated by IsValidVideoRegion()
 // before being used!
 void ScaleDisplayByAspectRatio(nsIntSize& aDisplay, float aAspectRatio);
 
 // Downmix multichannel Audio samples to Stereo.
 // Input are the buffer contains multichannel data,

--- a/dom/media/eme/CDMProxy.cpp
+++ b/dom/media/eme/CDMProxy.cpp
@@ -565,17 +565,20 @@ CDMProxy::OnKeyStatusesChange(const nsAS
   }
 }
 
 void
 CDMProxy::OnExpirationChange(const nsAString& aSessionId,
                              GMPTimestamp aExpiryTime)
 {
   MOZ_ASSERT(NS_IsMainThread());
-  NS_WARNING("CDMProxy::OnExpirationChange() not implemented");
+  RefPtr<dom::MediaKeySession> session(mKeys->GetSession(aSessionId));
+  if (session) {
+    session->SetExpiration(static_cast<double>(aExpiryTime));
+  }
 }
 
 void
 CDMProxy::OnSessionClosed(const nsAString& aSessionId)
 {
   MOZ_ASSERT(NS_IsMainThread());
   if (mKeys.IsNull()) {
     return;

--- a/dom/media/eme/MediaKeySession.cpp
+++ b/dom/media/eme/MediaKeySession.cpp
@@ -50,16 +50,17 @@ MediaKeySession::MediaKeySession(JSConte
   , mKeys(aKeys)
   , mKeySystem(aKeySystem)
   , mCDMVersion(aCDMVersion)
   , mSessionType(aSessionType)
   , mToken(sMediaKeySessionNum++)
   , mIsClosed(false)
   , mUninitialized(true)
   , mKeyStatusMap(new MediaKeyStatusMap(aCx, aParent, aRv))
+  , mExpiration(JS::GenericNaN())
 {
   EME_LOG("MediaKeySession[%p,''] session Id set", this);
 
   MOZ_ASSERT(aParent);
   if (aRv.Failed()) {
     return;
   }
   mClosed = MakePromise(aRv, NS_LITERAL_CSTRING("MediaKeys.createSession"));
@@ -109,17 +110,17 @@ JSObject*
 MediaKeySession::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto)
 {
   return MediaKeySessionBinding::Wrap(aCx, this, aGivenProto);
 }
 
 double
 MediaKeySession::Expiration() const
 {
-  return JS::GenericNaN();
+  return mExpiration;
 }
 
 Promise*
 MediaKeySession::Closed() const
 {
   return mClosed;
 }
 
@@ -258,16 +259,26 @@ MediaKeySession::Load(const nsAString& a
 already_AddRefed<Promise>
 MediaKeySession::Update(const ArrayBufferViewOrArrayBuffer& aResponse, ErrorResult& aRv)
 {
   RefPtr<DetailedPromise> promise(MakePromise(aRv,
     NS_LITERAL_CSTRING("MediaKeySession.update")));
   if (aRv.Failed()) {
     return nullptr;
   }
+
+  if (!IsCallable()) {
+    // If this object's callable value is false, return a promise rejected
+    // with a new DOMException whose name is InvalidStateError.
+    EME_LOG("MediaKeySession[%p,''] Update() called before sessionId set by CDM", this);
+    promise->MaybeReject(NS_ERROR_DOM_INVALID_STATE_ERR,
+      NS_LITERAL_CSTRING("MediaKeySession.Update() called before sessionId set by CDM"));
+    return promise.forget();
+  }
+
   nsTArray<uint8_t> data;
   if (IsClosed() || !mKeys->GetCDMProxy()) {
     promise->MaybeReject(NS_ERROR_DOM_INVALID_STATE_ERR,
                          NS_LITERAL_CSTRING("Session is closed or was not properly initialized"));
     EME_LOG("MediaKeySession[%p,'%s'] Update() failed, session is closed or was not properly initialised.",
             this, NS_ConvertUTF16toUTF8(mSessionId).get());
     return promise.forget();
   }
@@ -303,16 +314,24 @@ MediaKeySession::Update(const ArrayBuffe
 already_AddRefed<Promise>
 MediaKeySession::Close(ErrorResult& aRv)
 {
   RefPtr<DetailedPromise> promise(MakePromise(aRv,
     NS_LITERAL_CSTRING("MediaKeySession.close")));
   if (aRv.Failed()) {
     return nullptr;
   }
+  if (!IsCallable()) {
+    // If this object's callable value is false, return a promise rejected
+    // with a new DOMException whose name is InvalidStateError.
+    EME_LOG("MediaKeySession[%p,''] Close() called before sessionId set by CDM", this);
+    promise->MaybeReject(NS_ERROR_DOM_INVALID_STATE_ERR,
+      NS_LITERAL_CSTRING("MediaKeySession.Close() called before sessionId set by CDM"));
+    return promise.forget();
+  }
   if (IsClosed() || !mKeys->GetCDMProxy()) {
     EME_LOG("MediaKeySession[%p,'%s'] Close() already closed",
             this, NS_ConvertUTF16toUTF8(mSessionId).get());
     promise->MaybeResolve(JS::UndefinedHandleValue);
     return promise.forget();
   }
   PromiseId pid = mKeys->StorePromise(promise);
   mKeys->GetCDMProxy()->CloseSession(mSessionId, pid);
@@ -346,16 +365,24 @@ MediaKeySession::IsClosed() const
 already_AddRefed<Promise>
 MediaKeySession::Remove(ErrorResult& aRv)
 {
   RefPtr<DetailedPromise> promise(MakePromise(aRv,
     NS_LITERAL_CSTRING("MediaKeySession.remove")));
   if (aRv.Failed()) {
     return nullptr;
   }
+  if (!IsCallable()) {
+    // If this object's callable value is false, return a promise rejected
+    // with a new DOMException whose name is InvalidStateError.
+    EME_LOG("MediaKeySession[%p,''] Remove() called before sessionId set by CDM", this);
+    promise->MaybeReject(NS_ERROR_DOM_INVALID_STATE_ERR,
+      NS_LITERAL_CSTRING("MediaKeySession.Remove() called before sessionId set by CDM"));
+    return promise.forget();
+  }
   if (mSessionType != SessionType::Persistent) {
     promise->MaybeReject(NS_ERROR_DOM_INVALID_ACCESS_ERR,
                          NS_LITERAL_CSTRING("Calling MediaKeySession.remove() on non-persistent session"));
     // "The operation is not supported on session type sessions."
     EME_LOG("MediaKeySession[%p,'%s'] Remove() failed, sesion not persisrtent.",
             this, NS_ConvertUTF16toUTF8(mSessionId).get());
     return promise.forget();
   }
@@ -432,10 +459,20 @@ MediaKeySession::MakePromise(ErrorResult
   if (!global) {
     NS_WARNING("Passed non-global to MediaKeys ctor!");
     aRv.Throw(NS_ERROR_UNEXPECTED);
     return nullptr;
   }
   return DetailedPromise::Create(global, aRv, aName);
 }
 
+void
+MediaKeySession::SetExpiration(double aExpiration)
+{
+  EME_LOG("MediaKeySession[%p,'%s'] SetExpiry(%lf)",
+          this,
+          NS_ConvertUTF16toUTF8(mSessionId).get(),
+          aExpiration);
+  mExpiration = aExpiration;
+}
+
 } // namespace dom
 } // namespace mozilla

--- a/dom/media/eme/MediaKeySession.h
+++ b/dom/media/eme/MediaKeySession.h
@@ -87,36 +87,47 @@ public:
   void DispatchKeyError(uint32_t system_code);
 
   void DispatchKeyStatusesChange();
 
   void OnClosed();
 
   bool IsClosed() const;
 
+  void SetExpiration(double aExpiry);
+
   // Process-unique identifier.
   uint32_t Token() const;
 
 private:
   ~MediaKeySession();
 
   void UpdateKeyStatusMap();
+
+  bool IsCallable() const {
+    // The EME spec sets the "callable value" to true whenever the CDM sets
+    // the sessionId. When the session is initialized, sessionId is empty and
+    // callable is thus false.
+    return !mSessionId.IsEmpty();
+  }
+
   already_AddRefed<DetailedPromise> MakePromise(ErrorResult& aRv,
                                                 const nsACString& aName);
 
   RefPtr<DetailedPromise> mClosed;
 
   RefPtr<MediaKeyError> mMediaKeyError;
   RefPtr<MediaKeys> mKeys;
   const nsString mKeySystem;
   const nsString mCDMVersion;
   nsString mSessionId;
   const SessionType mSessionType;
   const uint32_t mToken;
   bool mIsClosed;
   bool mUninitialized;
   RefPtr<MediaKeyStatusMap> mKeyStatusMap;
+  double mExpiration;
 };
 
 } // namespace dom
 } // namespace mozilla
 
 #endif

--- a/dom/media/test/mochitest.ini
+++ b/dom/media/test/mochitest.ini
@@ -611,16 +611,17 @@ skip-if = (toolkit == 'android' && proce
 [test_currentTime.html]
 [test_decode_error.html]
 [test_decoder_disable.html]
 [test_defaultMuted.html]
 [test_delay_load.html]
 skip-if = buildapp == 'b2g' && toolkit != 'gonk' # bug 1082984
 [test_dormant_playback.html]
 skip-if = (os == 'win' && os_version == '5.1') || (os != 'win' && toolkit != 'gonk')
+[test_eme_session_callable_value.html]
 [test_eme_canvas_blocked.html]
 skip-if = toolkit == 'android' # bug 1149374
 [test_eme_non_mse_fails.html]
 skip-if = toolkit == 'android' # bug 1149374
 [test_eme_request_notifications.html]
 skip-if = toolkit == 'android' # bug 1149374
 [test_eme_persistent_sessions.html]
 skip-if = toolkit == 'android' # bug 1149374

new file mode 100644
--- /dev/null
+++ b/dom/media/test/test_eme_session_callable_value.html
@@ -0,0 +1,35 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test Encrypted Media Extensions</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+  <script type="text/javascript" src="manifest.js"></script>
+  <script type="text/javascript" src="eme.js"></script>
+</head>
+<body>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+
+function Test() {
+  navigator.requestMediaKeySystemAccess('org.w3.clearkey', [{ initDataTypes: ['cenc'] }])
+  .then(access => access.createMediaKeys())
+  .then(mediaKeys => {
+    var initData = (new TextEncoder()).encode( 'this is an invalid license, and that is ok');
+    var s = mediaKeys.createSession("temporary");
+    s.generateRequest("cenc", initData); // ignore result.
+    // "update()" call should fail, because MediaKeySession is "not callable"
+    // yet, since CDM won't have had a chance to set the sessionId on MediaKeySession.
+    return s.update(initData);
+  })
+  .then(()=>{ok(false, "An exception should be thrown; MediaKeySession should be not callable."); SimpleTest.finish();},
+        ()=>{ok(true,  "We expect this to fail; MediaKeySession should be not callable."); SimpleTest.finish();});
+}
+
+SimpleTest.waitForExplicitFinish();
+SetupEMEPref(Test);
+
+</script>
+</pre>
+</body>
+</html>

--- a/dom/media/webvtt/update-webvtt.js
+++ b/dom/media/webvtt/update-webvtt.js
@@ -4,31 +4,36 @@ var gift = require('gift'),
     argv = require('optimist')
       .usage('Update vtt.jsm with the latest from a vtt.js directory.\nUsage:' +
              ' $0 -d [dir]')
       .demand('d')
       .options('d', {
         alias: 'dir',
         describe: 'Path to WebVTT directory.'
       })
+      .options('r', {
+        alias: 'rev',
+        describe: 'Revision to update to.',
+        default: 'master'
+      })
       .options('w', {
         alias: 'write',
         describe: 'Path to file to write to.',
         default: "./vtt.jsm"
       })
       .argv;
 
 var repo = gift(argv.d);
 repo.status(function(err, status) {
   if (!status.clean) {
     console.log("The repository's working directory is not clean. Aborting.");
     process.exit(1);
   }
-  repo.checkout("master", function() {
-    repo.commits("master", 1, function(err, commits) {
+  repo.checkout(argv.r, function() {
+    repo.commits(argv.r, 1, function(err, commits) {
       var vttjs = fs.readFileSync(argv.d + "/lib/vtt.js", 'utf8');
 
       // Remove settings for VIM and Emacs.
       vttjs = vttjs.replace(/\/\* -\*-.*-\*- \*\/\n/, '');
       vttjs = vttjs.replace(/\/\* vim:.* \*\/\n/, '');
 
       // Concatenate header and vttjs code.
       vttjs =

--- a/dom/media/webvtt/vtt.jsm
+++ b/dom/media/webvtt/vtt.jsm
@@ -3,17 +3,17 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 this.EXPORTED_SYMBOLS = ["WebVTT"];
 
 /**
  * Code below is vtt.js the JS WebVTT implementation.
  * Current source code can be found at http://github.com/mozilla/vtt.js
  *
- * Code taken from commit f5a1a60775a615cd9670d6cdaedddf2c6f25fae3
+ * Code taken from commit 364c6b951a07306848a706d1d03c2a6ae942517d
  */
 /**
  * Copyright 2013 vtt.js Contributors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
@@ -721,48 +721,70 @@ this.EXPORTED_SYMBOLS = ["WebVTT"];
 
   StyleBox.prototype.formatStyle = function(val, unit) {
     return val === 0 ? 0 : val + unit;
   };
 
   // Constructs the computed display state of the cue (a div). Places the div
   // into the overlay which should be a block level element (usually a div).
   function CueStyleBox(window, cue, styleOptions) {
+    var isIE8 = (/MSIE\s8\.0/).test(navigator.userAgent);
+    var color = "rgba(255, 255, 255, 1)";
+    var backgroundColor = "rgba(0, 0, 0, 0.8)";
+
+    if (isIE8) {
+      color = "rgb(255, 255, 255)";
+      backgroundColor = "rgb(0, 0, 0)";
+    }
+
     StyleBox.call(this);
     this.cue = cue;
 
     // Parse our cue's text into a DOM tree rooted at 'cueDiv'. This div will
     // have inline positioning and will function as the cue background box.
     this.cueDiv = parseContent(window, cue.text);
-    this.applyStyles({
-      color: "rgba(255, 255, 255, 1)",
-      backgroundColor: "rgba(0, 0, 0, 0.8)",
+    var styles = {
+      color: color,
+      backgroundColor: backgroundColor,
       position: "relative",
       left: 0,
       right: 0,
       top: 0,
       bottom: 0,
       display: "inline"
-    }, this.cueDiv);
+    };
+
+    if (!isIE8) {
+      styles.writingMode = cue.vertical === "" ? "horizontal-tb"
+                                               : cue.vertical === "lr" ? "vertical-lr"
+                                                                       : "vertical-rl";
+      styles.unicodeBidi = "plaintext";
+    }
+    this.applyStyles(styles, this.cueDiv);
 
     // Create an absolutely positioned div that will be used to position the cue
     // div. Note, all WebVTT cue-setting alignments are equivalent to the CSS
     // mirrors of them except "middle" which is "center" in CSS.
     this.div = window.document.createElement("div");
-    this.applyStyles({
+    styles = {
       textAlign: cue.align === "middle" ? "center" : cue.align,
-      direction: determineBidi(this.cueDiv),
-      writingMode: cue.vertical === "" ? "horizontal-tb"
-                                       : cue.vertical === "lr" ? "vertical-lr"
-                                                               : "vertical-rl",
-      unicodeBidi: "plaintext",
       font: styleOptions.font,
       whiteSpace: "pre-line",
       position: "absolute"
-    });
+    };
+
+    if (!isIE8) {
+      styles.direction = determineBidi(this.cueDiv);
+      styles.writingMode = cue.vertical === "" ? "horizontal-tb"
+                                               : cue.vertical === "lr" ? "vertical-lr"
+                                                                       : "vertical-rl".
+      stylesunicodeBidi =  "plaintext";
+    }
+
+    this.applyStyles(styles);
 
     this.div.appendChild(this.cueDiv);
 
     // Calculate the distance from the reference edge of the viewport to the text
     // position of the cue box. The reference edge will be resolved later when
     // the box orientation styles are applied.
     var textPos = 0;
     switch (cue.positionAlign) {
@@ -778,17 +800,17 @@ this.EXPORTED_SYMBOLS = ["WebVTT"];
     }
 
     // Horizontal box orientation; textPos is the distance from the left edge of the
     // area to the left edge of the box and cue.size is the distance extending to
     // the right from there.
     if (cue.vertical === "") {
       this.applyStyles({
         left:  this.formatStyle(textPos, "%"),
-        width: this.formatStyle(cue.size, "%"),
+        width: this.formatStyle(cue.size, "%")
       });
     // Vertical box orientation; textPos is the distance from the top edge of the
     // area to the top edge of the box and cue.size is the height extending
     // downwards from there.
     } else {
       this.applyStyles({
         top: this.formatStyle(textPos, "%"),
         height: this.formatStyle(cue.size, "%")
@@ -797,50 +819,61 @@ this.EXPORTED_SYMBOLS = ["WebVTT"];
 
     this.move = function(box) {
       this.applyStyles({
         top: this.formatStyle(box.top, "px"),
         bottom: this.formatStyle(box.bottom, "px"),
         left: this.formatStyle(box.left, "px"),
         right: this.formatStyle(box.right, "px"),
         height: this.formatStyle(box.height, "px"),
-        width: this.formatStyle(box.width, "px"),
+        width: this.formatStyle(box.width, "px")
       });
     };
   }
   CueStyleBox.prototype = _objCreate(StyleBox.prototype);
   CueStyleBox.prototype.constructor = CueStyleBox;
 
   // Represents the co-ordinates of an Element in a way that we can easily
   // compute things with such as if it overlaps or intersects with another Element.
   // Can initialize it with either a StyleBox or another BoxPosition.
   function BoxPosition(obj) {
+    var isIE8 = (/MSIE\s8\.0/).test(navigator.userAgent);
+
     // Either a BoxPosition was passed in and we need to copy it, or a StyleBox
     // was passed in and we need to copy the results of 'getBoundingClientRect'
     // as the object returned is readonly. All co-ordinate values are in reference
     // to the viewport origin (top left).
-    var lh;
+    var lh, height, width, top;
     if (obj.div) {
+      height = obj.div.offsetHeight;
+      width = obj.div.offsetWidth;
+      top = obj.div.offsetTop;
+
       var rects = (rects = obj.div.childNodes) && (rects = rects[0]) &&
                   rects.getClientRects && rects.getClientRects();
       obj = obj.div.getBoundingClientRect();
       // In certain cases the outter div will be slightly larger then the sum of
       // the inner div's lines. This could be due to bold text, etc, on some platforms.
       // In this case we should get the average line height and use that. This will
       // result in the desired behaviour.
       lh = rects ? Math.max((rects[0] && rects[0].height) || 0, obj.height / rects.length)
                  : 0;
+
     }
     this.left = obj.left;
     this.right = obj.right;
-    this.top = obj.top;
-    this.height = obj.height;
-    this.bottom = obj.bottom;
-    this.width = obj.width;
+    this.top = obj.top || top;
+    this.height = obj.height || height;
+    this.bottom = obj.bottom || (top + (obj.height || height));
+    this.width = obj.width || width;
     this.lineHeight = lh !== undefined ? lh : obj.lineHeight;
+
+    if (isIE8 && !this.lineHeight) {
+      this.lineHeight = 13;
+    }
   }
 
   // Move the box along a particular axis. Optionally pass in an amount to move
   // the box. If no amount is passed then the default is the line height of the
   // box.
   BoxPosition.prototype.move = function(axis, toMove) {
     toMove = toMove !== undefined ? toMove : this.lineHeight;
     switch (axis) {
@@ -928,26 +961,31 @@ this.EXPORTED_SYMBOLS = ["WebVTT"];
       height: this.height,
       width: this.width
     };
   };
 
   // Get an object that represents the box's position without anything extra.
   // Can pass a StyleBox, HTMLElement, or another BoxPositon.
   BoxPosition.getSimpleBoxPosition = function(obj) {
+    var height = obj.div ? obj.div.offsetHeight : obj.tagName ? obj.offsetHeight : 0;
+    var width = obj.div ? obj.div.offsetWidth : obj.tagName ? obj.offsetWidth : 0;
+    var top = obj.div ? obj.div.offsetTop : obj.tagName ? obj.offsetTop : 0;
+
     obj = obj.div ? obj.div.getBoundingClientRect() :
                   obj.tagName ? obj.getBoundingClientRect() : obj;
-    return {
+    var ret = {
       left: obj.left,
       right: obj.right,
-      top: obj.top,
-      height: obj.height,
-      bottom: obj.bottom,
-      width: obj.width
+      top: obj.top || top,
+      height: obj.height || height,
+      bottom: obj.bottom || (top + (obj.height || height)),
+      width: obj.width || width
     };
+    return ret;
   };
 
   // Move a StyleBox to its specified, or next best, position. The containerBox
   // is the box that contains the StyleBox, such as a div. boxPositions are
   // a list of other boxes that the styleBox can't overlap with.
   function moveBoxToLinePosition(window, styleBox, containerBox, boxPositions) {
 
     // Find the best position for a cue box, b, on the video. The axis parameter
@@ -1136,43 +1174,49 @@ this.EXPORTED_SYMBOLS = ["WebVTT"];
           return true;
         }
       }
       return false;
     }
 
     // We don't need to recompute the cues' display states. Just reuse them.
     if (!shouldCompute(cues)) {
-      cues.forEach(function(cue) {
-        paddedOverlay.appendChild(cue.displayState);
-      });
+      for (var i = 0; i < cues.length; i++) {
+        paddedOverlay.appendChild(cues[i].displayState);
+      }
       return;
     }
 
     var boxPositions = [],
         containerBox = BoxPosition.getSimpleBoxPosition(paddedOverlay),
         fontSize = Math.round(containerBox.height * FONT_SIZE_PERCENT * 100) / 100;
     var styleOptions = {
       font: fontSize + "px " + FONT_STYLE
     };
 
-    cues.forEach(function(cue) {
-      // Compute the intial position and styles of the cue div.
-      var styleBox = new CueStyleBox(window, cue, styleOptions);
-      paddedOverlay.appendChild(styleBox.div);
+    (function() {
+      var styleBox, cue;
+
+      for (var i = 0; i < cues.length; i++) {
+        cue = cues[i];
+
+        // Compute the intial position and styles of the cue div.
+        styleBox = new CueStyleBox(window, cue, styleOptions);
+        paddedOverlay.appendChild(styleBox.div);
 
-      // Move the cue div to it's correct line position.
-      moveBoxToLinePosition(window, styleBox, containerBox, boxPositions);
+        // Move the cue div to it's correct line position.
+        moveBoxToLinePosition(window, styleBox, containerBox, boxPositions);
 
-      // Remember the computed div so that we don't have to recompute it later
-      // if we don't have too.
-      cue.displayState = styleBox.div;
+        // Remember the computed div so that we don't have to recompute it later
+        // if we don't have too.
+        cue.displayState = styleBox.div;
 
-      boxPositions.push(BoxPosition.getSimpleBoxPosition(styleBox));
-    });
+        boxPositions.push(BoxPosition.getSimpleBoxPosition(styleBox));
+      }
+    })();
   };
 
   WebVTT.Parser = function(window, decoder) {
     this.window = window;
     this.state = "INITIAL";
     this.buffer = "";
     this.decoder = decoder || new TextDecoder("utf8");
     this.regionList = [];

--- a/dom/push/Push.js
+++ b/dom/push/Push.js
@@ -1,76 +1,72 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 "use strict";
 
-// Don't modify this, instead set dom.push.debug.
-var gDebuggingEnabled = false;
-
-function debug(s) {
-  if (gDebuggingEnabled)
-    dump("-*- Push.js: " + s + "\n");
-}
-
 const Cc = Components.classes;
 const Ci = Components.interfaces;
 const Cu = Components.utils;
 const Cr = Components.results;
 
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/DOMRequestHelper.jsm");
 
+XPCOMUtils.defineLazyGetter(this, "console", () => {
+  let {ConsoleAPI} = Cu.import("resource://gre/modules/Console.jsm", {});
+  return new ConsoleAPI({
+    maxLogLevelPref: "dom.push.loglevel",
+    prefix: "Push",
+  });
+});
+
 const PUSH_CID = Components.ID("{cde1d019-fad8-4044-b141-65fb4fb7a245}");
 
 /**
  * The Push component runs in the child process and exposes the SimplePush API
  * to the web application. The PushService running in the parent process is the
  * one actually performing all operations.
  */
 function Push() {
-  debug("Push Constructor");
+  console.debug("Push()");
 }
 
 Push.prototype = {
   __proto__: DOMRequestIpcHelper.prototype,
 
   contractID: "@mozilla.org/push/PushManager;1",
 
   classID : PUSH_CID,
 
   QueryInterface : XPCOMUtils.generateQI([Ci.nsIDOMGlobalPropertyInitializer,
                                           Ci.nsISupportsWeakReference,
                                           Ci.nsIObserver]),
 
   init: function(aWindow) {
-    // Set debug first so that all debugging actually works.
-    // NOTE: We don't add an observer here like in PushService. Flipping the
-    // pref will require a reload of the app/page, which seems acceptable.
-    gDebuggingEnabled = Services.prefs.getBoolPref("dom.push.debug");
-    debug("init()");
+    console.debug("init()");
 
     this._window = aWindow;
 
     this.initDOMRequestHelper(aWindow);
 
     this._principal = aWindow.document.nodePrincipal;
 
     this._client = Cc["@mozilla.org/push/PushClient;1"].createInstance(Ci.nsIPushClient);
   },
 
   setScope: function(scope){
-    debug('setScope ' + scope);
+    console.debug("setScope()", scope);
     this._scope = scope;
   },
 
   askPermission: function (aAllowCallback, aCancelCallback) {
-    debug("askPermission");
+    console.debug("askPermission()");
 
     return this.createPromise((resolve, reject) => {
       let permissionDenied = () => {
         reject(new this._window.DOMException(
           "User denied permission to use the Push API",
           "PermissionDeniedError"
         ));
       };
@@ -89,39 +85,39 @@ Push.prototype = {
         permissionDenied();
       } else {
         this._requestPermission(resolve, permissionDenied);
       }
     });
   },
 
   subscribe: function() {
-    debug("subscribe()");
+    console.debug("subscribe()", this._scope);
 
     let histogram = Services.telemetry.getHistogramById("PUSH_API_USED");
     histogram.add(true);
     return this.askPermission().then(() =>
       this.createPromise((resolve, reject) => {
         let callback = new PushEndpointCallback(this, resolve, reject);
         this._client.subscribe(this._scope, this._principal, callback);
       })
     );
   },
 
   getSubscription: function() {
-    debug("getSubscription()" + this._scope);
+    console.debug("getSubscription()", this._scope);
 
     return this.createPromise((resolve, reject) => {
       let callback = new PushEndpointCallback(this, resolve, reject);
       this._client.getSubscription(this._scope, this._principal, callback);
     });
   },
 
   permissionState: function() {
-    debug("permissionState()" + this._scope);
+    console.debug("permissionState()", this._scope);
 
     return this.createPromise((resolve, reject) => {
       let permission = Ci.nsIPermissionManager.UNKNOWN_ACTION;
 
       try {
         permission = this._testPermission();
       } catch(e) {
         reject();

--- a/dom/push/PushClient.js
+++ b/dom/push/PushClient.js
@@ -1,43 +1,41 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 "use strict";
 
-// Don't modify this, instead set dom.push.debug.
-var gDebuggingEnabled = false;
-
-function debug(s) {
-  if (gDebuggingEnabled)
-    dump("-*- PushClient.js: " + s + "\n");
-}
-
 const Cc = Components.classes;
 const Ci = Components.interfaces;
 const Cu = Components.utils;
 const Cr = Components.results;
 
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
 
-gDebuggingEnabled = Services.prefs.getBoolPref("dom.push.debug");
+XPCOMUtils.defineLazyGetter(this, "console", () => {
+  let {ConsoleAPI} = Cu.import("resource://gre/modules/Console.jsm", {});
+  return new ConsoleAPI({
+    maxLogLevelPref: "dom.push.loglevel",
+    prefix: "PushClient",
+  });
+});
 
 const kMessages = [
   "PushService:Register:OK",
   "PushService:Register:KO",
   "PushService:Registration:OK",
   "PushService:Registration:KO",
   "PushService:Unregister:OK",
   "PushService:Unregister:KO",
 ];
 
 this.PushClient = function PushClient() {
-  debug("PushClient created!");
+  console.debug("PushClient()");
   this._cpmm = Cc["@mozilla.org/childprocessmessagemanager;1"]
                  .getService(Ci.nsISyncMessageSender);
   this._requests = {};
   this.addListeners();
 };
 
 PushClient.prototype = {
   classID: Components.ID("{16042199-bec0-484a-9640-25ecc0c0a149}"),
@@ -68,97 +66,95 @@ PushClient.prototype = {
 
   addListeners: function() {
     for (let message of kMessages) {
       this._cpmm.addWeakMessageListener(message, this);
     }
   },
 
   subscribe: function(scope, principal, callback) {
-    debug("subscribe() " + scope);
+    console.debug("subscribe()", scope);
     let requestId = this.addRequest(callback);
     this._cpmm.sendAsyncMessage("Push:Register", {
                                 scope: scope,
                                 requestID: requestId,
                               }, null, principal);
   },
 
   unsubscribe: function(scope, principal, callback) {
-    debug("unsubscribe() " + scope);
+    console.debug("unsubscribe()", scope);
     let requestId = this.addRequest(callback);
     this._cpmm.sendAsyncMessage("Push:Unregister", {
                                 scope: scope,
                                 requestID: requestId,
                               }, null, principal);
   },
 
   getSubscription: function(scope, principal, callback) {
-    debug("getSubscription()" + scope);
+    console.debug("getSubscription()", scope);
     let requestId = this.addRequest(callback);
-    debug("Going to send  " + scope + " " + principal + " " + requestId);
+    console.debug("getSubscription: Going to send", scope, principal,
+      requestId);
     this._cpmm.sendAsyncMessage("Push:Registration", {
                                 scope: scope,
                                 requestID: requestId,
                               }, null, principal);
   },
 
   _deliverPushEndpoint: function(request, registration) {
+    if (!registration) {
+      request.onPushEndpoint(Cr.NS_OK, "", 0, null);
+      return;
+    }
     if (registration.p256dhKey) {
       let key = new Uint8Array(registration.p256dhKey);
       request.onPushEndpoint(Cr.NS_OK,
                              registration.pushEndpoint,
                              key.length,
                              key);
       return;
     }
 
     request.onPushEndpoint(Cr.NS_OK, registration.pushEndpoint, 0, null);
   },
 
   receiveMessage: function(aMessage) {
+    console.debug("receiveMessage()", aMessage);
 
     let json = aMessage.data;
     let request = this.takeRequest(json.requestID);
 
     if (!request) {
+      console.error("receiveMessage: Unknown request ID", json.requestID);
       return;
     }
 
-    debug("receiveMessage(): " + JSON.stringify(aMessage))
     switch (aMessage.name) {
       case "PushService:Register:OK":
-        this._deliverPushEndpoint(request, json);
-        break;
-      case "PushService:Register:KO":
-        request.onPushEndpoint(Cr.NS_ERROR_FAILURE, "", 0, null);
+      case "PushService:Registration:OK":
+        this._deliverPushEndpoint(request, json.result);
         break;
-      case "PushService:Registration:OK":
-      {
-        let endpoint = "";
-        if (!json.registration) {
-          request.onPushEndpoint(Cr.NS_OK, "", 0, null);
-        } else {
-          this._deliverPushEndpoint(request, json.registration);
-        }
-        break;
-      }
+
+      case "PushService:Register:KO":
       case "PushService:Registration:KO":
         request.onPushEndpoint(Cr.NS_ERROR_FAILURE, "", 0, null);
         break;
+
       case "PushService:Unregister:OK":
         if (typeof json.result !== "boolean") {
-          debug("Expected boolean result from PushService!");
+          console.error("receiveMessage: Expected boolean for unregister response",
+            json.result);
           request.onUnsubscribe(Cr.NS_ERROR_FAILURE, false);
           return;
         }
 
         request.onUnsubscribe(Cr.NS_OK, json.result);
         break;
       case "PushService:Unregister:KO":
         request.onUnsubscribe(Cr.NS_ERROR_FAILURE, false);
         break;
       default:
-        debug("NOT IMPLEMENTED! receiveMessage for " + aMessage.name);
+        console.error("receiveMessage: NOT IMPLEMENTED!", aMessage.name);
     }
   },
 };
 
 this.NSGetFactory = XPCOMUtils.generateNSGetFactory([PushClient]);

--- a/dom/push/PushDB.jsm
+++ b/dom/push/PushDB.jsm
@@ -1,44 +1,40 @@
 /* jshint moz: true, esnext: true */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 "use strict";
 
-// Don't modify this, instead set dom.push.debug.
-var gDebuggingEnabled = false;
-
-function debug(s) {
-  if (gDebuggingEnabled) {
-    dump("-*- PushDB.jsm: " + s + "\n");
-  }
-}
-
 const Cu = Components.utils;
 Cu.import("resource://gre/modules/IndexedDBHelper.jsm");
 Cu.import("resource://gre/modules/Preferences.jsm");
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.importGlobalProperties(["indexedDB"]);
 
-const prefs = new Preferences("dom.push.");
-
 this.EXPORTED_SYMBOLS = ["PushDB"];
 
+XPCOMUtils.defineLazyGetter(this, "console", () => {
+  let {ConsoleAPI} = Cu.import("resource://gre/modules/Console.jsm", {});
+  return new ConsoleAPI({
+    maxLogLevelPref: "dom.push.loglevel",
+    prefix: "PushDB",
+  });
+});
+
 this.PushDB = function PushDB(dbName, dbVersion, dbStoreName, keyPath, model) {
-  debug("PushDB()");
+  console.debug("PushDB()");
   this._dbStoreName = dbStoreName;
   this._keyPath = keyPath;
   this._model = model;
 
   // set the indexeddb database
   this.initDBHelper(dbName, dbVersion,
                     [dbStoreName]);
-  gDebuggingEnabled = prefs.get("debug");
-  prefs.observe("debug", this);
 };
 
 this.PushDB.prototype = {
   __proto__: IndexedDBHelper.prototype,
 
   toPushRecord: function(record) {
     if (!record) {
       return;
@@ -85,145 +81,134 @@ this.PushDB.prototype = {
   },
 
   /*
    * @param aRecord
    *        The record to be added.
    */
 
   put: function(aRecord) {
-    debug("put()" + JSON.stringify(aRecord));
+    console.debug("put()", aRecord);
     if (!this.isValidRecord(aRecord)) {
       return Promise.reject(new TypeError(
         "Scope, originAttributes, and quota are required! " +
           JSON.stringify(aRecord)
         )
       );
     }
 
     return new Promise((resolve, reject) =>
       this.newTxn(
         "readwrite",
         this._dbStoreName,
         (aTxn, aStore) => {
           aTxn.result = undefined;
 
           aStore.put(aRecord).onsuccess = aEvent => {
-            debug("Request successful. Updated record ID: " +
-                  aEvent.target.result);
+            console.debug("put: Request successful. Updated record",
+              aEvent.target.result);
             aTxn.result = this.toPushRecord(aRecord);
           };
         },
         resolve,
         reject
       )
     );
   },
 
   /*
    * @param aKeyID
    *        The ID of record to be deleted.
    */
   delete: function(aKeyID) {
-    debug("delete()");
+    console.debug("delete()");
 
     return new Promise((resolve, reject) =>
       this.newTxn(
         "readwrite",
         this._dbStoreName,
         function txnCb(aTxn, aStore) {
-          debug("Going to delete " + aKeyID);
+          console.debug("delete: Removing record", aKeyID);
           aStore.delete(aKeyID);
         },
         resolve,
         reject
       )
     );
   },
 
-  clearAll: function clear() {
-    return new Promise((resolve, reject) =>
-      this.newTxn(
-        "readwrite",
-        this._dbStoreName,
-        function (aTxn, aStore) {
-          debug("Going to clear all!");
-          aStore.clear();
-        },
-        resolve,
-        reject
-      )
-    );
-  },
-
   // testFn(record) is called with a database record and should return true if
   // that record should be deleted.
   clearIf: function(testFn) {
-    debug("clearIf()");
+    console.debug("clearIf()");
     return new Promise((resolve, reject) =>
       this.newTxn(
         "readwrite",
         this._dbStoreName,
         (aTxn, aStore) => {
           aTxn.result = undefined;
 
           aStore.openCursor().onsuccess = event => {
             let cursor = event.target.result;
             if (cursor) {
-              if (testFn(this.toPushRecord(cursor.value))) {
+              let record = this.toPushRecord(cursor.value);
+              if (testFn(record)) {
                 let deleteRequest = cursor.delete();
                 deleteRequest.onerror = e => {
-                  debug("Failed to delete entry even when test succeeded!");
+                  console.error("clearIf: Error removing record",
+                    record.keyID, e);
                 }
               }
               cursor.continue();
             }
           }
         },
         resolve,
         reject
       )
     );
   },
 
   getByPushEndpoint: function(aPushEndpoint) {
-    debug("getByPushEndpoint()");
+    console.debug("getByPushEndpoint()");
 
     return new Promise((resolve, reject) =>
       this.newTxn(
         "readonly",
         this._dbStoreName,
         (aTxn, aStore) => {
           aTxn.result = undefined;
 
           let index = aStore.index("pushEndpoint");
           index.get(aPushEndpoint).onsuccess = aEvent => {
-            aTxn.result = this.toPushRecord(aEvent.target.result);
-            debug("Fetch successful " + aEvent.target.result);
+            let record = this.toPushRecord(aEvent.target.result);
+            console.debug("getByPushEndpoint: Got record", record);
+            aTxn.result = record;
           };
         },
         resolve,
         reject
       )
     );
   },
 
   getByKeyID: function(aKeyID) {
-    debug("getByKeyID()");
+    console.debug("getByKeyID()");
 
     return new Promise((resolve, reject) =>
       this.newTxn(
         "readonly",
         this._dbStoreName,
         (aTxn, aStore) => {
           aTxn.result = undefined;
 
           aStore.get(aKeyID).onsuccess = aEvent => {
-            aTxn.result = this.toPushRecord(aEvent.target.result);
-            debug("Fetch successful " + aEvent.target.result);
+            let record = this.toPushRecord(aEvent.target.result);
+            console.debug("getByKeyID: Got record", record);
+            aTxn.result = record;
           };
         },
         resolve,
         reject
       )
     );
   },
 
@@ -237,17 +222,17 @@ this.PushDB.prototype = {
    *  registration record as its argument, and returns a new record. The record
    *  will not be updated if the function returns `null`, `undefined`, or an
    *  invalid record. If the function returns `false`, the record will be
    *  dropped.
    * @returns {Promise} A promise that resolves once all records have been
    *  updated.
    */
   updateByOrigin: function(origin, originAttributes, updateFunc) {
-    debug("updateByOrigin()");
+    console.debug("updateByOrigin()");
 
     return new Promise((resolve, reject) =>
       this.newTxn(
         "readwrite",
         this._dbStoreName,
         (aTxn, aStore) => {
           aTxn.result = [];
 
@@ -259,44 +244,43 @@ this.PushDB.prototype = {
           index.openCursor(range).onsuccess = event => {
             let cursor = event.target.result;
             if (!cursor) {
               return;
             }
             let record = this.toPushRecord(cursor.value);
             let newRecord = updateFunc(record);
             if (newRecord === false) {
-              debug("updateByOrigin: Removing record for key ID " +
+              console.debug("updateByOrigin: Removing record for key ID",
                 record.keyID);
               cursor.delete();
             } else if (this.isValidRecord(newRecord)) {
-              debug("updateByOrigin: Updating record for key ID " +
-                record.keyID);
+              console.debug("updateByOrigin: Updating record for key ID",
+                record.keyID, newRecord);
               cursor.update(newRecord);
             } else {
-              debug("updateByOrigin: Ignoring invalid update for key ID " +
-                record.keyID + ": " + JSON.stringify(newRecord));
+              console.error("updateByOrigin: Ignoring invalid update for record",
+                record.keyID, newRecord);
             }
             cursor.continue();
           };
         },
         resolve,
         reject
       )
     );
   },
 
   // Perform a unique match against { scope, originAttributes }
   getByIdentifiers: function(aPageRecord) {
-    debug("getByIdentifiers() { " + aPageRecord.scope + ", " +
-          JSON.stringify(aPageRecord.originAttributes) + " }");
+    console.debug("getByIdentifiers()", aPageRecord);
     if (!aPageRecord.scope || aPageRecord.originAttributes == undefined) {
-      return Promise.reject(
-               new TypeError("Scope and originAttributes are required! " +
-                             JSON.stringify(aPageRecord)));
+      console.error("getByIdentifiers: Scope and originAttributes are required",
+        aPageRecord);
+      return Promise.reject(new TypeError("Invalid page record"));
     }
 
     return new Promise((resolve, reject) =>
       this.newTxn(
         "readonly",
         this._dbStoreName,
         (aTxn, aStore) => {
           aTxn.result = undefined;
@@ -341,17 +325,17 @@ this.PushDB.prototype = {
   getAllByOriginAttributes: function(aOriginAttributes) {
     if (typeof aOriginAttributes !== "string") {
       return Promise.reject("Expected string!");
     }
     return this._getAllByKey("originAttributes", aOriginAttributes);
   },
 
   getAllKeyIDs: function() {
-    debug("getAllKeyIDs()");
+    console.debug("getAllKeyIDs()");
 
     return new Promise((resolve, reject) =>
       this.newTxn(
         "readonly",
         this._dbStoreName,
         (aTxn, aStore) => {
           aTxn.result = undefined;
           aStore.mozGetAll().onsuccess = event => {
@@ -361,17 +345,17 @@ this.PushDB.prototype = {
         },
         resolve,
         reject
       )
     );
   },
 
   _getAllByPushQuota: function(range) {
-    debug("getAllByPushQuota()");
+    console.debug("getAllByPushQuota()");
 
     return new Promise((resolve, reject) =>
       this.newTxn(
         "readonly",
         this._dbStoreName,
         (aTxn, aStore) => {
           aTxn.result = [];
 
@@ -386,22 +370,22 @@ this.PushDB.prototype = {
         },
         resolve,
         reject
       )
     );
   },
 
   getAllUnexpired: function() {
-    debug("getAllUnexpired()");
+    console.debug("getAllUnexpired()");
     return this._getAllByPushQuota(IDBKeyRange.lowerBound(1));
   },
 
   getAllExpired: function() {
-    debug("getAllExpired()");
+    console.debug("getAllExpired()");
     return this._getAllByPushQuota(IDBKeyRange.only(0));
   },
 
   /**
    * Updates an existing push registration.
    *
    * @param {String} aKeyID The registration ID.
    * @param {Function} aUpdateFunc A function that receives the existing
@@ -417,50 +401,45 @@ this.PushDB.prototype = {
         "readwrite",
         this._dbStoreName,
         (aTxn, aStore) => {
           aStore.get(aKeyID).onsuccess = aEvent => {
             aTxn.result = undefined;
 
             let record = aEvent.target.result;
             if (!record) {
-              debug("update: Key ID " + aKeyID + " does not exist");
+              console.error("update: Record does not exist", aKeyID);
               return;
             }
             let newRecord = aUpdateFunc(this.toPushRecord(record));
             if (!this.isValidRecord(newRecord)) {
-              debug("update: Ignoring invalid update for key ID " + aKeyID +
-                ": " + JSON.stringify(newRecord));
+              console.error("update: Ignoring invalid update",
+                aKeyID, newRecord);
               return;
             }
             aStore.put(newRecord).onsuccess = aEvent => {
-              debug("update: Update successful for key ID " + aKeyID);
+              console.debug("update: Update successful", aKeyID, newRecord);
               aTxn.result = newRecord;
             };
           };
         },
         resolve,
         reject
       )
     );
   },
 
   drop: function() {
-    debug("drop()");
+    console.debug("drop()");
 
     return new Promise((resolve, reject) =>
       this.newTxn(
         "readwrite",
         this._dbStoreName,
         function txnCb(aTxn, aStore) {
           aStore.clear();
         },
         resolve,
         reject
       )
     );
   },
-
-  observe: function observe(aSubject, aTopic, aData) {
-    if ((aTopic == "nsPref:changed") && (aData == "dom.push.debug"))
-      gDebuggingEnabled = prefs.get("debug");
-  }
 };

--- a/dom/push/PushNotificationService.js
+++ b/dom/push/PushNotificationService.js
@@ -34,29 +34,29 @@ PushNotificationService.prototype = {
   contractID: "@mozilla.org/push/NotificationService;1",
 
   _xpcom_factory: XPCOMUtils.generateSingletonFactory(PushNotificationService),
   QueryInterface: XPCOMUtils.generateQI([Ci.nsIObserver,
                                          Ci.nsISupportsWeakReference,
                                          Ci.nsIPushNotificationService]),
 
   register: function register(scope, originAttributes) {
-    return PushService._register({
+    return PushService.register({
       scope: scope,
       originAttributes: originAttributes,
       maxQuota: Infinity,
     });
   },
 
   unregister: function unregister(scope, originAttributes) {
-    return PushService._unregister({scope, originAttributes});
+    return PushService.unregister({scope, originAttributes});
   },
 
   registration: function registration(scope, originAttributes) {
-    return PushService._registration({scope, originAttributes});
+    return PushService.registration({scope, originAttributes});
   },
 
   clearAll: function clearAll() {
     return PushService._clearAll();
   },
 
   clearForDomain: function(domain) {
     return PushService._clearForDomain(domain);

--- a/dom/push/PushService.jsm
+++ b/dom/push/PushService.jsm
@@ -1,24 +1,15 @@
 /* jshint moz: true, esnext: true */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 "use strict";
 
-// Don't modify this, instead set dom.push.debug.
-var gDebuggingEnabled = false;
-
-function debug(s) {
-  if (gDebuggingEnabled) {
-    dump("-*- PushService.jsm: " + s + "\n");
-  }
-}
-
 const Cc = Components.classes;
 const Ci = Components.interfaces;
 const Cu = Components.utils;
 const Cr = Components.results;
 
 const {PushDB} = Cu.import("resource://gre/modules/PushDB.jsm");
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
@@ -33,19 +24,25 @@ const {PushCrypto} = Cu.import("resource
 // Currently supported protocols: WebSocket.
 const CONNECTION_PROTOCOLS = [PushServiceWebSocket, PushServiceHttp2];
 
 XPCOMUtils.defineLazyModuleGetter(this, "AlarmService",
                                   "resource://gre/modules/AlarmService.jsm");
 
 this.EXPORTED_SYMBOLS = ["PushService"];
 
+XPCOMUtils.defineLazyGetter(this, "console", () => {
+  let {ConsoleAPI} = Cu.import("resource://gre/modules/Console.jsm", {});
+  return new ConsoleAPI({
+    maxLogLevelPref: "dom.push.loglevel",
+    prefix: "PushService",
+  });
+});
+
 const prefs = new Preferences("dom.push.");
-// Set debug first so that all debugging actually works.
-gDebuggingEnabled = prefs.get("debug");
 
 const kCHILD_PROCESS_MESSAGES = ["Push:Register", "Push:Unregister",
                                  "Push:Registration", "Push:RegisterEventNotificationListener",
                                  "child-process-shutdown"];
 
 const PUSH_SERVICE_UNINIT = 0;
 const PUSH_SERVICE_INIT = 1; // No serverURI
 const PUSH_SERVICE_ACTIVATING = 2;//activating db
@@ -115,17 +112,17 @@ this.PushService = {
   // Pending request. If a worker try to register for the same scope again, do
   // not send a new registration request. Therefore we need queue of pending
   // register requests. This is the list of scopes which pending registration.
   _pendingRegisterRequest: {},
   _notifyActivated: null,
   _activated: null,
   _checkActivated: function() {
     if (this._state < PUSH_SERVICE_ACTIVATING) {
-      return Promise.reject({state: 0, error: "Service not active"});
+      return Promise.reject(new Error("Push service not active"));
     } else if (this._state > PUSH_SERVICE_ACTIVATING) {
       return Promise.resolve();
     } else {
       return (this._activated) ? this._activated :
                                  this._activated = new Promise((res, rej) =>
                                    this._notifyActivated = {resolve: res,
                                                             reject: rej});
     }
@@ -147,41 +144,41 @@ this.PushService = {
   _deletePendingRequest: function(aPageRecord) {
     let key = this._makePendingKey(aPageRecord);
     if (this._pendingRegisterRequest[key]) {
       delete this._pendingRegisterRequest[key];
     }
   },
 
   _setState: function(aNewState) {
-    debug("new state: " + aNewState + " old state: " + this._state);
+    console.debug("setState()", "new state", aNewState, "old state", this._state);
 
     if (this._state == aNewState) {
       return;
     }
 
     if (this._state == PUSH_SERVICE_ACTIVATING) {
       // It is not important what is the new state as soon as we leave
       // PUSH_SERVICE_ACTIVATING
       this._state = aNewState;
       if (this._notifyActivated) {
         if (aNewState < PUSH_SERVICE_ACTIVATING) {
-          this._notifyActivated.reject({state: 0, error: "Service not active"});
+          this._notifyActivated.reject(new Error("Push service not active"));
         } else {
           this._notifyActivated.resolve();
         }
       }
       this._notifyActivated = null;
       this._activated = null;
     }
     this._state = aNewState;
   },
 
   _changeStateOfflineEvent: function(offline, calledFromConnEnabledEvent) {
-    debug("changeStateOfflineEvent: " + offline);
+    console.debug("changeStateOfflineEvent()", offline);
 
     if (this._state < PUSH_SERVICE_ACTIVE_OFFLINE &&
         this._state != PUSH_SERVICE_ACTIVATING &&
         !calledFromConnEnabledEvent) {
       return;
     }
 
     if (offline) {
@@ -203,17 +200,17 @@ this.PushService = {
             this._service.connect(records);
           }
         });
       this._setState(PUSH_SERVICE_RUNNING);
     }
   },
 
   _changeStateConnectionEnabledEvent: function(enabled) {
-    debug("changeStateConnectionEnabledEvent: " + enabled);
+    console.debug("changeStateConnectionEnabledEvent()", enabled);
 
     if (this._state < PUSH_SERVICE_CONNECTION_DISABLE &&
         this._state != PUSH_SERVICE_ACTIVATING) {
       return;
     }
 
     if (enabled) {
       this._changeStateOfflineEvent(Services.io.offline, true);
@@ -239,83 +236,80 @@ this.PushService = {
       case "network:offline-status-changed": /* On desktop. */
         this._stateChangeProcessEnqueue(_ =>
           this._changeStateOfflineEvent(aData === "offline", false)
         );
         break;
 
       case "nsPref:changed":
         if (aData == "dom.push.serverURL") {
-          debug("dom.push.serverURL changed! websocket. new value " +
+          console.debug("observe: dom.push.serverURL changed for websocket",
                 prefs.get("serverURL"));
           this._stateChangeProcessEnqueue(_ =>
             this._changeServerURL(prefs.get("serverURL"),
                                   CHANGING_SERVICE_EVENT)
           );
 
         } else if (aData == "dom.push.connection.enabled") {
           this._stateChangeProcessEnqueue(_ =>
             this._changeStateConnectionEnabledEvent(prefs.get("connection.enabled"))
           );
-
-        } else if (aData == "dom.push.debug") {
-          gDebuggingEnabled = prefs.get("debug");
         }
         break;
 
       case "idle-daily":
         this._dropExpiredRegistrations();
         break;
 
       case "perm-changed":
         this._onPermissionChange(aSubject, aData).catch(error => {
-          debug("onPermissionChange: Error updating registrations: " +
+          console.error("onPermissionChange: Error updating registrations:",
             error);
         })
         break;
 
       case "webapps-clear-data":
-        debug("webapps-clear-data");
+        console.debug("webapps-clear-data");
 
         let data = aSubject
                      .QueryInterface(Ci.mozIApplicationClearPrivateDataParams);
         if (!data) {
-          debug("webapps-clear-data: Failed to get information about " +
-                "application");
+          console.error("webapps-clear-data: Failed to get information " +
+            "about application");
           return;
         }
 
         var originAttributes =
           ChromeUtils.originAttributesToSuffix({ appId: data.appId,
                                                  inBrowser: data.browserOnly });
         this._db.getAllByOriginAttributes(originAttributes)
           .then(records => Promise.all(records.map(record =>
             this._db.delete(record.keyID).then(
-              _ => this._unregisterIfConnected(record),
+              _ => this._backgroundUnregister(record),
               err => {
-                debug("webapps-clear-data: " + record.scope +
-                      " Could not delete entry " + record.channelID);
+                console.error("webapps-clear-data: Error removing record",
+                  record, err);
 
-                return this._unregisterIfConnected(record);
+                this._backgroundUnregister(record);
               })
             )
           ));
 
         break;
     }
   },
 
-  _unregisterIfConnected: function(record) {
+  _backgroundUnregister: function(record) {
     if (this._service.isConnected()) {
       // courtesy, but don't establish a connection
       // just for it
-      debug("Had a connection, so telling the server");
-      return this._sendUnregister({channelID: record.channelID})
+      console.debug("backgroundUnregister: Notifying server", record);
+      return this._sendUnregister(record)
           .catch(function(e) {
-            debug("Unregister errored " + e);
+            console.error("backgroundUnregister: Error notifying server", e);
           });
     }
   },
 
   // utility function used to add/remove observers in startObservers() and
   // stopObservers()
   getNetworkStateChangeEventName: function() {
     try {
@@ -337,17 +331,17 @@ this.PushService = {
           break;
         }
       }
     }
     return [service, uri];
   },
 
   _changeServerURL: function(serverURI, event) {
-    debug("changeServerURL");
+    console.debug("changeServerURL()");
 
     switch(event) {
       case UNINIT_EVENT:
         return this._stopService(event);
 
       case STARTING_SERVICE_EVENT:
       {
         let [service, uri] = this._findService(serverURI);
@@ -409,27 +403,24 @@ this.PushService = {
    * startObservers() - start other observers.
    * changeStateConnectionEnabledEvent  - checks prefs and offline state.
    *                                      It changes state to:
    *                                        PUSH_SERVICE_RUNNING,
    *                                        PUSH_SERVICE_ACTIVE_OFFLINE or
    *                                        PUSH_SERVICE_CONNECTION_DISABLE.
    */
   init: function(options = {}) {
-    debug("init()");
+    console.debug("init()");
 
     if (this._state > PUSH_SERVICE_UNINIT) {
       return;
     }
 
     this._setState(PUSH_SERVICE_ACTIVATING);
 
-    // Debugging
-    prefs.observe("debug", this);
-
     Services.obs.addObserver(this, "xpcom-shutdown", false);
 
     if (options.serverURI) {
       // this is use for xpcshell test.
 
       var uri;
       var service;
       if (!options.service) {
@@ -464,17 +455,17 @@ this.PushService = {
       prefs.observe("serverURL", this);
 
       this._stateChangeProcessEnqueue(_ =>
         this._changeServerURL(prefs.get("serverURL"), STARTING_SERVICE_EVENT));
     }
   },
 
   _startObservers: function() {
-    debug("startObservers");
+    console.debug("startObservers()");
 
     if (this._state != PUSH_SERVICE_ACTIVATING) {
       return;
     }
 
     Services.obs.addObserver(this, "webapps-clear-data", false);
 
     // On B2G the NetworkManager interface fires a network-active-changed
@@ -505,17 +496,17 @@ this.PushService = {
     Services.obs.addObserver(this, "idle-daily", false);
 
     // Prunes registrations for sites for which the user revokes push
     // permissions.
     Services.obs.addObserver(this, "perm-changed", false);
   },
 
   _startService: function(service, serverURI, event, options = {}) {
-    debug("startService");
+    console.debug("startService()");
 
     if (this._state != PUSH_SERVICE_ACTIVATING) {
       return;
     }
 
     if (event != CHANGING_SERVICE_EVENT) {
       // if only serverURL is changed we can keep listening for broadcast
       // messages and queue them.
@@ -544,17 +535,17 @@ this.PushService = {
    * stopObservers() - stot observers started in startObservers.
    * stopService() - It stops listening for broadcasted messages, stops db and
    *                 PushService connection (WebSocket).
    *                 state is changed to PUSH_SERVICE_INIT.
    * uninit() - stop listening for xpcom-shutdown and serverURL changes.
    *            state is change to PUSH_SERVICE_UNINIT
    */
   _stopService: function(event) {
-    debug("stopService");
+    console.debug("stopService()");
 
     if (this._state < PUSH_SERVICE_ACTIVATING) {
       return;
     }
 
     this.stopAlarm();
     this._stopObservers();
 
@@ -588,48 +579,47 @@ this.PushService = {
          this._db = null;
        }, err => {
          this._db.close();
          this._db = null;
        });
   },
 
   _stopObservers: function() {
-    debug("stopObservers()");
+    console.debug("stopObservers()");
 
     if (this._state < PUSH_SERVICE_ACTIVATING) {
       return;
     }
 
-    prefs.ignore("debug", this);
     prefs.ignore("connection.enabled", this);
 
     Services.obs.removeObserver(this, this._networkStateChangeEventName);
     Services.obs.removeObserver(this, "webapps-clear-data");
     Services.obs.removeObserver(this, "idle-daily");
     Services.obs.removeObserver(this, "perm-changed");
   },
 
   uninit: function() {
-    debug("uninit()");
+    console.debug("uninit()");
 
     this._childListeners = [];
 
     if (this._state == PUSH_SERVICE_UNINIT) {
       return;
     }
 
     this._setState(PUSH_SERVICE_UNINIT);
 
     prefs.ignore("serverURL", this);
     Services.obs.removeObserver(this, "xpcom-shutdown");
 
     this._stateChangeProcessEnqueue(_ =>
             this._changeServerURL("", UNINIT_EVENT));
-    debug("shutdown complete!");
+    console.debug("uninit: shutdown complete!");
   },
 
   /** |delay| should be in milliseconds. */
   setAlarm: function(delay) {
     // Bug 909270: Since calls to AlarmService.add() are async, calls must be
     // 'queued' to ensure only one alarm is ever active.
     if (this._settingAlarm) {
         // onSuccess will handle the set. Overwriting the variable enforces the
@@ -649,30 +639,31 @@ this.PushService = {
         ignoreTimezone: true
       },
       () => {
         if (this._state > PUSH_SERVICE_ACTIVATING) {
           this._service.onAlarmFired();
         }
       }, (alarmID) => {
         this._alarmID = alarmID;
-        debug("Set alarm " + delay + " in the future " + this._alarmID);
+        console.debug("setAlarm: Set alarm", delay, "in the future",
+          this._alarmID);
         this._settingAlarm = false;
 
         if (this._waitingForAlarmSet) {
           this._waitingForAlarmSet = false;
           this.setAlarm(this._queuedAlarmDelay);
         }
       }
     );
   },
 
   stopAlarm: function() {
     if (this._alarmID !== null) {
-      debug("Stopped existing alarm " + this._alarmID);
+      console.debug("stopAlarm: Stopped existing alarm", this._alarmID);
       AlarmService.remove(this._alarmID);
       this._alarmID = null;
     }
   },
 
   dropRegistrations: function() {
     return this._notifyAllAppsRegister()
       .then(_ => this._db.drop());
@@ -711,17 +702,17 @@ this.PushService = {
                    .getService(Ci.nsIMessageListenerManager);
       ppmm.broadcastAsyncMessage(name, data);
     }
   },
 
   // Fires a push-register system message to all applications that have
   // registration.
   _notifyAllAppsRegister: function() {
-    debug("notifyAllAppsRegister()");
+    console.debug("notifyAllAppsRegister()");
     // records are objects describing the registration as stored in IndexedDB.
     return this._db.getAllUnexpired().then(records => {
       records.forEach(record => {
         this._notifySubscriptionChangeObservers(record);
       });
     });
   },
 
@@ -787,17 +778,17 @@ this.PushService = {
    * @param {Object} cryptoParams The message encryption settings.
    * @param {Function} updateFunc A function that receives the existing
    *  registration record as its argument, and returns a new record. If the
    *  function returns `null` or `undefined`, the record will not be updated.
    *  `PushServiceWebSocket` uses this to drop incoming updates with older
    *  versions.
    */
   receivedPushMessage: function(keyID, message, cryptoParams, updateFunc) {
-    debug("receivedPushMessage()");
+    console.debug("receivedPushMessage()");
     Services.telemetry.getHistogramById("PUSH_API_NOTIFICATION_RECEIVED").add();
 
     let shouldNotify = false;
     return this.getByKeyID(keyID).then(record => {
       if (!record) {
         this._recordDidNotNotify(kDROP_NOTIFICATION_REASON_KEY_NOT_FOUND);
         throw new Error("No record for key ID " + keyID);
       }
@@ -815,17 +806,18 @@ this.PushService = {
           this._recordDidNotNotify(kDROP_NOTIFICATION_REASON_NO_VERSION_INCREMENT);
           return null;
         }
         // Because `unregister` is advisory only, we can still receive messages
         // for stale Simple Push registrations from the server. To work around
         // this, we check if the record has expired before *and* after updating
         // the quota.
         if (newRecord.isExpired()) {
-          debug("receivedPushMessage: Ignoring update for expired key ID " + keyID);
+          console.error("receivedPushMessage: Ignoring update for expired key ID",
+            keyID);
           return null;
         }
         newRecord.receivedPush(lastVisit);
         return newRecord;
       });
     }).then(record => {
       var notified = false;
       if (!record) {
@@ -847,36 +839,33 @@ this.PushService = {
         if (shouldNotify) {
           notified = this._notifyApp(record, message);
         }
         if (record.isExpired()) {
           this._recordDidNotNotify(kDROP_NOTIFICATION_REASON_EXPIRED);
           // Drop the registration in the background. If the user returns to the
           // site, the service worker will be notified on the next `idle-daily`
           // event.
-          this._sendUnregister(record).catch(error => {
-            debug("receivedPushMessage: Unregister error: " + error);
-          });
+          this._backgroundUnregister(record);
         }
         return notified;
       });
     }).catch(error => {
-      debug("receivedPushMessage: Error notifying app: " + error);
+      console.error("receivedPushMessage: Error notifying app", error);
     });
   },
 
   _notifyApp: function(aPushRecord, message) {
     if (!aPushRecord || !aPushRecord.scope ||
         aPushRecord.originAttributes === undefined) {
-      debug("notifyApp() something is undefined.  Dropping notification: " +
-        JSON.stringify(aPushRecord) );
+      console.error("notifyApp: Invalid record", aPushRecord);
       return false;
     }
 
-    debug("notifyApp() " + aPushRecord.scope);
+    console.debug("notifyApp()", aPushRecord.scope);
     // Notify XPCOM observers.
     let notification = Cc["@mozilla.org/push/ObserverNotification;1"]
                          .createInstance(Ci.nsIPushObserverNotification);
     notification.pushEndpoint = aPushRecord.pushEndpoint;
     notification.version = aPushRecord.version;
 
     let payload = ArrayBuffer.isView(message) ?
                   new Uint8Array(message.buffer) : message;
@@ -893,17 +882,17 @@ this.PushService = {
     Services.obs.notifyObservers(
       notification,
       "push-notification",
       aPushRecord.scope
     );
 
     // If permission has been revoked, trash the message.
     if (!aPushRecord.hasPermission()) {
-      debug("Does not have permission for push.");
+      console.warn("notifyApp: Missing push permission", aPushRecord);
       return false;
     }
 
     let data = {
       payload: payload,
       originAttributes: aPushRecord.originAttributes,
       scope: aPushRecord.scope
     };
@@ -918,197 +907,186 @@ this.PushService = {
   },
 
   getAllUnexpired: function() {
     return this._db.getAllUnexpired();
   },
 
   _sendRequest: function(action, aRecord) {
     if (this._state == PUSH_SERVICE_CONNECTION_DISABLE) {
-      return Promise.reject({state: 0, error: "Service not active"});
+      return Promise.reject(new Error("Push service disabled"));
     } else if (this._state == PUSH_SERVICE_ACTIVE_OFFLINE) {
       if (this._service.serviceType() == "WebSocket" && action == "unregister") {
         return Promise.resolve();
       }
-      return Promise.reject({state: 0, error: "NetworkError"});
+      return Promise.reject(new Error("Push service offline"));
     }
     return this._service.request(action, aRecord);
   },
 
   /**
    * Called on message from the child process. aPageRecord is an object sent by
    * navigator.push, identifying the sending page and other fields.
    */
   _registerWithServer: function(aPageRecord) {
-    debug("registerWithServer()" + JSON.stringify(aPageRecord));
+    console.debug("registerWithServer()", aPageRecord);
 
     Services.telemetry.getHistogramById("PUSH_API_SUBSCRIBE_ATTEMPT").add();
     return this._sendRequest("register", aPageRecord)
       .then(record => this._onRegisterSuccess(record),
             err => this._onRegisterError(err))
       .then(record => {
         this._deletePendingRequest(aPageRecord);
-        return record;
+        return record.toRegister();
       }, err => {
         this._deletePendingRequest(aPageRecord);
         throw err;
      });
   },
 
-  _register: function(aPageRecord) {
-    debug("_register()");
-    if (!aPageRecord.scope || aPageRecord.originAttributes === undefined) {
-      return Promise.reject({state: 0, error: "NotFoundError"});
-    }
-
-    return this._checkActivated()
-      .then(_ => this._db.getByIdentifiers(aPageRecord))
-      .then(record => {
-        if (!record) {
-          return this._lookupOrPutPendingRequest(aPageRecord);
-        }
-        if (record.isExpired()) {
-          return record.quotaChanged().then(isChanged => {
-            if (isChanged) {
-              // If the user revisited the site, drop the expired push
-              // registration and re-register.
-              return this._db.delete(record.keyID);
-            }
-            throw {state: 0, error: "NotFoundError"};
-          }).then(_ => this._lookupOrPutPendingRequest(aPageRecord));
-        }
-        return record;
-      }, error => {
-        debug("getByIdentifiers failed");
-        throw error;
-      });
-  },
-
   _sendUnregister: function(aRecord) {
     Services.telemetry.getHistogramById("PUSH_API_UNSUBSCRIBE_ATTEMPT").add();
     return this._sendRequest("unregister", aRecord).then(function(v) {
       Services.telemetry.getHistogramById("PUSH_API_UNSUBSCRIBE_SUCCEEDED").add();
       return v;
     }).catch(function(e) {
       Services.telemetry.getHistogramById("PUSH_API_UNSUBSCRIBE_FAILED").add();
       return Promise.reject(e);
     });
   },
 
   /**
    * Exceptions thrown in _onRegisterSuccess are caught by the promise obtained
    * from _service.request, causing the promise to be rejected instead.
    */
   _onRegisterSuccess: function(aRecord) {
-    debug("_onRegisterSuccess()");
+    console.debug("_onRegisterSuccess()");
 
     return this._db.put(aRecord)
       .then(record => {
         Services.telemetry.getHistogramById("PUSH_API_SUBSCRIBE_SUCCEEDED").add();
         return record;
       })
       .catch(error => {
         Services.telemetry.getHistogramById("PUSH_API_SUBSCRIBE_FAILED").add()
         // Unable to save. Destroy the subscription in the background.
-        this._sendUnregister(aRecord).catch(err => {
-          debug("_onRegisterSuccess: Error unregistering stale subscription" +
-            err);
-        });
+        this._backgroundUnregister(aRecord);
         throw error;
       });
   },
 
   /**
    * Exceptions thrown in _onRegisterError are caught by the promise obtained
    * from _service.request, causing the promise to be rejected instead.
    */
   _onRegisterError: function(reply) {
-    debug("_onRegisterError()");
+    console.debug("_onRegisterError()");
     Services.telemetry.getHistogramById("PUSH_API_SUBSCRIBE_FAILED").add()
     if (!reply.error) {
-      debug("Called without valid error message!");
-      throw "Registration error";
+      console.warn("onRegisterError: Called without valid error message!",
+        reply.error);
+      throw new Error("Registration error");
     }
     throw reply.error;
   },
 
   receiveMessage: function(aMessage) {
-    debug("receiveMessage(): " + aMessage.name);
+    console.debug("receiveMessage()", aMessage.name);
 
     if (kCHILD_PROCESS_MESSAGES.indexOf(aMessage.name) == -1) {
-      debug("Invalid message from child " + aMessage.name);
+      console.debug("receiveMessage: Invalid message from child",
+        aMessage.name);
       return;
     }
 
     if (aMessage.name === "Push:RegisterEventNotificationListener") {
-      debug("Adding child listener");
+      console.debug("receiveMessage: Adding child listener");
       this._childListeners.push(aMessage.target);
       return;
     }
 
     if (aMessage.name === "child-process-shutdown") {
-      debug("Possibly removing child listener");
+      console.debug("receiveMessage: Possibly removing child listener");
       for (var i = this._childListeners.length - 1; i >= 0; --i) {
         if (this._childListeners[i] == aMessage.target) {
-          debug("Removed child listener");
+          console.debug("receiveMessage: Removed child listener");
           this._childListeners.splice(i, 1);
         }
       }
       return;
     }
 
     if (!aMessage.target.assertPermission("push")) {
-      debug("Got message from a child process that does not have 'push' permission.");
+      console.debug("receiveMessage: Got message from a child process that",
+        "does not have 'push' permission");
       return null;
     }
 
     let mm = aMessage.target.QueryInterface(Ci.nsIMessageSender);
-    let pageRecord = aMessage.data;
 
+    let name = aMessage.name.slice("Push:".length);
+    Promise.resolve().then(_ => {
+      let pageRecord = this._validatePageRecord(aMessage);
+      return this[name.toLowerCase()](pageRecord);
+    }).then(result => {
+      mm.sendAsyncMessage("PushService:" + name + ":OK", {
+        requestID: aMessage.data.requestID,
+        result: result,
+      });
+    }, error => {
+      console.error("receiveMessage: Error handling message", aMessage, error);
+      mm.sendAsyncMessage("PushService:" + name + ":KO", {
+        requestID: aMessage.data.requestID,
+      });
+    }).catch(error => {
+      console.error("receiveMessage: Error sending reply", error);
+    });
+  },
+
+  _validatePageRecord: function(aMessage) {
     let principal = aMessage.principal;
     if (!principal) {
-      debug("No principal passed!");
-      let message = {
-        requestID: pageRecord.requestID,
-        error: "SecurityError"
-      };
-      mm.sendAsyncMessage("PushService:Register:KO", message);
-      return;
+      throw new Error("Missing message principal");
+    }
+
+    let pageRecord = aMessage.data;
+    if (!pageRecord.scope) {
+      throw new Error("Missing page record scope");
     }
 
     pageRecord.originAttributes =
       ChromeUtils.originAttributesToSuffix(principal.originAttributes);
 
-    if (!pageRecord.scope || pageRecord.originAttributes === undefined) {
-      debug("Incorrect identifier values set! " + JSON.stringify(pageRecord));
-      let message = {
-        requestID: pageRecord.requestID,
-        error: "SecurityError"
-      };
-      mm.sendAsyncMessage("PushService:Register:KO", message);
-      return;
-    }
-
-    this[aMessage.name.slice("Push:".length).toLowerCase()](pageRecord, mm);
+    return pageRecord;
   },
 
-  register: function(aPageRecord, aMessageManager) {
-    debug("register(): " + JSON.stringify(aPageRecord));
+  register: function(aPageRecord) {
+    console.debug("register()", aPageRecord);
 
-    this._register(aPageRecord)
+    if (!aPageRecord.scope || aPageRecord.originAttributes === undefined) {
+      return Promise.reject(new Error("Invalid page record"));
+    }
+
+    return this._checkActivated()
+      .then(_ => this._db.getByIdentifiers(aPageRecord))
       .then(record => {
-        let message = record.toRegister();
-        message.requestID = aPageRecord.requestID;
-        aMessageManager.sendAsyncMessage("PushService:Register:OK", message);
-      }, error => {
-        let message = {
-          requestID: aPageRecord.requestID,
-          error
-        };
-        aMessageManager.sendAsyncMessage("PushService:Register:KO", message);
+        if (!record) {
+          return this._lookupOrPutPendingRequest(aPageRecord);
+        }
+        if (record.isExpired()) {
+          return record.quotaChanged().then(isChanged => {
+            if (isChanged) {
+              // If the user revisited the site, drop the expired push
+              // registration and re-register.
+              return this._db.delete(record.keyID);
+            }
+            throw new Error("Push subscription expired");
+          }).then(_ => this._lookupOrPutPendingRequest(aPageRecord));
+        }
+        return record.toRegister();
       });
   },
 
   /**
    * Called on message from the child process.
    *
    * Why is the record being deleted from the local database before the server
    * is told?
@@ -1127,57 +1105,40 @@ this.PushService = {
    * failure, the application is never informed. In addition the application may
    * retry the unregister when it fails due to timeout (websocket) or any other
    * reason at which point the server will say it does not know of this
    * unregistration.  We'll have to make the registration/unregistration phases
    * have retries and attempts to resend messages from the server, and have the
    * client acknowledge. On a server, data is cheap, reliable notification is
    * not.
    */
-  _unregister: function(aPageRecord) {
-    debug("_unregister()");
+  unregister: function(aPageRecord) {
+    console.debug("unregister()", aPageRecord);
+
     if (!aPageRecord.scope || aPageRecord.originAttributes === undefined) {
-      return Promise.reject({state: 0, error: "NotFoundError"});
+      return Promise.reject(new Error("Invalid page record"));
     }
 
     return this._checkActivated()
       .then(_ => this._db.getByIdentifiers(aPageRecord))
       .then(record => {
         if (record === undefined) {
           return false;
         }
 
         return Promise.all([
           this._sendUnregister(record),
           this._db.delete(record.keyID),
         ]).then(() => true);
       });
   },
 
-  unregister: function(aPageRecord, aMessageManager) {
-    debug("unregister() " + JSON.stringify(aPageRecord));
-
-    this._unregister(aPageRecord)
-      .then(result => {
-          aMessageManager.sendAsyncMessage("PushService:Unregister:OK", {
-            requestID: aPageRecord.requestID,
-            result: result,
-          })
-        }, error => {
-          debug("unregister(): Actual error " + error);
-          aMessageManager.sendAsyncMessage("PushService:Unregister:KO", {
-            requestID: aPageRecord.requestID,
-          })
-        }
-      );
-  },
-
   _clearAll: function _clearAll() {
     return this._checkActivated()
-      .then(_ => this._db.clearAll())
+      .then(_ => this._db.drop())
       .catch(_ => Promise.resolve());
   },
 
   _clearForDomain: function(domain) {
     /**
      * Copied from ForgetAboutSite.jsm.
      *
      * Returns true if the string passed in is part of the root domain of the
@@ -1208,28 +1169,25 @@ this.PushService = {
       db.clearIf(record => {
         return hasRootDomain(record.uri.prePath, domain);
       });
     }
 
     return this._checkActivated()
       .then(_ => clear(this._db, domain))
       .catch(e => {
-        debug("Error forgetting about domain! " + e);
+        console.warn("clearForDomain: Error forgetting about domain", e);
         return Promise.resolve();
       });
   },
 
-  /**
-   * Called on message from the child process
-   */
-  _registration: function(aPageRecord) {
-    debug("_registration()");
+  registration: function(aPageRecord) {
+    console.debug("registration()");
     if (!aPageRecord.scope || aPageRecord.originAttributes === undefined) {
-      return Promise.reject({state: 0, error: "NotFoundError"});
+      return Promise.reject(new Error("Invalid page record"));
     }
 
     return this._checkActivated()
       .then(_ => this._db.getByIdentifiers(aPageRecord))
       .then(record => {
         if (!record) {
           return null;
         }
@@ -1240,79 +1198,63 @@ this.PushService = {
             }
             return null;
           });
         }
         return record.toRegistration();
       });
   },
 
-  registration: function(aPageRecord, aMessageManager) {
-    debug("registration()");
-
-    return this._registration(aPageRecord)
-      .then(registration =>
-        aMessageManager.sendAsyncMessage("PushService:Registration:OK", {
-          requestID: aPageRecord.requestID,
-          registration
-        }), error =>
-        aMessageManager.sendAsyncMessage("PushService:Registration:KO", {
-          requestID: aPageRecord.requestID,
-          error
-        })
-      );
-  },
-
   _dropExpiredRegistrations: function() {
-    debug("dropExpiredRegistrations()");
+    console.debug("dropExpiredRegistrations()");
 
     return this._db.getAllExpired().then(records => {
       return Promise.all(records.map(record =>
         record.quotaChanged().then(isChanged => {
           if (isChanged) {
             // If the user revisited the site, drop the expired push
             // registration and notify the associated service worker.
             return this.dropRecordAndNotifyApp(record);
           }
         }).catch(error => {
-          debug("dropExpiredRegistrations: Error dropping registration " +
-            record.keyID + ": " + error);
+          console.error("dropExpiredRegistrations: Error dropping registration",
+            record.keyID, error);
         })
       ));
     });
   },
 
   _onPermissionChange: function(subject, data) {
-    debug("onPermissionChange()");
+    console.debug("onPermissionChange()");
 
     if (data == "cleared") {
       // If the permission list was cleared, drop all registrations
       // that are subject to quota.
       return this._db.clearIf(record => {
         if (record.quotaApplies()) {
           if (!record.isExpired()) {
             // Drop the registration in the background.
-            this._unregisterIfConnected(record);
+            this._backgroundUnregister(record);
           }
           return true;
         }
         return false;
       });
     }
 
     let permission = subject.QueryInterface(Ci.nsIPermission);
     if (permission.type != "desktop-notification") {
       return Promise.resolve();
     }
 
     return this._updatePermission(permission, data);
   },
 
   _updatePermission: function(permission, type) {
-    debug("updatePermission()");
+    console.debug("updatePermission()");
 
     let isAllow = permission.capability ==
                   Ci.nsIPermissionManager.ALLOW_ACTION;
     let isChange = type == "added" || type == "changed";
 
     if (isAllow && isChange) {
       // Permission set to "allow". Drop all expired registrations for this
       // site, notify the associated service workers, and reset the quota
@@ -1351,17 +1293,17 @@ this.PushService = {
    * @returns {Promise} A promise resolved with the expired records.
    */
   _permissionDenied: function(record) {
     if (!record.quotaApplies() || record.isExpired()) {
       // Ignore already-expired records.
       return null;
     }
     // Drop the registration in the background.
-    this._unregisterIfConnected(record);
+    this._backgroundUnregister(record);
     record.setQuota(0);
     return record;
   },
 
   /**
    * Drops all expired registrations, notifies the associated service
    * workers, and resets the quota for active registrations if the push
    * permission is granted.