--- a/accessible/jsat/AccessFu.jsm
+++ b/accessible/jsat/AccessFu.jsm
@@ -243,17 +243,17 @@ this.AccessFu = { // jshint ignore:line
       try {
         Output[presenter.type](presenter.details, aBrowser);
       } catch (x) {
         Logger.logException(x);
       }
     }
 
     if (this._notifyOutputPref.value) {
-      Services.obs.notifyObservers(null, 'accessfu-output',
+      Services.obs.notifyObservers(null, 'accessibility-output',
                                    JSON.stringify(aPresentationData));
     }
   },
 
   _loadFrameScript: function _loadFrameScript(aMessageManager) {
     if (this._processedMessageManagers.indexOf(aMessageManager) < 0) {
       aMessageManager.loadFrameScript(
         'chrome://global/content/accessibility/content-script.js', true);
@@ -509,17 +509,17 @@ var Output = {
   stop: function stop() {
     if (this.highlightBox) {
       Utils.win.document.documentElement.removeChild(this.highlightBox.get());
       delete this.highlightBox;
     }
   },
 
   B2G: function B2G(aDetails) {
-    Utils.dispatchChromeEvent('accessfu-output', aDetails);
+    Utils.dispatchChromeEvent('accessibility-output', aDetails);
   },
 
   Visual: function Visual(aDetail, aBrowser) {
     switch (aDetail.eventType) {
       case 'viewport-change':
       case 'vc-change':
       {
         let highlightBox = null;

--- a/accessible/tests/mochitest/jsat/jsatcommon.js
+++ b/accessible/tests/mochitest/jsat/jsatcommon.js
@@ -76,31 +76,31 @@ var AccessFuTest = {
       var data = JSON.parse(aData)[1];
       // Ignore non-relevant outputs.
       if (!data) {
         return;
       }
       isDeeply(data.details, aWaitForData, "Data is correct");
       aListener.apply(listener);
     };
-    Services.obs.addObserver(listener, 'accessfu-output', false);
+    Services.obs.addObserver(listener, 'accessibility-output', false);
     return listener;
   },
 
   on: function AccessFuTest_on(aWaitForData, aListener) {
     return this._addObserver(aWaitForData, aListener);
   },
 
   off: function AccessFuTest_off(aListener) {
-    Services.obs.removeObserver(aListener, 'accessfu-output');
+    Services.obs.removeObserver(aListener, 'accessibility-output');
   },
 
   once: function AccessFuTest_once(aWaitForData, aListener) {
     return this._addObserver(aWaitForData, function observerAndRemove() {
-      Services.obs.removeObserver(this, 'accessfu-output');
+      Services.obs.removeObserver(this, 'accessibility-output');
       aListener();
     });
   },
 
   _waitForExplicitFinish: false,
 
   waitForExplicitFinish: function AccessFuTest_waitForExplicitFinish() {
     this._waitForExplicitFinish = true;

--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@@ -49,17 +49,17 @@ pref("browser.cache.disk.smart_size.firs
 pref("browser.cache.memory.enable", true);
 pref("browser.cache.memory.capacity", 1024); // kilobytes
 
 pref("browser.cache.memory_limit", 2048); // 2 MB
 
 /* image cache prefs */
 pref("image.cache.size", 1048576); // bytes
 pref("image.high_quality_downscaling.enabled", false);
-pref("canvas.image.cache.limit", 10485760); // 10 MB
+pref("canvas.image.cache.limit", 20971520); // 20 MB
 
 /* offline cache prefs */
 pref("browser.offline-apps.notify", false);
 pref("browser.cache.offline.enable", true);
 pref("offline-apps.allow_by_default", true);
 
 /* protocol warning prefs */
 pref("network.protocol-handler.warn-external.tel", false);

--- a/browser/base/content/browser-plugins.js
+++ b/browser/base/content/browser-plugins.js
@@ -1217,23 +1217,25 @@ var gPluginHandler = {
 
     // If we're showing the link to manually trigger report submission, we'll
     // want to be able to update all the instances of the UI for this crash to
     // show an updated message when a report is submitted.
     if (doPrompt) {
       let observer = {
         QueryInterface: XPCOMUtils.generateQI([Ci.nsIObserver,
                                                Ci.nsISupportsWeakReference]),
-        observe : function(subject, topic, data) {
+        observe : (subject, topic, data) => {
           let propertyBag = subject;
           if (!(propertyBag instanceof Ci.nsIPropertyBag2))
             return;
           // Ignore notifications for other crashes.
           if (propertyBag.get("minidumpID") != pluginDumpID)
             return;
+
+          let statusDiv = this.getPluginUI(plugin, "submitStatus");
           statusDiv.setAttribute("status", data);
         },
 
         handleEvent : function(event) {
             // Not expected to be called, just here for the closure.
         }
       }
 

--- a/browser/base/content/nsContextMenu.js
+++ b/browser/base/content/nsContextMenu.js
@@ -1163,23 +1163,23 @@ nsContextMenu.prototype = {
 
             const promptSvc = Cc["@mozilla.org/embedcomp/prompt-service;1"].
                               getService(Ci.nsIPromptService);
             promptSvc.alert(doc.defaultView, title, msg);
           } catch (ex) {}
           return;
         }
 
-        var extHelperAppSvc = 
+        let extHelperAppSvc = 
           Cc["@mozilla.org/uriloader/external-helper-app-service;1"].
           getService(Ci.nsIExternalHelperAppService);
-        var channel = aRequest.QueryInterface(Ci.nsIChannel);
-        this.extListener = 
+        let channel = aRequest.QueryInterface(Ci.nsIChannel);
+        this.extListener =
           extHelperAppSvc.doContent(channel.contentType, aRequest, 
-                                    doc.defaultView, true);
+                                    doc.defaultView, true, window);
         this.extListener.onStartRequest(aRequest, aContext);
       }, 
 
       onStopRequest: function saveLinkAs_onStopRequest(aRequest, aContext, 
                                                        aStatusCode) {
         if (aStatusCode == NS_ERROR_SAVE_LINK_AS_TIMEOUT) {
           // do it the old fashioned way, which will pick the best filename
           // it can without waiting.

--- a/browser/base/content/test/plugins/browser_CTP_crashreporting.js
+++ b/browser/base/content/test/plugins/browser_CTP_crashreporting.js
@@ -109,16 +109,25 @@ function onSubmitStatus(subj, topic, dat
 
     let val = getPropertyBagValue(extra, "PluginUserComment");
     is(val, "a test comment",
        "Comment in extra data should match comment in textbox");
 
     val = getPropertyBagValue(extra, "PluginContentURL");
     ok(val === undefined,
        "URL should be absent from extra data when opt-in not checked");
+
+    // Execute this later in case the event to change submitStatus has not
+    // have been dispatched yet.
+    executeSoon(function () {
+      let plugin = gBrowser.contentDocument.getElementById("test");
+      let elt = gPluginHandler.getPluginUI.bind(gPluginHandler, plugin);
+      is(elt("submitStatus").getAttribute("status"), data,
+         "submitStatus data should match");
+    });
   }
   catch (err) {
     failWithException(err);
   }
   finish();
 }
 
 function getPropertyBagValue(bag, key) {

--- a/build/gyp.mozbuild
+++ b/build/gyp.mozbuild
@@ -104,17 +104,17 @@ if CONFIG['ARM_ARCH']:
         gyp_vars['arm_neon_optional'] = 0
     elif os == 'Android':
         gyp_vars['armv7'] = 1
     else:
         # CPU detection for ARM works on Android only.  armv7 always uses CPU
         # detection, so we have to set armv7=0 for non-Android target
         gyp_vars['armv7'] = 0
     # For libyuv
-    gyp_vars['arm_version'] = CONFIG['ARM_ARCH']
+    gyp_vars['arm_version'] = int(CONFIG['ARM_ARCH'])
 
 # Don't try to compile ssse3/sse4.1 code if toolchain doesn't support
 if CONFIG['INTEL_ARCHITECTURE']:
     if not CONFIG['HAVE_TOOLCHAIN_SUPPORT_MSSSE3'] or not CONFIG['HAVE_TOOLCHAIN_SUPPORT_MSSE4_1']:
         gyp_vars['yuv_disable_asm'] = 1
 
 if CONFIG['MACOS_SDK_DIR']:
     gyp_vars['mac_sdk_path'] = CONFIG['MACOS_SDK_DIR']

--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -7496,21 +7496,27 @@ nsIDocument::AdoptNode(nsINode& aAdopted
                "Should still be in the document we just got adopted into");
 
   return adoptedNode;
 }
 
 nsViewportInfo
 nsDocument::GetViewportInfo(const ScreenIntSize& aDisplaySize)
 {
+  // Compute the CSS-to-LayoutDevice pixel scale as the product of the
+  // widget scale and the full zoom.
   nsPresContext* context = mPresShell->GetPresContext();
   float fullZoom = context ? context->GetFullZoom() : 1.0;
   fullZoom = (fullZoom == 0.0) ? 1.0 : fullZoom;
-  CSSToScreenScale defaultScale = CSSToLayoutDeviceScale(fullZoom) *
-                                  LayoutDeviceToScreenScale(1.0);
+  nsIWidget *widget = nsContentUtils::WidgetForDocument(this);
+  float widgetScale = widget ? widget->GetDefaultScale().scale : 1.0f;
+  CSSToLayoutDeviceScale layoutDeviceScale(widgetScale * fullZoom);
+
+  CSSToScreenScale defaultScale = layoutDeviceScale
+                                * LayoutDeviceToScreenScale(1.0);
 
   // In cases where the width of the CSS viewport is less than or equal to the width
   // of the display (i.e. width <= device-width) then we disable double-tap-to-zoom
   // behaviour. See bug 941995 for details.
 
   switch (mViewportType) {
   case DisplayWidthHeight:
     return nsViewportInfo(aDisplaySize,
@@ -7684,29 +7690,23 @@ nsDocument::GetViewportInfo(const Screen
     if (!mValidHeight) {
       if (!aDisplaySize.IsEmpty()) {
         size.height = size.width * aDisplaySize.height / aDisplaySize.width;
       } else {
         size.height = size.width;
       }
     }
 
-    // Now convert the scale into device pixels per CSS pixel base on this formula
-    //   CSSPixel x widget scale x full zoom = LayoutDevicePixel
-    nsIWidget *widget = nsContentUtils::WidgetForDocument(this);
-    CSSToLayoutDeviceScale pixelRatio = CSSToLayoutDeviceScale(
-          (widget ? widget->GetDefaultScale().scale : 1.0f) * fullZoom);
-
-    CSSToScreenScale scaleFloat = mScaleFloat * pixelRatio;
-    CSSToScreenScale scaleMinFloat = mScaleMinFloat * pixelRatio;
-    CSSToScreenScale scaleMaxFloat = mScaleMaxFloat * pixelRatio;
+    CSSToScreenScale scaleFloat = mScaleFloat * layoutDeviceScale;
+    CSSToScreenScale scaleMinFloat = mScaleMinFloat * layoutDeviceScale;
+    CSSToScreenScale scaleMaxFloat = mScaleMaxFloat * layoutDeviceScale;
 
     if (mAutoSize) {
       // aDisplaySize is in screen pixels; convert them to CSS pixels for the viewport size.
-      CSSToScreenScale defaultPixelScale = pixelRatio * LayoutDeviceToScreenScale(1.0f);
+      CSSToScreenScale defaultPixelScale = layoutDeviceScale * LayoutDeviceToScreenScale(1.0f);
       size = ScreenSize(aDisplaySize) / defaultPixelScale;
     }
 
     size.width = clamped(size.width, float(kViewportMinSize.width), float(kViewportMaxSize.width));
 
     // Also recalculate the default zoom, if it wasn't specified in the metadata,
     // and the width is specified.
     if (mScaleStrEmpty && !mWidthStrEmpty) {

--- a/content/html/content/src/HTMLSelectElement.cpp
+++ b/content/html/content/src/HTMLSelectElement.cpp
@@ -968,18 +968,18 @@ HTMLSelectElement::SetOptionsSelectedByI
   bool optionsDeselected = false;
 
   nsISelectControlFrame* selectFrame = nullptr;
   bool didGetFrame = false;
   nsWeakFrame weakSelectFrame;
 
   if (aOptionsMask & IS_SELECTED) {
     // Setting selectedIndex to an out-of-bounds index means -1. (HTML5)
-    if (aStartIndex < 0 || SafeCast<uint32_t>(aStartIndex) >= numItems ||
-        aEndIndex < 0 || SafeCast<uint32_t>(aEndIndex) >= numItems) {
+    if (aStartIndex < 0 || AssertedCast<uint32_t>(aStartIndex) >= numItems ||
+        aEndIndex < 0 || AssertedCast<uint32_t>(aEndIndex) >= numItems) {
       aStartIndex = -1;
       aEndIndex = -1;
     }
 
     // Only select the first value if it's not multiple
     if (!isMultiple) {
       aEndIndex = aStartIndex;
     }
@@ -999,18 +999,18 @@ HTMLSelectElement::SetOptionsSelectedByI
     // Select the requested indices
     //
     // If index is -1, everything will be deselected (bug 28143)
     if (aStartIndex != -1) {
       MOZ_ASSERT(aStartIndex >= 0);
       MOZ_ASSERT(aEndIndex >= 0);
       // Loop through the options and select them (if they are not disabled and
       // if they are not already selected).
-      for (uint32_t optIndex = SafeCast<uint32_t>(aStartIndex);
-           optIndex <= SafeCast<uint32_t>(aEndIndex);
+      for (uint32_t optIndex = AssertedCast<uint32_t>(aStartIndex);
+           optIndex <= AssertedCast<uint32_t>(aEndIndex);
            optIndex++) {
         nsRefPtr<HTMLOptionElement> option = Item(optIndex);
 
         // Ignore disabled options.
         if (!(aOptionsMask & SET_DISABLED)) {
           if (option && IsOptionDisabled(option)) {
             continue;
           }
@@ -1035,17 +1035,17 @@ HTMLSelectElement::SetOptionsSelectedByI
     }
 
     // Next remove all other options if single select or all is clear
     // If index is -1, everything will be deselected (bug 28143)
     if (((!isMultiple && optionsSelected)
        || ((aOptionsMask & CLEAR_ALL) && !allDisabled)
        || aStartIndex == -1)
        && previousSelectedIndex != -1) {
-      for (uint32_t optIndex = SafeCast<uint32_t>(previousSelectedIndex);
+      for (uint32_t optIndex = AssertedCast<uint32_t>(previousSelectedIndex);
            optIndex < numItems;
            optIndex++) {
         if (static_cast<int32_t>(optIndex) < aStartIndex ||
             static_cast<int32_t>(optIndex) > aEndIndex) {
           HTMLOptionElement* option = Item(optIndex);
           // If the index is already selected, ignore it.
           if (option && option->Selected()) {
             if (!didGetFrame || (selectFrame && !weakSelectFrame.IsAlive())) {

--- a/content/media/gmp/GMPChild.cpp
+++ b/content/media/gmp/GMPChild.cpp
@@ -121,30 +121,84 @@ GetPluginPaths(const std::string& aPlugi
     libFile->GetNativeTarget(aPluginFilePath);
   } else {
     libFile->GetNativePath(aPluginFilePath);
   }
 
   return true;
 }
 
+static bool
+GetAppPaths(nsCString &aAppPath, nsCString &aAppBinaryPath)
+{
+  nsAutoCString appPath;
+  nsAutoCString appBinaryPath(
+    (CommandLine::ForCurrentProcess()->argv()[0]).c_str());
+
+  nsAutoCString::const_iterator start, end;
+  appBinaryPath.BeginReading(start);
+  appBinaryPath.EndReading(end);
+  if (RFindInReadable(NS_LITERAL_CSTRING(".app/Contents/MacOS/"), start, end)) {
+    end = start;
+    ++end; ++end; ++end; ++end;
+    appBinaryPath.BeginReading(start);
+    appPath.Assign(Substring(start, end));
+  } else {
+    return false;
+  }
+
+  nsCOMPtr<nsIFile> app, appBinary;
+  nsresult rv = NS_NewLocalFile(NS_ConvertUTF8toUTF16(appPath),
+                                true, getter_AddRefs(app));
+  if (NS_FAILED(rv)) {
+    return false;
+  }
+  rv = NS_NewLocalFile(NS_ConvertUTF8toUTF16(appBinaryPath),
+                       true, getter_AddRefs(appBinary));
+  if (NS_FAILED(rv)) {
+    return false;
+  }
+
+  bool isLink;
+  app->IsSymlink(&isLink);
+  if (isLink) {
+    app->GetNativeTarget(aAppPath);
+  } else {
+    app->GetNativePath(aAppPath);
+  }
+  appBinary->IsSymlink(&isLink);
+  if (isLink) {
+    appBinary->GetNativeTarget(aAppBinaryPath);
+  } else {
+    appBinary->GetNativePath(aAppBinaryPath);
+  }
+
+  return true;
+}
+
 void
 GMPChild::OnChannelConnected(int32_t aPid)
 {
   nsAutoCString pluginDirectoryPath, pluginFilePath;
   if (!GetPluginPaths(mPluginPath, pluginDirectoryPath, pluginFilePath)) {
     MOZ_CRASH("Error scanning plugin path");
   }
+  nsAutoCString appPath, appBinaryPath;
+  if (!GetAppPaths(appPath, appBinaryPath)) {
+    MOZ_CRASH("Error resolving child process path");
+  }
 
   MacSandboxInfo info;
   info.type = MacSandboxType_Plugin;
   info.pluginInfo.type = MacSandboxPluginType_GMPlugin_Default;
   info.pluginInfo.pluginPath.Assign(pluginDirectoryPath);
   mPluginBinaryPath.Assign(pluginFilePath);
   info.pluginInfo.pluginBinaryPath.Assign(pluginFilePath);
+  info.appPath.Assign(appPath);
+  info.appBinaryPath.Assign(appBinaryPath);
 
   nsAutoCString err;
   if (!mozilla::StartMacSandbox(info, err)) {
     NS_WARNING(err.get());
     MOZ_CRASH("sandbox_init() failed");
   }
 
   if (!LoadPluginLibrary(mPluginPath)) {

--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -872,17 +872,17 @@ nsDocShell::nsDocShell():
 #ifdef DEBUG
   // We're counting the number of |nsDocShells| to help find leaks
   ++gNumberOfDocShells;
   if (!PR_GetEnv("MOZ_QUIET")) {
       printf_stderr("++DOCSHELL %p == %ld [pid = %d] [id = %llu]\n",
                     (void*) this,
                     gNumberOfDocShells,
                     getpid(),
-                    SafeCast<unsigned long long>(mHistoryID));
+                    AssertedCast<unsigned long long>(mHistoryID));
   }
 #endif
 }
 
 nsDocShell::~nsDocShell()
 {
     Destroy();
 
@@ -904,17 +904,17 @@ nsDocShell::~nsDocShell()
 #ifdef DEBUG
     // We're counting the number of |nsDocShells| to help find leaks
     --gNumberOfDocShells;
     if (!PR_GetEnv("MOZ_QUIET")) {
         printf_stderr("--DOCSHELL %p == %ld [pid = %d] [id = %llu]\n",
                       (void*) this,
                       gNumberOfDocShells,
                       getpid(),
-                      SafeCast<unsigned long long>(mHistoryID));
+                      AssertedCast<unsigned long long>(mHistoryID));
     }
 #endif
 }
 
 nsresult
 nsDocShell::Init()
 {
     nsresult rv = nsDocLoader::Init();

--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -1030,16 +1030,22 @@ class CGHeaders(CGWrapper):
             elif unrolled.isDate():
                 if dictionary or jsImplementedDescriptors:
                     declareIncludes.add("mozilla/dom/Date.h")
                 else:
                     bindingHeaders.add("mozilla/dom/Date.h")
             elif unrolled.isInterface():
                 if unrolled.isSpiderMonkeyInterface():
                     bindingHeaders.add("jsfriendapi.h")
+                    if jsImplementedDescriptors:
+                        # Since we can't forward-declare typed array types
+                        # (because they're typedefs), we have to go ahead and
+                        # just include their header if we need to have functions
+                        # taking references to them declared in that header.
+                        headerSet = declareIncludes
                     headerSet.add("mozilla/dom/TypedArray.h")
                 else:
                     providers = getRelevantProviders(descriptor, config)
                     for p in providers:
                         try:
                             typeDesc = p.getDescriptor(unrolled.inner.identifier.name)
                         except NoSuchDescriptorError:
                             continue
@@ -5480,17 +5486,18 @@ def getWrapTemplateForType(type, descrip
             type.inner, descriptorProvider,
             {
                 'result': "%s[%s]" % (result, index),
                 'successCode': "break;\n",
                 'jsvalRef': "tmp",
                 'jsvalHandle': "&tmp",
                 'returnsNewObject': returnsNewObject,
                 'exceptionCode': exceptionCode,
-                'obj': "returnArray"
+                'obj': "returnArray",
+                'typedArraysAreStructs': typedArraysAreStructs
             })
         sequenceWrapLevel -= 1
         code = fill(
             """
 
             uint32_t length = ${result}.Length();
             JS::Rooted<JSObject*> returnArray(cx, JS_NewArrayObject(cx, length));
             if (!returnArray) {
@@ -5533,17 +5540,18 @@ def getWrapTemplateForType(type, descrip
             type.inner, descriptorProvider,
             {
                 'result': valueName,
                 'successCode': "break;\n",
                 'jsvalRef': "tmp",
                 'jsvalHandle': "&tmp",
                 'returnsNewObject': returnsNewObject,
                 'exceptionCode': exceptionCode,
-                'obj': "returnObj"
+                'obj': "returnObj",
+                'typedArraysAreStructs': typedArraysAreStructs
             })
         mozMapWrapLevel -= 1
         code = fill(
             """
 
             nsTArray<nsString> keys;
             ${result}.GetKeys(keys);
             JS::Rooted<JSObject*> returnObj(cx, JS_NewObject(cx, nullptr, JS::NullPtr(), JS::NullPtr()));
@@ -11804,16 +11812,18 @@ class CGForwardDeclarations(CGWrapper):
                         pass
                 # Find and add the worker implementation, if any.
                 if workerness != 'mainthreadonly':
                     try:
                         desc = config.getDescriptor(name, True)
                         builder.add(desc.nativeType)
                     except NoSuchDescriptorError:
                         pass
+            # Note: Spidermonkey interfaces are typedefs, so can't be
+            # forward-declared
             elif t.isCallback():
                 builder.addInMozillaDom(str(t))
             elif t.isDictionary():
                 builder.addInMozillaDom(t.inner.identifier.name, isStruct=True)
             elif t.isCallbackInterface():
                 builder.addInMozillaDom(t.inner.identifier.name)
             elif t.isUnion():
                 # Forward declare both the owning and non-owning version,
@@ -12010,17 +12020,17 @@ class CGBindingRoot(CGThing):
 
         # Do codegen for JS implemented classes
         def getParentDescriptor(desc):
             if not desc.interface.parent:
                 return set()
             return {desc.getDescriptor(desc.interface.parent.identifier.name)}
         for x in dependencySortObjects(jsImplemented, getParentDescriptor,
                                        lambda d: d.interface.identifier.name):
-            cgthings.append(CGCallbackInterface(x))
+            cgthings.append(CGCallbackInterface(x, typedArraysAreStructs=True))
             cgthings.append(CGJSImplClass(x))
 
         # And make sure we have the right number of newlines at the end
         curr = CGWrapper(CGList(cgthings, "\n\n"), post="\n\n")
 
         # Wrap all of that in our namespaces.
         curr = CGNamespace.build(['mozilla', 'dom'],
                                  CGWrapper(curr, pre="\n"))
@@ -12068,31 +12078,32 @@ class CGBindingRoot(CGThing):
 
     def deps(self):
         return self.root.deps()
 
 
 class CGNativeMember(ClassMethod):
     def __init__(self, descriptorProvider, member, name, signature, extendedAttrs,
                  breakAfter=True, passJSBitsAsNeeded=True, visibility="public",
-                 jsObjectsArePtr=False, variadicIsSequence=False):
+                 typedArraysAreStructs=True, variadicIsSequence=False):
         """
-        If jsObjectsArePtr is true, typed arrays and "object" will be
-        passed as JSObject*.
+        If typedArraysAreStructs is false, typed arrays will be passed as
+        JS::Handle<JSObject*>.  If it's true they will be passed as one of the
+        dom::TypedArray subclasses.
 
         If passJSBitsAsNeeded is false, we don't automatically pass in a
         JSContext* or a JSObject* based on the return and argument types.  We
         can still pass it based on 'implicitJSContext' annotations.
         """
         self.descriptorProvider = descriptorProvider
         self.member = member
         self.extendedAttrs = extendedAttrs
         self.resultAlreadyAddRefed = isResultAlreadyAddRefed(self.extendedAttrs)
         self.passJSBitsAsNeeded = passJSBitsAsNeeded
-        self.jsObjectsArePtr = jsObjectsArePtr
+        self.typedArraysAreStructs = typedArraysAreStructs
         self.variadicIsSequence = variadicIsSequence
         breakAfterSelf = "\n" if breakAfter else ""
         ClassMethod.__init__(self, name,
                              self.getReturnType(signature[0], False),
                              self.getArgs(signature[0], signature[1]),
                              static=member.isStatic(),
                              # Mark our getters, which are attrs that
                              # have a non-void return type, as const.
@@ -12190,19 +12201,19 @@ class CGNativeMember(ClassMethod):
                 # No need for a third element in the isMember case
                 return "JSObject*", None, None
             return "void", "", "aRetVal.set(${declName});\n"
         if type.isSpiderMonkeyInterface():
             if isMember:
                 # No need for a third element in the isMember case
                 return "JSObject*", None, None
             if type.nullable():
-                returnCode = "${declName}.IsNull() ? nullptr : ${declName}.Value().Obj();\n"
-            else:
-                returnCode = "${declName}.Obj();\n"
+                returnCode = "${declName}.IsNull() ? nullptr : ${declName}.Value().Obj()"
+            else:
+                returnCode = "${declName}.Obj()"
             return "void", "", "aRetVal.set(%s);\n" % returnCode
         if type.isSequence():
             # If we want to handle sequence-of-sequences return values, we're
             # going to need to fix example codegen to not produce nsTArray<void>
             # for the relevant argument...
             assert not isMember
             # Outparam.
             if type.nullable():
@@ -12368,18 +12379,18 @@ class CGNativeMember(ClassMethod):
                         typeDecl = "NonNull<%s>"
                 else:
                     typeDecl = "%s&"
             return ((typeDecl %
                      self.descriptorProvider.getDescriptor(iface.identifier.name).prettyNativeType),
                     False, False)
 
         if type.isSpiderMonkeyInterface():
-            if self.jsObjectsArePtr:
-                return "JSObject*", False, False
+            if not self.typedArraysAreStructs:
+                return "JS::Handle<JSObject*>", False, False
 
             return type.name, True, True
 
         if type.isDOMString() or type.isScalarValueString():
             if isMember:
                 declType = "nsString"
             else:
                 declType = "nsAString"
@@ -12857,23 +12868,21 @@ def jsImplName(name):
 
 class CGJSImplMember(CGNativeMember):
     """
     Base class for generating code for the members of the implementation class
     for a JS-implemented WebIDL interface.
     """
     def __init__(self, descriptorProvider, member, name, signature,
                  extendedAttrs, breakAfter=True, passJSBitsAsNeeded=True,
-                 visibility="public", jsObjectsArePtr=False,
-                 variadicIsSequence=False):
+                 visibility="public", variadicIsSequence=False):
         CGNativeMember.__init__(self, descriptorProvider, member, name,
                                 signature, extendedAttrs, breakAfter=breakAfter,
                                 passJSBitsAsNeeded=passJSBitsAsNeeded,
                                 visibility=visibility,
-                                jsObjectsArePtr=jsObjectsArePtr,
                                 variadicIsSequence=variadicIsSequence)
         self.body = self.getImpl()
 
     def getArgs(self, returnType, argList):
         args = CGNativeMember.getArgs(self, returnType, argList)
         args.append(Argument("JSCompartment*", "aCompartment", "nullptr"))
         return args
 
@@ -13365,26 +13374,27 @@ class CGCallbackFunction(CGCallback):
                 [Argument("CallbackFunction*", "aOther")],
                 bodyInHeader=True,
                 visibility="public",
                 explicit=True,
                 baseConstructors=["CallbackFunction(aOther)"])]
 
 
 class CGCallbackInterface(CGCallback):
-    def __init__(self, descriptor):
+    def __init__(self, descriptor, typedArraysAreStructs=False):
         iface = descriptor.interface
         attrs = [m for m in iface.members if m.isAttr() and not m.isStatic()]
-        getters = [CallbackGetter(a, descriptor) for a in attrs]
-        setters = [CallbackSetter(a, descriptor) for a in attrs
-                   if not a.readonly]
+        getters = [CallbackGetter(a, descriptor, typedArraysAreStructs)
+                   for a in attrs]
+        setters = [CallbackSetter(a, descriptor, typedArraysAreStructs)
+                   for a in attrs if not a.readonly]
         methods = [m for m in iface.members
                    if m.isMethod() and not m.isStatic() and not m.isIdentifierLess()]
-        methods = [CallbackOperation(m, sig, descriptor) for m in methods
-                   for sig in m.signatures()]
+        methods = [CallbackOperation(m, sig, descriptor, typedArraysAreStructs)
+                   for m in methods for sig in m.signatures()]
         if iface.isJSImplemented() and iface.ctor():
             sigs = descriptor.interface.ctor().signatures()
             if len(sigs) != 1:
                 raise TypeError("We only handle one constructor.  See bug 869268.")
             methods.append(CGJSImplInitOperation(sigs[0], descriptor))
         if any(m.isAttr() or m.isMethod() for m in iface.members) or (iface.isJSImplemented() and iface.ctor()):
             methods.append(initIdsClassMethod([descriptor.binaryNameFor(m.identifier.name)
                                                for m in iface.members
@@ -13415,17 +13425,18 @@ class FakeMember():
         # resultNotAddRefed" comments CGNativeMember codegen would
         # otherwise stick in.
         if name == "NewObject":
             return True
         return None
 
 
 class CallbackMember(CGNativeMember):
-    def __init__(self, sig, name, descriptorProvider, needThisHandling, rethrowContentException=False):
+    def __init__(self, sig, name, descriptorProvider, needThisHandling,
+                 rethrowContentException=False, typedArraysAreStructs=False):
         """
         needThisHandling is True if we need to be able to accept a specified
         thisObj, False otherwise.
         """
         assert not rethrowContentException or not needThisHandling
 
         self.retvalType = sig[0]
         self.originalSig = sig
@@ -13447,17 +13458,17 @@ class CallbackMember(CGNativeMember):
         # We don't care, for callback codegen, whether our original member was
         # a method or attribute or whatnot.  Just always pass FakeMember()
         # here.
         CGNativeMember.__init__(self, descriptorProvider, FakeMember(),
                                 name, (self.retvalType, args),
                                 extendedAttrs={},
                                 passJSBitsAsNeeded=False,
                                 visibility=visibility,
-                                jsObjectsArePtr=True)
+                                typedArraysAreStructs=typedArraysAreStructs)
         # We have to do all the generation of our body now, because
         # the caller relies on us throwing if we can't manage it.
         self.exceptionCode = ("aRv.Throw(NS_ERROR_UNEXPECTED);\n"
                               "return%s;\n" % self.getDefaultRetval())
         self.body = self.getImpl()
 
     def getImpl(self):
         setupCall = self.getCallSetup()
@@ -13563,17 +13574,18 @@ class CallbackMember(CGNativeMember):
                     'successCode': "continue;\n" if arg.variadic else "break;\n",
                     'jsvalRef': "argv[%s]" % jsvalIndex,
                     'jsvalHandle': "argv[%s]" % jsvalIndex,
                     # XXXbz we don't have anything better to use for 'obj',
                     # really...  It's OK to use CallbackPreserveColor because
                     # CallSetup already handled the unmark-gray bits for us.
                     'obj': 'CallbackPreserveColor()',
                     'returnsNewObject': False,
-                    'exceptionCode': self.exceptionCode
+                    'exceptionCode': self.exceptionCode,
+                    'typedArraysAreStructs': self.typedArraysAreStructs
                 })
         except MethodNotNewObjectError as err:
             raise TypeError("%s being passed as an argument to %s but is not "
                             "wrapper cached, so can't be reliably converted to "
                             "a JS object." %
                             (err.typename, self.getPrettyName()))
         if arg.variadic:
             conversion = fill(
@@ -13666,19 +13678,20 @@ class CallbackMember(CGNativeMember):
                               "double-quote character.  We can't handle "
                               "that.  %s" %
                               (type, idlObject.identifier.name,
                                idlObject.location))
 
 
 class CallbackMethod(CallbackMember):
     def __init__(self, sig, name, descriptorProvider, needThisHandling,
-                 rethrowContentException=False):
+                 rethrowContentException=False, typedArraysAreStructs=False):
         CallbackMember.__init__(self, sig, name, descriptorProvider,
-                                needThisHandling, rethrowContentException)
+                                needThisHandling, rethrowContentException,
+                                typedArraysAreStructs=typedArraysAreStructs)
 
     def getRvalDecl(self):
         return "JS::Rooted<JS::Value> rval(cx, JS::UndefinedValue());\n"
 
     def getCall(self):
         if self.argCount > 0:
             args = "JS::HandleValueArray::subarray(argv, 0, argc)"
         else:
@@ -13725,20 +13738,24 @@ class CallCallback(CallbackMethod):
             return "JS_ObjectIsCallable(cx, mCallback) && "
         return ""
 
 
 class CallbackOperationBase(CallbackMethod):
     """
     Common class for implementing various callback operations.
     """
-    def __init__(self, signature, jsName, nativeName, descriptor, singleOperation, rethrowContentException=False):
+    def __init__(self, signature, jsName, nativeName, descriptor,
+                 singleOperation, rethrowContentException=False,
+                 typedArraysAreStructs=False):
         self.singleOperation = singleOperation
         self.methodName = descriptor.binaryNameFor(jsName)
-        CallbackMethod.__init__(self, signature, nativeName, descriptor, singleOperation, rethrowContentException)
+        CallbackMethod.__init__(self, signature, nativeName, descriptor,
+                                singleOperation, rethrowContentException,
+                                typedArraysAreStructs=typedArraysAreStructs)
 
     def getThisDecl(self):
         if not self.singleOperation:
             return "JS::Rooted<JS::Value> thisValue(cx, JS::ObjectValue(*mCallback));\n"
         # This relies on getCallableDecl declaring a boolean
         # isCallable in the case when we're a single-operation
         # interface.
         return dedent("""
@@ -13779,53 +13796,56 @@ class CallbackOperationBase(CallbackMeth
     def getCallGuard(self):
         return ""
 
 
 class CallbackOperation(CallbackOperationBase):
     """
     Codegen actual WebIDL operations on callback interfaces.
     """
-    def __init__(self, method, signature, descriptor):
+    def __init__(self, method, signature, descriptor, typedArraysAreStructs):
         self.ensureASCIIName(method)
         self.method = method
         jsName = method.identifier.name
         CallbackOperationBase.__init__(self, signature,
                                        jsName,
                                        MakeNativeName(descriptor.binaryNameFor(jsName)),
                                        descriptor, descriptor.interface.isSingleOperationInterface(),
-                                       rethrowContentException=descriptor.interface.isJSImplemented())
+                                       rethrowContentException=descriptor.interface.isJSImplemented(),
+                                       typedArraysAreStructs=typedArraysAreStructs)
 
     def getPrettyName(self):
         return "%s.%s" % (self.descriptorProvider.interface.identifier.name,
                           self.method.identifier.name)
 
 
 class CallbackAccessor(CallbackMember):
     """
     Shared superclass for CallbackGetter and CallbackSetter.
     """
-    def __init__(self, attr, sig, name, descriptor):
+    def __init__(self, attr, sig, name, descriptor, typedArraysAreStructs):
         self.ensureASCIIName(attr)
         self.attrName = attr.identifier.name
         CallbackMember.__init__(self, sig, name, descriptor,
                                 needThisHandling=False,
-                                rethrowContentException=descriptor.interface.isJSImplemented())
+                                rethrowContentException=descriptor.interface.isJSImplemented(),
+                                typedArraysAreStructs=typedArraysAreStructs)
 
     def getPrettyName(self):
         return "%s.%s" % (self.descriptorProvider.interface.identifier.name,
                           self.attrName)
 
 
 class CallbackGetter(CallbackAccessor):
-    def __init__(self, attr, descriptor):
+    def __init__(self, attr, descriptor, typedArraysAreStructs):
         CallbackAccessor.__init__(self, attr,
                                   (attr.type, []),
                                   callbackGetterName(attr, descriptor),
-                                  descriptor)
+                                  descriptor,
+                                  typedArraysAreStructs)
 
     def getRvalDecl(self):
         return "JS::Rooted<JS::Value> rval(cx, JS::UndefinedValue());\n"
 
     def getCall(self):
         return fill(
             """
             JS::Rooted<JSObject *> callback(cx, mCallback);
@@ -13837,22 +13857,22 @@ class CallbackGetter(CallbackAccessor):
             }
             """,
             atomCacheName=self.descriptorProvider.interface.identifier.name + "Atoms",
             attrAtomName=CGDictionary.makeIdName(self.descriptorProvider.binaryNameFor(self.attrName)),
             errorReturn=self.getDefaultRetval())
 
 
 class CallbackSetter(CallbackAccessor):
-    def __init__(self, attr, descriptor):
+    def __init__(self, attr, descriptor, typedArraysAreStructs):
         CallbackAccessor.__init__(self, attr,
                                   (BuiltinTypes[IDLBuiltinType.Types.void],
                                    [FakeArgument(attr.type, attr)]),
                                   callbackSetterName(attr, descriptor),
-                                  descriptor)
+                                  descriptor, typedArraysAreStructs)
 
     def getRvalDecl(self):
         # We don't need an rval
         return ""
 
     def getCall(self):
         return fill(
             """

--- a/dom/bindings/parser/WebIDL.py
+++ b/dom/bindings/parser/WebIDL.py
@@ -1002,17 +1002,24 @@ class IDLInterface(IDLObjectWithScope):
                               [attr.location])
 
                     iface = forwardIface
                     attr = fowardAttr
                     putForwards = attr.getExtendedAttribute("PutForwards")
 
         if (self.getExtendedAttribute("Pref") and
             self._exposureGlobalNames != set([self.parentScope.primaryGlobalName])):
-            raise WebIDLError("[Pref] used on an member that is not %s-only" %
+            raise WebIDLError("[Pref] used on an interface that is not %s-only" %
+                              self.parentScope.primaryGlobalName,
+                              [self.location])
+
+        if (self.getExtendedAttribute("CheckPermissions") and
+            self._exposureGlobalNames != set([self.parentScope.primaryGlobalName])):
+            raise WebIDLError("[CheckPermissions] used on an interface that is "
+                              "not %s-only" %
                               self.parentScope.primaryGlobalName,
                               [self.location])
 
 
     def isInterface(self):
         return True
 
     def isExternal(self):
@@ -3017,16 +3024,23 @@ class IDLInterfaceMember(IDLObjectWithId
 
     def validate(self):
         if (self.getExtendedAttribute("Pref") and
             self.exposureSet != set([self._scope.primaryGlobalName])):
             raise WebIDLError("[Pref] used on an interface member that is not "
                               "%s-only" % self._scope.primaryGlobalName,
                               [self.location])
 
+        if (self.getExtendedAttribute("CheckPermissions") and
+            self.exposureSet != set([self._scope.primaryGlobalName])):
+            raise WebIDLError("[CheckPermissions] used on an interface member "
+                              "that is not %s-only" %
+                              self._scope.primaryGlobalName,
+                              [self.location])
+
 class IDLConst(IDLInterfaceMember):
     def __init__(self, location, identifier, type, value):
         IDLInterfaceMember.__init__(self, location, identifier,
                                     IDLInterfaceMember.Tags.Const)
 
         assert isinstance(type, IDLType)
         if type.isDictionary():
             raise WebIDLError("A constant cannot be of a dictionary type",

--- a/dom/bindings/test/TestBindingHeader.h
+++ b/dom/bindings/test/TestBindingHeader.h
@@ -456,16 +456,18 @@ public:
   void PassFloat64Array(const Float64Array&);
   void PassSequenceOfArrayBuffers(const Sequence<ArrayBuffer>&);
   void PassSequenceOfNullableArrayBuffers(const Sequence<Nullable<ArrayBuffer> >&);
   void PassMozMapOfArrayBuffers(const MozMap<ArrayBuffer>&);
   void PassMozMapOfNullableArrayBuffers(const MozMap<Nullable<ArrayBuffer> >&);
   void PassVariadicTypedArray(const Sequence<Float32Array>&);
   void PassVariadicNullableTypedArray(const Sequence<Nullable<Float32Array> >&);
   void ReceiveUint8Array(JSContext*, JS::MutableHandle<JSObject*>);
+  void SetUint8ArrayAttr(const Uint8Array&);
+  void GetUint8ArrayAttr(JSContext*, JS::MutableHandle<JSObject*>);
 
   // DOMString types
   void PassString(const nsAString&);
   void PassNullableString(const nsAString&);
   void PassOptionalString(const Optional<nsAString>&);
   void PassOptionalStringWithDefaultValue(const nsAString&);
   void PassOptionalNullableString(const Optional<nsAString>&);
   void PassOptionalNullableStringWithDefaultValue(const nsAString&);

--- a/dom/bindings/test/TestCodeGen.webidl
+++ b/dom/bindings/test/TestCodeGen.webidl
@@ -28,16 +28,37 @@ callback interface TestCallbackInterface
   sequence<TestInterface?> getSequenceOfNullableInterfaces();
   sequence<TestInterface?>? getNullableSequenceOfNullableInterfaces();
   sequence<TestCallbackInterface> getSequenceOfCallbackInterfaces();
   sequence<TestCallbackInterface>? getNullableSequenceOfCallbackInterfaces();
   sequence<TestCallbackInterface?> getSequenceOfNullableCallbackInterfaces();
   sequence<TestCallbackInterface?>? getNullableSequenceOfNullableCallbackInterfaces();
   MozMap<long> getMozMapOfLong();
   Dict? getDictionary();
+  void passArrayBuffer(ArrayBuffer arg);
+  void passNullableArrayBuffer(ArrayBuffer? arg);
+  void passOptionalArrayBuffer(optional ArrayBuffer arg);
+  void passOptionalNullableArrayBuffer(optional ArrayBuffer? arg);
+  void passOptionalNullableArrayBufferWithDefaultValue(optional ArrayBuffer? arg= null);
+  void passArrayBufferView(ArrayBufferView arg);
+  void passInt8Array(Int8Array arg);
+  void passInt16Array(Int16Array arg);
+  void passInt32Array(Int32Array arg);
+  void passUint8Array(Uint8Array arg);
+  void passUint16Array(Uint16Array arg);
+  void passUint32Array(Uint32Array arg);
+  void passUint8ClampedArray(Uint8ClampedArray arg);
+  void passFloat32Array(Float32Array arg);
+  void passFloat64Array(Float64Array arg);
+  void passSequenceOfArrayBuffers(sequence<ArrayBuffer> arg);
+  void passSequenceOfNullableArrayBuffers(sequence<ArrayBuffer?> arg);
+  void passVariadicTypedArray(Float32Array... arg);
+  void passVariadicNullableTypedArray(Float32Array?... arg);
+  Uint8Array receiveUint8Array();
+  attribute Uint8Array uint8ArrayAttr;
 };
 
 callback interface TestSingleOperationCallbackInterface {
   TestInterface doSomething(short arg, sequence<double> anotherArg);
 };
 
 enum TestEnum {
   "1",
@@ -415,16 +436,17 @@ interface TestInterface {
   void passFloat64Array(Float64Array arg);
   void passSequenceOfArrayBuffers(sequence<ArrayBuffer> arg);
   void passSequenceOfNullableArrayBuffers(sequence<ArrayBuffer?> arg);
   void passMozMapOfArrayBuffers(MozMap<ArrayBuffer> arg);
   void passMozMapOfNullableArrayBuffers(MozMap<ArrayBuffer?> arg);
   void passVariadicTypedArray(Float32Array... arg);
   void passVariadicNullableTypedArray(Float32Array?... arg);
   Uint8Array receiveUint8Array();
+  attribute Uint8Array uint8ArrayAttr;
 
   // DOMString types
   void passString(DOMString arg);
   void passNullableString(DOMString? arg);
   void passOptionalString(optional DOMString arg);
   void passOptionalStringWithDefaultValue(optional DOMString arg = "abc");
   void passOptionalNullableString(optional DOMString? arg);
   void passOptionalNullableStringWithDefaultValue(optional DOMString? arg = null);

--- a/dom/bindings/test/TestExampleGen.webidl
+++ b/dom/bindings/test/TestExampleGen.webidl
@@ -302,16 +302,17 @@ interface TestExampleInterface {
   void passFloat64Array(Float64Array arg);
   void passSequenceOfArrayBuffers(sequence<ArrayBuffer> arg);
   void passSequenceOfNullableArrayBuffers(sequence<ArrayBuffer?> arg);
   void passMozMapOfArrayBuffers(MozMap<ArrayBuffer> arg);
   void passMozMapOfNullableArrayBuffers(MozMap<ArrayBuffer?> arg);
   void passVariadicTypedArray(Float32Array... arg);
   void passVariadicNullableTypedArray(Float32Array?... arg);
   Uint8Array receiveUint8Array();
+  attribute Uint8Array uint8ArrayAttr;
 
   // DOMString types
   void passString(DOMString arg);
   void passNullableString(DOMString? arg);
   void passOptionalString(optional DOMString arg);
   void passOptionalStringWithDefaultValue(optional DOMString arg = "abc");
   void passOptionalNullableString(optional DOMString? arg);
   void passOptionalNullableStringWithDefaultValue(optional DOMString? arg = null);

--- a/dom/bindings/test/TestJSImplGen.webidl
+++ b/dom/bindings/test/TestJSImplGen.webidl
@@ -298,43 +298,40 @@ interface TestJSImplInterface {
   MozMap<long> receiveMozMap();
   MozMap<long>? receiveNullableMozMap();
   MozMap<long?> receiveMozMapOfNullableInts();
   MozMap<long?>? receiveNullableMozMapOfNullableInts();
   //XXXbz No support for MozMap of MozMaps return values yet.
   //MozMap<MozMap<long>> receiveMozMapOfMozMaps();
   MozMap<any> receiveAnyMozMap();
 
-  // ArrayBuffer is handled differently in callback interfaces and the example generator.
-  // Need to figure out what should be done there.  Seems like other typed array stuff is
-  // similarly not working in the JS implemented generator.  Probably some other issues
-  // here as well.
   // Typed array types
-  //void passArrayBuffer(ArrayBuffer arg);
-  //void passNullableArrayBuffer(ArrayBuffer? arg);
-  //void passOptionalArrayBuffer(optional ArrayBuffer arg);
-  //void passOptionalNullableArrayBuffer(optional ArrayBuffer? arg);
-  //void passOptionalNullableArrayBufferWithDefaultValue(optional ArrayBuffer? arg= null);
-  //void passArrayBufferView(ArrayBufferView arg);
-  //void passInt8Array(Int8Array arg);
-  //void passInt16Array(Int16Array arg);
-  //void passInt32Array(Int32Array arg);
-  //void passUint8Array(Uint8Array arg);
-  //void passUint16Array(Uint16Array arg);
-  //void passUint32Array(Uint32Array arg);
-  //void passUint8ClampedArray(Uint8ClampedArray arg);
-  //void passFloat32Array(Float32Array arg);
-  //void passFloat64Array(Float64Array arg);
-  //void passSequenceOfArrayBuffers(sequence<ArrayBuffer> arg);
-  //void passSequenceOfNullableArrayBuffers(sequence<ArrayBuffer?> arg);
-  //void passMozMapOfArrayBuffers(MozMap<ArrayBuffer> arg);
-  //void passMozMapOfNullableArrayBuffers(MozMap<ArrayBuffer?> arg);
-  //void passVariadicTypedArray(Float32Array... arg);
-  //void passVariadicNullableTypedArray(Float32Array?... arg);
-  //Uint8Array receiveUint8Array();
+  void passArrayBuffer(ArrayBuffer arg);
+  void passNullableArrayBuffer(ArrayBuffer? arg);
+  void passOptionalArrayBuffer(optional ArrayBuffer arg);
+  void passOptionalNullableArrayBuffer(optional ArrayBuffer? arg);
+  void passOptionalNullableArrayBufferWithDefaultValue(optional ArrayBuffer? arg= null);
+  void passArrayBufferView(ArrayBufferView arg);
+  void passInt8Array(Int8Array arg);
+  void passInt16Array(Int16Array arg);
+  void passInt32Array(Int32Array arg);
+  void passUint8Array(Uint8Array arg);
+  void passUint16Array(Uint16Array arg);
+  void passUint32Array(Uint32Array arg);
+  void passUint8ClampedArray(Uint8ClampedArray arg);
+  void passFloat32Array(Float32Array arg);
+  void passFloat64Array(Float64Array arg);
+  void passSequenceOfArrayBuffers(sequence<ArrayBuffer> arg);
+  void passSequenceOfNullableArrayBuffers(sequence<ArrayBuffer?> arg);
+  void passMozMapOfArrayBuffers(MozMap<ArrayBuffer> arg);
+  void passMozMapOfNullableArrayBuffers(MozMap<ArrayBuffer?> arg);
+  void passVariadicTypedArray(Float32Array... arg);
+  void passVariadicNullableTypedArray(Float32Array?... arg);
+  Uint8Array receiveUint8Array();
+  attribute Uint8Array uint8ArrayAttr;
 
   // DOMString types
   void passString(DOMString arg);
   void passNullableString(DOMString? arg);
   void passOptionalString(optional DOMString arg);
   void passOptionalStringWithDefaultValue(optional DOMString arg = "abc");
   void passOptionalNullableString(optional DOMString? arg);
   void passOptionalNullableStringWithDefaultValue(optional DOMString? arg = null);

--- a/dom/browser-element/BrowserElementChildPreload.js
+++ b/dom/browser-element/BrowserElementChildPreload.js
@@ -76,27 +76,31 @@ let SEC_ERROR_UNTRUSTED_ISSUER = (SEC_ER
 let SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE = (SEC_ERROR_BASE + 30);
 let SEC_ERROR_UNTRUSTED_CERT = (SEC_ERROR_BASE + 21);
 let SEC_ERROR_EXPIRED_CERTIFICATE = (SEC_ERROR_BASE + 11);
 let SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED = (SEC_ERROR_BASE + 176);
 
 let SSL_ERROR_BASE = Ci.nsINSSErrorsService.NSS_SSL_ERROR_BASE;
 let SSL_ERROR_BAD_CERT_DOMAIN = (SSL_ERROR_BASE + 12);
 
+let MOZILLA_PKIX_ERROR_BASE = Ci.nsINSSErrorsService.MOZILLA_PKIX_ERROR_BASE;
+let MOZILLA_PKIX_ERROR_CA_CERT_USED_AS_END_ENTITY = (MOZILLA_PKIX_ERROR_BASE + 1);
+
 function getErrorClass(errorCode) {
   let NSPRCode = -1 * NS_ERROR_GET_CODE(errorCode);
 
   switch (NSPRCode) {
     case SEC_ERROR_UNKNOWN_ISSUER:
     case SEC_ERROR_UNTRUSTED_ISSUER:
     case SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE:
     case SEC_ERROR_UNTRUSTED_CERT:
     case SSL_ERROR_BAD_CERT_DOMAIN:
     case SEC_ERROR_EXPIRED_CERTIFICATE:
     case SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED:
+    case MOZILLA_PKIX_ERROR_CA_CERT_USED_AS_END_ENTITY:
       return Ci.nsINSSErrorsService.ERROR_CLASS_BAD_CERT;
     default:
       return Ci.nsINSSErrorsService.ERROR_CLASS_SSL_PROTOCOL;
   }
 
   return null;
 }
 

--- a/dom/canvas/CanvasImageCache.cpp
+++ b/dom/canvas/CanvasImageCache.cpp
@@ -80,55 +80,130 @@ public:
   enum { ALLOW_MEMMOVE = true };
 
   nsAutoPtr<ImageCacheEntryData> mData;
 };
 
 static bool sPrefsInitialized = false;
 static int32_t sCanvasImageCacheLimit = 0;
 
+class ImageCacheObserver;
+
 class ImageCache MOZ_FINAL : public nsExpirationTracker<ImageCacheEntryData,4> {
 public:
   // We use 3 generations of 1 second each to get a 2-3 seconds timeout.
   enum { GENERATION_MS = 1000 };
-  ImageCache()
-    : nsExpirationTracker<ImageCacheEntryData,4>(GENERATION_MS)
-    , mTotal(0)
-  {
-    if (!sPrefsInitialized) {
-      sPrefsInitialized = true;
-      Preferences::AddIntVarCache(&sCanvasImageCacheLimit, "canvas.image.cache.limit", 0);
-    }
-  }
-  ~ImageCache() {
-    AgeAllGenerations();
-  }
+  ImageCache();
+  ~ImageCache();
 
   virtual void NotifyExpired(ImageCacheEntryData* aObject)
   {
     mTotal -= aObject->SizeInBytes();
     RemoveObject(aObject);
     // Deleting the entry will delete aObject since the entry owns aObject
     mCache.RemoveEntry(ImageCacheKey(aObject->mImage, aObject->mCanvas));
   }
 
   nsTHashtable<ImageCacheEntry> mCache;
   size_t mTotal;
+  nsRefPtr<ImageCacheObserver> mImageCacheObserver;
 };
 
 static ImageCache* gImageCache = nullptr;
 
+// Listen memory-pressure event for image cache purge
+class ImageCacheObserver MOZ_FINAL : public nsIObserver
+{
+public:
+  NS_DECL_ISUPPORTS
+
+  ImageCacheObserver(ImageCache* aImageCache)
+    : mImageCache(aImageCache)
+  {
+    RegisterMemoryPressureEvent();
+  }
+
+  void Destroy()
+  {
+    UnregisterMemoryPressureEvent();
+    mImageCache = nullptr;
+  }
+
+  NS_IMETHODIMP Observe(nsISupports* aSubject,
+                        const char* aTopic,
+                        const char16_t* aSomeData)
+  {
+    if (!mImageCache || strcmp(aTopic, "memory-pressure")) {
+      return NS_OK;
+    }
+
+    mImageCache->AgeAllGenerations();
+    return NS_OK;
+  }
+
+private:
+  virtual ~ImageCacheObserver()
+  {
+  }
+
+  void RegisterMemoryPressureEvent()
+  {
+    nsCOMPtr<nsIObserverService> observerService =
+      mozilla::services::GetObserverService();
+
+    MOZ_ASSERT(observerService);
+
+    if (observerService) {
+      observerService->AddObserver(this, "memory-pressure", false);
+    }
+  }
+
+  void UnregisterMemoryPressureEvent()
+  {
+    nsCOMPtr<nsIObserverService> observerService =
+        mozilla::services::GetObserverService();
+
+    // Do not assert on observerService here. This might be triggered by
+    // the cycle collector at a late enough time, that XPCOM services are
+    // no longer available. See bug 1029504.
+    if (observerService) {
+        observerService->RemoveObserver(this, "memory-pressure");
+    }
+  }
+
+  ImageCache* mImageCache;
+};
+
+NS_IMPL_ISUPPORTS(ImageCacheObserver, nsIObserver)
+
 class CanvasImageCacheShutdownObserver MOZ_FINAL : public nsIObserver
 {
   ~CanvasImageCacheShutdownObserver() {}
 public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSIOBSERVER
 };
 
+ImageCache::ImageCache()
+  : nsExpirationTracker<ImageCacheEntryData,4>(GENERATION_MS)
+  , mTotal(0)
+{
+  if (!sPrefsInitialized) {
+    sPrefsInitialized = true;
+    Preferences::AddIntVarCache(&sCanvasImageCacheLimit, "canvas.image.cache.limit", 0);
+  }
+  mImageCacheObserver = new ImageCacheObserver(this);
+  MOZ_RELEASE_ASSERT(mImageCacheObserver, "Can't alloc ImageCacheObserver");
+}
+
+ImageCache::~ImageCache() {
+  AgeAllGenerations();
+  mImageCacheObserver->Destroy();
+}
+
 void
 CanvasImageCache::NotifyDrawImage(Element* aImage,
                                   HTMLCanvasElement* aCanvas,
                                   imgIRequest* aRequest,
                                   SourceSurface* aSource,
                                   const gfxIntSize& aSize)
 {
   if (!gImageCache) {

--- a/dom/canvas/CanvasRenderingContext2D.cpp
+++ b/dom/canvas/CanvasRenderingContext2D.cpp
@@ -86,16 +86,17 @@
 #include "mozilla/Preferences.h"
 #include "mozilla/Telemetry.h"
 #include "mozilla/unused.h"
 #include "nsCCUncollectableMarker.h"
 #include "nsWrapperCacheInlines.h"
 #include "mozilla/dom/CanvasRenderingContext2DBinding.h"
 #include "mozilla/dom/HTMLImageElement.h"
 #include "mozilla/dom/HTMLVideoElement.h"
+#include "mozilla/dom/SVGMatrix.h"
 #include "mozilla/dom/TextMetrics.h"
 #include "mozilla/dom/UnionTypes.h"
 #include "mozilla/dom/SVGMatrix.h"
 #include "nsGlobalWindow.h"
 #include "GLContext.h"
 #include "GLContextProvider.h"
 #include "SVGContentUtils.h"
 #include "SVGImageContext.h"
@@ -4589,16 +4590,35 @@ CanvasPath::BezierTo(const gfx::Point& a
                      const gfx::Point& aCP2,
                      const gfx::Point& aCP3)
 {
   EnsurePathBuilder();
 
   mPathBuilder->BezierTo(aCP1, aCP2, aCP3);
 }
 
+void
+CanvasPath::AddPath(CanvasPath& aCanvasPath, const Optional<NonNull<SVGMatrix>>& aMatrix)
+{
+  RefPtr<gfx::Path> tempPath = aCanvasPath.GetPath(CanvasWindingRule::Nonzero,
+                                                   gfxPlatform::GetPlatform()->ScreenReferenceDrawTarget());
+
+  if (aMatrix.WasPassed()) {
+    const SVGMatrix& m = aMatrix.Value();
+    Matrix transform(m.A(), m.B(), m.C(), m.D(), m.E(), m.F());
+
+    if (!transform.IsIdentity()) {
+      RefPtr<PathBuilder> tempBuilder = tempPath->TransformedCopyToBuilder(transform, FillRule::FILL_WINDING);
+      tempPath = tempBuilder->Finish();
+    }
+  }
+
+  tempPath->StreamToSink(mPathBuilder);
+}
+
 TemporaryRef<gfx::Path>
 CanvasPath::GetPath(const CanvasWindingRule& winding, const DrawTarget* aTarget) const
 {
   FillRule fillRule = FillRule::FILL_WINDING;
   if (winding == CanvasWindingRule::Evenodd) {
     fillRule = FillRule::FILL_EVEN_ODD;
   }
 

--- a/dom/canvas/CanvasRenderingContext2D.h
+++ b/dom/canvas/CanvasRenderingContext2D.h
@@ -36,16 +36,17 @@ class SurfaceStream;
 }
 
 namespace dom {
 class HTMLImageElementOrHTMLCanvasElementOrHTMLVideoElement;
 class ImageData;
 class StringOrCanvasGradientOrCanvasPattern;
 class OwningStringOrCanvasGradientOrCanvasPattern;
 class TextMetrics;
+class SVGMatrix;
 
 extern const mozilla::gfx::Float SIGMA_MAX;
 
 template<typename T> class Optional;
 
 class CanvasPath MOZ_FINAL :
   public nsWrapperCache
 {
@@ -89,16 +90,19 @@ public:
                                   const gfx::DrawTarget* aTarget) const;
 
   explicit CanvasPath(nsISupports* aParent);
   // TemporaryRef arg because the return value from Path::CopyToBuilder() is
   // passed directly and we can't drop the only ref to have a raw pointer.
   CanvasPath(nsISupports* aParent,
              TemporaryRef<gfx::PathBuilder> aPathBuilder);
 
+  void AddPath(CanvasPath& aCanvasPath,
+               const Optional<NonNull<SVGMatrix>>& aMatrix);
+
 private:
   virtual ~CanvasPath() {}
 
   nsCOMPtr<nsISupports> mParent;
   static gfx::Float ToFloat(double aValue) { return gfx::Float(aValue); }
 
   mutable RefPtr<gfx::Path> mPath;
   mutable RefPtr<gfx::PathBuilder> mPathBuilder;

--- a/dom/canvas/test/test_canvas_path.html
+++ b/dom/canvas/test/test_canvas_path.html
@@ -332,60 +332,110 @@ function test_pathconstructor_canvas() {
 
   // copy constructor. This should not crash.
   var p1 = new Path2D();
   var _p2 = new Path2D(p1);
   p1.arcTo(0, 0, 1, 1, 2);
 }
 </script>
 
+<p>Canvas test: test_addpath_canvas</p>
+<canvas id="c8" class="output" width="200" height="200">+
+</canvas>
+<script type="text/javascript">
+
+function test_addpath_canvas() {
+  var c = document.getElementById("c8");
+  var ctx = c.getContext("2d");
+  ctx.beginPath();
+  var p1 = new Path2D();
+  p1.rect(0,0,100,100);
+  var p2 = new Path2D();
+  p2.rect(0,100,100,100);
+  var m = ctx.currentTransform;
+  p1.addPath(p2, m);
+  ctx.fillStyle = 'yellow';
+  ctx.fill(p1);
+  isPixel(ctx, 0, 100, [255, 255, 0, 255], 0);
+
+  ctx.clearRect(0,0,200,200);
+
+  ctx.beginPath();
+  var p3 = new Path2D();
+  p3.rect(0,0,100,100);
+  var p4 = new Path2D();
+  p4.rect(0,100,100,100);
+  var m = document.createElementNS("http://www.w3.org/2000/svg", "svg").createSVGMatrix();
+  m.a = 1; m.b = 0;
+  m.c = 0; m.d = 1;
+  m.e = 100; m.f = -100;
+  p3.addPath(p4, m);
+  ctx.fillStyle = 'yellow';
+  ctx.fill(p3);
+  isPixel(ctx, 50, 50, [255, 255, 0, 255], 0);
+  isPixel(ctx, 150, 150, [0, 0, 0, 0], 0);
+
+  var p5 = new Path2D();
+  p5.rect(0,0,100,100);
+  shouldThrow(ctx, "p5.addPath(null, m)");
+  shouldThrow(ctx, "p5.addPath([], m)");
+  shouldThrow(ctx, "p5.addPath({}, m)");
+}
+</script>
+
 <script>
 
 function runTests() {
  try {
   test_drawClipPath_canvas();
  } catch(e) {
+  ok(false, "unexpected exception thrown in: test_drawClipPath_canvas");
   throw e;
-  ok(false, "unexpected exception thrown in: test_drawClipPath_canvas");
  }
  try {
   test_drawFillPath_canvas();
  } catch(e) {
+  ok(false, "unexpected exception thrown in: test_drawFillPath_canvas");
   throw e;
-  ok(false, "unexpected exception thrown in: test_drawFillPath_canvas");
  }
  try {
   test_drawStrokePath_canvas();
  } catch(e) {
+  ok(false, "unexpected exception thrown in: test_drawStrokePath_canvas");
   throw e;
-  ok(false, "unexpected exception thrown in: test_drawStrokePath_canvas");
  }
  try {
   test_large_canvas();
  } catch(e) {
+  ok(false, "unexpected exception thrown in: test_large_canvas");
   throw e;
-  ok(false, "unexpected exception thrown in: test_large_canvas");
  }
  try {
   test_isPointInPath_canvas();
  } catch(e) {
+  ok(false, "unexpected exception thrown in: test_isPointInPath_canvas");
   throw e;
-  ok(false, "unexpected exception thrown in: test_isPointInPath_canvas");
  }
  try {
   test_isPointInStroke_canvas();
  } catch(e) {
+  ok(false, "unexpected exception thrown in: test_isPointInStroke_canvas");
   throw e;
-  ok(false, "unexpected exception thrown in: test_isPointInStroke_canvas");
  }
  try {
   test_pathconstructor_canvas();
  } catch(e) {
+  ok(false, "unexpected exception thrown in: test_pathconstructor_canvas");
   throw e;
-  ok(false, "unexpected exception thrown in: test_pathconstructor_canvas");
+ }
+ try {
+  test_addpath_canvas();
+ } catch(e) {
+  ok(false, "unexpected exception thrown in: test_addpath_canvas");
+  throw e;
  }
  SpecialPowers.setBoolPref("canvas.path.enabled", false);
  SimpleTest.finish();
 }
 
 addLoadEvent(runTests);
 
 // Don't leak the world via the Path2D reference to its window.

--- a/dom/events/EventStateManager.cpp
+++ b/dom/events/EventStateManager.cpp
@@ -1591,18 +1591,18 @@ EventStateManager::GenerateDragGesture(n
       if (!pixelThresholdY)
         pixelThresholdY = 5;
     }
 
     // fire drag gesture if mouse has moved enough
     LayoutDeviceIntPoint pt = aEvent->refPoint +
       LayoutDeviceIntPoint::FromUntyped(aEvent->widget->WidgetToScreenOffset());
     LayoutDeviceIntPoint distance = pt - mGestureDownPoint;
-    if (Abs(distance.x.value) > SafeCast<uint32_t>(pixelThresholdX) ||
-        Abs(distance.y.value) > SafeCast<uint32_t>(pixelThresholdY)) {
+    if (Abs(distance.x.value) > AssertedCast<uint32_t>(pixelThresholdX) ||
+        Abs(distance.y.value) > AssertedCast<uint32_t>(pixelThresholdY)) {
       if (Prefs::ClickHoldContextMenu()) {
         // stop the click-hold before we fire off the drag gesture, in case
         // it takes a long time
         KillClickHoldTimer();
       }
 
       nsCOMPtr<nsISupports> container = aPresContext->GetContainerWeak();
       nsCOMPtr<nsPIDOMWindow> window = do_GetInterface(container);

--- a/dom/webidl/CanvasRenderingContext2D.webidl
+++ b/dom/webidl/CanvasRenderingContext2D.webidl
@@ -318,10 +318,12 @@ interface TextMetrics {
 
 };
 
 [Pref="canvas.path.enabled",
  Constructor,
  Constructor(Path2D other),
  Constructor(DOMString pathString)]
 interface Path2D
-{};
+{
+  void addPath(Path2D path, optional SVGMatrix transformation);
+};
 Path2D implements CanvasPathMethods;

--- a/editor/libeditor/nsEditor.cpp
+++ b/editor/libeditor/nsEditor.cpp
@@ -1684,24 +1684,25 @@ nsEditor::InsertContainerAbove(nsIConten
 ///////////////////////////////////////////////////////////////////////////
 // MoveNode:  move aNode to {aParent,aOffset}
 nsresult
 nsEditor::MoveNode(nsIContent* aNode, nsINode* aParent, int32_t aOffset)
 {
   MOZ_ASSERT(aNode);
   MOZ_ASSERT(aParent);
   MOZ_ASSERT(aOffset == -1 ||
-             (0 <= aOffset && SafeCast<uint32_t>(aOffset) <= aParent->Length()));
+             (0 <= aOffset &&
+              AssertedCast<uint32_t>(aOffset) <= aParent->Length()));
 
   nsCOMPtr<nsINode> oldParent = aNode->GetParentNode();
   int32_t oldOffset = oldParent ? oldParent->IndexOf(aNode) : -1;
 
   if (aOffset == -1) {
     // Magic value meaning "move to end of aParent"
-    aOffset = SafeCast<int32_t>(aParent->Length());
+    aOffset = AssertedCast<int32_t>(aParent->Length());
   }
 
   // Don't do anything if it's already in right place
   if (aParent == oldParent && aOffset == oldOffset) {
     return NS_OK;
   }
 
   // Notify our internal selection state listener
@@ -2865,17 +2866,17 @@ nsEditor::JoinNodesImpl(nsINode* aNodeTo
   }
 
   // delete the extra node
   ErrorResult err;
   aParent->RemoveChild(*aNodeToJoin, err);
 
   if (GetShouldTxnSetSelection()) {
     // editor wants us to set selection at join point
-    selection->Collapse(aNodeToKeep, SafeCast<int32_t>(firstNodeLength));
+    selection->Collapse(aNodeToKeep, AssertedCast<int32_t>(firstNodeLength));
   } else if (selStartNode) {
     // and adjust the selection if needed
     // HACK: this is overly simplified - multi-range selections need more work than this
     bool bNeedToAdjust = false;
 
     // check to see if we joined nodes where selection starts
     if (selStartNode == aNodeToJoin) {
       bNeedToAdjust = true;

--- a/editor/libeditor/nsWSRunObject.cpp
+++ b/editor/libeditor/nsWSRunObject.cpp
@@ -1353,23 +1353,25 @@ nsWSRunObject::DeleteChars(nsINode* aSta
     nsRefPtr<Text> node = mNodeArray[idx];
     if (!node) {
       // We ran out of ws nodes; must have been deleting to end
       return NS_OK;
     }
     if (node == aStartNode) {
       uint32_t len = node->Length();
       if (uint32_t(aStartOffset) < len) {
-        res = mHTMLEditor->DeleteText(*node, SafeCast<uint32_t>(aStartOffset),
+        res = mHTMLEditor->DeleteText(*node,
+                                      AssertedCast<uint32_t>(aStartOffset),
                                       len - aStartOffset);
         NS_ENSURE_SUCCESS(res, res);
       }
     } else if (node == aEndNode) {
       if (aEndOffset) {
-        res = mHTMLEditor->DeleteText(*node, 0, SafeCast<uint32_t>(aEndOffset));
+        res = mHTMLEditor->DeleteText(*node, 0,
+                                      AssertedCast<uint32_t>(aEndOffset));
         NS_ENSURE_SUCCESS(res, res);
       }
       break;
     } else {
       if (!range) {
         range = new nsRange(aStartNode);
         res = range->Set(aStartNode, aStartOffset, aEndNode, aEndOffset);
         NS_ENSURE_SUCCESS(res, res);

--- a/extensions/spellcheck/hunspell/src/mozHunspellAllocator.h
+++ b/extensions/spellcheck/hunspell/src/mozHunspellAllocator.h
@@ -2,15 +2,15 @@
 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef mozHunspellAllocator_h__
 #define mozHunspellAllocator_h__
 
-#include "nsIMemoryReporter.h"
+#include "mozilla/CountingAllocatorBase.h"
 
 class HunspellAllocator : public mozilla::CountingAllocatorBase<HunspellAllocator>
 {
 };
 
 #endif

--- a/gfx/2d/HelpersSkia.h
+++ b/gfx/2d/HelpersSkia.h
@@ -14,51 +14,16 @@
 #include "skia/GrTypes.h"
 #endif
 #include "mozilla/Assertions.h"
 #include <vector>
 
 namespace mozilla {
 namespace gfx {
 
-static inline SkBitmap::Config
-GfxFormatToSkiaConfig(SurfaceFormat format)
-{
-  switch (format)
-  {
-    case SurfaceFormat::B8G8R8A8:
-      return SkBitmap::kARGB_8888_Config;
-    case SurfaceFormat::B8G8R8X8:
-      // We probably need to do something here.
-      return SkBitmap::kARGB_8888_Config;
-    case SurfaceFormat::R5G6B5:
-      return SkBitmap::kRGB_565_Config;
-    case SurfaceFormat::A8:
-      return SkBitmap::kA8_Config;
-    default:
-      return SkBitmap::kARGB_8888_Config;
-  }
-}
-
-static inline SurfaceFormat
-SkiaConfigToGfxFormat(SkBitmap::Config config)
-{
-  switch (config)
-  {
-    case SkBitmap::kARGB_8888_Config:
-      return SurfaceFormat::B8G8R8A8;
-    case SkBitmap::kRGB_565_Config:
-      return SurfaceFormat::R5G6B5;
-    case SkBitmap::kA8_Config:
-      return SurfaceFormat::A8;
-    default:
-      return SurfaceFormat::B8G8R8A8;
-  }
-}
-
 static inline SkColorType
 GfxFormatToSkiaColorType(SurfaceFormat format)
 {
   switch (format)
   {
     case SurfaceFormat::B8G8R8A8:
       return kBGRA_8888_SkColorType;
     case SurfaceFormat::B8G8R8X8:

--- a/gfx/layers/composite/ContainerLayerComposite.cpp
+++ b/gfx/layers/composite/ContainerLayerComposite.cpp
@@ -17,16 +17,17 @@
 #include "mozilla/gfx/Matrix.h"         // for Matrix4x4
 #include "mozilla/gfx/Point.h"          // for Point, IntPoint
 #include "mozilla/gfx/Rect.h"           // for IntRect, Rect
 #include "mozilla/layers/Compositor.h"  // for Compositor, etc
 #include "mozilla/layers/CompositorTypes.h"  // for DiagnosticFlags::CONTAINER
 #include "mozilla/layers/Effects.h"     // for Effect, EffectChain, etc
 #include "mozilla/layers/TextureHost.h"  // for CompositingRenderTarget
 #include "mozilla/layers/AsyncPanZoomController.h"  // for AsyncPanZoomController
+#include "mozilla/layers/AsyncCompositionManager.h" // for ViewTransform
 #include "mozilla/mozalloc.h"           // for operator delete, etc
 #include "nsAutoPtr.h"                  // for nsRefPtr
 #include "nsDebug.h"                    // for NS_ASSERTION
 #include "nsISupportsImpl.h"            // for MOZ_COUNT_CTOR, etc
 #include "nsISupportsUtils.h"           // for NS_ADDREF, NS_RELEASE
 #include "nsPoint.h"                    // for nsIntPoint
 #include "nsRect.h"                     // for nsIntRect
 #include "nsRegion.h"                   // for nsIntRegion
@@ -81,26 +82,16 @@ GetOpaqueRect(Layer* aLayer)
   const nsIntRect* clipRect = aLayer->GetEffectiveClipRect();
   if (clipRect) {
     result.IntersectRect(result, *clipRect);
   }
 
   return result;
 }
 
-static gfx::Point GetScrollData(Layer* aLayer) {
-  gfx::Matrix matrix;
-  if (aLayer->GetLocalTransform().Is2D(&matrix)) {
-    return matrix.GetTranslation();
-  }
-
-  gfx::Point origin;
-  return origin;
-}
-
 static void DrawLayerInfo(const RenderTargetIntRect& aClipRect,
                           LayerManagerComposite* aManager,
                           Layer* aLayer)
 {
 
   if (aLayer->GetType() == Layer::LayerType::TYPE_CONTAINER) {
     // XXX - should figure out a way to render this, but for now this
     // is hard to do, since it will often get superimposed over the first
@@ -114,38 +105,41 @@ static void DrawLayerInfo(const RenderTa
   nsIntRegion visibleRegion = aLayer->GetVisibleRegion();
 
   uint32_t maxWidth = std::min<uint32_t>(visibleRegion.GetBounds().width, 500);
 
   nsIntPoint topLeft = visibleRegion.GetBounds().TopLeft();
   aManager->GetTextRenderer()->RenderText(ss.str().c_str(), gfx::IntPoint(topLeft.x, topLeft.y),
                                           aLayer->GetEffectiveTransform(), 16,
                                           maxWidth);
-
 }
 
 static void PrintUniformityInfo(Layer* aLayer)
 {
   // Don't want to print a log for smaller layers
   if (aLayer->GetEffectiveVisibleRegion().GetBounds().width < 300 ||
       aLayer->GetEffectiveVisibleRegion().GetBounds().height < 300) {
     return;
   }
 
   FrameMetrics frameMetrics = aLayer->GetFrameMetrics();
   if (!frameMetrics.IsScrollable()) {
     return;
   }
 
-  const LayerPoint scrollOffset = frameMetrics.GetScrollOffsetInLayerPixels();
-  const gfx::Point layerTransform = GetScrollData(aLayer);
-  const gfx::Point layerScroll = scrollOffset.ToUnknownPoint() - layerTransform;
-
-  printf_stderr("UniformityInfo Layer_Move %llu %p %f, %f\n",
-    TimeStamp::Now(), aLayer, layerScroll.x, layerScroll.y);
+  AsyncPanZoomController* apzc = aLayer->GetAsyncPanZoomController();
+  if (apzc) {
+    ViewTransform asyncTransform, overscrollTransform;
+    ScreenPoint scrollOffset;
+    apzc->SampleContentTransformForFrame(&asyncTransform,
+                                         scrollOffset,
+                                         &overscrollTransform);
+    printf_stderr("UniformityInfo Layer_Move %llu %p %f, %f\n",
+          TimeStamp::Now(), aLayer, scrollOffset.x.value, scrollOffset.y.value);
+  }
 }
 
 /* all of the per-layer prepared data we need to maintain */
 struct PreparedLayer
 {
   PreparedLayer(LayerComposite *aLayer, RenderTargetIntRect aClipRect, bool aRestoreVisibleRegion, nsIntRegion &aVisibleRegion) :
     mLayer(aLayer), mClipRect(aClipRect), mRestoreVisibleRegion(aRestoreVisibleRegion), mSavedVisibleRegion(aVisibleRegion) {}
   LayerComposite* mLayer;

--- a/gfx/layers/composite/LayerManagerComposite.cpp
+++ b/gfx/layers/composite/LayerManagerComposite.cpp
@@ -406,61 +406,97 @@ LayerManagerComposite::RenderDebugOverla
 
   if (drawFrameColorBars || drawFrameCounter) {
     // We intentionally overflow at 2^16.
     sFrameCount++;
   }
 }
 
 RefPtr<CompositingRenderTarget>
-LayerManagerComposite::PushGroup()
+LayerManagerComposite::PushGroupForLayerEffects()
 {
+  // This is currently true, so just making sure that any new use of this
+  // method is flagged for investigation
+  MOZ_ASSERT(gfxPrefs::LayersEffectInvert() ||
+             gfxPrefs::LayersEffectGrayscale() ||
+             gfxPrefs::LayersEffectContrast() != 0.0);
+
   RefPtr<CompositingRenderTarget> previousTarget = mCompositor->GetCurrentRenderTarget();
   // make our render target the same size as the destination target
   // so that we don't have to change size if the drawing area changes.
   IntRect rect(previousTarget->GetOrigin(), previousTarget->GetSize());
   // XXX: I'm not sure if this is true or not...
   MOZ_ASSERT(rect.x == 0 && rect.y == 0);
   if (!mTwoPassTmpTarget ||
       mTwoPassTmpTarget->GetSize() != previousTarget->GetSize() ||
       mTwoPassTmpTarget->GetOrigin() != previousTarget->GetOrigin()) {
     mTwoPassTmpTarget = mCompositor->CreateRenderTarget(rect, INIT_MODE_NONE);
   }
   mCompositor->SetRenderTarget(mTwoPassTmpTarget);
   return previousTarget;
 }
-void LayerManagerComposite::PopGroup(RefPtr<CompositingRenderTarget> aPreviousTarget, nsIntRect aClipRect)
+void
+LayerManagerComposite::PopGroupForLayerEffects(RefPtr<CompositingRenderTarget> aPreviousTarget,
+                                               nsIntRect aClipRect,
+                                               bool aGrayscaleEffect,
+                                               bool aInvertEffect,
+                                               float aContrastEffect)
 {
+  MOZ_ASSERT(mTwoPassTmpTarget);
+
+  // This is currently true, so just making sure that any new use of this
+  // method is flagged for investigation
+  MOZ_ASSERT(aInvertEffect || aGrayscaleEffect || aContrastEffect != 0.0);
+
   mCompositor->SetRenderTarget(aPreviousTarget);
 
   EffectChain effectChain(RootLayer());
-  Matrix5x4 matrix;
-  if (gfxPrefs::Grayscale()) {
-    matrix._11 = matrix._12 = matrix._13 = 0.2126f;
-    matrix._21 = matrix._22 = matrix._23 = 0.7152f;
-    matrix._31 = matrix._32 = matrix._33 = 0.0722f;
+  Matrix5x4 effectMatrix;
+  if (aGrayscaleEffect) {
+    // R' = G' = B' = luminance
+    // R' = 0.2126*R + 0.7152*G + 0.0722*B
+    // G' = 0.2126*R + 0.7152*G + 0.0722*B
+    // B' = 0.2126*R + 0.7152*G + 0.0722*B
+    Matrix5x4 grayscaleMatrix(0.2126f, 0.2126f, 0.2126f, 0,
+                              0.7152f, 0.7152f, 0.7152f, 0,
+                              0.0722f, 0.0722f, 0.0722f, 0,
+                              0,       0,       0,       1,
+                              0,       0,       0,       0);
+    effectMatrix = grayscaleMatrix;
   }
 
-  if (gfxPrefs::Invert()) {
-    matrix._11 = -matrix._11;
-    matrix._12 = -matrix._12;
-    matrix._13 = -matrix._13;
-    matrix._21 = -matrix._21;
-    matrix._22 = -matrix._22;
-    matrix._23 = -matrix._23;
-    matrix._31 = -matrix._31;
-    matrix._32 = -matrix._32;
-    matrix._33 = -matrix._33;
-    matrix._51 = 1;
-    matrix._52 = 1;
-    matrix._53 = 1;
+  if (aInvertEffect) {
+    // R' = 1 - R
+    // G' = 1 - G
+    // B' = 1 - B
+    Matrix5x4 colorInvertMatrix(-1,  0,  0, 0,
+                                 0, -1,  0, 0,
+                                 0,  0, -1, 0,
+                                 0,  0,  0, 1,
+                                 1,  1,  1, 0);
+    effectMatrix = effectMatrix * colorInvertMatrix;
+  }
+
+  if (aContrastEffect != 0.0) {
+    // Multiplying with:
+    // R' = (1 + c) * (R - 0.5) + 0.5
+    // G' = (1 + c) * (G - 0.5) + 0.5
+    // B' = (1 + c) * (B - 0.5) + 0.5
+    float cP1 = aContrastEffect + 1;
+    float hc = 0.5*aContrastEffect;
+    Matrix5x4 contrastMatrix( cP1,   0,   0, 0,
+                                0, cP1,   0, 0,
+                                0,   0, cP1, 0,
+                                0,   0,   0, 1,
+                              -hc, -hc, -hc, 0);
+    effectMatrix = effectMatrix * contrastMatrix;
   }
 
   effectChain.mPrimaryEffect = new EffectRenderTarget(mTwoPassTmpTarget);
-  effectChain.mSecondaryEffects[EffectTypes::COLOR_MATRIX] = new EffectColorMatrix(matrix);
+  effectChain.mSecondaryEffects[EffectTypes::COLOR_MATRIX] = new EffectColorMatrix(effectMatrix);
 
   gfx::Rect clipRectF(aClipRect.x, aClipRect.y, aClipRect.width, aClipRect.height);
   mCompositor->DrawQuad(Rect(Point(0, 0), Size(mTwoPassTmpTarget->GetSize())), clipRectF, effectChain, 1.,
                         Matrix4x4());
 }
 
 void
 LayerManagerComposite::Render()
@@ -468,18 +504,25 @@ LayerManagerComposite::Render()
   PROFILER_LABEL("LayerManagerComposite", "Render",
     js::ProfileEntry::Category::GRAPHICS);
 
   if (mDestroyed) {
     NS_WARNING("Call on destroyed layer manager");
     return;
   }
 
-  /** Our more efficient but less powerful alter ego, if one is available. */
-  nsRefPtr<Composer2D> composer2D = mCompositor->GetWidget()->GetComposer2D();
+  // At this time, it doesn't really matter if these preferences change
+  // during the execution of the function; we should be safe in all
+  // permutations. However, may as well just get the values onces and
+  // then use them, just in case the consistency becomes important in
+  // the future.
+  bool invertVal = gfxPrefs::LayersEffectInvert();
+  bool grayscaleVal = gfxPrefs::LayersEffectGrayscale();
+  float contrastVal = gfxPrefs::LayersEffectContrast();
+  bool haveLayerEffects = (invertVal || grayscaleVal || contrastVal != 0.0);
 
   // Set LayerScope begin/end frame
   LayerScopeAutoFrame frame(PR_Now());
 
   // Dump to console
   if (gfxPrefs::LayersDump()) {
     this->Dump();
   }
@@ -489,18 +532,23 @@ LayerManagerComposite::Render()
     // Create a LayersPacket, dump Layers into it and transfer the
     // packet('s ownership) to LayerScope.
     auto packet = MakeUnique<layerscope::Packet>();
     layerscope::LayersPacket* layersPacket = packet->mutable_layers();
     this->Dump(layersPacket);
     LayerScope::SendLayerDump(Move(packet));
   }
 
-  if (gfxPrefs::Invert() || gfxPrefs::Grayscale()) {
-    composer2D = nullptr;
+  /** Our more efficient but less powerful alter ego, if one is available. */
+  nsRefPtr<Composer2D> composer2D;
+
+  // We can't use composert2D if we have layer effects, so only get it
+  // when we don't have any effects.
+  if (!haveLayerEffects) {
+    composer2D = mCompositor->GetWidget()->GetComposer2D();
   }
 
   if (!mTarget && composer2D && composer2D->TryRender(mRoot, mWorldMatrix, mGeometryChanged)) {
     if (mFPS) {
       double fps = mFPS->mCompositionFps.AddFrameAndGetFps(TimeStamp::Now());
       if (gfxPrefs::LayersDrawFPS()) {
         printf_stderr("HWComposer: FPS is %g\n", fps);
       }
@@ -553,18 +601,18 @@ LayerManagerComposite::Render()
 
   // Allow widget to render a custom background.
   mCompositor->GetWidget()->DrawWindowUnderlay(this, nsIntRect(actualBounds.x,
                                                                actualBounds.y,
                                                                actualBounds.width,
                                                                actualBounds.height));
 
   RefPtr<CompositingRenderTarget> previousTarget;
-  if (gfxPrefs::Invert() || gfxPrefs::Grayscale()) {
-    previousTarget = PushGroup();
+  if (haveLayerEffects) {
+    previousTarget = PushGroupForLayerEffects();
   } else {
     mTwoPassTmpTarget = nullptr;
   }
 
   // Render our layers.
   RootLayer()->Prepare(RenderTargetPixel::FromUntyped(clipRect));
   RootLayer()->RenderLayer(clipRect);
 
@@ -572,17 +620,19 @@ LayerManagerComposite::Render()
     nsIntRegionRectIterator iter(mRegionToClear);
     const nsIntRect *r;
     while ((r = iter.Next())) {
       mCompositor->ClearRect(Rect(r->x, r->y, r->width, r->height));
     }
   }
 
   if (mTwoPassTmpTarget) {
-    PopGroup(previousTarget, clipRect);
+    MOZ_ASSERT(haveLayerEffects);
+    PopGroupForLayerEffects(previousTarget, clipRect,
+                            grayscaleVal, invertVal, contrastVal);
   }
 
   // Allow widget to render a custom foreground.
   mCompositor->GetWidget()->DrawWindowOverlay(this, nsIntRect(actualBounds.x,
                                                               actualBounds.y,
                                                               actualBounds.width,
                                                               actualBounds.height));
 

--- a/gfx/layers/composite/LayerManagerComposite.h
+++ b/gfx/layers/composite/LayerManagerComposite.h
@@ -264,18 +264,22 @@ private:
 
   /**
    * Render debug overlays such as the FPS/FrameCounter above the frame.
    */
   void RenderDebugOverlay(const gfx::Rect& aBounds);
 
   void WorldTransformRect(nsIntRect& aRect);
 
-  RefPtr<CompositingRenderTarget> PushGroup();
-  void PopGroup(RefPtr<CompositingRenderTarget> aPreviousTarget, nsIntRect aClipRect);
+  RefPtr<CompositingRenderTarget> PushGroupForLayerEffects();
+  void PopGroupForLayerEffects(RefPtr<CompositingRenderTarget> aPreviousTarget,
+                               nsIntRect aClipRect,
+                               bool aGrayscaleEffect,
+                               bool aInvertEffect,
+                               float aContrastEffect);
 
   RefPtr<Compositor> mCompositor;
   nsAutoPtr<LayerProperties> mClonedLayerTreeProperties;
 
   /**
    * Context target, nullptr when drawing directly to our swap chain.
    */
   RefPtr<gfx::DrawTarget> mTarget;

--- a/gfx/skia/trunk/include/config/SkUserConfig.h
+++ b/gfx/skia/trunk/include/config/SkUserConfig.h
@@ -201,12 +201,11 @@
 #else
 #  define SK_BARRIERS_PLATFORM_H "skia/SkBarriers_x86.h"
 #endif
 
 #define SK_ALLOW_STATIC_GLOBAL_INITIALIZERS 0
 
 #define SK_SUPPORT_LEGACY_GETDEVICE
 #define SK_SUPPORT_LEGACY_GETTOPDEVICE
-#define SK_SUPPORT_LEGACY_BITMAP_CONFIG
 #define SK_IGNORE_ETC1_SUPPORT
 
 #endif

--- a/gfx/thebes/gfxAndroidPlatform.cpp
+++ b/gfx/thebes/gfxAndroidPlatform.cpp
@@ -3,16 +3,17 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "base/basictypes.h"
 
 #include "gfxAndroidPlatform.h"
 #include "mozilla/gfx/2D.h"
+#include "mozilla/CountingAllocatorBase.h"
 #include "mozilla/Preferences.h"
 
 #include "gfx2DGlue.h"
 #include "gfxFT2FontList.h"
 #include "gfxImageSurface.h"
 #include "mozilla/dom/ContentChild.h"
 #include "nsXULAppAPI.h"
 #include "nsIScreen.h"

--- a/gfx/thebes/gfxPrefs.h
+++ b/gfx/thebes/gfxPrefs.h
@@ -217,16 +217,23 @@ private:
   DECL_GFX_PREF(Once, "layers.componentalpha.enabled",         ComponentAlphaEnabled, bool, true);
 #endif
   DECL_GFX_PREF(Live, "layers.draw-bigimage-borders",          DrawBigImageBorders, bool, false);
   DECL_GFX_PREF(Live, "layers.draw-borders",                   DrawLayerBorders, bool, false);
   DECL_GFX_PREF(Live, "layers.draw-tile-borders",              DrawTileBorders, bool, false);
   DECL_GFX_PREF(Live, "layers.flash-borders",                  FlashLayerBorders, bool, false);
   DECL_GFX_PREF(Live, "layers.draw-layer-info",                DrawLayerInfo, bool, false);
   DECL_GFX_PREF(Live, "layers.dump",                           LayersDump, bool, false);
+
+  // 0 is "no change" for contrast, positive values increase it, negative values
+  // decrease it until we hit mid gray at -1 contrast, after that it gets weird.
+  DECL_GFX_PREF(Live, "layers.effect.contrast",                LayersEffectContrast, float, 0.0f);
+  DECL_GFX_PREF(Live, "layers.effect.grayscale",               LayersEffectGrayscale, bool, false);
+  DECL_GFX_PREF(Live, "layers.effect.invert",                  LayersEffectInvert, bool, false);
+
   DECL_GFX_PREF(Once, "layers.enable-tiles",                   LayersTilesEnabled, bool, false);
   DECL_GFX_PREF(Once, "layers.simple-tiles",                   LayersUseSimpleTiles, bool, false);
   DECL_GFX_PREF(Once, "layers.force-per-tile-drawing",         PerTileDrawing, bool, false);
   DECL_GFX_PREF(Once, "layers.tiled-drawtarget.enabled",       TiledDrawTargetEnabled, bool, false);
   // We allow for configurable and rectangular tile size to avoid wasting memory on devices whose
   // screen size does not align nicely to the default tile size. Although layers can be any size,
   // they are often the same size as the screen, especially for width.
   DECL_GFX_PREF(Once, "layers.tile-width",                     LayersTileWidth, int32_t, 256);
@@ -244,18 +251,16 @@ private:
   DECL_GFX_PREF(Once, "layers.offmainthreadcomposition.force-enabled", LayersOffMainThreadCompositionForceEnabled, bool, false);
   DECL_GFX_PREF(Once, "layers.offmainthreadcomposition.testing.enabled", LayersOffMainThreadCompositionTestingEnabled, bool, false);
   DECL_GFX_PREF(Once, "layers.use-image-offscreen-surfaces",   UseImageOffscreenSurfaces, bool, false);
   DECL_GFX_PREF(Live, "layers.orientation.sync.timeout",       OrientationSyncMillis, uint32_t, (uint32_t)0);
   DECL_GFX_PREF(Once, "layers.prefer-d3d9",                    LayersPreferD3D9, bool, false);
   DECL_GFX_PREF(Once, "layers.prefer-opengl",                  LayersPreferOpenGL, bool, false);
   DECL_GFX_PREF(Once, "layers.progressive-paint",              UseProgressiveTilePainting, bool, false);
   DECL_GFX_PREF(Once, "layers.uniformity-info",                UniformityInfo, bool, false);
-  DECL_GFX_PREF(Live, "layers.invert",                         Invert, bool, false);
-  DECL_GFX_PREF(Live, "layers.grayscale",                      Grayscale, bool, false);
 
   DECL_GFX_PREF(Live, "layout.css.scroll-behavior.damping-ratio", ScrollBehaviorDampingRatio, float, 1.0f);
   DECL_GFX_PREF(Live, "layout.css.scroll-behavior.enabled",    ScrollBehaviorEnabled, bool, false);
   DECL_GFX_PREF(Live, "layout.css.scroll-behavior.spring-constant", ScrollBehaviorSpringConstant, float, 250.0f);
   DECL_GFX_PREF(Once, "layout.css.touch_action.enabled",       TouchActionEnabled, bool, false);
   DECL_GFX_PREF(Once, "layout.frame_rate",                     LayoutFrameRate, int32_t, -1);
   DECL_GFX_PREF(Live, "layout.display-list.dump",              LayoutDumpDisplayList, bool, false);
   DECL_GFX_PREF(Once, "layout.paint_rects_separately",         LayoutPaintRectsSeparately, bool, true);

--- a/js/src/asmjs/AsmJSValidate.cpp
+++ b/js/src/asmjs/AsmJSValidate.cpp
@@ -5960,19 +5960,21 @@ GenerateEntry(ModuleCompiler &m, unsigne
 
     // In constrast to the system ABI, the Ion convention is that all registers
     // are clobbered by calls. Thus, we must save the caller's non-volatile
     // registers.
     masm.PushRegsInMask(NonVolatileRegs);
     JS_ASSERT(masm.framePushed() == FramePushedAfterSave);
 
     // ARM and MIPS have a globally-pinned GlobalReg (x64 uses RIP-relative
-    // addressing, x86 uses immediates in effective addresses).
+    // addressing, x86 uses immediates in effective addresses). For the
+    // AsmJSGlobalRegBias addition, see Assembler-(mips,arm).h.
 #if defined(JS_CODEGEN_ARM) || defined(JS_CODEGEN_MIPS)
     masm.movePtr(IntArgReg1, GlobalReg);
+    masm.addPtr(Imm32(AsmJSGlobalRegBias), GlobalReg);
 #endif
 
     // ARM, MIPS and x64 have a globally-pinned HeapReg (x86 uses immediates in
     // effective addresses).
 #if defined(JS_CODEGEN_X64) || defined(JS_CODEGEN_ARM) || defined(JS_CODEGEN_MIPS)
     masm.loadPtr(Address(IntArgReg1, AsmJSModule::heapGlobalDataOffset()), HeapReg);
 #endif
 
@@ -6249,17 +6251,17 @@ GenerateFFIIonExit(ModuleCompiler &m, co
 
     // 2.1. Get ExitDatum
     unsigned globalDataOffset = m.module().exitIndexToGlobalDataOffset(exitIndex);
 #if defined(JS_CODEGEN_X64)
     m.masm().append(AsmJSGlobalAccess(masm.leaRipRelative(callee), globalDataOffset));
 #elif defined(JS_CODEGEN_X86)
     m.masm().append(AsmJSGlobalAccess(masm.movlWithPatch(Imm32(0), callee), globalDataOffset));
 #else
-    masm.computeEffectiveAddress(Address(GlobalReg, globalDataOffset), callee);
+    masm.computeEffectiveAddress(Address(GlobalReg, globalDataOffset - AsmJSGlobalRegBias), callee);
 #endif
 
     // 2.2. Get callee
     masm.loadPtr(Address(callee, offsetof(AsmJSModule::ExitDatum, fun)), callee);
 
     // 2.3. Save callee
     masm.storePtr(callee, Address(StackPointer, argOffset));
     argOffset += sizeof(size_t);

--- a/js/src/builtin/TypedObject.cpp
+++ b/js/src/builtin/TypedObject.cpp
@@ -22,19 +22,19 @@
 #include "vm/StringBuffer.h"
 #include "vm/TypedArrayObject.h"
 
 #include "jsatominlines.h"
 #include "jsobjinlines.h"
 
 #include "vm/Shape-inl.h"
 
+using mozilla::AssertedCast;
 using mozilla::CheckedInt32;
 using mozilla::DebugOnly;
-using mozilla::SafeCast;
 
 using namespace js;
 
 const Class js::TypedObjectModuleObject::class_ = {
     "TypedObject",
     JSCLASS_HAS_RESERVED_SLOTS(SlotCount) |
     JSCLASS_HAS_CACHED_PROTO(JSProto_TypedObject),
     JS_PropertyStub,         /* addProperty */
@@ -1157,26 +1157,26 @@ StructTypeDescr::fieldName(size_t index)
 }
 
 size_t
 StructTypeDescr::fieldOffset(size_t index) const
 {
     JSObject &fieldOffsets =
         getReservedSlot(JS_DESCR_SLOT_STRUCT_FIELD_OFFSETS).toObject();
     JS_ASSERT(index < fieldOffsets.getDenseInitializedLength());
-    return SafeCast<size_t>(fieldOffsets.getDenseElement(index).toInt32());
+    return AssertedCast<size_t>(fieldOffsets.getDenseElement(index).toInt32());
 }
 
 size_t
 StructTypeDescr::maybeForwardedFieldOffset(size_t index) const
 {
     JSObject &fieldOffsets =
         *MaybeForwarded(&getReservedSlot(JS_DESCR_SLOT_STRUCT_FIELD_OFFSETS).toObject());
     JS_ASSERT(index < fieldOffsets.getDenseInitializedLength());
-    return SafeCast<size_t>(fieldOffsets.getDenseElement(index).toInt32());
+    return AssertedCast<size_t>(fieldOffsets.getDenseElement(index).toInt32());
 }
 
 SizedTypeDescr&
 StructTypeDescr::fieldDescr(size_t index) const
 {
     JSObject &fieldDescrs =
         getReservedSlot(JS_DESCR_SLOT_STRUCT_FIELD_TYPES).toObject();
     JS_ASSERT(index < fieldDescrs.getDenseInitializedLength());

--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -140,16 +140,19 @@ IonContext::~IonContext()
 }
 
 bool
 jit::InitializeIon()
 {
     if (!TlsIonContext.initialized() && !TlsIonContext.init())
         return false;
     CheckLogging();
+#if defined(JS_CODEGEN_ARM)
+    InitARMFlags();
+#endif
     CheckPerf();
     return true;
 }
 
 JitRuntime::JitRuntime()
   : execAlloc_(nullptr),
     ionAlloc_(nullptr),
     exceptionTail_(nullptr),

--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -28,19 +28,19 @@
 #include "jsscriptinlines.h"
 
 #include "jit/CompileInfo-inl.h"
 #include "jit/ExecutionMode-inl.h"
 
 using namespace js;
 using namespace js::jit;
 
+using mozilla::AssertedCast;
 using mozilla::DebugOnly;
 using mozilla::Maybe;
-using mozilla::SafeCast;
 
 class jit::BaselineFrameInspector
 {
   public:
     types::Type thisType;
     JSObject *singletonScopeChain;
 
     Vector<types::Type, 4, IonAllocPolicy> argTypes;
@@ -7547,17 +7547,17 @@ IonBuilder::addTypedArrayLengthAndData(M
             // The 'data' pointer can change in rare circumstances
             // (ArrayBufferObject::changeContents).
             types::TypeObjectKey *tarrType = types::TypeObjectKey::get(tarr);
             if (!tarrType->unknownProperties()) {
                 tarrType->watchStateChangeForTypedArrayData(constraints());
 
                 obj->setImplicitlyUsedUnchecked();
 
-                int32_t len = SafeCast<int32_t>(tarr->length());
+                int32_t len = AssertedCast<int32_t>(tarr->length());
                 *length = MConstant::New(alloc(), Int32Value(len));
                 current->add(*length);
 
                 if (index) {
                     if (checking == DoBoundsCheck)
                         *index = addBoundsCheck(*index, *length);
 
                     *elements = MConstantElements::New(alloc(), data);

--- a/js/src/jit/arm/Architecture-arm.cpp
+++ b/js/src/jit/arm/Architecture-arm.cpp
@@ -11,18 +11,18 @@
 #endif
 
 #include <fcntl.h>
 #include <unistd.h>
 
 #include "jit/arm/Assembler-arm.h"
 #include "jit/RegisterSets.h"
 
-#if defined(ANDROID) || defined(MOZ_B2G) || defined(JS_ARM_SIMULATOR)
-// The Android NDK does not include the hwcap.h kernel header, and it is not
+#if defined(ANDROID) || defined(JS_ARM_SIMULATOR)
+// The Android NDK and B2G do not include the hwcap.h kernel header, and it is not
 // defined when building the simulator, so inline the header defines we need.
 # define HWCAP_VFP        (1 << 6)
 # define HWCAP_NEON       (1 << 12)
 # define HWCAP_VFPv3      (1 << 13)
 # define HWCAP_VFPv3D16   (1 << 14) /* also set for VFPv4-D16 */
 # define HWCAP_VFPv4      (1 << 16)
 # define HWCAP_IDIVA      (1 << 17)
 # define HWCAP_IDIVT      (1 << 18)
@@ -33,30 +33,37 @@
 # if !defined(HWCAP_IDIVA)
 #  define HWCAP_IDIVA     (1 << 17)
 # endif
 # if !defined(HWCAP_VFPD32)
 #  define HWCAP_VFPD32    (1 << 19) /* set if VFP has 32 regs (not 16) */
 # endif
 #endif
 
-// Not part of the HWCAP flag, but we need to know this, and this bit is not
-// used so we are using it.
+// Not part of the HWCAP flag, but we need to know these and these bits are not used.
+
+// A bit to flag the use of the ARMv7 arch, otherwise ARMv6.
 #define HWCAP_ARMv7 (1 << 28)
 
-// Also take a bit to flag the use of the hardfp ABI.
+// A bit to flag the use of the hardfp ABI.
 #define HWCAP_USE_HARDFP_ABI (1 << 27)
 
+// A bit to flag when alignment faults are enabled and signal.
+#define HWCAP_ALIGNMENT_FAULT (1 << 26)
+
+// A bit to flag when the flags are uninitialized, so they can be atomically set.
+#define HWCAP_UNINITIALIZED (1 << 25)
+
 namespace js {
 namespace jit {
 
 
 // Parse the Linux kernel cpuinfo features. This is also used to parse the
-// override features which has some extensions: 'armv7' and 'hardfp'.
-uint32_t
+// override features which has some extensions: 'armv7', 'align' and 'hardfp'.
+static uint32_t
 ParseARMCpuFeatures(const char *features, bool override = false)
 {
     uint32_t flags = 0;
 
     for (;;) {
         char  ch = *features;
         if (!ch) {
             // End of string.
@@ -88,107 +95,138 @@ ParseARMCpuFeatures(const char *features
         else if (count == 5 && strncmp(features, "idiva", 5) == 0)
             flags |= HWCAP_IDIVA;
         else if (count == 5 && strncmp(features, "idivt", 5) == 0)
             flags |= HWCAP_IDIVT;
         else if (count == 6 && strncmp(features, "vfpd32", 6) == 0)
             flags |= HWCAP_VFPD32;
         else if (count == 5 && strncmp(features, "armv7", 5) == 0)
             flags |= HWCAP_ARMv7;
+        else if (count == 5 && strncmp(features, "align", 5) == 0)
+            flags |= HWCAP_ALIGNMENT_FAULT;
 #if defined(JS_ARM_SIMULATOR)
         else if (count == 6 && strncmp(features, "hardfp", 6) == 0)
             flags |= HWCAP_USE_HARDFP_ABI;
 #endif
         else if (override)
             fprintf(stderr, "Warning: unexpected ARM feature at: %s\n", features);
         features = end;
     }
-    IonSpew(IonSpew_Codegen, "ARM features: '%s'\n   flags: 0x%x\n", features, flags);
+    return flags;
+}
+
+static uint32_t
+CanonicalizeARMHwCapFlags(uint32_t flags)
+{
+    // Canonicalize the flags. These rules are also applied to the features
+    // supplied for simulation.
+
+    // The VFPv3 feature is expected when the VFPv3D16 is reported, but add it
+    // just in case of a kernel difference in feature reporting.
+    if (flags & HWCAP_VFPv3D16)
+        flags |= HWCAP_VFPv3;
+
+    // If VFPv3 or Neon is supported then this must be an ARMv7.
+    if (flags & (HWCAP_VFPv3 | HWCAP_NEON))
+        flags |= HWCAP_ARMv7;
+
+    // Some old kernels report VFP and not VFPv3, but if ARMv7 then it must be
+    // VFPv3.
+    if (flags & HWCAP_VFP && flags & HWCAP_ARMv7)
+        flags |= HWCAP_VFPv3;
+
+    // Older kernels do not implement the HWCAP_VFPD32 flag.
+    if ((flags & HWCAP_VFPv3) && !(flags & HWCAP_VFPv3D16))
+        flags |= HWCAP_VFPD32;
+
     return flags;
 }
 
 // The override flags parsed from the ARMHWCAP environment variable or from the
 // --arm-hwcap js shell argument.
-volatile static uint32_t armHwCapFlags = 0;
+volatile static uint32_t armHwCapFlags = HWCAP_UNINITIALIZED;
 
 bool
 ParseARMHwCapFlags(const char *armHwCap)
 {
     uint32_t flags = 0;
 
-    if (!armHwCap || !armHwCap[0])
+    if (!armHwCap)
         return false;
 
-#ifdef JS_CODEGEN_ARM_HARDFP
-    flags |= HWCAP_USE_HARDFP_ABI;
-#endif
-
     if (strstr(armHwCap, "help")) {
         fflush(NULL);
         printf(
                "\n"
                "usage: ARMHWCAP=option,option,option,... where options can be:\n"
                "\n"
-               "  armv7    \n"
                "  vfp      \n"
                "  neon     \n"
                "  vfpv3    \n"
                "  vfpv3d16 \n"
                "  vfpv4    \n"
                "  idiva    \n"
                "  idivt    \n"
                "  vfpd32   \n"
+               "  armv7    \n"
+               "  align    \n"
 #if defined(JS_ARM_SIMULATOR)
                "  hardfp   \n"
 #endif
                "\n"
                );
         exit(0);
         /*NOTREACHED*/
     }
 
-    armHwCapFlags = ParseARMCpuFeatures(armHwCap, /* override = */ true);
+    flags = ParseARMCpuFeatures(armHwCap, /* override = */ true);
+
+#ifdef JS_CODEGEN_ARM_HARDFP
+    flags |= HWCAP_USE_HARDFP_ABI;
+#endif
+
+    armHwCapFlags = CanonicalizeARMHwCapFlags(flags);
+    IonSpew(IonSpew_Codegen, "ARM HWCAP: 0x%x\n", armHwCapFlags);
     return true;
 }
 
-uint32_t GetARMFlags()
+void
+InitARMFlags()
 {
-    volatile static bool isSet = false;
-    volatile static uint32_t flags = 0;
-    if (isSet)
-        return flags;
+    uint32_t flags = 0;
+
+    if (armHwCapFlags != HWCAP_UNINITIALIZED)
+        return;
 
     const char *env = getenv("ARMHWCAP");
-    if (ParseARMHwCapFlags(env) || armHwCapFlags) {
-        flags = armHwCapFlags;
-        isSet = true;
-        return flags;
-    }
+    if (ParseARMHwCapFlags(env))
+        return;
 
 #ifdef JS_ARM_SIMULATOR
     flags = HWCAP_ARMv7 | HWCAP_VFP | HWCAP_VFPv3 | HWCAP_VFPv4 | HWCAP_NEON;
 #else
 
-#if defined(__linux__) || defined(ANDROID) || defined(MOZ_B2G)
+#if defined(__linux__)
+    // This includes Android and B2G.
     bool readAuxv = false;
     int fd = open("/proc/self/auxv", O_RDONLY);
     if (fd > 0) {
         struct { uint32_t a_type; uint32_t a_val; } aux;
         while (read(fd, &aux, sizeof(aux))) {
             if (aux.a_type == AT_HWCAP) {
                 flags = aux.a_val;
                 readAuxv = true;
                 break;
             }
         }
         close(fd);
     }
 
     if (!readAuxv) {
-        // Read the Features if the auxv is not available.
+        // Read the cpuinfo Features if the auxv is not available.
         FILE *fp = fopen("/proc/cpuinfo", "r");
         if (fp) {
             char buf[1024];
             memset(buf, 0, sizeof(buf));
             size_t len = fread(buf, sizeof(char), sizeof(buf) - 1, fp);
             fclose(fp);
             buf[len] = '\0';
             char *featureList = strstr(buf, "Features");
@@ -218,70 +256,73 @@ uint32_t GetARMFlags()
 
 #if defined(__ARM_ARCH_7__) || defined (__ARM_ARCH_7A__)
     // Compiled to use ARMv7 instructions so assume the ARMv7 arch.
     flags |= HWCAP_ARMv7;
 #endif
 
 #endif // JS_ARM_SIMULATOR
 
-    // Canonicalize the flags. These rules are also applied to the features
-    // supplied for simulation.
+    armHwCapFlags = CanonicalizeARMHwCapFlags(flags);
 
-    // The VFPv3 feature is expected when the VFPv3D16 is reported, but add it
-    // just in case of a kernel difference in feature reporting.
-    if (flags & HWCAP_VFPv3D16)
-        flags |= HWCAP_VFPv3;
-
-    // If VFPv3 or Neon is supported then this must be an ARMv7.
-    if (flags & (HWCAP_VFPv3 | HWCAP_NEON))
-        flags |= HWCAP_ARMv7;
+    IonSpew(IonSpew_Codegen, "ARM HWCAP: 0x%x\n", armHwCapFlags);
+    return;
+}
 
-    // Some old kernels report VFP and not VFPv3, but if ARMv7 then it must be
-    // VFPv3.
-    if (flags & HWCAP_VFP && flags & HWCAP_ARMv7)
-        flags |= HWCAP_VFPv3;
-
-    // Older kernels do not implement the HWCAP_VFPD32 flag.
-    if ((flags & HWCAP_VFPv3) && !(flags & HWCAP_VFPv3D16))
-        flags |= HWCAP_VFPD32;
-
-    IonSpew(IonSpew_Codegen, "ARM HWCAP: 0x%x\n", flags);
-    isSet = true;
-    return flags;
+uint32_t
+GetARMFlags()
+{
+    MOZ_ASSERT(armHwCapFlags != HWCAP_UNINITIALIZED);
+    return armHwCapFlags;
 }
 
 bool HasMOVWT()
 {
-    return GetARMFlags() & HWCAP_ARMv7;
+    MOZ_ASSERT(armHwCapFlags != HWCAP_UNINITIALIZED);
+    return armHwCapFlags & HWCAP_ARMv7;
 }
+
 bool HasVFPv3()
 {
-    return GetARMFlags() & HWCAP_VFPv3;
+    MOZ_ASSERT(armHwCapFlags != HWCAP_UNINITIALIZED);
+    return armHwCapFlags & HWCAP_VFPv3;
 }
+
 bool HasVFP()
 {
-    return GetARMFlags() & HWCAP_VFP;
+    MOZ_ASSERT(armHwCapFlags != HWCAP_UNINITIALIZED);
+    return armHwCapFlags & HWCAP_VFP;
 }
 
 bool Has32DP()
 {
-    return GetARMFlags() & HWCAP_VFPD32;
+    MOZ_ASSERT(armHwCapFlags != HWCAP_UNINITIALIZED);
+    return armHwCapFlags & HWCAP_VFPD32;
 }
 
 bool HasIDIV()
 {
-    return GetARMFlags() & HWCAP_IDIVA;
+    MOZ_ASSERT(armHwCapFlags != HWCAP_UNINITIALIZED);
+    return armHwCapFlags & HWCAP_IDIVA;
+}
+
+// Returns true when cpu alignment faults are enabled and signaled, and thus we
+// should ensure loads and stores are aligned.
+bool HasAlignmentFault()
+{
+    MOZ_ASSERT(armHwCapFlags != HWCAP_UNINITIALIZED);
+    return armHwCapFlags & HWCAP_ALIGNMENT_FAULT;
 }
 
 // This is defined in the header and inlined when not using the simulator.
 #if defined(JS_ARM_SIMULATOR)
 bool UseHardFpABI()
 {
-    return GetARMFlags() & HWCAP_USE_HARDFP_ABI;
+    MOZ_ASSERT(armHwCapFlags != HWCAP_UNINITIALIZED);
+    return armHwCapFlags & HWCAP_USE_HARDFP_ABI;
 }
 #endif
 
 Registers::Code
 Registers::FromName(const char *name)
 {
     // Check for some register aliases first.
     if (strcmp(name, "ip") == 0)

--- a/js/src/jit/arm/Architecture-arm.h
+++ b/js/src/jit/arm/Architecture-arm.h
@@ -9,18 +9,18 @@
 
 #include "mozilla/MathAlgorithms.h"
 
 #include <limits.h>
 #include <stdint.h>
 
 #include "js/Utility.h"
 
-// Gcc appears to use __ARM_PCS_VFP to denote that the target is a hard-float
-// target.
+// GCC versions 4.6 and above define __ARM_PCS_VFP to denote a hard-float
+// ABI target.
 #if defined(__ARM_PCS_VFP)
 #define JS_CODEGEN_ARM_HARDFP
 #endif
 
 namespace js {
 namespace jit {
 
 // In bytes: slots needed for potential memory->memory move spills.
@@ -514,16 +514,17 @@ class VFPRegister
 typedef VFPRegister FloatRegister;
 
 uint32_t GetARMFlags();
 bool HasMOVWT();
 bool HasVFPv3();
 bool HasVFP();
 bool Has32DP();
 bool HasIDIV();
+bool HasAlignmentFault();
 
 // Arm/D32 has double registers that can NOT be treated as float32 and this
 // requires some dances in lowering.
 inline bool
 hasUnaliasedDouble()
 {
     return Has32DP();
 }
@@ -532,16 +533,18 @@ hasUnaliasedDouble()
 // a double as a temporary, you need a temporary double register.
 inline bool
 hasMultiAlias()
 {
     return true;
 }
 
 bool ParseARMHwCapFlags(const char *armHwCap);
+void InitARMFlags();
+uint32_t GetARMFlags();
 
 // If the simulator is used then the ABI choice is dynamic. Otherwise the ABI is
 // static and useHardFpABI is inlined so that unused branches can be optimized
 // away.
 #if defined(JS_ARM_SIMULATOR)
 bool UseHardFpABI();
 #else
 static inline bool UseHardFpABI()

--- a/js/src/jit/arm/Assembler-arm.h
+++ b/js/src/jit/arm/Assembler-arm.h
@@ -97,16 +97,21 @@ static MOZ_CONSTEXPR_VAR FloatRegister R
 static MOZ_CONSTEXPR_VAR FloatRegister ReturnDoubleReg = { FloatRegisters::d0, VFPRegister::Double};
 static MOZ_CONSTEXPR_VAR FloatRegister ReturnSimdReg = InvalidFloatReg;
 static MOZ_CONSTEXPR_VAR FloatRegister ScratchFloat32Reg = { FloatRegisters::d30, VFPRegister::Single };
 static MOZ_CONSTEXPR_VAR FloatRegister ScratchDoubleReg = { FloatRegisters::d15, VFPRegister::Double };
 static MOZ_CONSTEXPR_VAR FloatRegister ScratchSimdReg = InvalidFloatReg;
 static MOZ_CONSTEXPR_VAR FloatRegister ScratchUIntReg = { FloatRegisters::d15, VFPRegister::UInt };
 static MOZ_CONSTEXPR_VAR FloatRegister ScratchIntReg = { FloatRegisters::d15, VFPRegister::Int };
 
+// A bias applied to the GlobalReg to allow the use of instructions with small
+// negative immediate offsets which doubles the range of global data that can be
+// accessed with a single instruction.
+static const int32_t AsmJSGlobalRegBias = 1024;
+
 // Registers used in the GenerateFFIIonExit Enable Activation block.
 static MOZ_CONSTEXPR_VAR Register AsmJSIonExitRegCallee = r4;
 static MOZ_CONSTEXPR_VAR Register AsmJSIonExitRegE0 = r0;
 static MOZ_CONSTEXPR_VAR Register AsmJSIonExitRegE1 = r1;
 static MOZ_CONSTEXPR_VAR Register AsmJSIonExitRegE2 = r2;
 static MOZ_CONSTEXPR_VAR Register AsmJSIonExitRegE3 = r3;
 
 // Registers used in the GenerateFFIIonExit Disable Activation block.

--- a/js/src/jit/arm/CodeGenerator-arm.cpp
+++ b/js/src/jit/arm/CodeGenerator-arm.cpp
@@ -1758,27 +1758,16 @@ CodeGeneratorARM::generateInvalidateEpil
 
 void
 DispatchIonCache::initializeAddCacheState(LInstruction *ins, AddCacheState *addState)
 {
     // Can always use the scratch register on ARM.
     addState->dispatchScratch = ScratchRegister;
 }
 
-template <class U>
-Register
-getBase(U *mir)
-{
-    switch (mir->base()) {
-      case U::Heap: return HeapReg;
-      case U::Global: return GlobalReg;
-    }
-    return InvalidReg;
-}
-
 bool
 CodeGeneratorARM::visitLoadTypedArrayElementStatic(LLoadTypedArrayElementStatic *ins)
 {
     MOZ_ASSUME_UNREACHABLE("NYI");
 }
 
 bool
 CodeGeneratorARM::visitStoreTypedArrayElementStatic(LStoreTypedArrayElementStatic *ins)
@@ -1840,20 +1829,22 @@ CodeGeneratorARM::visitAsmJSLoadHeap(LAs
         return true;
     }
 
     BufferOffset bo = masm.ma_BoundsCheck(ptrReg);
     if (isFloat) {
         FloatRegister dst = ToFloatRegister(ins->output());
         VFPRegister vd(dst);
         if (size == 32) {
-            masm.ma_vldr(Operand(GlobalReg, AsmJSNaN32GlobalDataOffset), vd.singleOverlay(), Assembler::AboveOrEqual);
+            masm.ma_vldr(Operand(GlobalReg, AsmJSNaN32GlobalDataOffset - AsmJSGlobalRegBias),
+                         vd.singleOverlay(), Assembler::AboveOrEqual);
             masm.ma_vldr(vd.singleOverlay(), HeapReg, ptrReg, 0, Assembler::Below);
         } else {
-            masm.ma_vldr(Operand(GlobalReg, AsmJSNaN64GlobalDataOffset), vd, Assembler::AboveOrEqual);
+            masm.ma_vldr(Operand(GlobalReg, AsmJSNaN64GlobalDataOffset - AsmJSGlobalRegBias),
+                         vd, Assembler::AboveOrEqual);
             masm.ma_vldr(vd, HeapReg, ptrReg, 0, Assembler::Below);
         }
     } else {
         Register d = ToRegister(ins->output());
         masm.ma_mov(Imm32(0), d, NoSetCond, Assembler::AboveOrEqual);
         masm.ma_dataTransferN(IsLoad, size, isSigned, HeapReg, ptrReg, d, Offset, Assembler::Below);
     }
     masm.append(AsmJSHeapAccess(bo.getOffset()));
@@ -2063,17 +2054,17 @@ CodeGeneratorARM::visitEffectiveAddress(
     masm.ma_add(Imm32(mir->displacement()), output);
     return true;
 }
 
 bool
 CodeGeneratorARM::visitAsmJSLoadGlobalVar(LAsmJSLoadGlobalVar *ins)
 {
     const MAsmJSLoadGlobalVar *mir = ins->mir();
-    unsigned addr = mir->globalDataOffset();
+    unsigned addr = mir->globalDataOffset() - AsmJSGlobalRegBias;
     if (mir->type() == MIRType_Int32) {
         masm.ma_dtr(IsLoad, GlobalReg, Imm32(addr), ToRegister(ins->output()));
     } else if (mir->type() == MIRType_Float32) {
         VFPRegister vd(ToFloatRegister(ins->output()));
         masm.ma_vldr(Operand(GlobalReg, addr), vd.singleOverlay());
     } else {
         masm.ma_vldr(Operand(GlobalReg, addr), ToFloatRegister(ins->output()));
     }
@@ -2082,17 +2073,17 @@ CodeGeneratorARM::visitAsmJSLoadGlobalVa
 
 bool
 CodeGeneratorARM::visitAsmJSStoreGlobalVar(LAsmJSStoreGlobalVar *ins)
 {
     const MAsmJSStoreGlobalVar *mir = ins->mir();
 
     MIRType type = mir->value()->type();
     JS_ASSERT(IsNumberType(type));
-    unsigned addr = mir->globalDataOffset();
+    unsigned addr = mir->globalDataOffset() - AsmJSGlobalRegBias;
     if (mir->value()->type() == MIRType_Int32) {
         masm.ma_dtr(IsStore, GlobalReg, Imm32(addr), ToRegister(ins->value()));
     } else if (mir->value()->type() == MIRType_Float32) {
         VFPRegister vd(ToFloatRegister(ins->value()));
         masm.ma_vstr(vd.singleOverlay(), Operand(GlobalReg, addr));
     } else {
         masm.ma_vstr(ToFloatRegister(ins->value()), Operand(GlobalReg, addr));
     }
@@ -2103,29 +2094,30 @@ bool
 CodeGeneratorARM::visitAsmJSLoadFuncPtr(LAsmJSLoadFuncPtr *ins)
 {
     const MAsmJSLoadFuncPtr *mir = ins->mir();
 
     Register index = ToRegister(ins->index());
     Register tmp = ToRegister(ins->temp());
     Register out = ToRegister(ins->output());
     unsigned addr = mir->globalDataOffset();
-    masm.ma_mov(Imm32(addr), tmp);
+    masm.ma_mov(Imm32(addr - AsmJSGlobalRegBias), tmp);
     masm.as_add(tmp, tmp, lsl(index, 2));
     masm.ma_ldr(DTRAddr(GlobalReg, DtrRegImmShift(tmp, LSL, 0)), out);
 
     return true;
 }
 
 bool
 CodeGeneratorARM::visitAsmJSLoadFFIFunc(LAsmJSLoadFFIFunc *ins)
 {
     const MAsmJSLoadFFIFunc *mir = ins->mir();
 
-    masm.ma_ldr(Operand(GlobalReg, mir->globalDataOffset()), ToRegister(ins->output()));
+    masm.ma_ldr(Operand(GlobalReg, mir->globalDataOffset() - AsmJSGlobalRegBias),
+                ToRegister(ins->output()));
 
     return true;
 }
 
 bool
 CodeGeneratorARM::visitNegI(LNegI *ins)
 {
     Register input = ToRegister(ins->input());

--- a/js/src/jit/arm/MacroAssembler-arm.h
+++ b/js/src/jit/arm/MacroAssembler-arm.h
@@ -1622,17 +1622,17 @@ class MacroAssemblerARMCompat : public M
     }
 
 #ifdef JSGC_GENERATIONAL
     void branchPtrInNurseryRange(Condition cond, Register ptr, Register temp, Label *label);
     void branchValueIsNurseryObject(Condition cond, ValueOperand value, Register temp, Label *label);
 #endif
 
     void loadAsmJSActivation(Register dest) {
-        loadPtr(Address(GlobalReg, AsmJSActivationGlobalDataOffset), dest);
+        loadPtr(Address(GlobalReg, AsmJSActivationGlobalDataOffset - AsmJSGlobalRegBias), dest);
     }
 };
 
 typedef MacroAssemblerARMCompat MacroAssemblerSpecific;
 
 } // namespace jit
 } // namespace js
 

--- a/js/src/jsfriendapi.h
+++ b/js/src/jsfriendapi.h
@@ -1652,17 +1652,17 @@ const size_t TypedArrayLengthSlot = 1;
  */
 
 #define JS_DEFINE_DATA_AND_LENGTH_ACCESSOR(Type, type) \
 inline void \
 Get ## Type ## ArrayLengthAndData(JSObject *obj, uint32_t *length, type **data) \
 { \
     JS_ASSERT(GetObjectClass(obj) == detail::Type ## ArrayClassPtr); \
     const JS::Value &slot = GetReservedSlot(obj, detail::TypedArrayLengthSlot); \
-    *length = mozilla::SafeCast<uint32_t>(slot.toInt32()); \
+    *length = mozilla::AssertedCast<uint32_t>(slot.toInt32()); \
     *data = static_cast<type*>(GetObjectPrivate(obj)); \
 }
 
 JS_DEFINE_DATA_AND_LENGTH_ACCESSOR(Int8, int8_t)
 JS_DEFINE_DATA_AND_LENGTH_ACCESSOR(Uint8, uint8_t)
 JS_DEFINE_DATA_AND_LENGTH_ACCESSOR(Uint8Clamped, uint8_t)
 JS_DEFINE_DATA_AND_LENGTH_ACCESSOR(Int16, int16_t)
 JS_DEFINE_DATA_AND_LENGTH_ACCESSOR(Uint16, uint16_t)

--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -53,25 +53,25 @@
 using namespace js;
 using namespace js::gc;
 using namespace js::types;
 using namespace js::unicode;
 
 using JS::Symbol;
 using JS::SymbolCode;
 
+using mozilla::AssertedCast;
 using mozilla::CheckedInt;
 using mozilla::IsNaN;
 using mozilla::IsNegativeZero;
 using mozilla::IsSame;
 using mozilla::Move;
 using mozilla::PodCopy;
 using mozilla::PodEqual;
 using mozilla::RangedPtr;
-using mozilla::SafeCast;
 using mozilla::UniquePtr;
 
 using JS::AutoCheckCannotGC;
 
 static JSLinearString *
 ArgToRootedString(JSContext *cx, CallArgs &args, unsigned argno)
 {
     if (argno >= args.length())
@@ -235,17 +235,17 @@ template <typename CharT>
 static bool
 Unescape(StringBuffer &sb, const mozilla::Range<const CharT> chars)
 {
     /*
      * NB: use signed integers for length/index to allow simple length
      * comparisons without unsigned-underflow hazards.
      */
     static_assert(JSString::MAX_LENGTH <= INT_MAX, "String length must fit in a signed integer");
-    int length = SafeCast<int>(chars.length());
+    int length = AssertedCast<int>(chars.length());
 
     /*
      * Note that the spec algorithm has been optimized to avoid building
      * a string in the case where no escapes are present.
      */
 
     /* Step 4. */
     int k = 0;
@@ -1009,17 +1009,17 @@ str_normalize(JSContext *cx, unsigned ar
     // Step 8.
     AutoStableStringChars stableChars(cx);
     if (!str->ensureFlat(cx) || !stableChars.initTwoByte(cx, str))
         return false;
 
     static const size_t INLINE_CAPACITY = 32;
 
     const UChar *srcChars = JSCharToUChar(stableChars.twoByteRange().start().get());
-    int32_t srcLen = SafeCast<int32_t>(str->length());
+    int32_t srcLen = AssertedCast<int32_t>(str->length());
     Vector<jschar, INLINE_CAPACITY> chars(cx);
     if (!chars.resize(INLINE_CAPACITY))
         return false;
 
     UErrorCode status = U_ZERO_ERROR;
     int32_t size = unorm_normalize(srcChars, srcLen, form, 0,
                                    JSCharToUChar(chars.begin()), INLINE_CAPACITY,
                                    &status);

--- a/js/src/vm/NumericConversions.h
+++ b/js/src/vm/NumericConversions.h
@@ -47,17 +47,17 @@ ToUintWidth(double d)
         int_fast16_t((bits & mozilla::FloatingPoint<double>::kExponentBits) >> DoubleExponentShift) -
         int_fast16_t(mozilla::FloatingPoint<double>::kExponentBias);
 
     // If the exponent's less than zero, abs(d) < 1, so the result is 0.  (This
     // also handles subnormals.)
     if (exp < 0)
         return 0;
 
-    uint_fast16_t exponent = mozilla::SafeCast<uint_fast16_t>(exp);
+    uint_fast16_t exponent = mozilla::AssertedCast<uint_fast16_t>(exp);
 
     // If the exponent is greater than or equal to the bits of precision of a
     // double plus ResultType's width, the number is either infinite, NaN, or
     // too large to have lower-order bits in the congruent value.  (Example:
     // 2**84 is exactly representable as a double.  The next exact double is
     // 2**84 + 2**32.  Thus if ResultType is int32_t, an exponent >= 84 implies
     // floor(abs(d)) == 0 mod 2**32.)  Return 0 in all these cases.
     const size_t ResultWidth = CHAR_BIT * sizeof(ResultType);

--- a/js/xpconnect/src/XPCJSRuntime.cpp
+++ b/js/xpconnect/src/XPCJSRuntime.cpp
@@ -2764,17 +2764,19 @@ JSReporter::CollectReports(WindowPaths *
                               anonymize);
     OrphanReporter orphanReporter(XPCConvert::GetISupportsFromJSObject);
     if (!JS::CollectRuntimeStats(xpcrt->Runtime(), &rtStats, &orphanReporter,
                                  anonymize))
     {
         return NS_ERROR_FAILURE;
     }
 
-    size_t xpconnect = xpcrt->SizeOfIncludingThis(JSMallocSizeOf);
+    size_t xpcJSRuntimeSize = xpcrt->SizeOfIncludingThis(JSMallocSizeOf);
+
+    size_t wrappedJSSize = xpcrt->GetWrappedJSMap()->SizeOfWrappedJS(JSMallocSizeOf);
 
     XPCWrappedNativeScope::ScopeSizeInfo sizeInfo(JSMallocSizeOf);
     XPCWrappedNativeScope::AddSizeOfAllScopesIncludingThis(&sizeInfo);
 
     mozJSComponentLoader* loader = mozJSComponentLoader::Get();
     size_t jsComponentLoaderSize = loader ? loader->SizeOfIncludingThis(JSMallocSizeOf) : 0;
 
     // This is the second step (see above).  First we report stuff in the
@@ -2844,19 +2846,23 @@ JSReporter::CollectReports(WindowPaths *
 
     REPORT_BYTES(NS_LITERAL_CSTRING("js-main-runtime-gc-heap-committed/used/gc-things"),
         KIND_OTHER, rtStats.gcHeapGCThings,
         "GC things: objects, strings, scripts, etc.");
 
     // Report xpconnect.
 
     REPORT_BYTES(NS_LITERAL_CSTRING("explicit/xpconnect/runtime"),
-        KIND_HEAP, xpconnect,
+        KIND_HEAP, xpcJSRuntimeSize,
         "The XPConnect runtime.");
 
+    REPORT_BYTES(NS_LITERAL_CSTRING("explicit/xpconnect/wrappedjs"),
+        KIND_HEAP, wrappedJSSize,
+        "Wrappers used to implement XPIDL interfaces with JS.");
+
     REPORT_BYTES(NS_LITERAL_CSTRING("explicit/xpconnect/scopes"),
         KIND_HEAP, sizeInfo.mScopeAndMapSize,
         "XPConnect scopes.");
 
     REPORT_BYTES(NS_LITERAL_CSTRING("explicit/xpconnect/proto-iface-cache"),
         KIND_HEAP, sizeInfo.mProtoAndIfaceCacheSize,
         "Prototype and interface binding caches.");
 

--- a/js/xpconnect/src/XPCMaps.cpp
+++ b/js/xpconnect/src/XPCMaps.cpp
@@ -106,16 +106,33 @@ JSObject2WrappedJSMap::ShutdownMarker()
     for (Map::Range r = mTable.all(); !r.empty(); r.popFront()) {
         nsXPCWrappedJS* wrapper = r.front().value();
         MOZ_ASSERT(wrapper, "found a null JS wrapper!");
         MOZ_ASSERT(wrapper->IsValid(), "found an invalid JS wrapper!");
         wrapper->SystemIsBeingShutDown();
     }
 }
 
+size_t
+JSObject2WrappedJSMap::SizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const
+{
+    size_t n = mallocSizeOf(this);
+    n += mTable.sizeOfExcludingThis(mallocSizeOf);
+    return n;
+}
+
+size_t
+JSObject2WrappedJSMap::SizeOfWrappedJS(mozilla::MallocSizeOf mallocSizeOf) const
+{
+    size_t n = 0;
+    for (Map::Range r = mTable.all(); !r.empty(); r.popFront())
+        n += r.front().value()->SizeOfIncludingThis(mallocSizeOf);
+    return n;
+}
+
 /***************************************************************************/
 // implement Native2WrappedNativeMap...
 
 // static
 Native2WrappedNativeMap*
 Native2WrappedNativeMap::newMap(int length)
 {
     Native2WrappedNativeMap* map = new Native2WrappedNativeMap(length);

--- a/js/xpconnect/src/XPCMaps.h
+++ b/js/xpconnect/src/XPCMaps.h
@@ -67,21 +67,21 @@ public:
         for (Map::Range r = mTable.all(); !r.empty(); r.popFront())
             r.front().value()->DebugDump(depth);
     }
 
     void FindDyingJSObjects(nsTArray<nsXPCWrappedJS*>* dying);
 
     void ShutdownMarker();
 
-    size_t SizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) {
-        size_t n = mallocSizeOf(this);
-        n += mTable.sizeOfExcludingThis(mallocSizeOf);
-        return n;
-    }
+    size_t SizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const;
+
+    // Report the sum of SizeOfIncludingThis() for all wrapped JS in the map.
+    // Each wrapped JS is only in one map.
+    size_t SizeOfWrappedJS(mozilla::MallocSizeOf mallocSizeOf) const;
 
 private:
     JSObject2WrappedJSMap() {}
 
     /*
      * This function is called during minor GCs for each key in the HashMap that
      * has been moved.
      */

--- a/js/xpconnect/src/XPCWrappedJS.cpp
+++ b/js/xpconnect/src/XPCWrappedJS.cpp
@@ -547,16 +547,35 @@ nsXPCWrappedJS::SystemIsBeingShutDown()
     // at this point.
     *mJSObj.unsafeGet() = nullptr;
 
     // Notify other wrappers in the chain.
     if (mNext)
         mNext->SystemIsBeingShutDown();
 }
 
+size_t
+nsXPCWrappedJS::SizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const
+{
+    // mJSObject is a JS pointer, so don't measure the object.
+    // mClass is not uniquely owned by this WrappedJS. Measure it in IID2WrappedJSClassMap.
+    // mRoot is not measured because it is either |this| or we have already measured it.
+    // mOuter is rare and probably not uniquely owned by this.
+    size_t n = mallocSizeOf(this);
+    n += nsAutoXPTCStub::SizeOfExcludingThis(mallocSizeOf);
+
+    // Wrappers form a linked list via the mNext field, so include them all
+    // in the measurement. Only root wrappers are stored in the map, so
+    // everything will be measured exactly once.
+    if (mNext)
+        n += mNext->SizeOfIncludingThis(mallocSizeOf);
+
+    return n;
+}
+
 /***************************************************************************/
 
 /* readonly attribute nsISimpleEnumerator enumerator; */
 NS_IMETHODIMP
 nsXPCWrappedJS::GetEnumerator(nsISimpleEnumerator * *aEnumerate)
 {
     AutoJSContext cx;
     XPCCallContext ccx(NATIVE_CALLER, cx);

--- a/js/xpconnect/src/xpcprivate.h
+++ b/js/xpconnect/src/xpcprivate.h
@@ -2484,16 +2484,18 @@ public:
             return;
         }
         mRoot->mOuter = aNative;
     }
 
     void TraceJS(JSTracer* trc);
     static void GetTraceName(JSTracer* trc, char *buf, size_t bufsize);
 
+    size_t SizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const;
+
     virtual ~nsXPCWrappedJS();
 protected:
     nsXPCWrappedJS();   // not implemented
     nsXPCWrappedJS(JSContext* cx,
                    JSObject* aJSObj,
                    nsXPCWrappedJSClass* aClass,
                    nsXPCWrappedJS* root);
 

--- a/layout/base/Units.h
+++ b/layout/base/Units.h
@@ -290,17 +290,27 @@ struct RenderTargetPixel {
  * generally be represented in ScreenPixel units.
  */
 struct ScreenPixel {
   static ScreenIntPoint FromUntyped(const nsIntPoint& aPoint) {
     return ScreenIntPoint(aPoint.x, aPoint.y);
   }
 };
 
-// Operators to apply ScaleFactors directly to Points, Rects, Sizes and Margins
+// Operators to apply ScaleFactors directly to Coords, Points, Rects, Sizes and Margins
+
+template<class src, class dst>
+gfx::CoordTyped<dst> operator*(gfx::CoordTyped<src>& aCoord, const gfx::ScaleFactor<src, dst>& aScale) {
+  return gfx::CoordTyped<dst>(aCoord.value * aScale.scale);
+}
+
+template<class src, class dst>
+gfx::CoordTyped<dst> operator/(gfx::CoordTyped<src>& aCoord, const gfx::ScaleFactor<src, dst>& aScale) {
+  return gfx::CoordTyped<dst>(aCoord.value / aScale.scale);
+}
 
 template<class src, class dst>
 gfx::PointTyped<dst> operator*(const gfx::PointTyped<src>& aPoint, const gfx::ScaleFactor<src, dst>& aScale) {
   return gfx::PointTyped<dst>(aPoint.x * aScale.scale,
                               aPoint.y * aScale.scale);
 }
 
 template<class src, class dst>

--- a/layout/forms/nsListControlFrame.cpp
+++ b/layout/forms/nsListControlFrame.cpp
@@ -1073,17 +1073,17 @@ dom::HTMLOptionElement*
 nsListControlFrame::GetCurrentOption()
 {
   // The mEndSelectionIndex is what is currently being selected. Use
   // the selected index if this is kNothingSelected.
   int32_t focusedIndex = (mEndSelectionIndex == kNothingSelected) ?
     GetSelectedIndex() : mEndSelectionIndex;
 
   if (focusedIndex != kNothingSelected) {
-    return GetOption(SafeCast<uint32_t>(focusedIndex));
+    return GetOption(AssertedCast<uint32_t>(focusedIndex));
   }
 
   // There is no selected item. Return the first non-disabled item.
   nsRefPtr<dom::HTMLSelectElement> selectElement =
     dom::HTMLSelectElement::FromContent(mContent);
 
   for (uint32_t i = 0, length = selectElement->Length(); i < length; ++i) {
     dom::HTMLOptionElement* node = selectElement->Item(i);
@@ -1901,17 +1901,17 @@ void
 nsListControlFrame::ScrollToIndex(int32_t aIndex)
 {
   if (aIndex < 0) {
     // XXX shouldn't we just do nothing if we're asked to scroll to
     // kNothingSelected?
     ScrollTo(nsPoint(0, 0), nsIScrollableFrame::INSTANT);
   } else {
     nsRefPtr<dom::HTMLOptionElement> option =
-      GetOption(SafeCast<uint32_t>(aIndex));
+      GetOption(AssertedCast<uint32_t>(aIndex));
     if (option) {
       ScrollToFrame(*option);
     }
   }
 }
 
 void
 nsListControlFrame::ScrollToFrame(dom::HTMLOptionElement& aOptElement)

new file mode 100644
--- /dev/null
+++ b/layout/reftests/svg/filters/css-filters/brightness-darken-ref.html
@@ -0,0 +1,22 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE html>
+<html>
+<head>
+  <title>CSS Filters: Darken an HTML Element Using the Brightness Function</title>
+  <link rel="author" title="Max Vujovic" href="mailto:mvujovic@adobe.com">
+  <style type="text/css">
+    #target {
+      background-color: rgb(0, 64, 0);
+      width: 100px;
+      height: 100px;
+    }
+  </style>
+</head>
+<body>
+  <p>You should see a dark green square.</p>
+  <div id="target"></div>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/layout/reftests/svg/filters/css-filters/brightness-darken.html
@@ -0,0 +1,28 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE html>
+<html>
+<head>
+  <title>CSS Filters: Darken an HTML Element Using the Brightness Function</title>
+  <link rel="author" title="Max Vujovic" href="mailto:mvujovic@adobe.com">
+  <link rel="help" href="http://www.w3.org/TR/filter-effects-1/#funcdef-brightness">
+  <link rel="match" href="brightness-darken-ref.html">
+  <meta name="assert"
+        content="Given a factor less than one, the CSS brightness filter
+                 function should darken the color of an HTML element.">
+  <style type="text/css">
+    #target {
+      filter: brightness(0.25);
+      background-color: #0f0;
+      width: 100px;
+      height: 100px;
+    }
+  </style>
+</head>
+<body>
+  <p>You should see a dark green square.</p>
+  <div id="target"></div>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/layout/reftests/svg/filters/css-filters/brightness-extreme-ref.html
@@ -0,0 +1,22 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE html>
+<html>
+<head>
+  <title>CSS Filters: Brighten an HTML Element Using a Large Factor</title>
+  <link rel="author" title="Max Vujovic" href="mailto:mvujovic@adobe.com">
+  <style type="text/css">
+    #target {
+      background-color: #0f0;
+      width: 100px;
+      height: 100px;
+    }
+  </style>
+</head>
+<body>
+  <p>You should see a bright green square.</p>
+  <div id="target"></div>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/layout/reftests/svg/filters/css-filters/brightness-extreme.html
@@ -0,0 +1,28 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE html>
+<html>
+<head>
+  <title>CSS Filters: Brighten an HTML Element Using a Large Factor</title>
+  <link rel="author" title="Max Vujovic" href="mailto:mvujovic@adobe.com">
+  <link rel="help" href="http://www.w3.org/TR/filter-effects-1/#funcdef-brightness">
+  <link rel="match" href="brightness-extreme-ref.html">
+  <meta name="assert"
+        content="Given a large factor, the CSS brightness filter function should
+                 completely change the color of an HTML element.">
+  <style type="text/css">
+    #target {
+      filter: brightness(1000);
+      background-color: rgb(0, 1, 0);
+      width: 100px;
+      height: 100px;
+    }
+  </style>
+</head>
+<body>
+  <p>You should see a bright green square.</p>
+  <div id="target"></div>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/layout/reftests/svg/filters/css-filters/brightness-one-ref.html
@@ -0,0 +1,22 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE html>
+<html>
+<head>
+  <title>CSS Filters: Brighten an HTML Element Using a Factor of One</title>
+  <link rel="author" title="Max Vujovic" href="mailto:mvujovic@adobe.com">
+  <style type="text/css">
+    #target {
+      background-color: rgb(0, 128, 0);
+      width: 100px;
+      height: 100px;
+    }
+  </style>
+</head>
+<body>
+  <p>You should see a green square.</p>
+  <div id="target"></div>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/layout/reftests/svg/filters/css-filters/brightness-one.html
@@ -0,0 +1,28 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE html>
+<html>
+<head>
+  <title>CSS Filters: Brighten an HTML Element Using a Factor of One</title>
+  <link rel="author" title="Max Vujovic" href="mailto:mvujovic@adobe.com">
+  <link rel="help" href="http://www.w3.org/TR/filter-effects-1/#funcdef-brightness">
+  <link rel="match" href="brightness-one-ref.html">
+  <meta name="assert"
+        content="Given a factor of one, the CSS brightness filter function
+                 should not change the color of an HTML element.">
+  <style type="text/css">
+    #target {
+      filter: brightness(1);
+      background-color: rgb(0, 128, 0);
+      width: 100px;
+      height: 100px;
+    }
+  </style>
+</head>
+<body>
+  <p>You should see a green square.</p>
+  <div id="target"></div>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/layout/reftests/svg/filters/css-filters/brightness-percent-ref.html
@@ -0,0 +1,22 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE html>
+<html>
+<head>
+  <title>CSS Filters: Brighten an HTML Element Using a Percentage</title>
+  <link rel="author" title="Max Vujovic" href="mailto:mvujovic@adobe.com">
+  <style type="text/css">
+    #target {
+      background-color: rgb(0, 128, 0);
+      width: 100px;
+      height: 100px;
+    }
+  </style>
+</head>
+<body>
+  <p>You should see a green square.</p>
+  <div id="target"></div>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/layout/reftests/svg/filters/css-filters/brightness-percent.html
@@ -0,0 +1,28 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE html>
+<html>
+<head>
+  <title>CSS Filters: Brighten an HTML Element Using a Percentage</title>
+  <link rel="author" title="Max Vujovic" href="mailto:mvujovic@adobe.com">
+  <link rel="help" href="http://www.w3.org/TR/filter-effects-1/#funcdef-brightness">
+  <link rel="match" href="brightness-percent-ref.html">
+  <meta name="assert"
+        content="Given a percentage, the CSS brightness filter function should
+                 change the color of an HTML element.">
+  <style type="text/css">
+    #target {
+      filter: brightness(400%);
+      background-color: rgb(0, 32, 0);
+      width: 100px;
+      height: 100px;
+    }
+  </style>
+</head>
+<body>
+  <p>You should see a green square.</p>
+  <div id="target"></div>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/layout/reftests/svg/filters/css-filters/brightness-ref.html
@@ -0,0 +1,22 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE html>
+<html>
+<head>
+  <title>CSS Filters: Brighten an HTML Element</title>
+  <link rel="author" title="Max Vujovic" href="mailto:mvujovic@adobe.com">
+  <style type="text/css">
+    #target {
+      background-color: rgb(0, 128, 0);
+      width: 100px;
+      height: 100px;
+    }
+  </style>
+</head>
+<body>
+  <p>You should see a green square.</p>
+  <div id="target"></div>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/layout/reftests/svg/filters/css-filters/brightness-zero-ref.html
@@ -0,0 +1,22 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE html>
+<html>
+<head>
+  <title>CSS Filters: Darken an HTML Element Using the Brightness Function and a Factor of Zero</title>
+  <link rel="author" title="Max Vujovic" href="mailto:mvujovic@adobe.com">
+  <style type="text/css">
+    #target {
+      background-color: black;
+      width: 100px;
+      height: 100px;
+    }
+  </style>
+</head>
+<body>
+  <p>You should see a black square.</p>
+  <div id="target"></div>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/layout/reftests/svg/filters/css-filters/brightness-zero.html
@@ -0,0 +1,28 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE html>
+<html>
+<head>
+  <title>CSS Filters: Darken an HTML Element Using the Brightness Function and a Factor of Zero</title>
+  <link rel="author" title="Max Vujovic" href="mailto:mvujovic@adobe.com">
+  <link rel="help" href="http://www.w3.org/TR/filter-effects-1/#funcdef-brightness">
+  <link rel="match" href="brightness-zero-ref.html">
+  <meta name="assert"
+        content="Given a factor of zero, the CSS brightness filter function
+                 should change the color of an HTML element to black.">
+  <style type="text/css">
+    #target {
+      filter: brightness(0);
+      background-color: #f00;
+      width: 100px;
+      height: 100px;
+    }
+  </style>
+</head>
+<body>
+  <p>You should see a black square.</p>
+  <div id="target"></div>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/layout/reftests/svg/filters/css-filters/brightness.html
@@ -0,0 +1,28 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE html>
+<html>
+<head>
+  <title>CSS Filters: Brighten an HTML Element</title>
+  <link rel="author" title="Max Vujovic" href="mailto:mvujovic@adobe.com">
+  <link rel="help" href="http://www.w3.org/TR/filter-effects-1/#funcdef-brightness">
+  <link rel="match" href="brightness-ref.html">
+  <meta name="assert"
+        content="The CSS brightness filter function should change the color of
+                 an HTML element.">
+  <style type="text/css">
+    #target {
+      filter: brightness(4);
+      background-color: rgb(0, 32, 0);
+      width: 100px;
+      height: 100px;
+    }
+  </style>
+</head>
+<body>
+  <p>You should see a green square.</p>
+  <div id="target"></div>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/layout/reftests/svg/filters/css-filters/contrast-extreme-ref.html
@@ -0,0 +1,22 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE html>
+<html>
+<head>
+  <title>CSS Filters: Increase the Contrast of an HTML Element Using a Large Factor</title>
+  <link rel="author" title="Max Vujovic" href="mailto:mvujovic@adobe.com">
+  <style type="text/css">
+    #target {
+      background-color: #0f0;
+      width: 100px;
+      height: 100px;
+    }
+  </style>
+</head>
+<body>
+  <p>You should see a bright green square.</p>
+  <div id="target"></div>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/layout/reftests/svg/filters/css-filters/contrast-extreme.html
@@ -0,0 +1,29 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE html>
+<html>
+<head>
+  <title>CSS Filters: Increase the Contrast of an HTML Element Using a Large Factor</title>
+  <link rel="author" title="Max Vujovic" href="mailto:mvujovic@adobe.com">
+  <link rel="help" href="http://www.w3.org/TR/filter-effects-1/#funcdef-contrast">
+  <link rel="match" href="contrast-extreme-ref.html">
+  <meta name="assert"
+        content="Given a large factor, the CSS contrast filter function should
+                 should change color channel values to be much farther from
+                 their middle value.">
+  <style type="text/css">
+    #target {
+      filter: contrast(1000);
+      background-color: rgb(127, 129, 127); /* 127 should change to 0, and 129 should change to 255. */
+      width: 100px;
+      height: 100px;
+    }
+  </style>
+</head>
+<body>
+  <p>You should see a bright green square.</p>
+  <div id="target"></div>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/layout/reftests/svg/filters/css-filters/contrast-one-ref.html
@@ -0,0 +1,22 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE html>
+<html>
+<head>
+  <title>CSS Filters: Set the Contrast of HTML Element Using a Factor of One</title>
+  <link rel="author" title="Max Vujovic" href="mailto:mvujovic@adobe.com">
+  <style type="text/css">
+    #target {
+      background-color: rgb(0, 128, 0);
+      width: 100px;
+      height: 100px;
+    }
+  </style>
+</head>
+<body>
+  <p>You should see a green square.</p>
+  <div id="target"></div>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/layout/reftests/svg/filters/css-filters/contrast-one.html
@@ -0,0 +1,28 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE html>
+<html>
+<head>
+  <title>CSS Filters: Set the Contrast of HTML Element Using a Factor of One</title>
+  <link rel="author" title="Max Vujovic" href="mailto:mvujovic@adobe.com">
+  <link rel="help" href="http://www.w3.org/TR/filter-effects-1/#funcdef-contrast">
+  <link rel="match" href="contrast-one-ref.html">
+  <meta name="assert"
+        content="Given a factor of one, the CSS contrast filter function
+                 should not change the color of an HTML element.">
+  <style type="text/css">
+    #target {
+      filter: contrast(1);
+      background-color: rgb(0, 128, 0);
+      width: 100px;
+      height: 100px;
+    }
+  </style>
+</head>
+<body>
+  <p>You should see a green square.</p>
+  <div id="target"></div>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/layout/reftests/svg/filters/css-filters/contrast-percent-ref.html
@@ -0,0 +1,22 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE html>
+<html>
+<head>
+  <title>CSS Filters: Increase the Contrast of an HTML Element</title>
+  <link rel="author" title="Max Vujovic" href="mailto:mvujovic@adobe.com">
+  <style type="text/css">
+    #target {
+      background-color: #0f0;
+      width: 100px;
+      height: 100px;
+    }
+  </style>
+</head>
+<body>
+  <p>You should see a bright green square.</p>
+  <div id="target"></div>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/layout/reftests/svg/filters/css-filters/contrast-percent.html
@@ -0,0 +1,28 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE html>
+<html>
+<head>
+  <title>CSS Filters: Increase the Contrast of an HTML Element</title>
+  <link rel="author" title="Max Vujovic" href="mailto:mvujovic@adobe.com">
+  <link rel="help" href="http://www.w3.org/TR/filter-effects-1/#funcdef-contrast">
+  <link rel="match" href="contrast-percent-ref.html">
+  <meta name="assert"
+        content="Given a percentage, the CSS contrast filter function should
+                 change the color of an HTML element.">
+  <style type="text/css">
+    #target {
+      filter: contrast(200%);
+      background-color: rgb(0, 196, 0);
+      width: 100px;
+      height: 100px;
+    }
+  </style>
+</head>
+<body>
+  <p>You should see a bright green square.</p>
+  <div id="target"></div>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/layout/reftests/svg/filters/css-filters/contrast-reduce-ref.html
@@ -0,0 +1,22 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE html>
+<html>
+<head>
+  <title>CSS Filters: Reduce the Contrast of an HTML Element</title>
+  <link rel="author" title="Max Vujovic" href="mailto:mvujovic@adobe.com">
+  <style type="text/css">
+    #target {
+      background-color: rgb(64, 191, 64);
+      width: 100px;
+      height: 100px;
+    }
+  </style>
+</head>
+<body>
+  <p>You should see a green square.</p>
+  <div id="target"></div>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/layout/reftests/svg/filters/css-filters/contrast-reduce.html
@@ -0,0 +1,29 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE html>
+<html>
+<head>
+  <title>CSS Filters: Reduce the Contrast of an HTML Element</title>
+  <link rel="author" title="Max Vujovic" href="mailto:mvujovic@adobe.com">
+  <link rel="help" href="http://www.w3.org/TR/filter-effects-1/#funcdef-contrast">
+  <link rel="match" href="contrast-reduce-ref.html">
+  <meta name="assert"
+        content="Given a factor of less than one, the CSS contrast filter
+                 function should change color channel values to be closer to
+                 their middle value.">
+  <style type="text/css">
+    #target {
+      filter: contrast(0.5);
+      background-color: #0f0;
+      width: 100px;
+      height: 100px;
+    }
+  </style>
+</head>
+<body>
+  <p>You should see a green square.</p>
+  <div id="target"></div>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/layout/reftests/svg/filters/css-filters/contrast-ref.html
@@ -0,0 +1,22 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE html>
+<html>
+<head>
+  <title>CSS Filters: Increase the Contrast of an HTML Element</title>
+  <link rel="author" title="Max Vujovic" href="mailto:mvujovic@adobe.com">
+  <style type="text/css">
+    #target {
+      background-color: #0f0;
+      width: 100px;
+      height: 100px;
+    }
+  </style>
+</head>
+<body>
+  <p>You should see a bright green square.</p>
+  <div id="target"></div>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/layout/reftests/svg/filters/css-filters/contrast-zero-ref.html
@@ -0,0 +1,23 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE html>
+<html>
+<head>
+  <title>CSS Filters: Reduce the Contrast of an HTML Element Using a Factor of Zero</title>
+  <link rel="author" title="Max Vujovic" href="mailto:mvujovic@adobe.com">
+  <style type="text/css">
+    #target {
+      filter: contrast(0);
+      background-color: rgb(128, 128, 128);
+      width: 100px;
+      height: 100px;
+    }
+  </style>
+</head>
+<body>
+  <p>You should see a gray square.</p>
+  <div id="target"></div>
+</body>
+</html>