--- a/accessible/jsat/AccessFu.jsm
+++ b/accessible/jsat/AccessFu.jsm
@@ -412,24 +412,16 @@ this.AccessFu = { // jshint ignore:line
     function(aJsonBounds, aBrowser, aToCSSPixels) {
       let bounds = new Rect(aJsonBounds.left, aJsonBounds.top,
                             aJsonBounds.right - aJsonBounds.left,
                             aJsonBounds.bottom - aJsonBounds.top);
       let win = Utils.win;
       let dpr = win.devicePixelRatio;
       let offset = { left: -win.mozInnerScreenX, top: -win.mozInnerScreenY };
 
-      if (!aBrowser.contentWindow) {
-        // OOP browser, add offset of browser.
-        // The offset of the browser element in relation to its parent window.
-        let clientRect = aBrowser.getBoundingClientRect();
-        let win = aBrowser.ownerDocument.defaultView;
-        offset.left += clientRect.left + win.mozInnerScreenX;
-        offset.top += clientRect.top + win.mozInnerScreenY;
-      }
       // Add the offset; the offset is in CSS pixels, so multiply the
       // devicePixelRatio back in before adding to preserve unit consistency.
       bounds = bounds.translate(offset.left * dpr, offset.top * dpr);
 
       // If we want to get to CSS pixels from device pixels, this needs to be
       // further divided by the devicePixelRatio due to widget scaling.
       if (aToCSSPixels) {
         bounds = bounds.scale(1 / dpr, 1 / dpr);

--- a/browser/base/content/test/general/test_contextmenu.html
+++ b/browser/base/content/test/general/test_contextmenu.html
@@ -352,18 +352,18 @@ function runTest(testNum) {
         closeContextMenu();
         openContextMenuFor(textarea); // Invoke context menu for next test
     },
 
     function () {
         // Context menu for textarea before spell check initialization finishes
         checkContextMenu(["context-undo",                false,
                           "---",                         null,
-                          "context-cut",                 false,
-                          "context-copy",                false,
+                          "context-cut",                 true,
+                          "context-copy",                true,
                           "context-paste",               null,
                           "context-delete",              false,
                           "---",                         null,
                           "context-selectall",           true,
                           "---",                         null,
                           "spell-add-dictionaries-main", true,
                          ].concat(inspectItems));
         closeContextMenu();
@@ -372,18 +372,18 @@ function runTest(testNum) {
 
     function () {
         // Context menu for textarea after spell check initialization finishes
         checkContextMenu(["*chubbiness",         true, // spelling suggestion
                           "spell-add-to-dictionary", true,
                           "---",                 null,
                           "context-undo",        false,
                           "---",                 null,
-                          "context-cut",         false,
-                          "context-copy",        false,
+                          "context-cut",         true,
+                          "context-copy",        true,
                           "context-paste",       null, // ignore clipboard state
                           "context-delete",      false,
                           "---",                 null,
                           "context-selectall",   true,
                           "---",                 null,
                           "spell-check-enabled", true,
                           "spell-dictionaries",  true,
                               ["spell-check-dictionary-en-US", true,
@@ -404,18 +404,18 @@ function runTest(testNum) {
 
     function () {
         // Context menu for textarea after a word has been added
         // to the dictionary
         checkContextMenu(["spell-undo-add-to-dictionary", true,
                           "---",                 null,
                           "context-undo",        false,
                           "---",                 null,
-                          "context-cut",         false,
-                          "context-copy",        false,
+                          "context-cut",         true,
+                          "context-copy",        true,
                           "context-paste",       null, // ignore clipboard state
                           "context-delete",      false,
                           "---",                 null,
                           "context-selectall",   true,
                           "---",                 null,
                           "spell-check-enabled", true,
                           "spell-dictionaries",  true,
                               ["spell-check-dictionary-en-US", true,
@@ -429,18 +429,18 @@ function runTest(testNum) {
 
     function () {
         // Context menu for contenteditable
         checkContextMenu(["spell-no-suggestions", false,
                           "spell-add-to-dictionary", true,
                           "---",                 null,
                           "context-undo",        false,
                           "---",                 null,
-                          "context-cut",         false,
-                          "context-copy",        false,
+                          "context-cut",         true,
+                          "context-copy",        true,
                           "context-paste",       null, // ignore clipboard state
                           "context-delete",      false,
                           "---",                 null,
                           "context-selectall",   true,
                           "---",                 null,
                           "spell-check-enabled", true,
                           "spell-dictionaries",  true,
                               ["spell-check-dictionary-en-US", true,
@@ -645,18 +645,18 @@ function runTest(testNum) {
         selectInputText(select_inputtext_password); // Select text prior to opening context menu.
         openContextMenuFor(select_inputtext_password); // Invoke context menu for next test.
     },
 
     function () {
         // Context menu for selected text in input[type="password"]
         checkContextMenu(["context-undo",        false,
                           "---",                 null,
-                          "context-cut",         false,
-                          "context-copy",        false,
+                          "context-cut",         true,
+                          "context-copy",        true,
                           "context-paste",       null, // ignore clipboard state
                           "context-delete",      true,
                           "---",                 null,
                           "context-selectall",   true,
                           "---",                 null,
                           "spell-check-enabled", true,
                           //spell checker is shown on input[type="password"] on this testcase
                           "spell-dictionaries",  true,
@@ -738,18 +738,18 @@ function runTest(testNum) {
         closeContextMenu();
         openContextMenuFor(inputspellfalse, false, true); // Invoke context menu for next test.
     },
 
     function () {
         // Context menu for text input field with spellcheck=false
         checkContextMenu(["context-undo",        false,
                           "---",                 null,
-                          "context-cut",         false,
-                          "context-copy",        false,
+                          "context-cut",         true,
+                          "context-copy",        true,
                           "context-paste",       null, // ignore clipboard state
                           "context-delete",      false,
                           "---",                 null,
                           "context-selectall",   true,
                           "---",                 null,
                           "spell-add-dictionaries-main",  true,
                          ].concat(inspectItems));
 

--- a/browser/base/content/test/general/test_contextmenu_input.html
+++ b/browser/base/content/test/general/test_contextmenu_input.html
@@ -35,18 +35,18 @@ function runTest(testNum) {
     case 1:
         openContextMenuFor(input); // Invoke context menu for next test.
         break;
 
     case 2:
         // Context menu for text input field.
         checkContextMenu(["context-undo",        false,
                           "---",                 null,
-                          "context-cut",         false,
-                          "context-copy",        false,
+                          "context-cut",         true,
+                          "context-copy",        true,
                           "context-paste",       null, // ignore clipboard state
                           "context-delete",      false,
                           "---",                 null,
                           "context-selectall",   false,
                           "---",                 null,
                           "spell-check-enabled", true,
                           "---",                 null,
                           "context-inspect",     true]);
@@ -56,18 +56,18 @@ function runTest(testNum) {
         openContextMenuFor(input, false, true);
         break;
 
     case 3:
         var value = false;
         // Context menu for spell-check input.
         checkContextMenu(["context-undo",        value,
                           "---",                 null,
-                          "context-cut",         value,
-                          "context-copy",        value,
+                          "context-cut",         true,
+                          "context-copy",        true,
                           "context-paste",       null, // ignore clipboard state
                           "context-delete",      value,
                           "---",                 null,
                           "context-selectall",   value,
                           "---",                 null,
                           "spell-check-enabled", true,
                           "spell-dictionaries",  true,
                               ["spell-check-dictionary-en-US", true,
@@ -85,18 +85,18 @@ function runTest(testNum) {
     case 4:
         var value = false;
         // Context menu for spell-check input with a unknwon word.
         checkContextMenu(["*prodigality",        true, // spelling suggestion
                           "spell-add-to-dictionary", true,
                           "---",                 null,
                           "context-undo",        value,
                           "---",                 null,
-                          "context-cut",         value,
-                          "context-copy",        value,
+                          "context-cut",         true,
+                          "context-copy",        true,
                           "context-paste",       null, // ignore clipboard state
                           "context-delete",      value,
                           "---",                 null,
                           "context-selectall",   true,
                           "---",                 null,
                           "spell-check-enabled", true,
                           "spell-dictionaries",  true,
                               ["spell-check-dictionary-en-US", true,
@@ -110,18 +110,18 @@ function runTest(testNum) {
         openContextMenuFor(inputspellcorrect, false, true);
         break;
 
     case 5:
         var value = false;
         // Context menu for spell-check input with a known word.
         checkContextMenu(["context-undo",        value,
                           "---",                 null,
-                          "context-cut",         value,
-                          "context-copy",        value,
+                          "context-cut",         true,
+                          "context-copy",        true,
                           "context-paste",       null, // ignore clipboard state
                           "context-delete",      value,
                           "---",                 null,
                           "context-selectall",   true,
                           "---",                 null,
                           "spell-check-enabled", true,
                           "spell-dictionaries",  true,
                               ["spell-check-dictionary-en-US", true,
@@ -134,55 +134,72 @@ function runTest(testNum) {
         input.disabled = true;
         openContextMenuFor(input); // Invoke context menu for next test.
         break;
 
     case 6:
         // Context menu for disabled input.
         checkContextMenu(["context-undo",        false,
                           "---",                 null,
-                          "context-cut",         false,
-                          "context-copy",        false,
+                          "context-cut",         true,
+                          "context-copy",        true,
                           "context-paste",       null, // ignore clipboard state
                           "context-delete",      false,
                           "---",                 null,
                           "context-selectall",   true,
                           "---",                 null,
                           "spell-check-enabled", true,
                           "---",                 null,
                           "context-inspect",     true]);
 
         closeContextMenu();
         input.disabled = false;
         input.type = 'password';
         openContextMenuFor(input); // Invoke context menu for next test.
         break;
 
     case 7: // password
-    case 8: // email
-    case 9: // url
-    case 10: // tel
-    case 11: // type='number'
-        // Context menu for tel, password, email, url and number input fields.
+        // Context menu for password input fields.
         checkContextMenu(["context-undo",        false,
                           "---",                 null,
-                          "context-cut",         false,
-                          "context-copy",        false,
+                          "context-cut",         true,
+                          "context-copy",        true,
                           "context-paste",       null, // ignore clipboard state
                           "context-delete",      false,
                           "---",                 null,
                           "context-selectall",   false,
                           "---",                 null,
                           "context-inspect",     true]);
 
         closeContextMenu();
 
-        if (testNum == 7) {
-          input.type = 'email';
-        } else if (testNum == 8) {
+        input.type = 'email';
+
+        openContextMenuFor(input); // Invoke context menu for next test.
+        break;
+
+    case 8: // email
+    case 9: // url
+    case 10: // tel
+    case 11: // type='number'
+        // Context menu for tel, email, url and number input fields.
+        checkContextMenu(["context-undo",        false,
+                          "---",                 null,
+                          "context-cut",         true,
+                          "context-copy",        true,
+                          "context-paste",       null, // ignore clipboard state
+                          "context-delete",      false,
+                          "---",                 null,
+                          "context-selectall",   false,
+                          "---",                 null,
+                          "context-inspect",     true]);
+
+        closeContextMenu();
+
+        if (testNum == 8) {
           input.type = 'url';
         } else if (testNum == 9) {
           input.type = 'tel';
         } else if (testNum == 10) {
           input.type = 'number';
         } else if (testNum == 11) {
           input.type = 'date';
         }
@@ -223,18 +240,18 @@ function runTest(testNum) {
 
         openContextMenuFor(input);
         break;
 
     case 16: // type='search'
         // Context menu for search input fields.
         checkContextMenu(["context-undo",        false,
                           "---",                 null,
-                          "context-cut",         false,
-                          "context-copy",        false,
+                          "context-cut",         true,
+                          "context-copy",        true,
                           "context-paste",       null, // ignore clipboard state
                           "context-delete",      false,
                           "---",                 null,
                           "context-selectall",   false,
                           "---",                 null,
                           "spell-check-enabled", true,
                           "---",                 null,
                           "context-inspect",     true]);
@@ -252,18 +269,18 @@ function runTest(testNum) {
         input.readOnly = true;
         openContextMenuFor(input);
         break;
 
     case 17:
         // Context menu for a read-only input.
         checkContextMenu(["context-undo",        false,
                           "---",                 null,
-                          "context-cut",         false,
-                          "context-copy",        false,
+                          "context-cut",         true,
+                          "context-copy",        true,
                           "context-paste",       null, // ignore clipboard state
                           "context-delete",      false,
                           "---",                 null,
                           "context-selectall",   false,
                           "---",                 null,
                           "context-inspect",     true]);
         closeContextMenu();
 

--- a/browser/components/customizableui/test/browser_947914_button_copy.js
+++ b/browser/components/customizableui/test/browser_947914_button_copy.js
@@ -14,26 +14,26 @@ add_task(function() {
 
   gURLBar.focus();
   info("The URL bar was focused");
   yield PanelUI.show();
   info("Menu panel was opened");
 
   let copyButton = document.getElementById("copy-button");
   ok(copyButton, "Copy button exists in Panel Menu");
-  is(copyButton.getAttribute("disabled"), "true", "Copy button is initially disabled");
+  ok(!copyButton.getAttribute("disabled"), "Copy button is initially enabled");
 
   // copy text from URL bar
   gURLBar.value = testText;
   gURLBar.focus();
   gURLBar.select();
   yield PanelUI.show();
   info("Menu panel was opened");
 
-  ok(!copyButton.hasAttribute("disabled"), "Copy button gets enabled");
+  ok(!copyButton.hasAttribute("disabled"), "Copy button is enabled when selecting");
 
   copyButton.click();
   is(gURLBar.value, testText, "Selected text is unaltered when clicking copy");
 
   // check that the text was added to the clipboard
   let clipboard = Services.clipboard;
   let transferable = Cc["@mozilla.org/widget/transferable;1"].createInstance(Ci.nsITransferable);
   globalClipboard = clipboard.kGlobalClipboard;

--- a/browser/components/customizableui/test/browser_947914_button_cut.js
+++ b/browser/components/customizableui/test/browser_947914_button_cut.js
@@ -13,26 +13,26 @@ add_task(function() {
   let testText = "cut text test";
 
   gURLBar.focus();
   yield PanelUI.show();
   info("Menu panel was opened");
 
   let cutButton = document.getElementById("cut-button");
   ok(cutButton, "Cut button exists in Panel Menu");
-  ok(cutButton.getAttribute("disabled"), "Cut button is disabled");
+  ok(!cutButton.hasAttribute("disabled"), "Cut button is enabled");
 
   // cut text from URL bar
   gURLBar.value = testText;
   gURLBar.focus();
   gURLBar.select();
   yield PanelUI.show();
   info("Menu panel was opened");
 
-  ok(!cutButton.hasAttribute("disabled"), "Cut button gets enabled");
+  ok(!cutButton.hasAttribute("disabled"), "Cut button is enabled when selecting");
   cutButton.click();
   is(gURLBar.value, "", "Selected text is removed from source when clicking on cut");
 
   // check that the text was added to the clipboard
   let clipboard = Services.clipboard;
   let transferable = Cc["@mozilla.org/widget/transferable;1"].createInstance(Ci.nsITransferable);
   globalClipboard = clipboard.kGlobalClipboard;
 

--- a/browser/devtools/scratchpad/test/browser_scratchpad_edit_ui_updates.js
+++ b/browser/devtools/scratchpad/test/browser_scratchpad_edit_ui_updates.js
@@ -114,17 +114,17 @@ function runTests()
         }
       } else {
         menuPopup.hidePopup();
       }
     });
   };
 
   let firstShow = function() {
-    ok(cutItem.hasAttribute("disabled"), "cut menuitem is disabled");
+    ok(!cutItem.hasAttribute("disabled"), "cut menuitem is enabled");
     closeMenu(firstHide);
   };
 
   let firstHide = function() {
     sp.editor.setSelection({ line: 0, ch: 0 }, { line: 0, ch: 10 });
     openMenu(11, 11, showAfterSelect);
   };
 
@@ -144,17 +144,17 @@ function runTests()
   };
 
   let onCut = function() {
     sp.editor.off("change", onCut);
     openMenu(12, 12, showAfterCut);
   };
 
   let showAfterCut = function() {
-    ok(cutItem.hasAttribute("disabled"), "cut menuitem is disabled after cut");
+    ok(!cutItem.hasAttribute("disabled"), "cut menuitem is enabled after cut");
     ok(!pasteItem.hasAttribute("disabled"), "paste menuitem is enabled after cut");
     closeMenu(hideAfterCut);
   };
 
   let hideAfterCut = function() {
     waitForFocus(function () {
       sp.editor.on("change", onPaste);
       EventUtils.synthesizeKey("v", {accelKey: true}, gScratchpadWindow);
@@ -162,17 +162,17 @@ function runTests()
   };
 
   let onPaste = function() {
     sp.editor.off("change", onPaste);
     openMenu(13, 13, showAfterPaste);
   };
 
   let showAfterPaste = function() {
-    ok(cutItem.hasAttribute("disabled"), "cut menuitem is disabled after paste");
+    ok(!cutItem.hasAttribute("disabled"), "cut menuitem is enabled after paste");
     ok(!pasteItem.hasAttribute("disabled"), "paste menuitem is enabled after paste");
     closeMenu(hideAfterPaste);
   };
 
   let hideAfterPaste = function() {
     if (pass == 0) {
       pass++;
       testContextMenu();

--- a/build/unix/elfhack/inject/moz.build
+++ b/build/unix/elfhack/inject/moz.build
@@ -12,13 +12,11 @@ elif CONFIG['TARGET_CPU'].startswith('ar
     cpu = 'arm'
 else:
     cpu = CONFIG['TARGET_CPU']
 
 GENERATED_SOURCES += [
     "%s.c" % cpu,
 ]
 
-DEFINES['ELFHACK_BUILD'] = True
-
 NO_PGO = True
 
 NO_VISIBILITY_FLAGS = True

--- a/build/unix/elfhack/moz.build
+++ b/build/unix/elfhack/moz.build
@@ -20,11 +20,9 @@ if not CONFIG['CROSS_COMPILE']:
 
 HOST_SOURCES += [
     'elf.cpp',
     'elfhack.cpp',
 ]
 
 HostProgram('elfhack')
 
-DEFINES['ELFHACK_BUILD'] = True
-
 NO_PGO = True

--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -6625,16 +6625,24 @@ nsContentUtils::IsRequestFullScreenAllow
 {
   return !sTrustedFullScreenOnly ||
          EventStateManager::IsHandlingUserInput() ||
          IsCallerChrome();
 }
 
 /* static */
 bool
+nsContentUtils::IsCutCopyAllowed()
+{
+  return EventStateManager::IsHandlingUserInput() ||
+         IsCallerChrome();
+}
+
+/* static */
+bool
 nsContentUtils::HaveEqualPrincipals(nsIDocument* aDoc1, nsIDocument* aDoc2)
 {
   if (!aDoc1 || !aDoc2) {
     return false;
   }
   bool principalsEqual = false;
   aDoc1->NodePrincipal()->Equals(aDoc2->NodePrincipal(), &principalsEqual);
   return principalsEqual;

--- a/dom/base/nsContentUtils.h
+++ b/dom/base/nsContentUtils.h
@@ -1858,16 +1858,23 @@ public:
   /**
    * Returns true if requests for full-screen are allowed in the current
    * context. Requests are only allowed if the user initiated them (like with
    * a mouse-click or key press), unless this check has been disabled by
    * setting the pref "full-screen-api.allow-trusted-requests-only" to false.
    */
   static bool IsRequestFullScreenAllowed();
 
+  /**
+   * Returns true if calling execCommand with 'cut' or 'copy' arguments is
+   * allowed in the current context. These are only allowed if the user initiated
+   * them (like with a mouse-click or key press).
+   */
+  static bool IsCutCopyAllowed();
+
   /*
    * Returns true if the performance timing APIs are enabled.
    */
   static bool IsPerformanceTimingEnabled()
   {
     return sIsPerformanceTimingEnabled;
   }
   

--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -1147,20 +1147,22 @@ nsDOMClassInfo::PostCreatePrototype(JSCo
   nsScriptNameSpaceManager *nameSpaceManager = GetNameSpaceManager();
   NS_ENSURE_TRUE(nameSpaceManager, NS_OK);
 
   JS::Rooted<JSPropertyDescriptor> desc(cx);
   nsresult rv = ResolvePrototype(sXPConnect, win, cx, global, mData->mNameUTF16,
                                  mData, nullptr, nameSpaceManager, proto,
                                  &desc);
   NS_ENSURE_SUCCESS(rv, rv);
-  if (!contentDefinedProperty && desc.object() && !desc.value().isUndefined() &&
-      !JS_DefineUCProperty(cx, global, mData->mNameUTF16,
-                           NS_strlen(mData->mNameUTF16), desc)) {
-    return NS_ERROR_UNEXPECTED;
+  if (!contentDefinedProperty && desc.object() && !desc.value().isUndefined()) {
+    desc.attributesRef() |= JSPROP_RESOLVING;
+    if (!JS_DefineUCProperty(cx, global, mData->mNameUTF16,
+                             NS_strlen(mData->mNameUTF16), desc)) {
+      return NS_ERROR_UNEXPECTED;
+    }
   }
 
   return NS_OK;
 }
 
 // static
 nsIClassInfo *
 NS_GetDOMClassInfoInstance(nsDOMClassInfoID aID)

--- a/dom/base/nsGkAtomList.h
+++ b/dom/base/nsGkAtomList.h
@@ -2116,16 +2116,19 @@ GK_ATOM(x_symbol, "x-symbol")
 // additional languages that have special case transformations
 GK_ATOM(az, "az")
 GK_ATOM(ba, "ba")
 GK_ATOM(crh, "crh")
 GK_ATOM(el, "el")
 GK_ATOM(ga, "ga")
 GK_ATOM(nl, "nl")
 
+// mathematical language, used for MathML
+GK_ATOM(x_math, "x-math")
+
 // Names for editor transactions
 GK_ATOM(TypingTxnName, "Typing")
 GK_ATOM(IMETxnName, "IME")
 GK_ATOM(DeleteTxnName, "Deleting")
 
 // IPC stuff
 GK_ATOM(Remote, "remote")
 GK_ATOM(RemoteId, "_remote_id")

--- a/dom/base/nsPerformance.h
+++ b/dom/base/nsPerformance.h
@@ -418,17 +418,17 @@ public:
 private:
   ~nsPerformance();
 
   nsISupports* GetAsISupports() override
   {
     return this;
   }
 
-  void InsertUserEntry(PerformanceEntry* aEntry);
+  void InsertUserEntry(PerformanceEntry* aEntry) override;
 
   bool IsPerformanceTimingAttribute(const nsAString& aName) override;
 
   DOMHighResTimeStamp
   DeltaFromNavigationStart(DOMHighResTimeStamp aTime) override;
 
   DOMHighResTimeStamp
   GetPerformanceTimingFromString(const nsAString& aTimingName) override;

--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@@ -545,17 +545,17 @@ DefineConstructor(JSContext* cx, JS::Han
 {
   bool alreadyDefined;
   if (!JS_AlreadyHasOwnProperty(cx, global, name, &alreadyDefined)) {
     return false;
   }
 
   // This is Enumerable: False per spec.
   return alreadyDefined ||
-         JS_DefineProperty(cx, global, name, constructor, 0);
+         JS_DefineProperty(cx, global, name, constructor, JSPROP_RESOLVING);
 }
 
 static JSObject*
 CreateInterfaceObject(JSContext* cx, JS::Handle<JSObject*> global,
                       JS::Handle<JSObject*> constructorProto,
                       const js::Class* constructorClass,
                       const JSNativeHolder* constructorNative,
                       unsigned ctorNargs, const NamedConstructor* namedConstructors,

--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -7798,19 +7798,21 @@ class CGResolveHook(CGAbstractClassHook)
               return false;
             }
             if (!desc.object()) {
               return true;
             }
             // If desc.value() is undefined, then the DoResolve call
             // has already defined it on the object.  Don't try to also
             // define it.
-            if (!desc.value().isUndefined() &&
-                !JS_DefinePropertyById(cx, obj, id, desc)) {
-              return false;
+            if (!desc.value().isUndefined()) {
+              desc.attributesRef() |= JSPROP_RESOLVING;
+              if (!JS_DefinePropertyById(cx, obj, id, desc)) {
+                return false;
+              }
             }
             *resolvedp = true;
             return true;
             """)
 
     def definition_body(self):
         if self.descriptor.isGlobal():
             # Resolve standard classes

--- a/dom/crypto/CryptoKey.cpp
+++ b/dom/crypto/CryptoKey.cpp
@@ -58,16 +58,39 @@ StringToUsage(const nsString& aUsage, Cr
   } else if (aUsage.EqualsLiteral(WEBCRYPTO_KEY_USAGE_UNWRAPKEY)) {
     aUsageOut = CryptoKey::UNWRAPKEY;
   } else {
     return NS_ERROR_DOM_SYNTAX_ERR;
   }
   return NS_OK;
 }
 
+SECKEYPrivateKey*
+PrivateKeyFromPrivateKeyTemplate(SECItem* aObjID,
+                                 CK_ATTRIBUTE* aTemplate,
+                                 CK_ULONG aTemplateSize)
+{
+  // Create a generic object with the contents of the key
+  ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
+  if (!slot) {
+    return nullptr;
+  }
+
+  ScopedPK11GenericObject obj(PK11_CreateGenericObject(slot,
+                                                       aTemplate,
+                                                       aTemplateSize,
+                                                       PR_FALSE));
+  if (!obj) {
+    return nullptr;
+  }
+
+  // Have NSS translate the object to a private key.
+  return PK11_FindKeyByKeyID(slot, aObjID, nullptr);
+}
+
 CryptoKey::CryptoKey(nsIGlobalObject* aGlobal)
   : mGlobal(aGlobal)
   , mAttributes(0)
   , mSymKey()
   , mPrivateKey(nullptr)
   , mPublicKey(nullptr)
 {
 }
@@ -218,16 +241,83 @@ void
 CryptoKey::SetExtractable(bool aExtractable)
 {
   mAttributes &= CLEAR_EXTRACTABLE;
   if (aExtractable) {
     mAttributes |= EXTRACTABLE;
   }
 }
 
+// NSS exports private EC keys without the CKA_EC_POINT attribute, i.e. the
+// public value. To properly export the private key to JWK or PKCS #8 we need
+// the public key data though and so we use this method to augment a private
+// key with data from the given public key.
+nsresult
+CryptoKey::AddPublicKeyData(SECKEYPublicKey* aPublicKey)
+{
+  // This should be a private key.
+  MOZ_ASSERT(GetKeyType() == PRIVATE);
+  // There should be a private NSS key with type 'EC'.
+  MOZ_ASSERT(mPrivateKey && mPrivateKey->keyType == ecKey);
+  // The given public key should have the same key type.
+  MOZ_ASSERT(aPublicKey->keyType == mPrivateKey->keyType);
+
+  nsNSSShutDownPreventionLock locker;
+
+  ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
+  if (!slot) {
+    return NS_ERROR_DOM_OPERATION_ERR;
+  }
+
+  // Generate a random 160-bit object ID.
+  ScopedSECItem objID(::SECITEM_AllocItem(nullptr, nullptr, 20));
+  SECStatus rv = PK11_GenerateRandomOnSlot(slot, objID->data, objID->len);
+  if (rv != SECSuccess) {
+    return NS_ERROR_DOM_OPERATION_ERR;
+  }
+
+  // Read EC params.
+  ScopedSECItem params(::SECITEM_AllocItem(nullptr, nullptr, 0));
+  rv = PK11_ReadRawAttribute(PK11_TypePrivKey, mPrivateKey, CKA_EC_PARAMS,
+                             params);
+  if (rv != SECSuccess) {
+    return NS_ERROR_DOM_OPERATION_ERR;
+  }
+
+  // Read private value.
+  ScopedSECItem value(::SECITEM_AllocItem(nullptr, nullptr, 0));
+  rv = PK11_ReadRawAttribute(PK11_TypePrivKey, mPrivateKey, CKA_VALUE, value);
+  if (rv != SECSuccess) {
+    return NS_ERROR_DOM_OPERATION_ERR;
+  }
+
+  SECItem* point = &aPublicKey->u.ec.publicValue;
+  CK_OBJECT_CLASS privateKeyValue = CKO_PRIVATE_KEY;
+  CK_BBOOL falseValue = CK_FALSE;
+  CK_KEY_TYPE ecValue = CKK_EC;
+
+  CK_ATTRIBUTE keyTemplate[9] = {
+    { CKA_CLASS,            &privateKeyValue,     sizeof(privateKeyValue) },
+    { CKA_KEY_TYPE,         &ecValue,             sizeof(ecValue) },
+    { CKA_TOKEN,            &falseValue,          sizeof(falseValue) },
+    { CKA_SENSITIVE,        &falseValue,          sizeof(falseValue) },
+    { CKA_PRIVATE,          &falseValue,          sizeof(falseValue) },
+    { CKA_ID,               objID->data,          objID->len },
+    { CKA_EC_PARAMS,        params->data,         params->len },
+    { CKA_EC_POINT,         point->data,          point->len },
+    { CKA_VALUE,            value->data,          value->len },
+  };
+
+  mPrivateKey = PrivateKeyFromPrivateKeyTemplate(objID, keyTemplate,
+                                                 PR_ARRAY_SIZE(keyTemplate));
+  NS_ENSURE_TRUE(mPrivateKey, NS_ERROR_DOM_OPERATION_ERR);
+
+  return NS_OK;
+}
+
 void
 CryptoKey::ClearUsages()
 {
   mAttributes &= CLEAR_USAGES;
 }
 
 nsresult
 CryptoKey::AddUsage(const nsString& aUsage)
@@ -362,16 +452,19 @@ void CryptoKey::destructorSafeDestroyNSS
 // Serialization and deserialization convenience methods
 
 SECKEYPrivateKey*
 CryptoKey::PrivateKeyFromPkcs8(CryptoBuffer& aKeyData,
                          const nsNSSShutDownPreventionLock& /*proofOfLock*/)
 {
   SECKEYPrivateKey* privKey;
   ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
+  if (!slot) {
+    return nullptr;
+  }
 
   ScopedPLArenaPool arena(PORT_NewArena(DER_DEFAULT_CHUNKSIZE));
   if (!arena) {
     return nullptr;
   }
 
   SECItem pkcs8Item = { siBuffer, nullptr, 0 };
   if (!aKeyData.ToSECItem(arena, &pkcs8Item)) {
@@ -578,46 +671,16 @@ CreateECPointForCoordinates(const Crypto
   point->data[0] = EC_POINT_FORM_UNCOMPRESSED;
   memcpy(point->data + 1, aX.Elements(), aX.Length());
   memcpy(point->data + 1 + aX.Length(), aY.Elements(), aY.Length());
 
   return point;
 }
 
 SECKEYPrivateKey*
-PrivateKeyFromPrivateKeyTemplate(SECItem* aObjID,
-                                 CK_ATTRIBUTE* aTemplate,
-                                 CK_ULONG aTemplateSize)
-{
-  // Create a generic object with the contents of the key
-  ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
-  if (!slot.get()) {
-    return nullptr;
-  }
-
-  ScopedPK11GenericObject obj(PK11_CreateGenericObject(slot.get(),
-                                                       aTemplate,
-                                                       aTemplateSize,
-                                                       PR_FALSE));
-  if (!obj.get()) {
-    return nullptr;
-  }
-
-  // Have NSS translate the object to a private key by inspection
-  // and make a copy we can own
-  ScopedSECKEYPrivateKey privKey(PK11_FindKeyByKeyID(slot.get(), aObjID,
-                                                     nullptr));
-  if (!privKey.get()) {
-    return nullptr;
-  }
-
-  return SECKEY_CopyPrivateKey(privKey.get());
-}
-
-SECKEYPrivateKey*
 CryptoKey::PrivateKeyFromJwk(const JsonWebKey& aJwk,
                              const nsNSSShutDownPreventionLock& /*proofOfLock*/)
 {
   CK_OBJECT_CLASS privateKeyValue = CKO_PRIVATE_KEY;
   CK_BBOOL falseValue = CK_FALSE;
 
   if (aJwk.mKty.EqualsLiteral(JWK_TYPE_EC)) {
     // Verify that all of the required parameters are present
@@ -1084,21 +1147,25 @@ CryptoKey::WriteStructuredClone(JSStruct
   // 1. Attributes
   // 2. Symmetric key as raw (if present)
   // 3. Private key as pkcs8 (if present)
   // 4. Public key as spki (if present)
   // 5. Algorithm in whatever form it chooses
   CryptoBuffer priv, pub;
 
   if (mPrivateKey) {
-    CryptoKey::PrivateKeyToPkcs8(mPrivateKey, priv, locker);
+    if (NS_FAILED(CryptoKey::PrivateKeyToPkcs8(mPrivateKey, priv, locker))) {
+      return false;
+    }
   }
 
   if (mPublicKey) {
-    CryptoKey::PublicKeyToSpki(mPublicKey, pub, locker);
+    if (NS_FAILED(CryptoKey::PublicKeyToSpki(mPublicKey, pub, locker))) {
+      return false;
+    }
   }
 
   return JS_WriteUint32Pair(aWriter, mAttributes, CRYPTOKEY_SC_VERSION) &&
          WriteBuffer(aWriter, mSymKey) &&
          WriteBuffer(aWriter, priv) &&
          WriteBuffer(aWriter, pub) &&
          mAlgorithm.WriteStructuredClone(aWriter);
 }

--- a/dom/crypto/CryptoKey.h
+++ b/dom/crypto/CryptoKey.h
@@ -111,16 +111,17 @@ public:
   // them to manipulate the object
 
   KeyAlgorithmProxy& Algorithm();
   const KeyAlgorithmProxy& Algorithm() const;
   KeyType GetKeyType() const;
   nsresult SetType(const nsString& aType);
   void SetType(KeyType aType);
   void SetExtractable(bool aExtractable);
+  nsresult AddPublicKeyData(SECKEYPublicKey* point);
   void ClearUsages();
   nsresult AddUsage(const nsString& aUsage);
   nsresult AddUsageIntersecting(const nsString& aUsage, uint32_t aUsageMask);
   void AddUsage(KeyUsage aUsage);
   bool HasAnyUsage();
   bool HasUsage(KeyUsage aUsage);
   bool HasUsageOtherThan(uint32_t aUsages);
   static bool IsRecognizedUsage(const nsString& aUsage);
@@ -150,29 +151,29 @@ public:
   static SECKEYPrivateKey* PrivateKeyFromPkcs8(CryptoBuffer& aKeyData,
                                                const nsNSSShutDownPreventionLock& /*proofOfLock*/);
   static nsresult PrivateKeyToPkcs8(SECKEYPrivateKey* aPrivKey,
                                     CryptoBuffer& aRetVal,
                                     const nsNSSShutDownPreventionLock& /*proofOfLock*/);
 
   static SECKEYPublicKey* PublicKeyFromSpki(CryptoBuffer& aKeyData,
                                             const nsNSSShutDownPreventionLock& /*proofOfLock*/);
-  static nsresult PublicKeyToSpki(SECKEYPublicKey* aPrivKey,
+  static nsresult PublicKeyToSpki(SECKEYPublicKey* aPubKey,
                                   CryptoBuffer& aRetVal,
                                   const nsNSSShutDownPreventionLock& /*proofOfLock*/);
 
   static SECKEYPrivateKey* PrivateKeyFromJwk(const JsonWebKey& aJwk,
                                              const nsNSSShutDownPreventionLock& /*proofOfLock*/);
   static nsresult PrivateKeyToJwk(SECKEYPrivateKey* aPrivKey,
                                   JsonWebKey& aRetVal,
                                   const nsNSSShutDownPreventionLock& /*proofOfLock*/);
 
   static SECKEYPublicKey* PublicKeyFromJwk(const JsonWebKey& aKeyData,
                                            const nsNSSShutDownPreventionLock& /*proofOfLock*/);
-  static nsresult PublicKeyToJwk(SECKEYPublicKey* aPrivKey,
+  static nsresult PublicKeyToJwk(SECKEYPublicKey* aPubKey,
                                  JsonWebKey& aRetVal,
                                  const nsNSSShutDownPreventionLock& /*proofOfLock*/);
 
   static SECKEYPublicKey* PublicDhKeyFromRaw(CryptoBuffer& aKeyData,
                                              const CryptoBuffer& aPrime,
                                              const CryptoBuffer& aGenerator,
                                              const nsNSSShutDownPreventionLock& /*proofOfLock*/);
   static nsresult PublicDhKeyToRaw(SECKEYPublicKey* aPubKey,

--- a/dom/crypto/WebCryptoTask.cpp
+++ b/dom/crypto/WebCryptoTask.cpp
@@ -1908,19 +1908,23 @@ private:
 
       return NS_OK;
     } else if (mFormat.EqualsLiteral(WEBCRYPTO_KEY_FORMAT_PKCS8)) {
       if (!mPrivateKey) {
         return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
       }
 
       switch (mPrivateKey->keyType) {
-        case rsaKey:
-          CryptoKey::PrivateKeyToPkcs8(mPrivateKey.get(), mResult, locker);
+        case rsaKey: {
+          nsresult rv = CryptoKey::PrivateKeyToPkcs8(mPrivateKey.get(), mResult, locker);
+          if (NS_FAILED(rv)) {
+            return NS_ERROR_DOM_OPERATION_ERR;
+          }
           return NS_OK;
+        }
         default:
           return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
       }
     } else if (mFormat.EqualsLiteral(WEBCRYPTO_KEY_FORMAT_SPKI)) {
       if (!mPublicKey) {
         return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
       }
 
@@ -2322,16 +2326,24 @@ private:
                                        PR_FALSE, PR_FALSE, nullptr);
     mPublicKey = pubKey;
     if (!mPrivateKey.get() || !mPublicKey.get()) {
       return NS_ERROR_DOM_UNKNOWN_ERR;
     }
 
     mKeyPair.mPrivateKey.get()->SetPrivateKey(mPrivateKey);
     mKeyPair.mPublicKey.get()->SetPublicKey(mPublicKey);
+
+    // PK11_GenerateKeyPair() does not set a CKA_EC_POINT attribute on the
+    // private key, we need this later when exporting to PKCS8 and JWK though.
+    if (mMechanism == CKM_EC_KEY_PAIR_GEN) {
+      nsresult rv = mKeyPair.mPrivateKey->AddPublicKeyData(mPublicKey);
+      NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_OPERATION_ERR);
+    }
+
     return NS_OK;
   }
 
   virtual void Resolve() override
   {
     mResultPromise->MaybeResolve(mKeyPair);
   }
 };

--- a/dom/crypto/test/test_WebCrypto_ECDH.html
+++ b/dom/crypto/test/test_WebCrypto_ECDH.html
@@ -295,16 +295,47 @@ TestArray.addTest(
       .then(error(that), doTryImport(tvs.jwk_missing_x))
       .then(error(that), doTryImport(tvs.jwk_missing_y))
       .then(error(that), complete(that));
   }
 );
 
 // -----------------------------------------------------------------------------
 TestArray.addTest(
+  "JWK export of a newly generated ECDH private key",
+  function () {
+    var that = this;
+    var alg = { name: "ECDH", namedCurve: "P-256" };
+    var reBase64URL = /^[a-zA-Z0-9_-]+$/;
+
+    function doExportToJWK(x) {
+      return crypto.subtle.exportKey("jwk", x.privateKey)
+    }
+
+    crypto.subtle.generateKey(alg, true, ["deriveKey", "deriveBits"])
+      .then(doExportToJWK)
+      .then(
+        complete(that, function(x) {
+          return x.ext &&
+                 x.kty == 'EC' &&
+                 x.crv == 'P-256' &&
+                 reBase64URL.test(x.x) &&
+                 reBase64URL.test(x.y) &&
+                 reBase64URL.test(x.d) &&
+                 x.x.length == 43 && // 32 octets, base64-encoded
+                 x.y.length == 43 && // 32 octets, base64-encoded
+                 shallowArrayEquals(x.key_ops, ['deriveKey', 'deriveBits']);
+          }),
+        error(that)
+      );
+  }
+);
+
+// -----------------------------------------------------------------------------
+TestArray.addTest(
   "Derive an HMAC key from two ECDH keys and test sign/verify",
   function() {
     var that = this;
     var alg = { name: "ECDH" };
     var algDerived = { name: "HMAC", hash: {name: "SHA-1"} };
 
     var pubKey, privKey;
     function setPub(x) { pubKey = x; }

--- a/dom/crypto/test/test_WebCrypto_RSA_OAEP.html
+++ b/dom/crypto/test/test_WebCrypto_RSA_OAEP.html
@@ -17,16 +17,19 @@
 <script src="./test-vectors.js"></script>
 
 <!-- General testing framework -->
 <script src="./test-array.js"></script>
 
 <script>/*<![CDATA[*/
 "use strict";
 
+// Generating 2048-bit keys takes some time.
+SimpleTest.requestLongerTimeout(2);
+
 // -----------------------------------------------------------------------------
 TestArray.addTest(
   "RSA-OAEP encrypt/decrypt round-trip",
   function () {
     var that = this;
     var privKey, pubKey;
     var alg = {name: "RSA-OAEP", hash: "SHA-1"};
 

--- a/dom/crypto/test/test_WebCrypto_Reject_Generating_Keys_Without_Usages.html
+++ b/dom/crypto/test/test_WebCrypto_Reject_Generating_Keys_Without_Usages.html
@@ -17,16 +17,19 @@
 <script src="./test-vectors.js"></script>
 
 <!-- General testing framework -->
 <script src="./test-array.js"></script>
 
 <script>/*<![CDATA[*/
 "use strict";
 
+// Generating 2048-bit keys takes some time.
+SimpleTest.requestLongerTimeout(2);
+
 TestArray.addTest(
   "Test that we reject generating keys without any usage",
   function() {
     var that = this;
     var alg = {
       name: "RSA-OAEP",
       hash: "SHA-256",
       modulusLength: 2048,

--- a/dom/events/IMEContentObserver.cpp
+++ b/dom/events/IMEContentObserver.cpp
@@ -38,17 +38,18 @@ namespace mozilla {
 
 using namespace widget;
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(IMEContentObserver)
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(IMEContentObserver)
   nsAutoScriptBlocker scriptBlocker;
 
-  tmp->UnregisterObservers(true);
+  tmp->NotifyIMEOfBlur();
+  tmp->UnregisterObservers();
 
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mWidget)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mSelection)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mRootContent)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mEditableNode)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mDocShell)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mEditor)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mEndOfAddedTextCache.mContainerNode)
@@ -81,16 +82,17 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
 NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(IMEContentObserver)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(IMEContentObserver)
 
 IMEContentObserver::IMEContentObserver()
   : mESM(nullptr)
   , mPreCharacterDataChangeLength(-1)
+  , mIsObserving(false)
   , mIsSelectionChangeEventPending(false)
   , mSelectionChangeCausedOnlyByComposition(false)
   , mIsPositionChangeEventPending(false)
   , mIsFlushingPendingNotifications(false)
 {
 #ifdef DEBUG
   TestMergingTextChangeData();
 #endif
@@ -99,27 +101,45 @@ IMEContentObserver::IMEContentObserver()
 void
 IMEContentObserver::Init(nsIWidget* aWidget,
                          nsPresContext* aPresContext,
                          nsIContent* aContent,
                          nsIEditor* aEditor)
 {
   MOZ_ASSERT(aEditor, "aEditor must not be null");
 
+  State state = GetState();
+  if (NS_WARN_IF(state == eState_Observing)) {
+    return; // Nothing to do.
+  }
+
+  bool firstInitialization = state != eState_StoppedObserving;
+  if (!firstInitialization) {
+    // If this is now trying to initialize with new contents, all observers
+    // should be registered again for simpler implementation.
+    UnregisterObservers();
+    // Clear members which may not be initialized again.
+    mRootContent = nullptr;
+    mEditor = nullptr;
+    mSelection = nullptr;
+    mDocShell = nullptr;
+  }
+
   mESM = aPresContext->EventStateManager();
   mESM->OnStartToObserveContent(this);
 
   mWidget = aWidget;
-  mEditableNode = IMEStateManager::GetRootEditableNode(aPresContext, aContent);
+
+  mEditableNode =
+    IMEStateManager::GetRootEditableNode(aPresContext, aContent);
   if (!mEditableNode) {
     return;
   }
 
   mEditor = aEditor;
-  mEditor->AddEditorObserver(this);
 
   nsIPresShell* presShell = aPresContext->PresShell();
 
   // get selection and root content
   nsCOMPtr<nsISelectionController> selCon;
   if (mEditableNode->IsNodeOfType(nsINode::eCONTENT)) {
     nsIFrame* frame =
       static_cast<nsIContent*>(mEditableNode.get())->GetPrimaryFrame();
@@ -149,41 +169,50 @@ IMEContentObserver::Init(nsIWidget* aWid
   }
   if (!mRootContent && mEditableNode->IsNodeOfType(nsINode::eDOCUMENT)) {
     // The document node is editable, but there are no contents, this document
     // is not editable.
     return;
   }
   NS_ENSURE_TRUE_VOID(mRootContent);
 
-  if (IMEStateManager::IsTestingIME()) {
-    nsIDocument* doc = aPresContext->Document();
-    (new AsyncEventDispatcher(doc, NS_LITERAL_STRING("MozIMEFocusIn"),
-                              false, false))->RunDOMEventWhenSafe();
-  }
+  if (firstInitialization) {
+    aWidget->NotifyIME(IMENotification(NOTIFY_IME_OF_FOCUS));
 
-  aWidget->NotifyIME(IMENotification(NOTIFY_IME_OF_FOCUS));
+    // While Init() notifies IME of focus, pending layout may be flushed
+    // because the notification may cause querying content.  Then, recursive
+    // call of Init() with the latest content may be occur.  In such case, we
+    // shouldn't keep first initialization.
+    if (GetState() != eState_Initializing) {
+      return;
+    }
 
-  // NOTIFY_IME_OF_FOCUS might cause recreating IMEContentObserver
-  // instance via IMEStateManager::UpdateIMEState().  So, this
-  // instance might already have been destroyed, check it.
-  if (!mRootContent) {
-    return;
+    // NOTIFY_IME_OF_FOCUS might cause recreating IMEContentObserver
+    // instance via IMEStateManager::UpdateIMEState().  So, this
+    // instance might already have been destroyed, check it.
+    if (!mRootContent) {
+      return;
+    }
   }
 
   mDocShell = aPresContext->GetDocShell();
 
   ObserveEditableNode();
 }
 
 void
 IMEContentObserver::ObserveEditableNode()
 {
-  MOZ_ASSERT(mSelection);
-  MOZ_ASSERT(mRootContent);
+  MOZ_RELEASE_ASSERT(mEditor);
+  MOZ_RELEASE_ASSERT(mSelection);
+  MOZ_RELEASE_ASSERT(mRootContent);
+  MOZ_RELEASE_ASSERT(GetState() != eState_Observing);
+
+  mIsObserving = true;
+  mEditor->AddEditorObserver(this);
 
   mUpdatePreference = mWidget->GetIMEUpdatePreference();
   if (mUpdatePreference.WantSelectionChange()) {
     // add selection change listener
     nsCOMPtr<nsISelectionPrivate> selPrivate(do_QueryInterface(mSelection));
     NS_ENSURE_TRUE_VOID(selPrivate);
     nsresult rv = selPrivate->AddSelectionListener(this);
     NS_ENSURE_SUCCESS_VOID(rv);
@@ -198,42 +227,40 @@ IMEContentObserver::ObserveEditableNode(
     // Add scroll position listener and reflow observer to detect position and
     // size changes
     mDocShell->AddWeakScrollObserver(this);
     mDocShell->AddWeakReflowObserver(this);
   }
 }
 
 void
-IMEContentObserver::UnregisterObservers(bool aPostEvent)
+IMEContentObserver::NotifyIMEOfBlur()
 {
-  if (mEditor) {
-    mEditor->RemoveEditorObserver(this);
+  // If this failed to initialize, mRootContent may be null, then, we
+  // should not call NotifyIME(IMENotification(NOTIFY_IME_OF_BLUR))
+  if (!mRootContent || !mWidget) {
+    return;
   }
 
-  // If CreateTextStateManager failed, mRootContent will be null, then, we
-  // should not call NotifyIME(IMENotification(NOTIFY_IME_OF_BLUR))
-  if (mRootContent && mWidget) {
-    if (IMEStateManager::IsTestingIME() && mEditableNode) {
-      nsIDocument* doc = mEditableNode->OwnerDoc();
-      if (doc) {
-        nsRefPtr<AsyncEventDispatcher> dispatcher =
-          new AsyncEventDispatcher(doc, NS_LITERAL_STRING("MozIMEFocusOut"),
-                                   false, false);
-        if (aPostEvent) {
-          dispatcher->PostDOMEvent();
-        } else {
-          dispatcher->RunDOMEventWhenSafe();
-        }
-      }
-    }
-    // A test event handler might destroy the widget.
-    if (mWidget) {
-      mWidget->NotifyIME(IMENotification(NOTIFY_IME_OF_BLUR));
-    }
+  // A test event handler might destroy the widget.
+  if (mWidget) {
+    mWidget->NotifyIME(IMENotification(NOTIFY_IME_OF_BLUR));
+  }
+}
+
+void
+IMEContentObserver::UnregisterObservers()
+{
+  if (!mIsObserving) {
+    return;
+  }
+  mIsObserving = false;
+
+  if (mEditor) {
+    mEditor->RemoveEditorObserver(this);
   }
 
   if (mUpdatePreference.WantSelectionChange() && mSelection) {
     nsCOMPtr<nsISelectionPrivate> selPrivate(do_QueryInterface(mSelection));
     if (selPrivate) {
       selPrivate->RemoveSelectionListener(this);
     }
   }
@@ -254,17 +281,18 @@ IMEContentObserver::GetPresContext() con
   return mESM ? mESM->GetPresContext() : nullptr;
 }
 
 void
 IMEContentObserver::Destroy()
 {
   // WARNING: When you change this method, you have to check Unlink() too.
 
-  UnregisterObservers(false);
+  NotifyIMEOfBlur();
+  UnregisterObservers();
 
   mEditor = nullptr;
   // Even if there are some pending notification, it'll never notify the widget.
   mWidget = nullptr;
   mSelection = nullptr;
   mRootContent = nullptr;
   mEditableNode = nullptr;
   mDocShell = nullptr;
@@ -278,25 +306,56 @@ IMEContentObserver::Destroy()
 
 void
 IMEContentObserver::DisconnectFromEventStateManager()
 {
   mESM = nullptr;
 }
 
 bool
+IMEContentObserver::MaybeReinitialize(nsIWidget* aWidget,
+                                      nsPresContext* aPresContext,
+                                      nsIContent* aContent,
+                                      nsIEditor* aEditor)
+{
+  if (!IsObservingContent(aPresContext, aContent)) {
+    return false;
+  }
+
+  if (GetState() == eState_StoppedObserving) {
+    Init(aWidget, aPresContext, aContent, aEditor);
+  }
+  return IsManaging(aPresContext, aContent);
+}
+
+bool
 IMEContentObserver::IsManaging(nsPresContext* aPresContext,
                                nsIContent* aContent)
 {
+  return GetState() == eState_Observing &&
+         IsObservingContent(aPresContext, aContent);
+}
+
+IMEContentObserver::State
+IMEContentObserver::GetState() const
+{
   if (!mSelection || !mRootContent || !mEditableNode) {
-    return false; // failed to initialize.
+    return eState_NotObserving; // failed to initialize or finalized.
   }
   if (!mRootContent->IsInComposedDoc()) {
-    return false; // the focused editor has already been reframed.
+    // the focused editor has already been reframed.
+    return eState_StoppedObserving;
   }
+  return mIsObserving ? eState_Observing : eState_Initializing;
+}
+
+bool
+IMEContentObserver::IsObservingContent(nsPresContext* aPresContext,
+                                       nsIContent* aContent) const
+{
   return mEditableNode == IMEStateManager::GetRootEditableNode(aPresContext,
                                                                aContent);
 }
 
 bool
 IMEContentObserver::IsEditorHandlingEventForComposition() const
 {
   if (!mWidget) {

--- a/dom/events/IMEContentObserver.h
+++ b/dom/events/IMEContentObserver.h
@@ -67,16 +67,27 @@ public:
             nsIContent* aContent, nsIEditor* aEditor);
   void Destroy();
   /**
    * IMEContentObserver is stored by EventStateManager during observing.
    * DisconnectFromEventStateManager() is called when EventStateManager stops
    * storing the instance.
    */
   void DisconnectFromEventStateManager();
+  /**
+   * MaybeReinitialize() tries to restart to observe the editor's root node.
+   * This is useful when the editor is reframed and all children are replaced
+   * with new node instances.
+   * @return            Returns true if the instance is managing the content.
+   *                    Otherwise, false.
+   */
+  bool MaybeReinitialize(nsIWidget* aWidget,
+                         nsPresContext* aPresContext,
+                         nsIContent* aContent,
+                         nsIEditor* aEditor);
   bool IsManaging(nsPresContext* aPresContext, nsIContent* aContent);
   bool IsEditorHandlingEventForComposition() const;
   bool KeepAliveDuringDeactive() const
   {
     return mUpdatePreference.WantDuringDeactive();
   }
   nsIWidget* GetWidget() const { return mWidget; }
   nsPresContext* GetPresContext() const;
@@ -128,28 +139,39 @@ public:
     {
       return mAddedEndOffset - mRemovedEndOffset;
     }
   };
 
 private:
   ~IMEContentObserver() {}
 
+  enum State {
+    eState_NotObserving,
+    eState_Initializing,
+    eState_StoppedObserving,
+    eState_Observing
+  };
+  State GetState() const;
+  bool IsObservingContent(nsPresContext* aPresContext,
+                          nsIContent* aContent) const;
   void MaybeNotifyIMEOfTextChange(const TextChangeData& aTextChangeData);
   void MaybeNotifyIMEOfSelectionChange(bool aCausedByComposition);
   void MaybeNotifyIMEOfPositionChange();
 
   void NotifyContentAdded(nsINode* aContainer, int32_t aStart, int32_t aEnd);
   void ObserveEditableNode();
   /**
-   *  UnregisterObservers() unresiters all listeners and observers.
-   *  @param aPostEvent     When true, DOM event will be posted to the thread.
-   *                        Otherwise, dispatched when safe.
+   *  NotifyIMEOfBlur() notifies IME of blur.
    */
-  void UnregisterObservers(bool aPostEvent);
+  void NotifyIMEOfBlur();
+  /**
+   *  UnregisterObservers() unregisters all listeners and observers.
+   */
+  void UnregisterObservers();
   void StoreTextChangeData(const TextChangeData& aTextChangeData);
   void FlushMergeableNotifications();
 
 #ifdef DEBUG
   void TestMergingTextChangeData();
 #endif
 
   nsCOMPtr<nsIWidget> mWidget;
@@ -216,16 +238,17 @@ private:
   TextChangeData mTextChangeData;
 
   EventStateManager* mESM;
 
   nsIMEUpdatePreference mUpdatePreference;
   uint32_t mPreAttrChangeLength;
   int64_t mPreCharacterDataChangeLength;
 
+  bool mIsObserving;
   bool mIsSelectionChangeEventPending;
   bool mSelectionChangeCausedOnlyByComposition;
   bool mIsPositionChangeEventPending;
   bool mIsFlushingPendingNotifications;
 };
 
 } // namespace mozilla
 

--- a/dom/events/IMEStateManager.cpp
+++ b/dom/events/IMEStateManager.cpp
@@ -175,17 +175,16 @@ GetNotifyIMEMessageName(IMEMessage aMess
     default:
       return "unacceptable IME notification message";
   }
 }
 
 nsIContent* IMEStateManager::sContent = nullptr;
 nsPresContext* IMEStateManager::sPresContext = nullptr;
 bool IMEStateManager::sInstalledMenuKeyboardListener = false;
-bool IMEStateManager::sIsTestingIME = false;
 bool IMEStateManager::sIsGettingNewIMEState = false;
 
 // sActiveIMEContentObserver points to the currently active IMEContentObserver.
 // sActiveIMEContentObserver is null if there is no focused editor.
 IMEContentObserver* IMEStateManager::sActiveIMEContentObserver = nullptr;
 TextCompositionArray* IMEStateManager::sTextCompositions = nullptr;
 
 // static
@@ -644,19 +643,33 @@ IMEStateManager::UpdateIMEState(const IM
   nsCOMPtr<nsIWidget> widget = sPresContext->GetRootWidget();
   if (NS_WARN_IF(!widget)) {
     MOZ_LOG(sISMLog, PR_LOG_ERROR,
       ("ISM:   IMEStateManager::UpdateIMEState(), FAILED due to "
        "no widget for the managing nsPresContext"));
     return;
   }
 
-  // If the IMEContentObserver instance isn't managing the editor's current
-  // editable root content, the editor frame might be reframed.  We should
-  // recreate the instance at that time.
+  // Even if there is active IMEContentObserver, it may not be observing the
+  // editor with current editable root content due to reframed.  In such case,
+  // We should try to reinitialize the IMEContentObserver.
+  if (sActiveIMEContentObserver && IsIMEObserverNeeded(aNewIMEState)) {
+    PR_LOG(sISMLog, PR_LOG_DEBUG,
+      ("ISM:   IMEStateManager::UpdateIMEState(), try to reinitialize the "
+       "active IMEContentObserver"));
+    if (!sActiveIMEContentObserver->MaybeReinitialize(widget, sPresContext,
+                                                      aContent, aEditor)) {
+      PR_LOG(sISMLog, PR_LOG_ERROR,
+        ("ISM:   IMEStateManager::UpdateIMEState(), failed to reinitialize the "
+         "active IMEContentObserver"));
+    }
+  }
+
+  // If there is no active IMEContentObserver or it isn't observing the
+  // editor correctly, we should recreate it.
   bool createTextStateManager =
     (!sActiveIMEContentObserver ||
      !sActiveIMEContentObserver->IsManaging(sPresContext, aContent));
 
   bool updateIMEState =
     (widget->GetInputContext().mIMEState.mEnabled != aNewIMEState.mEnabled);
 
   if (updateIMEState) {
@@ -1123,28 +1136,19 @@ IMEStateManager::GetRootEditableNode(nsP
       return document;
     }
   }
   return nullptr;
 }
 
 // static
 bool
-IMEStateManager::IsEditableIMEState(nsIWidget* aWidget)
+IMEStateManager::IsIMEObserverNeeded(const IMEState& aState)
 {
-  switch (aWidget->GetInputContext().mIMEState.mEnabled) {
-    case IMEState::ENABLED:
-    case IMEState::PASSWORD:
-      return true;
-    case IMEState::PLUGIN:
-    case IMEState::DISABLED:
-      return false;
-    default:
-      MOZ_CRASH("Unknown IME enable state");
-  }
+  return aState.IsEditable();
 }
 
 // static
 void
 IMEStateManager::DestroyIMEContentObserver()
 {
   MOZ_LOG(sISMLog, PR_LOG_ALWAYS,
     ("ISM: IMEStateManager::DestroyIMEContentObserver(), "
@@ -1188,30 +1192,24 @@ IMEStateManager::CreateIMEContentObserve
   nsCOMPtr<nsIWidget> widget = sPresContext->GetRootWidget();
   if (!widget) {
     MOZ_LOG(sISMLog, PR_LOG_ERROR,
       ("ISM:   IMEStateManager::CreateIMEContentObserver(), FAILED due to "
        "there is a root widget for the nsPresContext"));
     return; // Sometimes, there are no widgets.
   }
 
-  // If it's not text ediable, we don't need to create IMEContentObserver.
-  if (!IsEditableIMEState(widget)) {
+  // If it's not text editable, we don't need to create IMEContentObserver.
+  if (!IsIMEObserverNeeded(widget->GetInputContext().mIMEState)) {
     MOZ_LOG(sISMLog, PR_LOG_DEBUG,
       ("ISM:   IMEStateManager::CreateIMEContentObserver() doesn't create "
        "IMEContentObserver because of non-editable IME state"));
     return;
   }
 
-  static bool sInitializeIsTestingIME = true;
-  if (sInitializeIsTestingIME) {
-    Preferences::AddBoolVarCache(&sIsTestingIME, "test.IME", false);
-    sInitializeIsTestingIME = false;
-  }
-
   MOZ_LOG(sISMLog, PR_LOG_DEBUG,
     ("ISM:   IMEStateManager::CreateIMEContentObserver() is creating an "
      "IMEContentObserver instance..."));
   sActiveIMEContentObserver = new IMEContentObserver();
   NS_ADDREF(sActiveIMEContentObserver);
 
   // IMEContentObserver::Init() might create another IMEContentObserver
   // instance.  So, sActiveIMEContentObserver would be replaced with new one.

--- a/dom/events/IMEStateManager.h
+++ b/dom/events/IMEStateManager.h
@@ -133,17 +133,16 @@ public:
    * Send a notification to IME.  It depends on the IME or platform spec what
    * will occur (or not occur).
    */
   static nsresult NotifyIME(IMEMessage aMessage, nsIWidget* aWidget);
   static nsresult NotifyIME(IMEMessage aMessage, nsPresContext* aPresContext);
 
   static nsINode* GetRootEditableNode(nsPresContext* aPresContext,
                                       nsIContent* aContent);
-  static bool IsTestingIME() { return sIsTestingIME; }
 
 protected:
   static nsresult OnChangeFocusInternal(nsPresContext* aPresContext,
                                         nsIContent* aContent,
                                         InputContextAction aAction);
   static void SetIMEState(const IMEState &aState,
                           nsIContent* aContent,
                           nsIWidget* aWidget,
@@ -152,22 +151,21 @@ protected:
                                  nsIContent* aContent);
 
   static void EnsureTextCompositionArray();
   static void CreateIMEContentObserver(nsIEditor* aEditor);
   static void DestroyIMEContentObserver();
 
   static bool IsEditable(nsINode* node);
 
-  static bool IsEditableIMEState(nsIWidget* aWidget);
+  static bool IsIMEObserverNeeded(const IMEState& aState);
 
   static nsIContent*    sContent;
   static nsPresContext* sPresContext;
   static bool           sInstalledMenuKeyboardListener;
-  static bool           sIsTestingIME;
   static bool           sIsGettingNewIMEState;
 
   class MOZ_STACK_CLASS GettingNewIMEStateBlocker final
   {
   public:
     GettingNewIMEStateBlocker()
       : mOldValue(IMEStateManager::sIsGettingNewIMEState)
     {

--- a/dom/fetch/Fetch.cpp
+++ b/dom/fetch/Fetch.cpp
@@ -219,33 +219,44 @@ FetchRequest(nsIGlobalObject* aGlobal, c
 
   aRv = UpdateRequestReferrer(aGlobal, r);
   if (NS_WARN_IF(aRv.Failed())) {
     return nullptr;
   }
 
   if (NS_IsMainThread()) {
     nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(aGlobal);
-    if (!window) {
-      aRv.Throw(NS_ERROR_FAILURE);
-      return nullptr;
-    }
-
-    nsCOMPtr<nsIDocument> doc = window->GetExtantDoc();
-    if (!doc) {
-      aRv.Throw(NS_ERROR_FAILURE);
-      return nullptr;
+    nsCOMPtr<nsIDocument> doc;
+    nsCOMPtr<nsILoadGroup> loadGroup;
+    nsIPrincipal* principal;
+    if (window) {
+      doc = window->GetExtantDoc();
+      if (!doc) {
+        aRv.Throw(NS_ERROR_FAILURE);
+        return nullptr;
+      }
+      principal = doc->NodePrincipal();
+      loadGroup = doc->GetDocumentLoadGroup();
+    } else {
+      principal = aGlobal->PrincipalOrNull();
+      if (NS_WARN_IF(!principal)) {
+        aRv.Throw(NS_ERROR_FAILURE);
+        return nullptr;
+      }
+      nsresult rv = NS_NewLoadGroup(getter_AddRefs(loadGroup), principal);
+      if (NS_WARN_IF(NS_FAILED(rv))) {
+        aRv.Throw(rv);
+        return nullptr;
+      }
     }
 
     Telemetry::Accumulate(Telemetry::FETCH_IS_MAINTHREAD, 1);
 
     nsRefPtr<MainThreadFetchResolver> resolver = new MainThreadFetchResolver(p);
-    nsCOMPtr<nsILoadGroup> loadGroup = doc->GetDocumentLoadGroup();
-    nsRefPtr<FetchDriver> fetch =
-      new FetchDriver(r, doc->NodePrincipal(), loadGroup);
+    nsRefPtr<FetchDriver> fetch = new FetchDriver(r, principal, loadGroup);
     fetch->SetDocument(doc);
     aRv = fetch->Fetch(resolver);
     if (NS_WARN_IF(aRv.Failed())) {
       return nullptr;
     }
   } else {
     WorkerPrivate* worker = GetCurrentThreadWorkerPrivate();
     MOZ_ASSERT(worker);
@@ -406,16 +417,33 @@ UpdateRequestReferrer(nsIGlobalObject* a
   nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(aGlobal);
   if (window) {
     nsCOMPtr<nsIDocument> doc = window->GetExtantDoc();
     if (doc) {
       nsAutoString referrer;
       doc->GetReferrer(referrer);
       aRequest->SetReferrer(referrer);
     }
+  } else if (NS_IsMainThread()) {
+    // Pull the principal from the global for non-worker scripts.
+    nsIPrincipal *principal = aGlobal->PrincipalOrNull();
+    bool isNull;
+    // Only set the referrer if the principal is present,
+    // and the principal is not null or the system principal.
+    if (principal &&
+        NS_SUCCEEDED(principal->GetIsNullPrincipal(&isNull)) && !isNull &&
+        !nsContentUtils::IsSystemPrincipal(principal)) {
+      nsCOMPtr<nsIURI> uri;
+      if (NS_SUCCEEDED(principal->GetURI(getter_AddRefs(uri))) && uri) {
+        nsAutoCString referrer;
+        if (NS_SUCCEEDED(uri->GetSpec(referrer))) {
+          aRequest->SetReferrer(NS_ConvertUTF8toUTF16(referrer));
+        }
+      }
+    }
   } else {
     WorkerPrivate* worker = GetCurrentThreadWorkerPrivate();
     MOZ_ASSERT(worker);
     worker->AssertIsOnWorkerThread();
     WorkerPrivate::LocationInfo& info = worker->GetLocationInfo();
     aRequest->SetReferrer(NS_ConvertUTF8toUTF16(info.mHref));
   }
 

--- a/dom/html/nsHTMLDocument.cpp
+++ b/dom/html/nsHTMLDocument.cpp
@@ -3348,16 +3348,29 @@ nsHTMLDocument::QueryCommandEnabled(cons
 bool
 nsHTMLDocument::QueryCommandEnabled(const nsAString& commandID, ErrorResult& rv)
 {
   nsAutoCString cmdToDispatch;
   if (!ConvertToMidasInternalCommand(commandID, cmdToDispatch)) {
     return false;
   }
 
+  // cut & copy are always allowed
+  bool isCutCopy = commandID.LowerCaseEqualsLiteral("cut") ||
+                   commandID.LowerCaseEqualsLiteral("copy");
+  if (isCutCopy) {
+    return nsContentUtils::IsCutCopyAllowed();
+  }
+
+  // Report false for restricted commands
+  bool restricted = commandID.LowerCaseEqualsLiteral("paste");
+  if (restricted && !nsContentUtils::IsCallerChrome()) {
+    return false;
+  }
+
   // if editing is not on, bail
   if (!IsEditingOnAfterFlush()) {
     rv.Throw(NS_ERROR_FAILURE);
     return false;
   }
 
   // get command manager and dispatch command to our window if it's acceptable
   nsCOMPtr<nsICommandManager> cmdMgr;

--- a/dom/html/test/test_iframe_sandbox_navigation.html
+++ b/dom/html/test/test_iframe_sandbox_navigation.html
@@ -10,16 +10,17 @@ Implement HTML5 sandbox attribute for IF
   <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
 </head>
 <script type="application/javascript">
 /** Test for Bug 341604 - Implement HTML5 sandbox attribute for IFRAMEs **/
 /** Navigation tests Part 1**/
 
+SimpleTest.requestLongerTimeout(2); // slow on Android
 SimpleTest.waitForExplicitFinish();
 SimpleTest.requestFlakyTimeout("untriaged");
 // a postMessage handler that is used by sandboxed iframes without
 // 'allow-same-origin'/other windows to communicate pass/fail back to this main page.
 // it expects to be called with an object like {ok: true/false, desc:
 // <description of the test> which it then forwards to ok()
 window.addEventListener("message", receiveMessage, false);
 

--- a/dom/html/test/test_iframe_sandbox_navigation2.html
+++ b/dom/html/test/test_iframe_sandbox_navigation2.html
@@ -11,16 +11,17 @@ Implement HTML5 sandbox attribute for IF
   <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
 </head>
 <script type="application/javascript">
 /** Test for Bug 341604 - Implement HTML5 sandbox attribute for IFRAMEs **/
 /** Navigation tests Part 2**/
 
 SimpleTest.expectAssertions(0);
+SimpleTest.requestLongerTimeout(2); // slow on Android
 SimpleTest.waitForExplicitFinish();
 SimpleTest.requestFlakyTimeout("untriaged");
 // a postMessage handler that is used by sandboxed iframes without
 // 'allow-same-origin'/other windows to communicate pass/fail back to this main page.
 // it expects to be called with an object like {ok: true/false, desc:
 // <description of the test> which it then forwards to ok()
 window.addEventListener("message", receiveMessage, false);
 

--- a/dom/ipc/TabParent.cpp
+++ b/dom/ipc/TabParent.cpp
@@ -2241,16 +2241,24 @@ TabParent::HandleQueryContentEvent(Widge
 
       uint32_t baseOffset = aEvent.mInput.mOffset - mIMECompositionRectOffset;
       uint32_t endOffset = baseOffset + aEvent.mInput.mLength;
       aEvent.mReply.mRect.SetEmpty();
       for (uint32_t i = baseOffset; i < endOffset; i++) {
         aEvent.mReply.mRect =
           aEvent.mReply.mRect.Union(mIMECompositionRects[i]);
       }
+      if (aEvent.mInput.mOffset < mIMECacheText.Length()) {
+        aEvent.mReply.mString =
+          Substring(mIMECacheText, aEvent.mInput.mOffset,
+                    mIMECacheText.Length() >= aEvent.mInput.EndOffset() ?
+                      aEvent.mInput.mLength : UINT32_MAX);
+      } else {
+        aEvent.mReply.mString.Truncate();
+      }
       aEvent.mReply.mOffset = aEvent.mInput.mOffset;
       aEvent.mReply.mRect = aEvent.mReply.mRect - GetChildProcessOffset();
       aEvent.mReply.mWritingMode = mWritingMode;
       aEvent.mSucceeded = true;
     }
     break;
   case NS_QUERY_CARET_RECT:
     {

--- a/dom/media/CanvasCaptureMediaStream.h
+++ b/dom/media/CanvasCaptureMediaStream.h
@@ -1,16 +1,19 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-*/
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef mozilla_dom_CanvasCaptureMediaStream_h_
 #define mozilla_dom_CanvasCaptureMediaStream_h_
 
+#include "DOMMediaStream.h"
+#include "StreamBuffer.h"
+
 namespace mozilla {
 class DOMMediaStream;
 class MediaStreamListener;
 class SourceMediaStream;
 
 namespace layers {
 class Image;
 }

--- a/dom/media/IdpSandbox.jsm
+++ b/dom/media/IdpSandbox.jsm
@@ -202,17 +202,17 @@ IdpSandbox.prototype = {
 
     this.sandbox = Cu.Sandbox(principal, {
       sandboxName: 'IdP-' + this.source.host,
       wantComponents: false,
       wantExportHelpers: false,
       wantGlobalProperties: [
         'indexedDB', 'XMLHttpRequest', 'TextEncoder', 'TextDecoder',
         'URL', 'URLSearchParams', 'atob', 'btoa', 'Blob', 'crypto',
-        'rtcIdentityProvider'
+        'rtcIdentityProvider', 'fetch'
       ]
     });
     let registrar = this.sandbox.rtcIdentityProvider;
     if (!Cu.isXrayWrapper(registrar)) {
       throw new Error('IdP setup failed');
     }
 
     // have to use the ultimate URI, not the starting one to avoid

--- a/dom/media/MediaDecoderStateMachine.cpp
+++ b/dom/media/MediaDecoderStateMachine.cpp
@@ -1073,16 +1073,27 @@ MediaDecoderStateMachine::OnVideoDecoded
     }
 
     case DECODER_STATE_DECODING: {
       Push(video);
       if (mIsVideoPrerolling && DonePrerollingVideo()) {
         StopPrerollingVideo();
       }
 
+      // Schedule the state machine to send stream data as soon as possible or
+      // the VideoQueue() is empty before the Push().
+      // VideoQueue() is empty implies the state machine thread doesn't have
+      // precise time information about video frames. Once the first video
+      // frame pushed in the queue, schedule the state machine as soon as
+      // possible to render the video frame or delay the state machine thread
+      // accurately.
+      if (mAudioCaptured || VideoQueue().GetSize() == 1) {
+        ScheduleStateMachine();
+      }
+
       // For non async readers, if the requested video sample was slow to
       // arrive, increase the amount of audio we buffer to ensure that we
       // don't run out of audio. This is unnecessary for async readers,
       // since they decode audio and video on different threads so they
       // are unlikely to run out of decoded audio.
       if (mReader->IsAsync()) {
         return;
       }
@@ -1092,21 +1103,16 @@ MediaDecoderStateMachine::OnVideoDecoded
       {
         mLowAudioThresholdUsecs =
           std::min(THRESHOLD_FACTOR * DurationToUsecs(decodeTime), mAmpleAudioThresholdUsecs);
         mAmpleAudioThresholdUsecs = std::max(THRESHOLD_FACTOR * mLowAudioThresholdUsecs,
                                               mAmpleAudioThresholdUsecs);
         DECODER_LOG("Slow video decode, set mLowAudioThresholdUsecs=%lld mAmpleAudioThresholdUsecs=%lld",
                     mLowAudioThresholdUsecs, mAmpleAudioThresholdUsecs);
       }
-
-      // Schedule the state machine to send stream data as soon as possible.
-      if (mAudioCaptured) {
-        ScheduleStateMachine();
-      }
       return;
     }
     case DECODER_STATE_SEEKING: {
       if (!mCurrentSeek.Exists()) {
         // We've received a sample from a previous decode. Discard it.
         return;
       }
       if (mDropVideoUntilNextDiscontinuity) {
@@ -2954,19 +2960,17 @@ void MediaDecoderStateMachine::AdvanceFr
       OnPlaybackOffsetUpdate(frame->mOffset);
       if (VideoQueue().GetSize() == 0)
         break;
       frame = VideoQueue().PeekFront();
     }
     // Current frame has already been presented, wait until it's time to
     // present the next frame.
     if (frame && !currentFrame) {
-      int64_t now = IsPlaying() ? clock_time : mStartTime + mPlayDuration;
-
-      remainingTime = frame->mTime - now;
+      remainingTime = frame->mTime - clock_time;
     }
   }
 
   // Check to see if we don't have enough data to play up to the next frame.
   // If we don't, switch to buffering mode.
   if (mState == DECODER_STATE_DECODING &&
       mPlayState == MediaDecoder::PLAY_STATE_PLAYING &&
       mDecoder->IsExpectingMoreData()) {
@@ -3038,16 +3042,32 @@ void MediaDecoderStateMachine::AdvanceFr
       return;
     }
     MediaDecoder::FrameStatistics& frameStats = mDecoder->GetFrameStatistics();
     frameStats.NotifyPresentedFrame();
     remainingTime = currentFrame->GetEndTime() - clock_time;
     currentFrame = nullptr;
   }
 
+  // The remainingTime is negative (include zero):
+  // 1. When the clock_time is larger than the latest video frame's endtime.
+  // All the video frames should be rendered or dropped, nothing left in
+  // VideoQueue. And since the VideoQueue is empty, we don't need to wake up
+  // statemachine thread immediately, so set the remainingTime to default value.
+  // 2. Current frame's endtime is smaller than clock_time but there still exist
+  // newer frames in queue. Re-calculate the remainingTime.
+  if (remainingTime <= 0) {
+    VideoData* nextFrame = VideoQueue().PeekFront();
+    if (nextFrame) {
+      remainingTime = nextFrame->mTime - clock_time;
+    } else {
+      remainingTime = AUDIO_DURATION_USECS;
+    }
+  }
+
   int64_t delay = remainingTime / mPlaybackRate;
   if (delay > 0) {
     ScheduleStateMachineIn(delay);
   } else {
     ScheduleStateMachine();
   }
 }
 

--- a/dom/media/omx/MediaCodecReader.cpp
+++ b/dom/media/omx/MediaCodecReader.cpp
@@ -62,43 +62,16 @@ IsValidDurationUs(int64_t aDuration)
 }
 
 inline bool
 IsValidTimestampUs(int64_t aTimestamp)
 {
   return aTimestamp >= INT64_C(0);
 }
 
-MediaCodecReader::VideoResourceListener::VideoResourceListener(
-  MediaCodecReader* aReader)
-  : mReader(aReader)
-{
-}
-
-MediaCodecReader::VideoResourceListener::~VideoResourceListener()
-{
-  mReader = nullptr;
-}
-
-void
-MediaCodecReader::VideoResourceListener::codecReserved()
-{
-  if (mReader) {
-    mReader->VideoCodecReserved();
-  }
-}
-
-void
-MediaCodecReader::VideoResourceListener::codecCanceled()
-{
-  if (mReader) {
-    mReader->VideoCodecCanceled();
-  }
-}
-
 MediaCodecReader::TrackInputCopier::~TrackInputCopier()
 {
 }
 
 bool
 MediaCodecReader::TrackInputCopier::Copy(MediaBuffer* aSourceBuffer,
                                          sp<ABuffer> aCodecBuffer)
 {
@@ -271,17 +244,16 @@ MediaCodecReader::MediaCodecReader(Abstr
   , mIsWaitingResources(false)
   , mTextureClientIndexesLock("MediaCodecReader::mTextureClientIndexesLock")
   , mColorConverterBufferSize(0)
   , mParserMonitor("MediaCodecReader::mParserMonitor")
   , mParseDataFromCache(true)
   , mNextParserPosition(INT64_C(0))
   , mParsedDataLength(INT64_C(0))
 {
-  mVideoListener = new VideoResourceListener(this);
 }
 
 MediaCodecReader::~MediaCodecReader()
 {
 }
 
 nsresult
 MediaCodecReader::Init(MediaDecoderReader* aCloneDonor)
@@ -671,24 +643,16 @@ MediaCodecReader::ReadMetadata(MediaInfo
   // relies on IsWaitingMediaResources() function. And the waiting state will be
   // changed by binder thread, so we store the waiting state in a cache value to
   // make them in the same waiting state.
   UpdateIsWaitingMediaResources();
   if (IsWaitingMediaResources()) {
     return NS_OK;
   }
 
-  // Configure video codec after the codecReserved.
-  if (mVideoTrack.mSource != nullptr) {
-    if (!ConfigureMediaCodec(mVideoTrack)) {
-      DestroyMediaCodec(mVideoTrack);
-      return NS_ERROR_FAILURE;
-    }
-  }
-
   // TODO: start streaming
 
   if (!UpdateDuration()) {
     return NS_ERROR_FAILURE;
   }
 
   if (!UpdateAudioInfo()) {
     return NS_ERROR_FAILURE;
@@ -1290,42 +1254,45 @@ MediaCodecReader::CreateTaskQueues()
   }
 
   return true;
 }
 
 bool
 MediaCodecReader::CreateMediaCodecs()
 {
-  if (CreateMediaCodec(mLooper, mAudioTrack, false, nullptr) &&
-      CreateMediaCodec(mLooper, mVideoTrack, true, mVideoListener)) {
+  if (CreateMediaCodec(mLooper, mAudioTrack, nullptr) &&
+      CreateMediaCodec(mLooper, mVideoTrack, nullptr)) {
     return true;
   }
 
   return false;
 }
 
 bool
 MediaCodecReader::CreateMediaCodec(sp<ALooper>& aLooper,
                                    Track& aTrack,
-                                   bool aAsync,
                                    wp<MediaCodecProxy::CodecResourceListener> aListener)
 {
   if (aTrack.mSource != nullptr && aTrack.mCodec == nullptr) {
     sp<MetaData> sourceFormat = aTrack.mSource->getFormat();
 
     const char* mime;
     if (sourceFormat->findCString(kKeyMIMEType, &mime)) {
       aTrack.mCodec = MediaCodecProxy::CreateByType(aLooper, mime, false, aListener);
     }
 
     if (aTrack.mCodec == nullptr) {
       NS_WARNING("Couldn't create MediaCodecProxy");
       return false;
     }
+    if (!aTrack.mCodec->AskMediaCodecAndWait()) {
+      NS_WARNING("AskMediaCodecAndWait fail");
+      return false;
+    }
 
     if (!strcasecmp(mime, MEDIA_MIMETYPE_AUDIO_VORBIS)) {
       aTrack.mInputCopier = new VorbisInputCopier;
     } else {
       aTrack.mInputCopier = new TrackInputCopier;
     }
 
     uint32_t capability = MediaCodecProxy::kEmptyCapability;
@@ -1338,24 +1305,20 @@ MediaCodecReader::CreateMediaCodec(sp<AL
       GonkBufferQueue::createBufferQueue(&producer, &consumer);
       aTrack.mNativeWindow = new GonkNativeWindow(consumer);
       aTrack.mGraphicBufferProducer = producer;
 #else
       aTrack.mNativeWindow = new GonkNativeWindow();
 #endif
     }
 
-    if (!aAsync) {
-      // Pending configure() and start() to codecReserved() if the creation
-      // should be asynchronous.
-      if (!aTrack.mCodec->allocated() || !ConfigureMediaCodec(aTrack)){
-        NS_WARNING("Couldn't create and configure MediaCodec synchronously");
-        DestroyMediaCodec(aTrack);
-        return false;
-      }
+    if (!aTrack.mCodec->allocated() || !ConfigureMediaCodec(aTrack)) {
+      NS_WARNING("Couldn't create and configure MediaCodec synchronously");
+      DestroyMediaCodec(aTrack);
+      return false;
     }
   }
 
   return true;
 }
 
 bool
 MediaCodecReader::ConfigureMediaCodec(Track& aTrack)
@@ -1864,37 +1827,32 @@ MediaCodecReader::EnsureCodecFormatParse
   }
 
   status_t status = OK;
   size_t index = 0;
   size_t offset = 0;
   size_t size = 0;
   int64_t timeUs = INT64_C(0);
   uint32_t flags = 0;
+  FillCodecInputData(aTrack);
   while ((status = aTrack.mCodec->dequeueOutputBuffer(&index, &offset, &size,
                      &timeUs, &flags)) != INFO_FORMAT_CHANGED) {
     if (status == OK) {
       aTrack.mCodec->releaseOutputBuffer(index);
     } else if (status == INFO_OUTPUT_BUFFERS_CHANGED) {
       // Update output buffers of MediaCodec.
       if (aTrack.mCodec->getOutputBuffers(&aTrack.mOutputBuffers) != OK) {
         NS_WARNING("Couldn't get output buffers from MediaCodec");
         return false;
       }
-    } else if (status != -EAGAIN && status != INVALID_OPERATION){
+    } else if (status != -EAGAIN && status != INVALID_OPERATION) {
       // FIXME: let INVALID_OPERATION pass?
       return false; // something wrong!!!
     }
-
-    status = FillCodecInputData(aTrack);
-    if (status == INFO_FORMAT_CHANGED) {
-      break;
-    } else if (status != OK) {
-      return false;
-    }
+    FillCodecInputData(aTrack);
   }
   return aTrack.mCodec->getOutputFormat(&format) == OK;
 }
 
 uint8_t*
 MediaCodecReader::GetColorConverterBuffer(int32_t aWidth, int32_t aHeight)
 {
   // Allocate a temporary YUV420Planer buffer.
@@ -1912,27 +1870,9 @@ MediaCodecReader::GetColorConverterBuffe
 
 void
 MediaCodecReader::ClearColorConverterBuffer()
 {
   mColorConverterBuffer = nullptr;
   mColorConverterBufferSize = 0;
 }
 
-// Called on Binder thread.
-void
-MediaCodecReader::VideoCodecReserved()
-{
-  mDecoder->NotifyWaitingForResourcesStatusChanged();
-}
-
-// Called on Binder thread.
-void
-MediaCodecReader::VideoCodecCanceled()
-{
-  if (mVideoTrack.mTaskQueue) {
-    RefPtr<nsIRunnable> task =
-      NS_NewRunnableMethod(this, &MediaCodecReader::ReleaseCriticalResources);
-    mVideoTrack.mTaskQueue->Dispatch(task.forget());
-  }
-}
-
 } // namespace mozilla

--- a/dom/media/omx/MediaCodecReader.h
+++ b/dom/media/omx/MediaCodecReader.h
@@ -172,55 +172,28 @@ protected:
     Track(const Track &rhs) = delete;
     const Track &operator=(const Track&) = delete;
   };
 
   // Receive a message from MessageHandler.
   // Called on MediaCodecReader::mLooper thread.
   void onMessageReceived(const android::sp<android::AMessage>& aMessage);
 
-  // Receive a notify from ResourceListener.
-  // Called on Binder thread.
-  virtual void VideoCodecReserved();
-  virtual void VideoCodecCanceled();
-
   virtual bool CreateExtractor();
 
   // Check the underlying HW resource is available and store the result in
   // mIsWaitingResources.
   void UpdateIsWaitingMediaResources();
 
   android::sp<android::MediaExtractor> mExtractor;
   // A cache value updated by UpdateIsWaitingMediaResources(), makes the
   // "waiting resources state" is synchronous to StateMachine.
   bool mIsWaitingResources;
 
 private:
-
-  // An intermediary class that can be managed by android::sp<T>.
-  // Redirect codecReserved() and codecCanceled() to MediaCodecReader.
-  class VideoResourceListener : public android::MediaCodecProxy::CodecResourceListener
-  {
-  public:
-    VideoResourceListener(MediaCodecReader* aReader);
-    ~VideoResourceListener();
-
-    virtual void codecReserved();
-    virtual void codecCanceled();
-
-  private:
-    // Forbidden
-    VideoResourceListener() = delete;
-    VideoResourceListener(const VideoResourceListener& rhs) = delete;
-    const VideoResourceListener& operator=(const VideoResourceListener& rhs) = delete;
-
-    MediaCodecReader* mReader;
-  };
-  friend class VideoResourceListener;
-
   class VorbisInputCopier : public TrackInputCopier
   {
     virtual bool Copy(android::MediaBuffer* aSourceBuffer,
                       android::sp<android::ABuffer> aCodecBuffer);
   };
 
   struct AudioTrack : public Track
   {
@@ -349,17 +322,16 @@ private:
   void DestroyExtractor();
 
   bool CreateMediaSources();
   void DestroyMediaSources();
 
   bool CreateMediaCodecs();
   static bool CreateMediaCodec(android::sp<android::ALooper>& aLooper,
                                Track& aTrack,
-                               bool aAsync,
                                android::wp<android::MediaCodecProxy::CodecResourceListener> aListener);
   static bool ConfigureMediaCodec(Track& aTrack);
   void DestroyMediaCodecs();
   static void DestroyMediaCodec(Track& aTrack);
 
   bool CreateTaskQueues();
   void ShutdownTaskQueues();
   void DecodeVideoFrameTask(int64_t aTimeThreshold);
@@ -410,18 +382,16 @@ private:
   static PLDHashOperator ReleaseTextureClient(TextureClient* aClient,
                                               size_t& aIndex,
                                               void* aUserArg);
   PLDHashOperator ReleaseTextureClient(TextureClient* aClient,
                                        size_t& aIndex);
 
   void ReleaseAllTextureClients();
 
-  android::sp<VideoResourceListener> mVideoListener;
-
   android::sp<android::ALooper> mLooper;
   android::sp<android::MetaData> mMetaData;
 
   Mutex mTextureClientIndexesLock;
   nsDataHashtable<nsPtrHashKey<TextureClient>, size_t> mTextureClientIndexes;
 
   // media tracks
   AudioTrack mAudioTrack;

--- a/dom/media/tests/mochitest/identity/idp.js
+++ b/dom/media/tests/mochitest/identity/idp.js
@@ -16,22 +16,18 @@
     var path = global.location.pathname;
     this.protocol =
       path.substring(path.lastIndexOf('/') + 1) + global.location.hash;
     this.id = crypto.getRandomValues(new Uint8Array(10)).join('.');
   }
 
   IDPJS.prototype = {
     getLogin: function() {
-      var xhr = new XMLHttpRequest();
-      xhr.open('GET', 'https://example.com/.well-known/idp-proxy/idp.sjs?' + this.id);
-      return new Promise(resolve => {
-        xhr.onload = e => resolve(xhr.status === 200);
-        xhr.send();
-      });
+      return fetch('https://example.com/.well-known/idp-proxy/idp.sjs?' + this.id)
+        .then(response => response.status === 200);
     },
     checkLogin: function(result) {
       return this.getLogin()
         .then(loggedIn => {
           if (loggedIn) {
             return result;
           }
           return Promise.reject({

--- a/dom/tests/mochitest/bugs/test_bug346659.html
+++ b/dom/tests/mochitest/bugs/test_bug346659.html
@@ -14,16 +14,17 @@ https://bugzilla.mozilla.org/show_bug.cg
 <div id="content" style="display: none">
   
 </div>
 <pre id="test">
 <script type="application/javascript">
 
 /** Test for Bug 346659 **/
 var numTests = 10;
+SimpleTest.requestLongerTimeout(2); // test takes a long time on android and b2g emulators
 SimpleTest.waitForExplicitFinish();
 
 var wins = [];
 
 function r(base, tail) {
   return base.replace(/\/[^\/]*$/, "/" + tail);
 }
 

--- a/dom/tests/mochitest/fetch/test_fetch_basic.js
+++ b/dom/tests/mochitest/fetch/test_fetch_basic.js
@@ -34,16 +34,17 @@ function testDataURL() {
     });
   });
 }
 
 function testSameOriginBlobURL() {
   var blob = new Blob(["english ", "sentence"], { type: "text/plain" });
   var url = URL.createObjectURL(blob);
   return fetch(url).then(function(res) {
+    URL.revokeObjectURL(url);
     ok(true, "Blob URL fetch should resolve");
     if (res.type == "error") {
       ok(false, "Blob URL fetch should not fail.");
       return Promise.reject();
     }
     ok(res instanceof Response, "Fetch should resolve to a Response");
     is(res.status, 200, "Blob fetch status should be 200");
     is(res.statusText, "OK", "Blob fetch statusText should be OK");

--- a/editor/libeditor/tests/browserscope/lib/richtext2/currentStatus.js
+++ b/editor/libeditor/tests/browserscope/lib/richtext2/currentStatus.js
@@ -302,16 +302,25 @@ const knownFailures = {
     "QE-Proposed-INSERTLINEBREAK_TEXT-1-body": true,
     "QE-Proposed-INSERTLINEBREAK_TEXT-1-div": true,
     "QE-Proposed-CREATEBOOKMARK_TEXT-1-dM": true,
     "QE-Proposed-CREATEBOOKMARK_TEXT-1-body": true,
     "QE-Proposed-CREATEBOOKMARK_TEXT-1-div": true,
     "QE-Proposed-UNBOOKMARK_TEXT-1-dM": true,
     "QE-Proposed-UNBOOKMARK_TEXT-1-body": true,
     "QE-Proposed-UNBOOKMARK_TEXT-1-div": true,
+    "QE-Proposed-COPY_TEXT-1-dM": true,
+    "QE-Proposed-COPY_TEXT-1-body": true,
+    "QE-Proposed-COPY_TEXT-1-div": true,
+    "QE-Proposed-CUT_TEXT-1-dM": true,
+    "QE-Proposed-CUT_TEXT-1-body": true,
+    "QE-Proposed-CUT_TEXT-1-div": true,
+    "QE-Proposed-PASTE_TEXT-1-dM": true,
+    "QE-Proposed-PASTE_TEXT-1-body": true,
+    "QE-Proposed-PASTE_TEXT-1-div": true,
     "QS-Proposed-SUB_SPAN.sub-1-SI-dM": true,
     "QS-Proposed-SUB_SPAN.sub-1-SI-body": true,
     "QS-Proposed-SUB_SPAN.sub-1-SI-div": true,
     "QS-Proposed-SUB_MYSUB-1-SI-dM": true,
     "QS-Proposed-SUB_MYSUB-1-SI-body": true,
     "QS-Proposed-SUB_MYSUB-1-SI-div": true,
     "QS-Proposed-SUP_SPAN.sup-1-SI-dM": true,
     "QS-Proposed-SUP_SPAN.sup-1-SI-body": true,

--- a/editor/libeditor/tests/mochitest.ini
+++ b/editor/libeditor/tests/mochitest.ini
@@ -157,9 +157,10 @@ skip-if = toolkit == 'android' # bug 105
 [test_dom_input_event_on_texteditor.html]
 [test_keypress_untrusted_event.html]
 [test_root_element_replacement.html]
 [test_select_all_without_body.html]
 skip-if = e10s
 [test_spellcheck_pref.html]
 skip-if = toolkit == 'android'
 [test_bug1068979.html]
-[test_bug1109465.html]
\ No newline at end of file
+[test_bug1109465.html]
+[test_bug1162952.html]

new file mode 100644
--- /dev/null
+++ b/editor/libeditor/tests/test_bug1162952.html
@@ -0,0 +1,43 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1162952
+-->
+<head>
+  <title>Test for Bug 1162952</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1162952">Mozilla Bug 1162952</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+
+/** Test for Bug 1162952 **/
+var userCallbackRun = false;
+
+document.addEventListener('keydown', function() {
+    // During a user callback, the commands should be enabled
+    userCallbackRun = true;
+    is(true, document.queryCommandEnabled('cut'));
+    is(true, document.queryCommandEnabled('copy'));
+});
+
+// Otherwise, they should be disabled
+is(false, document.queryCommandEnabled('cut'));
+is(false, document.queryCommandEnabled('copy'));
+
+// Fire a user callback
+synthesizeKey('A', {});
+
+ok(userCallbackRun, "User callback should've been run");
+
+</script>
+</pre>
+</body>
+</html>

--- a/editor/libeditor/tests/test_bug408231.html
+++ b/editor/libeditor/tests/test_bug408231.html
@@ -40,17 +40,17 @@ https://bugzilla.mozilla.org/show_bug.cg
       ["insertunorderedlist", "true"],
       ["insertparagraph", "true"],
       ["italic", "true"],
       ["justifycenter", "true"],
       ["justifyfull", "true"],
       ["justifyleft", "true"],
       ["justifyright", "true"],
       ["outdent", "true"],
-      //["paste", "true"],
+      ["paste", "false"],
       ["redo", "false"],
       ["removeformat", "true"],
       ["selectall", "true"],
       ["strikethrough", "true"],
       ["styleWithCSS", "true"],
       ["subscript", "true"],
       ["superscript", "true"],
       ["underline", "true"],

--- a/editor/libeditor/tests/test_bug676401.html
+++ b/editor/libeditor/tests/test_bug676401.html
@@ -30,16 +30,17 @@ https://bugzilla.mozilla.org/show_bug.cg
 SimpleTest.waitForExplicitFinish();
 SimpleTest.waitForFocus(runTests);
 
 var gBlock1, gBlock2;
 
 var alwaysEnabledCommands = [
   "contentReadOnly",
   "copy",
+  "cut",
   "enableInlineTableEditing",
   "enableObjectResizing",
   "insertBrOnReturn",
   "selectAll",
   "styleWithCSS",
 ];
 
 function IsCommandEnabled(command) {
@@ -84,19 +85,22 @@ function runTests() {
     IsCommandEnabled(commands[i]);
 
   // Mozilla-specific stuff
   commands = ["enableInlineTableEditing", "enableObjectResizing", "insertBrOnReturn"];
   for (i = 0; i < commands.length; i++)
     IsCommandEnabled(commands[i]);
 
   // These are privileged, and available only to chrome.
-  commands = ["cut", "paste", "copy"];
+  commands = ["paste"];
   for (i = 0; i < commands.length; i++) {
-    IsCommandEnabled(commands[i]);
+    is(document.queryCommandEnabled(commands[i]), false,
+       "Command should not be enabled for non-privileged code");
+    is(SpecialPowers.wrap(document).queryCommandEnabled(commands[i]), true,
+       "Command should be enabled for privileged code");
     try {
       document.execCommand(commands[i], false, false);
       ok(false, "Thould have thrown: " + commands[i]);
     } catch (e) {
       ok(/insecure|denied/.test(e), "Threw correctly: " + commands[i] + " - " + e);
     }
     SpecialPowers.wrap(document).execCommand(commands[i], false, false);
   }

--- a/gfx/2d/Matrix.h
+++ b/gfx/2d/Matrix.h
@@ -148,17 +148,32 @@ public:
   {
     _11 *= aX;
     _12 *= aX;
     _21 *= aY;
     _22 *= aY;
 
     return *this;
   }
-  
+
+  /**
+   * Similar to PostTranslate, but applies a scale instead of a translation.
+   */
+  Matrix &PostScale(Float aScaleX, Float aScaleY)
+  {
+    _11 *= aScaleX;
+    _12 *= aScaleY;
+    _21 *= aScaleX;
+    _22 *= aScaleY;
+    _31 *= aScaleX;
+    _32 *= aScaleY;
+
+    return *this;
+  }
+
   GFX2D_API static Matrix Rotation(Float aAngle);
 
   /**
    * Similar to PreTranslate, but applies a rotation instead of a translation.
    */
   Matrix &PreRotate(Float aAngle)
   {
     return *this = Matrix::Rotation(aAngle) * *this;

--- a/gfx/layers/LayerScope.cpp
+++ b/gfx/layers/LayerScope.cpp
@@ -221,105 +221,91 @@ StaticAutoPtr<LayerScopeWebSocketManager
 class DebugGLData: public LinkedListElement<DebugGLData> {
 public:
     explicit DebugGLData(Packet::DataType aDataType)
         : mDataType(aDataType)
     { }
 
     virtual ~DebugGLData() { }
 
-    Packet::DataType GetDataType() const { return mDataType; }
-
     virtual bool Write() = 0;
 
+protected:
     static bool WriteToStream(Packet& aPacket) {
         if (!WebSocketHelper::GetSocketManager())
             return true;
 
         uint32_t size = aPacket.ByteSize();
         auto data = MakeUnique<uint8_t[]>(size);
         aPacket.SerializeToArray(data.get(), size);
         return WebSocketHelper::GetSocketManager()->WriteAll(data.get(), size);
     }
 
-protected:
     Packet::DataType mDataType;
 };
 
-class DebugGLFrameStatusData : public DebugGLData
+class DebugGLFrameStatusData final: public DebugGLData
 {
 public:
     DebugGLFrameStatusData(Packet::DataType aDataType,
                            int64_t aValue)
         : DebugGLData(aDataType),
           mFrameStamp(aValue)
     { }
 
     explicit DebugGLFrameStatusData(Packet::DataType aDataType)
         : DebugGLData(aDataType),
           mFrameStamp(0)
     { }
 
-    int64_t GetFrameStamp() const { return mFrameStamp; }
-
     virtual bool Write() override {
         Packet packet;
         packet.set_type(mDataType);
 
         FramePacket* fp = packet.mutable_frame();
         fp->set_value(static_cast<uint64_t>(mFrameStamp));
 
-        if (!WriteToStream(packet))
-            return false;
-        return true;
+        return WriteToStream(packet);
     }
 
 protected:
     int64_t mFrameStamp;
 };
 
-class DebugGLTextureData : public DebugGLData {
+class DebugGLTextureData final: public DebugGLData {
 public:
     DebugGLTextureData(GLContext* cx,
                        void* layerRef,
                        GLenum target,
                        GLuint name,
                        DataSourceSurface* img)
         : DebugGLData(Packet::TEXTURE),
-          mLayerRef(layerRef),
+          mLayerRef(reinterpret_cast<uint64_t>(layerRef)),
           mTarget(target),
           mName(name),
           mContextAddress(reinterpret_cast<intptr_t>(cx)),
           mDatasize(0)
     {
         // pre-packing
         // DataSourceSurface may have locked buffer,
         // so we should compress now, and then it could
         // be unlocked outside.
         pack(img);
     }
 
-    const void* GetLayerRef() const { return mLayerRef; }
-    GLuint GetName() const { return mName; }
-    GLenum GetTextureTarget() const { return mTarget; }
-    intptr_t GetContextAddress() const { return mContextAddress; }
-    uint32_t GetDataSize() const { return mDatasize; }
-
     virtual bool Write() override {
-        if (!WriteToStream(mPacket))
-            return false;
-        return true;
+        return WriteToStream(mPacket);
     }
 
 private:
     void pack(DataSourceSurface* aImage) {
         mPacket.set_type(mDataType);
 
         TexturePacket* tp = mPacket.mutable_texture();
-        tp->set_layerref(reinterpret_cast<uint64_t>(mLayerRef));
+        tp->set_layerref(mLayerRef);
         tp->set_name(mName);
         tp->set_target(mTarget);
         tp->set_dataformat(LOCAL_GL_RGBA);
         tp->set_glcontext(static_cast<uint64_t>(mContextAddress));
 
         if (aImage) {
             tp->set_width(aImage->GetSize().width);
             tp->set_height(aImage->GetSize().height);
@@ -347,83 +333,74 @@ private:
         } else {
             tp->set_width(0);
             tp->set_height(0);
             tp->set_stride(0);
         }
     }
 
 protected:
-    void* mLayerRef;
+    uint64_t mLayerRef;
     GLenum mTarget;
     GLuint mName;
     intptr_t mContextAddress;
     uint32_t mDatasize;
 
     // Packet data
     Packet mPacket;
 };
 
-class DebugGLColorData : public DebugGLData {
+class DebugGLColorData final: public DebugGLData {
 public:
     DebugGLColorData(void* layerRef,
                      const gfxRGBA& color,
                      int width,
                      int height)
         : DebugGLData(Packet::COLOR),
-          mLayerRef(layerRef),
+          mLayerRef(reinterpret_cast<uint64_t>(layerRef)),
           mColor(color.Packed()),
           mSize(width, height)
     { }
 
-    const void* GetLayerRef() const { return mLayerRef; }
-    uint32_t GetColor() const { return mColor; }
-    const nsIntSize& GetSize() const { return mSize; }
-
     virtual bool Write() override {
         Packet packet;
         packet.set_type(mDataType);
 
         ColorPacket* cp = packet.mutable_color();
-        cp->set_layerref(reinterpret_cast<uint64_t>(mLayerRef));
+        cp->set_layerref(mLayerRef);
         cp->set_color(mColor);
         cp->set_width(mSize.width);
         cp->set_height(mSize.height);
 
-        if (!WriteToStream(packet))
-            return false;
-        return true;
+        return WriteToStream(packet);
     }
 
 protected:
-    void* mLayerRef;
+    uint64_t mLayerRef;
     uint32_t mColor;
     nsIntSize mSize;
 };
 
-class DebugGLLayersData : public DebugGLData {
+class DebugGLLayersData final: public DebugGLData {
 public:
     explicit DebugGLLayersData(UniquePtr<Packet> aPacket)
         : DebugGLData(Packet::LAYERS),
           mPacket(Move(aPacket))
     { }
 
     virtual bool Write() override {
         mPacket->set_type(mDataType);
-
-        if (!WriteToStream(*mPacket))
-            return false;
-        return true;
+        return WriteToStream(*mPacket);
     }
 
 protected:
     UniquePtr<Packet> mPacket;
 };
 
-class DebugGLMetaData : public DebugGLData
+class DebugGLMetaData final: public DebugGLData
 {
 public:
     DebugGLMetaData(Packet::DataType aDataType,
                     bool aValue)
         : DebugGLData(aDataType),
           mComposedByHwc(aValue)
     { }
 
@@ -434,25 +411,79 @@ public:
 
     virtual bool Write() override {
         Packet packet;
         packet.set_type(mDataType);
 
         MetaPacket* mp = packet.mutable_meta();
         mp->set_composedbyhwc(mComposedByHwc);
 
-        if (!WriteToStream(packet))
-            return false;
-        return true;
+        return WriteToStream(packet);
     }
 
 protected:
     bool mComposedByHwc;
 };
 
+class DebugGLDrawData final: public DebugGLData {
+public:
+    DebugGLDrawData(float aOffsetX,
+                    float aOffsetY,
+                    const gfx::Matrix4x4& aMVMatrix,
+                    size_t aRects,
+                    const gfx::Rect* aLayerRects,
+                    void* aLayerRef)
+        : DebugGLData(Packet::DRAW),
+          mOffsetX(aOffsetX),
+          mOffsetY(aOffsetY),
+          mMVMatrix(aMVMatrix),
+          mRects(aRects),
+          mLayerRef(reinterpret_cast<uint64_t>(aLayerRef))
+    {
+        for (size_t i = 0; i < mRects; i++){
+            mLayerRects[i] = aLayerRects[i];
+        }
+    }
+
+    virtual bool Write() override {
+        Packet packet;
+        packet.set_type(mDataType);
+
+        DrawPacket* dp = packet.mutable_draw();
+        dp->set_layerref(mLayerRef);
+
+        dp->set_offsetx(mOffsetX);
+        dp->set_offsety(mOffsetY);
+
+        auto element = reinterpret_cast<Float *>(&mMVMatrix);
+        for (int i = 0; i < 16; i++) {
+          dp->add_mvmatrix(*element++);
+        }
+        dp->set_totalrects(mRects);
+
+        MOZ_ASSERT(mRects > 0 && mRects < 4);
+        for (size_t i = 0; i < mRects; i++) {
+            layerscope::DrawPacket::Rect* pRect = dp->add_layerrect();
+            pRect->set_x(mLayerRects[i].x);
+            pRect->set_y(mLayerRects[i].y);
+            pRect->set_w(mLayerRects[i].width);
+            pRect->set_h(mLayerRects[i].height);
+        }
+
+        return WriteToStream(packet);
+    }
+
+protected:
+    float mOffsetX;
+    float mOffsetY;
+    gfx::Matrix4x4 mMVMatrix;
+    size_t mRects;
+    gfx::Rect mLayerRects[4];
+    uint64_t mLayerRef;
+};
 
 class DebugListener : public nsIServerSocketListener
 {
     virtual ~DebugListener() { }
 
 public:
 
     NS_DECL_THREADSAFE_ISUPPORTS
@@ -798,17 +829,16 @@ SenderHelper::SendEffectChain(GLContext*
         default:
             break;
     }
 
     //const Effect* secondaryEffect = aEffectChain.mSecondaryEffects[EffectTypes::MASK];
     // TODO:
 }
 
-
 // ----------------------------------------------
 // LayerScopeWebSocketHandler implementation
 // ----------------------------------------------
 void
 LayerScopeWebSocketHandler::OpenStream(nsISocketTransport* aTransport)
 {
     MOZ_ASSERT(aTransport);
 
@@ -1291,26 +1321,117 @@ LayerScope::Init()
             return;
         }
         DebugOnly<nsresult> rv = NS_DispatchToMainThread(new CreateServerSocketRunnable());
         MOZ_ASSERT(NS_SUCCEEDED(rv), "Failed to dispatch WebSocket Creation to main thread");
         dispatched = true;
     }
 }
 
+class DrawSession {
+public:
+    NS_INLINE_DECL_REFCOUNTING(DrawSession)
+
+    DrawSession()
+      : mOffsetX(0.0),
+        mOffsetY(0.0),
+        mRects(0)
+    { }
+
+    float mOffsetX;
+    float mOffsetY;
+    gfx::Matrix4x4 mMVMatrix;
+    size_t mRects;
+    gfx::Rect mLayerRects[4];
+private:
+    ~DrawSession() {}
+};
+
+class DrawSessionHolder {
+public:
+    static void setSession(DrawSession *aSession) {
+        mSession = aSession;
+    }
+
+    static DrawSession& current() {
+        return *mSession;
+    }
+
+private:
+    static nsRefPtr<DrawSession> mSession;
+};
+
+nsRefPtr<DrawSession> DrawSessionHolder::mSession;
+
 void
-LayerScope::SendEffectChain(gl::GLContext* aGLContext,
-                            const EffectChain& aEffectChain,
-                            int aWidth,
-                            int aHeight)
+LayerScope::DrawBegin()
+{
+    if (!CheckSendable()) {
+        return;
+    }
+
+    DrawSessionHolder::setSession(new DrawSession());
+}
+
+void LayerScope::SetRenderOffset(float aX, float aY)
+{
+    if (!CheckSendable()) {
+        return;
+    }
+
+    DrawSessionHolder::current().mOffsetX = aX;
+    DrawSessionHolder::current().mOffsetY = aY;
+}
+
+void LayerScope::SetLayerTransform(const gfx::Matrix4x4& aMatrix)
+{
+    if (!CheckSendable()) {
+        return;
+    }
+
+    DrawSessionHolder::current().mMVMatrix = aMatrix;
+}
+
+void LayerScope::SetLayerRects(size_t aRects, const gfx::Rect* aLayerRects)
+{
+    if (!CheckSendable()) {
+        return;
+    }
+
+    MOZ_ASSERT(aRects > 0 && aRects <= 4);
+    MOZ_ASSERT(aLayerRects);
+
+    DrawSessionHolder::current().mRects = aRects;
+
+    for (size_t i = 0; i < aRects; i++){
+        DrawSessionHolder::current().mLayerRects[i] = aLayerRects[i];
+    }
+}
+
+void
+LayerScope::DrawEnd(gl::GLContext* aGLContext,
+                    const EffectChain& aEffectChain,
+                    int aWidth,
+                    int aHeight)
 {
     // Protect this public function
     if (!CheckSendable()) {
         return;
     }
+
+    // 1. Send parameters of draw call, such as uniforms and attributes of
+    // vertex adnd fragment shader.
+    DrawSession& draws = DrawSessionHolder::current();
+    WebSocketHelper::GetSocketManager()->AppendDebugData(
+        new DebugGLDrawData(draws.mOffsetX, draws.mOffsetY,
+                            draws.mMVMatrix, draws.mRects,
+                            draws.mLayerRects,
+                            aEffectChain.mLayerRef));
+
+    // 2. Send textures.
     SenderHelper::SendEffectChain(aGLContext, aEffectChain, aWidth, aHeight);
 }
 
 void
 LayerScope::SendLayer(LayerComposite* aLayer,
                       int aWidth,
                       int aHeight)
 {
@@ -1354,17 +1475,16 @@ LayerScope::CheckSendable()
 void
 LayerScope::CleanLayer()
 {
     if (CheckSendable()) {
         WebSocketHelper::GetSocketManager()->CleanDebugData();
     }
 }
 
-
 void
 LayerScope::SetHWComposed()
 {
     if (CheckSendable()) {
         WebSocketHelper::GetSocketManager()->AppendDebugData(
             new DebugGLMetaData(Packet::META, true));
     }
 }

--- a/gfx/layers/LayerScope.h
+++ b/gfx/layers/LayerScope.h
@@ -18,20 +18,25 @@ namespace layers {
 
 namespace layerscope { class Packet; }
 
 struct EffectChain;
 class LayerComposite;
 
 class LayerScope {
 public:
-    static void SendEffectChain(gl::GLContext* aGLContext,
-                                const EffectChain& aEffectChain,
-                                int aWidth,
-                                int aHeight);
+    static void DrawBegin();
+    static void SetRenderOffset(float aX, float aY);
+    static void SetLayerTransform(const gfx::Matrix4x4& aMatrix);
+    static void SetLayerRects(size_t aRects, const gfx::Rect* aLayerRects);
+    static void DrawEnd(gl::GLContext* aGLContext,
+                        const EffectChain& aEffectChain,
+                        int aWidth,
+                        int aHeight);
+
     static void SendLayer(LayerComposite* aLayer,
                           int aWidth,
                           int aHeight);
     static void SendLayerDump(UniquePtr<layerscope::Packet> aPacket);
     static bool CheckSendable();
     static void CleanLayer();
     static void SetHWComposed();
 

--- a/gfx/layers/composite/TextureHost.cpp
+++ b/gfx/layers/composite/TextureHost.cpp
@@ -139,20 +139,49 @@ TextureHost::AsTextureHost(PTextureParen
 }
 
 PTextureParent*
 TextureHost::GetIPDLActor()
 {
   return mActor;
 }
 
+bool
+TextureHost::SetReleaseFenceHandle(const FenceHandle& aReleaseFenceHandle)
+{
+  if (!aReleaseFenceHandle.IsValid()) {
+    // HWC might not provide Fence.
+    // In this case, HWC implicitly handles buffer's fence.
+    return false;
+  }
+
+  mReleaseFenceHandle.Merge(aReleaseFenceHandle);
+
+  return true;
+}
+
 FenceHandle
 TextureHost::GetAndResetReleaseFenceHandle()
 {
-  return FenceHandle();
+  FenceHandle fence;
+  mReleaseFenceHandle.TransferToAnotherFenceHandle(fence);
+  return fence;
+}
+
+void
+TextureHost::SetAcquireFenceHandle(const FenceHandle& aAcquireFenceHandle)
+{
+  mAcquireFenceHandle = aAcquireFenceHandle;
+}
+
+FenceHandle
+TextureHost::GetAndResetAcquireFenceHandle()
+{
+  nsRefPtr<FenceHandle::FdObj> fdObj = mAcquireFenceHandle.GetAndResetFdObj();
+  return FenceHandle(fdObj);
 }
 
 // implemented in TextureHostOGL.cpp
 TemporaryRef<TextureHost> CreateTextureHostOGL(const SurfaceDescriptor& aDesc,
                                                ISurfaceAllocator* aDeallocator,
                                                TextureFlags aFlags);
 
 // implemented in TextureHostBasic.cpp

--- a/gfx/layers/composite/TextureHost.h
+++ b/gfx/layers/composite/TextureHost.h
@@ -465,18 +465,16 @@ public:
   /**
    * Return a pointer to the IPDLActor.
    *
    * This is to be used with IPDL messages only. Do not store the returned
    * pointer.
    */
   PTextureParent* GetIPDLActor();
 
-  virtual FenceHandle GetAndResetReleaseFenceHandle();
-
   /**
    * Specific to B2G's Composer2D
    * XXX - more doc here
    */
   virtual LayerRenderState GetRenderState()
   {
     // By default we return an empty render state, this should be overridden
     // by the TextureHost implementations that are used on B2G with Composer2D
@@ -495,35 +493,54 @@ public:
 
   /**
    * Indicates whether the TextureHost implementation is backed by an
    * in-memory buffer. The consequence of this is that locking the
    * TextureHost does not contend with locking the texture on the client side.
    */
   virtual bool HasInternalBuffer() const { return false; }
 
-  /**
-   * Cast to a TextureHost for each backend.
-   */
-  virtual TextureHostOGL* AsHostOGL() { return nullptr; }
-
   void AddCompositableRef() { ++mCompositableCount; }
 
   void ReleaseCompositableRef()
   {
     --mCompositableCount;
     MOZ_ASSERT(mCompositableCount >= 0);
     if (mCompositableCount == 0) {
       UnbindTextureSource();
     }
   }
 
   int NumCompositableRefs() const { return mCompositableCount; }
 
+  /**
+   * Store a fence that will signal when the current buffer is no longer being read.
+   * Similar to android's GLConsumer::setReleaseFence()
+   */
+  bool SetReleaseFenceHandle(const FenceHandle& aReleaseFenceHandle);
+
+  /**
+   * Return a releaseFence's Fence and clear a reference to the Fence.
+   */
+  FenceHandle GetAndResetReleaseFenceHandle();
+
+  void SetAcquireFenceHandle(const FenceHandle& aAcquireFenceHandle);
+
+  /**
+   * Return a acquireFence's Fence and clear a reference to the Fence.
+   */
+  FenceHandle GetAndResetAcquireFenceHandle();
+
+  virtual void WaitAcquireFenceHandleSyncComplete() {};
+
 protected:
+  FenceHandle mReleaseFenceHandle;
+
+  FenceHandle mAcquireFenceHandle;
+
   void RecycleTexture(TextureFlags aFlags);
 
   PTextureParent* mActor;
   TextureFlags mFlags;
   int mCompositableCount;
 
   friend class TextureParent;
 };

--- a/gfx/layers/ipc/CompositableTransactionParent.cpp
+++ b/gfx/layers/ipc/CompositableTransactionParent.cpp
@@ -174,20 +174,17 @@ CompositableParentManager::ReceiveCompos
 
       MOZ_ASSERT(tex.get());
       compositable->UseTextureHost(tex);
 
       MaybeFence maybeFence = op.fence();
       if (maybeFence.type() == MaybeFence::TFenceHandle) {
         FenceHandle fence = maybeFence.get_FenceHandle();
         if (fence.IsValid() && tex) {
-          TextureHostOGL* hostOGL = tex->AsHostOGL();
-          if (hostOGL) {
-            hostOGL->SetAcquireFence(fence);
-          }
+          tex->SetAcquireFenceHandle(fence);
         }
       }
 
       if (IsAsync() && compositable->GetLayer()) {
         ScheduleComposition(op);
         // Async layer updates don't trigger invalidation, manually tell the layer
         // that its content have changed.
         compositable->GetLayer()->SetInvalidRectToVisibleRegion();

--- a/gfx/layers/opengl/CompositorOGL.cpp
+++ b/gfx/layers/opengl/CompositorOGL.cpp
@@ -427,16 +427,17 @@ CompositorOGL::BindAndDrawQuadWithTextur
                                               TextureSource *aTexture)
 {
   Rect layerRects[4];
   Rect textureRects[4];
   size_t rects = DecomposeIntoNoRepeatRects(aRect,
                                             aTexCoordRect,
                                             &layerRects,
                                             &textureRects);
+
   BindAndDrawQuads(aProg, rects, layerRects, textureRects);
 }
 
 void
 CompositorOGL::PrepareViewport(const gfx::IntSize& aSize)
 {
   // Set the viewport correctly.
   mGLContext->fViewport(0, 0, aSize.width, aSize.height);
@@ -914,34 +915,32 @@ CompositorOGL::DrawQuad(const Rect& aRec
 
   MOZ_ASSERT(mFrameInProgress, "frame not started");
   MOZ_ASSERT(mCurrentRenderTarget, "No destination");
 
   if (aEffectChain.mPrimaryEffect->mType == EffectTypes::VR_DISTORTION) {
     DrawVRDistortion(aRect, aClipRect, aEffectChain, aOpacity, aTransform);
     return;
   }
+  LayerScope::DrawBegin();
 
   Rect clipRect = aClipRect;
   // aClipRect is in destination coordinate space (after all
   // transforms and offsets have been applied) so if our
   // drawing is going to be shifted by mRenderOffset then we need
   // to shift the clip rect by the same amount.
   if (!mTarget && mCurrentRenderTarget->IsWindow()) {
     clipRect.MoveBy(mRenderOffset.x, mRenderOffset.y);
   }
   IntRect intClipRect;
   clipRect.ToIntRect(&intClipRect);
 
   gl()->fScissor(intClipRect.x, FlipY(intClipRect.y + intClipRect.height),
                  intClipRect.width, intClipRect.height);
 
-  LayerScope::SendEffectChain(mGLContext, aEffectChain,
-                              aRect.width, aRect.height);
-
   MaskType maskType;
   EffectMask* effectMask;
   TextureSourceOGL* sourceMask = nullptr;
   gfx::Matrix4x4 maskQuadTransform;
   if (aEffectChain.mSecondaryEffects[EffectTypes::MASK]) {
     effectMask = static_cast<EffectMask*>(aEffectChain.mSecondaryEffects[EffectTypes::MASK].get());
     sourceMask = effectMask->mMaskTexture->AsSourceOGL();
 
@@ -1004,25 +1003,27 @@ CompositorOGL::DrawQuad(const Rect& aRec
 
   bool colorMatrix = aEffectChain.mSecondaryEffects[EffectTypes::COLOR_MATRIX];
   ShaderConfigOGL config = GetShaderConfigFor(aEffectChain.mPrimaryEffect, maskType, blendMode, colorMatrix);
   config.SetOpacity(aOpacity != 1.f);
   ShaderProgramOGL *program = GetShaderProgramFor(config);
   ActivateProgram(program);
   program->SetProjectionMatrix(mProjMatrix);
   program->SetLayerTransform(aTransform);
-
+  LayerScope::SetLayerTransform(aTransform);
   if (colorMatrix) {
       EffectColorMatrix* effectColorMatrix =
         static_cast<EffectColorMatrix*>(aEffectChain.mSecondaryEffects[EffectTypes::COLOR_MATRIX].get());
       program->SetColorMatrix(effectColorMatrix->mColorMatrix);
   }
 
   IntPoint offset = mCurrentRenderTarget->GetOrigin();
   program->SetRenderOffset(offset.x, offset.y);
+  LayerScope::SetRenderOffset(offset.x, offset.y);
+
   if (aOpacity != 1.f)
     program->SetLayerOpacity(aOpacity);
   if (config.mFeatures & ENABLE_TEXTURE_RECT) {
     TexturedEffect* texturedEffect =
         static_cast<TexturedEffect*>(aEffectChain.mPrimaryEffect.get());
     TextureSourceOGL* source = texturedEffect->mTexture->AsSourceOGL();
     // This is used by IOSurface that use 0,0...w,h coordinate rather then 0,0..1,1.
     program->SetTexCoordMultiplier(source->GetSize().width, source->GetSize().height);
@@ -1211,16 +1212,17 @@ CompositorOGL::DrawQuad(const Rect& aRec
 
   if (didSetBlendMode) {
     gl()->fBlendFuncSeparate(LOCAL_GL_ONE, LOCAL_GL_ONE_MINUS_SRC_ALPHA,
                              LOCAL_GL_ONE, LOCAL_GL_ONE);
   }
 
   // in case rendering has used some other GL context
   MakeCurrent();
+  LayerScope::DrawEnd(mGLContext, aEffectChain, aRect.width, aRect.height);
 }
 
 void
 CompositorOGL::EndFrame()
 {
   PROFILER_LABEL("CompositorOGL", "EndFrame",
     js::ProfileEntry::Category::GRAPHICS);
 
@@ -1472,16 +1474,17 @@ CompositorOGL::BindAndDrawQuads(ShaderPr
   aProg->SetLayerRects(aLayerRects);
   if (aProg->GetTextureCount() > 0) {
     aProg->SetTextureRects(aTextureRects);
   }
 
   // We are using GL_TRIANGLES here because the Mac Intel drivers fail to properly
   // process uniform arrays with GL_TRIANGLE_STRIP. Go figure.
   mGLContext->fDrawArrays(LOCAL_GL_TRIANGLES, 0, 6 * aQuads);
+  LayerScope::SetLayerRects(aQuads, aLayerRects);
 }
 
 GLBlitTextureImageHelper*
 CompositorOGL::BlitTextureImageHelper()
 {
     if (!mBlitTextureImageHelper) {
         mBlitTextureImageHelper = MakeUnique<GLBlitTextureImageHelper>(this);
     }

--- a/gfx/layers/opengl/GrallocTextureHost.cpp
+++ b/gfx/layers/opengl/GrallocTextureHost.cpp
@@ -3,27 +3,29 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "base/process.h"
 #include "GLContext.h"
 #include "gfx2DGlue.h"
 #include <ui/GraphicBuffer.h>
 #include "GrallocImages.h"  // for GrallocImage
+#include "GLLibraryEGL.h"   // for GLLibraryEGL
 #include "mozilla/gfx/2D.h"
 #include "mozilla/gfx/DataSurfaceHelpers.h"
 #include "mozilla/layers/GrallocTextureHost.h"
 #include "mozilla/layers/SharedBufferManagerParent.h"
 #include "EGLImageHelpers.h"
 #include "GLReadTexImageHelper.h"
 
 namespace mozilla {
 namespace layers {
 
 using namespace android;
+using namespace mozilla::gl;
 
 static gfx::SurfaceFormat
 SurfaceFormatForAndroidPixelFormat(android::PixelFormat aFormat,
                                    TextureFlags aFlags)
 {
   bool swapRB = bool(aFlags & TextureFlags::RB_SWAPPED);
   switch (aFormat) {
   case android::PIXEL_FORMAT_BGRA_8888:
@@ -258,22 +260,16 @@ GrallocTextureHostOGL::UnbindTextureSour
   // detached, Although decreasing the refcount of the TextureSource may lead
   // to the gl handle being destroyed, which would unlock the gralloc buffer.
   // That said, this method is called before another TextureHost attaches to the
   // TextureSource, which has the effect of unlocking the gralloc buffer. So when
   // this is called we know we are going to be unlocked soon.
   mGLTextureSource = nullptr;
 }
 
-FenceHandle
-GrallocTextureHostOGL::GetAndResetReleaseFenceHandle()
-{
-  return GetAndResetReleaseFence();
-}
-
 GLenum GetTextureTarget(gl::GLContext* aGL, android::PixelFormat aFormat) {
   MOZ_ASSERT(aGL);
   if (aGL->Renderer() == gl::GLRenderer::SGX530 ||
       aGL->Renderer() == gl::GLRenderer::SGX540) {
     // SGX has a quirk that only TEXTURE_EXTERNAL works and any other value will
     // result in black pixels when trying to draw from bound textures.
     // Unfortunately, using TEXTURE_EXTERNAL on Adreno has a terrible effect on
     // performance.
@@ -377,16 +373,52 @@ GrallocTextureHostOGL::PrepareTextureSou
 
     gl->fEGLImageTargetTexture2D(textureTarget, mEGLImage);
     glSource->SetSize(mSize);
     glSource->SetFormat(mFormat);
     mGLTextureSource = glSource;
   }
 }
 
+void
+GrallocTextureHostOGL::WaitAcquireFenceHandleSyncComplete()
+{
+  if (!mAcquireFenceHandle.IsValid()) {
+    return;
+  }
+
+  nsRefPtr<FenceHandle::FdObj> fence = mAcquireFenceHandle.GetAndResetFdObj();
+  int fenceFd = fence->GetAndResetFd();
+
+  EGLint attribs[] = {
+              LOCAL_EGL_SYNC_NATIVE_FENCE_FD_ANDROID, fenceFd,
+              LOCAL_EGL_NONE
+          };
+
+  EGLSync sync = sEGLLibrary.fCreateSync(EGL_DISPLAY(),
+                                         LOCAL_EGL_SYNC_NATIVE_FENCE_ANDROID,
+                                         attribs);
+  if (!sync) {
+    NS_WARNING("failed to create native fence sync");
+    return;
+  }
+
+  // Wait sync complete with timeout.
+  // If a source of the fence becomes invalid because of error,
+  // fene complete is not signaled. See Bug 1061435.
+  EGLint status = sEGLLibrary.fClientWaitSync(EGL_DISPLAY(),
+                                              sync,
+                                              0,
+                                              400000000 /*400 usec*/);
+  if (status != LOCAL_EGL_CONDITION_SATISFIED) {
+    NS_ERROR("failed to wait native fence sync");
+  }
+  MOZ_ALWAYS_TRUE( sEGLLibrary.fDestroySync(EGL_DISPLAY(), sync) );
+}
+
 bool
 GrallocTextureHostOGL::BindTextureSource(CompositableTextureSourceRef& aTextureSource)
 {
   // This happens at composition time.
 
   // If mGLTextureSource is null it means PrepareTextureSource failed.
   if (!mGLTextureSource) {
     return false;
@@ -395,15 +427,15 @@ GrallocTextureHostOGL::BindTextureSource
   // If Prepare didn't fail, we expect our TextureSource to be the same as aTextureSource,
   // otherwise it means something has fiddled with the TextureSource between Prepare and
   // now.
   MOZ_ASSERT(mGLTextureSource == aTextureSource);
   aTextureSource = mGLTextureSource.get();
 
 #if defined(MOZ_WIDGET_GONK) && ANDROID_VERSION >= 17
   // Wait until it's ready.
-  WaitAcquireFenceSyncComplete();
+  WaitAcquireFenceHandleSyncComplete();
 #endif
   return true;
 }
 
 } // namepsace layers
 } // namepsace mozilla

--- a/gfx/layers/opengl/GrallocTextureHost.h
+++ b/gfx/layers/opengl/GrallocTextureHost.h
@@ -11,17 +11,16 @@
 #include "mozilla/layers/TextureHostOGL.h"
 #include "mozilla/layers/ShadowLayerUtilsGralloc.h"
 #include <ui/GraphicBuffer.h>
 
 namespace mozilla {
 namespace layers {
 
 class GrallocTextureHostOGL : public TextureHost
-                            , public TextureHostOGL
 {
   friend class GrallocBufferActor;
 public:
   GrallocTextureHostOGL(TextureFlags aFlags,
                         const NewSurfaceDescriptorGralloc& aDescriptor);
 
   virtual ~GrallocTextureHostOGL();
 
@@ -46,26 +45,19 @@ public:
   virtual LayerRenderState GetRenderState() override;
 
   virtual void PrepareTextureSource(CompositableTextureSourceRef& aTextureSource) override;
 
   virtual bool BindTextureSource(CompositableTextureSourceRef& aTextureSource) override;
 
   virtual void UnbindTextureSource() override;
 
-  virtual FenceHandle GetAndResetReleaseFenceHandle() override;
+  virtual TemporaryRef<gfx::DataSourceSurface> GetAsSurface() override;
 
-#if defined(MOZ_WIDGET_GONK) && ANDROID_VERSION >= 17
-  virtual TextureHostOGL* AsHostOGL() override
-  {
-    return this;
-  }
-#endif
-
-  virtual TemporaryRef<gfx::DataSourceSurface> GetAsSurface() override;
+  virtual void WaitAcquireFenceHandleSyncComplete() override;
 
   bool IsValid() const;
 
   virtual const char* Name() override { return "GrallocTextureHostOGL"; }
 
   gl::GLContext* GetGLContext() const { return mCompositor ? mCompositor->gl() : nullptr; }
 
 private:

--- a/gfx/layers/opengl/TextureHostOGL.cpp
+++ b/gfx/layers/opengl/TextureHostOGL.cpp
@@ -106,87 +106,16 @@ FlagsToGLFlags(TextureFlags aFlags)
     result |= TextureImage::OriginBottomLeft;
   if (aFlags & TextureFlags::DISALLOW_BIGIMAGE)
     result |= TextureImage::DisallowBigImage;
 
   return static_cast<gl::TextureImage::Flags>(result);
 }
 
 bool
-TextureHostOGL::SetReleaseFence(const FenceHandle& aReleaseFence)
-{
-  if (!aReleaseFence.IsValid()) {
-    // HWC might not provide Fence.
-    // In this case, HWC implicitly handles buffer's fence.
-    return false;
-  }
-
-  mReleaseFence.Merge(aReleaseFence);
-
-  return true;
-}
-
-FenceHandle
-TextureHostOGL::GetAndResetReleaseFence()
-{
-  FenceHandle fence;
-  mReleaseFence.TransferToAnotherFenceHandle(fence);
-  return fence;
-}
-
-void
-TextureHostOGL::SetAcquireFence(const FenceHandle& aAcquireFence)
-{
-  mAcquireFence = aAcquireFence;
-}
-
-FenceHandle
-TextureHostOGL::GetAndResetAcquireFence()
-{
-  nsRefPtr<FenceHandle::FdObj> fdObj = mAcquireFence.GetAndResetFdObj();
-  return FenceHandle(fdObj);
-}
-
-void
-TextureHostOGL::WaitAcquireFenceSyncComplete()
-{
-  if (!mAcquireFence.IsValid()) {
-    return;
-  }
-
-  nsRefPtr<FenceHandle::FdObj> fence = mAcquireFence.GetAndResetFdObj();
-  int fenceFd = fence->GetAndResetFd();
-
-  EGLint attribs[] = {
-              LOCAL_EGL_SYNC_NATIVE_FENCE_FD_ANDROID, fenceFd,
-              LOCAL_EGL_NONE
-          };
-
-  EGLSync sync = sEGLLibrary.fCreateSync(EGL_DISPLAY(),
-                                         LOCAL_EGL_SYNC_NATIVE_FENCE_ANDROID,
-                                         attribs);
-  if (!sync) {
-    NS_WARNING("failed to create native fence sync");
-    return;
-  }
-
-  // Wait sync complete with timeout.
-  // If a source of the fence becomes invalid because of error,
-  // fene complete is not signaled. See Bug 1061435.
-  EGLint status = sEGLLibrary.fClientWaitSync(EGL_DISPLAY(),
-                                              sync,
-                                              0,
-                                              400000000 /*400 usec*/);
-  if (status != LOCAL_EGL_CONDITION_SATISFIED) {
-    NS_ERROR("failed to wait native fence sync");
-  }
-  MOZ_ALWAYS_TRUE( sEGLLibrary.fDestroySync(EGL_DISPLAY(), sync) );
-}
-
-bool
 TextureImageTextureSourceOGL::Update(gfx::DataSourceSurface* aSurface,
                                      nsIntRegion* aDestRegion,
                                      gfx::IntPoint* aSrcOffset)
 {
   GLContext *gl = mCompositor->gl();
   MOZ_ASSERT(gl);
   if (!gl) {
     NS_WARNING("trying to update TextureImageTextureSourceOGL without a GLContext");

--- a/gfx/layers/opengl/TextureHostOGL.h
+++ b/gfx/layers/opengl/TextureHostOGL.h
@@ -118,48 +118,16 @@ public:
   void ClearCachedFilter() { mHasCachedFilter = false; }
 
 private:
   gfx::Filter mCachedFilter;
   bool mHasCachedFilter;
 };
 
 /**
- * TextureHostOGL provides the necessary API for platform specific composition.
- */
-class TextureHostOGL
-{
-public:
-  /**
-   * Store a fence that will signal when the current buffer is no longer being read.
-   * Similar to android's GLConsumer::setReleaseFence()
-   */
-  virtual bool SetReleaseFence(const FenceHandle& aReleaseFence);
-
-  /**
-   * Return a releaseFence's Fence and clear a reference to the Fence.
-   */
-  virtual FenceHandle GetAndResetReleaseFence();
-
-  virtual void SetAcquireFence(const FenceHandle& aAcquireFence);
-
-  /**
-   * Return a acquireFence's Fence and clear a reference to the Fence.
-   */
-  virtual FenceHandle GetAndResetAcquireFence();
-
-  virtual void WaitAcquireFenceSyncComplete();
-
-protected:
-  FenceHandle mReleaseFence;
-
-  FenceHandle mAcquireFence;
-};
-
-/**
  * A TextureSource backed by a TextureImage.
  *
  * Depending on the underlying TextureImage, may support texture tiling, so
  * make sure to check AsBigImageIterator() and use the texture accordingly.
  *
  * This TextureSource can be used without a TextureHost and manage it's own
  * GL texture(s).
  */

--- a/gfx/layers/protobuf/LayerScopePacket.pb.cc
+++ b/gfx/layers/protobuf/LayerScopePacket.pb.cc
@@ -21,16 +21,18 @@ void protobuf_ShutdownFile_LayerScopePac
   delete LayersPacket::default_instance_;
   delete LayersPacket_Layer::default_instance_;
   delete LayersPacket_Layer_Size::default_instance_;
   delete LayersPacket_Layer_Rect::default_instance_;
   delete LayersPacket_Layer_Region::default_instance_;
   delete LayersPacket_Layer_Matrix::default_instance_;
   delete LayersPacket_Layer_Shadow::default_instance_;
   delete MetaPacket::default_instance_;
+  delete DrawPacket::default_instance_;
+  delete DrawPacket_Rect::default_instance_;
   delete Packet::default_instance_;
   delete CommandPacket::default_instance_;
 }
 
 void protobuf_AddDesc_LayerScopePacket_2eproto() {
   static bool already_here = false;
   if (already_here) return;
   already_here = true;
@@ -42,29 +44,33 @@ void protobuf_AddDesc_LayerScopePacket_2
   LayersPacket::default_instance_ = new LayersPacket();
   LayersPacket_Layer::default_instance_ = new LayersPacket_Layer();
   LayersPacket_Layer_Size::default_instance_ = new LayersPacket_Layer_Size();
   LayersPacket_Layer_Rect::default_instance_ = new LayersPacket_Layer_Rect();
   LayersPacket_Layer_Region::default_instance_ = new LayersPacket_Layer_Region();
   LayersPacket_Layer_Matrix::default_instance_ = new LayersPacket_Layer_Matrix();
   LayersPacket_Layer_Shadow::default_instance_ = new LayersPacket_Layer_Shadow();
   MetaPacket::default_instance_ = new MetaPacket();
+  DrawPacket::default_instance_ = new DrawPacket();
+  DrawPacket_Rect::default_instance_ = new DrawPacket_Rect();
   Packet::default_instance_ = new Packet();
   CommandPacket::default_instance_ = new CommandPacket();
   FramePacket::default_instance_->InitAsDefaultInstance();
   ColorPacket::default_instance_->InitAsDefaultInstance();
   TexturePacket::default_instance_->InitAsDefaultInstance();
   LayersPacket::default_instance_->InitAsDefaultInstance();
   LayersPacket_Layer::default_instance_->InitAsDefaultInstance();
   LayersPacket_Layer_Size::default_instance_->InitAsDefaultInstance();
   LayersPacket_Layer_Rect::default_instance_->InitAsDefaultInstance();
   LayersPacket_Layer_Region::default_instance_->InitAsDefaultInstance();
   LayersPacket_Layer_Matrix::default_instance_->InitAsDefaultInstance();
   LayersPacket_Layer_Shadow::default_instance_->InitAsDefaultInstance();
   MetaPacket::default_instance_->InitAsDefaultInstance();
+  DrawPacket::default_instance_->InitAsDefaultInstance();
+  DrawPacket_Rect::default_instance_->InitAsDefaultInstance();
   Packet::default_instance_->InitAsDefaultInstance();
   CommandPacket::default_instance_->InitAsDefaultInstance();
   ::google::protobuf::internal::OnShutdown(&protobuf_ShutdownFile_LayerScopePacket_2eproto);
 }
 
 // Force AddDescriptors() to be called at static initialization time.
 struct StaticDescriptorInitializer_LayerScopePacket_2eproto {
   StaticDescriptorInitializer_LayerScopePacket_2eproto() {
@@ -3187,91 +3193,688 @@ void MetaPacket::Swap(MetaPacket* other)
 
 ::std::string MetaPacket::GetTypeName() const {
   return "mozilla.layers.layerscope.MetaPacket";
 }
 
 
 // ===================================================================
 
+#ifndef _MSC_VER
+const int DrawPacket_Rect::kXFieldNumber;
+const int DrawPacket_Rect::kYFieldNumber;
+const int DrawPacket_Rect::kWFieldNumber;
+const int DrawPacket_Rect::kHFieldNumber;
+#endif  // !_MSC_VER
+
+DrawPacket_Rect::DrawPacket_Rect()
+  : ::google::protobuf::MessageLite() {
+  SharedCtor();
+}
+
+void DrawPacket_Rect::InitAsDefaultInstance() {
+}
+
+DrawPacket_Rect::DrawPacket_Rect(const DrawPacket_Rect& from)
+  : ::google::protobuf::MessageLite() {
+  SharedCtor();
+  MergeFrom(from);
+}
+
+void DrawPacket_Rect::SharedCtor() {
+  _cached_size_ = 0;
+  x_ = 0;
+  y_ = 0;
+  w_ = 0;
+  h_ = 0;
+  ::memset(_has_bits_, 0, sizeof(_has_bits_));
+}
+
+DrawPacket_Rect::~DrawPacket_Rect() {
+  SharedDtor();
+}
+
+void DrawPacket_Rect::SharedDtor() {
+  if (this != default_instance_) {
+  }
+}
+
+void DrawPacket_Rect::SetCachedSize(int size) const {
+  GOOGLE_SAFE_CONCURRENT_WRITES_BEGIN();
+  _cached_size_ = size;
+  GOOGLE_SAFE_CONCURRENT_WRITES_END();
+}
+const DrawPacket_Rect& DrawPacket_Rect::default_instance() {
+  if (default_instance_ == NULL) protobuf_AddDesc_LayerScopePacket_2eproto();  return *default_instance_;
+}
+
+DrawPacket_Rect* DrawPacket_Rect::default_instance_ = NULL;
+
+DrawPacket_Rect* DrawPacket_Rect::New() const {
+  return new DrawPacket_Rect;
+}
+
+void DrawPacket_Rect::Clear() {
+  if (_has_bits_[0 / 32] & (0xffu << (0 % 32))) {
+    x_ = 0;
+    y_ = 0;
+    w_ = 0;
+    h_ = 0;
+  }
+  ::memset(_has_bits_, 0, sizeof(_has_bits_));
+}
+
+bool DrawPacket_Rect::MergePartialFromCodedStream(
+    ::google::protobuf::io::CodedInputStream* input) {
+#define DO_(EXPRESSION) if (!(EXPRESSION)) return false
+  ::google::protobuf::uint32 tag;
+  while ((tag = input->ReadTag()) != 0) {
+    switch (::google::protobuf::internal::WireFormatLite::GetTagFieldNumber(tag)) {
+      // required float x = 1;
+      case 1: {
+        if (::google::protobuf::internal::WireFormatLite::GetTagWireType(tag) ==
+            ::google::protobuf::internal::WireFormatLite::WIRETYPE_FIXED32) {
+          DO_((::google::protobuf::internal::WireFormatLite::ReadPrimitive<
+                   float, ::google::protobuf::internal::WireFormatLite::TYPE_FLOAT>(
+                 input, &x_)));
+          set_has_x();
+        } else {
+          goto handle_uninterpreted;
+        }
+        if (input->ExpectTag(21)) goto parse_y;
+        break;
+      }
+      
+      // required float y = 2;
+      case 2: {
+        if (::google::protobuf::internal::WireFormatLite::GetTagWireType(tag) ==
+            ::google::protobuf::internal::WireFormatLite::WIRETYPE_FIXED32) {
+         parse_y:
+          DO_((::google::protobuf::internal::WireFormatLite::ReadPrimitive<
+                   float, ::google::protobuf::internal::WireFormatLite::TYPE_FLOAT>(
+                 input, &y_)));
+          set_has_y();
+        } else {
+          goto handle_uninterpreted;
+        }
+        if (input->ExpectTag(29)) goto parse_w;
+        break;
+      }
+      
+      // required float w = 3;
+      case 3: {
+        if (::google::protobuf::internal::WireFormatLite::GetTagWireType(tag) ==
+            ::google::protobuf::internal::WireFormatLite::WIRETYPE_FIXED32) {
+         parse_w:
+          DO_((::google::protobuf::internal::WireFormatLite::ReadPrimitive<
+                   float, ::google::protobuf::internal::WireFormatLite::TYPE_FLOAT>(
+                 input, &w_)));
+          set_has_w();
+        } else {
+          goto handle_uninterpreted;
+        }
+        if (input->ExpectTag(37)) goto parse_h;
+        break;
+      }
+      
+      // required float h = 4;
+      case 4: {
+        if (::google::protobuf::internal::WireFormatLite::GetTagWireType(tag) ==
+            ::google::protobuf::internal::WireFormatLite::WIRETYPE_FIXED32) {
+         parse_h:
+          DO_((::google::protobuf::internal::WireFormatLite::ReadPrimitive<
+                   float, ::google::protobuf::internal::WireFormatLite::TYPE_FLOAT>(
+                 input, &h_)));
+          set_has_h();
+        } else {
+          goto handle_uninterpreted;
+        }
+        if (input->ExpectAtEnd()) return true;
+        break;
+      }
+      
+      default: {
+      handle_uninterpreted:
+        if (::google::protobuf::internal::WireFormatLite::GetTagWireType(tag) ==
+            ::google::protobuf::internal::WireFormatLite::WIRETYPE_END_GROUP) {
+          return true;
+        }
+        DO_(::google::protobuf::internal::WireFormatLite::SkipField(input, tag));
+        break;
+      }
+    }
+  }
+  return true;
+#undef DO_
+}
+
+void DrawPacket_Rect::SerializeWithCachedSizes(
+    ::google::protobuf::io::CodedOutputStream* output) const {
+  // required float x = 1;
+  if (has_x()) {
+    ::google::protobuf::internal::WireFormatLite::WriteFloat(1, this->x(), output);
+  }
+  
+  // required float y = 2;
+  if (has_y()) {
+    ::google::protobuf::internal::WireFormatLite::WriteFloat(2, this->y(), output);
+  }
+  
+  // required float w = 3;
+  if (has_w()) {
+    ::google::protobuf::internal::WireFormatLite::WriteFloat(3, this->w(), output);
+  }
+  
+  // required float h = 4;
+  if (has_h()) {
+    ::google::protobuf::internal::WireFormatLite::WriteFloat(4, this->h(), output);
+  }
+  
+}
+
+int DrawPacket_Rect::ByteSize() const {
+  int total_size = 0;
+  
+  if (_has_bits_[0 / 32] & (0xffu << (0 % 32))) {
+    // required float x = 1;
+    if (has_x()) {
+      total_size += 1 + 4;
+    }
+    
+    // required float y = 2;
+    if (has_y()) {
+      total_size += 1 + 4;
+    }
+    
+    // required float w = 3;
+    if (has_w()) {
+      total_size += 1 + 4;
+    }
+    
+    // required float h = 4;
+    if (has_h()) {
+      total_size += 1 + 4;
+    }
+    
+  }
+  GOOGLE_SAFE_CONCURRENT_WRITES_BEGIN();
+  _cached_size_ = total_size;
+  GOOGLE_SAFE_CONCURRENT_WRITES_END();
+  return total_size;
+}
+
+void DrawPacket_Rect::CheckTypeAndMergeFrom(
+    const ::google::protobuf::MessageLite& from) {
+  MergeFrom(*::google::protobuf::down_cast<const DrawPacket_Rect*>(&from));
+}
+
+void DrawPacket_Rect::MergeFrom(const DrawPacket_Rect& from) {
+  GOOGLE_CHECK_NE(&from, this);
+  if (from._has_bits_[0 / 32] & (0xffu << (0 % 32))) {
+    if (from.has_x()) {
+      set_x(from.x());
+    }
+    if (from.has_y()) {
+      set_y(from.y());
+    }
+    if (from.has_w()) {
+      set_w(from.w());
+    }
+    if (from.has_h()) {
+      set_h(from.h());
+    }
+  }
+}
+
+void DrawPacket_Rect::CopyFrom(const DrawPacket_Rect& from) {
+  if (&from == this) return;
+  Clear();
+  MergeFrom(from);
+}
+
+bool DrawPacket_Rect::IsInitialized() const {
+  if ((_has_bits_[0] & 0x0000000f) != 0x0000000f) return false;
+  
+  return true;
+}
+
+void DrawPacket_Rect::Swap(DrawPacket_Rect* other) {
+  if (other != this) {
+    std::swap(x_, other->x_);
+    std::swap(y_, other->y_);
+    std::swap(w_, other->w_);
+    std::swap(h_, other->h_);
+    std::swap(_has_bits_[0], other->_has_bits_[0]);
+    std::swap(_cached_size_, other->_cached_size_);
+  }
+}
+
+::std::string DrawPacket_Rect::GetTypeName() const {
+  return "mozilla.layers.layerscope.DrawPacket.Rect";
+}
+
+
+// -------------------------------------------------------------------
+
+#ifndef _MSC_VER
+const int DrawPacket::kOffsetXFieldNumber;
+const int DrawPacket::kOffsetYFieldNumber;
+const int DrawPacket::kMvMatrixFieldNumber;
+const int DrawPacket::kTotalRectsFieldNumber;
+const int DrawPacket::kLayerRectFieldNumber;
+const int DrawPacket::kLayerrefFieldNumber;
+#endif  // !_MSC_VER
+
+DrawPacket::DrawPacket()
+  : ::google::protobuf::MessageLite() {
+  SharedCtor();
+}
+
+void DrawPacket::InitAsDefaultInstance() {
+}
+
+DrawPacket::DrawPacket(const DrawPacket& from)
+  : ::google::protobuf::MessageLite() {
+  SharedCtor();
+  MergeFrom(from);
+}
+
+void DrawPacket::SharedCtor() {
+  _cached_size_ = 0;
+  offsetx_ = 0;
+  offsety_ = 0;
+  totalrects_ = 0u;
+  layerref_ = GOOGLE_ULONGLONG(0);
+  ::memset(_has_bits_, 0, sizeof(_has_bits_));
+}
+
+DrawPacket::~DrawPacket() {
+  SharedDtor();
+}
+
+void DrawPacket::SharedDtor() {
+  if (this != default_instance_) {
+  }
+}
+
+void DrawPacket::SetCachedSize(int size) const {
+  GOOGLE_SAFE_CONCURRENT_WRITES_BEGIN();
+  _cached_size_ = size;
+  GOOGLE_SAFE_CONCURRENT_WRITES_END();
+}
+const DrawPacket& DrawPacket::default_instance() {
+  if (default_instance_ == NULL) protobuf_AddDesc_LayerScopePacket_2eproto();  return *default_instance_;
+}
+
+DrawPacket* DrawPacket::default_instance_ = NULL;
+
+DrawPacket* DrawPacket::New() const {
+  return new DrawPacket;
+}
+
+void DrawPacket::Clear() {
+  if (_has_bits_[0 / 32] & (0xffu << (0 % 32))) {
+    offsetx_ = 0;
+    offsety_ = 0;
+    totalrects_ = 0u;
+    layerref_ = GOOGLE_ULONGLONG(0);
+  }
+  mvmatrix_.Clear();
+  layerrect_.Clear();
+  ::memset(_has_bits_, 0, sizeof(_has_bits_));
+}
+
+bool DrawPacket::MergePartialFromCodedStream(
+    ::google::protobuf::io::CodedInputStream* input) {
+#define DO_(EXPRESSION) if (!(EXPRESSION)) return false
+  ::google::protobuf::uint32 tag;
+  while ((tag = input->ReadTag()) != 0) {
+    switch (::google::protobuf::internal::WireFormatLite::GetTagFieldNumber(tag)) {
+      // required float offsetX = 1;
+      case 1: {
+        if (::google::protobuf::internal::WireFormatLite::GetTagWireType(tag) ==
+            ::google::protobuf::internal::WireFormatLite::WIRETYPE_FIXED32) {
+          DO_((::google::protobuf::internal::WireFormatLite::ReadPrimitive<
+                   float, ::google::protobuf::internal::WireFormatLite::TYPE_FLOAT>(
+                 input, &offsetx_)));
+          set_has_offsetx();
+        } else {
+          goto handle_uninterpreted;
+        }
+        if (input->ExpectTag(21)) goto parse_offsetY;
+        break;
+      }
+      
+      // required float offsetY = 2;
+      case 2: {
+        if (::google::protobuf::internal::WireFormatLite::GetTagWireType(tag) ==
+            ::google::protobuf::internal::WireFormatLite::WIRETYPE_FIXED32) {
+         parse_offsetY:
+          DO_((::google::protobuf::internal::WireFormatLite::ReadPrimitive<
+                   float, ::google::protobuf::internal::WireFormatLite::TYPE_FLOAT>(
+                 input, &offsety_)));
+          set_has_offsety();
+        } else {
+          goto handle_uninterpreted;
+        }
+        if (input->ExpectTag(29)) goto parse_mvMatrix;
+        break;
+      }
+      
+      // repeated float mvMatrix = 3;
+      case 3: {
+        if (::google::protobuf::internal::WireFormatLite::GetTagWireType(tag) ==
+            ::google::protobuf::internal::WireFormatLite::WIRETYPE_FIXED32) {
+         parse_mvMatrix:
+          DO_((::google::protobuf::internal::WireFormatLite::ReadRepeatedPrimitive<
+                   float, ::google::protobuf::internal::WireFormatLite::TYPE_FLOAT>(
+                 1, 29, input, this->mutable_mvmatrix())));
+        } else if (::google::protobuf::internal::WireFormatLite::GetTagWireType(tag)
+                   == ::google::protobuf::internal::WireFormatLite::
+                      WIRETYPE_LENGTH_DELIMITED) {
+          DO_((::google::protobuf::internal::WireFormatLite::ReadPackedPrimitiveNoInline<
+                   float, ::google::protobuf::internal::WireFormatLite::TYPE_FLOAT>(
+                 input, this->mutable_mvmatrix())));
+        } else {
+          goto handle_uninterpreted;
+        }
+        if (input->ExpectTag(29)) goto parse_mvMatrix;
+        if (input->ExpectTag(32)) goto parse_totalRects;
+        break;
+      }
+      
+      // required uint32 totalRects = 4;
+      case 4: {
+        if (::google::protobuf::internal::WireFormatLite::GetTagWireType(tag) ==
+            ::google::protobuf::internal::WireFormatLite::WIRETYPE_VARINT) {
+         parse_totalRects:
+          DO_((::google::protobuf::internal::WireFormatLite::ReadPrimitive<
+                   ::google::protobuf::uint32, ::google::protobuf::internal::WireFormatLite::TYPE_UINT32>(
+                 input, &totalrects_)));
+          set_has_totalrects();
+        } else {
+          goto handle_uninterpreted;
+        }
+        if (input->ExpectTag(42)) goto parse_layerRect;
+        break;
+      }
+      
+      // repeated .mozilla.layers.layerscope.DrawPacket.Rect layerRect = 5;
+      case 5: {
+        if (::google::protobuf::internal::WireFormatLite::GetTagWireType(tag) ==
+            ::google::protobuf::internal::WireFormatLite::WIRETYPE_LENGTH_DELIMITED) {
+         parse_layerRect:
+          DO_(::google::protobuf::internal::WireFormatLite::ReadMessageNoVirtual(
+                input, add_layerrect()));
+        } else {
+          goto handle_uninterpreted;
+        }
+        if (input->ExpectTag(42)) goto parse_layerRect;
+        if (input->ExpectTag(48)) goto parse_layerref;
+        break;
+      }
+      
+      // required uint64 layerref = 6;
+      case 6: {
+        if (::google::protobuf::internal::WireFormatLite::GetTagWireType(tag) ==
+            ::google::protobuf::internal::WireFormatLite::WIRETYPE_VARINT) {
+         parse_layerref:
+          DO_((::google::protobuf::internal::WireFormatLite::ReadPrimitive<
+                   ::google::protobuf::uint64, ::google::protobuf::internal::WireFormatLite::TYPE_UINT64>(
+                 input, &layerref_)));
+          set_has_layerref();
+        } else {
+          goto handle_uninterpreted;
+        }
+        if (input->ExpectAtEnd()) return true;
+        break;
+      }
+      
+      default: {
+      handle_uninterpreted:
+        if (::google::protobuf::internal::WireFormatLite::GetTagWireType(tag) ==
+            ::google::protobuf::internal::WireFormatLite::WIRETYPE_END_GROUP) {
+          return true;
+        }
+        DO_(::google::protobuf::internal::WireFormatLite::SkipField(input, tag));
+        break;
+      }
+    }
+  }
+  return true;
+#undef DO_
+}
+
+void DrawPacket::SerializeWithCachedSizes(
+    ::google::protobuf::io::CodedOutputStream* output) const {
+  // required float offsetX = 1;
+  if (has_offsetx()) {
+    ::google::protobuf::internal::WireFormatLite::WriteFloat(1, this->offsetx(), output);
+  }
+  
+  // required float offsetY = 2;
+  if (has_offsety()) {
+    ::google::protobuf::internal::WireFormatLite::WriteFloat(2, this->offsety(), output);
+  }
+  
+  // repeated float mvMatrix = 3;
+  for (int i = 0; i < this->mvmatrix_size(); i++) {
+    ::google::protobuf::internal::WireFormatLite::WriteFloat(
+      3, this->mvmatrix(i), output);
+  }
+  
+  // required uint32 totalRects = 4;
+  if (has_totalrects()) {
+    ::google::protobuf::internal::WireFormatLite::WriteUInt32(4, this->totalrects(), output);
+  }
+  
+  // repeated .mozilla.layers.layerscope.DrawPacket.Rect layerRect = 5;
+  for (int i = 0; i < this->layerrect_size(); i++) {
+    ::google::protobuf::internal::WireFormatLite::WriteMessage(
+      5, this->layerrect(i), output);
+  }
+  
+  // required uint64 layerref = 6;
+  if (has_layerref()) {
+    ::google::protobuf::internal::WireFormatLite::WriteUInt64(6, this->layerref(), output);
+  }
+  
+}
+
+int DrawPacket::ByteSize() const {
+  int total_size = 0;
+  
+  if (_has_bits_[0 / 32] & (0xffu << (0 % 32))) {
+    // required float offsetX = 1;
+    if (has_offsetx()) {
+      total_size += 1 + 4;
+    }
+    
+    // required float offsetY = 2;
+    if (has_offsety()) {
+      total_size += 1 + 4;
+    }
+    
+    // required uint32 totalRects = 4;
+    if (has_totalrects()) {
+      total_size += 1 +
+        ::google::protobuf::internal::WireFormatLite::UInt32Size(
+          this->totalrects());
+    }
+    
+    // required uint64 layerref = 6;
+    if (has_layerref()) {
+      total_size += 1 +
+        ::google::protobuf::internal::WireFormatLite::UInt64Size(
+          this->layerref());
+    }
+    
+  }
+  // repeated float mvMatrix = 3;
+  {
+    int data_size = 0;
+    data_size = 4 * this->mvmatrix_size();
+    total_size += 1 * this->mvmatrix_size() + data_size;
+  }
+  
+  // repeated .mozilla.layers.layerscope.DrawPacket.Rect layerRect = 5;
+  total_size += 1 * this->layerrect_size();
+  for (int i = 0; i < this->layerrect_size(); i++) {
+    total_size +=
+      ::google::protobuf::internal::WireFormatLite::MessageSizeNoVirtual(
+        this->layerrect(i));
+  }
+  
+  GOOGLE_SAFE_CONCURRENT_WRITES_BEGIN();
+  _cached_size_ = total_size;
+  GOOGLE_SAFE_CONCURRENT_WRITES_END();
+  return total_size;
+}
+
+void DrawPacket::CheckTypeAndMergeFrom(
+    const ::google::protobuf::MessageLite& from) {
+  MergeFrom(*::google::protobuf::down_cast<const DrawPacket*>(&from));
+}
+
+void DrawPacket::MergeFrom(const DrawPacket& from) {
+  GOOGLE_CHECK_NE(&from, this);
+  mvmatrix_.MergeFrom(from.mvmatrix_);
+  layerrect_.MergeFrom(from.layerrect_);
+  if (from._has_bits_[0 / 32] & (0xffu << (0 % 32))) {
+    if (from.has_offsetx()) {
+      set_offsetx(from.offsetx());
+    }
+    if (from.has_offsety()) {
+      set_offsety(from.offsety());
+    }
+    if (from.has_totalrects()) {
+      set_totalrects(from.totalrects());
+    }
+    if (from.has_layerref()) {
+      set_layerref(from.layerref());
+    }
+  }
+}
+
+void DrawPacket::CopyFrom(const DrawPacket& from) {
+  if (&from == this) return;
+  Clear();
+  MergeFrom(from);
+}
+
+bool DrawPacket::IsInitialized() const {
+  if ((_has_bits_[0] & 0x0000002b) != 0x0000002b) return false;
+  
+  for (int i = 0; i < layerrect_size(); i++) {
+    if (!this->layerrect(i).IsInitialized()) return false;
+  }
+  return true;
+}
+
+void DrawPacket::Swap(DrawPacket* other) {
+  if (other != this) {
+    std::swap(offsetx_, other->offsetx_);
+    std::swap(offsety_, other->offsety_);
+    mvmatrix_.Swap(&other->mvmatrix_);
+    std::swap(totalrects_, other->totalrects_);
+    layerrect_.Swap(&other->layerrect_);
+    std::swap(layerref_, other->layerref_);
+    std::swap(_has_bits_[0], other->_has_bits_[0]);
+    std::swap(_cached_size_, other->_cached_size_);
+  }
+}
+
+::std::string DrawPacket::GetTypeName() const {
+  return "mozilla.layers.layerscope.DrawPacket";
+}
+
+
+// ===================================================================
+
 bool Packet_DataType_IsValid(int value) {
   switch(value) {
     case 1:
     case 2:
     case 3:
     case 4:
     case 5:
     case 6:
+    case 7:
       return true;
     default:
       return false;
   }
 }
 
 #ifndef _MSC_VER
 const Packet_DataType Packet::FRAMESTART;
 const Packet_DataType Packet::FRAMEEND;
 const Packet_DataType Packet::COLOR;
 const Packet_DataType Packet::TEXTURE;
 const Packet_DataType Packet::LAYERS;
 const Packet_DataType Packet::META;
+const Packet_DataType Packet::DRAW;
 const Packet_DataType Packet::DataType_MIN;
 const Packet_DataType Packet::DataType_MAX;
 const int Packet::DataType_ARRAYSIZE;
 #endif  // _MSC_VER
 #ifndef _MSC_VER
 const int Packet::kTypeFieldNumber;
 const int Packet::kFrameFieldNumber;
 const int Packet::kColorFieldNumber;
 const int Packet::kTextureFieldNumber;
 const int Packet::kLayersFieldNumber;
 const int Packet::kMetaFieldNumber;
+const int Packet::kDrawFieldNumber;
 #endif  // !_MSC_VER
 
 Packet::Packet()
   : ::google::protobuf::MessageLite() {
   SharedCtor();
 }
 
 void Packet::InitAsDefaultInstance() {
   frame_ = const_cast< ::mozilla::layers::layerscope::FramePacket*>(&::mozilla::layers::layerscope::FramePacket::default_instance());
   color_ = const_cast< ::mozilla::layers::layerscope::ColorPacket*>(&::mozilla::layers::layerscope::ColorPacket::default_instance());
   texture_ = const_cast< ::mozilla::layers::layerscope::TexturePacket*>(&::mozilla::layers::layerscope::TexturePacket::default_instance());
   layers_ = const_cast< ::mozilla::layers::layerscope::LayersPacket*>(&::mozilla::layers::layerscope::LayersPacket::default_instance());
   meta_ = const_cast< ::mozilla::layers::layerscope::MetaPacket*>(&::mozilla::layers::layerscope::MetaPacket::default_instance());
+  draw_ = const_cast< ::mozilla::layers::layerscope::DrawPacket*>(&::mozilla::layers::layerscope::DrawPacket::default_instance());
 }
 
 Packet::Packet(const Packet& from)
   : ::google::protobuf::MessageLite() {
   SharedCtor();
   MergeFrom(from);
 }
 
 void Packet::SharedCtor() {
   _cached_size_ = 0;
   type_ = 1;
   frame_ = NULL;
   color_ = NULL;
   texture_ = NULL;
   layers_ = NULL;
   meta_ = NULL;
+  draw_ = NULL;
   ::memset(_has_bits_, 0, sizeof(_has_bits_));
 }
 
 Packet::~Packet() {
   SharedDtor();
 }
 
 void Packet::SharedDtor() {
   if (this != default_instance_) {
     delete frame_;
     delete color_;
     delete texture_;
     delete layers_;
     delete meta_;
+    delete draw_;
   }
 }
 
 void Packet::SetCachedSize(int size) const {
   GOOGLE_SAFE_CONCURRENT_WRITES_BEGIN();
   _cached_size_ = size;
   GOOGLE_SAFE_CONCURRENT_WRITES_END();
 }
@@ -3298,16 +3901,19 @@ void Packet::Clear() {
       if (texture_ != NULL) texture_->::mozilla::layers::layerscope::TexturePacket::Clear();
     }
     if (has_layers()) {
       if (layers_ != NULL) layers_->::mozilla::layers::layerscope::LayersPacket::Clear();
     }
     if (has_meta()) {
       if (meta_ != NULL) meta_->::mozilla::layers::layerscope::MetaPacket::Clear();
     }
+    if (has_draw()) {
+      if (draw_ != NULL) draw_->::mozilla::layers::layerscope::DrawPacket::Clear();
+    }
   }
   ::memset(_has_bits_, 0, sizeof(_has_bits_));
 }
 
 bool Packet::MergePartialFromCodedStream(
     ::google::protobuf::io::CodedInputStream* input) {
 #define DO_(EXPRESSION) if (!(EXPRESSION)) return false
   ::google::protobuf::uint32 tag;
@@ -3392,16 +3998,30 @@ bool Packet::MergePartialFromCodedStream
         if (::google::protobuf::internal::WireFormatLite::GetTagWireType(tag) ==
             ::google::protobuf::internal::WireFormatLite::WIRETYPE_LENGTH_DELIMITED) {
          parse_meta:
           DO_(::google::protobuf::internal::WireFormatLite::ReadMessageNoVirtual(
                input, mutable_meta()));
         } else {
           goto handle_uninterpreted;
         }
+        if (input->ExpectTag(58)) goto parse_draw;
+        break;
+      }
+      
+      // optional .mozilla.layers.layerscope.DrawPacket draw = 7;
+      case 7: {
+        if (::google::protobuf::internal::WireFormatLite::GetTagWireType(tag) ==
+            ::google::protobuf::internal::WireFormatLite::WIRETYPE_LENGTH_DELIMITED) {
+         parse_draw:
+          DO_(::google::protobuf::internal::WireFormatLite::ReadMessageNoVirtual(
+               input, mutable_draw()));
+        } else {
+          goto handle_uninterpreted;
+        }
         if (input->ExpectAtEnd()) return true;
         break;
       }
       
       default: {
       handle_uninterpreted:
         if (::google::protobuf::internal::WireFormatLite::GetTagWireType(tag) ==
             ::google::protobuf::internal::WireFormatLite::WIRETYPE_END_GROUP) {
@@ -3449,16 +4069,22 @@ void Packet::SerializeWithCachedSizes(
   }
   
   // optional .mozilla.layers.layerscope.MetaPacket meta = 6;
   if (has_meta()) {
     ::google::protobuf::internal::WireFormatLite::WriteMessage(
       6, this->meta(), output);
   }
   
+  // optional .mozilla.layers.layerscope.DrawPacket draw = 7;
+  if (has_draw()) {
+    ::google::protobuf::internal::WireFormatLite::WriteMessage(
+      7, this->draw(), output);
+  }
+  
 }
 
 int Packet::ByteSize() const {
   int total_size = 0;
   
   if (_has_bits_[0 / 32] & (0xffu << (0 % 32))) {
     // required .mozilla.layers.layerscope.Packet.DataType type = 1;
     if (has_type()) {
@@ -3496,16 +4122,23 @@ int Packet::ByteSize() const {
     
     // optional .mozilla.layers.layerscope.MetaPacket meta = 6;
     if (has_meta()) {
       total_size += 1 +
         ::google::protobuf::internal::WireFormatLite::MessageSizeNoVirtual(
           this->meta());
     }
     
+    // optional .mozilla.layers.layerscope.DrawPacket draw = 7;
+    if (has_draw()) {
+      total_size += 1 +
+        ::google::protobuf::internal::WireFormatLite::MessageSizeNoVirtual(
+          this->draw());
+    }
+    
   }
   GOOGLE_SAFE_CONCURRENT_WRITES_BEGIN();
   _cached_size_ = total_size;
   GOOGLE_SAFE_CONCURRENT_WRITES_END();
   return total_size;
 }
 
 void Packet::CheckTypeAndMergeFrom(
@@ -3529,16 +4162,19 @@ void Packet::MergeFrom(const Packet& fro
       mutable_texture()->::mozilla::layers::layerscope::TexturePacket::MergeFrom(from.texture());
     }
     if (from.has_layers()) {
       mutable_layers()->::mozilla::layers::layerscope::LayersPacket::MergeFrom(from.layers());
     }
     if (from.has_meta()) {
       mutable_meta()->::mozilla::layers::layerscope::MetaPacket::MergeFrom(from.meta());
     }
+    if (from.has_draw()) {
+      mutable_draw()->::mozilla::layers::layerscope::DrawPacket::MergeFrom(from.draw());
+    }
   }
 }
 
 void Packet::CopyFrom(const Packet& from) {
   if (&from == this) return;
   Clear();
   MergeFrom(from);
 }
@@ -3550,27 +4186,31 @@ bool Packet::IsInitialized() const {
     if (!this->color().IsInitialized()) return false;
   }
   if (has_texture()) {
     if (!this->texture().IsInitialized()) return false;
   }
   if (has_layers()) {
     if (!this->layers().IsInitialized()) return false;
   }
+  if (has_draw()) {
+    if (!this->draw().IsInitialized()) return false;
+  }
   return true;
 }
 
 void Packet::Swap(Packet* other) {
   if (other != this) {
     std::swap(type_, other->type_);
     std::swap(frame_, other->frame_);
     std::swap(color_, other->color_);
     std::swap(texture_, other->texture_);
     std::swap(layers_, other->layers_);
     std::swap(meta_, other->meta_);
+    std::swap(draw_, other->draw_);
     std::swap(_has_bits_[0], other->_has_bits_[0]);
     std::swap(_cached_size_, other->_cached_size_);
   }
 }
 
 ::std::string Packet::GetTypeName() const {
   return "mozilla.layers.layerscope.Packet";
 }