--- a/accessible/generic/Accessible.cpp
+++ b/accessible/generic/Accessible.cpp
@@ -1409,16 +1409,32 @@ Accessible::SetCurValue(double aValue)
 
   return NS_SUCCEEDED(
     mContent->SetAttr(kNameSpaceID_None, nsGkAtoms::aria_valuenow, strValue, true));
 }
 
 role
 Accessible::ARIATransformRole(role aRole)
 {
+  // Beginning with ARIA 1.1, user agents are expected to use the native host
+  // language role of the element when the region role is used without a name.
+  // https://rawgit.com/w3c/aria/master/core-aam/core-aam.html#role-map-region
+  //
+  // XXX: While the name computation algorithm can be non-trivial in the general
+  // case, it should not be especially bad here: If the author hasn't used the
+  // region role, this calculation won't occur. And the region role's name
+  // calculation rule excludes name from content. That said, this use case is
+  // another example of why we should consider caching the accessible name. See:
+  // https://bugzilla.mozilla.org/show_bug.cgi?id=1378235.
+  if (aRole == roles::REGION) {
+    nsAutoString name;
+    Name(name);
+    return name.IsEmpty() ? NativeRole() : aRole;
+  }
+
   // XXX: these unfortunate exceptions don't fit into the ARIA table. This is
   // where the accessible role depends on both the role and ARIA state.
   if (aRole == roles::PUSHBUTTON) {
     if (nsAccUtils::HasDefinedARIAToken(mContent, nsGkAtoms::aria_pressed)) {
       // For simplicity, any existing pressed attribute except "" or "undefined"
       // indicates a toggle.
       return roles::TOGGLE_BUTTON;
     }

--- a/accessible/ipc/win/PlatformChild.cpp
+++ b/accessible/ipc/win/PlatformChild.cpp
@@ -1,18 +1,18 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* vim: set ts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include "mozilla/a11y/Compatibility.h"
 #include "mozilla/a11y/PlatformChild.h"
 #include "mozilla/mscom/EnsureMTA.h"
 #include "mozilla/mscom/InterceptorLog.h"
-#include "mozilla/WindowsVersion.h"
 
 #include "Accessible2.h"
 #include "Accessible2_2.h"
 #include "AccessibleHypertext2.h"
 #include "AccessibleTableCell.h"
 
 #include "AccessibleHypertext2_i.c"
 
@@ -44,30 +44,17 @@ static const mozilla::mscom::ArrayData s
 // we intend to instantiate them. Therefore RegisterProxy() must be called
 // via EnsureMTA.
 PlatformChild::PlatformChild()
   : mAccTypelib(mozilla::mscom::RegisterTypelib(L"oleacc.dll",
         mozilla::mscom::RegistrationFlags::eUseSystemDirectory))
   , mMiscTypelib(mozilla::mscom::RegisterTypelib(L"Accessible.tlb"))
   , mSdnTypelib(mozilla::mscom::RegisterTypelib(L"AccessibleMarshal.dll"))
 {
-  // The manifest for 32-bit Windows is embedded with resource ID 32.
-  // The manifest for 64-bit Windows is embedded with resource ID 64.
-  // Beginning with Windows 10 Creators Update, 32-bit builds use the 64-bit
-  // manifest.
-  WORD actCtxResourceId;
-#if defined(HAVE_64BIT_BUILD)
-  actCtxResourceId = 64;
-#else
-  if (IsWin10CreatorsUpdateOrLater()) {
-    actCtxResourceId = 64;
-  } else {
-    actCtxResourceId = 32;
-  }
-#endif
+  WORD actCtxResourceId = Compatibility::GetActCtxResourceId();
 
   mozilla::mscom::MTADeletePtr<mozilla::mscom::ActivationContextRegion> tmpActCtxMTA;
   mozilla::mscom::EnsureMTA([actCtxResourceId, &tmpActCtxMTA]() -> void {
     tmpActCtxMTA.reset(new mozilla::mscom::ActivationContextRegion(actCtxResourceId));
   });
   mActCtxMTA = Move(tmpActCtxMTA);
 
   mozilla::mscom::InterceptorLog::Init();

--- a/accessible/ipc/win/handler/AccessibleHandler.cpp
+++ b/accessible/ipc/win/handler/AccessibleHandler.cpp
@@ -217,27 +217,22 @@ AccessibleHandler::ReadHandlerPayload(IS
   if (!deserializer.Read(&mCachedData, &IA2Payload_Decode)) {
     return E_FAIL;
   }
 
   if (!mCachedData.mGeckoBackChannel) {
     return S_OK;
   }
 
-  long pid = static_cast<long>(::GetCurrentProcessId());
-
-  RefPtr<IHandlerControl> ctl;
-  HRESULT hr = gControlFactory.CreateInstance(nullptr, IID_IHandlerControl,
-                                              getter_AddRefs(ctl));
-  if (SUCCEEDED(hr)) {
-    hr = mCachedData.mGeckoBackChannel->put_HandlerControl(pid, ctl);
-    MOZ_ASSERT(SUCCEEDED(hr));
+  RefPtr<AccessibleHandlerControl> ctl(gControlFactory.GetOrCreateSingleton());
+  if (!ctl) {
+    return E_OUTOFMEMORY;
   }
 
-  return hr;
+  return ctl->Register(WrapNotNull(mCachedData.mGeckoBackChannel));
 }
 
 REFIID
 AccessibleHandler::MarshalAs(REFIID aIid)
 {
   static_assert(&NEWEST_IA2_IID == &IID_IAccessible2_3,
                 "You have modified NEWEST_IA2_IID. This code needs updating.");
   if (aIid == IID_IAccessible2_3 || aIid == IID_IAccessible2_2 ||

--- a/accessible/ipc/win/handler/AccessibleHandlerControl.cpp
+++ b/accessible/ipc/win/handler/AccessibleHandlerControl.cpp
@@ -127,17 +127,18 @@ AccessibleHandlerControl::Create(Accessi
   }
 
   RefPtr<AccessibleHandlerControl> ctl(new AccessibleHandlerControl());
   ctl.forget(aOutObject);
   return S_OK;
 }
 
 AccessibleHandlerControl::AccessibleHandlerControl()
-  : mCacheGen(0)
+  : mIsRegistered(false)
+  , mCacheGen(0)
   , mIA2Proxy(mscom::RegisterProxy(L"ia2marshal.dll"))
   , mHandlerProxy(mscom::RegisterProxy())
 {
   MOZ_ASSERT(mIA2Proxy);
 }
 
 IMPL_IUNKNOWN1(AccessibleHandlerControl, IHandlerControl)
 
@@ -184,10 +185,24 @@ AccessibleHandlerControl::GetHandlerType
   if (!mHandlerProxy) {
     return E_UNEXPECTED;
   }
 
   return mHandlerProxy->GetTypeInfoForGuid(CLSID_AccessibleHandler,
                                            aOutTypeInfo);
 }
 
+HRESULT
+AccessibleHandlerControl::Register(NotNull<IGeckoBackChannel*> aGecko)
+{
+  if (mIsRegistered) {
+    return S_OK;
+  }
+
+  long pid = static_cast<long>(::GetCurrentProcessId());
+  HRESULT hr = aGecko->put_HandlerControl(pid, this);
+  mIsRegistered = SUCCEEDED(hr);
+  MOZ_ASSERT(mIsRegistered);
+  return hr;
+}
+
 } // namespace a11y
 } // namespace mozilla

--- a/accessible/ipc/win/handler/AccessibleHandlerControl.h
+++ b/accessible/ipc/win/handler/AccessibleHandlerControl.h
@@ -66,20 +66,23 @@ public:
     return mCacheGen;
   }
 
   HRESULT GetNewText(long aIA2UniqueId, NotNull<IA2TextSegment*> aOutNewText);
   HRESULT GetOldText(long aIA2UniqueId, NotNull<IA2TextSegment*> aOutOldText);
 
   HRESULT GetHandlerTypeInfo(ITypeInfo** aOutTypeInfo);
 
+  HRESULT Register(NotNull<IGeckoBackChannel*> aGecko);
+
 private:
   AccessibleHandlerControl();
   ~AccessibleHandlerControl() = default;
 
+  bool mIsRegistered;
   uint32_t mCacheGen;
   detail::TextChange mTextChange;
   UniquePtr<mscom::RegisteredProxy> mIA2Proxy;
   UniquePtr<mscom::RegisteredProxy> mHandlerProxy;
 };
 
 extern mscom::SingletonFactory<AccessibleHandlerControl> gControlFactory;
 

--- a/accessible/mac/mozAccessible.mm
+++ b/accessible/mac/mozAccessible.mm
@@ -793,17 +793,17 @@ ConvertToNSArray(nsTArray<ProxyAccessibl
       return @"AXApplicationLog";
     if (roleAtom == nsGkAtoms::marquee)
       return @"AXApplicationMarquee";
     if (roleAtom == nsGkAtoms::math)
       return @"AXDocumentMath";
     if (roleAtom == nsGkAtoms::note_)
       return @"AXDocumentNote";
     if (roleAtom == nsGkAtoms::region)
-      return @"AXLandmarkRegion";
+      return mRole == roles::REGION ? @"AXLandmarkRegion" : nil;
     if (roleAtom == nsGkAtoms::status)
       return @"AXApplicationStatus";
     if (roleAtom == nsGkAtoms::tabpanel)
       return @"AXTabPanel";
     if (roleAtom == nsGkAtoms::timer)
       return @"AXApplicationTimer";
     if (roleAtom == nsGkAtoms::tooltip)
       return @"AXUserInterfaceTooltip";

--- a/accessible/tests/mochitest/role/test_aria.html
+++ b/accessible/tests/mochitest/role/test_aria.html
@@ -49,17 +49,21 @@
       testRole("aria_menuitem", ROLE_MENUITEM);
       testRole("aria_menuitemcheckbox", ROLE_CHECK_MENU_ITEM);
       testRole("aria_menuitemradio", ROLE_RADIO_MENU_ITEM);
       testRole("aria_note", ROLE_NOTE);
       testRole("aria_presentation", ROLE_TEXT); // weak role
       testRole("aria_progressbar", ROLE_PROGRESSBAR);
       testRole("aria_radio", ROLE_RADIOBUTTON);
       testRole("aria_radiogroup", ROLE_RADIO_GROUP);
-      testRole("aria_region", ROLE_REGION);
+      testRole("aria_region_no_name", ROLE_TEXT);
+      testRole("aria_region_has_label", ROLE_REGION);
+      testRole("aria_region_has_labelledby", ROLE_REGION);
+      testRole("aria_region_has_title", ROLE_REGION);
+      testRole("aria_region_empty_name", ROLE_TEXT);
       testRole("aria_row", ROLE_ROW);
       testRole("aria_rowheader", ROLE_ROWHEADER);
       testRole("aria_scrollbar", ROLE_SCROLLBAR);
       testRole("aria_searchbox", ROLE_ENTRY);
       testRole("aria_separator", ROLE_SEPARATOR);
       testRole("aria_slider", ROLE_SLIDER);
       testRole("aria_spinbutton", ROLE_SPINBUTTON);
       testRole("aria_status", ROLE_STATUSBAR);
@@ -233,17 +237,21 @@
   <span id="aria_menuitem" role="menuitem"/>
   <span id="aria_menuitemcheckbox" role="menuitemcheckbox"/>
   <span id="aria_menuitemradio" role="menuitemradio"/>
   <span id="aria_note" role="note"/>
   <span id="aria_presentation" role="presentation" tabindex="0"/>
   <span id="aria_progressbar" role="progressbar"/>
   <span id="aria_radio" role="radio"/>
   <span id="aria_radiogroup" role="radiogroup"/>
-  <span id="aria_region" role="region"/>
+  <span id="aria_region_no_name" role="region"/>
+  <span id="aria_region_has_label" role="region" aria-label="label"/>
+  <span id="aria_region_has_labelledby" role="region" aria-labelledby="label"/><span id="label" aria-label="label">
+  <span id="aria_region_has_title" role="region" title="title"/>
+  <span id="aria_region_empty_name" role="region" aria-label="" title="" aria-labelledby="empty"/><span id="empty"/>
   <span id="aria_row" role="row"/>
   <span id="aria_rowheader" role="rowheader"/>
   <span id="aria_scrollbar" role="scrollbar"/>
   <span id="aria_searchbox" role="textbox"/>
   <span id="aria_separator" role="separator"/>
   <span id="aria_slider" role="slider"/>
   <span id="aria_spinbutton" role="spinbutton"/>
   <span id="aria_status" role="status"/>

--- a/accessible/windows/msaa/Compatibility.cpp
+++ b/accessible/windows/msaa/Compatibility.cpp
@@ -1,22 +1,27 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* vim: set ts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "Compatibility.h"
 
+#include "mozilla/WindowsVersion.h"
+#include "nsExceptionHandler.h"
+#include "nsUnicharUtils.h"
 #include "nsWindowsDllInterceptor.h"
 #include "nsWinUtils.h"
 #include "Statistics.h"
 
 #include "mozilla/Preferences.h"
 
+#include <shlobj.h>
+
 using namespace mozilla;
 using namespace mozilla::a11y;
 
 /**
  * Return true if module version is lesser than the given version.
  */
 bool
 IsModuleVersionLessThan(HMODULE aModuleHandle, DWORD aMajor, DWORD aMinor)
@@ -198,8 +203,183 @@ Compatibility::Init()
     // SEH handlers.
     if (!sVectoredExceptionHandler) {
       sVectoredExceptionHandler =
         AddVectoredExceptionHandler(TRUE, &DetectInSendMessageExCompat);
     }
   }
 }
 
+#if !defined(HAVE_64BIT_BUILD)
+
+static bool
+ReadCOMRegDefaultString(const nsString& aRegPath, nsAString& aOutBuf)
+{
+  aOutBuf.Truncate();
+
+  // Get the required size and type of the registry value.
+  // We expect either REG_SZ or REG_EXPAND_SZ.
+  DWORD type;
+  DWORD bufLen = 0;
+  LONG result = ::RegGetValue(HKEY_CLASSES_ROOT, aRegPath.get(),
+                              nullptr, RRF_RT_ANY, &type, nullptr, &bufLen);
+  if (result != ERROR_SUCCESS || (type != REG_SZ && type != REG_EXPAND_SZ)) {
+    return false;
+  }
+
+  // Now obtain the value
+  DWORD flags = type == REG_SZ ? RRF_RT_REG_SZ : RRF_RT_REG_EXPAND_SZ;
+
+  aOutBuf.SetLength((bufLen + 1) / sizeof(char16_t));
+
+  result = ::RegGetValue(HKEY_CLASSES_ROOT, aRegPath.get(), nullptr,
+                         flags, nullptr, aOutBuf.BeginWriting(), &bufLen);
+  if (result != ERROR_SUCCESS) {
+    aOutBuf.Truncate();
+    return false;
+  }
+
+  // Truncate terminator
+  aOutBuf.Truncate((bufLen + 1) / sizeof(char16_t) - 1);
+  return true;
+}
+
+static bool
+IsSystemOleAcc(nsCOMPtr<nsIFile>& aFile)
+{
+  // Use FOLDERID_SystemX86 so that Windows doesn't give us a redirected
+  // system32 if we're a 32-bit process running on a 64-bit OS. This is
+  // necessary because the values that we are reading from the registry
+  // are not redirected; they reference SysWOW64 directly.
+  PWSTR systemPath = nullptr;
+  HRESULT hr = ::SHGetKnownFolderPath(FOLDERID_SystemX86, 0, nullptr,
+                                      &systemPath);
+  if (FAILED(hr)) {
+    return false;
+  }
+
+  nsCOMPtr<nsIFile> oleAcc;
+  nsresult rv = NS_NewLocalFile(nsDependentString(systemPath), false,
+                                getter_AddRefs(oleAcc));
+
+  ::CoTaskMemFree(systemPath);
+  systemPath = nullptr;
+
+  if (NS_FAILED(rv)) {
+    return false;
+  }
+
+  rv = oleAcc->Append(NS_LITERAL_STRING("oleacc.dll"));
+  if (NS_FAILED(rv)) {
+    return false;
+  }
+
+  bool isEqual;
+  rv = oleAcc->Equals(aFile, &isEqual);
+  return NS_SUCCEEDED(rv) && isEqual;
+}
+
+static bool
+IsTypelibPreferred()
+{
+  // If IAccessible's Proxy/Stub CLSID is kUniversalMarshalerClsid, then any
+  // external a11y clients are expecting to use a typelib.
+  NS_NAMED_LITERAL_STRING(kUniversalMarshalerClsid,
+      "{00020424-0000-0000-C000-000000000046}");
+
+  NS_NAMED_LITERAL_STRING(kIAccessiblePSClsidPath,
+      "Interface\\{618736E0-3C3D-11CF-810C-00AA00389B71}\\ProxyStubClsid32");
+
+  nsAutoString psClsid;
+  if (!ReadCOMRegDefaultString(kIAccessiblePSClsidPath, psClsid)) {
+    return false;
+  }
+
+  return psClsid.Equals(kUniversalMarshalerClsid,
+                        nsCaseInsensitiveStringComparator());
+}
+
+static bool
+IsIAccessibleTypelibRegistered()
+{
+  // The system default IAccessible typelib is always registered with version
+  // 1.1, under the neutral locale (LCID 0).
+  NS_NAMED_LITERAL_STRING(kIAccessibleTypelibRegPath,
+    "TypeLib\\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\\1.1\\0\\win32");
+
+  nsAutoString typelibPath;
+  if (!ReadCOMRegDefaultString(kIAccessibleTypelibRegPath, typelibPath)) {
+    return false;
+  }
+
+  nsCOMPtr<nsIFile> libTestFile;
+  nsresult rv = NS_NewLocalFile(typelibPath, false, getter_AddRefs(libTestFile));
+  if (NS_FAILED(rv)) {
+    return false;
+  }
+
+  return IsSystemOleAcc(libTestFile);
+}
+
+static bool
+IsIAccessiblePSRegistered()
+{
+  NS_NAMED_LITERAL_STRING(kIAccessiblePSRegPath,
+    "CLSID\\{03022430-ABC4-11D0-BDE2-00AA001A1953}\\InProcServer32");
+
+  nsAutoString proxyStubPath;
+  if (!ReadCOMRegDefaultString(kIAccessiblePSRegPath, proxyStubPath)) {
+    return false;
+  }
+
+  nsCOMPtr<nsIFile> libTestFile;
+  nsresult rv = NS_NewLocalFile(proxyStubPath, false, getter_AddRefs(libTestFile));
+  if (NS_FAILED(rv)) {
+    return false;
+  }
+
+  return IsSystemOleAcc(libTestFile);
+}
+
+static bool
+UseIAccessibleProxyStub()
+{
+  // If a typelib is preferred then external clients are expecting to use
+  // typelib marshaling, so we should use that whenever available.
+  if (IsTypelibPreferred() && IsIAccessibleTypelibRegistered()) {
+    return false;
+  }
+
+  // Otherwise we try the proxy/stub
+  if (IsIAccessiblePSRegistered()) {
+    return true;
+  }
+
+  // If we reach this point then something is seriously wrong with the
+  // IAccessible configuration in the computer's registry. Let's annotate this
+  // so that we can easily determine this condition during crash analysis.
+  CrashReporter::AnnotateCrashReport(NS_LITERAL_CSTRING("IAccessibleConfig"),
+                                     NS_LITERAL_CSTRING("NoSystemTypeLibOrPS"));
+  return false;
+}
+
+#endif // !defined(HAVE_64BIT_BUILD)
+
+uint16_t
+Compatibility::GetActCtxResourceId()
+{
+#if defined(HAVE_64BIT_BUILD)
+  // The manifest for 64-bit Windows is embedded with resource ID 64.
+  return 64;
+#else
+  // The manifest for 32-bit Windows is embedded with resource ID 32.
+  // Beginning with Windows 10 Creators Update, 32-bit builds always use the
+  // 64-bit manifest. Older builds of Windows may or may not require the 64-bit
+  // manifest: UseIAccessibleProxyStub() determines the course of action.
+  if (mozilla::IsWin10CreatorsUpdateOrLater() ||
+      UseIAccessibleProxyStub()) {
+    return 64;
+  }
+
+  return 32;
+#endif // defined(HAVE_64BIT_BUILD)
+}
+

--- a/accessible/windows/msaa/Compatibility.h
+++ b/accessible/windows/msaa/Compatibility.h
@@ -34,16 +34,22 @@ public:
    */
   static bool IsWE() { return !!(sConsumers & WE); }
 
   /**
    * Return true if Dolphin mode is enabled.
    */
   static bool IsDolphin() { return !!(sConsumers & DOLPHIN); }
 
+  /**
+   * @return ID of a11y manifest resource to be passed to
+   * mscom::ActivationContext
+   */
+  static uint16_t GetActCtxResourceId();
+
 private:
   Compatibility();
   Compatibility(const Compatibility&);
   Compatibility& operator = (const Compatibility&);
 
   /**
    * Initialize compatibility mode. Called by platform (see Platform.h) during
    * accessibility initialization.

--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -5117,17 +5117,17 @@ nsBrowserAccess.prototype = {
     let browser = win.gBrowser.getBrowserForTab(tab);
 
     if (needToFocusWin || (!loadInBackground && aIsExternal))
       win.focus();
 
     return browser;
   },
 
-  openURI(aURI, aOpener, aWhere, aFlags) {
+  openURI(aURI, aOpener, aWhere, aFlags, aTriggeringPrincipal) {
     // This function should only ever be called if we're opening a URI
     // from a non-remote browser window (via nsContentTreeOwner).
     if (aOpener && Cu.isCrossProcessWrapper(aOpener)) {
       Cu.reportError("nsBrowserAccess.openURI was passed a CPOW for aOpener. " +
                      "openURI should only ever be called from non-remote browsers.");
       throw Cr.NS_ERROR_FAILURE;
     }
 
@@ -5149,21 +5149,19 @@ nsBrowserAccess.prototype = {
       if (isExternal &&
           gPrefService.prefHasUserValue("browser.link.open_newwindow.override.external"))
         aWhere = gPrefService.getIntPref("browser.link.open_newwindow.override.external");
       else
         aWhere = gPrefService.getIntPref("browser.link.open_newwindow");
     }
 
     let referrer = aOpener ? makeURI(aOpener.location.href) : null;
-    let triggeringPrincipal = null;
     let referrerPolicy = Ci.nsIHttpChannel.REFERRER_POLICY_UNSET;
     if (aOpener && aOpener.document) {
       referrerPolicy = aOpener.document.referrerPolicy;
-      triggeringPrincipal = aOpener.document.nodePrincipal;
     }
     let isPrivate = aOpener
                   ? PrivateBrowsingUtils.isContentWindowPrivate(aOpener)
                   : PrivateBrowsingUtils.isWindowPrivate(window);
 
     switch (aWhere) {
       case Ci.nsIBrowserDOMWindow.OPEN_NEWWINDOW :
         // FIXME: Bug 408379. So how come this doesn't send the
@@ -5187,28 +5185,28 @@ nsBrowserAccess.prototype = {
         let forceNotRemote = !!aOpener;
         let userContextId = aOpener && aOpener.document
                               ? aOpener.document.nodePrincipal.originAttributes.userContextId
                               : Ci.nsIScriptSecurityManager.DEFAULT_USER_CONTEXT_ID;
         let openerWindow = (aFlags & Ci.nsIBrowserDOMWindow.OPEN_NO_OPENER) ? null : aOpener;
         let browser = this._openURIInNewTab(aURI, referrer, referrerPolicy,
                                             isPrivate, isExternal,
                                             forceNotRemote, userContextId,
-                                            openerWindow, triggeringPrincipal);
+                                            openerWindow, aTriggeringPrincipal);
         if (browser)
           newWindow = browser.contentWindow;
         break;
       default : // OPEN_CURRENTWINDOW or an illegal value
         newWindow = window.content;
         if (aURI) {
           let loadflags = isExternal ?
                             Ci.nsIWebNavigation.LOAD_FLAGS_FROM_EXTERNAL :
                             Ci.nsIWebNavigation.LOAD_FLAGS_NONE;
           gBrowser.loadURIWithFlags(aURI.spec, {
-                                    triggeringPrincipal,
+                                    aTriggeringPrincipal,
                                     flags: loadflags,
                                     referrerURI: referrer,
                                     referrerPolicy,
                                     });
         }
         if (!gPrefService.getBoolPref("browser.tabs.loadDivertedInBackground"))
           window.focus();
     }

--- a/browser/base/content/test/general/browser_bug520538.js
+++ b/browser/base/content/test/general/browser_bug520538.js
@@ -1,15 +1,16 @@
 function test() {
   var tabCount = gBrowser.tabs.length;
   gBrowser.selectedBrowser.focus();
   window.browserDOMWindow.openURI(makeURI("about:blank"),
                                   null,
                                   Ci.nsIBrowserDOMWindow.OPEN_NEWTAB,
-                                  Ci.nsIBrowserDOMWindow.OPEN_EXTERNAL);
+                                  Ci.nsIBrowserDOMWindow.OPEN_EXTERNAL,
+                                  Services.scriptSecurityManager.getSystemPrincipal());
   is(gBrowser.tabs.length, tabCount + 1,
      "'--new-tab about:blank' opens a new tab");
   is(gBrowser.selectedTab, gBrowser.tabs[tabCount],
      "'--new-tab about:blank' selects the new tab");
   is(document.activeElement, gURLBar.inputField,
      "'--new-tab about:blank' focuses the location bar");
   gBrowser.removeCurrentTab();
 }

--- a/browser/base/content/test/general/browser_bug537474.js
+++ b/browser/base/content/test/general/browser_bug537474.js
@@ -1,7 +1,8 @@
 add_task(async function() {
   let browserLoadedPromise = BrowserTestUtils.browserLoaded(gBrowser.selectedBrowser);
   window.browserDOMWindow.openURI(makeURI("about:"), null,
-                                  Ci.nsIBrowserDOMWindow.OPEN_CURRENTWINDOW, null)
+                                  Ci.nsIBrowserDOMWindow.OPEN_CURRENTWINDOW, null,
+                                  Services.scriptSecurityManager.getSystemPrincipal())
   await browserLoadedPromise;
   is(gBrowser.currentURI.spec, "about:", "page loads in the current content window");
 });

--- a/browser/base/content/test/urlbar/browser_bug562649.js
+++ b/browser/base/content/test/urlbar/browser_bug562649.js
@@ -1,14 +1,15 @@
 function test() {
   const URI = "data:text/plain,bug562649";
   window.browserDOMWindow.openURI(makeURI(URI),
                                   null,
                                   Ci.nsIBrowserDOMWindow.OPEN_NEWTAB,
-                                  Ci.nsIBrowserDOMWindow.OPEN_EXTERNAL);
+                                  Ci.nsIBrowserDOMWindow.OPEN_EXTERNAL,
+                                  Services.scriptSecurityManager.getSystemPrincipal());
 
   is(gBrowser.userTypedValue, URI, "userTypedValue matches test URI");
   is(gURLBar.value, URI, "location bar value matches test URI");
 
   gBrowser.selectedTab = BrowserTestUtils.addTab(gBrowser);
   gBrowser.removeCurrentTab({ skipPermitUnload: true });
   is(gBrowser.userTypedValue, URI, "userTypedValue matches test URI after switching tabs");
   is(gURLBar.value, URI, "location bar value matches test URI after switching tabs");

--- a/browser/components/nsBrowserContentHandler.js
+++ b/browser/components/nsBrowserContentHandler.js
@@ -338,17 +338,18 @@ nsBrowserContentHandler.prototype = {
       }
     } catch (e) {
       Components.utils.reportError(e);
     }
 
     try {
       while ((uriparam = cmdLine.handleFlagWithParam("new-tab", false))) {
         let uri = resolveURIInternal(cmdLine, uriparam);
-        handURIToExistingBrowser(uri, nsIBrowserDOMWindow.OPEN_NEWTAB, cmdLine);
+        handURIToExistingBrowser(uri, nsIBrowserDOMWindow.OPEN_NEWTAB, cmdLine, false,
+                                 Services.scriptSecurityManager.getSystemPrincipal());
         cmdLine.preventDefault = true;
       }
     } catch (e) {
       Components.utils.reportError(e);
     }
 
     var chromeParam = cmdLine.handleFlagWithParam("chrome", false);
     if (chromeParam) {
@@ -386,17 +387,18 @@ nsBrowserContentHandler.prototype = {
     }
     if (cmdLine.handleFlag("silent", false))
       cmdLine.preventDefault = true;
 
     try {
       var privateWindowParam = cmdLine.handleFlagWithParam("private-window", false);
       if (privateWindowParam) {
         let resolvedURI = resolveURIInternal(cmdLine, privateWindowParam);
-        handURIToExistingBrowser(resolvedURI, nsIBrowserDOMWindow.OPEN_NEWTAB, cmdLine, true);
+        handURIToExistingBrowser(resolvedURI, nsIBrowserDOMWindow.OPEN_NEWTAB, cmdLine, true,
+                                 Services.scriptSecurityManager.getSystemPrincipal());
         cmdLine.preventDefault = true;
       }
     } catch (e) {
       if (e.result != Components.results.NS_ERROR_INVALID_ARG) {
         throw e;
       }
       // NS_ERROR_INVALID_ARG is thrown when flag exists, but has no param.
       if (cmdLine.handleFlag("private-window", false)) {
@@ -602,18 +604,18 @@ nsBrowserContentHandler.prototype = {
       if (!webNavInfo.isTypeSupported(contentType, null)) {
         throw NS_ERROR_WONT_HANDLE_CONTENT;
       }
     } catch (e) {
       throw NS_ERROR_WONT_HANDLE_CONTENT;
     }
 
     request.QueryInterface(nsIChannel);
-    handURIToExistingBrowser(request.URI,
-      nsIBrowserDOMWindow.OPEN_DEFAULTWINDOW, null);
+    handURIToExistingBrowser(request.URI, nsIBrowserDOMWindow.OPEN_DEFAULTWINDOW, null, false,
+                             request.loadInfo.triggeringPrincipal);
     request.cancel(NS_BINDING_ABORTED);
   },
 
   /* nsICommandLineValidator */
   validate: function bch_validate(cmdLine) {
     // Other handlers may use osint so only handle the osint flag if the url
     // flag is also present and the command line is valid.
     var osintFlagIdx = cmdLine.findFlag("osint", false);
@@ -637,17 +639,17 @@ nsBrowserContentHandler.prototype = {
         throw NS_ERROR_ABORT;
       }
       cmdLine.handleFlag("osint", false)
     }
   },
 };
 var gBrowserContentHandler = new nsBrowserContentHandler();
 
-function handURIToExistingBrowser(uri, location, cmdLine, forcePrivate) {
+function handURIToExistingBrowser(uri, location, cmdLine, forcePrivate, triggeringPrincipal) {
   if (!shouldLoadURI(uri))
     return;
 
   // Unless using a private window is forced, open external links in private
   // windows only if we're in perma-private mode.
   var allowPrivate = forcePrivate || PrivateBrowsingUtils.permanentPrivateBrowsing;
   var navWin = RecentWindow.getMostRecentBrowserWindow({private: allowPrivate});
   if (!navWin) {
@@ -662,17 +664,17 @@ function handURIToExistingBrowser(uri, l
 
   var navNav = navWin.QueryInterface(nsIInterfaceRequestor)
                      .getInterface(nsIWebNavigation);
   var rootItem = navNav.QueryInterface(nsIDocShellTreeItem).rootTreeItem;
   var rootWin = rootItem.QueryInterface(nsIInterfaceRequestor)
                         .getInterface(nsIDOMWindow);
   var bwin = rootWin.QueryInterface(nsIDOMChromeWindow).browserDOMWindow;
   bwin.openURI(uri, null, location,
-               nsIBrowserDOMWindow.OPEN_EXTERNAL);
+               nsIBrowserDOMWindow.OPEN_EXTERNAL, triggeringPrincipal);
 }
 
 function nsDefaultCommandLineHandler() {
 }
 
 nsDefaultCommandLineHandler.prototype = {
   classID: Components.ID("{47cd0651-b1be-4a0f-b5c4-10e5a573ef71}"),
 
@@ -737,17 +739,18 @@ nsDefaultCommandLineHandler.prototype = 
     }
 
     if (urilist.length) {
       if (cmdLine.state != nsICommandLine.STATE_INITIAL_LAUNCH &&
           urilist.length == 1) {
         // Try to find an existing window and load our URI into the
         // current tab, new tab, or new window as prefs determine.
         try {
-          handURIToExistingBrowser(urilist[0], nsIBrowserDOMWindow.OPEN_DEFAULTWINDOW, cmdLine);
+          handURIToExistingBrowser(urilist[0], nsIBrowserDOMWindow.OPEN_DEFAULTWINDOW, cmdLine, false,
+                                   Services.scriptSecurityManager.getSystemPrincipal());
           return;
         } catch (e) {
         }
       }
 
       var URLlist = urilist.filter(shouldLoadURI).map(u => u.spec);
       if (URLlist.length) {
         openWindow(null, gBrowserContentHandler.chromeURL, "_blank",

--- a/devtools/client/responsive.html/browser/tunnel.js
+++ b/devtools/client/responsive.html/browser/tunnel.js
@@ -236,23 +236,28 @@ function tunnelToInnerBrowser(outer, inn
       //   * Specific target names (everything treated as _blank)
       //   * Window features
       //   * window.opener
       // These things are deferred for now, since content which does depend on them seems
       // outside the main focus of RDM.
       let { detail } = event;
       event.preventDefault();
       let uri = Services.io.newURI(detail.url);
+      let sourceNode = event.dataTransfer.mozSourceNode;
+      let triggeringPrincipal = sourceNode
+        ? sourceNode.nodePrincipal
+        : Services.scriptSecurityManager.getSystemPrincipal();
       // This API is used mainly because it's near the path used for <a target/> with
       // regular browser tabs (which calls `openURIInFrame`).  The more elaborate APIs
       // that support openers, window features, etc. didn't seem callable from JS and / or
       // this event doesn't give enough info to use them.
       browserWindow.browserDOMWindow
         .openURI(uri, null, Ci.nsIBrowserDOMWindow.OPEN_NEWTAB,
-                 Ci.nsIBrowserDOMWindow.OPEN_NEW);
+                 Ci.nsIBrowserDOMWindow.OPEN_NEW,
+                 triggeringPrincipal);
     },
 
     stop() {
       let tab = gBrowser.getTabForBrowser(outer);
       let filteredProgressListener = gBrowser._tabFilters.get(tab);
 
       // The browser's state has changed over time while the tunnel was active.  Push the
       // the current state down to the inner browser, so that it follows the content in

--- a/dom/base/nsOpenURIInFrameParams.cpp
+++ b/dom/base/nsOpenURIInFrameParams.cpp
@@ -36,15 +36,30 @@ NS_IMETHODIMP
 nsOpenURIInFrameParams::GetIsPrivate(bool* aIsPrivate)
 {
   NS_ENSURE_ARG_POINTER(aIsPrivate);
   *aIsPrivate = mOpenerOriginAttributes.mPrivateBrowsingId > 0;
   return NS_OK;
 }
 
 NS_IMETHODIMP
+nsOpenURIInFrameParams::GetTriggeringPrincipal(nsIPrincipal** aTriggeringPrincipal)
+{
+  NS_ADDREF(*aTriggeringPrincipal = mTriggeringPrincipal);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsOpenURIInFrameParams::SetTriggeringPrincipal(nsIPrincipal* aTriggeringPrincipal)
+{
+  NS_ENSURE_TRUE(aTriggeringPrincipal, NS_ERROR_INVALID_ARG);
+  mTriggeringPrincipal = aTriggeringPrincipal;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
 nsOpenURIInFrameParams::GetOpenerOriginAttributes(JSContext* aCx,
                                                   JS::MutableHandle<JS::Value> aValue)
 {
   bool ok = ToJSValue(aCx, mOpenerOriginAttributes, aValue);
   NS_ENSURE_TRUE(ok, NS_ERROR_FAILURE);
   return NS_OK;
 }

--- a/dom/base/nsOpenURIInFrameParams.h
+++ b/dom/base/nsOpenURIInFrameParams.h
@@ -20,9 +20,10 @@ public:
 
   explicit nsOpenURIInFrameParams(const mozilla::OriginAttributes& aOriginAttributes);
 
 private:
   ~nsOpenURIInFrameParams();
 
   mozilla::OriginAttributes mOpenerOriginAttributes;
   nsString mReferrer;
+  nsCOMPtr<nsIPrincipal> mTriggeringPrincipal;
 };

--- a/dom/interfaces/base/nsIBrowserDOMWindow.idl
+++ b/dom/interfaces/base/nsIBrowserDOMWindow.idl
@@ -4,22 +4,24 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsISupports.idl"
 
 interface mozIDOMWindowProxy;
 interface nsIDOMWindow;
 interface nsIURI;
 interface nsIFrameLoaderOwner;
+interface nsIPrincipal;
 
 [scriptable, uuid(e774db14-79ac-4156-a7a3-aa3fd0a22c10)]
 interface nsIOpenURIInFrameParams : nsISupports
 {
   attribute DOMString referrer;
   readonly attribute boolean isPrivate;
+  attribute nsIPrincipal triggeringPrincipal;
 
   [implicit_jscontext]
   readonly attribute jsval openerOriginAttributes;
 };
 
 [scriptable, uuid(9d17f3dd-672b-451e-afd2-b1115df780d5)]
 
 /**
@@ -92,21 +94,22 @@ interface nsIBrowserDOMWindow : nsISuppo
    * @param aURI the URI to open. null is allowed.  If null is passed in, no
    *             load will be done, though the window the load would have
    *             happened in will be returned.
    * @param aWhere see possible values described above.
    * @param aOpener window requesting the open (can be null).
    * @param aFlags flags which control the behavior of the load. The
    *               OPEN_EXTERNAL/OPEN_NEW flag is only used when
    *               aWhere == OPEN_DEFAULTWINDOW.
+   * @param aTriggeringPrincipal the principal that triggered the load of aURI
    * @return the window into which the URI was opened.
   */
   mozIDOMWindowProxy
   openURI(in nsIURI aURI, in mozIDOMWindowProxy aOpener,
-          in short aWhere, in long aFlags);
+          in short aWhere, in long aFlags, in nsIPrincipal aTriggeringPrincipal);
 
   /**
    * As above, but return the nsIFrameLoaderOwner for the new window.
    *
    * Additional Parameters:
    * @param aNextTabParentId The TabParent to associate the window with
    * @param aName The name to give the window opened in the new tab.
    * @return The nsIFrameLoaderOwner for the newly opened window.

--- a/dom/ipc/ContentChild.cpp
+++ b/dom/ipc/ContentChild.cpp
@@ -67,16 +67,17 @@
 #include "mozilla/widget/ScreenManager.h"
 #include "mozilla/widget/WidgetMessageUtils.h"
 #include "nsBaseDragService.h"
 #include "mozilla/media/MediaChild.h"
 #include "mozilla/BasePrincipal.h"
 #include "mozilla/WebBrowserPersistDocumentChild.h"
 #include "imgLoader.h"
 #include "GMPServiceChild.h"
+#include "NullPrincipal.h"
 
 #ifdef MOZ_GECKO_PROFILER
 #include "ChildProfilerController.h"
 #endif
 
 #if defined(MOZ_CONTENT_SANDBOX)
 #include "mozilla/SandboxSettings.h"
 #if defined(XP_WIN)
@@ -685,25 +686,29 @@ ContentChild::ProvideWindow(mozIDOMWindo
   return ProvideWindowCommon(nullptr, aParent, false, aChromeFlags,
                              aCalledFromJS, aPositionSpecified,
                              aSizeSpecified, aURI, aName, aFeatures,
                              aForceNoOpener, aWindowIsNew, aReturn);
 }
 
 static nsresult
 GetWindowParamsFromParent(mozIDOMWindowProxy* aParent,
-                          nsACString& aBaseURIString, float* aFullZoom)
+                          nsACString& aBaseURIString, float* aFullZoom,
+                          nsIPrincipal** aTriggeringPrincipal)
 {
   *aFullZoom = 1.0f;
   auto* opener = nsPIDOMWindowOuter::From(aParent);
   if (!opener) {
+    nsCOMPtr<nsIPrincipal> nullPrincipal = NullPrincipal::Create();
+    NS_ADDREF(*aTriggeringPrincipal = nullPrincipal);
     return NS_OK;
   }
 
   nsCOMPtr<nsIDocument> doc = opener->GetDoc();
+  NS_ADDREF(*aTriggeringPrincipal = doc->NodePrincipal());
   nsCOMPtr<nsIURI> baseURI = doc->GetDocBaseURI();
   if (!baseURI) {
     NS_ERROR("nsIDocument didn't return a base URI");
     return NS_ERROR_FAILURE;
   }
 
   baseURI->GetSpec(aBaseURIString);
 
@@ -773,33 +778,36 @@ ContentChild::ProvideWindowCommon(TabChi
     }
   }
 
   // If we're in a content process and we have noopener set, there's no reason
   // to load in our process, so let's load it elsewhere!
   if (loadInDifferentProcess) {
     nsAutoCString baseURIString;
     float fullZoom;
-    rv = GetWindowParamsFromParent(aParent, baseURIString, &fullZoom);
+    nsCOMPtr<nsIPrincipal> triggeringPrincipal;
+    rv = GetWindowParamsFromParent(aParent, baseURIString, &fullZoom,
+                                   getter_AddRefs(triggeringPrincipal));
     if (NS_WARN_IF(NS_FAILED(rv))) {
       return rv;
     }
 
     URIParams uriToLoad;
     SerializeURI(aURI, uriToLoad);
     Unused << SendCreateWindowInDifferentProcess(aTabOpener,
                                                  aChromeFlags,
                                                  aCalledFromJS,
                                                  aPositionSpecified,
                                                  aSizeSpecified,
                                                  uriToLoad,
                                                  features,
                                                  baseURIString,
                                                  fullZoom,
-                                                 name);
+                                                 name,
+                                                 Principal(triggeringPrincipal));
 
     // We return NS_ERROR_ABORT, so that the caller knows that we've abandoned
     // the window open as far as it is concerned.
     return NS_ERROR_ABORT;
   }
 
   if (aTabOpener) {
     PopupIPCTabContext context;
@@ -885,28 +893,31 @@ ContentChild::ProvideWindowCommon(TabChi
     // NOTE: BrowserFrameOpenWindowPromise is the same type as
     // CreateWindowPromise, and this code depends on that fact.
     windowCreated =
       newChild->SendBrowserFrameOpenWindow(aTabOpener, renderFrame, NS_ConvertUTF8toUTF16(url),
                                            name, NS_ConvertUTF8toUTF16(features));
   } else {
     nsAutoCString baseURIString;
     float fullZoom;
-    rv = GetWindowParamsFromParent(aParent, baseURIString, &fullZoom);
+    nsCOMPtr<nsIPrincipal> triggeringPrincipal;
+    rv = GetWindowParamsFromParent(aParent, baseURIString, &fullZoom,
+                                   getter_AddRefs(triggeringPrincipal));
     if (NS_WARN_IF(NS_FAILED(rv))) {
       return rv;
     }
 
     windowCreated =
       SendCreateWindow(aTabOpener, newChild, renderFrame,
                        aChromeFlags, aCalledFromJS, aPositionSpecified,
                        aSizeSpecified,
                        features,
                        baseURIString,
-                       fullZoom);
+                       fullZoom,
+                       Principal(triggeringPrincipal));
   }
 
   // Await the promise being resolved. When the promise is resolved, we'll set
   // the `ready` local variable, which will cause us to exit our nested event
   // loop.
   //
   // NOTE: We need to run this callback on the StableStateEventTarget because we
   // need to resolve our runnable and exit from the nested event loop before
@@ -2744,39 +2755,16 @@ ContentChild::DeallocPOfflineCacheUpdate
 {
   OfflineCacheUpdateChild* offlineCacheUpdate =
     static_cast<OfflineCacheUpdateChild*>(actor);
   NS_RELEASE(offlineCacheUpdate);
   return true;
 }
 
 mozilla::ipc::IPCResult
-ContentChild::RecvLoadPluginResult(const uint32_t& aPluginId,
-                                   const bool& aResult)
-{
-  nsresult rv;
-  Endpoint<PPluginModuleParent> endpoint;
-  bool finalResult = aResult &&
-                     SendConnectPluginBridge(aPluginId, &rv, &endpoint) &&
-                     NS_SUCCEEDED(rv);
-  plugins::PluginModuleContentParent::OnLoadPluginResult(aPluginId,
-                                                         finalResult,
-                                                         Move(endpoint));
-  return IPC_OK();
-}
-
-mozilla::ipc::IPCResult
-ContentChild::RecvAssociatePluginId(const uint32_t& aPluginId,
-                                    const base::ProcessId& aProcessId)
-{
-  plugins::PluginModuleContentParent::AssociatePluginId(aPluginId, aProcessId);
-  return IPC_OK();
-}
-
-mozilla::ipc::IPCResult
 ContentChild::RecvDomainSetChanged(const uint32_t& aSetType,
                                    const uint32_t& aChangeType,
                                    const OptionalURIParams& aDomain)
 {
   if (aChangeType == ACTIVATE_POLICY) {
     if (mPolicy) {
       return IPC_OK();
     }

--- a/dom/ipc/ContentChild.h
+++ b/dom/ipc/ContentChild.h
@@ -433,22 +433,16 @@ public:
   void AddIdleObserver(nsIObserver* aObserver, uint32_t aIdleTimeInS);
 
   void RemoveIdleObserver(nsIObserver* aObserver, uint32_t aIdleTimeInS);
 
   virtual mozilla::ipc::IPCResult RecvNotifyIdleObserver(const uint64_t& aObserver,
                                                          const nsCString& aTopic,
                                                          const nsString& aData) override;
 
-  virtual mozilla::ipc::IPCResult RecvAssociatePluginId(const uint32_t& aPluginId,
-                                                        const base::ProcessId& aProcessId) override;
-
-  virtual mozilla::ipc::IPCResult RecvLoadPluginResult(const uint32_t& aPluginId,
-                                                       const bool& aResult) override;
-
   virtual mozilla::ipc::IPCResult RecvUpdateWindow(const uintptr_t& aChildId) override;
 
   virtual mozilla::ipc::IPCResult RecvDomainSetChanged(const uint32_t& aSetType,
                                                        const uint32_t& aChangeType,
                                                        const OptionalURIParams& aDomain) override;
 
   virtual mozilla::ipc::IPCResult RecvShutdown() override;
 

--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -1099,18 +1099,17 @@ ContentParent::RecvCreateGMPService()
 
 mozilla::ipc::IPCResult
 ContentParent::RecvLoadPlugin(const uint32_t& aPluginId,
                               nsresult* aRv,
                               uint32_t* aRunID,
                               Endpoint<PPluginModuleParent>* aEndpoint)
 {
   *aRv = NS_OK;
-  if (!mozilla::plugins::SetupBridge(aPluginId, this, false, aRv, aRunID,
-                                     aEndpoint)) {
+  if (!mozilla::plugins::SetupBridge(aPluginId, this, aRv, aRunID, aEndpoint)) {
     return IPC_FAIL_NO_REASON(this);
   }
   return IPC_OK();
 }
 
 mozilla::ipc::IPCResult
 ContentParent::RecvUngrabPointer(const uint32_t& aTime)
 {
@@ -1136,17 +1135,17 @@ ContentParent::RecvConnectPluginBridge(c
                                        nsresult* aRv,
                                        Endpoint<PPluginModuleParent>* aEndpoint)
 {
   *aRv = NS_OK;
   // We don't need to get the run ID for the plugin, since we already got it
   // in the first call to SetupBridge in RecvLoadPlugin, so we pass in a dummy
   // pointer and just throw it away.
   uint32_t dummy = 0;
-  if (!mozilla::plugins::SetupBridge(aPluginId, this, true, aRv, &dummy, aEndpoint)) {
+  if (!mozilla::plugins::SetupBridge(aPluginId, this, aRv, &dummy, aEndpoint)) {
     return IPC_FAIL(this, "SetupBridge failed");
   }
   return IPC_OK();
 }
 
 mozilla::ipc::IPCResult
 ContentParent::RecvGetBlocklistState(const uint32_t& aPluginId,
                                      uint32_t* aState)
@@ -4499,17 +4498,18 @@ ContentParent::CommonCreateWindow(PBrows
                                   nsIURI* aURIToLoad,
                                   const nsCString& aFeatures,
                                   const nsCString& aBaseURI,
                                   const float& aFullZoom,
                                   uint64_t aNextTabParentId,
                                   const nsString& aName,
                                   nsresult& aResult,
                                   nsCOMPtr<nsITabParent>& aNewTabParent,
-                                  bool* aWindowIsNew)
+                                  bool* aWindowIsNew,
+                                  nsIPrincipal* aTriggeringPrincipal)
 
 {
   // The content process should never be in charge of computing whether or
   // not a window should be private or remote - the parent will do that.
   const uint32_t badFlags = nsIWebBrowserChrome::CHROME_PRIVATE_WINDOW |
                             nsIWebBrowserChrome::CHROME_NON_PRIVATE_WINDOW |
                             nsIWebBrowserChrome::CHROME_PRIVATE_LIFETIME |
                             nsIWebBrowserChrome::CHROME_REMOTE_WINDOW;
@@ -4577,16 +4577,18 @@ ContentParent::CommonCreateWindow(PBrows
     if (NS_WARN_IF(!browserDOMWin)) {
       aResult = NS_ERROR_ABORT;
       return IPC_OK();
     }
 
     nsCOMPtr<nsIOpenURIInFrameParams> params =
       new nsOpenURIInFrameParams(openerOriginAttributes);
     params->SetReferrer(NS_ConvertUTF8toUTF16(aBaseURI));
+    MOZ_ASSERT(aTriggeringPrincipal, "need a valid triggeringPrincipal");
+    params->SetTriggeringPrincipal(aTriggeringPrincipal);
 
     nsCOMPtr<nsIFrameLoaderOwner> frameLoaderOwner;
     aResult = browserDOMWin->OpenURIInFrame(aURIToLoad, params, openLocation,
                                             nsIBrowserDOMWindow::OPEN_NEW,
                                             aNextTabParentId, aName,
                                             getter_AddRefs(frameLoaderOwner));
     if (NS_SUCCEEDED(aResult) && frameLoaderOwner) {
       RefPtr<nsFrameLoader> frameLoader = frameLoaderOwner->GetFrameLoader();
@@ -4642,16 +4644,17 @@ ContentParent::CommonCreateWindow(PBrows
     if (NS_WARN_IF(!newBrowserDOMWin)) {
       aResult = NS_ERROR_ABORT;
       return IPC_OK();
     }
     nsCOMPtr<mozIDOMWindowProxy> win;
     aResult = newBrowserDOMWin->OpenURI(aURIToLoad, openerWindow,
                                         nsIBrowserDOMWindow::OPEN_CURRENTWINDOW,
                                         nsIBrowserDOMWindow::OPEN_NEW,
+                                        aTriggeringPrincipal,
                                         getter_AddRefs(win));
   }
 
   return IPC_OK();
 }
 
 mozilla::ipc::IPCResult
 ContentParent::RecvCreateWindow(PBrowserParent* aThisTab,
@@ -4659,16 +4662,17 @@ ContentParent::RecvCreateWindow(PBrowser
                                 PRenderFrameParent* aRenderFrame,
                                 const uint32_t& aChromeFlags,
                                 const bool& aCalledFromJS,
                                 const bool& aPositionSpecified,
                                 const bool& aSizeSpecified,
                                 const nsCString& aFeatures,
                                 const nsCString& aBaseURI,
                                 const float& aFullZoom,
+                                const IPC::Principal& aTriggeringPrincipal,
                                 CreateWindowResolver&& aResolve)
 {
   nsresult rv = NS_OK;
   CreatedWindowInfo cwi;
 
   // We always expect to open a new window here. If we don't, it's an error.
   cwi.windowOpened() = true;
   cwi.layersId() = 0;
@@ -4703,17 +4707,18 @@ ContentParent::RecvCreateWindow(PBrowser
   sNextTabParents.Put(nextTabParentId, newTab);
 
   nsCOMPtr<nsITabParent> newRemoteTab;
   mozilla::ipc::IPCResult ipcResult =
     CommonCreateWindow(aThisTab, /* aSetOpener = */ true, aChromeFlags,
                        aCalledFromJS, aPositionSpecified, aSizeSpecified,
                        nullptr, aFeatures, aBaseURI, aFullZoom,
                        nextTabParentId, NullString(), rv,
-                       newRemoteTab, &cwi.windowOpened());
+                       newRemoteTab, &cwi.windowOpened(),
+                       aTriggeringPrincipal);
   if (!ipcResult) {
     return ipcResult;
   }
 
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return IPC_OK();
   }
 
@@ -4746,28 +4751,29 @@ ContentParent::RecvCreateWindowInDiffere
   const uint32_t& aChromeFlags,
   const bool& aCalledFromJS,
   const bool& aPositionSpecified,
   const bool& aSizeSpecified,
   const URIParams& aURIToLoad,
   const nsCString& aFeatures,
   const nsCString& aBaseURI,
   const float& aFullZoom,
-  const nsString& aName)
+  const nsString& aName,
+  const IPC::Principal& aTriggeringPrincipal)
 {
   nsCOMPtr<nsITabParent> newRemoteTab;
   bool windowIsNew;
   nsCOMPtr<nsIURI> uriToLoad = DeserializeURI(aURIToLoad);
   nsresult rv;
   mozilla::ipc::IPCResult ipcResult =
     CommonCreateWindow(aThisTab, /* aSetOpener = */ false, aChromeFlags,
                        aCalledFromJS, aPositionSpecified, aSizeSpecified,
                        uriToLoad, aFeatures, aBaseURI, aFullZoom,
                        /* aNextTabParentId = */ 0, aName, rv,
-                       newRemoteTab, &windowIsNew);
+                       newRemoteTab, &windowIsNew, aTriggeringPrincipal);
   if (!ipcResult) {
     return ipcResult;
   }
 
   if (NS_FAILED(rv)) {
     NS_WARNING("Call to CommonCreateWindow failed.");
   }
 

--- a/dom/ipc/ContentParent.h
+++ b/dom/ipc/ContentParent.h
@@ -531,29 +531,31 @@ public:
                    layout::PRenderFrameParent* aRenderFrame,
                    const uint32_t& aChromeFlags,
                    const bool& aCalledFromJS,
                    const bool& aPositionSpecified,
                    const bool& aSizeSpecified,
                    const nsCString& aFeatures,
                    const nsCString& aBaseURI,
                    const float& aFullZoom,
+                   const IPC::Principal& aTriggeringPrincipal,
                    CreateWindowResolver&& aResolve) override;
 
   virtual mozilla::ipc::IPCResult RecvCreateWindowInDifferentProcess(
     PBrowserParent* aThisTab,
     const uint32_t& aChromeFlags,
     const bool& aCalledFromJS,
     const bool& aPositionSpecified,
     const bool& aSizeSpecified,
     const URIParams& aURIToLoad,
     const nsCString& aFeatures,
     const nsCString& aBaseURI,
     const float& aFullZoom,
-    const nsString& aName) override;
+    const nsString& aName,
+    const IPC::Principal& aTriggeringPrincipal) override;
 
   static bool AllocateLayerTreeId(TabParent* aTabParent, uint64_t* aId);
 
   static void
   BroadcastBlobURLRegistration(const nsACString& aURI,
                                BlobImpl* aBlobImpl,
                                nsIPrincipal* aPrincipal,
                                ContentParent* aIgnoreThisCP = nullptr);
@@ -704,17 +706,18 @@ private:
                      nsIURI* aURIToLoad,
                      const nsCString& aFeatures,
                      const nsCString& aBaseURI,
                      const float& aFullZoom,
                      uint64_t aNextTabParentId,
                      const nsString& aName,
                      nsresult& aResult,
                      nsCOMPtr<nsITabParent>& aNewTabParent,
-                     bool* aWindowIsNew);
+                     bool* aWindowIsNew,
+                     nsIPrincipal* aTriggeringPrincipal);
 
   FORWARD_SHMEM_ALLOCATOR_TO(PContentParent)
 
   explicit ContentParent(int32_t aPluginID)
     : ContentParent(nullptr, EmptyString(), aPluginID)
   {}
   ContentParent(ContentParent* aOpener,
                 const nsAString& aRemoteType)

--- a/dom/ipc/PContent.ipdl
+++ b/dom/ipc/PContent.ipdl
@@ -484,29 +484,16 @@ child:
     async LoadAndRegisterSheet(URIParams uri, uint32_t type);
     async UnregisterSheet(URIParams uri, uint32_t type);
 
     /**
      * Notify idle observers in the child
      */
     async NotifyIdleObserver(uint64_t observerId, nsCString topic, nsString str);
 
-    /**
-     * Called during plugin initialization to map a plugin id to a child process
-     * id.
-     */
-    async AssociatePluginId(uint32_t aPluginId, ProcessId aProcessId);
-
-    /**
-     * This call is used by async plugin initialization to notify the
-     * PluginModuleContentParent that the PluginModuleChromeParent's async
-     * init has completed.
-     */
-    async LoadPluginResult(uint32_t aPluginId, bool aResult);
-
     async InvokeDragSession(IPCDataTransfer[] transfers, uint32_t action);
 
     async EndDragSession(bool aDoneDrag, bool aUserCancelled,
                          LayoutDeviceIntPoint aDragEndPoint,
                          uint32_t aKeyModifiers);
 
     async DomainSetChanged(uint32_t aSetType, uint32_t aChangeType, OptionalURIParams aDomain);
 
@@ -986,30 +973,32 @@ parent:
                        PBrowser aNewTab,
                        PRenderFrame aRenderFrame,
                        uint32_t aChromeFlags,
                        bool aCalledFromJS,
                        bool aPositionSpecified,
                        bool aSizeSpecified,
                        nsCString aFeatures,
                        nsCString aBaseURI,
-                       float aFullZoom)
+                       float aFullZoom,
+                       Principal aTriggeringPrincipal)
         returns (CreatedWindowInfo window);
 
     async CreateWindowInDifferentProcess(
       PBrowser aThisTab,
       uint32_t aChromeFlags,
       bool aCalledFromJS,
       bool aPositionSpecified,
       bool aSizeSpecified,
       URIParams aURIToLoad,
       nsCString aFeatures,
       nsCString aBaseURI,
       float aFullZoom,
-      nsString aName);
+      nsString aName,
+      Principal aTriggeringPrincipal);
 
     sync GetAndroidSystemInfo()
         returns (AndroidSystemInfo info);
 
     /**
      * Tells the parent to ungrab the pointer on the default display.
      *
      * This is for GTK platforms where we have to ensure the pointer ungrab happens in the

--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -3439,17 +3439,17 @@ TabChildSHistoryListener::OnRequestCross
   if (!tabChild) {
     return NS_ERROR_FAILURE;
   }
 
   return tabChild->SendRequestCrossBrowserNavigation(aIndex) ?
            NS_OK : NS_ERROR_FAILURE;
 }
 
-TabChildGlobal::TabChildGlobal(TabChildBase* aTabChild)
+TabChildGlobal::TabChildGlobal(TabChild* aTabChild)
 : mTabChild(aTabChild)
 {
   SetIsNotDOMBinding();
 }
 
 TabChildGlobal::~TabChildGlobal()
 {
 }
@@ -3541,8 +3541,37 @@ TabChildGlobal::GetPrincipal()
 }
 
 JSObject*
 TabChildGlobal::GetGlobalJSObject()
 {
   NS_ENSURE_TRUE(mTabChild, nullptr);
   return mTabChild->GetGlobal();
 }
+
+nsresult
+TabChildGlobal::Dispatch(const char* aName,
+                         TaskCategory aCategory,
+                         already_AddRefed<nsIRunnable>&& aRunnable)
+{
+  if (mTabChild && mTabChild->TabGroup()) {
+    return mTabChild->TabGroup()->Dispatch(aName, aCategory, Move(aRunnable));
+  }
+  return DispatcherTrait::Dispatch(aName, aCategory, Move(aRunnable));
+}
+
+nsISerialEventTarget*
+TabChildGlobal::EventTargetFor(TaskCategory aCategory) const
+{
+  if (mTabChild && mTabChild->TabGroup()) {
+    return mTabChild->TabGroup()->EventTargetFor(aCategory);
+  }
+  return DispatcherTrait::EventTargetFor(aCategory);
+}
+
+AbstractThread*
+TabChildGlobal::AbstractMainThreadFor(TaskCategory aCategory)
+{
+  if (mTabChild && mTabChild->TabGroup()) {
+    return mTabChild->TabGroup()->AbstractMainThreadFor(aCategory);
+  }
+  return DispatcherTrait::AbstractMainThreadFor(aCategory);
+}

--- a/dom/ipc/TabChild.h
+++ b/dom/ipc/TabChild.h
@@ -40,18 +40,20 @@
 #include "AudioChannelService.h"
 #include "PuppetWidget.h"
 #include "mozilla/layers/GeckoContentController.h"
 #include "nsISHistoryListener.h"
 #include "nsIPartialSHistoryListener.h"
 
 class nsIDOMWindowUtils;
 class nsIHttpChannel;
+class nsISerialEventTarget;
 
 namespace mozilla {
+class AbstractThread;
 namespace layout {
 class RenderFrameChild;
 } // namespace layout
 
 namespace layers {
 class APZChild;
 class APZEventState;
 class AsyncDragMetrics;
@@ -64,26 +66,25 @@ struct AutoCacheNativeKeyCommands;
 } // namespace widget
 
 namespace dom {
 
 class TabChild;
 class TabGroup;
 class ClonedMessageData;
 class CoalescedWheelData;
-class TabChildBase;
 
 class TabChildGlobal : public DOMEventTargetHelper,
                        public nsIContentFrameMessageManager,
                        public nsIScriptObjectPrincipal,
                        public nsIGlobalObject,
                        public nsSupportsWeakReference
 {
 public:
-  explicit TabChildGlobal(TabChildBase* aTabChild);
+  explicit TabChildGlobal(TabChild* aTabChild);
   void Init();
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(TabChildGlobal, DOMEventTargetHelper)
   NS_FORWARD_SAFE_NSIMESSAGELISTENERMANAGER(mMessageManager)
   NS_FORWARD_SAFE_NSIMESSAGESENDER(mMessageManager)
   NS_FORWARD_SAFE_NSIMESSAGEMANAGERGLOBAL(mMessageManager)
   NS_IMETHOD SendSyncMessage(const nsAString& aMessageName,
                              JS::Handle<JS::Value> aObject,
@@ -144,18 +145,29 @@ public:
   virtual nsIPrincipal* GetPrincipal() override;
   virtual JSObject* GetGlobalJSObject() override;
 
   virtual JSObject* WrapObject(JSContext* cx, JS::Handle<JSObject*> aGivenProto) override
   {
     MOZ_CRASH("TabChildGlobal doesn't use DOM bindings!");
   }
 
+  // Dispatch a runnable related to the global.
+  virtual nsresult Dispatch(const char* aName,
+                            mozilla::TaskCategory aCategory,
+                            already_AddRefed<nsIRunnable>&& aRunnable) override;
+
+  virtual nsISerialEventTarget*
+  EventTargetFor(mozilla::TaskCategory aCategory) const override;
+
+  virtual AbstractThread*
+  AbstractMainThreadFor(mozilla::TaskCategory aCategory) override;
+
   nsCOMPtr<nsIContentFrameMessageManager> mMessageManager;
-  RefPtr<TabChildBase> mTabChild;
+  RefPtr<TabChild> mTabChild;
 
 protected:
   ~TabChildGlobal();
 };
 
 class ContentListener final : public nsIDOMEventListener
 {
 public:

--- a/dom/media/eme/mediadrm/MediaDrmCDMProxy.h
+++ b/dom/media/eme/mediadrm/MediaDrmCDMProxy.h
@@ -23,17 +23,17 @@
 using namespace mozilla::java;
 
 namespace mozilla {
 
 class MediaDrmCDMCallbackProxy;
 class MediaDrmCDMProxy : public CDMProxy {
 public:
 
-  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(MediaDrmCDMProxy)
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(MediaDrmCDMProxy, override)
 
   MediaDrmCDMProxy(dom::MediaKeys* aKeys,
                    const nsAString& aKeySystem,
                    bool aDistinctiveIdentifierRequired,
                    bool aPersistentStateRequired,
                    nsIEventTarget* aMainThread);
 
   void Init(PromiseId aPromiseId,

--- a/dom/payments/PaymentRequest.cpp
+++ b/dom/payments/PaymentRequest.cpp
@@ -585,34 +585,46 @@ PaymentRequest::UpdateShippingAddress(co
                                         aPostalCode, aSortingCode, aLanguageCode,
                                         aOrganization, aRecipient, aPhone);
 
   // Fire shippingaddresschange event
   return DispatchUpdateEvent(NS_LITERAL_STRING("shippingaddresschange"));
 }
 
 void
+PaymentRequest::SetShippingOption(const nsAString& aShippingOption)
+{
+  mShippingOption = aShippingOption;
+}
+
+void
 PaymentRequest::GetShippingOption(nsAString& aRetVal) const
 {
   aRetVal = mShippingOption;
 }
 
 nsresult
 PaymentRequest::UpdateShippingOption(const nsAString& aShippingOption)
 {
   mShippingOption = aShippingOption;
 
   // Fire shippingaddresschange event
   return DispatchUpdateEvent(NS_LITERAL_STRING("shippingoptionchange"));
 }
 
+void
+PaymentRequest::SetShippingType(const Nullable<PaymentShippingType>& aShippingType)
+{
+  mShippingType = aShippingType;
+}
+
 Nullable<PaymentShippingType>
 PaymentRequest::GetShippingType() const
 {
-  return nullptr;
+  return mShippingType;
 }
 
 PaymentRequest::~PaymentRequest()
 {
 }
 
 JSObject*
 PaymentRequest::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto)

--- a/dom/payments/PaymentRequest.h
+++ b/dom/payments/PaymentRequest.h
@@ -101,22 +101,25 @@ public:
                                  const nsAString& aDependentLocality,
                                  const nsAString& aPostalCode,
                                  const nsAString& aSortingCode,
                                  const nsAString& aLanguageCode,
                                  const nsAString& aOrganization,
                                  const nsAString& aRecipient,
                                  const nsAString& aPhone);
 
+
+  void SetShippingOption(const nsAString& aShippingOption);
   void GetShippingOption(nsAString& aRetVal) const;
   nsresult UpdateShippingOption(const nsAString& aShippingOption);
 
   nsresult UpdatePayment(const PaymentDetailsUpdate& aDetails);
   void AbortUpdate(nsresult aRv);
 
+  void SetShippingType(const Nullable<PaymentShippingType>& aShippingType);
   Nullable<PaymentShippingType> GetShippingType() const;
 
   IMPL_EVENT_HANDLER(shippingaddresschange);
   IMPL_EVENT_HANDLER(shippingoptionchange);
 
 protected:
   ~PaymentRequest();
 
@@ -138,16 +141,18 @@ protected:
   RefPtr<Promise> mAbortPromise;
   // Resolve mAcceptPromise with mResponse if user accepts the request.
   RefPtr<PaymentResponse> mResponse;
   // It is populated when the user provides a shipping address.
   RefPtr<PaymentAddress> mShippingAddress;
   // It is populated when the user chooses a shipping option.
   nsString mShippingOption;
 
+  Nullable<PaymentShippingType> mShippingType;
+
   // "true" when there is a pending updateWith() call to update the payment request
   // and "false" otherwise.
   bool mUpdating;
   // The error is set in AbortUpdate(). The value is NS_OK by default.
   nsresult mUpdateError;
 
   enum {
     eUnknown,

--- a/dom/payments/PaymentRequestManager.cpp
+++ b/dom/payments/PaymentRequestManager.cpp
@@ -98,26 +98,27 @@ ConvertShippingOption(const PaymentShipp
   ConvertCurrencyAmount(aOption.mAmount, amount);
   aIPCOption = IPCPaymentShippingOption(aOption.mId, aOption.mLabel, amount, aOption.mSelected);
 }
 
 nsresult
 ConvertDetailsBase(const PaymentDetailsBase& aDetails,
                    nsTArray<IPCPaymentItem>& aDisplayItems,
                    nsTArray<IPCPaymentShippingOption>& aShippingOptions,
-                   nsTArray<IPCPaymentDetailsModifier>& aModifiers)
+                   nsTArray<IPCPaymentDetailsModifier>& aModifiers,
+                   bool aResetShippingOptions)
 {
   if (aDetails.mDisplayItems.WasPassed()) {
     for (const PaymentItem& item : aDetails.mDisplayItems.Value()) {
       IPCPaymentItem displayItem;
       ConvertItem(item, displayItem);
       aDisplayItems.AppendElement(displayItem);
     }
   }
-  if (aDetails.mShippingOptions.WasPassed()) {
+  if (aDetails.mShippingOptions.WasPassed() && !aResetShippingOptions) {
     for (const PaymentShippingOption& option : aDetails.mShippingOptions.Value()) {
       IPCPaymentShippingOption shippingOption;
       ConvertShippingOption(option, shippingOption);
       aShippingOptions.AppendElement(shippingOption);
     }
   }
   if (aDetails.mModifiers.WasPassed()) {
     for (const PaymentDetailsModifier& modifier : aDetails.mModifiers.Value()) {
@@ -129,23 +130,24 @@ ConvertDetailsBase(const PaymentDetailsB
       aModifiers.AppendElement(detailsModifier);
     }
   }
   return NS_OK;
 }
 
 nsresult
 ConvertDetailsInit(const PaymentDetailsInit& aDetails,
-                   IPCPaymentDetails& aIPCDetails)
+                   IPCPaymentDetails& aIPCDetails,
+                   bool aResetShippingOptions)
 {
   // Convert PaymentDetailsBase members
   nsTArray<IPCPaymentItem> displayItems;
   nsTArray<IPCPaymentShippingOption> shippingOptions;
   nsTArray<IPCPaymentDetailsModifier> modifiers;
-  nsresult rv = ConvertDetailsBase(aDetails, displayItems, shippingOptions, modifiers);
+  nsresult rv = ConvertDetailsBase(aDetails, displayItems, shippingOptions, modifiers, aResetShippingOptions);
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return rv;
   }
 
   // Convert |id|
   nsString id(EmptyString());
   if (aDetails.mId.WasPassed()) {
     id = aDetails.mId.Value();
@@ -170,17 +172,20 @@ ConvertDetailsInit(const PaymentDetailsI
 nsresult
 ConvertDetailsUpdate(const PaymentDetailsUpdate& aDetails,
                      IPCPaymentDetails& aIPCDetails)
 {
   // Convert PaymentDetailsBase members
   nsTArray<IPCPaymentItem> displayItems;
   nsTArray<IPCPaymentShippingOption> shippingOptions;
   nsTArray<IPCPaymentDetailsModifier> modifiers;
-  nsresult rv = ConvertDetailsBase(aDetails, displayItems, shippingOptions, modifiers);
+  // [TODO] Populate a boolean flag as aResetShippingOptions based on the
+  // result of processing details.shippingOptions in UpdatePayment method.
+  nsresult rv = ConvertDetailsBase(
+    aDetails, displayItems, shippingOptions, modifiers, false);
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return rv;
   }
 
   // Convert required |total|
   IPCPaymentItem total;
   ConvertItem(aDetails.mTotal, total);
 
@@ -347,46 +352,58 @@ PaymentRequestManager::GetPaymentRequest
     if (request->Equals(aRequestId)) {
       RefPtr<PaymentRequest> paymentRequest = request;
       return paymentRequest.forget();
     }
   }
   return nullptr;
 }
 
+void
+GetSelectedShippingOption(const PaymentDetailsInit& aDetails,
+                          nsAString& aOption,
+                          bool* aResetOptions)
+{
+  SetDOMStringToNull(aOption);
+  if (!aDetails.mShippingOptions.WasPassed()) {
+    return;
+  }
+
+  nsTArray<nsString> seenIDs;
+  const Sequence<PaymentShippingOption>& shippingOptions =
+    aDetails.mShippingOptions.Value();
+  for (const PaymentShippingOption& shippingOption : shippingOptions) {
+    // If there are duplicate IDs present in the shippingOptions, reset aOption
+    // to null and set resetOptions flag to reset details.shippingOptions later
+    // when converting to IPC structure.
+    if (seenIDs.Contains(shippingOption.mId)) {
+      SetDOMStringToNull(aOption);
+      *aResetOptions = true;
+      return;
+    }
+    seenIDs.AppendElement(shippingOption.mId);
+
+    // set aOption to last selected option's ID
+    if (shippingOption.mSelected) {
+      aOption = shippingOption.mId;
+    }
+  }
+}
+
 nsresult
 PaymentRequestManager::CreatePayment(nsPIDOMWindowInner* aWindow,
                                      const Sequence<PaymentMethodData>& aMethodData,
                                      const PaymentDetailsInit& aDetails,
                                      const PaymentOptions& aOptions,
                                      PaymentRequest** aRequest)
 {
   MOZ_ASSERT(NS_IsMainThread());
   NS_ENSURE_ARG_POINTER(aRequest);
   *aRequest = nullptr;
-
   nsresult rv;
-  nsTArray<IPCPaymentMethodData> methodData;
-  for (const PaymentMethodData& data : aMethodData) {
-    IPCPaymentMethodData ipcMethodData;
-    rv = ConvertMethodData(data, ipcMethodData);
-    if (NS_WARN_IF(NS_FAILED(rv))) {
-      return rv;
-    }
-    methodData.AppendElement(ipcMethodData);
-  }
-
-  IPCPaymentDetails details;
-  rv = ConvertDetailsInit(aDetails, details);
-  if (NS_WARN_IF(NS_FAILED(rv))) {
-    return rv;
-  }
-
-  IPCPaymentOptions options;
-  ConvertOptions(aOptions, options);
 
   RefPtr<PaymentRequest> request = PaymentRequest::CreatePaymentRequest(aWindow, rv);
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return rv;
   }
 
   /*
    *  Set request's |mId| to details.id if details.id exists.
@@ -395,18 +412,58 @@ PaymentRequestManager::CreatePayment(nsP
   nsAutoString requestId;
   if (aDetails.mId.WasPassed() && !aDetails.mId.Value().IsEmpty()) {
     requestId = aDetails.mId.Value();
   } else {
     request->GetInternalId(requestId);
   }
   request->SetId(requestId);
 
+  /*
+   *  Set request's mShippingOption to last selected option's ID if
+   *  details.shippingOptions exists and IDs of all options are unique.
+   *  Otherwise, set mShippingOption to null and set the resetShippingOptions
+   *  flag to reset details.shippingOptions to an empty array later when
+   *  converting details to IPC structure.
+   */
+  nsAutoString shippingOption;
+  bool resetShippingOptions = false;
+  GetSelectedShippingOption(aDetails, shippingOption, &resetShippingOptions);
+  request->SetShippingOption(shippingOption);
+
+  /*
+   * Set request's |mShippingType| if shipping is required.
+   */
+  if (aOptions.mRequestShipping) {
+    request->SetShippingType(
+        Nullable<PaymentShippingType>(aOptions.mShippingType));
+  }
+
   nsAutoString internalId;
   request->GetInternalId(internalId);
+
+  nsTArray<IPCPaymentMethodData> methodData;
+  for (const PaymentMethodData& data : aMethodData) {
+    IPCPaymentMethodData ipcMethodData;
+    rv = ConvertMethodData(data, ipcMethodData);
+    if (NS_WARN_IF(NS_FAILED(rv))) {
+      return rv;
+    }
+    methodData.AppendElement(ipcMethodData);
+  }
+
+  IPCPaymentDetails details;
+  rv = ConvertDetailsInit(aDetails, details, resetShippingOptions);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+
+  IPCPaymentOptions options;
+  ConvertOptions(aOptions, options);
+
   IPCPaymentCreateActionRequest action(internalId,
                                        methodData,
                                        details,
                                        options);
 
   rv = SendRequestPayment(request, action, true);
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return rv;
@@ -484,16 +541,22 @@ nsresult
 PaymentRequestManager::UpdatePayment(const nsAString& aRequestId,
                                      const PaymentDetailsUpdate& aDetails)
 {
   RefPtr<PaymentRequest> request = GetPaymentRequestById(aRequestId);
   if (!request) {
     return NS_ERROR_UNEXPECTED;
   }
 
+  // [TODO] Process details.shippingOptions if presented.
+  //        1) Check if there are duplicate IDs in details.shippingOptions,
+  //           if so, reset details.shippingOptions to an empty sequence.
+  //        2) Set request's selectedShippingOption to the ID of last selected
+  //           option.
+
   IPCPaymentDetails details;
   nsresult rv = ConvertDetailsUpdate(aDetails, details);
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return rv;
   }
 
   nsAutoString requestId(aRequestId);
   IPCPaymentUpdateActionRequest action(requestId, details);

--- a/dom/payments/test/ConstructorChromeScript.js
+++ b/dom/payments/test/ConstructorChromeScript.js
@@ -222,16 +222,77 @@ function checkComplexRequest(payRequest)
   if (!paymentOptions.requestShipping) {
     emitTestFail("requestShipping option should be true.");
   }
   if (paymentOptions.shippingType != "shipping") {
     emitTestFail("shippingType option should be 'shipping'.")
   }
 }
 
+function checkDuplicateShippingOptionsRequest(payRequest) {
+  if (payRequest.paymentMethods.length != 1) {
+    emitTestFail("paymentMethods' length should be 1.");
+  }
+
+  const methodData = payRequest.paymentMethods.queryElementAt(0, Ci.nsIPaymentMethodData);
+  if (!methodData) {
+    emitTestFail("Fail to get payment methodData.");
+  }
+  let supportedMethod = methodData.supportedMethods;
+  if (supportedMethod != "basic-card") {
+    emitTestFail("supported method should be 'basic-card'.");
+  }
+  // checking the passed PaymentDetails parameter
+  const details = payRequest.paymentDetails;
+  if (details.id != "duplicate shipping options details" ) {
+    emitTestFail("details.id should be 'duplicate shipping options details'.");
+  }
+  if (details.totalItem.label != "Total") {
+    emitTestFail("total item's label should be 'Total'.");
+  }
+  if (details.totalItem.amount.currency != "USD") {
+    emitTestFail("total item's currency should be 'USD'.");
+  }
+  if (details.totalItem.amount.value != "1.00") {
+    emitTestFail("total item's value should be '1.00'.");
+  }
+
+  if (details.displayItems) {
+    emitTestFail("details.displayItems should be undefined.");
+  }
+  if (details.modifiers) {
+    emitTestFail("details.displayItems should be undefined.");
+  }
+  const shippingOptions = details.shippingOptions;
+  if (!shippingOptions) {
+    emitTestFail("details.shippingOptions should not be undefined.");
+  }
+  if (shippingOptions.length != 0) {
+    emitTestFail("shippingOptions' length should be 0.");
+  }
+
+  // checking the default generated PaymentOptions parameter
+  const paymentOptions = payRequest.paymentOptions;
+  if (paymentOptions.requestPayerName) {
+    emitTestFail("requestPayerName option should be false.");
+  }
+  if (paymentOptions.requestPayerEmail) {
+    emitTestFail("requestPayerEmail option should be false.");
+  }
+  if (paymentOptions.requestPayerPhone) {
+    emitTestFail("requestPayerPhone option should be false.");
+  }
+  if (paymentOptions.requestShipping) {
+    emitTestFail("requestShipping option should be false.");
+  }
+  if (paymentOptions.shippingType != "shipping") {
+    emitTestFail("shippingType option should be 'shipping'.")
+  }
+}
+
 function checkSimplestRequestHandler() {
   const paymentEnum = paymentSrv.enumerate();
   if (!paymentEnum.hasMoreElements()) {
     emitTestFail("PaymentRequestService should have at least one payment request.");
   }
   while (paymentEnum.hasMoreElements()) {
     let payRequest = paymentEnum.getNext().QueryInterface(Ci.nsIPaymentRequest);
     if (!payRequest) {
@@ -256,37 +317,57 @@ function checkComplexRequestHandler() {
       break;
     }
     checkComplexRequest(payRequest);
   }
   paymentSrv.cleanup();
   sendAsyncMessage("check-complete");
 }
 
+function checkDuplicateShippingOptionsRequestHandler() {
+  const paymentEnum = paymentSrv.enumerate();
+  if (!paymentEnum.hasMoreElements()) {
+    emitTestFail("PaymentRequestService should have at least one payment request.");
+  }
+  while (paymentEnum.hasMoreElements()) {
+    let payRequest = paymentEnum.getNext().QueryInterface(Ci.nsIPaymentRequest);
+    if (!payRequest) {
+      emitTestFail("Fail to get existing payment request.");
+      break;
+    }
+    checkDuplicateShippingOptionsRequest(payRequest);
+  }
+  paymentSrv.cleanup();
+  sendAsyncMessage("check-complete");
+}
+
 function checkMultipleRequestsHandler () {
   const paymentEnum = paymentSrv.enumerate();
   if (!paymentEnum.hasMoreElements()) {
     emitTestFail("PaymentRequestService should have at least one payment request.");
   }
   while (paymentEnum.hasMoreElements()) {
     let payRequest = paymentEnum.getNext().QueryInterface(Ci.nsIPaymentRequest);
     if (!payRequest) {
       emitTestFail("Fail to get existing payment request.");
       break;
     }
-    if (payRequest.paymentDetails.id != "payment details") {
+    if (payRequest.paymentDetails.id == "payment details") {
+      checkComplexRequest(payRequest);
+    } else if (payRequest.paymentDetails.id == "duplicate shipping options details") {
+      checkDuplicateShippingOptionsRequest(payRequest);
+    } else {
       checkSimplestRequest(payRequest);
-    } else {
-      checkComplexRequest(payRequest);
     }
   }
   paymentSrv.cleanup();
   sendAsyncMessage("check-complete");
 }
 
 addMessageListener("check-simplest-request", checkSimplestRequestHandler);
 addMessageListener("check-complex-request", checkComplexRequestHandler);
+addMessageListener("check-duplicate-shipping-options-request", checkDuplicateShippingOptionsRequestHandler);
 addMessageListener("check-multiple-requests", checkMultipleRequestsHandler);
 
 addMessageListener("teardown", function() {
   paymentSrv.cleanup();
   sendAsyncMessage("teardown-complete");
 });

--- a/dom/payments/test/browser_multiple_construction.js
+++ b/dom/payments/test/browser_multiple_construction.js
@@ -17,16 +17,18 @@ add_task(async function() {
       ok(paymentEnum.hasMoreElements(), "PaymentRequestService should have at least one payment request.");
       while (paymentEnum.hasMoreElements()) {
         let payment = paymentEnum.getNext().QueryInterface(Ci.nsIPaymentRequest);
         ok(payment, "Fail to get existing payment request.");
         if (payment.paymentDetails.id == "complex details") {
           checkComplexPayment(payment);
         } else if (payment.paymentDetails.id == "simple details") {
           checkSimplePayment(payment);
+        } else if (payment.paymentDetails.id == "duplicate shipping options details") {
+          checkDupShippingOptionsPayment(payment);
         } else {
           ok(false, "Unknown payment.");
         }
       }
       Services.prefs.setBoolPref("dom.payments.request.enabled", false);
     }
   );
 });

--- a/dom/payments/test/head.js
+++ b/dom/payments/test/head.js
@@ -96,14 +96,42 @@ function checkComplexPayment(aPayment) {
   const paymentOptions = aPayment.paymentOptions;
   ok(paymentOptions.requestPayerName, "payerName option should be true");
   ok(paymentOptions.requestPayerEmail, "payerEmail option should be true");
   ok(paymentOptions.requestPayerPhone, "payerPhone option should be true");
   ok(paymentOptions.requestShipping, "requestShipping option should be true");
   is(paymentOptions.shippingType, "shipping", "shippingType option should be 'shipping'");
 }
 
+function checkDupShippingOptionsPayment(aPayment) {
+  // checking the passed PaymentMethods parameter
+  is(aPayment.paymentMethods.length, 1, "paymentMethods' length should be 1.");
+
+  const methodData = aPayment.paymentMethods.queryElementAt(0, Ci.nsIPaymentMethodData);
+  ok(methodData, "Fail to get payment methodData.");
+  is(methodData.supportedMethods, "MyPay", "modifier's supported method name should be 'MyPay'.");
+  is(methodData.data, "", "method data should be empty");
+
+  // checking the passed PaymentDetails parameter
+  const details = aPayment.paymentDetails;
+  is(details.id, "duplicate shipping options details", "details.id should be 'duplicate shipping options details'.");
+  is(details.totalItem.label, "Donation", "total item's label should be 'Donation'.");
+  is(details.totalItem.amount.currency, "USD", "total item's currency should be 'USD'.");
+  is(details.totalItem.amount.value, "55.00", "total item's value should be '55.00'.");
+
+  const shippingOptions = details.shippingOptions;
+  is(shippingOptions.length, 0, "shippingOptions' length should be 0.");
+
+  // checking the passed PaymentOptions parameter
+  const paymentOptions = aPayment.paymentOptions;
+  ok(paymentOptions.requestPayerName, "payerName option should be true");
+  ok(paymentOptions.requestPayerEmail, "payerEmail option should be true");
+  ok(paymentOptions.requestPayerPhone, "payerPhone option should be true");
+  ok(paymentOptions.requestShipping, "requestShipping option should be true");
+  is(paymentOptions.shippingType, "shipping", "shippingType option should be 'shipping'");
+}
+
 function cleanup() {
   const paymentSrv = Cc["@mozilla.org/dom/payments/payment-request-service;1"].getService(Ci.nsIPaymentRequestService);
   if (paymentSrv) {
     paymentSrv.cleanup();
   }
 }

--- a/dom/payments/test/multiple_payment_request.html
+++ b/dom/payments/test/multiple_payment_request.html
@@ -61,24 +61,49 @@
     const simpleDetails = {
       id: "simple details",
       total: {
         label: "Donation",
         amount: { currency: "USD", value: "55.00" }
       },
     };
 
+    const dupShippingOptionsDetails = {
+      id: "duplicate shipping options details",
+      total: {
+        label: "Donation",
+        amount: { currency: "USD", value: "55.00" }
+      },
+      shippingOptions: [
+        {
+          id: "dupShipping",
+          label: "NormalShipping",
+          amount: { currency: "USD", value: "10.00", },
+          selected: true,
+        },
+        {
+          id: "dupShipping",
+          label: "FastShipping",
+          amount: { currency: "USD", value: "30.00", },
+          selected: false,
+        },
+      ],
+    };
+
     const options = {
       requestPayerName: true,
       requestPayerEmail: true,
       requestPayerPhone: true,
       requestShipping: true,
       shippingType: "shipping",
     };
 
     const paymentRequest1 = new PaymentRequest(supportedInstruments,
                                                complexDetails,
                                                options);
     const paymentRequest2 = new PaymentRequest(supportedInstruments,
                                                simpleDetails);
+    const paymentRequest3 = new PaymentRequest(supportedInstruments,
+                                               dupShippingOptionsDetails,
+                                               options);
     </script>
   </body>
 </html>

--- a/dom/payments/test/test_constructor.html
+++ b/dom/payments/test/test_constructor.html
@@ -116,16 +116,47 @@ https://bugzilla.mozilla.org/show_bug.cg
   const complexOptions = {
     requestPayerName: true,
     requestPayerEmail: true,
     requestPayerPhone: true,
     requestShipping: true,
     shippingType: "shipping"
   };
 
+  const duplicateShippingOptionsDetails = {
+    id: "duplicate shipping options details",
+    total: {
+      label: "Total",
+      amount: {
+        currency: "USD",
+        value: "1.00"
+      }
+    },
+    shippingOptions: [
+      {
+        id: "dupShipping",
+        label: "NormalShipping",
+        amount: {
+          currency: "USD",
+          value: "10.00"
+        },
+        selected: true,
+      },
+      {
+        id: "dupShipping",
+        label: "FastShipping",
+        amount: {
+          currency: "USD",
+          value: "30.00"
+        },
+        selected: false,
+      },
+    ],
+  };
+
 
   function testWithSimplestParameters() {
     return new Promise((resolve, reject) => {
       const payRequest = new PaymentRequest(simplestMethods, simplestDetails);
       ok(payRequest, "PaymentRequest should be created");
       gScript.addMessageListener("check-complete", function checkCompleteHandler() {
         gScript.removeMessageListener("check-complete", checkCompleteHandler);
         resolve();
@@ -141,22 +172,36 @@ https://bugzilla.mozilla.org/show_bug.cg
       gScript.addMessageListener("check-complete", function checkCompleteHandler() {
         gScript.removeMessageListener("check-complete", checkCompleteHandler);
         resolve();
       });
       gScript.sendAsyncMessage("check-complex-request");
     });
   }
 
+  function testWithDuplicateShippingOptionsParameters() {
+    return new Promise((resolve, reject) => {
+      const payRequest = new PaymentRequest(simplestMethods, duplicateShippingOptionsDetails);
+      ok(payRequest, "PaymentRequest should be created");
+      gScript.addMessageListener("check-complete", function checkCompleteHandler() {
+        gScript.removeMessageListener("check-complete", checkCompleteHandler);
+        resolve();
+      });
+      gScript.sendAsyncMessage("check-duplicate-shipping-options-request");
+    });
+  }
+
   function testMultipleRequests() {
     return new Promise((resolve, reject) => {
       const payRequest1 = new PaymentRequest(complexMethods, complexDetails, complexOptions);
       const payRequest2 = new PaymentRequest(simplestMethods, simplestDetails);
+      const payRequest3 = new PaymentRequest(simplestMethods, duplicateShippingOptionsDetails);
       ok(payRequest1, "PaymentRequest with complex parameters should be created");
       ok(payRequest2, "PaymentRequest with simplest parameters should be created");
+      ok(payRequest3, "PaymentRequest with duplicate shipping options parameters should be created");
       gScript.addMessageListener("check-complete", function checkCompleteHandler() {
         gScript.removeMessageListener("check-complete", checkCompleteHandler);
         resolve();
       });
       gScript.sendAsyncMessage("check-multiple-requests");
     });
   }
 
@@ -168,16 +213,17 @@ https://bugzilla.mozilla.org/show_bug.cg
       SimpleTest.finish();
     });
     gScript.sendAsyncMessage("teardown");
   }
 
   function runTests() {
     testWithSimplestParameters()
     .then(testWithComplexParameters)
+    .then(testWithDuplicateShippingOptionsParameters)
     .then(testMultipleRequests)
     .then(teardown)
     .catch( e => {
       ok(false, "Unexpected error: " + e.name);
       SimpleTest.finish();
     });
   }
 

--- a/dom/plugins/base/nsJSNPRuntime.cpp
+++ b/dom/plugins/base/nsJSNPRuntime.cpp
@@ -1,9 +1,10 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "base/basictypes.h"
 
 #include "jsfriendapi.h"
 #include "jswrapper.h"
@@ -24,20 +25,16 @@
 #include "nsIDOMElement.h"
 #include "nsIContent.h"
 #include "nsPluginInstanceOwner.h"
 #include "nsWrapperCacheInlines.h"
 #include "js/GCHashTable.h"
 #include "js/TracingAPI.h"
 #include "mozilla/HashFunctions.h"
 #include "mozilla/dom/ScriptSettings.h"
-#include "mozilla/plugins/PluginAsyncSurrogate.h"
-
-using mozilla::plugins::AsyncNPObject;
-using mozilla::plugins::PluginAsyncSurrogate;
 
 #define NPRUNTIME_JSCLASS_NAME "NPObject JS wrapper class"
 
 using namespace mozilla::plugins::parent;
 using namespace mozilla;
 
 #include "mozilla/plugins/PluginScriptableObjectParent.h"
 using mozilla::plugins::PluginScriptableObjectParent;
@@ -104,34 +101,20 @@ static PLDHashTable* sNPObjWrappers;
 static int32_t sWrapperCount;
 
 static bool sCallbackIsRegistered = false;
 
 static nsTArray<NPObject*>* sDelayedReleases;
 
 namespace {
 
-inline void
-CastNPObject(NPObject *aObj, PluginScriptableObjectParent*& aActor,
-             PluginAsyncSurrogate*& aSurrogate)
-{
-  aActor = nullptr;
-  aSurrogate = nullptr;
-  if (aObj->_class == PluginScriptableObjectParent::GetClass()) {
-    aActor = static_cast<ParentNPObject*>(aObj)->parent;
-  } else if (aObj->_class == PluginAsyncSurrogate::GetClass()) {
-    aSurrogate = static_cast<AsyncNPObject*>(aObj)->mSurrogate;
-  }
-}
-
 inline bool
 NPObjectIsOutOfProcessProxy(NPObject *obj)
 {
-  return obj->_class == PluginScriptableObjectParent::GetClass() ||
-         obj->_class == PluginAsyncSurrogate::GetClass();
+  return obj->_class == PluginScriptableObjectParent::GetClass();
 }
 
 } // namespace
 
 // Helper class that suppresses any JS exceptions that were thrown while
 // the plugin executed JS, if the nsJSObjWrapper has a destroy pending.
 // Note that this class is the product (vestige?) of a long evolution in how
 // error reporting worked, and hence the mIsDestroyPending check, and hence this
@@ -1092,27 +1075,16 @@ NPObject *
 nsJSObjWrapper::GetNewOrUsed(NPP npp, JS::Handle<JSObject*> obj)
 {
   if (!npp) {
     NS_ERROR("Null NPP passed to nsJSObjWrapper::GetNewOrUsed()!");
 
     return nullptr;
   }
 
-  // If we're running out-of-process and initializing asynchronously, and if
-  // the plugin has been asked to destroy itself during initialization,
-  // don't return any new NPObjects.
-  nsNPAPIPluginInstance* inst = static_cast<nsNPAPIPluginInstance*>(npp->ndata);
-  if (inst->GetPlugin()->GetLibrary()->IsOOP()) {
-    PluginAsyncSurrogate* surrogate = PluginAsyncSurrogate::Cast(npp);
-    if (surrogate && surrogate->IsDestroyPending()) {
-      return nullptr;
-    }
-  }
-
   // No need to enter the right compartment here as we only get the
   // class and private from the JSObject, neither of which cares about
   // compartments.
 
   if (nsNPObjWrapper::IsWrapper(obj)) {
     // obj is one of our own, its private data is the NPObject we're
     // looking for.
 
@@ -1399,32 +1371,25 @@ NPObjWrapper_GetProperty(JSContext *cx, 
   bool hasProperty, hasMethod;
 
   NPVariant npv;
   VOID_TO_NPVARIANT(npv);
 
   NPIdentifier identifier = JSIdToNPIdentifier(id);
 
   if (NPObjectIsOutOfProcessProxy(npobj)) {
-    PluginScriptableObjectParent* actor = nullptr;
-    PluginAsyncSurrogate* surrogate = nullptr;
-    CastNPObject(npobj, actor, surrogate);
-
-    // actor and surrogate may be null if the plugin crashed.
-    if (!actor && !surrogate)
+    PluginScriptableObjectParent* actor =
+      static_cast<ParentNPObject*>(npobj)->parent;
+
+    // actor may be null if the plugin crashed.
+    if (!actor)
       return false;
 
-    bool success = false;
-    if (surrogate) {
-      success = surrogate->GetPropertyHelper(npobj, identifier, &hasProperty,
-                                             &hasMethod, &npv);
-    } else if (actor) {
-      success = actor->GetPropertyHelper(identifier, &hasProperty, &hasMethod,
-                                         &npv);
-    }
+    bool success = actor->GetPropertyHelper(identifier, &hasProperty,
+                                            &hasMethod, &npv);
 
     if (!ReportExceptionIfPending(cx)) {
       if (success)
         _releasevariantvalue(&npv);
       return false;
     }
 
     if (success) {

--- a/dom/plugins/base/nsPluginHost.cpp
+++ b/dom/plugins/base/nsPluginHost.cpp
@@ -48,17 +48,16 @@
 #include "nsIObjectLoadingContent.h"
 #include "nsIWritablePropertyBag2.h"
 #include "nsICategoryManager.h"
 #include "nsPluginStreamListenerPeer.h"
 #include "mozilla/dom/ContentChild.h"
 #include "mozilla/dom/ContentParent.h"
 #include "mozilla/dom/FakePluginTagInitBinding.h"
 #include "mozilla/LoadInfo.h"
-#include "mozilla/plugins/PluginAsyncSurrogate.h"
 #include "mozilla/plugins/PluginBridge.h"
 #include "mozilla/plugins/PluginTypes.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/ipc/URIUtils.h"
 
 #include "nsEnumeratorUtils.h"
 #include "nsXPCOM.h"
 #include "nsXPCOMCID.h"
@@ -114,17 +113,16 @@
 #endif
 
 #include "npapi.h"
 
 using namespace mozilla;
 using mozilla::TimeStamp;
 using mozilla::plugins::FakePluginTag;
 using mozilla::plugins::PluginTag;
-using mozilla::plugins::PluginAsyncSurrogate;
 using mozilla::dom::FakePluginTagInit;
 using mozilla::dom::FakePluginMimeEntry;
 
 // Null out a strong ref to a linked list iteratively to avoid
 // exhausting the stack (bug 486349).
 #define NS_ITERATIVE_UNREF_LIST(type_, list_, mNext_)                \
   {                                                                  \
     while (list_) {                                                  \
@@ -753,27 +751,25 @@ nsPluginHost::InstantiatePluginInstance(
     return NS_ERROR_FAILURE;
   }
 
   rv = SetUpPluginInstance(aMimeType, aURL, instanceOwner);
   if (NS_FAILED(rv)) {
     instanceOwner->Destroy();
     return NS_ERROR_FAILURE;
   }
-  const bool isAsyncInit = (rv == NS_PLUGIN_INIT_PENDING);
 
   RefPtr<nsNPAPIPluginInstance> instance;
   rv = instanceOwner->GetInstance(getter_AddRefs(instance));
   if (NS_FAILED(rv)) {
     instanceOwner->Destroy();
     return rv;
   }
 
-  // Async init plugins will initiate their own widget creation.
-  if (!isAsyncInit && instance) {
+  if (instance) {
     CreateWidget(instanceOwner);
   }
 
   // At this point we consider instantiation to be successful. Do not return an error.
   instanceOwner.forget(aOwner);
 
 #ifdef PLUGIN_LOGGING
   nsAutoCString urlSpec2;
@@ -2378,17 +2374,16 @@ nsPluginHost::SetPluginsInContent(uint32
                                                tag.filename().get(),
                                                "", // aFullPath
                                                tag.version().get(),
                                                nsTArray<nsCString>(tag.mimeTypes()),
                                                nsTArray<nsCString>(tag.mimeDescriptions()),
                                                nsTArray<nsCString>(tag.extensions()),
                                                tag.isJavaPlugin(),
                                                tag.isFlashPlugin(),
-                                               tag.supportsAsyncInit(),
                                                tag.supportsAsyncRender(),
                                                tag.lastModifiedTime(),
                                                tag.isFromExtension(),
                                                tag.sandboxLevel());
       AddPluginTag(pluginTag);
     }
 
     for (const auto& tag : aFakePlugins) {
@@ -2619,17 +2614,16 @@ nsPluginHost::SendPluginsToContent()
     pluginTags.AppendElement(PluginTag(tag->mId,
                                        tag->Name(),
                                        tag->Description(),
                                        tag->MimeTypes(),
                                        tag->MimeDescriptions(),
                                        tag->Extensions(),
                                        tag->mIsJavaPlugin,
                                        tag->mIsFlashPlugin,
-                                       tag->mSupportsAsyncInit,
                                        tag->mSupportsAsyncRender,
                                        tag->FileName(),
                                        tag->Version(),
                                        tag->mLastModifiedTime,
                                        tag->IsFromExtension(),
                                        tag->mSandboxLevel));
   }
   nsTArray<dom::ContentParent*> parents;
@@ -4018,22 +4012,16 @@ mozilla::LinkedList<nsPluginDestroyRunna
 mozilla::LinkedList<PluginDestructionGuard> PluginDestructionGuard::sList;
 
 PluginDestructionGuard::PluginDestructionGuard(nsNPAPIPluginInstance *aInstance)
   : mInstance(aInstance)
 {
   Init();
 }
 
-PluginDestructionGuard::PluginDestructionGuard(PluginAsyncSurrogate *aSurrogate)
-  : mInstance(static_cast<nsNPAPIPluginInstance*>(aSurrogate->GetNPP()->ndata))
-{
-  InitAsync();
-}
-
 PluginDestructionGuard::PluginDestructionGuard(NPP npp)
   : mInstance(npp ? static_cast<nsNPAPIPluginInstance*>(npp->ndata) : nullptr)
 {
   Init();
 }
 
 PluginDestructionGuard::~PluginDestructionGuard()
 {

--- a/dom/plugins/base/nsPluginHost.h
+++ b/dom/plugins/base/nsPluginHost.h
@@ -30,17 +30,16 @@
 #ifdef XP_WIN
 #include <minwindef.h>
 #include "nsIWindowsRegKey.h"
 #endif
 
 namespace mozilla {
 namespace plugins {
 class FakePluginTag;
-class PluginAsyncSurrogate;
 class PluginTag;
 } // namespace plugins
 } // namespace mozilla
 
 class nsNPAPIPlugin;
 class nsIFile;
 class nsIChannel;
 class nsPluginNativeWindow;
@@ -420,43 +419,31 @@ private:
   // two different CIDs for some reason...
   static nsPluginHost* sInst;
 };
 
 class PluginDestructionGuard : public mozilla::LinkedListElement<PluginDestructionGuard>
 {
 public:
   explicit PluginDestructionGuard(nsNPAPIPluginInstance *aInstance);
-  explicit PluginDestructionGuard(mozilla::plugins::PluginAsyncSurrogate *aSurrogate);
   explicit PluginDestructionGuard(NPP npp);
 
   ~PluginDestructionGuard();
 
   static bool DelayDestroy(nsNPAPIPluginInstance *aInstance);
 
 protected:
   void Init()
   {
     NS_ASSERTION(NS_IsMainThread(), "Should be on the main thread");
 
     mDelayedDestroy = false;
 
     sList.insertBack(this);
   }
 
-  void InitAsync()
-  {
-    NS_ASSERTION(NS_IsMainThread(), "Should be on the main thread");
-
-    mDelayedDestroy = false;
-
-    // Instances with active surrogates must be inserted *in front of* sList so
-    // that they appear to be at the bottom of the stack
-    sList.insertFront(this);
-  }
-
   RefPtr<nsNPAPIPluginInstance> mInstance;
   bool mDelayedDestroy;
 
   static mozilla::LinkedList<PluginDestructionGuard> sList;
 };
 
 #endif // nsPluginHost_h_

--- a/dom/plugins/base/nsPluginInstanceOwner.cpp
+++ b/dom/plugins/base/nsPluginInstanceOwner.cpp
@@ -1663,55 +1663,16 @@ void nsPluginInstanceOwner::ExitFullScre
   if (sFullScreenInstance && sFullScreenInstance->mInstance &&
       env->IsSameObject(view, (jobject)sFullScreenInstance->mInstance->GetJavaSurface())) {
     sFullScreenInstance->ExitFullScreen();
   }
 }
 
 #endif
 
-void
-nsPluginInstanceOwner::NotifyHostAsyncInitFailed()
-{
-  nsCOMPtr<nsIObjectLoadingContent> content = do_QueryReferent(mContent);
-  content->StopPluginInstance();
-}
-
-void
-nsPluginInstanceOwner::NotifyHostCreateWidget()
-{
-  mPluginHost->CreateWidget(this);
-#ifdef XP_MACOSX
-  FixUpPluginWindow(ePluginPaintEnable);
-#else
-  if (mPluginFrame) {
-    mPluginFrame->InvalidateFrame();
-  } else {
-    CallSetWindow();
-  }
-#endif
-}
-
-void
-nsPluginInstanceOwner::NotifyDestroyPending()
-{
-  if (!mInstance) {
-    return;
-  }
-  bool isOOP = false;
-  if (NS_FAILED(mInstance->GetIsOOP(&isOOP)) || !isOOP) {
-    return;
-  }
-  NPP npp = nullptr;
-  if (NS_FAILED(mInstance->GetNPP(&npp)) || !npp) {
-    return;
-  }
-  PluginAsyncSurrogate::NotifyDestroyPending(npp);
-}
-
 nsresult nsPluginInstanceOwner::DispatchFocusToPlugin(nsIDOMEvent* aFocusEvent)
 {
 #ifdef MOZ_WIDGET_ANDROID
   if (mInstance) {
     ANPEvent event;
     event.inSize = sizeof(ANPEvent);
     event.eventType = kLifecycle_ANPEventType;
 

--- a/dom/plugins/base/nsPluginInstanceOwner.h
+++ b/dom/plugins/base/nsPluginInstanceOwner.h
@@ -264,20 +264,16 @@ public:
 
   void RequestFullScreen();
   void ExitFullScreen();
 
   // Called from nsAppShell when we removed the fullscreen view.
   static void ExitFullScreen(jobject view);
 #endif
 
-  void NotifyHostAsyncInitFailed();
-  void NotifyHostCreateWidget();
-  void NotifyDestroyPending();
-
   bool GetCompositionString(uint32_t aIndex, nsTArray<uint8_t>* aString,
                             int32_t* aLength);
   bool SetCandidateWindow(
            const mozilla::widget::CandidateWindowPosition& aPosition);
   bool RequestCommitOrCancel(bool aCommitted);
 
   // See nsIKeyEventInPluginCallback
   virtual void HandledWindowedPluginKeyEvent(

--- a/dom/plugins/base/nsPluginTags.cpp
+++ b/dom/plugins/base/nsPluginTags.cpp
@@ -228,17 +228,16 @@ nsPluginTag::nsPluginTag(nsPluginInfo* a
   : nsIInternalPluginTag(aPluginInfo->fName, aPluginInfo->fDescription,
                          aPluginInfo->fFileName, aPluginInfo->fVersion),
     mId(sNextId++),
     mContentProcessRunningCount(0),
     mHadLocalInstance(false),
     mLibrary(nullptr),
     mIsJavaPlugin(false),
     mIsFlashPlugin(false),
-    mSupportsAsyncInit(false),
     mSupportsAsyncRender(false),
     mFullPath(aPluginInfo->fFullPath),
     mLastModifiedTime(aLastModifiedTime),
     mSandboxLevel(0),
     mCachedBlocklistState(nsIBlocklistService::STATE_NOT_BLOCKED),
     mCachedBlocklistStateValid(false),
     mIsFromExtension(fromExtension)
 {
@@ -265,17 +264,16 @@ nsPluginTag::nsPluginTag(const char* aNa
                          bool aArgsAreUTF8)
   : nsIInternalPluginTag(aName, aDescription, aFileName, aVersion),
     mId(sNextId++),
     mContentProcessRunningCount(0),
     mHadLocalInstance(false),
     mLibrary(nullptr),
     mIsJavaPlugin(false),
     mIsFlashPlugin(false),
-    mSupportsAsyncInit(false),
     mSupportsAsyncRender(false),
     mFullPath(aFullPath),
     mLastModifiedTime(aLastModifiedTime),
     mSandboxLevel(0),
     mCachedBlocklistState(nsIBlocklistService::STATE_NOT_BLOCKED),
     mCachedBlocklistStateValid(false),
     mIsFromExtension(fromExtension)
 {
@@ -293,29 +291,27 @@ nsPluginTag::nsPluginTag(uint32_t aId,
                          const char* aFileName,
                          const char* aFullPath,
                          const char* aVersion,
                          nsTArray<nsCString> aMimeTypes,
                          nsTArray<nsCString> aMimeDescriptions,
                          nsTArray<nsCString> aExtensions,
                          bool aIsJavaPlugin,
                          bool aIsFlashPlugin,
-                         bool aSupportsAsyncInit,
                          bool aSupportsAsyncRender,
                          int64_t aLastModifiedTime,
                          bool aFromExtension,
                          int32_t aSandboxLevel)
   : nsIInternalPluginTag(aName, aDescription, aFileName, aVersion, aMimeTypes,
                          aMimeDescriptions, aExtensions),
     mId(aId),
     mContentProcessRunningCount(0),
     mLibrary(nullptr),
     mIsJavaPlugin(aIsJavaPlugin),
     mIsFlashPlugin(aIsFlashPlugin),
-    mSupportsAsyncInit(aSupportsAsyncInit),
     mSupportsAsyncRender(aSupportsAsyncRender),
     mLastModifiedTime(aLastModifiedTime),
     mSandboxLevel(aSandboxLevel),
     mNiceFileName(),
     mCachedBlocklistState(nsIBlocklistService::STATE_NOT_BLOCKED),
     mCachedBlocklistStateValid(false),
     mIsFromExtension(aFromExtension)
 {
@@ -351,35 +347,27 @@ void nsPluginTag::InitMime(const char* c
     if (!nsPluginHost::IsTypeWhitelisted(mimeType.get())) {
       continue;
     }
 
     // Look for certain special plugins.
     switch (nsPluginHost::GetSpecialType(mimeType)) {
       case nsPluginHost::eSpecialType_Java:
         mIsJavaPlugin = true;
-        mSupportsAsyncInit = true;
         break;
       case nsPluginHost::eSpecialType_Flash:
         // VLC sometimes claims to implement the Flash MIME type, and we want
         // to allow users to control that separately from Adobe Flash.
         if (Name().EqualsLiteral("Shockwave Flash")) {
           mIsFlashPlugin = true;
-          mSupportsAsyncInit = true;
         }
         break;
       case nsPluginHost::eSpecialType_Test:
-        mSupportsAsyncInit = true;
-        break;
       case nsPluginHost::eSpecialType_None:
       default:
-#ifndef RELEASE_OR_BETA
-        // Allow async init for all plugins on Nightly and Aurora
-        mSupportsAsyncInit = true;
-#endif
         break;
     }
 
     // Fill in our MIME type array.
     mMimeTypes.AppendElement(mimeType);
 
     // Now fill in the MIME descriptions.
     if (aMimeDescriptions && aMimeDescriptions[i]) {

--- a/dom/plugins/base/nsPluginTags.h
+++ b/dom/plugins/base/nsPluginTags.h
@@ -127,17 +127,16 @@ public:
               const char* aFileName,
               const char* aFullPath,
               const char* aVersion,
               nsTArray<nsCString> aMimeTypes,
               nsTArray<nsCString> aMimeDescriptions,
               nsTArray<nsCString> aExtensions,
               bool aIsJavaPlugin,
               bool aIsFlashPlugin,
-              bool aSupportsAsyncInit,
               bool aSupportsAsyncRender,
               int64_t aLastModifiedTime,
               bool aFromExtension,
               int32_t aSandboxLevel);
 
   void TryUnloadPlugin(bool inShutdown);
 
   // plugin is enabled and not blocklisted
@@ -164,17 +163,16 @@ public:
 
   // True if we've ever created an instance of this plugin in the current process.
   bool          mHadLocalInstance;
 
   PRLibrary     *mLibrary;
   RefPtr<nsNPAPIPlugin> mPlugin;
   bool          mIsJavaPlugin;
   bool          mIsFlashPlugin;
-  bool          mSupportsAsyncInit;
   bool          mSupportsAsyncRender;
   nsCString     mFullPath; // UTF-8
   int64_t       mLastModifiedTime;
   nsCOMPtr<nsITimer> mUnloadTimer;
   int32_t       mSandboxLevel;
 
   void          InvalidateBlocklistState();
 

--- a/dom/plugins/ipc/BrowserStreamParent.cpp
+++ b/dom/plugins/ipc/BrowserStreamParent.cpp
@@ -1,16 +1,15 @@
 /* -*- Mode: C++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 8 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
 #include "BrowserStreamParent.h"
-#include "PluginAsyncSurrogate.h"
 #include "PluginInstanceParent.h"
 #include "nsNPAPIPlugin.h"
 
 #include "mozilla/UniquePtr.h"
 #include "mozilla/Unused.h"
 
 // How much data are we willing to send across the wire
 // in one chunk?
@@ -18,17 +17,16 @@ static const int32_t kSendDataChunk = 0x
 
 namespace mozilla {
 namespace plugins {
 
 BrowserStreamParent::BrowserStreamParent(PluginInstanceParent* npp,
                                          NPStream* stream)
   : mNPP(npp)
   , mStream(stream)
-  , mDeferredDestroyReason(NPRES_DONE)
   , mState(INITIALIZING)
 {
   mStream->pdata = static_cast<AStream*>(this);
   nsNPAPIStreamWrapper* wrapper =
     reinterpret_cast<nsNPAPIStreamWrapper*>(mStream->ndata);
   if (wrapper) {
     mStreamListener = wrapper->GetStreamListener();
   }
@@ -41,51 +39,16 @@ BrowserStreamParent::~BrowserStreamParen
 
 void
 BrowserStreamParent::ActorDestroy(ActorDestroyReason aWhy)
 {
   // Implement me! Bug 1005159
 }
 
 mozilla::ipc::IPCResult
-BrowserStreamParent::RecvAsyncNPP_NewStreamResult(const NPError& rv,
-                                                  const uint16_t& stype)
-{
-  PLUGIN_LOG_DEBUG_FUNCTION;
-  PluginAsyncSurrogate* surrogate = mNPP->GetAsyncSurrogate();
-  MOZ_ASSERT(surrogate);
-  surrogate->AsyncCallArriving();
-  if (mState == DEFERRING_DESTROY) {
-    // We've been asked to destroy ourselves before init was complete.
-    mState = DYING;
-    Unused << SendNPP_DestroyStream(mDeferredDestroyReason);
-    return IPC_OK();
-  }
-
-  NPError error = rv;
-  if (error == NPERR_NO_ERROR) {
-    if (!mStreamListener) {
-      return IPC_FAIL_NO_REASON(this);
-    }
-    if (mStreamListener->SetStreamType(stype)) {
-      mState = ALIVE;
-    } else {
-      error = NPERR_GENERIC_ERROR;
-    }
-  }
-
-  if (error != NPERR_NO_ERROR) {
-    surrogate->DestroyAsyncStream(mStream);
-    Unused << PBrowserStreamParent::Send__delete__(this);
-  }
-
-  return IPC_OK();
-}
-
-mozilla::ipc::IPCResult
 BrowserStreamParent::AnswerNPN_RequestRead(const IPCByteRanges& ranges,
                                            NPError* result)
 {
   PLUGIN_LOG_DEBUG_FUNCTION;
 
   switch (mState) {
   case INITIALIZING:
     NS_ERROR("Requesting a read before initialization has completed");
@@ -144,17 +107,16 @@ BrowserStreamParent::RecvNPN_DestroyStre
 void
 BrowserStreamParent::NPP_DestroyStream(NPReason reason)
 {
   NS_ASSERTION(ALIVE == mState || INITIALIZING == mState,
                "NPP_DestroyStream called twice?");
   bool stillInitializing = INITIALIZING == mState;
   if (stillInitializing) {
     mState = DEFERRING_DESTROY;
-    mDeferredDestroyReason = reason;
   } else {
     mState = DYING;
     Unused << SendNPP_DestroyStream(reason);
   }
 }
 
 mozilla::ipc::IPCResult
 BrowserStreamParent::RecvStreamDestroyed()

--- a/dom/plugins/ipc/BrowserStreamParent.h
+++ b/dom/plugins/ipc/BrowserStreamParent.h
@@ -25,20 +25,16 @@ public:
   BrowserStreamParent(PluginInstanceParent* npp,
                       NPStream* stream);
   virtual ~BrowserStreamParent();
 
   virtual bool IsBrowserStream() override { return true; }
 
   virtual void ActorDestroy(ActorDestroyReason aWhy) override;
 
-  virtual mozilla::ipc::IPCResult RecvAsyncNPP_NewStreamResult(
-    const NPError& rv,
-    const uint16_t& stype) override;
-
   virtual mozilla::ipc::IPCResult AnswerNPN_RequestRead(const IPCByteRanges& ranges,
                                                         NPError* result) override;
 
   virtual mozilla::ipc::IPCResult RecvNPN_DestroyStream(const NPReason& reason) override;
 
   virtual mozilla::ipc::IPCResult RecvStreamDestroyed() override;
 
   int32_t WriteReady();
@@ -56,17 +52,16 @@ public:
 
 private:
   using PBrowserStreamParent::SendNPP_DestroyStream;
 
   PluginInstanceParent* mNPP;
   NPStream* mStream;
   nsCOMPtr<nsISupports> mStreamPeer;
   RefPtr<nsNPAPIPluginStreamListener> mStreamListener;
-  NPReason mDeferredDestroyReason;
 
   enum {
     INITIALIZING,
     DEFERRING_DESTROY,
     ALIVE,
     DYING,
     DELETING
   } mState;

--- a/dom/plugins/ipc/PBrowserStream.ipdl
+++ b/dom/plugins/ipc/PBrowserStream.ipdl
@@ -31,17 +31,16 @@ child:
   /**
    * NPP_DestroyStream may race with other messages: the child acknowledges
    * the message with StreamDestroyed before this actor is deleted.
    */
   async NPP_DestroyStream(NPReason reason);
   async __delete__();
 
 parent:
-  async AsyncNPP_NewStreamResult(NPError rv, uint16_t stype);
   intr NPN_RequestRead(IPCByteRanges ranges)
     returns (NPError result);
   async NPN_DestroyStream(NPReason reason);
   async StreamDestroyed();
 
 /*
   TODO: turn on state machine.
 

--- a/dom/plugins/ipc/PPluginInstance.ipdl
+++ b/dom/plugins/ipc/PPluginInstance.ipdl
@@ -249,19 +249,16 @@ parent:
     returns (NPError result);
 
   intr NPN_ConvertPoint(double sourceX, bool ignoreDestX, double sourceY, bool ignoreDestY, NPCoordinateSpace sourceSpace,
                        NPCoordinateSpace destSpace)
     returns (double destX, double destY, bool result);
 
   async RedrawPlugin();
 
-  // Notifies the parent of its NPP_New result code.
-  async AsyncNPP_NewResult(NPError aResult);
-
   // Sends a native window to be adopted by the native window that would be
   // returned by NPN_GetValue_NPNVnetscapeWindow. Only used on Windows.
   async SetNetscapeWindowAsParent(NativeWindowHandle childWindow);
 
   sync GetCompositionString(uint32_t aType)
                             returns (uint8_t[] aDist, int32_t aLength);
   // Set candidate window position.
   //
@@ -288,19 +285,16 @@ child:
                        nsCString headers);
 
   // Implements the legacy (synchronous) version of NPP_NewStream for when
   // async plugin init is preffed off.
   intr NPP_NewStream(PBrowserStream actor, nsCString mimeType, bool seekable)
     returns (NPError rv,
              uint16_t stype);
 
-  // Implements the async plugin init version of NPP_NewStream.
-  async AsyncNPP_NewStream(PBrowserStream actor, nsCString mimeType, bool seekable);
-
 parent:
   /* NPN_NewStream */
   intr PPluginStream(nsCString mimeType,
                     nsCString target)
     returns (NPError result);
 
 parent:
   intr PluginFocusChange(bool gotFocus);

--- a/dom/plugins/ipc/PPluginModule.ipdl
+++ b/dom/plugins/ipc/PPluginModule.ipdl
@@ -57,30 +57,25 @@ child:
 
   // Forces the child process to update its plugin function table.
   intr NP_GetEntryPoints()
     returns (NPError rv);
 
   intr NP_Initialize(PluginSettings settings)
     returns (NPError rv);
 
-  async AsyncNP_Initialize(PluginSettings settings);
-
   async PPluginInstance(nsCString aMimeType,
                         nsCString[] aNames,
                         nsCString[] aValues);
 
   // Implements the synchronous version of NPP_New for when async plugin init
   // is preffed off.
   intr SyncNPP_New(PPluginInstance aActor)
     returns (NPError rv);
 
-  // Implements the async plugin init version of NPP_New.
-  async AsyncNPP_New(PPluginInstance aActor);
-
   intr NP_Shutdown()
     returns (NPError rv);
 
   intr OptionalFunctionsSupported()
     returns (bool aURLRedirectNotify, bool aClearSiteData,
              bool aGetSitesWithData);
 
   async NPP_ClearSiteData(nsCString site, uint64_t flags, uint64_t maxAge, uint64_t aCallbackId);
@@ -99,18 +94,16 @@ child:
 
   async SettingChanged(PluginSettings settings);
 
   async NPP_SetValue_NPNVaudioDeviceChangeDetails(NPAudioDeviceChangeDetailsIPC changeDetails);
 
   async InitPluginModuleChild(Endpoint<PPluginModuleChild> endpoint);
 
 parent:
-  async NP_InitializeResult(NPError aError);
-
   /**
    * This message is only used on X11 platforms.
    *
    * Send a dup of the plugin process's X socket to the parent
    * process.  In theory, this scheme keeps the plugin's X resources
    * around until after both the plugin process shuts down *and* the
    * parent process closes the dup fd.  This is used to prevent the
    * parent process from crashing on X errors if, e.g., the plugin

deleted file mode 100644
--- a/dom/plugins/ipc/PluginAsyncSurrogate.cpp
+++ /dev/null
@@ -1,996 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "PluginAsyncSurrogate.h"
-
-#include "base/message_loop.h"
-#include "base/message_pump_default.h"
-#include "mozilla/dom/ContentChild.h"
-#include "mozilla/plugins/PluginInstanceParent.h"
-#include "mozilla/plugins/PluginModuleParent.h"
-#include "mozilla/plugins/PluginScriptableObjectParent.h"
-#include "mozilla/Telemetry.h"
-#include "nsJSNPRuntime.h"
-#include "nsNPAPIPlugin.h"
-#include "nsNPAPIPluginInstance.h"
-#include "nsNPAPIPluginStreamListener.h"
-#include "nsPluginInstanceOwner.h"
-#include "nsPluginStreamListenerPeer.h"
-#include "npruntime.h"
-#include "nsThreadUtils.h"
-#include "PluginMessageUtils.h"
-
-namespace mozilla {
-namespace plugins {
-
-AsyncNPObject::AsyncNPObject(PluginAsyncSurrogate* aSurrogate)
-  : NPObject()
-  , mSurrogate(aSurrogate)
-  , mRealObject(nullptr)
-{
-}
-
-AsyncNPObject::~AsyncNPObject()
-{
-  if (mRealObject) {
-    --mRealObject->asyncWrapperCount;
-    parent::_releaseobject(mRealObject);
-    mRealObject = nullptr;
-  }
-}
-
-NPObject*
-AsyncNPObject::GetRealObject()
-{
-  if (mRealObject) {
-    return mRealObject;
-  }
-  PluginInstanceParent* instance = PluginInstanceParent::Cast(mSurrogate->GetNPP());
-  if (!instance) {
-    return nullptr;
-  }
-  NPObject* realObject = nullptr;
-  NPError err = instance->NPP_GetValue(NPPVpluginScriptableNPObject,
-                                       &realObject);
-  if (err != NPERR_NO_ERROR) {
-    return nullptr;
-  }
-  if (realObject->_class != PluginScriptableObjectParent::GetClass()) {
-    NS_ERROR("Don't know what kind of object this is!");
-    parent::_releaseobject(realObject);
-    return nullptr;
-  }
-  mRealObject = static_cast<ParentNPObject*>(realObject);
-  ++mRealObject->asyncWrapperCount;
-  return mRealObject;
-}
-
-class MOZ_STACK_CLASS RecursionGuard
-{
-public:
-  RecursionGuard()
-    : mIsRecursive(sHasEntered)
-  {
-    if (!mIsRecursive) {
-      sHasEntered = true;
-    }
-  }
-
-  ~RecursionGuard()
-  {
-    if (!mIsRecursive) {
-      sHasEntered = false;
-    }
-  }
-
-  inline bool
-  IsRecursive()
-  {
-    return mIsRecursive;
-  }
-
-private:
-  bool        mIsRecursive;
-  static bool sHasEntered;
-};
-
-bool RecursionGuard::sHasEntered = false;
-
-PluginAsyncSurrogate::PluginAsyncSurrogate(PluginModuleParent* aParent)
-  : mParent(aParent)
-  , mWindow(nullptr)
-  , mAcceptCalls(false)
-  , mInstantiated(false)
-  , mAsyncSetWindow(false)
-  , mInitCancelled(false)
-  , mDestroyPending(false)
-  , mAsyncCallsInFlight(0)
-{
-  MOZ_ASSERT(aParent);
-}
-
-PluginAsyncSurrogate::~PluginAsyncSurrogate()
-{
-}
-
-bool
-PluginAsyncSurrogate::Init(NPMIMEType aPluginType, NPP aInstance,
-                           int16_t aArgc, char* aArgn[], char* aArgv[])
-{
-  mMimeType = aPluginType;
-  nsNPAPIPluginInstance* instance =
-    static_cast<nsNPAPIPluginInstance*>(aInstance->ndata);
-  MOZ_ASSERT(instance);
-  mInstance = instance;
-  for (int i = 0; i < aArgc; ++i) {
-    mNames.AppendElement(NullableString(aArgn[i]));
-    mValues.AppendElement(NullableString(aArgv[i]));
-  }
-  return true;
-}
-
-/* static */ bool
-PluginAsyncSurrogate::Create(PluginModuleParent* aParent, NPMIMEType aPluginType,
-                             NPP aInstance, int16_t aArgc,
-                             char* aArgn[], char* aArgv[])
-{
-  RefPtr<PluginAsyncSurrogate> surrogate(new PluginAsyncSurrogate(aParent));
-  if (!surrogate->Init(aPluginType, aInstance, aArgc, aArgn, aArgv)) {
-    return false;
-  }
-  PluginAsyncSurrogate* rawSurrogate = nullptr;
-  surrogate.forget(&rawSurrogate);
-  aInstance->pdata = static_cast<PluginDataResolver*>(rawSurrogate);
-  return true;
-}
-
-/* static */ PluginAsyncSurrogate*
-PluginAsyncSurrogate::Cast(NPP aInstance)
-{
-  MOZ_ASSERT(aInstance);
-  PluginDataResolver* resolver =
-    reinterpret_cast<PluginDataResolver*>(aInstance->pdata);
-  if (!resolver) {
-    return nullptr;
-  }
-  return resolver->GetAsyncSurrogate();
-}
-
-nsresult
-PluginAsyncSurrogate::NPP_New(NPError* aError)
-{
-  if (!mInstance) {
-    return NS_ERROR_NULL_POINTER;
-  }
-
-  nsresult rv = mParent->NPP_NewInternal(mMimeType.BeginWriting(), GetNPP(),
-                                         mNames, mValues, nullptr,
-                                         aError);
-  if (NS_FAILED(rv)) {
-    return rv;
-  }
-  return NS_OK;
-}
-
-void
-PluginAsyncSurrogate::NP_GetEntryPoints(NPPluginFuncs* aFuncs)
-{
-  aFuncs->version = (NP_VERSION_MAJOR << 8) | NP_VERSION_MINOR;
-  aFuncs->destroy = &NPP_Destroy;
-  aFuncs->getvalue = &NPP_GetValue;
-  aFuncs->setvalue = &NPP_SetValue;
-  aFuncs->newstream = &NPP_NewStream;
-  aFuncs->setwindow = &NPP_SetWindow;
-  aFuncs->writeready = &NPP_WriteReady;
-  aFuncs->event = &NPP_HandleEvent;
-  aFuncs->destroystream = &NPP_DestroyStream;
-  // We need to set these so that content code doesn't make assumptions
-  // about these operations not being supported
-  aFuncs->write = &PluginModuleParent::NPP_Write;
-  aFuncs->asfile = &PluginModuleParent::NPP_StreamAsFile;
-}
-
-/* static */ void
-PluginAsyncSurrogate::NotifyDestroyPending(NPP aInstance)
-{
-  PluginAsyncSurrogate* surrogate = Cast(aInstance);
-  if (!surrogate) {
-    return;
-  }
-  surrogate->NotifyDestroyPending();
-}
-
-NPP
-PluginAsyncSurrogate::GetNPP()
-{
-  MOZ_ASSERT(mInstance);
-  NPP npp;
-  DebugOnly<nsresult> rv = mInstance->GetNPP(&npp);
-  MOZ_ASSERT(NS_SUCCEEDED(rv));
-  return npp;
-}
-
-void
-PluginAsyncSurrogate::NotifyDestroyPending()
-{
-  mDestroyPending = true;
-  nsJSNPRuntime::OnPluginDestroyPending(GetNPP());
-}
-
-NPError
-PluginAsyncSurrogate::NPP_Destroy(NPSavedData** aSave)
-{
-  NotifyDestroyPending();
-  if (!WaitForInit()) {
-    return NPERR_GENERIC_ERROR;
-  }
-  return PluginModuleParent::NPP_Destroy(GetNPP(), aSave);
-}
-
-NPError
-PluginAsyncSurrogate::NPP_GetValue(NPPVariable aVariable, void* aRetval)
-{
-  if (aVariable != NPPVpluginScriptableNPObject) {
-    if (!WaitForInit()) {
-      return NPERR_GENERIC_ERROR;
-    }
-
-    PluginInstanceParent* instance = PluginInstanceParent::Cast(GetNPP());
-    MOZ_ASSERT(instance);
-    return instance->NPP_GetValue(aVariable, aRetval);
-  }
-
-  NPObject* npobject = parent::_createobject(GetNPP(),
-                                             const_cast<NPClass*>(GetClass()));
-  MOZ_ASSERT(npobject);
-  MOZ_ASSERT(npobject->_class == GetClass());
-  MOZ_ASSERT(npobject->referenceCount == 1);
-  *(NPObject**)aRetval = npobject;
-  return npobject ? NPERR_NO_ERROR : NPERR_GENERIC_ERROR;
-}
-
-NPError
-PluginAsyncSurrogate::NPP_SetValue(NPNVariable aVariable, void* aValue)
-{
-  if (!WaitForInit()) {
-    return NPERR_GENERIC_ERROR;
-  }
-  return PluginModuleParent::NPP_SetValue(GetNPP(), aVariable, aValue);
-}
-
-NPError
-PluginAsyncSurrogate::NPP_NewStream(NPMIMEType aType, NPStream* aStream,
-                                    NPBool aSeekable, uint16_t* aStype)
-{
-  mPendingNewStreamCalls.AppendElement(PendingNewStreamCall(aType, aStream,
-                                                            aSeekable));
-  if (aStype) {
-    *aStype = nsPluginStreamListenerPeer::STREAM_TYPE_UNKNOWN;
-  }
-  return NPERR_NO_ERROR;
-}
-
-NPError
-PluginAsyncSurrogate::NPP_SetWindow(NPWindow* aWindow)
-{
-  mWindow = aWindow;
-  mAsyncSetWindow = false;
-  return NPERR_NO_ERROR;
-}
-
-nsresult
-PluginAsyncSurrogate::AsyncSetWindow(NPWindow* aWindow)
-{
-  mWindow = aWindow;
-  mAsyncSetWindow = true;
-  return NS_OK;
-}
-
-void
-PluginAsyncSurrogate::NPP_Print(NPPrint* aPrintInfo)
-{
-  // Do nothing, we've got nothing to print right now
-}
-
-int16_t
-PluginAsyncSurrogate::NPP_HandleEvent(void* event)
-{
-  // Drop the event -- the plugin isn't around to handle it
-  return false;
-}
-
-int32_t
-PluginAsyncSurrogate::NPP_WriteReady(NPStream* aStream)
-{
-  // We'll tell the browser to retry in a bit. Eventually NPP_WriteReady
-  // will resolve to the plugin's NPP_WriteReady and this should all just work.
-  return 0;
-}
-
-NPError
-PluginAsyncSurrogate::NPP_DestroyStream(NPStream* aStream, NPReason aReason)
-{
-  for (uint32_t idx = 0, len = mPendingNewStreamCalls.Length(); idx < len; ++idx) {
-    PendingNewStreamCall& curPendingCall = mPendingNewStreamCalls[idx];
-    if (curPendingCall.mStream == aStream) {
-      mPendingNewStreamCalls.RemoveElementAt(idx);
-      break;
-    }
-  }
-  return NPERR_NO_ERROR;
-}
-
-/* static */ NPError
-PluginAsyncSurrogate::NPP_Destroy(NPP aInstance, NPSavedData** aSave)
-{
-  PluginAsyncSurrogate* rawSurrogate = Cast(aInstance);
-  MOZ_ASSERT(rawSurrogate);
-  PluginModuleParent* module = rawSurrogate->GetParent();
-  if (module && !module->IsInitialized()) {
-    // Take ownership of pdata's surrogate since we're going to release it
-    RefPtr<PluginAsyncSurrogate> surrogate(dont_AddRef(rawSurrogate));
-    aInstance->pdata = nullptr;
-    // We haven't actually called NPP_New yet, so we should remove the
-    // surrogate for this instance.
-    bool removeOk = module->RemovePendingSurrogate(surrogate);
-    MOZ_ASSERT(removeOk);
-    if (!removeOk) {
-      return NPERR_GENERIC_ERROR;
-    }
-    surrogate->mInitCancelled = true;
-    return NPERR_NO_ERROR;
-  }
-  return rawSurrogate->NPP_Destroy(aSave);
-}
-
-/* static */ NPError
-PluginAsyncSurrogate::NPP_GetValue(NPP aInstance, NPPVariable aVariable,
-                                   void* aRetval)
-{
-  PluginAsyncSurrogate* surrogate = Cast(aInstance);
-  MOZ_ASSERT(surrogate);
-  return surrogate->NPP_GetValue(aVariable, aRetval);
-}
-
-/* static */ NPError
-PluginAsyncSurrogate::NPP_SetValue(NPP aInstance, NPNVariable aVariable,
-                                   void* aValue)
-{
-  PluginAsyncSurrogate* surrogate = Cast(aInstance);
-  MOZ_ASSERT(surrogate);
-  return surrogate->NPP_SetValue(aVariable, aValue);
-}
-
-/* static */ NPError
-PluginAsyncSurrogate::NPP_NewStream(NPP aInstance, NPMIMEType aType,
-                                    NPStream* aStream, NPBool aSeekable,
-                                    uint16_t* aStype)
-{
-  PluginAsyncSurrogate* surrogate = Cast(aInstance);
-  MOZ_ASSERT(surrogate);
-  return surrogate->NPP_NewStream(aType, aStream, aSeekable, aStype);
-}
-
-/* static */ NPError
-PluginAsyncSurrogate::NPP_SetWindow(NPP aInstance, NPWindow* aWindow)
-{
-  PluginAsyncSurrogate* surrogate = Cast(aInstance);
-  MOZ_ASSERT(surrogate);
-  return surrogate->NPP_SetWindow(aWindow);
-}
-
-/* static */ void
-PluginAsyncSurrogate::NPP_Print(NPP aInstance, NPPrint* aPrintInfo)
-{
-  PluginAsyncSurrogate* surrogate = Cast(aInstance);
-  MOZ_ASSERT(surrogate);
-  surrogate->NPP_Print(aPrintInfo);
-}
-
-/* static */ int16_t
-PluginAsyncSurrogate::NPP_HandleEvent(NPP aInstance, void* aEvent)
-{
-  PluginAsyncSurrogate* surrogate = Cast(aInstance);
-  MOZ_ASSERT(surrogate);
-  return surrogate->NPP_HandleEvent(aEvent);
-}
-
-/* static */ int32_t
-PluginAsyncSurrogate::NPP_WriteReady(NPP aInstance, NPStream* aStream)
-{
-  PluginAsyncSurrogate* surrogate = Cast(aInstance);
-  MOZ_ASSERT(surrogate);
-  return surrogate->NPP_WriteReady(aStream);
-}
-
-/* static */ NPError
-PluginAsyncSurrogate::NPP_DestroyStream(NPP aInstance,
-                                        NPStream* aStream,
-                                        NPReason aReason)
-{
-  PluginAsyncSurrogate* surrogate = Cast(aInstance);
-  MOZ_ASSERT(surrogate);
-  return surrogate->NPP_DestroyStream(aStream, aReason);
-}
-
-PluginAsyncSurrogate::PendingNewStreamCall::PendingNewStreamCall(
-    NPMIMEType aType, NPStream* aStream, NPBool aSeekable)
-  : mType(NullableString(aType))
-  , mStream(aStream)
-  , mSeekable(aSeekable)
-{
-}
-
-/* static */ nsNPAPIPluginStreamListener*
-PluginAsyncSurrogate::GetStreamListener(NPStream* aStream)
-{
-  nsNPAPIStreamWrapper* wrapper =
-    reinterpret_cast<nsNPAPIStreamWrapper*>(aStream->ndata);
-  if (!wrapper) {
-    return nullptr;
-  }
-  return wrapper->GetStreamListener();
-}
-
-void
-PluginAsyncSurrogate::DestroyAsyncStream(NPStream* aStream)
-{
-  MOZ_ASSERT(aStream);
-  nsNPAPIPluginStreamListener* streamListener = GetStreamListener(aStream);
-  MOZ_ASSERT(streamListener);
-  // streamListener was suspended during async init. We must resume the stream
-  // request prior to calling _destroystream for cleanup to work correctly.
-  streamListener->ResumeRequest();
-  if (!mInstance) {
-    return;
-  }
-  parent::_destroystream(GetNPP(), aStream, NPRES_DONE);
-}
-
-/* static */ bool
-PluginAsyncSurrogate::SetStreamType(NPStream* aStream, uint16_t aStreamType)
-{
-  nsNPAPIPluginStreamListener* streamListener = GetStreamListener(aStream);
-  if (!streamListener) {
-    return false;
-  }
-  return streamListener->SetStreamType(aStreamType);
-}
-
-void
-PluginAsyncSurrogate::OnInstanceCreated(PluginInstanceParent* aInstance)
-{
-  if (!mDestroyPending) {
-    // If NPP_Destroy has already been called then these streams have already
-    // been cleaned up on the browser side and are no longer valid.
-    for (uint32_t i = 0, len = mPendingNewStreamCalls.Length(); i < len; ++i) {
-      PendingNewStreamCall& curPendingCall = mPendingNewStreamCalls[i];
-      uint16_t streamType = NP_NORMAL;
-      NPError curError = aInstance->NPP_NewStream(
-                      const_cast<char*>(NullableStringGet(curPendingCall.mType)),
-                      curPendingCall.mStream, curPendingCall.mSeekable,
-                      &streamType);
-      if (curError != NPERR_NO_ERROR) {
-        // If we failed here then the send failed and we need to clean up
-        DestroyAsyncStream(curPendingCall.mStream);
-      }
-    }
-  }
-  mPendingNewStreamCalls.Clear();
-  mInstantiated = true;
-}
-
-/**
- * During asynchronous initialization it might be necessary to wait for the
- * plugin to complete its initialization. This typically occurs when the result
- * of a plugin call depends on the plugin being fully instantiated. For example,
- * if some JS calls into the plugin, the call must be executed synchronously to
- * preserve correctness.
- *
- * This function works by pumping the plugin's IPC channel for events until
- * initialization has completed.
- */
-bool
-PluginAsyncSurrogate::WaitForInit()
-{
-  if (mInitCancelled) {
-    return false;
-  }
-  if (mAcceptCalls) {
-    return true;
-  }
-  Telemetry::AutoTimer<Telemetry::BLOCKED_ON_PLUGINASYNCSURROGATE_WAITFORINIT_MS>
-    timer(mParent->GetHistogramKey());
-  bool result = false;
-  MOZ_ASSERT(mParent);
-  if (mParent->IsChrome()) {
-    PluginProcessParent* process = static_cast<PluginModuleChromeParent*>(mParent)->Process();
-    MOZ_ASSERT(process);
-    process->SetCallRunnableImmediately(true);
-    if (!process->WaitUntilConnected()) {
-      return false;
-    }
-  }
-  if (!mParent->WaitForIPCConnection()) {
-    return false;
-  }
-  if (!mParent->IsChrome()) {
-    // For e10s content processes, we need to spin the content channel until the
-    // protocol bridging has occurred.
-    dom::ContentChild* cp = dom::ContentChild::GetSingleton();
-    mozilla::ipc::MessageChannel* contentChannel = cp->GetIPCChannel();
-    MOZ_ASSERT(contentChannel);
-    while (!mParent->mNPInitialized) {
-      if (mParent->mShutdown) {
-        // Since we are pumping the message channel for events, it may be
-        // possible for module initialization to fail during this loop. We must
-        // return false if this happens or else we'll be permanently stuck.
-        return false;
-      }
-      result = contentChannel->WaitForIncomingMessage();
-      if (!result) {
-        return result;
-      }
-    }
-  }
-  mozilla::ipc::MessageChannel* channel = mParent->GetIPCChannel();
-  MOZ_ASSERT(channel);
-  while (!mAcceptCalls) {
-    if (mInitCancelled) {
-      // Since we are pumping the message channel for events, it may be
-      // possible for plugin instantiation to fail during this loop. We must
-      // return false if this happens or else we'll be permanently stuck.
-      return false;
-    }
-    result = channel->WaitForIncomingMessage();
-    if (!result) {
-      break;
-    }
-  }
-  return result;
-}
-
-void
-PluginAsyncSurrogate::AsyncCallDeparting()
-{
-  ++mAsyncCallsInFlight;
-  if (!mPluginDestructionGuard) {
-    mPluginDestructionGuard = MakeUnique<PluginDestructionGuard>(this);
-  }
-}
-
-void
-PluginAsyncSurrogate::AsyncCallArriving()
-{
-  MOZ_ASSERT(mAsyncCallsInFlight > 0);
-  if (--mAsyncCallsInFlight == 0) {
-    mPluginDestructionGuard.reset(nullptr);
-  }
-}
-
-void
-PluginAsyncSurrogate::NotifyAsyncInitFailed()
-{
-  if (!mDestroyPending) {
-    // Clean up any pending NewStream requests
-    for (uint32_t i = 0, len = mPendingNewStreamCalls.Length(); i < len; ++i) {
-      PendingNewStreamCall& curPendingCall = mPendingNewStreamCalls[i];
-      DestroyAsyncStream(curPendingCall.mStream);
-    }
-  }
-  mPendingNewStreamCalls.Clear();
-
-  // Make sure that any WaitForInit calls on this surrogate will fail, or else
-  // we'll be perma-blocked
-  mInitCancelled = true;
-
-  if (!mInstance) {
-      return;
-  }
-  nsPluginInstanceOwner* owner = mInstance->GetOwner();
-  if (owner) {
-    owner->NotifyHostAsyncInitFailed();
-  }
-}
-
-// static
-NPObject*
-PluginAsyncSurrogate::ScriptableAllocate(NPP aInstance, NPClass* aClass)
-{
-  PLUGIN_LOG_DEBUG_FUNCTION;
-  if (aClass != GetClass()) {
-    NS_ERROR("Huh?! Wrong class!");
-    return nullptr;
-  }
-
-  return new AsyncNPObject(Cast(aInstance));
-}
-
-// static
-void
-PluginAsyncSurrogate::ScriptableInvalidate(NPObject* aObject)
-{
-  PLUGIN_LOG_DEBUG_FUNCTION;
-  if (aObject->_class != GetClass()) {
-    NS_ERROR("Don't know what kind of object this is!");
-    return;
-  }
-
-  AsyncNPObject* object = static_cast<AsyncNPObject*>(aObject);
-  if (!object->mSurrogate->WaitForInit()) {
-    return;
-  }
-  NPObject* realObject = object->GetRealObject();
-  if (!realObject) {
-    return;
-  }
-  realObject->_class->invalidate(realObject);
-}
-
-// static
-void
-PluginAsyncSurrogate::ScriptableDeallocate(NPObject* aObject)
-{
-  PLUGIN_LOG_DEBUG_FUNCTION;
-  if (aObject->_class != GetClass()) {
-    NS_ERROR("Don't know what kind of object this is!");
-    return;
-  }
-
-  AsyncNPObject* object = static_cast<AsyncNPObject*>(aObject);
-  delete object;
-}
-
-// static
-bool
-PluginAsyncSurrogate::ScriptableHasMethod(NPObject* aObject,
-                                                  NPIdentifier aName)
-{
-  PLUGIN_LOG_DEBUG_FUNCTION;
-  if (aObject->_class != GetClass()) {
-    NS_ERROR("Don't know what kind of object this is!");
-    return false;
-  }
-
-  RecursionGuard guard;
-  if (guard.IsRecursive()) {
-    return false;
-  }
-
-  AsyncNPObject* object = static_cast<AsyncNPObject*>(aObject);
-  MOZ_ASSERT(object);
-  bool checkPluginObject = !object->mSurrogate->mInstantiated &&
-                           !object->mSurrogate->mAcceptCalls;
-
-  if (!object->mSurrogate->WaitForInit()) {
-    return false;
-  }
-  NPObject* realObject = object->GetRealObject();
-  if (!realObject) {
-    return false;
-  }
-  bool result = realObject->_class->hasMethod(realObject, aName);
-  if (!result && checkPluginObject) {
-    // We may be calling into this object because properties in the WebIDL
-    // object hadn't been set yet. Now that we're further along in
-    // initialization, we should try again.
-    const NPNetscapeFuncs* npn = object->mSurrogate->mParent->GetNetscapeFuncs();
-    NPObject* pluginObject = nullptr;
-    NPError nperror = npn->getvalue(object->mSurrogate->GetNPP(),
-                                    NPNVPluginElementNPObject,
-                                    (void*)&pluginObject);
-    if (nperror == NPERR_NO_ERROR) {
-      NPPAutoPusher nppPusher(object->mSurrogate->GetNPP());
-      result = pluginObject->_class->hasMethod(pluginObject, aName);
-      npn->releaseobject(pluginObject);
-      NPUTF8* idstr = npn->utf8fromidentifier(aName);
-      npn->memfree(idstr);
-    }
-  }
-  return result;
-}
-
-bool
-PluginAsyncSurrogate::GetPropertyHelper(NPObject* aObject, NPIdentifier aName,
-                                        bool* aHasProperty, bool* aHasMethod,
-                                        NPVariant* aResult)
-{
-  PLUGIN_LOG_DEBUG_FUNCTION;
-
-  if (!aObject) {
-    return false;
-  }
-
-  RecursionGuard guard;
-  if (guard.IsRecursive()) {
-    return false;
-  }
-
-  if (!WaitForInit()) {
-    return false;
-  }
-
-  AsyncNPObject* object = static_cast<AsyncNPObject*>(aObject);
-  NPObject* realObject = object->GetRealObject();
-  if (!realObject) {
-    return false;
-  }
-  if (realObject->_class != PluginScriptableObjectParent::GetClass()) {
-    NS_ERROR("Don't know what kind of object this is!");
-    return false;
-  }
-
-  PluginScriptableObjectParent* actor =
-    static_cast<ParentNPObject*>(realObject)->parent;
-  if (!actor) {
-    return false;
-  }
-  bool success = actor->GetPropertyHelper(aName, aHasProperty, aHasMethod, aResult);
-  if (!success) {
-    const NPNetscapeFuncs* npn = mParent->GetNetscapeFuncs();
-    NPObject* pluginObject = nullptr;
-    NPError nperror = npn->getvalue(GetNPP(), NPNVPluginElementNPObject,
-                                    (void*)&pluginObject);
-    if (nperror == NPERR_NO_ERROR) {
-      NPPAutoPusher nppPusher(GetNPP());
-      bool hasProperty = nsJSObjWrapper::HasOwnProperty(pluginObject, aName);
-      NPUTF8* idstr = npn->utf8fromidentifier(aName);
-      npn->memfree(idstr);
-      bool hasMethod = false;
-      if (hasProperty) {
-        hasMethod = pluginObject->_class->hasMethod(pluginObject, aName);
-        success = pluginObject->_class->getProperty(pluginObject, aName, aResult);
-        idstr = npn->utf8fromidentifier(aName);
-        npn->memfree(idstr);
-      }
-      *aHasProperty = hasProperty;
-      *aHasMethod = hasMethod;
-      npn->releaseobject(pluginObject);
-    }
-  }
-  return success;
-}
-
-// static
-bool
-PluginAsyncSurrogate::ScriptableInvoke(NPObject* aObject,
-                                               NPIdentifier aName,
-                                               const NPVariant* aArgs,
-                                               uint32_t aArgCount,
-                                               NPVariant* aResult)
-{
-  PLUGIN_LOG_DEBUG_FUNCTION;
-  if (aObject->_class != GetClass()) {
-    NS_ERROR("Don't know what kind of object this is!");
-    return false;
-  }
-
-  AsyncNPObject* object = static_cast<AsyncNPObject*>(aObject);
-  if (!object->mSurrogate->WaitForInit()) {
-    return false;
-  }
-  NPObject* realObject = object->GetRealObject();
-  if (!realObject) {
-    return false;
-  }
-  return realObject->_class->invoke(realObject, aName, aArgs, aArgCount, aResult);
-}
-
-// static
-bool
-PluginAsyncSurrogate::ScriptableInvokeDefault(NPObject* aObject,
-                                                      const NPVariant* aArgs,
-                                                      uint32_t aArgCount,
-                                                      NPVariant* aResult)
-{
-  PLUGIN_LOG_DEBUG_FUNCTION;
-  if (aObject->_class != GetClass()) {
-    NS_ERROR("Don't know what kind of object this is!");
-    return false;
-  }
-
-  AsyncNPObject* object = static_cast<AsyncNPObject*>(aObject);
-  if (!object->mSurrogate->WaitForInit()) {
-    return false;
-  }
-  NPObject* realObject = object->GetRealObject();
-  if (!realObject) {
-    return false;
-  }
-  return realObject->_class->invokeDefault(realObject, aArgs, aArgCount, aResult);
-}
-
-// static
-bool
-PluginAsyncSurrogate::ScriptableHasProperty(NPObject* aObject,
-                                                    NPIdentifier aName)
-{
-  PLUGIN_LOG_DEBUG_FUNCTION;
-  if (aObject->_class != GetClass()) {
-    NS_ERROR("Don't know what kind of object this is!");
-    return false;
-  }
-
-  RecursionGuard guard;
-  if (guard.IsRecursive()) {
-    return false;
-  }
-
-  AsyncNPObject* object = static_cast<AsyncNPObject*>(aObject);
-  MOZ_ASSERT(object);
-  bool checkPluginObject = !object->mSurrogate->mInstantiated &&
-                           !object->mSurrogate->mAcceptCalls;
-
-  if (!object->mSurrogate->WaitForInit()) {
-    return false;
-  }
-  NPObject* realObject = object->GetRealObject();
-  if (!realObject) {
-    return false;
-  }
-  bool result = realObject->_class->hasProperty(realObject, aName);
-  const NPNetscapeFuncs* npn = object->mSurrogate->mParent->GetNetscapeFuncs();
-  NPUTF8* idstr = npn->utf8fromidentifier(aName);
-  npn->memfree(idstr);
-  if (!result && checkPluginObject) {
-    // We may be calling into this object because properties in the WebIDL
-    // object hadn't been set yet. Now that we're further along in
-    // initialization, we should try again.
-    NPObject* pluginObject = nullptr;
-    NPError nperror = npn->getvalue(object->mSurrogate->GetNPP(),
-                                    NPNVPluginElementNPObject,
-                                    (void*)&pluginObject);
-    if (nperror == NPERR_NO_ERROR) {
-      NPPAutoPusher nppPusher(object->mSurrogate->GetNPP());
-      result = nsJSObjWrapper::HasOwnProperty(pluginObject, aName);
-      npn->releaseobject(pluginObject);
-      idstr = npn->utf8fromidentifier(aName);
-      npn->memfree(idstr);
-    }
-  }
-  return result;
-}
-
-// static
-bool
-PluginAsyncSurrogate::ScriptableGetProperty(NPObject* aObject,
-                                                    NPIdentifier aName,
-                                                    NPVariant* aResult)
-{
-  PLUGIN_LOG_DEBUG_FUNCTION;
-  // See GetPropertyHelper below.
-  NS_NOTREACHED("Shouldn't ever call this directly!");
-  return false;
-}
-
-// static
-bool
-PluginAsyncSurrogate::ScriptableSetProperty(NPObject* aObject,
-                                                    NPIdentifier aName,
-                                                    const NPVariant* aValue)
-{
-  PLUGIN_LOG_DEBUG_FUNCTION;
-  if (aObject->_class != GetClass()) {
-    NS_ERROR("Don't know what kind of object this is!");
-    return false;
-  }
-
-  AsyncNPObject* object = static_cast<AsyncNPObject*>(aObject);
-  if (!object->mSurrogate->WaitForInit()) {
-    return false;
-  }
-  NPObject* realObject = object->GetRealObject();
-  if (!realObject) {
-    return false;
-  }
-  return realObject->_class->setProperty(realObject, aName, aValue);
-}
-
-// static
-bool
-PluginAsyncSurrogate::ScriptableRemoveProperty(NPObject* aObject,
-                                                       NPIdentifier aName)
-{
-  PLUGIN_LOG_DEBUG_FUNCTION;
-  if (aObject->_class != GetClass()) {
-    NS_ERROR("Don't know what kind of object this is!");
-    return false;
-  }
-
-  AsyncNPObject* object = static_cast<AsyncNPObject*>(aObject);
-  if (!object->mSurrogate->WaitForInit()) {
-    return false;
-  }
-  NPObject* realObject = object->GetRealObject();
-  if (!realObject) {
-    return false;
-  }
-  return realObject->_class->removeProperty(realObject, aName);
-}
-
-// static
-bool
-PluginAsyncSurrogate::ScriptableEnumerate(NPObject* aObject,
-                                                  NPIdentifier** aIdentifiers,
-                                                  uint32_t* aCount)
-{
-  PLUGIN_LOG_DEBUG_FUNCTION;
-  if (aObject->_class != GetClass()) {
-    NS_ERROR("Don't know what kind of object this is!");
-    return false;
-  }
-
-  AsyncNPObject* object = static_cast<AsyncNPObject*>(aObject);
-  if (!object->mSurrogate->WaitForInit()) {
-    return false;
-  }
-  NPObject* realObject = object->GetRealObject();
-  if (!realObject) {
-    return false;
-  }
-  return realObject->_class->enumerate(realObject, aIdentifiers, aCount);
-}
-
-// static
-bool
-PluginAsyncSurrogate::ScriptableConstruct(NPObject* aObject,
-                                                  const NPVariant* aArgs,
-                                                  uint32_t aArgCount,
-                                                  NPVariant* aResult)
-{
-  PLUGIN_LOG_DEBUG_FUNCTION;
-  if (aObject->_class != GetClass()) {
-    NS_ERROR("Don't know what kind of object this is!");
-    return false;
-  }
-
-  AsyncNPObject* object = static_cast<AsyncNPObject*>(aObject);
-  if (!object->mSurrogate->WaitForInit()) {
-    return false;
-  }
-  NPObject* realObject = object->GetRealObject();
-  if (!realObject) {
-    return false;
-  }
-  return realObject->_class->construct(realObject, aArgs, aArgCount, aResult);
-}
-
-const NPClass PluginAsyncSurrogate::sNPClass = {
-  NP_CLASS_STRUCT_VERSION,
-  PluginAsyncSurrogate::ScriptableAllocate,
-  PluginAsyncSurrogate::ScriptableDeallocate,
-  PluginAsyncSurrogate::ScriptableInvalidate,
-  PluginAsyncSurrogate::ScriptableHasMethod,
-  PluginAsyncSurrogate::ScriptableInvoke,
-  PluginAsyncSurrogate::ScriptableInvokeDefault,
-  PluginAsyncSurrogate::ScriptableHasProperty,
-  PluginAsyncSurrogate::ScriptableGetProperty,
-  PluginAsyncSurrogate::ScriptableSetProperty,
-  PluginAsyncSurrogate::ScriptableRemoveProperty,
-  PluginAsyncSurrogate::ScriptableEnumerate,
-  PluginAsyncSurrogate::ScriptableConstruct
-};
-
-PushSurrogateAcceptCalls::PushSurrogateAcceptCalls(PluginInstanceParent* aInstance)
-  : mSurrogate(nullptr)
-  , mPrevAcceptCallsState(false)
-{
-  MOZ_ASSERT(aInstance);
-  mSurrogate = aInstance->GetAsyncSurrogate();
-  if (mSurrogate) {
-    mPrevAcceptCallsState = mSurrogate->SetAcceptingCalls(true);
-  }
-}
-
-PushSurrogateAcceptCalls::~PushSurrogateAcceptCalls()
-{
-  if (mSurrogate) {
-    mSurrogate->SetAcceptingCalls(mPrevAcceptCallsState);
-  }
-}
-
-} // namespace plugins
-} // namespace mozilla