--- a/browser/config/mozconfigs/linux64/code-coverage
+++ b/browser/config/mozconfigs/linux64/code-coverage
@@ -7,11 +7,11 @@ TOOLTOOL_DIR=${TOOLTOOL_DIR:-$topsrcdir}
 ac_add_options --disable-install-strip
 ac_add_options --disable-elf-hack
 ac_add_options --disable-sandbox
 ac_add_options --disable-dmd
 ac_add_options --disable-profiling
 ac_add_options --disable-warnings-as-errors
 ac_add_options --enable-coverage
 
-export LDFLAGS="--coverage -L$topsrcdir/clang/lib/clang/8.0.0/lib/linux/"
+export LDFLAGS="--coverage -L$MOZ_FETCHES_DIR/clang/lib/clang/8.0.0/lib/linux/"
 export LIBS="-lclang_rt.profile-x86_64"
 export RUSTFLAGS="-Ccodegen-units=1 -Zprofile -Zno-landing-pads -Clink-dead-code -Coverflow-checks=off"

--- a/browser/config/mozconfigs/linux64/debug-searchfox-clang
+++ b/browser/config/mozconfigs/linux64/debug-searchfox-clang
@@ -4,18 +4,18 @@ MOZ_AUTOMATION_L10N_CHECK=0
 
 . "$topsrcdir/build/unix/mozconfig.unix"
 
 ac_add_options --enable-debug
 
 . $topsrcdir/build/mozconfig.stylo
 
 # Use Clang as specified in manifest
-export CC="$topsrcdir/clang/bin/clang"
-export CXX="$topsrcdir/clang/bin/clang++"
+export CC="$MOZ_FETCHES_DIR/clang/bin/clang"
+export CXX="$MOZ_FETCHES_DIR/clang/bin/clang++"
 
 # Save rust analysis (this requires unlocking the unstable features,
 # which is done in the taskcluster task definition via RUSTC_BOOTSTRAP)
 export RUSTFLAGS="-Zsave-analysis"
 
 # Add the static checker
 ac_add_options --enable-clang-plugin
 ac_add_options --enable-mozsearch-plugin

--- a/browser/config/mozconfigs/linux64/debug-static-analysis-clang
+++ b/browser/config/mozconfigs/linux64/debug-static-analysis-clang
@@ -4,17 +4,17 @@ MOZ_AUTOMATION_L10N_CHECK=0
 
 . "$topsrcdir/build/mozconfig.common"
 
 ac_add_options --enable-debug
 
 . $topsrcdir/build/mozconfig.stylo
 
 # Use Clang as specified in manifest
-export CC="$topsrcdir/clang/bin/clang"
-export CXX="$topsrcdir/clang/bin/clang++"
+export CC="$MOZ_FETCHES_DIR/clang/bin/clang"
+export CXX="$MOZ_FETCHES_DIR/clang/bin/clang++"
 
 # Add the static checker
 ac_add_options --enable-clang-plugin
 
 . "$topsrcdir/build/unix/mozconfig.stdcxx"
 
 . "$topsrcdir/build/mozconfig.common.override"

--- a/browser/config/mozconfigs/linux64/plain-opt
+++ b/browser/config/mozconfigs/linux64/plain-opt
@@ -1,14 +1,14 @@
 export TOOLTOOL_DIR="$topsrcdir"
-export LLVM_CONFIG="${TOOLTOOL_DIR}/clang/bin/llvm-config"
+export LLVM_CONFIG="${MOZ_FETCHES_DIR}/clang/bin/llvm-config"
 
-CARGO="${TOOLTOOL_DIR}/rustc/bin/cargo"
-RUSTC="${TOOLTOOL_DIR}/rustc/bin/rustc"
-RUSTDOC="${TOOLTOOL_DIR}/rustc/bin/rustdoc"
-RUSTFMT="${TOOLTOOL_DIR}/rustc/bin/rustfmt"
-CBINDGEN="${TOOLTOOL_DIR}/cbindgen/cbindgen"
+CARGO="${MOZ_FETCHES_DIR}/rustc/bin/cargo"
+RUSTC="${MOZ_FETCHES_DIR}/rustc/bin/rustc"
+RUSTDOC="${MOZ_FETCHES_DIR}/rustc/bin/rustdoc"
+RUSTFMT="${MOZ_FETCHES_DIR}/rustc/bin/rustfmt"
+CBINDGEN="${MOZ_FETCHES_DIR}/cbindgen/cbindgen"
 
-export NODEJS="${TOOLTOOL_DIR}/node/bin/node"
-NASM="${TOOLTOOL_DIR}/nasm/nasm"
+export NODEJS="${MOZ_FETCHES_DIR}/node/bin/node"
+NASM="${MOZ_FETCHES_DIR}/nasm/nasm"
 
-CC="${TOOLTOOL_DIR}/clang/bin/clang"
-CXX="${TOOLTOOL_DIR}/clang/bin/clang++"
+CC="${MOZ_FETCHES_DIR}/clang/bin/clang"
+CXX="${MOZ_FETCHES_DIR}/clang/bin/clang++"

--- a/browser/config/mozconfigs/linux64/tup
+++ b/browser/config/mozconfigs/linux64/tup
@@ -1,17 +1,17 @@
 MOZ_AUTOMATION_BUILD_SYMBOLS=0
 MOZ_AUTOMATION_L10N_CHECK=0
 MOZ_AUTOMATION_PACKAGE=0
 MOZ_AUTOMATION_PACKAGE_TESTS=0
 MOZ_AUTOMATION_UPLOAD=0
 MOZ_AUTOMATION_UPLOAD_SYMBOLS=0
 
 TOOLTOOL_DIR=${TOOLTOOL_DIR:-$topsrcdir}
-export TUP=${TOOLTOOL_DIR}/tup/tup
+export TUP=${MOZ_FETCHES_DIR}/tup/tup
 
 . "$topsrcdir/browser/config/mozconfigs/linux64/common-opt"
 . "$topsrcdir/build/mozconfig.common.override"
 
 ac_add_options --enable-build-backends=Tup
 unset ENABLE_CLANG_PLUGIN
 # To enable the option to upload the tup database, uncomment the line below
 # ac_add_options --upload-tup-db

--- a/browser/config/mozconfigs/macosx64/code-coverage
+++ b/browser/config/mozconfigs/macosx64/code-coverage
@@ -3,11 +3,11 @@
 unset MOZ_LTO
 
 TOOLTOOL_DIR=${TOOLTOOL_DIR:-$topsrcdir}
 
 ac_add_options --disable-sandbox
 ac_add_options --disable-warnings-as-errors
 ac_add_options --enable-coverage
 
-export LDFLAGS="-coverage -L$topsrcdir/clang/lib/clang/8.0.0/lib/darwin/"
+export LDFLAGS="-coverage -L$MOZ_FETCHES_DIR/clang/lib/clang/8.0.0/lib/darwin/"
 export LIBS="-lclang_rt.profile_osx"
 export RUSTFLAGS="-Ccodegen-units=1 -Zprofile -Zno-landing-pads -Clink-dead-code -Coverflow-checks=off"

--- a/browser/config/mozconfigs/macosx64/l10n-mozconfig
+++ b/browser/config/mozconfigs/macosx64/l10n-mozconfig
@@ -1,17 +1,17 @@
 . "$topsrcdir/browser/config/mozconfigs/common"
 . "$topsrcdir/build/mozconfig.no-compile"
 
 if test `uname -s` = "Linux"; then
   # We need to indicate the target for cross builds
   ac_add_options --target=x86_64-apple-darwin
-  export MKFSHFS=$topsrcdir/hfsplus-tools/newfs_hfs
-  export DMG_TOOL=$topsrcdir/dmg/dmg
-  export HFS_TOOL=$topsrcdir/dmg/hfsplus
+  export MKFSHFS=$MOZ_FETCHES_DIR/hfsplus-tools/newfs_hfs
+  export DMG_TOOL=$MOZ_FETCHES_DIR/dmg/dmg
+  export HFS_TOOL=$MOZ_FETCHES_DIR/dmg/hfsplus
 fi
 
 ac_add_options --with-l10n-base=../../l10n
 ac_add_options --enable-update-channel=${MOZ_UPDATE_CHANNEL}
 ac_add_options --with-branding=browser/branding/nightly
 
 ac_add_options --disable-nodejs
 unset NODEJS

--- a/browser/config/mozconfigs/macosx64/l10n-mozconfig-devedition
+++ b/browser/config/mozconfigs/macosx64/l10n-mozconfig-devedition
@@ -1,17 +1,17 @@
 . "$topsrcdir/browser/config/mozconfigs/common"
 . "$topsrcdir/build/mozconfig.no-compile"
 
 if test `uname -s` = "Linux"; then
   # We need to indicate the target for cross builds
   ac_add_options --target=x86_64-apple-darwin
-  export MKFSHFS=$topsrcdir/hfsplus-tools/newfs_hfs
-  export DMG_TOOL=$topsrcdir/dmg/dmg
-  export HFS_TOOL=$topsrcdir/dmg/hfsplus
+  export MKFSHFS=$MOZ_FETCHES_DIR/hfsplus-tools/newfs_hfs
+  export DMG_TOOL=$MOZ_FETCHES_DIR/dmg/dmg
+  export HFS_TOOL=$MOZ_FETCHES_DIR/dmg/hfsplus
 fi
 
 ac_add_options --with-l10n-base=../../l10n
 ac_add_options --enable-update-channel=${MOZ_UPDATE_CHANNEL}
 ac_add_options --with-branding=browser/branding/aurora
 
 ac_add_options --disable-nodejs
 unset NODEJS

--- a/browser/config/mozconfigs/macosx64/repack
+++ b/browser/config/mozconfigs/macosx64/repack
@@ -1,8 +1,8 @@
 # This mozconfig is responsible merely for getting the cross tools setup
 # for repacking a .tar into a .dmg as returned from signing.
 
-export MKFSHFS=$topsrcdir/hfsplus-tools/newfs_hfs
-export DMG_TOOL=$topsrcdir/dmg/dmg
-export HFS_TOOL=$topsrcdir/dmg/hfsplus
-export NODEJS=$topsrcdir/node/bin/node
+export MKFSHFS=$MOZ_FETCHES_DIR/hfsplus-tools/newfs_hfs
+export DMG_TOOL=$MOZ_FETCHES_DIR/dmg/dmg
+export HFS_TOOL=$MOZ_FETCHES_DIR/dmg/hfsplus
+export NODEJS=$MOZ_FETCHES_DIR/node/bin/node
 ac_add_options --disable-compile-environment

--- a/browser/config/mozconfigs/win32/mingwclang
+++ b/browser/config/mozconfigs/win32/mingwclang
@@ -41,34 +41,34 @@ ac_add_options --disable-jemalloc
 ac_add_options --enable-proxy-bypass-protection
 
 # These aren't supported on mingw at this time
 ac_add_options --disable-maintenance-service
 ac_add_options --disable-webrtc # Bug 1393901
 ac_add_options --disable-geckodriver # Bug 1489320
 
 # Find our toolchain
-HOST_CC="$TOOLTOOL_DIR/clang/bin/clang"
-HOST_CXX="$TOOLTOOL_DIR/clang/bin/clang++"
-CC="$TOOLTOOL_DIR/clang/bin/i686-w64-mingw32-clang"
-CXX="$TOOLTOOL_DIR/clang/bin/i686-w64-mingw32-clang++"
+HOST_CC="$MOZ_FETCHES_DIR/clang/bin/clang"
+HOST_CXX="$MOZ_FETCHES_DIR/clang/bin/clang++"
+CC="$MOZ_FETCHES_DIR/clang/bin/i686-w64-mingw32-clang"
+CXX="$MOZ_FETCHES_DIR/clang/bin/i686-w64-mingw32-clang++"
 ac_add_options --with-clang-path="$CC"
-ac_add_options --with-libclang-path="$TOOLTOOL_DIR/clang/lib"
+ac_add_options --with-libclang-path="$MOZ_FETCHES_DIR/clang/lib"
 CXXFLAGS="-fms-extensions"
 AR=llvm-ar
 RANLIB=llvm-ranlib
 
 # For Stylo
-BINDGEN_CFLAGS="-I$TOOLTOOL_DIR/clang/i686-w64-mingw32/include/c++/v1 -I$TOOLTOOL_DIR/clang/i686-w64-mingw32/include"
+BINDGEN_CFLAGS="-I$MOZ_FETCHES_DIR/clang/i686-w64-mingw32/include/c++/v1 -I$MOZ_FETCHES_DIR/clang/i686-w64-mingw32/include"
 
 # We want to make sure we use binutils and other binaries in the tooltool
 # package.
-mk_add_options "export PATH=$TOOLTOOL_DIR/clang/bin:$TOOLTOOL_DIR/mingw32/bin:$TOOLTOOL_DIR/wine/bin:$TOOLTOOL_DIR/upx/bin:$TOOLTOOL_DIR/fxc2/bin:$PATH"
+mk_add_options "export PATH=$MOZ_FETCHES_DIR/clang/bin:$MOZ_FETCHES_DIR/mingw32/bin:$MOZ_FETCHES_DIR/wine/bin:$MOZ_FETCHES_DIR/upx/bin:$MOZ_FETCHES_DIR/fxc2/bin:$PATH"
 
-LD_LIBRARY_PATH=${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOOLTOOL_DIR/mingw32/lib64:$TOOLTOOL_DIR/clang/lib
+LD_LIBRARY_PATH=${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$MOZ_FETCHES_DIR/mingw32/lib64:$MOZ_FETCHES_DIR/clang/lib
 mk_add_options "export LD_LIBRARY_PATH=$LD_LIBRARY_PATH"
 
 # Do not include the visual studio related mozconfigs of course
 
 ac_add_options --with-branding=browser/branding/nightly
 
 . "$topsrcdir/build/mozconfig.common.override"
 . "$topsrcdir/build/mozconfig.cache"

--- a/browser/config/mozconfigs/win64/code-coverage
+++ b/browser/config/mozconfigs/win64/code-coverage
@@ -13,18 +13,18 @@ ac_add_options --enable-rust-tests
 # Needed to enable breakpad in application.ini
 export MOZILLA_OFFICIAL=1
 
 . $topsrcdir/build/win64/mozconfig.vs-latest
 
 # Package js shell.
 export MOZ_PACKAGE_JSSHELL=1
 
-if [ -d "$topsrcdir/clang" ]; then
-    CLANG_LIB_DIR="$(cd $topsrcdir/clang/lib/clang/* && cd lib/windows && pwd)"
+if [ -d "$MOZ_FETCHES_DIR/clang" ]; then
+    CLANG_LIB_DIR="$(cd $MOZ_FETCHES_DIR/clang/lib/clang/* && cd lib/windows && pwd)"
 
     export LIB=$LIB:$CLANG_LIB_DIR
     export LDFLAGS="clang_rt.profile-x86_64.lib"
 fi
 
 export RUSTFLAGS="-Ccodegen-units=1 -Zprofile -Zno-landing-pads -Clink-dead-code -Coverflow-checks=off"
 
 . "$topsrcdir/build/mozconfig.common.override"

--- a/browser/config/mozconfigs/win64/mingwclang
+++ b/browser/config/mozconfigs/win64/mingwclang
@@ -41,34 +41,34 @@ ac_add_options --disable-jemalloc
 ac_add_options --enable-proxy-bypass-protection
 
 # These aren't supported on mingw at this time
 ac_add_options --disable-maintenance-service
 ac_add_options --disable-webrtc # Bug 1393901
 ac_add_options --disable-geckodriver # Bug 1489320
 
 # Find our toolchain
-HOST_CC="$TOOLTOOL_DIR/clang/bin/clang"
-HOST_CXX="$TOOLTOOL_DIR/clang/bin/clang++"
-CC="$TOOLTOOL_DIR/clang/bin/x86_64-w64-mingw32-clang"
-CXX="$TOOLTOOL_DIR/clang/bin/x86_64-w64-mingw32-clang++"
+HOST_CC="$MOZ_FETCHES_DIR/clang/bin/clang"
+HOST_CXX="$MOZ_FETCHES_DIR/clang/bin/clang++"
+CC="$MOZ_FETCHES_DIR/clang/bin/x86_64-w64-mingw32-clang"
+CXX="$MOZ_FETCHES_DIR/clang/bin/x86_64-w64-mingw32-clang++"
 ac_add_options --with-clang-path="$CC"
-ac_add_options --with-libclang-path="$TOOLTOOL_DIR/clang/lib"
+ac_add_options --with-libclang-path="$MOZ_FETCHES_DIR/clang/lib"
 CXXFLAGS="-fms-extensions"
 AR=llvm-ar
 RANLIB=llvm-ranlib
 
 # For Stylo
-BINDGEN_CFLAGS="-I$TOOLTOOL_DIR/clang/x86_64-w64-mingw32/include/c++/v1 -I$TOOLTOOL_DIR/clang/x86_64-w64-mingw32/include"
+BINDGEN_CFLAGS="-I$MOZ_FETCHES_DIR/clang/x86_64-w64-mingw32/include/c++/v1 -I$MOZ_FETCHES_DIR/clang/x86_64-w64-mingw32/include"
 
 # We want to make sure we use binutils and other binaries in the tooltool
 # package.
-mk_add_options "export PATH=$TOOLTOOL_DIR/clang/bin:$TOOLTOOL_DIR/mingw32/bin:$TOOLTOOL_DIR/wine/bin:$TOOLTOOL_DIR/upx/bin:$TOOLTOOL_DIR/fxc2/bin:$PATH"
+mk_add_options "export PATH=$MOZ_FETCHES_DIR/clang/bin:$MOZ_FETCHES_DIR/mingw32/bin:$MOZ_FETCHES_DIR/wine/bin:$MOZ_FETCHES_DIR/upx/bin:$MOZ_FETCHES_DIR/fxc2/bin:$PATH"
 
-LD_LIBRARY_PATH=${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOOLTOOL_DIR/mingw32/lib64:$TOOLTOOL_DIR/clang/lib
+LD_LIBRARY_PATH=${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$MOZ_FETCHES_DIR/mingw32/lib64:$MOZ_FETCHES_DIR/clang/lib
 mk_add_options "export LD_LIBRARY_PATH=$LD_LIBRARY_PATH"
 
 # Do not include the visual studio related mozconfigs of course
 
 ac_add_options --with-branding=browser/branding/nightly
 
 . "$topsrcdir/build/mozconfig.common.override"
 . "$topsrcdir/build/mozconfig.cache"

--- a/browser/config/mozconfigs/win64/plain-opt
+++ b/browser/config/mozconfigs/win64/plain-opt
@@ -1,16 +1,16 @@
 TOOLTOOL_DIR=${topsrcdir}
 export MAKECAB=$TOOLTOOL_DIR/makecab.exe
-export LLVM_CONFIG="${TOOLTOOL_DIR}/clang/bin/llvm-config"
+export LLVM_CONFIG="${MOZ_FETCHES_DIR}/clang/bin/llvm-config"
 
-RUSTC="${TOOLTOOL_DIR}/rustc/bin/rustc"
-CARGO="${TOOLTOOL_DIR}/rustc/bin/cargo"
-RUSTDOC="${TOOLTOOL_DIR}/rustc/bin/rustdoc"
-RUSTFMT="${TOOLTOOL_DIR}/rustc/bin/rustfmt"
-CBINDGEN="${TOOLTOOL_DIR}/cbindgen/cbindgen"
+RUSTC="${MOZ_FETCHES_DIR}/rustc/bin/rustc"
+CARGO="${MOZ_FETCHES_DIR}/rustc/bin/cargo"
+RUSTDOC="${MOZ_FETCHES_DIR}/rustc/bin/rustdoc"
+RUSTFMT="${MOZ_FETCHES_DIR}/rustc/bin/rustfmt"
+CBINDGEN="${MOZ_FETCHES_DIR}/cbindgen/cbindgen"
 
-NASM="${TOOLTOOL_DIR}/nasm/nasm.exe"
-NODEJS="${TOOLTOOL_DIR}/node/node.exe"
+NASM="${MOZ_FETCHES_DIR}/nasm/nasm.exe"
+NODEJS="${MOZ_FETCHES_DIR}/node/node.exe"
 
 ac_add_options --target=x86_64-pc-mingw32
 
 . $topsrcdir/build/win64/mozconfig.vs-latest

--- a/build/build-clang/build-clang.py
+++ b/build/build-clang/build-clang.py
@@ -341,22 +341,23 @@ def build_one_stage(cc, cxx, asm, ld, ar
     if is_final_stage and android_targets:
         cmake_args += [
             "-DLLVM_LIBDIR_SUFFIX=64",
         ]
 
         android_link_flags = "-fuse-ld=lld"
 
         for target, cfg in android_targets.items():
-            sysroot_dir = cfg["ndk_sysroot"]
-            android_gcc_dir = cfg["ndk_toolchain"]
+            sysroot_dir = cfg["ndk_sysroot"].format(**os.environ)
+            android_gcc_dir = cfg["ndk_toolchain"].format(**os.environ)
             android_include_dirs = cfg["ndk_includes"]
             api_level = cfg["api_level"]
 
-            android_flags = ["-isystem %s" % d for d in android_include_dirs]
+            android_flags = ["-isystem %s" % d.format(**os.environ)
+                             for d in android_include_dirs]
             android_flags += ["--gcc-toolchain=%s" % android_gcc_dir]
             android_flags += ["-D__ANDROID_API__=%s" % api_level]
 
             # Our flags go last to override any --gcc-toolchain that may have
             # been set earlier.
             rt_c_flags = " ".join(cc[1:] + android_flags)
             rt_cxx_flags = " ".join(cxx[1:] + android_flags)
             rt_asm_flags = " ".join(asm[1:] + android_flags)
@@ -434,17 +435,17 @@ def build_one_stage(cc, cxx, asm, ld, ar
 # $PATH named "key".
 #
 # This expects the name of the key in the config file to match the name of
 # the tool in the default toolchain on the system (for example, "ld" on Unix
 # and "link" on Windows).
 def get_tool(config, key):
     f = None
     if key in config:
-        f = config[key]
+        f = config[key].format(**os.environ)
         if os.path.isabs(f):
             if not os.path.exists(f):
                 raise ValueError("%s must point to an existing path" % key)
             return f
 
     # Assume that we have the name of some program that should be on PATH.
     tool = which(f) if f else which(key)
     if not tool:
@@ -621,17 +622,17 @@ if __name__ == "__main__":
         if assertions not in (True, False):
             raise ValueError("Only boolean values are accepted for assertions.")
     python_path = None
     if "python_path" not in config:
         raise ValueError("Config file needs to set python_path")
     python_path = config["python_path"]
     gcc_dir = None
     if "gcc_dir" in config:
-        gcc_dir = config["gcc_dir"]
+        gcc_dir = config["gcc_dir"].format(**os.environ)
         if not os.path.exists(gcc_dir):
             raise ValueError("gcc_dir must point to an existing path")
     ndk_dir = None
     android_targets = None
     if "android_targets" in config:
         android_targets = config["android_targets"]
         for attr in ("ndk_toolchain", "ndk_sysroot", "ndk_includes", "api_level"):
             for target, cfg in android_targets.items():

--- a/build/build-clang/clang-4.0-linux64.json
+++ b/build/build-clang/clang-4.0-linux64.json
@@ -1,12 +1,12 @@
 {
     "stages": "3",
     "build_libcxx": true,
     "build_type": "Release",
     "assertions": false,
     "python_path": "/usr/bin/python2.7",
-    "gcc_dir": "/builds/worker/workspace/build/gcc",
-    "cc": "/builds/worker/workspace/build/gcc/bin/gcc",
-    "cxx": "/builds/worker/workspace/build/gcc/bin/g++",
-    "as": "/builds/worker/workspace/build/gcc/bin/gcc",
+    "gcc_dir": "{MOZ_FETCHES_DIR}/gcc",
+    "cc": "{MOZ_FETCHES_DIR}/gcc/bin/gcc",
+    "cxx": "{MOZ_FETCHES_DIR}/gcc/bin/g++",
+    "as": "{MOZ_FETCHES_DIR}/gcc/bin/gcc",
     "patches": []
 }

--- a/build/build-clang/clang-7-linux64.json
+++ b/build/build-clang/clang-7-linux64.json
@@ -1,18 +1,18 @@
 {
     "stages": "3",
     "build_libcxx": true,
     "build_type": "Release",
     "assertions": false,
     "python_path": "/usr/bin/python2.7",
-    "gcc_dir": "/builds/worker/workspace/build/gcc",
-    "cc": "/builds/worker/workspace/build/gcc/bin/gcc",
-    "cxx": "/builds/worker/workspace/build/gcc/bin/g++",
-    "as": "/builds/worker/workspace/build/gcc/bin/gcc",
+    "gcc_dir": "{MOZ_FETCHES_DIR}/gcc",
+    "cc": "{MOZ_FETCHES_DIR}/gcc/bin/gcc",
+    "cxx": "{MOZ_FETCHES_DIR}/gcc/bin/g++",
+    "as": "{MOZ_FETCHES_DIR}/gcc/bin/gcc",
     "patches": [
       "static-llvm-symbolizer.patch",
       "find_symbolizer_linux.patch",
       "rename_gcov_flush_7.patch",
       "r350774.patch",
       "android-mangling-error.patch"
     ]
 }

--- a/build/build-clang/clang-8-android.json
+++ b/build/build-clang/clang-8-android.json
@@ -1,52 +1,52 @@
 {
     "stages": "2",
     "build_libcxx": true,
     "build_type": "Release",
     "assertions": false,
     "python_path": "/usr/bin/python2.7",
-    "gcc_dir": "/builds/worker/workspace/build/gcc",
-    "cc": "/builds/worker/workspace/build/gcc/bin/gcc",
-    "cxx": "/builds/worker/workspace/build/gcc/bin/g++",
-    "as": "/builds/worker/workspace/build/gcc/bin/gcc",
+    "gcc_dir": "{MOZ_FETCHES_DIR}/gcc",
+    "cc": "{MOZ_FETCHES_DIR}/gcc/bin/gcc",
+    "cxx": "{MOZ_FETCHES_DIR}/gcc/bin/g++",
+    "as": "{MOZ_FETCHES_DIR}/gcc/bin/gcc",
     "android_targets": {
       "armv7-linux-android": {
-        "ndk_toolchain": "/builds/worker/workspace/build/android-ndk/toolchains/arm-linux-androideabi-4.9/prebuilt/linux-x86_64",
-        "ndk_sysroot": "/builds/worker/workspace/build/android-ndk/platforms/android-16/arch-arm",
+        "ndk_toolchain": "{MOZ_FETCHES_DIR}/android-ndk/toolchains/arm-linux-androideabi-4.9/prebuilt/linux-x86_64",
+        "ndk_sysroot": "{MOZ_FETCHES_DIR}/android-ndk/platforms/android-16/arch-arm",
         "ndk_includes": [
-          "/builds/worker/workspace/build/android-ndk/sysroot/usr/include/arm-linux-androideabi",
-          "/builds/worker/workspace/build/android-ndk/sysroot/usr/include"
+          "{MOZ_FETCHES_DIR}/android-ndk/sysroot/usr/include/arm-linux-androideabi",
+          "{MOZ_FETCHES_DIR}/android-ndk/sysroot/usr/include"
         ],
         "api_level": 16
       },
       "i686-linux-android": {
-        "ndk_toolchain": "/builds/worker/workspace/build/android-ndk/toolchains/x86-4.9/prebuilt/linux-x86_64",
-        "ndk_sysroot": "/builds/worker/workspace/build/android-ndk/platforms/android-16/arch-x86",
+        "ndk_toolchain": "{MOZ_FETCHES_DIR}/android-ndk/toolchains/x86-4.9/prebuilt/linux-x86_64",
+        "ndk_sysroot": "{MOZ_FETCHES_DIR}/android-ndk/platforms/android-16/arch-x86",
         "ndk_includes": [
-          "/builds/worker/workspace/build/android-ndk/sysroot/usr/include/i686-linux-android",
-          "/builds/worker/workspace/build/android-ndk/sysroot/usr/include"
+          "{MOZ_FETCHES_DIR}/android-ndk/sysroot/usr/include/i686-linux-android",
+          "{MOZ_FETCHES_DIR}/android-ndk/sysroot/usr/include"
         ],
         "api_level": 16
       },
       "aarch64-linux-android": {
-        "ndk_toolchain": "/builds/worker/workspace/build/android-ndk/toolchains/aarch64-linux-android-4.9/prebuilt/linux-x86_64",
-        "ndk_sysroot": "/builds/worker/workspace/build/android-ndk/platforms/android-21/arch-arm64",
+        "ndk_toolchain": "{MOZ_FETCHES_DIR}/android-ndk/toolchains/aarch64-linux-android-4.9/prebuilt/linux-x86_64",
+        "ndk_sysroot": "{MOZ_FETCHES_DIR}/android-ndk/platforms/android-21/arch-arm64",
         "ndk_includes": [
-          "/builds/worker/workspace/build/android-ndk/sysroot/usr/include/aarch64-linux-android",
-          "/builds/worker/workspace/build/android-ndk/sysroot/usr/include"
+          "{MOZ_FETCHES_DIR}/android-ndk/sysroot/usr/include/aarch64-linux-android",
+          "{MOZ_FETCHES_DIR}/android-ndk/sysroot/usr/include"
         ],
         "api_level": 21
       },
       "x86_64-linux-android": {
-        "ndk_toolchain": "/builds/worker/workspace/build/android-ndk/toolchains/x86_64-4.9/prebuilt/linux-x86_64",
-        "ndk_sysroot": "/builds/worker/workspace/build/android-ndk/platforms/android-21/arch-x86_64",
+        "ndk_toolchain": "{MOZ_FETCHES_DIR}/android-ndk/toolchains/x86_64-4.9/prebuilt/linux-x86_64",
+        "ndk_sysroot": "{MOZ_FETCHES_DIR}/android-ndk/platforms/android-21/arch-x86_64",
         "ndk_includes": [
-          "/builds/worker/workspace/build/android-ndk/sysroot/usr/include/x86_64-linux-android",
-          "/builds/worker/workspace/build/android-ndk/sysroot/usr/include"
+          "{MOZ_FETCHES_DIR}/android-ndk/sysroot/usr/include/x86_64-linux-android",
+          "{MOZ_FETCHES_DIR}/android-ndk/sysroot/usr/include"
         ],
         "api_level": 21
       }
     },
     "patches": [
       "static-llvm-symbolizer.patch",
       "find_symbolizer_linux.patch",
       "rename_gcov_flush.patch"

--- a/build/build-clang/clang-8-linux64-aarch64-cross.json
+++ b/build/build-clang/clang-8-linux64-aarch64-cross.json
@@ -1,18 +1,18 @@
 {
     "stages": "3",
     "build_libcxx": true,
     "build_type": "Release",
     "assertions": false,
     "python_path": "/usr/bin/python2.7",
-    "gcc_dir": "/builds/worker/workspace/build/gcc",
-    "cc": "/builds/worker/workspace/build/gcc/bin/gcc",
-    "cxx": "/builds/worker/workspace/build/gcc/bin/g++",
-    "as": "/builds/worker/workspace/build/gcc/bin/gcc",
+    "gcc_dir": "{MOZ_FETCHES_DIR}/gcc",
+    "cc": "{MOZ_FETCHES_DIR}/gcc/bin/gcc",
+    "cxx": "{MOZ_FETCHES_DIR}/gcc/bin/g++",
+    "as": "{MOZ_FETCHES_DIR}/gcc/bin/gcc",
     "extra_targets": [
       "aarch64-unknown-linux-gnu"
     ],
     "patches": [
       "static-llvm-symbolizer.patch",
       "find_symbolizer_linux.patch",
       "rename_gcov_flush.patch",
       "android-mangling-error.patch"

--- a/build/build-clang/clang-8-linux64.json
+++ b/build/build-clang/clang-8-linux64.json
@@ -1,17 +1,17 @@
 {
     "stages": "3",
     "build_libcxx": true,
     "build_type": "Release",
     "assertions": false,
     "python_path": "/usr/bin/python2.7",
-    "gcc_dir": "/builds/worker/workspace/build/gcc",
-    "cc": "/builds/worker/workspace/build/gcc/bin/gcc",
-    "cxx": "/builds/worker/workspace/build/gcc/bin/g++",
-    "as": "/builds/worker/workspace/build/gcc/bin/gcc",
+    "gcc_dir": "{MOZ_FETCHES_DIR}/gcc",
+    "cc": "{MOZ_FETCHES_DIR}/gcc/bin/gcc",
+    "cxx": "{MOZ_FETCHES_DIR}/gcc/bin/g++",
+    "as": "{MOZ_FETCHES_DIR}/gcc/bin/gcc",
     "patches": [
       "static-llvm-symbolizer.patch",
       "find_symbolizer_linux.patch",
       "rename_gcov_flush.patch",
       "android-mangling-error.patch"
     ]
 }

--- a/build/build-clang/clang-8-macosx64.json
+++ b/build/build-clang/clang-8-macosx64.json
@@ -1,22 +1,22 @@
 {
     "stages": "1",
     "build_libcxx": true,
     "build_type": "Release",
     "assertions": false,
     "osx_cross_compile": true,
     "python_path": "/usr/bin/python2.7",
-    "gcc_dir": "/builds/worker/workspace/build/gcc",
-    "cc": "/builds/worker/workspace/build/clang/bin/clang",
-    "cxx": "/builds/worker/workspace/build/clang/bin/clang++",
-    "as": "/builds/worker/workspace/build/clang/bin/clang",
-    "ar": "/builds/worker/workspace/build/cctools/bin/x86_64-apple-darwin-ar",
-    "ranlib": "/builds/worker/workspace/build/cctools/bin/x86_64-apple-darwin-ranlib",
-    "libtool": "/builds/worker/workspace/build/cctools/bin/x86_64-apple-darwin-libtool",
-    "ld": "/builds/worker/workspace/build/clang/bin/clang",
+    "gcc_dir": "{MOZ_FETCHES_DIR}/gcc",
+    "cc": "{MOZ_FETCHES_DIR}/clang/bin/clang",
+    "cxx": "{MOZ_FETCHES_DIR}/clang/bin/clang++",
+    "as": "{MOZ_FETCHES_DIR}/clang/bin/clang",
+    "ar": "{MOZ_FETCHES_DIR}/cctools/bin/x86_64-apple-darwin-ar",
+    "ranlib": "{MOZ_FETCHES_DIR}/cctools/bin/x86_64-apple-darwin-ranlib",
+    "libtool": "{MOZ_FETCHES_DIR}/cctools/bin/x86_64-apple-darwin-libtool",
+    "ld": "{MOZ_FETCHES_DIR}/clang/bin/clang",
     "patches": [
       "static-llvm-symbolizer.patch",
       "rename_gcov_flush.patch",
       "compiler-rt-cross-compile.patch",
       "compiler-rt-no-codesign.patch"
     ]
 }

--- a/build/build-clang/clang-8-mingw.json
+++ b/build/build-clang/clang-8-mingw.json
@@ -1,18 +1,18 @@
 {
     "stages": "3",
     "build_libcxx": true,
     "build_type": "Release",
     "assertions": false,
     "python_path": "/usr/bin/python2.7",
-    "gcc_dir": "/builds/worker/workspace/build/gcc",
-    "cc": "/builds/worker/workspace/build/gcc/bin/gcc",
-    "cxx": "/builds/worker/workspace/build/gcc/bin/g++",
-    "as": "/builds/worker/workspace/build/gcc/bin/gcc",
+    "gcc_dir": "{MOZ_FETCHES_DIR}/gcc",
+    "cc": "{MOZ_FETCHES_DIR}/gcc/bin/gcc",
+    "cxx": "{MOZ_FETCHES_DIR}/gcc/bin/g++",
+    "as": "{MOZ_FETCHES_DIR}/gcc/bin/gcc",
     "patches": [
         "mingwclang-llvm-objcopy-COFF-Remove-a-superfluous-namespace-qua.patch",
         "mingwclang-llvm-objcopy-COFF-Add-support-for-removing-sections.patch",
         "mingwclang-llvm-objcopy-COFF-Implement-strip-debug.patch",
         "mingwclang-llvm-objcopy-COFF-Implement-only-keep-debug.patch",
         "mingwclang-llvm-objcopy-COFF-Implement-only-section.patch",
         "mingwclang-llvm-objcopy-Consistently-use-createStringError-inst.patch",
         "mingwclang-llvm-objcopy-COFF-Update-symbol-indices-in-weak-exte.patch",

--- a/build/build-clang/clang-tidy-linux64.json
+++ b/build/build-clang/clang-tidy-linux64.json
@@ -1,15 +1,15 @@
 {
     "stages": "1",
     "build_libcxx": true,
     "build_type": "Release",
     "assertions": false,
     "build_clang_tidy": true,
     "python_path": "/usr/bin/python2.7",
-    "gcc_dir": "/builds/worker/workspace/build/gcc",
-    "cc": "/builds/worker/workspace/build/gcc/bin/gcc",
-    "cxx": "/builds/worker/workspace/build/gcc/bin/g++",
-    "as": "/builds/worker/workspace/build/gcc/bin/gcc",
+    "gcc_dir": "{MOZ_FETCHES_DIR}/gcc",
+    "cc": "{MOZ_FETCHES_DIR}/gcc/bin/gcc",
+    "cxx": "{MOZ_FETCHES_DIR}/gcc/bin/g++",
+    "as": "{MOZ_FETCHES_DIR}/gcc/bin/gcc",
     "patches": [
       "clang-tidy-8.patch"
     ]
 }

--- a/build/build-clang/clang-tidy-macosx64.json
+++ b/build/build-clang/clang-tidy-macosx64.json
@@ -1,21 +1,21 @@
 {
     "stages": "1",
     "build_libcxx": true,
     "build_type": "Release",
     "assertions": false,
     "build_clang_tidy": true,
     "osx_cross_compile": true,
     "python_path": "/usr/bin/python2.7",
-    "gcc_dir": "/builds/worker/workspace/build/gcc",
-    "cc": "/builds/worker/workspace/build/clang/bin/clang",
-    "cxx": "/builds/worker/workspace/build/clang/bin/clang++",
-    "as": "/builds/worker/workspace/build/clang/bin/clang",
-    "ar": "/builds/worker/workspace/build/cctools/bin/x86_64-apple-darwin-ar",
-    "ranlib": "/builds/worker/workspace/build/cctools/bin/x86_64-apple-darwin-ranlib",
-    "libtool": "/builds/worker/workspace/build/cctools/bin/x86_64-apple-darwin-libtool",
-    "ld": "/builds/worker/workspace/build/clang/bin/clang",
+    "gcc_dir": "{MOZ_FETCHES_DIR}/gcc",
+    "cc": "{MOZ_FETCHES_DIR}/clang/bin/clang",
+    "cxx": "{MOZ_FETCHES_DIR}/clang/bin/clang++",
+    "as": "{MOZ_FETCHES_DIR}/clang/bin/clang",
+    "ar": "{MOZ_FETCHES_DIR}/cctools/bin/x86_64-apple-darwin-ar",
+    "ranlib": "{MOZ_FETCHES_DIR}/cctools/bin/x86_64-apple-darwin-ranlib",
+    "libtool": "{MOZ_FETCHES_DIR}/cctools/bin/x86_64-apple-darwin-libtool",
+    "ld": "{MOZ_FETCHES_DIR}/clang/bin/clang",
     "patches": [
       "clang-tidy-8.patch",
       "compiler-rt-no-codesign.patch"
     ]
 }

--- a/build/macosx/cross-mozconfig.common
+++ b/build/macosx/cross-mozconfig.common
@@ -2,41 +2,41 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 MOZ_AUTOMATION_L10N_CHECK=0
 
 . "$topsrcdir/build/mozconfig.common"
 
 # cctools for ld, ar, and other related tools ; dsymutil for rust.
-mk_add_options "export PATH=$topsrcdir/cctools/bin:$topsrcdir/binutils/bin:$topsrcdir/llvm-dsymutil/bin:$PATH"
+mk_add_options "export PATH=$MOZ_FETCHES_DIR/cctools/bin:$MOZ_FETCHES_DIR/binutils/bin:$MOZ_FETCHES_DIR/llvm-dsymutil/bin:$PATH"
 
 # dsymutil needs a libstdc++ more recent than what's on the system.
-mk_add_options "export LD_LIBRARY_PATH=$topsrcdir/clang/lib"
+mk_add_options "export LD_LIBRARY_PATH=$MOZ_FETCHES_DIR/clang/lib"
 
 # This SDK was copied from a local XCode install and uploaded to tooltool.
 # Generate the tarball by running this command with the proper SDK version:
 #   sdk_path=$(xcrun --sdk macosx10.12 --show-sdk-path)
 #   tar -C $(dirname ${sdk_path}) -cHjf /tmp/$(basename ${sdk_path}).tar.bz2 $(basename ${sdk_path})
 # Upload the resulting tarball from /tmp to tooltool, and change the entry in
 # `browser/config/tooltool-manifests/macosx64/cross-releng.manifest`.
 CROSS_SYSROOT=$topsrcdir/MacOSX10.11.sdk
 CROSS_PRIVATE_FRAMEWORKS=$CROSS_SYSROOT/System/Library/PrivateFrameworks
 
-export CC="$topsrcdir/clang/bin/clang"
-export CXX="$topsrcdir/clang/bin/clang++"
+export CC="$MOZ_FETCHES_DIR/clang/bin/clang"
+export CXX="$MOZ_FETCHES_DIR/clang/bin/clang++"
 export CFLAGS="$CFLAGS -fcrash-diagnostics-dir=${UPLOAD_PATH}"
 export CXXFLAGS="$CXXFLAGS -fcrash-diagnostics-dir=${UPLOAD_PATH}"
-export LLVMCONFIG=$topsrcdir/clang/bin/llvm-config
+export LLVMCONFIG=$MOZ_FETCHES_DIR/clang/bin/llvm-config
 export BINDGEN_CFLAGS="-isysroot $CROSS_SYSROOT"
 export DSYMUTIL=$topsrcdir/build/macosx/llvm-dsymutil
-mk_add_options "export REAL_DSYMUTIL=$topsrcdir/llvm-dsymutil/bin/dsymutil"
-export MKFSHFS=$topsrcdir/hfsplus-tools/newfs_hfs
-export DMG_TOOL=$topsrcdir/dmg/dmg
-export HFS_TOOL=$topsrcdir/dmg/hfsplus
+mk_add_options "export REAL_DSYMUTIL=$MOZ_FETCHES_DIR/llvm-dsymutil/bin/dsymutil"
+export MKFSHFS=$MOZ_FETCHES_DIR/hfsplus-tools/newfs_hfs
+export DMG_TOOL=$MOZ_FETCHES_DIR/dmg/dmg
+export HFS_TOOL=$MOZ_FETCHES_DIR/dmg/hfsplus
 
 export HOST_CFLAGS="-g"
 export HOST_CXXFLAGS="-g"
 export HOST_LDFLAGS="-g"
 
 ac_add_options --target=x86_64-apple-darwin
 export MACOS_SDK_DIR=$CROSS_SYSROOT
 export MACOS_PRIVATE_FRAMEWORKS_DIR=$CROSS_PRIVATE_FRAMEWORKS

--- a/build/macosx/local-mozconfig.common
+++ b/build/macosx/local-mozconfig.common
@@ -1,34 +1,24 @@
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 . "$topsrcdir/build/mozconfig.common"
 
-if [ -d "$topsrcdir/clang" ]; then
+if [ -d "$MOZ_FETCHES_DIR/clang" ]; then
     # mozilla-central based build
-    export CC=$topsrcdir/clang/bin/clang
-    export CXX=$topsrcdir/clang/bin/clang++
-    export LLVMCONFIG=$topsrcdir/clang/bin/llvm-config
-    export DSYMUTIL=$topsrcdir/clang/bin/llvm-dsymutil
+    export CC=$MOZ_FETCHES_DIR/clang/bin/clang
+    export CXX=$MOZ_FETCHES_DIR/clang/bin/clang++
+    export LLVMCONFIG=$MOZ_FETCHES_DIR/clang/bin/llvm-config
+    export DSYMUTIL=$MOZ_FETCHES_DIR/clang/bin/llvm-dsymutil
     # Use an updated linker.
-    ldflags="-B$topsrcdir/cctools/bin"
-    export AR=$topsrcdir/cctools/bin/ar
-    export RANLIB=$topsrcdir/cctools/bin/ranlib
-elif [ -d "$topsrcdir/../clang" ]; then
-    # comm-central based build
-    export CC=$topsrcdir/../clang/bin/clang
-    export CXX=$topsrcdir/../clang/bin/clang++
-    export LLVMCONFIG=$topsrcdir/../clang/bin/llvm-config
-    export DSYMUTIL=$topsrcdir/../clang/bin/llvm-dsymutil
-    # Use an updated linker.
-    ldflags="-B$topsrcdir/../cctools/bin"
-    export AR=$topsrcdir/../cctools/bin/ar
-    export RANLIB=$topsrcdir/../cctools/bin/ranlib
+    ldflags="-B$MOZ_FETCHES_DIR/cctools/bin"
+    export AR=$MOZ_FETCHES_DIR/cctools/bin/ar
+    export RANLIB=$MOZ_FETCHES_DIR/cctools/bin/ranlib
 fi
 
 # Ensure the updated linker doesn't generate things our older build tools
 # don't understand.
 ldflags="$ldflags -Wl,-no_data_in_code_info"
 export LDFLAGS="$ldflags"
 
 # If not set use the system default clang

--- a/build/mozconfig.cache
+++ b/build/mozconfig.cache
@@ -53,12 +53,12 @@ if test -z "$bucket" -a -z "$SCCACHE_DIS
 fi
 
 if test -n "$bucket"; then
     if [ -n "${SCCACHE_GCS_KEY_PATH}" ]; then
         mk_add_options "export SCCACHE_GCS_BUCKET=$bucket"
     else
         mk_add_options "export SCCACHE_BUCKET=$bucket"
     fi
-    export CCACHE="$topsrcdir/sccache/sccache"
+    export CCACHE="$MOZ_FETCHES_DIR/sccache/sccache"
     export SCCACHE_VERBOSE_STATS=1
-    mk_add_options MOZBUILD_MANAGE_SCCACHE_DAEMON=${topsrcdir}/sccache/sccache
+    mk_add_options MOZBUILD_MANAGE_SCCACHE_DAEMON=${MOZ_FETCHES_DIR}/sccache/sccache
 fi

--- a/build/mozconfig.clang-cl
+++ b/build/mozconfig.clang-cl
@@ -1,14 +1,14 @@
-if test -d "$topsrcdir/clang/bin"; then
-    CLANG_DIR=`cd "$topsrcdir/clang/bin" ; pwd`
+if test -d "$MOZ_FETCHES_DIR/clang/bin"; then
+    CLANG_DIR=`cd "$MOZ_FETCHES_DIR/clang/bin" ; pwd`
     export PATH="${CLANG_DIR}:${PATH}"
 
-    if $(cd $topsrcdir/clang/lib/clang/* && test -d lib/windows); then
-        CLANG_LIB_DIR="$(cd $topsrcdir/clang/lib/clang/* && cd lib/windows && pwd)"
+    if $(cd $MOZ_FETCHES_DIR/clang/lib/clang/* && test -d lib/windows); then
+        CLANG_LIB_DIR="$(cd $MOZ_FETCHES_DIR/clang/lib/clang/* && cd lib/windows && pwd)"
         export LIB=$LIB:$CLANG_LIB_DIR
     fi
 fi
 
 export CC=clang-cl
 export CXX=clang-cl
 export ENABLE_CLANG_PLUGIN=1
 

--- a/build/mozconfig.lld-link
+++ b/build/mozconfig.lld-link
@@ -1,6 +1,6 @@
-if test -d "$topsrcdir/clang/bin"; then
-    CLANG_DIR=`cd "$topsrcdir/clang/bin" ; pwd`
+if test -d "$MOZ_FETCHES_DIR/clang/bin"; then
+    CLANG_DIR=`cd "$MOZ_FETCHES_DIR/clang/bin" ; pwd`
     export PATH="${CLANG_DIR}:${PATH}"
 fi
 
 export LINKER=lld-link

--- a/build/mozconfig.nasm
+++ b/build/mozconfig.nasm
@@ -1,12 +1,12 @@
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 case "$(uname -s)" in
 MINGW*)
-    export NASM=$topsrcdir/nasm/nasm.exe
+    export NASM=$MOZ_FETCHES_DIR/nasm/nasm.exe
     ;;
 *)
-    export NASM=$topsrcdir/nasm/nasm
+    export NASM=$MOZ_FETCHES_DIR/nasm/nasm
     ;;
 esac

--- a/build/mozconfig.node
+++ b/build/mozconfig.node
@@ -1,12 +1,12 @@
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 case "$(uname -s)" in
 MINGW*)
-    export NODEJS=$topsrcdir/node/node.exe
+    export NODEJS=$MOZ_FETCHES_DIR/node/node.exe
     ;;
 *)
-    export NODEJS=$topsrcdir/node/bin/node
+    export NODEJS=$MOZ_FETCHES_DIR/node/bin/node
     ;;
 esac

--- a/build/mozconfig.rust
+++ b/build/mozconfig.rust
@@ -1,12 +1,12 @@
 # Options to enable rust in automation builds.
 
 TOOLTOOL_DIR=${TOOLTOOL_DIR:-$topsrcdir}
 
 # Tell configure to use the tooltool rustc.
-RUSTC="$TOOLTOOL_DIR/rustc/bin/rustc"
-CARGO="$TOOLTOOL_DIR/rustc/bin/cargo"
-RUSTDOC="$TOOLTOOL_DIR/rustc/bin/rustdoc"
-RUSTFMT="$TOOLTOOL_DIR/rustc/bin/rustfmt"
-CBINDGEN="$TOOLTOOL_DIR/cbindgen/cbindgen"
+RUSTC="$MOZ_FETCHES_DIR/rustc/bin/rustc"
+CARGO="$MOZ_FETCHES_DIR/rustc/bin/cargo"
+RUSTDOC="$MOZ_FETCHES_DIR/rustc/bin/rustdoc"
+RUSTFMT="$MOZ_FETCHES_DIR/rustc/bin/rustfmt"
+CBINDGEN="$MOZ_FETCHES_DIR/cbindgen/cbindgen"
 
 ac_add_options --enable-rust-simd

--- a/build/mozconfig.stylo
+++ b/build/mozconfig.stylo
@@ -1,2 +1,2 @@
 # Tell the build system where to find llvm-config for builds on automation.
-export LLVM_CONFIG="${TOOLTOOL_DIR:-$topsrcdir}/clang/bin/llvm-config"
+export LLVM_CONFIG="${MOZ_FETCHES_DIR}/clang/bin/llvm-config"

--- a/build/unix/mozconfig.asan
+++ b/build/unix/mozconfig.asan
@@ -1,13 +1,13 @@
 MOZ_AUTOMATION_L10N_CHECK=0
 
 . "$topsrcdir/build/unix/mozconfig.unix"
 
-export LLVM_SYMBOLIZER="$topsrcdir/clang/bin/llvm-symbolizer"
+export LLVM_SYMBOLIZER="$MOZ_FETCHES_DIR/clang/bin/llvm-symbolizer"
 #
 # Enable ASan specific code and build workarounds
 ac_add_options --enable-address-sanitizer
 
 # Mandatory options required for ASan builds (both on Linux and Mac)
 export MOZ_DEBUG_SYMBOLS=1
 ac_add_options --enable-debug-symbols
 ac_add_options --disable-install-strip

--- a/build/unix/mozconfig.stdcxx
+++ b/build/unix/mozconfig.stdcxx
@@ -1,19 +1,19 @@
 # Avoid dependency on libstdc++ 4.7
 export MOZ_STDCXX_COMPAT=1
 
 TOOLTOOL_DIR=${TOOLTOOL_DIR:-$topsrcdir}
 
 # Depending whether GCC was built on a RedHat-based or a Debian-based system,
 # the directory containing 32-bits libraries can be either (respectively)
 # lib or lib32. The directory for 64-bits libraries is always lib64.
-if [ -f "$TOOLTOOL_DIR/gcc/lib64/libstdc++.so" ]; then
+if [ -f "$MOZ_FETCHES_DIR/gcc/lib64/libstdc++.so" ]; then
   # We put both 32-bits and 64-bits library path in LD_LIBRARY_PATH: ld.so
   # will prefer the files in the 32-bits path when loading 32-bits executables,
   # and the files in the 64-bits path when loading 64-bits executables.
   # We also put both possible 32-bits library paths.
-  LD_LIBRARY_PATH=${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOOLTOOL_DIR/gcc/lib64:$TOOLTOOL_DIR/gcc/lib32:$TOOLTOOL_DIR/gcc/lib
-elif [ -f "$TOOLTOOL_DIR/clang/lib/libstdc++.so" ]; then
-  LD_LIBRARY_PATH=${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOOLTOOL_DIR/clang/lib:$TOOLTOOL_DIR/clang/lib32
+  LD_LIBRARY_PATH=${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$MOZ_FETCHES_DIR/gcc/lib64:$MOZ_FETCHES_DIR/gcc/lib32:$MOZ_FETCHES_DIR/gcc/lib
+elif [ -f "$MOZ_FETCHES_DIR/clang/lib/libstdc++.so" ]; then
+  LD_LIBRARY_PATH=${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$MOZ_FETCHES_DIR/clang/lib:$MOZ_FETCHES_DIR/clang/lib32
 fi
 
 mk_add_options "export LD_LIBRARY_PATH=$LD_LIBRARY_PATH"

--- a/build/unix/mozconfig.tsan
+++ b/build/unix/mozconfig.tsan
@@ -1,13 +1,13 @@
 MOZ_AUTOMATION_L10N_CHECK=0
 
 . "$topsrcdir/build/unix/mozconfig.unix"
 
-export LLVM_SYMBOLIZER="$topsrcdir/clang/bin/llvm-symbolizer"
+export LLVM_SYMBOLIZER="$MOZ_FETCHES_DIR/clang/bin/llvm-symbolizer"
 
 # Enable TSan specific code and build workarounds
 ac_add_options --enable-thread-sanitizer
 
 # The ThreadSanitizer is not compatible with sandboxing
 # (see bug 1182565)
 ac_add_options --disable-sandbox
 

--- a/build/unix/mozconfig.unix
+++ b/build/unix/mozconfig.unix
@@ -1,23 +1,23 @@
 . "$topsrcdir/build/mozconfig.common"
 
 TOOLTOOL_DIR=${TOOLTOOL_DIR:-$topsrcdir}
 
 if [ -n "$FORCE_GCC" ]; then
-    CC="$TOOLTOOL_DIR/gcc/bin/gcc"
-    CXX="$TOOLTOOL_DIR/gcc/bin/g++"
+    CC="$MOZ_FETCHES_DIR/gcc/bin/gcc"
+    CXX="$MOZ_FETCHES_DIR/gcc/bin/g++"
 
     # We want to make sure we use binutils and other binaries in the tooltool
     # package.
-    mk_add_options "export PATH=$TOOLTOOL_DIR/gcc/bin:$PATH"
-    ac_add_options --with-clang-path=$TOOLTOOL_DIR/clang/bin/clang
+    mk_add_options "export PATH=$MOZ_FETCHES_DIR/gcc/bin:$PATH"
+    ac_add_options --with-clang-path=$MOZ_FETCHES_DIR/clang/bin/clang
 else
-    CC="$TOOLTOOL_DIR/clang/bin/clang"
-    CXX="$TOOLTOOL_DIR/clang/bin/clang++"
+    CC="$MOZ_FETCHES_DIR/clang/bin/clang"
+    CXX="$MOZ_FETCHES_DIR/clang/bin/clang++"
     export ENABLE_CLANG_PLUGIN=1
     case "$PERFHERDER_EXTRA_OPTIONS" in
     base-toolchains*)
       # Clang versions < 7.0 don't support the -fcrash-diagnostics-dir flag.
       ;;
     *)
       export CFLAGS="$CFLAGS -fcrash-diagnostics-dir=${UPLOAD_PATH}"
       export CXXFLAGS="$CXXFLAGS -fcrash-diagnostics-dir=${UPLOAD_PATH}"
@@ -28,18 +28,18 @@ else
         if [ -z "$USE_ARTIFACT" ]; then
             export MOZ_LTO=cross
             if [ -n "$MOZ_PGO_PROFILE_USE" ]; then
                 ac_add_options --enable-profile-use=cross
                 ac_add_options --with-pgo-jarlog=/builds/worker/fetches/en-US.log
                 ac_add_options --with-pgo-profile-path=/builds/worker/fetches
             fi
         fi
-        export LLVM_PROFDATA="$TOOLTOOL_DIR/clang/bin/llvm-profdata"
-        export AR="$topsrcdir/clang/bin/llvm-ar"
-        export NM="$topsrcdir/clang/bin/llvm-nm"
-        export RANLIB="$topsrcdir/clang/bin/llvm-ranlib"
+        export LLVM_PROFDATA="$MOZ_FETCHES_DIR/clang/bin/llvm-profdata"
+        export AR="$MOZ_FETCHES_DIR/clang/bin/llvm-ar"
+        export NM="$MOZ_FETCHES_DIR/clang/bin/llvm-nm"
+        export RANLIB="$MOZ_FETCHES_DIR/clang/bin/llvm-ranlib"
     fi
 
-    mk_add_options "export PATH=$TOOLTOOL_DIR/binutils/bin:$PATH"
+    mk_add_options "export PATH=$MOZ_FETCHES_DIR/binutils/bin:$PATH"
 fi
 
 . "$topsrcdir/build/unix/mozconfig.stdcxx"

--- a/build/win64/mozconfig.asan
+++ b/build/win64/mozconfig.asan
@@ -1,18 +1,18 @@
 . "$topsrcdir/browser/config/mozconfigs/win64/common-win64"
 
-if [ -d "$topsrcdir/clang" ]; then
-    CLANG_LIB_DIR="$(cd $topsrcdir/clang/lib/clang/* && cd lib/windows && pwd)"
+if [ -d "$MOZ_FETCHES_DIR/clang" ]; then
+    CLANG_LIB_DIR="$(cd $MOZ_FETCHES_DIR/clang/lib/clang/* && cd lib/windows && pwd)"
 
     export LIB=$LIB:$CLANG_LIB_DIR
     export LDFLAGS="clang_rt.asan_dynamic-x86_64.lib clang_rt.asan_dynamic_runtime_thunk-x86_64.lib"
 
     export MOZ_COPY_PDBS=1
-    export LLVM_SYMBOLIZER="$topsrcdir/clang/bin/llvm-symbolizer.exe"
+    export LLVM_SYMBOLIZER="$MOZ_FETCHES_DIR/clang/bin/llvm-symbolizer.exe"
     export MOZ_CLANG_RT_ASAN_LIB_PATH="${CLANG_LIB_DIR}/clang_rt.asan_dynamic-x86_64.dll"
 fi
 
 # Enable ASan specific code and build workarounds
 ac_add_options --enable-address-sanitizer
 
 # Mandatory options required for ASan builds
 ac_add_options --enable-debug-symbols

--- a/docshell/base/BrowsingContext.cpp
+++ b/docshell/base/BrowsingContext.cpp
@@ -457,114 +457,131 @@ void BrowsingContext::GetChildren(Childr
 // 4) Siblings and their children, both in insertion order
 // 5) After this we iteratively follow the parent chain, repeating 3
 //    and 4 until
 // 6) If there is no parent, consider all other top level browsing
 //    contexts and their children, both in insertion order
 //
 // See
 // https://html.spec.whatwg.org/multipage/browsers.html#the-rules-for-choosing-a-browsing-context-given-a-browsing-context-name
-BrowsingContext* BrowsingContext::FindWithName(const nsAString& aName) {
+BrowsingContext* BrowsingContext::FindWithName(
+    const nsAString& aName, BrowsingContext& aRequestingContext) {
   BrowsingContext* found = nullptr;
   if (aName.IsEmpty()) {
     // You can't find a browsing context with an empty name.
     found = nullptr;
-  } else if (BrowsingContext* special = FindWithSpecialName(aName)) {
-    found = special;
   } else if (aName.LowerCaseEqualsLiteral("_blank")) {
     // Just return null. Caller must handle creating a new window with
     // a blank name.
     found = nullptr;
-  } else if (BrowsingContext* child = FindWithNameInSubtree(aName, this)) {
+  } else if (IsSpecialName(aName)) {
+    found = FindWithSpecialName(aName, aRequestingContext);
+  } else if (BrowsingContext* child =
+                 FindWithNameInSubtree(aName, aRequestingContext)) {
     found = child;
   } else {
     BrowsingContext* current = this;
 
     do {
       Children* siblings;
       BrowsingContext* parent = current->mParent;
 
       if (!parent) {
         // We've reached the root of the tree, consider browsing
         // contexts in the same browsing context group.
         siblings = &mGroup->Toplevels();
-      } else if (parent->NameEquals(aName) && CanAccess(parent) &&
+      } else if (parent->NameEquals(aName) &&
+                 aRequestingContext.CanAccess(parent) &&
                  parent->IsTargetable()) {
         found = parent;
         break;
       } else {
         siblings = &parent->mChildren;
       }
 
       for (BrowsingContext* sibling : *siblings) {
         if (sibling == current) {
           continue;
         }
 
         if (BrowsingContext* relative =
-                sibling->FindWithNameInSubtree(aName, this)) {
+                sibling->FindWithNameInSubtree(aName, aRequestingContext)) {
           found = relative;
           // Breaks the outer loop
           parent = nullptr;
           break;
         }
       }
 
       current = parent;
     } while (current);
   }
 
   // Helpers should perform access control checks, which means that we
   // only need to assert that we can access found.
-  MOZ_DIAGNOSTIC_ASSERT(!found || CanAccess(found));
+  MOZ_DIAGNOSTIC_ASSERT(!found || aRequestingContext.CanAccess(found));
 
   return found;
 }
 
-BrowsingContext* BrowsingContext::FindChildWithName(const nsAString& aName) {
+BrowsingContext* BrowsingContext::FindChildWithName(
+    const nsAString& aName, BrowsingContext& aRequestingContext) {
   if (aName.IsEmpty()) {
     // You can't find a browsing context with the empty name.
     return nullptr;
   }
 
   for (BrowsingContext* child : mChildren) {
-    if (child->NameEquals(aName) && CanAccess(child) && child->IsTargetable()) {
+    if (child->NameEquals(aName) && aRequestingContext.CanAccess(child) &&
+        child->IsTargetable()) {
       return child;
     }
   }
 
   return nullptr;
 }
 
-BrowsingContext* BrowsingContext::FindWithSpecialName(const nsAString& aName) {
+/* static */
+bool BrowsingContext::IsSpecialName(const nsAString& aName) {
+  return (aName.LowerCaseEqualsLiteral("_self") ||
+          aName.LowerCaseEqualsLiteral("_parent") ||
+          aName.LowerCaseEqualsLiteral("_top") ||
+          aName.LowerCaseEqualsLiteral("_blank"));
+}
+
+BrowsingContext* BrowsingContext::FindWithSpecialName(
+    const nsAString& aName, BrowsingContext& aRequestingContext) {
   // TODO(farre): Neither BrowsingContext nor nsDocShell checks if the
   // browsing context pointed to by a special name is active. Should
   // it be? See Bug 1527913.
   if (aName.LowerCaseEqualsLiteral("_self")) {
     return this;
   }
 
   if (aName.LowerCaseEqualsLiteral("_parent")) {
-    return mParent && CanAccess(mParent.get()) ? mParent.get() : this;
+    if (mParent) {
+      return aRequestingContext.CanAccess(mParent) ? mParent.get() : nullptr;
+    }
+    return this;
   }
 
   if (aName.LowerCaseEqualsLiteral("_top")) {
     BrowsingContext* top = Top();
 
-    return CanAccess(top) ? top : nullptr;
+    return aRequestingContext.CanAccess(top) ? top : nullptr;
   }
 
   return nullptr;
 }
 
 BrowsingContext* BrowsingContext::FindWithNameInSubtree(
-    const nsAString& aName, BrowsingContext* aRequestingContext) {
+    const nsAString& aName, BrowsingContext& aRequestingContext) {
   MOZ_DIAGNOSTIC_ASSERT(!aName.IsEmpty());
 
-  if (NameEquals(aName) && aRequestingContext->CanAccess(this) &&
+  if (NameEquals(aName) && aRequestingContext.CanAccess(this) &&
       IsTargetable()) {
     return this;
   }
 
   for (BrowsingContext* child : mChildren) {
     if (BrowsingContext* found =
             child->FindWithNameInSubtree(aName, aRequestingContext)) {
       return found;
@@ -761,16 +778,39 @@ void BrowsingContext::Location(JSContext
   aError.MightThrowJSException();
   sSingleton.GetProxyObject(aCx, &mLocation, /* aTransplantTo = */ nullptr,
                             aLocation);
   if (!aLocation) {
     aError.StealExceptionFromJSContext(aCx);
   }
 }
 
+void BrowsingContext::LoadURI(BrowsingContext* aAccessor,
+                              nsDocShellLoadState* aLoadState) {
+  MOZ_DIAGNOSTIC_ASSERT(!IsDiscarded());
+  MOZ_DIAGNOSTIC_ASSERT(!aAccessor || !aAccessor->IsDiscarded());
+
+  if (mDocShell) {
+    mDocShell->LoadURI(aLoadState);
+  } else if (!aAccessor && XRE_IsParentProcess()) {
+    Unused << Canonical()->GetCurrentWindowGlobal()->SendLoadURIInChild(
+        aLoadState);
+  } else {
+    MOZ_DIAGNOSTIC_ASSERT(aAccessor);
+    MOZ_DIAGNOSTIC_ASSERT(aAccessor->Group() == Group());
+
+    nsCOMPtr<nsPIDOMWindowOuter> win(aAccessor->GetDOMWindow());
+    MOZ_DIAGNOSTIC_ASSERT(win);
+    if (WindowGlobalChild* wgc =
+            win->GetCurrentInnerWindow()->GetWindowGlobalChild()) {
+      wgc->SendLoadURI(this, aLoadState);
+    }
+  }
+}
+
 void BrowsingContext::Close(CallerType aCallerType, ErrorResult& aError) {
   // FIXME We need to set mClosed, but only once we're sending the
   //       DOMWindowClose event (which happens in the process where the
   //       document for this browsing context is loaded).
   //       See https://bugzilla.mozilla.org/show_bug.cgi?id=1516343.
   if (ContentChild* cc = ContentChild::GetSingleton()) {
     cc->SendWindowClose(this, aCallerType == CallerType::System);
   } else if (ContentParent* cp = Canonical()->GetContentParent()) {

--- a/docshell/base/BrowsingContext.h
+++ b/docshell/base/BrowsingContext.h
@@ -15,16 +15,17 @@
 #include "nsCOMPtr.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsIDocShell.h"
 #include "nsString.h"
 #include "nsTArray.h"
 #include "nsWrapperCache.h"
 #include "nsILoadInfo.h"
 
+class nsDocShellLoadState;
 class nsGlobalWindowOuter;
 class nsIPrincipal;
 class nsOuterWindowProxy;
 class PickleIterator;
 
 namespace IPC {
 class Message;
 }  // namespace IPC
@@ -174,16 +175,21 @@ class BrowsingContext : public nsWrapper
 
   // Remove all children from the current BrowsingContext and cache
   // them to allow them to be attached again.
   void CacheChildren(bool aFromIPC = false);
 
   // Restore cached browsing contexts.
   void RestoreChildren(Children&& aChildren, bool aFromIPC = false);
 
+  // Triggers a load in the process which currently owns this BrowsingContext.
+  // aAccessor is the context which initiated the load, and may be null only for
+  // in-process BrowsingContexts.
+  void LoadURI(BrowsingContext* aAccessor, nsDocShellLoadState* aLoadState);
+
   // Determine if the current BrowsingContext was 'cached' by the logic in
   // CacheChildren.
   bool IsCached();
 
   // Check that this browsing context is targetable for navigations (i.e. that
   // it is neither closed, cached, nor discarded).
   bool IsTargetable();
 
@@ -204,37 +210,58 @@ class BrowsingContext : public nsWrapper
 
   already_AddRefed<BrowsingContext> GetOpener() const { return Get(mOpenerId); }
   void SetOpener(BrowsingContext* aOpener) {
     SetOpenerId(aOpener ? aOpener->Id() : 0);
   }
 
   bool HasOpener() const;
 
+  /**
+   * When a new browsing context is opened by a sandboxed document, it needs to
+   * keep track of the browsing context that opened it, so that it can be
+   * navigated by it.  This is the "one permitted sandboxed navigator".
+   */
+  already_AddRefed<BrowsingContext> GetOnePermittedSandboxedNavigator() const {
+    return Get(mOnePermittedSandboxedNavigatorId);
+  }
+  void SetOnePermittedSandboxedNavigator(BrowsingContext* aNavigator) {
+    if (mOnePermittedSandboxedNavigatorId) {
+      MOZ_ASSERT(false,
+                 "One Permitted Sandboxed Navigator should only be set once.");
+    } else {
+      SetOnePermittedSandboxedNavigatorId(aNavigator ? aNavigator->Id() : 0);
+    }
+  }
+
   void GetChildren(Children& aChildren);
 
   BrowsingContextGroup* Group() { return mGroup; }
 
   // Using the rules for choosing a browsing context we try to find
   // the browsing context with the given name in the set of
   // transitively reachable browsing contexts. Performs access control
   // with regards to this.
   // See
   // https://html.spec.whatwg.org/multipage/browsers.html#the-rules-for-choosing-a-browsing-context-given-a-browsing-context-name.
   //
   // BrowsingContext::FindWithName(const nsAString&) is equivalent to
   // calling nsIDocShellTreeItem::FindItemWithName(aName, nullptr,
   // nullptr, false, <return value>).
-  BrowsingContext* FindWithName(const nsAString& aName);
+  BrowsingContext* FindWithName(const nsAString& aName,
+                                BrowsingContext& aRequestingContext);
+
 
   // Find a browsing context in this context's list of
   // children. Doesn't consider the special names, '_self', '_parent',
   // '_top', or '_blank'. Performs access control with regard to
   // 'this'.
-  BrowsingContext* FindChildWithName(const nsAString& aName);
+  BrowsingContext* FindChildWithName(const nsAString& aName,
+                                     BrowsingContext& aRequestingContext);
+
 
   nsISupports* GetParentObject() const;
   JSObject* WrapObject(JSContext* aCx,
                        JS::Handle<JSObject*> aGivenProto) override;
 
   // This function would be called when its corresponding document is activated
   // by user gesture, and we would set the flag in the top level browsing
   // context.
@@ -385,26 +412,31 @@ class BrowsingContext : public nsWrapper
   bool CanAccess(BrowsingContext* aTarget, bool aConsiderOpener = true);
 
  protected:
   virtual ~BrowsingContext();
   BrowsingContext(BrowsingContext* aParent, BrowsingContextGroup* aGroup,
                   uint64_t aBrowsingContextId, Type aType);
 
  private:
+  // Returns true if the given name is one of the "special" names, currently:
+  // "_self", "_parent", "_top", or "_blank".
+  static bool IsSpecialName(const nsAString& aName);
+
   // Find the special browsing context if aName is '_self', '_parent',
   // '_top', but not '_blank'. The latter is handled in FindWithName
-  BrowsingContext* FindWithSpecialName(const nsAString& aName);
+  BrowsingContext* FindWithSpecialName(const nsAString& aName,
+                                       BrowsingContext& aRequestingContext);
 
   // Find a browsing context in the subtree rooted at 'this' Doesn't
   // consider the special names, '_self', '_parent', '_top', or
   // '_blank'. Performs access control with regard to
   // 'aRequestingContext'.
   BrowsingContext* FindWithNameInSubtree(const nsAString& aName,
-                                         BrowsingContext* aRequestingContext);
+                                         BrowsingContext& aRequestingContext);
 
   // Removes the context from its group and sets mIsDetached to true.
   void Unregister();
 
   friend class ::nsOuterWindowProxy;
   friend class ::nsGlobalWindowOuter;
   // Update the window proxy object that corresponds to this browsing context.
   // This should be called from the window proxy object's objectMoved hook, if

--- a/docshell/base/BrowsingContextFieldList.h
+++ b/docshell/base/BrowsingContextFieldList.h
@@ -14,13 +14,15 @@ MOZ_BC_FIELD(Name, nsString)
 MOZ_BC_FIELD(Closed, bool)
 MOZ_BC_FIELD(EmbedderPolicy, nsILoadInfo::CrossOriginEmbedderPolicy)
 MOZ_BC_FIELD(OpenerPolicy, nsILoadInfo::CrossOriginOpenerPolicy)
 
 // The current opener for this BrowsingContext. This is a weak reference, and
 // stored as the opener ID.
 MOZ_BC_FIELD(OpenerId, uint64_t)
 
+MOZ_BC_FIELD(OnePermittedSandboxedNavigatorId, uint64_t)
+
 // Toplevel browsing contexts only. This field controls whether the browsing
 // context is currently considered to be activated by a gesture.
 MOZ_BC_FIELD(IsActivatedByUserGesture, bool)
 
 #undef MOZ_BC_FIELD

--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -3002,24 +3002,24 @@ nsresult nsDocShell::DoFindItemWithName(
   if (window && !aSkipTabGroup) {
     RefPtr<mozilla::dom::TabGroup> tabGroup = window->TabGroup();
     tabGroup->FindItemWithName(aName, this, aOriginalRequestor, aResult);
   }
 
   return NS_OK;
 }
 
-bool nsDocShell::IsSandboxedFrom(nsIDocShell* aTargetDocShell) {
+bool nsDocShell::IsSandboxedFrom(BrowsingContext* aTargetBC) {
   // If no target then not sandboxed.
-  if (!aTargetDocShell) {
+  if (!aTargetBC) {
     return false;
   }
 
   // We cannot be sandboxed from ourselves.
-  if (aTargetDocShell == this) {
+  if (aTargetBC == mBrowsingContext) {
     return false;
   }
 
   // Default the sandbox flags to our flags, so that if we can't retrieve the
   // active document, we will still enforce our own.
   uint32_t sandboxFlags = mSandboxFlags;
   if (mContentViewer) {
     RefPtr<Document> doc = mContentViewer->GetDocument();
@@ -3028,55 +3028,47 @@ bool nsDocShell::IsSandboxedFrom(nsIDocS
     }
   }
 
   // If no flags, we are not sandboxed at all.
   if (!sandboxFlags) {
     return false;
   }
 
-  // If aTargetDocShell has an ancestor, it is not top level.
-  nsCOMPtr<nsIDocShellTreeItem> ancestorOfTarget;
-  aTargetDocShell->GetInProcessSameTypeParent(getter_AddRefs(ancestorOfTarget));
+  // If aTargetBC has an ancestor, it is not top level.
+  RefPtr<BrowsingContext> ancestorOfTarget(aTargetBC->GetParent());
   if (ancestorOfTarget) {
     do {
       // We are not sandboxed if we are an ancestor of target.
-      if (ancestorOfTarget == this) {
+      if (ancestorOfTarget == mBrowsingContext) {
         return false;
       }
-      nsCOMPtr<nsIDocShellTreeItem> tempTreeItem;
-      ancestorOfTarget->GetInProcessSameTypeParent(
-          getter_AddRefs(tempTreeItem));
-      tempTreeItem.swap(ancestorOfTarget);
+      ancestorOfTarget = ancestorOfTarget->GetParent();
     } while (ancestorOfTarget);
 
-    // Otherwise, we are sandboxed from aTargetDocShell.
+    // Otherwise, we are sandboxed from aTargetBC.
     return true;
   }
 
-  // aTargetDocShell is top level, are we the "one permitted sandboxed
-  // navigator", i.e. did we open aTargetDocShell?
-  nsCOMPtr<nsIDocShell> permittedNavigator;
-  aTargetDocShell->GetOnePermittedSandboxedNavigator(
-      getter_AddRefs(permittedNavigator));
-  if (permittedNavigator == this) {
+  // aTargetBC is top level, are we the "one permitted sandboxed
+  // navigator", i.e. did we open aTargetBC?
+  RefPtr<BrowsingContext> permittedNavigator(
+      aTargetBC->GetOnePermittedSandboxedNavigator());
+  if (permittedNavigator == mBrowsingContext) {
     return false;
   }
 
   // If SANDBOXED_TOPLEVEL_NAVIGATION flag is not on, we are not sandboxed
   // from our top.
-  if (!(sandboxFlags & SANDBOXED_TOPLEVEL_NAVIGATION)) {
-    nsCOMPtr<nsIDocShellTreeItem> rootTreeItem;
-    GetInProcessSameTypeRootTreeItem(getter_AddRefs(rootTreeItem));
-    if (SameCOMIdentity(aTargetDocShell, rootTreeItem)) {
-      return false;
-    }
-  }
-
-  // Otherwise, we are sandboxed from aTargetDocShell.
+  if (!(sandboxFlags & SANDBOXED_TOPLEVEL_NAVIGATION) &&
+      aTargetBC == mBrowsingContext->Top()) {
+    return false;
+  }
+
+  // Otherwise, we are sandboxed from aTargetBC.
   return true;
 }
 
 NS_IMETHODIMP
 nsDocShell::GetTreeOwner(nsIDocShellTreeOwner** aTreeOwner) {
   NS_ENSURE_ARG_POINTER(aTreeOwner);
 
   *aTreeOwner = mTreeOwner;
@@ -4962,18 +4954,16 @@ nsDocShell::Destroy() {
   }
 
   SetTreeOwner(nullptr);
 
   mBrowserChild = nullptr;
 
   mChromeEventHandler = nullptr;
 
-  mOnePermittedSandboxedNavigator = nullptr;
-
   // required to break ref cycle
   mSecurityUI = nullptr;
 
   // Cancel any timers that were set for this docshell; this is needed
   // to break the cycle between us and the timers.
   CancelRefreshURITimers();
 
   if (UsePrivateBrowsing()) {
@@ -5260,21 +5250,16 @@ nsDocShell::SetIsOffScreenBrowser(bool a
 NS_IMETHODIMP
 nsDocShell::GetIsOffScreenBrowser(bool* aIsOffScreen) {
   *aIsOffScreen = mIsOffScreenBrowser;
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsDocShell::SetIsActive(bool aIsActive) {
-  // We disallow setting active on chrome docshells.
-  if (mItemType == nsIDocShellTreeItem::typeChrome) {
-    return NS_ERROR_INVALID_ARG;
-  }
-
   // Keep track ourselves.
   mIsActive = aIsActive;
 
   // Tell the PresShell about it.
   if (RefPtr<PresShell> presShell = GetPresShell()) {
     presShell->SetIsActive(aIsActive);
   }
 
@@ -5363,44 +5348,16 @@ nsDocShell::SetSandboxFlags(uint32_t aSa
 
 NS_IMETHODIMP
 nsDocShell::GetSandboxFlags(uint32_t* aSandboxFlags) {
   *aSandboxFlags = mSandboxFlags;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsDocShell::SetOnePermittedSandboxedNavigator(
-    nsIDocShell* aSandboxedNavigator) {
-  if (mOnePermittedSandboxedNavigator) {
-    NS_ERROR("One Permitted Sandboxed Navigator should only be set once.");
-    return NS_OK;
-  }
-
-  MOZ_ASSERT(!mIsBeingDestroyed);
-
-  mOnePermittedSandboxedNavigator = do_GetWeakReference(aSandboxedNavigator);
-  NS_ASSERTION(
-      mOnePermittedSandboxedNavigator,
-      "One Permitted Sandboxed Navigator must support weak references.");
-
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsDocShell::GetOnePermittedSandboxedNavigator(
-    nsIDocShell** aSandboxedNavigator) {
-  NS_ENSURE_ARG_POINTER(aSandboxedNavigator);
-  nsCOMPtr<nsIDocShell> permittedNavigator =
-      do_QueryReferent(mOnePermittedSandboxedNavigator);
-  permittedNavigator.forget(aSandboxedNavigator);
-  return NS_OK;
-}
-
-NS_IMETHODIMP
 nsDocShell::SetDefaultLoadFlags(uint32_t aDefaultLoadFlags) {
   mDefaultLoadFlags = aDefaultLoadFlags;
 
   // Tell the load group to set these flags all requests in the group
   if (mLoadGroup) {
     mLoadGroup->SetDefaultLoadFlags(aDefaultLoadFlags);
   } else {
     NS_WARNING(
@@ -9295,17 +9252,17 @@ nsresult nsDocShell::InternalLoad(nsDocS
     if (handled) {
       return NS_OK;
     }
   }
 
   // If a source docshell has been passed, check to see if we are sandboxed
   // from it as the result of an iframe or CSP sandbox.
   if (aLoadState->SourceDocShell() &&
-      aLoadState->SourceDocShell()->IsSandboxedFrom(this)) {
+      aLoadState->SourceDocShell()->IsSandboxedFrom(mBrowsingContext)) {
     return NS_ERROR_DOM_INVALID_ACCESS_ERR;
   }
 
   NS_ENSURE_STATE(!HasUnloadedParent());
 
   rv = CheckLoadingPermissions();
   if (NS_FAILED(rv)) {
     return rv;

--- a/docshell/base/nsDocShell.h
+++ b/docshell/base/nsDocShell.h
@@ -1061,17 +1061,16 @@ class nsDocShell final : public nsDocLoa
   // We're counting the number of |nsDocShells| to help find leaks
   static unsigned long gNumberOfDocShells;
 #endif /* DEBUG */
 
   nsID mHistoryID;
   nsString mTitle;
   nsString mCustomUserAgent;
   nsCString mOriginalUriString;
-  nsWeakPtr mOnePermittedSandboxedNavigator;
   nsWeakPtr mOpener;
   nsTObserverArray<nsWeakPtr> mPrivacyObservers;
   nsTObserverArray<nsWeakPtr> mReflowObservers;
   nsTObserverArray<nsWeakPtr> mScrollObservers;
   mozilla::OriginAttributes mOriginAttributes;
   mozilla::UniquePtr<mozilla::dom::ClientSource> mInitialClientSource;
   nsCOMPtr<nsINetworkInterceptController> mInterceptController;
   RefPtr<nsDOMNavigationTiming> mTiming;

--- a/docshell/base/nsIDocShell.idl
+++ b/docshell/base/nsIDocShell.idl
@@ -780,27 +780,20 @@ interface nsIDocShell : nsIDocShellTreeI
    * loaded.
    * The sandbox flags of a document depend on the sandbox flags on its
    * docshell and of its parent document, if any.
    * See nsSandboxFlags.h for the possible flags.
    */
   attribute unsigned long sandboxFlags;
 
   /**
-   * When a new browsing context is opened by a sandboxed document, it needs to
-   * keep track of the browsing context that opened it, so that it can be
-   * navigated by it.  This is the "one permitted sandboxed navigator".
-   */
-  attribute nsIDocShell onePermittedSandboxedNavigator;
-
-  /**
    * Returns true if we are sandboxed from aTargetDocShell.
    * aTargetDocShell - the browsing context we are attempting to navigate.
    */
-  [noscript,notxpcom,nostdcall] bool isSandboxedFrom(in nsIDocShell aTargetDocShell);
+  [noscript,notxpcom,nostdcall] bool isSandboxedFrom(in BrowsingContext aTargetBC);
 
   /**
    * This member variable determines whether a document has Mixed Active Content that
    * was initially blocked from loading, but the user has choosen to override the
    * block and allow the content to load. mMixedContentChannel is set to the document's
    * channel when the user allows mixed content. The nsMixedContentBlocker content policy
    * checks if the document's root channel matches the mMixedContentChannel.  If it matches,
    * then Mixed Content is loaded.  If it does match, mixed content is blocked.

--- a/docshell/test/browser/browser.ini
+++ b/docshell/test/browser/browser.ini
@@ -129,19 +129,19 @@ skip-if = true # Bug 1220415
 [browser_timelineMarkers-03.js]
 [browser_timelineMarkers-04.js]
 [browser_timelineMarkers-05.js]
 [browser_ua_emulation.js]
 [browser_history_triggeringprincipal_viewsource.js]
 [browser_click_link_within_view_source.js]
 [browser_browsingContext-01.js]
 [browser_browsingContext-02.js]
-fail-if = fission
+skip-if = fission # Cross-process postMessage
 [browser_browsingContext-03.js]
-fail-if = fission
+skip-if = fission # Cross-process postMessage
 [browser_browsingContext-embedder.js]
 [browser_csp_uir.js]
 support-files =
   file_csp_uir.html
   file_csp_uir_dummy.html
 [browser_cross_process_csp_inheritance.js]
 fail-if = fission
 skip-if = !e10s # e10s specific test.

--- a/docshell/test/browser/browser_browsingContext-02.js
+++ b/docshell/test/browser/browser_browsingContext-02.js
@@ -27,54 +27,66 @@ add_task(async function() {
         URL + "#seventh",
         true,
         true
       );
       await ContentTask.spawn(
         browser,
         { base1: BASE1, base2: BASE2 },
         async function({ base1, base2 }) {
-          let top = content.window;
+          let top = content;
           top.name = "top";
           top.location.href += "#top";
 
           let contexts = {
             top: top.location.href,
             first: base1 + "dummy_page.html#first",
             third: base2 + "dummy_page.html#third",
             second: base1 + "dummy_page.html#second",
             fourth: base2 + "dummy_page.html#fourth",
             fifth: base1 + "dummy_page.html#fifth",
             sixth: base1 + "onload_message.html#sixth",
             seventh: base1 + "onload_message.html#seventh",
           };
 
           function addFrame(target, name) {
-            let doc = (target.contentWindow || target).document;
-            let frame = doc.createElement("iframe");
-            let p = new Promise(
-              resolve => (frame.onload = () => resolve(frame))
+            return content.SpecialPowers.spawn(
+              target,
+              [name, contexts[name]],
+              async (name, context) => {
+                let doc = this.content.document;
+
+                let frame = doc.createElement("iframe");
+                doc.body.appendChild(frame);
+                frame.name = name;
+                frame.src = context;
+                await new Promise(resolve => {
+                  frame.addEventListener("load", resolve, { once: true });
+                });
+                return frame.browsingContext;
+              }
             );
-            doc.body.appendChild(frame);
-            frame.name = name;
-            frame.src = contexts[name];
-            return p;
           }
 
           function addWindow(target, name, { options, resolve }) {
-            var win = target.contentWindow.open(contexts[name], name, options);
+            return content.SpecialPowers.spawn(
+              target,
+              [name, contexts[name], options, resolve],
+              (name, context, options, resolve) => {
+                let win = this.content.open(context, name, options);
+                let bc = win && win.docShell.browsingContext;
 
-            if (resolve) {
-              return new Promise(resolve =>
-                target.contentWindow.addEventListener("message", () =>
-                  resolve(win)
-                )
-              );
-            }
-            return Promise.resolve({ name });
+                if (resolve) {
+                  return new Promise(resolve =>
+                    this.content.addEventListener("message", () => resolve(bc))
+                  );
+                }
+                return Promise.resolve({ name });
+              }
+            );
           }
 
           // We're going to create a tree that looks like the
           // following.
           //
           //           top          sixth    seventh
           //          /   \
           //         /     \        /
@@ -88,35 +100,31 @@ add_task(async function() {
           //
           // The idea is to have one top level non-auxiliary browsing
           // context, five nested, one top level auxiliary with an
           // opener, and one top level without an opener. Given that
           // set of related and one unrelated browsing contexts we
           // wish to confirm that targeting is able to find
           // appropriate browsing contexts.
 
-          function bc(frame) {
-            return (frame.contentWindow || frame).docShell.browsingContext;
-          }
-
           function reachable(start, targets) {
             for (let target of targets) {
               is(
-                bc(start).findWithName(target.name),
-                bc(target),
-                [bc(start).name, "can reach", target.name].join(" ")
+                start.findWithName(target.name, start),
+                target,
+                [start.name, "can reach", target.name].join(" ")
               );
             }
           }
 
           function unreachable(start, target) {
             is(
-              bc(start).findWithName(target.name),
+              start.findWithName(target.name, start),
               null,
-              [bc(start).name, "can't reach", target.name].join(" ")
+              [start.name, "can't reach", target.name].join(" ")
             );
           }
 
           let first = await addFrame(top, "first");
           info("first");
           let second = await addFrame(top, "second");
           info("second");
           let third = await addFrame(first, "third");
@@ -127,17 +135,25 @@ add_task(async function() {
           info("fifth");
           let sixth = await addWindow(fourth, "sixth", { resolve: true });
           info("sixth");
           let seventh = await addWindow(fourth, "seventh", {
             options: ["noopener"],
           });
           info("seventh");
 
-          let frames = [top, first, second, third, fourth, fifth, sixth];
+          let frames = [
+            BrowsingContext.getFromWindow(top),
+            first,
+            second,
+            third,
+            fourth,
+            fifth,
+            sixth,
+          ];
           for (let start of frames) {
             reachable(start, frames);
             unreachable(start, seventh);
           }
         }
       );
 
       for (let tab of await Promise.all([sixth, seventh])) {

--- a/docshell/test/browser/browser_browsingContext-03.js
+++ b/docshell/test/browser/browser_browsingContext-03.js
@@ -21,49 +21,61 @@ add_task(async function() {
         URL + "#sixth",
         true,
         true
       );
       await ContentTask.spawn(
         browser,
         { base1: BASE1, base2: BASE2 },
         async function({ base1, base2 }) {
-          let top = content.window;
+          let top = content;
           top.name = "top";
           top.location.href += "#top";
 
           let contexts = {
             top: top.location.href,
             first: base1 + "dummy_page.html#first",
             third: base2 + "dummy_page.html#third",
             second: base1 + "dummy_page.html#second",
             fourth: base2 + "dummy_page.html#fourth",
             fifth: base1 + "dummy_page.html#fifth",
             sixth: base1 + "onload_message.html#sixth",
           };
 
           function addFrame(target, name) {
-            let doc = (target.contentWindow || target).document;
-            let frame = doc.createElement("iframe");
-            let p = new Promise(
-              resolve => (frame.onload = () => resolve(frame))
+            return content.SpecialPowers.spawn(
+              target,
+              [name, contexts[name]],
+              async (name, context) => {
+                let doc = this.content.document;
+
+                let frame = doc.createElement("iframe");
+                doc.body.appendChild(frame);
+                frame.name = name;
+                frame.src = context;
+                await new Promise(resolve => {
+                  frame.addEventListener("load", resolve, { once: true });
+                });
+                return frame.browsingContext;
+              }
             );
-            doc.body.appendChild(frame);
-            frame.name = name;
-            frame.src = contexts[name];
-            return p;
           }
 
           function addWindow(target, name) {
-            var win = target.contentWindow.open(contexts[name], name);
+            return content.SpecialPowers.spawn(
+              target,
+              [name, contexts[name]],
+              (name, context) => {
+                let win = this.content.open(context, name);
+                let bc = win && win.docShell.browsingContext;
 
-            return new Promise(resolve =>
-              target.contentWindow.addEventListener("message", () =>
-                resolve(win)
-              )
+                return new Promise(resolve =>
+                  this.content.addEventListener("message", () => resolve(bc))
+                );
+              }
             );
           }
 
           // Generate all lists of length length with every combination of
           // values in input
           function* generate(input, length) {
             let list = new Array(length);
 
@@ -98,29 +110,32 @@ add_task(async function() {
           // context, five nested, one top level auxiliary with an
           // opener. Given that set of related browsing contexts we
           // wish to confirm that targeting is semantically equivalent
           // with how nsIDocShellTreeItem.findItemWithName works. The
           // trick to ensure that is to give all frames the same name!
           // and ensure that the find algorithms return the same nodes
           // in the same order.
 
-          function bc(frame) {
-            return (frame.contentWindow || frame).docShell.browsingContext;
-          }
-
           let first = await addFrame(top, "first");
           let second = await addFrame(top, "second");
           let third = await addFrame(first, "third");
           let fourth = await addFrame(first, "fourth");
           let fifth = await addFrame(fourth, "fifth");
           let sixth = await addWindow(fourth, "sixth");
 
-          let frames = [top, first, second, third, fourth, fifth, sixth];
-          let browsingContexts = frames.map(bc);
+          let browsingContexts = [
+            BrowsingContext.getFromWindow(top),
+            first,
+            second,
+            third,
+            fourth,
+            fifth,
+            sixth,
+          ];
           let docShells = browsingContexts.map(context => context.docShell);
 
           ok(
             top.docShell instanceof Ci.nsIDocShellTreeItem,
             "When we remove nsIDocShellTreeItem this test should be removed"
           );
 
           // For every browsing context we generate all possible
@@ -133,34 +148,40 @@ add_task(async function() {
 
             for (let i = 0; i < docShells.length; ++i) {
               let docShell = docShells[i].findItemWithName(
                 "target",
                 null,
                 null,
                 false
               );
-              let browsingContext = browsingContexts[i].findWithName("target");
+              let browsingContext = browsingContexts[i].findWithName(
+                "target",
+                browsingContexts[i]
+              );
               is(
                 docShell ? docShell.browsingContext : null,
                 browsingContext,
                 "findItemWithName should find same browsing context as findWithName"
               );
             }
           }
 
           for (let target of ["_self", "_top", "_parent", "_blank"]) {
             for (let i = 0; i < docShells.length; ++i) {
               let docShell = docShells[i].findItemWithName(
                 target,
                 null,
                 null,
                 false
               );
-              let browsingContext = browsingContexts[i].findWithName(target);
+              let browsingContext = browsingContexts[i].findWithName(
+                target,
+                browsingContexts[i]
+              );
               is(
                 docShell ? docShell.browsingContext : null,
                 browsingContext,
                 "findItemWithName should find same browsing context as findWithName for " +
                   target
               );
             }
           }

--- a/docshell/test/chrome/bug113934_window.xul
+++ b/docshell/test/chrome/bug113934_window.xul
@@ -43,20 +43,20 @@
     "data:text/html,<html><body onbeforeunload='document.documentElement.textContent = \"\"' onunload='document.documentElement.textContent = \"\"' onpagehide='document.documentElement.textContent = \"\"'>This is a test</body></html>";
     var doc2 = "data:text/html,<html><head></head><body>This is a second test</body></html>";
 
 
     $("f1").setAttribute("src", doc1);
     $("f2").setAttribute("src", doc2);
     $("f3").setAttribute("src", doc2);
 
-    function doTheTest() {
-      var s1 = snapshotWindow($("f1").contentWindow);
-      var s2 = snapshotWindow($("f2").contentWindow);
-      var s3 = snapshotWindow($("f3").contentWindow);
+    async function doTheTest() {
+      var s1 = await snapshotWindow($("f1").contentWindow);
+      var s2 = await snapshotWindow($("f2").contentWindow);
+      var s3 = await snapshotWindow($("f3").contentWindow);
 
       // This test is broken - see bug 1090274
       //ok(!compareSnapshots(s2, s3, true)[0],
       //   "Should look different due to different sizing");
 
       function getDOM(id) {
         return $(id).contentDocument.documentElement.innerHTML;
       }
@@ -81,17 +81,17 @@
       // first DOMLinkAdded event (which is a result of the actual addition)
       // is dispatched, the docshells are swapped and the pageshow and pagehide
       // events are tested. Only then, we wait for the DOMLink* events,
       // which are a result of swapping the docshells.
       var DOMLinkListener = {
         _afterFirst: false,
         _removedDispatched: false,
         _addedDispatched: false,
-        handleEvent: function(aEvent) {
+        handleEvent: async function(aEvent) {
           if (!this._afterFirst) {
             is(aEvent.type, "DOMLinkAdded");
 
             var strs = { "f1": "", "f3" : "" };
             function attachListener(node, type) {
               var listener = function(e) {
                 if (strs[node.id]) strs[node.id] += " ";
                 strs[node.id] += node.id + ".page" + type;
@@ -115,17 +115,17 @@
             l1.detach();
             l2.detach();
             l3.detach();
             l4.detach();
 
             // swapDocShells reflows asynchronously, ensure layout is
             // clean so that the viewport of f1 is the right size.
             $("f1").getBoundingClientRect();
-            var s1_new = snapshotWindow($("f1").contentWindow);
+            var s1_new = await snapshotWindow($("f1").contentWindow);
             var [same, first, second] = compareSnapshots(s1_new, s2, true);
             ok(same, "Should reflow on swap. Expected " + second + " but got " + first);
 
             is(strs["f1"], "f1.pagehide f1.pageshow");
             is(strs["f3"], "f3.pagehide f3.pageshow");
             this._afterFirst = true;
             return;
           }

--- a/docshell/test/chrome/bug293235_window.xul
+++ b/docshell/test/chrome/bug293235_window.xul
@@ -1,47 +1,36 @@
 <?xml version="1.0"?>
 <?xml-stylesheet href="chrome://global/skin" type="text/css"?>
 
 <window id="293235Test"
         xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
         width="600"
         height="600"
-        onload="setTimeout(nextTest, 0);"
+        onload="setTimeout(runTests, 0);"
         title="bug 293235 test">
 
   <script src="chrome://mochikit/content/tests/SimpleTest/ChromePowers.js"/>
   <script type="application/javascript" src= "chrome://mochikit/content/chrome-harness.js" />
   <script type="application/javascript" src="docshell_helpers.js" />
   <script src="chrome://mochikit/content/tests/SimpleTest/WindowSnapshot.js"></script>
 
   <script type="application/javascript"><![CDATA[
     var {NetUtil} = ChromeUtils.import("resource://gre/modules/NetUtil.jsm");
 
-    // Define the generator-iterator for the tests.
-    var tests = testIterator();
-
-    ////
-    // Execute the next test in the generator function.
-    //
-    function nextTest() {
-      tests.next();
-    }
-
     // Return the Element object for the specified element id
     function $(id) { return TestWindow.getDocument().getElementById(id); }
 
     ////
     // Generator function for test steps for bug 293235:
     // A visited link should have the :visited style applied
     // to it when displayed on a page which was fetched from
     // the bfcache.
     //
-    function* testIterator()
-    {
+    async function runTests() {
       // Register our observer to know when the link lookup is complete.
       let testURI = NetUtil.newURI(getHttpUrl("bug293235_p2.html"));
       let os = Cc["@mozilla.org/observer-service;1"].
                getService(Ci.nsIObserverService);
       const URI_VISITED_RESOLUTION_TOPIC = "visited-status-resolution";
       let observer = {
         notified: false,
         observe: function(aSubject, aTopic, aData)
@@ -58,94 +47,97 @@
       };
       os.addObserver(observer, URI_VISITED_RESOLUTION_TOPIC);
       function notified() {
         return observer.notified;
       }
 
       // Load a test page containing a link that should be initially
       // blue, per the :link style.
-      doPageNavigation({
-        uri: getHttpUrl("bug293235.html"),
-        onNavComplete: nextTest
+      await new Promise(resolve => {
+        doPageNavigation({
+          uri: getHttpUrl("bug293235.html"),
+          onNavComplete: resolve,
+        });
       });
-      yield undefined;
 
       // Before we go any further, make sure our link has been notified.
-      waitForTrue(notified, nextTest);
-      yield undefined;
+      await new Promise(resolve => {
+        waitForTrue(notified, resolve);
+      });
 
       // Now that we've been notified, we can check our link color.
       // Since we can't use getComputedStyle() for this because
       // getComputedStyle lies about styles that result from :visited,
       // we have to take snapshots.
       // First, take two reference snapshots.
       var link1 = $("link1");
       link1.className = "forcelink";
-      var refLink = snapshotWindow(TestWindow.getWindow());
+      var refLink = await snapshotWindow(TestWindow.getWindow());
       link1.className = "forcevisited";
-      var refVisited = snapshotWindow(TestWindow.getWindow());
+      var refVisited = await snapshotWindow(TestWindow.getWindow());
       link1.className = "";
       function snapshotsEqual(snap1, snap2) {
         return compareSnapshots(snap1, snap2, true)[0];
       }
       ok(!snapshotsEqual(refLink, refVisited), "references should not match");
-      ok(snapshotsEqual(refLink, snapshotWindow(TestWindow.getWindow())),
+      ok(snapshotsEqual(refLink, await snapshotWindow(TestWindow.getWindow())),
          "link should initially be blue");
 
       let observedVisit = false, observedPageShow = false;
-      function maybeRunNextTest() {
-        ok(true, "maybe run next test? visited: " + observedVisit + " pageShow: " + observedPageShow);
-        if (observedVisit && observedPageShow)
-          nextTest();
-      }
+      await new Promise(resolve => {
+        function maybeResolve() {
+          ok(true, "maybe run next test? visited: " + observedVisit + " pageShow: " + observedPageShow);
+          if (observedVisit && observedPageShow)
+            resolve();
+        }
 
-      // Because adding visits is async, we will not be notified imemdiately.
-      let visitObserver = {
-        observe: function(aSubject, aTopic, aData)
-        {
-          if (!testURI.equals(aSubject.QueryInterface(Ci.nsIURI))) {
-            return;
+        // Because adding visits is async, we will not be notified imemdiately.
+        let visitObserver = {
+          observe: function(aSubject, aTopic, aData)
+          {
+            if (!testURI.equals(aSubject.QueryInterface(Ci.nsIURI))) {
+              return;
+            }
+            os.removeObserver(this, aTopic);
+            observedVisit = true;
+            maybeResolve();
+          },
+        };
+        os.addObserver(visitObserver, "uri-visit-saved");
+        // Load the page that the link on the previous page points to.
+        doPageNavigation({
+          uri: getHttpUrl("bug293235_p2.html"),
+          onNavComplete: function() {
+            observedPageShow = true;
+            maybeResolve();
           }
-          os.removeObserver(this, aTopic);
-          observedVisit = true;
-          maybeRunNextTest();
-        },
-      };
-      os.addObserver(visitObserver, "uri-visit-saved");
-      // Load the page that the link on the previous page points to.
-      doPageNavigation({
-        uri: getHttpUrl("bug293235_p2.html"),
-        onNavComplete: function() {
-          observedPageShow = true;
-          maybeRunNextTest();
-        }
-      });
-      yield undefined;
+        });
+      })
 
       // And the nodes get notified after the "uri-visit-saved" topic, so
       // we need to execute soon...
-      SimpleTest.executeSoon(nextTest);
-      yield undefined;
+      await new Promise(SimpleTest.executeSoon);
 
       // Go back, verify the original page was loaded from the bfcache,
       // and verify that the link is now purple, per the
       // :visited style.
-      doPageNavigation({
-        back: true,
-        eventsToListenFor: ["pageshow"],
-        expectedEvents: [ { type: "pageshow",
-                            persisted: true,
-                            title: "Bug 293235 page1" } ],
-        onNavComplete: nextTest
-      });
-      yield undefined;
+      await new Promise(resolve => {
+        doPageNavigation({
+          back: true,
+          eventsToListenFor: ["pageshow"],
+          expectedEvents: [ { type: "pageshow",
+                              persisted: true,
+                              title: "Bug 293235 page1" } ],
+          onNavComplete: resolve,
+        });
+      })
 
       // Now we can test the link color.
-      ok(snapshotsEqual(refVisited, snapshotWindow(TestWindow.getWindow())),
+      ok(snapshotsEqual(refVisited, await snapshotWindow(TestWindow.getWindow())),
          "visited link should be purple");
 
       // Tell the framework the test is finished.
       finish();
     }
 
   ]]></script>
 

--- a/docshell/test/chrome/bug89419_window.xul
+++ b/docshell/test/chrome/bug89419_window.xul
@@ -1,77 +1,67 @@
 <?xml version="1.0"?>
 <?xml-stylesheet href="chrome://global/skin" type="text/css"?>
 
 <window id="89419Test"
         xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
         width="600"
         height="600"
-        onload="setTimeout(nextTest, 0);"
+        onload="setTimeout(runTests, 0);"
         title="bug 89419 test">
 
   <script type="application/javascript" src= "chrome://mochikit/content/chrome-harness.js" />
   <script src="chrome://mochikit/content/tests/SimpleTest/ChromePowers.js"/>
   <script type="application/javascript" src="docshell_helpers.js" />
   <script src="chrome://mochikit/content/tests/SimpleTest/WindowSnapshot.js"></script>
 
   <script type="application/javascript"><![CDATA[
-    // Define the generator-iterator for the tests.
-    var tests = testIterator();
-
     ////
-    // Execute the next test in the generator function.
-    //
-    function nextTest() {
-      tests.next();
-    }
-
-    ////
-    // Generator function for test steps for bug 89419:
     // A visited link should have the :visited style applied
     // to it when displayed on a page which was fetched from
     // the bfcache.
     //
-    function* testIterator()
-    {
+    async function runTests() {
       // Disable rcwn to make cache behavior deterministic.
-      var SpecialPowers = window.opener.wrappedJSObject.SpecialPowers;
-      SpecialPowers.pushPrefEnv({"set":[["network.http.rcwn.enabled", false]]}, nextTest);
-      yield undefined;
+      var {SpecialPowers} = opener;
+      await SpecialPowers.pushPrefEnv({"set":[["network.http.rcwn.enabled", false]]});
 
       // Load a test page containing an image referring to the sjs that returns
       // a different redirect every time it's loaded.
-      doPageNavigation({
-        uri: getHttpUrl("89419.html"),
-        onNavComplete: nextTest,
-        preventBFCache: true
-      });
-      yield undefined;
+      await new Promise(resolve => {
+        doPageNavigation({
+          uri: getHttpUrl("89419.html"),
+          onNavComplete: resolve,
+          preventBFCache: true,
+        });
+      })
 
-      var first = snapshotWindow(TestWindow.getWindow());
+      var first = await snapshotWindow(TestWindow.getWindow());
 
-      doPageNavigation({
-        uri: "about:blank",
-        onNavComplete: nextTest
+      await new Promise(resolve => {
+        doPageNavigation({
+          uri: "about:blank",
+          onNavComplete: resolve,
+        });
       });
-      yield undefined;
 
-      var second = snapshotWindow(TestWindow.getWindow());
+      var second = await snapshotWindow(TestWindow.getWindow());
       function snapshotsEqual(snap1, snap2) {
         return compareSnapshots(snap1, snap2, true)[0];
       }
       ok(!snapshotsEqual(first, second), "about:blank should not be the same as the image web page");
 
-      doPageNavigation({
-        back: true,
-        onNavComplete: nextTest
+      await new Promise(resolve => {
+        doPageNavigation({
+          back: true,
+          onNavComplete: resolve,
+        });
       });
-      yield undefined;
 
-      var third = snapshotWindow(TestWindow.getWindow());
+      var third = await snapshotWindow(TestWindow.getWindow());
       ok(!snapshotsEqual(third, second), "going back should not be the same as about:blank");
       ok(snapshotsEqual(first, third), "going back should be the same as the initial load");
 
       // Tell the framework the test is finished.
       finish();
     }
 
   ]]></script>

--- a/docshell/test/mochitest/mochitest.ini
+++ b/docshell/test/mochitest/mochitest.ini
@@ -69,19 +69,19 @@ support-files =
 skip-if = true
 # Disabled for too many intermittent failures (bug 719186)
 [test_bug475636.html]
 [test_bug509055.html]
 [test_bug511449.html]
 skip-if = toolkit != "cocoa" || headless # Headless: bug 1410525
 support-files = file_bug511449.html
 [test_bug529119-1.html]
-fail-if = fission
+skip-if = fission # Times out in weird ways.
 [test_bug529119-2.html]
-fail-if = fission
+skip-if = fission # Times out in weird ways.
 [test_bug530396.html]
 support-files = bug530396-noref.sjs bug530396-subframe.html
 [test_bug540462.html]
 skip-if = toolkit == 'android' && debug && !is_fennec
 [test_bug551225.html]
 [test_bug570341.html]
 skip-if = (verify && !debug && (os == 'win'))
 [test_bug580069.html]

--- a/docshell/test/mochitest/test_bug598895.html
+++ b/docshell/test/mochitest/test_bug598895.html
@@ -22,22 +22,22 @@ https://bugzilla.mozilla.org/show_bug.cg
 SimpleTest.waitForExplicitFinish();
 
 addLoadEvent(function() {
 var win1 = window.open();
 win1.document.body.textContent = "Should show";
 
 var windowsLoaded = 0;
 
-window.onmessage = function(ev) {
+window.onmessage = async function(ev) {
   is(ev.data, "loaded", "Message should be 'loaded'");
   if (++windowsLoaded == 2) {
-    var one = snapshotWindow(win1);
-    var two = snapshotWindow(win2);
-    var three = snapshotWindow(win3);
+    var one = await snapshotWindow(win1);
+    var two = await snapshotWindow(win2);
+    var three = await snapshotWindow(win3);
     win1.close();
     win2.close();
     win3.close();
     ok(compareSnapshots(one, two, true)[0], "Popups should look identical");
     ok(compareSnapshots(one, three, false)[0], "Popups should not look identical");
 
     SimpleTest.finish();
   }

--- a/docshell/test/mochitest/test_bug637644.html
+++ b/docshell/test/mochitest/test_bug637644.html
@@ -22,22 +22,22 @@ https://bugzilla.mozilla.org/show_bug.cg
 SimpleTest.waitForExplicitFinish();
 
 addLoadEvent(function() {
 var win1 = window.open("", "", "height=500,width=500");
 win1.document.body.textContent = "Should show";
 
 var windowsLoaded = 0;
 
-window.onmessage = function(ev) {
+window.onmessage = async function(ev) {
   is(ev.data, "loaded", "Message should be 'loaded'");
   if (++windowsLoaded == 2) {
-    var one = snapshotWindow(win1);
-    var two = snapshotWindow(win2);
-    var three = snapshotWindow(win3);
+    var one = await snapshotWindow(win1);
+    var two = await snapshotWindow(win2);
+    var three = await snapshotWindow(win3);
     win1.close();
     win2.close();
     win3.close();
     ok(compareSnapshots(one, two, true)[0], "Popups should look identical");
     ok(compareSnapshots(one, three, false)[0], "Popups should not look identical");
 
     SimpleTest.finish();
   }

--- a/docshell/test/navigation/mochitest.ini
+++ b/docshell/test/navigation/mochitest.ini
@@ -52,54 +52,54 @@ support-files =
   file_bug1364364-1.html
   file_bug1364364-2.html
   file_bug1375833.html
   file_bug1375833-frame1.html
   file_bug1375833-frame2.html
   test_bug145971.html
 
 [test_bug13871.html]
-fail-if = fission
-skip-if = fission && debug # Times out.
+skip-if = fission # Times out.
 [test_bug270414.html]
-fail-if = fission
+skip-if =
+  fission || # Times out.
+  fission && debug # Crashes in automation: @ mozilla::dom::ContentProcessManager::GetContentProcessById(mozilla::dom::IdType<mozilla::dom::ContentParent> const&)
 [test_bug278916.html]
 [test_bug279495.html]
 [test_bug344861.html]
 skip-if = toolkit == "android" || toolkit == "windows" # disabled on Windows because of bug 1234520
 [test_bug386782.html]
 [test_bug430624.html]
 [test_bug430723.html]
 skip-if = (toolkit == 'android') || (!debug && (os == 'mac' || os == 'win')) # Bug 874423
 [test_bug1364364.html]
 [test_bug1375833.html]
 [test_child.html]
-fail-if = fission
+skip-if = fission # Times out.
 [test_grandchild.html]
-fail-if = fission
 skip-if = fission && (debug || asan) # Causes shutdown leaks under Fission.
+fail-if = fission
 [test_not-opener.html]
-fail-if = fission
-skip-if = fission && debug # Times out
+skip-if = fission # Times out.
 [test_opener.html]
-skip-if = fission && debug # Times out
+skip-if = fission # Times out.
 [test_popup-navigates-children.html]
-fail-if = fission
+skip-if = fission # Times out.
 [test_reserved.html]
-skip-if = 
+skip-if =
   (toolkit == 'android') || (debug && e10s) || (os == 'mac' && os_version == '10.14') || #too slow on Android 4.3 aws only; bug 1030403; bug 1263213 for debug e10s, macosx1014 due to 1548821
-  (fission && !debug) #Bug 1570953
+  fission # Times out.
 [test_performance_navigation.html]
 [test_sessionhistory.html]
 skip-if =
   toolkit == 'android' || # RANDOM on android
   (fission && debug) # Intermittent timeouts
 support-files = file_bug1379762-1.html
 [test_sibling-matching-parent.html]
-fail-if = fission
+skip-if = fission # Times out.
 [test_sibling-off-domain.html]
 skip-if =
   fission || # Times out.
   fission && debug # Crashes: @ mozilla::dom::ContentParent::CommonCreateWindow(mozilla::dom::PBrowserParent*, bool, unsigned int const&, bool const&, bool const&, bool const&, nsIURI*, nsTString<char> const&, float const&, unsigned long, nsTString<char16_t> const&, nsresult&, nsCOMPtr<nsIRemoteTab>&, bool*, int&, nsIPrincipal*, nsIReferrerInfo*, bool, nsIContentSecurityPolicy*)
 [test_triggeringprincipal_frame_nav.html]
 [test_triggeringprincipal_window_open.html]
 [test_triggeringprincipal_parent_iframe_window_open.html]
 [test_triggeringprincipal_iframe_iframe_window_open.html]

--- a/dom/base/nsGlobalWindowOuter.cpp
+++ b/dom/base/nsGlobalWindowOuter.cpp
@@ -4034,17 +4034,17 @@ Nullable<WindowProxyHolder> nsGlobalWind
   BrowsingContext* bc = GetBrowsingContext();
   return bc ? bc->GetTop(IgnoreErrors()) : nullptr;
 }
 
 already_AddRefed<BrowsingContext> nsGlobalWindowOuter::GetChildWindow(
     const nsAString& aName) {
   NS_ENSURE_TRUE(mBrowsingContext, nullptr);
 
-  return do_AddRef(mBrowsingContext->FindChildWithName(aName));
+  return do_AddRef(mBrowsingContext->FindChildWithName(aName, *mBrowsingContext));
 }
 
 bool nsGlobalWindowOuter::DispatchCustomEvent(const nsAString& aEventName) {
   bool defaultActionEnabled = true;
   nsContentUtils::DispatchTrustedEvent(mDoc, ToSupports(this), aEventName,
                                        CanBubble::eYes, Cancelable::eYes,
                                        &defaultActionEnabled);
 
@@ -6327,16 +6327,18 @@ void nsGlobalWindowOuter::ForceClose() {
 
   FinalClose();
 }
 
 void nsGlobalWindowOuter::FinalClose() {
   // Flag that we were closed.
   mIsClosed = true;
 
+  GetBrowsingContext()->SetClosed(true);
+
   // If we get here from CloseOuter then it means that the parent process is
   // going to close our window for us. It's just important to set mIsClosed.
   if (XRE_GetProcessType() == GeckoProcessType_Content) {
     return;
   }
 
   // This stuff is non-sensical but incredibly fragile. The reasons for the
   // behavior here don't make sense today and may not have ever made sense,

--- a/dom/base/test/file_bug326337_inner.html
+++ b/dom/base/test/file_bug326337_inner.html
@@ -16,25 +16,29 @@ runTest();
 var xhr;
 
 function runTest() {
   xhr = new XMLHttpRequest();
   xhr.open("GET", "file_bug326337.xml", true);
   xhr.onreadystatechange = function() {
     if (xhr.readyState == 4) {
       check(xhr.responseXML.documentElement.getAttribute("root"));
-      SpecialPowers.wrap(parent).location.hash = "#done";
+      SpecialPowers.spawn(parent, [], () => {
+        content.location.hash = "#done";
+      });
     }
   }
   xhr.send(null);
 }
 
 function check(attr) {
   if (attr != "yes") {
-    SpeciaPowers.wrap(parent).location.hash = "#fail";
+    SpecialPowers.spawn(parent, [], () => {
+      content.location.hash = "#fail";
+    });
     throw 1;
   }
 }
 
 </script>
 </pre>
 </body>
 </html>

--- a/dom/base/test/mochitest.ini
+++ b/dom/base/test/mochitest.ini
@@ -305,23 +305,21 @@ skip-if = toolkit == 'android' || headle
 [test_bug282547.html]
 [test_bug298064.html]
 [test_bug300992.html]
 [test_bug311681.xml]
 [test_bug313646.html]
 [test_bug320799.html]
 [test_bug322317.html]
 [test_bug326337.html]
-fail-if = fission
 skip-if = fission && debug # Crashes: @ std::_Function_handler<void (mozilla::Tuple<nsresult, mozilla::dom::PBrowserBridgeParent*>&&), mozilla::dom::WindowGlobalParent::ChangeFrameRemoteness(mozilla::dom::BrowsingContext*, nsTSubstring<char16_t> const&, unsigned long, mozilla::ErrorResult&)::$_2>::_M_invoke(std::_Any_data const&, mozilla::Tuple<nsresult, mozilla::dom::PBrowserBridgeParent*>&&)
 [test_bug330925.xhtml]
 [test_bug331959.html]
-skip-if = fission
 [test_bug333064.html]
-skip-if = fission || toolkit == 'android' || headless # Headless: Bug 1405868
+skip-if = toolkit == 'android' || headless # Headless: Bug 1405868
 [test_bug333198.html]
 [test_bug333673.html]
 [test_bug337631.html]
 [test_bug338541.xhtml]
 [test_bug338583.html]
 skip-if = toolkit == 'android'
 [test_bug338679.html]
 [test_bug339494.html]
@@ -486,17 +484,16 @@ skip-if = (os == "android") # Failure wi
 [test_bug574596.html]
 skip-if = toolkit == 'android'
 [test_bug578096.html]
 skip-if = (verify && (os == 'win'))
 [test_bug585978.html]
 [test_bug587931.html]
 [test_bug588990.html]
 [test_bug590812.html]
-fail-if = fission
 skip-if = toolkit == 'android' || (verify && !debug && (os == 'linux')) #bug 687032
 [test_bug590870.html]
 skip-if = fission # Crashes: @ mozilla::dom::ContentParent::RecvDetachBrowsingContext(unsigned long, std::function<void (bool const&)>&&)
 [test_bug592366.html]
 [test_bug592829.html]
 [test_bug597345.html]
 [test_bug599295.html]
 [test_bug599588.html]
@@ -588,17 +585,17 @@ skip-if = fission # Crashes: @ mozilla::
 [test_bug902847.html]
 [test_bug907892.html]
 fail-if = fission
 [test_bug913761.html]
 [test_bug922681.html]
 [test_bug927196.html]
 [test_bug962251.html]
 [test_bug976673.html]
-fail-if = fission
+skip-if = fission # Times out in weird ways.
 [test_bug982153.html]
 [test_bug999456.html]
 [test_bug1022229.html]
 [test_bug1025933.html]
 [test_bug1037687.html]
 support-files = test_bug1037687_subframe.html
 [test_bug1043106.html]
 [test_bug1057176.html]
@@ -831,17 +828,16 @@ support-files =
 [test_setInterval_from_start.html]
 [test_setInterval_uncatchable_exception.html]
 skip-if = debug == false
 [test_settimeout_extra_arguments.html]
 [test_settimeout_inner.html]
 [test_setTimeoutWith0.html]
 [test_setting_opener.html]
 [test_shared_compartment1.html]
-fail-if = fission
 [test_shared_compartment2.html]
 fail-if = fission
 [test_structuredclone_backref.html]
 [test_style_cssText.html]
 [test_text_wholeText.html]
 [test_textnode_normalize_in_selection.html]
 [test_textnode_split_in_selection.html]
 [test_timeout_clamp.html]
@@ -877,12 +873,12 @@ fail-if = fission
 [test_window_extensible.html]
 [test_window_indexing.html]
 [test_window_keys.html]
 [test_window_named_frame_enumeration.html]
 [test_window_own_props.html]
 [test_window_proto.html]
 [test_writable-replaceable.html]
 [test_x-frame-options.html]
-fail-if = fission
+fail-if = fission # Cross-origin X-Frame-Options
 skip-if = toolkit == 'android' && debug && !is_fennec
 [test_youtube_flash_embed.html]
 # Please keep alphabetical order.

--- a/dom/base/test/test_bug1101364.html
+++ b/dom/base/test/test_bug1101364.html
@@ -21,46 +21,46 @@ https://bugzilla.mozilla.org/show_bug.cg
 </head>
 <body id='body'>
 
 <iframe id="test1" srcdoc="<h1 id='test1' style='-moz-user-select:none'>Header</h1><div id='testDiv'>test1</div>"></iframe>
 <iframe id="test2" srcdoc="<div contenteditable id='test2'>AAA<span id='test2Inner'>BBB</span></div>"></iframe>
 <pre id="test">
 <script class="testbody" type="text/javascript">
 
-function test()
+async function test()
 {
   var iframe1 = document.getElementById('test1');
   iframe1.focus();
   var docShell = SpecialPowers.wrap(iframe1.contentWindow).docShell;
 
   // test1
   docShell.doCommand("cmd_selectAll");
-  var withoutContenteditable = snapshotWindow(iframe1.contentWindow);
+  var withoutContenteditable = await snapshotWindow(iframe1.contentWindow);
 
   iframe1.contentDocument.getElementById('testDiv').setAttribute('contentEditable', true);
   docShell.doCommand("cmd_selectAll");
-  var withContenteditable = snapshotWindow(iframe1.contentWindow);
+  var withContenteditable = await snapshotWindow(iframe1.contentWindow);
   dump(withoutContenteditable.toDataURL());
   dump(withContenteditable.toDataURL());
 
   ok(compareSnapshots(withoutContenteditable, withContenteditable, true)[0], 'Select all should look identical');
 
   // test2
   var iframe2 = document.getElementById('test2');
   iframe2.focus();
   var docShell = SpecialPowers.wrap(iframe2.contentWindow).docShell;
   var test2Inner = iframe2.contentDocument.getElementById('test2Inner');
   test2Inner.style.MozUserSelect = 'text';
   docShell.doCommand("cmd_selectAll");
-  var withoutUserSelect = snapshotWindow(iframe2.contentWindow);
+  var withoutUserSelect = await snapshotWindow(iframe2.contentWindow);
 
   test2Inner.style.MozUserSelect = 'none';
   docShell.doCommand("cmd_selectAll");
-  var withUserSelect = snapshotWindow(iframe2.contentWindow);
+  var withUserSelect = await snapshotWindow(iframe2.contentWindow);
   ok(compareSnapshots(withoutUserSelect, withUserSelect, true)[0], 'Editable fields should ignore user select style');
 
   SimpleTest.finish();
 }
 window.onload = function() { setTimeout(test, 0); };
 SimpleTest.waitForExplicitFinish();
 </script>
 </pre>

--- a/dom/base/test/test_bug590812.html
+++ b/dom/base/test/test_bug590812.html
@@ -12,20 +12,28 @@
 <iframe src="http://noxul.example.com/tests/dom/base/test/file_bug590812.xml"></iframe>
 <iframe src="file_bug590812.xml"></iframe>
 <iframe src="file_bug590812-ref.xhtml"></iframe>
 <pre id="test">
 <script class="testbody" type="application/javascript">
 
 SimpleTest.waitForExplicitFinish();
 
-function runTest() {
-  sNoXUL = snapshotWindow(window.frames[0], false);
-  sWithXUL = snapshotWindow(window.frames[1], false);
-  sRef = snapshotWindow(window.frames[2], false);
+async function runTest() {
+  // FIXME(Fission): The load event fires before cross-origin iframes have
+  // loaded (bug 1559841).
+  if (SpecialPowers.useRemoteSubframes) {
+    for (let i = 0; i < 100; i++) {
+      await new Promise(resolve => setTimeout(resolve, 0));
+    }
+  }
+
+  let sNoXUL = await snapshotWindow(window.frames[0], false);
+  let sWithXUL = await snapshotWindow(window.frames[1], false);
+  let sRef = await snapshotWindow(window.frames[2], false);
   let res;
   ok(compareSnapshots(sNoXUL, sRef, true)[0],
      "noxul domain same as ref");
   ok(compareSnapshots(sWithXUL, sRef, true)[0],
      "xul supporting domain same as ref");
 
   SimpleTest.finish();
 }

--- a/dom/base/test/test_bug682592.html
+++ b/dom/base/test/test_bug682592.html
@@ -45,21 +45,21 @@ if (navigator.platform.startsWith("Linux
 }
 
 var page = `<!DOCTYPE html>
 <html><meta charset='UTF-8'><body><p id="content"></p></body></html>`;
 var refFrame = document.getElementById("iframe-ref")
 var testFrame = document.getElementById("iframe-test");
 
 refFrame.addEventListener("load", function() {
-  testFrame.addEventListener("load", function() {
+  testFrame.addEventListener("load", async function() {
     let {done} = tests.next();
     if (!done) {
-      ok(compareSnapshots(snapshotWindow(testFrame.contentWindow), 
-                          snapshotWindow(refFrame.contentWindow), true)[0], 
+      ok(compareSnapshots(await snapshotWindow(testFrame.contentWindow), 
+                          await snapshotWindow(refFrame.contentWindow), true)[0], 
          "bidi is not detected correctly");
 
       testFrame.contentWindow.location.reload();
     } else {
       SimpleTest.finish();
     }
   });
   testFrame.srcdoc = page;

--- a/dom/base/test/test_x-frame-options.html
+++ b/dom/base/test/test_x-frame-options.html
@@ -12,102 +12,138 @@
 </div>
 
 <iframe style="width:100%;height:300px;" id="harness"></iframe>
 <script class="testbody" type="text/javascript">
 
 var path = "/tests/dom/base/test/";
 var isUnique = SpecialPowers.getBoolPref("security.data_uri.unique_opaque_origin");
 
-var testFramesLoaded = function() {
-  var harness = SpecialPowers.wrap(document).getElementById("harness");
+var testFramesLoaded = async function() {
+  var harness = document.getElementById("harness").contentDocument;
+
+  // FIXME(Fission): The load event fires before cross-origin iframes have
+  // loaded (bug 1559841).
+  if (SpecialPowers.useRemoteSubframes) {
+    for (let i = 0; i < 100; i++) {
+      await new Promise(resolve => setTimeout(resolve, 0));
+    }
+  }
 
   // iframe from same origin, no X-F-O header - should load
-  var frame = harness.contentDocument.getElementById("control1");
-  var test1 = frame.contentDocument.getElementById("test").textContent;
-  is(test1, "control1", "test control1");
+  var frame = harness.getElementById("control1");
+  await SpecialPowers.spawn(frame, [], () => {
+    var test1 = this.content.document.getElementById("test").textContent;
+    Assert.equal(test1, "control1", "test control1");
+  });
 
   // iframe from different origin, no X-F-O header - should load
-  frame = harness.contentDocument.getElementById("control2");
-  var test2 = frame.contentDocument.getElementById("test").textContent;
-  is(test2, "control2", "test control2");
+  frame = harness.getElementById("control2");
+  await SpecialPowers.spawn(frame, [], () => {
+    var test2 = this.content.document.getElementById("test").textContent;
+    Assert.equal(test2, "control2", "test control2");
+  });
 
   // iframe from same origin, X-F-O: DENY - should not load
-  frame = harness.contentDocument.getElementById("deny");
-  var test3 = frame.contentDocument.getElementById("test");
-  is(test3, null, "test deny");
+  frame = harness.getElementById("deny");
+  await SpecialPowers.spawn(frame, [], () => {
+    var test3 = this.content.document.getElementById("test");
+    Assert.equal(test3, null, "test deny");
+  });
 
   // iframe from same origin, X-F-O: SAMEORIGIN - should load
-  frame = harness.contentDocument.getElementById("sameorigin1");
-  var test4 = frame.contentDocument.getElementById("test").textContent;
-  is(test4, "sameorigin1", "test sameorigin1");
+  frame = harness.getElementById("sameorigin1");
+  await SpecialPowers.spawn(frame, [], () => {
+    var test4 = this.content.document.getElementById("test").textContent;
+    Assert.equal(test4, "sameorigin1", "test sameorigin1");
+  });
 
   // iframe from different origin, X-F-O: SAMEORIGIN - should not load
-  frame = harness.contentDocument.getElementById("sameorigin2");
-  var test5 = frame.contentDocument.getElementById("test");
-  is(test5, null, "test sameorigin2");
+  frame = harness.getElementById("sameorigin2");
+  await SpecialPowers.spawn(frame, [], () => {
+    var test5 = this.content.document.getElementById("test");
+    Assert.equal(test5, null, "test sameorigin2");
+  });
 
   // iframe from different origin, X-F-O: SAMEORIGIN, SAMEORIGIN - should not load
-  frame = harness.contentDocument.getElementById("sameorigin5");
-  var test6 = frame.contentDocument.getElementById("test");
-  is(test6, null, "test sameorigin5");
+  frame = harness.getElementById("sameorigin5");
+  await SpecialPowers.spawn(frame, [], () => {
+    var test6 = this.content.document.getElementById("test");
+    Assert.equal(test6, null, "test sameorigin5");
+  });
 
   // iframe from same origin, X-F-O: SAMEORIGIN, SAMEORIGIN - should load
-  frame = harness.contentDocument.getElementById("sameorigin6");
-  var test7 = frame.contentDocument.getElementById("test").textContent;
-  is(test7, "sameorigin6", "test sameorigin6");
+  frame = harness.getElementById("sameorigin6");
+  await SpecialPowers.spawn(frame, [], () => {
+    var test7 = this.content.document.getElementById("test").textContent;
+    Assert.equal(test7, "sameorigin6", "test sameorigin6");
+  });
 
   // iframe from same origin, X-F-O: SAMEORIGIN,SAMEORIGIN, SAMEORIGIN - should load
-  frame = harness.contentDocument.getElementById("sameorigin7");
-  var test8 = frame.contentDocument.getElementById("test").textContent;
-  is(test8, "sameorigin7", "test sameorigin7");
+  frame = harness.getElementById("sameorigin7");
+  await SpecialPowers.spawn(frame, [], () => {
+    var test8 = this.content.document.getElementById("test").textContent;
+    Assert.equal(test8, "sameorigin7", "test sameorigin7");
+  });
 
   // iframe from same origin, X-F-O: SAMEORIGIN,SAMEORIGIN, SAMEORIGIN - should not load
-  frame = harness.contentDocument.getElementById("sameorigin8");
-  var test9 = frame.contentDocument.getElementById("test");
-  is(test9, null, "test sameorigin8");
+  frame = harness.getElementById("sameorigin8");
+  await SpecialPowers.spawn(frame, [], () => {
+    var test9 = this.content.document.getElementById("test");
+    Assert.equal(test9, null, "test sameorigin8");
+  });
 
   // iframe from same origin, X-F-O: DENY,SAMEORIGIN - should not load
-  frame = harness.contentDocument.getElementById("mixedpolicy");
-  var test10 = frame.contentDocument.getElementById("test");
-  is(test10, null, "test mixedpolicy");
+  frame = harness.getElementById("mixedpolicy");
+  await SpecialPowers.spawn(frame, [], () => {
+    var test10 = this.content.document.getElementById("test");
+    Assert.equal(test10, null, "test mixedpolicy");
+  });
 
   // iframe from different origin, allow-from: this origin - should load
-  frame = harness.contentDocument.getElementById("allow-from-allow");
-  var test11 = frame.contentDocument.getElementById("test").textContent;
-  is(test11, "allow-from-allow", "test allow-from-allow");
+  frame = harness.getElementById("allow-from-allow");
+  await SpecialPowers.spawn(frame, [], () => {
+    var test11 = this.content.document.getElementById("test").textContent;
+    Assert.equal(test11, "allow-from-allow", "test allow-from-allow");
+  });
 
   // iframe from different origin, with allow-from: other - should load as we no longer support allow-from (Bug 1301529)
-  frame = harness.contentDocument.getElementById("allow-from-deny");
-  var test12 = frame.contentDocument.getElementById("test");
-  isnot(test12, null, "test allow-from-deny");
+  frame = harness.getElementById("allow-from-deny");
+  await SpecialPowers.spawn(frame, [], () => {
+    var test12 = this.content.document.getElementById("test");
+    Assert.notEqual(test12, null, "test allow-from-deny");
+  });
 
   // iframe from different origin, X-F-O: SAMEORIGIN, multipart - should not load
-  frame = harness.contentDocument.getElementById("sameorigin-multipart");
-  var test13 = frame.contentDocument.getElementById("test");
-  is(test13, null, "test sameorigin-multipart");
+  frame = harness.getElementById("sameorigin-multipart");
+  await SpecialPowers.spawn(frame, [], () => {
+    var test13 = this.content.document.getElementById("test");
+    Assert.equal(test13, null, "test sameorigin-multipart");
+  });
 
   // iframe from same origin, X-F-O: SAMEORIGIN, multipart - should load
-  frame = harness.contentDocument.getElementById("sameorigin-multipart2");
-  var test14 = frame.contentDocument.getElementById("test").textContent;
-  is(test14, "sameorigin-multipart2", "test sameorigin-multipart2");
+  frame = harness.getElementById("sameorigin-multipart2");
+  await SpecialPowers.spawn(frame, [], () => {
+    var test14 = this.content.document.getElementById("test").textContent;
+    Assert.equal(test14, "sameorigin-multipart2", "test sameorigin-multipart2");
+  });
 
 
   // frames from bug 836132 tests, no longer supported allow-from
   {
-    frame = harness.contentDocument.getElementById("allow-from-allow-1");
+    frame = harness.getElementById("allow-from-allow-1");
     var theTestResult = frame.contentDocument.getElementById("test");
     isnot(theTestResult, null, "test afa1 should have been allowed");
     if(theTestResult) {
       is(theTestResult.textContent, "allow-from-allow-1", "test allow-from-allow-1");
     }
   }
   // Verify allow-from no longer works
   for (var i = 1; i<=14; i++) {
-    frame = harness.contentDocument.getElementById("allow-from-deny-" + i);
+    frame = harness.getElementById("allow-from-deny-" + i);
     var theTestResult = frame.contentDocument.getElementById("test");
     isnot(theTestResult, null, "test allow-from-deny-" + i);
   }
 
   // call tests to check principal comparison, e.g. a document can open a window
   // to a data: or javascript: document which frames an
   // X-Frame-Options: SAMEORIGIN document and the frame should load
   testFrameInJSURI();

--- a/dom/browser-element/mochitest/browserElement_XFrameOptionsDeny.js
+++ b/dom/browser-element/mochitest/browserElement_XFrameOptionsDeny.js
@@ -34,25 +34,25 @@ function runTest() {
   iframe.setAttribute("mozbrowser", "true");
 
   // Our child will create two iframes, so make sure this iframe is big enough
   // to show both of them without scrolling, so taking a screenshot gets both
   // frames.
   iframe.height = "1000px";
 
   var step1, stepfinish;
-  iframe.addEventListener("mozbrowsershowmodalprompt", function(e) {
+  iframe.addEventListener("mozbrowsershowmodalprompt", async function(e) {
     switch (e.detail.message) {
       case "step 1":
-        step1 = SpecialPowers.snapshotWindow(iframe.contentWindow);
+        step1 = await SpecialPowers.snapshotWindow(iframe.contentWindow);
         break;
       case "step 2":
         // The page has now attempted to load the X-Frame-Options page; take
         // another screenshot.
-        stepfinish = SpecialPowers.snapshotWindow(iframe.contentWindow);
+        stepfinish = await SpecialPowers.snapshotWindow(iframe.contentWindow);
         ok(
           step1.toDataURL() == stepfinish.toDataURL(),
           "Screenshots should be identical"
         );
         SimpleTest.finish();
         break;
     }
   });

--- a/dom/canvas/test/test_bitmaprenderer.html
+++ b/dom/canvas/test/test_bitmaprenderer.html
@@ -47,33 +47,33 @@ function runTest(canvasWidth, canvasHeig
   var ctx = canvasRef.getContext("2d");
   // Clear with black transparent first
   ctx.fillStyle = "rgba(0, 0, 0, 0)";
   ctx.fillRect(0, 0, 90, 90);
 
   ctx.fillStyle = "#00FF00";
   ctx.fillRect(0, 0, canvasWidth, canvasHeight);
 
-  createImageBitmap(canvas1).then(function(bmp) {
+  createImageBitmap(canvas1).then(async function(bmp) {
     document.body.removeChild(canvas1);
 
     var canvas2 = createCanvas(90, 90);
     var ctx2 = canvas2.getContext("bitmaprenderer");
     ctx2.transferFromImageBitmap(bmp);
 
     ok(canvasRef.toDataURL() == canvas2.toDataURL(), "toDataURL should return same result.");
 
     // Exam render result
     canvasRef.style.display = "none";
     canvas2.style.display = "block";
-    var snapshot = snapshotWindow(window);
+    var snapshot = await snapshotWindow(window);
 
     canvasRef.style.display = "block";
     canvas2.style.display = "none";
-    var snapshotRef = snapshotWindow(window);
+    var snapshotRef = await snapshotWindow(window);
 
     // bitmaprenderers use an ImageLayer whereas a normal 2d canvas uses a canvas layer. This
     // can result in some anti-aliasing differences on the edge. We consider slight AA differences
     // to be reasonable when using different codepaths so fuzz a little bit.
     var fuzz = { numDifferentPixels:  0,
                  maxDifference: 0 };
     if (SpecialPowers.Services.appinfo.widgetToolkit == "android") {
       fuzz.maxDifference = 2;
@@ -97,40 +97,40 @@ function scaleTest() {
 
   var canvas2 = createCanvas(64, 64);
   var ctx2 = canvas2.getContext("2d");
   ctx2.fillStyle = "#00FF00";
   ctx2.fillRect(0, 0, 64, 64);
 
   var p1 = createImageBitmap(canvas1);
   var p2 = createImageBitmap(canvas2);
-  Promise.all([p1, p2]).then(function(bitmaps) {
+  Promise.all([p1, p2]).then(async function(bitmaps) {
     document.body.removeChild(canvas1);
     document.body.removeChild(canvas2);
 
     // Create a large canvas then shrink.
     var canvas3 = createCanvas(128, 128);
     var ctx3 = canvas3.getContext("bitmaprenderer");
     ctx3.transferFromImageBitmap(bitmaps[0]);
-    var snapshotLargeRef = snapshotWindow(window);
+    var snapshotLargeRef = await snapshotWindow(window);
 
     canvas3.width = 32;
     canvas3.height = 32;
-    var snapshotSmall = snapshotWindow(window);
+    var snapshotSmall = await snapshotWindow(window);
     document.body.removeChild(canvas3);
 
     // Create a small canvas then grow.
     var canvas4 = createCanvas(32, 32);
     var ctx4 = canvas4.getContext("bitmaprenderer");
     ctx4.transferFromImageBitmap(bitmaps[1]);
-    var snapshotSmallRef = snapshotWindow(window);
+    var snapshotSmallRef = await snapshotWindow(window);
 
     canvas4.width = 128;
     canvas4.height = 128;
-    var snapshotLarge = snapshotWindow(window);
+    var snapshotLarge = await snapshotWindow(window);
     document.body.removeChild(canvas4);
 
     var resultsLarge = compareSnapshots(snapshotLarge, snapshotLargeRef, true);
     ok(resultsLarge[0], "Screenshots should be the same");
 
     var resultsSmall = compareSnapshots(snapshotSmall, snapshotSmallRef, true);
     ok(resultsSmall[0], "Screenshots should be the same");
     runTestOnWorker();

--- a/dom/canvas/test/test_offscreencanvas_dynamic_fallback.html
+++ b/dom/canvas/test/test_offscreencanvas_dynamic_fallback.html
@@ -18,47 +18,47 @@ function createCanvas(initWithMask) {
   document.body.appendChild(canvas);
   if (initWithMask) {
     canvas.style.mask = "url('offscreencanvas_mask.svg#fade_mask_both')";
   }
 
   return canvas;
 }
 
-function getRefSnapshot(initWithMask) {
+async function getRefSnapshot(initWithMask) {
   var refCanvas = createCanvas(!initWithMask);
   var ctx = refCanvas.getContext("2d");
   ctx.rect(0, 0, 64, 64);
   ctx.fillStyle = "#00FF00";
   ctx.fill();
-  var result = snapshotWindow(window);
+  var result = await snapshotWindow(window);
   document.body.removeChild(refCanvas);
   return result;
 }
 
 function runTest(initWithMask) {
   var htmlCanvas = createCanvas(initWithMask);
   var worker = new Worker("offscreencanvas.js");
 
-  worker.onmessage = function(evt) {
+  worker.onmessage = async function(evt) {
     var msg = evt.data || {};
     if (msg.type == "draw") {
       if (msg.count === 10) {
         // Change the fallback state dynamically when drawing count reaches 10.
         if (initWithMask) {
           htmlCanvas.style.mask = "";
         } else {
           htmlCanvas.style.mask = "url('offscreencanvas_mask.svg#fade_mask_both')";
         }
       } else if (msg.count === 20) {
-        var snapshotFallback = snapshotWindow(window);
         worker.terminate();
+        var snapshotFallback = await snapshotWindow(window);
         document.body.removeChild(htmlCanvas);
 
-        var results = compareSnapshots(snapshotFallback, getRefSnapshot(initWithMask), true);
+        var results = compareSnapshots(snapshotFallback, await getRefSnapshot(initWithMask), true);
         ok(results[0], "after dynamic fallback, screenshots should be the same");
 
         if (initWithMask) {
           SimpleTest.finish();
         } else {
           runTest(true);
         }
       }

--- a/dom/chrome-webidl/BrowsingContext.webidl
+++ b/dom/chrome-webidl/BrowsingContext.webidl
@@ -6,18 +6,18 @@
 interface nsIDocShell;
 
 [Exposed=Window, ChromeOnly]
 interface BrowsingContext {
   static BrowsingContext? get(unsigned long long aId);
 
   static BrowsingContext? getFromWindow(WindowProxy window);
 
-  BrowsingContext? findChildWithName(DOMString name);
-  BrowsingContext? findWithName(DOMString name);
+  BrowsingContext? findChildWithName(DOMString name, BrowsingContext accessor);
+  BrowsingContext? findWithName(DOMString name, BrowsingContext accessor);
 
   readonly attribute DOMString name;
 
   readonly attribute BrowsingContext? parent;
 
   readonly attribute BrowsingContext top;
 
   sequence<BrowsingContext> getChildren();

--- a/dom/events/test/test_bug864040.html
+++ b/dom/events/test/test_bug864040.html
@@ -24,62 +24,62 @@ https://bugzilla.mozilla.org/show_bug.cg
     /**
     * Test for Bug 864040
     *
     * We use a selection event to set the selection to the end of an editor
     * containing an ending newline. Then we test to see that the caret is
     * actually drawn on the newline.
     */
 
-    function testSelectEndOfText(elem) {
+    async function testSelectEndOfText(elem) {
       var tn = elem.tagName;
       elem.focus();
 
       // Enter test string into editor
       var test_string = 'test\n';
       sendString(test_string);
 
       // Get the caret position after what we entered
       var result = synthesizeQuerySelectedText();
       ok(result, tn + ': failed to query selection (1)');
       var refoffset = result.offset;
 
       // Take a snapshot of where the caret is (on the new line)
-      referenceSnapshot = snapshotWindow(window, true /* withCaret */);
+      referenceSnapshot = await snapshotWindow(window, true /* withCaret */);
       ok(referenceSnapshot, tn + ': failed to take snapshot (1)');
 
       // Set selection to the same spot through a selection event
       ok(synthesizeSelectionSet(refoffset, 0, false), tn + ': failed to set selection');
 
       // Make sure new selection is the same
       result = synthesizeQuerySelectedText();
       ok(result, tn + ': failed to query selection (2)');
       is(result.offset, refoffset, tn + ': caret is not at the right position');
 
       // Take a snapshot of where the new caret is (shoud still be on the new line)
-      testSnapshot = snapshotWindow(window, true /* withCaret */);
+      testSnapshot = await snapshotWindow(window, true /* withCaret */);
       ok(testSnapshot, tn + ': failed to take snapshot (2)');
 
       // Compare snapshot (should be the same)
       result = compareSnapshots(referenceSnapshot, testSnapshot, true /* expected */)
       ok(result, tn + ': failed to compare snapshots');
       // result = [correct, s1data, s2data]
       ok(result[0], tn + ': caret is not on new line');
       if (!result[0]) {
         dump('Ref: ' + result[1] + '\n');
         dump('Res: ' + result[2] + '\n');
       }
     }
 
-    function runTests() {
+    async function runTests() {
       // we don't test regular <input> because this test is about multiline support
       // test textarea
-      testSelectEndOfText(document.getElementById('ta'));
+      await testSelectEndOfText(document.getElementById('ta'));
       // test contentEditable
-      testSelectEndOfText(document.getElementById('ce'));
+      await testSelectEndOfText(document.getElementById('ce'));
       SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
 
     SimpleTest.waitForFocus(runTests);
   </script>
 </pre>

--- a/dom/html/test/forms/test_input_textarea_set_value_no_scroll.html
+++ b/dom/html/test/forms/test_input_textarea_set_value_no_scroll.html
@@ -17,40 +17,40 @@ https://bugzilla.mozilla.org/show_bug.cg
    * This test checks that setting .value on an text field (input or textarea)
    * doesn't scroll the field to its beginning.
    */
 
   SimpleTest.waitForExplicitFinish();
 
   var gTestRunner = null;
 
-  function test(aElementName)
+  async function test(aElementName)
   {
     var element = document.getElementsByTagName(aElementName)[0];
     element.focus();
 
-    var baseSnapshot = snapshotWindow(window);
+    var baseSnapshot = await snapshotWindow(window);
 
     // This is a sanity check.
-    var s2 = snapshotWindow(window);
-    var results = compareSnapshots(baseSnapshot, snapshotWindow(window), true);
+    var s2 = await snapshotWindow(window);
+    var results = compareSnapshots(baseSnapshot, await snapshotWindow(window), true);
     ok(results[0], "sanity check: screenshots should be the same");
 
     element.selectionStart = element.selectionEnd = element.value.length;
 
     setTimeout(function() {
       sendString('f');
 
-      requestAnimationFrame(function() {
-        var selectionAtTheEndSnapshot = snapshotWindow(window);
+      requestAnimationFrame(async function() {
+        var selectionAtTheEndSnapshot = await snapshotWindow(window);
         results = compareSnapshots(baseSnapshot, selectionAtTheEndSnapshot, false);
         ok(results[0], "after appending a character, string should have changed");
 
         element.value = element.value;
-        var tmpSnapshot = snapshotWindow(window);
+        var tmpSnapshot = await snapshotWindow(window);
 
         results = compareSnapshots(baseSnapshot, tmpSnapshot, false);
         ok(results[0], "re-settig the value should change nothing");
 
         results = compareSnapshots(selectionAtTheEndSnapshot, tmpSnapshot, true);
         ok(results[0], "re-settig the value should change nothing");
 
         element.selectionStart = element.selectionEnd = 0;
@@ -58,36 +58,36 @@ https://bugzilla.mozilla.org/show_bug.cg
 
         gTestRunner.next();
       });
     }, 0);
   }
 
   // This test checks that when a textarea has a long list of values and the
   // textarea's value is then changed, the values are shown correctly.
-  function testCorrectUpdateOnScroll()
+  async function testCorrectUpdateOnScroll()
   {
     var textarea = document.createElement('textarea');
     textarea.rows = 5;
     textarea.cols = 10;
     textarea.value = 'a\nb\nc\nd';
     document.getElementById('content').appendChild(textarea);
 
-    var baseSnapshot = snapshotWindow(window);
+    var baseSnapshot = await snapshotWindow(window);
 
     textarea.value = '1\n2\n3\n4\n5\n6\n7\n8\n9\n10\n';
     textarea.selectionStart = textarea.selectionEnd = textarea.value.length;
 
-    var fullSnapshot = snapshotWindow(window);
+    var fullSnapshot = await snapshotWindow(window);
     var results = compareSnapshots(baseSnapshot, fullSnapshot, false);
     ok(results[0], "sanity check: screenshots should not be the same");
 
     textarea.value = 'a\nb\nc\nd';
 
-    var tmpSnapshot = snapshotWindow(window);
+    var tmpSnapshot = await snapshotWindow(window);
     results = compareSnapshots(baseSnapshot, tmpSnapshot, true);
     ok(results[0], "textarea view should look like the beginning");
 
     setTimeout(function() {
       gTestRunner.next();
     }, 0);
   }
 

--- a/dom/html/test/test_bug611189.html
+++ b/dom/html/test/test_bug611189.html
@@ -15,31 +15,31 @@ https://bugzilla.mozilla.org/show_bug.cg
 <p id="display"></p>
 <div id="content">
 </div>
 <pre id="test">
 <script type="application/javascript">
 
 /** Test for Bug 611189 **/
 SimpleTest.waitForExplicitFinish();
-addLoadEvent(function() {
+addLoadEvent(async function() {
   var i = document.createElement("input");
   var b = document.getElementById("content");
   b.appendChild(i);
   b.clientWidth; // bind to frame
   i.focus(); // initialize editor
-  var before = snapshotWindow(window, true);
+  var before = await snapshotWindow(window, true);
   i.value = "L"; // set the value
   i.style.display = "none";
   b.clientWidth; // unbind from frame
   i.value = ""; // set the value without a frame
   i.style.display = "";
   b.clientWidth; // rebind to frame
   is(i.value, "", "Input's value should be correctly updated");
-  var after = snapshotWindow(window, true);
+  var after = await snapshotWindow(window, true);
   ok(compareSnapshots(before, after, true), "The correct value should be rendered inside the control");
   SimpleTest.finish();
 });
 
 </script>
 </pre>
 </body>
 </html>

--- a/dom/ipc/DOMTypes.ipdlh
+++ b/dom/ipc/DOMTypes.ipdlh
@@ -1,15 +1,16 @@
 /* -*- Mode: C++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 8 -*- */
 /* vim: set sw=4 ts=8 et tw=80 ft=cpp : */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 include "mozilla/GfxMessageUtils.h";
+include "mozilla/dom/DocShellMessageUtils.h";
 include "mozilla/layers/LayersMessageUtils.h";
 
 include IPCBlob;
 include IPCStream;
 include ProtocolTypes;
 
 using struct mozilla::void_t
   from "ipc/IPCMessageUtils.h";

--- a/dom/ipc/PWindowGlobal.ipdl
+++ b/dom/ipc/PWindowGlobal.ipdl
@@ -1,24 +1,27 @@
 /* -*- Mode: C++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 8 -*- */
 /* vim: set sw=2 ts=8 et tw=80 ft=cpp : */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+include "mozilla/dom/DocShellMessageUtils.h";
+
 include protocol PBrowser;
 include protocol PInProcess;
 include protocol PBrowserBridge;
 
 include DOMTypes;
 
 using JSWindowActorMessageKind from "mozilla/dom/JSWindowActor.h";
 using mozilla::gfx::IntRect from "mozilla/gfx/Rect.h";
 using moveonly mozilla::gfx::PaintFragment from "mozilla/gfx/CrossProcessPaint.h";
 using nscolor from "nsColor.h";
+using refcounted class nsDocShellLoadState from "nsDocShellLoadState.h";
 
 namespace mozilla {
 namespace dom {
 
 struct JSWindowActorMessageMeta {
   nsString actorName;
   nsString messageName;
   uint64_t queryId;
@@ -45,20 +48,27 @@ child:
 
   async DrawSnapshot(IntRect? aRect, float aScale, nscolor aBackgroundColor, uint32_t aFlags) returns (PaintFragment retval);
 
   /**
    * Returns the serialized security info associated with this window.
    */
   async GetSecurityInfo() returns(nsCString? serializedSecInfo);
 
+  async LoadURIInChild(nsDocShellLoadState aLoadState);
+
 both:
   async RawMessage(JSWindowActorMessageMeta aMetadata, ClonedMessageData aData);
 
 parent:
+  // Load the given URI load state into the current owner process of the given
+  // BrowsingContext. aTargetBC must be in the same BrowsingContextGroup as this
+  // window global.
+  async LoadURI(BrowsingContext aTargetBC, nsDocShellLoadState aLoadState);
+
   /// Update the URI of the document in this WindowGlobal.
   async UpdateDocumentURI(nsIURI aUri);
 
   /// Send down initial document bit to the parent.
   async SetIsInitialDocument(bool aIsInitialDocument);
 
   /// Tell the parent if this WindowGlobal has any "beforeunload" event
   /// listeners.

--- a/dom/ipc/WindowGlobalChild.cpp
+++ b/dom/ipc/WindowGlobalChild.cpp
@@ -223,16 +223,22 @@ void WindowGlobalChild::Destroy() {
 
     for (auto& windowActor : windowActors) {
       windowActor->StartDestroy();
     }
     SendDestroy();
   }
 }
 
+mozilla::ipc::IPCResult WindowGlobalChild::RecvLoadURIInChild(
+    nsDocShellLoadState* aLoadState) {
+  mWindowGlobal->GetDocShell()->LoadURI(aLoadState);
+  return IPC_OK();
+}
+
 static nsresult ChangeFrameRemoteness(WindowGlobalChild* aWgc,
                                       BrowsingContext* aBc,
                                       const nsString& aRemoteType,
                                       uint64_t aPendingSwitchId,
                                       BrowserBridgeChild** aBridge) {
   MOZ_ASSERT(XRE_IsContentProcess(), "This doesn't make sense in the parent");
 
   // Get the target embedder's FrameLoaderOwner, and make sure we're in the

--- a/dom/ipc/WindowGlobalChild.h
+++ b/dom/ipc/WindowGlobalChild.h
@@ -109,16 +109,18 @@ class WindowGlobalChild final : public W
  protected:
   const nsAString& GetRemoteType() override;
   JSWindowActor::Type GetSide() override { return JSWindowActor::Type::Child; }
 
   // IPC messages
   mozilla::ipc::IPCResult RecvRawMessage(const JSWindowActorMessageMeta& aMeta,
                                          const ClonedMessageData& aData);
 
+  mozilla::ipc::IPCResult RecvLoadURIInChild(nsDocShellLoadState* aLoadState);
+
   mozilla::ipc::IPCResult RecvChangeFrameRemoteness(
       dom::BrowsingContext* aBc, const nsString& aRemoteType,
       uint64_t aPendingSwitchId, ChangeFrameRemotenessResolver&& aResolver);
 
   mozilla::ipc::IPCResult RecvDrawSnapshot(const Maybe<IntRect>& aRect,
                                            const float& aScale,
                                            const nscolor& aBackgroundColor,
                                            const uint32_t& aFlags,

--- a/dom/ipc/WindowGlobalParent.cpp
+++ b/dom/ipc/WindowGlobalParent.cpp
@@ -168,16 +168,48 @@ bool WindowGlobalParent::IsProcessRoot()
   auto* embedder = BrowsingContext()->GetEmbedderWindowGlobal();
   if (NS_WARN_IF(!embedder)) {
     return false;
   }
 
   return ContentParentId() != embedder->ContentParentId();
 }
 
+mozilla::ipc::IPCResult WindowGlobalParent::RecvLoadURI(
+    dom::BrowsingContext* aTargetBC,
+    nsDocShellLoadState* aLoadState) {
+  if (!aTargetBC || aTargetBC->IsDiscarded()) {
+    MOZ_LOG(
+        BrowsingContext::GetLog(), LogLevel::Debug,
+        ("ParentIPC: Trying to send a message with dead or detached context"));
+    return IPC_OK();
+  }
+
+  // FIXME: For cross-process loads, we should double check CanAccess() for the
+  // source browsing context in the parent process.
+
+  if (aTargetBC->Group() != BrowsingContext()->Group()) {
+    return IPC_FAIL(this, "Illegal cross-group BrowsingContext load");
+  }
+
+  // FIXME: We should really initiate the load in the parent before bouncing
+  // back down to the child.
+
+  WindowGlobalParent* wgp = aTargetBC->Canonical()->GetCurrentWindowGlobal();
+  if (!wgp) {
+    MOZ_LOG(
+        BrowsingContext::GetLog(), LogLevel::Debug,
+        ("ParentIPC: Target BrowsingContext has no WindowGlobalParent"));
+    return IPC_OK();
+  }
+
+  Unused << wgp->SendLoadURIInChild(aLoadState);
+  return IPC_OK();
+}
+
 IPCResult WindowGlobalParent::RecvUpdateDocumentURI(nsIURI* aURI) {
   // XXX(nika): Assert that the URI change was one which makes sense (either
   // about:blank -> a real URI, or a legal push/popstate URI change?)
   mDocumentURI = aURI;
   return IPC_OK();
 }
 
 IPCResult WindowGlobalParent::RecvSetHasBeforeUnload(bool aHasBeforeUnload) {

--- a/dom/ipc/WindowGlobalParent.h
+++ b/dom/ipc/WindowGlobalParent.h
@@ -134,16 +134,18 @@ class WindowGlobalParent final : public 
   JSObject* WrapObject(JSContext* aCx,
                        JS::Handle<JSObject*> aGivenProto) override;
 
  protected:
   const nsAString& GetRemoteType() override;
   JSWindowActor::Type GetSide() override { return JSWindowActor::Type::Parent; }
 
   // IPC messages
+  mozilla::ipc::IPCResult RecvLoadURI(dom::BrowsingContext* aTargetBC,
+                                      nsDocShellLoadState* aLoadState);
   mozilla::ipc::IPCResult RecvUpdateDocumentURI(nsIURI* aURI);
   mozilla::ipc::IPCResult RecvSetIsInitialDocument(bool aIsInitialDocument) {
     mIsInitialDocument = aIsInitialDocument;
     return IPC_OK();
   }
   mozilla::ipc::IPCResult RecvSetHasBeforeUnload(bool aHasBeforeUnload);
   mozilla::ipc::IPCResult RecvBecomeCurrentWindowGlobal();
   mozilla::ipc::IPCResult RecvDestroy();

--- a/dom/security/test/csp/mochitest.ini
+++ b/dom/security/test/csp/mochitest.ini
@@ -304,17 +304,16 @@ skip-if = toolkit == 'android'
 [test_child-src_worker_data.html]
 [test_child-src_worker-redirect.html]
 [test_child-src_iframe.html]
 [test_meta_element.html]
 [test_meta_header_dual.html]
 [test_docwrite_meta.html]
 [test_multipartchannel.html]
 [test_fontloader.html]
-fail-if = fission
 [test_block_all_mixed_content.html]
 tags = mcb
 [test_block_all_mixed_content_frame_navigation.html]
 tags = mcb
 [test_form_action_blocks_url.html]
 [test_meta_whitespace_skipping.html]
 [test_iframe_sandbox.html]
 [test_iframe_sandbox_top_1.html]

--- a/dom/security/test/csp/test_fontloader.html
+++ b/dom/security/test/csp/test_fontloader.html
@@ -52,21 +52,21 @@ const tests = [
   }
 ];
 
 var curTest;
 var counter = -1;
 var baselineframe = document.getElementById("baselineframe");
 var testframe = document.getElementById("testframe");
 
-function checkResult() {
+async function checkResult() {
   testframe.removeEventListener('load', checkResult);
   try {
-    ok(compareSnapshots(snapshotWindow(baselineframe.contentWindow),
-                        snapshotWindow(testframe.contentWindow),
+    ok(compareSnapshots(await snapshotWindow(baselineframe.contentWindow),
+                        await snapshotWindow(testframe.contentWindow),
                         curTest.expected)[0],
                         curTest.description);
   } catch(err) {
     ok(false, "error: " + err.message);
   }
   loadNextTest();
 }
 

--- a/dom/svg/test/mochitest.ini
+++ b/dom/svg/test/mochitest.ini
@@ -96,15 +96,14 @@ support-files = tearoff_with_cc_helper.h
 [test_text.html]
 [test_text_lengthAdjust.html]
 [test_text_scaled.html]
 [test_text_selection.html]
 [test_text_update.html]
 [test_transform.xhtml]
 [test_transformParsing.html]
 [test_use_with_hsts.html]
-skip-if = fission
 support-files = use-with-hsts-helper.html use-with-hsts-helper.html^headers^
 [test_valueAsString.xhtml]
 [test_valueLeaks.xhtml]
 [test_viewBox.html]
 [test_viewport.html]
 

--- a/dom/svg/test/test_text_dirty.html
+++ b/dom/svg/test/test_text_dirty.html
@@ -18,26 +18,26 @@ https://bugzilla.mozilla.org/show_bug.cg
     <mask id="m"><text id="t">x</text></mask>
     <rect width="600" height="400" mask="url(#m)"/>
   </svg>
 </p>
 <div id="content" style="display: none">
 </div>
 <pre id="test">
 <script class="testbody" type="text/javascript">
-function runTest() {
+async function runTest() {
   var svgText = document.getElementById("t");
 
   // Dirty the frames.
   document.getElementById("display").style.width = "700px";
   svgText.firstChild.remove();
 
   // Paint without flushing layout.  If the test fails, we'll trigger
   // an assertion.
-  SpecialPowers.snapshotWindowWithOptions(window, undefined, undefined, { DRAWWINDOW_DO_NOT_FLUSH: true });
+  await SpecialPowers.snapshotWindowWithOptions(window, undefined, undefined, { DRAWWINDOW_DO_NOT_FLUSH: true });
 
   ok(true);
   SimpleTest.finish();
 }
 
 window.addEventListener("load", runTest);
 
 SimpleTest.waitForExplicitFinish();

--- a/dom/svg/test/test_use_with_hsts.html
+++ b/dom/svg/test/test_use_with_hsts.html
@@ -68,52 +68,52 @@ https://bugzilla.mozilla.org/show_bug.cg
     });
   }
 
   // MAIN TEST CODE BEGINS HERE.
   async function runTest() {
     // Capture a snapshot with nothing in the iframe, so we can do a
     // sanity-check not-equal comparison against our reference case, to be
     // sure we're rendering anything at all:
-    let blankSnapshot = snapshotWindow(iframeWin);
+    let blankSnapshot = await snapshotWindow(iframeWin);
 
     // Load & snapshot a reference case (fully lime):
     await LoadIframeAsync("data:text/html,<body style='background:lime'>");
-    let refSnapshot = snapshotWindow(iframeWin);
+    let refSnapshot = await snapshotWindow(iframeWin);
 
     // Ensure reference snapshot looks different from blank snapshot:
     assertSnapshots(refSnapshot, blankSnapshot,
                     false /* not equal*/, null /* no fuzz*/,
                     "refSnapshot", "blankSnapshot");
 
     // OK, assuming we've got a valid refSnapshot, we can now proceed to
     // capture test screenshots.
 
     // Register a postMessage handler, so that iframe can report its location:
     window.addEventListener("message", receiveMessage);
 
     // Load & snapshot secure (HTTPS) version of testcase, & check against ref:
     await LoadIframeAsync(secureURI);
-    let secureSnapshot = snapshotWindow(iframeWin);
+    let secureSnapshot = await snapshotWindow(iframeWin);
     assertSnapshots(secureSnapshot, refSnapshot,
                     true /* equal*/, null /* no fuzz*/,
                     "secureSnapshot", "refSnapshot");
 
     // Load insecure (HTTP) version of testcase (which should get
     // automatically upgraded to secure (HTTPS) under the hood):
     await LoadIframeAsync(insecureURI);
 
     // Double-check that iframe is really pointed at insecure URI, to be sure
     // we're actually exercising HSTS. (Note that receiveMessage() will make
     // sure it's been upgraded to a secure HTTPS URI under the hood.)
     is(iframe.src, insecureURI,
        "test should've attempted to load insecure HTTP URI, to exercise HSTS");
 
     // Capture snapshot of iframe showing upgraded-to-HTTPS version of testcase:
-    let upgradedSnapshot = snapshotWindow(iframeWin);
+    let upgradedSnapshot = await snapshotWindow(iframeWin);
     assertSnapshots(upgradedSnapshot, refSnapshot,
                     true /* equal*/, null /* no fuzz*/,
                     "upgradedSnapshot", "refSnapshot");
 
     // Check that the iframe did actually invoke our postMessage handler (which
     // is where we verify that the HSTS upgrade actually happened):
     is(numPostMessageCalls, expectedNumPostMessageCalls,
       "didn't receive as many messages from child iframe as expected");

--- a/dom/xul/test/test_bug398289.html
+++ b/dom/xul/test/test_bug398289.html
@@ -10,28 +10,28 @@
   <iframe id="test" src="398289-resource.xul" width="100%" height="100%">
   </iframe>
 
   <script class="testbody" type="text/javascript">
     var snap1, snap2;
   
     SimpleTest.waitForExplicitFinish();
   
-    function onBodyLoad() {
+    async function onBodyLoad() {
       window.frames[0].document.getElementById("test").selectedIndex = 0;
       window.frames[0].document.getElementById("test").selectedIndex = 1;
       
-      snap1 = snapshotWindow(window);
+      snap1 = await snapshotWindow(window);
       
       document.getElementById("test").onload = onFrameLoad;
       window.frames[0].location.reload();
     }
     
-    function onFrameLoad() {
-      snap2 = snapshotWindow(window);
+    async function onFrameLoad() {
+      snap2 = await snapshotWindow(window);
 
       var equal, str1, str2;
       [equal, str1, str2] = compareSnapshots(snap1, snap2, true);
 
       ok(equal, "persistent attribute in tab box broken, expected: "+str1+" got: "+str2);
           
       SimpleTest.finish();
     }