new file mode 100644
--- /dev/null
+++ b/build/pgo/prefs_override.js
@@ -0,0 +1,2 @@
+// Turn off budget throttling for the profile server
+user_pref("dom.timeout.enable_budget_timer_throttling", false);

old mode 100644
new mode 100755
--- a/build/pgo/profileserver.py
+++ b/build/pgo/profileserver.py
@@ -40,23 +40,29 @@ if __name__ == '__main__':
     locations.add_host(host='127.0.0.1',
                        port=PORT,
                        options='primary,privileged')
 
     with TemporaryDirectory() as profilePath:
         # TODO: refactor this into mozprofile
         prefpath = os.path.join(
             build.topsrcdir, "testing", "profiles", "prefs_general.js")
+        overridepath = os.path.join(
+            build.topsrcdir, "build", "pgo", "prefs_override.js")
+
         prefs = {}
         prefs.update(Preferences.read_prefs(prefpath))
+        prefs.update(Preferences.read_prefs(overridepath))
+
         interpolation = {"server": "%s:%d" % httpd.httpd.server_address,
                          "OOP": "false"}
         prefs = json.loads(json.dumps(prefs) % interpolation)
         for pref in prefs:
             prefs[pref] = Preferences.cast(prefs[pref])
+
         profile = FirefoxProfile(profile=profilePath,
                                  preferences=prefs,
                                  addons=[os.path.join(
                                      build.topsrcdir, 'tools', 'quitter', 'quitter@mozilla.org.xpi')],
                                  locations=locations)
 
         env = os.environ.copy()
         env["MOZ_CRASHREPORTER_NO_REPORT"] = "1"

--- a/dom/base/ChromeUtils.cpp
+++ b/dom/base/ChromeUtils.cpp
@@ -5,16 +5,20 @@
 
 #include "ChromeUtils.h"
 
 #include "jsfriendapi.h"
 #include "WrapperFactory.h"
 
 #include "mozilla/Base64.h"
 #include "mozilla/BasePrincipal.h"
+#include "mozilla/TimeStamp.h"
+#include "mozilla/dom/IdleDeadline.h"
+#include "mozilla/dom/WindowBinding.h" // For IdleRequestCallback/Options
+#include "nsThreadUtils.h"
 
 namespace mozilla {
 namespace dom {
 
 /* static */ void
 ThreadSafeChromeUtils::NondeterministicGetWeakMapKeys(GlobalObject& aGlobal,
                                                       JS::Handle<JS::Value> aMap,
                                                       JS::MutableHandle<JS::Value> aRetval,
@@ -259,16 +263,119 @@ ChromeUtils::ShallowClone(GlobalObject& 
   if (aTarget && !JS_WrapObject(cx, &obj)) {
     return;
   }
 
   cleanup.release();
   aRetval.set(obj);
 }
 
+namespace {
+  class IdleDispatchRunnable final : public IdleRunnable
+                                   , public nsITimerCallback
+  {
+  public:
+    NS_DECL_ISUPPORTS_INHERITED
+
+    IdleDispatchRunnable(nsIGlobalObject* aParent,
+                         IdleRequestCallback& aCallback)
+      : IdleRunnable("ChromeUtils::IdleDispatch")
+      , mCallback(&aCallback)
+      , mParent(aParent)
+    {}
+
+    NS_IMETHOD Run() override
+    {
+      if (mCallback) {
+        CancelTimer();
+
+        auto deadline = mDeadline - TimeStamp::ProcessCreation();
+
+        ErrorResult rv;
+        RefPtr<IdleDeadline> idleDeadline =
+          new IdleDeadline(mParent, mTimedOut, deadline.ToMilliseconds());
+
+        mCallback->Call(*idleDeadline, rv, "ChromeUtils::IdleDispatch handler");
+        mCallback = nullptr;
+        mParent = nullptr;
+
+        rv.SuppressException();
+        return rv.StealNSResult();
+      }
+      return NS_OK;
+    }
+
+    void SetDeadline(TimeStamp aDeadline) override
+    {
+      mDeadline = aDeadline;
+    }
+
+    NS_IMETHOD Notify(nsITimer* aTimer) override
+    {
+      mTimedOut = true;
+      SetDeadline(TimeStamp::Now());
+      return Run();
+    }
+
+    void SetTimer(uint32_t aDelay, nsIEventTarget* aTarget) override
+    {
+      MOZ_ASSERT(aTarget);
+      MOZ_ASSERT(!mTimer);
+      mTimer = do_CreateInstance(NS_TIMER_CONTRACTID);
+      if (mTimer) {
+        mTimer->SetTarget(aTarget);
+        mTimer->InitWithCallback(this, aDelay, nsITimer::TYPE_ONE_SHOT);
+      }
+    }
+
+  protected:
+    virtual ~IdleDispatchRunnable()
+    {
+      CancelTimer();
+    }
+
+  private:
+    void CancelTimer()
+    {
+      if (mTimer) {
+        mTimer->Cancel();
+        mTimer = nullptr;
+      }
+    }
+
+    RefPtr<IdleRequestCallback> mCallback;
+    nsCOMPtr<nsIGlobalObject> mParent;
+
+    nsCOMPtr<nsITimer> mTimer;
+
+    TimeStamp mDeadline{};
+    bool mTimedOut = false;
+  };
+
+  NS_IMPL_ISUPPORTS_INHERITED(IdleDispatchRunnable, IdleRunnable, nsITimerCallback)
+} // anonymous namespace
+
+/* static */ void
+ChromeUtils::IdleDispatch(const GlobalObject& aGlobal,
+                          IdleRequestCallback& aCallback,
+                          const IdleRequestOptions& aOptions,
+                          ErrorResult& aRv)
+{
+  nsCOMPtr<nsIGlobalObject> global = do_QueryInterface(aGlobal.GetAsSupports());
+  MOZ_ASSERT(global);
+
+  auto runnable = MakeRefPtr<IdleDispatchRunnable>(global, aCallback);
+
+  if (aOptions.mTimeout.WasPassed()) {
+    aRv = NS_IdleDispatchToCurrentThread(runnable.forget(), aOptions.mTimeout.Value());
+  } else {
+    aRv = NS_IdleDispatchToCurrentThread(runnable.forget());
+  }
+}
+
 /* static */ void
 ChromeUtils::OriginAttributesToSuffix(dom::GlobalObject& aGlobal,
                                       const dom::OriginAttributesDictionary& aAttrs,
                                       nsCString& aSuffix)
 
 {
   OriginAttributes attrs(aAttrs);
   attrs.CreateSuffix(aSuffix);

--- a/dom/base/ChromeUtils.h
+++ b/dom/base/ChromeUtils.h
@@ -16,16 +16,18 @@ namespace mozilla {
 
 namespace devtools {
 class HeapSnapshot;
 } // namespace devtools
 
 namespace dom {
 
 class ArrayBufferViewOrArrayBuffer;
+class IdleRequestCallback;
+struct IdleRequestOptions;
 class PrecompiledScript;
 class Promise;
 
 class ThreadSafeChromeUtils
 {
 private:
   // Implemented in devtools/shared/heapsnapshot/HeapSnapshot.cpp
   static void SaveHeapSnapshotShared(GlobalObject& global,
@@ -140,14 +142,19 @@ public:
                            bool aUnwrap,
                            nsAString& aRetval);
 
   static void ShallowClone(GlobalObject& aGlobal,
                            JS::HandleObject aObj,
                            JS::HandleObject aTarget,
                            JS::MutableHandleObject aRetval,
                            ErrorResult& aRv);
+
+  static void IdleDispatch(const GlobalObject& global,
+                           IdleRequestCallback& callback,
+                           const IdleRequestOptions& options,
+                           ErrorResult& aRv);
 };
 
 } // namespace dom
 } // namespace mozilla
 
 #endif // mozilla_dom_ChromeUtils__

--- a/dom/base/IdleDeadline.cpp
+++ b/dom/base/IdleDeadline.cpp
@@ -12,30 +12,41 @@
 #include "nsCOMPtr.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsDOMNavigationTiming.h"
 #include "nsPIDOMWindow.h"
 
 namespace mozilla {
 namespace dom {
 
-NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(IdleDeadline, mWindow)
+NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(IdleDeadline, mWindow, mGlobal)
 NS_IMPL_CYCLE_COLLECTING_ADDREF(IdleDeadline)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(IdleDeadline)
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(IdleDeadline)
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 IdleDeadline::IdleDeadline(nsPIDOMWindowInner* aWindow, bool aDidTimeout,
                            DOMHighResTimeStamp aDeadline)
   : mWindow(aWindow)
   , mDidTimeout(aDidTimeout)
   , mDeadline(aDeadline)
 {
+  bool hasHadSHO;
+  mGlobal = aWindow->GetDoc()->GetScriptHandlingObject(hasHadSHO);
+}
+
+IdleDeadline::IdleDeadline(nsIGlobalObject* aGlobal, bool aDidTimeout,
+                           DOMHighResTimeStamp aDeadline)
+  : mWindow(nullptr)
+  , mGlobal(aGlobal)
+  , mDidTimeout(aDidTimeout)
+  , mDeadline(aDeadline)
+{
 }
 
 IdleDeadline::~IdleDeadline()
 {
 }
 
 JSObject*
 IdleDeadline::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto)
@@ -45,24 +56,31 @@ IdleDeadline::WrapObject(JSContext* aCx,
 
 DOMHighResTimeStamp
 IdleDeadline::TimeRemaining()
 {
   if (mDidTimeout) {
     return 0.0;
   }
 
-  RefPtr<Performance> performance = mWindow->GetPerformance();
-  if (!performance) {
-    // If there is no performance object the window is partially torn
-    // down, so we can safely say that there is no time remaining.
-    return 0.0;
+  if (mWindow) {
+    RefPtr<Performance> performance = mWindow->GetPerformance();
+    if (!performance) {
+      // If there is no performance object the window is partially torn
+      // down, so we can safely say that there is no time remaining.
+      return 0.0;
+    }
+
+    return std::max(mDeadline - performance->Now(), 0.0);
   }
 
-  return std::max(mDeadline - performance->Now(), 0.0);
+  // If there's no window, we're in a system scope, and can just use
+  // a high-resolution TimeStamp::Now();
+  auto timestamp = TimeStamp::Now() - TimeStamp::ProcessCreation();
+  return std::max(mDeadline - timestamp.ToMilliseconds(), 0.0);
 }
 
 bool
 IdleDeadline::DidTimeout() const
 {
   return mDidTimeout;
 }
 

--- a/dom/base/IdleDeadline.h
+++ b/dom/base/IdleDeadline.h
@@ -12,44 +12,49 @@
 #include "mozilla/ErrorResult.h"
 #include "mozilla/Maybe.h"
 #include "mozilla/dom/BindingDeclarations.h"
 #include "nsCOMPtr.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsDOMNavigationTiming.h"
 #include "nsWrapperCache.h"
 
+class nsIGlobalObject;
 class nsPIDOMWindowInner;
 
 namespace mozilla {
 namespace dom {
 
 class IdleDeadline final
   : public nsISupports
   , public nsWrapperCache
 {
 public:
   IdleDeadline(nsPIDOMWindowInner* aWindow, bool aDidTimeout,
                DOMHighResTimeStamp aDeadline);
 
-  nsPIDOMWindowInner* GetParentObject() const { return mWindow; }
+  IdleDeadline(nsIGlobalObject* aGlobal, bool aDidTimeout,
+               DOMHighResTimeStamp aDeadline);
+
+  nsIGlobalObject* GetParentObject() const { return mGlobal; }
 
   virtual JSObject* WrapObject(JSContext* aCx,
                                JS::Handle<JSObject*> aGivenProto) override;
 
   DOMHighResTimeStamp TimeRemaining();
   bool DidTimeout() const;
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(IdleDeadline)
 
 private:
   ~IdleDeadline();
 
   nsCOMPtr<nsPIDOMWindowInner> mWindow;
+  nsCOMPtr<nsIGlobalObject> mGlobal;
   const bool mDidTimeout;
   const DOMHighResTimeStamp mDeadline;
 };
 
 } // namespace dom
 } // namespace mozilla
 
 #endif // mozilla_dom_IdleDeadline_h

--- a/dom/base/WebSocket.cpp
+++ b/dom/base/WebSocket.cpp
@@ -1661,28 +1661,27 @@ WebSocketImpl::Init(JSContext* aCx,
       nsCOMPtr<nsIGlobalObject> globalObject(GetEntryGlobal());
       if (globalObject) {
         principal = globalObject->PrincipalOrNull();
       }
 
       nsCOMPtr<nsPIDOMWindowInner> innerWindow;
 
       while (true) {
-        if (principal) {
-          bool isNullPrincipal = true;
-          isNullPrincipal = principal->GetIsNullPrincipal();
-          if (isNullPrincipal || nsContentUtils::IsSystemPrincipal(principal)) {
-            break;
-          }
+        if (principal && !principal->GetIsNullPrincipal()) {
+          break;
         }
 
         if (!innerWindow) {
           innerWindow = do_QueryInterface(globalObject);
-          if (NS_WARN_IF(!innerWindow)) {
-            return NS_ERROR_DOM_SECURITY_ERR;
+          if (!innerWindow) {
+            // If we are in a XPConnect sandbox or in a JS component,
+            // innerWindow will be null. There is nothing on top of this to be
+            // considered.
+            break;
           }
         }
 
         nsCOMPtr<nsPIDOMWindowOuter> parentWindow =
           innerWindow->GetScriptableParent();
         if (NS_WARN_IF(!parentWindow)) {
           return NS_ERROR_DOM_SECURITY_ERR;
         }

--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -8151,34 +8151,34 @@ nsGlobalWindow::PrintOuter(ErrorResult& 
     if (printSettingsService) {
       bool printSettingsAreGlobal =
         Preferences::GetBool("print.use_global_printsettings", false);
 
       if (printSettingsAreGlobal) {
         printSettingsService->GetGlobalPrintSettings(getter_AddRefs(printSettings));
 
         nsAutoString printerName;
-        printSettings->GetPrinterName(getter_Copies(printerName));
+        printSettings->GetPrinterName(printerName);
 
         bool shouldGetDefaultPrinterName = printerName.IsEmpty();
 #ifdef MOZ_X11
         // In Linux, GTK backend does not support per printer settings.
         // Calling GetDefaultPrinterName causes a sandbox violation (see Bug 1329216).
         // The printer name is not needed anywhere else on Linux before it gets to the parent.
         // In the parent, we will then query the default printer name if no name is set.
         // Unless we are in the parent, we will skip this part.
         if (!XRE_IsParentProcess()) {
           shouldGetDefaultPrinterName = false;
         }
 #endif
         if (shouldGetDefaultPrinterName) {
-          printSettingsService->GetDefaultPrinterName(getter_Copies(printerName));
-          printSettings->SetPrinterName(printerName.get());
+          printSettingsService->GetDefaultPrinterName(printerName);
+          printSettings->SetPrinterName(printerName);
         }
-        printSettingsService->InitPrintSettingsFromPrinter(printerName.get(),
+        printSettingsService->InitPrintSettingsFromPrinter(printerName,
                                                            printSettings);
         printSettingsService->InitPrintSettingsFromPrefs(printSettings,
                                                          true,
                                                          nsIPrintSettings::kInitSaveAll);
       } else {
         printSettingsService->GetNewPrintSettings(getter_AddRefs(printSettings));
       }
 

--- a/dom/base/nsNodeUtils.cpp
+++ b/dom/base/nsNodeUtils.cpp
@@ -611,16 +611,19 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNod
         MOZ_ASSERT(IsDOMObject(wrapper));
         JSAutoCompartment ac(cx, wrapper);
         ReparentWrapper(cx, wrapper, aError);
         if (aError.Failed()) {
           if (wasRegistered) {
             aNode->OwnerDoc()->UnregisterActivityObserver(aNode->AsElement());
           }
           aNode->mNodeInfo.swap(newNodeInfo);
+          if (elem) {
+            elem->NodeInfoChanged(newDoc);
+          }
           if (wasRegistered) {
             aNode->OwnerDoc()->RegisterActivityObserver(aNode->AsElement());
           }
           return nullptr;
         }
       }
     }
   }

new file mode 100644
--- /dev/null
+++ b/dom/base/test/iframe_webSocket_sandbox.html
@@ -0,0 +1,65 @@
+<html><body>
+<iframe id="frame" sandbox="allow-scripts allow-popups"></iframe>
+<script type="application/javascript;version=1.8">
+onmessage = function(e) {
+  parent.postMessage(e.data, '*');
+}
+
+var ifr = document.getElementById('frame');
+
+if (location.search == '?nested') {
+  var url = new URL(location);
+  url.search = "";
+  ifr.src = url.href;
+} else if (location.search == '?popup') {
+  var url = new URL(location);
+  url.search = "?opener";
+
+  ifr.srcdoc = "<html><script>" +
+    "window.open('" + url.href + "', 'foobar');" +
+    "onmessage = function(e) { " +
+    "  parent.postMessage(e.data, '*'); " +
+    "}" +
+  "</scr" + "ipt></html>";
+} else if (location.search == '?opener') {
+  try{
+    var socket = new WebSocket('ws://mochi.test:8888/tests/dom/base/test/file_websocket_basic');
+    socket.onerror = function(e) {
+      opener.postMessage('WS onerror', '*');
+      close();
+    };
+    socket.onopen = function(event) {
+      opener.postMessage('WS onopen', '*');
+      close();
+    };
+  } catch(e) {
+    if (e.name == 'SecurityError') {
+      opener.postMessage('WS Throws!', '*');
+    } else {
+      opener.postMessage('WS Throws something else!', '*');
+    }
+    close();
+  }
+} else {
+  ifr.srcdoc = `
+  <html><script>
+  try{
+    var socket = new WebSocket('ws://mochi.test:8888/tests/dom/base/test/file_websocket_basic');
+    socket.onerror = function(e) {
+      parent.postMessage('WS onerror', '*');
+    };
+    socket.onopen = function(event) {
+      parent.postMessage('WS onopen', '*');
+    };
+  } catch(e) {
+    if (e.name == 'SecurityError') {
+      parent.postMessage('WS Throws!', '*');
+    } else {
+      parent.postMessage('WS Throws something else!', '*');
+    }
+  }
+  </scr`+`ipt>
+  </html>`;
+}
+</script>
+</body></html>

--- a/dom/base/test/mochitest.ini
+++ b/dom/base/test/mochitest.ini
@@ -801,16 +801,19 @@ tags = audiochannel
 [test_webaudioNotificationStopOnNavigation.html]
 tags = audiochannel
 [test_websocket_basic.html]
 skip-if = toolkit == 'android'
 [test_websocket_hello.html]
 skip-if = toolkit == 'android'
 [test_websocket_permessage_deflate.html]
 skip-if = toolkit == 'android'
+[test_webSocket_sandbox.html]
+skip-if = toolkit == 'android'
+support-files = iframe_webSocket_sandbox.html
 [test_websocket1.html]
 skip-if = toolkit == 'android'
 [test_websocket2.html]
 skip-if = toolkit == 'android'
 [test_websocket3.html]
 skip-if = toolkit == 'android'
 [test_websocket4.html]
 skip-if = toolkit == 'android'

--- a/dom/base/test/test_bug1222633.html
+++ b/dom/base/test/test_bug1222633.html
@@ -83,18 +83,20 @@ function testChangePrefetchToPreload(url
 };
 
 const SJS_PATH = window.location.pathname.replace(/[^/]+$/, "file_bug1268962.sjs");
 const SAME_ORIGIN = "http://mochi.test:8888" + SJS_PATH;
 const CROSS_ORIGIN = "http://example.com" + SJS_PATH;
 
 SimpleTest.waitForExplicitFinish();
 
+SpecialPowers.pushPrefEnv({"set": [["network.preload", true]]})
+
 // test same origin
-testPreloadEvent(SAME_ORIGIN + "?statusCode=200&cacheControl=no-cache", false, false)
+.then(() => testPreloadEvent(SAME_ORIGIN + "?statusCode=200&cacheControl=no-cache", false, false))
 .then(() => testPreloadEvent(SAME_ORIGIN + "?statusCode=404&cacheControl=no-cache", false, false))
 .then(() => testPreloadEvent(SAME_ORIGIN + "?statusCode=200&cacheControl=max-age%3D120", false, true))
 .then(() => testPreloadEvent(SAME_ORIGIN + "?statusCode=404&cacheControl=max-age%3D120", false, false))
 
 // test cross origin without CORS
 .then(() => testPreloadEvent(CROSS_ORIGIN + "?statusCode=200&cacheControl=no-cache", false, true))
 .then(() => testPreloadEvent(CROSS_ORIGIN + "?statusCode=404&cacheControl=no-cache", false, true))
 .then(() => testPreloadEvent(CROSS_ORIGIN + "?statusCode=200&cacheControl=max-age%3D120", false, true))

--- a/dom/base/test/test_bug1222633_link_update.html
+++ b/dom/base/test/test_bug1222633_link_update.html
@@ -117,18 +117,20 @@ function testPreloadEventSetCrossOrigin(
 }
 
 const SJS_PATH = window.location.pathname.replace(/[^/]+$/, "file_bug1268962.sjs");
 const SAME_ORIGIN = "http://mochi.test:8888" + SJS_PATH;
 const CROSS_ORIGIN = "http://example.com" + SJS_PATH;
 
 SimpleTest.waitForExplicitFinish();
 
+SpecialPowers.pushPrefEnv({"set": [["network.preload", true]]})
+
 // Test changing as parameter from a wrong to a correct one.
-testPreloadEventAsAttributeChange(SAME_ORIGIN + "?statusCode=200&cacheControl=max-age%3D120")
+.then(() => testPreloadEventAsAttributeChange(SAME_ORIGIN + "?statusCode=200&cacheControl=max-age%3D120"))
 // Test changing type parameter from a wrong to a correct one for given as parameter.
 .then(() => testPreloadEventAttributeChange(SAME_ORIGIN + "?statusCode=200&cacheControl=max-age%3D120", "type", "text/vtt", "image/png", false, true))
 // Test changing media parameter from a wrong to a correct one.
 .then(() => testPreloadEventAttributeChange(SAME_ORIGIN + "?statusCode=200&cacheControl=max-age%3D120", "media", "foo", "all", false, true))
 // Test changing crossorigin parameter.
 .then(() => testPreloadEventSetCrossOrigin(CROSS_ORIGIN + "?statusCode=404&cacheControl=max-age%3D120&allowOrigin=*"))
 
 .catch((err) => ok(false, "promise rejected: " + err))

new file mode 100644
--- /dev/null
+++ b/dom/base/test/test_webSocket_sandbox.html
@@ -0,0 +1,34 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Bug 1252751</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<div id="container"></div>
+<iframe id="frame"></iframe>
+<script type="application/javascript;version=1.8">
+var urls = [ "https://example.com/tests/dom/base/test/iframe_webSocket_sandbox.html",
+             "https://example.com/tests/dom/base/test/iframe_webSocket_sandbox.html?nested",
+             "https://example.com/tests/dom/base/test/iframe_webSocket_sandbox.html?popup" ];
+
+onmessage = function(e) {
+  is(e.data, "WS Throws!", "ws://URI cannot be used by a https iframe");
+  runTest();
+}
+
+function runTest() {
+  if (!urls.length) {
+    SimpleTest.finish();
+    return;
+  }
+
+  document.getElementById("frame").src = urls.shift();
+}
+
+SimpleTest.waitForExplicitFinish();
+runTest();
+</script>
+</body>
+</html>

--- a/dom/html/HTMLLinkElement.cpp
+++ b/dom/html/HTMLLinkElement.cpp
@@ -386,21 +386,38 @@ static const DOMTokenListSupportedToken 
   "alternate",
   "preconnect",
   "icon",
   "search",
   "preload",
   nullptr
 };
 
+static const DOMTokenListSupportedToken sSupportedRelValuesNoPreload[] = {
+  // Keep this in sync with ToLinkMask in nsStyleLinkElement.cpp.
+  // "import" must come first because it's conditional.
+  "prefetch",
+  "dns-prefetch",
+  "stylesheet",
+  "next",
+  "alternate",
+  "preconnect",
+  "icon",
+  "search",
+  nullptr
+};
 nsDOMTokenList*
 HTMLLinkElement::RelList()
 {
   if (!mRelList) {
-    mRelList = new nsDOMTokenList(this, nsGkAtoms::rel, sSupportedRelValues);
+    if (Preferences::GetBool("network.preload")) {
+      mRelList = new nsDOMTokenList(this, nsGkAtoms::rel, sSupportedRelValues);
+    } else {
+      mRelList = new nsDOMTokenList(this, nsGkAtoms::rel, sSupportedRelValuesNoPreload);
+    }
   }
   return mRelList;
 }
 
 already_AddRefed<nsIURI>
 HTMLLinkElement::GetHrefURI() const
 {
   return GetHrefURIForAnchors();

--- a/dom/webauthn/WebAuthnManager.cpp
+++ b/dom/webauthn/WebAuthnManager.cpp
@@ -229,16 +229,17 @@ WebAuthnManager::MaybeClearTransaction()
     RefPtr<WebAuthnTransactionChild> c;
     mChild.swap(c);
     c->Send__delete__(c);
   }
 }
 
 WebAuthnManager::~WebAuthnManager()
 {
+  MOZ_ASSERT(NS_IsMainThread());
   MaybeClearTransaction();
 }
 
 RefPtr<WebAuthnManager::BackgroundActorPromise>
 WebAuthnManager::GetOrCreateBackgroundActor()
 {
   MOZ_ASSERT(NS_IsMainThread());
 
@@ -258,16 +259,17 @@ WebAuthnManager::GetOrCreateBackgroundAc
   return promise;
 }
 
 //static
 WebAuthnManager*
 WebAuthnManager::GetOrCreate()
 {
   MOZ_ASSERT(NS_IsMainThread());
+
   if (gWebAuthnManager) {
     return gWebAuthnManager;
   }
 
   gWebAuthnManager = new WebAuthnManager();
   ClearOnShutdown(&gWebAuthnManager);
   return gWebAuthnManager;
 }
@@ -279,25 +281,26 @@ WebAuthnManager::Get()
   MOZ_ASSERT(NS_IsMainThread());
   return gWebAuthnManager;
 }
 
 already_AddRefed<Promise>
 WebAuthnManager::MakeCredential(nsPIDOMWindowInner* aParent,
                                 const MakePublicKeyCredentialOptions& aOptions)
 {
+  MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(aParent);
 
   MaybeClearTransaction();
 
   nsCOMPtr<nsIGlobalObject> global = do_QueryInterface(aParent);
 
   ErrorResult rv;
   RefPtr<Promise> promise = Promise::Create(global, rv);
-  if(rv.Failed()) {
+  if (rv.Failed()) {
     return nullptr;
   }
 
   nsString origin;
   nsCString rpId;
   rv = GetOrigin(aParent, origin, rpId);
   if (NS_WARN_IF(rv.Failed())) {
     promise->MaybeReject(rv);
@@ -511,48 +514,55 @@ WebAuthnManager::MakeCredential(nsPIDOMW
   mInfo = Some(info);
   ListenForVisibilityEvents(aParent, this);
 
   return promise.forget();
 }
 
 void
 WebAuthnManager::StartRegister() {
+  MOZ_ASSERT(NS_IsMainThread());
+
   if (mChild) {
     mChild->SendRequestRegister(mInfo.ref());
   }
 }
 
 void
 WebAuthnManager::StartSign() {
+  MOZ_ASSERT(NS_IsMainThread());
+
   if (mChild) {
     mChild->SendRequestSign(mInfo.ref());
   }
 }
 
 void
 WebAuthnManager::StartCancel() {
+  MOZ_ASSERT(NS_IsMainThread());
+
   if (mChild) {
     mChild->SendRequestCancel();
   }
 }
 
 already_AddRefed<Promise>
 WebAuthnManager::GetAssertion(nsPIDOMWindowInner* aParent,
                               const PublicKeyCredentialRequestOptions& aOptions)
 {
+  MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(aParent);
 
   MaybeClearTransaction();
 
   nsCOMPtr<nsIGlobalObject> global = do_QueryInterface(aParent);
 
   ErrorResult rv;
   RefPtr<Promise> promise = Promise::Create(global, rv);
-  if(rv.Failed()) {
+  if (rv.Failed()) {
     return nullptr;
   }
 
   nsString origin;
   nsCString rpId;
   rv = GetOrigin(aParent, origin, rpId);
   if (NS_WARN_IF(rv.Failed())) {
     promise->MaybeReject(rv);
@@ -685,16 +695,17 @@ WebAuthnManager::GetAssertion(nsPIDOMWin
   ListenForVisibilityEvents(aParent, this);
 
   return promise.forget();
 }
 
 void
 WebAuthnManager::FinishMakeCredential(nsTArray<uint8_t>& aRegBuffer)
 {
+  MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(mTransactionPromise);
   MOZ_ASSERT(mInfo.isSome());
 
   CryptoBuffer regData;
   if (NS_WARN_IF(!regData.Assign(aRegBuffer.Elements(), aRegBuffer.Length()))) {
     Cancel(NS_ERROR_OUT_OF_MEMORY);
     return;
   }
@@ -808,16 +819,17 @@ WebAuthnManager::FinishMakeCredential(ns
   mTransactionPromise->MaybeResolve(credential);
   MaybeClearTransaction();
 }
 
 void
 WebAuthnManager::FinishGetAssertion(nsTArray<uint8_t>& aCredentialId,
                                     nsTArray<uint8_t>& aSigBuffer)
 {
+  MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(mTransactionPromise);
   MOZ_ASSERT(mInfo.isSome());
 
   CryptoBuffer tokenSignatureData;
   if (NS_WARN_IF(!tokenSignatureData.Assign(aSigBuffer.Elements(),
                                             aSigBuffer.Length()))) {
     Cancel(NS_ERROR_OUT_OF_MEMORY);
     return;
@@ -900,16 +912,17 @@ WebAuthnManager::Cancel(const nsresult& 
   }
 
   MaybeClearTransaction();
 }
 
 NS_IMETHODIMP
 WebAuthnManager::HandleEvent(nsIDOMEvent* aEvent)
 {
+  MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(aEvent);
 
   nsAutoString type;
   aEvent->GetType(type);
   if (!type.Equals(kVisibilityChange)) {
     return NS_ERROR_FAILURE;
   }
 
@@ -949,19 +962,21 @@ WebAuthnManager::ActorCreated(PBackgroun
   MOZ_ASSERT(constructedMgr == mgr);
   mChild = mgr.forget();
   mPBackgroundCreationPromise.Resolve(NS_OK, __func__);
 }
 
 void
 WebAuthnManager::ActorDestroyed()
 {
+  MOZ_ASSERT(NS_IsMainThread());
   mChild = nullptr;
 }
 
 void
 WebAuthnManager::ActorFailed()
 {
+  MOZ_ASSERT(NS_IsMainThread());
   MOZ_CRASH("We shouldn't be here!");
 }
 
 }
 }

--- a/dom/webidl/ChromeUtils.webidl
+++ b/dom/webidl/ChromeUtils.webidl
@@ -96,16 +96,25 @@ interface ChromeUtils : ThreadSafeChrome
    * target compartment (or the caller compartment if no target is provided).
    * Property values themeselves are not cloned.
    *
    * Ignores non-enumerable properties, properties on prototypes, and properties
    * with getters or setters.
    */
   [Throws]
   static object shallowClone(object obj, optional object? target = null);
+
+  /**
+   * Dispatches the given callback to the main thread when it would be
+   * otherwise idle. Similar to Window.requestIdleCallback, but not bound to a
+   * particular DOM windw.
+   */
+  [Throws]
+  static void idleDispatch(IdleRequestCallback callback,
+                           optional IdleRequestOptions options);
 };
 
 /**
  * Used by principals and the script security manager to represent origin
  * attributes. The first dictionary is designed to contain the full set of
  * OriginAttributes, the second is used for pattern-matching (i.e. does this
  * OriginAttributesDictionary match the non-empty attributes in this pattern).
  *

--- a/dom/webidl/IdleDeadline.webidl
+++ b/dom/webidl/IdleDeadline.webidl
@@ -2,13 +2,14 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/.
  *
  * The origin of this IDL file is:
  * https://w3c.github.io/requestidlecallback/
  */
 
-[Func="nsGlobalWindow::IsRequestIdleCallbackEnabled"]
+[Exposed=(Window,System),
+ Func="nsGlobalWindow::IsRequestIdleCallbackEnabled"]
 interface IdleDeadline {
   DOMHighResTimeStamp timeRemaining();
   readonly attribute boolean didTimeout;
 };

new file mode 100644
--- /dev/null
+++ b/dom/workers/test/crashtests/1348882.html
@@ -0,0 +1,18 @@
+<!DOCTYPE>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+function boom() {
+  let r = new Request("#a#a");
+  setTimeout(function(){
+    r.formData();
+    setTimeout(function(){
+      r.blob();
+    }, 0);
+  }, 0);
+}
+addEventListener("DOMContentLoaded", boom);
+</script>
+</head>
+</html>

--- a/dom/workers/test/crashtests/crashtests.list
+++ b/dom/workers/test/crashtests/crashtests.list
@@ -1,5 +1,6 @@
 load 779707.html
 load 943516.html
 load 1153636.html
 load 1158031.html
 load 1228456.html
+load 1348882.html

--- a/dom/xul/templates/nsIXULTemplateBuilder.idl
+++ b/dom/xul/templates/nsIXULTemplateBuilder.idl
@@ -1,25 +1,29 @@
 /* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "domstubs.idl"
 
-interface nsAtom;  // not a real interface; used in [noscript] methods only
 interface nsIContent;
 interface nsIXULBuilderListener;
 interface nsIXULTemplateResult;
 interface nsIXULTemplateRuleFilter;
 interface nsIXULTemplateQueryProcessor;
 interface nsIRDFResource;
 interface nsIRDFCompositeDataSource;
 interface nsIDOMDataTransfer;
 
+%{C++
+class nsAtom;
+%}
+[ptr] native nsAtomPtr(nsAtom);
+
 /**
  * A template builder, given an input source of data, a template, and a
  * reference point, generates a list of results from the input, and copies
  * part of the template for each result. Templates may generate content
  * recursively, using the same template, but with the previous iteration's
  * results as the reference point. As an example, for an XML datasource the
  * initial reference point would be a specific node in the DOM tree and a
  * template might generate a list of all child nodes. For the next iteration,
@@ -263,17 +267,17 @@ interface nsIXULTemplateBuilder : nsISup
      * intended to be called only by the RDF query processor. If aTag is set,
      * the content must have a tag name that matches aTag. aTag may be ignored
      * for builders that don't generate real DOM content.
      *
      * @param aNode node to check
      * @param aTag tag that must match
      */
     [noscript] boolean hasGeneratedContent(in nsIRDFResource aNode,
-                                           in nsAtom aTag);
+                                           in nsAtomPtr aTag);
 
     /**
      * Adds a rule filter for a given rule, which may be used for specialized
      * rule filtering. Any existing filter on the rule is removed. The default
      * conditions specified inside the <rule> tag are applied before the
      * rule filter is applied, meaning that the filter may be used to further
      * filter out results but not reaccept results that have already been
      * rejected.

--- a/dom/xul/templates/nsIXULTemplateQueryProcessor.idl
+++ b/dom/xul/templates/nsIXULTemplateQueryProcessor.idl
@@ -1,22 +1,26 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "domstubs.idl"
 
-interface nsAtom;  // not a real interface; used in [noscript] methods only
 interface nsIArray;
 interface nsISimpleEnumerator;
 interface nsIXULTemplateResult;
 interface nsIXULTemplateRuleFilter;
 interface nsIXULTemplateBuilder;
 
+%{C++
+class nsAtom;
+%}
+[ptr] native nsAtomPtr(nsAtom);
+
 /**
  * A query processor takes a template query and generates results for it given
  * a datasource and a reference point. There is a one-to-one relationship
  * between a template builder and a query processor. The template builder
  * creates the query processor, and there is no other means to retrieve it.
  *
  * A template query is the contents inside a <query> element within the
  * template. The actual syntax is opaque to the template builder and defined
@@ -159,18 +163,18 @@ interface nsIXULTemplateQueryProcessor :
    * @param aQuery <query> node to compile
    * @param aRefVariable the reference variable
    * @param aMemberVariable the member variable
    *
    * @returns a compiled query object
    */
   [noscript] nsISupports compileQuery(in nsIXULTemplateBuilder aBuilder,
                                       in nsIDOMNode aQuery,
-                                      in nsAtom aRefVariable,
-                                      in nsAtom aMemberVariable);
+                                      in nsAtomPtr aRefVariable,
+                                      in nsAtomPtr aMemberVariable);
 
   /**
    * Generate the results of a query and return them in an enumerator. The
    * enumerator must contain nsIXULTemplateResult objects. If there are no
    * results, an empty enumerator must be returned.
    *
    * The datasource will be the same as the one passed to the earlier
    * initializeForBuilding method. The context reference (aRef) is a reference
@@ -218,18 +222,18 @@ interface nsIXULTemplateQueryProcessor :
    * the syntax '+2' to mean add two to the reference.
    *
    * @param aRuleNode rule to add the binding to
    * @param aVar variable that will be bound
    * @param aRef variable that holds reference value
    * @param aExpr expression used to compute the value to assign
    */
   [noscript] void addBinding(in nsIDOMNode aRuleNode,
-                             in nsAtom aVar,
-                             in nsAtom aRef,
+                             in nsAtomPtr aVar,
+                             in nsAtomPtr aRef,
                              in AString aExpr);
 
   /**
    * Translate a ref attribute string into a result. This is used as the
    * reference point by the template builder when generating the first level
    * of content. For recursive generation, the result from the parent
    * generation phase will be used directly as the reference so a translation
    * is not needed. This allows all levels to be generated using objects that
@@ -266,11 +270,11 @@ interface nsIXULTemplateQueryProcessor :
    * @param aLeft the left result to compare
    * @param aRight the right result to compare
    * @param aVar variable to compare
    *
    * @param returns -1 if less, 0 if equal, or 1 if greater
    */
    [noscript] int32_t compareResults(in nsIXULTemplateResult aLeft,
                                      in nsIXULTemplateResult aRight,
-                                     in nsAtom aVar,
+                                     in nsAtomPtr aVar,
                                      in unsigned long aSortHints);
 };

--- a/dom/xul/templates/nsIXULTemplateResult.idl
+++ b/dom/xul/templates/nsIXULTemplateResult.idl
@@ -1,19 +1,23 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsISupports.idl"
 
-interface nsAtom;  // not a real interface; used in [noscript] methods only
 interface nsIDOMNode;
 interface nsIRDFResource;
 
+%{C++
+class nsAtom;
+%}
+[ptr] native nsAtomPtr(nsAtom);
+
 /**
  * A single result generated from a template query. Each result is identified
  * by an id, which must be unique within the set of results produced from a
  * query. The result may optionally be identified by an RDF resource.
  *
  * Generally, the result and its id will be able to uniquely identify a node
  * in the source data, such as an RDF or XML node. In other contexts, such as
  * a database query, a result would represent a particular record.
@@ -75,30 +79,30 @@ interface nsIXULTemplateResult : nsISupp
    * attribute within the action body, it will be replaced with the result
    * of this method. The question mark is considered part of the variable
    * name, thus aVar should be ?name and not simply name.
    *
    * @param aVar the variable to look up
    *
    * @return the value for the variable or a null string if it has no value
    */
-  [noscript] AString getBindingFor(in nsAtom aVar);
+  [noscript] AString getBindingFor(in nsAtomPtr aVar);
 
   /**
    * Get an object value for a variable such as ?name for this result. 
    *
    * This method may return null for a variable, even if getBindingFor returns
    * a non-null value for the same variable. This method is provided as a
    * convenience when sorting results.
    *
    * @param aVar the variable to look up
    *
    * @return the value for the variable or null if it has no value
    */
-  [noscript] nsISupports getBindingObjectFor(in nsAtom aVar);
+  [noscript] nsISupports getBindingObjectFor(in nsAtomPtr aVar);
 
   /**
    * Indicate that a particular rule of a query has matched and that output
    * will be generated for it. Both the query as compiled by the query
    * processor's compileQuery method and the XUL <rule> element are supplied.
    * The query must always be one that was compiled by the query processor
    * that created this result. The <rule> element must always be a child of
    * the <query> element that was used to compile the query.

new file mode 100644
--- /dev/null
+++ b/editor/libeditor/crashtests/1383747.html
@@ -0,0 +1,15 @@
+<html>
+  <head>
+    <script>
+      try { o1 = window.getSelection() } catch(e) { }
+      try { o2 = document.createElement('map') } catch(e) { };
+      try { o3 = document.createElement('select') } catch(e) { }
+      try { document.documentElement.appendChild(o2) } catch(e) { };
+      try { o2.contentEditable = 'true' } catch(e) { };
+      try { o2.offsetTop } catch(e) { };
+      try { document.replaceChild(document.implementation.createHTMLDocument().documentElement, document.documentElement); } catch(e) { }
+      try { document.documentElement.appendChild(o3) } catch(e) { }
+      try { o1.modify('extend', 'forward', 'word') } catch(e) { }
+    </script>
+  </head>
+</html>
\ No newline at end of file

new file mode 100644
--- /dev/null
+++ b/editor/libeditor/crashtests/1383763.html
@@ -0,0 +1,17 @@
+<xsl:stylesheet id='xsl'>
+<script id='script'>
+try { o1 = document.createElement('table') } catch(e) { }
+try { o3 = document.createElement('area') } catch(e) { }
+try { o4 = document.createElement('script'); } catch(e) { }
+try { o5 = document.getSelection() } catch(e) { }
+try { document.implementation.createDocument('', '', null).adoptNode(o1); } catch(e) { }
+try { o1.appendChild(o3) } catch(e) { }
+try { o5.addRange(new Range()); } catch(e) { }
+try { document.documentElement.appendChild(o4) } catch(e) { }
+try { o4.textContent = 'XX' } catch(e) { }
+try { o7 = o4.firstChild } catch(e) { }
+try { o4.parentNode.insertBefore(o7, o4); } catch(e) { }
+try { o5.modify('extend', 'forward', 'line') } catch(e) { }
+try { o5.selectAllChildren(o3) } catch(e) { }
+try { o7.splitText(1) } catch(e) { }
+</script>
\ No newline at end of file

new file mode 100644
--- /dev/null
+++ b/editor/libeditor/crashtests/1384161.html
@@ -0,0 +1,17 @@
+<html>
+  <head>
+    <script>
+      try { o1 = document.createElement('caption') } catch(e) { }
+      try { o2 = document.createElement('select') } catch(e) { }
+      try { o3 = document.createElement('map') } catch(e) { }
+      try { o4 = window.getSelection() } catch(e) { }
+      try { document.documentElement.appendChild(o1) } catch(e) { }
+      try { o1.style.display = 'contents' } catch(e) { }
+      try { document.prepend(o2, document) } catch(e) { }
+      try { document.designMode = 'on'; } catch(e) { }
+      try { o3.ownerDocument.execCommand('outdent', false, null) } catch(e) { }
+      try { document.designMode = 'off'; } catch(e) { }
+      try { o4.extend(o2, 0) } catch(e) { }
+    </script>
+  </head>
+</html>
\ No newline at end of file

new file mode 100644
--- /dev/null
+++ b/editor/libeditor/crashtests/1393171.html
@@ -0,0 +1,10 @@
+<script>
+window.onload=function(){
+  window.getSelection().addRange(document.createRange());
+  document.getElementById('a').appendChild(document.createElement('option'));
+  window.getSelection().modify('extend','backward','lineboundary');
+}
+</script>
+<div></div>
+<textarea autofocus='true'></textarea>
+<del id='a'>

--- a/editor/libeditor/crashtests/crashtests.list
+++ b/editor/libeditor/crashtests/crashtests.list
@@ -75,13 +75,17 @@ load 1324505.html
 needs-focus load 1343918.html
 load 1345015.html
 load 1348851.html
 load 1350772.html
 load 1364133.html
 load 1366176.html
 load 1375131.html
 load 1381541.html
+load 1383747.html
 load 1383755.html
+load 1383763.html
+load 1384161.html
 load 1388075.html
+load 1393171.html
 load 1402469.html
 load 1402904.html
 load 1405747.html

--- a/gfx/harfbuzz/src/hb-shape-plan.cc
+++ b/gfx/harfbuzz/src/hb-shape-plan.cc
@@ -515,25 +515,27 @@ hb_shape_plan_create_cached2 (hb_face_t 
 
     if (unlikely (!proposal.shaper_func))
       return hb_shape_plan_get_empty ();
   }
 
 
 retry:
   hb_face_t::plan_node_t *cached_plan_nodes = (hb_face_t::plan_node_t *) hb_atomic_ptr_get (&face->shape_plans);
-  for (hb_face_t::plan_node_t *node = cached_plan_nodes; node; node = node->next)
-    if (hb_shape_plan_matches (node->shape_plan, &proposal))
-    {
-      DEBUG_MSG_FUNC (SHAPE_PLAN, node->shape_plan, "fulfilled from cache");
-      return hb_shape_plan_reference (node->shape_plan);
-    }
+
+  /* Don't look for plan in the cache if there were variation coordinates XXX Fix me. */
+  if (!hb_coords_present (coords, num_coords))
+    for (hb_face_t::plan_node_t *node = cached_plan_nodes; node; node = node->next)
+      if (hb_shape_plan_matches (node->shape_plan, &proposal))
+      {
+        DEBUG_MSG_FUNC (SHAPE_PLAN, node->shape_plan, "fulfilled from cache");
+        return hb_shape_plan_reference (node->shape_plan);
+      }
 
   /* Not found. */
-
   hb_shape_plan_t *shape_plan = hb_shape_plan_create2 (face, props,
 						       user_features, num_user_features,
 						       coords, num_coords,
 						       shaper_list);
 
   /* Don't add to the cache if face is inert. */
   if (unlikely (hb_object_is_inert (face)))
     return shape_plan;

--- a/gfx/layers/ipc/PWebRenderBridge.ipdl
+++ b/gfx/layers/ipc/PWebRenderBridge.ipdl
@@ -54,16 +54,19 @@ parent:
                        WebRenderScrollData aScrollData,
                        OpUpdateResource[] aResourceUpdates, Shmem[] aSmallShmems, Shmem[] aLargeShmems,
                        IdNamespace aIdNamespace, TimeStamp txnStartTime, TimeStamp fwdTime);
   sync SetDisplayListSync(IntSize aSize, WebRenderParentCommand[] commands, OpDestroy[] toDestroy, uint64_t fwdTransactionId, uint64_t transactionId,
                           LayoutSize aContentSize, ByteBuffer aDL, BuiltDisplayListDescriptor aDLDesc,
                           WebRenderScrollData aScrollData,
                           OpUpdateResource[] aResourceUpdates, Shmem[] aSmallShmems, Shmem[] aLargeShmems,
                           IdNamespace aIdNamespace, TimeStamp txnStartTime, TimeStamp fwdTime);
+  async EmptyTransaction(FocusTarget focusTarget,
+                         WebRenderParentCommand[] commands, OpDestroy[] toDestroy, uint64_t fwdTransactionId, uint64_t transactionId,
+                         IdNamespace aIdNamespace, TimeStamp txnStartTime, TimeStamp fwdTime);
   async SetFocusTarget(FocusTarget focusTarget);
   async UpdateResources(OpUpdateResource[] aResourceUpdates, Shmem[] aSmallShmems, Shmem[] aLargeShmems);
   async ParentCommands(WebRenderParentCommand[] commands);
   sync GetSnapshot(PTexture texture);
   async AddPipelineIdForCompositable(PipelineId aImageId, CompositableHandle aHandle, bool aAsync);
   async RemovePipelineIdForCompositable(PipelineId aPipelineId);
   async AddExternalImageIdForCompositable(ExternalImageId aImageId, CompositableHandle aHandle);
   async RemoveExternalImageId(ExternalImageId aImageId);

--- a/gfx/layers/wr/IpcResourceUpdateQueue.cpp
+++ b/gfx/layers/wr/IpcResourceUpdateQueue.cpp
@@ -36,20 +36,28 @@ ShmSegmentsWriter::Write(Range<uint8_t> 
     memcpy(dstPtr, aBytes.begin().get(), length);
     return range;
   }
 
   int remainingBytesToCopy = length;
 
   size_t srcCursor = 0;
   size_t dstCursor = mCursor;
+  size_t currAllocLen = mSmallAllocs.Length();
 
   while (remainingBytesToCopy > 0) {
     if (dstCursor >= mSmallAllocs.Length() * mChunkSize) {
-      AllocChunk();
+      if (!AllocChunk()) {
+        for (size_t i = mSmallAllocs.Length() ; currAllocLen <= i ; i--) {
+          ipc::Shmem shm = mSmallAllocs.ElementAt(i);
+          mShmAllocator->DeallocShmem(shm);
+          mSmallAllocs.RemoveElementAt(i);
+        }
+        return layers::OffsetRange(0, start, 0);
+      }
       continue;
     }
 
     const size_t dstMaxOffset = mChunkSize * mSmallAllocs.Length();
     const size_t dstBaseOffset = mChunkSize * (mSmallAllocs.Length() - 1);
 
     MOZ_ASSERT(dstCursor >= dstBaseOffset);
     MOZ_ASSERT(dstCursor <= dstMaxOffset);
@@ -70,36 +78,39 @@ ShmSegmentsWriter::Write(Range<uint8_t> 
     MOZ_ASSERT(remainingBytesToCopy >= 0);
   }
 
   mCursor += length;
 
   return layers::OffsetRange(0, start, length);
 }
 
-void
+bool
 ShmSegmentsWriter::AllocChunk()
 {
   ipc::Shmem shm;
   auto shmType = ipc::SharedMemory::SharedMemoryType::TYPE_BASIC;
   if (!mShmAllocator->AllocShmem(mChunkSize, shmType, &shm)) {
-    gfxCriticalError() << "ShmSegmentsWriter failed to allocate chunk #" << mSmallAllocs.Length();
-    MOZ_CRASH();
+    gfxCriticalNote << "ShmSegmentsWriter failed to allocate chunk #" << mSmallAllocs.Length();
+    MOZ_ASSERT(false, "ShmSegmentsWriter fails to allocate chunk");
+    return false;
   }
   mSmallAllocs.AppendElement(shm);
+  return true;
 }
 
 layers::OffsetRange
 ShmSegmentsWriter::AllocLargeChunk(size_t aSize)
 {
   ipc::Shmem shm;
   auto shmType = ipc::SharedMemory::SharedMemoryType::TYPE_BASIC;
   if (!mShmAllocator->AllocShmem(aSize, shmType, &shm)) {
-    gfxCriticalError() << "ShmSegmentsWriter failed to allocate large chunk of size " << aSize;
-    MOZ_CRASH();
+    gfxCriticalNote << "ShmSegmentsWriter failed to allocate large chunk of size " << aSize;
+    MOZ_ASSERT(false, "ShmSegmentsWriter fails to allocate large chunk");
+    return layers::OffsetRange(0, 0, 0);
   }
   mLargeAllocs.AppendElement(shm);
 
   return layers::OffsetRange(mLargeAllocs.Length(), 0, aSize);
 }
 
 void
 ShmSegmentsWriter::Flush(nsTArray<ipc::Shmem>& aSmallAllocs, nsTArray<ipc::Shmem>& aLargeAllocs)
@@ -217,67 +228,87 @@ ShmSegmentsReader::Read(const layers::Of
   return aInto.Length() - initialLength == aRange.length();
 }
 
 IpcResourceUpdateQueue::IpcResourceUpdateQueue(ipc::IShmemAllocator* aAllocator,
                                                size_t aChunkSize)
 : mWriter(Move(aAllocator), aChunkSize)
 {}
 
-void
+bool
 IpcResourceUpdateQueue::AddImage(ImageKey key, const ImageDescriptor& aDescriptor,
                                  Range<uint8_t> aBytes)
 {
   auto bytes = mWriter.Write(aBytes);
+  if (!bytes.length()) {
+    return false;
+  }
   mUpdates.AppendElement(layers::OpAddImage(aDescriptor, bytes, 0, key));
+  return true;
 }
 
-void
+bool
 IpcResourceUpdateQueue::AddBlobImage(ImageKey key, const ImageDescriptor& aDescriptor,
                                      Range<uint8_t> aBytes)
 {
   auto bytes = mWriter.Write(aBytes);
+  if (!bytes.length()) {
+    return false;
+  }
   mUpdates.AppendElement(layers::OpAddBlobImage(aDescriptor, bytes, 0, key));
+  return true;
 }
 
 void
 IpcResourceUpdateQueue::AddExternalImage(wr::ExternalImageId aExtId, wr::ImageKey aKey)
 {
   mUpdates.AppendElement(layers::OpAddExternalImage(aExtId, aKey));
 }
 
-void
+bool
 IpcResourceUpdateQueue::UpdateImageBuffer(ImageKey aKey,
                                           const ImageDescriptor& aDescriptor,
                                           Range<uint8_t> aBytes)
 {
   auto bytes = mWriter.Write(aBytes);
+  if (!bytes.length()) {
+    return false;
+  }
   mUpdates.AppendElement(layers::OpUpdateImage(aDescriptor, bytes, aKey));
+  return true;
 }
 
-void
+bool
 IpcResourceUpdateQueue::UpdateBlobImage(ImageKey aKey,
                                         const ImageDescriptor& aDescriptor,
                                         Range<uint8_t> aBytes)
 {
   auto bytes = mWriter.Write(aBytes);
+  if (!bytes.length()) {
+    return false;
+  }
   mUpdates.AppendElement(layers::OpUpdateBlobImage(aDescriptor, bytes, aKey));
+  return true;
 }
 
 void
 IpcResourceUpdateQueue::DeleteImage(ImageKey aKey)
 {
   mUpdates.AppendElement(layers::OpDeleteImage(aKey));
 }
 
-void
+bool
 IpcResourceUpdateQueue::AddRawFont(wr::FontKey aKey, Range<uint8_t> aBytes, uint32_t aIndex)
 {
   auto bytes = mWriter.Write(aBytes);
+  if (!bytes.length()) {
+    return false;
+  }
   mUpdates.AppendElement(layers::OpAddRawFont(bytes, aIndex, aKey));
+  return true;
 }
 
 void
 IpcResourceUpdateQueue::DeleteFont(wr::FontKey aKey)
 {
   mUpdates.AppendElement(layers::OpDeleteFont(aKey));
 }
 

--- a/gfx/layers/wr/IpcResourceUpdateQueue.h
+++ b/gfx/layers/wr/IpcResourceUpdateQueue.h
@@ -29,17 +29,17 @@ public:
     return Write(Range<uint8_t>((uint8_t*)aValues.begin().get(), aValues.length() * sizeof(T)));
   }
 
   void Flush(nsTArray<ipc::Shmem>& aSmallAllocs, nsTArray<ipc::Shmem>& aLargeAllocs);
 
   void Clear();
 
 protected:
-  void AllocChunk();
+  bool AllocChunk();
   layers::OffsetRange AllocLargeChunk(size_t aSize);
 
   nsTArray<ipc::Shmem> mSmallAllocs;
   nsTArray<ipc::Shmem> mLargeAllocs;
   ipc::IShmemAllocator* mShmAllocator;
   size_t mCursor;
   size_t mChunkSize;
 };
@@ -62,43 +62,43 @@ protected:
 class IpcResourceUpdateQueue {
 public:
   // Because we are using shmems, the size should be a multiple of the page size.
   // Each shmem has two guard pages, and the minimum shmem size (at least one Windows)
   // is 64k which is already quite large for a lot of the resources we use here.
   // So we pick 64k - 2 * 4k = 57344 bytes as the defautl alloc
   explicit IpcResourceUpdateQueue(ipc::IShmemAllocator* aAllocator, size_t aChunkSize = 57344);
 
-  void AddImage(wr::ImageKey aKey,
+  bool AddImage(wr::ImageKey aKey,
                 const ImageDescriptor& aDescriptor,
                 Range<uint8_t> aBytes);
 
-  void AddBlobImage(wr::ImageKey aKey,
+  bool AddBlobImage(wr::ImageKey aKey,
                     const ImageDescriptor& aDescriptor,
                     Range<uint8_t> aBytes);
 
   void AddExternalImage(wr::ExternalImageId aExtId, wr::ImageKey aKey);
 
-  void UpdateImageBuffer(wr::ImageKey aKey,
+  bool UpdateImageBuffer(wr::ImageKey aKey,
                          const ImageDescriptor& aDescriptor,
                          Range<uint8_t> aBytes);
 
-  void UpdateBlobImage(wr::ImageKey aKey,
+  bool UpdateBlobImage(wr::ImageKey aKey,
                        const ImageDescriptor& aDescriptor,
                        Range<uint8_t> aBytes);
 
   void UpdateExternalImage(ImageKey aKey,
                            const ImageDescriptor& aDescriptor,
                            ExternalImageId aExtID,
                            wr::WrExternalImageBufferType aBufferType,
                            uint8_t aChannelIndex = 0);
 
   void DeleteImage(wr::ImageKey aKey);
 
-  void AddRawFont(wr::FontKey aKey, Range<uint8_t> aBytes, uint32_t aIndex);
+  bool AddRawFont(wr::FontKey aKey, Range<uint8_t> aBytes, uint32_t aIndex);
 
   void DeleteFont(wr::FontKey aKey);
 
   void AddFontInstance(wr::FontInstanceKey aKey,
                        wr::FontKey aFontKey,
                        float aGlyphSize,
                        const wr::FontInstanceOptions* aOptions,
                        const wr::FontInstancePlatformOptions* aPlatformOptions,

--- a/gfx/layers/wr/WebRenderBridgeChild.cpp
+++ b/gfx/layers/wr/WebRenderBridgeChild.cpp
@@ -153,16 +153,38 @@ WebRenderBridgeChild::EndTransaction(con
   }
 
   mParentCommands.Clear();
   mDestroyedActors.Clear();
   mIsInTransaction = false;
 }
 
 void
+WebRenderBridgeChild::EndEmptyTransaction(const FocusTarget& aFocusTarget,
+                                          uint64_t aTransactionId,
+                                          const mozilla::TimeStamp& aTxnStartTime)
+{
+  MOZ_ASSERT(!mDestroyed);
+  MOZ_ASSERT(mIsInTransaction);
+
+  TimeStamp fwdTime;
+#if defined(ENABLE_FRAME_LATENCY_LOG)
+  fwdTime = TimeStamp::Now();
+#endif
+
+  this->SendEmptyTransaction(aFocusTarget,
+                             mParentCommands, mDestroyedActors,
+                             GetFwdTransactionId(), aTransactionId,
+                             mIdNamespace, aTxnStartTime, fwdTime);
+  mParentCommands.Clear();
+  mDestroyedActors.Clear();
+  mIsInTransaction = false;
+}
+
+void
 WebRenderBridgeChild::ProcessWebRenderParentCommands()
 {
   MOZ_ASSERT(!mDestroyed);
 
   if (mParentCommands.IsEmpty()) {
     return;
   }
   this->SendParentCommands(mParentCommands);

--- a/gfx/layers/wr/WebRenderBridgeChild.h
+++ b/gfx/layers/wr/WebRenderBridgeChild.h
@@ -70,16 +70,19 @@ public:
   void BeginTransaction();
   void EndTransaction(const wr::LayoutSize& aContentSize,
                       wr::BuiltDisplayList& dl,
                       wr::IpcResourceUpdateQueue& aResources,
                       const gfx::IntSize& aSize,
                       bool aIsSync, uint64_t aTransactionId,
                       const WebRenderScrollData& aScrollData,
                       const mozilla::TimeStamp& aTxnStartTime);
+  void EndEmptyTransaction(const FocusTarget& aFocusTarget,
+                           uint64_t aTransactionId,
+                           const mozilla::TimeStamp& aTxnStartTime);
   void ProcessWebRenderParentCommands();
 
   CompositorBridgeChild* GetCompositorBridgeChild();
 
   wr::PipelineId GetPipeline() { return mPipelineId; }
 
   // KnowsCompositor
   TextureForwarder* GetTextureForwarder() override;

--- a/gfx/layers/wr/WebRenderBridgeParent.cpp
+++ b/gfx/layers/wr/WebRenderBridgeParent.cpp
@@ -610,16 +610,58 @@ WebRenderBridgeParent::RecvSetDisplayLis
   return RecvSetDisplayList(aSize, Move(aCommands), Move(aToDestroy),
                             aFwdTransactionId, aTransactionId,
                             aContentSize, dl, dlDesc, aScrollData,
                             Move(aResourceUpdates), Move(aSmallShmems), Move(aLargeShmems),
                             aIdNamespace, aTxnStartTime, aFwdTime);
 }
 
 mozilla::ipc::IPCResult
+WebRenderBridgeParent::RecvEmptyTransaction(const FocusTarget& aFocusTarget,
+                                            InfallibleTArray<WebRenderParentCommand>&& aCommands,
+                                            InfallibleTArray<OpDestroy>&& aToDestroy,
+                                            const uint64_t& aFwdTransactionId,
+                                            const uint64_t& aTransactionId,
+                                            const wr::IdNamespace& aIdNamespace,
+                                            const TimeStamp& aTxnStartTime,
+                                            const TimeStamp& aFwdTime)
+{
+  if (mDestroyed) {
+    for (const auto& op : aToDestroy) {
+      DestroyActor(op);
+    }
+    return IPC_OK();
+  }
+
+  AutoProfilerTracing tracing("Paint", "EmptyTransaction");
+  UpdateFwdTransactionId(aFwdTransactionId);
+  AutoClearReadLocks clearLocks(mReadLocks);
+
+  // This ensures that destroy operations are always processed. It is not safe
+  // to early-return without doing so.
+  AutoWebRenderBridgeParentAsyncMessageSender autoAsyncMessageSender(this, &aToDestroy);
+
+  if (!aCommands.IsEmpty()) {
+    mAsyncImageManager->SetCompositionTime(TimeStamp::Now());
+    ProcessWebRenderParentCommands(aCommands);
+    mCompositorScheduler->ScheduleComposition();
+  }
+
+  mScrollData.SetFocusTarget(aFocusTarget);
+  UpdateAPZ(false);
+
+  // XXX Call DidComposite at correct timing.
+  TimeStamp now = TimeStamp::Now();
+  HoldPendingTransactionId(mWrEpoch, aTransactionId, aTxnStartTime, aFwdTime);
+  mCompositorBridge->DidComposite(wr::AsUint64(mPipelineId), now, now);
+
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult
 WebRenderBridgeParent::RecvSetFocusTarget(const FocusTarget& aFocusTarget)
 {
   mScrollData.SetFocusTarget(aFocusTarget);
   UpdateAPZ(false);
   return IPC_OK();
 }
 
 mozilla::ipc::IPCResult

--- a/gfx/layers/wr/WebRenderBridgeParent.h
+++ b/gfx/layers/wr/WebRenderBridgeParent.h
@@ -101,16 +101,24 @@ public:
                                                  const wr::BuiltDisplayListDescriptor& dlDesc,
                                                  const WebRenderScrollData& aScrollData,
                                                  nsTArray<OpUpdateResource>&& aResourceUpdates,
                                                  nsTArray<ipc::Shmem>&& aSmallShmems,
                                                  nsTArray<ipc::Shmem>&& aLargeShmems,
                                                  const wr::IdNamespace& aIdNamespace,
                                                  const TimeStamp& aTxnStartTime,
                                                  const TimeStamp& aFwdTime) override;
+  mozilla::ipc::IPCResult RecvEmptyTransaction(const FocusTarget& aFocusTarget,
+                                               InfallibleTArray<WebRenderParentCommand>&& aCommands,
+                                               InfallibleTArray<OpDestroy>&& aToDestroy,
+                                               const uint64_t& aFwdTransactionId,
+                                               const uint64_t& aTransactionId,
+                                               const wr::IdNamespace& aIdNamespace,
+                                               const TimeStamp& aTxnStartTime,
+                                               const TimeStamp& aFwdTime) override;
   mozilla::ipc::IPCResult RecvSetFocusTarget(const FocusTarget& aFocusTarget) override;
   mozilla::ipc::IPCResult RecvParentCommands(nsTArray<WebRenderParentCommand>&& commands) override;
   mozilla::ipc::IPCResult RecvGetSnapshot(PTextureParent* aTexture) override;
 
   mozilla::ipc::IPCResult RecvAddPipelineIdForCompositable(const wr::PipelineId& aPipelineIds,
                                                            const CompositableHandle& aHandle,
                                                            const bool& aAsync) override;
   mozilla::ipc::IPCResult RecvRemovePipelineIdForCompositable(const wr::PipelineId& aPipelineId) override;

--- a/gfx/layers/wr/WebRenderCommandBuilder.cpp
+++ b/gfx/layers/wr/WebRenderCommandBuilder.cpp
@@ -27,16 +27,33 @@ namespace layers {
 
 void WebRenderCommandBuilder::Destroy()
 {
   mLastCanvasDatas.Clear();
   RemoveUnusedAndResetWebRenderUserData();
 }
 
 void
+WebRenderCommandBuilder::EmptyTransaction()
+{
+  // We need to update canvases that might have changed.
+  for (auto iter = mLastCanvasDatas.Iter(); !iter.Done(); iter.Next()) {
+    RefPtr<WebRenderCanvasData> canvasData = iter.Get()->GetKey();
+    WebRenderCanvasRendererAsync* canvas = canvasData->GetCanvasRenderer();
+    canvas->UpdateCompositableClient();
+  }
+}
+
+bool
+WebRenderCommandBuilder::NeedsEmptyTransaction()
+{
+  return !mLastCanvasDatas.IsEmpty();
+}
+
+void
 WebRenderCommandBuilder::BuildWebRenderCommands(wr::DisplayListBuilder& aBuilder,
                                                 wr::IpcResourceUpdateQueue& aResourceUpdates,
                                                 nsDisplayList* aDisplayList,
                                                 nsDisplayListBuilder* aDisplayListBuilder,
                                                 WebRenderScrollData& aScrollData,
                                                 wr::LayoutSize& aContentSize)
 {
   { // scoping for StackingContextHelper RAII
@@ -494,17 +511,19 @@ WebRenderCommandBuilder::GenerateFallbac
       RefPtr<gfx::DrawTarget> dt = gfx::Factory::CreateRecordingDrawTarget(recorder, dummyDt, paintSize.ToUnknownSize());
       PaintItemByDrawTarget(aItem, dt, paintRect, offset, aDisplayListBuilder,
                             fallbackData->mBasicLayerManager, mManager, scale);
       recorder->Finish();
 
       Range<uint8_t> bytes((uint8_t*)recorder->mOutputStream.mData, recorder->mOutputStream.mLength);
       wr::ImageKey key = mManager->WrBridge()->GetNextImageKey();
       wr::ImageDescriptor descriptor(paintSize.ToUnknownSize(), 0, dt->GetFormat(), isOpaque);
-      aResources.AddBlobImage(key, descriptor, bytes);
+      if (!aResources.AddBlobImage(key, descriptor, bytes)) {
+        return nullptr;
+      }
       fallbackData->SetKey(key);
     } else {
       fallbackData->CreateImageClientIfNeeded();
       RefPtr<ImageClient> imageClient = fallbackData->GetImageClient();
       RefPtr<ImageContainer> imageContainer = LayerManager::CreateImageContainer();
 
       {
         UpdateImageHelper helper(imageContainer, imageClient, paintSize.ToUnknownSize(), format);

--- a/gfx/layers/wr/WebRenderCommandBuilder.h
+++ b/gfx/layers/wr/WebRenderCommandBuilder.h
@@ -35,16 +35,20 @@ class WebRenderCommandBuilder {
 public:
   explicit WebRenderCommandBuilder(WebRenderLayerManager* aManager)
   : mManager(aManager)
   , mLastAsr(nullptr)
   {}
 
   void Destroy();
 
+  void EmptyTransaction();
+
+  bool NeedsEmptyTransaction();
+
   void BuildWebRenderCommands(wr::DisplayListBuilder& aBuilder,
                               wr::IpcResourceUpdateQueue& aResourceUpdates,
                               nsDisplayList* aDisplayList,
                               nsDisplayListBuilder* aDisplayListBuilder,
                               WebRenderScrollData& aScrollData,
                               wr::LayoutSize& aContentSize);
 
   Maybe<wr::ImageKey> CreateImageKey(nsDisplayItem* aItem,

--- a/gfx/layers/wr/WebRenderLayerManager.cpp
+++ b/gfx/layers/wr/WebRenderLayerManager.cpp
@@ -173,31 +173,48 @@ WebRenderLayerManager::BeginTransaction(
 
 bool
 WebRenderLayerManager::EndEmptyTransaction(EndTransactionFlags aFlags)
 {
   // With the WebRenderLayerManager we reject attempts to set most kind of
   // "pending data" for empty transactions. Any place that attempts to update
   // transforms or scroll offset, for example, will get failure return values
   // back, and will fall back to a full transaction. Therefore the only piece
-  // of "pending" information we need to send in an empty transaction is the
-  // APZ focus state.
-  WrBridge()->SendSetFocusTarget(mFocusTarget);
+  // of "pending" information we need to send in an empty transaction are the
+  // APZ focus state and canvases's CompositableOperations.
+
+  if (aFlags & EndTransactionFlags::END_NO_COMPOSITE && 
+      !mWebRenderCommandBuilder.NeedsEmptyTransaction()) {
+    MOZ_ASSERT(!mTarget);
+    WrBridge()->SendSetFocusTarget(mFocusTarget);
+    return true;
+  }
+
+  LayoutDeviceIntSize size = mWidget->GetClientSize();
+  WrBridge()->BeginTransaction();
+
+  mWebRenderCommandBuilder.EmptyTransaction();
 
-  // We also need to update canvases that might have changed, but this code
-  // as-is causes crashes so comment it out for now.
-  //for (auto iter = mLastCanvasDatas.Iter(); !iter.Done(); iter.Next()) {
-  //  RefPtr<WebRenderCanvasData> canvasData = iter.Get()->GetKey();
-  //  WebRenderCanvasRendererAsync* canvas = canvasData->GetCanvasRenderer();
-  //  canvas->UpdateCompositableClient();
-  //}
+  WrBridge()->ClearReadLocks();
+
+  mLatestTransactionId = mTransactionIdAllocator->GetTransactionId(/*aThrottle*/ true);
+  TimeStamp transactionStart = mTransactionIdAllocator->GetTransactionStart();
 
-  if (!(aFlags & EndTransactionFlags::END_NO_COMPOSITE)) {
-    ScheduleComposite();
+  // Skip the synchronization for buffer since we also skip the painting during
+  // device-reset status.
+  if (!gfxPlatform::GetPlatform()->DidRenderingDeviceReset()) {
+    if (WrBridge()->GetSyncObject() &&
+        WrBridge()->GetSyncObject()->IsSyncObjectValid()) {
+      WrBridge()->GetSyncObject()->Synchronize();
+    }
   }
+
+  WrBridge()->EndEmptyTransaction(mFocusTarget, mLatestTransactionId, transactionStart);
+
+  MakeSnapshotIfRequired(size);
   return true;
 }
 
 /*static*/ int32_t
 PopulateScrollData(WebRenderScrollData& aTarget, Layer* aLayer)
 {
   MOZ_ASSERT(aLayer);
 

new file mode 100644
--- /dev/null
+++ b/gfx/tests/crashtests/1278305.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+<style>
+body {
+  mask: url(#mymask);
+}
+div::after {
+  content: counter(n);
+}
+</style>
+<script>
+window.onload = function(){
+  document.getElementsByTagName('body')[0].animate(
+    [{"transform": "skewy(11rad)"},
+     {"transform": "rotatex(0.125turn)"}],
+    {"fill":"forwards", "iterations": 0.75, "duration": 1});
+};
+</script></head>
+<body><div></div></body>
+</html>

--- a/gfx/tests/crashtests/crashtests.list
+++ b/gfx/tests/crashtests/crashtests.list
@@ -126,13 +126,14 @@ skip-if(webrender&&debug) load 944579.ht
 pref(security.fileuri.strict_origin_policy,false) load 950000.html
 load 1034403-1.html
 load 1056516.html
 load 1205900.html
 load 1134549-1.svg
 load balinese-letter-spacing.html
 load 1216832-1.html
 load 1225125-1.html
+load 1278305.html
 load 1308394.html
 load 1317403-1.html # bug 1331533
 load 1325159-1.html
 load 1331683.html
 skip-if(Android) pref(dom.disable_open_during_load,false) load 1343666.html

--- a/gfx/thebes/gfxHarfBuzzShaper.cpp
+++ b/gfx/thebes/gfxHarfBuzzShaper.cpp
@@ -1278,16 +1278,25 @@ gfxHarfBuzzShaper::Initialize()
                                 HB_BUFFER_CLUSTER_LEVEL_MONOTONE_CHARACTERS);
 
     mHBFont = hb_font_create(mHBFace);
     hb_font_set_funcs(mHBFont, sHBFontFuncs, &mCallbackData, nullptr);
     hb_font_set_ppem(mHBFont, mFont->GetAdjustedSize(), mFont->GetAdjustedSize());
     uint32_t scale = FloatToFixed(mFont->GetAdjustedSize()); // 16.16 fixed-point
     hb_font_set_scale(mHBFont, scale, scale);
 
+    const auto& vars = mFont->GetStyle()->variationSettings;
+    size_t len = vars.Length();
+    if (len > 0) {
+        // Fortunately, the hb_variation_t struct is compatible with our
+        // gfxFontFeature, so we can simply cast here.
+        auto hbVars = reinterpret_cast<const hb_variation_t*>(vars.Elements());
+        hb_font_set_variations(mHBFont, hbVars, len);
+    }
+
     return true;
 }
 
 bool
 gfxHarfBuzzShaper::LoadHmtxTable()
 {
     // Read mNumLongHMetrics from metrics-head table without caching its
     // blob, and preload/cache the metrics table.

--- a/js/src/gc/GCRuntime.h
+++ b/js/src/gc/GCRuntime.h
@@ -29,16 +29,17 @@ class AutoLockGC;
 class AutoLockHelperThreadState;
 class VerifyPreTracer;
 
 namespace gc {
 
 typedef Vector<ZoneGroup*, 4, SystemAllocPolicy> ZoneGroupVector;
 using BlackGrayEdgeVector = Vector<TenuredCell*, 0, SystemAllocPolicy>;
 
+class AutoCallGCCallbacks;
 class AutoMaybeStartBackgroundAllocation;
 class AutoRunParallelTask;
 class AutoTraceSession;
 class MarkingValidator;
 struct MovingTracer;
 class WeakCacheSweepIterator;
 
 enum IncrementalProgress
@@ -1045,16 +1046,20 @@ class GCRuntime
     gcstats::ZoneGCStats scanZonesBeforeGC();
     void collect(bool nonincrementalByAPI, SliceBudget budget, JS::gcreason::Reason reason) JS_HAZ_GC_CALL;
     MOZ_MUST_USE IncrementalResult gcCycle(bool nonincrementalByAPI, SliceBudget& budget,
                                            JS::gcreason::Reason reason);
     bool shouldRepeatForDeadZone(JS::gcreason::Reason reason);
     void incrementalCollectSlice(SliceBudget& budget, JS::gcreason::Reason reason,
                                  AutoLockForExclusiveAccess& lock);
 
+    friend class AutoCallGCCallbacks;
+    void maybeCallBeginCallback();
+    void maybeCallEndCallback();
+
     void pushZealSelectedObjects();
     void purgeRuntime(AutoLockForExclusiveAccess& lock);
     MOZ_MUST_USE bool beginMarkPhase(JS::gcreason::Reason reason, AutoLockForExclusiveAccess& lock);
     bool prepareZonesForCollection(JS::gcreason::Reason reason, bool* isFullOut,
                                    AutoLockForExclusiveAccess& lock);
     bool shouldPreserveJITCode(JSCompartment* comp, int64_t currentTime,
                                JS::gcreason::Reason reason, bool canAllocateMoreCode);
     void traceRuntimeForMajorGC(JSTracer* trc, AutoLockForExclusiveAccess& lock);
@@ -1403,16 +1408,18 @@ class GCRuntime
     ActiveThreadData<bool> deterministicOnly;
     ActiveThreadData<int> incrementalLimit;
 
     ActiveThreadData<Vector<JSObject*, 0, SystemAllocPolicy>> selectedForMarking;
 #endif
 
     ActiveThreadData<bool> fullCompartmentChecks;
 
+    ActiveThreadData<uint32_t> gcBeginCallbackDepth;
+
     Callback<JSGCCallback> gcCallback;
     Callback<JS::DoCycleCollectionCallback> gcDoCycleCollectionCallback;
     Callback<JSObjectsTenuredCallback> tenuredCallback;
     CallbackVector<JSFinalizeCallback> finalizeCallbacks;
     CallbackVector<JSWeakPointerZonesCallback> updateWeakPointerZonesCallbacks;
     CallbackVector<JSWeakPointerCompartmentCallback> updateWeakPointerCompartmentCallbacks;
 
     MemoryCounter<GCRuntime> mallocCounter;

--- a/js/src/gc/Zone.cpp
+++ b/js/src/gc/Zone.cpp
@@ -53,16 +53,17 @@ JS::Zone::Zone(JSRuntime* rt, ZoneGroup*
     nurseryShapes_(group),
     data(group, nullptr),
     isSystem(group, false),
 #ifdef DEBUG
     gcLastSweepGroupIndex(group, 0),
 #endif
     jitZone_(group, nullptr),
     gcScheduled_(false),
+    gcScheduledSaved_(false),
     gcPreserveCode_(group, false),
     keepShapeTables_(group, false),
     listNext_(group, NotOnList)
 {
     /* Ensure that there are no vtables to mess us up here. */
     MOZ_ASSERT(reinterpret_cast<JS::shadow::Zone*>(this) ==
                static_cast<JS::shadow::Zone*>(this));
 

--- a/js/src/gc/Zone.h
+++ b/js/src/gc/Zone.h
@@ -690,16 +690,17 @@ struct Zone : public JS::shadow::Zone,
         updateMallocCounter(bytes);
         return p;
     }
 
   private:
     js::ZoneGroupData<js::jit::JitZone*> jitZone_;
 
     js::ActiveThreadData<bool> gcScheduled_;
+    js::ActiveThreadData<bool> gcScheduledSaved_;
     js::ZoneGroupData<bool> gcPreserveCode_;
     js::ZoneGroupData<bool> keepShapeTables_;
 
     // Allow zones to be linked into a list
     friend class js::gc::ZoneList;
     static Zone * const NotOnList;
     js::ZoneGroupOrGCTaskData<Zone*> listNext_;
     bool isOnList() const;

new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug1407058.js
@@ -0,0 +1,16 @@
+"use strict";
+function f() {
+    var o = {};
+    Object.defineProperty(o, "x", {get: undefined, set: undefined});
+    for (var i = 0; i < 20; i++) {
+        var ex = null;
+        try {
+            o.x = 9;
+        } catch (e) {
+            ex = e;
+        }
+        assertEq(ex instanceof TypeError, true);
+        assertEq(o.x, undefined);
+    }
+}
+f();

new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/enable-profiling-in-import.js
@@ -0,0 +1,9 @@
+var module = new WebAssembly.Module(wasmTextToBinary(`
+    (module
+        (import "global" "func")
+        (func (export "f")
+         call 0
+        )
+    )
+`));
+new WebAssembly.Instance(module, { global: { func: enableGeckoProfiling } }).exports.f();

--- a/js/src/jit/ExecutableAllocator.cpp
+++ b/js/src/jit/ExecutableAllocator.cpp
@@ -123,17 +123,18 @@ ExecutableAllocator::ExecutableAllocator
 }
 
 ExecutableAllocator::~ExecutableAllocator()
 {
     for (size_t i = 0; i < m_smallPools.length(); i++)
         m_smallPools[i]->release(/* willDestroy = */true);
 
     // If this asserts we have a pool leak.
-    MOZ_ASSERT_IF(m_pools.initialized(), m_pools.empty());
+    MOZ_ASSERT_IF(m_pools.initialized() && rt_->gc.shutdownCollectedEverything(),
+                  m_pools.empty());
 }
 
 ExecutablePool*
 ExecutableAllocator::poolForSize(size_t n)
 {
     // Try to fit in an existing small allocator.  Use the pool with the
     // least available space that is big enough (best-fit).  This is the
     // best strategy because (a) it maximizes the chance of the next

--- a/js/src/jit/JSJitFrameIter.h
+++ b/js/src/jit/JSJitFrameIter.h
@@ -298,17 +298,17 @@ class JSJitProfilingFrameIterator
     void fixBaselineReturnAddress();
 
     void moveToCppEntryFrame();
     void moveToWasmFrame(CommonFrameLayout* frame);
     void moveToNextFrame(CommonFrameLayout* frame);
 
   public:
     JSJitProfilingFrameIterator(JSContext* cx,
-                              const JS::ProfilingFrameIterator::RegisterState& state);
+                                const JS::ProfilingFrameIterator::RegisterState& state);
     explicit JSJitProfilingFrameIterator(void* exitFrame);
 
     void operator++();
     bool done() const { return fp_ == nullptr; }
 
     void* fp() const { MOZ_ASSERT(!done()); return fp_; }
     void* stackAddress() const { return fp(); }
     FrameType frameType() const { MOZ_ASSERT(!done()); return type_; }

--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -936,16 +936,17 @@ GCRuntime::GCRuntime(JSRuntime* rt) :
 #ifdef JS_GC_ZEAL
     zealModeBits(0),
     zealFrequency(0),
     nextScheduled(0),
     deterministicOnly(false),
     incrementalLimit(0),
 #endif
     fullCompartmentChecks(false),
+    gcBeginCallbackDepth(0),
     alwaysPreserveCode(false),
 #ifdef DEBUG
     arenasEmptyAtShutdown(true),
 #endif
     lock(mutexid::GCLock),
     allocTask(rt, emptyChunks_.ref()),
     decommitTask(rt),
     helperState(rt),
@@ -1643,35 +1644,16 @@ GCRuntime::setObjectsTenuredCallback(JSO
 
 void
 GCRuntime::callObjectsTenuredCallback()
 {
     if (tenuredCallback.op)
         tenuredCallback.op(TlsContext.get(), tenuredCallback.data);
 }
 
-namespace {
-
-class AutoNotifyGCActivity {
-  public:
-    explicit AutoNotifyGCActivity(GCRuntime& gc) : gc_(gc) {
-        if (!gc_.isIncrementalGCInProgress())
-            gc_.callGCCallback(JSGC_BEGIN);
-    }
-    ~AutoNotifyGCActivity() {
-        if (!gc_.isIncrementalGCInProgress())
-            gc_.callGCCallback(JSGC_END);
-    }
-
-  private:
-    GCRuntime& gc_;
-};
-
-} // (anon)
-
 bool
 GCRuntime::addFinalizeCallback(JSFinalizeCallback callback, void* data)
 {
     return finalizeCallbacks.ref().append(Callback<JSFinalizeCallback>(callback, data));
 }
 
 void
 GCRuntime::removeFinalizeCallback(JSFinalizeCallback callback)
@@ -7100,30 +7082,77 @@ class AutoScheduleZonesForGC
     ~AutoScheduleZonesForGC() {
         for (ZonesIter zone(rt_, WithAtoms); !zone.done(); zone.next())
             zone->unscheduleGC();
     }
 };
 
 } /* anonymous namespace */
 
+class js::gc::AutoCallGCCallbacks {
+    GCRuntime& gc_;
+
+  public:
+    explicit AutoCallGCCallbacks(GCRuntime& gc) : gc_(gc) {
+        gc_.maybeCallBeginCallback();
+    }
+    ~AutoCallGCCallbacks() {
+        gc_.maybeCallEndCallback();
+    }
+};
+
+void
+GCRuntime::maybeCallBeginCallback()
+{
+    if (isIncrementalGCInProgress())
+        return;
+
+    if (gcBeginCallbackDepth == 0) {
+        // Save scheduled zone information in case the callback changes it.
+        for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next())
+            zone->gcScheduledSaved_ = zone->gcScheduled_;
+    }
+
+    gcBeginCallbackDepth++;
+
+    callGCCallback(JSGC_BEGIN);
+
+    MOZ_ASSERT(gcBeginCallbackDepth != 0);
+    gcBeginCallbackDepth--;
+
+    if (gcBeginCallbackDepth == 0) {
+        // Restore scheduled zone information again.
+        for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next())
+            zone->gcScheduled_ = zone->gcScheduledSaved_;
+    }
+}
+
+void
+GCRuntime::maybeCallEndCallback()
+{
+    if (isIncrementalGCInProgress())
+        return;
+
+    callGCCallback(JSGC_END);
+}
+
 /*
  * Run one GC "cycle" (either a slice of incremental GC or an entire
  * non-incremental GC. We disable inlining to ensure that the bottom of the
  * stack with possible GC roots recorded in MarkRuntime excludes any pointers we
  * use during the marking implementation.
  *
  * Returns true if we "reset" an existing incremental GC, which would force us
  * to run another cycle.
  */
 MOZ_NEVER_INLINE GCRuntime::IncrementalResult
 GCRuntime::gcCycle(bool nonincrementalByAPI, SliceBudget& budget, JS::gcreason::Reason reason)
 {
-    // Note that the following is allowed to re-enter GC in the finalizer.
-    AutoNotifyGCActivity notify(*this);
+    // Note that GC callbacks are allowed to re-enter GC.
+    AutoCallGCCallbacks callCallbacks(*this);
 
     gcstats::AutoGCSlice agc(stats(), scanZonesBeforeGC(), invocationKind, budget, reason);
 
     minorGC(reason, gcstats::PhaseKind::EVICT_NURSERY_FOR_MAJOR_GC);
 
     AutoTraceSession session(rt, JS::HeapState::MajorCollecting);
 
     majorGCTriggerReason = JS::gcreason::NO_REASON;

--- a/js/src/vm/GeckoProfiler.cpp
+++ b/js/src/vm/GeckoProfiler.cpp
@@ -64,24 +64,33 @@ GeckoProfilerRuntime::setEventMarker(voi
 
 // Get a pointer to the top-most profiling frame, given the exit frame pointer.
 static void*
 GetTopProfilingJitFrame(Activation* act)
 {
     if (!act || !act->isJit())
         return nullptr;
 
-    // For null exitFrame, there is no previous exit frame, just return.
-    uint8_t* jsExitFP = act->asJit()->jsExitFP();
-    if (!jsExitFP)
+    jit::JitActivation* jitActivation = act->asJit();
+
+    // If there is no exit frame set, just return.
+    if (!jitActivation->hasExitFP())
         return nullptr;
 
-    jit::JSJitProfilingFrameIterator iter(jsExitFP);
-    MOZ_ASSERT(!iter.done());
-    return iter.fp();
+    // Skip wasm frames that might be in the way.
+    JitFrameIter iter(jitActivation);
+    while (!iter.done() && iter.isWasm())
+        ++iter;
+
+    if (!iter.isJSJit())
+        return nullptr;
+
+    jit::JSJitProfilingFrameIterator jitIter(iter.asJSJit().fp());
+    MOZ_ASSERT(!jitIter.done());
+    return jitIter.fp();
 }
 
 void
 GeckoProfilerRuntime::enable(bool enabled)
 {
 #ifdef DEBUG
     // All cooperating contexts must have profile stacks installed before the
     // profiler can be enabled. Cooperating threads created while the profiler

--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -3130,19 +3130,16 @@ CASE(JSOP_FUNCALL)
                 }
             }
         }
 
         funScript = fun->nonLazyScript();
 
         if (!activation.pushInlineFrame(args, funScript, construct))
             goto error;
-
-        if (createSingleton)
-            REGS.fp()->setCreateSingleton();
     }
 
     SET_SCRIPT(REGS.fp()->script());
 
     {
         TraceLoggerEvent event(TraceLogger_Scripts, script);
         TraceLogStartEvent(logger, event);
         TraceLogStartEvent(logger, TraceLogger_Interpreter);

--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@@ -741,17 +741,17 @@ NativeObject::putProperty(JSContext* cx,
 
     /*
      * If the caller wants to allocate a slot, but doesn't care which slot,
      * copy the existing shape's slot into slot so we can match shape, if all
      * other members match.
      */
     bool hadSlot = shape->isDataProperty();
     uint32_t oldSlot = shape->maybeSlot();
-    bool needSlot = !getter && !setter;
+    bool needSlot = Shape::isDataProperty(attrs, getter, setter);
     if (needSlot && slot == SHAPE_INVALID_SLOT && hadSlot)
         slot = oldSlot;
 
     Rooted<UnownedBaseShape*> nbase(cx);
     {
         RootedShape shape(cx, obj->lastProperty());
         nbase = GetBaseShapeForNewShape(cx, shape, id);
         if (!nbase)
@@ -784,17 +784,17 @@ NativeObject::putProperty(JSContext* cx,
     if (obj->inDictionaryMode()) {
         /*
          * Updating some property in a dictionary-mode object. Create a new
          * shape for the existing property, and also generate a new shape for
          * the last property of the dictionary (unless the modified property
          * is also the last property).
          */
         bool updateLast = (shape == obj->lastProperty());
-        bool accessorShape = getter || setter || (attrs & (JSPROP_GETTER | JSPROP_SETTER));
+        bool accessorShape = !Shape::isDataProperty(attrs, getter, setter);
         shape = NativeObject::replaceWithNewEquivalentShape(cx, obj, shape, nullptr,
                                                             accessorShape);
         if (!shape)
             return nullptr;
         if (!updateLast && !NativeObject::generateOwnShape(cx, obj))
             return nullptr;
 
         /*
@@ -867,17 +867,17 @@ NativeObject::putProperty(JSContext* cx,
 /* static */ Shape*
 NativeObject::changeProperty(JSContext* cx, HandleNativeObject obj, HandleShape shape,
                              unsigned attrs, GetterOp getter, SetterOp setter)
 {
     MOZ_ASSERT(obj->containsPure(shape));
 
     /* Allow only shared (slotless) => unshared (slotful) transition. */
 #ifdef DEBUG
-    bool needSlot = !getter && !setter;
+    bool needSlot = Shape::isDataProperty(attrs, getter, setter);
     MOZ_ASSERT_IF(shape->isDataProperty() != needSlot, needSlot);
 #endif
 
     MarkTypePropertyNonData(cx, obj, shape->propid());
 
     AssertCanChangeAttrs(shape, attrs);
 
     if (shape->attrs == attrs && shape->getter() == getter && shape->setter() == setter)

--- a/js/src/vm/Shape.h
+++ b/js/src/vm/Shape.h
@@ -1008,19 +1008,23 @@ class Shape : public gc::TenuredCell
                maybeSlot() == aslot &&
                attrs == aattrs &&
                getter() == rawGetter &&
                setter() == rawSetter;
     }
 
     BaseShape* base() const { return base_.get(); }
 
+    static bool isDataProperty(unsigned attrs, GetterOp getter, SetterOp setter) {
+        return !(attrs & (JSPROP_GETTER | JSPROP_SETTER)) && !getter && !setter;
+    }
+
     bool isDataProperty() const {
         MOZ_ASSERT(!isEmptyShape());
-        return !getter() && !setter();
+        return isDataProperty(attrs, getter(), setter());
     }
     uint32_t slot() const { MOZ_ASSERT(isDataProperty() && !hasMissingSlot()); return maybeSlot(); }
     uint32_t maybeSlot() const {
         return slotInfo & SLOT_MASK;
     }
 
     bool isEmptyShape() const {
         MOZ_ASSERT_IF(JSID_IS_EMPTY(propid_), hasMissingSlot());
@@ -1471,17 +1475,17 @@ struct StackShape
             flags &= ~Shape::ACCESSOR_SHAPE;
 
         this->rawGetter = rawGetter;
         this->rawSetter = rawSetter;
     }
 
     bool isDataProperty() const {
         MOZ_ASSERT(!JSID_IS_EMPTY(propid));
-        return !rawGetter && !rawSetter;
+        return Shape::isDataProperty(attrs, rawGetter, rawSetter);
     }
     bool hasMissingSlot() const { return maybeSlot() == SHAPE_INVALID_SLOT; }
 
     uint32_t slot() const { MOZ_ASSERT(isDataProperty() && !hasMissingSlot()); return slot_; }
     uint32_t maybeSlot() const { return slot_; }
 
     void setSlot(uint32_t slot) {
         MOZ_ASSERT(slot <= SHAPE_INVALID_SLOT);

--- a/js/src/vm/Stack-inl.h
+++ b/js/src/vm/Stack-inl.h
@@ -558,24 +558,16 @@ AbstractFramePtr::hasInitialEnvironment(
     if (isInterpreterFrame())
         return asInterpreterFrame()->hasInitialEnvironment();
     if (isBaselineFrame())
         return asBaselineFrame()->hasInitialEnvironment();
     return asRematerializedFrame()->hasInitialEnvironment();
 }
 
 inline bool
-AbstractFramePtr::createSingleton() const
-{
-    if (isInterpreterFrame())
-        return asInterpreterFrame()->createSingleton();
-    return false;
-}
-
-inline bool
 AbstractFramePtr::isGlobalFrame() const
 {
     if (isInterpreterFrame())
         return asInterpreterFrame()->isGlobalFrame();
     if (isBaselineFrame())
         return asBaselineFrame()->isGlobalFrame();
     if (isWasmDebugFrame())
         return false;

--- a/js/src/vm/Stack.h
+++ b/js/src/vm/Stack.h
@@ -265,17 +265,16 @@ class AbstractFramePtr
     inline unsigned numFormalArgs() const;
 
     inline Value* argv() const;
 
     inline bool hasArgs() const;
     inline bool hasArgsObj() const;
     inline ArgumentsObject& argsObj() const;
     inline void initArgsObj(ArgumentsObject& argsobj) const;
-    inline bool createSingleton() const;
 
     inline Value& unaliasedLocal(uint32_t i);
     inline Value& unaliasedFormal(unsigned i, MaybeCheckAliasing checkAliasing = CHECK_ALIASING);
     inline Value& unaliasedActual(unsigned i, MaybeCheckAliasing checkAliasing = CHECK_ALIASING);
     template <class Op> inline void unaliasedForEachActual(JSContext* cx, Op op);
 
     inline bool prevUpToDate() const;
     inline void setPrevUpToDate() const;
@@ -334,25 +333,22 @@ class InterpreterFrame
         HAS_PUSHED_PROF_FRAME  =       0x80,  /* Gecko Profiler was notified of entry */
 
         /*
          * If set, we entered one of the JITs and ScriptFrameIter should skip
          * this frame.
          */
         RUNNING_IN_JIT         =      0x100,
 
-        /* Miscellaneous state. */
-        CREATE_SINGLETON       =      0x200,  /* Constructed |this| object should be singleton. */
-
         /*
          * If set, this frame has been on the stack when
          * |js::SavedStacks::saveCurrentStack| was called, and so there is a
          * |js::SavedFrame| object cached for this frame.
          */
-        HAS_CACHED_SAVED_FRAME =      0x400,
+        HAS_CACHED_SAVED_FRAME =      0x200,
     };
 
     mutable uint32_t    flags_;         /* bits described by Flags */
     uint32_t            nactual_;       /* number of actual arguments, for function frames */
     JSScript*           script_;        /* the script we're executing */
     JSObject*           envChain_;      /* current environment chain */
     Value               rval_;          /* if HAS_RVAL, return value of the frame */
     ArgumentsObject*    argsObj_;       /* if HAS_ARGS_OBJ, the call's arguments object */
@@ -754,25 +750,16 @@ class InterpreterFrame
         return flags_ & HAS_INITIAL_ENV;
     }
 
     bool hasArgsObj() const {
         MOZ_ASSERT(script()->needsArgsObj());
         return flags_ & HAS_ARGS_OBJ;
     }
 
-    void setCreateSingleton() {
-        MOZ_ASSERT(isConstructing());
-        flags_ |= CREATE_SINGLETON;
-    }
-    bool createSingleton() const {
-        MOZ_ASSERT(isConstructing());
-        return flags_ & CREATE_SINGLETON;
-    }
-
     /*
      * Debugger eval frames.
      *
      * - If evalInFramePrev_ is non-null, frame was created for an "eval in
      *   frame" call, which can push a successor to any live frame; so its
      *   logical "prev" frame is not necessarily the previous frame in memory.
      *   Iteration should treat evalInFramePrev_ as this frame's previous frame.
      *

--- a/js/src/wasm/WasmBuiltins.cpp
+++ b/js/src/wasm/WasmBuiltins.cpp
@@ -287,38 +287,44 @@ WasmReportOutOfBounds()
 static void
 WasmReportUnalignedAccess()
 {
     JSContext* cx = TlsContext.get();
     JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_WASM_UNALIGNED_ACCESS);
 }
 
 static int32_t
-CoerceInPlace_ToInt32(MutableHandleValue val)
+CoerceInPlace_ToInt32(Value* rawVal)
 {
     JSContext* cx = TlsContext.get();
 
     int32_t i32;
-    if (!ToInt32(cx, val, &i32))
+    RootedValue val(cx, *rawVal);
+    if (!ToInt32(cx, val, &i32)) {
+        *rawVal = PoisonedObjectValue(0x42);
         return false;
-    val.set(Int32Value(i32));
+    }
 
+    *rawVal = Int32Value(i32);
     return true;
 }
 
 static int32_t
-CoerceInPlace_ToNumber(MutableHandleValue val)
+CoerceInPlace_ToNumber(Value* rawVal)
 {
     JSContext* cx = TlsContext.get();
 
     double dbl;
-    if (!ToNumber(cx, val, &dbl))
+    RootedValue val(cx, *rawVal);
+    if (!ToNumber(cx, val, &dbl)) {
+        *rawVal = PoisonedObjectValue(0x42);
         return false;
-    val.set(DoubleValue(dbl));
+    }
 
+    *rawVal = DoubleValue(dbl);
     return true;
 }
 
 static int64_t
 DivI64(uint32_t x_hi, uint32_t x_lo, uint32_t y_hi, uint32_t y_lo)
 {
     int64_t x = ((uint64_t)x_hi << 32) + x_lo;
     int64_t y = ((uint64_t)y_hi << 32) + y_lo;

--- a/js/src/wasm/WasmStubs.cpp
+++ b/js/src/wasm/WasmStubs.cpp
@@ -765,16 +765,25 @@ GenerateImportJitExit(MacroAssembler& ma
     masm.loadBaselineOrIonNoArgCheck(callee, callee, nullptr);
 
     Label rejoinBeforeCall;
     masm.bind(&rejoinBeforeCall);
 
     AssertStackAlignment(masm, JitStackAlignment, sizeOfRetAddr);
     masm.callJitNoProfiler(callee);
 
+    // Note that there might be a GC thing in the JSReturnOperand now.
+    // In all the code paths from here:
+    // - either the value is unboxed because it was a primitive and we don't
+    //   need to worry about rooting anymore.
+    // - or the value needs to be rooted, but nothing can cause a GC between
+    //   here and CoerceInPlace, which roots before coercing to a primitive.
+    //   In particular, this is true because wasm::InInterruptibleCode will
+    //   return false when PC is in the jit exit.
+
     // The JIT callee clobbers all registers, including WasmTlsReg and
     // FramePointer, so restore those here. During this sequence of
     // instructions, FP can't be trusted by the profiling frame iterator.
     offsets->untrustedFPStart = masm.currentOffset();
     AssertStackAlignment(masm, JitStackAlignment, sizeOfRetAddr);
 
     masm.loadWasmTlsRegFromFrame();
     masm.moveStackPtrTo(FramePointer);

--- a/layout/generic/nsPageFrame.cpp
+++ b/layout/generic/nsPageFrame.cpp
@@ -637,27 +637,27 @@ nsPageFrame::PaintHeaderFooter(gfxContex
   nscoord visibleHeight = 0;
   if (fontMet) {
     visibleHeight = fontMet->MaxHeight();
     ascent = fontMet->MaxAscent();
   }
 
   // print document headers and footers
   nsString headerLeft, headerCenter, headerRight;
-  mPD->mPrintSettings->GetHeaderStrLeft(getter_Copies(headerLeft));
-  mPD->mPrintSettings->GetHeaderStrCenter(getter_Copies(headerCenter));
-  mPD->mPrintSettings->GetHeaderStrRight(getter_Copies(headerRight));
+  mPD->mPrintSettings->GetHeaderStrLeft(headerLeft);
+  mPD->mPrintSettings->GetHeaderStrCenter(headerCenter);
+  mPD->mPrintSettings->GetHeaderStrRight(headerRight);
   DrawHeaderFooter(aRenderingContext, *fontMet, eHeader,
                    headerLeft, headerCenter, headerRight,
                    rect, ascent, visibleHeight);
 
   nsString footerLeft, footerCenter, footerRight;
-  mPD->mPrintSettings->GetFooterStrLeft(getter_Copies(footerLeft));
-  mPD->mPrintSettings->GetFooterStrCenter(getter_Copies(footerCenter));
-  mPD->mPrintSettings->GetFooterStrRight(getter_Copies(footerRight));
+  mPD->mPrintSettings->GetFooterStrLeft(footerLeft);
+  mPD->mPrintSettings->GetFooterStrCenter(footerCenter);
+  mPD->mPrintSettings->GetFooterStrRight(footerRight);
   DrawHeaderFooter(aRenderingContext, *fontMet, eFooter,
                    footerLeft, footerCenter, footerRight,
                    rect, ascent, visibleHeight);
 }
 
 void
 nsPageFrame::SetSharedPageData(nsSharedPageData* aPD)
 {

--- a/layout/printing/nsPrintEngine.cpp
+++ b/layout/printing/nsPrintEngine.cpp
@@ -1006,29 +1006,29 @@ nsPrintEngine::CheckForPrinters(nsIPrint
   if (!XRE_IsParentProcess()) {
     return NS_OK;
   }
 #endif
   NS_ENSURE_ARG_POINTER(aPrintSettings);
 
   // See if aPrintSettings already has a printer
   nsString printerName;
-  nsresult rv = aPrintSettings->GetPrinterName(getter_Copies(printerName));
+  nsresult rv = aPrintSettings->GetPrinterName(printerName);
   if (NS_SUCCEEDED(rv) && !printerName.IsEmpty()) {
     return NS_OK;
   }
 
   // aPrintSettings doesn't have a printer set. Try to fetch the default.
   nsCOMPtr<nsIPrintSettingsService> printSettingsService =
     do_GetService(sPrintSettingsServiceContractID, &rv);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  rv = printSettingsService->GetDefaultPrinterName(getter_Copies(printerName));
+  rv = printSettingsService->GetDefaultPrinterName(printerName);
   if (NS_SUCCEEDED(rv) && !printerName.IsEmpty()) {
-    rv = aPrintSettings->SetPrinterName(printerName.get());
+    rv = aPrintSettings->SetPrinterName(printerName);
   }
   return rv;
 #endif
 }
 
 //----------------------------------------------------------------------
 // Set up to use the "pluggable" Print Progress Dialog
 void
@@ -1450,31 +1450,18 @@ nsPrintEngine::GetDisplayTitleAndURL(con
     return;
 
   aTitle.Truncate();
   aURLStr.Truncate();
 
   // First check to see if the PrintSettings has defined an alternate title
   // and use that if it did
   if (mPrt->mPrintSettings) {
-    char16_t * docTitleStrPS = nullptr;
-    char16_t * docURLStrPS   = nullptr;
-    mPrt->mPrintSettings->GetTitle(&docTitleStrPS);
-    mPrt->mPrintSettings->GetDocURL(&docURLStrPS);
-
-    if (docTitleStrPS) {
-      aTitle = docTitleStrPS;
-    }
-
-    if (docURLStrPS) {
-      aURLStr = docURLStrPS;
-    }
-
-    free(docTitleStrPS);
-    free(docURLStrPS);
+    mPrt->mPrintSettings->GetTitle(aTitle);
+    mPrt->mPrintSettings->GetDocURL(aURLStr);
   }
 
   nsAutoString docTitle;
   nsAutoString docUrl;
   GetDocumentTitleAndURL(aPO->mDocument, docTitle, docUrl);
 
   if (aURLStr.IsEmpty() && !docUrl.IsEmpty()) {
     aURLStr = docUrl;
@@ -1823,17 +1810,17 @@ nsPrintEngine::SetupToPrintContent()
   }
 
   nsAutoString fileNameStr;
   // check to see if we are printing to a file
   bool isPrintToFile = false;
   printData->mPrintSettings->GetPrintToFile(&isPrintToFile);
   if (isPrintToFile) {
     // On some platforms The BeginDocument needs to know the name of the file.
-    printData->mPrintSettings->GetToFileName(getter_Copies(fileNameStr));
+    printData->mPrintSettings->GetToFileName(fileNameStr);
   }
 
   nsAutoString docTitleStr;
   nsAutoString docURLStr;
   GetDisplayTitleAndURL(printData->mPrintObject, docTitleStr, docURLStr,
                         eDocTitleDefURLDoc);
 
   int32_t startPage = 1;

--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -2107,17 +2107,17 @@ pref("network.ftp.idleConnectionTimeout"
 // 3: XUL directory viewer
 // all other values are treated like 2
 pref("network.dir.format", 2);
 
 // enables the prefetch service (i.e., prefetching of <link rel="next"> and
 // <link rel="prefetch"> URLs).
 pref("network.prefetch-next", true);
 // enables the preloading (i.e., preloading of <link rel="preload"> URLs).
-pref("network.preload", true);
+pref("network.preload", false);
 
 // enables the predictive service
 pref("network.predictor.enabled", true);
 pref("network.predictor.enable-hover-on-ssl", false);
 pref("network.predictor.enable-prefetch", false);
 pref("network.predictor.page-degradation.day", 0);
 pref("network.predictor.page-degradation.week", 5);
 pref("network.predictor.page-degradation.month", 10);

--- a/rdf/base/nsIRDFXMLSerializer.idl
+++ b/rdf/base/nsIRDFXMLSerializer.idl
@@ -2,27 +2,30 @@
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsISupports.idl"
 #include "nsIRDFDataSource.idl"
 
-interface nsAtom;  // not a real interface; used in [noscript] methods only
+%{C++
+class nsAtom;
+%}
+[ptr] native nsAtomPtr(nsAtom);
 
 [scriptable, uuid(8ae1fbf8-1dd2-11b2-bd21-d728069cca92)]
 interface nsIRDFXMLSerializer : nsISupports
 {
     /**
      * Initialize the serializer with the specified datasource.
      * @param aDataSource the datasource from which data will be
      *   serialized
      */
     void init(in nsIRDFDataSource aDataSource);
 
     /**
      * Add the specified namespace to the serializer.
      * @param aPrefix the attribute namespace prefix
      * @param aURI the namespace URI
      */
-    [noscript] void addNameSpace(in nsAtom aPrefix, in DOMString aURI);
+    [noscript] void addNameSpace(in nsAtomPtr aPrefix, in DOMString aURI);
 };

--- a/rdf/base/nsIRDFXMLSink.idl
+++ b/rdf/base/nsIRDFXMLSink.idl
@@ -7,17 +7,20 @@
 
   Interfaces for the RDF/XML sink, which parses RDF/XML into
   a graph representation.
 
 */
 
 #include "nsISupports.idl"
 
-interface nsAtom;  // not a real interface; used in [noscript] methods only
+%{C++
+class nsAtom;
+%}
+[ptr] native nsAtomPtr(nsAtom);
 
 // XXX Until these get scriptable. See nsIRDFXMLSink::AddNameSpace()
 [ref] native nsStringRef(nsString);
 %{C++
 #include "nsStringFwd.h"
 %}
 
 interface nsIRDFXMLSink;
@@ -97,17 +100,17 @@ interface nsIRDFXMLSink : nsISupports
      */
     void endLoad();
 
     /**
      * Add namespace information to the RDF/XML sink.
      * @param aPrefix the namespace prefix
      * @param aURI the namespace URI
      */
-    [noscript] void addNameSpace(in nsAtom aPrefix,
+    [noscript] void addNameSpace(in nsAtomPtr aPrefix,
                                  [const] in nsStringRef aURI);
 
     /**
      * Add an observer that will be notified as the RDF/XML load
      * progresses.
      * <p>
      *
      * Note that the sink will acquire a strong reference to the

--- a/security/nss/TAG-INFO
+++ b/security/nss/TAG-INFO
@@ -1,1 +1,1 @@
-6fb9c5396d52
+f3766809817b

--- a/security/nss/coreconf/coreconf.dep
+++ b/security/nss/coreconf/coreconf.dep
@@ -5,9 +5,8 @@
 
 /*
  * A dummy header file that is a dependency for all the object files.
  * Used to force a full recompilation of NSS in Mozilla's Tinderbox
  * depend builds.  See comments in rules.mk.
  */
 
 #error "Do not include this header file."
-

--- a/security/nss/gtests/pk11_gtest/pk11_ecdsa_unittest.cc
+++ b/security/nss/gtests/pk11_gtest/pk11_ecdsa_unittest.cc
@@ -10,145 +10,159 @@
 #include "gtest/gtest.h"
 #include "scoped_ptrs.h"
 
 #include "pk11_ecdsa_vectors.h"
 #include "pk11_signature_test.h"
 
 namespace nss_test {
 
-class Pkcs11EcdsaTest : public Pk11SignatureTest {
+class Pkcs11EcdsaTestBase : public Pk11SignatureTest {
  protected:
-  CK_MECHANISM_TYPE mechanism() { return CKM_ECDSA; }
-  SECItem* parameters() { return nullptr; }
+  Pkcs11EcdsaTestBase(SECOidTag hash_oid)
+      : Pk11SignatureTest(CKM_ECDSA, hash_oid) {}
 };
 
-class Pkcs11EcdsaSha256Test : public Pkcs11EcdsaTest {
- protected:
-  SECOidTag hashOID() { return SEC_OID_SHA256; }
+struct Pkcs11EcdsaTestParams {
+  SECOidTag hash_oid_;
+  Pkcs11SignatureTestParams sig_params_;
 };
 
-class Pkcs11EcdsaSha384Test : public Pkcs11EcdsaTest {
- protected:
-  SECOidTag hashOID() { return SEC_OID_SHA384; }
-};
-
-class Pkcs11EcdsaSha512Test : public Pkcs11EcdsaTest {
- protected:
-  SECOidTag hashOID() { return SEC_OID_SHA512; }
+class Pkcs11EcdsaTest
+    : public Pkcs11EcdsaTestBase,
+      public ::testing::WithParamInterface<Pkcs11EcdsaTestParams> {
+ public:
+  Pkcs11EcdsaTest() : Pkcs11EcdsaTestBase(GetParam().hash_oid_) {}
 };
 
-TEST_F(Pkcs11EcdsaSha256Test, VerifyP256) {
-  SIG_TEST_VECTOR_VERIFY(kP256Spki, kP256Data, kP256Signature)
-}
-TEST_F(Pkcs11EcdsaSha256Test, SignAndVerifyP256) {
-  SIG_TEST_VECTOR_SIGN_VERIFY(kP256Pkcs8, kP256Spki, kP256Data)
+TEST_P(Pkcs11EcdsaTest, Verify) { Verify(GetParam().sig_params_); }
+
+TEST_P(Pkcs11EcdsaTest, SignAndVerify) {
+  SignAndVerify(GetParam().sig_params_);
 }
 
-TEST_F(Pkcs11EcdsaSha384Test, VerifyP384) {
-  SIG_TEST_VECTOR_VERIFY(kP384Spki, kP384Data, kP384Signature)
-}
-TEST_F(Pkcs11EcdsaSha384Test, SignAndVerifyP384) {
-  SIG_TEST_VECTOR_SIGN_VERIFY(kP384Pkcs8, kP384Spki, kP384Data)
-}
+static const Pkcs11EcdsaTestParams kEcdsaVectors[] = {
+    {SEC_OID_SHA256,
+     {DataBuffer(kP256Pkcs8, sizeof(kP256Pkcs8)),
+      DataBuffer(kP256Spki, sizeof(kP256Spki)),
+      DataBuffer(kP256Data, sizeof(kP256Data)),
+      DataBuffer(kP256Signature, sizeof(kP256Signature))}},
+    {SEC_OID_SHA384,
+     {DataBuffer(kP384Pkcs8, sizeof(kP384Pkcs8)),
+      DataBuffer(kP384Spki, sizeof(kP384Spki)),
+      DataBuffer(kP384Data, sizeof(kP384Data)),
+      DataBuffer(kP384Signature, sizeof(kP384Signature))}},
+    {SEC_OID_SHA512,
+     {DataBuffer(kP521Pkcs8, sizeof(kP521Pkcs8)),
+      DataBuffer(kP521Spki, sizeof(kP521Spki)),
+      DataBuffer(kP521Data, sizeof(kP521Data)),
+      DataBuffer(kP521Signature, sizeof(kP521Signature))}}};
 
-TEST_F(Pkcs11EcdsaSha512Test, VerifyP521) {
-  SIG_TEST_VECTOR_VERIFY(kP521Spki, kP521Data, kP521Signature)
-}
-TEST_F(Pkcs11EcdsaSha512Test, SignAndVerifyP521) {
-  SIG_TEST_VECTOR_SIGN_VERIFY(kP521Pkcs8, kP521Spki, kP521Data)
-}
+INSTANTIATE_TEST_CASE_P(EcdsaSignVerify, Pkcs11EcdsaTest,
+                        ::testing::ValuesIn(kEcdsaVectors));
+
+class Pkcs11EcdsaSha256Test : public Pkcs11EcdsaTestBase {
+ public:
+  Pkcs11EcdsaSha256Test() : Pkcs11EcdsaTestBase(SEC_OID_SHA256) {}
+};
 
 // Importing a private key in PKCS#8 format must fail when the outer AlgID
 // struct contains neither id-ecPublicKey nor a namedCurve parameter.
 TEST_F(Pkcs11EcdsaSha256Test, ImportNoCurveOIDOrAlgorithmParams) {
-  EXPECT_FALSE(ImportPrivateKey(kP256Pkcs8NoCurveOIDOrAlgorithmParams,
-                                sizeof(kP256Pkcs8NoCurveOIDOrAlgorithmParams)));
+  DataBuffer k(kP256Pkcs8NoCurveOIDOrAlgorithmParams,
+               sizeof(kP256Pkcs8NoCurveOIDOrAlgorithmParams));
+  EXPECT_FALSE(ImportPrivateKey(k));
 };
 
 // Importing a private key in PKCS#8 format must succeed when only the outer
 // AlgID struct contains the namedCurve parameters.
 TEST_F(Pkcs11EcdsaSha256Test, ImportOnlyAlgorithmParams) {
-  EXPECT_TRUE(ImportPrivateKeyAndSignHashedData(
-      kP256Pkcs8OnlyAlgorithmParams, sizeof(kP256Pkcs8OnlyAlgorithmParams),
-      kP256Data, sizeof(kP256Data)));
+  DataBuffer k(kP256Pkcs8OnlyAlgorithmParams,
+               sizeof(kP256Pkcs8OnlyAlgorithmParams));
+  DataBuffer data(kP256Data, sizeof(kP256Data));
+  DataBuffer sig;
+  EXPECT_TRUE(ImportPrivateKeyAndSignHashedData(k, data, &sig));
 };
 
 // Importing a private key in PKCS#8 format must succeed when the outer AlgID
 // struct and the inner ECPrivateKey contain the same namedCurve parameters.
 // The inner curveOID is always ignored, so only the outer one will be used.
 TEST_F(Pkcs11EcdsaSha256Test, ImportMatchingCurveOIDAndAlgorithmParams) {
-  EXPECT_TRUE(ImportPrivateKeyAndSignHashedData(
-      kP256Pkcs8MatchingCurveOIDAndAlgorithmParams,
-      sizeof(kP256Pkcs8MatchingCurveOIDAndAlgorithmParams), kP256Data,
-      sizeof(kP256Data)));
+  DataBuffer k(kP256Pkcs8MatchingCurveOIDAndAlgorithmParams,
+               sizeof(kP256Pkcs8MatchingCurveOIDAndAlgorithmParams));
+  DataBuffer data(kP256Data, sizeof(kP256Data));
+  DataBuffer sig;
+  EXPECT_TRUE(ImportPrivateKeyAndSignHashedData(k, data, &sig));
 };
 
 // Importing a private key in PKCS#8 format must succeed when the outer AlgID
 // struct and the inner ECPrivateKey contain dissimilar namedCurve parameters.
 // The inner curveOID is always ignored, so only the outer one will be used.
 TEST_F(Pkcs11EcdsaSha256Test, ImportDissimilarCurveOIDAndAlgorithmParams) {
-  EXPECT_TRUE(ImportPrivateKeyAndSignHashedData(
-      kP256Pkcs8DissimilarCurveOIDAndAlgorithmParams,
-      sizeof(kP256Pkcs8DissimilarCurveOIDAndAlgorithmParams), kP256Data,
-      sizeof(kP256Data)));
+  DataBuffer k(kP256Pkcs8DissimilarCurveOIDAndAlgorithmParams,
+               sizeof(kP256Pkcs8DissimilarCurveOIDAndAlgorithmParams));
+  DataBuffer data(kP256Data, sizeof(kP256Data));
+  DataBuffer sig;
+  EXPECT_TRUE(ImportPrivateKeyAndSignHashedData(k, data, &sig));
 };
 
 // Importing a private key in PKCS#8 format must fail when the outer ASN.1
 // AlgorithmID struct contains only id-ecPublicKey but no namedCurve parameter.
 TEST_F(Pkcs11EcdsaSha256Test, ImportNoAlgorithmParams) {
-  EXPECT_FALSE(ImportPrivateKey(kP256Pkcs8NoAlgorithmParams,
-                                sizeof(kP256Pkcs8NoAlgorithmParams)));
+  DataBuffer k(kP256Pkcs8NoAlgorithmParams,
+               sizeof(kP256Pkcs8NoAlgorithmParams));
+  EXPECT_FALSE(ImportPrivateKey(k));
 };
 
 // Importing a private key in PKCS#8 format must fail when id-ecPublicKey is
 // given (so we know it's an EC key) but the namedCurve parameter is unknown.
 TEST_F(Pkcs11EcdsaSha256Test, ImportInvalidAlgorithmParams) {
-  EXPECT_FALSE(ImportPrivateKey(kP256Pkcs8InvalidAlgorithmParams,
-                                sizeof(kP256Pkcs8InvalidAlgorithmParams)));
+  DataBuffer k(kP256Pkcs8InvalidAlgorithmParams,
+               sizeof(kP256Pkcs8InvalidAlgorithmParams));
+  EXPECT_FALSE(ImportPrivateKey(k));
 };
 
 // Importing a private key in PKCS#8 format with a point not on the curve will
 // succeed. Using the contained public key however will fail when trying to
 // import it before using it for any operation.
 TEST_F(Pkcs11EcdsaSha256Test, ImportPointNotOnCurve) {
-  ScopedSECKEYPrivateKey privKey(ImportPrivateKey(
-      kP256Pkcs8PointNotOnCurve, sizeof(kP256Pkcs8PointNotOnCurve)));
+  DataBuffer k(kP256Pkcs8PointNotOnCurve, sizeof(kP256Pkcs8PointNotOnCurve));
+  ScopedSECKEYPrivateKey privKey(ImportPrivateKey(k));
   ASSERT_TRUE(privKey);
 
   ScopedSECKEYPublicKey pubKey(SECKEY_ConvertToPublicKey(privKey.get()));
   ASSERT_TRUE(pubKey);
 
   ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
   ASSERT_TRUE(slot);
 
   auto handle = PK11_ImportPublicKey(slot.get(), pubKey.get(), false);
   EXPECT_EQ(handle, static_cast<decltype(handle)>(CK_INVALID_HANDLE));
 };
 
 // Importing a private key in PKCS#8 format must fail when no point is given.
 // PK11 currently offers no APIs to derive raw public keys from private values.
 TEST_F(Pkcs11EcdsaSha256Test, ImportNoPublicKey) {
-  EXPECT_FALSE(
-      ImportPrivateKey(kP256Pkcs8NoPublicKey, sizeof(kP256Pkcs8NoPublicKey)));
+  DataBuffer k(kP256Pkcs8NoPublicKey, sizeof(kP256Pkcs8NoPublicKey));
+  EXPECT_FALSE(ImportPrivateKey(k));
 };
 
 // Importing a public key in SPKI format must fail when id-ecPublicKey is
 // given (so we know it's an EC key) but the namedCurve parameter is missing.
 TEST_F(Pkcs11EcdsaSha256Test, ImportSpkiNoAlgorithmParams) {
-  EXPECT_FALSE(ImportPublicKey(kP256SpkiNoAlgorithmParams,
-                               sizeof(kP256SpkiNoAlgorithmParams)));
+  DataBuffer k(kP256SpkiNoAlgorithmParams, sizeof(kP256SpkiNoAlgorithmParams));
+  EXPECT_FALSE(ImportPublicKey(k));
 }
 
 // Importing a public key in SPKI format with a point not on the curve will
 // succeed. Using the public key however will fail when trying to import
 // it before using it for any operation.
 TEST_F(Pkcs11EcdsaSha256Test, ImportSpkiPointNotOnCurve) {
-  ScopedSECKEYPublicKey pubKey(ImportPublicKey(
-      kP256SpkiPointNotOnCurve, sizeof(kP256SpkiPointNotOnCurve)));
+  DataBuffer k(kP256SpkiPointNotOnCurve, sizeof(kP256SpkiPointNotOnCurve));
+  ScopedSECKEYPublicKey pubKey(ImportPublicKey(k));
   ASSERT_TRUE(pubKey);
 
   ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
   ASSERT_TRUE(slot);
 
   auto handle = PK11_ImportPublicKey(slot.get(), pubKey.get(), false);
   EXPECT_EQ(handle, static_cast<decltype(handle)>(CK_INVALID_HANDLE));
 }

--- a/security/nss/gtests/pk11_gtest/pk11_rsapss_unittest.cc
+++ b/security/nss/gtests/pk11_gtest/pk11_rsapss_unittest.cc
@@ -7,44 +7,42 @@
 #include <memory>
 #include "nss.h"
 #include "pk11pub.h"
 #include "sechash.h"
 
 #include "gtest/gtest.h"
 #include "scoped_ptrs.h"
 
+#include "pk11_signature_test.h"
 #include "pk11_rsapss_vectors.h"
-#include "pk11_signature_test.h"
 
 namespace nss_test {
 
-class Pkcs11RsaPssVectorTest : public Pk11SignatureTest {
+class Pkcs11RsaPssTest : public Pk11SignatureTest {
  public:
-  Pkcs11RsaPssVectorTest() {
+  Pkcs11RsaPssTest() : Pk11SignatureTest(CKM_RSA_PKCS_PSS, SEC_OID_SHA1) {
     rsaPssParams_.hashAlg = CKM_SHA_1;
     rsaPssParams_.mgf = CKG_MGF1_SHA1;
     rsaPssParams_.sLen = HASH_ResultLenByOidTag(SEC_OID_SHA1);
 
     params_.type = siBuffer;
     params_.data = reinterpret_cast<unsigned char*>(&rsaPssParams_);
     params_.len = sizeof(rsaPssParams_);
   }
 
  protected:
-  CK_MECHANISM_TYPE mechanism() { return CKM_RSA_PKCS_PSS; }
-  SECItem* parameters() { return &params_; }
-  SECOidTag hashOID() { return SEC_OID_SHA1; }
+  const SECItem* parameters() const { return &params_; }
 
  private:
   CK_RSA_PKCS_PSS_PARAMS rsaPssParams_;
   SECItem params_;
 };
 
-TEST_F(Pkcs11RsaPssVectorTest, GenerateAndSignAndVerify) {
+TEST_F(Pkcs11RsaPssTest, GenerateAndSignAndVerify) {
   // Sign data with a 1024-bit RSA key, using PSS/SHA-256.
   SECOidTag hashOid = SEC_OID_SHA256;
   CK_MECHANISM_TYPE hashMech = CKM_SHA256;
   CK_RSA_PKCS_MGF_TYPE mgf = CKG_MGF1_SHA256;
   PK11RSAGenParams rsaGenParams = {1024, 0x10001};
 
   // Generate RSA key pair.
   ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
@@ -90,110 +88,61 @@ TEST_F(Pkcs11RsaPssVectorTest, GenerateA
   // Verification with original data but the wrong signature must fail.
   data.data[0] ^= 0xff;  // Revert previous changes.
   sig.data[0] ^= 0xff;
   rv = PK11_VerifyWithMechanism(pubKey.get(), mechanism(), &params, &sig, &data,
                                 nullptr);
   EXPECT_EQ(rv, SECFailure);
 }
 
-// RSA-PSS test vectors, pss-vect.txt, Example 1.1: A 1024-bit RSA Key Pair
-// <ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip>
-TEST_F(Pkcs11RsaPssVectorTest, VerifyKnownSignature1) {
-  SIG_TEST_VECTOR_VERIFY(kTestVector1Spki, kTestVector1Data, kTestVector1Sig);
-}
-TEST_F(Pkcs11RsaPssVectorTest, SignAndVerify1) {
-  SIG_TEST_VECTOR_SIGN_VERIFY(kTestVector1Pkcs8, kTestVector1Spki,
-                              kTestVector1Data);
-}
+class Pkcs11RsaPssVectorTest
+    : public Pkcs11RsaPssTest,
+      public ::testing::WithParamInterface<Pkcs11SignatureTestParams> {};
 
-// RSA-PSS test vectors, pss-vect.txt, Example 2.1: A 1025-bit RSA Key Pair
-// <ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip>
-TEST_F(Pkcs11RsaPssVectorTest, VerifyKnownSignature2) {
-  SIG_TEST_VECTOR_VERIFY(kTestVector2Spki, kTestVector2Data, kTestVector2Sig);
-}
-TEST_F(Pkcs11RsaPssVectorTest, SignAndVerify2) {
-  SIG_TEST_VECTOR_SIGN_VERIFY(kTestVector2Pkcs8, kTestVector2Spki,
-                              kTestVector2Data);
-}
+TEST_P(Pkcs11RsaPssVectorTest, Verify) { Verify(GetParam()); }
+
+TEST_P(Pkcs11RsaPssVectorTest, SignAndVerify) { SignAndVerify(GetParam()); }
 
-// RSA-PSS test vectors, pss-vect.txt, Example 3.1: A 1026-bit RSA Key Pair
-// <ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip>
-TEST_F(Pkcs11RsaPssVectorTest, VerifyKnownSignature3) {
-  SIG_TEST_VECTOR_VERIFY(kTestVector3Spki, kTestVector3Data, kTestVector3Sig);
-}
-TEST_F(Pkcs11RsaPssVectorTest, SignAndVerify3) {
-  SIG_TEST_VECTOR_SIGN_VERIFY(kTestVector3Pkcs8, kTestVector3Spki,
-                              kTestVector3Data);
-}
-
-// RSA-PSS test vectors, pss-vect.txt, Example 4.1: A 1027-bit RSA Key Pair
-// <ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip>
-TEST_F(Pkcs11RsaPssVectorTest, VerifyKnownSignature4) {
-  SIG_TEST_VECTOR_VERIFY(kTestVector4Spki, kTestVector4Data, kTestVector4Sig);
-}
-TEST_F(Pkcs11RsaPssVectorTest, SignAndVerify4) {
-  SIG_TEST_VECTOR_SIGN_VERIFY(kTestVector4Pkcs8, kTestVector4Spki,
-                              kTestVector4Data);
-}
-
-// RSA-PSS test vectors, pss-vect.txt, Example 5.1: A 1028-bit RSA Key Pair
-// <ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip>
-TEST_F(Pkcs11RsaPssVectorTest, VerifyKnownSignature5) {
-  SIG_TEST_VECTOR_VERIFY(kTestVector5Spki, kTestVector5Data, kTestVector5Sig);
-}
-TEST_F(Pkcs11RsaPssVectorTest, SignAndVerify5) {
-  SIG_TEST_VECTOR_SIGN_VERIFY(kTestVector5Pkcs8, kTestVector5Spki,
-                              kTestVector5Data);
-}
+#define VECTOR(pkcs8, spki, data, sig)                                \
+  {                                                                   \
+    DataBuffer(pkcs8, sizeof(pkcs8)), DataBuffer(spki, sizeof(spki)), \
+        DataBuffer(data, sizeof(data)), DataBuffer(sig, sizeof(sig))  \
+  }
+#define VECTOR_N(n)                                                         \
+  VECTOR(kTestVector##n##Pkcs8, kTestVector##n##Spki, kTestVector##n##Data, \
+         kTestVector##n##Sig)
 
-// RSA-PSS test vectors, pss-vect.txt, Example 6.1: A 1029-bit RSA Key Pair
-// <ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip>
-TEST_F(Pkcs11RsaPssVectorTest, VerifyKnownSignature6) {
-  SIG_TEST_VECTOR_VERIFY(kTestVector6Spki, kTestVector6Data, kTestVector6Sig);
-}
-TEST_F(Pkcs11RsaPssVectorTest, SignAndVerify6) {
-  SIG_TEST_VECTOR_SIGN_VERIFY(kTestVector6Pkcs8, kTestVector6Spki,
-                              kTestVector6Data);
-}
-
-// RSA-PSS test vectors, pss-vect.txt, Example 7.1: A 1030-bit RSA Key Pair
-// <ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip>
-TEST_F(Pkcs11RsaPssVectorTest, VerifyKnownSignature7) {
-  SIG_TEST_VECTOR_VERIFY(kTestVector7Spki, kTestVector7Data, kTestVector7Sig);
-}
-TEST_F(Pkcs11RsaPssVectorTest, SignAndVerify7) {
-  SIG_TEST_VECTOR_SIGN_VERIFY(kTestVector7Pkcs8, kTestVector7Spki,
-                              kTestVector7Data);
-}
+static const Pkcs11SignatureTestParams kRsaPssVectors[] = {
+    // RSA-PSS test vectors, pss-vect.txt, Example 1.1: A 1024-bit RSA Key Pair
+    // <ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip>
+    VECTOR_N(1),
+    // RSA-PSS test vectors, pss-vect.txt, Example 2.1: A 1025-bit RSA Key Pair
+    // <ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip>
+    VECTOR_N(2),
+    // RSA-PSS test vectors, pss-vect.txt, Example 3.1: A 1026-bit RSA Key Pair
+    // <ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip>
+    VECTOR_N(3),
+    // RSA-PSS test vectors, pss-vect.txt, Example 4.1: A 1027-bit RSA Key Pair
+    // <ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip>
+    VECTOR_N(4),
+    // RSA-PSS test vectors, pss-vect.txt, Example 5.1: A 1028-bit RSA Key Pair
+    // <ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip>
+    VECTOR_N(5),
+    // RSA-PSS test vectors, pss-vect.txt, Example 6.1: A 1029-bit RSA Key Pair
+    // <ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip>
+    VECTOR_N(6),
+    // RSA-PSS test vectors, pss-vect.txt, Example 7.1: A 1030-bit RSA Key Pair
+    // <ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip>
+    VECTOR_N(7),
+    // RSA-PSS test vectors, pss-vect.txt, Example 8.1: A 1031-bit RSA Key Pair
+    // <ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip>
+    VECTOR_N(8),
+    // RSA-PSS test vectors, pss-vect.txt, Example 9.1: A 1536-bit RSA Key Pair
+    // <ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip>
+    VECTOR_N(9),
+    // RSA-PSS test vectors, pss-vect.txt, Example 10.1: A 2048-bit RSA Key Pair
+    // <ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip>
+    VECTOR_N(10)};
 
-// RSA-PSS test vectors, pss-vect.txt, Example 8.1: A 1031-bit RSA Key Pair
-// <ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip>
-TEST_F(Pkcs11RsaPssVectorTest, VerifyKnownSignature8) {
-  SIG_TEST_VECTOR_VERIFY(kTestVector8Spki, kTestVector8Data, kTestVector8Sig);
-}
-TEST_F(Pkcs11RsaPssVectorTest, SignAndVerify8) {
-  SIG_TEST_VECTOR_SIGN_VERIFY(kTestVector8Pkcs8, kTestVector8Spki,
-                              kTestVector8Data);
-}
-
-// RSA-PSS test vectors, pss-vect.txt, Example 9.1: A 1536-bit RSA Key Pair
-// <ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip>
-TEST_F(Pkcs11RsaPssVectorTest, VerifyKnownSignature9) {
-  SIG_TEST_VECTOR_VERIFY(kTestVector9Spki, kTestVector9Data, kTestVector9Sig);
-}
-TEST_F(Pkcs11RsaPssVectorTest, SignAndVerify9) {
-  SIG_TEST_VECTOR_SIGN_VERIFY(kTestVector9Pkcs8, kTestVector9Spki,
-                              kTestVector9Data);
-}
-
-// RSA-PSS test vectors, pss-vect.txt, Example 10.1: A 2048-bit RSA Key Pair
-// <ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip>
-TEST_F(Pkcs11RsaPssVectorTest, VerifyKnownSignature10) {
-  SIG_TEST_VECTOR_VERIFY(kTestVector10Spki, kTestVector10Data,
-                         kTestVector10Sig);
-}
-TEST_F(Pkcs11RsaPssVectorTest, SignAndVerify10) {
-  SIG_TEST_VECTOR_SIGN_VERIFY(kTestVector10Pkcs8, kTestVector10Spki,
-                              kTestVector10Data);
-}
+INSTANTIATE_TEST_CASE_P(RsaPssSignVerify, Pkcs11RsaPssVectorTest,
+                        ::testing::ValuesIn(kRsaPssVectors));
 
 }  // namespace nss_test

--- a/security/nss/gtests/pk11_gtest/pk11_signature_test.h
+++ b/security/nss/gtests/pk11_gtest/pk11_signature_test.h
@@ -4,135 +4,133 @@
 
 #include <memory>
 #include "nss.h"
 #include "pk11pub.h"
 #include "sechash.h"
 
 #include "cpputil.h"
 #include "scoped_ptrs.h"
+#include "databuffer.h"
 
 #include "gtest/gtest.h"
 
 namespace nss_test {
 
+// For test vectors.
+struct Pkcs11SignatureTestParams {
+  const DataBuffer pkcs8_;
+  const DataBuffer spki_;
+  const DataBuffer data_;
+  const DataBuffer signature_;
+};
+
 class Pk11SignatureTest : public ::testing::Test {
  protected:
-  virtual CK_MECHANISM_TYPE mechanism() = 0;
-  virtual SECItem* parameters() = 0;
-  virtual SECOidTag hashOID() = 0;
+  Pk11SignatureTest(CK_MECHANISM_TYPE mechanism, SECOidTag hash_oid)
+      : mechanism_(mechanism), hash_oid_(hash_oid) {}
 
-  ScopedSECKEYPrivateKey ImportPrivateKey(const uint8_t* pkcs8,
-                                          size_t pkcs8_len) {
+  virtual const SECItem* parameters() const { return nullptr; }
+  CK_MECHANISM_TYPE mechanism() const { return mechanism_; }
+
+  ScopedSECKEYPrivateKey ImportPrivateKey(const DataBuffer& pkcs8) {
     ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
     if (!slot) {
+      ADD_FAILURE() << "No slot";
       return nullptr;
     }
 
-    SECItem pkcs8Item = {siBuffer, toUcharPtr(pkcs8),
-                         static_cast<unsigned int>(pkcs8_len)};
+    SECItem pkcs8Item = {siBuffer, toUcharPtr(pkcs8.data()),
+                         static_cast<unsigned int>(pkcs8.len())};
 
     SECKEYPrivateKey* key = nullptr;
     SECStatus rv = PK11_ImportDERPrivateKeyInfoAndReturnKey(
         slot.get(), &pkcs8Item, nullptr, nullptr, false, false, KU_ALL, &key,
         nullptr);
 
     if (rv != SECSuccess) {
       return nullptr;
     }
 
     return ScopedSECKEYPrivateKey(key);
   }
 
-  ScopedSECKEYPublicKey ImportPublicKey(const uint8_t* spki, size_t spki_len) {
-    SECItem spkiItem = {siBuffer, toUcharPtr(spki),
-                        static_cast<unsigned int>(spki_len)};
+  ScopedSECKEYPublicKey ImportPublicKey(const DataBuffer& spki) {
+    SECItem spkiItem = {siBuffer, toUcharPtr(spki.data()),
+                        static_cast<unsigned int>(spki.len())};
 
     ScopedCERTSubjectPublicKeyInfo certSpki(
         SECKEY_DecodeDERSubjectPublicKeyInfo(&spkiItem));
 
     return ScopedSECKEYPublicKey(SECKEY_ExtractPublicKey(certSpki.get()));
   }
 
-  ScopedSECItem ComputeHash(const uint8_t* data, size_t len) {
-    unsigned int hLen = HASH_ResultLenByOidTag(hashOID());
-    ScopedSECItem hash(SECITEM_AllocItem(nullptr, nullptr, hLen));
-    if (!hash) {
-      return nullptr;
-    }
-
-    SECStatus rv = PK11_HashBuf(hashOID(), hash->data, data, len);
-    if (rv != SECSuccess) {
-      return nullptr;
-    }
-
-    return hash;
+  bool ComputeHash(const DataBuffer& data, DataBuffer* hash) {
+    hash->Allocate(static_cast<size_t>(HASH_ResultLenByOidTag(hash_oid_)));
+    SECStatus rv =
+        PK11_HashBuf(hash_oid_, hash->data(), data.data(), data.len());
+    return rv == SECSuccess;
   }
 
-  ScopedSECItem SignHashedData(ScopedSECKEYPrivateKey& privKey,
-                               ScopedSECItem& hash) {
-    unsigned int sLen = PK11_SignatureLen(privKey.get());
-    ScopedSECItem sig(SECITEM_AllocItem(nullptr, nullptr, sLen));
-    if (!sig) {
-      return nullptr;
-    }
-
-    SECStatus rv = PK11_SignWithMechanism(privKey.get(), mechanism(),
-                                          parameters(), sig.get(), hash.get());
-    if (rv != SECSuccess) {
-      return nullptr;
-    }
-
-    return sig;
+  bool SignHashedData(ScopedSECKEYPrivateKey& privKey, const DataBuffer& hash,
+                      DataBuffer* sig) {
+    SECItem hashItem = {siBuffer, toUcharPtr(hash.data()),
+                        static_cast<unsigned int>(hash.len())};
+    int sigLen = PK11_SignatureLen(privKey.get());
+    EXPECT_LT(0, sigLen);
+    sig->Allocate(static_cast<size_t>(sigLen));
+    SECItem sigItem = {siBuffer, toUcharPtr(sig->data()),
+                       static_cast<unsigned int>(sig->len())};
+    SECStatus rv = PK11_SignWithMechanism(privKey.get(), mechanism_,
+                                          parameters(), &sigItem, &hashItem);
+    return rv == SECSuccess;
   }
 
-  ScopedSECItem ImportPrivateKeyAndSignHashedData(const uint8_t* pkcs8,
-                                                  size_t pkcs8_len,
-                                                  const uint8_t* data,
-                                                  size_t data_len) {
-    ScopedSECKEYPrivateKey privKey(ImportPrivateKey(pkcs8, pkcs8_len));
+  bool ImportPrivateKeyAndSignHashedData(const DataBuffer& pkcs8,
+                                         const DataBuffer& data,
+                                         DataBuffer* sig) {
+    ScopedSECKEYPrivateKey privKey(ImportPrivateKey(pkcs8));
     if (!privKey) {
-      return nullptr;
-    }
-
-    ScopedSECItem hash(ComputeHash(data, data_len));
-    if (!hash) {
-      return nullptr;
+      return false;
     }
 
-    return ScopedSECItem(SignHashedData(privKey, hash));
+    DataBuffer hash;
+    if (!ComputeHash(data, &hash)) {
+      ADD_FAILURE() << "Failed to compute hash";
+      return false;
+    }
+    return SignHashedData(privKey, hash, sig);
   }
 
-  void Verify(const uint8_t* spki, size_t spki_len, const uint8_t* data,
-              size_t data_len, const uint8_t* sig, size_t sig_len) {
-    ScopedSECKEYPublicKey pubKey(ImportPublicKey(spki, spki_len));
+  void Verify(const Pkcs11SignatureTestParams& params, const DataBuffer& sig) {
+    ScopedSECKEYPublicKey pubKey(ImportPublicKey(params.spki_));
     ASSERT_TRUE(pubKey);
 
-    ScopedSECItem hash(ComputeHash(data, data_len));
-    ASSERT_TRUE(hash);
-
-    SECItem sigItem = {siBuffer, toUcharPtr(sig),
-                       static_cast<unsigned int>(sig_len)};
+    DataBuffer hash;
+    ASSERT_TRUE(ComputeHash(params.data_, &hash));
 
     // Verify.
+    SECItem hashItem = {siBuffer, toUcharPtr(hash.data()),
+                        static_cast<unsigned int>(hash.len())};
+    SECItem sigItem = {siBuffer, toUcharPtr(sig.data()),
+                       static_cast<unsigned int>(sig.len())};
     SECStatus rv = PK11_VerifyWithMechanism(
-        pubKey.get(), mechanism(), parameters(), &sigItem, hash.get(), nullptr);
+        pubKey.get(), mechanism_, parameters(), &sigItem, &hashItem, nullptr);
     EXPECT_EQ(rv, SECSuccess);
   }
 
-  void SignAndVerify(const uint8_t* pkcs8, size_t pkcs8_len,
-                     const uint8_t* spki, size_t spki_len, const uint8_t* data,
-                     size_t data_len) {
-    ScopedSECItem sig(
-        ImportPrivateKeyAndSignHashedData(pkcs8, pkcs8_len, data, data_len));
-    ASSERT_TRUE(sig);
+  void Verify(const Pkcs11SignatureTestParams& params) {
+    Verify(params, params.signature_);
+  }
 
-    Verify(spki, spki_len, data, data_len, sig->data, sig->len);
+  void SignAndVerify(const Pkcs11SignatureTestParams& params) {
+    DataBuffer sig;
+    ASSERT_TRUE(
+        ImportPrivateKeyAndSignHashedData(params.pkcs8_, params.data_, &sig));
+    Verify(params, sig);
   }
+
+ private:
+  CK_MECHANISM_TYPE mechanism_;
+  SECOidTag hash_oid_;
 };
 
-#define SIG_TEST_VECTOR_VERIFY(spki, data, sig) \
-  Verify(spki, sizeof(spki), data, sizeof(data), sig, sizeof(sig));
-
-#define SIG_TEST_VECTOR_SIGN_VERIFY(pkcs8, spki, data) \
-  SignAndVerify(pkcs8, sizeof(pkcs8), spki, sizeof(spki), data, sizeof(data));
-
 }  // namespace nss_test

--- a/security/nss/gtests/softoken_gtest/softoken_gtest.cc
+++ b/security/nss/gtests/softoken_gtest/softoken_gtest.cc
@@ -1,10 +1,12 @@
 #include <cstdlib>
 
+#include "cert.h"
+#include "certdb.h"
 #include "nspr.h"
 #include "nss.h"
 #include "pk11pub.h"
 #include "secerr.h"
 
 #include "scoped_ptrs.h"
 
 #define GTEST_HAS_RTTI 0
@@ -195,16 +197,120 @@ TEST_F(SoftokenTest, CreateObjectChangeT
   EXPECT_EQ(SEC_ERROR_TOKEN_NOT_LOGGED_IN, PORT_GetError());
   ScopedPK11GenericObject obj(PK11_CreateGenericObject(
       slot.get(), attributes, PR_ARRAY_SIZE(attributes), true));
   // Because there's no password we can't logout and the operation should have
   // succeeded.
   EXPECT_NE(nullptr, obj);
 }
 
+// This is just any X509 certificate. Its contents don't matter.
+static unsigned char certDER[] = {
+    0x30, 0x82, 0x01, 0xEF, 0x30, 0x82, 0x01, 0x94, 0xA0, 0x03, 0x02, 0x01,
+    0x02, 0x02, 0x14, 0x49, 0xC4, 0xC4, 0x4A, 0xB6, 0x86, 0x07, 0xA3, 0x06,
+    0xDC, 0x4D, 0xC8, 0xC3, 0xFE, 0xC7, 0x21, 0x3A, 0x2D, 0xE4, 0xDA, 0x30,
+    0x0B, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0B,
+    0x30, 0x0F, 0x31, 0x0D, 0x30, 0x0B, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0C,
+    0x04, 0x74, 0x65, 0x73, 0x74, 0x30, 0x22, 0x18, 0x0F, 0x32, 0x30, 0x31,
+    0x35, 0x31, 0x31, 0x32, 0x38, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5A,
+    0x18, 0x0F, 0x32, 0x30, 0x31, 0x38, 0x30, 0x32, 0x30, 0x35, 0x30, 0x30,
+    0x30, 0x30, 0x30, 0x30, 0x5A, 0x30, 0x0F, 0x31, 0x0D, 0x30, 0x0B, 0x06,
+    0x03, 0x55, 0x04, 0x03, 0x0C, 0x04, 0x74, 0x65, 0x73, 0x74, 0x30, 0x82,
+    0x01, 0x22, 0x30, 0x0D, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D,
+    0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0F, 0x00, 0x30, 0x82,
+    0x01, 0x0A, 0x02, 0x82, 0x01, 0x01, 0x00, 0xBA, 0x88, 0x51, 0xA8, 0x44,
+    0x8E, 0x16, 0xD6, 0x41, 0xFD, 0x6E, 0xB6, 0x88, 0x06, 0x36, 0x10, 0x3D,
+    0x3C, 0x13, 0xD9, 0xEA, 0xE4, 0x35, 0x4A, 0xB4, 0xEC, 0xF5, 0x68, 0x57,
+    0x6C, 0x24, 0x7B, 0xC1, 0xC7, 0x25, 0xA8, 0xE0, 0xD8, 0x1F, 0xBD, 0xB1,
+    0x9C, 0x06, 0x9B, 0x6E, 0x1A, 0x86, 0xF2, 0x6B, 0xE2, 0xAF, 0x5A, 0x75,
+    0x6B, 0x6A, 0x64, 0x71, 0x08, 0x7A, 0xA5, 0x5A, 0xA7, 0x45, 0x87, 0xF7,
+    0x1C, 0xD5, 0x24, 0x9C, 0x02, 0x7E, 0xCD, 0x43, 0xFC, 0x1E, 0x69, 0xD0,
+    0x38, 0x20, 0x29, 0x93, 0xAB, 0x20, 0xC3, 0x49, 0xE4, 0xDB, 0xB9, 0x4C,
+    0xC2, 0x6B, 0x6C, 0x0E, 0xED, 0x15, 0x82, 0x0F, 0xF1, 0x7E, 0xAD, 0x69,
+    0x1A, 0xB1, 0xD3, 0x02, 0x3A, 0x8B, 0x2A, 0x41, 0xEE, 0xA7, 0x70, 0xE0,
+    0x0F, 0x0D, 0x8D, 0xFD, 0x66, 0x0B, 0x2B, 0xB0, 0x24, 0x92, 0xA4, 0x7D,
+    0xB9, 0x88, 0x61, 0x79, 0x90, 0xB1, 0x57, 0x90, 0x3D, 0xD2, 0x3B, 0xC5,
+    0xE0, 0xB8, 0x48, 0x1F, 0xA8, 0x37, 0xD3, 0x88, 0x43, 0xEF, 0x27, 0x16,
+    0xD8, 0x55, 0xB7, 0x66, 0x5A, 0xAA, 0x7E, 0x02, 0x90, 0x2F, 0x3A, 0x7B,
+    0x10, 0x80, 0x06, 0x24, 0xCC, 0x1C, 0x6C, 0x97, 0xAD, 0x96, 0x61, 0x5B,
+    0xB7, 0xE2, 0x96, 0x12, 0xC0, 0x75, 0x31, 0xA3, 0x0C, 0x91, 0xDD, 0xB4,
+    0xCA, 0xF7, 0xFC, 0xAD, 0x1D, 0x25, 0xD3, 0x09, 0xEF, 0xB9, 0x17, 0x0E,
+    0xA7, 0x68, 0xE1, 0xB3, 0x7B, 0x2F, 0x22, 0x6F, 0x69, 0xE3, 0xB4, 0x8A,
+    0x95, 0x61, 0x1D, 0xEE, 0x26, 0xD6, 0x25, 0x9D, 0xAB, 0x91, 0x08, 0x4E,
+    0x36, 0xCB, 0x1C, 0x24, 0x04, 0x2C, 0xBF, 0x16, 0x8B, 0x2F, 0xE5, 0xF1,
+    0x8F, 0x99, 0x17, 0x31, 0xB8, 0xB3, 0xFE, 0x49, 0x23, 0xFA, 0x72, 0x51,
+    0xC4, 0x31, 0xD5, 0x03, 0xAC, 0xDA, 0x18, 0x0A, 0x35, 0xED, 0x8D, 0x02,
+    0x03, 0x01, 0x00, 0x01, 0x30, 0x0B, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86,
+    0xF7, 0x0D, 0x01, 0x01, 0x0B, 0x03, 0x48, 0x00, 0x30, 0x45, 0x02, 0x20,
+    0x5C, 0x75, 0x51, 0x9F, 0x13, 0x11, 0x50, 0xCD, 0x5D, 0x8A, 0xDE, 0x20,
+    0xA3, 0xBC, 0x06, 0x30, 0x91, 0xFF, 0xB2, 0x73, 0x75, 0x5F, 0x31, 0x64,
+    0xEC, 0xFD, 0xCB, 0x42, 0x80, 0x0A, 0x70, 0xE6, 0x02, 0x21, 0x00, 0x82,
+    0x12, 0xF7, 0xE5, 0xEA, 0x40, 0x27, 0xFD, 0xF7, 0xC0, 0x0E, 0x25, 0xF3,
+    0x3E, 0x34, 0x95, 0x80, 0xB9, 0xA3, 0x38, 0xE0, 0x56, 0x68, 0xDA, 0xE5,
+    0xC1, 0xF5, 0x37, 0xC7, 0xB5, 0xCE, 0x0D};
+
+struct PasswordPair {
+  const char *mInitialPassword;
+  const char *mSecondPassword;
+};
+
+class SoftokenPasswordChangeTest
+    : public SoftokenTest,
+      public ::testing::WithParamInterface<PasswordPair> {};
+
+TEST_P(SoftokenPasswordChangeTest, KeepTrustAfterPasswordChange) {
+  const PasswordPair &passwords = GetParam();
+  ScopedPK11SlotInfo slot(PK11_GetInternalKeySlot());
+  ASSERT_TRUE(slot);
+  // Set a password.
+  EXPECT_EQ(SECSuccess,
+            PK11_InitPin(slot.get(), nullptr, passwords.mInitialPassword));
+  SECItem certDERItem = {siBuffer, certDER, sizeof(certDER)};
+  // Import a certificate.
+  ScopedCERTCertificate cert(CERT_NewTempCertificate(
+      CERT_GetDefaultCertDB(), &certDERItem, nullptr, true, true));
+  EXPECT_TRUE(cert);
+  SECStatus result =
+      PK11_ImportCert(slot.get(), cert.get(), CK_INVALID_HANDLE, "test", false);
+  EXPECT_EQ(SECSuccess, result);
+  // Set a trust value.
+  CERTCertTrust trust = {CERTDB_TRUSTED_CLIENT_CA | CERTDB_NS_TRUSTED_CA |
+                             CERTDB_TRUSTED_CA | CERTDB_VALID_CA,
+                         0, 0};
+  result = CERT_ChangeCertTrust(nullptr, cert.get(), &trust);
+  EXPECT_EQ(SECSuccess, result);
+  // Release the certificate to ensure we get it from the DB rather than an
+  // in-memory cache, below.
+  cert = nullptr;
+  // Change the password.
+  result = PK11_ChangePW(slot.get(), passwords.mInitialPassword,
+                         passwords.mSecondPassword);
+  EXPECT_EQ(SECSuccess, result);
+  // Look up the certificate again.
+  ScopedCERTCertificate newCert(
+      PK11_FindCertFromDERCertItem(slot.get(), &certDERItem, nullptr));
+  EXPECT_TRUE(newCert.get());
+  // The trust should be the same as before.
+  CERTCertTrust newTrust = {0, 0, 0};
+  result = CERT_GetCertTrust(newCert.get(), &newTrust);
+  EXPECT_EQ(SECSuccess, result);
+  EXPECT_EQ(trust.sslFlags, newTrust.sslFlags);
+  EXPECT_EQ(trust.emailFlags, newTrust.emailFlags);
+  EXPECT_EQ(trust.objectSigningFlags, newTrust.objectSigningFlags);
+}
+
+static const PasswordPair PASSWORD_CHANGE_TESTS[] = {
+    {"password", ""},           // non-empty to empty password
+    {"", "password"},           // empty to non-empty password
+    {"password", "password2"},  // non-empty to non-empty password
+};
+
+INSTANTIATE_TEST_CASE_P(SoftokenPasswordChangeTests, SoftokenPasswordChangeTest,
+                        ::testing::ValuesIn(PASSWORD_CHANGE_TESTS));
+
 class SoftokenNoDBTest : public ::testing::Test {};
 
 TEST_F(SoftokenNoDBTest, NeedUserInitNoDB) {
   ASSERT_EQ(SECSuccess, NSS_NoDB_Init("."));
   ScopedPK11SlotInfo slot(PK11_GetInternalKeySlot());
   ASSERT_TRUE(slot);
   EXPECT_EQ(PR_FALSE, PK11_NeedUserInit(slot.get()));
 

--- a/security/nss/lib/softoken/sftkdb.c
+++ b/security/nss/lib/softoken/sftkdb.c
@@ -35,17 +35,17 @@
  * are endian/length independent except those attributes that pass CK_ULONG.
  *
  * The following functions fixes up the CK_ULONG type attributes so that the data
  * base sees a machine independent view. CK_ULONGs are stored as 4 byte network
  * byte order values (big endian).
  */
 #define BBP 8
 
-static PRBool
+PRBool
 sftkdb_isULONGAttribute(CK_ATTRIBUTE_TYPE type)
 {
     switch (type) {
         case CKA_CERTIFICATE_CATEGORY:
         case CKA_CERTIFICATE_TYPE:
         case CKA_CLASS:
         case CKA_JAVA_MIDP_SECURITY_DOMAIN:
         case CKA_KEY_GEN_MECHANISM:
@@ -1365,34 +1365,35 @@ sftkdb_SetAttributeValue(SFTKDBHandle *h
     }
 
     ntemplate = sftkdb_fixupTemplateIn(template, count, &data);
     if (ntemplate == NULL) {
         return CKR_HOST_MEMORY;
     }
 
     /* make sure we don't have attributes that conflict with the existing DB */
-    crv = sftkdb_checkConflicts(db, object->objclass, template, count, objectID);
+    crv = sftkdb_checkConflicts(db, object->objclass, ntemplate, count,
+                                objectID);
     if (crv != CKR_OK) {
         goto loser;
     }
 
     arena = PORT_NewArena(256);
     if (arena == NULL) {
         crv = CKR_HOST_MEMORY;
         goto loser;
     }
 
     crv = (*db->sdb_Begin)(db);
     if (crv != CKR_OK) {
         goto loser;
     }
     inTransaction = PR_TRUE;
-    crv = sftkdb_setAttributeValue(arena, handle, db,
-                                   objectID, template, count);
+    crv = sftkdb_setAttributeValue(arena, handle, db, objectID, ntemplate,
+                                   count);
     if (crv != CKR_OK) {
         goto loser;
     }
     crv = (*db->sdb_Commit)(db);
 loser:
     if (crv != CKR_OK && inTransaction) {
         (*db->sdb_Abort)(db);
     }

--- a/security/nss/lib/softoken/sftkdbti.h
+++ b/security/nss/lib/softoken/sftkdbti.h
@@ -44,15 +44,16 @@ SECStatus sftkdb_SignAttribute(PLArenaPo
                                CK_OBJECT_HANDLE objectID,
                                CK_ATTRIBUTE_TYPE attrType,
                                SECItem *plainText, SECItem **sigText);
 SECStatus sftkdb_VerifyAttribute(SECItem *passKey,
                                  CK_OBJECT_HANDLE objectID,
                                  CK_ATTRIBUTE_TYPE attrType,
                                  SECItem *plainText, SECItem *sigText);
 
+PRBool sftkdb_isULONGAttribute(CK_ATTRIBUTE_TYPE type);
 void sftk_ULong2SDBULong(unsigned char *data, CK_ULONG value);
 CK_RV sftkdb_Update(SFTKDBHandle *handle, SECItem *key);
 CK_RV sftkdb_PutAttributeSignature(SFTKDBHandle *handle,
                                    SDB *keyTarget, CK_OBJECT_HANDLE objectID,
                                    CK_ATTRIBUTE_TYPE type, SECItem *signText);
 
 #endif

--- a/security/nss/lib/softoken/sftkpwd.c
+++ b/security/nss/lib/softoken/sftkpwd.c
@@ -921,16 +921,23 @@ sftk_updateMacs(PLArenaPool *arena, SFTK
         SECItem *signText;
         SECItem plainText;
         SECStatus rv;
 
         if ((authAttrs[i].ulValueLen == -1) || (authAttrs[i].ulValueLen == 0)) {
             continue;
         }
 
+        if (authAttrs[i].ulValueLen == sizeof(CK_ULONG) &&
+            sftkdb_isULONGAttribute(authAttrs[i].type)) {
+            CK_ULONG value = *(CK_ULONG *)authAttrs[i].pValue;
+            sftk_ULong2SDBULong(authAttrs[i].pValue, value);
+            authAttrs[i].ulValueLen = SDB_ULONG_SIZE;
+        }
+
         plainText.data = authAttrs[i].pValue;
         plainText.len = authAttrs[i].ulValueLen;
         rv = sftkdb_SignAttribute(arena, newKey, id,
                                   authAttrs[i].type, &plainText, &signText);
         if (rv != SECSuccess) {
             return CKR_GENERAL_ERROR;
         }
         rv = sftkdb_PutAttributeSignature(handle, keyTarget, id,

--- a/security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp
+++ b/security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp
@@ -33,20 +33,16 @@
 // processes and so they will be unloaded if they attempt to load.
 const std::vector<std::wstring> kDllsToUnload = {
   // HitmanPro - SurfRight now part of Sophos (bug 1400637)
   L"hmpalert.dll",
 
   // K7 Computing (bug 1400637)
   L"k7pswsen.dll",
 
-  // Symantec (bug 1400637)
-  L"prntm64.dll",
-  L"sysfer.dll",
-
   // Avast Antivirus (bug 1400637)
   L"snxhk64.dll",
   L"snxhk.dll",
 
   // Webroot SecureAnywhere (bug 1400637)
   L"wrusr.dll",
 };
 

--- a/services/sync/modules/engines/history.js
+++ b/services/sync/modules/engines/history.js
@@ -240,26 +240,27 @@ HistoryStore.prototype = {
                       + record.uri.spec + ": can't add this URI.");
       return false;
     }
 
     // We dupe visits by date and type. So an incoming visit that has
     // the same timestamp and type as a local one won't get applied.
     // To avoid creating new objects, we rewrite the query result so we
     // can simply check for containment below.
-    let curVisits = [];
+    let curVisitsAsArray = [];
+    let curVisits = new Set();
     try {
-      curVisits = await PlacesSyncUtils.history.fetchVisitsForURL(record.histUri);
+      curVisitsAsArray = await PlacesSyncUtils.history.fetchVisitsForURL(record.histUri);
     } catch (e) {
       this._log.error("Error while fetching visits for URL ${record.histUri}", record.histUri);
     }
 
     let i, k;
-    for (i = 0; i < curVisits.length; i++) {
-      curVisits[i] = curVisits[i].date + "," + curVisits[i].type;
+    for (i = 0; i < curVisitsAsArray.length; i++) {
+      curVisits.add(curVisitsAsArray[i].date + "," + curVisitsAsArray[i].type);
     }
 
     // Walk through the visits, make sure we have sound data, and eliminate
     // dupes. The latter is done by rewriting the array in-place.
     for (i = 0, k = 0; i < record.visits.length; i++) {
       let visit = record.visits[k] = record.visits[i];
 
       if (!visit.date || typeof visit.date != "number" || !Number.isInteger(visit.date)) {
@@ -277,25 +278,25 @@ HistoryStore.prototype = {
 
       // Dates need to be integers. Future and far past dates are clamped to the
       // current date and earliest sensible date, respectively.
       let originalVisitDate = PlacesUtils.toDate(Math.round(visit.date));
       visit.date = PlacesSyncUtils.history.clampVisitDate(originalVisitDate);
 
       let visitDateAsPRTime = PlacesUtils.toPRTime(visit.date);
       let visitKey = visitDateAsPRTime + "," + visit.type;
-      if (curVisits.indexOf(visitKey) != -1) {
+      if (curVisits.has(visitKey)) {
         // Visit is a dupe, don't increment 'k' so the element will be
         // overwritten.
         continue;
       }
 
       // Note the visit key, so that we don't add duplicate visits with
       // clamped timestamps.
-      curVisits.push(visitKey);
+      curVisits.add(visitKey);
 
       visit.transition = visit.type;
       k += 1;
     }
     record.visits.length = k; // truncate array
 
     // No update if there aren't any visits to apply.
     // mozIAsyncHistory::updatePlaces() wants at least one visit.

--- a/testing/web-platform/tests/tools/wptrunner/wptrunner/browsers/firefox.py
+++ b/testing/web-platform/tests/tools/wptrunner/wptrunner/browsers/firefox.py
@@ -185,17 +185,18 @@ class FirefoxBrowser(Browser):
 
         self.profile = FirefoxProfile(locations=locations,
                                       preferences=preferences)
         self.profile.set_preferences({"marionette.port": self.marionette_port,
                                       "dom.disable_open_during_load": False,
                                       "network.dns.localDomains": ",".join(hostnames),
                                       "network.proxy.type": 0,
                                       "places.history.enabled": False,
-                                      "dom.send_after_paint_to_content": True})
+                                      "dom.send_after_paint_to_content": True,
+                                      "network.preload": True})
         if self.e10s:
             self.profile.set_preferences({"browser.tabs.remote.autostart": True})
 
         if self.test_type == "reftest":
             self.profile.set_preferences({"layout.interruptible-reflow.enabled": False})
 
         if self.leak_check and kwargs.get("check_leaks", True):
             self.leak_report_file = os.path.join(self.profile.profile, "runtests_leaks.log")

--- a/toolkit/components/extensions/ExtensionParent.jsm
+++ b/toolkit/components/extensions/ExtensionParent.jsm
@@ -766,29 +766,33 @@ ParentAPIManager = {
   async addListener(data, target) {
     let context = this.getContextById(data.childId);
     if (context.parentMessageManager !== target.messageManager) {
       throw new Error("Got message on unexpected message manager");
     }
 
     let {childId} = data;
     let handlingUserInput = false;
+    let lowPriority = data.path.startsWith("webRequest.");
 
     function listener(...listenerArgs) {
       return context.sendMessage(
         context.parentMessageManager,
         "API:RunListener",
         {
           childId,
           handlingUserInput,
           listenerId: data.listenerId,
           path: data.path,
-          args: new StructuredCloneHolder(listenerArgs),
+          get args() {
+            return new StructuredCloneHolder(listenerArgs);
+          },
         },
         {
+          lowPriority,
           recipient: {childId},
         }).then(result => {
           return result && result.deserialize(global);
         });
     }
 
     context.listenerProxies.set(data.listenerId, listener);