--- a/browser/components/sessionstore/test/browser.ini
+++ b/browser/components/sessionstore/test/browser.ini
@@ -204,16 +204,17 @@ skip-if = true # Needs to be rewritten a
 [browser_687710_2.js]
 [browser_694378.js]
 [browser_701377.js]
 [browser_705597.js]
 [browser_707862.js]
 [browser_739531.js]
 [browser_739805.js]
 [browser_819510_perwindowpb.js]
+skip-if = (os == 'win' && bits == 64) # Bug 1284312
 
 # Disabled for frequent intermittent failures
 [browser_464620_a.js]
 skip-if = true
 [browser_464620_b.js]
 skip-if = true
 
 # Disabled on OS X:

--- a/browser/modules/SitePermissions.jsm
+++ b/browser/modules/SitePermissions.jsm
@@ -572,19 +572,26 @@ var gPermissionObject = {
     }
   },
 
   "desktop-notification": {
     exactHostMatch: true,
     labelID: "desktop-notification2",
   },
 
-  "camera": {},
-  "microphone": {},
+  "camera": {
+    exactHostMatch: true,
+  },
+
+  "microphone": {
+    exactHostMatch: true,
+  },
+
   "screen": {
+    exactHostMatch: true,
     states: [ SitePermissions.UNKNOWN, SitePermissions.BLOCK ],
   },
 
   "popup": {
     getDefault() {
       return Services.prefs.getBoolPref("dom.disable_open_during_load") ?
                SitePermissions.BLOCK : SitePermissions.ALLOW;
     }

--- a/browser/modules/test/unit/test_SitePermissions.js
+++ b/browser/modules/test/unit/test_SitePermissions.js
@@ -62,8 +62,40 @@ add_task(function* testGetAvailableState
                    [ SitePermissions.ALLOW,
                      SitePermissions.ALLOW_COOKIES_FOR_SESSION,
                      SitePermissions.BLOCK ]);
 
   Assert.deepEqual(SitePermissions.getAvailableStates("popup"),
                    [ SitePermissions.ALLOW,
                      SitePermissions.BLOCK ]);
 });
+
+add_task(function* testExactHostMatch() {
+  let uri = Services.io.newURI("https://example.com");
+  let subUri = Services.io.newURI("https://test1.example.com");
+
+  let exactHostMatched = ["desktop-notification", "camera", "microphone", "screen", "geo"];
+  let nonExactHostMatched = ["image", "cookie", "popup", "install", "indexedDB"];
+
+  let permissions = SitePermissions.listPermissions();
+  for (let permission of permissions) {
+    SitePermissions.set(uri, permission, SitePermissions.ALLOW);
+
+    if (exactHostMatched.includes(permission)) {
+      // Check that the sub-origin does not inherit the permission from its parent.
+      Assert.equal(SitePermissions.get(subUri, permission).state, SitePermissions.UNKNOWN);
+    } else if (nonExactHostMatched.includes(permission)) {
+      // Check that the sub-origin does inherit the permission from its parent.
+      Assert.equal(SitePermissions.get(subUri, permission).state, SitePermissions.ALLOW);
+    } else {
+      Assert.ok(false, `Found an unknown permission ${permission} in exact host match test.` +
+                       "Please add new permissions from SitePermissions.jsm to this test.");
+    }
+
+    // Check that the permission can be made specific to the sub-origin.
+    SitePermissions.set(subUri, permission, SitePermissions.BLOCK);
+    Assert.equal(SitePermissions.get(subUri, permission).state, SitePermissions.BLOCK);
+    Assert.equal(SitePermissions.get(uri, permission).state, SitePermissions.ALLOW);
+
+    SitePermissions.remove(subUri, permission);
+    SitePermissions.remove(uri, permission);
+  }
+});

--- a/devtools/client/.eslintrc.js
+++ b/devtools/client/.eslintrc.js
@@ -1,9 +1,12 @@
 "use strict";
 
 module.exports = {
+  "globals": {
+    "define": true,
+  },
   "rules": {
     // See bug 1288147, the devtools front-end wants to be able to run in
     // content privileged windows, where ownerGlobal doesn't exist.
     "mozilla/use-ownerGlobal": "off",
   }
 };

--- a/devtools/client/inspector/boxmodel/components/BoxModelMain.js
+++ b/devtools/client/inspector/boxmodel/components/BoxModelMain.js
@@ -75,31 +75,51 @@ module.exports = createClass({
   },
 
   getMarginValue(property, direction) {
     let { layout } = this.props.boxModel;
     let autoMargins = layout.autoMargins || {};
     let value = "-";
 
     if (direction in autoMargins) {
-      value = "auto";
+      value = autoMargins[direction];
     } else if (layout[property]) {
-      value = parseFloat(layout[property]);
+      let parsedValue = parseFloat(layout[property]);
+
+      if (Number.isNaN(parsedValue)) {
+        // Not a number. We use the raw string.
+        // Useful for pseudo-elements with auto margins since they
+        // don't appear in autoMargins.
+        value = layout[property];
+      } else {
+        value = parsedValue;
+      }
     }
 
     return value;
   },
 
   getPositionValue(property) {
     let { layout } = this.props.boxModel;
+    let value = "-";
 
-    if (layout.position === "static") {
-      return "-";
+    if (!layout[property]) {
+      return value;
     }
-    return layout[property] ? parseFloat(layout[property]) : "-";
+
+    let parsedValue = parseFloat(layout[property]);
+
+    if (Number.isNaN(parsedValue)) {
+      // Not a number. We use the raw string.
+      value = layout[property];
+    } else {
+      value = parsedValue;
+    }
+
+    return value;
   },
 
   /**
    * While waiting for a reps fix in https://github.com/devtools-html/reps/issues/92,
    * translate nodeFront to a grip-like object that can be used with an ElementNode rep.
    *
    * @params  {NodeFront} nodeFront
    *          The NodeFront for which we want to create a grip-like object.

--- a/devtools/client/inspector/boxmodel/test/browser.ini
+++ b/devtools/client/inspector/boxmodel/test/browser.ini
@@ -18,17 +18,19 @@ support-files =
 # Disabled for too many intermittent failures (bug 1009322)
 [browser_boxmodel_editablemodel_bluronclick.js]
 [browser_boxmodel_editablemodel_border.js]
 [browser_boxmodel_editablemodel_stylerules.js]
 [browser_boxmodel_guides.js]
 [browser_boxmodel_navigation.js]
 skip-if = true # Bug 1336198
 [browser_boxmodel_offsetparent.js]
+[browser_boxmodel_positions.js]
 [browser_boxmodel_properties.js]
+[browser_boxmodel_pseudo-element.js]
 [browser_boxmodel_rotate-labels-on-sides.js]
 [browser_boxmodel_sync.js]
 [browser_boxmodel_tooltips.js]
 skip-if = true # Bug 1336198
 [browser_boxmodel_update-after-navigation.js]
 [browser_boxmodel_update-after-reload.js]
 # [browser_boxmodel_update-in-iframes.js]
 # Bug 1020038 boxmodel-view updates for iframe elements changes

--- a/devtools/client/inspector/boxmodel/test/browser_boxmodel.js
+++ b/devtools/client/inspector/boxmodel/test/browser_boxmodel.js
@@ -17,16 +17,24 @@ var res1 = [
     selector: ".boxmodel-size > .boxmodel-width",
     value: "100"
   },
   {
     selector: ".boxmodel-size > .boxmodel-height",
     value: "100.117"
   },
   {
+    selector: ".boxmodel-position.boxmodel-top > span",
+    value: 42
+  },
+  {
+    selector: ".boxmodel-position.boxmodel-left > span",
+    value: 42
+  },
+  {
     selector: ".boxmodel-margin.boxmodel-top > span",
     value: 30
   },
   {
     selector: ".boxmodel-margin.boxmodel-left > span",
     value: "auto"
   },
   {
@@ -80,16 +88,24 @@ var res2 = [
     selector: ".boxmodel-size > .boxmodel-width",
     value: "100"
   },
   {
     selector: ".boxmodel-size > .boxmodel-height",
     value: "150"
   },
   {
+    selector: ".boxmodel-position.boxmodel-top > span",
+    value: 50
+  },
+  {
+    selector: ".boxmodel-position.boxmodel-left > span",
+    value: 42
+  },
+  {
     selector: ".boxmodel-margin.boxmodel-top > span",
     value: 30
   },
   {
     selector: ".boxmodel-margin.boxmodel-left > span",
     value: "auto"
   },
   {
@@ -160,17 +176,17 @@ function* testInitialValues(inspector, v
 }
 
 function* testChangingValues(inspector, view, testActor) {
   info("Test that changing the document updates the box model");
   let viewdoc = view.document;
 
   let onUpdated = waitForUpdate(inspector);
   yield testActor.setAttribute("div", "style",
-                               "height:150px;padding-right:50px;");
+                               "height:150px;padding-right:50px;top:50px");
   yield onUpdated;
 
   for (let i = 0; i < res2.length; i++) {
     let elt = viewdoc.querySelector(res2[i].selector);
     is(elt.textContent, res2[i].value,
        res2[i].selector + " has the right value after style update.");
   }
 }

new file mode 100644
--- /dev/null
+++ b/devtools/client/inspector/boxmodel/test/browser_boxmodel_positions.js
@@ -0,0 +1,65 @@
+/* vim: set ts=2 et sw=2 tw=80: */
+/* Any copyright is dedicated to the Public Domain.
+ http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+// Test that the box model displays the right values for positions.
+
+const TEST_URI = `
+  <style type='text/css'>
+    div {
+      position: absolute;
+      left: 0;
+      margin: 0;
+      padding: 0;
+      display: none;
+      height: 100px;
+      width: 100px;
+      border: 10px solid black;
+    }
+  </style>
+  <div>Test Node</div>
+`;
+
+// Expected values:
+const res1 = [
+  {
+    selector: ".boxmodel-position.boxmodel-top > span",
+    value: "auto"
+  },
+  {
+    selector: ".boxmodel-position.boxmodel-right > span",
+    value: "auto"
+  },
+  {
+    selector: ".boxmodel-position.boxmodel-bottom > span",
+    value: "auto"
+  },
+  {
+    selector: ".boxmodel-position.boxmodel-left > span",
+    value: 0
+  },
+];
+
+add_task(function* () {
+  yield addTab("data:text/html;charset=utf-8," + encodeURIComponent(TEST_URI));
+  let {inspector, view} = yield openBoxModelView();
+  let node = yield getNodeFront("div", inspector);
+  let children = yield inspector.markup.walker.children(node);
+  let beforeElement = children.nodes[0];
+
+  yield selectNode(beforeElement, inspector);
+  yield testPositionValues(inspector, view);
+});
+
+function* testPositionValues(inspector, view) {
+  info("Test that the position values of the box model are correct");
+  let viewdoc = view.document;
+
+  for (let i = 0; i < res1.length; i++) {
+    let elt = viewdoc.querySelector(res1[i].selector);
+    is(elt.textContent, res1[i].value,
+       res1[i].selector + " has the right value.");
+  }
+}

new file mode 100644
--- /dev/null
+++ b/devtools/client/inspector/boxmodel/test/browser_boxmodel_pseudo-element.js
@@ -0,0 +1,120 @@
+/* vim: set ts=2 et sw=2 tw=80: */
+/* Any copyright is dedicated to the Public Domain.
+ http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+// Test that the box model displays the right values for a pseduo-element.
+
+const TEST_URI = `
+  <style type='text/css'>
+    div {
+      box-sizing: border-box;
+      display: block;
+      float: left;
+      line-height: 20px;
+      position: relative;
+      z-index: 2;
+      height: 100px;
+      width: 100px;
+      border: 10px solid black;
+      padding: 20px;
+      margin: 30px auto;
+    }
+
+    div::before {
+      content: 'before';
+      display: block;
+      width: 32px;
+      height: 32px;
+      margin: 0 auto 6px;
+    }
+  </style>
+  <div>Test Node</div>
+`;
+
+// Expected values:
+const res1 = [
+  {
+    selector: ".boxmodel-element-size",
+    value: "32" + "\u00D7" + "32"
+  },
+  {
+    selector: ".boxmodel-size > .boxmodel-width",
+    value: "32"
+  },
+  {
+    selector: ".boxmodel-size > .boxmodel-height",
+    value: "32"
+  },
+  {
+    selector: ".boxmodel-margin.boxmodel-top > span",
+    value: 0
+  },
+  {
+    selector: ".boxmodel-margin.boxmodel-left > span",
+    value: "auto"
+  },
+  {
+    selector: ".boxmodel-margin.boxmodel-bottom > span",
+    value: 6
+  },
+  {
+    selector: ".boxmodel-margin.boxmodel-right > span",
+    value: "auto"
+  },
+  {
+    selector: ".boxmodel-padding.boxmodel-top > span",
+    value: 0
+  },
+  {
+    selector: ".boxmodel-padding.boxmodel-left > span",
+    value: 0
+  },
+  {
+    selector: ".boxmodel-padding.boxmodel-bottom > span",
+    value: 0
+  },
+  {
+    selector: ".boxmodel-padding.boxmodel-right > span",
+    value: 0
+  },
+  {
+    selector: ".boxmodel-border.boxmodel-top > span",
+    value: 0
+  },
+  {
+    selector: ".boxmodel-border.boxmodel-left > span",
+    value: 0
+  },
+  {
+    selector: ".boxmodel-border.boxmodel-bottom > span",
+    value: 0
+  },
+  {
+    selector: ".boxmodel-border.boxmodel-right > span",
+    value: 0
+  },
+];
+
+add_task(function* () {
+  yield addTab("data:text/html;charset=utf-8," + encodeURIComponent(TEST_URI));
+  let {inspector, view} = yield openBoxModelView();
+  let node = yield getNodeFront("div", inspector);
+  let children = yield inspector.markup.walker.children(node);
+  let beforeElement = children.nodes[0];
+
+  yield selectNode(beforeElement, inspector);
+  yield testInitialValues(inspector, view);
+});
+
+function* testInitialValues(inspector, view) {
+  info("Test that the initial values of the box model are correct");
+  let viewdoc = view.document;
+
+  for (let i = 0; i < res1.length; i++) {
+    let elt = viewdoc.querySelector(res1[i].selector);
+    is(elt.textContent, res1[i].value,
+       res1[i].selector + " has the right value.");
+  }
+}

--- a/devtools/client/inspector/grids/components/GridOutline.js
+++ b/devtools/client/inspector/grids/components/GridOutline.js
@@ -10,48 +10,58 @@ const { throttle } = require("devtools/c
 
 const Types = require("../types");
 
 // The delay prior to executing the grid cell highlighting.
 const GRID_CELL_MOUSEOVER_TIMEOUT = 150;
 
 // Move SVG grid to the right 100 units, so that it is not flushed against the edge of
 // layout border
-const TRANSLATE_X = -100;
+const TRANSLATE_X = 0;
 const TRANSLATE_Y = 0;
 
-const VIEWPORT_HEIGHT = 100;
-const VIEWPORT_WIDTH = 450;
+const GRID_CELL_SCALE_FACTOR = 50;
+
+const VIEWPORT_MIN_HEIGHT = 100;
+const VIEWPORT_MAX_HEIGHT = 150;
 
 module.exports = createClass({
 
   displayName: "GridOutline",
 
   propTypes: {
     grids: PropTypes.arrayOf(PropTypes.shape(Types.grid)).isRequired,
     onShowGridAreaHighlight: PropTypes.func.isRequired,
     onShowGridCellHighlight: PropTypes.func.isRequired,
   },
 
   mixins: [ addons.PureRenderMixin ],
 
   getInitialState() {
     return {
       selectedGrids: [],
+      height: 0,
+      width: 0,
     };
   },
 
   componentWillMount() {
     // Throttle the grid highlighting of grid cells. It makes the UX smoother by not
     // lagging the grid cell highlighting if a lot of grid cells are mouseover in a
     // quick succession.
     this.highlightCell = throttle(this.highlightCell, GRID_CELL_MOUSEOVER_TIMEOUT);
   },
 
   componentWillReceiveProps({ grids }) {
+    if (this.state.selectedGrids.length < 2) {
+      this.setState({
+        height: 0,
+        width: 0,
+      });
+    }
     this.setState({
       selectedGrids: grids.filter(grid => grid.highlighted),
     });
   },
 
   /**
    * Returns the grid area name if the given grid cell is part of a grid area, otherwise
    * null.
@@ -72,16 +82,33 @@ module.exports = createClass({
 
     if (!gridArea) {
       return null;
     }
 
     return gridArea.name;
   },
 
+  /**
+   * Returns the height of the grid outline ranging between a minimum and maximum height.
+   *
+   * @return {Number} The height of the grid outline.
+   */
+  getHeight() {
+    const { height } = this.state;
+
+    if (height >= VIEWPORT_MAX_HEIGHT) {
+      return VIEWPORT_MAX_HEIGHT;
+    } else if (height <= VIEWPORT_MIN_HEIGHT) {
+      return VIEWPORT_MIN_HEIGHT;
+    }
+
+    return height;
+  },
+
   highlightCell({ target }) {
     const {
       grids,
       onShowGridAreaHighlight,
       onShowGridCellHighlight,
     } = this.props;
     const name = target.getAttribute("data-grid-area-name");
     const id = target.getAttribute("data-grid-id");
@@ -92,61 +119,82 @@ module.exports = createClass({
 
     target.setAttribute("fill", color);
 
     if (name) {
       onShowGridAreaHighlight(grids[id].nodeFront, name, color);
     }
 
     if (fragmentIndex && rowNumber && columnNumber) {
-      onShowGridCellHighlight(grids[id].nodeFront, fragmentIndex,
+      onShowGridCellHighlight(grids[id].nodeFront, color, fragmentIndex,
         rowNumber, columnNumber);
     }
   },
 
   /**
-   * Renders the grid outline for the given grid container object.
-   *
-   * @param  {Object} grid
-   *         A single grid container in the document.
-   */
+    * Renders the grid outline for the given grid container object.
+    *
+    * @param  {Object} grid
+    *         A single grid container in the document.
+    */
   renderGrid(grid) {
     const { id, color, gridFragments } = grid;
     // TODO: We are drawing the first fragment since only one is currently being stored.
     // In the future we will need to iterate over all fragments of a grid.
     let gridFragmentIndex = 0;
     const { rows, cols, areas } = gridFragments[gridFragmentIndex];
     const numberOfColumns = cols.lines.length - 1;
     const numberOfRows = rows.lines.length - 1;
     const rectangles = [];
-
-    // Draw a rectangle that acts as a border for the grid outline.
-    const border = this.renderGridOutlineBorder(numberOfRows, numberOfColumns, color);
-    rectangles.push(border);
-
     let x = 1;
     let y = 1;
-    const width = 10;
-    const height = 10;
+    let width = 0;
+    let height = 0;
+    // The grid outline border height/width is the total height/width of grid cells drawn.
+    let totalHeight = 0;
+    let totalWidth = 0;
 
-    // Draw the cells within the grid outline border.
+      // Draw the cells contained within the grid outline border.
     for (let rowNumber = 1; rowNumber <= numberOfRows; rowNumber++) {
+      height = GRID_CELL_SCALE_FACTOR * (rows.tracks[rowNumber - 1].breadth / 100);
       for (let columnNumber = 1; columnNumber <= numberOfColumns; columnNumber++) {
+        width = GRID_CELL_SCALE_FACTOR * (cols.tracks[columnNumber - 1].breadth / 100);
+
         const gridAreaName = this.getGridAreaName(columnNumber, rowNumber, areas);
-        const gridCell = this.renderGridCell(id, gridFragmentIndex, x, y, rowNumber,
-          columnNumber, color, gridAreaName);
+        const gridCell = this.renderGridCell(id, gridFragmentIndex, x, y,
+          rowNumber, columnNumber, color, gridAreaName, width, height);
 
         rectangles.push(gridCell);
         x += width;
       }
 
       x = 1;
       y += height;
+      totalHeight += height;
     }
 
+    // Find the total width of the grid container so we can draw the border for it
+    for (let columnNumber = 0; columnNumber < numberOfColumns; columnNumber++) {
+      totalWidth += GRID_CELL_SCALE_FACTOR * (cols.tracks[columnNumber].breadth / 100);
+    }
+
+    // Store the height of the grid container in the component state to prevent overflow
+    // issues. We want to store the width of the grid container as well so that the
+    // viewbox is only the calculated width of the grid outline.
+    if (totalHeight > this.state.height || totalWidth > this.state.width) {
+      this.setState({
+        height: totalHeight + 20,
+        width: totalWidth,
+      });
+    }
+
+    // Draw a rectangle that acts as the grid outline border.
+    const border = this.renderGridOutlineBorder(totalWidth, totalHeight, color);
+    rectangles.unshift(border);
+
     return rectangles;
   },
 
   /**
    * Renders the grid cell of a grid fragment.
    *
    * @param  {Number} id
    *         The grid id stored on the grid fragment
@@ -157,31 +205,35 @@ module.exports = createClass({
    * @param  {Number} y
    *         The y-position of the grid cell.
    * @param  {Number} rowNumber
    *         The row number of the grid cell.
    * @param  {Number} columnNumber
    *         The column number of the grid cell.
    * @param  {String|null} gridAreaName
    *         The grid area name or null if the grid cell is not part of a grid area.
+   * @param  {Number} width
+   *         The width of grid cell.
+   * @param  {Number} height
+   *         The height of the grid cell.
    */
   renderGridCell(id, gridFragmentIndex, x, y, rowNumber, columnNumber, color,
-    gridAreaName) {
+    gridAreaName, width, height) {
     return dom.rect(
       {
         className: "grid-outline-cell",
         "data-grid-area-name": gridAreaName,
         "data-grid-fragment-index": gridFragmentIndex,
         "data-grid-id": id,
         "data-grid-row": rowNumber,
         "data-grid-column": columnNumber,
         x,
         y,
-        width: 10,
-        height: 10,
+        width,
+        height,
         fill: "none",
         stroke: color,
         onMouseOver: this.onMouseOverCell,
         onMouseOut: this.onMouseLeaveCell,
       }
     );
   },
 
@@ -189,24 +241,24 @@ module.exports = createClass({
     return dom.g(
       {
         className: "grid-cell-group",
       },
       grids.map(grid => this.renderGrid(grid))
     );
   },
 
-  renderGridOutlineBorder(numberOfRows, numberOfColumns, color) {
+  renderGridOutlineBorder(borderWidth, borderHeight, color) {
     return dom.rect(
       {
         className: "grid-outline-border",
         x: 1,
         y: 1,
-        width: numberOfColumns * 10,
-        height: numberOfRows * 10,
+        width: borderWidth,
+        height: borderHeight,
         stroke: color,
       }
     );
   },
 
   onMouseLeaveCell({ target }) {
     const {
       grids,
@@ -214,32 +266,34 @@ module.exports = createClass({
       onShowGridCellHighlight,
     } = this.props;
     const id = target.getAttribute("data-grid-id");
     const color = target.getAttribute("stroke");
 
     target.setAttribute("fill", "none");
 
     onShowGridAreaHighlight(grids[id].nodeFront, null, color);
-    onShowGridCellHighlight(grids[id].nodeFront);
+    onShowGridCellHighlight(grids[id].nodeFront, color);
   },
 
   onMouseOverCell(event) {
     event.persist();
     this.highlightCell(event);
   },
 
   render() {
-    return this.state.selectedGrids.length ?
+    const { selectedGrids, height, width } = this.state;
+
+    return selectedGrids.length ?
       dom.svg(
         {
           className: "grid-outline",
           width: "100%",
-          height: 100,
-          viewBox: `${TRANSLATE_X} ${TRANSLATE_Y} ${VIEWPORT_WIDTH} ${VIEWPORT_HEIGHT}`,
+          height: this.getHeight(),
+          viewBox: `${TRANSLATE_X} ${TRANSLATE_Y} ${width} ${height}`,
         },
-        this.renderGridOutline(this.state.selectedGrids)
+        this.renderGridOutline(selectedGrids)
       )
       :
       null;
   },
 
 });

--- a/devtools/client/inspector/grids/grid-inspector.js
+++ b/devtools/client/inspector/grids/grid-inspector.js
@@ -340,29 +340,34 @@ GridInspector.prototype = {
   },
 
   /**
    * Highlights the grid cell in the CSS Grid Highlighter for the given grid.
    *
    * @param  {NodeFront} node
    *         The NodeFront of the grid container element for which the grid
    *         highlighter is highlighted for.
+   * @param  {String} color
+   *         The color of the grid cell for which the grid highlighter
+   *         is highlighted for.
    * @param  {Number|null} gridFragmentIndex
    *         The index of the grid fragment for which the grid highlighter
    *         is highlighted for.
    * @param  {Number|null} rowNumber
    *         The row number of the grid cell for which the grid highlighter
    *         is highlighted for.
    * @param  {Number|null} columnNumber
    *         The column number of the grid cell for which the grid highlighter
    *         is highlighted for.
    */
-  onShowGridCellHighlight(node, gridFragmentIndex, rowNumber, columnNumber) {
+  onShowGridCellHighlight(node, color, gridFragmentIndex, rowNumber, columnNumber) {
     let { highlighterSettings } = this.store.getState();
+
     highlighterSettings.showGridCell = { gridFragmentIndex, rowNumber, columnNumber };
+    highlighterSettings.color = color;
 
     this.highlighters.showGridHighlighter(node, highlighterSettings);
   },
 
   /**
    * Handler for the inspector sidebar select event. Starts listening for
    * "grid-layout-changed" if the layout panel is visible. Otherwise, stop
    * listening for grid layout changes. Finally, refresh the layout view if

--- a/devtools/client/jsonview/main.js
+++ b/devtools/client/jsonview/main.js
@@ -46,17 +46,15 @@ var JsonView = {
   // Message handlers for events from child processes
 
   /**
    * Save JSON to a file needs to be implemented here
    * in the parent process.
    */
   onSave: function (message) {
     JsonViewUtils.getTargetFile().then(file => {
-      if (file) {
-        JsonViewUtils.saveToFile(file, message.data);
-      }
-    });
+      JsonViewUtils.saveToFile(file, message.data);
+    }, () => {});
   }
 };
 
 // Exports from this module
 module.exports.JsonView = JsonView;

--- a/devtools/client/jsonview/utils.js
+++ b/devtools/client/jsonview/utils.js
@@ -14,35 +14,46 @@ const OPEN_FLAGS = {
   RDONLY: parseInt("0x01", 16),
   WRONLY: parseInt("0x02", 16),
   CREATE_FILE: parseInt("0x08", 16),
   APPEND: parseInt("0x10", 16),
   TRUNCATE: parseInt("0x20", 16),
   EXCL: parseInt("0x80", 16)
 };
 
+let filePickerShown = false;
+
 /**
  * Open File Save As dialog and let the user to pick proper file location.
  */
 exports.getTargetFile = function () {
-  return new Promise(resolve => {
+  return new Promise((resolve, reject) => {
+    if (filePickerShown) {
+      reject(null);
+      return;
+    }
+
+    filePickerShown = true;
+
     let fp = Cc["@mozilla.org/filepicker;1"].createInstance(Ci.nsIFilePicker);
 
     let win = getMostRecentBrowserWindow();
     fp.init(win, null, Ci.nsIFilePicker.modeSave);
     fp.appendFilter("JSON Files", "*.json; *.jsonp;");
     fp.appendFilters(Ci.nsIFilePicker.filterText);
     fp.appendFilters(Ci.nsIFilePicker.filterAll);
     fp.filterIndex = 0;
 
     fp.open(rv => {
+      filePickerShown = false;
+
       if (rv == Ci.nsIFilePicker.returnOK || rv == Ci.nsIFilePicker.returnReplace) {
         resolve(fp.file);
       } else {
-        resolve(null);
+        reject(null);
       }
     });
   });
 };
 
 /**
  * Save JSON to a file
  */

--- a/devtools/client/shared/components/tree/label-cell.js
+++ b/devtools/client/shared/components/tree/label-cell.js
@@ -18,20 +18,22 @@ define(function (require, exports, modul
    * Render the default cell used for toggle buttons
    */
   let LabelCell = React.createClass({
     displayName: "LabelCell",
 
     // See the TreeView component for details related
     // to the 'member' object.
     propTypes: {
+      id: PropTypes.string.isRequired,
       member: PropTypes.object.isRequired
     },
 
     render: function () {
+      let id = this.props.id;
       let member = this.props.member;
       let level = member.level || 0;
 
       // Compute indentation dynamically. The deeper the item is
       // inside the hierarchy, the bigger is the left padding.
       let rowStyle = {
         "paddingInlineStart": (level * 16) + "px",
       };
@@ -45,20 +47,25 @@ define(function (require, exports, modul
       if (member.open) {
         iconClassList.push("open");
       }
 
       return (
         td({
           className: "treeLabelCell",
           key: "default",
-          style: rowStyle},
-          span({ className: iconClassList.join(" ") }),
+          style: rowStyle,
+          role: "presentation"},
+          span({
+            className: iconClassList.join(" "),
+            role: "presentation"
+          }),
           span({
             className: "treeLabel " + member.type + "Label",
+            "aria-labelledby": id,
             "data-level": level
           }, member.name)
         )
       );
     }
   });
 
   // Exports from this module

--- a/devtools/client/shared/components/tree/tree-cell.js
+++ b/devtools/client/shared/components/tree/tree-cell.js
@@ -100,28 +100,33 @@ define(function (require, exports, modul
       let cellElement;
       if (enableInput && this.state.inputEnabled && type !== "object") {
         classNames.push("inputEnabled");
         cellElement = input({
           autoFocus: true,
           onBlur: this.updateInputEnabled,
           readOnly: true,
           value,
+          "aria-labelledby": id
         });
       } else {
         cellElement = span({
           onClick: (type !== "object") ? this.updateInputEnabled : null,
+          "aria-labelledby": id
         },
           renderValue(props)
         );
       }
 
       // Render me!
       return (
-        td({ className: classNames.join(" ") },
+        td({
+          className: classNames.join(" "),
+          role: "presentation"
+        },
           cellElement
         )
       );
     }
   });
 
   // Default value rendering.
   let defaultRenderValue = props => {

--- a/devtools/client/shared/components/tree/tree-header.js
+++ b/devtools/client/shared/components/tree/tree-header.js
@@ -74,27 +74,32 @@ define(function (require, exports, modul
           classNames = this.getHeaderClass(col.id);
           classNames.push("treeHeaderCell");
         }
 
         cells.push(
           td({
             className: classNames.join(" "),
             style: cellStyle,
+            role: "presentation",
+            id: col.id,
             key: col.id},
             visible ? div({ className: "treeHeaderCellBox"},
               col.title
             ) : null,
           )
         );
       });
 
       return (
-        thead({}, tr({ className: visible ? "treeHeaderRow" : "" },
-          cells
-        ))
+        thead({
+          role: "presentation"
+        }, tr({
+          className: visible ? "treeHeaderRow" : "",
+          role: "presentation"
+        }, cells))
       );
     }
   });
 
   // Exports from this module
   module.exports = TreeHeader;
 });

--- a/devtools/client/shared/components/tree/tree-row.js
+++ b/devtools/client/shared/components/tree/tree-row.js
@@ -10,16 +10,19 @@ define(function (require, exports, modul
   // ReactJS
   const React = require("devtools/client/shared/vendor/react");
   const ReactDOM = require("devtools/client/shared/vendor/react-dom");
 
   // Tree
   const TreeCell = React.createFactory(require("./tree-cell"));
   const LabelCell = React.createFactory(require("./label-cell"));
 
+  // Scroll
+  const { scrollIntoViewIfNeeded } = require("devtools/client/shared/scroll");
+
   // Shortcuts
   const { tr } = React.DOM;
   const PropTypes = React.PropTypes;
 
   /**
    * This template represents a node in TreeView component. It's rendered
    * using <tr> element (the entire tree is one big <table>).
    */
@@ -35,23 +38,27 @@ define(function (require, exports, modul
         type: PropTypes.string.isRequired,
         rowClass: PropTypes.string.isRequired,
         level: PropTypes.number.isRequired,
         hasChildren: PropTypes.bool,
         value: PropTypes.any,
         open: PropTypes.bool.isRequired,
         path: PropTypes.string.isRequired,
         hidden: PropTypes.bool,
+        selected: PropTypes.bool,
       }),
       decorator: PropTypes.object,
       renderCell: PropTypes.object,
       renderLabelCell: PropTypes.object,
       columns: PropTypes.array.isRequired,
+      id: PropTypes.string.isRequired,
       provider: PropTypes.object.isRequired,
-      onClick: PropTypes.func.isRequired
+      onClick: PropTypes.func.isRequired,
+      onMouseOver: PropTypes.func,
+      onMouseOut: PropTypes.func
     },
 
     componentWillReceiveProps(nextProps) {
       // I don't like accessing the underlying DOM elements directly,
       // but this optimization makes the filtering so damn fast!
       // The row doesn't have to be re-rendered, all we really need
       // to do is toggling a class name.
       // The important part is that DOM elements don't need to be
@@ -62,26 +69,37 @@ define(function (require, exports, modul
       }
     },
 
     /**
      * Optimize row rendering. If props are the same do not render.
      * This makes the rendering a lot faster!
      */
     shouldComponentUpdate: function (nextProps) {
-      let props = ["name", "open", "value", "loading"];
+      let props = ["name", "open", "value", "loading", "selected", "hasChildren"];
       for (let p in props) {
         if (nextProps.member[props[p]] != this.props.member[props[p]]) {
           return true;
         }
       }
 
       return false;
     },
 
+    componentDidUpdate: function () {
+      if (this.props.member.selected) {
+        let row = ReactDOM.findDOMNode(this);
+        // Because this is called asynchronously, context window might be
+        // already gone.
+        if (row.ownerDocument.defaultView) {
+          scrollIntoViewIfNeeded(row);
+        }
+      }
+    },
+
     getRowClass: function (object) {
       let decorator = this.props.decorator;
       if (!decorator || !decorator.getRowClass) {
         return [];
       }
 
       // Decorator can return a simple string or array of strings.
       let classNames = decorator.getRowClass(object);
@@ -94,82 +112,95 @@ define(function (require, exports, modul
       }
 
       return classNames;
     },
 
     render: function () {
       let member = this.props.member;
       let decorator = this.props.decorator;
+      let props = {
+        id: this.props.id,
+        role: "treeitem",
+        "aria-level": member.level,
+        "aria-selected": !!member.selected,
+        onClick: this.props.onClick,
+        onMouseOver: this.props.onMouseOver,
+        onMouseOut: this.props.onMouseOut
+      };
 
       // Compute class name list for the <tr> element.
       let classNames = this.getRowClass(member.object) || [];
       classNames.push("treeRow");
       classNames.push(member.type + "Row");
 
       if (member.hasChildren) {
         classNames.push("hasChildren");
+        props["aria-expanded"] = false;
       }
 
       if (member.open) {
         classNames.push("opened");
+        props["aria-expanded"] = true;
       }
 
       if (member.loading) {
         classNames.push("loading");
       }
 
+      if (member.selected) {
+        classNames.push("selected");
+      }
+
       if (member.hidden) {
         classNames.push("hidden");
       }
 
+      props.className = classNames.join(" ");
+
       // The label column (with toggle buttons) is usually
       // the first one, but there might be cases (like in
       // the Memory panel) where the toggling is done
       // in the last column.
       let cells = [];
 
       // Get components for rendering cells.
       let renderCell = this.props.renderCell || RenderCell;
       let renderLabelCell = this.props.renderLabelCell || RenderLabelCell;
       if (decorator && decorator.renderLabelCell) {
         renderLabelCell = decorator.renderLabelCell(member.object) ||
           renderLabelCell;
       }
 
       // Render a cell for every column.
       this.props.columns.forEach(col => {
-        let props = Object.assign({}, this.props, {
+        let cellProps = Object.assign({}, this.props, {
           key: col.id,
           id: col.id,
           value: this.props.provider.getValue(member.object, col.id)
         });
 
         if (decorator && decorator.renderCell) {
           renderCell = decorator.renderCell(member.object, col.id);
         }
 
         let render = (col.id == "default") ? renderLabelCell : renderCell;
 
         // Some cells don't have to be rendered. This happens when some
         // other cells span more columns. Note that the label cells contains
         // toggle buttons and should be usually there unless we are rendering
         // a simple non-expandable table.
         if (render) {
-          cells.push(render(props));
+          cells.push(render(cellProps));
         }
       });
 
       // Render tree row
       return (
-        tr({
-          className: classNames.join(" "),
-          onClick: this.props.onClick},
-          cells
-        )
+        tr(props, cells)
       );
     }
   });
 
   // Helpers
 
   let RenderCell = props => {
     return TreeCell(props);

--- a/devtools/client/shared/components/tree/tree-view.css
+++ b/devtools/client/shared/components/tree/tree-view.css
@@ -67,16 +67,25 @@
 }
 
 .treeTable .treeRow.hasChildren > .treeLabelCell > .treeLabel:hover {
   cursor: pointer;
   color: var(--tree-link-color);
   text-decoration: underline;
 }
 
+.treeTable .treeRow.selected {
+  background-color: var(--theme-selection-background);
+}
+
+.treeTable .treeRow.selected:not(:hover) *,
+.treeTable .treeRow.selected:not(:hover) .treeLabelCell::after {
+  color: var(--theme-selection-color);
+}
+
 /* Filtering */
 .treeTable .treeRow.hidden {
   display: none;
 }
 
 .treeTable .treeValueCellDivider {
   display: flex;
   flex-wrap: wrap;

--- a/devtools/client/shared/components/tree/tree-view.js
+++ b/devtools/client/shared/components/tree/tree-view.js
@@ -57,16 +57,17 @@ define(function (require, exports, modul
     displayName: "TreeView",
 
     // The only required property (not set by default) is the input data
     // object that is used to puputate the tree.
     propTypes: {
       // The input data object.
       object: PropTypes.any,
       className: PropTypes.string,
+      label: PropTypes.string,
       // Data provider (see also the interface above)
       provider: PropTypes.shape({
         getChildren: PropTypes.func,
         hasChildren: PropTypes.func,
         getLabel: PropTypes.func,
         getValue: PropTypes.func,
         getKey: PropTypes.func,
         getType: PropTypes.func,
@@ -116,27 +117,38 @@ define(function (require, exports, modul
         expandableStrings: true,
         columns: []
       };
     },
 
     getInitialState: function () {
       return {
         expandedNodes: this.props.expandedNodes,
-        columns: ensureDefaultColumn(this.props.columns)
+        columns: ensureDefaultColumn(this.props.columns),
+        selected: null
       };
     },
 
     componentWillReceiveProps: function (nextProps) {
       let { expandedNodes } = nextProps;
       this.setState(Object.assign({}, this.state, {
         expandedNodes,
       }));
     },
 
+    componentDidUpdate: function () {
+      let selected = this.getSelectedRow(this.rows);
+      if (!selected && this.rows.length > 0) {
+        // TODO: Do better than just selecting the first row again. We want to
+        // select (in order) previous, next or parent in case when selected
+        // row is removed.
+        this.selectRow(this.rows[0].props.member.path);
+      }
+    },
+
     // Node expand/collapse
 
     toggle: function (nodePath) {
       let nodes = this.state.expandedNodes;
       if (this.isExpanded(nodePath)) {
         nodes.delete(nodePath);
       } else {
         nodes.add(nodePath);
@@ -149,19 +161,82 @@ define(function (require, exports, modul
     },
 
     isExpanded: function (nodePath) {
       return this.state.expandedNodes.has(nodePath);
     },
 
     // Event Handlers
 
+    onKeyDown: function (event) {
+      if (["ArrowUp", "ArrowDown", "ArrowLeft", "ArrowRight"].includes(
+        event.key)) {
+        event.preventDefault();
+      }
+    },
+
+    onKeyUp: function (event) {
+      let row = this.getSelectedRow(this.rows);
+      if (!row) {
+        return;
+      }
+
+      let index = this.rows.indexOf(row);
+      switch (event.key) {
+        case "ArrowRight":
+          let { hasChildren, open } = row.props.member;
+          if (hasChildren && !open) {
+            this.toggle(this.state.selected);
+          }
+          break;
+        case "ArrowLeft":
+          if (row && row.props.member.open) {
+            this.toggle(this.state.selected);
+          }
+          break;
+        case "ArrowDown":
+          let nextRow = this.rows[index + 1];
+          if (nextRow) {
+            this.selectRow(nextRow.props.member.path);
+          }
+          break;
+        case "ArrowUp":
+          let previousRow = this.rows[index - 1];
+          if (previousRow) {
+            this.selectRow(previousRow.props.member.path);
+          }
+          break;
+        default:
+          return;
+      }
+
+      event.preventDefault();
+    },
+
     onClickRow: function (nodePath, event) {
       event.stopPropagation();
       this.toggle(nodePath);
+      this.selectRow(nodePath);
+    },
+
+    getSelectedRow: function (rows) {
+      if (!this.state.selected || rows.length === 0) {
+        return null;
+      }
+      return rows.find(row => this.isSelected(row.props.member.path));
+    },
+
+    selectRow: function (nodePath) {
+      this.setState(Object.assign({}, this.state, {
+        selected: nodePath
+      }));
+    },
+
+    isSelected: function (nodePath) {
+      return nodePath === this.state.selected;
     },
 
     // Filtering & Sorting
 
     /**
      * Filter out nodes that don't correspond to the current filter.
      * @return {Boolean} true if the node should be visible otherwise false.
      */
@@ -232,17 +307,19 @@ define(function (require, exports, modul
           hasChildren: hasChildren,
           // Value associated with this node (as provided by the data provider)
           value: value,
           // True if the node is expanded.
           open: this.isExpanded(nodePath),
           // Node path
           path: nodePath,
           // True if the node is hidden (used for filtering)
-          hidden: !this.onFilter(child)
+          hidden: !this.onFilter(child),
+          // True if the node is selected with keyboard
+          selected: this.isSelected(nodePath)
         };
       });
     },
 
     /**
      * Render tree rows/nodes.
      */
     renderRows: function (parent, level = 0, path = "") {
@@ -263,16 +340,18 @@ define(function (require, exports, modul
         if (decorator && decorator.renderRow) {
           renderRow = decorator.renderRow(member.object) || renderRow;
         }
 
         let props = Object.assign({}, this.props, {
           key: member.path,
           member: member,
           columns: this.state.columns,
+          id: member.path,
+          ref: row => row && this.rows.push(row),
           onClick: this.onClickRow.bind(this, member.path)
         });
 
         // Render single row.
         rows.push(renderRow(props));
 
         // If a child node is expanded render its rows too.
         if (member.hasChildren && member.open) {
@@ -293,16 +372,17 @@ define(function (require, exports, modul
       });
 
       return rows;
     },
 
     render: function () {
       let root = this.props.object;
       let classNames = ["treeTable"];
+      this.rows = [];
 
       // Use custom class name from props.
       let className = this.props.className;
       if (className) {
         classNames.push(...className.split(" "));
       }
 
       // Alright, let's render all tree rows. The tree is one big <table>.
@@ -317,22 +397,28 @@ define(function (require, exports, modul
 
       let props = Object.assign({}, this.props, {
         columns: this.state.columns
       });
 
       return (
         DOM.table({
           className: classNames.join(" "),
+          role: "tree",
+          tabIndex: 0,
+          onKeyDown: this.onKeyDown,
+          onKeyUp: this.onKeyUp,
+          "aria-label": this.props.label || "",
+          "aria-activedescendant": this.state.selected,
           cellPadding: 0,
           cellSpacing: 0},
           TreeHeader(props),
-          DOM.tbody({},
-            rows
-          )
+          DOM.tbody({
+            role: "presentation"
+          }, rows)
         )
       );
     }
   });
 
   // Helpers
 
   /**

--- a/devtools/client/shared/scroll.js
+++ b/devtools/client/shared/scroll.js
@@ -1,52 +1,56 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 "use strict";
 
-/**
- * Scroll the document so that the element "elem" appears in the viewport.
- *
- * @param {DOMNode} elem
- *        The element that needs to appear in the viewport.
- * @param {Boolean} centered
- *        true if you want it centered, false if you want it to appear on the
- *        top of the viewport. It is true by default, and that is usually what
- *        you want.
- */
-function scrollIntoViewIfNeeded(elem, centered = true) {
-  let win = elem.ownerDocument.defaultView;
-  let clientRect = elem.getBoundingClientRect();
+// Make this available to both AMD and CJS environments
+define(function (require, exports, module) {
+  /**
+   * Scroll the document so that the element "elem" appears in the viewport.
+   *
+   * @param {DOMNode} elem
+   *        The element that needs to appear in the viewport.
+   * @param {Boolean} centered
+   *        true if you want it centered, false if you want it to appear on the
+   *        top of the viewport. It is true by default, and that is usually what
+   *        you want.
+   */
+  function scrollIntoViewIfNeeded(elem, centered = true) {
+    let win = elem.ownerDocument.defaultView;
+    let clientRect = elem.getBoundingClientRect();
 
-  // The following are always from the {top, bottom}
-  // of the viewport, to the {top, …} of the box.
-  // Think of them as geometrical vectors, it helps.
-  // The origin is at the top left.
+    // The following are always from the {top, bottom}
+    // of the viewport, to the {top, …} of the box.
+    // Think of them as geometrical vectors, it helps.
+    // The origin is at the top left.
 
-  let topToBottom = clientRect.bottom;
-  let bottomToTop = clientRect.top - win.innerHeight;
-  // We allow one translation on the y axis.
-  let yAllowed = true;
+    let topToBottom = clientRect.bottom;
+    let bottomToTop = clientRect.top - win.innerHeight;
+    // We allow one translation on the y axis.
+    let yAllowed = true;
 
-  // Whatever `centered` is, the behavior is the same if the box is
-  // (even partially) visible.
-  if ((topToBottom > 0 || !centered) && topToBottom <= elem.offsetHeight) {
-    win.scrollBy(0, topToBottom - elem.offsetHeight);
-    yAllowed = false;
-  } else if ((bottomToTop < 0 || !centered) &&
-             bottomToTop >= -elem.offsetHeight) {
-    win.scrollBy(0, bottomToTop + elem.offsetHeight);
-    yAllowed = false;
-  }
+    // Whatever `centered` is, the behavior is the same if the box is
+    // (even partially) visible.
+    if ((topToBottom > 0 || !centered) && topToBottom <= elem.offsetHeight) {
+      win.scrollBy(0, topToBottom - elem.offsetHeight);
+      yAllowed = false;
+    } else if ((bottomToTop < 0 || !centered) &&
+              bottomToTop >= -elem.offsetHeight) {
+      win.scrollBy(0, bottomToTop + elem.offsetHeight);
+      yAllowed = false;
+    }
 
-  // If we want it centered, and the box is completely hidden,
-  // then we center it explicitly.
-  if (centered) {
-    if (yAllowed && (topToBottom <= 0 || bottomToTop >= 0)) {
-      win.scroll(win.scrollX,
-                 win.scrollY + clientRect.top
-                 - (win.innerHeight - elem.offsetHeight) / 2);
+    // If we want it centered, and the box is completely hidden,
+    // then we center it explicitly.
+    if (centered) {
+      if (yAllowed && (topToBottom <= 0 || bottomToTop >= 0)) {
+        win.scroll(win.scrollX,
+                  win.scrollY + clientRect.top
+                  - (win.innerHeight - elem.offsetHeight) / 2);
+      }
     }
   }
-}
-exports.scrollIntoViewIfNeeded = scrollIntoViewIfNeeded;
+  // Exports from this module
+  module.exports.scrollIntoViewIfNeeded = scrollIntoViewIfNeeded;
+});

--- a/devtools/client/themes/layout.css
+++ b/devtools/client/themes/layout.css
@@ -58,23 +58,25 @@
  * Grid Outline
  */
 
 #grid-outline {
   margin: 5px auto;
 }
 
 .grid-outline-border {
+  fill: none;
   stroke-width: 0.75;
-  fill: none;
+  vector-effect: non-scaling-stroke;
 }
 
 .grid-outline-cell {
   pointer-events: all;
   stroke-dasharray: 0.5, 2;
+  vector-effect: non-scaling-stroke;
 }
 
 .grid-outline-cell:hover {
   opacity: 0.45;
 }
 
 /**
  * Container when no grids are present

--- a/dom/file/MutableBlobStorage.cpp
+++ b/dom/file/MutableBlobStorage.cpp
@@ -3,16 +3,17 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "MutableBlobStorage.h"
 #include "MemoryBlobImpl.h"
 #include "mozilla/CheckedInt.h"
 #include "mozilla/Preferences.h"
+#include "mozilla/TaskQueue.h"
 #include "File.h"
 #include "nsAnonymousTemporaryFile.h"
 #include "nsNetCID.h"
 #include "nsProxyRelease.h"
 #include "WorkerPrivate.h"
 
 #define BLOB_MEMORY_TEMPORARY_FILE 1048576
 
@@ -357,17 +358,22 @@ MutableBlobStorage::MutableBlobStorage(M
   MOZ_ASSERT(NS_IsMainThread());
 }
 
 MutableBlobStorage::~MutableBlobStorage()
 {
   free(mData);
 
   if (mFD) {
-    DispatchToIOThread(new CloseFileRunnable(mFD));
+    RefPtr<Runnable> runnable = new CloseFileRunnable(mFD);
+    DispatchToIOThread(runnable.forget());
+  }
+
+  if (mTaskQueue) {
+    mTaskQueue->BeginShutdown();
   }
 }
 
 uint64_t
 MutableBlobStorage::GetBlobWhenReady(nsISupports* aParent,
                                      const nsACString& aContentType,
                                      MutableBlobStorageCallback* aCallback)
 {
@@ -378,32 +384,28 @@ MutableBlobStorage::GetBlobWhenReady(nsI
   MOZ_ASSERT(mStorageState != eClosed);
   StorageState previousState = mStorageState;
   mStorageState = eClosed;
 
   if (previousState == eInTemporaryFile) {
     MOZ_ASSERT(mFD);
 
     if (NS_FAILED(mErrorResult)) {
-      NS_DispatchToMainThread(
-        new BlobCreationDoneRunnable(this, aCallback, nullptr, mErrorResult));
+      RefPtr<Runnable> runnable =
+        new BlobCreationDoneRunnable(this, aCallback, nullptr, mErrorResult);
+      NS_DispatchToMainThread(runnable.forget());
       return 0;
     }
 
     // We want to wait until all the WriteRunnable are completed. The way we do
     // this is to go to the I/O thread and then we come back: the runnables are
     // executed in order and this LastRunnable will be... the last one.
-    nsresult rv = DispatchToIOThread(new LastRunnable(this, aParent,
-                                                      aContentType, aCallback));
-    if (NS_WARN_IF(NS_FAILED(rv))) {
-      NS_DispatchToMainThread(
-        new BlobCreationDoneRunnable(this, aCallback, nullptr, rv));
-      return 0;
-    }
-
+    RefPtr<Runnable> runnable =
+      new LastRunnable(this, aParent, aContentType, aCallback);
+    DispatchToIOThread(runnable.forget());
     return mDataLen;
   }
 
   RefPtr<BlobImpl> blobImpl;
 
   if (mData) {
     blobImpl = new MemoryBlobImpl(mData, mDataLen,
                                   NS_ConvertUTF8toUTF16(aContentType));
@@ -453,20 +455,17 @@ MutableBlobStorage::Append(const void* a
     MOZ_ASSERT(mFD);
 
     RefPtr<WriteRunnable> runnable =
       WriteRunnable::CopyBuffer(this, mFD, aData, aLength);
     if (NS_WARN_IF(!runnable)) {
       return NS_ERROR_OUT_OF_MEMORY;
     }
 
-    nsresult rv = DispatchToIOThread(runnable);
-    if (NS_WARN_IF(NS_FAILED(rv))) {
-      return rv;
-    }
+    DispatchToIOThread(runnable.forget());
 
     mDataLen += aLength;
     return NS_OK;
   }
 
   // By default, we store in memory.
 
   uint64_t offset = mDataLen;
@@ -527,20 +526,18 @@ MutableBlobStorage::ShouldBeTemporarySto
   return bufferSize.value() >= Preferences::GetUint("dom.blob.memoryToTemporaryFile",
                                                     BLOB_MEMORY_TEMPORARY_FILE);
 }
 
 nsresult
 MutableBlobStorage::MaybeCreateTemporaryFile()
 {
   if (XRE_IsParentProcess()) {
-    nsresult rv = DispatchToIOThread(new CreateTemporaryFileRunnable(this));
-    if (NS_WARN_IF(NS_FAILED(rv))) {
-      return rv;
-    }
+    RefPtr<Runnable> runnable = new CreateTemporaryFileRunnable(this);
+    DispatchToIOThread(runnable.forget());
   } else {
     RefPtr<MutableBlobStorage> self(this);
     ContentChild::GetSingleton()->
       AsyncOpenAnonymousTemporaryFile([self](PRFileDesc* prfile) {
         if (prfile) {
           // The ownership of the prfile is moved to the FileCreatedRunnable.
           NS_DispatchToMainThread(new FileCreatedRunnable(self, prfile));
         }
@@ -554,34 +551,31 @@ MutableBlobStorage::MaybeCreateTemporary
 void
 MutableBlobStorage::TemporaryFileCreated(PRFileDesc* aFD)
 {
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(mStorageState == eWaitingForTemporaryFile ||
              mStorageState == eClosed);
 
   if (mStorageState == eClosed) {
-    DispatchToIOThread(new CloseFileRunnable(aFD));
+    RefPtr<Runnable> runnable = new CloseFileRunnable(aFD);
+    DispatchToIOThread(runnable.forget());
     return;
   }
 
   mStorageState = eInTemporaryFile;
   mFD = aFD;
 
   RefPtr<WriteRunnable> runnable =
     WriteRunnable::AdoptBuffer(this, mFD, mData, mDataLen);
   MOZ_ASSERT(runnable);
 
   mData = nullptr;
 
-  nsresult rv = DispatchToIOThread(runnable);
-  if (NS_WARN_IF(NS_FAILED(rv))) {
-    mErrorResult = rv;
-    return;
-  }
+  DispatchToIOThread(runnable.forget());
 }
 
 void
 MutableBlobStorage::CreateBlobAndRespond(already_AddRefed<nsISupports> aParent,
                                          const nsACString& aContentType,
                                          already_AddRefed<MutableBlobStorageCallback> aCallback)
 {
   MOZ_ASSERT(NS_IsMainThread());
@@ -602,25 +596,25 @@ MutableBlobStorage::CreateBlobAndRespond
 
 void
 MutableBlobStorage::ErrorPropagated(nsresult aRv)
 {
   MOZ_ASSERT(NS_IsMainThread());
   mErrorResult = aRv;
 }
 
-/* static */ nsresult
-MutableBlobStorage::DispatchToIOThread(Runnable* aRunnable)
+void
+MutableBlobStorage::DispatchToIOThread(already_AddRefed<nsIRunnable> aRunnable)
 {
-  nsCOMPtr<nsIEventTarget> target
-    = do_GetService(NS_STREAMTRANSPORTSERVICE_CONTRACTID);
-  MOZ_ASSERT(target);
+  if (!mTaskQueue) {
+    nsCOMPtr<nsIEventTarget> target
+      = do_GetService(NS_STREAMTRANSPORTSERVICE_CONTRACTID);
+    MOZ_ASSERT(target);
 
-  nsresult rv = target->Dispatch(aRunnable, NS_DISPATCH_NORMAL);
-  if (NS_WARN_IF(NS_FAILED(rv))) {
-    return rv;
+    mTaskQueue = new TaskQueue(target.forget());
   }
 
-  return NS_OK;
+  nsCOMPtr<nsIRunnable> runnable(aRunnable);
+  mTaskQueue->Dispatch(runnable.forget());
 }
 
 } // dom namespace
 } // mozilla namespace

--- a/dom/file/MutableBlobStorage.h
+++ b/dom/file/MutableBlobStorage.h
@@ -6,16 +6,19 @@
 
 #ifndef mozilla_dom_MutableBlobStorage_h
 #define mozilla_dom_MutableBlobStorage_h
 
 #include "mozilla/RefPtr.h"
 #include "prio.h"
 
 namespace mozilla {
+
+class TaskQueue;
+
 namespace dom {
 
 class Blob;
 class BlobImpl;
 class MutableBlobStorage;
 
 class MutableBlobStorageCallback
 {
@@ -62,17 +65,17 @@ private:
   ~MutableBlobStorage();
 
   bool ExpandBufferSize(uint64_t aSize);
 
   bool ShouldBeTemporaryStorage(uint64_t aSize) const;
 
   nsresult MaybeCreateTemporaryFile();
 
-  static nsresult DispatchToIOThread(Runnable* aRunnable);
+  void DispatchToIOThread(already_AddRefed<nsIRunnable> aRunnable);
 
   // All these variables are touched on the main thread only.
 
   void* mData;
   uint64_t mDataLen;
   uint64_t mDataBufferLen;
 
   enum StorageState {
@@ -83,14 +86,16 @@ private:
     eClosed
   };
 
   StorageState mStorageState;
 
   PRFileDesc* mFD;
 
   nsresult mErrorResult;
+
+  RefPtr<TaskQueue> mTaskQueue;
 };
 
 } // namespace dom
 } // namespace mozilla
 
 #endif // mozilla_dom_MutableBlobStorage_h

--- a/dom/media/webaudio/AudioContext.cpp
+++ b/dom/media/webaudio/AudioContext.cpp
@@ -135,16 +135,17 @@ AudioContext::AudioContext(nsPIDOMWindow
   , mSampleRate(GetSampleRateForAudioContext(aIsOffline, aSampleRate))
   , mAudioContextState(AudioContextState::Suspended)
   , mNumberOfChannels(aNumberOfChannels)
   , mIsOffline(aIsOffline)
   , mIsStarted(!aIsOffline)
   , mIsShutDown(false)
   , mCloseCalled(false)
   , mSuspendCalled(false)
+  , mIsDisconnecting(false)
 {
   bool mute = aWindow->AddAudioContext(this);
 
   // Note: AudioDestinationNode needs an AudioContext that must already be
   // bound to the window.
   mDestination = new AudioDestinationNode(this, aIsOffline, aChannel,
                                           aNumberOfChannels, aLength, aSampleRate);
 
@@ -255,17 +256,19 @@ AudioContext::Constructor(const GlobalOb
 
   RegisterWeakMemoryReporter(object);
 
   return object.forget();
 }
 
 bool AudioContext::CheckClosed(ErrorResult& aRv)
 {
-  if (mAudioContextState == AudioContextState::Closed) {
+  if (mAudioContextState == AudioContextState::Closed ||
+      mIsShutDown ||
+      mIsDisconnecting) {
     aRv.Throw(NS_ERROR_DOM_INVALID_STATE_ERR);
     return true;
   }
   return false;
 }
 
 already_AddRefed<AudioBufferSourceNode>
 AudioContext::CreateBufferSource(ErrorResult& aRv)
@@ -635,32 +638,42 @@ AudioContext::DestinationStream() const
 
 double
 AudioContext::CurrentTime() const
 {
   MediaStream* stream = Destination()->Stream();
   return stream->StreamTimeToSeconds(stream->GetCurrentTime());
 }
 
+void AudioContext::DisconnectFromOwner()
+{
+  mIsDisconnecting = true;
+  Shutdown();
+  DOMEventTargetHelper::DisconnectFromOwner();
+}
+
 void
 AudioContext::Shutdown()
 {
   mIsShutDown = true;
 
-  if (!mIsOffline) {
-    ErrorResult dummy;
-    RefPtr<Promise> ignored = Close(dummy);
-  }
+  // We don't want to touch promises if the global is going away soon.
+  if (!mIsDisconnecting) {
+    if (!mIsOffline) {
+      IgnoredErrorResult dummy;
+      RefPtr<Promise> ignored = Close(dummy);
+    }
 
-  for (auto p : mPromiseGripArray) {
-    p->MaybeReject(NS_ERROR_DOM_INVALID_STATE_ERR);
+    for (auto p : mPromiseGripArray) {
+      p->MaybeReject(NS_ERROR_DOM_INVALID_STATE_ERR);
+    }
+
+    mPromiseGripArray.Clear();
   }
 
-  mPromiseGripArray.Clear();
-
   // Release references to active nodes.
   // Active AudioNodes don't unregister in destructors, at which point the
   // Node is already unregistered.
   mActiveNodes.Clear();
 
   // For offline contexts, we can destroy the MediaStreamGraph at this point.
   if (mIsOffline && mDestination) {
     mDestination->OfflineShutdown();

--- a/dom/media/webaudio/AudioContext.h
+++ b/dom/media/webaudio/AudioContext.h
@@ -137,16 +137,18 @@ public:
                                            DOMEventTargetHelper)
   MOZ_DEFINE_MALLOC_SIZE_OF(MallocSizeOf)
 
   nsPIDOMWindowInner* GetParentObject() const
   {
     return GetOwner();
   }
 
+  virtual void DisconnectFromOwner() override;
+
   void Shutdown(); // idempotent
 
   JSObject* WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto) override;
 
   using DOMEventTargetHelper::DispatchTrustedEvent;
 
   // Constructor for regular AudioContext
   static already_AddRefed<AudioContext>
@@ -367,16 +369,17 @@ private:
   uint32_t mNumberOfChannels;
   bool mIsOffline;
   bool mIsStarted;
   bool mIsShutDown;
   // Close has been called, reject suspend and resume call.
   bool mCloseCalled;
   // Suspend has been called with no following resume.
   bool mSuspendCalled;
+  bool mIsDisconnecting;
 };
 
 static const dom::AudioContext::AudioContextId NO_AUDIO_CONTEXT = 0;
 
 } // namespace dom
 } // namespace mozilla
 
 #endif

--- a/dom/media/webaudio/test/mochitest.ini
+++ b/dom/media/webaudio/test/mochitest.ini
@@ -169,16 +169,17 @@ tags=capturestream
 [test_mediaStreamAudioSourceNodeResampling.html]
 tags=capturestream
 [test_mixingRules.html]
 skip-if = toolkit == 'android' # bug 1091965
 [test_mozaudiochannel.html]
 # Android: bug 1061675; OSX 10.6: bug 1097721
 skip-if = (toolkit == 'android') || (os == 'mac' && os_version == '10.6')
 [test_nodeToParamConnection.html]
+[test_nodeCreationDocumentGone.html]
 [test_OfflineAudioContext.html]
 [test_offlineDestinationChannelCountLess.html]
 [test_offlineDestinationChannelCountMore.html]
 [test_oscillatorNode.html]
 [test_oscillatorNode2.html]
 [test_oscillatorNodeNegativeFrequency.html]
 [test_oscillatorNodePassThrough.html]
 [test_oscillatorNodeStart.html]

new file mode 100644
--- /dev/null
+++ b/dom/media/webaudio/test/test_nodeCreationDocumentGone.html
@@ -0,0 +1,45 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test whether we can create an AudioContext interface</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+
+SimpleTest.waitForExplicitFinish();
+
+SpecialPowers.pushPrefEnv({
+  set: [
+    [ "dom.disable_open_during_load", false ]
+  ]
+}).then(function() {
+  var sub = encodeURI("data:text/html,<!DOCTYPE html>\n"+
+                      "<html><script>"+
+                      "var context = new AudioContext();"+
+                      "setTimeout(function(){window.close();},1000);\x3C/script></html>");
+  window.onload = function(){
+    var a = window.open(sub);
+    a.onbeforeunload = function(){
+      setTimeout(function(){
+        try {
+          a.context.createScriptProcessor(512, 1, 1);
+        } catch(e) {
+          ok (true,"got exception");
+        }
+        setTimeout(function() {
+        ok (true,"no crash");
+          SimpleTest.finish();
+        }, 0);
+      }, 0);
+    };
+  };
+});
+
+
+</script>
+</pre>
+</body>
+</html>

--- a/dom/workers/PServiceWorkerManager.ipdl
+++ b/dom/workers/PServiceWorkerManager.ipdl
@@ -1,41 +1,46 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 include protocol PBackground;
+include protocol PServiceWorkerUpdater;
 
 include PBackgroundSharedTypes;
 include ServiceWorkerRegistrarTypes;
 
 using mozilla::OriginAttributes from "mozilla/ipc/BackgroundUtils.h";
 
 namespace mozilla {
 namespace dom {
 
 protocol PServiceWorkerManager
 {
   manager PBackground;
+  manages PServiceWorkerUpdater;
 
 parent:
   async Register(ServiceWorkerRegistrationData data);
 
   async Unregister(PrincipalInfo principalInfo, nsString scope);
 
   async PropagateSoftUpdate(OriginAttributes originAttributes,
                             nsString scope);
   async PropagateUnregister(PrincipalInfo principalInfo, nsString scope);
 
   async PropagateRemove(nsCString host);
 
   async PropagateRemoveAll();
 
   async Shutdown();
 
+  async PServiceWorkerUpdater(OriginAttributes originAttributes,
+                              nsCString scope);
+
 child:
   async NotifyRegister(ServiceWorkerRegistrationData data);
   async NotifySoftUpdate(OriginAttributes originAttributes, nsString scope);
   async NotifyUnregister(PrincipalInfo principalInfo, nsString scope);
   async NotifyRemove(nsCString host);
   async NotifyRemoveAll();
 
   async __delete__();

new file mode 100644
--- /dev/null
+++ b/dom/workers/PServiceWorkerUpdater.ipdl
@@ -0,0 +1,25 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+include protocol PServiceWorkerManager;
+
+namespace mozilla {
+namespace dom {
+
+protocol PServiceWorkerUpdater
+{
+  manager PServiceWorkerManager;
+
+parent:
+  // This __delete__ is safe because it's called when Proceed() is received and
+  // no other IPC messages are received nor sent.
+  async __delete__();
+
+child:
+  async Proceed(bool allowed);
+};
+
+} // namespace dom
+} // namespace mozilla
+

--- a/dom/workers/ServiceWorkerManager.cpp
+++ b/dom/workers/ServiceWorkerManager.cpp
@@ -72,16 +72,17 @@
 #include "ServiceWorkerPrivate.h"
 #include "ServiceWorkerRegisterJob.h"
 #include "ServiceWorkerRegistrar.h"
 #include "ServiceWorkerRegistration.h"
 #include "ServiceWorkerScriptCache.h"
 #include "ServiceWorkerEvents.h"
 #include "ServiceWorkerUnregisterJob.h"
 #include "ServiceWorkerUpdateJob.h"
+#include "ServiceWorkerUpdaterChild.h"
 #include "SharedWorker.h"
 #include "WorkerInlines.h"
 #include "WorkerPrivate.h"
 #include "WorkerRunnable.h"
 #include "WorkerScope.h"
 
 #ifdef PostMessage
 #undef PostMessage
@@ -503,16 +504,248 @@ public:
     return NS_OK;
   }
 
 private:
   ~PropagateRemoveAllRunnable()
   {}
 };
 
+class PromiseResolverCallback final : public ServiceWorkerUpdateFinishCallback
+{
+public:
+  PromiseResolverCallback(ServiceWorkerUpdateFinishCallback* aCallback,
+                          GenericPromise::Private* aPromise)
+    : mCallback(aCallback)
+    , mPromise(aPromise)
+  {
+    MOZ_DIAGNOSTIC_ASSERT(mPromise);
+  }
+
+  void UpdateSucceeded(ServiceWorkerRegistrationInfo* aInfo) override
+  {
+    MOZ_DIAGNOSTIC_ASSERT(mPromise);
+
+    if (mCallback) {
+      mCallback->UpdateSucceeded(aInfo);
+    }
+
+    MaybeResolve();
+  }
+
+  void UpdateFailed(ErrorResult& aStatus) override
+  {
+    MOZ_DIAGNOSTIC_ASSERT(mPromise);
+
+    if (mCallback) {
+      mCallback->UpdateFailed(aStatus);
+    }
+
+    MaybeResolve();
+  }
+
+private:
+  ~PromiseResolverCallback()
+  {
+    MaybeResolve();
+  }
+
+  void
+  MaybeResolve()
+  {
+    if (mPromise) {
+      mPromise->Resolve(true, __func__);
+      mPromise = nullptr;
+    }
+  }
+
+  RefPtr<ServiceWorkerUpdateFinishCallback> mCallback;
+  RefPtr<GenericPromise::Private> mPromise;
+};
+
+// This runnable is used for 2 different tasks:
+// - to postpone the SoftUpdate() until the IPC SWM actor is created
+//   (aInternalMethod == false)
+// - to call the 'real' SoftUpdate when the ServiceWorkerUpdaterChild is
+//   notified by the parent (aInternalMethod == true)
+class SoftUpdateRunnable final : public CancelableRunnable
+{
+public:
+  SoftUpdateRunnable(const OriginAttributes& aOriginAttributes,
+                     const nsACString& aScope, bool aInternalMethod,
+                     GenericPromise::Private* aPromise)
+    : mAttrs(aOriginAttributes)
+    , mScope(aScope)
+    , mInternalMethod(aInternalMethod)
+    , mPromise(aPromise)
+  {}
+
+  NS_IMETHOD Run() override
+  {
+    AssertIsOnMainThread();
+
+    RefPtr<ServiceWorkerManager> swm = ServiceWorkerManager::GetInstance();
+    if (!swm) {
+      return NS_ERROR_FAILURE;
+    }
+
+    if (mInternalMethod) {
+      RefPtr<PromiseResolverCallback> callback =
+        new PromiseResolverCallback(nullptr, mPromise);
+      mPromise = nullptr;
+
+      swm->SoftUpdateInternal(mAttrs, mScope, callback);
+    } else {
+      swm->SoftUpdate(mAttrs, mScope);
+    }
+
+    return NS_OK;
+  }
+
+  nsresult
+  Cancel() override
+  {
+    mPromise = nullptr;
+    return NS_OK;
+  }
+
+private:
+  ~SoftUpdateRunnable()
+  {
+    if (mPromise) {
+      mPromise->Resolve(true, __func__);
+    }
+  }
+
+  const OriginAttributes mAttrs;
+  const nsCString mScope;
+  bool mInternalMethod;
+
+  RefPtr<GenericPromise::Private> mPromise;
+};
+
+// This runnable is used for 3 different tasks:
+// - to postpone the Update() until the IPC SWM actor is created
+//   (aType == ePostpone)
+// - to call the 'real' Update when the ServiceWorkerUpdaterChild is
+//   notified by the parent (aType == eSuccess)
+// - an error must be propagated (aType == eFailure)
+class UpdateRunnable final : public CancelableRunnable
+{
+public:
+  enum Type {
+    ePostpone,
+    eSuccess,
+    eFailure,
+  };
+
+  UpdateRunnable(nsIPrincipal* aPrincipal,
+                 const nsACString& aScope,
+                 ServiceWorkerUpdateFinishCallback* aCallback,
+                 Type aType,
+                 GenericPromise::Private* aPromise)
+    : mPrincipal(aPrincipal)
+    , mScope(aScope)
+    , mCallback(aCallback)
+    , mType(aType)
+    , mPromise(aPromise)
+  {}
+
+  NS_IMETHOD Run() override
+  {
+    AssertIsOnMainThread();
+
+    RefPtr<ServiceWorkerManager> swm = ServiceWorkerManager::GetInstance();
+    if (!swm) {
+      return NS_ERROR_FAILURE;
+    }
+
+    if (mType == ePostpone) {
+      swm->Update(mPrincipal, mScope, mCallback);
+      return NS_OK;
+    }
+
+    MOZ_ASSERT(mPromise);
+
+    RefPtr<PromiseResolverCallback> callback =
+      new PromiseResolverCallback(mCallback, mPromise);
+    mPromise = nullptr;
+
+    if (mType == eSuccess) {
+      swm->UpdateInternal(mPrincipal, mScope, callback);
+      return NS_OK;
+    }
+
+    ErrorResult error(NS_ERROR_DOM_ABORT_ERR);
+    callback->UpdateFailed(error);
+    return NS_OK;
+  }
+
+  nsresult
+  Cancel() override
+  {
+    mPromise = nullptr;
+    return NS_OK;
+  }
+
+private:
+  ~UpdateRunnable()
+  {
+    if (mPromise) {
+      mPromise->Resolve(true, __func__);
+    }
+  }
+
+  nsCOMPtr<nsIPrincipal> mPrincipal;
+  const nsCString mScope;
+  RefPtr<ServiceWorkerUpdateFinishCallback> mCallback;
+  Type mType;
+
+  RefPtr<GenericPromise::Private> mPromise;
+};
+
+class ResolvePromiseRunnable final : public CancelableRunnable
+{
+public:
+  explicit ResolvePromiseRunnable(GenericPromise::Private* aPromise)
+    : mPromise(aPromise)
+  {}
+
+  NS_IMETHOD
+  Run() override
+  {
+    MaybeResolve();
+    return NS_OK;
+  }
+
+  nsresult
+  Cancel() override
+  {
+    mPromise = nullptr;
+    return NS_OK;
+  }
+
+private:
+  ~ResolvePromiseRunnable()
+  {
+    MaybeResolve();
+  }
+
+  void
+  MaybeResolve()
+  {
+    if (mPromise) {
+      mPromise->Resolve(true, __func__);
+      mPromise = nullptr;
+    }
+  }
+
+  RefPtr<GenericPromise::Private> mPromise;
+};
+
 } // namespace
 
 // This function implements parts of the step 3 of the following algorithm:
 // https://w3c.github.io/webappsec/specs/powerfulfeatures/#settings-secure
 static bool
 IsFromAuthenticatedOrigin(nsIDocument* aDoc)
 {
   MOZ_ASSERT(aDoc);
@@ -2721,16 +2954,90 @@ ServiceWorkerManager::SoftUpdate(const O
                                  const nsACString& aScope)
 {
   AssertIsOnMainThread();
 
   if (mShuttingDown) {
     return;
   }
 
+  if (!mActor) {
+    RefPtr<Runnable> runnable =
+      new SoftUpdateRunnable(aOriginAttributes, aScope, false, nullptr);
+    AppendPendingOperation(runnable);
+    return;
+  }
+
+  RefPtr<GenericPromise::Private> promise =
+    new GenericPromise::Private(__func__);
+
+  RefPtr<CancelableRunnable> successRunnable =
+    new SoftUpdateRunnable(aOriginAttributes, aScope, true, promise);
+
+  RefPtr<CancelableRunnable> failureRunnable =
+    new ResolvePromiseRunnable(promise);
+
+  ServiceWorkerUpdaterChild* actor =
+    new ServiceWorkerUpdaterChild(promise, successRunnable, failureRunnable);
+
+  mActor->SendPServiceWorkerUpdaterConstructor(actor, aOriginAttributes,
+                                               nsCString(aScope));
+}
+
+namespace {
+
+class UpdateJobCallback final : public ServiceWorkerJob::Callback
+{
+  RefPtr<ServiceWorkerUpdateFinishCallback> mCallback;
+
+  ~UpdateJobCallback() = default;
+
+public:
+  explicit UpdateJobCallback(ServiceWorkerUpdateFinishCallback* aCallback)
+    : mCallback(aCallback)
+  {
+    AssertIsOnMainThread();
+    MOZ_ASSERT(mCallback);
+  }
+
+  void
+  JobFinished(ServiceWorkerJob* aJob, ErrorResult& aStatus)
+  {
+    AssertIsOnMainThread();
+    MOZ_ASSERT(aJob);
+
+    if (aStatus.Failed()) {
+      mCallback->UpdateFailed(aStatus);
+      return;
+    }
+
+    MOZ_DIAGNOSTIC_ASSERT(aJob->GetType() == ServiceWorkerJob::Type::Update);
+    RefPtr<ServiceWorkerUpdateJob> updateJob =
+      static_cast<ServiceWorkerUpdateJob*>(aJob);
+    RefPtr<ServiceWorkerRegistrationInfo> reg = updateJob->GetRegistration();
+    mCallback->UpdateSucceeded(reg);
+  }
+
+  NS_INLINE_DECL_REFCOUNTING(UpdateJobCallback)
+};
+
+} // anonymous namespace
+
+void
+ServiceWorkerManager::SoftUpdateInternal(const OriginAttributes& aOriginAttributes,
+                                         const nsACString& aScope,
+                                         ServiceWorkerUpdateFinishCallback* aCallback)
+{
+  AssertIsOnMainThread();
+  MOZ_ASSERT(aCallback);
+
+  if (mShuttingDown) {
+    return;
+  }
+
   nsCOMPtr<nsIURI> scopeURI;
   nsresult rv = NS_NewURI(getter_AddRefs(scopeURI), aScope);
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return;
   }
 
   nsCOMPtr<nsIPrincipal> principal =
     BasePrincipal::CreateCodebasePrincipal(scopeURI, aOriginAttributes);
@@ -2774,64 +3081,62 @@ ServiceWorkerManager::SoftUpdate(const O
   // See: https://github.com/slightlyoff/ServiceWorker/issues/759
   RefPtr<ServiceWorkerJobQueue> queue = GetOrCreateJobQueue(scopeKey,
                                                             aScope);
 
   RefPtr<ServiceWorkerUpdateJob> job =
     new ServiceWorkerUpdateJob(principal, registration->mScope,
                                newest->ScriptSpec(), nullptr,
                                registration->GetLoadFlags());
+
+  RefPtr<UpdateJobCallback> cb = new UpdateJobCallback(aCallback);
+  job->AppendResultCallback(cb);
+
   queue->ScheduleJob(job);
 }
 
-namespace {
-
-class UpdateJobCallback final : public ServiceWorkerJob::Callback
-{
-  RefPtr<ServiceWorkerUpdateFinishCallback> mCallback;
-
-  ~UpdateJobCallback()
-  {
-  }
-
-public:
-  explicit UpdateJobCallback(ServiceWorkerUpdateFinishCallback* aCallback)
-    : mCallback(aCallback)
-  {
-    AssertIsOnMainThread();
-    MOZ_ASSERT(mCallback);
-  }
-
-  void
-  JobFinished(ServiceWorkerJob* aJob, ErrorResult& aStatus)
-  {
-    AssertIsOnMainThread();
-    MOZ_ASSERT(aJob);
-
-    if (aStatus.Failed()) {
-      mCallback->UpdateFailed(aStatus);
-      return;
-    }
-
-    MOZ_ASSERT(aJob->GetType() == ServiceWorkerJob::Type::Update);
-    RefPtr<ServiceWorkerUpdateJob> updateJob =
-      static_cast<ServiceWorkerUpdateJob*>(aJob);
-    RefPtr<ServiceWorkerRegistrationInfo> reg = updateJob->GetRegistration();
-    mCallback->UpdateSucceeded(reg);
-  }
-
-  NS_INLINE_DECL_REFCOUNTING(UpdateJobCallback)
-};
-} // anonymous namespace
-
 void
 ServiceWorkerManager::Update(nsIPrincipal* aPrincipal,
                              const nsACString& aScope,
                              ServiceWorkerUpdateFinishCallback* aCallback)
 {
+  AssertIsOnMainThread();
+
+  if (!mActor) {
+    RefPtr<Runnable> runnable =
+      new UpdateRunnable(aPrincipal, aScope, aCallback,
+                         UpdateRunnable::ePostpone, nullptr);
+    AppendPendingOperation(runnable);
+    return;
+  }
+
+  RefPtr<GenericPromise::Private> promise =
+    new GenericPromise::Private(__func__);
+
+  RefPtr<CancelableRunnable> successRunnable =
+    new UpdateRunnable(aPrincipal, aScope, aCallback,
+                       UpdateRunnable::eSuccess, promise);
+
+  RefPtr<CancelableRunnable> failureRunnable =
+    new UpdateRunnable(aPrincipal, aScope, aCallback,
+                       UpdateRunnable::eFailure, promise);
+
+  ServiceWorkerUpdaterChild* actor =
+    new ServiceWorkerUpdaterChild(promise, successRunnable, failureRunnable);
+
+  mActor->SendPServiceWorkerUpdaterConstructor(actor,
+                                               aPrincipal->OriginAttributesRef(),
+                                               nsCString(aScope));
+}
+
+void
+ServiceWorkerManager::UpdateInternal(nsIPrincipal* aPrincipal,
+                                     const nsACString& aScope,
+                                     ServiceWorkerUpdateFinishCallback* aCallback)
+{
   MOZ_ASSERT(aPrincipal);
   MOZ_ASSERT(aCallback);
 
   nsAutoCString scopeKey;
   nsresult rv = PrincipalToScopeKey(aPrincipal, scopeKey);
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return;
   }

--- a/dom/workers/ServiceWorkerManager.h
+++ b/dom/workers/ServiceWorkerManager.h
@@ -160,20 +160,31 @@ public:
                      ErrorResult& aRv);
 
   void
   Update(nsIPrincipal* aPrincipal,
          const nsACString& aScope,
          ServiceWorkerUpdateFinishCallback* aCallback);
 
   void
+  UpdateInternal(nsIPrincipal* aPrincipal,
+                 const nsACString& aScope,
+                 ServiceWorkerUpdateFinishCallback* aCallback);
+
+  void
   SoftUpdate(const OriginAttributes& aOriginAttributes,
              const nsACString& aScope);
 
   void
+  SoftUpdateInternal(const OriginAttributes& aOriginAttributes,
+                     const nsACString& aScope,
+                     ServiceWorkerUpdateFinishCallback* aCallback);
+
+
+  void
   PropagateSoftUpdate(const OriginAttributes& aOriginAttributes,
                       const nsAString& aScope);
 
   void
   PropagateRemove(const nsACString& aHost);
 
   void
   Remove(const nsACString& aHost);

--- a/dom/workers/ServiceWorkerManagerChild.cpp
+++ b/dom/workers/ServiceWorkerManagerChild.cpp
@@ -1,16 +1,17 @@
 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "ServiceWorkerManagerChild.h"
 #include "ServiceWorkerManager.h"
+#include "ServiceWorkerUpdaterChild.h"
 #include "mozilla/Unused.h"
 
 namespace mozilla {
 
 using namespace ipc;
 
 namespace dom {
 namespace workers {
@@ -97,11 +98,25 @@ ServiceWorkerManagerChild::RecvNotifyRem
   RefPtr<ServiceWorkerManager> swm = ServiceWorkerManager::GetInstance();
   if (swm) {
     swm->RemoveAll();
   }
 
   return IPC_OK();
 }
 
+PServiceWorkerUpdaterChild*
+ServiceWorkerManagerChild::AllocPServiceWorkerUpdaterChild(const OriginAttributes& aOriginAttributes,
+                                                           const nsCString& aScope)
+{
+  MOZ_CRASH("Do no use ServiceWorkerUpdaterChild IPC CTOR.");
+}
+
+bool
+ServiceWorkerManagerChild::DeallocPServiceWorkerUpdaterChild(PServiceWorkerUpdaterChild* aActor)
+{
+  delete aActor;
+  return true;
+}
+
 } // namespace workers
 } // namespace dom
 } // namespace mozilla

--- a/dom/workers/ServiceWorkerManagerChild.h
+++ b/dom/workers/ServiceWorkerManagerChild.h
@@ -41,16 +41,23 @@ public:
 
   virtual mozilla::ipc::IPCResult RecvNotifyUnregister(const PrincipalInfo& aPrincipalInfo,
                                                        const nsString& aScope) override;
 
   virtual mozilla::ipc::IPCResult RecvNotifyRemove(const nsCString& aHost) override;
 
   virtual mozilla::ipc::IPCResult RecvNotifyRemoveAll() override;
 
+  virtual PServiceWorkerUpdaterChild*
+  AllocPServiceWorkerUpdaterChild(const OriginAttributes& originAttributes,
+                                  const nsCString& scope) override;
+
+  virtual bool
+  DeallocPServiceWorkerUpdaterChild(PServiceWorkerUpdaterChild* aActor) override;
+
 private:
   ServiceWorkerManagerChild()
     : mShuttingDown(false)
   {}
 
   ~ServiceWorkerManagerChild() {}
 
   bool mShuttingDown;

--- a/dom/workers/ServiceWorkerManagerParent.cpp
+++ b/dom/workers/ServiceWorkerManagerParent.cpp
@@ -1,16 +1,17 @@
 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "ServiceWorkerManagerParent.h"
 #include "ServiceWorkerManagerService.h"
+#include "ServiceWorkerUpdaterParent.h"
 #include "mozilla/dom/ContentParent.h"
 #include "mozilla/dom/ServiceWorkerRegistrar.h"
 #include "mozilla/ipc/BackgroundParent.h"
 #include "mozilla/ipc/BackgroundUtils.h"
 #include "mozilla/Unused.h"
 #include "nsThreadUtils.h"
 
 namespace mozilla {
@@ -305,16 +306,48 @@ ServiceWorkerManagerParent::RecvShutdown
 
   mService->UnregisterActor(this);
   mService = nullptr;
 
   Unused << Send__delete__(this);
   return IPC_OK();
 }
 
+PServiceWorkerUpdaterParent*
+ServiceWorkerManagerParent::AllocPServiceWorkerUpdaterParent(const OriginAttributes& aOriginAttributes,
+                                                             const nsCString& aScope)
+{
+  AssertIsOnBackgroundThread();
+  return new ServiceWorkerUpdaterParent();
+}
+
+mozilla::ipc::IPCResult
+ServiceWorkerManagerParent::RecvPServiceWorkerUpdaterConstructor(PServiceWorkerUpdaterParent* aActor,
+                                                                 const OriginAttributes& aOriginAttributes,
+                                                                 const nsCString& aScope)
+{
+  AssertIsOnBackgroundThread();
+
+  if (NS_WARN_IF(!mService)) {
+    return IPC_FAIL_NO_REASON(this);
+  }
+
+  mService->ProcessUpdaterActor(static_cast<ServiceWorkerUpdaterParent*>(aActor),
+                                aOriginAttributes, aScope, mID);
+  return IPC_OK();
+}
+
+bool
+ServiceWorkerManagerParent::DeallocPServiceWorkerUpdaterParent(PServiceWorkerUpdaterParent* aActor)
+{
+  AssertIsOnBackgroundThread();
+  delete aActor;
+  return true;
+}
+
 void
 ServiceWorkerManagerParent::ActorDestroy(ActorDestroyReason aWhy)
 {
   AssertIsOnBackgroundThread();
 
   if (mService) {
     // This object is about to be released and with it, also mService will be
     // released too.

--- a/dom/workers/ServiceWorkerManagerParent.h
+++ b/dom/workers/ServiceWorkerManagerParent.h
@@ -51,16 +51,28 @@ private:
                                                           const nsString& aScope) override;
 
   virtual mozilla::ipc::IPCResult RecvPropagateRemove(const nsCString& aHost) override;
 
   virtual mozilla::ipc::IPCResult RecvPropagateRemoveAll() override;
 
   virtual mozilla::ipc::IPCResult RecvShutdown() override;
 
+  virtual PServiceWorkerUpdaterParent*
+  AllocPServiceWorkerUpdaterParent(const OriginAttributes& aOriginAttributes,
+                                   const nsCString& aScope) override;
+
+  virtual mozilla::ipc::IPCResult
+  RecvPServiceWorkerUpdaterConstructor(PServiceWorkerUpdaterParent* aActor,
+                                       const OriginAttributes& aOriginAttributes,
+                                       const nsCString& aScope) override;
+
+  virtual bool
+  DeallocPServiceWorkerUpdaterParent(PServiceWorkerUpdaterParent* aActor) override;
+
   virtual void ActorDestroy(ActorDestroyReason aWhy) override;
 
   RefPtr<ServiceWorkerManagerService> mService;
 
   // We use this ID in the Service in order to avoid the sending of messages to
   // ourself.
   uint64_t mID;
 };

--- a/dom/workers/ServiceWorkerManagerService.cpp
+++ b/dom/workers/ServiceWorkerManagerService.cpp
@@ -2,16 +2,17 @@
 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "ServiceWorkerManagerService.h"
 #include "ServiceWorkerManagerParent.h"
 #include "ServiceWorkerRegistrar.h"
+#include "ServiceWorkerUpdaterParent.h"
 #include "mozilla/dom/ContentParent.h"
 #include "mozilla/ipc/BackgroundParent.h"
 #include "mozilla/Unused.h"
 #include "nsAutoPtr.h"
 
 namespace mozilla {
 
 using namespace ipc;
@@ -227,11 +228,56 @@ ServiceWorkerManagerService::PropagateRe
     }
   }
 
 #ifdef DEBUG
   MOZ_ASSERT(parentFound);
 #endif
 }
 
+void
+ServiceWorkerManagerService::ProcessUpdaterActor(ServiceWorkerUpdaterParent* aActor,
+                                                 const OriginAttributes& aOriginAttributes,
+                                                 const nsACString& aScope,
+                                                 uint64_t aParentId)
+{
+  AssertIsOnBackgroundThread();
+
+  nsAutoCString suffix;
+  aOriginAttributes.CreateSuffix(suffix);
+
+  nsCString scope(aScope);
+  scope.Append(suffix);
+
+  for (uint32_t i = 0; i < mPendingUpdaterActors.Length(); ++i) {
+    // We already have an actor doing this update on another process.
+    if (mPendingUpdaterActors[i].mScope.Equals(scope) &&
+        mPendingUpdaterActors[i].mParentId != aParentId) {
+      Unused << aActor->SendProceed(false);
+      return;
+    }
+  }
+
+  if (aActor->Proceed(this)) {
+    PendingUpdaterActor* pua = mPendingUpdaterActors.AppendElement();
+    pua->mActor = aActor;
+    pua->mScope = scope;
+    pua->mParentId = aParentId;
+  }
+}
+
+void
+ServiceWorkerManagerService::UpdaterActorDestroyed(ServiceWorkerUpdaterParent* aActor)
+{
+  for (uint32_t i = 0; i < mPendingUpdaterActors.Length(); ++i) {
+    // We already have an actor doing the update for this scope.
+    if (mPendingUpdaterActors[i].mActor == aActor) {
+      mPendingUpdaterActors.RemoveElementAt(i);
+      return;
+    }
+  }
+
+  MOZ_CRASH("The actor should be found");
+}
+
 } // namespace workers
 } // namespace dom
 } // namespace mozilla

--- a/dom/workers/ServiceWorkerManagerService.h
+++ b/dom/workers/ServiceWorkerManagerService.h
@@ -21,16 +21,17 @@ class PrincipalInfo;
 
 namespace dom {
 
 class ServiceWorkerRegistrationData;
 
 namespace workers {
 
 class ServiceWorkerManagerParent;
+class ServiceWorkerUpdaterParent;
 
 class ServiceWorkerManagerService final
 {
 public:
   NS_INLINE_DECL_REFCOUNTING(ServiceWorkerManagerService)
 
   static already_AddRefed<ServiceWorkerManagerService> Get();
   static already_AddRefed<ServiceWorkerManagerService> GetOrCreate();
@@ -48,20 +49,36 @@ public:
   void PropagateUnregister(uint64_t aParentID,
                            const mozilla::ipc::PrincipalInfo& aPrincipalInfo,
                            const nsAString& aScope);
 
   void PropagateRemove(uint64_t aParentID, const nsACString& aHost);
 
   void PropagateRemoveAll(uint64_t aParentID);
 
+  void ProcessUpdaterActor(ServiceWorkerUpdaterParent* aActor,
+                           const OriginAttributes& aOriginAttributes,
+                           const nsACString& aScope,
+                           uint64_t aParentID);
+
+  void UpdaterActorDestroyed(ServiceWorkerUpdaterParent* aActor);
+
 private:
   ServiceWorkerManagerService();
   ~ServiceWorkerManagerService();
 
   nsTHashtable<nsPtrHashKey<ServiceWorkerManagerParent>> mAgents;
+
+  struct PendingUpdaterActor
+  {
+    nsCString mScope;
+    ServiceWorkerUpdaterParent* mActor;
+    uint64_t mParentId;
+  };
+
+  nsTArray<PendingUpdaterActor> mPendingUpdaterActors;
 };
 
 } // namespace workers
 } // namespace dom
 } // namespace mozilla
 
 #endif // mozilla_dom_ServiceWorkerManagerService_h

new file mode 100644
--- /dev/null
+++ b/dom/workers/ServiceWorkerUpdaterChild.cpp
@@ -0,0 +1,65 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ServiceWorkerUpdaterChild.h"
+
+namespace mozilla {
+namespace dom {
+namespace workers {
+
+ServiceWorkerUpdaterChild::ServiceWorkerUpdaterChild(GenericPromise* aPromise,
+                                                     CancelableRunnable* aSuccessRunnable,
+                                                     CancelableRunnable* aFailureRunnable)
+  : mSuccessRunnable(aSuccessRunnable)
+  , mFailureRunnable(aFailureRunnable)
+{
+  MOZ_ASSERT(aPromise);
+  MOZ_ASSERT(aSuccessRunnable);
+  MOZ_ASSERT(aFailureRunnable);
+
+  aPromise->Then(AbstractThread::GetCurrent(), __func__,
+    [this]() {
+      mPromiseHolder.Complete();
+      Unused << Send__delete__(this);
+  }).Track(mPromiseHolder);
+}
+
+mozilla::ipc::IPCResult
+ServiceWorkerUpdaterChild::RecvProceed(const bool& aAllowed)
+{
+  // If we have a callback, it will resolve the promise.
+
+  if (aAllowed) {
+    mSuccessRunnable->Run();
+    mFailureRunnable->Cancel();
+  } else {
+    mFailureRunnable->Run();
+    mSuccessRunnable->Cancel();
+  }
+
+  mSuccessRunnable = nullptr;
+  mFailureRunnable = nullptr;
+
+  return IPC_OK();
+}
+
+void
+ServiceWorkerUpdaterChild::ActorDestroy(ActorDestroyReason aWhy)
+{
+  if (mSuccessRunnable) {
+    mSuccessRunnable->Cancel();
+  }
+
+  if (mFailureRunnable) {
+    mFailureRunnable->Cancel();
+  }
+
+  mPromiseHolder.DisconnectIfExists();
+}
+
+} // namespace workers
+} // namespace dom
+} // namespace mozilla

new file mode 100644
--- /dev/null
+++ b/dom/workers/ServiceWorkerUpdaterChild.h
@@ -0,0 +1,42 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_ServiceWorkerUpdaterChild_h
+#define mozilla_dom_ServiceWorkerUpdaterChild_h
+
+#include "mozilla/dom/PServiceWorkerUpdaterChild.h"
+#include "mozilla/BasePrincipal.h"
+#include "mozilla/MozPromise.h"
+
+namespace mozilla {
+namespace dom {
+namespace workers {
+
+class ServiceWorkerUpdaterChild final : public PServiceWorkerUpdaterChild
+{
+public:
+  ServiceWorkerUpdaterChild(GenericPromise* aPromise,
+                            CancelableRunnable* aSuccessRunnable,
+                            CancelableRunnable* aFailureRunnable);
+
+  mozilla::ipc::IPCResult
+  RecvProceed(const bool& aAllowed) override;
+
+private:
+  void
+  ActorDestroy(ActorDestroyReason aWhy) override;
+
+  MozPromiseRequestHolder<GenericPromise> mPromiseHolder;
+
+  RefPtr<CancelableRunnable> mSuccessRunnable;
+  RefPtr<CancelableRunnable> mFailureRunnable;
+};
+
+} // namespace workers
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_ServiceWorkerUpdaterChild_h

new file mode 100644
--- /dev/null
+++ b/dom/workers/ServiceWorkerUpdaterParent.cpp
@@ -0,0 +1,35 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ServiceWorkerUpdaterParent.h"
+#include "ServiceWorkerManagerService.h"
+
+namespace mozilla {
+namespace dom {
+namespace workers {
+
+bool
+ServiceWorkerUpdaterParent::Proceed(ServiceWorkerManagerService* aService)
+{
+  if (!SendProceed(true)) {
+    return false;
+  }
+
+  mService = aService;
+  return true;
+}
+
+void
+ServiceWorkerUpdaterParent::ActorDestroy(ActorDestroyReason aWhy)
+{
+  if (mService) {
+    mService->UpdaterActorDestroyed(this);
+  }
+}
+
+} // namespace workers
+} // namespace dom
+} // namespace mozilla

new file mode 100644
--- /dev/null
+++ b/dom/workers/ServiceWorkerUpdaterParent.h
@@ -0,0 +1,36 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_ServiceWorkerUpdaterParent_h
+#define mozilla_dom_ServiceWorkerUpdaterParent_h
+
+#include "mozilla/dom/PServiceWorkerUpdaterParent.h"
+#include "mozilla/BasePrincipal.h"
+
+namespace mozilla {
+namespace dom {
+namespace workers {
+
+class ServiceWorkerManagerService;
+
+class ServiceWorkerUpdaterParent final : public PServiceWorkerUpdaterParent
+{
+public:
+  void
+  ActorDestroy(ActorDestroyReason aWhy) override;
+
+  bool
+  Proceed(ServiceWorkerManagerService* aService);
+
+private:
+  RefPtr<ServiceWorkerManagerService> mService;
+};
+
+} // namespace workers
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_ServiceWorkerUpdaterParent_h

--- a/dom/workers/moz.build
+++ b/dom/workers/moz.build
@@ -71,30 +71,33 @@ UNIFIED_SOURCES += [
     'ServiceWorkerPrivate.cpp',
     'ServiceWorkerRegisterJob.cpp',
     'ServiceWorkerRegistrar.cpp',
     'ServiceWorkerRegistration.cpp',
     'ServiceWorkerRegistrationInfo.cpp',
     'ServiceWorkerScriptCache.cpp',
     'ServiceWorkerUnregisterJob.cpp',
     'ServiceWorkerUpdateJob.cpp',
+    'ServiceWorkerUpdaterChild.cpp',
+    'ServiceWorkerUpdaterParent.cpp',
     'ServiceWorkerWindowClient.cpp',
     'SharedWorker.cpp',
     'WorkerDebuggerManager.cpp',
     'WorkerHolder.cpp',
     'WorkerLocation.cpp',
     'WorkerNavigator.cpp',
     'WorkerPrivate.cpp',
     'WorkerRunnable.cpp',
     'WorkerScope.cpp',
     'WorkerThread.cpp',
 ]
 
 IPDL_SOURCES += [
     'PServiceWorkerManager.ipdl',
+    'PServiceWorkerUpdater.ipdl',
     'ServiceWorkerRegistrarTypes.ipdlh',
 ]
 
 LOCAL_INCLUDES += [
     '../base',
     '../system',
     '/dom/base',
     '/dom/bindings',

--- a/dom/workers/test/serviceworkers/browser.ini
+++ b/dom/workers/test/serviceworkers/browser.ini
@@ -1,10 +1,14 @@
 [DEFAULT]
 support-files =
   browser_base_force_refresh.html
   browser_cached_force_refresh.html
   download/window.html
   download/worker.js
+  file_multie10s_update.html
   force_refresh_browser_worker.js
+  server_multie10s_update.sjs
 
 [browser_force_refresh.js]
 [browser_download.js]
+[browser_multie10s_update.js]
+run-if=e10s

new file mode 100644
--- /dev/null
+++ b/dom/workers/test/serviceworkers/browser_multie10s_update.js
@@ -0,0 +1,80 @@
+"use strict";
+
+const { classes: Cc, interfaces: Ci, results: Cr } = Components;
+
+// Testing if 2 child processes are correctly managed when they both try to do
+// an SW update.
+
+const BASE_URI = "http://mochi.test:8888/browser/dom/workers/test/serviceworkers/";
+
+add_task(function* test_update() {
+  info("Setting the prefs to having multi-e10s enabled");
+  yield SpecialPowers.pushPrefEnv({"set": [
+    ["dom.ipc.processCount", 4],
+    ["dom.serviceWorkers.enabled", true],
+    ["dom.serviceWorkers.testing.enabled", true],
+  ]});
+
+  let url = BASE_URI + "file_multie10s_update.html";
+
+  info("Creating the first tab...");
+  let tab1 = gBrowser.addTab(url);
+  let browser1 = gBrowser.getBrowserForTab(tab1);
+  yield BrowserTestUtils.browserLoaded(browser1);
+
+  info("Creating the second tab...");
+  let tab2 = gBrowser.addTab(url);
+  let browser2 = gBrowser.getBrowserForTab(tab2);
+  yield BrowserTestUtils.browserLoaded(browser2);
+
+  let sw = BASE_URI + "server_multie10s_update.sjs";
+
+  info("Let's start the test...");
+  let status = yield ContentTask.spawn(browser1, sw, function(url) {
+    // Registration of the SW
+    return content.navigator.serviceWorker.register(url)
+
+    // Activation
+    .then(function(r) {
+      return new content.window.Promise(resolve => {
+        let worker = r.installing;
+        worker.addEventListener('statechange', () => {
+          if (worker.state === 'installed') {
+            resolve(true);
+          }
+        });
+      });
+    })
+
+    // Waiting for the result.
+    .then(() => {
+      return new content.window.Promise(resolve => {
+        let results = [];
+        let bc = new content.window.BroadcastChannel('result');
+        bc.onmessage = function(e) {
+          results.push(e.data);
+          if (results.length != 2) {
+            return;
+          }
+
+          resolve(results[0] + results[1]);
+        }
+
+        // Let's inform the tabs.
+        bc = new content.window.BroadcastChannel('start');
+        bc.postMessage('go');
+      });
+    });
+  });
+
+  if (status == 0) {
+    ok(false, "both succeeded. This is wrong.");
+  } else if (status == 1) {
+    ok(true, "one succeded, one failed. This is good.");
+  } else {
+    ok(false, "both failed. This is definitely wrong.");
+  }
+
+  yield BrowserTestUtils.removeTab(tab1);
+  yield BrowserTestUtils.removeTab(tab2);
+});

new file mode 100644
--- /dev/null
+++ b/dom/workers/test/serviceworkers/file_multie10s_update.html
@@ -0,0 +1,34 @@
+<html>
+<body>
+<script>
+
+var bc = new BroadcastChannel('start');
+bc.onmessage = function(e) {
+  // This message is not for us.
+  if (e.data != 'go') {
+    return;
+  }
+
+  // It can happen that we don't have the registrations yet. Let's try with a
+  // timeout.
+  function proceed() {
+    return navigator.serviceWorker.getRegistrations().then(regs => {
+      if (regs.length == 0) {
+        setTimeout(proceed, 200);
+        return;
+      }
+
+      bc = new BroadcastChannel('result');
+      regs[0].update().then(() => {
+        bc.postMessage(0);
+      }, () => {
+        bc.postMessage(1);
+      });
+    });
+  }
+
+  proceed();
+}
+</script>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/dom/workers/test/serviceworkers/server_multie10s_update.sjs
@@ -0,0 +1,12 @@
+function handleRequest(request, response)
+{
+  response.processAsync();
+  response.setHeader("Content-Type", "application/javascript", false);
+
+  timer = Components.classes["@mozilla.org/timer;1"].
+          createInstance(Components.interfaces.nsITimer);
+  timer.init(function() {
+    response.write("42");
+    response.finish();
+  }, 3000, Components.interfaces.nsITimer.TYPE_ONE_SHOT);
+}

--- a/editor/libeditor/HTMLEditRules.cpp
+++ b/editor/libeditor/HTMLEditRules.cpp
@@ -1519,20 +1519,21 @@ HTMLEditRules::WillInsertBreak(Selection
     *aCancel = true;
     return NS_OK;
   }
 
   // Identify the block
   nsCOMPtr<Element> blockParent = htmlEditor->GetBlock(node);
   NS_ENSURE_TRUE(blockParent, NS_ERROR_FAILURE);
 
-  // If the active editing host is an inline element, or if the active editing
-  // host is the block parent itself, just append a br.
+  // When there is an active editing host (the <body> if it's in designMode)
+  // and a block which becomes the parent of line breaker is in it, do the
+  // standard thing.
   nsCOMPtr<Element> host = htmlEditor->GetActiveEditingHost();
-  if (!EditorUtils::IsDescendantOf(blockParent, host)) {
+  if (host && !EditorUtils::IsDescendantOf(blockParent, host)) {
     nsresult rv = StandardBreakImpl(node, offset, aSelection);
     NS_ENSURE_SUCCESS(rv, rv);
     *aHandled = true;
     return NS_OK;
   }
 
   // If block is empty, populate with br.  (For example, imagine a div that
   // contains the word "text".  The user selects "text" and types return.
@@ -6486,20 +6487,24 @@ HTMLEditRules::SplitParagraph(nsIDOMNode
                                             address_of(selNode), aOffset);
   // XXX When it fails, why do we need to return selection node?  (Why can the
   //     caller trust the result even when it returns error?)
   *aSelNode = GetAsDOMNode(selNode);
   NS_ENSURE_SUCCESS(rv, rv);
   // split the paragraph
   NS_ENSURE_STATE(mHTMLEditor);
   NS_ENSURE_STATE(selNode->IsContent());
-  mHTMLEditor->SplitNodeDeep(*para, *selNode->AsContent(), *aOffset,
-                             HTMLEditor::EmptyContainers::yes,
-                             getter_AddRefs(leftPara),
-                             getter_AddRefs(rightPara));
+  int32_t offset =
+    mHTMLEditor->SplitNodeDeep(*para, *selNode->AsContent(), *aOffset,
+                               HTMLEditor::EmptyContainers::yes,
+                               getter_AddRefs(leftPara),
+                               getter_AddRefs(rightPara));
+  if (NS_WARN_IF(offset == -1)) {
+    return NS_ERROR_FAILURE;
+  }
   // get rid of the break, if it is visible (otherwise it may be needed to prevent an empty p)
   NS_ENSURE_STATE(mHTMLEditor);
   if (mHTMLEditor->IsVisBreak(aBRNode)) {
     NS_ENSURE_STATE(mHTMLEditor);
     rv = mHTMLEditor->DeleteNode(aBRNode);
     NS_ENSURE_SUCCESS(rv, rv);
   }
 

new file mode 100644
--- /dev/null
+++ b/editor/libeditor/crashtests/1350772.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+addEventListener("DOMContentLoaded", () => {
+  try {
+    document.designMode = 'on';
+    document.removeChild(document.documentElement);
+    document.appendChild(document.createElement("p"));
+    document.execCommand("insertParagraph", false, null);
+  } catch(e) {
+  }
+});
+</script>
+</head>
+</html>

--- a/editor/libeditor/crashtests/crashtests.list
+++ b/editor/libeditor/crashtests/crashtests.list
@@ -68,8 +68,9 @@ load 1158452.html
 load 1158651.html
 load 1244894.xhtml
 load 1264921.html
 load 1272490.html
 load 1317704.html
 load 1317718.html
 load 1324505.html
 load 1348851.html
+load 1350772.html

--- a/gfx/config/gfxVars.h
+++ b/gfx/config/gfxVars.h
@@ -20,16 +20,17 @@ namespace gfx {
 
 class gfxVarReceiver;
 
 // Generator for graphics vars.
 #define GFX_VARS_LIST(_)                                                \
   /* C++ Name,                  Data Type,        Default Value */      \
   _(BrowserTabsRemoteAutostart, bool,             false)                \
   _(ContentBackend,             BackendType,      BackendType::NONE)    \
+  _(SoftwareBackend,            BackendType,      BackendType::NONE)    \
   _(TileSize,                   IntSize,          IntSize(-1, -1))      \
   _(UseXRender,                 bool,             false)                \
   _(OffscreenFormat,            gfxImageFormat,   mozilla::gfx::SurfaceFormat::X8R8G8B8_UINT32) \
   _(RequiresAcceleratedGLContextForCompositorOGL, bool, false)          \
   _(CanUseHardwareVideoDecoding, bool,            false)                \
   _(PDMWMFDisableD3D11Dlls,     nsCString,        nsCString())          \
   _(PDMWMFDisableD3D9Dlls,      nsCString,        nsCString())          \
   _(DXInterop2Blocked,          bool,             false)                \

--- a/gfx/layers/client/ClientPaintedLayer.cpp
+++ b/gfx/layers/client/ClientPaintedLayer.cpp
@@ -52,16 +52,17 @@ ClientPaintedLayer::PaintThebes(nsTArray
   }
 #endif
   PaintState state =
     mContentClient->BeginPaintBuffer(this, flags);
   mValidRegion.Sub(mValidRegion, state.mRegionToInvalidate);
 
   if (!state.mRegionToDraw.IsEmpty() && !ClientManager()->GetPaintedLayerCallback()) {
     ClientManager()->SetTransactionIncomplete();
+    mContentClient->EndPaint(nullptr);
     return;
   }
 
   // The area that became invalid and is visible needs to be repainted
   // (this could be the whole visible area if our buffer switched
   // from RGB to RGBA, because we might need to repaint with
   // subpixel AA)
   state.mRegionToInvalidate.And(state.mRegionToInvalidate,

--- a/gfx/layers/client/ContentClient.cpp
+++ b/gfx/layers/client/ContentClient.cpp
@@ -250,17 +250,17 @@ ContentClientRemoteBuffer::EndPaint(nsTA
   for (unsigned i = 0; i< mOldTextures.Length(); ++i) {
     if (mOldTextures[i]->IsLocked()) {
       mOldTextures[i]->Unlock();
     }
   }
   mOldTextures.Clear();
 
   if (mTextureClient && mTextureClient->IsLocked()) {
-    if (aReadbackUpdates->Length() > 0) {
+    if (aReadbackUpdates && aReadbackUpdates->Length() > 0) {
       RefPtr<TextureReadbackSink> readbackSink = new RemoteBufferReadbackProcessor(aReadbackUpdates, mBufferRect, mBufferRotation);
 
       mTextureClient->SetReadbackSink(readbackSink);
     }
 
     mTextureClient->Unlock();
     mTextureClient->SyncWithObject(mForwarder->GetSyncObject());
   }

--- a/gfx/layers/opengl/TextureHostOGL.cpp
+++ b/gfx/layers/opengl/TextureHostOGL.cpp
@@ -199,21 +199,20 @@ TextureImageTextureSourceOGL::EnsureBuff
   }
   mTexImage->Resize(aSize);
 }
 
 void
 TextureImageTextureSourceOGL::SetTextureSourceProvider(TextureSourceProvider* aProvider)
 {
   GLContext* newGL = aProvider ? aProvider->GetGLContext() : nullptr;
-  if (!mGL) {
-    mGL = newGL;
-  } else if (mGL != newGL) {
+  if (!newGL || mGL != newGL) {
     DeallocateDeviceData();
   }
+  mGL = newGL;
 }
 
 gfx::IntSize
 TextureImageTextureSourceOGL::GetSize() const
 {
   if (mTexImage) {
     if (mIterating) {
       return mTexImage->GetTileRect().Size();

--- a/gfx/thebes/gfxPlatform.cpp
+++ b/gfx/thebes/gfxPlatform.cpp
@@ -1689,16 +1689,17 @@ gfxPlatform::InitBackendPrefs(uint32_t a
     }
 
     uint32_t swBackendBits = BackendTypeBit(BackendType::SKIA) |
                              BackendTypeBit(BackendType::CAIRO);
     mSoftwareBackend = GetContentBackendPref(swBackendBits);
 
     if (XRE_IsParentProcess()) {
         gfxVars::SetContentBackend(mContentBackend);
+        gfxVars::SetSoftwareBackend(mSoftwareBackend);
     }
 }
 
 /* static */ BackendType
 gfxPlatform::GetCanvasBackendPref(uint32_t aBackendBitmask)
 {
     return GetBackendPref("gfx.canvas.azure.backends", aBackendBitmask);
 }

--- a/ipc/glue/MessageChannel.cpp
+++ b/ipc/glue/MessageChannel.cpp
@@ -2114,17 +2114,20 @@ MessageChannel::ShouldContinueFromTimeou
         MonitorAutoUnlock unlock(*mMonitor);
         cont = mListener->ShouldContinueFromReplyTimeout();
         mListener->ArtificialSleep();
     }
 
     static enum { UNKNOWN, NOT_DEBUGGING, DEBUGGING } sDebuggingChildren = UNKNOWN;
 
     if (sDebuggingChildren == UNKNOWN) {
-        sDebuggingChildren = getenv("MOZ_DEBUG_CHILD_PROCESS") ? DEBUGGING : NOT_DEBUGGING;
+        sDebuggingChildren = getenv("MOZ_DEBUG_CHILD_PROCESS") ||
+                             getenv("MOZ_DEBUG_CHILD_PAUSE")
+                               ? DEBUGGING
+                               : NOT_DEBUGGING;
     }
     if (sDebuggingChildren == DEBUGGING) {
         return true;
     }
 
     return cont;
 }
 

--- a/js/ipc/WrapperOwner.cpp
+++ b/js/ipc/WrapperOwner.cpp
@@ -124,17 +124,18 @@ class CPOWProxyHandler : public BaseProx
     virtual bool getOwnEnumerablePropertyKeys(JSContext* cx, HandleObject proxy,
                                               AutoIdVector& props) const override;
     virtual bool hasInstance(JSContext* cx, HandleObject proxy,
                              MutableHandleValue v, bool* bp) const override;
     virtual bool getBuiltinClass(JSContext* cx, HandleObject obj, js::ESClass* cls) const override;
     virtual bool isArray(JSContext* cx, HandleObject obj,
                          IsArrayAnswer* answer) const override;
     virtual const char* className(JSContext* cx, HandleObject proxy) const override;
-    virtual bool regexp_toShared(JSContext* cx, HandleObject proxy, RegExpGuard* g) const override;
+    virtual bool regexp_toShared(JSContext* cx, HandleObject proxy,
+                                 MutableHandle<RegExpShared*> shared) const override;
     virtual void finalize(JSFreeOp* fop, JSObject* proxy) const override;
     virtual void objectMoved(JSObject* proxy, const JSObject* old) const override;
     virtual bool isCallable(JSObject* obj) const override;
     virtual bool isConstructor(JSObject* obj) const override;
     virtual bool getPrototype(JSContext* cx, HandleObject proxy, MutableHandleObject protop) const override;
     virtual bool getPrototypeIfOrdinary(JSContext* cx, HandleObject proxy, bool* isOrdinary,
                                         MutableHandleObject protop) const override;
 
@@ -849,23 +850,24 @@ WrapperOwner::getPrototypeIfOrdinary(JSC
         return false;
 
     objp.set(fromObjectOrNullVariant(cx, val));
 
     return true;
 }
 
 bool
-CPOWProxyHandler::regexp_toShared(JSContext* cx, HandleObject proxy, RegExpGuard* g) const
+CPOWProxyHandler::regexp_toShared(JSContext* cx, HandleObject proxy,
+                                  MutableHandle<RegExpShared*> shared) const
 {
-    FORWARD(regexp_toShared, (cx, proxy, g));
+    FORWARD(regexp_toShared, (cx, proxy, shared));
 }
 
 bool
-WrapperOwner::regexp_toShared(JSContext* cx, HandleObject proxy, RegExpGuard* g)
+WrapperOwner::regexp_toShared(JSContext* cx, HandleObject proxy, MutableHandle<RegExpShared*> shared)
 {
     ObjectId objId = idOf(proxy);
 
     ReturnStatus status;
     nsString source;
     unsigned flags = 0;
     if (!SendRegExpToShared(objId, &status, &source, &flags))
         return ipcfail(cx);
@@ -875,17 +877,17 @@ WrapperOwner::regexp_toShared(JSContext*
     if (!ok(cx, status))
         return false;
 
     RootedObject regexp(cx);
     regexp = JS_NewUCRegExpObject(cx, source.get(), source.Length(), flags);
     if (!regexp)
         return false;
 
-    return js::RegExpToSharedNonInline(cx, regexp, g);
+    return js::RegExpToSharedNonInline(cx, regexp, shared);
 }
 
 void
 CPOWProxyHandler::finalize(JSFreeOp* fop, JSObject* proxy) const
 {
     AuxCPOWData* aux = AuxCPOWDataOf(proxy);
 
     OwnerOf(proxy)->drop(proxy);

--- a/js/ipc/WrapperOwner.h
+++ b/js/ipc/WrapperOwner.h
@@ -55,17 +55,18 @@ class WrapperOwner : public virtual Java
     bool hasInstance(JSContext* cx, JS::HandleObject proxy, JS::MutableHandleValue v, bool* bp);
     bool getBuiltinClass(JSContext* cx, JS::HandleObject proxy, js::ESClass* cls);
     bool isArray(JSContext* cx, JS::HandleObject proxy, JS::IsArrayAnswer* answer);
     const char* className(JSContext* cx, JS::HandleObject proxy);
     bool getPrototype(JSContext* cx, JS::HandleObject proxy, JS::MutableHandleObject protop);
     bool getPrototypeIfOrdinary(JSContext* cx, JS::HandleObject proxy, bool* isOrdinary,
                                 JS::MutableHandleObject protop);
 
-    bool regexp_toShared(JSContext* cx, JS::HandleObject proxy, js::RegExpGuard* g);
+    bool regexp_toShared(JSContext* cx, JS::HandleObject proxy,
+                         js::MutableHandle<js::RegExpShared*> shared);
 
     nsresult instanceOf(JSObject* obj, const nsID* id, bool* bp);
 
     bool toString(JSContext* cx, JS::HandleObject callee, JS::CallArgs& args);
     bool DOMQI(JSContext* cx, JS::HandleObject callee, JS::CallArgs& args);
 
     /*
      * Check that |obj| is a DOM wrapper whose prototype chain contains

--- a/js/public/MemoryMetrics.h
+++ b/js/public/MemoryMetrics.h
@@ -573,40 +573,42 @@ struct UnusedGCThingSizes
     macro(Other, GCHeapUnused, script) \
     macro(Other, GCHeapUnused, lazyScript) \
     macro(Other, GCHeapUnused, shape) \
     macro(Other, GCHeapUnused, baseShape) \
     macro(Other, GCHeapUnused, objectGroup) \
     macro(Other, GCHeapUnused, string) \
     macro(Other, GCHeapUnused, symbol) \
     macro(Other, GCHeapUnused, jitcode) \
-    macro(Other, GCHeapUnused, scope)
+    macro(Other, GCHeapUnused, scope) \
+    macro(Other, GCHeapUnused, regExpShared)
 
     UnusedGCThingSizes()
       : FOR_EACH_SIZE(ZERO_SIZE)
         dummy()
     {}
 
     UnusedGCThingSizes(UnusedGCThingSizes&& other)
       : FOR_EACH_SIZE(COPY_OTHER_SIZE)
         dummy()
     {}
 
     void addToKind(JS::TraceKind kind, intptr_t n) {
         switch (kind) {
-          case JS::TraceKind::Object:       object += n;      break;
-          case JS::TraceKind::String:       string += n;      break;
-          case JS::TraceKind::Symbol:       symbol += n;      break;
-          case JS::TraceKind::Script:       script += n;      break;
-          case JS::TraceKind::Shape:        shape += n;       break;
-          case JS::TraceKind::BaseShape:    baseShape += n;   break;
-          case JS::TraceKind::JitCode:      jitcode += n;     break;
-          case JS::TraceKind::LazyScript:   lazyScript += n;  break;
-          case JS::TraceKind::ObjectGroup:  objectGroup += n; break;
-          case JS::TraceKind::Scope:        scope += n;       break;
+          case JS::TraceKind::Object:       object += n;       break;
+          case JS::TraceKind::String:       string += n;       break;
+          case JS::TraceKind::Symbol:       symbol += n;       break;
+          case JS::TraceKind::Script:       script += n;       break;
+          case JS::TraceKind::Shape:        shape += n;        break;
+          case JS::TraceKind::BaseShape:    baseShape += n;    break;
+          case JS::TraceKind::JitCode:      jitcode += n;      break;
+          case JS::TraceKind::LazyScript:   lazyScript += n;   break;
+          case JS::TraceKind::ObjectGroup:  objectGroup += n;  break;
+          case JS::TraceKind::Scope:        scope += n;        break;
+          case JS::TraceKind::RegExpShared: regExpShared += n; break;
           default:
             MOZ_CRASH("Bad trace kind for UnusedGCThingSizes");
         }
     }
 
     void addSizes(const UnusedGCThingSizes& other) {
         FOR_EACH_SIZE(ADD_OTHER_SIZE)
     }
@@ -638,16 +640,18 @@ struct ZoneStats
     macro(Other,   GCHeapAdmin, gcHeapArenaAdmin) \
     macro(Other,   GCHeapUsed,  lazyScriptsGCHeap) \
     macro(Other,   MallocHeap,  lazyScriptsMallocHeap) \
     macro(Other,   GCHeapUsed,  jitCodesGCHeap) \
     macro(Other,   GCHeapUsed,  objectGroupsGCHeap) \
     macro(Other,   MallocHeap,  objectGroupsMallocHeap) \
     macro(Other,   GCHeapUsed,  scopesGCHeap) \
     macro(Other,   MallocHeap,  scopesMallocHeap) \
+    macro(Other,   GCHeapUsed,  regExpSharedsGCHeap) \
+    macro(Other,   MallocHeap,  regExpSharedsMallocHeap) \
     macro(Other,   MallocHeap,  typePool) \
     macro(Other,   MallocHeap,  baselineStubsOptimized) \
     macro(Other,   MallocHeap,  uniqueIdMap) \
     macro(Other,   MallocHeap,  shapeTables)
 
     ZoneStats()
       : FOR_EACH_SIZE(ZERO_SIZE)
         unusedGCThings(),

--- a/js/public/Proxy.h
+++ b/js/public/Proxy.h
@@ -27,17 +27,18 @@ using JS::MutableHandle;
 using JS::MutableHandleObject;
 using JS::MutableHandleValue;
 using JS::NativeImpl;
 using JS::ObjectOpResult;
 using JS::PrivateValue;
 using JS::PropertyDescriptor;
 using JS::Value;
 
-class RegExpGuard;
+class RegExpShared;
+
 class JS_FRIEND_API(Wrapper);
 
 /*
  * A proxy is a JSObject with highly customizable behavior. ES6 specifies a
  * single kind of proxy, but the customization mechanisms we use to implement
  * ES6 Proxy objects are also useful wherever an object with weird behavior is
  * wanted. Proxies are used to implement:
  *
@@ -325,17 +326,18 @@ class JS_FRIEND_API(BaseProxyHandler)
     virtual bool nativeCall(JSContext* cx, IsAcceptableThis test, NativeImpl impl,
                             const CallArgs& args) const;
     virtual bool hasInstance(JSContext* cx, HandleObject proxy, MutableHandleValue v, bool* bp) const;
     virtual bool getBuiltinClass(JSContext* cx, HandleObject proxy,
                                  ESClass* cls) const;
     virtual bool isArray(JSContext* cx, HandleObject proxy, JS::IsArrayAnswer* answer) const;
     virtual const char* className(JSContext* cx, HandleObject proxy) const;
     virtual JSString* fun_toString(JSContext* cx, HandleObject proxy, unsigned indent) const;
-    virtual bool regexp_toShared(JSContext* cx, HandleObject proxy, RegExpGuard* g) const;
+    virtual bool regexp_toShared(JSContext* cx, HandleObject proxy,
+                                 MutableHandle<js::RegExpShared*> shared) const;
     virtual bool boxedValue_unbox(JSContext* cx, HandleObject proxy, MutableHandleValue vp) const;
     virtual void trace(JSTracer* trc, JSObject* proxy) const;
     virtual void finalize(JSFreeOp* fop, JSObject* proxy) const;
     virtual void objectMoved(JSObject* proxy, const JSObject* old) const;
 
     // Allow proxies, wrappers in particular, to specify callability at runtime.
     // Note: These do not take const JSObject*, but they do in spirit.
     //       We are not prepared to do this, as there's little const correctness

--- a/js/public/TraceKind.h
+++ b/js/public/TraceKind.h
@@ -11,16 +11,17 @@
 
 #include "js/TypeDecls.h"
 
 // Forward declarations of all the types a TraceKind can denote.
 namespace js {
 class BaseShape;
 class LazyScript;
 class ObjectGroup;
+class RegExpShared;
 class Shape;
 class Scope;
 namespace jit {
 class JitCode;
 } // namespace jit
 } // namespace js
 
 namespace JS {
@@ -54,23 +55,25 @@ enum class TraceKind
 
     // The kind associated with a nullptr.
     Null = 0x06,
 
     // The following kinds do not have an exposed C++ idiom.
     BaseShape = 0x0F,
     JitCode = 0x1F,
     LazyScript = 0x2F,
-    Scope = 0x3F
+    Scope = 0x3F,
+    RegExpShared = 0x4F
 };
 const static uintptr_t OutOfLineTraceKindMask = 0x07;
 static_assert(uintptr_t(JS::TraceKind::BaseShape) & OutOfLineTraceKindMask, "mask bits are set");
 static_assert(uintptr_t(JS::TraceKind::JitCode) & OutOfLineTraceKindMask, "mask bits are set");
 static_assert(uintptr_t(JS::TraceKind::LazyScript) & OutOfLineTraceKindMask, "mask bits are set");
 static_assert(uintptr_t(JS::TraceKind::Scope) & OutOfLineTraceKindMask, "mask bits are set");
+static_assert(uintptr_t(JS::TraceKind::RegExpShared) & OutOfLineTraceKindMask, "mask bits are set");
 
 // When this header is imported inside SpiderMonkey, the class definitions are
 // available and we can query those definitions to find the correct kind
 // directly from the class hierarchy.
 template <typename T>
 struct MapTypeToTraceKind {
     static const JS::TraceKind kind = T::TraceKind;
 };
@@ -83,17 +86,18 @@ struct MapTypeToTraceKind {
     D(JitCode,       js::jit::JitCode,  true) \
     D(LazyScript,    js::LazyScript,    true) \
     D(Scope,         js::Scope,         true) \
     D(Object,        JSObject,          true) \
     D(ObjectGroup,   js::ObjectGroup,   true) \
     D(Script,        JSScript,          true) \
     D(Shape,         js::Shape,         true) \
     D(String,        JSString,          false) \
-    D(Symbol,        JS::Symbol,        false)
+    D(Symbol,        JS::Symbol,        false) \
+    D(RegExpShared,  js::RegExpShared,  true)
 
 // Map from all public types to their trace kind.
 #define JS_EXPAND_DEF(name, type, _) \
     template <> struct MapTypeToTraceKind<type> { \
         static const JS::TraceKind kind = JS::TraceKind::name; \
     };
 JS_FOR_EACH_TRACEKIND(JS_EXPAND_DEF);
 #undef JS_EXPAND_DEF

--- a/js/public/TracingAPI.h
+++ b/js/public/TracingAPI.h
@@ -159,16 +159,19 @@ class JS_PUBLIC_API(CallbackTracer) : pu
         onChild(JS::GCCellPtr(*codep, JS::TraceKind::JitCode));
     }
     virtual void onLazyScriptEdge(js::LazyScript** lazyp) {
         onChild(JS::GCCellPtr(*lazyp, JS::TraceKind::LazyScript));
     }
     virtual void onScopeEdge(js::Scope** scopep) {
         onChild(JS::GCCellPtr(*scopep, JS::TraceKind::Scope));
     }
+    virtual void onRegExpSharedEdge(js::RegExpShared** sharedp) {
+        onChild(JS::GCCellPtr(*sharedp, JS::TraceKind::RegExpShared));
+    }
 
     // Override this method to receive notification when a node in the GC
     // heap graph is visited.
     virtual void onChild(const JS::GCCellPtr& thing) = 0;
 
     // Access to the tracing context:
     // When tracing with a JS::CallbackTracer, we invoke the callback with the
     // edge location and the type of target. This is useful for operating on
@@ -229,16 +232,17 @@ class JS_PUBLIC_API(CallbackTracer) : pu
     void dispatchToOnEdge(JS::Symbol** symp) { onSymbolEdge(symp); }
     void dispatchToOnEdge(JSScript** scriptp) { onScriptEdge(scriptp); }
     void dispatchToOnEdge(js::Shape** shapep) { onShapeEdge(shapep); }
     void dispatchToOnEdge(js::ObjectGroup** groupp) { onObjectGroupEdge(groupp); }
     void dispatchToOnEdge(js::BaseShape** basep) { onBaseShapeEdge(basep); }
     void dispatchToOnEdge(js::jit::JitCode** codep) { onJitCodeEdge(codep); }
     void dispatchToOnEdge(js::LazyScript** lazyp) { onLazyScriptEdge(lazyp); }
     void dispatchToOnEdge(js::Scope** scopep) { onScopeEdge(scopep); }
+    void dispatchToOnEdge(js::RegExpShared** sharedp) { onRegExpSharedEdge(sharedp); }
 
   protected:
     void setTraceWeakEdges(bool value) {
         traceWeakEdges_ = value;
     }
 
   private:
     friend class AutoTracingName;