--- a/devtools/client/aboutdebugging-new/src/components/sidebar/Sidebar.js
+++ b/devtools/client/aboutdebugging-new/src/components/sidebar/Sidebar.js
@@ -32,17 +32,17 @@ class Sidebar extends PureComponent {
   renderDevices() {
     const { dispatch, runtimes, selectedPage } = this.props;
     if (!runtimes.networkRuntimes.length && !runtimes.usbRuntimes.length) {
       return Localized(
         {
           id: "about-debugging-sidebar-no-devices"
         }, dom.span(
           {
-            className: "sidebar__devices__no-devices-message"
+            className: "sidebar__devices__no-devices-message js-sidebar-no-devices"
           },
           "No devices discovered"
         )
       );
     }
 
     return [
       ...runtimes.networkRuntimes.map(runtime => {

--- a/devtools/client/aboutdebugging-new/src/modules/usb-runtimes.js
+++ b/devtools/client/aboutdebugging-new/src/modules/usb-runtimes.js
@@ -1,15 +1,14 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 "use strict";
 
-const { check } = require("devtools/shared/adb/adb-running-checker");
 const { ADBScanner } = require("devtools/shared/adb/adb-scanner");
 const { GetAvailableAddons } = require("devtools/client/webide/modules/addons");
 
 /**
  * This module provides a collection of helper methods to detect USB runtimes whom Firefox
  * is running on.
  */
 function addUSBRuntimesObserver(listener) {
@@ -19,17 +18,17 @@ exports.addUSBRuntimesObserver = addUSBR
 
 function disableUSBRuntimes() {
   ADBScanner.disable();
 }
 exports.disableUSBRuntimes = disableUSBRuntimes;
 
 async function enableUSBRuntimes() {
   const { adb } = GetAvailableAddons();
-  if (adb.status === "uninstalled" || !(await check())) {
+  if (adb.status !== "installed") {
     console.error("ADB extension is not installed");
     return;
   }
 
   ADBScanner.enable();
 }
 exports.enableUSBRuntimes = enableUSBRuntimes;
 

--- a/devtools/client/aboutdebugging-new/test/browser/browser.ini
+++ b/devtools/client/aboutdebugging-new/test/browser/browser.ini
@@ -2,12 +2,14 @@
 tags = devtools
 subsuite = devtools
 support-files =
   debug-target-pane_collapsibilities_head.js
   head.js
   !/devtools/client/shared/test/shared-head.js
   !/devtools/client/shared/test/telemetry-test-helpers.js
 
+[browser_aboutdebugging_connect_networklocations.js]
 [browser_aboutdebugging_debug-target-pane_collapsibilities_interaction.js]
 [browser_aboutdebugging_debug-target-pane_collapsibilities_preference.js]
+[browser_aboutdebugging_navigate.js]
+[browser_aboutdebugging_sidebar_network_runtimes.js]
 [browser_aboutdebugging_thisfirefox.js]
-[browser_aboutdebugging_connect_networklocations.js]

--- a/devtools/client/aboutdebugging-new/test/browser/browser_aboutdebugging_debug-target-pane_collapsibilities_interaction.js
+++ b/devtools/client/aboutdebugging-new/test/browser/browser_aboutdebugging_debug-target-pane_collapsibilities_interaction.js
@@ -1,21 +1,17 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
-/* import-globals-from debug-target-pane_collapsibilities_head.js */
 
 "use strict";
 
 /**
  * Test that collapsibilities of DebugTargetPane on RuntimePage by mouse clicking.
  */
 
-Services.scriptloader.loadSubScript(
-  CHROME_URL_ROOT + "debug-target-pane_collapsibilities_head.js", this);
-
 add_task(async function() {
   prepareCollapsibilitiesTest();
 
   const { document, tab } = await openAboutDebugging();
 
   for (const { title } of TARGET_PANES) {
     const debugTargetPaneEl = getDebugTargetPane(title, document);
 

--- a/devtools/client/aboutdebugging-new/test/browser/browser_aboutdebugging_debug-target-pane_collapsibilities_preference.js
+++ b/devtools/client/aboutdebugging-new/test/browser/browser_aboutdebugging_debug-target-pane_collapsibilities_preference.js
@@ -1,21 +1,17 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
-/* import-globals-from debug-target-pane_collapsibilities_head.js */
 
 "use strict";
 
 /**
  * Test for preference of DebugTargetPane collapsibilities.
  */
 
-Services.scriptloader.loadSubScript(
-  CHROME_URL_ROOT + "debug-target-pane_collapsibilities_head.js", this);
-
 add_task(async function() {
   prepareCollapsibilitiesTest();
 
   const { document, tab } = await openAboutDebugging();
 
   info("Collapse all pane");
   for (const { title } of TARGET_PANES) {
     const debugTargetPaneEl = getDebugTargetPane(title, document);

new file mode 100644
--- /dev/null
+++ b/devtools/client/aboutdebugging-new/test/browser/browser_aboutdebugging_navigate.js
@@ -0,0 +1,79 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+/**
+ * Check that navigating from This Firefox to Connect and back to This Firefox works and
+ * does not leak.
+ */
+
+const TAB_URL_1 = "data:text/html,<title>TAB1</title>";
+const TAB_URL_2 = "data:text/html,<title>TAB2</title>";
+
+add_task(async function() {
+  info("Force all debug target panes to be expanded");
+  prepareCollapsibilitiesTest();
+
+  const { document, tab } = await openAboutDebugging();
+
+  const connectSidebarItem = findSidebarItemByText("Connect", document);
+  ok(connectSidebarItem, "Found the Connect sidebar item");
+
+  const thisFirefoxSidebarItem = findSidebarItemByText("This Firefox", document);
+  ok(thisFirefoxSidebarItem, "Found the ThisFirefox sidebar item");
+  ok(isSidebarItemSelected(thisFirefoxSidebarItem),
+    "ThisFirefox sidebar item is selected by default");
+
+  info("Open a new background tab TAB1");
+  const backgroundTab1 = await addTab(TAB_URL_1, { background: true });
+
+  info("Wait for the tab to appear in the debug targets with the correct name");
+  await waitUntil(() => findDebugTargetByText("TAB1", document));
+
+  info("Click on the Connect item in the sidebar");
+  connectSidebarItem.click();
+
+  info("Wait until Connect page is displayed");
+  await waitUntil(() => document.querySelector(".js-connect-page"));
+  ok(isSidebarItemSelected(connectSidebarItem), "Connect sidebar item is selected");
+  ok(!document.querySelector(".js-runtime-page"), "Runtime page no longer rendered");
+
+  info("Open a new tab which should be listed when we go back to This Firefox");
+  const backgroundTab2 = await addTab(TAB_URL_2, { background: true });
+
+  info("Click on the ThisFirefox item in the sidebar");
+  thisFirefoxSidebarItem.click();
+
+  info("Wait until ThisFirefox page is displayed");
+  await waitUntil(() => document.querySelector(".js-runtime-page"));
+  ok(isSidebarItemSelected(thisFirefoxSidebarItem),
+    "ThisFirefox sidebar item is selected again");
+  ok(!document.querySelector(".js-connect-page"), "Connect page no longer rendered");
+
+  info("TAB2 should already be displayed in the debug targets");
+  await waitUntil(() => findDebugTargetByText("TAB2", document));
+
+  info("Remove first background tab");
+  await removeTab(backgroundTab1);
+
+  info("Check TAB1 disappears, meaning ThisFirefox client is correctly connected");
+  await waitUntil(() => !findDebugTargetByText("TAB1", document));
+
+  info("Remove second background tab");
+  await removeTab(backgroundTab2);
+
+  info("Check TAB2 disappears, meaning ThisFirefox client is correctly connected");
+  await waitUntil(() => !findDebugTargetByText("TAB2", document));
+
+  await removeTab(tab);
+});
+
+function isSidebarItemSelected(item) {
+  return item.classList.contains("js-sidebar-item-selected");
+}
+
+function findDebugTargetByText(text, document) {
+  const targets = [...document.querySelectorAll(".js-debug-target-item")];
+  return targets.find(target => target.textContent.includes(text));
+}

new file mode 100644
--- /dev/null
+++ b/devtools/client/aboutdebugging-new/test/browser/browser_aboutdebugging_sidebar_network_runtimes.js
@@ -0,0 +1,40 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+const networkLocationsModule =
+  require("devtools/client/aboutdebugging-new/src/modules/network-locations.js");
+
+/**
+ * Test the sidebar is updated correctly when network runtimes are added/removed.
+ */
+
+add_task(async function() {
+  registerCleanupFunction(() => {
+    Services.prefs.clearUserPref("devtools.aboutdebugging.network-locations");
+  });
+
+  const { document, tab } = await openAboutDebugging();
+
+  const noDevicesElement = document.querySelector(".js-sidebar-no-devices");
+  ok(noDevicesElement, "Sidebar shows the 'no devices' element");
+
+  info("Add a network location");
+  networkLocationsModule.addNetworkLocation("localhost:6080");
+
+  info("Wait for 'no devices' element to disappear");
+  waitUntil(() => !document.querySelector(".js-sidebar-no-devices"));
+  ok(findSidebarItemByText("localhost:6080", document),
+    "Found a sidebar item for localhost:6080");
+
+  info("Remove the network location");
+  networkLocationsModule.removeNetworkLocation("localhost:6080");
+
+  info("Wait for 'no devices' element to reappear");
+  waitUntil(() => document.querySelector(".js-sidebar-no-devices"));
+  ok(!findSidebarItemByText("localhost:6080", document),
+    "Sidebar item for localhost:6080 removed");
+
+  await removeTab(tab);
+});

--- a/devtools/client/aboutdebugging-new/test/browser/head.js
+++ b/devtools/client/aboutdebugging-new/test/browser/head.js
@@ -1,22 +1,27 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 /* eslint-env browser */
 /* eslint no-unused-vars: [2, {"vars": "local"}] */
 /* import-globals-from ../../../shared/test/shared-head.js */
+/* import-globals-from debug-target-pane_collapsibilities_head.js */
 
 "use strict";
 
 // Load the shared-head file first.
 Services.scriptloader.loadSubScript(
   "chrome://mochitests/content/browser/devtools/client/shared/test/shared-head.js",
   this);
 
+// Load collapsibilities helpers
+Services.scriptloader.loadSubScript(
+  CHROME_URL_ROOT + "debug-target-pane_collapsibilities_head.js", this);
+
 /**
  * Enable the new about:debugging panel.
  */
 async function enableNewAboutDebugging() {
   await pushPref("devtools.aboutdebugging.new-enabled", true);
 }
 
 async function openAboutDebugging(page, win) {
@@ -31,8 +36,15 @@ async function openAboutDebugging(page, 
   info("Wait until the main about debugging container is available");
   await waitUntil(() => document.querySelector(".app"));
 
   info("Wait until the client connection was established");
   await waitUntil(() => document.querySelector(".js-runtime-page"));
 
   return { tab, document, window };
 }
+
+function findSidebarItemByText(text, document) {
+  const sidebarItems = document.querySelectorAll(".js-sidebar-item");
+  return [...sidebarItems].find(element => {
+    return element.textContent.includes(text);
+  });
+}

--- a/dom/base/nsINode.cpp
+++ b/dom/base/nsINode.cpp
@@ -2894,24 +2894,30 @@ nsINode::WrapObject(JSContext *aCx, JS::
   // Event handling is possible only if (1). If (2) event handling is
   // prevented.
   // If the document has never had a script handling object, untrusted
   // scripts (3) shouldn't touch it!
   bool hasHadScriptHandlingObject = false;
   if (!OwnerDoc()->GetScriptHandlingObject(hasHadScriptHandlingObject) &&
       !hasHadScriptHandlingObject &&
       !nsContentUtils::IsSystemCaller(aCx)) {
+    if (IsDocument()) {
+      MOZ_CRASH("Looks like bug 1488480/1405521, with a document that lost its script handling object");
+    }
     Throw(aCx, NS_ERROR_UNEXPECTED);
     return nullptr;
   }
 
   JS::Rooted<JSObject*> obj(aCx, WrapNode(aCx, aGivenProto));
   MOZ_ASSERT_IF(obj && ChromeOnlyAccess(),
                 xpc::IsInContentXBLScope(obj) ||
                 !xpc::UseContentXBLScope(JS::GetObjectRealmOrNull(obj)));
+  if (!obj && IsDocument()) {
+    MOZ_CRASH("Looks like bug 1488480/1405521, with WrapNode on a document returning null");
+  }
   return obj;
 }
 
 already_AddRefed<nsINode>
 nsINode::CloneNode(bool aDeep, ErrorResult& aError)
 {
   return nsNodeUtils::CloneNodeImpl(this, aDeep, aError);
 }

--- a/dom/bindings/BindingUtils.h
+++ b/dom/bindings/BindingUtils.h
@@ -39,27 +39,25 @@
 #include "xpcpublic.h"
 #include "nsIVariant.h"
 #include "mozilla/dom/FakeString.h"
 
 #include "nsWrapperCacheInlines.h"
 
 class nsGenericHTMLElement;
 class nsIJSID;
-class nsIDocument;
 
 namespace mozilla {
 
 enum UseCounter : int16_t;
 
 namespace dom {
 class CustomElementReactionsStack;
 class MessageManagerGlobal;
 template<typename KeyType, typename ValueType> class Record;
-class Location;
 
 nsresult
 UnwrapArgImpl(JSContext* cx, JS::Handle<JSObject*> src, const nsIID& iid,
               void** ppArg);
 
 nsresult
 UnwrapWindowProxyImpl(JSContext* cx, JS::Handle<JSObject*> src,
                       nsPIDOMWindowOuter** ppArg);
@@ -1057,40 +1055,18 @@ struct CheckWrapperCacheTracing<T, true>
     wrapperCacheFromQI->CheckCCWrapperTraversal(ccISupports, participant);
     wrapperCacheFromQI->SetPreservingWrapper(wasPreservingWrapper);
   }
 };
 
 void
 AssertReflectorHasGivenProto(JSContext* aCx, JSObject* aReflector,
                              JS::Handle<JSObject*> aGivenProto);
-
 #endif // DEBUG
 
-template <class T>
-MOZ_ALWAYS_INLINE void
-CrashIfDocumentOrLocationWrapFailed()
-{
-  // Do nothing.
-}
-
-template<>
-MOZ_ALWAYS_INLINE void
-CrashIfDocumentOrLocationWrapFailed<nsIDocument>()
-{
-  MOZ_CRASH("Looks like bug 1488480/1405521, with WrapObject() on nsIDocument throwing");
-}
-
-template<>
-MOZ_ALWAYS_INLINE void
-CrashIfDocumentOrLocationWrapFailed<Location>()
-{
-  MOZ_CRASH("Looks like bug 1488480/1405521, with WrapObject() on Location throwing");
-}
-
 template <class T, GetOrCreateReflectorWrapBehavior wrapBehavior>
 MOZ_ALWAYS_INLINE bool
 DoGetOrCreateDOMReflector(JSContext* cx, T* value,
                           JS::Handle<JSObject*> givenProto,
                           JS::MutableHandle<JS::Value> rval)
 {
   MOZ_ASSERT(value);
   MOZ_ASSERT_IF(givenProto, js::IsObjectInContextCompartment(givenProto, cx));
@@ -1103,17 +1079,16 @@ DoGetOrCreateDOMReflector(JSContext* cx,
     obj = value->GetWrapper();
 #endif
   } else {
     obj = value->WrapObject(cx, givenProto);
     if (!obj) {
       // At this point, obj is null, so just return false.
       // Callers seem to be testing JS_IsExceptionPending(cx) to
       // figure out whether WrapObject() threw.
-      CrashIfDocumentOrLocationWrapFailed<T>();
       return false;
     }
 
 #ifdef DEBUG
     if (IsBaseOf<nsWrapperCache, T>::value) {
       CheckWrapperCacheTracing<T>::Check(value);
     }
 #endif
@@ -1133,45 +1108,29 @@ DoGetOrCreateDOMReflector(JSContext* cx,
     MOZ_ASSERT_IF(clasp->mDOMObjectIsISupports, (IsBaseOf<nsISupports, T>::value));
     MOZ_ASSERT(CheckWrapperCacheCast<T>::Check());
   }
 #endif
 
   rval.set(JS::ObjectValue(*obj));
 
   if (js::GetObjectCompartment(obj) == js::GetContextCompartment(cx)) {
-    if (!TypeNeedsOuterization<T>::value) {
-      return true;
-    }
-    if (TryToOuterize(rval)) {
-      return true;
-    }
-
-    return false;
+    return TypeNeedsOuterization<T>::value ? TryToOuterize(rval) : true;
   }
 
   if (wrapBehavior == eDontWrapIntoContextCompartment) {
     if (TypeNeedsOuterization<T>::value) {
       JSAutoRealm ar(cx, obj);
-      if (TryToOuterize(rval)) {
-        return true;
-      }
-
-      return false;
+      return TryToOuterize(rval);
     }
 
     return true;
   }
 
-  if (JS_WrapValue(cx, rval)) {
-    return true;
-  }
-
-  MOZ_CRASH("Looks like bug 1488480/1405521, with JS_WrapValue failing");
-  return false;
+  return JS_WrapValue(cx, rval);
 }
 
 } // namespace binding_detail
 
 // Create a JSObject wrapping "value", if there isn't one already, and store it
 // in rval.  "value" must be a concrete class that implements a
 // GetWrapperPreserveColor() which can return its existing wrapper, if any, and
 // a WrapObject() which will try to create a wrapper. Typically, this is done by

--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -3491,17 +3491,17 @@ class CGConstructorEnabled(CGAbstractMet
                                           reindent=True)
         else:
             conditionsWrapper = CGGeneric("return true;\n")
 
         body.append(conditionsWrapper)
         return body.define()
 
 
-def CreateBindingJSObject(descriptor, properties):
+def CreateBindingJSObject(descriptor, properties, failureCode = ""):
     objDecl = "BindingJSObjectCreator<%s> creator(aCx);\n" % descriptor.nativeType
 
     # We don't always need to root obj, but there are a variety
     # of cases where we do, so for simplicity, just always root it.
     if descriptor.proxy:
         if descriptor.interface.getExtendedAttribute('OverrideBuiltins'):
             create = dedent(
                 """
@@ -3516,22 +3516,24 @@ def CreateBindingJSObject(descriptor, pr
                 creator.CreateProxyObject(aCx, &sClass.mBase, DOMProxyHandler::getInstance(),
                                           proto, aObject, JS::UndefinedHandleValue, aReflector);
                 """)
     else:
         create = dedent(
             """
             creator.CreateObject(aCx, sClass.ToJSClass(), proto, aObject, aReflector);
             """)
-    return objDecl + create + dedent(
+    return objDecl + create + fill(
         """
         if (!aReflector) {
+          $*{failureCode}
           return false;
         }
-        """)
+        """,
+        failureCode=failureCode)
 
 
 def InitUnforgeablePropertiesOnHolder(descriptor, properties, failureCode,
                                       holderName="unforgeableHolder"):
     """
     Define the unforgeable properties on the unforgeable holder for
     the interface represented by descriptor.
 
@@ -3691,41 +3693,45 @@ def SetImmutablePrototype(descriptor, fa
         MOZ_ASSERT(succeeded,
                    "Making a fresh reflector instance have an immutable "
                    "prototype can internally fail, but it should never be "
                    "unsuccessful");
         """,
         failureCode=failureCode)
 
 
-def DeclareProto():
+def DeclareProto(noProto = "", wrapFail = ""):
     """
     Declare the canonicalProto and proto we have for our wrapping operation.
     """
-    return dedent(
+    return fill(
         """
         JS::Handle<JSObject*> canonicalProto = GetProtoObjectHandle(aCx);
         if (!canonicalProto) {
+          $*{noProto}
           return false;
         }
         JS::Rooted<JSObject*> proto(aCx);
         if (aGivenProto) {
           proto = aGivenProto;
           // Unfortunately, while aGivenProto was in the compartment of aCx
           // coming in, we changed compartments to that of "parent" so may need
           // to wrap the proto here.
           if (js::GetContextCompartment(aCx) != js::GetObjectCompartment(proto)) {
             if (!JS_WrapObject(aCx, &proto)) {
+              $*{wrapFail}
               return false;
             }
           }
         } else {
           proto = canonicalProto;
         }
-        """)
+        """,
+        noProto=noProto,
+        wrapFail=wrapFail)
 
 
 class CGWrapWithCacheMethod(CGAbstractMethod):
     """
     Create a wrapper JSObject for a given native that implements nsWrapperCache.
 
     properties should be a PropertyArrays instance.
     """
@@ -3742,31 +3748,73 @@ class CGWrapWithCacheMethod(CGAbstractMe
     def definition_body(self):
         failureCode = dedent(
             """
             aCache->ReleaseWrapper(aObject);
             aCache->ClearWrapper();
             return false;
             """)
 
+        isDocument = False
+        iface = self.descriptor.interface
+        while iface:
+            if iface.identifier.name == "Document":
+                isDocument = True
+                break
+            iface = iface.parent
+
+        if isDocument:
+            noGlobal = fill(
+                """
+                MOZ_CRASH("Looks like bug 1488480/1405521, with ${name} not having a global");
+                """,
+                name = self.descriptor.name)
+            noProto = fill(
+                """
+                MOZ_CRASH("Looks like bug 1488480/1405521, with ${name} not having a proto");
+                """,
+                name = self.descriptor.name)
+            protoWrapFail = fill(
+                """
+                MOZ_CRASH("Looks like bug 1488480/1405521, with ${name} failing to wrap a custom proto");
+                """,
+                name = self.descriptor.name)
+            createObjectFailed = fill(
+                """
+                MOZ_CRASH("Looks like bug 1488480/1405521, with ${name} failing to CreateObject/CreateProxyObject");
+                """,
+                name = self.descriptor.name)
+            expandoAllocFail = fill(
+                """
+                MOZ_CRASH("Looks like bug 1488480/1405521, with ${name} failing to EnsureExpandoObject or JS_InitializePropertiesFromCompatibleNativeObject");
+                """,
+                name = self.descriptor.name)
+        else:
+            noGlobal = ""
+            noProto = ""
+            protoWrapFail = ""
+            createObjectFailed = ""
+            expandoAllocFail = ""
+
         return fill(
             """
             static_assert(!IsBaseOf<NonRefcountedDOMObject, ${nativeType}>::value,
                           "Shouldn't have wrappercached things that are not refcounted.");
             $*{assertInheritance}
             MOZ_ASSERT_IF(aGivenProto, js::IsObjectInContextCompartment(aGivenProto, aCx));
             MOZ_ASSERT(!aCache->GetWrapper(),
                        "You should probably not be using Wrap() directly; use "
                        "GetOrCreateDOMReflector instead");
 
             MOZ_ASSERT(ToSupportsIsOnPrimaryInheritanceChain(aObject, aCache),
                        "nsISupports must be on our primary inheritance chain");
 
             JS::Rooted<JSObject*> global(aCx, FindAssociatedGlobal(aCx, aObject->GetParentObject()));
             if (!global) {
+              $*{noGlobal}
               return false;
             }
             MOZ_ASSERT(JS_IsGlobalObject(global));
             MOZ_ASSERT(JS::ObjectIsNotGray(global));
 
             // That might have ended up wrapping us already, due to the wonders
             // of XBL.  Check for that, and bail out as needed.
             aReflector.set(aCache->GetWrapper());
@@ -3797,21 +3845,24 @@ class CGWrapWithCacheMethod(CGAbstractMe
             // somewhat common) to have a non-null aGivenProto which is the
             // same as canonicalProto.
             if (proto != canonicalProto) {
               PreserveWrapper(aObject);
             }
 
             return true;
             """,
+            noGlobal=noGlobal,
             nativeType=self.descriptor.nativeType,
             assertInheritance=AssertInheritanceChain(self.descriptor),
-            declareProto=DeclareProto(),
-            createObject=CreateBindingJSObject(self.descriptor, self.properties),
+            declareProto=DeclareProto(noProto, protoWrapFail),
+            createObject=CreateBindingJSObject(self.descriptor, self.properties,
+                                               createObjectFailed),
             unforgeable=CopyUnforgeablePropertiesToInstance(self.descriptor,
+                                                            expandoAllocFail +
                                                             failureCode),
             slots=InitMemberSlots(self.descriptor, failureCode),
             setImmutablePrototype=SetImmutablePrototype(self.descriptor,
                                                         failureCode))
 
 
 class CGWrapMethod(CGAbstractMethod):
     def __init__(self, descriptor):
@@ -4017,39 +4068,29 @@ class CGClearCachedValueMethod(CGAbstrac
         if self.member.getExtendedAttribute("StoreInSlot"):
             # We have to root things and save the old value in case
             # regetting fails, so we can restore it.
             declObj = "JS::Rooted<JSObject*> obj(aCx);\n"
             noopRetval = " true"
             saveMember = (
                 "JS::Rooted<JS::Value> oldValue(aCx, js::GetReservedSlot(obj, %s));\n" %
                 slotIndex)
-            if self.descriptor.name == "Document" or self.descriptor.name == "Location":
-                maybeCrash = dedent(
-                    """
-                    MOZ_CRASH("Looks like bug 1488480/1405521, with the getter failing");
-                    """)
-            else:
-                maybeCrash = ""
-
             regetMember = fill(
                 """
                 JS::Rooted<JS::Value> temp(aCx);
                 JSJitGetterCallArgs args(&temp);
                 JSAutoRealm ar(aCx, obj);
                 if (!get_${name}(aCx, obj, aObject, args)) {
                   js::SetReservedSlot(obj, ${slotIndex}, oldValue);
-                  $*{maybeCrash}
                   return false;
                 }
                 return true;
                 """,
                 name=self.member.identifier.name,
-                slotIndex=slotIndex,
-                maybeCrash=maybeCrash)
+                slotIndex=slotIndex)
         else:
             declObj = "JSObject* obj;\n"
             noopRetval = ""
             saveMember = ""
             regetMember = ""
 
         if self.descriptor.wantsXrays:
             clearXrayExpandoSlots = fill(
@@ -6693,21 +6734,16 @@ def getWrapTemplateForType(type, descrip
                 wrapArgs = "cx, ${obj}, %s, ${jsvalHandle}" % result
             if isConstructorRetval:
                 wrapArgs += ", desiredProto"
             wrap = "%s(%s)" % (wrapMethod, wrapArgs)
             # Can only fail to wrap as a new-binding object if they already
             # threw an exception.
             failed = ("MOZ_ASSERT(JS_IsExceptionPending(cx));\n" +
                       exceptionCode)
-
-            if descriptor.name == "Document" or descriptor.name == "Location":
-                failed = (
-                    'MOZ_CRASH("Looks like bug 1488480/1405521, with getting the reflector failing");\n' +
-                    failed)
         else:
             if descriptor.notflattened:
                 getIID = "&NS_GET_IID(%s), " % descriptor.nativeType
             else:
                 getIID = ""
             wrap = "WrapObject(cx, %s, %s${jsvalHandle})" % (result, getIID)
             failed = None
 
@@ -7853,38 +7889,28 @@ class CGPerSignatureCall(CGThing):
                     "if (!JS_FreezeObject(cx, rvalObj)) {\n"
                     "  return false;\n"
                     "}\n")
                 if self.idlNode.type.nullable():
                     freezeValue = CGIfWrapper(freezeValue,
                                               "args.rval().isObject()")
                 postConversionSteps += freezeValue.define()
 
-            if self.descriptor.name == "Window":
-                maybeCrash = dedent(
-                    """
-                    MOZ_CRASH("Looks like bug 1488480/1405521, with the other MaybeWrap failing");
-                    """)
-            else:
-                maybeCrash = ""
-
             # slotStorageSteps are steps that run once we have entered the
             # slotStorage compartment.
             slotStorageSteps= fill(
                 """
                 // Make a copy so that we don't do unnecessary wrapping on args.rval().
                 JS::Rooted<JS::Value> storedVal(cx, args.rval());
                 if (!${maybeWrap}(cx, &storedVal)) {
-                  $*{maybeCrash}
                   return false;
                 }
                 js::SetReservedSlot(slotStorage, slotIndex, storedVal);
                 """,
-                maybeWrap=getMaybeWrapValueFuncForType(self.idlNode.type),
-                maybeCrash=maybeCrash)
+                maybeWrap=getMaybeWrapValueFuncForType(self.idlNode.type))
 
             checkForXray = mayUseXrayExpandoSlots(self.descriptor, self.idlNode)
 
             # For the case of Cached attributes, go ahead and preserve our
             # wrapper if needed.  We need to do this because otherwise the
             # wrapper could get garbage-collected and the cached value would
             # suddenly disappear, but the whole premise of cached values is that
             # they never change without explicit action on someone's part.  We
@@ -7912,51 +7938,38 @@ class CGPerSignatureCall(CGThing):
             if checkForXray:
                 # In the Xray case we use the current global as conversion
                 # scope, as explained in the big compartment/conversion comment
                 # above.
                 conversionScope = "isXray ? JS::CurrentGlobalOrNull(cx) : slotStorage"
             else:
                 conversionScope = "slotStorage"
 
-            if self.descriptor.name == "Window":
-                maybeCrash = dedent(
-                    """
-                    MOZ_CRASH("Looks like bug 1488480/1405521, with the third MaybeWrap failing");
-                    """)
-            else:
-                maybeCrash = ""
-
             wrapCode = fill(
                 """
                 {
                   JS::Rooted<JSObject*> conversionScope(cx, ${conversionScope});
                   JSAutoRealm ar(cx, conversionScope);
                   do { // block we break out of when done wrapping
                     $*{wrapCode}
                   } while (false);
                   $*{postConversionSteps}
                 }
                 { // And now store things in the realm of our slotStorage.
                   JSAutoRealm ar(cx, slotStorage);
                   $*{slotStorageSteps}
                 }
                 // And now make sure args.rval() is in the caller realm.
-                if (${maybeWrap}(cx, args.rval())) {
-                  return true;
-                }
-                $*{maybeCrash}
-                return false;
+                return ${maybeWrap}(cx, args.rval());
                 """,
                 conversionScope=conversionScope,
                 wrapCode=wrapCode,
                 postConversionSteps=postConversionSteps,
                 slotStorageSteps=slotStorageSteps,
-                maybeWrap=getMaybeWrapValueFuncForType(self.idlNode.type),
-                maybeCrash=maybeCrash)
+                maybeWrap=getMaybeWrapValueFuncForType(self.idlNode.type))
         return wrapCode
 
     def define(self):
         return (self.cgRoot.define() + self.wrap_return_value())
 
 
 class CGSwitch(CGList):
     """
@@ -8978,45 +8991,32 @@ class CGSpecializedGetter(CGAbstractStat
                     """
                     // Have to either root across the getter call or reget after.
                     JS::Rooted<JSObject*> slotStorage(cx, js::UncheckedUnwrap(obj, /* stopAtWindowProxy = */ false));
                     MOZ_ASSERT(IsDOMObject(slotStorage));
                     const size_t slotIndex = ${slotIndex};
                     """,
                     slotIndex=memberReservedSlot(self.attr, self.descriptor))
 
-            if self.descriptor.name == "Window":
-                maybeCrash = dedent(
-                    """
-                    MOZ_CRASH("Looks like bug 1488480/1405521, with cached value wrapping failing");
-                    """)
-            else:
-                maybeCrash = ""
-                
             prefix += fill(
                 """
                 MOZ_ASSERT(JSCLASS_RESERVED_SLOTS(js::GetObjectClass(slotStorage)) > slotIndex);
                 {
                   // Scope for cachedVal
                   JS::Value cachedVal = js::GetReservedSlot(slotStorage, slotIndex);
                   if (!cachedVal.isUndefined()) {
                     args.rval().set(cachedVal);
                     // The cached value is in the compartment of slotStorage,
                     // so wrap into the caller compartment as needed.
-                    if (${maybeWrap}(cx, args.rval())) {
-                      return true;
-                    }
-                    $*{maybeCrash}
-                    return false;
+                    return ${maybeWrap}(cx, args.rval());
                   }
                 }
 
                 """,
-                maybeWrap=getMaybeWrapValueFuncForType(self.attr.type),
-                maybeCrash=maybeCrash)
+                maybeWrap=getMaybeWrapValueFuncForType(self.attr.type))
         else:
             prefix = ""
 
         if self.attr.navigatorObjectGetter:
             cgGetterCall = CGNavigatorGetterCall
         else:
             cgGetterCall = CGGetterCall
         return (prefix +

--- a/dom/html/ImageDocument.cpp
+++ b/dom/html/ImageDocument.cpp
@@ -195,17 +195,21 @@ ImageDocument::Init()
   mFirstResize = true;
 
   return NS_OK;
 }
 
 JSObject*
 ImageDocument::WrapNode(JSContext* aCx, JS::Handle<JSObject*> aGivenProto)
 {
-  return ImageDocument_Binding::Wrap(aCx, this, aGivenProto);
+  JSObject* obj = ImageDocument_Binding::Wrap(aCx, this, aGivenProto);
+  if (!obj) {
+      MOZ_CRASH("Looks like bug 1488480/1405521, with ImageDocument::WrapNode failing");
+  }
+  return obj;
 }
 
 nsresult
 ImageDocument::StartDocumentLoad(const char*         aCommand,
                                  nsIChannel*         aChannel,
                                  nsILoadGroup*       aLoadGroup,
                                  nsISupports*        aContainer,
                                  nsIStreamListener** aDocListener,

--- a/dom/html/nsHTMLDocument.cpp
+++ b/dom/html/nsHTMLDocument.cpp
@@ -197,17 +197,21 @@ NS_IMPL_CYCLE_COLLECTION_INHERITED(nsHTM
 
 NS_IMPL_ISUPPORTS_CYCLE_COLLECTION_INHERITED(nsHTMLDocument,
                                              nsDocument,
                                              nsIHTMLDocument)
 
 JSObject*
 nsHTMLDocument::WrapNode(JSContext* aCx, JS::Handle<JSObject*> aGivenProto)
 {
-  return HTMLDocument_Binding::Wrap(aCx, this, aGivenProto);
+  JSObject* obj = HTMLDocument_Binding::Wrap(aCx, this, aGivenProto);
+  if (!obj) {
+      MOZ_CRASH("Looks like bug 1488480/1405521, with nsHTMLDocument::WrapNode failing");
+  }
+  return obj;
 }
 
 nsresult
 nsHTMLDocument::Init()
 {
   nsresult rv = nsDocument::Init();
   NS_ENSURE_SUCCESS(rv, rv);
 

--- a/dom/indexedDB/KeyPath.cpp
+++ b/dom/indexedDB/KeyPath.cpp
@@ -10,16 +10,17 @@
 #include "ReportInternalError.h"
 
 #include "nsCharSeparatedTokenizer.h"
 #include "nsJSUtils.h"
 #include "nsPrintfCString.h"
 #include "xpcpublic.h"
 
 #include "mozilla/dom/BindingDeclarations.h"
+#include "mozilla/dom/BlobBinding.h"
 #include "mozilla/dom/IDBObjectStoreBinding.h"
 
 namespace mozilla {
 namespace dom {
 namespace indexedDB {
 
 namespace {
 
@@ -96,42 +97,97 @@ GetJSValFromKeyPathString(JSContext* aCx
   while (tokenizer.hasMoreTokens()) {
     const nsDependentSubstring& token = tokenizer.nextToken();
 
     NS_ASSERTION(!token.IsEmpty(), "Should be a valid keypath");
 
     const char16_t* keyPathChars = token.BeginReading();
     const size_t keyPathLen = token.Length();
 
-    bool hasProp;
     if (!targetObject) {
       // We're still walking the chain of existing objects
       // http://w3c.github.io/IndexedDB/#evaluate-a-key-path-on-a-value
       // step 4 substep 1: check for .length on a String value.
       if (currentVal.isString() && !tokenizer.hasMoreTokens() &&
           token.EqualsLiteral("length")) {
         aKeyJSVal->setNumber(double(JS_GetStringLength(currentVal.toString())));
         break;
       }
 
       if (!currentVal.isObject()) {
         return NS_ERROR_DOM_INDEXEDDB_DATA_ERR;
       }
       obj = &currentVal.toObject();
 
-      bool ok = JS_HasUCProperty(aCx, obj, keyPathChars, keyPathLen,
-                                 &hasProp);
+      // We call JS_GetOwnUCPropertyDescriptor on purpose (as opposed to
+      // JS_GetUCPropertyDescriptor) to avoid searching the prototype chain.
+      JS::Rooted<JS::PropertyDescriptor> desc(aCx);
+      bool ok = JS_GetOwnUCPropertyDescriptor(aCx, obj, keyPathChars,
+                                              keyPathLen, &desc);
       IDB_ENSURE_TRUE(ok, NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR);
 
+      JS::Rooted<JS::Value> intermediate(aCx);
+      bool hasProp = false;
+
+      if (desc.object()) {
+        intermediate = desc.value();
+        hasProp = true;
+      } else {
+        // If we get here it means the object doesn't have the property or the
+        // property is available throuch a getter. We don't want to call any
+        // getters to avoid potential re-entrancy.
+        // The blob object is special since its properties are available
+        // only through getters but we still want to support them for key
+        // extraction. So they need to be handled manually.
+        Blob* blob;
+        if (NS_SUCCEEDED(UNWRAP_OBJECT(Blob, &obj, blob))) {
+          if (token.EqualsLiteral("size")) {
+            ErrorResult rv;
+            uint64_t size = blob->GetSize(rv);
+            MOZ_ALWAYS_TRUE(!rv.Failed());
+
+            intermediate = JS_NumberValue(size);
+            hasProp = true;
+          } else if (token.EqualsLiteral("type")) {
+            nsString type;
+            blob->GetType(type);
+
+            JSString* string =
+              JS_NewUCStringCopyN(aCx, type.get(), type.Length());
+
+            intermediate = JS::StringValue(string);
+            hasProp = true;
+          } else {
+            RefPtr<File> file = blob->ToFile();
+            if (file) {
+              if (token.EqualsLiteral("name")) {
+                nsString name;
+                file->GetName(name);
+
+                JSString* string =
+                  JS_NewUCStringCopyN(aCx, name.get(), name.Length());
+
+                intermediate = JS::StringValue(string);
+                hasProp = true;
+              } else if (token.EqualsLiteral("lastModified")) {
+                ErrorResult rv;
+                int64_t lastModifiedDate = file->GetLastModified(rv);
+                MOZ_ALWAYS_TRUE(!rv.Failed());
+
+                intermediate = JS_NumberValue(lastModifiedDate);
+                hasProp = true;
+              }
+              // The spec also lists "lastModifiedDate", but we deprecated and
+              // removed support for it.
+            }
+          }
+        }
+      }
+
       if (hasProp) {
-        // Get if the property exists...
-        JS::Rooted<JS::Value> intermediate(aCx);
-        bool ok = JS_GetUCProperty(aCx, obj, keyPathChars, keyPathLen, &intermediate);
-        IDB_ENSURE_TRUE(ok, NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR);
-
         // Treat explicitly undefined as an error.
         if (intermediate.isUndefined()) {
           return NS_ERROR_DOM_INDEXEDDB_DATA_ERR;
         }
         if (tokenizer.hasMoreTokens()) {
           // ...and walk to it if there are more steps...
           currentVal = intermediate;
         }

--- a/dom/xbl/nsXBLBinding.cpp
+++ b/dom/xbl/nsXBLBinding.cpp
@@ -979,17 +979,18 @@ nsXBLBinding::DoInitJSClass(JSContext *c
   js::AssertSameCompartment(holder, xblScope);
   JSAutoRealm ar(cx, holder);
 
   // Look up the class on the property holder. The only properties on the
   // holder should be class objects. If we don't find the class object, we need
   // to create and define it.
   JS::Rooted<JSObject*> proto(cx);
   JS::Rooted<JS::PropertyDescriptor> desc(cx);
-  if (!JS_GetOwnUCPropertyDescriptor(cx, holder, aClassName.get(), &desc)) {
+  if (!JS_GetOwnUCPropertyDescriptor(cx, holder, aClassName.get(),
+                                     aClassName.Length(), &desc)) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
   *aNew = !desc.object();
   if (desc.object()) {
     proto = &desc.value().toObject();
     DebugOnly<nsXBLPrototypeBinding*> cachedBinding =
       GetProtoBindingFromClassObject(js::UncheckedUnwrap(proto));
     MOZ_ASSERT(cachedBinding == aProtoBinding);

--- a/dom/xbl/nsXBLProtoImpl.cpp
+++ b/dom/xbl/nsXBLProtoImpl.cpp
@@ -91,37 +91,42 @@ nsXBLProtoImpl::InstallImplementation(ns
   //
   // Note: If |targetIsNew| is false, we'll early-return above. However, that only
   // tells us if the content-side object is new, which may be the case even if
   // we've already set up the binding on the XBL side. For example, if we apply
   // a binding #foo to a <span> when we've already applied it to a <div>, we'll
   // end up with a different content prototype, but we'll already have a property
   // holder called |foo| in the XBL scope. Check for that to avoid wasteful and
   // weird property holder duplication.
-  const char16_t* className = aPrototypeBinding->ClassName().get();
+  const nsString& className = aPrototypeBinding->ClassName();
+  const char16_t* classNameChars = className.get();
+  const size_t classNameLen = className.Length();
+
   JS::Rooted<JSObject*> propertyHolder(cx);
   JS::Rooted<JS::PropertyDescriptor> existingHolder(cx);
   if (scopeObject != globalObject &&
-      !JS_GetOwnUCPropertyDescriptor(cx, scopeObject, className, &existingHolder)) {
+      !JS_GetOwnUCPropertyDescriptor(cx, scopeObject, classNameChars,
+                                     classNameLen, &existingHolder)) {
     return NS_ERROR_FAILURE;
   }
   bool propertyHolderIsNew = !existingHolder.object() || !existingHolder.value().isObject();
 
   if (!propertyHolderIsNew) {
     propertyHolder = &existingHolder.value().toObject();
   } else if (scopeObject != globalObject) {
 
     // This is just a property holder, so it doesn't need any special JSClass.
     propertyHolder = JS_NewObjectWithGivenProto(cx, nullptr, nullptr);
     NS_ENSURE_TRUE(propertyHolder, NS_ERROR_OUT_OF_MEMORY);
 
     // Define it as a property on the scopeObject, using the same name used on
     // the content side.
-    bool ok = JS_DefineUCProperty(cx, scopeObject, className, -1, propertyHolder,
-                                  JSPROP_PERMANENT | JSPROP_READONLY);
+    bool ok =
+      JS_DefineUCProperty(cx, scopeObject, classNameChars, classNameLen,
+                          propertyHolder, JSPROP_PERMANENT | JSPROP_READONLY);
     NS_ENSURE_TRUE(ok, NS_ERROR_UNEXPECTED);
   } else {
     propertyHolder = targetClassObject;
   }
 
   // Walk our member list and install each one in turn on the XBL scope object.
   if (propertyHolderIsNew) {
     for (nsXBLProtoImplMember* curr = mMembers;

--- a/dom/xml/XMLDocument.cpp
+++ b/dom/xml/XMLDocument.cpp
@@ -622,17 +622,22 @@ XMLDocument::Clone(dom::NodeInfo* aNodeI
   clone->mIsPlainDocument = mIsPlainDocument;
 
   return CallQueryInterface(clone.get(), aResult);
 }
 
 JSObject*
 XMLDocument::WrapNode(JSContext *aCx, JS::Handle<JSObject*> aGivenProto)
 {
+  JSObject* obj;
   if (mIsPlainDocument) {
-    return Document_Binding::Wrap(aCx, this, aGivenProto);
+    obj = Document_Binding::Wrap(aCx, this, aGivenProto);
+  } else {
+    obj = XMLDocument_Binding::Wrap(aCx, this, aGivenProto);
   }
-
-  return XMLDocument_Binding::Wrap(aCx, this, aGivenProto);
+  if (!obj) {
+      MOZ_CRASH("Looks like bug 1488480/1405521, with XMLDocument::WrapNode failing");
+  }
+  return obj;
 }
 
 } // namespace dom
 } // namespace mozilla

--- a/dom/xul/XULDocument.cpp
+++ b/dom/xul/XULDocument.cpp
@@ -2501,13 +2501,17 @@ XULDocument::DirectionChanged(const char
   if (aDoc) {
       aDoc->ResetDocumentDirection();
   }
 }
 
 JSObject*
 XULDocument::WrapNode(JSContext *aCx, JS::Handle<JSObject*> aGivenProto)
 {
-  return XULDocument_Binding::Wrap(aCx, this, aGivenProto);
+  JSObject* obj = XULDocument_Binding::Wrap(aCx, this, aGivenProto);
+  if (!obj) {
+      MOZ_CRASH("Looks like bug 1488480/1405521, with XULDocument_Binding::Wrap failing");
+  }
+  return obj;
 }
 
 } // namespace dom
 } // namespace mozilla

--- a/gfx/2d/2D.h
+++ b/gfx/2d/2D.h
@@ -415,17 +415,17 @@ public:
    */
   virtual void *GetNativeSurface(NativeSurfaceType aType) {
     return nullptr;
   }
 
   void AddUserData(UserDataKey *key, void *userData, void (*destroy)(void*)) {
     mUserData.Add(key, userData, destroy);
   }
-  void *GetUserData(UserDataKey *key) {
+  void *GetUserData(UserDataKey *key) const {
     return mUserData.Get(key);
   }
   void RemoveUserData(UserDataKey *key) {
     mUserData.RemoveAndDestroy(key);
   }
 
 protected:
   friend class DrawTargetCaptureImpl;
@@ -582,17 +582,18 @@ public:
   virtual already_AddRefed<DataSourceSurface> GetDataSurface() override;
 
   /**
    * Add the size of the underlying data buffer to the aggregate.
    */
   virtual void AddSizeOfExcludingThis(MallocSizeOf aMallocSizeOf,
                                       size_t& aHeapSizeOut,
                                       size_t& aNonHeapSizeOut,
-                                      size_t& aExtHandlesOut) const
+                                      size_t& aExtHandlesOut,
+                                      uint64_t& aExtIdOut) const
   {
   }
 
   /**
    * Returns whether or not the data was allocated on the heap. This should
    * be used to determine if the memory needs to be cleared to 0.
    */
   virtual bool OnHeap() const

--- a/gfx/2d/SourceSurfaceRawData.cpp
+++ b/gfx/2d/SourceSurfaceRawData.cpp
@@ -78,15 +78,16 @@ SourceSurfaceAlignedRawData::Init(const 
 
   return mArray != nullptr;
 }
 
 void
 SourceSurfaceAlignedRawData::AddSizeOfExcludingThis(MallocSizeOf aMallocSizeOf,
                                                     size_t& aHeapSizeOut,
                                                     size_t& aNonHeapSizeOut,
-                                                    size_t& aExtHandlesOut) const
+                                                    size_t& aExtHandlesOut,
+                                                    uint64_t& aExtIdOut) const
 {
   aHeapSizeOut += mArray.HeapSizeOfExcludingThis(aMallocSizeOf);
 }
 
 } // namespace gfx
 } // namespace mozilla

--- a/gfx/2d/SourceSurfaceRawData.h
+++ b/gfx/2d/SourceSurfaceRawData.h
@@ -126,17 +126,18 @@ public:
 
   virtual SurfaceType GetType() const override { return SurfaceType::DATA; }
   virtual IntSize GetSize() const override { return mSize; }
   virtual SurfaceFormat GetFormat() const override { return mFormat; }
 
   void AddSizeOfExcludingThis(MallocSizeOf aMallocSizeOf,
                               size_t& aHeapSizeOut,
                               size_t& aNonHeapSizeOut,
-                              size_t& aExtHandlesOut) const override;
+                              size_t& aExtHandlesOut,
+                              uint64_t& aExtIdOut) const override;
 
   virtual bool Map(MapType, MappedSurface *aMappedSurface) override
   {
     aMappedSurface->mData = GetData();
     aMappedSurface->mStride = Stride();
     bool success = !!aMappedSurface->mData;
     if (success) {
       mMapCount++;

--- a/gfx/ipc/GPUParent.cpp
+++ b/gfx/ipc/GPUParent.cpp
@@ -17,16 +17,17 @@
 #include "mozilla/Assertions.h"
 #include "mozilla/Telemetry.h"
 #include "mozilla/TimeStamp.h"
 #include "mozilla/dom/MemoryReportRequest.h"
 #include "mozilla/dom/VideoDecoderManagerChild.h"
 #include "mozilla/dom/VideoDecoderManagerParent.h"
 #include "mozilla/gfx/2D.h"
 #include "mozilla/gfx/gfxVars.h"
+#include "mozilla/image/ImageMemoryReporter.h"
 #include "mozilla/ipc/CrashReporterClient.h"
 #include "mozilla/ipc/ProcessChild.h"
 #include "mozilla/layers/APZInputBridgeParent.h"
 #include "mozilla/layers/APZThreadUtils.h"
 #include "mozilla/layers/APZUtils.h"    // for apz::InitializeGlobalState
 #include "mozilla/layers/CompositorBridgeParent.h"
 #include "mozilla/layers/CompositorManagerParent.h"
 #include "mozilla/layers/CompositorThread.h"
@@ -263,16 +264,17 @@ GPUParent::RecvInit(nsTArray<GfxPrefSett
     MOZ_ASSERT(library);
     Factory::SetFTLibrary(library);
   }
 #endif
 
   // Make sure to do this *after* we update gfxVars above.
   if (gfxVars::UseWebRender()) {
     wr::RenderThread::Start();
+    image::ImageMemoryReporter::InitForWebRender();
   }
 
   VRManager::ManagerInit();
   // Send a message to the UI process that we're done.
   GPUDeviceData data;
   RecvGetDeviceStatus(&data);
   Unused << SendInitComplete(data);
 
@@ -533,16 +535,18 @@ GPUParent::ActorDestroy(ActorDestroyReas
   CompositorThreadHolder::Shutdown();
   VRListenerThreadHolder::Shutdown();
   // There is a case that RenderThread exists when gfxVars::UseWebRender() is false.
   // This could happen when WebRender was fallbacked to compositor.
   if (wr::RenderThread::Get()) {
     wr::RenderThread::ShutDown();
   }
 
+  image::ImageMemoryReporter::ShutdownForWebRender();
+
   // Shut down the default GL context provider.
   gl::GLContextProvider::Shutdown();
 
 #if defined(XP_WIN)
   // The above shutdown calls operate on the available context providers on
   // most platforms.  Windows is a "special snowflake", though, and has three
   // context providers available, so we have to shut all of them down.
   // We should only support the default GL provider on Windows; then, this

--- a/gfx/layers/SourceSurfaceSharedData.cpp
+++ b/gfx/layers/SourceSurfaceSharedData.cpp
@@ -92,25 +92,30 @@ SourceSurfaceSharedData::GuaranteePersis
 {
   // Shared memory is not unmapped until we release SourceSurfaceSharedData.
 }
 
 void
 SourceSurfaceSharedData::AddSizeOfExcludingThis(MallocSizeOf aMallocSizeOf,
                                                 size_t& aHeapSizeOut,
                                                 size_t& aNonHeapSizeOut,
-                                                size_t& aExtHandlesOut) const
+                                                size_t& aExtHandlesOut,
+                                                uint64_t& aExtIdOut) const
 {
   MutexAutoLock lock(mMutex);
   if (mBuf) {
     aNonHeapSizeOut += GetAlignedDataLength();
   }
   if (!mClosed) {
     ++aExtHandlesOut;
   }
+  Maybe<wr::ExternalImageId> extId = SharedSurfacesChild::GetExternalId(this);
+  if (extId) {
+    aExtIdOut = wr::AsUint64(extId.ref());
+  }
 }
 
 uint8_t*
 SourceSurfaceSharedData::GetDataInternal() const
 {
   mMutex.AssertCurrentThreadOwns();
 
   // If we have an old buffer lingering, it is because we get reallocated to

--- a/gfx/layers/SourceSurfaceSharedData.h
+++ b/gfx/layers/SourceSurfaceSharedData.h
@@ -38,16 +38,17 @@ class SourceSurfaceSharedDataWrapper fin
 public:
   MOZ_DECLARE_REFCOUNTED_VIRTUAL_TYPENAME(SourceSurfaceSharedDataWrapper, override)
 
   SourceSurfaceSharedDataWrapper()
     : mStride(0)
     , mConsumers(0)
     , mFormat(SurfaceFormat::UNKNOWN)
     , mCreatorPid(0)
+    , mCreatorRef(true)
   { }
 
   bool Init(const IntSize& aSize,
             int32_t aStride,
             SurfaceFormat aFormat,
             const SharedMemoryBasic::Handle& aHandle,
             base::ProcessId aCreatorPid);
 
@@ -74,22 +75,40 @@ public:
     return false;
   }
 
   bool AddConsumer()
   {
     return ++mConsumers == 1;
   }
 
-  bool RemoveConsumer()
+  bool RemoveConsumer(bool aForCreator)
   {
     MOZ_ASSERT(mConsumers > 0);
+    if (aForCreator) {
+      if (!mCreatorRef) {
+        MOZ_ASSERT_UNREACHABLE("Already released creator reference!");
+        return false;
+      }
+      mCreatorRef = false;
+    }
     return --mConsumers == 0;
   }
 
+  uint32_t GetConsumers() const
+  {
+    MOZ_ASSERT(mConsumers > 0);
+    return mConsumers;
+  }
+
+  bool HasCreatorRef() const
+  {
+    return mCreatorRef;
+  }
+
 private:
   size_t GetDataLength() const
   {
     return static_cast<size_t>(mStride) * mSize.height;
   }
 
   size_t GetAlignedDataLength() const
   {
@@ -97,16 +116,17 @@ private:
   }
 
   int32_t mStride;
   uint32_t mConsumers;
   IntSize mSize;
   RefPtr<SharedMemoryBasic> mBuf;
   SurfaceFormat mFormat;
   base::ProcessId mCreatorPid;
+  bool mCreatorRef;
 };
 
 /**
  * This class is used to wrap shared (as in process) data buffers used by a
  * source surface.
  */
 class SourceSurfaceSharedData final : public DataSourceSurface
 {
@@ -150,17 +170,18 @@ public:
   IntSize GetSize() const override { return mSize; }
   SurfaceFormat GetFormat() const override { return mFormat; }
 
   void GuaranteePersistance() override;
 
   void AddSizeOfExcludingThis(MallocSizeOf aMallocSizeOf,
                               size_t& aHeapSizeOut,
                               size_t& aNonHeapSizeOut,
-                              size_t& aExtHandlesOut) const override;
+                              size_t& aExtHandlesOut,
+                              uint64_t& aExtIdOut) const override;
 
   bool OnHeap() const override
   {
     return false;
   }
 
   /**
    * Although Map (and Moz2D in general) isn't normally threadsafe,

--- a/gfx/layers/SourceSurfaceVolatileData.cpp
+++ b/gfx/layers/SourceSurfaceVolatileData.cpp
@@ -37,17 +37,18 @@ SourceSurfaceVolatileData::GuaranteePers
 {
   MOZ_ASSERT_UNREACHABLE("Should use SourceSurfaceRawData wrapper!");
 }
 
 void
 SourceSurfaceVolatileData::AddSizeOfExcludingThis(MallocSizeOf aMallocSizeOf,
                                                   size_t& aHeapSizeOut,
                                                   size_t& aNonHeapSizeOut,
-                                                  size_t& aExtHandlesOut) const
+                                                  size_t& aExtHandlesOut,
+                                                  uint64_t& aExtIdOut) const
 {
   if (mVBuf) {
     aHeapSizeOut += mVBuf->HeapSizeOfExcludingThis(aMallocSizeOf);
     aNonHeapSizeOut += mVBuf->NonHeapSizeOfExcludingThis();
 #ifdef ANDROID
     if (!mVBuf->OnHeap()) {
       // Volatile buffers keep a file handle open on Android.
       ++aExtHandlesOut;

--- a/gfx/layers/SourceSurfaceVolatileData.h
+++ b/gfx/layers/SourceSurfaceVolatileData.h
@@ -48,17 +48,18 @@ public:
   IntSize GetSize() const override { return mSize; }
   SurfaceFormat GetFormat() const override { return mFormat; }
 
   void GuaranteePersistance() override;
 
   void AddSizeOfExcludingThis(MallocSizeOf aMallocSizeOf,
                               size_t& aHeapSizeOut,
                               size_t& aNonHeapSizeOut,
-                              size_t& aExtHandlesOut) const override;
+                              size_t& aExtHandlesOut,
+                              uint64_t& aExtIdOut) const override;
 
   bool OnHeap() const override
   {
     return mVBuf->OnHeap();
   }
 
   // Althought Map (and Moz2D in general) isn't normally threadsafe,
   // we want to allow it for SourceSurfaceVolatileData since it should

--- a/gfx/layers/ipc/CompositorManagerParent.cpp
+++ b/gfx/layers/ipc/CompositorManagerParent.cpp
@@ -285,16 +285,25 @@ CompositorManagerParent::RecvAddSharedSu
 mozilla::ipc::IPCResult
 CompositorManagerParent::RecvRemoveSharedSurface(const wr::ExternalImageId& aId)
 {
   SharedSurfacesParent::Remove(aId);
   return IPC_OK();
 }
 
 mozilla::ipc::IPCResult
+CompositorManagerParent::RecvReportSharedSurfacesMemory(ReportSharedSurfacesMemoryResolver&& aResolver)
+{
+  SharedSurfacesMemoryReport report;
+  SharedSurfacesParent::AccumulateMemoryReport(OtherPid(), report);
+  aResolver(std::move(report));
+  return IPC_OK();
+}
+
+mozilla::ipc::IPCResult
 CompositorManagerParent::RecvNotifyMemoryPressure()
 {
   nsTArray<PCompositorBridgeParent*> compositorBridges;
   ManagedPCompositorBridgeParent(compositorBridges);
   for (auto bridge : compositorBridges) {
     static_cast<CompositorBridgeParentBase*>(bridge)->NotifyMemoryPressure();
   }
   return IPC_OK();

--- a/gfx/layers/ipc/CompositorManagerParent.h
+++ b/gfx/layers/ipc/CompositorManagerParent.h
@@ -38,16 +38,17 @@ public:
   CreateSameProcessWidgetCompositorBridge(CSSToLayoutDeviceScale aScale,
                                           const CompositorOptions& aOptions,
                                           bool aUseExternalSurfaceSize,
                                           const gfx::IntSize& aSurfaceSize);
 
   mozilla::ipc::IPCResult RecvAddSharedSurface(const wr::ExternalImageId& aId,
                                                const SurfaceDescriptorShared& aDesc) override;
   mozilla::ipc::IPCResult RecvRemoveSharedSurface(const wr::ExternalImageId& aId) override;
+  mozilla::ipc::IPCResult RecvReportSharedSurfacesMemory(ReportSharedSurfacesMemoryResolver&&) override;
 
   virtual mozilla::ipc::IPCResult RecvNotifyMemoryPressure() override;
 
   virtual mozilla::ipc::IPCResult RecvReportMemory(ReportMemoryResolver&&) override;
 
   void BindComplete();
   void ActorDestroy(ActorDestroyReason aReason) override;
 

--- a/gfx/layers/ipc/PCompositorManager.ipdl
+++ b/gfx/layers/ipc/PCompositorManager.ipdl
@@ -13,16 +13,17 @@ include "mozilla/layers/WebRenderMessage
 using struct mozilla::void_t from "ipc/IPCMessageUtils.h";
 using mozilla::TimeDuration from "mozilla/TimeStamp.h";
 using mozilla::CSSToLayoutDeviceScale from "Units.h";
 using mozilla::gfx::IntSize from "mozilla/gfx/2D.h";
 using mozilla::ipc::SharedMemoryBasic::Handle from "mozilla/ipc/SharedMemoryBasic.h";
 using mozilla::layers::CompositorOptions from "mozilla/layers/CompositorOptions.h";
 using mozilla::wr::ExternalImageId from "mozilla/webrender/WebRenderTypes.h";
 using mozilla::wr::MemoryReport from "mozilla/webrender/WebRenderTypes.h";
+using mozilla::layers::SharedSurfacesMemoryReport from "mozilla/layers/SharedSurfacesMemoryReport.h";
 
 namespace mozilla {
 namespace layers {
 
 struct WidgetCompositorOptions {
   CSSToLayoutDeviceScale scale;
   TimeDuration vsyncRate;
   CompositorOptions options;
@@ -71,16 +72,17 @@ parent:
    * - A "same process widget" PCompositorBridge is requested by the combined
    *   GPU/UI process for each "top level browser window" as above.
    * See gfx/layers/ipc/PCompositorBridge.ipdl for more details.
    */
   async PCompositorBridge(CompositorBridgeOptions options);
 
   async AddSharedSurface(ExternalImageId aId, SurfaceDescriptorShared aDesc);
   async RemoveSharedSurface(ExternalImageId aId);
+  async ReportSharedSurfacesMemory() returns (SharedSurfacesMemoryReport aReport);
 
   async NotifyMemoryPressure();
 
   async ReportMemory() returns (MemoryReport aReport);
 };
 
 } // layers
 } // mozilla

--- a/gfx/layers/ipc/SharedSurfacesChild.cpp
+++ b/gfx/layers/ipc/SharedSurfacesChild.cpp
@@ -14,16 +14,18 @@
 #include "mozilla/layers/WebRenderLayerManager.h"
 #include "mozilla/SystemGroup.h"        // for SystemGroup
 
 namespace mozilla {
 namespace layers {
 
 using namespace mozilla::gfx;
 
+/* static */ UserDataKey SharedSurfacesChild::sSharedKey;
+
 class SharedSurfacesChild::ImageKeyData final
 {
 public:
   ImageKeyData(WebRenderLayerManager* aManager,
                const wr::ImageKey& aImageKey)
     : mManager(aManager)
     , mImageKey(aImageKey)
   { }
@@ -219,17 +221,16 @@ SharedSurfacesChild::ShareInternal(Sourc
     // We cannot try to share the surface, most likely because the GPU process
     // crashed. Ideally, we would retry when it is ready, but the handles may be
     // a scarce resource, which can cause much more serious problems if we run
     // out. Better to copy into a fresh buffer later.
     aSurface->FinishedSharing();
     return NS_ERROR_NOT_INITIALIZED;
   }
 
-  static UserDataKey sSharedKey;
   SharedUserData* data =
     static_cast<SharedUserData*>(aSurface->GetUserData(&sSharedKey));
   if (!data) {
     data = new SharedUserData(manager->GetNextExternalImageId());
     aSurface->AddUserData(&sSharedKey, data, DestroySharedUserData);
   } else if (!manager->OwnsExternalImageId(data->Id())) {
     // If the id isn't owned by us, that means the bridge was reinitialized, due
     // to the GPU process crashing. All previous mappings have been released.
@@ -450,10 +451,25 @@ SharedSurfacesChild::Unshare(const wr::E
     // Only attempt to release current mappings in the GPU process. It is
     // possible we had a surface that was previously shared, the GPU process
     // crashed / was restarted, and then we freed the surface. In that case
     // we know the mapping has already been freed.
     manager->SendRemoveSharedSurface(aId);
   }
 }
 
+/* static */ Maybe<wr::ExternalImageId>
+SharedSurfacesChild::GetExternalId(const SourceSurfaceSharedData* aSurface)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(aSurface);
+
+  SharedUserData* data =
+    static_cast<SharedUserData*>(aSurface->GetUserData(&sSharedKey));
+  if (!data || !data->IsShared()) {
+    return Nothing();
+  }
+
+  return Some(data->Id());
+}
+
 } // namespace layers
 } // namespace mozilla

--- a/gfx/layers/ipc/SharedSurfacesChild.h
+++ b/gfx/layers/ipc/SharedSurfacesChild.h
@@ -5,18 +5,20 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef MOZILLA_GFX_SHAREDSURFACESCHILD_H
 #define MOZILLA_GFX_SHAREDSURFACESCHILD_H
 
 #include <stddef.h>                     // for size_t
 #include <stdint.h>                     // for uint32_t, uint64_t
 #include "mozilla/Attributes.h"         // for override
+#include "mozilla/Maybe.h"              // for Maybe
 #include "mozilla/RefPtr.h"             // for already_AddRefed
 #include "mozilla/StaticPtr.h"          // for StaticRefPtr
+#include "mozilla/gfx/UserData.h"       // for UserDataKey
 #include "mozilla/webrender/WebRenderTypes.h" // for wr::ImageKey
 
 namespace mozilla {
 namespace gfx {
 class SourceSurfaceSharedData;
 } // namespace gfx
 
 namespace wr {
@@ -66,26 +68,35 @@ public:
    * used to share the image data for this particular container, it will return
    * NS_ERROR_NOT_IMPLEMENTED. This must be called from the main thread.
    */
   static nsresult Share(ImageContainer* aContainer,
                         WebRenderLayerManager* aManager,
                         wr::IpcResourceUpdateQueue& aResources,
                         wr::ImageKey& aKey);
 
+  /**
+   * Get the external ID, if any, bound to the shared surface. Used for memory
+   * reporting purposes.
+   */
+  static Maybe<wr::ExternalImageId>
+  GetExternalId(const gfx::SourceSurfaceSharedData* aSurface);
+
 private:
   SharedSurfacesChild() = delete;
   ~SharedSurfacesChild() = delete;
 
   class ImageKeyData;
   class SharedUserData;
 
   static nsresult ShareInternal(gfx::SourceSurfaceSharedData* aSurface,
                                 SharedUserData** aUserData);
 
   static void Unshare(const wr::ExternalImageId& aId, nsTArray<ImageKeyData>& aKeys);
   static void DestroySharedUserData(void* aClosure);
+
+  static gfx::UserDataKey sSharedKey;
 };
 
 } // namespace layers
 } // namespace mozilla
 
 #endif

new file mode 100644
--- /dev/null
+++ b/gfx/layers/ipc/SharedSurfacesMemoryReport.h
@@ -0,0 +1,93 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef MOZILLA_GFX_SHAREDSURFACESMEMORYREPORT_H
+#define MOZILLA_GFX_SHAREDSURFACESMEMORYREPORT_H
+
+#include <cstdint>                      // for uint32_t
+#include <unordered_map>
+#include "ipc/IPCMessageUtils.h"
+#include "mozilla/gfx/Point.h"          // for IntSize
+
+namespace mozilla {
+namespace layers {
+
+class SharedSurfacesMemoryReport final
+{
+public:
+  class SurfaceEntry final {
+  public:
+    base::ProcessId mCreatorPid;
+    gfx::IntSize mSize;
+    int32_t mStride;
+    uint32_t mConsumers;
+    bool mCreatorRef;
+  };
+
+  std::unordered_map<uint64_t, SurfaceEntry> mSurfaces;
+};
+
+} // namespace layers
+} // namespace mozilla
+
+namespace IPC {
+
+template<>
+struct ParamTraits<mozilla::layers::SharedSurfacesMemoryReport>
+{
+  typedef mozilla::layers::SharedSurfacesMemoryReport paramType;
+
+  static void Write(Message* aMsg, const paramType& aParam) {
+    WriteParam(aMsg, aParam.mSurfaces);
+  }
+
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
+  {
+    return ReadParam(aMsg, aIter, &aResult->mSurfaces);
+  }
+};
+
+template<>
+struct ParamTraits<mozilla::layers::SharedSurfacesMemoryReport::SurfaceEntry>
+  : public PlainOldDataSerializer<mozilla::layers::SharedSurfacesMemoryReport::SurfaceEntry>
+{
+};
+
+template<class KeyType, class DataType>
+struct ParamTraits<std::unordered_map<KeyType, DataType>>
+{
+  typedef std::unordered_map<KeyType, DataType> paramType;
+
+  static void Write(Message* aMsg, const paramType& aParam) {
+    WriteParam(aMsg, aParam.size());
+    for (auto i = aParam.begin(); i != aParam.end(); ++i) {
+      WriteParam(aMsg, i->first);
+      WriteParam(aMsg, i->second);
+    }
+  }
+
+  static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult)
+  {
+    size_t count;
+    if (!ReadParam(aMsg, aIter, &count)) {
+      return false;
+    }
+    for (; count > 0; --count) {
+      KeyType k;
+      DataType v;
+      if (!ReadParam(aMsg, aIter, &k) ||
+          !ReadParam(aMsg, aIter, &v)) {
+        return false;
+      }
+      aResult->insert(std::make_pair(std::move(k), std::move(v)));
+    }
+    return true;
+  }
+};
+
+} // namespace IPC
+
+#endif

--- a/gfx/layers/ipc/SharedSurfacesParent.cpp
+++ b/gfx/layers/ipc/SharedSurfacesParent.cpp
@@ -1,16 +1,18 @@
 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "SharedSurfacesParent.h"
 #include "mozilla/DebugOnly.h"
+#include "mozilla/gfx/GPUProcessManager.h"
+#include "mozilla/layers/SharedSurfacesMemoryReport.h"
 #include "mozilla/layers/SourceSurfaceSharedData.h"
 #include "mozilla/layers/CompositorThread.h"
 #include "mozilla/webrender/RenderSharedSurfaceTextureHost.h"
 #include "mozilla/webrender/RenderThread.h"
 
 namespace mozilla {
 namespace layers {
 
@@ -80,31 +82,31 @@ SharedSurfacesParent::Acquire(const wr::
   if (surface) {
     DebugOnly<bool> rv = surface->AddConsumer();
     MOZ_ASSERT(!rv);
   }
   return surface.forget();
 }
 
 /* static */ bool
-SharedSurfacesParent::Release(const wr::ExternalImageId& aId)
+SharedSurfacesParent::Release(const wr::ExternalImageId& aId, bool aForCreator)
 {
   StaticMutexAutoLock lock(sMutex);
   if (!sInstance) {
     return false;
   }
 
   uint64_t id = wr::AsUint64(aId);
   RefPtr<SourceSurfaceSharedDataWrapper> surface;
   sInstance->mSurfaces.Get(wr::AsUint64(aId), getter_AddRefs(surface));
   if (!surface) {
     return false;
   }
 
-  if (surface->RemoveConsumer()) {
+  if (surface->RemoveConsumer(aForCreator)) {
     wr::RenderThread::Get()->UnregisterExternalImage(id);
     sInstance->mSurfaces.Remove(id);
   }
 
   return true;
 }
 
 /* static */ void
@@ -138,32 +140,34 @@ SharedSurfacesParent::AddSameProcess(con
   sInstance->mSurfaces.Put(id, surface);
 }
 
 /* static */ void
 SharedSurfacesParent::RemoveSameProcess(const wr::ExternalImageId& aId)
 {
   MOZ_ASSERT(XRE_IsParentProcess());
   MOZ_ASSERT(NS_IsMainThread());
-  Release(aId);
+  Release(aId, /* aForCreator */ true);
 }
 
 /* static */ void
 SharedSurfacesParent::DestroyProcess(base::ProcessId aPid)
 {
   StaticMutexAutoLock lock(sMutex);
   if (!sInstance) {
     return;
   }
 
   // Note that the destruction of a parent may not be cheap if it still has a
   // lot of surfaces still bound that require unmapping.
   for (auto i = sInstance->mSurfaces.Iter(); !i.Done(); i.Next()) {
     SourceSurfaceSharedDataWrapper* surface = i.Data();
-    if (surface->GetCreatorPid() == aPid && surface->RemoveConsumer()) {
+    if (surface->GetCreatorPid() == aPid &&
+        surface->HasCreatorRef() &&
+        surface->RemoveConsumer(/* aForCreator */ true)) {
       wr::RenderThread::Get()->UnregisterExternalImage(i.Key());
       i.Remove();
     }
   }
 }
 
 /* static */ void
 SharedSurfacesParent::Add(const wr::ExternalImageId& aId,
@@ -195,14 +199,62 @@ SharedSurfacesParent::Add(const wr::Exte
 
   surface->AddConsumer();
   sInstance->mSurfaces.Put(id, surface.forget());
 }
 
 /* static */ void
 SharedSurfacesParent::Remove(const wr::ExternalImageId& aId)
 {
-  DebugOnly<bool> rv = Release(aId);
+  DebugOnly<bool> rv = Release(aId, /* aForCreator */ true);
   MOZ_ASSERT(rv);
 }
 
+/* static */ void
+SharedSurfacesParent::AccumulateMemoryReport(base::ProcessId aPid,
+                                             SharedSurfacesMemoryReport& aReport)
+{
+  StaticMutexAutoLock lock(sMutex);
+  if (!sInstance) {
+    return;
+  }
+
+  for (auto i = sInstance->mSurfaces.ConstIter(); !i.Done(); i.Next()) {
+    SourceSurfaceSharedDataWrapper* surface = i.Data();
+    if (surface->GetCreatorPid() == aPid) {
+      aReport.mSurfaces.insert(std::make_pair(i.Key(),
+        SharedSurfacesMemoryReport::SurfaceEntry {
+          aPid, surface->GetSize(), surface->Stride(),
+          surface->GetConsumers(), surface->HasCreatorRef() }));
+    }
+  }
+}
+
+/* static */ bool
+SharedSurfacesParent::AccumulateMemoryReport(SharedSurfacesMemoryReport& aReport)
+{
+  if (XRE_IsParentProcess()) {
+    GPUProcessManager* gpm = GPUProcessManager::Get();
+    if (!gpm || gpm->GPUProcessPid() != -1) {
+      return false;
+    }
+  } else if (!XRE_IsGPUProcess()) {
+    return false;
+  }
+
+  StaticMutexAutoLock lock(sMutex);
+  if (!sInstance) {
+    return true;
+  }
+
+  for (auto i = sInstance->mSurfaces.ConstIter(); !i.Done(); i.Next()) {
+    SourceSurfaceSharedDataWrapper* surface = i.Data();
+    aReport.mSurfaces.insert(std::make_pair(i.Key(),
+      SharedSurfacesMemoryReport::SurfaceEntry {
+        surface->GetCreatorPid(), surface->GetSize(), surface->Stride(),
+        surface->GetConsumers(), surface->HasCreatorRef() }));
+  }
+
+  return true;
+}
+
 } // namespace layers
 } // namespace mozilla

--- a/gfx/layers/ipc/SharedSurfacesParent.h
+++ b/gfx/layers/ipc/SharedSurfacesParent.h
@@ -24,41 +24,48 @@ namespace gfx {
 class DataSourceSurface;
 class SourceSurfaceSharedData;
 class SourceSurfaceSharedDataWrapper;
 } // namespace gfx
 
 namespace layers {
 
 class SharedSurfacesChild;
+class SharedSurfacesMemoryReport;
 
 class SharedSurfacesParent final
 {
 public:
   static void Initialize();
   static void Shutdown();
 
   // Get without increasing the consumer count.
   static already_AddRefed<gfx::DataSourceSurface>
   Get(const wr::ExternalImageId& aId);
 
   // Get but also increase the consumer count. Must call Release after finished.
   static already_AddRefed<gfx::DataSourceSurface>
   Acquire(const wr::ExternalImageId& aId);
 
-  static bool Release(const wr::ExternalImageId& aId);
+  static bool Release(const wr::ExternalImageId& aId,
+                      bool aForCreator = false);
 
   static void Add(const wr::ExternalImageId& aId,
                   const SurfaceDescriptorShared& aDesc,
                   base::ProcessId aPid);
 
   static void Remove(const wr::ExternalImageId& aId);
 
   static void DestroyProcess(base::ProcessId aPid);
 
+  static void AccumulateMemoryReport(base::ProcessId aPid,
+                                     SharedSurfacesMemoryReport& aReport);
+
+  static bool AccumulateMemoryReport(SharedSurfacesMemoryReport& aReport);
+
   ~SharedSurfacesParent();
 
 private:
   friend class SharedSurfacesChild;
 
   SharedSurfacesParent();
 
   static void AddSameProcess(const wr::ExternalImageId& aId,

--- a/gfx/layers/moz.build
+++ b/gfx/layers/moz.build
@@ -191,16 +191,17 @@ EXPORTS.mozilla.layers += [
     'ipc/LayerTransactionParent.h',
     'ipc/LayerTreeOwnerTracker.h',
     'ipc/RefCountedShmem.h',
     'ipc/RemoteContentController.h',
     'ipc/ShadowLayers.h',
     'ipc/SharedPlanarYCbCrImage.h',
     'ipc/SharedRGBImage.h',
     'ipc/SharedSurfacesChild.h',
+    'ipc/SharedSurfacesMemoryReport.h',
     'ipc/SharedSurfacesParent.h',
     'ipc/SynchronousTask.h',
     'ipc/TextureForwarder.h',
     'ipc/UiCompositorControllerChild.h',
     'ipc/UiCompositorControllerMessageTypes.h',
     'ipc/UiCompositorControllerParent.h',
     'ipc/VideoBridgeChild.h',
     'ipc/VideoBridgeParent.h',

--- a/gfx/thebes/gfxPlatform.cpp
+++ b/gfx/thebes/gfxPlatform.cpp
@@ -1,14 +1,15 @@
 /* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 2 -*-
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "mozilla/FontPropertyTypes.h"
+#include "mozilla/image/ImageMemoryReporter.h"
 #include "mozilla/layers/CompositorManagerChild.h"
 #include "mozilla/layers/CompositorThread.h"
 #include "mozilla/layers/ImageBridgeChild.h"
 #include "mozilla/layers/ISurfaceAllocator.h"     // for GfxMemoryImageReporter
 #include "mozilla/webrender/RenderThread.h"
 #include "mozilla/webrender/WebRenderAPI.h"
 #include "mozilla/webrender/webrender_ffi.h"
 #include "mozilla/layers/PaintThread.h"
@@ -1139,16 +1140,17 @@ gfxPlatform::InitLayersIPC()
     if (gfxVars::UseOMTP() && !recordreplay::IsRecordingOrReplaying()) {
       layers::PaintThread::Start();
     }
   }
 
   if (XRE_IsParentProcess() || recordreplay::IsRecordingOrReplaying()) {
     if (!gfxConfig::IsEnabled(Feature::GPU_PROCESS) && gfxVars::UseWebRender()) {
       wr::RenderThread::Start();
+      image::ImageMemoryReporter::InitForWebRender();
     }
 
     layers::CompositorThreadHolder::Start();
     gfx::VRListenerThreadHolder::Start();
   }
 }
 
 /* static */ void
@@ -1172,16 +1174,17 @@ gfxPlatform::ShutdownLayersIPC()
         }
     } else if (XRE_IsParentProcess()) {
         gfx::VRManagerChild::ShutDown();
         layers::CompositorManagerChild::Shutdown();
         layers::ImageBridgeChild::ShutDown();
         // This has to happen after shutting down the child protocols.
         layers::CompositorThreadHolder::Shutdown();
         gfx::VRListenerThreadHolder::Shutdown();
+        image::ImageMemoryReporter::ShutdownForWebRender();
         // There is a case that RenderThread exists when gfxVars::UseWebRender() is false.
         // This could happen when WebRender was fallbacked to compositor.
         if (wr::RenderThread::Get()) {
           wr::RenderThread::ShutDown();
 
           Preferences::UnregisterCallback(WebRenderDebugPrefChangeCallback, WR_DEBUG_PREF);
         }
 

--- a/gfx/thebes/gfxPrefs.h
+++ b/gfx/thebes/gfxPrefs.h
@@ -552,16 +552,17 @@ private:
   DECL_GFX_PREF(Live, "image.decode-immediately.enabled",      ImageDecodeImmediatelyEnabled, bool, false);
   DECL_GFX_PREF(Live, "image.downscale-during-decode.enabled", ImageDownscaleDuringDecodeEnabled, bool, true);
   DECL_GFX_PREF(Live, "image.infer-src-animation.threshold-ms", ImageInferSrcAnimationThresholdMS, uint32_t, 2000);
   DECL_GFX_PREF(Live, "image.layout_network_priority",         ImageLayoutNetworkPriority, bool, true);
   DECL_GFX_PREF(Once, "image.mem.decode_bytes_at_a_time",      ImageMemDecodeBytesAtATime, uint32_t, 200000);
   DECL_GFX_PREF(Live, "image.mem.discardable",                 ImageMemDiscardable, bool, false);
   DECL_GFX_PREF(Once, "image.mem.animated.discardable",        ImageMemAnimatedDiscardable, bool, false);
   DECL_GFX_PREF(Live, "image.mem.animated.use_heap",           ImageMemAnimatedUseHeap, bool, false);
+  DECL_GFX_PREF(Live, "image.mem.debug-reporting",             ImageMemDebugReporting, bool, false);
   DECL_GFX_PREF(Live, "image.mem.shared",                      ImageMemShared, bool, true);
   DECL_GFX_PREF(Once, "image.mem.surfacecache.discard_factor", ImageMemSurfaceCacheDiscardFactor, uint32_t, 1);
   DECL_GFX_PREF(Once, "image.mem.surfacecache.max_size_kb",    ImageMemSurfaceCacheMaxSizeKB, uint32_t, 100 * 1024);
   DECL_GFX_PREF(Once, "image.mem.surfacecache.min_expiration_ms", ImageMemSurfaceCacheMinExpirationMS, uint32_t, 60*1000);
   DECL_GFX_PREF(Once, "image.mem.surfacecache.size_factor",    ImageMemSurfaceCacheSizeFactor, uint32_t, 64);
   DECL_GFX_PREF(Live, "image.mem.volatile.min_threshold_kb",   ImageMemVolatileMinThresholdKB, int32_t, -1);
   DECL_GFX_PREF(Once, "image.multithreaded_decoding.limit",    ImageMTDecodingLimit, int32_t, -1);
   DECL_GFX_PREF(Once, "image.multithreaded_decoding.idle_timeout", ImageMTDecodingIdleTimeout, int32_t, -1);

--- a/gfx/webrender/res/cs_border_segment.glsl
+++ b/gfx/webrender/res/cs_border_segment.glsl
@@ -147,17 +147,17 @@ vec4[2] get_colors_for_side(vec4 color, 
 
     return result;
 }
 
 void main(void) {
     int segment = aFlags & 0xff;
     int style0 = (aFlags >> 8) & 0xff;
     int style1 = (aFlags >> 16) & 0xff;
-    int clip_mode = (aFlags >> 24) & 0xff;
+    int clip_mode = (aFlags >> 24) & 0x0f;
 
     vec2 outer_scale = get_outer_corner_scale(segment);
     vec2 outer = outer_scale * aRect.zw;
     vec2 clip_sign = 1.0 - 2.0 * outer_scale;
 
     // Set some flags used by the FS to determine the
     // orientation of the two edges in this corner.
     ivec2 edge_axis = ivec2(0, 0);

--- a/gfx/webrender/res/cs_border_solid.glsl
+++ b/gfx/webrender/res/cs_border_solid.glsl
@@ -1,14 +1,18 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include shared,ellipse
 
+#define DONT_MIX 0
+#define MIX_AA 1
+#define MIX_NO_AA 2
+
 // For edges, the colors are the same. For corners, these
 // are the colors of each edge making up the corner.
 flat varying vec4 vColor0;
 flat varying vec4 vColor1;
 
 // A point + tangent defining the line where the edge
 // transition occurs. Used for corners only.
 flat varying vec4 vColorLine;
@@ -65,31 +69,32 @@ vec2 get_outer_corner_scale(int segment)
             break;
     }
 
     return p;
 }
 
 void main(void) {
     int segment = aFlags & 0xff;
+    bool do_aa = ((aFlags >> 24) & 0xf0) != 0;
 
     vec2 outer_scale = get_outer_corner_scale(segment);
     vec2 outer = outer_scale * aRect.zw;
     vec2 clip_sign = 1.0 - 2.0 * outer_scale;
 
     int mix_colors;
     switch (segment) {
         case SEGMENT_TOP_LEFT:
         case SEGMENT_TOP_RIGHT:
         case SEGMENT_BOTTOM_RIGHT:
         case SEGMENT_BOTTOM_LEFT:
-            mix_colors = 1;
+            mix_colors = do_aa ? MIX_AA : MIX_NO_AA;
             break;
         default:
-            mix_colors = 0;
+            mix_colors = DONT_MIX;
             break;
     }
 
     vMixColors = mix_colors;
     vPos = aRect.zw * aPosition.xy;
 
     vColor0 = aColor0;
     vColor1 = aColor1;
@@ -99,31 +104,36 @@ void main(void) {
 
     gl_Position = uTransform * vec4(aTaskOrigin + aRect.xy + vPos, 0.0, 1.0);
 }
 #endif
 
 #ifdef WR_FRAGMENT_SHADER
 void main(void) {
     float aa_range = compute_aa_range(vPos);
+    bool do_aa = vMixColors != MIX_NO_AA;
 
     float mix_factor = 0.0;
-    if (vMixColors != 0) {
+    if (vMixColors != DONT_MIX) {
         float d_line = distance_to_line(vColorLine.xy, vColorLine.zw, vPos);
-        mix_factor = distance_aa(aa_range, -d_line);
+        if (do_aa) {
+            mix_factor = distance_aa(aa_range, -d_line);
+        } else {
+            mix_factor = d_line + EPSILON >= 0. ? 1.0 : 0.0;
+        }
     }
 
     // Check if inside corner clip-region
     vec2 clip_relative_pos = vPos - vClipCenter_Sign.xy;
     bool in_clip_region = all(lessThan(vClipCenter_Sign.zw * clip_relative_pos, vec2(0.0)));
 
     float d = -1.0;
     if (in_clip_region) {
         float d_radii_a = distance_to_ellipse(clip_relative_pos, vClipRadii.xy, aa_range);
         float d_radii_b = distance_to_ellipse(clip_relative_pos, vClipRadii.zw, aa_range);
         d = max(d_radii_a, -d_radii_b);
     }
 
-    float alpha = distance_aa(aa_range, d);
+    float alpha = do_aa ? distance_aa(aa_range, d) : 1.0;
     vec4 color = mix(vColor0, vColor1, mix_factor);
     oFragColor = color * alpha;
 }
 #endif

--- a/gfx/webrender/src/border.rs
+++ b/gfx/webrender/src/border.rs
@@ -98,16 +98,17 @@ impl From<BorderSide> for BorderSideAu {
 #[cfg_attr(feature = "replay", derive(Deserialize))]
 pub struct BorderCacheKey {
     pub left: BorderSideAu,
     pub right: BorderSideAu,
     pub top: BorderSideAu,
     pub bottom: BorderSideAu,
     pub radius: BorderRadiusAu,
     pub widths: SideOffsets2D<Au>,
+    pub do_aa: bool,
     pub scale: Au,
 }
 
 impl BorderCacheKey {
     pub fn new(border: &NormalBorder, widths: &LayoutSideOffsets) -> Self {
         BorderCacheKey {
             left: border.left.into(),
             top: border.top.into(),
@@ -115,16 +116,17 @@ impl BorderCacheKey {
             bottom: border.bottom.into(),
             widths: SideOffsets2D::new(
                 Au::from_f32_px(widths.top),
                 Au::from_f32_px(widths.right),
                 Au::from_f32_px(widths.bottom),
                 Au::from_f32_px(widths.left),
             ),
             radius: border.radius.into(),
+            do_aa: border.do_aa,
             scale: Au(0),
         }
     }
 }
 
 pub fn ensure_no_corner_overlap(
     radius: &mut BorderRadius,
     rect: &LayoutRect,
@@ -569,16 +571,17 @@ bitflags! {
 /// `available_size_dependence` is non-empty, which is effectively just dashed
 /// and dotted borders for now, since the spacing between the dash and dots
 /// changes depending on that size.
 #[derive(Debug)]
 pub struct BorderRenderTaskInfo {
     pub border_segments: Vec<BorderSegmentInfo>,
     pub size: DeviceIntSize,
     pub available_size_dependence: AvailableSizeDependence,
+    do_aa: bool,
 }
 
 #[derive(PartialEq, Eq)]
 enum DependsOnAvailableSize {
     No,
     Yes,
 }
 
@@ -956,16 +959,17 @@ impl BorderRenderTaskInfo {
             &mut border_segments,
             brush_segments,
         );
 
         Some(BorderRenderTaskInfo {
             border_segments,
             size: size.to_i32(),
             available_size_dependence: size_dependence,
+            do_aa: border.do_aa,
         })
     }
 
     /// Returns the cache key size for this task, based on our available size
     /// dependence computed earlier.
     #[inline]
     pub fn cache_key_size(
         &self,
@@ -1021,16 +1025,17 @@ impl BorderRenderTaskInfo {
                 style0,
                 style1,
                 color0,
                 color1,
                 info.segment,
                 &mut instances,
                 info.widths,
                 info.radius,
+                self.do_aa,
             );
         }
 
         instances
     }
 
     /// Computes the maximum scale that we allow for this set of border parameters.
     /// capping the scale will result in rendering very large corners at a lower
@@ -1089,20 +1094,22 @@ fn add_segment(
     style0: BorderStyle,
     style1: BorderStyle,
     color0: ColorF,
     color1: ColorF,
     segment: BorderSegment,
     instances: &mut Vec<BorderInstance>,
     widths: DeviceSize,
     radius: DeviceSize,
+    do_aa: bool,
 ) {
     let base_flags = (segment as i32) |
                      ((style0 as i32) << 8) |
-                     ((style1 as i32) << 16);
+                     ((style1 as i32) << 16) |
+                     ((do_aa as i32) << 28);
 
     let base_instance = BorderInstance {
         task_origin: DevicePoint::zero(),
         local_rect: task_rect,
         flags: base_flags,
         color0: color0.premultiplied(),
         color1: color1.premultiplied(),
         widths,

--- a/gfx/webrender_api/src/display_item.rs
+++ b/gfx/webrender_api/src/display_item.rs
@@ -257,33 +257,55 @@ pub struct TextDisplayItem {
 
 #[derive(Clone, Copy, Debug, Deserialize, PartialEq, Serialize)]
 pub struct NormalBorder {
     pub left: BorderSide,
     pub right: BorderSide,
     pub top: BorderSide,
     pub bottom: BorderSide,
     pub radius: BorderRadius,
+    /// Whether to apply anti-aliasing on the border corners.
+    ///
+    /// Note that for this to be `false` and work, this requires the borders to
+    /// be solid, and no border-radius.
+    pub do_aa: bool,
 }
 
 impl NormalBorder {
     // Construct a border based upon self with color
     pub fn with_color(&self, color: ColorF) -> Self {
         let mut b = *self;
         b.left.color = color;
         b.right.color = color;
         b.top.color = color;
         b.bottom.color = color;
         b
     }
 
+    fn can_disable_antialiasing(&self) -> bool {
+        fn is_valid(style: BorderStyle) -> bool {
+            style == BorderStyle::Solid || style == BorderStyle::None
+        }
+
+        self.radius.is_zero() &&
+            is_valid(self.top.style) &&
+            is_valid(self.left.style) &&
+            is_valid(self.bottom.style) &&
+            is_valid(self.right.style)
+    }
+
     /// Normalizes a border so that we don't render disallowed stuff, like inset
     /// borders that are less than two pixels wide.
     #[inline]
     pub fn normalize(&mut self, widths: &LayoutSideOffsets) {
+        debug_assert!(
+            self.do_aa || self.can_disable_antialiasing(),
+            "Unexpected disabled-antialising in a border, likely won't work or will be ignored"
+        );
+
         #[inline]
         fn renders_small_border_solid(style: BorderStyle) -> bool {
             match style {
                 BorderStyle::Groove |
                 BorderStyle::Ridge => true,
                 _ => false,
             }
         }

--- a/gfx/webrender_bindings/revision.txt
+++ b/gfx/webrender_bindings/revision.txt
@@ -1,1 +1,1 @@
-b83ec3fd994b69f31e9c6b6ffa19426b2b98c66a
+2549b791abb3a24c115d03616ddd82e14727b5a1

--- a/gfx/webrender_bindings/src/bindings.rs
+++ b/gfx/webrender_bindings/src/bindings.rs
@@ -2184,16 +2184,17 @@ pub extern "C" fn wr_dp_push_border(stat
     debug_assert!(unsafe { is_in_main_thread() });
 
     let border_details = BorderDetails::Normal(NormalBorder {
                                                    left: left.into(),
                                                    right: right.into(),
                                                    top: top.into(),
                                                    bottom: bottom.into(),
                                                    radius: radius.into(),
+                                                   do_aa: true,
                                                });
     let mut prim_info = LayoutPrimitiveInfo::with_clip_rect(rect, clip.into());
     prim_info.is_backface_visible = is_backface_visible;
     prim_info.tag = state.current_tag;
     state.frame_builder
          .dl_builder
          .push_border(&prim_info,
                       widths,

--- a/gfx/wrench/src/yaml_frame_reader.rs
+++ b/gfx/wrench/src/yaml_frame_reader.rs
@@ -865,22 +865,24 @@ impl YamlFrameReader {
                     let bottom = BorderSide {
                         color: colors[2],
                         style: styles[2],
                     };
                     let left = BorderSide {
                         color: colors[3],
                         style: styles[3],
                     };
+                    let do_aa = item["do_aa"].as_bool().unwrap_or(true);
                     Some(BorderDetails::Normal(NormalBorder {
                         top,
                         left,
                         bottom,
                         right,
                         radius,
+                        do_aa,
                     }))
                 }
                 "image" | "gradient" | "radial-gradient" => {
                     let image_width = item["image-width"]
                         .as_i64()
                         .unwrap_or(info.rect.size.width as i64);
                     let image_height = item["image-height"]
                         .as_i64()

--- a/gfx/wrench/src/yaml_frame_writer.rs
+++ b/gfx/wrench/src/yaml_frame_writer.rs
@@ -864,16 +864,17 @@ impl YamlFrameWriter {
                                         BorderStyle::Groove => "groove",
                                     }.to_owned()
                                 })
                                 .collect();
                             yaml_node(&mut v, "width", f32_vec_yaml(&widths, true));
                             str_node(&mut v, "border-type", "normal");
                             yaml_node(&mut v, "color", string_vec_yaml(&colors, true));
                             yaml_node(&mut v, "style", string_vec_yaml(&styles, true));
+                            bool_node(&mut v, "do_aa", details.do_aa);
                             if let Some(radius_node) = maybe_radius_yaml(&details.radius) {
                                 yaml_node(&mut v, "radius", radius_node);
                             }
                         }
                         BorderDetails::NinePatch(ref details) => {
                             let widths: Vec<f32> = vec![
                                 item.widths.top,
                                 item.widths.right,

--- a/gfx/wrench/src/yaml_helper.rs
+++ b/gfx/wrench/src/yaml_helper.rs
@@ -41,16 +41,17 @@ pub trait YamlHelper {
 fn string_to_color(color: &str) -> Option<ColorF> {
     match color {
         "red" => Some(ColorF::new(1.0, 0.0, 0.0, 1.0)),
         "green" => Some(ColorF::new(0.0, 1.0, 0.0, 1.0)),
         "blue" => Some(ColorF::new(0.0, 0.0, 1.0, 1.0)),
         "white" => Some(ColorF::new(1.0, 1.0, 1.0, 1.0)),
         "black" => Some(ColorF::new(0.0, 0.0, 0.0, 1.0)),
         "yellow" => Some(ColorF::new(1.0, 1.0, 0.0, 1.0)),
+        "transparent" => Some(ColorF::new(1.0, 1.0, 1.0, 0.0)),
         s => {
             let items: Vec<f32> = s.split_whitespace()
                 .map(|s| f32::from_str(s).unwrap())
                 .collect();
             if items.len() == 3 {
                 Some(ColorF::new(
                     items[0] / 255.0,
                     items[1] / 255.0,

--- a/image/AnimationSurfaceProvider.cpp
+++ b/image/AnimationSurfaceProvider.cpp
@@ -201,29 +201,33 @@ AnimationSurfaceProvider::LogicalSizeInB
   // animation has, so we really can't do better here. This will become correct
   // once bug 1289954 is complete.
   IntSize size = GetSurfaceKey().Size();
   return 3 * size.width * size.height * sizeof(uint32_t);
 }
 
 void
 AnimationSurfaceProvider::AddSizeOfExcludingThis(MallocSizeOf aMallocSizeOf,
-                                                 size_t& aHeapSizeOut,
-                                                 size_t& aNonHeapSizeOut,
-                                                 size_t& aExtHandlesOut)
+                                                 const AddSizeOfCb& aCallback)
 {
   // Note that the surface cache lock is already held here, and then we acquire
   // mFramesMutex. For this method, this ordering is unavoidable, which means
   // that we must be careful to always use the same ordering elsewhere.
   MutexAutoLock lock(mFramesMutex);
 
+  size_t i = 0;
   for (const RawAccessFrameRef& frame : mFrames.Frames()) {
+    ++i;
     if (frame) {
-      frame->AddSizeOfExcludingThis(aMallocSizeOf, aHeapSizeOut,
-                                    aNonHeapSizeOut, aExtHandlesOut);
+      frame->AddSizeOfExcludingThis(aMallocSizeOf,
+        [&](AddSizeOfCbData& aMetadata) {
+          aMetadata.index = i;
+          aCallback(aMetadata);
+        }
+      );
     }
   }
 }
 
 void
 AnimationSurfaceProvider::Run()
 {
   MutexAutoLock lock(mDecodingMutex);

--- a/image/AnimationSurfaceProvider.h
+++ b/image/AnimationSurfaceProvider.h
@@ -44,19 +44,17 @@ public:
   // We use the ISurfaceProvider constructor of DrawableSurface to indicate that
   // our surfaces are computed lazily.
   DrawableSurface Surface() override { return DrawableSurface(WrapNotNull(this)); }
 
   bool IsFinished() const override;
   bool IsFullyDecoded() const override;
   size_t LogicalSizeInBytes() const override;
   void AddSizeOfExcludingThis(MallocSizeOf aMallocSizeOf,
-                              size_t& aHeapSizeOut,
-                              size_t& aNonHeapSizeOut,
-                              size_t& aExtHandlesOut) override;
+                              const AddSizeOfCb& aCallback) override;
   void Reset() override;
   void Advance(size_t aFrame) override;
 
 protected:
   DrawableFrameRef DrawableRef(size_t aFrame) override;
   RawAccessFrameRef RawAccessRef(size_t aFrame) override;
 
   // Animation frames are always locked. This is because we only want to release

--- a/image/FrameAnimator.cpp
+++ b/image/FrameAnimator.cpp
@@ -556,30 +556,34 @@ DoCollectSizeOfCompositingSurfaces(const
                                    nsTArray<SurfaceMemoryCounter>& aCounters,
                                    MallocSizeOf aMallocSizeOf)
 {
   // Concoct a SurfaceKey for this surface.
   SurfaceKey key = RasterSurfaceKey(aSurface->GetImageSize(),
                                     DefaultSurfaceFlags(),
                                     PlaybackType::eStatic);
 
-  // Create a counter for this surface.
-  SurfaceMemoryCounter counter(key, /* aIsLocked = */ true,
-                               /* aCannotSubstitute */ false,
-                               /* aIsFactor2 */ false, aType);
+  // Extract the surface's memory usage information.
+  aSurface->AddSizeOfExcludingThis(aMallocSizeOf,
+    [&](imgFrame::AddSizeOfCbData& aMetadata) {
+      // Create a counter for this surface.
+      SurfaceMemoryCounter counter(key, /* aIsLocked = */ true,
+                                   /* aCannotSubstitute */ false,
+                                   /* aIsFactor2 */ false, aType);
 
-  // Extract the surface's memory usage information.
-  size_t heap = 0, nonHeap = 0, handles = 0;
-  aSurface->AddSizeOfExcludingThis(aMallocSizeOf, heap, nonHeap, handles);
-  counter.Values().SetDecodedHeap(heap);
-  counter.Values().SetDecodedNonHeap(nonHeap);
-  counter.Values().SetExternalHandles(handles);
+      // Record it.
+      counter.Values().SetDecodedHeap(aMetadata.heap);
+      counter.Values().SetDecodedNonHeap(aMetadata.nonHeap);
+      counter.Values().SetExternalHandles(aMetadata.handles);
+      counter.Values().SetFrameIndex(aMetadata.index);
+      counter.Values().SetExternalId(aMetadata.externalId);
 
-  // Record it.
-  aCounters.AppendElement(counter);
+      aCounters.AppendElement(counter);
+    }
+  );
 }
 
 void
 FrameAnimator::CollectSizeOfCompositingSurfaces(
     nsTArray<SurfaceMemoryCounter>& aCounters,
     MallocSizeOf aMallocSizeOf) const
 {
   if (mCompositingFrame) {

--- a/image/ISurfaceProvider.h
+++ b/image/ISurfaceProvider.h
@@ -60,31 +60,31 @@ public:
   virtual bool IsFullyDecoded() const { return IsFinished(); }
 
   /// @return the number of bytes of memory this ISurfaceProvider is expected to
   /// require. Optimizations may result in lower real memory usage. Trivial
   /// overhead is ignored. Because this value is used in bookkeeping, it's
   /// important that it be constant over the lifetime of this object.
   virtual size_t LogicalSizeInBytes() const = 0;
 
+  typedef imgFrame::AddSizeOfCbData AddSizeOfCbData;
+  typedef imgFrame::AddSizeOfCb AddSizeOfCb;
+
   /// @return the actual number of bytes of memory this ISurfaceProvider is
   /// using. May vary over the lifetime of the ISurfaceProvider. The default
   /// implementation is appropriate for static ISurfaceProviders.
   virtual void AddSizeOfExcludingThis(MallocSizeOf aMallocSizeOf,
-                                      size_t& aHeapSizeOut,
-                                      size_t& aNonHeapSizeOut,
-                                      size_t& aExtHandlesOut)
+                                      const AddSizeOfCb& aCallback)
   {
     DrawableFrameRef ref = DrawableRef(/* aFrame = */ 0);
     if (!ref) {
       return;
     }
 
-    ref->AddSizeOfExcludingThis(aMallocSizeOf, aHeapSizeOut,
-                                aNonHeapSizeOut, aExtHandlesOut);
+    ref->AddSizeOfExcludingThis(aMallocSizeOf, aCallback);
   }
 
   virtual void Reset() { }
   virtual void Advance(size_t aFrame) { }
 
   /// @return the availability state of this ISurfaceProvider, which indicates
   /// whether DrawableRef() could successfully return a surface. Should only be
   /// called from SurfaceCache code as it relies on SurfaceCache for

--- a/image/Image.h
+++ b/image/Image.h
@@ -31,41 +31,49 @@ class Image;
 
 struct MemoryCounter
 {
   MemoryCounter()
     : mSource(0)
     , mDecodedHeap(0)
     , mDecodedNonHeap(0)
     , mExternalHandles(0)
+    , mFrameIndex(0)
+    , mExternalId(0)
   { }
 
   void SetSource(size_t aCount) { mSource = aCount; }
   size_t Source() const { return mSource; }
   void SetDecodedHeap(size_t aCount) { mDecodedHeap = aCount; }
   size_t DecodedHeap() const { return mDecodedHeap; }
   void SetDecodedNonHeap(size_t aCount) { mDecodedNonHeap = aCount; }
   size_t DecodedNonHeap() const { return mDecodedNonHeap; }
   void SetExternalHandles(size_t aCount) { mExternalHandles = aCount; }
   size_t ExternalHandles() const { return mExternalHandles; }
+  void SetFrameIndex(size_t aIndex) { mFrameIndex = aIndex; }
+  size_t FrameIndex() const { return mFrameIndex; }
+  void SetExternalId(uint64_t aId) { mExternalId = aId; }
+  uint64_t ExternalId() const { return mExternalId; }
 
   MemoryCounter& operator+=(const MemoryCounter& aOther)
   {
     mSource += aOther.mSource;
     mDecodedHeap += aOther.mDecodedHeap;
     mDecodedNonHeap += aOther.mDecodedNonHeap;
     mExternalHandles += aOther.mExternalHandles;
     return *this;
   }
 
 private:
   size_t mSource;
   size_t mDecodedHeap;
   size_t mDecodedNonHeap;
   size_t mExternalHandles;
+  size_t mFrameIndex;
+  uint64_t mExternalId;
 };
 
 enum class SurfaceMemoryCounterType
 {
   NORMAL,
   COMPOSITING,
   COMPOSITING_PREV
 };

new file mode 100644
--- /dev/null
+++ b/image/ImageMemoryReporter.cpp
@@ -0,0 +1,189 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ImageMemoryReporter.h"
+#include "Image.h"
+#include "mozilla/layers/SharedSurfacesParent.h"
+#include "nsIMemoryReporter.h"
+#include "nsISupportsImpl.h"
+
+namespace mozilla {
+namespace image {
+
+ImageMemoryReporter::WebRenderReporter* ImageMemoryReporter::sWrReporter;
+ 
+class ImageMemoryReporter::WebRenderReporter final : public nsIMemoryReporter
+{
+public:
+  NS_DECL_ISUPPORTS
+
+  WebRenderReporter()
+  { }
+
+  NS_IMETHOD CollectReports(nsIHandleReportCallback* aHandleReport,
+                            nsISupports* aData, bool aAnonymize) override
+  {
+    layers::SharedSurfacesMemoryReport report;
+    layers::SharedSurfacesParent::AccumulateMemoryReport(report);
+    ReportSharedSurfaces(aHandleReport, aData, /* aIsForCompositor */ true, report);
+    return NS_OK;
+  }
+
+private:
+  virtual ~WebRenderReporter()
+  { }
+};
+
+NS_IMPL_ISUPPORTS(ImageMemoryReporter::WebRenderReporter, nsIMemoryReporter)
+
+/* static */ void
+ImageMemoryReporter::InitForWebRender()
+{
+  MOZ_ASSERT(XRE_IsParentProcess() || XRE_IsGPUProcess());
+  if (!sWrReporter) {
+    sWrReporter = new WebRenderReporter();
+    RegisterStrongMemoryReporter(sWrReporter);
+  }
+}
+
+/* static */ void
+ImageMemoryReporter::ShutdownForWebRender()
+{
+  MOZ_ASSERT(XRE_IsParentProcess() || XRE_IsGPUProcess());
+  if (sWrReporter) {
+    UnregisterStrongMemoryReporter(sWrReporter);
+    sWrReporter = nullptr;
+  }
+}
+
+/* static */ void
+ImageMemoryReporter::ReportSharedSurfaces(nsIHandleReportCallback* aHandleReport,
+                                          nsISupports* aData,
+                                          const layers::SharedSurfacesMemoryReport& aSharedSurfaces)
+{
+  ReportSharedSurfaces(aHandleReport, aData,
+                       /* aIsForCompositor */ false,
+                       aSharedSurfaces);
+}
+
+/* static */ void
+ImageMemoryReporter::ReportSharedSurfaces(nsIHandleReportCallback* aHandleReport,
+                                          nsISupports* aData,
+                                          bool aIsForCompositor,
+                                          const layers::SharedSurfacesMemoryReport& aSharedSurfaces)
+{
+  MOZ_ASSERT_IF(aIsForCompositor, XRE_IsParentProcess() || XRE_IsGPUProcess());
+  MOZ_ASSERT_IF(!aIsForCompositor,
+                XRE_IsParentProcess() || XRE_IsContentProcess());
+
+  for (auto i = aSharedSurfaces.mSurfaces.begin();
+    i != aSharedSurfaces.mSurfaces.end(); ++i) {
+    ReportSharedSurface(aHandleReport, aData, aIsForCompositor, i->first, i->second);
+  }
+}
+
+/* static */ void
+ImageMemoryReporter::ReportSharedSurface(nsIHandleReportCallback* aHandleReport,
+                                         nsISupports* aData,
+                                         bool aIsForCompositor,
+                                         uint64_t aExternalId,
+                                         const layers::SharedSurfacesMemoryReport::SurfaceEntry& aEntry)
+{
+  nsAutoCString path;
+  if (aIsForCompositor) {
+    path.AppendLiteral("gfx/webrender/images/mapped_from_owner/");
+  } else {
+    path.AppendLiteral("gfx/webrender/images/owner_cache_missing/");
+  }
+
+  if (aIsForCompositor) {
+    path.AppendLiteral("pid=");
+    path.AppendInt(uint32_t(aEntry.mCreatorPid));
+    path.AppendLiteral("/");
+  }
+
+  if (gfxPrefs::ImageMemDebugReporting()) {
+    path.AppendInt(aExternalId, 16);
+    path.AppendLiteral("/");
+  }
+
+  path.AppendLiteral("image(");
+  path.AppendInt(aEntry.mSize.width);
+  path.AppendLiteral("x");
+  path.AppendInt(aEntry.mSize.height);
+  path.AppendLiteral(", compositor_ref:");
+  path.AppendInt(aEntry.mConsumers);
+  path.AppendLiteral(", creator_ref:");
+  path.AppendInt(aEntry.mCreatorRef);
+  path.AppendLiteral(")/decoded-nonheap");
+
+  size_t surfaceSize =
+    mozilla::ipc::SharedMemory::PageAlignedSize(aEntry.mSize.height *
+                                                aEntry.mStride);
+
+  // If this memory has already been reported elsewhere (e.g. as part of our
+  // explicit section in the surface cache), we don't want report it again as
+  // KIND_NONHEAP and have it counted again.
+  bool sameProcess = aEntry.mCreatorPid == base::GetCurrentProcId();
+  int32_t kind = aIsForCompositor && !sameProcess
+               ? nsIMemoryReporter::KIND_NONHEAP
+               : nsIMemoryReporter::KIND_OTHER;
+
+  NS_NAMED_LITERAL_CSTRING(desc, "Decoded image data stored in shared memory.");
+  aHandleReport->Callback(EmptyCString(), path, kind,
+                          nsIMemoryReporter::UNITS_BYTES,
+                          surfaceSize, desc, aData);
+}
+
+/* static */ void
+ImageMemoryReporter::AppendSharedSurfacePrefix(nsACString& aPathPrefix,
+                                               const SurfaceMemoryCounter& aCounter,
+                                               layers::SharedSurfacesMemoryReport& aSharedSurfaces)
+{
+  uint64_t extId = aCounter.Values().ExternalId();
+  if (extId) {
+    auto gpuEntry = aSharedSurfaces.mSurfaces.find(extId);
+
+    if (gfxPrefs::ImageMemDebugReporting()) {
+      aPathPrefix.AppendLiteral(", external_id:");
+      aPathPrefix.AppendInt(extId, 16);
+      if (gpuEntry != aSharedSurfaces.mSurfaces.end()) {
+        aPathPrefix.AppendLiteral(", compositor_ref:");
+        aPathPrefix.AppendInt(gpuEntry->second.mConsumers);
+      } else {
+        aPathPrefix.AppendLiteral(", compositor_ref:missing");
+      }
+    }
+
+    if (gpuEntry != aSharedSurfaces.mSurfaces.end()) {
+      MOZ_ASSERT(gpuEntry->second.mCreatorRef);
+      aSharedSurfaces.mSurfaces.erase(gpuEntry);
+    }
+  }
+}
+
+/* static */ void
+ImageMemoryReporter::TrimSharedSurfaces(const ImageMemoryCounter& aCounter,
+                                        layers::SharedSurfacesMemoryReport& aSharedSurfaces)
+{
+  if (aSharedSurfaces.mSurfaces.empty()) {
+    return;
+  }
+
+  for (const SurfaceMemoryCounter& counter : aCounter.Surfaces()) {
+    uint64_t extId = counter.Values().ExternalId();
+    if (extId) {
+      auto gpuEntry = aSharedSurfaces.mSurfaces.find(extId);
+      if (gpuEntry != aSharedSurfaces.mSurfaces.end()) {
+        MOZ_ASSERT(gpuEntry->second.mCreatorRef);
+        aSharedSurfaces.mSurfaces.erase(gpuEntry);
+      }
+    }
+  }
+}
+
+} // image
+} // mozilla

new file mode 100644
--- /dev/null
+++ b/image/ImageMemoryReporter.h
@@ -0,0 +1,96 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_image_ImageMemoryReporter_h
+#define mozilla_image_ImageMemoryReporter_h
+
+#include <cstdint>
+#include "nsString.h"
+#include "mozilla/layers/SharedSurfacesMemoryReport.h"
+
+class nsISupports;
+class nsIHandleReportCallback;
+
+namespace mozilla {
+namespace image {
+struct ImageMemoryCounter;
+struct SurfaceMemoryCounter;
+
+class ImageMemoryReporter final
+{
+public:
+  /**
+   * Initializes image related memory reporting in the compositor process when
+   * using WebRender.
+   */
+  static void InitForWebRender();
+
+  /**
+   * Tears down image related memory reporting in the compositor process when
+   * using WebRender.
+   */
+  static void ShutdownForWebRender();
+
+  /**
+   * Report all remaining entries in the shared surface's memory report. This
+   * should be used by the content or main process to allow reporting any
+   * entries that is was unable to cross reference with the local surface cache.
+   * These are candidates for having been leaked. This should be used in
+   * conjunction with AppendSharedSurfacePrefix and/or TrimSharedSurfaces to
+   * produce the expected result.
+   */
+  static void ReportSharedSurfaces(nsIHandleReportCallback* aHandleReport,
+                                   nsISupports* aData,
+                                   const layers::SharedSurfacesMemoryReport& aSharedSurfaces);
+
+  /**
+   * Adjust the path prefix for a surface to include any additional metadata for
+   * the shared surface, if any. It will also remove any corresponding entries
+   * in the given memory report.
+   */
+  static void AppendSharedSurfacePrefix(nsACString& aPathPrefix,
+                                        const SurfaceMemoryCounter& aCounter,
+                                        layers::SharedSurfacesMemoryReport& aSharedSurfaces);
+
+  /**
+   * Remove all entries in the memory report for the given set of surfaces for
+   * an image. This is useful when we aren't reporting on a particular image
+   * because it isn't notable.
+   */
+  static void TrimSharedSurfaces(const ImageMemoryCounter& aCounter,
+                                 layers::SharedSurfacesMemoryReport& aSharedSurfaces);
+
+private:
+  /**
+   * Report all remaining entries in the shared surface's memory report.
+   *
+   * aIsForCompositor controls how to intepret what remains in the report. If
+   * true, this should mirror exactly what is currently in
+   * SharedSurfacesParent's cache. This will report entries that are currently
+   * mapped into the compositor process. If false, then we are in a content or
+   * main process, and it should have removed entries that also exist in its
+   * local surface cache -- thus any remaining entries are those that are
+   * candidates for leaks.
+   */
+  static void ReportSharedSurfaces(nsIHandleReportCallback* aHandleReport,
+                                   nsISupports* aData,
+                                   bool aIsForCompositor,
+                                   const layers::SharedSurfacesMemoryReport& aSharedSurfaces);
+
+  static void ReportSharedSurface(nsIHandleReportCallback* aHandleReport,
+                                  nsISupports* aData,
+                                  bool aIsForCompositor,
+                                  uint64_t aExternalId,
+                                  const layers::SharedSurfacesMemoryReport::SurfaceEntry& aEntry);
+
+  class WebRenderReporter;
+  static WebRenderReporter* sWrReporter;
+};
+
+} // image
+} // mozilla
+
+#endif // mozilla_image_ImageMemoryReporter_h

--- a/image/SurfaceCache.cpp
+++ b/image/SurfaceCache.cpp
@@ -183,39 +183,40 @@ public:
     SurfaceMemoryReport(nsTArray<SurfaceMemoryCounter>& aCounters,
                         MallocSizeOf                    aMallocSizeOf)
       : mCounters(aCounters)
       , mMallocSizeOf(aMallocSizeOf)
     { }
 
     void Add(NotNull<CachedSurface*> aCachedSurface, bool aIsFactor2)
     {
-      SurfaceMemoryCounter counter(aCachedSurface->GetSurfaceKey(),
-                                   aCachedSurface->IsLocked(),
-                                   aCachedSurface->CannotSubstitute(),
-                                   aIsFactor2);
-
       if (aCachedSurface->IsPlaceholder()) {
         return;
       }
 
       // Record the memory used by the ISurfaceProvider. This may not have a
       // straightforward relationship to the size of the surface that
       // DrawableRef() returns if the surface is generated dynamically. (i.e.,
       // for surfaces with PlaybackType::eAnimated.)
-      size_t heap = 0;
-      size_t nonHeap = 0;
-      size_t handles = 0;
-      aCachedSurface->mProvider
-        ->AddSizeOfExcludingThis(mMallocSizeOf, heap, nonHeap, handles);
-      counter.Values().SetDecodedHeap(heap);
-      counter.Values().SetDecodedNonHeap(nonHeap);
-      counter.Values().SetExternalHandles(handles);
+      aCachedSurface->mProvider->AddSizeOfExcludingThis(mMallocSizeOf,
+        [&](ISurfaceProvider::AddSizeOfCbData& aMetadata) {
+          SurfaceMemoryCounter counter(aCachedSurface->GetSurfaceKey(),
+                                       aCachedSurface->IsLocked(),
+                                       aCachedSurface->CannotSubstitute(),
+                                       aIsFactor2);
 
-      mCounters.AppendElement(counter);
+          counter.Values().SetDecodedHeap(aMetadata.heap);
+          counter.Values().SetDecodedNonHeap(aMetadata.nonHeap);
+          counter.Values().SetExternalHandles(aMetadata.handles);
+          counter.Values().SetFrameIndex(aMetadata.index);
+          counter.Values().SetExternalId(aMetadata.externalId);
+
+          mCounters.AppendElement(counter);
+        }
+      );
     }
 
   private:
     nsTArray<SurfaceMemoryCounter>& mCounters;
     MallocSizeOf                    mMallocSizeOf;
   };
 
 private:

--- a/image/imgFrame.cpp
+++ b/image/imgFrame.cpp
@@ -937,32 +937,34 @@ void
 imgFrame::SetCompositingFailed(bool val)
 {
   MOZ_ASSERT(NS_IsMainThread());
   mCompositingFailed = val;
 }
 
 void
 imgFrame::AddSizeOfExcludingThis(MallocSizeOf aMallocSizeOf,
-                                 size_t& aHeapSizeOut,
-                                 size_t& aNonHeapSizeOut,
-                                 size_t& aExtHandlesOut) const
+                                 const AddSizeOfCb& aCallback) const
 {
   MonitorAutoLock lock(mMonitor);
 
+  AddSizeOfCbData metadata;
   if (mPalettedImageData) {
-    aHeapSizeOut += aMallocSizeOf(mPalettedImageData);
+    metadata.heap += aMallocSizeOf(mPalettedImageData);
   }
   if (mLockedSurface) {
-    aHeapSizeOut += aMallocSizeOf(mLockedSurface);
+    metadata.heap += aMallocSizeOf(mLockedSurface);
   }
   if (mOptSurface) {
-    aHeapSizeOut += aMallocSizeOf(mOptSurface);
+    metadata.heap += aMallocSizeOf(mOptSurface);
   }
   if (mRawSurface) {
-    aHeapSizeOut += aMallocSizeOf(mRawSurface);
-    mRawSurface->AddSizeOfExcludingThis(aMallocSizeOf, aHeapSizeOut,
-                                        aNonHeapSizeOut, aExtHandlesOut);
+    metadata.heap += aMallocSizeOf(mRawSurface);
+    mRawSurface->AddSizeOfExcludingThis(aMallocSizeOf, metadata.heap,
+                                        metadata.nonHeap, metadata.handles,
+                                        metadata.externalId);
   }
+
+  aCallback(metadata);
 }
 
 } // namespace image
 } // namespace mozilla

--- a/image/imgFrame.h
+++ b/image/imgFrame.h
@@ -201,19 +201,32 @@ public:
   bool GetCompositingFailed() const;
   void SetCompositingFailed(bool val);
 
   void SetOptimizable();
 
   void FinalizeSurface();
   already_AddRefed<SourceSurface> GetSourceSurface();
 
-  void AddSizeOfExcludingThis(MallocSizeOf aMallocSizeOf, size_t& aHeapSizeOut,
-                              size_t& aNonHeapSizeOut,
-                              size_t& aExtHandlesOut) const;
+  struct AddSizeOfCbData {
+    AddSizeOfCbData()
+      : heap(0), nonHeap(0), handles(0), index(0), externalId(0)
+    { }
+
+    size_t heap;
+    size_t nonHeap;
+    size_t handles;
+    size_t index;
+    uint64_t externalId;
+  };
+
+  typedef std::function<void(AddSizeOfCbData& aMetadata)> AddSizeOfCb;
+
+  void AddSizeOfExcludingThis(MallocSizeOf aMallocSizeOf,
+                              const AddSizeOfCb& aCallback) const;
 
 private: // methods
 
   ~imgFrame();
 
   /**
    * Used when the caller desires raw access to the underlying frame buffer.
    * If the locking succeeds, the data pointer to the start of the buffer is

--- a/image/imgLoader.cpp
+++ b/image/imgLoader.cpp
@@ -41,16 +41,18 @@
 #include "nsIAsyncVerifyRedirectCallback.h"
 #include "nsIFileURL.h"
 #include "nsIFile.h"
 #include "nsCRT.h"
 #include "nsINetworkPredictor.h"
 #include "nsReadableUtils.h"
 #include "mozilla/dom/ContentParent.h"
 #include "mozilla/dom/nsMixedContentBlocker.h"
+#include "mozilla/image/ImageMemoryReporter.h"
+#include "mozilla/layers/CompositorManagerChild.h"
 
 #include "nsIApplicationCache.h"
 #include "nsIApplicationCacheContainer.h"
 
 #include "nsIMemoryReporter.h"
 #include "DecoderFactory.h"
 #include "Image.h"
 #include "gfxPrefs.h"
@@ -76,16 +78,44 @@ class imgMemoryReporter final : public n
   ~imgMemoryReporter() = default;
 
 public:
   NS_DECL_ISUPPORTS
 
   NS_IMETHOD CollectReports(nsIHandleReportCallback* aHandleReport,
                             nsISupports* aData, bool aAnonymize) override
   {
+    MOZ_ASSERT(NS_IsMainThread());
+
+    layers::CompositorManagerChild* manager = CompositorManagerChild::GetInstance();
+    if (!manager || !gfxPrefs::ImageMemDebugReporting()) {
+      layers::SharedSurfacesMemoryReport sharedSurfaces;
+      FinishCollectReports(aHandleReport, aData, aAnonymize, sharedSurfaces);
+      return NS_OK;
+    }
+
+    RefPtr<imgMemoryReporter> self(this);
+    nsCOMPtr<nsIHandleReportCallback> handleReport(aHandleReport);
+    nsCOMPtr<nsISupports> data(aData);
+    manager->SendReportSharedSurfacesMemory(
+      [=](layers::SharedSurfacesMemoryReport aReport) {
+        self->FinishCollectReports(handleReport, data, aAnonymize, aReport);
+      },
+      [=](mozilla::ipc::ResponseRejectReason aReason) {
+        layers::SharedSurfacesMemoryReport sharedSurfaces;
+        self->FinishCollectReports(handleReport, data, aAnonymize, sharedSurfaces);
+      }
+    );
+    return NS_OK;
+  }
+
+  void FinishCollectReports(nsIHandleReportCallback* aHandleReport,
+                            nsISupports* aData, bool aAnonymize,
+                            layers::SharedSurfacesMemoryReport& aSharedSurfaces)
+  {
     nsTArray<ImageMemoryCounter> chrome;
     nsTArray<ImageMemoryCounter> content;
     nsTArray<ImageMemoryCounter> uncached;
 
     for (uint32_t i = 0; i < mKnownLoaders.Length(); i++) {
       for (auto iter = mKnownLoaders[i]->mChromeCache.Iter(); !iter.Done(); iter.Next()) {
         imgCacheEntry* entry = iter.UserData();
         RefPtr<imgRequest> req = entry->GetRequest();
@@ -103,26 +133,35 @@ public:
         nsPtrHashKey<imgRequest>* entry = iter.Get();
         RefPtr<imgRequest> req = entry->GetKey();
         RecordCounterForRequest(req, &uncached, req->HasConsumers());
       }
     }
 
     // Note that we only need to anonymize content image URIs.
 
-    ReportCounterArray(aHandleReport, aData, chrome, "images/chrome");
+    ReportCounterArray(aHandleReport, aData, chrome, "images/chrome",
+                       /* aAnonymize */ false, aSharedSurfaces);
 
     ReportCounterArray(aHandleReport, aData, content, "images/content",
-                       aAnonymize);
+                       aAnonymize, aSharedSurfaces);
 
     // Uncached images may be content or chrome, so anonymize them.
     ReportCounterArray(aHandleReport, aData, uncached, "images/uncached",
-                       aAnonymize);
-
-    return NS_OK;
+                       aAnonymize, aSharedSurfaces);
+
+    // Report any shared surfaces that were not merged with the surface cache.
+    ImageMemoryReporter::ReportSharedSurfaces(aHandleReport, aData,
+                                              aSharedSurfaces);
+
+    nsCOMPtr<nsIMemoryReporterManager> imgr =
+      do_GetService("@mozilla.org/memory-reporter-manager;1");
+    if (imgr) {
+      imgr->EndReport();
+    }
   }
 
   static int64_t ImagesContentUsedUncompressedDistinguishedAmount()
   {
     size_t n = 0;
     for (uint32_t i = 0; i < imgLoader::sMemReporter->mKnownLoaders.Length();
          i++) {
       for (auto iter = imgLoader::sMemReporter->mKnownLoaders[i]->mCache.Iter();
@@ -201,17 +240,18 @@ private:
     MemoryCounter mUnusedVectorCounter;
   };
 
   // Reports all images of a single kind, e.g. all used chrome images.
   void ReportCounterArray(nsIHandleReportCallback* aHandleReport,
                           nsISupports* aData,
                           nsTArray<ImageMemoryCounter>& aCounterArray,
                           const char* aPathPrefix,
-                          bool aAnonymize = false)
+                          bool aAnonymize,
+                          layers::SharedSurfacesMemoryReport& aSharedSurfaces)
   {
     MemoryTotal summaryTotal;
     MemoryTotal nonNotableTotal;
 
     // Report notable images, and compute total and non-notable aggregate sizes.
     for (uint32_t i = 0; i < aCounterArray.Length(); i++) {
       ImageMemoryCounter& counter = aCounterArray[i];
 
@@ -225,36 +265,39 @@ private:
           counter.URI().Truncate(max);
           counter.URI().AppendLiteral(" (truncated)");
         }
         counter.URI().ReplaceChar('/', '\\');
       }
 
       summaryTotal += counter;
 
-      if (counter.IsNotable()) {
-        ReportImage(aHandleReport, aData, aPathPrefix, counter);
+      if (counter.IsNotable() || gfxPrefs::ImageMemDebugReporting()) {
+        ReportImage(aHandleReport, aData, aPathPrefix,
+                    counter, aSharedSurfaces);
       } else {
+        ImageMemoryReporter::TrimSharedSurfaces(counter, aSharedSurfaces);
         nonNotableTotal += counter;
       }
     }
 
     // Report non-notable images in aggregate.
     ReportTotal(aHandleReport, aData, /* aExplicit = */ true,
                 aPathPrefix, "<non-notable images>/", nonNotableTotal);
 
     // Report a summary in aggregate, outside of the explicit tree.
     ReportTotal(aHandleReport, aData, /* aExplicit = */ false,
                 aPathPrefix, "", summaryTotal);
   }
 
   static void ReportImage(nsIHandleReportCallback* aHandleReport,
                           nsISupports* aData,
                           const char* aPathPrefix,
-                          const ImageMemoryCounter& aCounter)
+                          const ImageMemoryCounter& aCounter,
+                          layers::SharedSurfacesMemoryReport& aSharedSurfaces)
   {
     nsAutoCString pathPrefix(NS_LITERAL_CSTRING("explicit/"));
     pathPrefix.Append(aPathPrefix);
     pathPrefix.Append(aCounter.Type() == imgIContainer::TYPE_RASTER
                         ? "/raster/"
                         : "/vector/");
     pathPrefix.Append(aCounter.IsUsed() ? "used/" : "unused/");
     pathPrefix.AppendLiteral("image(");
@@ -266,25 +309,26 @@ private:
     if (aCounter.URI().IsEmpty()) {
       pathPrefix.AppendLiteral("<unknown URI>");
     } else {
       pathPrefix.Append(aCounter.URI());
     }
 
     pathPrefix.AppendLiteral(")/");
 
-    ReportSurfaces(aHandleReport, aData, pathPrefix, aCounter);
+    ReportSurfaces(aHandleReport, aData, pathPrefix, aCounter, aSharedSurfaces);
 
     ReportSourceValue(aHandleReport, aData, pathPrefix, aCounter.Values());
   }
 
   static void ReportSurfaces(nsIHandleReportCallback* aHandleReport,
                              nsISupports* aData,
                              const nsACString& aPathPrefix,
-                             const ImageMemoryCounter& aCounter)
+                             const ImageMemoryCounter& aCounter,
+                             layers::SharedSurfacesMemoryReport& aSharedSurfaces)
   {
     for (const SurfaceMemoryCounter& counter : aCounter.Surfaces()) {
       nsAutoCString surfacePathPrefix(aPathPrefix);
       if (counter.IsLocked()) {
         surfacePathPrefix.AppendLiteral("locked/");
       } else {
         surfacePathPrefix.AppendLiteral("unlocked/");
       }
@@ -295,25 +339,33 @@ private:
         surfacePathPrefix.AppendLiteral("cannot_substitute/");
       }
       surfacePathPrefix.AppendLiteral("surface(");
       surfacePathPrefix.AppendInt(counter.Key().Size().width);
       surfacePathPrefix.AppendLiteral("x");
       surfacePathPrefix.AppendInt(counter.Key().Size().height);
 
       if (counter.Values().ExternalHandles() > 0) {
-        surfacePathPrefix.AppendLiteral(", external:");
+        surfacePathPrefix.AppendLiteral(", handles:");
         surfacePathPrefix.AppendInt(uint32_t(counter.Values().ExternalHandles()));
       }
 
+      ImageMemoryReporter::AppendSharedSurfacePrefix(surfacePathPrefix, counter,
+                                                     aSharedSurfaces);
+
       if (counter.Type() == SurfaceMemoryCounterType::NORMAL) {
         PlaybackType playback = counter.Key().Playback();
-        surfacePathPrefix.Append(playback == PlaybackType::eAnimated
-                                 ? " (animation)"
-                                 : "");
+        if (playback == PlaybackType::eAnimated) {
+          if (gfxPrefs::ImageMemDebugReporting()) {
+            surfacePathPrefix.AppendPrintf(" (animation %4u)",
+                                           uint32_t(counter.Values().FrameIndex()));
+          } else {
+            surfacePathPrefix.AppendLiteral(" (animation)");
+          }
+        }
 
         if (counter.Key().Flags() != DefaultSurfaceFlags()) {
           surfacePathPrefix.AppendLiteral(", flags:");
           surfacePathPrefix.AppendInt(uint32_t(counter.Key().Flags()),
                                       /* aRadix = */ 16);
         }
 
         if (counter.Key().SVGContext()) {
@@ -1354,17 +1406,17 @@ imgLoader::GetCacheQueue(const ImageCach
 
 void imgLoader::GlobalInit()
 {
   sCacheTimeWeight = gfxPrefs::ImageCacheTimeWeight() / 1000.0;
   int32_t cachesize = gfxPrefs::ImageCacheSize();
   sCacheMaxSize = cachesize > 0 ? cachesize : 0;
 
   sMemReporter = new imgMemoryReporter();
-  RegisterStrongMemoryReporter(sMemReporter);
+  RegisterStrongAsyncMemoryReporter(sMemReporter);
   RegisterImagesContentUsedUncompressedDistinguishedAmount(
     imgMemoryReporter::ImagesContentUsedUncompressedDistinguishedAmount);
 
   Telemetry::ScalarSet(Telemetry::ScalarID::IMAGES_WEBP_PROBE_OBSERVED, false);
   Telemetry::ScalarSet(Telemetry::ScalarID::IMAGES_WEBP_CONTENT_OBSERVED, false);
 }
 
 void imgLoader::ShutdownMemoryReporter()

--- a/image/imgRequest.cpp
+++ b/image/imgRequest.cpp
@@ -35,16 +35,17 @@
 #include "plstr.h" // PL_strcasestr(...)
 #include "prtime.h" // for PR_Now
 #include "nsNetUtil.h"
 #include "nsIProtocolHandler.h"
 #include "imgIRequest.h"
 #include "nsProperties.h"
 
 #include "mozilla/IntegerPrintfMacros.h"
+#include "mozilla/SizeOfState.h"
 #include "mozilla/Telemetry.h"
 
 using namespace mozilla;
 using namespace mozilla::image;
 
 #define LOG_TEST(level) (MOZ_LOG_TEST(gImgLog, (level)))
 
 NS_IMPL_ISUPPORTS(imgRequest,

--- a/image/moz.build
+++ b/image/moz.build
@@ -48,31 +48,36 @@ EXPORTS += [
     'imgLoader.h',
     'imgRequest.h',
     'imgRequestProxy.h',
     'IProgressObserver.h',
     'Orientation.h',
     'SurfaceCacheUtils.h',
 ]
 
+EXPORTS.mozilla.image += [
+    'ImageMemoryReporter.h',
+]
+
 UNIFIED_SOURCES += [
     'AnimationFrameBuffer.cpp',
     'AnimationSurfaceProvider.cpp',
     'ClippedImage.cpp',
     'DecodedSurfaceProvider.cpp',
     'DecodePool.cpp',
     'Decoder.cpp',
     'DecoderFactory.cpp',
     'DynamicImage.cpp',
     'FrameAnimator.cpp',
     'FrozenImage.cpp',
     'IDecodingTask.cpp',
     'Image.cpp',
     'ImageCacheKey.cpp',
     'ImageFactory.cpp',
+    'ImageMemoryReporter.cpp',
     'ImageOps.cpp',
     'ImageWrapper.cpp',
     'imgFrame.cpp',
     'imgLoader.cpp',
     'imgRequest.cpp',
     'imgRequestProxy.cpp',
     'imgTools.cpp',
     'MultipartImage.cpp',

--- a/js/src/builtin/TypedObject.cpp
+++ b/js/src/builtin/TypedObject.cpp
@@ -1413,26 +1413,38 @@ GlobalObject::initTypedObjectModule(JSCo
         return false;
     JS_FOR_EACH_REFERENCE_TYPE_REPR(BINARYDATA_REFERENCE_DEFINE)
 #undef BINARYDATA_REFERENCE_DEFINE
 
     // Tuck away descriptors we will use for wasm.
 
     RootedValue typeDescr(cx);
 
-    MOZ_ALWAYS_TRUE(JS_GetProperty(cx, module, "int32", &typeDescr));
+    // The lookups should fail only from atomization-related OOM in
+    // JS_GetProperty().  The properties themselves will always exist on the
+    // object.
+
+    if (!JS_GetProperty(cx, module, "int32", &typeDescr)) {
+        return false;
+    }
     module->initReservedSlot(TypedObjectModuleObject::Int32Desc, typeDescr);
 
-    MOZ_ALWAYS_TRUE(JS_GetProperty(cx, module, "float32", &typeDescr));
+    if (!JS_GetProperty(cx, module, "float32", &typeDescr)) {
+        return false;
+    }
     module->initReservedSlot(TypedObjectModuleObject::Float32Desc, typeDescr);
 
-    MOZ_ALWAYS_TRUE(JS_GetProperty(cx, module, "float64", &typeDescr));
+    if (!JS_GetProperty(cx, module, "float64", &typeDescr)) {
+        return false;
+    }
     module->initReservedSlot(TypedObjectModuleObject::Float64Desc, typeDescr);
 
-    MOZ_ALWAYS_TRUE(JS_GetProperty(cx, module, "Object", &typeDescr));
+    if (!JS_GetProperty(cx, module, "Object", &typeDescr)) {
+        return false;
+    }
     module->initReservedSlot(TypedObjectModuleObject::ObjectDesc, typeDescr);
 
     // ArrayType.
 
     RootedObject arrayType(cx);
     arrayType = DefineMetaTypeDescr<ArrayMetaTypeDescr>(
         cx, "ArrayType", global, module, TypedObjectModuleObject::ArrayTypePrototype);
     if (!arrayType) {

--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -2072,20 +2072,20 @@ JS_GetOwnPropertyDescriptor(JSContext* c
     if (!atom) {
         return false;
     }
     RootedId id(cx, AtomToId(atom));
     return JS_GetOwnPropertyDescriptorById(cx, obj, id, desc);
 }
 
 JS_PUBLIC_API(bool)
-JS_GetOwnUCPropertyDescriptor(JSContext* cx, HandleObject obj, const char16_t* name,
+JS_GetOwnUCPropertyDescriptor(JSContext* cx, HandleObject obj, const char16_t* name, size_t namelen,
                               MutableHandle<PropertyDescriptor> desc)
 {
-    JSAtom* atom = AtomizeChars(cx, name, js_strlen(name));
+    JSAtom* atom = AtomizeChars(cx, name, namelen);
     if (!atom) {
         return false;
     }
     RootedId id(cx, AtomToId(atom));
     return JS_GetOwnPropertyDescriptorById(cx, obj, id, desc);
 }
 
 JS_PUBLIC_API(bool)
@@ -2100,17 +2100,29 @@ JS_PUBLIC_API(bool)
 JS_GetPropertyDescriptor(JSContext* cx, HandleObject obj, const char* name,
                          MutableHandle<PropertyDescriptor> desc)
 {
     JSAtom* atom = Atomize(cx, name, strlen(name));
     if (!atom) {
         return false;
     }
     RootedId id(cx, AtomToId(atom));
-    return atom && JS_GetPropertyDescriptorById(cx, obj, id, desc);
+    return JS_GetPropertyDescriptorById(cx, obj, id, desc);
+}
+
+JS_PUBLIC_API(bool)
+JS_GetUCPropertyDescriptor(JSContext* cx, HandleObject obj, const char16_t* name, size_t namelen,
+                           MutableHandle<PropertyDescriptor> desc)
+{
+    JSAtom* atom = AtomizeChars(cx, name, namelen);
+    if (!atom) {
+        return false;
+    }
+    RootedId id(cx, AtomToId(atom));
+    return JS_GetPropertyDescriptorById(cx, obj, id, desc);
 }
 
 static bool
 DefinePropertyByDescriptor(JSContext* cx, HandleObject obj, HandleId id,
                            Handle<PropertyDescriptor> desc, ObjectOpResult& result)
 {
     AssertHeapIsIdle();
     CHECK_THREAD(cx);

--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -2174,33 +2174,37 @@ extern JS_PUBLIC_API(bool)
 JS_GetOwnPropertyDescriptorById(JSContext* cx, JS::HandleObject obj, JS::HandleId id,
                                 JS::MutableHandle<JS::PropertyDescriptor> desc);
 
 extern JS_PUBLIC_API(bool)
 JS_GetOwnPropertyDescriptor(JSContext* cx, JS::HandleObject obj, const char* name,
                             JS::MutableHandle<JS::PropertyDescriptor> desc);
 
 extern JS_PUBLIC_API(bool)
-JS_GetOwnUCPropertyDescriptor(JSContext* cx, JS::HandleObject obj, const char16_t* name,
+JS_GetOwnUCPropertyDescriptor(JSContext* cx, JS::HandleObject obj, const char16_t* name, size_t namelen,
                               JS::MutableHandle<JS::PropertyDescriptor> desc);
 
 /**
  * Like JS_GetOwnPropertyDescriptorById, but also searches the prototype chain
  * if no own property is found directly on obj. The object on which the
  * property is found is returned in desc.object(). If the property is not found
  * on the prototype chain, this returns true with desc.object() set to null.
  */
 extern JS_PUBLIC_API(bool)
 JS_GetPropertyDescriptorById(JSContext* cx, JS::HandleObject obj, JS::HandleId id,
                              JS::MutableHandle<JS::PropertyDescriptor> desc);
 
 extern JS_PUBLIC_API(bool)
 JS_GetPropertyDescriptor(JSContext* cx, JS::HandleObject obj, const char* name,
                          JS::MutableHandle<JS::PropertyDescriptor> desc);
 
+extern JS_PUBLIC_API(bool)
+JS_GetUCPropertyDescriptor(JSContext* cx, JS::HandleObject obj, const char16_t* name, size_t namelen,
+                           JS::MutableHandle<JS::PropertyDescriptor> desc);
+
 /**
  * Define a property on obj.
  *
  * This function uses JS::ObjectOpResult to indicate conditions that ES6
  * specifies as non-error failures. This is inconvenient at best, so use this
  * function only if you are implementing a proxy handler's defineProperty()
  * method. For all other purposes, use one of the many DefineProperty functions
  * below that throw an exception in all failure cases.

--- a/js/src/jsdate.cpp
+++ b/js/src/jsdate.cpp
@@ -1145,20 +1145,23 @@ ParseDate(const CharT* s, size_t length,
     int year = -1;
     int mon = -1;
     int mday = -1;
     int hour = -1;
     int min = -1;
     int sec = -1;
     int tzOffset = -1;
 
+    // One of '+', '-', ':', '/', or 0 (the default value).
     int prevc = 0;
 
     bool seenPlusMinus = false;
     bool seenMonthName = false;
+    bool seenFullYear = false;
+    bool negativeYear = false;
 
     size_t i = 0;
     while (i < length) {
         int c = s[i];
         i++;
         if (c <= ' ' || c == ',' || c == '-') {
             if (c == '-' && '0' <= s[i] && s[i] <= '9') {
                 prevc = c;
@@ -1176,44 +1179,58 @@ ParseDate(const CharT* s, size_t length,
                     if (--depth <= 0) {
                         break;
                     }
                 }
             }
             continue;
         }
         if ('0' <= c && c <= '9') {
+            size_t partStart = i - 1;
             int n = c - '0';
             while (i < length && '0' <= (c = s[i]) && c <= '9') {
                 n = n * 10 + c - '0';
                 i++;
             }
+            size_t partLength = i - partStart;
 
             /*
              * Allow TZA before the year, so 'Wed Nov 05 21:49:11 GMT-0800 1997'
              * works.
              *
              * Uses of seenPlusMinus allow ':' in TZA, so Java no-timezone style
              * of GMT+4:30 works.
              */
 
-            if ((prevc == '+' || prevc == '-')/*  && year>=0 */) {
+            if (prevc == '-' && (tzOffset != 0 || seenPlusMinus) && partLength >= 4 && year < 0) {
+                // Parse as a negative, possibly zero-padded year if
+                // 1. the preceding character is '-',
+                // 2. the TZA is not 'GMT' (tested by |tzOffset != 0|),
+                // 3. or a TZA was already parsed |seenPlusMinus == true|,
+                // 4. the part length is at least 4 (to parse '-08' as a TZA),
+                // 5. and we did not already parse a year |year < 0|.
+                year = n;
+                seenFullYear = true;
+                negativeYear = true;
+            } else if ((prevc == '+' || prevc == '-')/*  && year>=0 */) {
                 /* Make ':' case below change tzOffset. */
                 seenPlusMinus = true;
 
                 /* offset */
                 if (n < 24) {
                     n = n * 60; /* EG. "GMT-3" */
                 } else {
                     n = n % 100 + n / 100 * 60; /* eg "GMT-0430" */
                 }
 
                 if (prevc == '+')       /* plus means east of GMT */
                     n = -n;
 
+                // Reject if not preceded by 'GMT' or if a time zone offset
+                // was already parsed.
                 if (tzOffset != 0 && tzOffset != -1) {
                     return false;
                 }
 
                 tzOffset = n;
             } else if (prevc == '/' && mon >= 0 && mday >= 0 && year < 0) {
                 if (c <= ' ' || c == ',' || c == '/' || i >= length) {
                     year = n;
@@ -1253,16 +1270,17 @@ ParseDate(const CharT* s, size_t length,
             } else if (prevc == ':' && min >= 0 && sec < 0) {
                 sec = /*byte*/ n;
             } else if (mon < 0) {
                 mon = /*byte*/n;
             } else if (mon >= 0 && mday < 0) {
                 mday = /*byte*/ n;
             } else if (mon >= 0 && mday >= 0 && year < 0) {
                 year = n;
+                seenFullYear = partLength >= 4;
             } else {
                 return false;
             }
             prevc = 0;
         } else if (c == '/' || c == ':' || c == '+' || c == '-') {
             prevc = c;
         } else {
             size_t st = i - 1;
@@ -1343,70 +1361,70 @@ ParseDate(const CharT* s, size_t length,
     /*
      * Case 1. The input string contains an English month name.
      *         The form of the string can be month f l, or f month l, or
      *         f l month which each evaluate to the same date.
      *         If f and l are both greater than or equal to 100 the date
      *         is invalid.
      *
      *         The year is taken to be either the greater of the values f, l or
-     *         whichever is set to zero. If the year is greater than or equal to
-     *         50 and less than 100, it is considered to be the number of years
-     *         after 1900. If the year is less than 50 it is considered to be the
-     *         number of years after 2000, otherwise it is considered to be the
-     *         number of years after 0.
+     *         whichever is set to zero.
      *
      * Case 2. The input string is of the form "f/m/l" where f, m and l are
      *         integers, e.g. 7/16/45. mon, mday and year values are adjusted
      *         to achieve Chrome compatibility.
      *
      *         a. If 0 < f <= 12 and 0 < l <= 31, f/m/l is interpreted as
      *         month/day/year.
-     *            i.  If year < 50, it is the number of years after 2000
-     *            ii. If year >= 50, it is the number of years after 1900.
-     *           iii. If year >= 100, it is the number of years after 0.
      *         b. If 31 < f and 0 < m <= 12 and 0 < l <= 31 f/m/l is
      *         interpreted as year/month/day
-     *            i.  If year < 50, it is the number of years after 2000
-     *            ii. If year >= 50, it is the number of years after 1900.
-     *           iii. If year >= 100, it is the number of years after 0.
      */
     if (seenMonthName) {
         if (mday >= 100 && mon >= 100) {
             return false;
         }
 
-        if (year > 0 && (mday == 0 || mday > year)) {
+        if (year > 0 && (mday == 0 || mday > year) && !seenFullYear) {
             int temp = year;
             year = mday;
             mday = temp;
         }
 
         if (mday <= 0 || mday > 31) {
             return false;
         }
 
     } else if (0 < mon && mon <= 12 && 0 < mday && mday <= 31) {
         /* (a) month/day/year */
     } else {
         /* (b) year/month/day */
-        if (mon > 31 && mday <= 12 && year <= 31) {
+        if (mon > 31 && mday <= 12 && year <= 31 && !seenFullYear) {
             int temp = year;
             year = mon;
             mon = mday;
             mday = temp;
         } else {
             return false;
         }
     }
 
-    if (year < 50) {
-        year += 2000;
-    } else if (year >= 50 && year < 100) {
-        year += 1900;
+    // If the year is greater than or equal to 50 and less than 100, it is
+    // considered to be the number of years after 1900. If the year is less
+    // than 50 it is considered to be the number of years after 2000,
+    // otherwise it is considered to be the number of years after 0.
+    if (!seenFullYear) {
+        if (year < 50) {
+            year += 2000;
+        } else if (year >= 50 && year < 100) {
+            year += 1900;
+        }
+    }
+
+    if (negativeYear) {
+        year = -year;
     }
 
     mon -= 1; /* convert month to 0-based */
     if (sec < 0) {
         sec = 0;
     }
     if (min < 0) {
         min = 0;

--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -797,16 +797,19 @@ ShellInterruptCallback(JSContext* cx)
         } else {
             result = false;
         }
     } else {
         result = false;
     }
 
     if (!result && sc->exitCode == 0) {
+        static const char msg[] = "Script terminated by interrupt handler.\n";
+        fputs(msg, stderr);
+
         sc->exitCode = EXITCODE_TIMEOUT;
     }
 
     return result;
 }
 
 /*
  * Some UTF-8 files, notably those written using Notepad, have a Unicode
@@ -4240,21 +4243,16 @@ KillWorkerThreads(JSContext* cx)
 }
 
 static void
 CancelExecution(JSContext* cx)
 {
     ShellContext* sc = GetShellContext(cx);
     sc->serviceInterrupt = true;
     JS_RequestInterruptCallback(cx);
-
-    if (sc->haveInterruptFunc) {
-        static const char msg[] = "Script runs for too long, terminating.\n";
-        fputs(msg, stderr);
-    }
 }
 
 static bool
 SetTimeoutValue(JSContext* cx, double t)
 {
     if (mozilla::IsNaN(t)) {
         JS_ReportErrorASCII(cx, "timeout is not a number");
         return false;
@@ -8340,36 +8338,40 @@ JS_FN_HELP("parseBin", BinParse, 1, 0,
 "runOffThreadDecodedScript([jobID])",
 "  Wait for off-thread decoding to complete. The job ID can be ommitted if there\n"
 "  is only one job pending. If an error occurred, throw the appropriate\n"
 "  exception; otherwise, run the script and return its value."),
 
     JS_FN_HELP("timeout", Timeout, 1, 0,
 "timeout([seconds], [func])",
 "  Get/Set the limit in seconds for the execution time for the current context.\n"
-"  A negative value (default) means that the execution time is unlimited.\n"
-"  If a second argument is provided, it will be invoked when the timer elapses.\n"
-"  Calling this function will replace any callback set by |setInterruptCallback|.\n"),
+"  When the timeout expires the current interrupt callback is invoked.\n"
+"  The timeout is used just once.  If the callback returns a falsy value, the\n"
+"  script is aborted.  A negative value for seconds (this is the default) cancels\n"
+"  any pending timeout.\n"
+"  If a second argument is provided, it is installed as the interrupt handler,\n"
+"  exactly as if by |setInterruptCallback|.\n"),
 
     JS_FN_HELP("interruptIf", InterruptIf, 1, 0,
 "interruptIf(cond)",
 "  Requests interrupt callback if cond is true. If a callback function is set via\n"
 "  |timeout| or |setInterruptCallback|, it will be called. No-op otherwise."),
 
     JS_FN_HELP("invokeInterruptCallback", InvokeInterruptCallbackWrapper, 0, 0,
 "invokeInterruptCallback(fun)",
 "  Forcefully set the interrupt flag and invoke the interrupt handler. If a\n"
 "  callback function is set via |timeout| or |setInterruptCallback|, it will\n"
 "  be called. Before returning, fun is called with the return value of the\n"
 "  interrupt handler."),
 
     JS_FN_HELP("setInterruptCallback", SetInterruptCallback, 1, 0,
 "setInterruptCallback(func)",
 "  Sets func as the interrupt callback function.\n"
-"  Calling this function will replace any callback set by |timeout|.\n"),
+"  Calling this function will replace any callback set by |timeout|.\n"
+"  If the callback returns a falsy value, the script is aborted.\n"),
 
     JS_FN_HELP("setJitCompilerOption", SetJitCompilerOption, 2, 0,
 "setJitCompilerOption(<option>, <number>)",
 "  Set a compiler option indexed in JSCompileOption enum to a number.\n"),
 
     JS_FN_HELP("enableLastWarning", EnableLastWarning, 0, 0,
 "enableLastWarning()",
 "  Enable storing the last warning."),