Merge inbound to mozilla-central. a=merge
authorshindli <shindli@mozilla.com>
Thu, 19 Jul 2018 00:45:25 +0300
changeset 427173 5a8107262015714d2907a85abc24c847ad9b32d2
parent 427157 7ad45eaf20cade7c3e1f3e6022e619abff3f02d4 (current diff)
parent 427172 a1175f58a6a5b0abea9ade0f3e77a393a3e599f9 (diff)
child 427197 db6e5f2a79bcd63eafed0a49b969753b03af6c09
child 427236 81865036ea5fe72d202c2fefe663e5e202778595
push id34295
push usershindli@mozilla.com
push dateWed, 18 Jul 2018 21:45:46 +0000
treeherdermozilla-central@5a8107262015 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmerge
milestone63.0a1
first release with
nightly linux32
5a8107262015 / 63.0a1 / 20180718220144 / files
nightly linux64
5a8107262015 / 63.0a1 / 20180718220144 / files
nightly mac
5a8107262015 / 63.0a1 / 20180718220144 / files
nightly win32
5a8107262015 / 63.0a1 / 20180718220144 / files
nightly win64
5a8107262015 / 63.0a1 / 20180718220144 / files
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
releases
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Merge inbound to mozilla-central. a=merge
dom/webidl/ListBoxObject.webidl
dom/xbl/crashtests/404125-1.xhtml
dom/xbl/crashtests/415301-1.xul
dom/xbl/crashtests/463511-1.xhtml
layout/base/crashtests/354771-1.xul
layout/base/crashtests/373919.xhtml
layout/base/crashtests/376223-1.xhtml
layout/base/crashtests/383102-1.xhtml
layout/base/crashtests/383806-1.xhtml
layout/base/crashtests/400185-1.xul
layout/base/crashtests/414175-1.xul
layout/base/crashtests/428113.xhtml
layout/base/crashtests/514104-1.xul
layout/generic/crashtests/363848-1.xhtml
layout/generic/crashtests/472957.xhtml
layout/generic/crashtests/494300-1.xul
layout/generic/crashtests/547338.xul
layout/reftests/bugs/486848-1-ref.xul
layout/reftests/bugs/486848-1.xul
layout/reftests/bugs/498228-1-ref.xul
layout/reftests/bugs/498228-1.xul
layout/xul/ListBoxObject.cpp
layout/xul/ListBoxObject.h
layout/xul/crashtests/265161-1.xul
layout/xul/crashtests/326834-1-inner.xul
layout/xul/crashtests/326834-1.html
layout/xul/crashtests/360642-1.xul
layout/xul/crashtests/383236-1.xul
layout/xul/crashtests/384491-1.xhtml
layout/xul/crashtests/394120-1.xhtml
layout/xul/crashtests/397293.xhtml
layout/xul/crashtests/397304-1.html
layout/xul/crashtests/398326-1.xhtml
layout/xul/crashtests/400779-1.xhtml
layout/xul/crashtests/415394-1.xhtml
layout/xul/crashtests/420424-1.xul
layout/xul/crashtests/431738.xhtml
layout/xul/crashtests/432058-1.xul
layout/xul/crashtests/432068-1.xul
layout/xul/crashtests/432068-2.xul
layout/xul/crashtests/433296-1.xul
layout/xul/crashtests/433429.xul
layout/xul/crashtests/464149-1.xul
layout/xul/crashtests/467481-1.xul
layout/xul/crashtests/488210-1.xhtml
layout/xul/crashtests/495728-1.xul
layout/xul/crashtests/508927-1.xul
layout/xul/crashtests/508927-2.xul
layout/xul/crashtests/514300-1.xul
layout/xul/crashtests/536931-1.xhtml
layout/xul/grid/crashtests/306911-crash.xul
layout/xul/grid/crashtests/321073-1.xul
layout/xul/grid/crashtests/382750-1.xul
layout/xul/grid/crashtests/400790-1.xul
layout/xul/nsIListBoxObject.idl
layout/xul/nsListBoxBodyFrame.cpp
layout/xul/nsListBoxBodyFrame.h
layout/xul/nsListBoxLayout.cpp
layout/xul/nsListBoxLayout.h
layout/xul/nsListItemFrame.cpp
layout/xul/nsListItemFrame.h
layout/xul/nsPIListBoxObject.h
testing/web-platform/meta/content-security-policy/media-src/media-src-7_3_2.sub.html.ini
testing/web-platform/meta/content-security-policy/reporting/report-strips-fragment.html.ini
testing/web-platform/meta/content-security-policy/securitypolicyviolation/inside-dedicated-worker.html.ini
testing/web-platform/meta/content-security-policy/securitypolicyviolation/inside-service-worker.https.html.ini
testing/web-platform/meta/content-security-policy/securitypolicyviolation/inside-shared-worker.html.ini
testing/web-platform/meta/content-security-policy/securitypolicyviolation/securitypolicyviolation-block-cross-origin-image-from-script.sub.html.ini
testing/web-platform/meta/content-security-policy/securitypolicyviolation/securitypolicyviolation-block-cross-origin-image.sub.html.ini
testing/web-platform/meta/content-security-policy/securitypolicyviolation/securitypolicyviolation-block-image-from-script.sub.html.ini
toolkit/themes/linux/global/listbox.css
toolkit/themes/osx/global/checkbox/cbox-check-dis.gif
toolkit/themes/osx/global/listbox.css
toolkit/themes/windows/global/listbox.css
--- a/accessible/atk/XULListboxAccessibleWrap.h
+++ b/accessible/atk/XULListboxAccessibleWrap.h
@@ -8,14 +8,13 @@
 #define mozilla_a11y_XULListboxAccessibleWrap_h__
 
 #include "XULListboxAccessible.h"
 
 namespace mozilla {
 namespace a11y {
 
 typedef class XULListboxAccessible XULListboxAccessibleWrap;
-typedef class XULListCellAccessible XULListCellAccessibleWrap;
 
 } // namespace a11y
 } // namespace mozilla
 
 #endif
--- a/accessible/base/Role.h
+++ b/accessible/base/Role.h
@@ -196,18 +196,18 @@ enum Role {
   COLUMN = 27,
 
   /**
    * Represents a row of cells within a table. Also, see TABLE.
    */
   ROW = 28,
 
   /**
-   * Represents a cell within a table. It is used for html:td,
-   * xul:tree cell and xul:listcell. Also, see TABLE.
+   * Represents a cell within a table. It is used for html:td and xul:tree cell.
+   * Also, see TABLE.
    */
   CELL = 29,
 
   /**
    * Represents a link to something else. This object might look like text or
    * a graphic, but it acts like a button. It is used for
    * xul:label@class="text-link", html:a, html:area.
    */
--- a/accessible/base/XULMap.h
+++ b/accessible/base/XULMap.h
@@ -6,20 +6,17 @@ XULMAP_TYPE(browser, OuterDocAccessible)
 XULMAP_TYPE(button, XULButtonAccessible)
 XULMAP_TYPE(checkbox, XULCheckboxAccessible)
 XULMAP_TYPE(description, XULLabelAccessible)
 XULMAP_TYPE(dropMarker, XULDropmarkerAccessible)
 XULMAP_TYPE(editor, OuterDocAccessible)
 XULMAP_TYPE(findbar, XULToolbarAccessible)
 XULMAP_TYPE(groupbox, XULGroupboxAccessible)
 XULMAP_TYPE(iframe, OuterDocAccessible)
-XULMAP_TYPE(listbox, XULListboxAccessibleWrap)
-XULMAP_TYPE(listhead, XULColumAccessible)
-XULMAP_TYPE(listheader, XULColumnItemAccessible)
-XULMAP_TYPE(listitem, XULListitemAccessible)
+XULMAP_TYPE(listheader, XULColumAccessible)
 XULMAP_TYPE(menu, XULMenuitemAccessibleWrap)
 XULMAP_TYPE(menubar, XULMenubarAccessible)
 XULMAP_TYPE(menucaption, XULMenuitemAccessibleWrap)
 XULMAP_TYPE(menuitem, XULMenuitemAccessibleWrap)
 XULMAP_TYPE(menulist, XULComboboxAccessible)
 XULMAP_TYPE(menuseparator, XULMenuSeparatorAccessible)
 XULMAP_TYPE(notification, XULAlertAccessible)
 XULMAP_TYPE(progressmeter, XULProgressMeterAccessible)
@@ -78,36 +75,16 @@ XULMAP(
       return nullptr;
     }
 
     return new ImageAccessibleWrap(aElement, aContext->Document());
   }
 )
 
 XULMAP(
-  listcell,
-  [](Element* aElement, Accessible* aContext) -> Accessible* {
-    // Only create cells if there's more than one per row.
-    nsIContent* listItem = aElement->GetParent();
-    if (!listItem) {
-      return nullptr;
-    }
-
-    for (nsIContent* child = listItem->GetFirstChild(); child;
-         child = child->GetNextSibling()) {
-      if (child->IsXULElement(nsGkAtoms::listcell) && child != aElement) {
-        return new XULListCellAccessibleWrap(aElement, aContext->Document());
-      }
-    }
-
-    return nullptr;
-  }
-)
-
-XULMAP(
   menupopup,
   [](Element* aElement, Accessible* aContext) {
     return CreateMenupopupAccessible(aElement, aContext);
   }
 )
 
 XULMAP(
   panel,
--- a/accessible/interfaces/nsIAccessibleRole.idl
+++ b/accessible/interfaces/nsIAccessibleRole.idl
@@ -189,18 +189,18 @@ interface nsIAccessibleRole : nsISupport
   const unsigned long ROLE_COLUMN = 27;
 
   /**
    * Represents a row of cells within a table. Also, see ROLE_TABLE.
    */
   const unsigned long ROLE_ROW = 28;
 
   /**
-   * Represents a cell within a table. It is used for html:td,
-   * xul:tree cell and xul:listcell. Also, see ROLE_TABLE.
+   * Represents a cell within a table. It is used for html:td and xul:tree cell.
+   * Also, see ROLE_TABLE.
    */
   const unsigned long ROLE_CELL = 29;
 
   /**
    * Represents a link to something else. This object might look like text or
    * a graphic, but it acts like a button. It is used for
    * xul:label@class="text-link", html:a, html:area.
    */
--- a/accessible/mac/XULListboxAccessibleWrap.h
+++ b/accessible/mac/XULListboxAccessibleWrap.h
@@ -7,14 +7,13 @@
 #define mozilla_a11y_XULListboxAccessibleWrap_h__
 
 #include "XULListboxAccessible.h"
 
 namespace mozilla {
 namespace a11y {
 
 typedef class XULListboxAccessible XULListboxAccessibleWrap;
-typedef class XULListCellAccessible XULListCellAccessibleWrap;
 
 } // namespace a11y
 } // namespace mozilla
 
 #endif
--- a/accessible/other/XULListboxAccessibleWrap.h
+++ b/accessible/other/XULListboxAccessibleWrap.h
@@ -7,14 +7,13 @@
 #define mozilla_a11y_XULListboxAccessibleWrap_h__
 
 #include "XULListboxAccessible.h"
 
 namespace mozilla {
 namespace a11y {
 
 typedef class XULListboxAccessible XULListboxAccessibleWrap;
-typedef class XULListCellAccessible XULListCellAccessibleWrap;
 
 } // namespace a11y
 } // namespace mozilla
 
 #endif
--- a/accessible/windows/msaa/XULListboxAccessibleWrap.cpp
+++ b/accessible/windows/msaa/XULListboxAccessibleWrap.cpp
@@ -23,26 +23,8 @@ IMPL_IUNKNOWN_QUERY_CLASS(AccessibleWrap
 IMPL_IUNKNOWN_QUERY_TAIL
 
 void
 XULListboxAccessibleWrap::Shutdown()
 {
   ia2AccessibleTable::mTable = nullptr;
   XULListboxAccessible::Shutdown();
 }
-
-////////////////////////////////////////////////////////////////////////////////
-// XULListCellAccessibleWrap
-////////////////////////////////////////////////////////////////////////////////
-
-NS_IMPL_ISUPPORTS_INHERITED0(XULListCellAccessibleWrap,
-                             XULListCellAccessible)
-
-IMPL_IUNKNOWN_INHERITED1(XULListCellAccessibleWrap,
-                         HyperTextAccessibleWrap,
-                         ia2AccessibleTableCell)
-
-void
-XULListCellAccessibleWrap::Shutdown()
-{
-  ia2AccessibleTableCell::mTableCell = nullptr;
-  XULListCellAccessible::Shutdown();
-}
--- a/accessible/windows/msaa/XULListboxAccessibleWrap.h
+++ b/accessible/windows/msaa/XULListboxAccessibleWrap.h
@@ -31,34 +31,12 @@ public:
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   virtual void Shutdown() override;
 };
 
-/**
- * IA2 wrapper class for XULListCellAccessible class, implements
- * IAccessibleTableCell interface.
- */
-class XULListCellAccessibleWrap : public XULListCellAccessible,
-                                  public ia2AccessibleTableCell
-{
-  ~XULListCellAccessibleWrap() {}
-
-public:
-  XULListCellAccessibleWrap(nsIContent* aContent, DocAccessible* aDoc) :
-    XULListCellAccessible(aContent, aDoc), ia2AccessibleTableCell(this) {}
-
-  // IUnknown
-  DECL_IUNKNOWN_INHERITED
-
-  // nsISupports
-  NS_DECL_ISUPPORTS_INHERITED
-
-  virtual void Shutdown() override;
-};
-
 } // namespace a11y
 } // namespace mozilla
 
 #endif
--- a/accessible/xul/XULListboxAccessible.cpp
+++ b/accessible/xul/XULListboxAccessible.cpp
@@ -163,37 +163,17 @@ XULListboxAccessible::NativeRole() const
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // XULListboxAccessible: Table
 
 uint32_t
 XULListboxAccessible::ColCount() const
 {
-  nsIContent* headContent = nullptr;
-  for (nsIContent* childContent = mContent->GetFirstChild(); childContent;
-       childContent = childContent->GetNextSibling()) {
-    if (childContent->NodeInfo()->Equals(nsGkAtoms::listcols,
-                                         kNameSpaceID_XUL)) {
-      headContent = childContent;
-    }
-  }
-  if (!headContent)
-    return 0;
-
-  uint32_t columnCount = 0;
-  for (nsIContent* childContent = headContent->GetFirstChild(); childContent;
-       childContent = childContent->GetNextSibling()) {
-    if (childContent->NodeInfo()->Equals(nsGkAtoms::listcol,
-                                         kNameSpaceID_XUL)) {
-      columnCount++;
-    }
-  }
-
-  return columnCount;
+  return 0;
 }
 
 uint32_t
 XULListboxAccessible::RowCount()
 {
   nsCOMPtr<nsIDOMXULSelectControlElement> element(do_QueryInterface(mContent));
 
   uint32_t itemCount = 0;
@@ -564,31 +544,21 @@ XULListitemAccessible::Description(nsStr
 {
   AccessibleWrap::Description(aDesc);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // XULListitemAccessible: Accessible
 
 /**
-  * If there is a Listcell as a child ( not anonymous ) use it, otherwise
-  *   default to getting the name from GetXULName
-  */
+ * Get the name from GetXULName.
+ */
 ENameValueFlag
 XULListitemAccessible::NativeName(nsString& aName) const
 {
-  nsIContent* childContent = mContent->GetFirstChild();
-  if (childContent) {
-    if (childContent->NodeInfo()->Equals(nsGkAtoms::listcell,
-                                         kNameSpaceID_XUL)) {
-      childContent->AsElement()->GetAttr(kNameSpaceID_None, nsGkAtoms::label, aName);
-      return eNameOK;
-    }
-  }
-
   return Accessible::NativeName(aName);
 }
 
 role
 XULListitemAccessible::NativeRole() const
 {
   Accessible* list = GetListAccessible();
   if (!list) {
@@ -654,151 +624,8 @@ XULListitemAccessible::ActionNameAt(uint
 ////////////////////////////////////////////////////////////////////////////////
 // XULListitemAccessible: Widgets
 
 Accessible*
 XULListitemAccessible::ContainerWidget() const
 {
   return Parent();
 }
-
-
-////////////////////////////////////////////////////////////////////////////////
-// XULListCellAccessible
-////////////////////////////////////////////////////////////////////////////////
-
-XULListCellAccessible::
-  XULListCellAccessible(nsIContent* aContent, DocAccessible* aDoc) :
-  HyperTextAccessibleWrap(aContent, aDoc)
-{
-  mGenericTypes |= eTableCell;
-}
-
-////////////////////////////////////////////////////////////////////////////////
-// nsISupports
-
-////////////////////////////////////////////////////////////////////////////////
-// XULListCellAccessible: TableCell
-
-TableAccessible*
-XULListCellAccessible::Table() const
-{
-  Accessible* thisRow = Parent();
-  if (!thisRow || thisRow->Role() != roles::ROW)
-    return nullptr;
-
-  Accessible* table = thisRow->Parent();
-  if (!table || table->Role() != roles::TABLE)
-    return nullptr;
-
-  return table->AsTable();
-}
-
-uint32_t
-XULListCellAccessible::ColIdx() const
-{
-  Accessible* row = Parent();
-  if (!row)
-    return 0;
-
-  int32_t indexInRow = IndexInParent();
-  uint32_t colIdx = 0;
-  for (int32_t idx = 0; idx < indexInRow; idx++) {
-    Accessible* cell = row->GetChildAt(idx);
-    roles::Role role = cell->Role();
-    if (role == roles::CELL || role == roles::GRID_CELL ||
-        role == roles::ROWHEADER || role == roles::COLUMNHEADER)
-      colIdx++;
-  }
-
-  return colIdx;
-}
-
-uint32_t
-XULListCellAccessible::RowIdx() const
-{
-  Accessible* row = Parent();
-  if (!row)
-    return 0;
-
-  Accessible* table = row->Parent();
-  if (!table)
-    return 0;
-
-  int32_t indexInTable = row->IndexInParent();
-  uint32_t rowIdx = 0;
-  for (int32_t idx = 0; idx < indexInTable; idx++) {
-    row = table->GetChildAt(idx);
-    if (row->Role() == roles::ROW)
-      rowIdx++;
-  }
-
-  return rowIdx;
-}
-
-void
-XULListCellAccessible::ColHeaderCells(nsTArray<Accessible*>* aCells)
-{
-  TableAccessible* table = Table();
-  NS_ASSERTION(table, "cell not in a table!");
-  if (!table)
-    return;
-
-  // Get column header cell from XUL listhead.
-  Accessible* list = nullptr;
-
-  Accessible* tableAcc = table->AsAccessible();
-  uint32_t tableChildCount = tableAcc->ChildCount();
-  for (uint32_t childIdx = 0; childIdx < tableChildCount; childIdx++) {
-    Accessible* child = tableAcc->GetChildAt(childIdx);
-    if (child->Role() == roles::LIST) {
-      list = child;
-      break;
-    }
-  }
-
-  if (list) {
-    Accessible* headerCell = list->GetChildAt(ColIdx());
-    if (headerCell) {
-      aCells->AppendElement(headerCell);
-      return;
-    }
-  }
-
-  // No column header cell from XUL markup, try to get it from ARIA markup.
-  TableCellAccessible::ColHeaderCells(aCells);
-}
-
-bool
-XULListCellAccessible::Selected()
-{
-  TableAccessible* table = Table();
-  NS_ENSURE_TRUE(table, false); // we expect to be in a listbox (table)
-
-  return table->IsRowSelected(RowIdx());
-}
-
-////////////////////////////////////////////////////////////////////////////////
-// XULListCellAccessible. Accessible implementation
-
-role
-XULListCellAccessible::NativeRole() const
-{
-  return roles::CELL;
-}
-
-already_AddRefed<nsIPersistentProperties>
-XULListCellAccessible::NativeAttributes()
-{
-  nsCOMPtr<nsIPersistentProperties> attributes =
-    HyperTextAccessibleWrap::NativeAttributes();
-
-  // "table-cell-index" attribute
-  TableAccessible* table = Table();
-  if (!table) // we expect to be in a listbox (table)
-    return attributes.forget();
-
-  nsAutoString stringIdx;
-  stringIdx.AppendInt(table->CellIndexAt(RowIdx(), ColIdx()));
-  nsAccUtils::SetAccAttr(attributes, nsGkAtoms::tableCellIndex, stringIdx);
-
-  return attributes.forget();
-}
--- a/accessible/xul/XULListboxAccessible.h
+++ b/accessible/xul/XULListboxAccessible.h
@@ -14,31 +14,31 @@
 #include "XULMenuAccessible.h"
 #include "XULSelectControlAccessible.h"
 
 namespace mozilla {
 namespace a11y {
 
 /**
  * XULColumAccessible are accessible for list and tree columns elements
- * (xul:treecols and xul:listcols).
+ * (xul:treecols and xul:listheader).
  */
 class XULColumAccessible : public AccessibleWrap
 {
 public:
   XULColumAccessible(nsIContent* aContent, DocAccessible* aDoc);
 
   // Accessible
   virtual a11y::role NativeRole() const override;
   virtual uint64_t NativeState() const override;
 };
 
 /**
  * XULColumnItemAccessible are accessibles for list and tree column elements
- * (xul:listcol and xul:treecol).
+ * (xul:treecol).
  */
 class XULColumnItemAccessible : public LeafAccessible
 {
 public:
   XULColumnItemAccessible(nsIContent* aContent, DocAccessible* aDoc);
 
   // Accessible
   virtual a11y::role NativeRole() const override;
@@ -135,41 +135,12 @@ protected:
    * Return listbox accessible for the listitem.
    */
   Accessible* GetListAccessible() const;
 
 private:
   bool mIsCheckbox;
 };
 
-/**
- * Class represents xul:listcell.
- */
-class XULListCellAccessible : public HyperTextAccessibleWrap,
-                              public TableCellAccessible
-{
-public:
-  XULListCellAccessible(nsIContent* aContent, DocAccessible* aDoc);
-
-  // nsISupports
-  NS_INLINE_DECL_REFCOUNTING_INHERITED(XULListCellAccessible,
-                                       HyperTextAccessibleWrap)
-
-  // Accessible
-  virtual TableCellAccessible* AsTableCell() override { return this; }
-  virtual already_AddRefed<nsIPersistentProperties> NativeAttributes() override;
-  virtual a11y::role NativeRole() const override;
-
-  // TableCellAccessible
-  virtual TableAccessible* Table() const override;
-  virtual uint32_t ColIdx() const override;
-  virtual uint32_t RowIdx() const override;
-  virtual void ColHeaderCells(nsTArray<Accessible*>* aHeaderCells) override;
-  virtual bool Selected() override;
-
-protected:
-  virtual ~XULListCellAccessible() {}
-};
-
 } // namespace a11y
 } // namespace mozilla
 
 #endif
--- a/browser/base/content/aboutNetError.js
+++ b/browser/base/content/aboutNetError.js
@@ -173,17 +173,16 @@ function initPage() {
       // eslint-disable-next-line no-unsanitized/property
       sd.innerHTML = errDesc.innerHTML;
     } else {
       sd.textContent = getDescription();
     }
   }
   if (showCaptivePortalUI) {
     initPageCaptivePortal();
-    updateContainerPosition();
     return;
   }
   if (gIsCertError) {
     initPageCertError();
     updateContainerPosition();
     return;
   }
   addAutofocus("errorTryAgain");
@@ -290,17 +289,16 @@ function initPage() {
     // again won't help.
     document.getElementById("errorTryAgain").style.display = "none";
 
     var container = document.getElementById("errorLongDesc");
     for (var span of container.querySelectorAll("span.hostname")) {
       span.textContent = document.location.hostname;
     }
   }
-  updateContainerPosition();
 }
 
 function updateContainerPosition() {
   let textContainer = document.getElementById("text-container");
   textContainer.style.marginTop = `calc(50vh - ${textContainer.clientHeight / 2}px)`;
 }
 
 function initPageCaptivePortal() {
--- a/browser/components/preferences/in-content/tests/browser.ini
+++ b/browser/components/preferences/in-content/tests/browser.ini
@@ -4,17 +4,16 @@ prefs =
   extensions.formautofill.creditCards.available=true
 support-files =
   head.js
   privacypane_tests_perwindow.js
   addons/set_homepage.xpi
   addons/set_newtab.xpi
 
 [browser_applications_selection.js]
-skip-if = os == 'linux' || verify # bug 1382057
 [browser_advanced_update.js]
 skip-if = !updater
 [browser_basic_rebuild_fonts_test.js]
 [browser_bug410900.js]
 [browser_bug731866.js]
 [browser_search_no_results_change_category.js]
 [browser_search_within_preferences_1.js]
 [browser_search_within_preferences_2.js]
@@ -31,19 +30,17 @@ skip-if = !updater
 [browser_bug795764_cachedisabled.js]
 [browser_bug1018066_resetScrollPosition.js]
 [browser_bug1020245_openPreferences_to_paneContent.js]
 [browser_bug1184989_prevent_scrolling_when_preferences_flipped.js]
 [browser_engines.js]
 support-files =
   browser_bug1184989_prevent_scrolling_when_preferences_flipped.xul
 [browser_change_app_handler.js]
-skip-if = os != "win" || (os == "win" && os_version == "6.1") || (verify && debug)
-# This test tests the windows-specific app selection dialog, so can't run on non-Windows.
-# Skip the test on Window 7, see the detail at Bug 1381706.
+skip-if = os != "win" # Windows-specific handler application selection dialog
 [browser_checkspelling.js]
 [browser_connection.js]
 [browser_connection_bug388287.js]
 [browser_connection_bug1445991.js]
 skip-if = (verify && debug && (os == 'linux' || os == 'mac'))
 [browser_cookies_exceptions.js]
 [browser_defaultbrowser_alwayscheck.js]
 [browser_healthreport.js]
--- a/browser/components/preferences/in-content/tests/browser_applications_selection.js
+++ b/browser/components/preferences/in-content/tests/browser_applications_selection.js
@@ -25,59 +25,46 @@ add_task(async function getFeedItem() {
 });
 
 add_task(async function selectInternalOptionForFeed() {
   // Select the item.
   feedItem.scrollIntoView();
   container.selectItem(feedItem);
   Assert.ok(feedItem.selected, "Should be able to select our item.");
 
-  // Wait for the menu.
-  let list = await TestUtils.waitForCondition(() =>
-    win.document.getAnonymousElementByAttribute(feedItem, "class", "actionsMenu"));
-  info("Got list after item was selected");
+  let list = feedItem.querySelector(".actionsMenu");
 
   // Find the "Add Live bookmarks option".
   let chooseItems = list.getElementsByAttribute("action", Ci.nsIHandlerInfo.handleInternally);
   Assert.equal(chooseItems.length, 1, "Should only be one action to handle internally");
 
   // Select the option.
   let cmdEvent = win.document.createEvent("xulcommandevent");
   cmdEvent.initCommandEvent("command", true, true, win, 0, false, false, false, false, null, 0);
   chooseItems[0].dispatchEvent(cmdEvent);
 
   // Check that we display the correct result.
-  list = await TestUtils.waitForCondition(() =>
-    win.document.getAnonymousElementByAttribute(feedItem, "class", "actionsMenu"));
-  info("Got list after item was selected");
   Assert.ok(list.selectedItem, "Should have a selected item.");
   Assert.equal(list.selectedItem.getAttribute("action"),
                Ci.nsIHandlerInfo.handleInternally,
                "Newly selected item should be the expected one.");
 });
 
 // This builds on the previous selectInternalOptionForFeed task.
 add_task(async function reselectInternalOptionForFeed() {
   // Now select a different option in the list - use the pdf item as that doesn't
   // need to load any favicons.
   let anotherItem = container.querySelector("richlistitem[type='application/pdf']");
 
   container.selectItem(anotherItem);
 
-  // Wait for the menu so that we don't hit race conditions.
-  await TestUtils.waitForCondition(() =>
-    win.document.getAnonymousElementByAttribute(anotherItem, "class", "actionsMenu"));
-  info("Got list after item was selected");
-
   // Now select the feed item again, and check what it is displaying.
   container.selectItem(feedItem);
 
-  let list = await TestUtils.waitForCondition(() =>
-    win.document.getAnonymousElementByAttribute(feedItem, "class", "actionsMenu"));
-  info("Got list after item was selected");
+  let list = feedItem.querySelector(".actionsMenu");
 
   Assert.ok(list.selectedItem,
             "Should have a selected item");
   Assert.equal(list.selectedItem.getAttribute("action"),
                Ci.nsIHandlerInfo.handleInternally,
                "Selected item should still be the same as the previously selected item.");
 });
 
@@ -113,16 +100,20 @@ add_task(async function sortingCheck() {
   assertSortByAction("ascending");
   Assert.notEqual(oldActionDir,
                actionColumn.getAttribute("sortDirection"),
                "Sort direction should change");
 
   actionColumn.click();
   assertSortByAction("descending");
 
+  // Restore the default sort order
+  typeColumn.click();
+  assertSortByType("ascending");
+
   function assertSortByAction(order) {
   Assert.equal(actionColumn.getAttribute("sortDirection"),
                order,
                `Sort direction should be ${order}`);
     let siteItems = handlerView.getElementsByTagName("richlistitem");
     for (let i = 0; i < siteItems.length - 1; ++i) {
       let aType = siteItems[i].getAttribute("actionDescription").toLowerCase();
       let bType = siteItems[i + 1].getAttribute("actionDescription").toLowerCase();
--- a/browser/components/preferences/in-content/tests/browser_change_app_handler.js
+++ b/browser/components/preferences/in-content/tests/browser_change_app_handler.js
@@ -23,18 +23,17 @@ add_task(async function() {
 
   let container = win.document.getElementById("handlersView");
   let ourItem = container.querySelector("richlistitem[type='text/x-test-handler']");
   ok(ourItem, "handlersView is present");
   ourItem.scrollIntoView();
   container.selectItem(ourItem);
   ok(ourItem.selected, "Should be able to select our item.");
 
-  let list = await TestUtils.waitForCondition(() => win.document.getAnonymousElementByAttribute(ourItem, "class", "actionsMenu"));
-  info("Got list after item was selected");
+  let list = ourItem.querySelector(".actionsMenu");
 
   let chooseItem = list.firstChild.querySelector(".choose-app-item");
   let dialogLoadedPromise = promiseLoadSubDialog("chrome://global/content/appPicker.xul");
   let cmdEvent = win.document.createEvent("xulcommandevent");
   cmdEvent.initCommandEvent("command", true, true, win, 0, false, false, false, false, null, 0);
   chooseItem.dispatchEvent(cmdEvent);
 
   let dialog = await dialogLoadedPromise;
@@ -46,18 +45,16 @@ add_task(async function() {
   let selectedApp = dialogList.firstChild.handlerApp;
   dialogDoc.documentElement.acceptDialog();
 
   // Verify results are correct in mime service:
   let mimeInfo = gMimeSvc.getFromTypeAndExtension("text/x-test-handler", null);
   ok(mimeInfo.preferredApplicationHandler.equals(selectedApp), "App should be set as preferred.");
 
   // Check that we display this result:
-  list = await TestUtils.waitForCondition(() => win.document.getAnonymousElementByAttribute(ourItem, "class", "actionsMenu"));
-  info("Got list after item was selected");
   ok(list.selectedItem, "Should have a selected item");
   ok(mimeInfo.preferredApplicationHandler.equals(list.selectedItem.handlerApp),
      "App should be visible as preferred item.");
 
 
   // Now try to 'manage' this list:
   dialogLoadedPromise = promiseLoadSubDialog("chrome://browser/content/preferences/applicationManager.xul");
 
@@ -79,17 +76,16 @@ add_task(async function() {
   is(dialogList.children.length, itemsBefore - 1, "Item got removed");
   dialogDoc.documentElement.acceptDialog();
 
   // Verify results are correct in mime service:
   mimeInfo = gMimeSvc.getFromTypeAndExtension("text/x-test-handler", null);
   ok(!mimeInfo.preferredApplicationHandler, "App should no longer be set as preferred.");
 
   // Check that we display this result:
-  list = await TestUtils.waitForCondition(() => win.document.getAnonymousElementByAttribute(ourItem, "class", "actionsMenu"));
   ok(list.selectedItem, "Should have a selected item");
   ok(!list.selectedItem.handlerApp,
      "No app should be visible as preferred item.");
 
   BrowserTestUtils.removeTab(gBrowser.selectedTab);
 });
 
 registerCleanupFunction(function() {
--- a/browser/installer/allowed-dupes.mn
+++ b/browser/installer/allowed-dupes.mn
@@ -89,17 +89,16 @@ chrome.manifest
 chrome/toolkit/skin/classic/global/autocomplete.css
 chrome/toolkit/skin/classic/global/button.css
 chrome/toolkit/skin/classic/global/checkbox.css
 chrome/toolkit/skin/classic/global/dialog.css
 chrome/toolkit/skin/classic/global/dropmarker.css
 chrome/toolkit/skin/classic/global/global.css
 chrome/toolkit/skin/classic/global/groupbox.css
 chrome/toolkit/skin/classic/global/icons/close-win7.png
-chrome/toolkit/skin/classic/global/listbox.css
 chrome/toolkit/skin/classic/global/menu.css
 chrome/toolkit/skin/classic/global/menulist.css
 chrome/toolkit/skin/classic/global/numberbox.css
 chrome/toolkit/skin/classic/global/popup.css
 chrome/toolkit/skin/classic/global/preferences.css
 chrome/toolkit/skin/classic/global/progressmeter.css
 chrome/toolkit/skin/classic/global/radio.css
 chrome/toolkit/skin/classic/global/richlistbox.css
--- a/browser/themes/shared/aboutNetError-new.css
+++ b/browser/themes/shared/aboutNetError-new.css
@@ -8,16 +8,17 @@
   --exception-button-container-background: #F5F5F7;
 }
 
 body.certerror {
   border-style: solid;
   border-color: #ffe900;
   border-width: 16px;
   width: 100%;
+  justify-content: normal;
 }
 
 body.captiveportal .title {
   background-image: url("wifi.svg");
 }
 
 body.certerror .title {
   background-image: url("cert-error-new.svg");
--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -250,17 +250,16 @@
 #include "mozilla/ServoStyleSet.h"
 #include "mozilla/StyleSheet.h"
 #include "mozilla/StyleSheetInlines.h"
 #include "mozilla/dom/SVGDocument.h"
 #include "mozilla/dom/SVGSVGElement.h"
 #include "mozilla/dom/DocGroup.h"
 #include "mozilla/dom/TabGroup.h"
 #ifdef MOZ_XUL
-#include "mozilla/dom/ListBoxObject.h"
 #include "mozilla/dom/MenuBoxObject.h"
 #include "mozilla/dom/TreeBoxObject.h"
 #include "nsIXULWindow.h"
 #include "nsIDocShellTreeOwner.h"
 #endif
 #include "nsIPresShellInlines.h"
 
 #include "mozilla/DocLoadingTimelineMarker.h"
@@ -6356,18 +6355,16 @@ nsIDocument::GetBoxObjectFor(Element* aE
   int32_t namespaceID;
   RefPtr<nsAtom> tag = BindingManager()->ResolveTag(aElement, &namespaceID);
 #ifdef MOZ_XUL
   if (namespaceID == kNameSpaceID_XUL) {
     if (tag == nsGkAtoms::menu) {
       boxObject = new MenuBoxObject();
     } else if (tag == nsGkAtoms::tree) {
       boxObject = new TreeBoxObject();
-    } else if (tag == nsGkAtoms::listbox) {
-      boxObject = new ListBoxObject();
     } else {
       boxObject = new BoxObject();
     }
   } else
 #endif // MOZ_XUL
   {
     boxObject = new BoxObject();
   }
--- a/dom/security/nsCSPContext.cpp
+++ b/dom/security/nsCSPContext.cpp
@@ -86,16 +86,39 @@ ValidateDirectiveName(const nsAString& a
   } ();
 
   nsAutoString directive(aDirective);
   auto itr = directives.find(NS_ConvertUTF16toUTF8(directive).get());
   return itr != directives.end();
 }
 #endif // DEBUG
 
+static void
+BlockedContentSourceToString(nsCSPContext::BlockedContentSource aSource,
+                             nsACString& aString)
+{
+  switch (aSource) {
+    case nsCSPContext::BlockedContentSource::eUnknown:
+      aString.Truncate();
+      break;
+
+    case nsCSPContext::BlockedContentSource::eInline:
+      aString.AssignLiteral("inline");
+      break;
+
+    case nsCSPContext::BlockedContentSource::eEval:
+      aString.AssignLiteral("eval");
+      break;
+
+    case nsCSPContext::BlockedContentSource::eSelf:
+      aString.AssignLiteral("self");
+      break;
+  }
+}
+
 /**
  * Creates a key for use in the ShouldLoad cache.
  * Looks like: <uri>!<nsIContentPolicy::LOAD_TYPE>
  */
 nsresult
 CreateCacheKey_Internal(nsIURI* aContentLocation,
                         nsContentPolicyType aContentType,
                         nsACString& outCacheKey)
@@ -270,16 +293,17 @@ nsCSPContext::permitsInternal(CSPDirecti
 
       // Do not send a report or notify observers if this is a preload - the
       // decision may be wrong due to the inability to get the nonce, and will
       // incorrectly fail the unit tests.
       if (!aIsPreload && aSendViolationReports) {
         AsyncReportViolation(aTriggeringElement,
                              (aSendContentLocationInViolationReports ?
                               aContentLocation : nullptr),
+                             BlockedContentSource::eUnknown, /* a BlockedContentSource */
                              aOriginalURI,  /* in case of redirect originalURI is not null */
                              violatedDirective,
                              p,             /* policy index        */
                              EmptyString(), /* no observer subject */
                              EmptyString(), /* no source file      */
                              EmptyString(), /* no script sample    */
                              0,             /* no line number      */
                              0);            /* no column number    */
@@ -476,30 +500,25 @@ nsCSPContext::reportInlineViolation(nsCo
                       : NS_LITERAL_STRING(STYLE_NONCE_VIOLATION_OBSERVER_TOPIC);
   }
   else {
     observerSubject = (aContentType == nsIContentPolicy::TYPE_SCRIPT)
                       ? NS_LITERAL_STRING(SCRIPT_HASH_VIOLATION_OBSERVER_TOPIC)
                       : NS_LITERAL_STRING(STYLE_HASH_VIOLATION_OBSERVER_TOPIC);
   }
 
-  nsCOMPtr<nsISupportsCString> selfICString(do_CreateInstance(NS_SUPPORTS_CSTRING_CONTRACTID));
-  if (selfICString) {
-    selfICString->SetData(nsDependentCString("inline"));
-  }
-  nsCOMPtr<nsISupports> selfISupports(do_QueryInterface(selfICString));
-
   // use selfURI as the sourceFile
   nsAutoCString sourceFile;
   if (mSelfURI) {
     mSelfURI->GetSpec(sourceFile);
   }
 
   AsyncReportViolation(aTriggeringElement,
-                       selfISupports,                      // aBlockedContentSource
+                       nullptr,                            // aBlockedURI
+                       BlockedContentSource::eInline,      // aBloeckedSource
                        mSelfURI,                           // aOriginalURI
                        aViolatedDirective,                 // aViolatedDirective
                        aViolatedPolicyIndex,               // aViolatedPolicyIndex
                        observerSubject,                    // aObserverSubject
                        NS_ConvertUTF8toUTF16(sourceFile),  // aSourceFile
                        aContent,                           // aScriptSample
                        aLineNumber,                        // aLineNum
                        aColumnNumber);                     // aColumnNum
@@ -590,17 +609,17 @@ nsCSPContext::GetAllowsInline(nsContentP
  * and violates.  Based on those, they must choose whether to call
  * LogViolationDetails or not.  Policies that are report-only allow the
  * loads/compilations but violations should still be reported.  Not all
  * policies in this nsIContentSecurityPolicy instance will be violated,
  * which is why we must check allows() again here.
  *
  * Note: This macro uses some parameters from its caller's context:
  * p, mPolicies, this, aSourceFile, aScriptSample, aLineNum, aColumnNum,
- * selfISupports
+ * blockedContentSource
  *
  * @param violationType: the VIOLATION_TYPE_* constant (partial symbol)
  *                 such as INLINE_SCRIPT
  * @param contentPolicyType: a constant from nsIContentPolicy such as TYPE_STYLESHEET
  * @param nonceOrHash: for NONCE and HASH violations, it's the nonce or content
  *               string. For other violations, it is an empty string.
  * @param keyword: the keyword corresponding to violation (UNSAFE_INLINE for most)
  * @param observerTopic: the observer topic string to send with the CSP
@@ -617,18 +636,18 @@ nsCSPContext::GetAllowsInline(nsContentP
     if (!mPolicies[p]->allows(nsIContentPolicy::TYPE_ ## contentPolicyType,    \
                               keyword, nonceOrHash, false))                    \
     {                                                                          \
       nsAutoString violatedDirective;                                          \
       bool reportSample = false;                                               \
       mPolicies[p]->getDirectiveStringAndReportSampleForContentType(           \
                         nsIContentPolicy::TYPE_ ## contentPolicyType,          \
                         violatedDirective, &reportSample);                     \
-      AsyncReportViolation(aTriggeringElement, selfISupports, nullptr,         \
-                           violatedDirective, p,                               \
+      AsyncReportViolation(aTriggeringElement, nullptr, blockedContentSource,  \
+                           nullptr, violatedDirective, p,                      \
                            NS_LITERAL_STRING(observerTopic),                   \
                            aSourceFile,                                        \
                            reportSample                                        \
                              ? aScriptSample : EmptyString(),                  \
                            aLineNum, aColumnNum);                              \
     }                                                                          \
     PR_END_MACRO;                                                              \
     break
@@ -665,30 +684,27 @@ nsCSPContext::LogViolationDetails(uint16
                                   int32_t aLineNum,
                                   int32_t aColumnNum,
                                   const nsAString& aNonce,
                                   const nsAString& aContent)
 {
   for (uint32_t p = 0; p < mPolicies.Length(); p++) {
     NS_ASSERTION(mPolicies[p], "null pointer in nsTArray<nsCSPPolicy>");
 
-    nsCOMPtr<nsISupportsCString> selfICString(do_CreateInstance(NS_SUPPORTS_CSTRING_CONTRACTID));
-    if (selfICString) {
-      if (aViolationType == nsIContentSecurityPolicy::VIOLATION_TYPE_EVAL) {
-        selfICString->SetData(nsDependentCString("eval"));
-      } else if (aViolationType == nsIContentSecurityPolicy::VIOLATION_TYPE_INLINE_SCRIPT ||
-                 aViolationType == nsIContentSecurityPolicy::VIOLATION_TYPE_INLINE_STYLE) {
-        selfICString->SetData(nsDependentCString("inline"));
-      } else {
-        // All the other types should have a URL, but just in case, let's use
-        // 'self' here.
-        selfICString->SetData(nsDependentCString("self"));
-      }
+    BlockedContentSource blockedContentSource = BlockedContentSource::eUnknown;
+    if (aViolationType == nsIContentSecurityPolicy::VIOLATION_TYPE_EVAL) {
+      blockedContentSource = BlockedContentSource::eEval;
+    } else if (aViolationType == nsIContentSecurityPolicy::VIOLATION_TYPE_INLINE_SCRIPT ||
+               aViolationType == nsIContentSecurityPolicy::VIOLATION_TYPE_INLINE_STYLE) {
+      blockedContentSource = BlockedContentSource::eInline;
+    } else {
+      // All the other types should have a URL, but just in case, let's use
+      // 'self' here.
+      blockedContentSource = BlockedContentSource::eSelf;
     }
-    nsCOMPtr<nsISupports> selfISupports(do_QueryInterface(selfICString));
 
     switch (aViolationType) {
       CASE_CHECK_AND_REPORT(EVAL,              SCRIPT,     NS_LITERAL_STRING(""),
                             CSP_UNSAFE_EVAL,   EVAL_VIOLATION_OBSERVER_TOPIC);
       CASE_CHECK_AND_REPORT(INLINE_STYLE,      STYLESHEET, NS_LITERAL_STRING(""),
                             CSP_UNSAFE_INLINE, INLINE_STYLE_VIOLATION_OBSERVER_TOPIC);
       CASE_CHECK_AND_REPORT(INLINE_SCRIPT,     SCRIPT,     NS_LITERAL_STRING(""),
                             CSP_UNSAFE_INLINE, INLINE_SCRIPT_VIOLATION_OBSERVER_TOPIC);
@@ -869,26 +885,17 @@ StripURIForReporting(nsIURI* aURI,
   if (!isHttpOrFtp) {
     // not strictly spec compliant, but what we really care about is
     // http/https and also ftp. If it's not http/https or ftp, then treat aURI
     // as if it's a globally unique identifier and just return the scheme.
     aURI->GetScheme(outStrippedURI);
     return;
   }
 
-  // 2) If the origin of uri is not the same as the origin of the protected
-  // resource, then return the ASCII serialization of uri’s origin.
-  if (!NS_SecurityCompareURIs(aSelfURI, aURI, false)) {
-    // cross origin redirects also fall into this category, see:
-    // http://www.w3.org/TR/CSP/#violation-reports
-    aURI->GetPrePath(outStrippedURI);
-    return;
-  }
-
-  // 3) Return uri, with any fragment component removed.
+  // Return uri, with any fragment component removed.
   aURI->GetSpecIgnoringRef(outStrippedURI);
 }
 
 nsresult
 nsCSPContext::GatherSecurityPolicyViolationEventData(
   nsIURI* aBlockedURI,
   const nsACString& aBlockedString,
   nsIURI* aOriginalURI,
@@ -912,17 +919,18 @@ nsCSPContext::GatherSecurityPolicyViolat
   aViolationEventInit.mDocumentURI = NS_ConvertUTF8toUTF16(reportDocumentURI);
 
   // referrer
   aViolationEventInit.mReferrer = mReferrer;
 
   // blocked-uri
   if (aBlockedURI) {
     nsAutoCString reportBlockedURI;
-    StripURIForReporting(aBlockedURI, mSelfURI, reportBlockedURI);
+    StripURIForReporting(aOriginalURI ? aOriginalURI : aBlockedURI,
+                         mSelfURI, reportBlockedURI);
     aViolationEventInit.mBlockedURI = NS_ConvertUTF8toUTF16(reportBlockedURI);
   } else {
     aViolationEventInit.mBlockedURI = NS_ConvertUTF8toUTF16(aBlockedString);
   }
 
   // effective-directive
   // The name of the policy directive that was violated.
   aViolationEventInit.mEffectiveDirective = aViolatedDirective;
@@ -1247,124 +1255,132 @@ nsCSPContext::FireViolationEvent(
 
 /**
  * Dispatched from the main thread to send reports for one CSP violation.
  */
 class CSPReportSenderRunnable final : public Runnable
 {
   public:
     CSPReportSenderRunnable(Element* aTriggeringElement,
-                            nsISupports* aBlockedContentSource,
+                            nsIURI* aBlockedURI,
+                            nsCSPContext::BlockedContentSource aBlockedContentSource,
                             nsIURI* aOriginalURI,
                             uint32_t aViolatedPolicyIndex,
                             bool aReportOnlyFlag,
                             const nsAString& aViolatedDirective,
                             const nsAString& aObserverSubject,
                             const nsAString& aSourceFile,
                             const nsAString& aScriptSample,
                             uint32_t aLineNum,
                             uint32_t aColumnNum,
                             nsCSPContext* aCSPContext)
       : mozilla::Runnable("CSPReportSenderRunnable")
       , mTriggeringElement(aTriggeringElement)
+      , mBlockedURI(aBlockedURI)
       , mBlockedContentSource(aBlockedContentSource)
       , mOriginalURI(aOriginalURI)
       , mViolatedPolicyIndex(aViolatedPolicyIndex)
       , mReportOnlyFlag(aReportOnlyFlag)
       , mViolatedDirective(aViolatedDirective)
       , mSourceFile(aSourceFile)
       , mScriptSample(aScriptSample)
       , mLineNum(aLineNum)
       , mColumnNum(aColumnNum)
       , mCSPContext(aCSPContext)
     {
       NS_ASSERTION(!aViolatedDirective.IsEmpty(), "Can not send reports without a violated directive");
       // the observer subject is an nsISupports: either an nsISupportsCString
       // from the arg passed in directly, or if that's empty, it's the blocked
       // source.
+      if (aObserverSubject.IsEmpty() && mBlockedURI) {
+        mObserverSubject = aBlockedURI;
+        return;
+      }
+
+      nsAutoCString subject;
       if (aObserverSubject.IsEmpty()) {
-        mObserverSubject = aBlockedContentSource;
+        BlockedContentSourceToString(aBlockedContentSource, subject);
       } else {
-        nsCOMPtr<nsISupportsCString> supportscstr =
-          do_CreateInstance(NS_SUPPORTS_CSTRING_CONTRACTID);
-        NS_ASSERTION(supportscstr, "Couldn't allocate nsISupportsCString");
-        supportscstr->SetData(NS_ConvertUTF16toUTF8(aObserverSubject));
+        CopyUTF16toUTF8(aObserverSubject, subject);
+      }
+
+      nsCOMPtr<nsISupportsCString> supportscstr =
+        do_CreateInstance(NS_SUPPORTS_CSTRING_CONTRACTID);
+      if (supportscstr) {
+        supportscstr->SetData(subject);
         mObserverSubject = do_QueryInterface(supportscstr);
       }
     }
 
     NS_IMETHOD Run() override
     {
       MOZ_ASSERT(NS_IsMainThread());
 
       nsresult rv;
 
       // 0) prepare violation data
       mozilla::dom::SecurityPolicyViolationEventInit init;
-      // mBlockedContentSource could be a URI or a string.
-      nsCOMPtr<nsIURI> blockedURI = do_QueryInterface(mBlockedContentSource);
-      // if mBlockedContentSource is not a URI, it could be a string
-      nsCOMPtr<nsISupportsCString> blockedICString = do_QueryInterface(mBlockedContentSource);
-      nsAutoCString blockedDataStr;
-      if (blockedICString) {
-        blockedICString->GetData(blockedDataStr);
-      }
+
+      nsAutoCString blockedContentSource;
+      BlockedContentSourceToString(mBlockedContentSource, blockedContentSource);
 
       rv = mCSPContext->GatherSecurityPolicyViolationEventData(
-        blockedURI, blockedDataStr, mOriginalURI,
+        mBlockedURI, blockedContentSource, mOriginalURI,
         mViolatedDirective, mViolatedPolicyIndex,
         mSourceFile, mScriptSample, mLineNum, mColumnNum,
         init);
       NS_ENSURE_SUCCESS(rv, rv);
 
       // 1) notify observers
       nsCOMPtr<nsIObserverService> observerService = mozilla::services::GetObserverService();
-      NS_ASSERTION(observerService, "needs observer service");
-      rv = observerService->NotifyObservers(mObserverSubject,
-                                            CSP_VIOLATION_TOPIC,
-                                            mViolatedDirective.get());
-      NS_ENSURE_SUCCESS(rv, rv);
+      if (mObserverSubject && observerService) {
+        rv = observerService->NotifyObservers(mObserverSubject,
+                                              CSP_VIOLATION_TOPIC,
+                                              mViolatedDirective.get());
+        NS_ENSURE_SUCCESS(rv, rv);
+      }
 
       // 2) send reports for the policy that was violated
       mCSPContext->SendReports(init, mViolatedPolicyIndex);
 
       // 3) log to console (one per policy violation)
 
-      if (blockedURI) {
-        blockedURI->GetSpec(blockedDataStr);
-        if (blockedDataStr.Length() > nsCSPContext::ScriptSampleMaxLength()) {
+      if (mBlockedURI) {
+        mBlockedURI->GetSpec(blockedContentSource);
+        if (blockedContentSource.Length() > nsCSPContext::ScriptSampleMaxLength()) {
           bool isData = false;
-          rv = blockedURI->SchemeIs("data", &isData);
+          rv = mBlockedURI->SchemeIs("data", &isData);
           if (NS_SUCCEEDED(rv) && isData &&
-              blockedDataStr.Length() > nsCSPContext::ScriptSampleMaxLength()) {
-            blockedDataStr.Truncate(nsCSPContext::ScriptSampleMaxLength());
-            blockedDataStr.Append(NS_ConvertUTF16toUTF8(nsContentUtils::GetLocalizedEllipsis()));
+              blockedContentSource.Length() > nsCSPContext::ScriptSampleMaxLength()) {
+            blockedContentSource.Truncate(nsCSPContext::ScriptSampleMaxLength());
+            blockedContentSource.Append(NS_ConvertUTF16toUTF8(nsContentUtils::GetLocalizedEllipsis()));
           }
         }
       }
 
-      if (blockedDataStr.Length() > 0) {
-        nsString blockedDataChar16 = NS_ConvertUTF8toUTF16(blockedDataStr);
+      if (blockedContentSource.Length() > 0) {
+        nsString blockedContentSource16 = NS_ConvertUTF8toUTF16(blockedContentSource);
         const char16_t* params[] = { mViolatedDirective.get(),
-                                     blockedDataChar16.get() };
+                                     blockedContentSource16.get() };
         mCSPContext->logToConsole(mReportOnlyFlag ? "CSPROViolationWithURI" :
                                                     "CSPViolationWithURI",
                                   params, ArrayLength(params), mSourceFile, mScriptSample,
                                   mLineNum, mColumnNum, nsIScriptError::errorFlag);
       }
 
       // 4) fire violation event
       mCSPContext->FireViolationEvent(mTriggeringElement, init);
 
       return NS_OK;
     }
 
   private:
     RefPtr<Element>         mTriggeringElement;
-    nsCOMPtr<nsISupports>   mBlockedContentSource;
+    nsCOMPtr<nsIURI>        mBlockedURI;
+    nsCSPContext::BlockedContentSource mBlockedContentSource;
     nsCOMPtr<nsIURI>        mOriginalURI;
     uint32_t                mViolatedPolicyIndex;
     bool                    mReportOnlyFlag;
     nsString                mViolatedDirective;
     nsCOMPtr<nsISupports>   mObserverSubject;
     nsString                mSourceFile;
     nsString                mScriptSample;
     uint32_t                mLineNum;
@@ -1398,30 +1414,32 @@ class CSPReportSenderRunnable final : pu
  *        a sample of the violating inline script
  * @param aLineNum
  *        source line number of the violation (if available)
  * @param aColumnNum
  *        source column number of the violation (if available)
  */
 nsresult
 nsCSPContext::AsyncReportViolation(Element* aTriggeringElement,
-                                   nsISupports* aBlockedContentSource,
+                                   nsIURI* aBlockedURI,
+                                   BlockedContentSource aBlockedContentSource,
                                    nsIURI* aOriginalURI,
                                    const nsAString& aViolatedDirective,
                                    uint32_t aViolatedPolicyIndex,
                                    const nsAString& aObserverSubject,
                                    const nsAString& aSourceFile,
                                    const nsAString& aScriptSample,
                                    uint32_t aLineNum,
                                    uint32_t aColumnNum)
 {
   NS_ENSURE_ARG_MAX(aViolatedPolicyIndex, mPolicies.Length() - 1);
 
   nsCOMPtr<nsIRunnable> task =
     new CSPReportSenderRunnable(aTriggeringElement,
+                                aBlockedURI,
                                 aBlockedContentSource,
                                 aOriginalURI,
                                 aViolatedPolicyIndex,
                                 mPolicies[aViolatedPolicyIndex]->getReportOnlyFlag(),
                                 aViolatedDirective,
                                 aObserverSubject,
                                 aSourceFile,
                                 aScriptSample,
--- a/dom/security/nsCSPContext.h
+++ b/dom/security/nsCSPContext.h
@@ -102,18 +102,27 @@ class nsCSPContext : public nsIContentSe
     nsresult SendReports(
       const mozilla::dom::SecurityPolicyViolationEventInit& aViolationEventInit,
       uint32_t aViolatedPolicyIndex);
 
     nsresult FireViolationEvent(
       mozilla::dom::Element* aTriggeringElement,
       const mozilla::dom::SecurityPolicyViolationEventInit& aViolationEventInit);
 
+    enum BlockedContentSource
+    {
+      eUnknown,
+      eInline,
+      eEval,
+      eSelf,
+    };
+
     nsresult AsyncReportViolation(mozilla::dom::Element* aTriggeringElement,
-                                  nsISupports* aBlockedContentSource,
+                                  nsIURI* aBlockedURI,
+                                  BlockedContentSource aBlockedContentSource,
                                   nsIURI* aOriginalURI,
                                   const nsAString& aViolatedDirective,
                                   uint32_t aViolatedPolicyIndex,
                                   const nsAString& aObserverSubject,
                                   const nsAString& aSourceFile,
                                   const nsAString& aScriptSample,
                                   uint32_t aLineNum,
                                   uint32_t aColumnNum);
--- a/dom/security/test/csp/test_blocked_uri_in_reports.html
+++ b/dom/security/test/csp/test_blocked_uri_in_reports.html
@@ -45,17 +45,17 @@ script.addMessageListener('opening-reque
       var reportObj = JSON.parse(msg.report);
     } catch (e) {
       ok(false, "Could not parse JSON (exception: " + e + ")");
     }
     try {
       var cspReport = reportObj["csp-report"];
       // blocked-uri should only be the asciiHost instead of:
       // http://test1.example.com/tests/dom/security/test/csp/file_path_matching.js
-      is(cspReport["blocked-uri"], "http://test1.example.com", "Incorrect blocked-uri");
+      is(cspReport["blocked-uri"], "http://example.com/tests/dom/security/test/csp/file_path_matching_redirect_server.sjs", "Incorrect blocked-uri");
     } catch (e) {
       ok(false, "Could not query report (exception: " + e + ")");
     }
   }
 
   script.removeMessageListener('opening-request-completed', ml);
   script.sendAsyncMessage("finish");
   SimpleTest.finish();
--- a/dom/security/test/csp/test_report_for_import.html
+++ b/dom/security/test/csp/test_report_for_import.html
@@ -52,17 +52,17 @@ function checkResults(reportStr) {
     is(cspReport["violated-directive"],
        "style-src",
        "Incorrect violated-directive");
     is(cspReport["original-policy"],
        "style-src http://mochi.test:8888; report-uri " +
        "http://mochi.test:8888/tests/dom/security/test/csp/file_report_for_import_server.sjs?report",
        "Incorrect original-policy");
     is(cspReport["blocked-uri"],
-       "http://example.com",
+       "http://example.com/tests/dom/security/test/csp/file_report_for_import_server.sjs?stylesheet",
        "Incorrect blocked-uri");
 
     // we do not always set the following fields
     is(cspReport["source-file"], undefined, "Incorrect source-file");
     is(cspReport["script-sample"], undefined, "Incorrect script-sample");
     is(cspReport["line-number"], undefined, "Incorrect line-number");
   }
   catch (e) {
--- a/dom/security/test/unit/test_csp_reports.js
+++ b/dom/security/test/unit/test_csp_reports.js
@@ -142,17 +142,17 @@ function run_test() {
                                   // csp report in JSON is not cut-off, please
                                   // note that JSON is UTF8 encoded.
                                   "\u00a3\u00a5\u00b5\u5317\ud841\udf79",
                                   1, // line number
                                   2); // column number
         }
       });
 
-  makeTest(2, {"blocked-uri": "http://blocked.test"}, false,
+  makeTest(2, {"blocked-uri": "http://blocked.test/foo.js"}, false,
       function(csp) {
         // shouldLoad creates and sends out the report here.
         csp.shouldLoad(Ci.nsIContentPolicy.TYPE_SCRIPT,
                       NetUtil.newURI("http://blocked.test/foo.js"),
                       null, null, null, null);
       });
 
   // test that inline script violations cause a report in report-only policy
@@ -221,16 +221,16 @@ function run_test() {
       var uri = NetUtil
       // shouldLoad creates and sends out the report here.
       csp.shouldLoad(Ci.nsIContentPolicy.TYPE_SCRIPT,
                      NetUtil.newURI(selfSpec + "#bar"),
                      null, null, null, null);
       });
 
   // test scheme of ftp:
-  makeTest(8, {"blocked-uri": "ftp://blocked.test"}, false,
+  makeTest(8, {"blocked-uri": "ftp://blocked.test/profile.png"}, false,
     function(csp) {
       // shouldLoad creates and sends out the report here.
       csp.shouldLoad(Ci.nsIContentPolicy.TYPE_SCRIPT,
                     NetUtil.newURI("ftp://blocked.test/profile.png"),
                     null, null, null, null);
     });
 }
--- a/dom/tests/mochitest/chrome/window_focus.xul
+++ b/dom/tests/mochitest/chrome/window_focus.xul
@@ -294,17 +294,17 @@ function mouseWillTriggerFocus(element)
   if (element.namespaceURI == "http://www.w3.org/1999/xhtml") {
     // links are special. They can be focused but show no focus ring
     if (element.localName == "a" || element.localName == "div" ||
         element.localName == "select" ||
         element.localName == "input" && (element.type == "text" ||
                                          element.type == "password")) {
       return true;
     }
-  } else if (element.localName == "listbox") {
+  } else if (element.localName == "richlistbox") {
     return true;
   }
 
   return false;
 }
 
 function mouseOnElement(element, expectedElement, focusChanged, testid)
 {
@@ -452,17 +452,17 @@ function startTest()
 
     var element = getById("t" + idx);
     // skip area elements, as getBoundingClientRect doesn't return their actual coordinates
     if (element.localName == "area")
       continue;
 
     mouseOnElement(element, getById("t" + idx), true, "mouse on element t" + idx);
     var expectedWindow = (element.ownerGlobal == gChildWindow) ? gChildWindow : window;
-    if (element.localName == "listbox" && expectedWindow == window &&
+    if (element.localName == "richlistbox" && expectedWindow == window &&
         navigator.platform.indexOf("Mac") == 0) {
       // after focusing a listbox on Mac, clear the focus before continuing.
       setFocusTo(null, window);
     }
   }
 
   ok(t19.selectionStart == t19.selectionEnd, "input focused from mouse selection");
 
@@ -1629,34 +1629,34 @@ SimpleTest.waitForFocus(startTest);
  The elements with ids starting with n are:
    odd numbered ids - not focusable with -moz-user-focus: none
    even numbered ids - focusable but not part of the tab order
  -->
 <vbox id="buttonbox">
 <hbox id="innerbox">
   <button id="t4" accesskey="h" label="no tabindex"/>
   <button id="o1" accesskey="i" label="tabindex = -1" tabindex="-1"/>
-  <listbox id="t5" label="tabindex = 0" tabindex="0" rows="1">
-    <listitem/>
-  </listbox>
+  <richlistbox id="t5" label="tabindex = 0" tabindex="0" width="50">
+    <richlistitem height="10"/>
+  </richlistbox>
   <button id="t1" label="tabindex = 2" tabindex="2"/>
 </hbox>
 <hbox>
   <button id="o2" accesskey="o" style="-moz-user-focus: ignore;" label="no tabindex"/>
   <button id="o4" style="-moz-user-focus: ignore;" label="tabindex = -1" tabindex="-1"/>
   <button id="t6" style="-moz-user-focus: ignore;" label="tabindex = 0" tabindex="0"/>
   <button id="t2" style="-moz-user-focus: ignore;" label="tabindex = 2" tabindex="2"/>
 </hbox>
 <hbox id="specialroot">
   <button id="t7" style="-moz-user-focus: normal;" label="no tabindex"/>
   <button id="o3" style="-moz-user-focus: normal;" label="tabindex = -1" tabindex="-1"/>
   <button id="t8" style="-moz-user-focus: normal;" label="tabindex = 0" tabindex="0"/>
-  <listbox id="t3" style="-moz-user-focus: normal;" label="tabindex = 2" tabindex="2" rows="1">
-    <listitem/>
-  </listbox>
+  <richlistbox id="t3" style="-moz-user-focus: normal;" label="tabindex = 2" tabindex="2" width="50">
+    <richlistitem height="10"/>
+  </richlistbox>
 </hbox>
 <hbox>
   <button accesskey="p" style="display: none;"/> <button accesskey="q" style="visibility: collapse;"/>
   <button style="display: none;" tabindex="2"/> <button style="visibility: collapse;" tabindex="2"/>
 </hbox>
 <hbox>
   <button id="o20" accesskey="s" label="no tabindex" disabled="true"/>
   <button id="o22" label="tabindex = -1" tabindex="-1" disabled="true"/>
@@ -1704,17 +1704,17 @@ SimpleTest.waitForFocus(startTest);
 <description label="o" accesskey="v"/>
 <button id="t38"/>
 <!-- The 't' element tests end here so it doesn't matter that these elements are tabbable -->
 <label id="aj" value="j" accesskey="j" control="o9"/>
 <label id="ak" accesskey="k" control="n4">k</label>
 <checkbox id="o5"/><checkbox id="o7"/><hbox><checkbox id="o9"/></hbox>
 <checkbox id="o13"/><checkbox id="o15"/><checkbox id="o17"/><checkbox id="o19"/><checkbox id="o21"/><checkbox id="o23"/><checkbox id="o25"/>
 <checkbox id="n2"/><checkbox id="n4"/>
-<listbox id="last" width="20" rows="1"/>
+<richlistbox id="last" width="20" height="20"/>
 
 <iframe id="ifa" width="40" height="60" style="-moz-user-focus: ignore;" type="content"
         src="data:text/html,&lt;input id=fra size='2'&gt;&lt;input id='fra-b' size='2'&gt;
         &lt;iframe src='data:text/html,&lt;input id=frc&gt;&lt;iframe src=&quot;data:text/html,&lt;input id=frd&gt;&quot;&gt;&lt;/iframe&gt;'&gt;&lt;/iframe&gt;"/>
 <iframe id="ifb" width="20" height="20" style="-moz-user-focus: ignore;"
         src="data:text/html,&lt;input id=frd&gt;&lt;/iframe&gt;"/>
 
 </hbox>
--- a/dom/tests/mochitest/general/test_focusrings.xul
+++ b/dom/tests/mochitest/general/test_focusrings.xul
@@ -156,19 +156,19 @@ function testHTMLElements(list, isMac, e
   }
 }
 
 SimpleTest.waitForFocus(runTest);
 
 ]]>
 </script>
 
-<listbox id="l1" class="plain" height="20"/>
-<listbox id="l2" class="plain" height="20"/>
-<listbox id="l3" class="plain" height="20"/>
+<richlistbox id="l1" class="plain" height="20"/>
+<richlistbox id="l2" class="plain" height="20"/>
+<richlistbox id="l3" class="plain" height="20"/>
 <button id="b1" label="Button"/>
 <button id="b2" label="Button"/>
 <button id="b3" label="Button"/>
 
 <iframe id="child" src="file_focusrings.html"/>
 
 <body xmlns="http://www.w3.org/1999/xhtml" style="height: 300px; overflow: auto;"/>
 
deleted file mode 100644
--- a/dom/webidl/ListBoxObject.webidl
+++ /dev/null
@@ -1,22 +0,0 @@
-
-/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-
-[NoInterfaceObject]
-interface ListBoxObject : BoxObject {
-
-  long getRowCount();
-  long getRowHeight();
-  long getNumberOfVisibleRows();
-  long getIndexOfFirstVisibleRow();
-
-  void ensureIndexIsVisible(long rowIndex);
-  void scrollToIndex(long rowIndex);
-  void scrollByLines(long numLines);
-
-  Element? getItemAtIndex(long index);
-  long getIndexOfItem(Element item);
-};
--- a/dom/webidl/moz.build
+++ b/dom/webidl/moz.build
@@ -628,17 +628,16 @@ WEBIDL_FILES = [
     'KeyboardEvent.webidl',
     'KeyEvent.webidl',
     'KeyframeAnimationOptions.webidl',
     'KeyframeEffect.webidl',
     'KeyIdsInitData.webidl',
     'L10nUtils.webidl',
     'LegacyQueryInterface.webidl',
     'LinkStyle.webidl',
-    'ListBoxObject.webidl',
     'LocalMediaStream.webidl',
     'Location.webidl',
     'MediaCapabilities.webidl',
     'MediaDeviceInfo.webidl',
     'MediaDevices.webidl',
     'MediaElementAudioSourceNode.webidl',
     'MediaEncryptedEvent.webidl',
     'MediaError.webidl',
deleted file mode 100644
--- a/dom/xbl/crashtests/404125-1.xhtml
+++ /dev/null
@@ -1,29 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-
-<head>
-
-<bindings xmlns="http://www.mozilla.org/xbl">
-  <binding id="lc">
-    <content>
-      <xul:listcell> t <children/></xul:listcell>
-    </content>
-  </binding>
-</bindings>
-
-<script>
-function boom()
-{
-  var hbox = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "hbox");
-  document.getElementById("vv").appendChild(hbox);
-}
-</script>
-
-</head>
-
-<body onload="boom();">
-
-<div style="-moz-binding: url(#lc);" id="vv"></div>
-
-</body>
-
-</html>
deleted file mode 100644
--- a/dom/xbl/crashtests/415301-1.xul
+++ /dev/null
@@ -1,34 +0,0 @@
-<?xml version="1.0"?>
-<?xml-stylesheet href="chrome://global/skin/global.css"?>
-
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
-        xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
-        onload="boom();">
-
-
-<bindings xmlns="http://www.mozilla.org/xbl">
-
-<binding id="chil"><content><children/></content></binding>
-
-<binding id="ichil"><content>
-<xul:hbox style="-moz-binding: url(#chil)"><children/></xul:hbox>
-</content></binding>
-
-</bindings>
-
-
-<script type="text/javascript">
-
-function boom()
-{
-  document.getElementById("inner").removeChild(document.getElementById("lbb"));
-  document.getElementById("outer").style.MozBinding = "";
-}
-
-</script>
-
-
-<hbox id="outer" style="-moz-binding: url(#chil)"><hbox id="inner" style="-moz-binding: url(#ichil)"><listboxbody id="lbb" /></hbox></hbox>
-
-
-</window>
deleted file mode 100644
--- a/dom/xbl/crashtests/463511-1.xhtml
+++ /dev/null
@@ -1,9 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml" style="-moz-binding: url(#foo)">
-<head>
-<bindings xmlns="http://www.mozilla.org/xbl">
-<binding id="foo"><content><listcell xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><children xmlns="http://www.mozilla.org/xbl"/></listcell></content></binding>
-</bindings>
-</head>
-
-<body onload="document.documentElement.innerHTML = 'x';"></body>
-</html>
--- a/dom/xbl/crashtests/crashtests.list
+++ b/dom/xbl/crashtests/crashtests.list
@@ -9,29 +9,26 @@ load 336960-1.html
 load 342954-1.xhtml
 load 342954-2.xhtml
 load 368276-1.xhtml
 load 368641-1.xhtml
 load 378521-1.xhtml
 load 382376-1.xhtml
 load 382376-2.xhtml
 load 397596-1.xhtml
-load 404125-1.xhtml
 load 406900-1.xul
 load 406904-1.xhtml
 load 406904-2.xhtml
 load 415192-1.xul
-load 415301-1.xul
 load 418133-1.xhtml
 load 420233-1.xhtml
 load 421997-1.xhtml
 load 432813-1.xhtml
 load 454820-1.html
 load 460665-1.xhtml
-load 463511-1.xhtml
 load 464863-1.xhtml
 load 472260-1.xhtml
 load 477878-1.html
 load 492978-1.xul
 load 493123-1.xhtml
 load 495354-1.xhtml
 load 507628-1.xhtml
 load 507991-1.xhtml
--- a/dom/xul/nsXULElement.cpp
+++ b/dom/xul/nsXULElement.cpp
@@ -37,17 +37,16 @@
 #include "mozilla/dom/Event.h"
 #include "nsStyleConsts.h"
 #include "nsString.h"
 #include "nsXULControllers.h"
 #include "nsIBoxObject.h"
 #include "nsPIBoxObject.h"
 #include "XULDocument.h"
 #include "nsXULPopupListener.h"
-#include "ListBoxObject.h"
 #include "nsContentUtils.h"
 #include "nsContentList.h"
 #include "mozilla/InternalMutationEvent.h"
 #include "mozilla/MouseEvents.h"
 #include "nsPIDOMWindow.h"
 #include "nsJSPrincipals.h"
 #include "nsDOMAttributeMap.h"
 #include "nsGkAtoms.h"
@@ -442,17 +441,16 @@ nsXULElement::GetEventListenerManagerFor
 
     return nsStyledElement::GetEventListenerManagerForAttr(aAttrName, aDefer);
 }
 
 // returns true if the element is not a list
 static bool IsNonList(mozilla::dom::NodeInfo* aNodeInfo)
 {
   return !aNodeInfo->Equals(nsGkAtoms::tree) &&
-         !aNodeInfo->Equals(nsGkAtoms::listbox) &&
          !aNodeInfo->Equals(nsGkAtoms::richlistbox);
 }
 
 bool
 nsXULElement::IsFocusableInternal(int32_t *aTabIndex, bool aWithMouse)
 {
   /*
    * Returns true if an element may be focused, and false otherwise. The inout
@@ -790,108 +788,16 @@ nsXULElement::UnbindFromTree(bool aDeep,
     if (slots) {
         slots->mControllers = nullptr;
     }
 
     nsStyledElement::UnbindFromTree(aDeep, aNullParent);
 }
 
 void
-nsXULElement::RemoveChildNode(nsIContent* aKid, bool aNotify)
-{
-    // On the removal of a <treeitem>, <treechildren>, or <treecell> element,
-    // the possibility exists that some of the items in the removed subtree
-    // are selected (and therefore need to be deselected). We need to account for this.
-    nsCOMPtr<nsIDOMXULMultiSelectControlElement> controlElement;
-    nsCOMPtr<nsIListBoxObject> listBox;
-    bool fireSelectionHandler = false;
-
-    // -1 = do nothing, -2 = null out current item
-    // anything else = index to re-set as current
-    int32_t newCurrentIndex = -1;
-
-    if (aKid->NodeInfo()->Equals(nsGkAtoms::listitem, kNameSpaceID_XUL)) {
-      // This is the nasty case. We have (potentially) a slew of selected items
-      // and cells going away.
-      // First, retrieve the tree.
-      // Check first whether this element IS the tree
-      controlElement = do_QueryObject(this);
-
-      // If it's not, look at our parent
-      if (!controlElement)
-        GetParentTree(getter_AddRefs(controlElement));
-      nsCOMPtr<nsIContent> controlContent(do_QueryInterface(controlElement));
-      RefPtr<nsXULElement> xulElement = FromNodeOrNull(controlContent);
-
-      if (xulElement) {
-        // Iterate over all of the items and find out if they are contained inside
-        // the removed subtree.
-        int32_t length;
-        controlElement->GetSelectedCount(&length);
-        for (int32_t i = 0; i < length; i++) {
-          nsCOMPtr<nsIDOMXULSelectControlItemElement> item;
-          controlElement->MultiGetSelectedItem(i, getter_AddRefs(item));
-          nsCOMPtr<nsINode> node = do_QueryInterface(item);
-          if (node == aKid &&
-              NS_SUCCEEDED(controlElement->RemoveItemFromSelection(item))) {
-            length--;
-            i--;
-            fireSelectionHandler = true;
-          }
-        }
-
-        nsCOMPtr<nsIDOMXULSelectControlItemElement> curItem;
-        controlElement->GetCurrentItem(getter_AddRefs(curItem));
-        nsCOMPtr<nsIContent> curNode = do_QueryInterface(curItem);
-        if (curNode && nsContentUtils::ContentIsDescendantOf(curNode, aKid)) {
-            // Current item going away
-            nsCOMPtr<nsIBoxObject> box = xulElement->GetBoxObject(IgnoreErrors());
-            listBox = do_QueryInterface(box);
-            if (listBox) {
-              listBox->GetIndexOfItem(aKid->AsElement(), &newCurrentIndex);
-            }
-
-            // If any of this fails, we'll just set the current item to null
-            if (newCurrentIndex == -1)
-              newCurrentIndex = -2;
-        }
-      }
-    }
-
-    nsStyledElement::RemoveChildNode(aKid, aNotify);
-
-    if (newCurrentIndex == -2) {
-        controlElement->SetCurrentItem(nullptr);
-    } else if (newCurrentIndex > -1) {
-        // Make sure the index is still valid
-        int32_t treeRows;
-        listBox->GetRowCount(&treeRows);
-        if (treeRows > 0) {
-            newCurrentIndex = std::min((treeRows - 1), newCurrentIndex);
-            RefPtr<Element> newCurrentItem;
-            listBox->GetItemAtIndex(newCurrentIndex, getter_AddRefs(newCurrentItem));
-            nsCOMPtr<nsIDOMXULSelectControlItemElement> xulCurItem = do_QueryInterface(newCurrentItem);
-            if (xulCurItem)
-                controlElement->SetCurrentItem(xulCurItem);
-        } else {
-            controlElement->SetCurrentItem(nullptr);
-        }
-    }
-
-    nsIDocument* doc;
-    if (fireSelectionHandler && (doc = GetComposedDoc())) {
-      nsContentUtils::DispatchTrustedEvent(doc,
-                                           static_cast<nsIContent*>(this),
-                                           NS_LITERAL_STRING("select"),
-                                           CanBubble::eNo,
-                                           Cancelable::eYes);
-    }
-}
-
-void
 nsXULElement::UnregisterAccessKey(const nsAString& aOldValue)
 {
     // If someone changes the accesskey, unregister the old one
     //
     nsIDocument* doc = GetComposedDoc();
     if (doc && !aOldValue.IsEmpty()) {
         nsIPresShell *shell = doc->GetShell();
 
@@ -1313,34 +1219,16 @@ nsXULElement::GetControllers(ErrorResult
 
 already_AddRefed<BoxObject>
 nsXULElement::GetBoxObject(ErrorResult& rv)
 {
     // XXX sXBL/XBL2 issue! Owner or current document?
     return OwnerDoc()->GetBoxObjectFor(this, rv);
 }
 
-NS_IMETHODIMP
-nsXULElement::GetParentTree(nsIDOMXULMultiSelectControlElement** aTreeElement)
-{
-    for (nsIContent* current = GetParent(); current;
-         current = current->GetParent()) {
-        if (current->NodeInfo()->Equals(nsGkAtoms::listbox,
-                                        kNameSpaceID_XUL)) {
-            CallQueryInterface(current, aTreeElement);
-            // XXX returning NS_OK because that's what the code used to do;
-            // is that the right thing, though?
-
-            return NS_OK;
-        }
-    }
-
-    return NS_OK;
-}
-
 void
 nsXULElement::Click(CallerType aCallerType)
 {
   ClickWithInputSource(MouseEvent_Binding::MOZ_SOURCE_UNKNOWN,
                        aCallerType == CallerType::System);
 }
 
 void
--- a/dom/xul/nsXULElement.h
+++ b/dom/xul/nsXULElement.h
@@ -361,17 +361,16 @@ public:
     void GetEventTargetParent(mozilla::EventChainPreVisitor& aVisitor) override;
     virtual nsresult PreHandleEvent(
                        mozilla::EventChainVisitor& aVisitor) override;
     // nsIContent
     virtual nsresult BindToTree(nsIDocument* aDocument, nsIContent* aParent,
                                 nsIContent* aBindingParent,
                                 bool aCompileEventHandlers) override;
     virtual void UnbindFromTree(bool aDeep, bool aNullParent) override;
-    virtual void RemoveChildNode(nsIContent* aKid, bool aNotify) override;
     virtual void DestroyContent() override;
 
 #ifdef DEBUG
     virtual void List(FILE* out, int32_t aIndent) const override;
     virtual void DumpContent(FILE* out, int32_t aIndent,bool aDumpAll) const override
     {
     }
 #endif
@@ -639,19 +638,16 @@ protected:
     ~nsXULElement();
 
     // This can be removed if EnsureContentsGenerated dies.
     friend class nsNSElementTearoff;
 
     // Implementation methods
     nsresult EnsureContentsGenerated(void) const;
 
-    // Helper routine that crawls a parent chain looking for a tree element.
-    NS_IMETHOD GetParentTree(nsIDOMXULMultiSelectControlElement** aTreeElement);
-
     nsresult AddPopupListener(nsAtom* aName);
 
     /**
      * The nearest enclosing content node with a binding
      * that created us.
      */
     nsCOMPtr<nsIContent> mBindingParent;
 
new file mode 100644
--- /dev/null
+++ b/gfx/layers/BufferEdgePad.cpp
@@ -0,0 +1,93 @@
+#include "BufferEdgePad.h"
+
+#include "mozilla/gfx/Point.h" // for IntSize
+#include "mozilla/gfx/Types.h" // for SurfaceFormat
+
+namespace mozilla {
+namespace layers {
+
+using namespace gfx;
+
+void
+PadDrawTargetOutFromRegion(RefPtr<DrawTarget> aDrawTarget, nsIntRegion &aRegion)
+{
+  struct LockedBits {
+    uint8_t *data;
+    IntSize size;
+    int32_t stride;
+    SurfaceFormat format;
+    static int clamp(int x, int min, int max)
+    {
+      if (x < min)
+        x = min;
+      if (x > max)
+        x = max;
+      return x;
+    }
+
+    static void ensure_memcpy(uint8_t *dst, uint8_t *src, size_t n, uint8_t *bitmap, int stride, int height)
+    {
+        if (src + n > bitmap + stride*height) {
+            MOZ_CRASH("GFX: long src memcpy");
+        }
+        if (src < bitmap) {
+            MOZ_CRASH("GFX: short src memcpy");
+        }
+        if (dst + n > bitmap + stride*height) {
+            MOZ_CRASH("GFX: long dst mempcy");
+        }
+        if (dst < bitmap) {
+            MOZ_CRASH("GFX: short dst mempcy");
+        }
+    }
+
+    static void visitor(void *closure, VisitSide side, int x1, int y1, int x2, int y2) {
+      LockedBits *lb = static_cast<LockedBits*>(closure);
+      uint8_t *bitmap = lb->data;
+      const int bpp = gfx::BytesPerPixel(lb->format);
+      const int stride = lb->stride;
+      const int width = lb->size.width;
+      const int height = lb->size.height;
+
+      if (side == VisitSide::TOP) {
+        if (y1 > 0) {
+          x1 = clamp(x1, 0, width - 1);
+          x2 = clamp(x2, 0, width - 1);
+          ensure_memcpy(&bitmap[x1*bpp + (y1-1) * stride], &bitmap[x1*bpp + y1 * stride], (x2 - x1) * bpp, bitmap, stride, height);
+          memcpy(&bitmap[x1*bpp + (y1-1) * stride], &bitmap[x1*bpp + y1 * stride], (x2 - x1) * bpp);
+        }
+      } else if (side == VisitSide::BOTTOM) {
+        if (y1 < height) {
+          x1 = clamp(x1, 0, width - 1);
+          x2 = clamp(x2, 0, width - 1);
+          ensure_memcpy(&bitmap[x1*bpp + y1 * stride], &bitmap[x1*bpp + (y1-1) * stride], (x2 - x1) * bpp, bitmap, stride, height);
+          memcpy(&bitmap[x1*bpp + y1 * stride], &bitmap[x1*bpp + (y1-1) * stride], (x2 - x1) * bpp);
+        }
+      } else if (side == VisitSide::LEFT) {
+        if (x1 > 0) {
+          while (y1 != y2) {
+            memcpy(&bitmap[(x1-1)*bpp + y1 * stride], &bitmap[x1*bpp + y1*stride], bpp);
+            y1++;
+          }
+        }
+      } else if (side == VisitSide::RIGHT) {
+        if (x1 < width) {
+          while (y1 != y2) {
+            memcpy(&bitmap[x1*bpp + y1 * stride], &bitmap[(x1-1)*bpp + y1*stride], bpp);
+            y1++;
+          }
+        }
+      }
+
+    }
+  } lb;
+
+  if (aDrawTarget->LockBits(&lb.data, &lb.size, &lb.stride, &lb.format)) {
+    // we can only pad software targets so if we can't lock the bits don't pad
+    aRegion.VisitEdges(lb.visitor, &lb);
+    aDrawTarget->ReleaseBits(lb.data);
+  }
+}
+
+} // namespace layers
+} // namespace mozilla
new file mode 100644
--- /dev/null
+++ b/gfx/layers/BufferEdgePad.h
@@ -0,0 +1,21 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef MOZILLA_LAYERS_BUFFER_EDGE_PAD_H
+#define MOZILLA_LAYERS_BUFFER_EDGE_PAD_H
+
+#include "mozilla/gfx/2D.h"
+#include "nsRegion.h"
+
+namespace mozilla {
+namespace layers {
+
+void PadDrawTargetOutFromRegion(RefPtr<gfx::DrawTarget> aDrawTarget, nsIntRegion &aRegion);
+
+} // namespace layers
+} // namespace mozilla
+
+#endif // MOZILLA_LAYERS_BUFFER_EDGE_PAD_H
--- a/gfx/layers/PaintThread.cpp
+++ b/gfx/layers/PaintThread.cpp
@@ -7,16 +7,17 @@
 #include "PaintThread.h"
 
 #include <algorithm>
 
 #include "base/task.h"
 #include "gfxPlatform.h"
 #include "gfxPrefs.h"
 #include "GeckoProfiler.h"
+#include "mozilla/layers/BufferEdgePad.h"
 #include "mozilla/layers/CompositorBridgeChild.h"
 #include "mozilla/layers/ShadowLayers.h"
 #include "mozilla/layers/SyncObject.h"
 #include "mozilla/gfx/2D.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/SharedThreadPool.h"
 #include "mozilla/SyncRunnable.h"
 #include "nsIPropertyBag2.h"
@@ -96,16 +97,49 @@ CapturedTiledPaintState::Clear::ClearBuf
                                iter.Get().Width(), iter.Get().Height());
       mTarget->ClearRect(drawRect);
     }
   }
 
   mTarget->SetTransform(oldTransform);
 }
 
+void
+CapturedTiledPaintState::EdgePad::EdgePadBuffer()
+{
+  PadDrawTargetOutFromRegion(mTarget, mValidRegion);
+}
+
+void
+CapturedTiledPaintState::PrePaint()
+{
+  for (auto& copy : mCopies) {
+    copy.CopyBuffer();
+  }
+
+  for (auto& clear : mClears) {
+    clear.ClearBuffer();
+  }
+}
+
+void
+CapturedTiledPaintState::Paint()
+{
+  mTarget->DrawCapturedDT(mCapture, Matrix());
+  mTarget->Flush();
+}
+
+void
+CapturedTiledPaintState::PostPaint()
+{
+  if (mEdgePad) {
+    mEdgePad->EdgePadBuffer();
+  }
+}
+
 StaticAutoPtr<PaintThread> PaintThread::sSingleton;
 StaticRefPtr<nsIThread> PaintThread::sThread;
 PlatformThreadId PaintThread::sThreadId;
 
 PaintThread::PaintThread()
 {
 }
 
@@ -414,30 +448,19 @@ void
 PaintThread::AsyncPaintTiledContents(CompositorBridgeChild* aBridge,
                                      CapturedTiledPaintState* aState)
 {
   AUTO_PROFILER_LABEL("PaintThread::AsyncPaintTiledContents", GRAPHICS);
   
   MOZ_ASSERT(IsOnPaintWorkerThread());
   MOZ_ASSERT(aState);
 
-  for (auto& copy : aState->mCopies) {
-    copy.CopyBuffer();
-  }
-
-  for (auto& clear : aState->mClears) {
-    clear.ClearBuffer();
-  }
-
-  DrawTarget* target = aState->mTarget;
-  DrawTargetCapture* capture = aState->mCapture;
-
-  // Draw all the things into the actual dest target.
-  target->DrawCapturedDT(capture, Matrix());
-  target->Flush();
+  aState->PrePaint();
+  aState->Paint();
+  aState->PostPaint();
 
   if (gfxPrefs::LayersOMTPReleaseCaptureOnMainThread()) {
     // This should ensure the capture drawtarget, which may hold on to UnscaledFont objects,
     // gets destroyed on the main thread (See bug 1404742). This assumes (unflushed) target
     // DrawTargets do not themselves hold on to UnscaledFonts.
     NS_ReleaseOnMainThreadSystemGroup("CapturePaintState::DrawTargetCapture", aState->mCapture.forget());
   }
 
--- a/gfx/layers/PaintThread.h
+++ b/gfx/layers/PaintThread.h
@@ -218,16 +218,29 @@ public:
 
     void ClearBuffer();
 
     RefPtr<gfx::DrawTarget> mTarget;
     RefPtr<gfx::DrawTarget> mTargetOnWhite;
     nsIntRegion mDirtyRegion;
   };
 
+  struct EdgePad {
+    EdgePad(RefPtr<gfx::DrawTarget> aTarget,
+            nsIntRegion&& aValidRegion)
+      : mTarget(aTarget)
+      , mValidRegion(aValidRegion)
+    {}
+
+    void EdgePadBuffer();
+
+    RefPtr<gfx::DrawTarget> mTarget;
+    nsIntRegion mValidRegion;
+  };
+
   CapturedTiledPaintState()
   {}
   CapturedTiledPaintState(gfx::DrawTarget* aTarget,
                           gfx::DrawTargetCapture* aCapture)
   : mTarget(aTarget)
   , mCapture(aCapture)
   {}
 
@@ -239,20 +252,25 @@ public:
     }
   }
 
   void DropTextureClients()
   {
     mClients.clear();
   }
 
+  void PrePaint();
+  void Paint();
+  void PostPaint();
+
   RefPtr<gfx::DrawTarget> mTarget;
   RefPtr<gfx::DrawTargetCapture> mCapture;
   std::vector<Copy> mCopies;
   std::vector<Clear> mClears;
+  Maybe<EdgePad> mEdgePad;
 
   std::vector<RefPtr<TextureClient>> mClients;
 
 protected:
   virtual ~CapturedTiledPaintState() {}
 };
 
 class CompositorBridgeChild;
--- a/gfx/layers/SourceSurfaceSharedData.cpp
+++ b/gfx/layers/SourceSurfaceSharedData.cpp
@@ -5,16 +5,18 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "SourceSurfaceSharedData.h"
 
 #include "mozilla/Likely.h"
 #include "mozilla/Types.h" // for decltype
 #include "mozilla/layers/SharedSurfacesChild.h"
 
+#include "base/process_util.h"
+
 #ifdef DEBUG
 /**
  * If defined, this makes SourceSurfaceSharedData::Finalize memory protect the
  * underlying shared buffer in the producing process (the content or UI
  * process). Given flushing the page table is expensive, and its utility is
  * predominantly diagnostic (in case of overrun), turn it off by default.
  */
 #define SHARED_SURFACE_PROTECT_FINALIZED
--- a/gfx/layers/client/MultiTiledContentClient.cpp
+++ b/gfx/layers/client/MultiTiledContentClient.cpp
@@ -3,16 +3,17 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "mozilla/layers/MultiTiledContentClient.h"
 
 #include "ClientTiledPaintedLayer.h"
 #include "mozilla/layers/LayerMetricsWrapper.h"
+#include "mozilla/layers/BufferEdgePad.h"
 
 namespace mozilla {
 
 using namespace gfx;
 
 namespace layers {
 
 MultiTiledContentClient::MultiTiledContentClient(ClientTiledPaintedLayer& aPaintedLayer,
@@ -134,96 +135,16 @@ ClientMultiTiledLayerBuffer::PaintThebes
   }
 #endif
 
   mLastPaintContentType = GetContentType(&mLastPaintSurfaceMode);
   mCallback = nullptr;
   mCallbackData = nullptr;
 }
 
-void PadDrawTargetOutFromRegion(RefPtr<DrawTarget> drawTarget, nsIntRegion &region)
-{
-  struct LockedBits {
-    uint8_t *data;
-    IntSize size;
-    int32_t stride;
-    SurfaceFormat format;
-    static int clamp(int x, int min, int max)
-    {
-      if (x < min)
-        x = min;
-      if (x > max)
-        x = max;
-      return x;
-    }
-
-    static void ensure_memcpy(uint8_t *dst, uint8_t *src, size_t n, uint8_t *bitmap, int stride, int height)
-    {
-        if (src + n > bitmap + stride*height) {
-            MOZ_CRASH("GFX: long src memcpy");
-        }
-        if (src < bitmap) {
-            MOZ_CRASH("GFX: short src memcpy");
-        }
-        if (dst + n > bitmap + stride*height) {
-            MOZ_CRASH("GFX: long dst mempcy");
-        }
-        if (dst < bitmap) {
-            MOZ_CRASH("GFX: short dst mempcy");
-        }
-    }
-
-    static void visitor(void *closure, VisitSide side, int x1, int y1, int x2, int y2) {
-      LockedBits *lb = static_cast<LockedBits*>(closure);
-      uint8_t *bitmap = lb->data;
-      const int bpp = gfx::BytesPerPixel(lb->format);
-      const int stride = lb->stride;
-      const int width = lb->size.width;
-      const int height = lb->size.height;
-
-      if (side == VisitSide::TOP) {
-        if (y1 > 0) {
-          x1 = clamp(x1, 0, width - 1);
-          x2 = clamp(x2, 0, width - 1);
-          ensure_memcpy(&bitmap[x1*bpp + (y1-1) * stride], &bitmap[x1*bpp + y1 * stride], (x2 - x1) * bpp, bitmap, stride, height);
-          memcpy(&bitmap[x1*bpp + (y1-1) * stride], &bitmap[x1*bpp + y1 * stride], (x2 - x1) * bpp);
-        }
-      } else if (side == VisitSide::BOTTOM) {
-        if (y1 < height) {
-          x1 = clamp(x1, 0, width - 1);
-          x2 = clamp(x2, 0, width - 1);
-          ensure_memcpy(&bitmap[x1*bpp + y1 * stride], &bitmap[x1*bpp + (y1-1) * stride], (x2 - x1) * bpp, bitmap, stride, height);
-          memcpy(&bitmap[x1*bpp + y1 * stride], &bitmap[x1*bpp + (y1-1) * stride], (x2 - x1) * bpp);
-        }
-      } else if (side == VisitSide::LEFT) {
-        if (x1 > 0) {
-          while (y1 != y2) {
-            memcpy(&bitmap[(x1-1)*bpp + y1 * stride], &bitmap[x1*bpp + y1*stride], bpp);
-            y1++;
-          }
-        }
-      } else if (side == VisitSide::RIGHT) {
-        if (x1 < width) {
-          while (y1 != y2) {
-            memcpy(&bitmap[x1*bpp + y1 * stride], &bitmap[(x1-1)*bpp + y1*stride], bpp);
-            y1++;
-          }
-        }
-      }
-
-    }
-  } lb;
-
-  if (drawTarget->LockBits(&lb.data, &lb.size, &lb.stride, &lb.format)) {
-    // we can only pad software targets so if we can't lock the bits don't pad
-    region.VisitEdges(lb.visitor, &lb);
-    drawTarget->ReleaseBits(lb.data);
-  }
-}
-
 void ClientMultiTiledLayerBuffer::Update(const nsIntRegion& newValidRegion,
                                          const nsIntRegion& aPaintRegion,
                                          const nsIntRegion& aDirtyRegion,
                                          TilePaintFlags aFlags)
 {
   const IntSize scaledTileSize = GetScaledTileSize();
   const gfx::IntRect newBounds = newValidRegion.GetBounds();
 
@@ -279,16 +200,23 @@ void ClientMultiTiledLayerBuffer::Update
       }
 
       // Validating the tile may have required more to be painted.
       paintRegion.OrWith(tileDrawRegion);
       dirtyRegion.OrWith(tileDrawRegion);
     }
 
     if (!mPaintTiles.empty()) {
+      // Perform buffer copies and clears if we don't have the paint thread
+      if (!(aFlags & TilePaintFlags::Async)) {
+        for (const auto& state : mPaintStates) {
+          state->PrePaint();
+        }
+      }
+
       // Create a tiled draw target
       gfx::TileSet tileset;
       for (size_t i = 0; i < mPaintTiles.size(); ++i) {
         mPaintTiles[i].mTileOrigin -= mTilingOrigin;
       }
       tileset.mTiles = &mPaintTiles[0];
       tileset.mTileCount = mPaintTiles.size();
       RefPtr<DrawTarget> drawTarget = gfx::Factory::CreateTiledDrawTarget(tileset);
@@ -303,65 +231,37 @@ void ClientMultiTiledLayerBuffer::Update
       MOZ_ASSERT(ctx); // already checked the draw target above
       ctx->SetMatrix(
         ctx->CurrentMatrix().PreScale(mResolution, mResolution).PreTranslate(-mTilingOrigin));
 
       mCallback(&mPaintedLayer, ctx, paintRegion, dirtyRegion,
                 DrawRegionClip::DRAW, nsIntRegion(), mCallbackData);
       ctx = nullptr;
 
+      // Dispatch to the paint thread or do any work left over
       if (aFlags & TilePaintFlags::Async) {
         for (const auto& state : mPaintStates) {
           PaintThread::Get()->PaintTiledContents(state);
         }
         mManager->SetQueuedAsyncPaints();
-        MOZ_ASSERT(mPaintStates.size() > 0);
-        mPaintStates.clear();
       } else {
-        MOZ_ASSERT(mPaintStates.size() == 0);
+        for (const auto& state : mPaintStates) {
+          state->PostPaint();
+        }
       }
+      mPaintStates.clear();
 
       // Reset
       mPaintTiles.clear();
       mTilingOrigin = IntPoint(std::numeric_limits<int32_t>::max(),
                                std::numeric_limits<int32_t>::max());
     }
 
-    bool edgePaddingEnabled = gfxPrefs::TileEdgePaddingEnabled();
     for (uint32_t i = 0; i < mRetainedTiles.Length(); ++i) {
       TileClient& tile = mRetainedTiles[i];
-
-      // Only worry about padding when not doing low-res because it simplifies
-      // the math and the artifacts won't be noticable
-      // Edge padding prevents sampling artifacts when compositing.
-      if (edgePaddingEnabled && mResolution == 1 &&
-          tile.mFrontBuffer && tile.mFrontBuffer->IsLocked()) {
-
-        const TileCoordIntPoint tileCoord = newTiles.TileCoord(i);
-        IntPoint tileOffset = GetTileOffset(tileCoord);
-        // Strictly speakig we want the unscaled rect here, but it doesn't matter
-        // because we only run this code when the resolution is equal to 1.
-        IntRect tileRect = IntRect(tileOffset.x, tileOffset.y,
-                                   GetTileSize().width, GetTileSize().height);
-
-        nsIntRegion tileDrawRegion = IntRect(tileOffset, scaledTileSize);
-        tileDrawRegion.AndWith(paintRegion);
-
-        nsIntRegion tileValidRegion = mValidRegion;
-        tileValidRegion.OrWith(tileDrawRegion);
-
-        // We only need to pad out if the tile has area that's not valid
-        if (!tileValidRegion.Contains(tileRect)) {
-          tileValidRegion = tileValidRegion.Intersect(tileRect);
-          // translate the region into tile space and pad
-          tileValidRegion.MoveBy(-IntPoint(tileOffset.x, tileOffset.y));
-          RefPtr<DrawTarget> drawTarget = tile.mFrontBuffer->BorrowDrawTarget();
-          PadDrawTargetOutFromRegion(drawTarget, tileValidRegion);
-        }
-      }
       UnlockTile(tile);
     }
   }
 
   mTiles = newTiles;
   mValidRegion = newValidRegion;
 }
 
@@ -456,61 +356,74 @@ ClientMultiTiledLayerBuffer::ValidateTil
 
   RefPtr<DrawTarget> drawTarget;
   if (dtOnWhite) {
     drawTarget = Factory::CreateDualDrawTarget(dt, dtOnWhite);
   } else {
     drawTarget = dt;
   }
 
+  // Create the paint operation that will be either dispatched to the paint
+  // thread, or executed synchronously
+  RefPtr<CapturedTiledPaintState> paintState = new CapturedTiledPaintState();
+
+  paintState->mCopies = std::move(asyncPaintCopies);
+
   // We need to clear the dirty region of the tile before painting
   // if we are painting non-opaque content
-  Maybe<CapturedTiledPaintState::Clear> clear = Nothing();
   if (mode != SurfaceMode::SURFACE_OPAQUE) {
-    clear = Some(CapturedTiledPaintState::Clear{
+    auto clear = CapturedTiledPaintState::Clear{
       dt,
       dtOnWhite,
       tileDirtyRegion
-    });
+    };
+    paintState->mClears.push_back(clear);
   }
 
-  // Queue or execute the paint operation
+  // Only worry about padding when not doing low-res because it simplifies
+  // the math and the artifacts won't be noticable
+  // Edge padding prevents sampling artifacts when compositing.
+  if (gfxPrefs::TileEdgePaddingEnabled() && mResolution == 1) {
+    IntRect tileRect = IntRect(0, 0,
+                               GetScaledTileSize().width,
+                               GetScaledTileSize().height);
+
+    // We only need to pad out if the tile has area that's not valid
+    if (!tileVisibleRegion.Contains(tileRect)) {
+      tileVisibleRegion = tileVisibleRegion.Intersect(tileRect);
+
+      paintState->mEdgePad = Some(CapturedTiledPaintState::EdgePad{
+        drawTarget,
+        std::move(tileVisibleRegion),
+      });
+    }
+  }
+
+  paintState->mClients = std::move(asyncPaintClients);
+  paintState->mClients.push_back(backBuffer);
+  if (backBufferOnWhite) {
+    paintState->mClients.push_back(backBufferOnWhite);
+  }
+
   gfx::Tile paintTile;
   paintTile.mTileOrigin = gfx::IntPoint(aTileOrigin.x, aTileOrigin.y);
 
   if (aFlags & TilePaintFlags::Async) {
-    RefPtr<CapturedTiledPaintState> asyncPaint = new CapturedTiledPaintState();
-
     RefPtr<DrawTargetCapture> captureDT =
       Factory::CreateCaptureDrawTarget(drawTarget->GetBackendType(),
                                        drawTarget->GetSize(),
                                        drawTarget->GetFormat());
     paintTile.mDrawTarget = captureDT;
-    asyncPaint->mTarget = drawTarget;
-    asyncPaint->mCapture = captureDT;
-
-    asyncPaint->mCopies = std::move(asyncPaintCopies);
-    if (clear) {
-      asyncPaint->mClears.push_back(*clear);
-    }
-
-    asyncPaint->mClients = std::move(asyncPaintClients);
-    asyncPaint->mClients.push_back(backBuffer);
-    if (backBufferOnWhite) {
-      asyncPaint->mClients.push_back(backBufferOnWhite);
-    }
-
-    mPaintStates.push_back(asyncPaint);
+    paintState->mTarget = drawTarget;
+    paintState->mCapture = captureDT;
   } else {
     paintTile.mDrawTarget = drawTarget;
-    if (clear) {
-      clear->ClearBuffer();
-    }
   }
 
+  mPaintStates.push_back(paintState);
   mPaintTiles.push_back(paintTile);
 
   mTilingOrigin.x = std::min(mTilingOrigin.x, paintTile.mTileOrigin.x);
   mTilingOrigin.y = std::min(mTilingOrigin.y, paintTile.mTileOrigin.y);
 
   // The new buffer is now validated, remove the dirty region from it.
   aTile.mInvalidBack.SubOut(tileDirtyRegion);
 
--- a/gfx/layers/moz.build
+++ b/gfx/layers/moz.build
@@ -120,16 +120,17 @@ EXPORTS.mozilla.layers += [
     'AsyncCanvasRenderer.h',
     'AtomicRefCountedWithFinalize.h',
     'AxisPhysicsModel.h',
     'AxisPhysicsMSDModel.h',
     'basic/BasicCompositor.h',
     'basic/MacIOSurfaceTextureHostBasic.h',
     'basic/TextureHostBasic.h',
     'BSPTree.h',
+    'BufferEdgePad.h',
     'BufferTexture.h',
     'CanvasRenderer.h',
     'client/CanvasClient.h',
     'client/CompositableClient.h',
     'client/ContentClient.h',
     'client/GPUVideoTextureClient.h',
     'client/ImageClient.h',
     'client/MultiTiledContentClient.h',
@@ -345,16 +346,17 @@ UNIFIED_SOURCES += [
     'basic/BasicCompositor.cpp',
     'basic/BasicContainerLayer.cpp',
     'basic/BasicImages.cpp',
     'basic/BasicLayerManager.cpp',
     'basic/BasicLayersImpl.cpp',
     'basic/BasicPaintedLayer.cpp',
     'basic/TextureHostBasic.cpp',
     'BSPTree.cpp',
+    'BufferEdgePad.cpp',
     'BufferTexture.cpp',
     'BufferUnrotate.cpp',
     'CanvasRenderer.cpp',
     'client/CanvasClient.cpp',
     'client/ClientCanvasLayer.cpp',
     'client/ClientCanvasRenderer.cpp',
     'client/ClientColorLayer.cpp',
     'client/ClientContainerLayer.cpp',
--- a/gfx/thebes/gfxPlatform.cpp
+++ b/gfx/thebes/gfxPlatform.cpp
@@ -2723,19 +2723,16 @@ gfxPlatform::InitOMTPConfig()
     omtp.ForceDisable(FeatureStatus::Blocked, "OMTP blocked before OSX 10.10",
                       NS_LITERAL_CSTRING("FEATURE_FAILURE_OMTP_OSX_MAVERICKS"));
   }
 #endif
 
   if (InSafeMode()) {
     omtp.ForceDisable(FeatureStatus::Blocked, "OMTP blocked by safe-mode",
                       NS_LITERAL_CSTRING("FEATURE_FAILURE_COMP_SAFEMODE"));
-  } else if (gfxPrefs::TileEdgePaddingEnabled()) {
-    omtp.ForceDisable(FeatureStatus::Blocked, "OMTP does not yet support tiling with edge padding",
-                      NS_LITERAL_CSTRING("FEATURE_FAILURE_OMTP_TILING"));
   }
 
   if (omtp.IsEnabled()) {
     gfxVars::SetUseOMTP(true);
     reporter.SetSuccessful(paintWorkerCount);
   }
 }
 
--- a/js/src/ds/LifoAlloc.cpp
+++ b/js/src/ds/LifoAlloc.cpp
@@ -203,16 +203,24 @@ LifoAlloc::newChunkWithCapacity(size_t n
         chunkSize = RoundUpPow2(allocSizeWithCanaries);
     } else {
         chunkSize = defaultChunkSize_;
     }
 
     bool protect = false;
 #ifdef LIFO_CHUNK_PROTECT
     protect = protect_;
+    // In a few cases where we keep adding memory protection, we might OOM while
+    // doing a mprotect / VirtualProtect due to the consumption of space in the
+    // page table reserved by the system. This error appears as an OOM on Linux,
+    // as an Invalid parameters on Windows and as a crash on OS/X. This code caps
+    // the amount of memory protected in order to limit occurences of this issue.
+    const size_t MaxPeakSize = 32 * 1024 * 1024;
+    if (protect && MaxPeakSize <= this->peakSize_)
+        protect = false;
 #endif
 
     // Create a new BumpChunk, and allocate space for it.
     UniqueBumpChunk result = detail::BumpChunk::newWithCapacity(chunkSize, protect);
     if (!result)
         return nullptr;
     MOZ_ASSERT(result->computedSizeOfIncludingThis() == chunkSize);
     return result;
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/consume-interpreter-stack-bug1473289.js
@@ -0,0 +1,495 @@
+// |jit-test| allow-overrecursed
+
+(function f(x) {
+    f(x - 1);
+    Array.prototype.unshift.call(a1, s2, a1, t2, a0, p2, t2);
+    var r2;
+    var r3;
+    var r4;
+    var r5;
+    var r6;
+    var r7;
+    var r8;
+    var r9;
+    var r10;
+    var r11;
+    var r12;
+    var r13;
+    var r14;
+    var r15;
+    var r16;
+    var r17;
+    var r18;
+    var r19;
+    var r20;
+    var r21;
+    var r22;
+    var r23;
+    var r24;
+    var r25;
+    var r26;
+    var r27;
+    var r28;
+    var r29;
+    var r30;
+    var r31;
+    var r32;
+    var r33;
+    var r34;
+    var r35;
+    var r36;
+    var r37;
+    var r38;
+    var r39;
+    var r40;
+    var r41;
+    var r42;
+    var r43;
+    var r44;
+    var r45;
+    var r46;
+    var r47;
+    var r48;
+    var r49;
+    var r50;
+    var r51;
+    var r52;
+    var r53;
+    var r54;
+    var r55;
+    var r56;
+    var r57;
+    var r58;
+    var r59;
+    var r60;
+    var r61;
+    var r62;
+    var r63;
+    var r64;
+    var r65;
+    var r66;
+    var r67;
+    var r68;
+    var r69;
+    var r70;
+    var r71;
+    var r72;
+    var r73;
+    var r74;
+    var r75;
+    var r76;
+    var r77;
+    var r78;
+    var r79;
+    var r80;
+    var r81;
+    var r82;
+    var r83;
+    var r84;
+    var r85;
+    var r86;
+    var r87;
+    var r88;
+    var r89;
+    var r90;
+    var r91;
+    var r92;
+    var r93;
+    var r149;
+    var r150;
+    var r151;
+    var r152;
+    var r153;
+    var r154;
+    var r155;
+    var r156;
+    var r157;
+    var r158;
+    var r159;
+    var r160;
+    var r161;
+    var r162;
+    var r163;
+    var r164;
+    var r165;
+    var r166;
+    var r167;
+    var r168;
+    var r169;
+    var r170;
+    var r171;
+    var r172;
+    var r173;
+    var r174;
+    var r175;
+    var r176;
+    var r177;
+    var r178;
+    var r179;
+    var r180;
+    var r181;
+    var r182;
+    var r183;
+    var r184;
+    var r185;
+    var r186;
+    var r187;
+    var r188;
+    var r189;
+    var r190;
+    var r191;
+    var r192;
+    var r193;
+    var r194;
+    var r195;
+    var r196;
+    var r197;
+    var r198;
+    var r199;
+    var r200;
+    var r201;
+    var r202;
+    var r203;
+    var r204;
+    var r205;
+    var r206;
+    var r207;
+    var r208;
+    var r209;
+    var r210;
+    var r211;
+    var r212;
+    var r213;
+    var r214;
+    var r215;
+    var r216;
+    var r217;
+    var r218;
+    var r219;
+    var r220;
+    var r221;
+    var r222;
+    var r223;
+    var r224;
+    var r225;
+    var r226;
+    var r227;
+    var r228;
+    var r229;
+    var r230;
+    var r231;
+    var r232;
+    var r233;
+    var r234;
+    var r235;
+    var r236;
+    var r237;
+    var r238;
+    var r239;
+    var r240;
+    var r241;
+    var r242;
+    var r243;
+    var r244;
+    var r245;
+    var r246;
+    var r247;
+    var r248;
+    var r249;
+    var r250;
+    var r251;
+    var r252;
+    var r253;
+    var r254;
+    var r255;
+    var r256;
+    var r257;
+    var r258;
+    var r259;
+    var r260;
+    var r261;
+    var r262;
+    var r263;
+    var r264;
+    var r265;
+    var r266;
+    var r267;
+    var r268;
+    var r269;
+    var r270;
+    var r271;
+    var r272;
+    var r273;
+    var r274;
+    var r275;
+    var r276;
+    var r277;
+    var r278;
+    var r279;
+    var r280;
+    var r281;
+    var r282;
+    var r283;
+    var r284;
+    var r285;
+    var r286;
+    var r287;
+    var r288;
+    var r289;
+    var r290;
+    var r291;
+    var r292;
+    var r293;
+    var r294;
+    var r295;
+    var r296;
+    var r297;
+    var r298;
+    var r299;
+    var r300;
+    var r301;
+    var r302;
+    var r303;
+    var r304;
+    var r305;
+    var r306;
+    var r307;
+    var r308;
+    var r309;
+    var r310;
+    var r311;
+    var r312;
+    var r313;
+    var r314;
+    var r315;
+    var r316;
+    var r317;
+    var r318;
+    var r319;
+    var r320;
+    var r321;
+    var r322;
+    var r323;
+    var r324;
+    var r325;
+    var r326;
+    var r327;
+    var r328;
+    var r329;
+    var r330;
+    var r331;
+    var r332;
+    var r333;
+    var r334;
+    var r335;
+    var r336;
+    var r337;
+    var r338;
+    var r339;
+    var r340;
+    var r341;
+    var r342;
+    var r343;
+    var r344;
+    var r345;
+    var r346;
+    var r347;
+    var r348;
+    var r349;
+    var r350;
+    var r351;
+    var r352;
+    var r353;
+    var r354;
+    var r355;
+    var r356;
+    var r357;
+    var r358;
+    var r359;
+    var r360;
+    var r361;
+    var r362;
+    var r363;
+    var r364;
+    var r365;
+    var r366;
+    var r367;
+    var r368;
+    var r369;
+    var r370;
+    var r371;
+    var r372;
+    var r373;
+    var r374;
+    var r375;
+    var r376;
+    var r377;
+    var r378;
+    var r379;
+    var r380;
+    var r381;
+    var r382;
+    var r383;
+    var r384;
+    var r385;
+    var r386;
+    var r387;
+    var r388;
+    var r389;
+    var r390;
+    var r391;
+    var r392;
+    var r393;
+    var r394;
+    var r395;
+    var r396;
+    var r397;
+    var r398;
+    var r399;
+    var r400;
+    var r401;
+    var r402;
+    var r403;
+    var r404;
+    var r405;
+    var r406;
+    var r407;
+    var r408;
+    var r409;
+    var r410;
+    var r411;
+    var r412;
+    var r413;
+    var r414;
+    var r415;
+    var r416;
+    var r417;
+    var r418;
+    var r419;
+    var r420;
+    var r421;
+    var r422;
+    var r423;
+    var r424;
+    var r425;
+    var r426;
+    var r427;
+    var r428;
+    var r429;
+    var r430;
+    var r431;
+    var r432;
+    var r433;
+    var r434;
+    var r435;
+    var r436;
+    var r437;
+    var r438;
+    var r439;
+    var r440;
+    var r441;
+    var r442;
+    var r443;
+    var r444;
+    var r445;
+    var r446;
+    var r447;
+    var r448;
+    var r449;
+    var r450;
+    var r451;
+    var r452;
+    var r453;
+    var r454;
+    var r455;
+    var r456;
+    var r457;
+    var r458;
+    var r459;
+    var r460;
+    var r461;
+    var r462;
+    var r463;
+    var r464;
+    var r465;
+    var r466;
+    var r467;
+    var r468;
+    var r469;
+    var r470;
+    var r471;
+    var r472;
+    var r473;
+    var r474;
+    var r475;
+    var r476;
+    var r477;
+    var r478;
+    var r479;
+    var r480;
+    var r481;
+    var r482;
+    var r483;
+    var r484;
+    var r485;
+    var r486;
+    var r487;
+    var r488;
+    var r489;
+    var r490;
+    var r491;
+    var r492;
+    var r493;
+    var r494;
+    var r495;
+    var r496;
+    var r497;
+    var r498;
+    var r499;
+    var r500;
+    var r501;
+    var r502;
+    var r503;
+    var r504;
+    var r505;
+    var r506;
+    var r507;
+    var r508;
+    var r509;
+    var r510;
+    var r511;
+    var r512;
+    var r513;
+    var r514;
+    var r515;
+    var r516;
+    var r517;
+    var r518;
+    var r519;
+    var r520;
+    var r521;
+    var r522;
+    var r523;
+    var r524;
+    var r525;
+    var r526;
+    var r527;
+    var r528;
+    var r529;
+    var r530;
+    var r531;
+    var r532;
+    var r533;
+    var r534;
+    var r535;
+    var r536;
+    var r537;
+    var r538;
+    var r539;
+    var r540;
+    var r541;
+    var r542;
+    var r543;
+    var r544;
+    var r545;
+})(32769);
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/expr-decompiler-bug1475953.js
@@ -0,0 +1,36 @@
+Object.defineProperty(this, "fuzzutils", { value:{} });
+setModuleResolveHook(function(module, specifier) {});
+try { evaluate(`
+  var f = 396684;
+  var src = "return f(" +Array(10*1000).join("0,")+"Math.atan2());";
+  var result = new Function(src)();
+`);
+} catch (exc) {}
+try {
+  evalInWorker(`
+    function lfEvalInCache(lfCode, lfIncremental = false, lfRunOnce = false) {
+      ctx = Object.create(ctx, {});
+    }
+    try { evaluate(\`
+      var f = 396684;
+      var src = "return f(" +Array(10*1000).join("0,")+"Math.atan2());";
+      var result = new Function(src)();
+      \`); } catch(exc) {}
+  `);
+  evalInWorker(`
+    Object.defineProperty(this, "fuzzutils", { value:{} });
+    try { evaluate(\`
+    var f = 396684;
+    var src = "return f(" +Array(10*1000).join("0,")+"Math.atan2());";
+    var result = new Function(src)();
+    \`); } catch(exc) {}
+  `);
+} catch (exc) {}
+try { evalInWorker(`
+  try { evaluate(\`
+    var f = 396684;
+    var src = "return f(" +Array(10*1000).join("0,")+"Math.atan2());";
+    var result = new Function(src)();
+  \`); } catch(exc) {}
+`);
+} catch (exc) {}
deleted file mode 100644
--- a/layout/base/crashtests/354771-1.xul
+++ /dev/null
@@ -1,28 +0,0 @@
-<?xml version="1.0"?>
-
-<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
-
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-
-<listbox flex="1" style="float: right">
-  <listitem label="foo"/>
-  <listitem label="foo"/>
-  <listitem label="foo"/>
-  <listitem label="foo"/>
-  <listitem label="foo"/>
-  <listitem label="foo"/>
-  <listitem label="foo"/>
-  <listitem label="foo"/>
-  <listitem label="foo"/>
-  <listitem label="foo"/>
-  <listitem label="foo"/>
-  <listitem label="foo"/>
-  <listitem label="foo"/>
-  <listitem label="foo"/>
-  <listitem label="foo"/>
-  <listitem label="foo"/>
-  <listitem label="b" style="float: left;"/>
-  <listitem label="c" style="position: absolute"/>
-</listbox>
-
-</window>
deleted file mode 100644
--- a/layout/base/crashtests/373919.xhtml
+++ /dev/null
@@ -1,29 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">
-
-<object id="mw_ij" xmlns="http://www.w3.org/1999/xhtml" style="display: none;"/>
-
-<textnode xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-  <dir xmlns="http://www.w3.org/1999/xhtml" style="overflow: scroll;position: fixed;"/>
-</textnode>
-
-<wizardpage id="mw_ab" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-  <label id="mw_kl">
-    <toolbox style="float: right;"/>
-  </label>
-</wizardpage>
-
-<listbox id="mw_cd" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"/>
-
-<script xmlns="http://www.w3.org/1999/xhtml">
-function doe() {
-document.getElementById('mw_ab').insertBefore(document.getElementById('mw_cd'), document.getElementById('mw_ab').childNodes[0]);
-document.documentElement.offsetHeight;
-document.getElementById('mw_ij').appendChild(document.getElementById('mw_kl'));
-document.documentElement.offsetHeight;
-}
-setTimeout(doe, 100);
-
-setTimeout(function() {window.location=window.location;}, 500);
-</script>
-
-</html>
\ No newline at end of file
deleted file mode 100644
--- a/layout/base/crashtests/376223-1.xhtml
+++ /dev/null
@@ -1,29 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml"
-      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-<head>
-<script>
-
-function boom()
-{
-  var listbox = document.getElementById("listbox");
-  var td = document.getElementById("td");
-
-  var listitem = document.createElementNS(XUL_NS, "listitem");
-
-  listbox.appendChild(listitem);
-  listbox.appendChild(td);
-}
-
-var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
-
-</script>
-</head>
-
-<body onload="boom();">
-
-<table><tbody><tr><td id="td">X</td></tr></tbody></table>
-
-<xul:listbox id="listbox"/>
-
-</body>
-</html>
deleted file mode 100644
--- a/layout/base/crashtests/383102-1.xhtml
+++ /dev/null
@@ -1,13 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml"
-      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" >
-<body>
-
-<xul:hbox>
-  <xul:hbox>
-    <xul:listboxbody><xul:hbox/><span><div></div></span></xul:listboxbody>
-  </xul:hbox>
-  <xul:toolbarbutton/>
-</xul:hbox>
-
-</body>
-</html>
deleted file mode 100644
--- a/layout/base/crashtests/383806-1.xhtml
+++ /dev/null
@@ -1,29 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml"
-      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-<head>
-<script>
-
-function boom()
-{
-  var listbox = document.getElementById("listbox");
-  var td = document.getElementById("td");
-
-  var listitem = document.createElementNS(XUL_NS, "listitem");
-
-  listbox.appendChild(listitem);
-  listbox.appendChild(td);
-}
-
-var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
-
-</script>
-</head>
-
-<body onload="boom();">
-
-<table><tbody><tr><td id="td">X</td></tr></tbody></table>
-
-<xul:listbox id="listbox"/>
-
-</body>
-</html>
deleted file mode 100644
--- a/layout/base/crashtests/400185-1.xul
+++ /dev/null
@@ -1,21 +0,0 @@
-<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="setTimeout(doe, 30);" class="reftest-wait">
-<popupgroup id="a"/>
-<listcols>
-<nativescrollbar id="c">
-<treecols/>
-</nativescrollbar>
-</listcols>
-
-<script>
-function doe() {
-  document.documentElement.id = "true";
-  document.documentElement.removeChild(document.getElementById('a')); 
-  var ne = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", 'popupgroup'); 
-  document.documentElement.appendChild(ne); 
-  document.getElementById('c').appendChild(document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", 'treecols'));
-  document.documentElement.removeChild(ne);
-  document.documentElement.removeAttribute("class");
-}
-</script>
-</window>
deleted file mode 100644
--- a/layout/base/crashtests/414175-1.xul
+++ /dev/null
@@ -1,26 +0,0 @@
-<xul xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
-
-<script type="text/javascript">
-
-function boom()
-{
-  var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
-
-  var oldListbox = document.getElementById("oldListbox");
-  var listitem = document.getElementById("listitem");
-  var newListbox = document.createElementNS(XUL_NS, "listbox");
-  var newHbox = document.createElementNS(XUL_NS, "hbox");
-
-  oldListbox.appendChild(newListbox);
-  listitem.appendChild(newHbox);
-
-  newListbox.style.display = "inline";
-  oldListbox.style.display = "block";
-  newHbox.style.display = "inline";
-}
-
-</script>
-
-<listbox id="oldListbox"><listitem id="listitem" /></listbox>
-
-</xul>
deleted file mode 100644
--- a/layout/base/crashtests/428113.xhtml
+++ /dev/null
@@ -1,2 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">
-<listbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" style="float: right;"><listitem/><listitem/><listitem/><listitem/><listitem/><listitem label="foo"/><listitem style="position: absolute;"/></listbox></html>
deleted file mode 100644
--- a/layout/base/crashtests/514104-1.xul
+++ /dev/null
@@ -1,22 +0,0 @@
-<?xml version="1.0"?>
-<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
-
-<!-- there must be no extra elements in the document -->
-
-<window onload="
-            document.documentElement.removeChild(document.getElementById('b'));
-            document.getElementById('l').removeChild(document.getElementById('h'));
-            document.documentElement.appendChild(document.createElementNS('http://www.w3.org/1999/xhtml', 'span'));"
-        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-
-<bindings xmlns="http://www.mozilla.org/xbl" id="b">
-    <binding id="foo">
-        <content><listitem xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><children xmlns="http://www.mozilla.org/xbl"/></listitem></content>
-    </binding>
-</bindings>
-
-<listbox id="l" style="-moz-binding: url(&quot;#foo&quot;);"><hbox id="h"/></listbox>
-
-<listitem/>
-
-</window>
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -111,17 +111,16 @@ load 348126-1.html
 load 348688-1.html
 load 348708-1.xhtml
 load 348729-1.html
 load 349095-1.xhtml
 load 350128-1.xhtml
 load 350267-1.html
 load 354133-1.html
 load 354766-1.xhtml
-load 354771-1.xul
 load 355989-1.xhtml
 load 355993-1.xhtml
 load 356325-1.xul
 load 358729-1.xhtml
 load 360339-1.xul
 load 360339-2.xul
 load 363729-1.html
 load 363729-2.html
@@ -140,35 +139,31 @@ load 369176-1.html
 load 369547-1.html
 load 369547-2.html
 load 369945-1.xhtml
 load 371681-1.xhtml
 load 372237-1.html
 load 372475-1.xhtml
 load 372550-1.html
 load 373628-1.html
-load 373919.xhtml
 load 374193-1.xhtml
 load 374297-1.html
 load 374297-2.html
-load 376223-1.xhtml
 load 378325-1.html
 load 378682.html
 load 379105-1.xhtml
 load 379419-1.xhtml
 load 379768-1.html
 load 379799-1.html
 load 379920-1.svg
 load 379920-2.svg
 load 379975.html
 load 380096-1.html
 load 382204-1.html # bug 1323680
-load 383102-1.xhtml
 load 383129-1.html
-load 383806-1.xhtml
 load 384344-1.html
 load 384392-1.xhtml
 load 384392-2.svg
 load 384649-1.xhtml
 load 385354.html
 load 385866-1.xhtml
 load 385880-1.xhtml
 load 386266-1.html
@@ -192,17 +187,16 @@ load 399132-1.xhtml
 load 399219-1.xhtml
 load 399365-1.html
 load 399676-1.xhtml
 load 399687-1.html
 load 399940-1.xhtml
 load 399946-1.xhtml
 load 399951-1.html
 load 399994-1.html
-load 400185-1.xul
 load 400445-1.xhtml
 load 400904-1.xhtml
 load 401589-1.xul
 load 401734-1.html
 load 401734-2.html
 needs-focus pref(accessibility.browsewithcaret,true) load 403048.html
 skip load 403175-1.html # times out occasionally, bug 473680
 load 403245-1.html # bug 1323652
@@ -223,30 +217,28 @@ load 408299.html
 load 408450-1.xhtml
 load 409461-1.xhtml
 load 409513.html
 load 410967.html
 load 411870-1.html
 load 412651-1.html
 load 413587-1.svg
 load 414058-1.html
-load 414175-1.xul
 load 415503.xhtml
 load 416107.xhtml # bug 1323652
 HTTP load 419985.html
 load 420031-1.html
 load 420213-1.html
 load 420219-1.html # bug 1323652
 load 420651-1.xhtml
 load 421203-1.xul
 load 421432.html
 load 422276.html
 asserts(0-1) load 423107-1.xhtml # bug 866955
 load 425981-1.html
-load 428113.xhtml
 load 428138-1.html
 load 428448-1.html
 load 429088-1.html
 load 429088-2.html
 load 429780-1.xhtml
 load 429865-1.html
 load 429881.html
 load 430569-1.html
@@ -322,17 +314,16 @@ load 497519-3.xhtml
 load 497519-4.xhtml
 load 499741-1.xhtml
 load 499841-1.xhtml
 load 499858-1.xhtml
 load 500467-1.html
 load 501878-1.html
 load 503936-1.html
 load 507119.html
-load 514104-1.xul
 load 522374-1.html
 load 522374-2.html
 load 526378-1.xul
 load 534367-1.xhtml
 load 534368-1.xhtml
 load 534768-1.html
 load 534768-2.html
 load 535721-1.xhtml
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -223,19 +223,16 @@ static FrameCtorDebugFlags gFlags[] = {
 #endif
 
 
 #ifdef MOZ_XUL
 #include "nsMenuFrame.h"
 #include "nsPopupSetFrame.h"
 #include "nsTreeColFrame.h"
 #include "nsIBoxObject.h"
-#include "nsPIListBoxObject.h"
-#include "nsListBoxBodyFrame.h"
-#include "nsListItemFrame.h"
 #include "nsXULLabelFrame.h"
 
 //------------------------------------------------------------------
 
 nsContainerFrame*
 NS_NewRootBoxFrame (nsIPresShell* aPresShell, ComputedStyle* aStyle);
 
 nsContainerFrame*
@@ -331,43 +328,16 @@ NS_NewImageFrameForGeneratedContentIndex
 #ifdef NOISY_FINDFRAME
 static int32_t FFWC_totalCount=0;
 static int32_t FFWC_doLoop=0;
 static int32_t FFWC_doSibling=0;
 static int32_t FFWC_recursions=0;
 static int32_t FFWC_nextInFlows=0;
 #endif
 
-#ifdef MOZ_XUL
-
-static bool
-IsXULListBox(nsIContent* aContainer)
-{
-  return aContainer->IsXULElement(nsGkAtoms::listbox);
-}
-
-static
-nsListBoxBodyFrame*
-MaybeGetListBoxBodyFrame(nsIContent* aChild)
-{
-  if (aChild->IsXULElement(nsGkAtoms::listitem) && aChild->GetParent() &&
-      IsXULListBox(aChild->GetParent())) {
-    RefPtr<nsXULElement> xulElement =
-      nsXULElement::FromNode(aChild->GetParent());
-    nsCOMPtr<nsIBoxObject> boxObject = xulElement->GetBoxObject(IgnoreErrors());
-    nsCOMPtr<nsPIListBoxObject> listBoxObject = do_QueryInterface(boxObject);
-    if (listBoxObject) {
-      return listBoxObject->GetListBoxBody(false);
-    }
-  }
-
-  return nullptr;
-}
-#endif // MOZ_XUL
-
 // Returns true if aFrame is an anonymous flex/grid item.
 static inline bool
 IsAnonymousFlexOrGridItem(const nsIFrame* aFrame)
 {
   const nsAtom* pseudoType = aFrame->Style()->GetPseudo();
   return pseudoType == nsCSSAnonBoxes::anonymousFlexItem ||
          pseudoType == nsCSSAnonBoxes::anonymousGridItem;
 }
@@ -4340,19 +4310,16 @@ nsCSSFrameConstructor::FindXULTagData(El
     SIMPLE_XUL_CREATE(menubar, NS_NewMenuBarFrame),
 #endif /* XP_MACOSX */
     SIMPLE_TAG_CHAIN(popupgroup, nsCSSFrameConstructor::FindPopupGroupData),
     SIMPLE_XUL_CREATE(iframe, NS_NewSubDocumentFrame),
     SIMPLE_XUL_CREATE(editor, NS_NewSubDocumentFrame),
     SIMPLE_XUL_CREATE(browser, NS_NewSubDocumentFrame),
     SIMPLE_XUL_CREATE(progressmeter, NS_NewProgressMeterFrame),
     SIMPLE_XUL_CREATE(splitter, NS_NewSplitterFrame),
-    SIMPLE_TAG_CHAIN(listboxbody,
-                     nsCSSFrameConstructor::FindXULListBoxBodyData),
-    SIMPLE_TAG_CHAIN(listitem, nsCSSFrameConstructor::FindXULListItemData),
 #endif /* MOZ_XUL */
     SIMPLE_XUL_CREATE(slider, NS_NewSliderFrame),
     SIMPLE_XUL_CREATE(scrollbar, NS_NewScrollbarFrame),
     SIMPLE_XUL_CREATE(scrollbarbutton, NS_NewScrollbarButtonFrame)
   };
 
   return FindDataByTag(aTag, aElement, aComputedStyle, sXULTagData,
                        ArrayLength(sXULTagData));
@@ -4432,45 +4399,16 @@ nsCSSFrameConstructor::FindXULMenubarDat
   }
 
   static const FrameConstructionData sMenubarData =
     SIMPLE_XUL_FCDATA(NS_NewMenuBarFrame);
   return &sMenubarData;
 }
 #endif /* XP_MACOSX */
 
-/* static */
-const nsCSSFrameConstructor::FrameConstructionData*
-nsCSSFrameConstructor::FindXULListBoxBodyData(Element* aElement,
-                                              ComputedStyle* aComputedStyle)
-{
-  if (aComputedStyle->StyleDisplay()->mDisplay !=
-        StyleDisplay::MozGridGroup) {
-    return nullptr;
-  }
-
-  static const FrameConstructionData sListBoxBodyData =
-    SCROLLABLE_XUL_FCDATA(NS_NewListBoxBodyFrame);
-  return &sListBoxBodyData;
-}
-
-/* static */
-const nsCSSFrameConstructor::FrameConstructionData*
-nsCSSFrameConstructor::FindXULListItemData(Element* aElement,
-                                           ComputedStyle* aComputedStyle)
-{
-  if (aComputedStyle->StyleDisplay()->mDisplay != StyleDisplay::MozGridLine) {
-    return nullptr;
-  }
-
-  static const FrameConstructionData sListItemData =
-    SCROLLABLE_XUL_FCDATA(NS_NewListItemFrame);
-  return &sListItemData;
-}
-
 #endif /* MOZ_XUL */
 
 /* static */
 const nsCSSFrameConstructor::FrameConstructionData*
 nsCSSFrameConstructor::FindXULDisplayData(const nsStyleDisplay* aDisplay,
                                           Element* aElement,
                                           ComputedStyle* aComputedStyle)
 {
@@ -5512,23 +5450,19 @@ nsCSSFrameConstructor::ShouldCreateItems
                                                  nsContainerFrame* aParentFrame)
 {
   aContent->UnsetFlags(NODE_DESCENDANTS_NEED_FRAMES | NODE_NEEDS_FRAME);
   // XXX the GetContent() != aContent check is needed due to bug 135040.
   // Remove it once that's fixed.
   if (aContent->GetPrimaryFrame() &&
       aContent->GetPrimaryFrame()->GetContent() == aContent &&
       !aState.mCreatingExtraFrames) {
-    // This condition is known to be reachable for listitems, assert fatally
-    // elsewhere.
-    MOZ_ASSERT(MaybeGetListBoxBodyFrame(aContent),
+    MOZ_ASSERT(false,
                "asked to create frame construction item for a node that "
                "already has a frame");
-    NS_ERROR("asked to create frame construction item for a node that already "
-             "has a frame");
     return false;
   }
 
   // don't create a whitespace frame if aParent doesn't want it
   if (!NeedFrameFor(aState, aParentFrame, aContent)) {
     return false;
   }
 
@@ -6901,18 +6835,17 @@ nsCSSFrameConstructor::MaybeConstructLaz
 void
 nsCSSFrameConstructor::IssueSingleInsertNofications(nsIContent* aStartChild,
                                                     nsIContent* aEndChild,
                                                     InsertionKind aInsertionKind)
 {
   for (nsIContent* child = aStartChild;
        child != aEndChild;
        child = child->GetNextSibling()) {
-    // listboxes suck.
-    MOZ_ASSERT(MaybeGetListBoxBodyFrame(child) || !child->GetPrimaryFrame());
+    MOZ_ASSERT(!child->GetPrimaryFrame());
 
     // Call ContentRangeInserted with this node.
     ContentRangeInserted(child, child->GetNextSibling(),
                          mTempFrameTreeState, aInsertionKind);
   }
 }
 
 bool
@@ -7352,54 +7285,16 @@ nsCSSFrameConstructor::ContentAppended(n
 
 #ifdef ACCESSIBILITY
   if (nsAccessibilityService* accService = nsIPresShell::AccService()) {
     accService->ContentRangeInserted(mPresShell, aFirstNewContent, nullptr);
   }
 #endif
 }
 
-#ifdef MOZ_XUL
-
-enum content_operation
-{
-    CONTENT_INSERTED,
-    CONTENT_REMOVED
-};
-
-// Helper function to lookup the listbox body frame and send a notification
-// for insertion or removal of content
-static bool
-NotifyListBoxBody(nsPresContext*    aPresContext,
-                  nsIContent*        aChild,
-                  // Only used for the removed notification
-                  nsIContent*        aOldNextSibling,
-                  nsIFrame*          aChildFrame,
-                  content_operation  aOperation)
-{
-  nsListBoxBodyFrame* listBoxBodyFrame = MaybeGetListBoxBodyFrame(aChild);
-  if (listBoxBodyFrame) {
-    if (aOperation == CONTENT_REMOVED) {
-      // Except if we have an aChildFrame and its parent is not the right
-      // thing, then we don't do this.  Pseudo frames are so much fun....
-      if (!aChildFrame || aChildFrame->GetParent() == listBoxBodyFrame) {
-        listBoxBodyFrame->OnContentRemoved(aPresContext, aChild->GetParent(),
-                                           aChildFrame, aOldNextSibling);
-        return true;
-      }
-    } else {
-      listBoxBodyFrame->OnContentInserted(aChild);
-      return true;
-    }
-  }
-
-  return false;
-}
-#endif // MOZ_XUL
-
 void
 nsCSSFrameConstructor::ContentInserted(nsIContent* aChild,
                                        nsILayoutHistoryState* aFrameState,
                                        InsertionKind aInsertionKind)
 {
   ContentRangeInserted(aChild,
                        aChild->GetNextSibling(),
                        aFrameState,
@@ -7468,35 +7363,16 @@ nsCSSFrameConstructor::ContentRangeInser
 
   bool isSingleInsert = (aStartChild->GetNextSibling() == aEndChild);
   NS_ASSERTION(isSingleInsert ||
                aInsertionKind == InsertionKind::Sync,
                "range insert shouldn't be lazy");
   NS_ASSERTION(isSingleInsert || aEndChild,
                "range should not include all nodes after aStartChild");
 
-#ifdef MOZ_XUL
-  if (aStartChild->GetParent() && IsXULListBox(aStartChild->GetParent())) {
-    if (isSingleInsert) {
-      // The insert case in NotifyListBoxBody doesn't use "old next sibling".
-      if (NotifyListBoxBody(mPresShell->GetPresContext(),
-                            aStartChild, nullptr, nullptr, CONTENT_INSERTED)) {
-        return;
-      }
-    } else {
-      // We don't handle a range insert to a listbox parent, issue single
-      // ContertInserted calls for each node inserted.
-      LAYOUT_PHASE_TEMP_EXIT();
-      IssueSingleInsertNofications(aStartChild, aEndChild, InsertionKind::Sync);
-      LAYOUT_PHASE_TEMP_REENTER();
-      return;
-    }
-  }
-#endif // MOZ_XUL
-
   // If we have a null parent, then this must be the document element being
   // inserted, or some other child of the document in the DOM (might be a PI,
   // say).
   if (!aStartChild->GetParent()) {
     MOZ_ASSERT(isSingleInsert,
                "root node insertion should be a single insertion");
     Element* docElement = mDocument->GetRootElement();
 
@@ -7955,23 +7831,16 @@ nsCSSFrameConstructor::ContentRemoved(ns
 
   nsIFrame* childFrame = aChild->GetPrimaryFrame();
   if (!childFrame || childFrame->GetContent() != aChild) {
     // XXXbz the GetContent() != aChild check is needed due to bug 135040.
     // Remove it once that's fixed.
     childFrame = nullptr;
   }
 
-#ifdef MOZ_XUL
-  if (NotifyListBoxBody(presContext, aChild, aOldNextSibling,
-                        childFrame, CONTENT_REMOVED)) {
-    return false;
-  }
-#endif // MOZ_XUL
-
   // If we're removing the root, then make sure to remove things starting at
   // the viewport's child instead of the primary frame (which might even be
   // null if the root had an XBL binding or display:none, even though the
   // frames above it got created).  Detecting removal of a root is a little
   // exciting; in particular, having no parent is necessary but NOT sufficient.
   // Due to how we process reframes, the content node might not even be in our
   // document by now.  So explicitly check whether the viewport's first kid's
   // content node is aChild.
@@ -11132,85 +11001,16 @@ nsCSSFrameConstructor::RecoverLetterFram
 
     // Insert in the letter frame(s)
     parentFrame->InsertFrames(kPrincipalList, prevFrame, letterFrames);
   }
 }
 
 //----------------------------------------------------------------------
 
-// listbox Widget Routines
-
-void
-nsCSSFrameConstructor::CreateListBoxContent(nsContainerFrame*      aParentFrame,
-                                            nsIFrame*              aPrevFrame,
-                                            nsIContent*            aChild,
-                                            nsIFrame**             aNewFrame,
-                                            bool                   aIsAppend)
-{
-#ifdef MOZ_XUL
-  // Construct a new frame
-  if (aParentFrame) {
-    nsFrameItems            frameItems;
-    nsFrameConstructorState state(mPresShell,
-                                  GetAbsoluteContainingBlock(aParentFrame, FIXED_POS),
-                                  GetAbsoluteContainingBlock(aParentFrame, ABS_POS),
-                                  GetFloatContainingBlock(aParentFrame),
-                                  do_AddRef(mTempFrameTreeState));
-
-    if (aChild->IsElement() && !aChild->AsElement()->HasServoData()) {
-      mPresShell->StyleSet()->StyleNewSubtree(aChild->AsElement());
-    }
-
-    RefPtr<ComputedStyle> computedStyle = ResolveComputedStyle(aChild);
-
-    // Pre-check for display "none" - only if we find that, do we create
-    // any frame at all
-    const nsStyleDisplay* display = computedStyle->StyleDisplay();
-
-    if (StyleDisplay::None == display->mDisplay) {
-      *aNewFrame = nullptr;
-      return;
-    }
-
-    AutoFrameConstructionItemList items(this);
-    AddFrameConstructionItemsInternal(state, aChild, aParentFrame,
-                                      true, computedStyle,
-                                      ITEM_ALLOW_XBL_BASE, nullptr, items);
-    ConstructFramesFromItemList(state, items, aParentFrame,
-                                /* aParentIsWrapperAnonBox = */ false,
-                                frameItems);
-
-    nsIFrame* newFrame = frameItems.FirstChild();
-    *aNewFrame = newFrame;
-
-    if (newFrame) {
-      // Notify the parent frame
-      if (aIsAppend)
-        ((nsListBoxBodyFrame*)aParentFrame)->ListBoxAppendFrames(frameItems);
-      else
-        ((nsListBoxBodyFrame*)aParentFrame)->ListBoxInsertFrames(aPrevFrame, frameItems);
-    }
-
-#ifdef ACCESSIBILITY
-    if (newFrame) {
-      nsAccessibilityService* accService = nsIPresShell::AccService();
-      if (accService) {
-        accService->ContentRangeInserted(mPresShell,
-                                         aChild,
-                                         aChild->GetNextSibling());
-      }
-    }
-#endif
-  }
-#endif
-}
-
-//----------------------------------------
-
 void
 nsCSSFrameConstructor::ConstructBlock(nsFrameConstructorState& aState,
                                       nsIContent*              aContent,
                                       nsContainerFrame*        aParentFrame,
                                       nsContainerFrame*        aContentParentFrame,
                                       ComputedStyle*          aComputedStyle,
                                       nsContainerFrame**       aNewFrame,
                                       nsFrameItems&            aFrameItems,
--- a/layout/base/nsCSSFrameConstructor.h
+++ b/layout/base/nsCSSFrameConstructor.h
@@ -344,22 +344,16 @@ public:
   InsertionPoint GetInsertionPoint(nsIContent* aChild);
 
   /**
    * Return the insertion frame of the primary frame of aContent, or its nearest
    * ancestor that isn't display:contents.
    */
   nsContainerFrame* GetContentInsertionFrameFor(nsIContent* aContent);
 
-  void CreateListBoxContent(nsContainerFrame* aParentFrame,
-                            nsIFrame*         aPrevFrame,
-                            nsIContent*       aChild,
-                            nsIFrame**        aResult,
-                            bool              aIsAppend);
-
   // GetInitialContainingBlock() is deprecated in favor of GetRootElementFrame();
   // nsIFrame* GetInitialContainingBlock() { return mRootElementFrame; }
   // This returns the outermost frame for the root element
   nsContainerFrame* GetRootElementFrame() { return mRootElementFrame; }
   // This returns the frame for the root element that does not
   // have a psuedo-element style
   nsIFrame* GetRootElementStyleFrame() { return mRootElementStyleFrame; }
   nsIFrame* GetPageSequenceFrame() { return mPageSequenceFrame; }
@@ -1560,20 +1554,16 @@ private:
   static const FrameConstructionData*
     FindXULLabelData(Element* aElement, ComputedStyle* aComputedStyle);
   static const FrameConstructionData*
     FindXULDescriptionData(Element* aElement, ComputedStyle* aComputedStyle);
 #ifdef XP_MACOSX
   static const FrameConstructionData*
     FindXULMenubarData(Element* aElement, ComputedStyle* aComputedStyle);
 #endif /* XP_MACOSX */
-  static const FrameConstructionData*
-    FindXULListBoxBodyData(Element* aElement, ComputedStyle* aComputedStyle);
-  static const FrameConstructionData*
-    FindXULListItemData(Element* aElement, ComputedStyle* aComputedStyle);
 #endif /* MOZ_XUL */
 
   // Function to find FrameConstructionData for aContent using one of the XUL
   // display types.  Will return null if aDisplay doesn't have a XUL display
   // type.  This function performs no other checks, so should only be called if
   // we know for sure that the content is not something that should get a frame
   // constructed by tag.
   static const FrameConstructionData*
--- a/layout/build/nsLayoutCID.h
+++ b/layout/build/nsLayoutCID.h
@@ -14,20 +14,16 @@
 /* a6cf90f9-15b3-11d2-932e-00805f8add32 */
 #define NS_LAYOUT_DEBUGGER_CID \
  { 0xa6cf90f9, 0x15b3, 0x11d2,{0x93, 0x2e, 0x00, 0x80, 0x5f, 0x8a, 0xdd, 0x32}}
 
 // {D750A964-2D14-484c-B3AA-8ED7823B5C7B}
 #define NS_BOXOBJECT_CID \
 { 0xd750a964, 0x2d14, 0x484c, { 0xb3, 0xaa, 0x8e, 0xd7, 0x82, 0x3b, 0x5c, 0x7b } }
 
-// {C2710D40-6F4D-4b7f-9778-76AE5166648C}
-#define NS_LISTBOXOBJECT_CID \
-{ 0xc2710d40, 0x6f4d, 0x4b7f, { 0x97, 0x78, 0x76, 0xae, 0x51, 0x66, 0x64, 0x8c } }
-
 // {AA40253B-4C42-4056-8132-37BCD07862FD}
 #define NS_MENUBOXOBJECT_CID \
 { 0xaa40253b, 0x4c42, 0x4056, { 0x81, 0x32, 0x37, 0xbc, 0xd0, 0x78, 0x62, 0xfd } }
 
 // {3B581FD4-3497-426c-8F61-3658B971CB80}
 #define NS_TREEBOXOBJECT_CID \
 { 0x3b581fd4, 0x3497, 0x426c, { 0x8f, 0x61, 0x36, 0x58, 0xb9, 0x71, 0xcb, 0x80 } }
 
--- a/layout/build/nsLayoutModule.cpp
+++ b/layout/build/nsLayoutModule.cpp
@@ -295,17 +295,16 @@ Shutdown()
 
 #ifdef DEBUG
 nsresult NS_NewLayoutDebugger(nsILayoutDebugger** aResult);
 #endif
 
 nsresult NS_NewBoxObject(nsIBoxObject** aResult);
 
 #ifdef MOZ_XUL
-nsresult NS_NewListBoxObject(nsIBoxObject** aResult);
 nsresult NS_NewMenuBoxObject(nsIBoxObject** aResult);
 nsresult NS_NewTreeBoxObject(nsIBoxObject** aResult);
 #endif
 
 nsresult NS_CreateFrameTraversal(nsIFrameTraversal** aResult);
 
 already_AddRefed<nsIContentViewer> NS_NewContentViewer();
 nsresult NS_NewContentDocumentLoaderFactory(nsIDocumentLoaderFactory** aResult);
@@ -356,17 +355,16 @@ ctor_(nsISupports* aOuter, REFNSIID aIID
 #ifdef DEBUG
 MAKE_CTOR(CreateNewLayoutDebugger,        nsILayoutDebugger,           NS_NewLayoutDebugger)
 #endif
 
 MAKE_CTOR(CreateNewFrameTraversal,      nsIFrameTraversal,      NS_CreateFrameTraversal)
 MAKE_CTOR(CreateNewBoxObject,           nsIBoxObject,           NS_NewBoxObject)
 
 #ifdef MOZ_XUL
-MAKE_CTOR(CreateNewListBoxObject,       nsIBoxObject,           NS_NewListBoxObject)
 MAKE_CTOR(CreateNewMenuBoxObject,       nsIBoxObject,           NS_NewMenuBoxObject)
 MAKE_CTOR(CreateNewTreeBoxObject,       nsIBoxObject,           NS_NewTreeBoxObject)
 #endif // MOZ_XUL
 
 NS_GENERIC_FACTORY_CONSTRUCTOR(inDeepTreeWalker)
 
 MAKE_CTOR2(CreateContentViewer,           nsIContentViewer,            NS_NewContentViewer)
 MAKE_CTOR(CreateHTMLDocument,             nsIDocument,                 NS_NewHTMLDocument)
@@ -498,17 +496,16 @@ Construct_nsIScriptSecurityManager(nsISu
 }
 
 #ifdef DEBUG
 NS_DEFINE_NAMED_CID(NS_LAYOUT_DEBUGGER_CID);
 #endif
 NS_DEFINE_NAMED_CID(NS_FRAMETRAVERSAL_CID);
 NS_DEFINE_NAMED_CID(NS_BOXOBJECT_CID);
 #ifdef MOZ_XUL
-NS_DEFINE_NAMED_CID(NS_LISTBOXOBJECT_CID);
 NS_DEFINE_NAMED_CID(NS_MENUBOXOBJECT_CID);
 NS_DEFINE_NAMED_CID(NS_TREEBOXOBJECT_CID);
 #endif // MOZ_XUL
 NS_DEFINE_NAMED_CID(IN_DEEPTREEWALKER_CID);
 NS_DEFINE_NAMED_CID(NS_CONTENT_VIEWER_CID);
 NS_DEFINE_NAMED_CID(NS_HTMLDOCUMENT_CID);
 NS_DEFINE_NAMED_CID(NS_XMLDOCUMENT_CID);
 NS_DEFINE_NAMED_CID(NS_SVGDOCUMENT_CID);
@@ -739,17 +736,16 @@ nsEditingCommandTableConstructor(nsISupp
 static const mozilla::Module::CIDEntry kLayoutCIDs[] = {
   XPCONNECT_CIDENTRIES
 #ifdef DEBUG
   { &kNS_LAYOUT_DEBUGGER_CID, false, nullptr, CreateNewLayoutDebugger },
 #endif
   { &kNS_FRAMETRAVERSAL_CID, false, nullptr, CreateNewFrameTraversal },
   { &kNS_BOXOBJECT_CID, false, nullptr, CreateNewBoxObject },
 #ifdef MOZ_XUL
-  { &kNS_LISTBOXOBJECT_CID, false, nullptr, CreateNewListBoxObject },
   { &kNS_MENUBOXOBJECT_CID, false, nullptr, CreateNewMenuBoxObject },
   { &kNS_TREEBOXOBJECT_CID, false, nullptr, CreateNewTreeBoxObject },
 #endif // MOZ_XUL
   { &kIN_DEEPTREEWALKER_CID, false, nullptr, inDeepTreeWalkerConstructor },
   { &kNS_CONTENT_VIEWER_CID, false, nullptr, CreateContentViewer },
   { &kNS_HTMLDOCUMENT_CID, false, nullptr, CreateHTMLDocument },
   { &kNS_XMLDOCUMENT_CID, false, nullptr, CreateXMLDocument },
   { &kNS_SVGDOCUMENT_CID, false, nullptr, CreateSVGDocument },
@@ -846,17 +842,16 @@ static const mozilla::Module::CIDEntry k
   { &kNS_SCRIPTERROR_CID, false, nullptr, nsScriptErrorConstructor },
   { nullptr }
 };
 
 static const mozilla::Module::ContractIDEntry kLayoutContracts[] = {
   XPCONNECT_CONTRACTS
   { "@mozilla.org/layout/xul-boxobject;1", &kNS_BOXOBJECT_CID },
 #ifdef MOZ_XUL
-  { "@mozilla.org/layout/xul-boxobject-listbox;1", &kNS_LISTBOXOBJECT_CID },
   { "@mozilla.org/layout/xul-boxobject-menu;1", &kNS_MENUBOXOBJECT_CID },
   { "@mozilla.org/layout/xul-boxobject-tree;1", &kNS_TREEBOXOBJECT_CID },
 #endif // MOZ_XUL
   { "@mozilla.org/inspector/deep-tree-walker;1", &kIN_DEEPTREEWALKER_CID },
   { "@mozilla.org/xml/xml-document;1", &kNS_XMLDOCUMENT_CID },
   { "@mozilla.org/svg/svg-document;1", &kNS_SVGDOCUMENT_CID },
   { "@mozilla.org/content/post-content-iterator;1", &kNS_CONTENTITERATOR_CID },
   { "@mozilla.org/content/pre-content-iterator;1", &kNS_PRECONTENTITERATOR_CID },
deleted file mode 100644
--- a/layout/generic/crashtests/363848-1.xhtml
+++ /dev/null
@@ -1,10 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml"
-      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-      
-<body>
-
-<xul:listbox />
-
-</body>
-
-</html>
\ No newline at end of file
deleted file mode 100644
--- a/layout/generic/crashtests/472957.xhtml
+++ /dev/null
@@ -1,14 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-<head>
-
-<bindings xmlns="http://www.mozilla.org/xbl">
-  <binding id="b">
-    <content><xul:hbox><children/></xul:hbox></content>
-  </binding>  
-</bindings>
-
-</head>
-
-<body><xul:listboxbody height="168178912813" style="-moz-binding: url(#b);"><xul:iframe/></xul:listboxbody></body>
-
-</html>
deleted file mode 100644
--- a/layout/generic/crashtests/494300-1.xul
+++ /dev/null
@@ -1,49 +0,0 @@
-<?xml version="1.0"?>
-
-<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
-
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();" class="reftest-wait">
-<script type="text/javascript">
-// <![CDATA[
-
-var HTML_NS   = "http://www.w3.org/1999/xhtml";
-var MATHML_NS = "http://www.w3.org/1998/Math/MathML";
-var XUL_NS    = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
-
-function boom()
-{
-    var listbox = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "listbox");
-    var listitem = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "listitem");
-    listbox.appendChild(listitem);
-    document.documentElement.appendChild(listbox);
-    var hbox = document.createElementNS(XUL_NS, "hbox");
-    listbox.appendChild(hbox);
-    var mphantom = document.createElementNS(MATHML_NS, 'mphantom');
-    listbox.appendChild(mphantom);
-    var wax = document.createElementNS(MATHML_NS, 'wax');
-    hbox.appendChild(wax);
-    var msub = document.createElementNS(MATHML_NS, 'msub');
-    wax.appendChild(msub);
-    var merror = document.createElementNS(MATHML_NS, 'merror');
-    wax.appendChild(merror);
-    var span = document.createElementNS(HTML_NS, 'span');
-    mphantom.appendChild(span);
-    var vbox = document.createElementNS(XUL_NS, 'vbox');
-    span.appendChild(vbox);
-
-    setTimeout(boom2, 0);
-
-    function boom2()
-    {
-        var munderover = document.createElementNS(MATHML_NS, 'munderover'); 
-        msub.appendChild(munderover);
-        var mtext = document.createElementNS(MATHML_NS, 'mtext');
-        span.appendChild(mtext);
-
-        document.documentElement.removeAttribute("class");
-    }
-}
-
-// ]]>
-</script>
-</window>
deleted file mode 100644
--- a/layout/generic/crashtests/547338.xul
+++ /dev/null
@@ -1,27 +0,0 @@
-<?xml version="1.0"?>
-<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
-
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-
-<script type="text/javascript">
-<![CDATA[
-
-function boom()
-{
-  document.getElementById("list").ensureIndexIsVisible(4);
-  document.getElementById("i4").style.fontSize = "10000%";
-}
-
-window.addEventListener("load", boom, false);
-
-]]>
-</script>
-
-<listbox id="list" rows="3">
-  <listitem/>
-  <listitem/>
-  <listitem/>
-  <listitem id="i4" label="Item 4"/><listitem/>
-</listbox>
-
-</window>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -57,17 +57,16 @@ load 354458-1.html
 load 354458-2.html
 load 355426-1.html
 load 359371-1.html
 load 359371-2.html
 load 360599.html
 load 363448.html
 load 363722-1.html
 load 363722-2.html
-load 363848-1.xhtml
 load 364220.html
 load 364407-1.html
 load 364686-1.xhtml
 load 366021-1.xhtml
 load 366667-1.html
 load 366952-1.html
 load 367246-1.html
 load 367360.html
@@ -337,17 +336,16 @@ load 468771-1.xhtml
 load 468771-2.xhtml
 load 469859-1.xhtml # bug 1323665
 load 471360.html
 load 472587-1.xhtml
 load 472617-1.xhtml
 load 472774-1.html
 load 472776-1.html
 load 472950-1.html
-load 472957.xhtml
 load 473278-1.xhtml
 load 473894-1.html
 load 476241-1.html
 load 477731-1.html
 load 477928.html
 load 478131-1.html
 load 478170-1.html
 load 478185-1.html
@@ -359,17 +357,16 @@ load 489462-1.html
 load 489477.html
 load 489480-1.xhtml
 load 489647-1.html
 load 493111-1.html
 load 493118-1.html
 load 493649.html
 load 494283-1.xhtml
 load 494283-2.html
-load 494300-1.xul
 load 494332-1.html
 load 495875-1.html
 load 495875-2.html
 load 496742.html
 load 499138.html
 load 499857-1.html
 load 499862-1.html
 asserts(0-3) load 499885-1.xhtml # Bug 1220265
@@ -406,17 +403,16 @@ load 534366-2.html
 load 536692-1.xhtml
 load 537645.xhtml
 load 541277-1.html
 load 541277-2.html
 load 541714-1.html
 load 541714-2.html
 load 542136-1.html
 load 545571-1.html
-load 547338.xul
 load 547843-1.xhtml
 load 551635-1.html
 load 553504-1.xhtml
 load 564368-1.xhtml
 load 564968.xhtml
 load 569193-1.html
 load 570160.html
 load 570289-1.html
--- a/layout/generic/nsFrameIdList.h
+++ b/layout/generic/nsFrameIdList.h
@@ -41,19 +41,17 @@ FRAME_ID(nsHTMLFramesetBorderFrame, None
 FRAME_ID(nsHTMLFramesetFrame, FrameSet, Leaf)
 FRAME_ID(nsHTMLScrollFrame, Scroll, NotLeaf)
 FRAME_ID(nsImageBoxFrame, ImageBox, Leaf)
 FRAME_ID(nsImageControlFrame, ImageControl, Leaf)
 FRAME_ID(nsImageFrame, Image, Leaf)
 FRAME_ID(nsInlineFrame, Inline, NotLeaf)
 FRAME_ID(nsLeafBoxFrame, LeafBox, Leaf)
 FRAME_ID(nsLegendFrame, Legend, NotLeaf)
-FRAME_ID(nsListBoxBodyFrame, Box, NotLeaf)
 FRAME_ID(nsListControlFrame, ListControl, NotLeaf)
-FRAME_ID(nsListItemFrame, Box, NotLeaf)
 FRAME_ID(nsMathMLFrame, None, NotLeaf)
 FRAME_ID(nsMathMLmactionFrame, None, NotLeaf)
 FRAME_ID(nsMathMLmathBlockFrame, Block, NotLeaf)
 FRAME_ID(nsMathMLmathInlineFrame, Inline, NotLeaf)
 FRAME_ID(nsMathMLmencloseFrame, None, NotLeaf)
 FRAME_ID(nsMathMLmfencedFrame, None, NotLeaf)
 FRAME_ID(nsMathMLmfracFrame, None, NotLeaf)
 FRAME_ID(nsMathMLmmultiscriptsFrame, None, NotLeaf)
deleted file mode 100644
--- a/layout/reftests/bugs/486848-1-ref.xul
+++ /dev/null
@@ -1,12 +0,0 @@
-<?xml version="1.0"?>
-
-<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
-
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-<listbox id="listbox">
-  <listitem id="a">a</listitem>
-  <listitem>b</listitem>
-  <listitem id="c">c</listitem>
-</listbox>
-
-</window>
deleted file mode 100644
--- a/layout/reftests/bugs/486848-1.xul
+++ /dev/null
@@ -1,25 +0,0 @@
-<?xml version="1.0"?>
-
-<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
-
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
-	onload="boom();">
-
-<script type="text/javascript">
-
-function boom()
-{
-  var c = document.getElementById("c");
-  var n = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "listitem");
-  n.textContent = "b";
-  c.parentNode.insertBefore(n, c);
-}
-
-</script>
-
-<listbox id="listbox">
-  <listitem id="a">a</listitem>
-  <listitem id="c">c</listitem>
-</listbox>
-
-</window>
deleted file mode 100644
--- a/layout/reftests/bugs/498228-1-ref.xul
+++ /dev/null
@@ -1,27 +0,0 @@
-<?xml version="1.0"?>
-
-<window id="list-testcase" title="Testcase"
-        xmlns:html="http://www.w3.org/1999/xhtml"
-        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
-        class="reftest-wait">
-
-<script>
-function dotest() {
-  var list = document.getElementById('list');
-  list.ensureIndexIsVisible(4);
-  setTimeout("document.documentElement.className = ''", 0);
-}
-
-window.addEventListener("load", dotest, false);
-
-</script>
-		
-<listbox id="list" rows="3" seltype="single">
-<listitem label="Item 1"/>
-<listitem label="Item 2"/>
-<listitem label="Item 3"/>
-<listitem label="Item 4"/>
-<listitem label="Item 5" selected="true"/>
-</listbox>
-
-</window>
deleted file mode 100644
--- a/layout/reftests/bugs/498228-1.xul
+++ /dev/null
@@ -1,31 +0,0 @@
-<?xml version="1.0"?>
-
-<window id="list-testcase" title="Testcase"
-        xmlns:html="http://www.w3.org/1999/xhtml"
-        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
-        class="reftest-wait">
-
-<script>
-function fill() {
-  var list = document.getElementById('list');
-  for (var i = 1; i != 6; i++) {
-    list.appendItem("Item " + i, "");
-  }
-}
-
-function dotest() {
-  fill();
-  var list = document.getElementById('list');
-  list.ensureIndexIsVisible(4);
-  list.selectItem(list.getItemAtIndex(4));
-  setTimeout("document.documentElement.className = ''", 0);
-}
-
-window.addEventListener("load", dotest, false);
-
-</script>
-		
-<listbox id="list" rows="3" seltype="single">
-</listbox>
-
-</window>
--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@@ -1337,17 +1337,16 @@ fuzzy-if(skiaContent,1,5) == 482659-1d.h
 == 486052-2a.html 486052-2-ref.html
 == 486052-2b.html 486052-2-ref.html
 == 486052-2c.html 486052-2-ref.html
 == 486052-2d.html 486052-2-ref.html
 == 486052-2e.html 486052-2-ref.html
 == 486052-2f.html 486052-2-ref.html
 == 486052-2g.html 486052-2-ref.html
 == 486065-1.html 486065-1-ref.html
-== 486848-1.xul 486848-1-ref.xul
 == 487539-1.html about:blank
 == 488390-1.html 488390-1-ref.html
 == 488649-1.html 488649-1-ref.html
 == 488685-1.html 488685-1-ref.html
 == 488692-1.html 488692-1-ref.html
 == 489868-1.svg 489868-1-ref.svg
 == 490173-1.html 490173-1-ref.html
 == 490173-2.html 490173-2-ref.html
@@ -1380,17 +1379,16 @@ random-if(/^Windows\x20NT\x206\.1/.test(
 pref(dom.use_xbl_scopes_for_remote_xul,true) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == 495385-2f.xhtml 495385-2-ref.html # Bug 1392106
 random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == 495385-2g.html 495385-2-ref.html # Bug 1392106
 random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == 495385-2h.html 495385-2-ref.html # Bug 1392106
 random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == 495385-2i.html 495385-2-ref.html # Bug 1392106
 random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == 495385-3.html 495385-3-ref.html # Bug 1392106
 random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == 495385-4.html 495385-4-ref.html # Bug 1392106
 == 496032-1.html 496032-1-ref.html
 == 496840-1.html 496840-1-ref.html
-fuzzy-if(skiaContent,1,17000) == 498228-1.xul 498228-1-ref.xul
 == 501037.html 501037-ref.html
 == 501257-1a.html 501257-1-ref.html
 == 501257-1b.html 501257-1-ref.html
 == 501257-1.xhtml 501257-1-ref.xhtml
 fuzzy-if(webrender,5-6,83244-97456) == 501627-1.html 501627-1-ref.html
 == 502288-1.html 502288-1-ref.html
 fuzzy-if(gtkWidget,1,2) == 502447-1.html 502447-1-ref.html #Bug 1315834
 == 502795-1.html 502795-1-ref.html
deleted file mode 100644
--- a/layout/xul/ListBoxObject.cpp
+++ /dev/null
@@ -1,247 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "mozilla/dom/ListBoxObject.h"
-#include "nsCOMPtr.h"
-#include "nsIFrame.h"
-#include "nsGkAtoms.h"
-#include "nsIScrollableFrame.h"
-#include "nsListBoxBodyFrame.h"
-#include "ChildIterator.h"
-#include "mozilla/dom/Element.h"
-#include "mozilla/dom/ListBoxObjectBinding.h"
-
-namespace mozilla {
-namespace dom {
-
-NS_IMPL_ISUPPORTS_INHERITED(ListBoxObject, BoxObject, nsIListBoxObject,
-                            nsPIListBoxObject)
-
-ListBoxObject::ListBoxObject()
-  : mListBoxBody(nullptr)
-{
-}
-
-ListBoxObject::~ListBoxObject()
-{
-}
-
-JSObject* ListBoxObject::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto)
-{
-  return ListBoxObject_Binding::Wrap(aCx, this, aGivenProto);
-}
-
-// nsIListBoxObject
-NS_IMETHODIMP
-ListBoxObject::GetRowCount(int32_t *aResult)
-{
-  *aResult = GetRowCount();
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-ListBoxObject::GetItemAtIndex(int32_t index, Element **_retval)
-{
-  nsListBoxBodyFrame* body = GetListBoxBody(true);
-  if (body) {
-    return body->GetItemAtIndex(index, _retval);
-  }
-  return NS_OK;
- }
-
-NS_IMETHODIMP
-ListBoxObject::GetIndexOfItem(Element* aElement, int32_t *aResult)
-{
-  *aResult = 0;
-
-  nsListBoxBodyFrame* body = GetListBoxBody(true);
-  if (body) {
-    return body->GetIndexOfItem(aElement, aResult);
-  }
-  return NS_OK;
-}
-
-// ListBoxObject
-
-int32_t
-ListBoxObject::GetRowCount()
-{
-  nsListBoxBodyFrame* body = GetListBoxBody(true);
-  if (body) {
-    return body->GetRowCount();
-  }
-  return 0;
-}
-
-int32_t
-ListBoxObject::GetRowHeight()
-{
-  nsListBoxBodyFrame* body = GetListBoxBody(true);
-  if (body) {
-    return body->GetRowHeightPixels();
-  }
-  return 0;
-}
-
-int32_t
-ListBoxObject::GetNumberOfVisibleRows()
-{
-  nsListBoxBodyFrame* body = GetListBoxBody(true);
-  if (body) {
-    return body->GetNumberOfVisibleRows();
-  }
-  return 0;
-}
-
-int32_t
-ListBoxObject::GetIndexOfFirstVisibleRow()
-{
-  nsListBoxBodyFrame* body = GetListBoxBody(true);
-  if (body) {
-    return body->GetIndexOfFirstVisibleRow();
-  }
-  return 0;
-}
-
-void
-ListBoxObject::EnsureIndexIsVisible(int32_t aRowIndex)
-{
-  nsListBoxBodyFrame* body = GetListBoxBody(true);
-  if (body) {
-    body->EnsureIndexIsVisible(aRowIndex);
-  }
-}
-
-void
-ListBoxObject::ScrollToIndex(int32_t aRowIndex)
-{
-  nsListBoxBodyFrame* body = GetListBoxBody(true);
-  if (body) {
-    body->ScrollToIndex(aRowIndex);
-  }
-}
-
-void
-ListBoxObject::ScrollByLines(int32_t aNumLines)
-{
-  nsListBoxBodyFrame* body = GetListBoxBody(true);
-  if (body) {
-    body->ScrollByLines(aNumLines);
-  }
-}
-
-already_AddRefed<Element>
-ListBoxObject::GetItemAtIndex(int32_t index)
-{
-  RefPtr<Element> el;
-  GetItemAtIndex(index, getter_AddRefs(el));
-  return el.forget();
-}
-
-int32_t
-ListBoxObject::GetIndexOfItem(Element& aElement)
-{
-  int32_t ret;
-  GetIndexOfItem(&aElement, &ret);
-  return ret;
-}
-
-//////////////////////
-
-static nsIContent*
-FindBodyContent(nsIContent* aParent)
-{
-  if (aParent->IsXULElement(nsGkAtoms::listboxbody)) {
-    return aParent;
-  }
-
-  mozilla::dom::FlattenedChildIterator iter(aParent);
-  for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
-    nsIContent* result = FindBodyContent(child);
-    if (result) {
-      return result;
-    }
-  }
-
-  return nullptr;
-}
-
-nsListBoxBodyFrame*
-ListBoxObject::GetListBoxBody(bool aFlush)
-{
-  if (mListBoxBody) {
-    return mListBoxBody;
-  }
-
-  nsIPresShell* shell = GetPresShell(false);
-  if (!shell) {
-    return nullptr;
-  }
-
-  nsIFrame* frame = aFlush ?
-                      GetFrame(false) /* does FlushType::Frames */ :
-                      mContent->GetPrimaryFrame();
-  if (!frame) {
-    return nullptr;
-  }
-
-  // Iterate over our content model children looking for the body.
-  nsCOMPtr<nsIContent> content = FindBodyContent(frame->GetContent());
-
-  if (!content) {
-    return nullptr;
-  }
-
-  // this frame will be a nsGFXScrollFrame
-  frame = content->GetPrimaryFrame();
-  if (!frame) {
-     return nullptr;
-  }
-
-  nsIScrollableFrame* scrollFrame = do_QueryFrame(frame);
-  if (!scrollFrame) {
-    return nullptr;
-  }
-
-  // this frame will be the one we want
-  nsIFrame* yeahBaby = scrollFrame->GetScrolledFrame();
-  if (!yeahBaby) {
-     return nullptr;
-  }
-
-  // It's a frame. Refcounts are irrelevant.
-  nsListBoxBodyFrame* listBoxBody = do_QueryFrame(yeahBaby);
-  NS_ENSURE_TRUE(listBoxBody &&
-                 listBoxBody->SetBoxObject(this),
-                 nullptr);
-  mListBoxBody = listBoxBody;
-  return mListBoxBody;
-}
-
-void
-ListBoxObject::Clear()
-{
-  ClearCachedValues();
-  BoxObject::Clear();
-}
-
-void
-ListBoxObject::ClearCachedValues()
-{
-  mListBoxBody = nullptr;
-}
-
-} // namespace dom
-} // namespace mozilla
-
-// Creation Routine ///////////////////////////////////////////////////////////////////////
-
-nsresult
-NS_NewListBoxObject(nsIBoxObject** aResult)
-{
-  NS_ADDREF(*aResult = new mozilla::dom::ListBoxObject());
-  return NS_OK;
-}
deleted file mode 100644
--- a/layout/xul/ListBoxObject.h
+++ /dev/null
@@ -1,55 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef mozilla_dom_ListBoxObject_h
-#define mozilla_dom_ListBoxObject_h
-
-#include "mozilla/dom/BoxObject.h"
-#include "nsPIListBoxObject.h"
-
-namespace mozilla {
-namespace dom {
-
-class ListBoxObject final : public BoxObject,
-                            public nsPIListBoxObject
-{
-public:
-  NS_DECL_ISUPPORTS_INHERITED
-  NS_DECL_NSILISTBOXOBJECT
-
-  ListBoxObject();
-
-  virtual JSObject* WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto) override;
-
-  // nsPIListBoxObject
-  virtual nsListBoxBodyFrame* GetListBoxBody(bool aFlush) override;
-
-  // nsPIBoxObject
-  virtual void Clear() override;
-  virtual void ClearCachedValues() override;
-
-  // ListBoxObject.webidl
-  int32_t GetRowCount();
-  int32_t GetRowHeight();
-  int32_t GetNumberOfVisibleRows();
-  int32_t GetIndexOfFirstVisibleRow();
-  void EnsureIndexIsVisible(int32_t rowIndex);
-  void ScrollToIndex(int32_t rowIndex);
-  void ScrollByLines(int32_t numLines);
-  already_AddRefed<Element> GetItemAtIndex(int32_t index);
-  int32_t GetIndexOfItem(Element& item);
-
-protected:
-  nsListBoxBodyFrame *mListBoxBody;
-
-private:
-  ~ListBoxObject();
-};
-
-} // namespace dom
-} // namespace mozilla
-
-#endif // mozilla_dom_ListBoxObject_h
deleted file mode 100644
--- a/layout/xul/crashtests/265161-1.xul
+++ /dev/null
@@ -1,9 +0,0 @@
-<?xml version="1.0"?>
-<window
-	xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
-	xmlns:html="http://www.w3.org/1999/xhtml">
-			<html:div>
-				<listitem>
-				</listitem>
-			</html:div>
-</window>
deleted file mode 100644
--- a/layout/xul/crashtests/326834-1-inner.xul
+++ /dev/null
@@ -1,17 +0,0 @@
-<window title="Testcase bug 326834 - Crash with evil xul testcase, using listbox/listitem and display: table-cell"
-        xmlns:html="http://www.w3.org/1999/xhtml"
-        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-<listbox>
-  <listitem label="This page should not crash Mozilla"/>
-</listbox>
-<html:script>
-function doe() {
-var el=document.getElementsByTagName('*');
-document.getElementsByTagName('listbox')[0].style.display = 'table-cell';
-document.getElementsByTagName('listitem')[0].style.display = 'table-cell';
-window.getComputedStyle(document.getElementsByTagName('listitem')[0], '').getPropertyValue("height");
-document.getElementsByTagName('listitem')[0].style.display = '';
-}
-setTimeout(doe,500);
-</html:script>
-</window>
deleted file mode 100644
--- a/layout/xul/crashtests/326834-1.html
+++ /dev/null
@@ -1,9 +0,0 @@
-<html class="reftest-wait">
-<head>
-<script>
-setTimeout('document.documentElement.className = ""', 1000);
-</script>
-<body>
-<iframe src="326834-1-inner.xul"></iframe>
-</body>
-</html>
deleted file mode 100644
--- a/layout/xul/crashtests/360642-1.xul
+++ /dev/null
@@ -1,9 +0,0 @@
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" 
-        class="reftest-wait"
-        onload="setTimeout(function() { var foo = document.getElementById('foo'); foo.parentNode.removeChild(foo); document.documentElement.removeAttribute('class'); }, 30);">
-        
-  <listboxbody>
-    <hbox id="foo"/>
-  </listboxbody>
-  
-</window>
deleted file mode 100644
--- a/layout/xul/crashtests/383236-1.xul
+++ /dev/null
@@ -1,5 +0,0 @@
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-
-<listbox><listhead>x</listhead></listbox>
-
-</window>
\ No newline at end of file
deleted file mode 100644
--- a/layout/xul/crashtests/384491-1.xhtml
+++ /dev/null
@@ -1,8 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml" 
-      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-<body>
-
-<xul:listboxbody style="overflow: hidden" />
-
-</body>
-</html>
deleted file mode 100644
--- a/layout/xul/crashtests/394120-1.xhtml
+++ /dev/null
@@ -1,19 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml" 
-      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-<head>
-<script>
-function boom()
-{
-  var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
-  var xultext = document.createElementNS(XUL_NS, "text");
-  var hbox = document.getElementById("hbox")
-  hbox.appendChild(xultext);
-}
-</script>
-</head>
-<body onload="boom();">
-
-<xul:listboxbody><xul:hbox id="hbox" /></xul:listboxbody>
-
-</body>
-</html>
deleted file mode 100644
--- a/layout/xul/crashtests/397293.xhtml
+++ /dev/null
@@ -1,21 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml"  
-      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
-      style="opacity: 0.2;">
-<head>
-<script>
-
-function x()
-{
-  document.documentElement.style.counterReset = "chicken";
-  
-  document.body.offsetHeight;
-}
-
-</script>
-</head>
-
-<body onload="setTimeout(x, 0);">Foo</body>
-
-<xul:listbox/>
-
-</html>
deleted file mode 100644
--- a/layout/xul/crashtests/397304-1.html
+++ /dev/null
@@ -1,1 +0,0 @@
-<html><body><listboxbody style="display: -moz-grid-group;"></listboxbody></body></html>
\ No newline at end of file
deleted file mode 100644
--- a/layout/xul/crashtests/398326-1.xhtml
+++ /dev/null
@@ -1,17 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-<script>
-var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
-
-function boom()
-{
-  var listbox = document.createElementNS(XUL_NS, 'listbox');
-  document.body.appendChild(listbox);
-  var listitem = document.createElementNS(XUL_NS, 'listitem');
-  listbox.appendChild(listitem);
-}
-</script>
-</head>
-<body onload="boom();">
-</body>
-</html>
deleted file mode 100644
--- a/layout/xul/crashtests/400779-1.xhtml
+++ /dev/null
@@ -1,16 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-<head>
-<script>
-
-function boom()
-{
-  var menulist = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "menulist");
-  document.getElementById("h").appendChild(menulist);
-}
-
-</script>
-</head>
-<body onload="boom();">
-<xul:listboxbody><xul:hbox id="h"/></xul:listboxbody>
-</body>
-</html>
deleted file mode 100644
--- a/layout/xul/crashtests/415394-1.xhtml
+++ /dev/null
@@ -1,28 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml" 
-      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
-      class="reftest-wait">
-<head>
-<script type="text/javascript">
-
-function boom()
-{
-  document.execCommand("justifycenter", false, null);
-
-  var listboxbody = document.getElementById("lbb");
-  listboxbody.height = 9;
-  setTimeout(boom2, 0);
-
-  function boom2()
-  {
-    var td = document.createElementNS("http://www.w3.org/1999/xhtml", "td");
-    listboxbody.appendChild(td);
-    document.documentElement.removeAttribute("class");
-  }
-}
-
-</script>
-</head>
-
-<body onload="setTimeout(boom, 0);" contenteditable="true"><xul:listboxbody id="lbb"><xul:hbox/><span><col style="width: 100px;" /></span></xul:listboxbody></body>
-
-</html>
deleted file mode 100644
--- a/layout/xul/crashtests/420424-1.xul
+++ /dev/null
@@ -1,6 +0,0 @@
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
-        onload="document.getElementById('a').ensureElementIsVisible(null);">
-
-<listbox id="a"/>
-
-</window>
deleted file mode 100644
--- a/layout/xul/crashtests/431738.xhtml
+++ /dev/null
@@ -1,7 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-<body>
-<div>
-<span style="font-size: 0pt;"><xul:listboxbody><span style="border: 1px solid red;"/></xul:listboxbody></span>
-</div>
-</body>
-</html>
deleted file mode 100644
--- a/layout/xul/crashtests/432058-1.xul
+++ /dev/null
@@ -1,31 +0,0 @@
-<?xml version="1.0"?>
-
-<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
-
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
-
-<script type="text/javascript">
-// <![CDATA[
-
-var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
-
-function boom()
-{
-  var lb = document.getElementById("lb");
-  var firstli = document.getElementById("firstli");
-  lb.appendChild(document.createElementNS(XUL_NS, "hbox"));
-  lb.appendChild(document.createElementNS(XUL_NS, "listitem"));
-  firstli.style.display = "none";
-
-  // Flush layout.
-  document.getBoxObjectFor(document.documentElement).height;
-
-  lb.removeChild(firstli);
-}
-
-// ]]>
-</script>
-
-<listbox id="lb"><listitem id="firstli"/></listbox>
-
-</window>
deleted file mode 100644
--- a/layout/xul/crashtests/432068-1.xul
+++ /dev/null
@@ -1,31 +0,0 @@
-<?xml version="1.0"?>
-
-<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
-
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
-
-<hbox style="display: none;">
-  <bindings xmlns="http://www.mozilla.org/xbl">
-    <binding id="x">
-      <content><listitem xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"/></content>
-    </binding>
-  </bindings>
-</hbox>
-
-<script type="text/javascript">
-
-function boom()
-{
-  document.getElementById("b").style.MozBinding = "url('#x')";
-  
-  // Flush layout.
-  document.documentElement.boxObject.height;
-  
-  document.getElementById("listbox").removeChild(document.getElementById("c"));
-}
-
-</script>
-
-<listbox id="listbox"><listitem/><listitem id="b"/><listitem id="c"/></listbox>
-
-</window>
deleted file mode 100644
--- a/layout/xul/crashtests/432068-2.xul
+++ /dev/null
@@ -1,24 +0,0 @@
-<?xml version="1.0"?>
-
-<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
-
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
-
-<script type="text/javascript">
-
-function boom()
-{
-  var l = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "listitem");
-  l.style.display = "none";
-
-  var c = document.getElementById("c");
-  c.parentNode.insertBefore(l, c);
-  
-  document.getElementById("listbox").removeChild(document.getElementById("c"));
-}
-
-</script>
-
-<listbox id="listbox"><listitem/><listitem id="c"/></listbox>
-
-</window>
deleted file mode 100644
--- a/layout/xul/crashtests/433296-1.xul
+++ /dev/null
@@ -1,5 +0,0 @@
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-
-<hbox><listboxbody><listheader/><hbox><iframe/></hbox></listboxbody><tabpanels><tabpanels/></tabpanels></hbox>
-
-</window>
deleted file mode 100644
--- a/layout/xul/crashtests/433429.xul
+++ /dev/null
@@ -1,23 +0,0 @@
-<?xml version="1.0"?>
-
-<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
-
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
-
-<script type="text/javascript">
-
-function boom()
-{
-  var listbox = document.getElementById("listbox");
-
-  listbox.removeChild(listbox.childNodes[1]);
-  document.documentElement.style.MozBinding = "url('data:text/xml,%3Cbindings%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fxbl%22%3E%3Cbinding%20id%3D%22foo%22%3E%3Ccontent%3E%0A%3Chbox%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fkeymaster%2Fgatekeeper%2Fthere.is.only.xul%22%2F%3E%0A%3C%2Fcontent%3E%3C%2Fbinding%3E%3C%2Fbindings%3E%0A')";
-  document.documentElement.boxObject.height;
-  listbox.removeChild(listbox.childNodes[0]);
-}
-
-</script>
-
-<listbox id="listbox" style="-moz-binding: url(data:text/xml,%3Cbindings%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fxbl%22%3E%3Cbinding%20id%3D%22foo%22%3E%3Ccontent%3E%0A%3Clistbox%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fkeymaster%2Fgatekeeper%2Fthere.is.only.xul%22%3E%3Cchildren%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fxbl%22%2F%3E%3C%2Flistbox%3E%0A%3C%2Fcontent%3E%3C%2Fbinding%3E%3C%2Fbindings%3E%0A);"><listitem/><listitem/></listbox>
-
-</window>
deleted file mode 100644
--- a/layout/xul/crashtests/464149-1.xul
+++ /dev/null
@@ -1,24 +0,0 @@
-<?xml version="1.0"?>
-
-<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
-
-<window onload="boom();" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-
-<bindings xmlns="http://www.mozilla.org/xbl">
-  <binding id="m"><content><xul:textbox type="text"><children/></xul:textbox></content></binding>
-</bindings>
-
-<script type="text/javascript">
-<![CDATA[
-
-function boom()
-{
-  document.getElementById("b").style.MozBinding = 'url("data:text/xml,' + encodeURIComponent("<bindings xmlns='http://www.mozilla.org/xbl'><binding id='foo'><content><hbox xmlns='http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul'><children xmlns='http://www.mozilla.org/xbl'/></hbox></content></binding></bindings>\n") + '")';
-}
-
-]]>
-</script>
-
-<listbox style="float: right;"><listitem/><listitem id="b"/><listitem><hbox style="-moz-binding: url(#m);"/></listitem></listbox>
-
-</window>
deleted file mode 100644
--- a/layout/xul/crashtests/467481-1.xul
+++ /dev/null
@@ -1,6 +0,0 @@
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="document.getElementById('a').setAttribute('ordinal', 30);">
-  <listbox>
-    <listitem id="a"/>
-    <listitem><iframe/></listitem>
-  </listbox>
-</window>
deleted file mode 100644
--- a/layout/xul/crashtests/488210-1.xhtml
+++ /dev/null
@@ -1,19 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-<script type="text/javascript">
-
-function boom()
-{
-  var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
-  var listbox = document.createElementNS(XUL_NS, 'listbox');
-  document.body.appendChild(listbox);
-  listbox.appendChild(document.createElementNS(XUL_NS, 'listitem'));
-  listbox.appendChild(document.createElementNS(XUL_NS, 'listboxbody'));
-  listbox.appendChild(document.createElementNS(XUL_NS, 'hbox'));
-}
-
-</script>
-</head>
-
-<body onload="boom();"></body>
-</html>
deleted file mode 100644
--- a/layout/xul/crashtests/495728-1.xul
+++ /dev/null
@@ -1,239 +0,0 @@
-<?xml version="1.0"?>
-
-<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
-
-<window id="list-testcase" title="Testcase"
-        xmlns:html="http://www.w3.org/1999/xhtml"
-        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
-        class="reftest-wait">
-
-<script>
-function scrollup() {
-  var list = document.getElementById('list');
-  var firstindex = list.getIndexOfItem(document.getElementById('first'));
-  list.ensureIndexIsVisible(firstindex);
-  setTimeout("document.documentElement.removeAttribute('class')",1);
-}
-
-function scrolldown() {
-  var list = document.getElementById('list');
-  var lastindex = list.getIndexOfItem(document.getElementById('last'));
-  list.ensureIndexIsVisible(lastindex);
-  setTimeout("scrollup()",1);
-}
-
-window.addEventListener("load", scrolldown, false);
-</script>
-		
-<listbox id="list">
-<listitem label="Item x" id="first"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x"/>
-<listitem label="Item x" id="last"/>
-</listbox>
-
-</window>
deleted file mode 100644
--- a/layout/xul/crashtests/508927-1.xul
+++ /dev/null
@@ -1,6 +0,0 @@
-<?xml version="1.0"?>
-<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo"><content><xul:listrows xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><xul:listboxbody/><children xmlns="http://www.mozilla.org/xbl"/></xul:listrows></content></binding></bindings>
-<hbox style="-moz-binding: url(#foo);"><listitem/><listitem/></hbox>
-</window>
deleted file mode 100644
--- a/layout/xul/crashtests/508927-2.xul
+++ /dev/null
@@ -1,6 +0,0 @@
-<?xml version="1.0"?>
-<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo"><content><xul:listrows xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><xul:listboxbody/><children xmlns="http://www.mozilla.org/xbl"/></xul:listrows></content></binding></bindings>
-<hbox style="-moz-binding: url(#foo);"><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/></hbox>
-</window>
deleted file mode 100644
--- a/layout/xul/crashtests/514300-1.xul
+++ /dev/null
@@ -1,14 +0,0 @@
-<?xml version="1.0"?>
-<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
-
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="document.getElementById('listbox').removeChild(document.getElementById('span'));">
-
-<bindings xmlns="http://www.mozilla.org/xbl">
-  <binding id="foo">
-    <content><listitem xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><children xmlns="http://www.mozilla.org/xbl"/></listitem></content>
-  </binding>
-</bindings>
-
-<listbox id="listbox" style="-moz-binding: url(#foo)"><span xmlns="http://www.w3.org/1999/xhtml" id="span"/></listbox>
-
-</window>
deleted file mode 100644
--- a/layout/xul/crashtests/536931-1.xhtml
+++ /dev/null
@@ -1,4 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">
-<listbox id="listbox" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><tab/></listbox>
-<script>window.addEventListener("load", function() { document.documentElement.appendChild(document.getElementById("listbox")); }, false);</script>
-</html>
--- a/layout/xul/crashtests/crashtests.list
+++ b/layout/xul/crashtests/crashtests.list
@@ -1,98 +1,72 @@
 load 131008-1.xul
 load 137216-1.xul
 load 140218-1.xml
 load 151826-1.xul
 load 168724-1.xul
 load 189814-1.xul
 load 237787-1.xul
-load 265161-1.xul
 load 289410-1.xul
 load 290743.html
 load 291702-1.xul
 load 291702-2.xul
 load 291702-3.xul
 load 294371-1.xul
 load 311457-1.html
 load 321056-1.xhtml
 load 322786-1.xul
 load 325377.xul
-load 326834-1.html
 load 326879-1.xul
 load 327776-1.xul
 load 328135-1.xul
 load 329327-1.xul
 load 329407-1.xml
 load 329477-1.xhtml
 load 336962-1.xul
 load 344228-1.xul
 load 346083-1.xul
 load 346281-1.xul
 load 350460.xul
-load 360642-1.xul
 load 365151.xul
 load 366112-1.xul
 load 366203-1.xul
 load 367185-1.xhtml
 load 369942-1.xhtml
 load 374102-1.xul
 load 376137-1.html
 load 376137-2.html
 load 377592-1.svg
 load 378961.html
 load 381862.html
 load 382746-1.xul
 load 382899-1.xul
-load 383236-1.xul
 load 384037-1.xhtml
 load 384105-1.html
 load 384373.html
-load 384491-1.xhtml
 load 384871-1.html
 load 386642.xul
 load 387033-1.xhtml
 load 387080-1.xul
 load 391974-1.html
-load 394120-1.xhtml
-load 397293.xhtml # bug 1323652
-load 397304-1.html
-load 398326-1.xhtml
 load 399013.xul
-load 400779-1.xhtml
 load 402912-1.xhtml
 load 404192.xhtml
 load 407152.xul
 load 408904-1.xul
 load 412479-1.xhtml
-load 415394-1.xhtml
 load 417509.xul
-load 420424-1.xul
 load 430356-1.xhtml
-load 431738.xhtml
-load 432058-1.xul
-load 432068-1.xul
-load 432068-2.xul
-load 433296-1.xul
-load 433429.xul
 load 452185.html
-load 464149-1.xul
 asserts(0-1) load 464407-1.xhtml # Bugs 450974, 1267054, 718883
 load 467080.xul
-load 467481-1.xul
 load 470063-1.html
 load 470272.html
 load 472189.xul
 load 475133.html
-load 488210-1.xhtml
-load 495728-1.xul
-load 508927-1.xul
-load 508927-2.xul
-load 514300-1.xul
-load 536931-1.xhtml
 load 538308-1.xul
 load 557174-1.xml
 load 564705-1.xul
 load 583957-1.html
 load 617089.html
 load menulist-focused.xhtml
 load 716503.html
 load 1379332-1.xul
deleted file mode 100644
--- a/layout/xul/grid/crashtests/306911-crash.xul
+++ /dev/null
@@ -1,4 +0,0 @@
-<?xml version="1.0"?>

<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>

<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">

<listbox id="thelist" flex="1">
  <listitem label="Item1" value="item1">
-     <listitem label="Item2" value="item2"/>
-  </listitem>
</listbox>
-</window>
\ No newline at end of file
deleted file mode 100644
--- a/layout/xul/grid/crashtests/321073-1.xul
+++ /dev/null
@@ -1,7 +0,0 @@
-<?xml version="1.0"?>
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-  <listcols>
-    <grid/>
-    <listitem/>
-  </listcols>
-</window>
\ No newline at end of file
deleted file mode 100644
--- a/layout/xul/grid/crashtests/382750-1.xul
+++ /dev/null
@@ -1,5 +0,0 @@
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-
-<grid><rows><listbox/></rows></grid>
-
-</window>
deleted file mode 100644
--- a/layout/xul/grid/crashtests/400790-1.xul
+++ /dev/null
@@ -1,20 +0,0 @@
-<xul xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
-
-<script>
-
-function boom()
-{
-  var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
-
-  var newListbox = document.createElementNS(XUL_NS, "listbox");
-  document.getElementById("listbox").appendChild(newListbox);
-
-  var newHbox = document.createElementNS(XUL_NS, "hbox");
-  document.getElementById("listitem").appendChild(newHbox);
-}
-
-</script>
-
-<listbox id="listbox"><listitem id="listitem" /></listbox>
-
-</xul>
--- a/layout/xul/grid/crashtests/crashtests.list
+++ b/layout/xul/grid/crashtests/crashtests.list
@@ -1,11 +1,7 @@
-load 306911-crash.xul
 load 306911-grid-testcases.xul
 load 306911-grid-testcases2.xul
 load 311710-1.xul
 load 312784-1.xul
 load 313173-1.html
 load 321066-1.xul
-load 321073-1.xul
-load 382750-1.xul
-load 400790-1.xul
 load 423802-crash.xul
--- a/layout/xul/moz.build
+++ b/layout/xul/moz.build
@@ -12,33 +12,30 @@ with Files('*Menu*'):
 
 if CONFIG['ENABLE_TESTS']:
     MOCHITEST_MANIFESTS += ['test/mochitest.ini']
     MOCHITEST_CHROME_MANIFESTS += ['test/chrome.ini']
     BROWSER_CHROME_MANIFESTS += ['test/browser.ini']
 
 XPIDL_SOURCES += [
     'nsIBoxObject.idl',
-    'nsIListBoxObject.idl',
 ]
 
 XPIDL_MODULE = 'layout_xul'
 
 EXPORTS += [
     'nsBox.h',
     'nsIScrollbarMediator.h',
     'nsPIBoxObject.h',
-    'nsPIListBoxObject.h',
     'nsXULPopupManager.h',
     'nsXULTooltipListener.h',
 ]
 
 EXPORTS.mozilla.dom += [
     'BoxObject.h',
-    'ListBoxObject.h',
     'MenuBoxObject.h',
 ]
 
 UNIFIED_SOURCES += [
     'BoxObject.cpp',
     'nsBox.cpp',
     'nsBoxFrame.cpp',
     'nsBoxLayout.cpp',
@@ -52,26 +49,22 @@ UNIFIED_SOURCES += [
     'nsSprocketLayout.cpp',
     'nsStackFrame.cpp',
     'nsStackLayout.cpp',
     'nsXULTooltipListener.cpp',
 ]
 
 if CONFIG['MOZ_XUL']:
     UNIFIED_SOURCES += [
-        'ListBoxObject.cpp',
         'MenuBoxObject.cpp',
         'nsDeckFrame.cpp',
         'nsDocElementBoxFrame.cpp',
         'nsGroupBoxFrame.cpp',
         'nsImageBoxFrame.cpp',
         'nsLeafBoxFrame.cpp',
-        'nsListBoxBodyFrame.cpp',
-        'nsListBoxLayout.cpp',
-        'nsListItemFrame.cpp',
         'nsMenuBarFrame.cpp',
         'nsMenuBarListener.cpp',
         'nsMenuFrame.cpp',
         'nsMenuPopupFrame.cpp',
         'nsPopupSetFrame.cpp',
         'nsProgressMeterFrame.cpp',
         'nsResizerFrame.cpp',
         'nsSplitterFrame.cpp',
--- a/layout/xul/nsBoxFrame.cpp
+++ b/layout/xul/nsBoxFrame.cpp
@@ -1259,22 +1259,16 @@ nsBoxFrame::RegUnregAccessKey(bool aDoRe
 
   uint32_t key = accessKey.First();
   if (aDoReg)
     esm->RegisterAccessKey(mContent->AsElement(), key);
   else
     esm->UnregisterAccessKey(mContent->AsElement(), key);
 }
 
-bool
-nsBoxFrame::SupportsOrdinalsInChildren()
-{
-  return true;
-}
-
 void
 nsBoxFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
 {
   if (GetStateBits() & NS_STATE_BOX_WRAPS_KIDS_IN_BLOCK) {
     aResult.AppendElement(OwnedAnonBox(PrincipalChildList().FirstChild()));
   }
 }
 
@@ -1288,18 +1282,17 @@ IsBoxOrdinalLEQ(nsIFrame* aFrame1,
   nsIFrame* aRealFrame1 = nsPlaceholderFrame::GetRealFrameFor(aFrame1);
   nsIFrame* aRealFrame2 = nsPlaceholderFrame::GetRealFrameFor(aFrame2);
   return aRealFrame1->GetXULOrdinal() <= aRealFrame2->GetXULOrdinal();
 }
 
 void
 nsBoxFrame::CheckBoxOrder()
 {
-  if (SupportsOrdinalsInChildren() &&
-      !nsIFrame::IsFrameListSorted<IsBoxOrdinalLEQ>(mFrames)) {
+  if (!nsIFrame::IsFrameListSorted<IsBoxOrdinalLEQ>(mFrames)) {
     nsIFrame::SortFrameList<IsBoxOrdinalLEQ>(mFrames);
   }
 }
 
 nsresult
 nsBoxFrame::LayoutChildAt(nsBoxLayoutState& aState, nsIFrame* aBox, const nsRect& aRect)
 {
   // get the current rect
@@ -1313,19 +1306,16 @@ nsBoxFrame::LayoutChildAt(nsBoxLayoutSta
   }
 
   return NS_OK;
 }
 
 nsresult
 nsBoxFrame::XULRelayoutChildAtOrdinal(nsIFrame* aChild)
 {
-  if (!SupportsOrdinalsInChildren())
-    return NS_OK;
-
   uint32_t ord = aChild->GetXULOrdinal();
 
   nsIFrame* child = mFrames.FirstChild();
   nsIFrame* newPrevSib = nullptr;
 
   while (child) {
     if (ord < child->GetXULOrdinal()) {
       break;
--- a/layout/xul/nsBoxFrame.h
+++ b/layout/xul/nsBoxFrame.h
@@ -149,22 +149,16 @@ public:
    * Supports 'allowevents' attribute on descendant elements to allow those
    * elements and their descendants to receive events.
    */
   void WrapListsInRedirector(nsDisplayListBuilder*   aBuilder,
                              const nsDisplayListSet& aIn,
                              const nsDisplayListSet& aOut);
 
   /**
-   * This defaults to true, but some box frames (nsListBoxBodyFrame for
-   * example) don't support ordinals in their children.
-   */
-  virtual bool SupportsOrdinalsInChildren();
-
-  /**
    * Return our wrapper block, if any.
    */
   void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override;
 
 private:
   explicit nsBoxFrame(ComputedStyle* aStyle)
     : nsBoxFrame(aStyle, kClassID, false, nullptr) {}
 protected:
deleted file mode 100644
--- a/layout/xul/nsIListBoxObject.idl
+++ /dev/null
@@ -1,19 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsISupports.idl"
-
-// DEPRECATED: see ListBoxObject.webidl
-
-webidl Element;
-
-[shim(ListBoxObject), uuid(AA9DEF4E-2E59-412d-A6DF-B76F52167795)]
-interface nsIListBoxObject : nsISupports
-{
-  long getRowCount();
-
-  Element getItemAtIndex(in long index);
-  long getIndexOfItem(in Element item);
-};
deleted file mode 100644
--- a/layout/xul/nsListBoxBodyFrame.cpp
+++ /dev/null
@@ -1,1532 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsListBoxBodyFrame.h"
-
-#include "nsListBoxLayout.h"
-
-#include "mozilla/MathAlgorithms.h"
-#include "nsCOMPtr.h"
-#include "nsGridRowGroupLayout.h"
-#include "nsIServiceManager.h"
-#include "nsGkAtoms.h"
-#include "nsIContent.h"
-#include "nsNameSpaceManager.h"
-#include "nsIDocument.h"
-#include "nsCSSFrameConstructor.h"
-#include "nsIScrollableFrame.h"
-#include "nsScrollbarFrame.h"
-#include "nsView.h"
-#include "nsViewManager.h"
-#include "mozilla/ComputedStyle.h"
-#include "nsFontMetrics.h"
-#include "nsITimer.h"
-#include "mozilla/ServoStyleSet.h"
-#include "mozilla/dom/Element.h"
-#include "mozilla/dom/Text.h"
-#include "nsPIBoxObject.h"
-#include "nsLayoutUtils.h"
-#include "nsPIListBoxObject.h"
-#include "nsContentUtils.h"
-#include "ChildIterator.h"
-#include "gfxContext.h"
-#include "prtime.h"
-#include <algorithm>
-
-#ifdef ACCESSIBILITY
-#include "nsAccessibilityService.h"
-#endif
-
-using namespace mozilla;
-using namespace mozilla::dom;
-
-/////////////// nsListScrollSmoother //////////////////
-
-/* A mediator used to smooth out scrolling. It works by seeing if
- * we have time to scroll the amount of rows requested. This is determined
- * by measuring how long it takes to scroll a row. If we can scroll the
- * rows in time we do so. If not we start a timer and skip the request. We
- * do this until the timer finally first because the user has stopped moving
- * the mouse. Then do all the queued requests in on shot.
- */
-
-// the longest amount of time that can go by before the use
-// notices it as a delay.
-#define USER_TIME_THRESHOLD 150000
-
-// how long it takes to layout a single row initial value.
-// we will time this after we scroll a few rows.
-#define TIME_PER_ROW_INITAL  50000
-
-// if we decide we can't layout the rows in the amount of time. How long
-// do we wait before checking again?
-#define SMOOTH_INTERVAL 100
-
-class nsListScrollSmoother final
-{
-private:
-  ~nsListScrollSmoother();
-
-public:
-  NS_INLINE_DECL_REFCOUNTING(nsListScrollSmoother)
-
-  explicit nsListScrollSmoother(nsListBoxBodyFrame* aOuter);
-
-  void Start();
-  void Stop();
-  bool IsRunning();
-
-  nsCOMPtr<nsITimer> mRepeatTimer;
-  int32_t mDelta;
-  nsListBoxBodyFrame* mOuter;
-};
-
-nsListScrollSmoother::nsListScrollSmoother(nsListBoxBodyFrame* aOuter)
-{
-  mDelta = 0;
-  mOuter = aOuter;
-}
-
-nsListScrollSmoother::~nsListScrollSmoother()
-{
-  Stop();
-}
-
-bool
-nsListScrollSmoother::IsRunning()
-{
-  return mRepeatTimer ? true : false;
-}
-
-void
-nsListScrollSmoother::Start()
-{
-  nsTimerCallbackFunc scrollSmootherCallback = [](nsITimer* aTimer,
-                                                  void* aClosure) {
-    // The passed-in nsListScrollSmoother is always alive here. Because if
-    // nsListScrollSmoother died, mRepeatTimer->Stop() would be called during
-    // the destruction and this callback would never be invoked.
-    auto self = static_cast<nsListScrollSmoother*>(aClosure);
-
-    self->Stop();
-
-    NS_ASSERTION(self->mOuter, "mOuter is null, see bug #68365");
-    if (self->mOuter) {
-      // actually do some work.
-      self->mOuter->InternalPositionChangedCallback();
-    }
-  };
-
-  Stop();
-  nsIEventTarget* target = nullptr;
-  if (mOuter) {
-    if (nsIContent* content = mOuter->GetContent()) {
-      target = content->OwnerDoc()->EventTargetFor(TaskCategory::Other);
-    }
-  }
-  NS_NewTimerWithFuncCallback(getter_AddRefs(mRepeatTimer),
-                              scrollSmootherCallback,
-                              this,
-                              SMOOTH_INTERVAL,
-                              nsITimer::TYPE_ONE_SHOT,
-                              "scrollSmootherCallback",
-                              target);
-}
-
-void
-nsListScrollSmoother::Stop()
-{
-  if ( mRepeatTimer ) {
-    mRepeatTimer->Cancel();
-    mRepeatTimer = nullptr;
-  }
-}
-
-/////////////// nsListBoxBodyFrame //////////////////
-
-nsListBoxBodyFrame::nsListBoxBodyFrame(ComputedStyle* aStyle,
-                                       nsBoxLayout* aLayoutManager)
-  : nsBoxFrame(aStyle, kClassID, false, aLayoutManager),
-    mTopFrame(nullptr),
-    mBottomFrame(nullptr),
-    mLinkupFrame(nullptr),
-    mScrollSmoother(nullptr),
-    mRowsToPrepend(0),
-    mRowCount(-1),
-    mRowHeight(0),
-    mAvailableHeight(0),
-    mStringWidth(-1),
-    mCurrentIndex(0),
-    mOldIndex(0),
-    mYPosition(0),
-    mTimePerRow(TIME_PER_ROW_INITAL),
-    mRowHeightWasSet(false),
-    mScrolling(false),
-    mAdjustScroll(false),
-    mReflowCallbackPosted(false)
-{
-}
-
-nsListBoxBodyFrame::~nsListBoxBodyFrame()
-{
-  NS_IF_RELEASE(mScrollSmoother);
-
-#if USE_TIMER_TO_DELAY_SCROLLING
-  StopScrollTracking();
-  mAutoScrollTimer = nullptr;
-#endif
-
-}
-
-NS_QUERYFRAME_HEAD(nsListBoxBodyFrame)
-  NS_QUERYFRAME_ENTRY(nsIScrollbarMediator)
-  NS_QUERYFRAME_ENTRY(nsListBoxBodyFrame)
-NS_QUERYFRAME_TAIL_INHERITING(nsBoxFrame)
-
-////////// nsIFrame /////////////////
-
-void
-nsListBoxBodyFrame::Init(nsIContent*       aContent,
-                         nsContainerFrame* aParent,
-                         nsIFrame*         aPrevInFlow)
-{
-  nsBoxFrame::Init(aContent, aParent, aPrevInFlow);
-  // Don't call nsLayoutUtils::GetScrollableFrameFor since we are not its
-  // scrollframe child yet.
-  nsIScrollableFrame* scrollFrame = do_QueryFrame(aParent);
-  if (scrollFrame) {
-    nsIFrame* verticalScrollbar = scrollFrame->GetScrollbarBox(true);
-    nsScrollbarFrame* scrollbarFrame = do_QueryFrame(verticalScrollbar);
-    if (scrollbarFrame) {
-      scrollbarFrame->SetScrollbarMediatorContent(GetContent());
-    }
-  }
-  RefPtr<nsFontMetrics> fm =
-    nsLayoutUtils::GetFontMetricsForFrame(this, 1.0f);
-  mRowHeight = fm->MaxHeight();
-}
-
-void
-nsListBoxBodyFrame::DestroyFrom(nsIFrame* aDestructRoot, PostDestroyData& aPostDestroyData)
-{
-  // make sure we cancel any posted callbacks.
-  if (mReflowCallbackPosted)
-     PresShell()->CancelReflowCallback(this);
-
-  // Revoke any pending position changed events
-  for (uint32_t i = 0; i < mPendingPositionChangeEvents.Length(); ++i) {
-    mPendingPositionChangeEvents[i]->Revoke();
-  }
-
-  // Make sure we tell our listbox's box object we're being destroyed.
-  if (mBoxObject) {
-    mBoxObject->ClearCachedValues();
-  }
-
-  nsBoxFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
-}
-
-nsresult
-nsListBoxBodyFrame::AttributeChanged(int32_t aNameSpaceID,
-                                     nsAtom* aAttribute,
-                                     int32_t aModType)
-{
-  nsresult rv = NS_OK;
-
-  if (aAttribute == nsGkAtoms::rows) {
-    PresShell()->
-      FrameNeedsReflow(this, nsIPresShell::eStyleChange, NS_FRAME_IS_DIRTY);
-  }
-  else
-    rv = nsBoxFrame::AttributeChanged(aNameSpaceID, aAttribute, aModType);
-
-  return rv;
-
-}
-
-/* virtual */ void
-nsListBoxBodyFrame::MarkIntrinsicISizesDirty()
-{
-  mStringWidth = -1;
-  nsBoxFrame::MarkIntrinsicISizesDirty();
-}
-
-/////////// nsBox ///////////////
-
-NS_IMETHODIMP
-nsListBoxBodyFrame::DoXULLayout(nsBoxLayoutState& aBoxLayoutState)
-{
-  if (mScrolling)
-    aBoxLayoutState.SetPaintingDisabled(true);
-
-  nsresult rv = nsBoxFrame::DoXULLayout(aBoxLayoutState);
-
-  // determine the real height for the scrollable area from the total number
-  // of rows, since non-visible rows don't yet have frames
-  nsRect rect(nsPoint(0, 0), GetSize());
-  nsOverflowAreas overflow(rect, rect);
-  if (mLayoutManager) {
-    nsIFrame* childFrame = mFrames.FirstChild();
-    while (childFrame) {
-      ConsiderChildOverflow(overflow, childFrame);
-      childFrame = childFrame->GetNextSibling();
-    }
-
-    nsSize prefSize = mLayoutManager->GetXULPrefSize(this, aBoxLayoutState);
-    NS_FOR_FRAME_OVERFLOW_TYPES(otype) {
-      nsRect& o = overflow.Overflow(otype);
-      o.height = std::max(o.height, prefSize.height);
-    }
-  }
-  FinishAndStoreOverflow(overflow, GetSize());
-
-  if (mScrolling)
-    aBoxLayoutState.SetPaintingDisabled(false);
-
-  // if we are scrolled and the row height changed
-  // make sure we are scrolled to a correct index.
-  if (mAdjustScroll)
-     PostReflowCallback();
-
-  return rv;
-}
-
-nsSize
-nsListBoxBodyFrame::GetXULMinSizeForScrollArea(nsBoxLayoutState& aBoxLayoutState)
-{
-  nsSize result(0, 0);
-  if (nsContentUtils::HasNonEmptyAttr(GetContent(), kNameSpaceID_None,
-                                      nsGkAtoms::sizemode)) {
-    result = GetXULPrefSize(aBoxLayoutState);
-    result.height = 0;
-    nsIScrollableFrame* scrollFrame = nsLayoutUtils::GetScrollableFrameFor(this);
-    if (scrollFrame &&
-        scrollFrame->GetScrollbarStyles().mVertical == NS_STYLE_OVERFLOW_AUTO) {
-      nsMargin scrollbars =
-        scrollFrame->GetDesiredScrollbarSizes(&aBoxLayoutState);
-      result.width += scrollbars.left + scrollbars.right;
-    }
-  }
-  return result;
-}
-
-nsSize
-nsListBoxBodyFrame::GetXULPrefSize(nsBoxLayoutState& aBoxLayoutState)
-{
-  nsSize pref = nsBoxFrame::GetXULPrefSize(aBoxLayoutState);
-
-  int32_t size = GetFixedRowSize();
-  if (size > -1)
-    pref.height = size*GetRowHeightAppUnits();
-
-  nsIScrollableFrame* scrollFrame = nsLayoutUtils::GetScrollableFrameFor(this);
-  if (scrollFrame &&
-      scrollFrame->GetScrollbarStyles().mVertical == NS_STYLE_OVERFLOW_AUTO) {
-    nsMargin scrollbars = scrollFrame->GetDesiredScrollbarSizes(&aBoxLayoutState);
-    pref.width += scrollbars.left + scrollbars.right;
-  }
-  return pref;
-}
-
-///////////// nsIScrollbarMediator ///////////////
-
-void
-nsListBoxBodyFrame::ScrollByPage(nsScrollbarFrame* aScrollbar, int32_t aDirection,
-                                 nsIScrollbarMediator::ScrollSnapMode aSnap)
-{
-  // CSS Scroll Snapping is not enabled for XUL, aSnap is ignored
-  MOZ_ASSERT(aScrollbar != nullptr);
-  aScrollbar->SetIncrementToPage(aDirection);
-  AutoWeakFrame weakFrame(this);
-  int32_t newPos = aScrollbar->MoveToNewPosition();
-  if (!weakFrame.IsAlive()) {
-    return;
-  }
-  UpdateIndex(newPos);
-}
-
-void
-nsListBoxBodyFrame::ScrollByWhole(nsScrollbarFrame* aScrollbar, int32_t aDirection,
-                                  nsIScrollbarMediator::ScrollSnapMode aSnap)
-{
-  // CSS Scroll Snapping is not enabled for XUL, aSnap is ignored
-  MOZ_ASSERT(aScrollbar != nullptr);
-  aScrollbar->SetIncrementToWhole(aDirection);
-  AutoWeakFrame weakFrame(this);
-  int32_t newPos = aScrollbar->MoveToNewPosition();
-  if (!weakFrame.IsAlive()) {
-    return;
-  }
-  UpdateIndex(newPos);
-}
-
-void
-nsListBoxBodyFrame::ScrollByLine(nsScrollbarFrame* aScrollbar, int32_t aDirection,
-                                 nsIScrollbarMediator::ScrollSnapMode aSnap)
-{
-  // CSS Scroll Snapping is not enabled for XUL, aSnap is ignored
-  MOZ_ASSERT(aScrollbar != nullptr);
-  aScrollbar->SetIncrementToLine(aDirection);
-  AutoWeakFrame weakFrame(this);
-  int32_t newPos = aScrollbar->MoveToNewPosition();
-  if (!weakFrame.IsAlive()) {
-    return;
-  }
-  UpdateIndex(newPos);
-}
-
-void
-nsListBoxBodyFrame::RepeatButtonScroll(nsScrollbarFrame* aScrollbar)
-{
-  AutoWeakFrame weakFrame(this);
-  int32_t newPos = aScrollbar->MoveToNewPosition();
-  if (!weakFrame.IsAlive()) {
-    return;
-  }
-  UpdateIndex(newPos);
-}
-
-int32_t
-nsListBoxBodyFrame::ToRowIndex(nscoord aPos) const
-{
-  return NS_roundf(float(std::max(aPos, 0)) / mRowHeight);
-}
-
-void
-nsListBoxBodyFrame::ThumbMoved(nsScrollbarFrame* aScrollbar,
-                               nscoord aOldPos,
-                               nscoord aNewPos)
-{
-  if (mScrolling || mRowHeight == 0)
-    return;
-
-  int32_t newIndex = ToRowIndex(aNewPos);
-  if (newIndex == mCurrentIndex) {
-    return;
-  }
-  int32_t rowDelta = newIndex - mCurrentIndex;
-
-  nsListScrollSmoother* smoother = GetSmoother();
-
-  // if we can't scroll the rows in time then start a timer. We will eat
-  // events until the user stops moving and the timer stops.
-  if (smoother->IsRunning() || Abs(rowDelta)*mTimePerRow > USER_TIME_THRESHOLD) {
-
-     smoother->Stop();
-
-     smoother->mDelta = rowDelta;
-
-     smoother->Start();
-
-     return;
-  }
-
-  smoother->Stop();
-
-  mCurrentIndex = newIndex;
-  smoother->mDelta = 0;
-
-  if (mCurrentIndex < 0) {
-    mCurrentIndex = 0;
-    return;
-  }
-  InternalPositionChanged(rowDelta < 0, Abs(rowDelta));
-}
-
-void
-nsListBoxBodyFrame::VisibilityChanged(bool aVisible)
-{
-  if (mRowHeight == 0)
-    return;
-
-  int32_t lastPageTopRow = GetRowCount() - (GetAvailableHeight() / mRowHeight);
-  if (lastPageTopRow < 0)
-    lastPageTopRow = 0;
-  int32_t delta = mCurrentIndex - lastPageTopRow;
-  if (delta > 0) {
-    mCurrentIndex = lastPageTopRow;
-    InternalPositionChanged(true, delta);
-  }
-}
-
-nsIFrame*
-nsListBoxBodyFrame::GetScrollbarBox(bool aVertical)
-{
-  nsIScrollableFrame* scrollFrame = nsLayoutUtils::GetScrollableFrameFor(this);
-  return scrollFrame ? scrollFrame->GetScrollbarBox(true) : nullptr;
-}
-
-void
-nsListBoxBodyFrame::UpdateIndex(int32_t aNewPos)
-{
-  int32_t newIndex = ToRowIndex(nsPresContext::CSSPixelsToAppUnits(aNewPos));
-  if (newIndex == mCurrentIndex) {
-    return;
-  }
-  bool up = newIndex < mCurrentIndex;
-  int32_t indexDelta = Abs(newIndex - mCurrentIndex);
-  mCurrentIndex = newIndex;
-  InternalPositionChanged(up, indexDelta);
-}
-
-///////////// nsIReflowCallback ///////////////
-
-bool
-nsListBoxBodyFrame::ReflowFinished()
-{
-  nsAutoScriptBlocker scriptBlocker;
-  // now create or destroy any rows as needed
-  CreateRows();
-
-  // keep scrollbar in sync
-  if (mAdjustScroll) {
-     VerticalScroll(mYPosition);
-     mAdjustScroll = false;
-  }
-
-  // if the row height changed then mark everything as a style change.
-  // That will dirty the entire listbox
-  if (mRowHeightWasSet) {
-    PresShell()->
-      FrameNeedsReflow(this, nsIPresShell::eStyleChange, NS_FRAME_IS_DIRTY);
-     int32_t pos = mCurrentIndex * mRowHeight;
-     if (mYPosition != pos)
-       mAdjustScroll = true;
-    mRowHeightWasSet = false;
-  }
-
-  mReflowCallbackPosted = false;
-  return true;
-}
-
-void
-nsListBoxBodyFrame::ReflowCallbackCanceled()
-{
-  mReflowCallbackPosted = false;
-}
-
-///////// ListBoxObject ///////////////
-
-int32_t
-nsListBoxBodyFrame::GetNumberOfVisibleRows()
-{
-  return mRowHeight ? GetAvailableHeight() / mRowHeight : 0;
-}
-
-int32_t
-nsListBoxBodyFrame::GetIndexOfFirstVisibleRow()
-{
-  return mCurrentIndex;
-}
-
-nsresult
-nsListBoxBodyFrame::EnsureIndexIsVisible(int32_t aRowIndex)
-{
-  if (aRowIndex < 0)
-    return NS_ERROR_ILLEGAL_VALUE;
-
-  int32_t rows = 0;
-  if (mRowHeight)
-    rows = GetAvailableHeight()/mRowHeight;
-  if (rows <= 0)
-    rows = 1;
-  int32_t bottomIndex = mCurrentIndex + rows;
-
-  // if row is visible, ignore
-  if (mCurrentIndex <= aRowIndex && aRowIndex < bottomIndex)
-    return NS_OK;
-
-  int32_t delta;
-
-  bool up = aRowIndex < mCurrentIndex;
-  if (up) {
-    delta = mCurrentIndex - aRowIndex;
-    mCurrentIndex = aRowIndex;
-  }
-  else {
-    // Check to be sure we're not scrolling off the bottom of the tree
-    if (aRowIndex >= GetRowCount())
-      return NS_ERROR_ILLEGAL_VALUE;
-
-    // Bring it just into view.
-    delta = 1 + (aRowIndex-bottomIndex);
-    mCurrentIndex += delta;
-  }
-
-  // Safe to not go off an event here, since this is coming from the
-  // box object.
-  DoInternalPositionChangedSync(up, delta);
-  return NS_OK;
-}
-
-nsresult
-nsListBoxBodyFrame::ScrollByLines(int32_t aNumLines)
-{
-  int32_t scrollIndex = GetIndexOfFirstVisibleRow(),
-    visibleRows = GetNumberOfVisibleRows();
-
-  scrollIndex += aNumLines;
-
-  if (scrollIndex < 0)
-    scrollIndex = 0;
-  else {
-    int32_t numRows = GetRowCount();
-    int32_t lastPageTopRow = numRows - visibleRows;
-    if (scrollIndex > lastPageTopRow)
-      scrollIndex = lastPageTopRow;
-  }
-
-  ScrollToIndex(scrollIndex);
-
-  return NS_OK;
-}
-
-// walks the DOM to get the zero-based row index of the content
-nsresult
-nsListBoxBodyFrame::GetIndexOfItem(Element* aItem, int32_t* _retval)
-{
-  if (aItem) {
-    *_retval = 0;
-
-    FlattenedChildIterator iter(mContent);
-    for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
-      // we hit a list row, count it
-      if (child->IsXULElement(nsGkAtoms::listitem)) {
-        // is this it?
-        if (child == aItem)
-          return NS_OK;
-
-        ++(*_retval);
-      }
-    }
-  }
-
-  // not found
-  *_retval = -1;
-  return NS_OK;
-}
-
-nsresult
-nsListBoxBodyFrame::GetItemAtIndex(int32_t aIndex, Element** aItem)
-{
-  *aItem = nullptr;
-  if (aIndex < 0)
-    return NS_OK;
-
-  int32_t itemCount = 0;
-  FlattenedChildIterator iter(mContent);
-  for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
-    // we hit a list row, check if it is the one we are looking for
-    if (child->IsXULElement(nsGkAtoms::listitem)) {
-      // is this it?
-      if (itemCount == aIndex) {
-        *aItem = do_AddRef(child->AsElement()).take();
-        return NS_OK;
-      }
-      ++itemCount;
-    }
-  }
-
-  // not found
-  return NS_OK;
-}
-
-/////////// nsListBoxBodyFrame ///////////////
-
-int32_t
-nsListBoxBodyFrame::GetRowCount()
-{
-  if (mRowCount < 0)
-    ComputeTotalRowCount();
-  return mRowCount;
-}
-
-int32_t
-nsListBoxBodyFrame::GetRowHeightPixels() const
-{
-  return nsPresContext::AppUnitsToIntCSSPixels(mRowHeight);
-}
-
-int32_t
-nsListBoxBodyFrame::GetFixedRowSize()
-{
-  nsresult dummy;
-
-  nsAutoString rows;
-  mContent->AsElement()->GetAttr(kNameSpaceID_None, nsGkAtoms::rows, rows);
-  if (!rows.IsEmpty())
-    return rows.ToInteger(&dummy);
-
-  mContent->AsElement()->GetAttr(kNameSpaceID_None, nsGkAtoms::size, rows);
-  if (!rows.IsEmpty())
-    return rows.ToInteger(&dummy);
-
-  return -1;
-}
-
-void
-nsListBoxBodyFrame::SetRowHeight(nscoord aRowHeight)
-{
-  if (aRowHeight > mRowHeight) {
-    mRowHeight = aRowHeight;
-
-    // signal we need to dirty everything
-    // and we want to be notified after reflow
-    // so we can create or destory rows as needed
-    mRowHeightWasSet = true;
-    PostReflowCallback();
-  }
-}
-
-nscoord
-nsListBoxBodyFrame::GetAvailableHeight()
-{
-  nsIScrollableFrame* scrollFrame =
-    nsLayoutUtils::GetScrollableFrameFor(this);
-  if (scrollFrame) {
-    return scrollFrame->GetScrollPortRect().height;
-  }
-  return 0;
-}
-
-nscoord
-nsListBoxBodyFrame::GetYPosition()
-{
-  return mYPosition;
-}
-
-nscoord
-nsListBoxBodyFrame::ComputeIntrinsicISize(nsBoxLayoutState& aBoxLayoutState)
-{
-  if (mStringWidth != -1)
-    return mStringWidth;
-
-  nscoord largestWidth = 0;
-
-  int32_t index = 0;
-  RefPtr<Element> firstRowEl;
-  GetItemAtIndex(index, getter_AddRefs(firstRowEl));
-
-  if (firstRowEl) {
-    nsPresContext* presContext = aBoxLayoutState.PresContext();
-    RefPtr<ComputedStyle> computedStyle =
-      presContext->StyleSet()->ResolveStyleFor(
-          firstRowEl, nullptr, LazyComputeBehavior::Allow);
-
-    nscoord width = 0;
-    nsMargin margin(0,0,0,0);
-
-    if (computedStyle->StylePadding()->GetPadding(margin))
-      width += margin.LeftRight();
-    width += computedStyle->StyleBorder()->GetComputedBorder().LeftRight();
-    if (computedStyle->StyleMargin()->GetMargin(margin))
-      width += margin.LeftRight();
-
-    FlattenedChildIterator iter(mContent);
-    for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
-      if (child->IsXULElement(nsGkAtoms::listitem)) {
-        gfxContext* rendContext = aBoxLayoutState.GetRenderingContext();
-        if (rendContext) {
-          nsAutoString value;
-          for (nsIContent* content = child->GetFirstChild();
-               content; content = content->GetNextSibling()) {
-            if (Text* text = content->GetAsText()) {
-              text->AppendTextTo(value);
-            }
-          }
-
-          RefPtr<nsFontMetrics> fm =
-            nsLayoutUtils::GetFontMetricsForComputedStyle(computedStyle,
-                                                          presContext);
-
-          nscoord textWidth =
-            nsLayoutUtils::AppUnitWidthOfStringBidi(value, this, *fm,
-                                                    *rendContext);
-          textWidth += width;
-
-          if (textWidth > largestWidth)
-            largestWidth = textWidth;
-        }
-      }
-    }
-  }
-
-  mStringWidth = largestWidth;
-  return mStringWidth;
-}
-
-void
-nsListBoxBodyFrame::ComputeTotalRowCount()
-{
-  mRowCount = 0;
-  FlattenedChildIterator iter(mContent);
-  for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
-    if (child->IsXULElement(nsGkAtoms::listitem)) {
-      ++mRowCount;
-    }
-  }
-}
-
-void
-nsListBoxBodyFrame::PostReflowCallback()
-{
-  if (!mReflowCallbackPosted) {
-    mReflowCallbackPosted = true;
-    PresShell()->PostReflowCallback(this);
-  }
-}
-
-////////// scrolling
-
-nsresult
-nsListBoxBodyFrame::ScrollToIndex(int32_t aRowIndex)
-{
-  if (( aRowIndex < 0 ) || (mRowHeight == 0))
-    return NS_OK;
-
-  int32_t newIndex = aRowIndex;
-  int32_t delta = mCurrentIndex > newIndex ? mCurrentIndex - newIndex : newIndex - mCurrentIndex;
-  bool up = newIndex < mCurrentIndex;
-
-  // Check to be sure we're not scrolling off the bottom of the tree
-  int32_t lastPageTopRow = GetRowCount() - (GetAvailableHeight() / mRowHeight);
-  if (lastPageTopRow < 0)
-    lastPageTopRow = 0;
-
-  if (aRowIndex > lastPageTopRow)
-    return NS_OK;
-
-  mCurrentIndex = newIndex;
-
-  AutoWeakFrame weak(this);
-
-  // Since we're going to flush anyway, we need to not do this off an event
-  DoInternalPositionChangedSync(up, delta);
-
-  if (!weak.IsAlive()) {
-    return NS_OK;
-  }
-
-  // This change has to happen immediately.
-  // Flush any pending reflow commands.
-  // XXXbz why, exactly?
-  mContent->GetComposedDoc()->FlushPendingNotifications(FlushType::Layout);
-
-  return NS_OK;
-}
-
-nsresult
-nsListBoxBodyFrame::InternalPositionChangedCallback()
-{
-  nsListScrollSmoother* smoother = GetSmoother();
-
-  if (smoother->mDelta == 0)
-    return NS_OK;
-
-  mCurrentIndex += smoother->mDelta;
-
-  if (mCurrentIndex < 0)
-    mCurrentIndex = 0;
-
-  return DoInternalPositionChangedSync(smoother->mDelta < 0,
-                                       smoother->mDelta < 0 ?
-                                         -smoother->mDelta : smoother->mDelta);
-}
-
-nsresult
-nsListBoxBodyFrame::InternalPositionChanged(bool aUp, int32_t aDelta)
-{
-  RefPtr<nsPositionChangedEvent> event =
-    new nsPositionChangedEvent(this, aUp, aDelta);
-  nsresult rv = mContent->OwnerDoc()->Dispatch(TaskCategory::Other,
-                                               do_AddRef(event));
-  if (NS_SUCCEEDED(rv)) {
-    if (!mPendingPositionChangeEvents.AppendElement(event)) {
-      rv = NS_ERROR_OUT_OF_MEMORY;
-      event->Revoke();
-    }
-  }
-  return rv;
-}
-
-nsresult
-nsListBoxBodyFrame::DoInternalPositionChangedSync(bool aUp, int32_t aDelta)
-{
-  AutoWeakFrame weak(this);
-
-  // Process all the pending position changes first
-  nsTArray< RefPtr<nsPositionChangedEvent> > temp;
-  temp.SwapElements(mPendingPositionChangeEvents);
-  for (uint32_t i = 0; i < temp.Length(); ++i) {
-    if (weak.IsAlive()) {
-      temp[i]->Run();
-    }
-    temp[i]->Revoke();
-  }
-
-  if (!weak.IsAlive()) {
-    return NS_OK;
-  }
-
-  return DoInternalPositionChanged(aUp, aDelta);
-}
-
-nsresult
-nsListBoxBodyFrame::DoInternalPositionChanged(bool aUp, int32_t aDelta)
-{
-  if (aDelta == 0)
-    return NS_OK;
-
-  RefPtr<nsPresContext> presContext(PresContext());
-  nsBoxLayoutState state(presContext);
-
-  // begin timing how long it takes to scroll a row
-  PRTime start = PR_Now();
-
-  AutoWeakFrame weakThis(this);
-  mContent->GetComposedDoc()->FlushPendingNotifications(FlushType::Layout);
-  if (!weakThis.IsAlive()) {
-    return NS_OK;
-  }
-
-  {
-    nsAutoScriptBlocker scriptBlocker;
-
-    int32_t visibleRows = 0;
-    if (mRowHeight)
-      visibleRows = GetAvailableHeight()/mRowHeight;
-
-    if (aDelta < visibleRows) {
-      int32_t loseRows = aDelta;
-      if (aUp) {
-        // scrolling up, destroy rows from the bottom downwards
-        ReverseDestroyRows(loseRows);
-        mRowsToPrepend += aDelta;
-        mLinkupFrame = nullptr;
-      }
-      else {
-        // scrolling down, destroy rows from the top upwards
-        DestroyRows(loseRows);
-        mRowsToPrepend = 0;
-      }
-    }
-    else {
-      // We have scrolled so much that all of our current frames will
-      // go off screen, so blow them all away. Weeee!
-      nsIFrame *currBox = mFrames.FirstChild();
-      while (currBox) {
-        nsIFrame *nextBox = currBox->GetNextSibling();
-        RemoveChildFrame(state, currBox);
-        currBox = nextBox;
-      }
-    }
-
-    // clear frame markers so that CreateRows will re-create
-    mTopFrame = mBottomFrame = nullptr;
-
-    mYPosition = mCurrentIndex*mRowHeight;
-    mScrolling = true;
-    presContext->PresShell()->
-      FrameNeedsReflow(this, nsIPresShell::eResize, NS_FRAME_HAS_DIRTY_CHILDREN);
-  }
-  if (!weakThis.IsAlive()) {
-    return NS_OK;
-  }
-  // Flush calls CreateRows
-  // XXXbz there has to be a better way to do this than flushing!
-  presContext->PresShell()->FlushPendingNotifications(FlushType::Layout);
-  if (!weakThis.IsAlive()) {
-    return NS_OK;
-  }
-
-  mScrolling = false;
-
-  VerticalScroll(mYPosition);
-
-  PRTime end = PR_Now();
-
-  int32_t newTime = int32_t(end - start) / aDelta;
-
-  // average old and new
-  mTimePerRow = (newTime + mTimePerRow)/2;
-
-  return NS_OK;
-}
-
-nsListScrollSmoother*
-nsListBoxBodyFrame::GetSmoother()
-{
-  if (!mScrollSmoother) {
-    mScrollSmoother = new nsListScrollSmoother(this);
-    NS_ASSERTION(mScrollSmoother, "out of memory");
-    NS_IF_ADDREF(mScrollSmoother);
-  }
-
-  return mScrollSmoother;
-}
-
-void
-nsListBoxBodyFrame::VerticalScroll(int32_t aPosition)
-{
-  nsIScrollableFrame* scrollFrame
-    = nsLayoutUtils::GetScrollableFrameFor(this);
-  if (!scrollFrame) {
-    return;
-  }
-
-  nsPoint scrollPosition = scrollFrame->GetScrollPosition();
-
-  AutoWeakFrame weakFrame(this);
-  scrollFrame->ScrollTo(nsPoint(scrollPosition.x, aPosition),
-                        nsIScrollableFrame::INSTANT);
-  if (!weakFrame.IsAlive()) {
-    return;
-  }
-
-  mYPosition = aPosition;
-}
-
-////////// frame and box retrieval
-
-nsIFrame*
-nsListBoxBodyFrame::GetFirstFrame()
-{
-  mTopFrame = mFrames.FirstChild();
-  return mTopFrame;
-}
-
-nsIFrame*
-nsListBoxBodyFrame::GetLastFrame()
-{
-  return mFrames.LastChild();
-}
-
-bool
-nsListBoxBodyFrame::SupportsOrdinalsInChildren()
-{
-  return false;
-}
-
-////////// lazy row creation and destruction
-
-void
-nsListBoxBodyFrame::CreateRows()
-{
-  // Get our client rect.
-  nsRect clientRect;
-  GetXULClientRect(clientRect);
-
-  // Get the starting y position and the remaining available
-  // height.
-  nscoord availableHeight = GetAvailableHeight();
-
-  if (availableHeight <= 0) {
-    bool fixed = (GetFixedRowSize() != -1);
-    if (fixed)
-      availableHeight = 10;
-    else
-      return;
-  }
-
-  // get the first tree box. If there isn't one create one.
-  bool created = false;
-  nsIFrame* box = GetFirstItemBox(0, &created);
-  nscoord rowHeight = GetRowHeightAppUnits();
-  while (box) {
-    if (created && mRowsToPrepend > 0)
-      --mRowsToPrepend;
-
-    // if the row height is 0 then fail. Wait until someone
-    // laid out and sets the row height.
-    if (rowHeight == 0)
-        return;
-
-    availableHeight -= rowHeight;
-
-    // should we continue? Is the enought height?
-    if (!ContinueReflow(availableHeight))
-      break;
-
-    // get the next tree box. Create one if needed.
-    box = GetNextItemBox(box, 0, &created);
-  }
-
-  mRowsToPrepend = 0;
-  mLinkupFrame = nullptr;
-}
-
-void
-nsListBoxBodyFrame::DestroyRows(int32_t& aRowsToLose)
-{
-  // We need to destroy frames until our row count has been properly
-  // reduced.  A reflow will then pick up and create the new frames.
-  nsIFrame* childFrame = GetFirstFrame();
-  nsBoxLayoutState state(PresContext());
-
-  while (childFrame && aRowsToLose > 0) {
-    --aRowsToLose;
-
-    nsIFrame* nextFrame = childFrame->GetNextSibling();
-    RemoveChildFrame(state, childFrame);
-
-    mTopFrame = childFrame = nextFrame;
-  }
-
-  PresShell()->
-    FrameNeedsReflow(this, nsIPresShell::eTreeChange,
-                     NS_FRAME_HAS_DIRTY_CHILDREN);
-}
-
-void
-nsListBoxBodyFrame::ReverseDestroyRows(int32_t& aRowsToLose)
-{
-  // We need to destroy frames until our row count has been properly
-  // reduced.  A reflow will then pick up and create the new frames.
-  nsIFrame* childFrame = GetLastFrame();
-  nsBoxLayoutState state(PresContext());
-
-  while (childFrame && aRowsToLose > 0) {
-    --aRowsToLose;
-
-    nsIFrame* prevFrame;
-    prevFrame = childFrame->GetPrevSibling();
-    RemoveChildFrame(state, childFrame);
-
-    mBottomFrame = childFrame = prevFrame;
-  }
-
-  PresShell()->
-    FrameNeedsReflow(this, nsIPresShell::eTreeChange,
-                     NS_FRAME_HAS_DIRTY_CHILDREN);
-}
-
-static bool
-IsListItemChild(nsListBoxBodyFrame* aParent, nsIContent* aChild,
-                nsIFrame** aChildFrame)
-{
-  *aChildFrame = nullptr;
-  if (!aChild->IsXULElement(nsGkAtoms::listitem)) {
-    return false;
-  }
-  nsIFrame* existingFrame = aChild->GetPrimaryFrame();
-  if (existingFrame && existingFrame->GetParent() != aParent) {
-    return false;
-  }
-  *aChildFrame = existingFrame;
-  return true;
-}
-
-//
-// Get the nsIFrame for the first visible listitem, and if none exists,
-// create one.
-//
-nsIFrame*
-nsListBoxBodyFrame::GetFirstItemBox(int32_t aOffset, bool* aCreated)
-{
-  if (aCreated)
-   *aCreated = false;
-
-  // Clear ourselves out.
-  mBottomFrame = mTopFrame;
-
-  if (mTopFrame) {
-    return mTopFrame->IsXULBoxFrame() ? mTopFrame.GetFrame() : nullptr;
-  }
-
-  // top frame was cleared out
-  mTopFrame = GetFirstFrame();
-  mBottomFrame = mTopFrame;
-
-  if (mTopFrame && mRowsToPrepend <= 0) {
-    return mTopFrame->IsXULBoxFrame() ? mTopFrame.GetFrame() : nullptr;
-  }
-
-  // At this point, we either have no frames at all,
-  // or the user has scrolled upwards, leaving frames
-  // to be created at the top.  Let's determine which
-  // content needs a new frame first.
-
-  nsCOMPtr<nsIContent> startContent;
-  if (mTopFrame && mRowsToPrepend > 0) {
-    // We need to insert rows before the top frame
-    nsIContent* topContent = mTopFrame->GetContent();
-    nsIContent* topParent = topContent->GetParent();
-    int32_t contentIndex = topParent->ComputeIndexOf(topContent);
-    contentIndex -= aOffset;
-    if (contentIndex < 0)
-      return nullptr;
-    startContent = topParent->GetChildAt_Deprecated(contentIndex - mRowsToPrepend);
-  } else {
-    // This will be the first item frame we create.  Use the content
-    // at the current index, which is the first index scrolled into view
-    GetListItemContentAt(mCurrentIndex+aOffset, getter_AddRefs(startContent));
-  }
-
-  if (startContent) {
-    nsIFrame* existingFrame;
-    if (!IsListItemChild(this, startContent, &existingFrame)) {
-      return GetFirstItemBox(++aOffset, aCreated);
-    }
-    if (existingFrame) {
-      return existingFrame->IsXULBoxFrame() ? existingFrame : nullptr;
-    }
-
-    // Either append the new frame, or prepend it (at index 0)
-    // XXX check here if frame was even created, it may not have been if
-    //     display: none was on listitem content
-    bool isAppend = mRowsToPrepend <= 0;
-
-    nsIFrame* topFrame = nullptr;
-    PresContext()->FrameConstructor()->CreateListBoxContent(
-        this, nullptr, startContent, &topFrame, isAppend);
-    mTopFrame = topFrame;
-    if (mTopFrame) {
-      if (aCreated)
-        *aCreated = true;
-
-      mBottomFrame = mTopFrame;
-
-      return mTopFrame->IsXULBoxFrame() ? mTopFrame.GetFrame() : nullptr;
-    } else
-      return GetFirstItemBox(++aOffset, 0);
-  }
-
-  return nullptr;
-}
-
-//
-// Get the nsIFrame for the next visible listitem after aBox, and if none
-// exists, create one.
-//
-nsIFrame*
-nsListBoxBodyFrame::GetNextItemBox(nsIFrame* aBox, int32_t aOffset,
-                                   bool* aCreated)
-{
-  if (aCreated)
-    *aCreated = false;
-
-  nsIFrame* result = aBox->GetNextSibling();
-
-  if (!result || result == mLinkupFrame || mRowsToPrepend > 0) {
-    // No result found. See if there's a content node that wants a frame.
-    nsIContent* prevContent = aBox->GetContent();
-    nsIContent* parentContent = prevContent->GetParent();
-
-    int32_t i = parentContent->ComputeIndexOf(prevContent);
-
-    uint32_t childCount = parentContent->GetChildCount();
-    if (((uint32_t)i + aOffset + 1) < childCount) {
-      // There is a content node that wants a frame.
-      nsIContent *nextContent = parentContent->GetChildAt_Deprecated(i + aOffset + 1);
-
-      nsIFrame* existingFrame;
-      if (!IsListItemChild(this, nextContent, &existingFrame)) {
-        return GetNextItemBox(aBox, ++aOffset, aCreated);
-      }
-      if (!existingFrame) {
-        // Either append the new frame, or insert it after the current frame
-        bool isAppend = result != mLinkupFrame && mRowsToPrepend <= 0;
-        nsIFrame* prevFrame = isAppend ? nullptr : aBox;
-
-        PresContext()->FrameConstructor()->CreateListBoxContent(
-            this, prevFrame, nextContent, &result, isAppend);
-
-        if (result) {
-          if (aCreated)
-            *aCreated = true;
-        } else
-          return GetNextItemBox(aBox, ++aOffset, aCreated);
-      } else {
-        result = existingFrame;
-      }
-
-      mLinkupFrame = nullptr;
-    }
-  }
-
-  if (!result)
-    return nullptr;
-
-  mBottomFrame = result;
-
-  NS_ASSERTION(!result->IsXULBoxFrame() || result->GetParent() == this,
-               "returning frame that is not in childlist");
-
-  return result->IsXULBoxFrame() ? result : nullptr;
-}
-
-bool
-nsListBoxBodyFrame::ContinueReflow(nscoord height)
-{
-#ifdef ACCESSIBILITY
-  if (nsIPresShell::IsAccessibilityActive()) {
-    // Create all the frames at once so screen readers and
-    // onscreen keyboards can see the full list right away
-    return true;
-  }
-#endif
-
-  if (height <= 0) {
-    nsIFrame* lastChild = GetLastFrame();
-    nsIFrame* startingPoint = mBottomFrame;
-    if (startingPoint == nullptr) {
-      // We just want to delete everything but the first item.
-      startingPoint = GetFirstFrame();
-    }
-
-    if (lastChild != startingPoint) {
-      // We have some hangers on (probably caused by shrinking the size of the window).
-      // Nuke them.
-      nsIFrame* currFrame = startingPoint->GetNextSibling();
-      nsBoxLayoutState state(PresContext());
-
-      while (currFrame) {
-        nsIFrame* nextFrame = currFrame->GetNextSibling();
-        RemoveChildFrame(state, currFrame);
-        currFrame = nextFrame;
-      }
-
-      PresShell()->
-        FrameNeedsReflow(this, nsIPresShell::eTreeChange,
-                         NS_FRAME_HAS_DIRTY_CHILDREN);
-    }
-    return false;
-  }
-  else
-    return true;
-}
-
-NS_IMETHODIMP
-nsListBoxBodyFrame::ListBoxAppendFrames(nsFrameList& aFrameList)
-{
-  // append them after
-  nsBoxLayoutState state(PresContext());
-  const nsFrameList::Slice& newFrames = mFrames.AppendFrames(nullptr, aFrameList);
-  if (mLayoutManager)
-    mLayoutManager->ChildrenAppended(this, state, newFrames);
-  PresShell()->
-    FrameNeedsReflow(this, nsIPresShell::eTreeChange,
-                     NS_FRAME_HAS_DIRTY_CHILDREN);
-
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsListBoxBodyFrame::ListBoxInsertFrames(nsIFrame* aPrevFrame,
-                                        nsFrameList& aFrameList)
-{
-  // insert the frames to our info list
-  nsBoxLayoutState state(PresContext());
-  const nsFrameList::Slice& newFrames =
-    mFrames.InsertFrames(nullptr, aPrevFrame, aFrameList);
-  if (mLayoutManager)
-    mLayoutManager->ChildrenInserted(this, state, aPrevFrame, newFrames);
-  PresShell()->
-    FrameNeedsReflow(this, nsIPresShell::eTreeChange,
-                     NS_FRAME_HAS_DIRTY_CHILDREN);
-
-  return NS_OK;
-}
-
-//
-// Called by nsCSSFrameConstructor when a new listitem content is inserted.
-//
-void
-nsListBoxBodyFrame::OnContentInserted(nsIContent* aChildContent)
-{
-  if (mRowCount >= 0)
-    ++mRowCount;
-
-  // The RDF content builder will build content nodes such that they are all
-  // ready when OnContentInserted is first called, meaning the first call
-  // to CreateRows will create all the frames, but OnContentInserted will
-  // still be called again for each content node - so we need to make sure
-  // that the frame for each content node hasn't already been created.
-  nsIFrame* childFrame = aChildContent->GetPrimaryFrame();
-  if (childFrame)
-    return;
-
-  int32_t siblingIndex;
-  nsCOMPtr<nsIContent> nextSiblingContent;
-  GetListItemNextSibling(aChildContent, getter_AddRefs(nextSiblingContent), siblingIndex);
-
-  // if we're inserting our item before the first visible content,
-  // then we need to shift all rows down by one
-  if (siblingIndex >= 0 &&  siblingIndex-1 <= mCurrentIndex) {
-    mTopFrame = nullptr;
-    mRowsToPrepend = 1;
-  } else if (nextSiblingContent) {
-    // we may be inserting before a frame that is on screen
-    nsIFrame* nextSiblingFrame = nextSiblingContent->GetPrimaryFrame();
-    mLinkupFrame = nextSiblingFrame;
-  }
-
-  CreateRows();
-  PresShell()->
-    FrameNeedsReflow(this, nsIPresShell::eTreeChange,
-                     NS_FRAME_HAS_DIRTY_CHILDREN);
-}
-
-//
-// Called by nsCSSFrameConstructor when listitem content is removed.
-//
-void
-nsListBoxBodyFrame::OnContentRemoved(nsPresContext* aPresContext,
-                                     nsIContent* aContainer,
-                                     nsIFrame* aChildFrame,
-                                     nsIContent* aOldNextSibling)
-{
-  NS_ASSERTION(!aChildFrame || aChildFrame->GetParent() == this,
-               "Removing frame that's not our child... Not good");
-
-  if (mRowCount >= 0)
-    --mRowCount;
-
-  if (aContainer) {
-    if (!aChildFrame) {
-      // The row we are removing is out of view, so we need to try to
-      // determine the index of its next sibling.
-      int32_t siblingIndex = -1;
-      if (aOldNextSibling) {
-        nsCOMPtr<nsIContent> nextSiblingContent;
-        GetListItemNextSibling(aOldNextSibling,
-                               getter_AddRefs(nextSiblingContent),
-                               siblingIndex);
-      }
-
-      // if the row being removed is off-screen and above the top frame, we need to
-      // adjust our top index and tell the scrollbar to shift up one row.
-      if (siblingIndex >= 0 && siblingIndex-1 < mCurrentIndex) {
-        MOZ_ASSERT(mCurrentIndex > 0, "mCurrentIndex > 0");
-        --mCurrentIndex;
-        mYPosition = mCurrentIndex*mRowHeight;
-        AutoWeakFrame weakChildFrame(aChildFrame);
-        VerticalScroll(mYPosition);
-        if (!weakChildFrame.IsAlive()) {
-          return;
-        }
-      }
-    } else if (mCurrentIndex > 0) {
-      // At this point, we know we have a scrollbar, and we need to know
-      // if we are scrolled to the last row.  In this case, the behavior
-      // of the scrollbar is to stay locked to the bottom.  Since we are
-      // removing visible content, the first visible row will have to move
-      // down by one, and we will have to insert a new frame at the top.
-
-      // if the last content node has a frame, we are scrolled to the bottom
-      nsIContent* lastChild = nullptr;
-      FlattenedChildIterator iter(mContent);
-      for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
-        lastChild = child;
-      }
-
-      if (lastChild) {
-        nsIFrame* lastChildFrame = lastChild->GetPrimaryFrame();
-
-        if (lastChildFrame) {
-          mTopFrame = nullptr;
-          mRowsToPrepend = 1;
-          --mCurrentIndex;
-          mYPosition = mCurrentIndex*mRowHeight;
-          AutoWeakFrame weakChildFrame(aChildFrame);
-          VerticalScroll(mYPosition);
-          if (!weakChildFrame.IsAlive()) {
-            return;
-          }
-        }
-      }
-    }
-  }
-
-  // if we're removing the top row, the new top row is the next row
-  if (mTopFrame && mTopFrame == aChildFrame)
-    mTopFrame = mTopFrame->GetNextSibling();
-
-  // Go ahead and delete the frame.
-  nsBoxLayoutState state(aPresContext);
-  if (aChildFrame) {
-    RemoveChildFrame(state, aChildFrame);
-  }
-
-  PresShell()->
-    FrameNeedsReflow(this, nsIPresShell::eTreeChange,
-                     NS_FRAME_HAS_DIRTY_CHILDREN);
-}
-
-void
-nsListBoxBodyFrame::GetListItemContentAt(int32_t aIndex, nsIContent** aContent)
-{
-  *aContent = nullptr;
-
-  int32_t itemsFound = 0;
-  FlattenedChildIterator iter(mContent);
-  for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
-    if (child->IsXULElement(nsGkAtoms::listitem)) {
-      ++itemsFound;
-      if (itemsFound-1 == aIndex) {
-        *aContent = child;
-        NS_IF_ADDREF(*aContent);
-        return;
-      }
-    }
-  }
-}
-
-void
-nsListBoxBodyFrame::GetListItemNextSibling(nsIContent* aListItem, nsIContent** aContent, int32_t& aSiblingIndex)
-{
-  *aContent = nullptr;
-  aSiblingIndex = -1;
-  nsIContent *prevKid = nullptr;
-  FlattenedChildIterator iter(mContent);
-  for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
-    if (child->IsXULElement(nsGkAtoms::listitem)) {
-      ++aSiblingIndex;
-      if (prevKid == aListItem) {
-        *aContent = child;
-        NS_IF_ADDREF(*aContent);
-        return;
-      }
-    }
-    prevKid = child;
-  }
-
-  aSiblingIndex = -1; // no match, so there is no next sibling
-}
-
-void
-nsListBoxBodyFrame::RemoveChildFrame(nsBoxLayoutState &aState,
-                                     nsIFrame         *aFrame)
-{
-  MOZ_ASSERT(mFrames.ContainsFrame(aFrame));
-  MOZ_ASSERT(aFrame != GetContentInsertionFrame());
-
-#ifdef ACCESSIBILITY
-  nsAccessibilityService* accService = nsIPresShell::AccService();
-  if (accService) {
-    nsIContent* content = aFrame->GetContent();
-    accService->ContentRemoved(PresShell(), content);
-  }
-#endif
-
-  mFrames.RemoveFrame(aFrame);
-  if (mLayoutManager)
-    mLayoutManager->ChildrenRemoved(this, aState, aFrame);
-  aFrame->Destroy();
-}
-
-// Creation Routines ///////////////////////////////////////////////////////////////////////
-
-already_AddRefed<nsBoxLayout> NS_NewListBoxLayout();
-
-nsIFrame*
-NS_NewListBoxBodyFrame(nsIPresShell* aPresShell, ComputedStyle* aStyle)
-{
-  nsCOMPtr<nsBoxLayout> layout = NS_NewListBoxLayout();
-  return new (aPresShell) nsListBoxBodyFrame(aStyle, layout);
-}
-
-NS_IMPL_FRAMEARENA_HELPERS(nsListBoxBodyFrame)
deleted file mode 100644
--- a/layout/xul/nsListBoxBodyFrame.h
+++ /dev/null
@@ -1,226 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef nsListBoxBodyFrame_h
-#define nsListBoxBodyFrame_h
-
-#include "mozilla/Attributes.h"
-#include "nsCOMPtr.h"
-#include "nsBoxFrame.h"
-#include "nsIScrollbarMediator.h"
-#include "nsIReflowCallback.h"
-#include "nsBoxLayoutState.h"
-#include "nsThreadUtils.h"
-#include "nsPIBoxObject.h"
-
-class nsPresContext;
-class nsListScrollSmoother;
-nsIFrame* NS_NewListBoxBodyFrame(nsIPresShell* aPresShell,
-                                 mozilla::ComputedStyle* aStyle);
-
-namespace mozilla {
-namespace dom {
-class Element;
-} // namespace dom
-} // namespace mozilla
-
-class nsListBoxBodyFrame final : public nsBoxFrame,
-                                 public nsIScrollbarMediator,
-                                 public nsIReflowCallback
-{
-  nsListBoxBodyFrame(ComputedStyle* aStyle,
-                     nsBoxLayout* aLayoutManager);
-  virtual ~nsListBoxBodyFrame();
-
-public:
-  NS_DECL_QUERYFRAME
-  NS_DECL_FRAMEARENA_HELPERS(nsListBoxBodyFrame)
-
-  // non-virtual ListBoxObject
-  int32_t GetNumberOfVisibleRows();
-  int32_t GetIndexOfFirstVisibleRow();
-  nsresult EnsureIndexIsVisible(int32_t aRowIndex);
-  nsresult ScrollToIndex(int32_t aRowIndex);
-  nsresult ScrollByLines(int32_t aNumLines);
-  nsresult GetItemAtIndex(int32_t aIndex, mozilla::dom::Element **aResult);
-  nsresult GetIndexOfItem(mozilla::dom::Element *aItem, int32_t *aResult);
-
-  friend nsIFrame* NS_NewListBoxBodyFrame(nsIPresShell* aPresShell,
-                                          ComputedStyle* aStyle);
-
-  // nsIFrame
-  virtual void Init(nsIContent*       aContent,
-                    nsContainerFrame* aParent,
-                    nsIFrame*         aPrevInFlow) override;
-  virtual void DestroyFrom(nsIFrame* aDestructRoot, PostDestroyData& aPostDestroyData) override;
-
-  virtual nsresult AttributeChanged(int32_t aNameSpaceID, nsAtom* aAttribute, int32_t aModType) override;
-
-  // nsIScrollbarMediator
-  virtual void ScrollByPage(nsScrollbarFrame* aScrollbar, int32_t aDirection,
-                            nsIScrollbarMediator::ScrollSnapMode snapMode
-                              = nsIScrollbarMediator::DISABLE_SNAP) override;
-  virtual void ScrollByWhole(nsScrollbarFrame* aScrollbar, int32_t aDirection,
-                             nsIScrollbarMediator::ScrollSnapMode snapMode
-                               = nsIScrollbarMediator::DISABLE_SNAP) override;
-  virtual void ScrollByLine(nsScrollbarFrame* aScrollbar, int32_t aDirection,
-                            nsIScrollbarMediator::ScrollSnapMode snapMode
-                              = nsIScrollbarMediator::DISABLE_SNAP) override;
-  virtual void RepeatButtonScroll(nsScrollbarFrame* aScrollbar) override;
-  virtual void ThumbMoved(nsScrollbarFrame* aScrollbar,
-                          int32_t aOldPos,
-                          int32_t aNewPos) override;
-  virtual void ScrollbarReleased(nsScrollbarFrame* aScrollbar) override {}
-  virtual void VisibilityChanged(bool aVisible) override;
-  virtual nsIFrame* GetScrollbarBox(bool aVertical) override;
-  virtual void ScrollbarActivityStarted() const override {}
-  virtual void ScrollbarActivityStopped() const override {}
-  virtual bool IsScrollbarOnRight() const override {
-    return (StyleVisibility()->mDirection == NS_STYLE_DIRECTION_LTR);
-  }
-  virtual bool ShouldSuppressScrollbarRepaints() const override {
-    return false;
-  }
-
-
-  // nsIReflowCallback
-  virtual bool ReflowFinished() override;
-  virtual void ReflowCallbackCanceled() override;
-
-  NS_IMETHOD DoXULLayout(nsBoxLayoutState& aBoxLayoutState) override;
-  virtual void MarkIntrinsicISizesDirty() override;
-
-  virtual nsSize GetXULMinSizeForScrollArea(nsBoxLayoutState& aBoxLayoutState) override;
-  virtual nsSize GetXULPrefSize(nsBoxLayoutState& aBoxLayoutState) override;
-
-  // size calculation
-  int32_t GetRowCount();
-  int32_t GetRowHeightAppUnits() { return mRowHeight; }
-  int32_t GetRowHeightPixels() const;
-  int32_t GetFixedRowSize();
-  void SetRowHeight(nscoord aRowHeight);
-  nscoord GetYPosition();
-  nscoord GetAvailableHeight();
-  nscoord ComputeIntrinsicISize(nsBoxLayoutState& aBoxLayoutState);
-
-  // scrolling
-  nsresult InternalPositionChangedCallback();
-  nsresult InternalPositionChanged(bool aUp, int32_t aDelta);
-  // Process pending position changed events, then do the position change.
-  // This can wipe out the frametree.
-  nsresult DoInternalPositionChangedSync(bool aUp, int32_t aDelta);
-  // Actually do the internal position change.  This can wipe out the frametree
-  nsresult DoInternalPositionChanged(bool aUp, int32_t aDelta);
-  nsListScrollSmoother* GetSmoother();
-  void VerticalScroll(int32_t aDelta);
-  // Update the scroll index given a position, in CSS pixels
-  void UpdateIndex(int32_t aNewPos);
-
-  // frames
-  nsIFrame* GetFirstFrame();
-  nsIFrame* GetLastFrame();
-
-  // lazy row creation and destruction
-  void CreateRows();
-  void DestroyRows(int32_t& aRowsToLose);
-  void ReverseDestroyRows(int32_t& aRowsToLose);
-  nsIFrame* GetFirstItemBox(int32_t aOffset, bool* aCreated);
-  nsIFrame* GetNextItemBox(nsIFrame* aBox, int32_t aOffset, bool* aCreated);
-  bool ContinueReflow(nscoord height);
-  NS_IMETHOD ListBoxAppendFrames(nsFrameList& aFrameList);
-  NS_IMETHOD ListBoxInsertFrames(nsIFrame* aPrevFrame, nsFrameList& aFrameList);
-  void OnContentInserted(nsIContent* aContent);
-  void OnContentRemoved(nsPresContext* aPresContext,  nsIContent* aContainer,
-                        nsIFrame* aChildFrame, nsIContent* aOldNextSibling);
-
-  void GetListItemContentAt(int32_t aIndex, nsIContent** aContent);
-  void GetListItemNextSibling(nsIContent* aListItem, nsIContent** aContent, int32_t& aSiblingIndex);
-
-  void PostReflowCallback();
-
-  bool SetBoxObject(nsPIBoxObject* aBoxObject)
-  {
-    NS_ENSURE_TRUE(!mBoxObject, false);
-    mBoxObject = aBoxObject;
-    return true;
-  }
-
-  virtual bool SupportsOrdinalsInChildren() override;
-
-  virtual bool ComputesOwnOverflowArea() override { return true; }
-
-protected:
-  class nsPositionChangedEvent;
-  friend class nsPositionChangedEvent;
-
-  class nsPositionChangedEvent : public mozilla::Runnable
-  {
-  public:
-    nsPositionChangedEvent(nsListBoxBodyFrame* aFrame, bool aUp, int32_t aDelta)
-      : mozilla::Runnable("nsListBoxBodyFrame::nsPositionChangedEvent")
-      , mFrame(aFrame)
-      , mUp(aUp)
-      , mDelta(aDelta)
-    {}
-
-    NS_IMETHOD Run() override
-    {
-      if (!mFrame) {
-        return NS_OK;
-      }
-
-      mFrame->mPendingPositionChangeEvents.RemoveElement(this);
-
-      return mFrame->DoInternalPositionChanged(mUp, mDelta);
-    }
-
-    void Revoke() {
-      mFrame = nullptr;
-    }
-
-    nsListBoxBodyFrame* mFrame;
-    bool mUp;
-    int32_t mDelta;
-  };
-
-  void ComputeTotalRowCount();
-  int32_t ToRowIndex(nscoord aPos) const;
-  void RemoveChildFrame(nsBoxLayoutState &aState, nsIFrame *aChild);
-
-  nsTArray< RefPtr<nsPositionChangedEvent> > mPendingPositionChangeEvents;
-  nsCOMPtr<nsPIBoxObject> mBoxObject;
-
-  // frame markers
-  WeakFrame mTopFrame;
-  nsIFrame* mBottomFrame;
-  nsIFrame* mLinkupFrame;
-
-  nsListScrollSmoother* mScrollSmoother;
-
-  int32_t mRowsToPrepend;
-
-  // row height
-  int32_t mRowCount;
-  nscoord mRowHeight;
-  nscoord mAvailableHeight;
-  nscoord mStringWidth;
-
-  // scrolling
-  int32_t mCurrentIndex; // Row-based
-  int32_t mOldIndex;
-  int32_t mYPosition;
-  int32_t mTimePerRow;
-
-  // row height
-  bool mRowHeightWasSet;
-  // scrolling
-  bool mScrolling;
-  bool mAdjustScroll;
-
-  bool mReflowCallbackPosted;
-};
-
-#endif // nsListBoxBodyFrame_h
deleted file mode 100644
--- a/layout/xul/nsListBoxLayout.cpp
+++ /dev/null
@@ -1,213 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsListBoxLayout.h"
-
-#include "nsListBoxBodyFrame.h"
-#include "nsBox.h"
-#include "nsBoxLayoutState.h"
-#include "nsIScrollableFrame.h"
-#include "nsIReflowCallback.h"
-#include "mozilla/dom/NameSpaceConstants.h"
-#include "nsGkAtoms.h"
-#include "nsContentUtils.h"
-
-nsListBoxLayout::nsListBoxLayout() : nsGridRowGroupLayout()
-{
-}
-
-////////// nsBoxLayout //////////////
-
-nsSize
-nsListBoxLayout::GetXULPrefSize(nsIFrame* aBox, nsBoxLayoutState& aBoxLayoutState)
-{
-  nsSize pref = nsGridRowGroupLayout::GetXULPrefSize(aBox, aBoxLayoutState);
-
-  nsListBoxBodyFrame* frame = static_cast<nsListBoxBodyFrame*>(aBox);
-  if (frame) {
-    nscoord rowheight = frame->GetRowHeightAppUnits();
-    pref.height = frame->GetRowCount() * rowheight;
-    // Pad the height.
-    nscoord y = frame->GetAvailableHeight();
-    if (pref.height > y && y > 0 && rowheight > 0) {
-      nscoord m = (pref.height-y)%rowheight;
-      nscoord remainder = m == 0 ? 0 : rowheight - m;
-      pref.height += remainder;
-    }
-    if (nsContentUtils::HasNonEmptyAttr(frame->GetContent(), kNameSpaceID_None,
-                                        nsGkAtoms::sizemode)) {
-      nscoord width = frame->ComputeIntrinsicISize(aBoxLayoutState);
-      if (width > pref.width)
-        pref.width = width;
-    }
-  }
-  return pref;
-}
-
-nsSize
-nsListBoxLayout::GetXULMinSize(nsIFrame* aBox, nsBoxLayoutState& aBoxLayoutState)
-{
-  nsSize minSize = nsGridRowGroupLayout::GetXULMinSize(aBox, aBoxLayoutState);
-
-  nsListBoxBodyFrame* frame = static_cast<nsListBoxBodyFrame*>(aBox);
-  if (frame) {
-    nscoord rowheight = frame->GetRowHeightAppUnits();
-    minSize.height = frame->GetRowCount() * rowheight;
-    // Pad the height.
-    nscoord y = frame->GetAvailableHeight();
-    if (minSize.height > y && y > 0 && rowheight > 0) {
-      nscoord m = (minSize.height-y)%rowheight;
-      nscoord remainder = m == 0 ? 0 : rowheight - m;
-      minSize.height += remainder;
-    }
-    if (nsContentUtils::HasNonEmptyAttr(frame->GetContent(), kNameSpaceID_None,
-                                        nsGkAtoms::sizemode)) {
-      nscoord width = frame->ComputeIntrinsicISize(aBoxLayoutState);
-      if (width > minSize.width)
-        minSize.width = width;
-    }
-  }
-  return minSize;
-}
-
-nsSize
-nsListBoxLayout::GetXULMaxSize(nsIFrame* aBox, nsBoxLayoutState& aBoxLayoutState)
-{
-  nsSize maxSize = nsGridRowGroupLayout::GetXULMaxSize(aBox, aBoxLayoutState);
-
-  nsListBoxBodyFrame* frame = static_cast<nsListBoxBodyFrame*>(aBox);
-  if (frame) {
-    nscoord rowheight = frame->GetRowHeightAppUnits();
-    maxSize.height = frame->GetRowCount() * rowheight;
-    // Pad the height.
-    nscoord y = frame->GetAvailableHeight();
-    if (maxSize.height > y && y > 0 && rowheight > 0) {
-      nscoord m = (maxSize.height-y)%rowheight;
-      nscoord remainder = m == 0 ? 0 : rowheight - m;
-      maxSize.height += remainder;
-    }
-  }
-  return maxSize;
-}
-
-NS_IMETHODIMP
-nsListBoxLayout::XULLayout(nsIFrame* aBox, nsBoxLayoutState& aState)
-{
-  return LayoutInternal(aBox, aState);
-}
-
-
-/////////// nsListBoxLayout /////////////////////////
-
-/**
- * Called to layout our our children. Does no frame construction
- */
-NS_IMETHODIMP
-nsListBoxLayout::LayoutInternal(nsIFrame* aBox, nsBoxLayoutState& aState)
-{
-  int32_t redrawStart = -1;
-
-  // Get the start y position.
-  nsListBoxBodyFrame* body = static_cast<nsListBoxBodyFrame*>(aBox);
-  if (!body) {
-    NS_ERROR("Frame encountered that isn't a listboxbody!");
-    return NS_ERROR_FAILURE;
-  }
-
-  nsMargin margin;
-
-  // Get our client rect.
-  nsRect clientRect;
-  aBox->GetXULClientRect(clientRect);
-
-  // Get the starting y position and the remaining available
-  // height.
-  nscoord availableHeight = body->GetAvailableHeight();
-  nscoord yOffset = body->GetYPosition();
-
-  if (availableHeight <= 0) {
-    bool fixed = (body->GetFixedRowSize() != -1);
-    if (fixed)
-      availableHeight = 10;
-    else
-      return NS_OK;
-  }
-
-  // run through all our currently created children
-  nsIFrame* box = nsBox::GetChildXULBox(body);
-
-  // if the reason is resize or initial we must relayout.
-  nscoord rowHeight = body->GetRowHeightAppUnits();
-
-  while (box) {
-    // If this box is dirty or if it has dirty children, we
-    // call layout on it.
-    nsRect childRect(box->GetRect());
-    box->GetXULMargin(margin);
-
-    // relayout if we must or we are dirty or some of our children are dirty
-    //   or the client area is wider than us
-    // XXXldb There should probably be a resize check here too!
-    if (NS_SUBTREE_DIRTY(box) || childRect.width < clientRect.width) {
-      childRect.x = 0;
-      childRect.y = yOffset;
-      childRect.width = clientRect.width;
-
-      nsSize size = box->GetXULPrefSize(aState);
-      body->SetRowHeight(size.height);
-
-      childRect.height = rowHeight;
-
-      childRect.Deflate(margin);
-      box->SetXULBounds(aState, childRect);
-      box->XULLayout(aState);
-    } else {
-      // if the child did not need to be relayed out. Then its easy.
-      // Place the child by just grabbing its rect and adjusting the y.
-      int32_t newPos = yOffset+margin.top;
-
-      // are we pushing down or pulling up any rows?
-      // Then we may have to redraw everything below the moved
-      // rows.
-      if (redrawStart == -1 && childRect.y != newPos)
-        redrawStart = newPos;
-
-      childRect.y = newPos;
-      box->SetXULBounds(aState, childRect);
-    }
-
-    // Ok now the available size gets smaller and we move the
-    // starting position of the next child down some.
-    nscoord size = childRect.height + margin.top + margin.bottom;
-
-    yOffset += size;
-    availableHeight -= size;
-
-    box = nsBox::GetNextXULBox(box);
-  }
-
-  // We have enough available height left to add some more rows
-  // Since we can't do this during layout, we post a callback
-  // that will be processed after the reflow completes.
-  body->PostReflowCallback();
-
-  // if rows were pushed down or pulled up because some rows were added
-  // before them then redraw everything under the inserted rows. The inserted
-  // rows will automatically be redrawn because the were marked dirty on insertion.
-  if (redrawStart > -1) {
-    aBox->XULRedraw(aState);
-  }
-
-  return NS_OK;
-}
-
-// Creation Routines ///////////////////////////////////////////////////////////////////////
-
-already_AddRefed<nsBoxLayout> NS_NewListBoxLayout()
-{
-  RefPtr<nsBoxLayout> layout = new nsListBoxLayout();
-  return layout.forget();
-}
deleted file mode 100644
--- a/layout/xul/nsListBoxLayout.h
+++ /dev/null
@@ -1,33 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef nsListBoxLayout_h___
-#define nsListBoxLayout_h___
-
-#include "mozilla/Attributes.h"
-#include "nsGridRowGroupLayout.h"
-
-class nsIFrame;
-typedef class nsIFrame nsIFrame;
-class nsBoxLayoutState;
-
-class nsListBoxLayout final : public nsGridRowGroupLayout
-{
-public:
-  nsListBoxLayout();
-
-  // nsBoxLayout
-  NS_IMETHOD XULLayout(nsIFrame* aBox, nsBoxLayoutState& aState) override;
-  virtual nsSize GetXULPrefSize(nsIFrame* aBox, nsBoxLayoutState& aBoxLayoutState) override;
-  virtual nsSize GetXULMinSize(nsIFrame* aBox, nsBoxLayoutState& aBoxLayoutState) override;
-  virtual nsSize GetXULMaxSize(nsIFrame* aBox, nsBoxLayoutState& aBoxLayoutState) override;
-
-protected:
-  NS_IMETHOD LayoutInternal(nsIFrame* aBox, nsBoxLayoutState& aState);
-};
-
-#endif
-
deleted file mode 100644
--- a/layout/xul/nsListItemFrame.cpp
+++ /dev/null
@@ -1,72 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsListItemFrame.h"
-
-#include <algorithm>
-
-#include "nsCOMPtr.h"
-#include "nsNameSpaceManager.h"
-#include "nsGkAtoms.h"
-#include "nsDisplayList.h"
-#include "nsBoxLayout.h"
-#include "nsIContent.h"
-
-using namespace mozilla;
-
-nsListItemFrame::nsListItemFrame(ComputedStyle* aStyle,
-                                 bool aIsRoot,
-                                 nsBoxLayout* aLayoutManager)
-  : nsGridRowLeafFrame(aStyle, aIsRoot, aLayoutManager, kClassID)
-{
-}
-
-nsListItemFrame::~nsListItemFrame()
-{
-}
-
-nsSize
-nsListItemFrame::GetXULPrefSize(nsBoxLayoutState& aState)
-{
-  nsSize size = nsBoxFrame::GetXULPrefSize(aState);
-  DISPLAY_PREF_SIZE(this, size);
-
-  // guarantee that our preferred height doesn't exceed the standard
-  // listbox row height
-  size.height = std::max(mRect.height, size.height);
-  return size;
-}
-
-void
-nsListItemFrame::BuildDisplayListForChildren(nsDisplayListBuilder*   aBuilder,
-                                             const nsDisplayListSet& aLists)
-{
-  if (aBuilder->IsForEventDelivery()) {
-    if (!mContent->AsElement()->AttrValueIs(kNameSpaceID_None,
-                                            nsGkAtoms::allowevents,
-                                            nsGkAtoms::_true, eCaseMatters))
-      return;
-  }
-
-  nsGridRowLeafFrame::BuildDisplayListForChildren(aBuilder, aLists);
-}
-
-// Creation Routine ///////////////////////////////////////////////////////////////////////
-
-already_AddRefed<nsBoxLayout> NS_NewGridRowLeafLayout();
-
-nsIFrame*
-NS_NewListItemFrame(nsIPresShell* aPresShell, ComputedStyle* aStyle)
-{
-  nsCOMPtr<nsBoxLayout> layout = NS_NewGridRowLeafLayout();
-  if (!layout) {
-    return nullptr;
-  }
-
-  return new (aPresShell) nsListItemFrame(aStyle, false, layout);
-}
-
-NS_IMPL_FRAMEARENA_HELPERS(nsListItemFrame)
deleted file mode 100644
--- a/layout/xul/nsListItemFrame.h
+++ /dev/null
@@ -1,34 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "mozilla/Attributes.h"
-#include "nsGridRowLeafFrame.h"
-
-nsIFrame* NS_NewListItemFrame(nsIPresShell* aPresShell,
-                              mozilla::ComputedStyle* aStyle);
-
-class nsListItemFrame final : public nsGridRowLeafFrame
-{
-public:
-  NS_DECL_FRAMEARENA_HELPERS(nsListItemFrame)
-
-  friend nsIFrame* NS_NewListItemFrame(nsIPresShell* aPresShell,
-                                       ComputedStyle* aStyle);
-
-  // overridden so that children of listitems don't handle mouse events,
-  // unless allowevents="true" is specified on the listitem
-  virtual void BuildDisplayListForChildren(nsDisplayListBuilder*   aBuilder,
-                                           const nsDisplayListSet& aLists) override;
-
-  virtual nsSize GetXULPrefSize(nsBoxLayoutState& aState) override;
-
-protected:
-  explicit nsListItemFrame(ComputedStyle* aStyle,
-                           bool aIsRoot = false,
-                           nsBoxLayout* aLayoutManager = nullptr);
-  virtual ~nsListItemFrame();
-
-}; // class nsListItemFrame
deleted file mode 100644
--- a/layout/xul/nsPIListBoxObject.h
+++ /dev/null
@@ -1,31 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef nsPIListBoxObject_h__
-#define nsPIListBoxObject_h__
-
-class nsListBoxBodyFrame;
-
-// fa9549f7-ee09-48fc-89f7-30cceee21c15
-#define NS_PILISTBOXOBJECT_IID \
-{ 0xfa9549f7, 0xee09, 0x48fc, \
-  { 0x89, 0xf7, 0x30, 0xcc, 0xee, 0xe2, 0x1c, 0x15 } }
-
-#include "nsIListBoxObject.h"
-
-class nsPIListBoxObject : public nsIListBoxObject {
- public:
-  NS_DECLARE_STATIC_IID_ACCESSOR(NS_PILISTBOXOBJECT_IID)
-  /**
-   * Get the list box body.  This will search for it as needed.
-   * If aFlush is false we don't FlushType::Frames though.
-   */
-  virtual nsListBoxBodyFrame* GetListBoxBody(bool aFlush) = 0;
-};
-
-NS_DEFINE_STATIC_IID_ACCESSOR(nsPIListBoxObject, NS_PILISTBOXOBJECT_IID)
-
-#endif // nsPIListBoxObject_h__
--- a/layout/xul/nsPopupSetFrame.cpp
+++ b/layout/xul/nsPopupSetFrame.cpp
@@ -10,16 +10,18 @@
 #include "nsIContent.h"
 #include "nsPresContext.h"
 #include "mozilla/ComputedStyle.h"
 #include "nsBoxLayoutState.h"
 #include "nsIScrollableFrame.h"
 #include "nsIPopupContainer.h"
 #include "nsMenuPopupFrame.h"
 
+typedef mozilla::ComputedStyle ComputedStyle;
+
 nsIFrame*
 NS_NewPopupSetFrame(nsIPresShell* aPresShell, ComputedStyle* aStyle)
 {
   return new (aPresShell) nsPopupSetFrame(aStyle);
 }
 
 NS_IMPL_FRAMEARENA_HELPERS(nsPopupSetFrame)
 
--- a/layout/xul/nsRootBoxFrame.cpp
+++ b/layout/xul/nsRootBoxFrame.cpp
@@ -4,16 +4,17 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsHTMLParts.h"
 #include "nsStyleConsts.h"
 #include "nsGkAtoms.h"
 #include "nsIPresShell.h"
 #include "nsBoxFrame.h"
+#include "nsDisplayList.h"
 #include "nsStackLayout.h"
 #include "nsIPopupContainer.h"
 #include "nsIContent.h"
 #include "nsFrameManager.h"
 #include "mozilla/BasicEvents.h"
 
 using namespace mozilla;
 
--- a/layout/xul/nsSliderFrame.cpp
+++ b/layout/xul/nsSliderFrame.cpp
@@ -49,16 +49,17 @@
 #include <algorithm>
 
 using namespace mozilla;
 using mozilla::layers::APZCCallbackHelper;
 using mozilla::layers::AsyncDragMetrics;
 using mozilla::layers::InputAPZContext;
 using mozilla::layers::ScrollDirection;
 using mozilla::layers::ScrollbarData;
+using mozilla::dom::Event;
 
 bool nsSliderFrame::gMiddlePref = false;
 int32_t nsSliderFrame::gSnapMultiplier;
 
 // Turn this on if you want to debug slider frames.
 #undef DEBUG_SLIDER
 
 static already_AddRefed<nsIContent>
--- a/layout/xul/nsXULPopupManager.h
+++ b/layout/xul/nsXULPopupManager.h
@@ -17,16 +17,17 @@
 #include "nsIDOMEventListener.h"
 #include "nsPoint.h"
 #include "nsCOMPtr.h"
 #include "nsTArray.h"
 #include "nsIObserver.h"
 #include "nsITimer.h"
 #include "nsIReflowCallback.h"
 #include "nsThreadUtils.h"
+#include "nsPresContext.h"
 #include "nsStyleConsts.h"
 #include "nsWidgetInitData.h"
 #include "mozilla/Attributes.h"
 #include "Units.h"
 
 // X.h defines KeyPress
 #ifdef KeyPress
 #undef KeyPress
--- a/layout/xul/nsXULTooltipListener.cpp
+++ b/layout/xul/nsXULTooltipListener.cpp
@@ -19,16 +19,17 @@
 #include "nsIScriptContext.h"
 #include "nsPIDOMWindow.h"
 #ifdef MOZ_XUL
 #include "nsXULPopupManager.h"
 #endif
 #include "nsIPopupContainer.h"
 #include "nsIBoxObject.h"
 #include "nsTreeColumns.h"
+#include "nsContentUtils.h"
 #include "mozilla/ErrorResult.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/LookAndFeel.h"
 #include "mozilla/dom/Element.h"
 #include "mozilla/dom/Event.h" // for Event
 #include "mozilla/dom/BoxObject.h"
 #include "mozilla/dom/MouseEvent.h"
 #include "mozilla/dom/TreeColumnBinding.h"
--- a/testing/marionette/element.js
+++ b/testing/marionette/element.js
@@ -33,23 +33,21 @@ const DOCUMENT_NODE = 9;
 
 const XBLNS = "http://www.mozilla.org/xbl";
 const XULNS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
 
 /** XUL elements that support checked property. */
 const XUL_CHECKED_ELS = new Set([
   "button",
   "checkbox",
-  "listitem",
   "toolbarbutton",
 ]);
 
 /** XUL elements that support selected property. */
 const XUL_SELECTED_ELS = new Set([
-  "listitem",
   "menu",
   "menuitem",
   "menuseparator",
   "radio",
   "richlistitem",
   "tab",
 ]);
 
--- a/testing/web-platform/meta/content-security-policy/media-src/media-src-7_1_2.sub.html.ini
+++ b/testing/web-platform/meta/content-security-policy/media-src/media-src-7_1_2.sub.html.ini
@@ -1,4 +1,4 @@
 [media-src-7_1_2.sub.html]
+  expected: TIMEOUT
   [Test that securitypolicyviolation events are fired]
-    expected: FAIL
-
+    expected: TIMEOUT
--- a/testing/web-platform/meta/content-security-policy/media-src/media-src-7_2_2.sub.html.ini
+++ b/testing/web-platform/meta/content-security-policy/media-src/media-src-7_2_2.sub.html.ini
@@ -1,4 +1,4 @@
 [media-src-7_2_2.sub.html]
+  expected: TIMEOUT
   [Test that securitypolicyviolation events are fired]
-    expected: FAIL
-
+    expected: TIMEOUT
deleted file mode 100644
--- a/testing/web-platform/meta/content-security-policy/media-src/media-src-7_3_2.sub.html.ini
+++ /dev/null
@@ -1,4 +0,0 @@
-[media-src-7_3_2.sub.html]
-  [Test that securitypolicyviolation events are fired]
-    expected: FAIL
-
--- a/testing/web-platform/meta/content-security-policy/media-src/media-src-blocked.sub.html.ini
+++ b/testing/web-platform/meta/content-security-policy/media-src/media-src-blocked.sub.html.ini
@@ -1,4 +1,4 @@
 [media-src-blocked.sub.html]
+  expected: TIMEOUT
   [Test that securitypolicyviolation events are fired]
-    expected: FAIL
-
+    expected: TIMEOUT
--- a/testing/web-platform/meta/content-security-policy/reporting/report-original-url.sub.html.ini
+++ b/testing/web-platform/meta/content-security-policy/reporting/report-original-url.sub.html.ini
@@ -1,4 +1,7 @@
 [report-original-url.sub.html]
   expected: TIMEOUT
-  [Direct block, cross-origin = full URL in report]
+  [Block after redirect, same-origin = original URL in report]
     expected: TIMEOUT
+
+  [Block after redirect, cross-origin = original URL in report]
+    expected: TIMEOUT
deleted file mode 100644
--- a/testing/web-platform/meta/content-security-policy/reporting/report-strips-fragment.html.ini
+++ /dev/null
@@ -1,4 +0,0 @@
-[report-strips-fragment.html]
-  expected: TIMEOUT
-  [Reported document URI does not contain fragments.]
-    expected: TIMEOUT
--- a/testing/web-platform/meta/content-security-policy/script-src/script-src-strict_dynamic_double_policy_honor_whitelist.sub.html.ini
+++ b/testing/web-platform/meta/content-security-policy/script-src/script-src-strict_dynamic_double_policy_honor_whitelist.sub.html.ini
@@ -1,4 +1,3 @@
 [script-src-strict_dynamic_double_policy_honor_whitelist.sub.html]
-  expected: TIMEOUT
   [Non-whitelisted script injected via `appendChild` is not allowed with `strict-dynamic` + a nonce+whitelist double policy.]
-    expected: TIMEOUT
+    expected: FAIL
deleted file mode 100644
--- a/testing/web-platform/meta/content-security-policy/securitypolicyviolation/inside-dedicated-worker.html.ini
+++ /dev/null
@@ -1,5 +0,0 @@
-[inside-dedicated-worker.html]
-  expected: TIMEOUT
-  [SecurityPolicyViolation event fired on global.]
-    expected: TIMEOUT
-
deleted file mode 100644
--- a/testing/web-platform/meta/content-security-policy/securitypolicyviolation/inside-service-worker.https.html.ini
+++ /dev/null
@@ -1,5 +0,0 @@
-[inside-service-worker.https.html]
-  expected: TIMEOUT
-  [SecurityPolicyViolation event fired on global.]
-    expected: TIMEOUT
-
deleted file mode 100644
--- a/testing/web-platform/meta/content-security-policy/securitypolicyviolation/inside-shared-worker.html.ini
+++ /dev/null
@@ -1,5 +0,0 @@
-[inside-shared-worker.html]
-  expected: TIMEOUT
-  [SecurityPolicyViolation event fired on global.]
-    expected: TIMEOUT
-
deleted file mode 100644
--- a/testing/web-platform/meta/content-security-policy/securitypolicyviolation/securitypolicyviolation-block-cross-origin-image-from-script.sub.html.ini
+++ /dev/null
@@ -1,4 +0,0 @@
-[securitypolicyviolation-block-cross-origin-image-from-script.sub.html]
-  [Non-redirected cross-origin URLs are not stripped.]
-    expected: FAIL
-
deleted file mode 100644
--- a/testing/web-platform/meta/content-security-policy/securitypolicyviolation/securitypolicyviolation-block-cross-origin-image.sub.html.ini
+++ /dev/null
@@ -1,4 +0,0 @@
-[securitypolicyviolation-block-cross-origin-image.sub.html]
-  [Non-redirected cross-origin URLs are not stripped.]
-    expected: FAIL
-
deleted file mode 100644
--- a/testing/web-platform/meta/content-security-policy/securitypolicyviolation/securitypolicyviolation-block-image-from-script.sub.html.ini
+++ /dev/null
@@ -1,4 +0,0 @@
-[securitypolicyviolation-block-image-from-script.sub.html]
-  [Non-redirected cross-origin URLs are not stripped.]
-    expected: FAIL
-
--- a/testing/web-platform/tests/content-security-policy/securitypolicyviolation/img-src-redirect-upgrade-reporting.https.html
+++ b/testing/web-platform/tests/content-security-policy/securitypolicyviolation/img-src-redirect-upgrade-reporting.https.html
@@ -1,31 +1,31 @@
 <!doctype html>
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <script src="./support/testharness-helper.sub.js"></script>
 <body></body>
 <script>
-    function waitForViolation(el, t, policy, blocked_origin) {
+    function waitForViolation(el, t, policy, blockedURI) {
       return new Promise(resolve => {
         el.addEventListener('securitypolicyviolation', e => {
-          if (e.originalPolicy == policy && (new URL(e.blockedURI)).origin == blocked_origin)
+          if (e.originalPolicy == policy && e.blockedURI == blockedURI)
             resolve(e);
           else
             t.unreached_func("Unexpected violation event for " + e.blockedURI)();
         });
       });
     }
 
     async_test(t => {
       var i = document.createElement("img");
       var redirect = generateCrossOriginRedirectImage();
       i.src = redirect.url;
 
       // Report-only policy should trigger a violation on the redirected request.
-      waitForViolation(window, t, "img-src https:", (new URL(redirect.target)).origin).then(t.step_func(e => {
+      waitForViolation(window, t, "img-src https:", new URL(redirect.url, window.location).href).then(t.step_func(e => {
         t.done();
       }));
 
       document.body.appendChild(i);
     }, "Image that redirects to http:// URL prohibited by Report-Only must generate a violation report, even with upgrade-insecure-requests");
 </script>
 </html>
--- a/testing/web-platform/tests/content-security-policy/securitypolicyviolation/support/inside-worker.sub.js
+++ b/testing/web-platform/tests/content-security-policy/securitypolicyviolation/support/inside-worker.sub.js
@@ -35,10 +35,23 @@ async_test(t => {
       assert_false(cspEventFiredInDocument);
     }));
 
   fetch(url)
     .then(t.unreached_func("Fetch should not succeed."))
     .catch(t.step_func(e => assert_true(e instanceof TypeError)));
 }, "SecurityPolicyViolation event fired on global.");
 
+async_test(t => {
+  var url = "{{location[scheme]}}://{{host}}:{{location[port]}}/common/redirect.py?location={{location[scheme]}}://{{domains[www]}}:{{location[port]}}/content-security-policy/support/ping.js";
+  waitUntilCSPEventForURL(t, url)
+    .then(t.step_func_done(e => {
+      assert_equals(e.blockedURI, url);
+      assert_false(cspEventFiredInDocument);
+    }));
+
+  fetch(url)
+    .then(t.unreached_func("Fetch should not succeed."))
+    .catch(t.step_func(e => assert_true(e instanceof TypeError)));
+}, "SecurityPolicyViolation event fired on global with the correct blockedURI.");
+
 // Worker tests need an explicit `done()`.
 done();
--- a/toolkit/content/tests/chrome/test_hiddenitems.xul
+++ b/toolkit/content/tests/chrome/test_hiddenitems.xul
@@ -19,27 +19,17 @@ https://bugzilla.mozilla.org/show_bug.cg
     <richlistitem id="richlistbox_item1"><label value="Item 1"/></richlistitem>
     <richlistitem id="richlistbox_item2"><label value="Item 2"/></richlistitem>
     <richlistitem id="richlistbox_item3" hidden="true"><label value="Item 3"/></richlistitem>
     <richlistitem id="richlistbox_item4"><label value="Item 4"/></richlistitem>
     <richlistitem id="richlistbox_item5" collapsed="true"><label value="Item 5"/></richlistitem>
     <richlistitem id="richlistbox_item6"><label value="Item 6"/></richlistitem>
     <richlistitem id="richlistbox_item7" hidden="true"><label value="Item 7"/></richlistitem>
   </richlistbox>
-  
-  <listbox id="listbox" seltype="multiple">
-    <listitem id="listbox_item1" label="Item 1"/>
-    <listitem id="listbox_item2" label="Item 2"/>
-    <listitem id="listbox_item3" label="Item 3" hidden="true"/>
-    <listitem id="listbox_item4" label="Item 4"/>
-    <listitem id="listbox_item5" label="Item 5" collapsed="true"/>
-    <listitem id="listbox_item6" label="Item 6"/>
-    <listitem id="listbox_item7" label="Item 7" hidden="true"/>
-  </listbox>
-  
+
   <!-- test code goes here -->
   <script type="application/javascript"><![CDATA[
 
 /** Test for Bug 317422 **/
 SimpleTest.waitForExplicitFinish();
 
 function testListbox(id)
 {
@@ -77,13 +67,12 @@ function testListbox(id)
   sendKey("PAGE_DOWN");
   is(listbox.selectedItem.id, id + "_item6", id + ": Page down should go to the last visible item");
   sendKey("PAGE_UP");
   is(listbox.selectedItem.id, id + "_item1", id + ": Page up should go to the first visible item");
 }
 
 window.onload = function runTests() {
   testListbox("richlistbox");
-  testListbox("listbox");
   SimpleTest.finish();
 };
   ]]></script>
 </window>
--- a/toolkit/content/tests/chrome/test_hiddenpaging.xul
+++ b/toolkit/content/tests/chrome/test_hiddenpaging.xul
@@ -37,35 +37,17 @@ https://bugzilla.mozilla.org/show_bug.cg
     <richlistitem id="richlistbox_item9"><label value="Item 9"/></richlistitem>
     <richlistitem id="richlistbox_item10"><label value="Item 10"/></richlistitem>
     <richlistitem id="richlistbox_item11"><label value="Item 11"/></richlistitem>
     <richlistitem id="richlistbox_item12"><label value="Item 12"/></richlistitem>
     <richlistitem id="richlistbox_item13"><label value="Item 13"/></richlistitem>
     <richlistitem id="richlistbox_item14"><label value="Item 14"/></richlistitem>
     <richlistitem id="richlistbox_item15" hidden="true"><label value="Item 15"/></richlistitem>
   </richlistbox>
-  
-  <listbox id="listbox" seltype="multiple" rows="5">
-    <listitem id="listbox_item1" label="Item 1"/>
-    <listitem id="listbox_item2" label="Item 2"/>
-    <listitem id="listbox_item3" label="Item 3" hidden="true"/>
-    <listitem id="listbox_item4" label="Item 4"/>
-    <listitem id="listbox_item5" label="Item 5" hidden="true"/>
-    <listitem id="listbox_item6" label="Item 6"/>
-    <listitem id="listbox_item7" label="Item 7"/>
-    <listitem id="listbox_item8" label="Item 8"/>
-    <listitem id="listbox_item9" label="Item 9"/>
-    <listitem id="listbox_item10" label="Item 10"/>
-    <listitem id="listbox_item11" label="Item 11"/>
-    <listitem id="listbox_item12" label="Item 12"/>
-    <listitem id="listbox_item13" label="Item 13"/>
-    <listitem id="listbox_item14" label="Item 14"/>
-    <listitem id="listbox_item15" label="Item 15" hidden="true"/>
-  </listbox>
-  
+
   <!-- test code goes here -->
   <script type="application/javascript"><![CDATA[
 
 /** Test for Bug 317422 **/
 SimpleTest.waitForExplicitFinish();
 
 function testRichlistbox()
 {
@@ -88,74 +70,14 @@ function testRichlistbox()
   sendKey("PAGE_UP");
   is(listbox.selectedItem.id, id + "_item6", id + ": Second page up should go to the item two visible pages away");
   is(listbox.getIndexOfFirstVisibleRow(), 0, id + ": Second page up should not scroll beyond the start");
   sendKey("PAGE_UP");
   is(listbox.selectedItem.id, id + "_item1", id + ": Third page up should return to the first visible item");
   is(listbox.getIndexOfFirstVisibleRow(), 0, id + ": Third page up should not have scrolled at all");
 }
 
-function testListbox()
-{
-  var id = "listbox";
-  var listbox = document.getElementById(id);
-
-  if (!window.matchMedia("(-moz-overlay-scrollbars)").matches) {
-   // Check that a scrollbar is visible by comparing the width of the listitem
-   // with the width of the listbox. This is a simple way to do this without
-   // checking the anonymous content.
-   ok(listbox.firstChild.getBoundingClientRect().width < listbox.getBoundingClientRect().width - 10,
-      id + ": Scrollbar visible");
- }
-
-  var rowHeight = listbox.firstChild.getBoundingClientRect().height;
-
-  listbox.focus();
-  listbox.selectedIndex = 0;
-  sendKey("PAGE_DOWN");
-  is(listbox.selectedItem.id, id + "_item8", id + ": Page down should go to the item one visible page away");
-  is(listbox.getIndexOfFirstVisibleRow(), 7, id + ": Page down should have scrolled down a visible page");
-  sendKey("PAGE_DOWN");
-  is(listbox.selectedItem.id, id + "_item13", id + ": Second page down should go to the item two visible pages away");
-  is(listbox.getIndexOfFirstVisibleRow(), 9, id + ": Second page down should not scroll beyond the end");
-  sendKey("PAGE_DOWN");
-  is(listbox.selectedItem.id, id + "_item14", id + ": Third page down should go to the last visible item");
-  is(listbox.getIndexOfFirstVisibleRow(), 9, id + ": Third page down should not have scrolled at all");
-  sendKey("PAGE_UP");
-  is(listbox.selectedItem.id, id + "_item9", id + ": Page up should go to the item one visible page away");
-  // the listScrollbox seems to go haywire when scrolling up with hidden listitems
-  todo_is(listbox.getIndexOfFirstVisibleRow(), 3, id + ": Page up should scroll up a visible page");
-  sendKey("PAGE_UP");
-  is(listbox.selectedItem.id, id + "_item2", id + ": Second page up should go to the item two visible pages away");
-  is(listbox.getIndexOfFirstVisibleRow(), 0, id + ": Second page up should not scroll beyond the start");
-  sendKey("PAGE_UP");
-  is(listbox.selectedItem.id, id + "_item1", id + ": Third page up should return to the first visible item");
-  is(listbox.getIndexOfFirstVisibleRow(), 0, id + ": Third page up should not have scrolled at all");
-
-  var scrollHeight = document.getAnonymousNodes(listbox)[1].lastChild.scrollHeight;
-  is(scrollHeight, rowHeight * 15, id + ": scrollHeight when rows set");
-
-  listbox.minHeight = 50;
-  scrollHeight = document.getAnonymousNodes(listbox)[1].lastChild.scrollHeight;
-  is(scrollHeight, rowHeight * 15, id + ": scrollHeight when rows and minimium height set");
-
-  listbox.removeAttribute("rows");
-
-  var availHeight = document.getAnonymousNodes(listbox)[1].lastChild.getBoundingClientRect().height;
-  // The listbox layout adds this extra height in GetPrefSize. Not sure what it's for though.
-  var e = (rowHeight * 15 - availHeight) % rowHeight;
-  var extraHeight = (e == 0) ? 0 : rowHeight - e;
-
-  scrollHeight = document.getAnonymousNodes(listbox)[1].lastChild.scrollHeight;
-  is(scrollHeight, rowHeight * 15 + extraHeight, id + ": scrollHeight when minimium height set");
-
-  listbox.removeAttribute("minheight");
-  scrollHeight = document.getAnonymousNodes(listbox)[1].lastChild.scrollHeight;
-  is(scrollHeight, rowHeight * 15 + extraHeight, id + ": scrollHeight");
-}
-
 window.onload = function runTests() {
   testRichlistbox();
-  testListbox();
   SimpleTest.finish();
 };
   ]]></script>
 </window>
--- a/toolkit/content/tests/chrome/test_menulist.xul
+++ b/toolkit/content/tests/chrome/test_menulist.xul
@@ -13,32 +13,32 @@
 <vbox id="scroller" style="overflow: auto" height="60">
   <menulist id="menulist" onpopupshown="test_menulist_open(this, this.parentNode)"
             onpopuphidden="$('menulist-in-listbox').open = true;">
     <menupopup id="menulist-popup"/>
   </menulist>
   <button label="Two"/>
   <button label="Three"/>
 </vbox>
-<listbox id="scroller-in-listbox" style="overflow: auto" height="60">
-  <listitem allowevents="true">
+<richlistbox id="scroller-in-listbox" style="overflow: auto" height="60">
+  <richlistitem allowevents="true">
     <menulist id="menulist-in-listbox" onpopupshown="test_menulist_open(this, this.parentNode.parentNode)"
               onpopuphidden="SimpleTest.executeSoon(checkScrollAndFinish)">
       <menupopup id="menulist-in-listbox-popup">
         <menuitem label="One" value="one"/>
         <menuitem label="Two" value="two"/>
       </menupopup>
     </menulist>
-  </listitem>
-  <listitem label="Two"/>
-  <listitem label="Three"/>
-  <listitem label="Four"/>
-  <listitem label="Five"/>
-  <listitem label="Six"/>
-</listbox>
+  </richlistitem>
+  <richlistitem><label value="Two"/></richlistitem>
+  <richlistitem><label value="Three"/></richlistitem>
+  <richlistitem><label value="Four"/></richlistitem>
+  <richlistitem><label value="Five"/></richlistitem>
+  <richlistitem><label value="Six"/></richlistitem>
+</richlistbox>
 
 <hbox>
   <menulist id="menulist-size">
     <menupopup>
       <menuitem label="Menuitem Label" width="200"/>
     </menupopup>
   </menulist>
 </hbox>
--- a/toolkit/content/tests/chrome/test_mousescroll.xul
+++ b/toolkit/content/tests/chrome/test_mousescroll.xul
@@ -26,28 +26,16 @@ https://bugzilla.mozilla.org/show_bug.cg
     <richlistitem id="richlistbox_item3"><label value="Item 3"/></richlistitem>
     <richlistitem id="richlistbox_item4"><label value="Item 4"/></richlistitem>
     <richlistitem id="richlistbox_item5"><label value="Item 5"/></richlistitem>
     <richlistitem id="richlistbox_item6"><label value="Item 6"/></richlistitem>
     <richlistitem id="richlistbox_item7"><label value="Item 7"/></richlistitem>
     <richlistitem id="richlistbox_item8"><label value="Item 8"/></richlistitem>
   </richlistbox>
 
-  <listbox id="listbox" rows="2">
-    <listitem id="listbox_item0" label="Item 0" hidden="true"/>
-    <listitem id="listbox_item1" label="Item 1"/>
-    <listitem id="listbox_item2" label="Item 2"/>
-    <listitem id="listbox_item3" label="Item 3"/>
-    <listitem id="listbox_item4" label="Item 4"/>
-    <listitem id="listbox_item5" label="Item 5"/>
-    <listitem id="listbox_item6" label="Item 6"/>
-    <listitem id="listbox_item7" label="Item 7"/>
-    <listitem id="listbox_item8" label="Item 8"/>
-  </listbox>
-
   <box orient="horizontal">
     <arrowscrollbox id="hscrollbox" clicktoscroll="true" orient="horizontal"
      smoothscroll="false" style="max-width:80px;" flex="1">
       <hbox style="width:40px; height:20px; background:black;" hidden="true"/>
       <hbox style="width:40px; height:20px; background:white;"/>
       <hbox style="width:40px; height:20px; background:black;"/>
       <hbox style="width:40px; height:20px; background:white;"/>
       <hbox style="width:40px; height:20px; background:black;"/>
@@ -105,60 +93,16 @@ function sendWheelAndWait(aScrollTaget, 
   sendWheelAndPaint(aScrollTaget, aX, aY, aEvent, ()=>{
     // sendWheelAndPaint may wait not enough for <scrollbox>.
     // Let's check the position before using is() for avoiding random orange.
     // So, this test may detect regressions with timeout.
     continueTestsIfScrolledAsExpected(aChecker);
   });
 }
 
-function* testListbox(id)
-{
-  var listbox = document.getElementById(id);
-
-  function* helper(aStart, aDelta, aIntDelta, aDeltaMode)
-  {
-    listbox.scrollToIndex(aStart);
-    var expectedPos = aStart;
-    if (aIntDelta) {
-      if (aDeltaMode == WheelEvent.DOM_DELTA_PAGE) {
-        expectedPos += aIntDelta > 0 ? listbox.getNumberOfVisibleRows() :
-                                       -listbox.getNumberOfVisibleRows();
-      } else {
-        expectedPos += aIntDelta;
-      }
-    }
-    yield sendWheelAndWait(listbox, 10, 10,
-                           { deltaMode: aDeltaMode, deltaY: aDelta,
-                             lineOrPageDeltaY: aIntDelta },
-                           ()=>{ return listbox.getIndexOfFirstVisibleRow() == expectedPos; });
-    is(listbox.getIndexOfFirstVisibleRow(), expectedPos,
-       "testListbox(" + id +  "): vertical, starting " + aStart +
-         " delta " + aDelta + " lineOrPageDelta " + aIntDelta +
-         " aDeltaMode " + aDeltaMode);
-
-    // Check that horizontal scrolling has no effect
-    listbox.scrollToIndex(aStart);
-    yield sendWheelAndWait(listbox, 10, 10,
-                           { deltaMode: aDeltaMode, deltaX: aDelta,
-                             lineOrPageDeltaX: aIntDelta }, ()=>{ return true; });
-    is(listbox.getIndexOfFirstVisibleRow(), aStart,
-       "testListbox(" + id +  "): horizontal, starting " + aStart +
-         " delta " + aDelta + " lineOrPageDelta " + aIntDelta +
-         " aDeltaMode " + aDeltaMode);
-  }
-  for (let i = 0; i < deltaModes.length; i++) {
-    let delta = (deltaModes[i] == WheelEvent.DOM_DELTA_PIXEL) ? 5.0 : 0.3;
-    yield* helper(5, -delta,  0, deltaModes[i]);
-    yield* helper(5, -delta, -1, deltaModes[i]);
-    yield* helper(5,  delta,  1, deltaModes[i]);
-    yield* helper(5,  delta,  0, deltaModes[i]);
-  }
-}
-
 function* testRichListbox(id)
 {
   var listbox = document.getElementById(id);
 
   function* helper(aStart, aDelta, aIntDelta, aDeltaMode) {
     listbox.scrollToIndex(aStart);
 
     let event = {
@@ -355,15 +299,14 @@ async function prepareRunningTests()
                                             false]]});
 
   runTests();
 }
 
 function* testBody()
 {
   yield* testRichListbox("richlistbox");
-  yield* testListbox("listbox");
   yield* testArrowScrollbox("hscrollbox");
   yield* testArrowScrollbox("vscrollbox");
 }
 
   ]]></script>
 </window>
--- a/toolkit/content/tests/chrome/test_tabindex.xul
+++ b/toolkit/content/tests/chrome/test_tabindex.xul
@@ -34,19 +34,19 @@
   <checkbox id="t3" style="-moz-user-focus: ignore;" label="Four" tabindex="1"/>
 </hbox>
 <hbox>
   <textbox id="t10" idmod="t5" style="-moz-user-focus: ignore;" size="3"/>
   <textbox id="no5" style="-moz-user-focus: ignore;" size="3" tabindex="-1"/>
   <textbox id="t11" idmod="t6" style="-moz-user-focus: ignore;" size="3" tabindex="0"/>
   <textbox id="t4" idmod="t2" style="-moz-user-focus: ignore;" size="3" tabindex="1"/>
 </hbox>
-<listbox id="t12" idmod="t7">
-  <listitem label="Item One"/>
-</listbox>
+<richlistbox id="t12" idmod="t7">
+  <richlistitem><label value="Item One"/></richlistitem>
+</richlistbox>
 
 <hbox>
   <!-- the tabindex attribute does not apply to non-controls, so it
        should be treated as -1 for non-focusable dropmarkers, and 0
        for focusable dropmarkers. Thus, the first four dropmarkers
        are not in the tab order, and the last four dropmarkers should
        be in the tab order just after the listbox above.
     -->
--- a/toolkit/content/widgets/listbox.xml
+++ b/toolkit/content/widgets/listbox.xml
@@ -630,303 +630,18 @@
             break;
           }
         }
       ]]>
       </handler>
     </handlers>
   </binding>
 
-
-  <!-- Binding for xul:listbox element.
-  -->
-  <binding id="listbox"
-           extends="#listbox-base">
-
-    <resources>
-      <stylesheet src="chrome://global/skin/listbox.css"/>
-    </resources>
-
-    <content>
-      <children includes="listcols">
-        <xul:listcols>
-          <xul:listcol flex="1"/>
-        </xul:listcols>
-      </children>
-      <xul:listrows>
-        <children includes="listhead"/>
-        <xul:listboxbody xbl:inherits="rows,size,minheight">
-          <children includes="listitem"/>
-        </xul:listboxbody>
-      </xul:listrows>
-    </content>
-
-    <implementation>
-
-      <!-- ///////////////// public listbox members ///////////////// -->
-
-      <property name="listBoxObject"
-                onget="return this.boxObject;"
-                readonly="true"/>
-
-      <!-- ///////////////// private listbox members ///////////////// -->
-
-      <field name="_touchY">-1</field>
-
-      <method name="_fireOnSelect">
-        <body>
-        <![CDATA[
-          if (!this._suppressOnSelect && !this.suppressOnSelect) {
-            var event = document.createEvent("Events");
-            event.initEvent("select", true, true);
-            this.dispatchEvent(event);
-          }
-        ]]>
-        </body>
-      </method>
-
-      <constructor>
-      <![CDATA[
-        var count = this.itemCount;
-        for (var index = 0; index < count; index++) {
-          var item = this.getItemAtIndex(index);
-          if (item.getAttribute("selected") == "true")
-            this.selectedItems.append(item);
-        }
-      ]]>
-      </constructor>
-
-      <!-- ///////////////// nsIDOMXULSelectControlElement ///////////////// -->
-
-      <method name="appendItem">
-        <parameter name="aLabel"/>
-        <parameter name="aValue"/>
-        <body>
-          const XULNS =
-            "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
-
-          var item = this.ownerDocument.createElementNS(XULNS, "listitem");
-          item.setAttribute("label", aLabel);
-          item.setAttribute("value", aValue);
-          this.appendChild(item);
-          return item;
-        </body>
-      </method>
-
-      <property name="itemCount" readonly="true"
-                onget="return this.listBoxObject.getRowCount()"/>
-
-      <!-- ///////////////// nsIListBoxObject ///////////////// -->
-      <method name="getIndexOfItem">
-        <parameter name="item"/>
-        <body>
-          <![CDATA[
-            if (this._selecting && this._selecting.item == item)
-              return this._selecting.index;
-            return this.listBoxObject.getIndexOfItem(item);
-          ]]>
-        </body>
-      </method>
-      <method name="getItemAtIndex">
-        <parameter name="index"/>
-        <body>
-          <![CDATA[
-            if (this._selecting && this._selecting.index == index)
-              return this._selecting.item;
-            return this.listBoxObject.getItemAtIndex(index);
-          ]]>
-        </body>
-      </method>
-      <method name="ensureIndexIsVisible">
-        <parameter name="index"/>
-        <body>
-          return this.listBoxObject.ensureIndexIsVisible(index);
-        </body>
-      </method>
-      <method name="ensureElementIsVisible">
-        <parameter name="element"/>
-        <body>
-          return this.ensureIndexIsVisible(this.listBoxObject.getIndexOfItem(element));
-        </body>
-      </method>
-      <method name="scrollToIndex">
-        <parameter name="index"/>
-        <body>
-          return this.listBoxObject.scrollToIndex(index);
-        </body>
-      </method>
-      <method name="getNumberOfVisibleRows">
-        <body>
-          return this.listBoxObject.getNumberOfVisibleRows();
-        </body>
-      </method>
-      <method name="getIndexOfFirstVisibleRow">
-        <body>
-          return this.listBoxObject.getIndexOfFirstVisibleRow();
-        </body>
-      </method>
-      <method name="getRowCount">
-        <body>
-          return this.listBoxObject.getRowCount();
-        </body>
-      </method>
-
-      <method name="scrollOnePage">
-        <parameter name="direction"/>  <!-- Must be -1 or 1 -->
-        <body>
-          <![CDATA[
-            var pageOffset = this.getNumberOfVisibleRows() * direction;
-            // skip over invisible elements - the user won't care about them
-            for (var i = 0; i != pageOffset; i += direction) {
-              var item = this.getItemAtIndex(this.currentIndex + i);
-              if (item && !this._canUserSelect(item))
-                pageOffset += direction;
-            }
-            var newTop = this.getIndexOfFirstVisibleRow() + pageOffset;
-            if (direction == 1) {
-              var maxTop = this.getRowCount() - this.getNumberOfVisibleRows();
-              for (i = this.getRowCount(); i >= 0 && i > maxTop; i--) {
-                item = this.getItemAtIndex(i);
-                if (item && !this._canUserSelect(item))
-                  maxTop--;
-              }
-              if (newTop >= maxTop)
-                newTop = maxTop;
-            }
-            if (newTop < 0)
-              newTop = 0;
-            this.scrollToIndex(newTop);
-            return pageOffset;
-          ]]>
-        </body>
-      </method>
-    </implementation>
-
-    <handlers>
-      <handler event="keypress" key=" " phase="target">
-        <![CDATA[
-          if (this.currentItem) {
-            if (this.currentItem.getAttribute("type") != "checkbox") {
-              this.addItemToSelection(this.currentItem);
-              // Prevent page from scrolling on the space key.
-              event.preventDefault();
-            } else if (!this.currentItem.disabled) {
-              this.currentItem.checked = !this.currentItem.checked;
-              this.currentItem.doCommand();
-              // Prevent page from scrolling on the space key.
-              event.preventDefault();
-            }
-          }
-        ]]>
-      </handler>
-
-      <handler event="MozSwipeGesture">
-        <![CDATA[
-          // Figure out which index to show
-          let targetIndex = 0;
-
-          // Only handle swipe gestures up and down
-          switch (event.direction) {
-            case event.DIRECTION_DOWN:
-              targetIndex = this.itemCount - 1;
-              // Fall through for actual action
-            case event.DIRECTION_UP:
-              this.ensureIndexIsVisible(targetIndex);
-              break;
-          }
-        ]]>
-      </handler>
-
-      <handler event="touchstart">
-        <![CDATA[
-          if (event.touches.length > 1) {
-            // Multiple touch points detected, abort. In particular this aborts
-            // the panning gesture when the user puts a second finger down after
-            // already panning with one finger. Aborting at this point prevents
-            // the pan gesture from being resumed until all fingers are lifted
-            // (as opposed to when the user is back down to one finger).
-            this._touchY = -1;
-          } else {
-            this._touchY = event.touches[0].screenY;
-          }
-        ]]>
-      </handler>
-      <handler event="touchmove">
-        <![CDATA[
-          if (event.touches.length == 1 &&
-              this._touchY >= 0) {
-            let deltaY = this._touchY - event.touches[0].screenY;
-            let lines = Math.trunc(deltaY / this.listBoxObject.getRowHeight());
-            if (Math.abs(lines) > 0) {
-              this.listBoxObject.scrollByLines(lines);
-              deltaY -= lines * this.listBoxObject.getRowHeight();
-              this._touchY = event.touches[0].screenY + deltaY;
-            }
-            event.preventDefault();
-          }
-        ]]>
-      </handler>
-      <handler event="touchend">
-        <![CDATA[
-          this._touchY = -1;
-        ]]>
-      </handler>
-
-    </handlers>
-  </binding>
-
-  <binding id="listrows">
-
-    <resources>
-      <stylesheet src="chrome://global/skin/listbox.css"/>
-    </resources>
-
-    <handlers>
-      <handler event="DOMMouseScroll" phase="capturing">
-      <![CDATA[
-        if (event.axis == event.HORIZONTAL_AXIS)
-          return;
-
-        var listBox = this.parentNode.listBoxObject;
-        var rows = event.detail;
-        if (rows == UIEvent.SCROLL_PAGE_UP)
-          rows = -listBox.getNumberOfVisibleRows();
-        else if (rows == UIEvent.SCROLL_PAGE_DOWN)
-          rows = listBox.getNumberOfVisibleRows();
-
-        listBox.scrollByLines(rows);
-        event.preventDefault();
-      ]]>
-      </handler>
-
-      <handler event="MozMousePixelScroll" phase="capturing">
-      <![CDATA[
-        if (event.axis == event.HORIZONTAL_AXIS)
-          return;
-
-        // shouldn't be scrolled by pixel scrolling events before a line/page
-        // scrolling event.
-        event.preventDefault();
-      ]]>
-      </handler>
-    </handlers>
-  </binding>
-
   <binding id="listitem"
            extends="chrome://global/content/bindings/general.xml#basetext">
-    <resources>
-      <stylesheet src="chrome://global/skin/listbox.css"/>
-    </resources>
-
-    <content>
-      <children>
-        <xul:listcell xbl:inherits="label,crop,disabled,flexlabel"/>
-      </children>
-    </content>
-
     <implementation implements="nsIDOMXULSelectControlItemElement">
       <property name="current" onget="return this.getAttribute('current') == 'true';">
         <setter><![CDATA[
           if (val)
             this.setAttribute("current", "true");
           else
             this.removeAttribute("current");
 
@@ -1024,83 +739,9 @@
           // doesn't de- and reselect this item if it is selected
           control.selectItemRange(this, this);
         }
         control._userSelecting = false;
       ]]>
       </handler>
     </handlers>
   </binding>
-
-  <binding id="listitem-checkbox"
-           extends="chrome://global/content/bindings/listbox.xml#listitem">
-    <content>
-      <children>
-        <xul:listcell type="checkbox" xbl:inherits="label,crop,checked,disabled,flexlabel"/>
-      </children>
-    </content>
-
-    <implementation>
-      <property name="checked"
-                onget="return this.getAttribute('checked') == 'true';">
-        <setter><![CDATA[
-          if (val)
-            this.setAttribute("checked", "true");
-          else
-            this.removeAttribute("checked");
-          var event = document.createEvent("Events");
-          event.initEvent("CheckboxStateChange", true, true);
-          this.dispatchEvent(event);
-          return val;
-        ]]></setter>
-      </property>
-    </implementation>
-
-    <handlers>
-      <handler event="mousedown" button="0">
-      <![CDATA[
-        if (!this.disabled && !this.control.disabled) {
-          this.checked = !this.checked;
-          this.doCommand();
-        }
-      ]]>
-      </handler>
-    </handlers>
-  </binding>
-
-  <binding id="listcell"
-           extends="chrome://global/content/bindings/general.xml#basecontrol">
-
-    <resources>
-      <stylesheet src="chrome://global/skin/listbox.css"/>
-    </resources>
-
-    <content>
-      <children>
-        <xul:label class="listcell-label" xbl:inherits="value=label,flex=flexlabel,crop,disabled" flex="1" crop="right"/>
-      </children>
-    </content>
-  </binding>
-
-  <binding id="listcell-checkbox"
-           extends="chrome://global/content/bindings/listbox.xml#listcell">
-    <content>
-      <children>
-        <xul:image class="listcell-check" xbl:inherits="checked,disabled"/>
-        <xul:label class="listcell-label" xbl:inherits="value=label,flex=flexlabel,crop,disabled" flex="1" crop="right"/>
-      </children>
-    </content>
-  </binding>
-
-  <binding id="listhead">
-
-    <resources>
-      <stylesheet src="chrome://global/skin/listbox.css"/>
-    </resources>
-
-    <content>
-      <xul:listheaditem>
-        <children includes="listheader"/>
-      </xul:listheaditem>
-    </content>
-  </binding>
-
 </bindings>
--- a/toolkit/content/widgets/richlistbox.xml
+++ b/toolkit/content/widgets/richlistbox.xml
@@ -500,20 +500,16 @@
           }
         ]]>
       </handler>
     </handlers>
   </binding>
 
   <binding id="richlistitem"
            extends="chrome://global/content/bindings/listbox.xml#listitem">
-    <content>
-      <children/>
-    </content>
-
     <implementation>
       <field name="selectedByMouseOver">false</field>
 
       <destructor>
         <![CDATA[
           var control = this.control;
           if (!control)
             return;
--- a/toolkit/content/xul.css
+++ b/toolkit/content/xul.css
@@ -473,98 +473,16 @@ column {
 rows {
   -moz-box-orient: vertical;
 }
 
 column {
   -moz-box-orient: vertical;
 }
 
-/******** listbox **********/
-
-listbox {
-  -moz-binding: url("chrome://global/content/bindings/listbox.xml#listbox");
-}
-
-listhead {
-  -moz-binding: url("chrome://global/content/bindings/listbox.xml#listhead");
-}
-
-listrows {
-  -moz-binding: url("chrome://global/content/bindings/listbox.xml#listrows");
-}
-
-listitem {
-  -moz-binding: url("chrome://global/content/bindings/listbox.xml#listitem");
-}
-
-listitem[type="checkbox"] {
-  -moz-binding: url("chrome://global/content/bindings/listbox.xml#listitem-checkbox");
-}
-
-listcell {
-  -moz-binding: url("chrome://global/content/bindings/listbox.xml#listcell");
-}
-
-listcell[type="checkbox"] {
-  -moz-binding: url("chrome://global/content/bindings/listbox.xml#listcell-checkbox");
-}
-
-listbox {
-  display: -moz-grid;
-}
-
-listbox[rows] {
-  height: auto;
-}
-
-listcols, listhead, listrows, listboxbody {
-  display: -moz-grid-group;
-}
-
-listcol, listitem, listheaditem {
-  display: -moz-grid-line;
-}
-
-listbox {
-  -moz-user-focus: normal;
-  -moz-box-orient: vertical;
-  min-width: 0px;
-  min-height: 0px;
-  width: 200px;
-  height: 200px;
-}
-
-listhead {
-  -moz-box-orient: vertical;
-}
-
-listrows {
-  -moz-box-orient: vertical;
-  -moz-box-flex: 1;
-}
-
-listboxbody {
-  -moz-box-orient: vertical;
-  -moz-box-flex: 1;
-  /* Don't permit a horizontal scrollbar. See bug 285449 */
-  overflow-x: hidden !important;
-  overflow-y: auto;
-  min-height: 0px;
-}
-
-listcol {
-  -moz-box-orient: vertical;
-  min-width: 16px;
-}
-
-listcell {
-  -moz-box-align: center;
-}
-
 /******** tree ******/
 
 tree {
   -moz-binding: url("chrome://global/content/bindings/tree.xml#tree");
 }
 
 treecols {
   -moz-binding: url("chrome://global/content/bindings/tree.xml#treecols");
--- a/toolkit/themes/linux/global/jar.mn
+++ b/toolkit/themes/linux/global/jar.mn
@@ -9,17 +9,16 @@ toolkit.jar:
    skin/classic/global/button.css
    skin/classic/global/checkbox.css
    skin/classic/global/colorpicker.css
    skin/classic/global/commonDialog.css
    skin/classic/global/dropmarker.css
 *  skin/classic/global/findBar.css
 *  skin/classic/global/global.css
    skin/classic/global/groupbox.css
-   skin/classic/global/listbox.css
    skin/classic/global/menu.css
    skin/classic/global/menulist.css
    skin/classic/global/netError.css
 *  skin/classic/global/notification.css
 *  skin/classic/global/numberbox.css
    skin/classic/global/popup.css
    skin/classic/global/radio.css
    skin/classic/global/richlistbox.css
deleted file mode 100644
--- a/toolkit/themes/linux/global/listbox.css
+++ /dev/null
@@ -1,68 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/* ===== listbox.css =======================================================
-  == Styles used by XUL listbox-related elements.
-  ======================================================================= */
-
-@namespace url("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul");
-
-/* ::::: listbox ::::: */
-
-listbox {
-  -moz-appearance: listbox;
-  margin: 2px 4px;
-  background-color: -moz-Field;
-  color: -moz-FieldText;
-}
-
-listbox[disabled="true"] {
-  color: GrayText;
-}
-
-/* ::::: listitem ::::: */
-
-listbox:focus > listitem[selected="true"][current="true"] {
-  outline: 1px dotted #F3D982;
-}
-
-listbox:focus > listitem[current="true"] {
-  outline: 1px dotted Highlight;
-  outline-offset: -1px;
-}
-
-listitem[selected="true"] {
-  background-color: -moz-cellhighlight;
-  color: -moz-cellhighlighttext;
-}
-
-listbox:focus > listitem[selected="true"] {
-  background-color: Highlight;
-  color: HighlightText;
-}
-
-/* ::::: listcell ::::: */
-
-.listcell-label {
-  margin: 0 !important;
-  padding-top: 0;
-  padding-bottom: 1px;
-  padding-inline-start: 4px;
-  padding-inline-end: 0;
-  white-space: nowrap;
-}
-
-.listcell-label[disabled="true"] {
-  color: GrayText;
-}
-
-/* ::::: listcell checkbox ::::: */
-
-.listcell-check {
-  -moz-appearance: checkbox;
-  -moz-box-align: center;
-  margin: 0 2px;
-  min-width: 13px;
-  min-height: 13px;
-}
--- a/toolkit/themes/mobile/jar.mn
+++ b/toolkit/themes/mobile/jar.mn
@@ -7,17 +7,16 @@ toolkit.jar:
 # These are the CSS files that must exist
    skin/classic/global/autocomplete.css                    (global/empty.css)
    skin/classic/global/button.css                          (global/empty.css)
    skin/classic/global/checkbox.css                        (global/empty.css)
    skin/classic/global/dialog.css                          (global/empty.css)
    skin/classic/global/dropmarker.css                      (global/empty.css)
    skin/classic/global/global.css                          (global/empty.css)
    skin/classic/global/groupbox.css                        (global/empty.css)
-   skin/classic/global/listbox.css                         (global/empty.css)
    skin/classic/global/menu.css                            (global/empty.css)
    skin/classic/global/menulist.css                        (global/empty.css)
    skin/classic/global/numberbox.css                       (global/empty.css)
    skin/classic/global/popup.css                           (global/empty.css)
    skin/classic/global/progressmeter.css                   (global/empty.css)
    skin/classic/global/radio.css                           (global/empty.css)
    skin/classic/global/richlistbox.css                     (global/empty.css)
    skin/classic/global/scrollbox.css                       (global/empty.css)
deleted file mode 100644
index bd43dd17c3bd07b1787baca148442ec777797d8c..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391
GIT binary patch
literal 0
Hc$@<O00001
--- a/toolkit/themes/osx/global/jar.mn
+++ b/toolkit/themes/osx/global/jar.mn
@@ -10,17 +10,16 @@ toolkit.jar:
   skin/classic/global/checkbox.css
   skin/classic/global/colorpicker.css
   skin/classic/global/commonDialog.css
   skin/classic/global/dialog.css
   skin/classic/global/dropmarker.css
 * skin/classic/global/findBar.css
 * skin/classic/global/global.css
   skin/classic/global/groupbox.css
-  skin/classic/global/listbox.css
   skin/classic/global/menu.css
   skin/classic/global/menulist.css
 * skin/classic/global/notification.css
   skin/classic/global/netError.css
 * skin/classic/global/numberbox.css
   skin/classic/global/popup.css
   skin/classic/global/progressmeter.css
   skin/classic/global/radio.css
@@ -47,17 +46,16 @@ toolkit.jar:
   skin/classic/global/arrow/arrow-rit-dis.gif                        (arrow/arrow-rit-dis.gif)
   skin/classic/global/arrow/arrow-rit-sharp.gif                      (arrow/arrow-rit-sharp.gif)
   skin/classic/global/arrow/arrow-up-dis.gif                         (arrow/arrow-up-dis.gif)
   skin/classic/global/arrow/arrow-up-sharp.gif                       (arrow/arrow-up-sharp.gif)
   skin/classic/global/arrow/arrow-up.gif                             (arrow/arrow-up.gif)
   skin/classic/global/arrow/panelarrow-horizontal.svg                (arrow/panelarrow-horizontal.svg)
   skin/classic/global/arrow/panelarrow-vertical.svg                  (arrow/panelarrow-vertical.svg)
   skin/classic/global/checkbox/cbox-check.gif                        (checkbox/cbox-check.gif)
-  skin/classic/global/checkbox/cbox-check-dis.gif                    (checkbox/cbox-check-dis.gif)
   skin/classic/global/dirListing/dirListing.css                      (dirListing/dirListing.css)
   skin/classic/global/dirListing/folder.png                          (dirListing/folder.png)
   skin/classic/global/dirListing/up.png                              (dirListing/up.png)
   skin/classic/global/icons/blacklist_favicon.png                    (icons/blacklist_favicon.png)
   skin/classic/global/icons/blacklist_64.png                         (icons/blacklist_64.png)
   skin/classic/global/icons/glyph-dropdown.png                       (icons/glyph-dropdown.png)
   skin/classic/global/icons/glyph-dropdown@2x.png                    (icons/glyph-dropdown@2x.png)
   skin/classic/global/icons/panel-dropmarker.png                     (icons/panel-dropmarker.png)
deleted file mode 100644
--- a/toolkit/themes/osx/global/listbox.css
+++ /dev/null
@@ -1,72 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-@namespace url("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul");
-
-listbox {
-  -moz-appearance: listbox;
-  margin: 2px 4px;
-  background-color: #FFFFFF;
-  color: -moz-FieldText;
-}
-
-.listcell-label {
-  margin: 0px !important;
-  padding-bottom: 1px;
-  padding-inline-start: 4px;
-  white-space: nowrap;
-}
-
-/* ::::: listitem ::::: */
-
-listitem {
-  border: 1px solid transparent;
-}
-
-listitem[selected="true"] {
-  background-color: -moz-mac-secondaryhighlight;
-  color: -moz-DialogText;
-}
-
-listbox:focus > listitem[selected="true"] {
-   background-color: Highlight;
-   color: HighlightText;
-}
-
-/* ::::: listcell ::::: */
-
-.listcell-label {
-  margin: 0px !important;
-  padding-bottom: 1px;
-  padding-inline-start: 4px;
-  white-space: nowrap;
-}
-
-.listcell-label[disabled="true"] {
-  color: GrayText;
-}
-
-/* ::::: listcell checkbox ::::: */
-
-.listcell-check {
-  -moz-appearance: checkbox;
-  -moz-box-align: center;
-  margin: 0px 2px;
-  border: 1px solid -moz-DialogText;
-  min-width: 13px;
-  min-height: 13px;
-  background: -moz-Field no-repeat 50% 50%;
-}
-
-.listcell-check[checked="true"] {
-  background-image: url("chrome://global/skin/checkbox/cbox-check.gif");
-}
-
-.listcell-check[disabled="true"] {
-  border-color: GrayText;
-}
-
-.listcell-check[disabled="true"][checked="true"] {
-  background-image: url("chrome://global/skin/checkbox/cbox-check-dis.gif");
-}
--- a/toolkit/themes/shared/extensions/extensions.inc.css
+++ b/toolkit/themes/shared/extensions/extensions.inc.css
@@ -1029,15 +1029,14 @@ button.button-link:not([disabled="true"]
 
 #detail-findUpdates-btn[hidden] {
   display: -moz-box;
   visibility: hidden;
 }
 
 /*** Reset PopupAutoComplete richlistbox styles ***/
 
-#PopupAutoComplete richlistbox,
-#PopupAutoComplete listbox {
+#PopupAutoComplete richlistbox {
   -moz-appearance: initial;
   margin-inline-start: 0;
   border: none;
   border-radius: 0;
 }
--- a/toolkit/themes/shared/in-content/info-pages.inc.css
+++ b/toolkit/themes/shared/in-content/info-pages.inc.css
@@ -12,16 +12,17 @@
 /* Body and container */
 body {
   display: flex;
   flex-direction: column;
   box-sizing: border-box;
   min-height: 100vh;
   padding: 40px 48px;
   align-items: center;
+  justify-content: center;
 }
 
 body.wide-container {
   display: block;
 }
 
 .container {
   min-width: var(--in-content-container-min-width);
--- a/toolkit/themes/windows/global/jar.mn
+++ b/toolkit/themes/windows/global/jar.mn
@@ -15,17 +15,16 @@ toolkit.jar:
 * skin/classic/global/popup.css
   skin/classic/global/radio.css
   skin/classic/global/tabbox.css
   skin/classic/global/textbox.css
   skin/classic/global/colorpicker.css
   skin/classic/global/commonDialog.css
 * skin/classic/global/findBar.css
 * skin/classic/global/global.css
-  skin/classic/global/listbox.css
   skin/classic/global/netError.css
 * skin/classic/global/numberbox.css
 * skin/classic/global/notification.css
   skin/classic/global/printPageSetup.css
   skin/classic/global/richlistbox.css
   skin/classic/global/scrollbox.css
   skin/classic/global/splitter.css
   skin/classic/global/toolbar.css
deleted file mode 100644
--- a/toolkit/themes/windows/global/listbox.css
+++ /dev/null
@@ -1,167 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/* ===== listbox.css =======================================================
-  == Styles used by XUL listbox-related elements.
-  ======================================================================= */
-
-
-@namespace url("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul");
-
-/* ::::: listbox ::::: */
-
-listbox {
-  -moz-appearance: listbox;
-  margin: 2px 4px;
-  color: -moz-FieldText;
-}
-
-listbox[disabled="true"] {
-  color: GrayText;
-}
-
-/* ::::: listitem ::::: */
-
-listitem {
-  border: 1px solid transparent;
-}
-
-listbox:focus > listitem[selected="true"][current="true"] {
-  outline: 1px dotted #F3D982;
-}
-
-listbox:focus > listitem[current="true"] {
-  outline: 1px dotted Highlight;
-  outline-offset: -1px;
-}
-
-listitem[selected="true"] {
-  background-color: -moz-cellhighlight;
-  color: -moz-cellhighlighttext;
-}
-
-listbox:focus > listitem[selected="true"] {
-  background-color: Highlight;
-  color: HighlightText;
-}
-
-/* ::::: listcell ::::: */
-
-.listcell-label {
-  margin: 0px !important;
-  padding-top: 0px;
-  padding-bottom: 1px;
-  padding-inline-start: 4px;
-  padding-inline-end: 0px;
-  white-space: nowrap;
-}
-
-.listcell-label[disabled="true"] {
-  color: GrayText;
-}
-
-/* ::::: listcell checkbox ::::: */
-
-.listcell-check {
-  -moz-appearance: checkbox;
-  -moz-box-align: center;
-  margin: 0px 2px;
-  border: 1px solid -moz-DialogText;
-  min-width: 13px;
-  min-height: 13px;
-  background: -moz-Field no-repeat 50% 50%;
-}
-
-@media (-moz-windows-default-theme) {
-  listitem {
-    --listitem-selectedColor: rgb(217,217,217);
-    --listitem-selectedBorder: var(--listitem-selectedColor);
-    --listitem-selectedBottomBorder: rgb(204,204,204);
-    --listitem-selectedBackground: var(--listitem-selectedColor);
-    --listitem-selectedImage: none;
-    --listitem-selectedCurrentBorder: rgb(123,195,255);
-    --listitem-selectedFocusColor: rgb(205,232,255);
-    --listitem-selectedFocusBorder: var(--listitem-selectedFocusColor);
-    --listitem-selectedFocusBottomBorder: rgb(165,214,255);
-    --listitem-selectedFocusBackground: var(--listitem-selectedFocusColor);
-    --listitem-selectedFocusImage: none;
-    --listitem-selectedFocusCurrentBorder: var(--listitem-selectedFocusColor);
-    --listitem-selectedFocusCurrentBottomBorder: var(--listitem-selectedFocusBottomBorder);
-    --listitem-selectedFocusCurrentBackground: var(--listitem-selectedFocusColor);
-
-    color: -moz-FieldText;
-    margin-inline-start: 1px;
-    margin-inline-end: 1px;
-    padding-top: 1px;
-    padding-bottom: 1px;
-    border-width: 1px;
-    background-repeat: no-repeat;
-    background-size: 100% 100%;
-  }
-
-  listitem[selected="true"] {
-    border-top-color: var(--listitem-selectedBorder);
-    border-right-color: var(--listitem-selectedBorder);
-    border-left-color: var(--listitem-selectedBorder);
-    border-bottom-color: var(--listitem-selectedBottomBorder);
-    background-image: var(--listitem-selectedImage);
-    background-color: var(--listitem-selectedBackground);
-    color: -moz-DialogText;
-  }
-
-  listbox:focus > listitem[selected="true"] {
-    border-top-color: var(--listitem-selectedFocusBorder);
-    border-right-color: var(--listitem-selectedFocusBorder);
-    border-left-color: var(--listitem-selectedFocusBorder);
-    border-bottom-color: var(--listitem-selectedFocusBottomBorder);
-    background-image: var(--listitem-selectedFocusImage);
-    background-color: var(--listitem-selectedFocusBackground);
-    color: -moz-DialogText;
-  }
-
-  listbox:focus > listitem[current="true"] {
-    border-color: var(--listitem-selectedCurrentBorder);
-    outline: none;
-  }
-
-  listbox:focus > listitem[selected="true"][current="true"] {
-    border-top-color: var(--listitem-selectedFocusCurrentBorder);
-    border-right-color: var(--listitem-selectedFocusCurrentBorder);
-    border-left-color: var(--listitem-selectedFocusCurrentBorder);
-    border-bottom-color: var(--listitem-selectedFocusCurrentBottomBorder);
-    background-color: var(--listitem-selectedFocusCurrentBackground);
-    outline: none;
-  }
-
-  @media (-moz-os-version: windows-win7) {
-    listitem {
-      --listitem-selectedBottomBorder: var(--listitem-selectedColor);
-      --listitem-selectedBackground: rgba(190,190,190,.15);
-      --listitem-selectedImage: linear-gradient(rgba(190,190,190,.1), rgba(190,190,190,.4));
-      --listitem-selectedCurrentBorder: rgb(125,162,206);
-      --listitem-selectedFocusColor: rgb(132,172,221);
-      --listitem-selectedFocusBottomBorder: var(--listitem-selectedFocusColor);
-      --listitem-selectedFocusBackground: rgba(131,183,249,.02);
-      --listitem-selectedFocusImage: linear-gradient(rgba(131,183,249,.16), rgba(131,183,249,.375));
-      --listitem-selectedFocusCurrentBackground: rgba(131,183,249,.15);
-
-      border-radius: 3px;
-      box-shadow: inset 0 0 0 1px rgba(255,255,255,.4), inset 0 -1px 0 1px rgba(255,255,255,.2);
-    }
-  }
-
-  @media (-moz-os-version: windows-win8) {
-    listitem {
-      --listitem-selectedBottomBorder: var(--listitem-selectedColor);
-      --listitem-selectedBackground: rgba(190,190,190,.15);
-      --listitem-selectedImage: linear-gradient(rgba(190,190,190,.4), rgba(190,190,190,.4));
-      --listitem-selectedCurrentBorder: rgb(125,162,206);
-      --listitem-selectedFocusColor: rgb(132,172,221);
-      --listitem-selectedFocusBottomBorder: var(--listitem-selectedFocusColor);
-      --listitem-selectedFocusBackground: rgba(131,183,249,.02);
-      --listitem-selectedFocusImage: linear-gradient(rgba(131,183,249,.375), rgba(131,183,249,.375));
-      --listitem-selectedFocusCurrentBackground: rgba(131,183,249,.15);
-    }
-  }
-}
--- a/xpcom/ds/nsGkAtomList.h
+++ b/xpcom/ds/nsGkAtomList.h
@@ -545,22 +545,17 @@ GK_ATOM(legend, "legend")
 GK_ATOM(length, "length")
 GK_ATOM(letterValue, "letter-value")
 GK_ATOM(level, "level")
 GK_ATOM(li, "li")
 GK_ATOM(line, "line")
 GK_ATOM(link, "link")
 //GK_ATOM(list, "list")  # "list" is present below
 GK_ATOM(listbox, "listbox")
-GK_ATOM(listboxbody, "listboxbody")
-GK_ATOM(listcell, "listcell")
-GK_ATOM(listcol, "listcol")
-GK_ATOM(listcols, "listcols")
 GK_ATOM(listener, "listener")
-GK_ATOM(listhead, "listhead")
 GK_ATOM(listheader, "listheader")
 GK_ATOM(listing, "listing")
 GK_ATOM(listitem, "listitem")
 GK_ATOM(load, "load")
 GK_ATOM(triggeringprincipal, "triggeringprincipal")
 GK_ATOM(localedir, "localedir")
 GK_ATOM(localName, "local-name")
 GK_ATOM(longdesc, "longdesc")