--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -176,17 +176,17 @@ pref("general.autoScroll", true);
 
 // Whether or not the application should check at startup each time if it 
 // is the default browser.
 pref("browser.shell.checkDefaultBrowser", true);
 
 // 0 = blank, 1 = home (browser.startup.homepage), 2 = last visited page, 3 = resume previous browser session
 // The behavior of option 3 is detailed at: http://wiki.mozilla.org/Session_Restore
 pref("browser.startup.page",                1);
-pref("browser.startup.homepage",            "resource:/browserconfig.properties");
+pref("browser.startup.homepage",            "chrome://branding/locale/browserconfig.properties");
 
 pref("browser.enable_automatic_image_resizing", true);
 pref("browser.chrome.site_icons", true);
 pref("browser.chrome.favicons", true);
 pref("browser.warnOnQuit", true);
 pref("browser.warnOnRestart", true);
 pref("browser.fullscreen.autohide", true);
 pref("browser.fullscreen.animateUp", 1);

--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -4259,17 +4259,17 @@ var XULBrowserWindow = {
   },
 
   // simulate all change notifications after switching tabs
   onUpdateCurrentBrowser: function (aStateFlags, aStatus, aMessage, aTotalProgress) {
     if (FullZoom.updateBackgroundTabs)
       FullZoom.onLocationChange(gBrowser.currentURI, true);
     var nsIWebProgressListener = Components.interfaces.nsIWebProgressListener;
     var loadingDone = aStateFlags & nsIWebProgressListener.STATE_STOP;
-    // use a pseudo-object instead of a (potentially non-existing) channel for getting
+    // use a pseudo-object instead of a (potentially nonexistent) channel for getting
     // a correct error message - and make sure that the UI is always either in
     // loading (STATE_START) or done (STATE_STOP) mode
     this.onStateChange(
       gBrowser.webProgress,
       { URI: gBrowser.currentURI },
       loadingDone ? nsIWebProgressListener.STATE_STOP : nsIWebProgressListener.STATE_START,
       aStatus
     );
@@ -4770,17 +4770,17 @@ var gHomeButton = {
       url = gPrefService.getComplexValue(this.prefDomain,
                                 Components.interfaces.nsIPrefLocalizedString).data;
     } catch (e) {
     }
 
     // use this if we can't find the pref
     if (!url) {
       var SBS = Cc["@mozilla.org/intl/stringbundle;1"].getService(Ci.nsIStringBundleService);
-      var configBundle = SBS.createBundle("resource:/browserconfig.properties");
+      var configBundle = SBS.createBundle("chrome://branding/locale/browserconfig.properties");
       url = configBundle.GetStringFromName(this.prefDomain);
     }
 
     return url;
   },
 
   updatePersonalToolbarStyle: function (homeButton)
   {

--- a/browser/base/content/pageinfo/pageInfo.js
+++ b/browser/base/content/pageinfo/pageInfo.js
@@ -163,23 +163,29 @@ const COL_IMAGE_BG      = 6;
 const COPYCOL_NONE = -1;
 const COPYCOL_META_CONTENT = 1;
 const COPYCOL_IMAGE = COL_IMAGE_ADDRESS;
 
 // one nsITreeView for each tree in the window
 var gMetaView = new pageInfoTreeView(COPYCOL_META_CONTENT);
 var gImageView = new pageInfoTreeView(COPYCOL_IMAGE);
 
+
+var atomSvc = Components.classes["@mozilla.org/atom-service;1"]
+                        .getService(Components.interfaces.nsIAtomService);
+gImageView._ltrAtom = atomSvc.getAtom("ltr");
+gImageView._brokenAtom = atomSvc.getAtom("broken");
+
 gImageView.getCellProperties = function(row, col, props) {
-  var aserv = Components.classes[ATOM_CONTRACTID]
-                        .getService(Components.interfaces.nsIAtomService);
-
   if (gImageView.data[row][COL_IMAGE_SIZE] == gStrings.unknown &&
       !/^https:/.test(gImageView.data[row][COL_IMAGE_ADDRESS]))
-    props.AppendElement(aserv.getAtom("broken"));
+    props.AppendElement(this._brokenAtom);
+
+  if (col.element.id == "image-address")
+    props.AppendElement(this._ltrAtom);
 };
 
 var gImageHash = { };
 
 // localized strings (will be filled in when the document is loaded)
 // this isn't all of them, these are just the ones that would otherwise have been loaded inside a loop
 var gStrings = { };
 var gBundle;

--- a/browser/branding/nightly/locales/Makefile.in
+++ b/browser/branding/nightly/locales/Makefile.in
@@ -40,16 +40,8 @@ srcdir         = @srcdir@
 VPATH          = @srcdir@
 relativesrcdir = browser/branding/nightly/locales
 
 include $(DEPTH)/config/autoconf.mk
 
 DEFINES += -DAB_CD=$(AB_CD) -DMOZ_DISTRIBUTION_ID_UNQUOTED=$(MOZ_DISTRIBUTION_ID)
 
 include $(topsrcdir)/config/rules.mk
-
-libs::
-	@$(PYTHON) $(topsrcdir)/config/Preprocessor.py $(DEFINES) $(ACDEFINES) \
-	  $(srcdir)/browserconfig.properties > $(FINAL_TARGET)/browserconfig.properties
-
-install::
-	@$(PYTHON) $(topsrcdir)/config/Preprocessor.py $(DEFINES) $(ACDEFINES) \
-	  $(srcdir)/browserconfig.properties > $(DESTDIR)$(mozappdir)/browserconfig.properties

--- a/browser/branding/nightly/locales/jar.mn
+++ b/browser/branding/nightly/locales/jar.mn
@@ -1,7 +1,8 @@
 #filter substitution
 
 @AB_CD@.jar:
 % locale branding @AB_CD@ %locale/branding/
 # Nightly branding only exists in en-US
   locale/branding/brand.dtd        (en-US/brand.dtd)
 * locale/branding/brand.properties (en-US/brand.properties)
+* locale/branding/browserconfig.properties (browserconfig.properties)

--- a/browser/branding/unofficial/locales/Makefile.in
+++ b/browser/branding/unofficial/locales/Makefile.in
@@ -40,16 +40,8 @@ srcdir         = @srcdir@
 VPATH          = @srcdir@
 relativesrcdir = browser/branding/unofficial/locales
 
 include $(DEPTH)/config/autoconf.mk
 
 DEFINES += -DAB_CD=$(AB_CD) -DMOZ_DISTRIBUTION_ID_UNQUOTED=$(MOZ_DISTRIBUTION_ID)
 
 include $(topsrcdir)/config/rules.mk
-
-libs::
-	@$(PYTHON) $(topsrcdir)/config/Preprocessor.py $(DEFINES) $(ACDEFINES) \
-	  $(srcdir)/browserconfig.properties > $(FINAL_TARGET)/browserconfig.properties
-
-install::
-	@$(PYTHON) $(topsrcdir)/config/Preprocessor.py $(DEFINES) $(ACDEFINES) \
-	  $(srcdir)/browserconfig.properties > $(DESTDIR)$(mozappdir)/browserconfig.properties

--- a/browser/branding/unofficial/locales/jar.mn
+++ b/browser/branding/unofficial/locales/jar.mn
@@ -1,7 +1,8 @@
 #filter substitution
 
 @AB_CD@.jar:
 % locale branding @AB_CD@ %locale/branding/
 # Unofficial branding only exists in en-US
   locale/branding/brand.dtd        (en-US/brand.dtd)
 * locale/branding/brand.properties (en-US/brand.properties)
+* locale/branding/browserconfig.properties (browserconfig.properties)

--- a/browser/components/places/tests/unit/test_bookmarksRestoreNotification.js
+++ b/browser/components/places/tests/unit/test_bookmarksRestoreNotification.js
@@ -104,17 +104,17 @@ var tests = [
       }
       catch (e) {
         do_throw("  Restore should not have failed");
       }
     }
   },
 
   {
-    desc:       "JSON restore: nonexisting file should fail",
+    desc:       "JSON restore: nonexistent file should fail",
     currTopic:  NSIOBSERVER_TOPIC_BEGIN,
     finalTopic: NSIOBSERVER_TOPIC_FAILED,
     data:       NSIOBSERVER_DATA_JSON,
     folderId:   null,
     run:        function () {
       this.file = Services.dirsvc.get("ProfD", Ci.nsILocalFile);
       this.file.append("this file doesn't exist because nobody created it");
       try {
@@ -158,17 +158,17 @@ var tests = [
       }
       catch (e) {
         do_throw("  Restore should not have failed");
       }
     }
   },
 
   {
-    desc:       "HTML restore: nonexisting file should fail",
+    desc:       "HTML restore: nonexistent file should fail",
     currTopic:  NSIOBSERVER_TOPIC_BEGIN,
     finalTopic: NSIOBSERVER_TOPIC_FAILED,
     data:       NSIOBSERVER_DATA_HTML,
     folderId:   null,
     run:        function () {
       this.file = Services.dirsvc.get("ProfD", Ci.nsILocalFile);
       this.file.append("this file doesn't exist because nobody created it");
       try {
@@ -212,17 +212,17 @@ var tests = [
       }
       catch (e) {
         do_throw("  Restore should not have failed");
       }
     }
   },
 
   {
-    desc:       "HTML initial restore: nonexisting file should fail",
+    desc:       "HTML initial restore: nonexistent file should fail",
     currTopic:  NSIOBSERVER_TOPIC_BEGIN,
     finalTopic: NSIOBSERVER_TOPIC_FAILED,
     data:       NSIOBSERVER_DATA_HTML_INIT,
     folderId:   null,
     run:        function () {
       this.file = Services.dirsvc.get("ProfD", Ci.nsILocalFile);
       this.file.append("this file doesn't exist because nobody created it");
       try {
@@ -274,17 +274,17 @@ var tests = [
       }
       catch (e) {
         do_throw("  Restore should not have failed");
       }
     }
   },
 
   {
-    desc:       "HTML restore into folder: nonexisting file should fail",
+    desc:       "HTML restore into folder: nonexistent file should fail",
     currTopic:  NSIOBSERVER_TOPIC_BEGIN,
     finalTopic: NSIOBSERVER_TOPIC_FAILED,
     data:       NSIOBSERVER_DATA_HTML,
     run:        function () {
       this.file = Services.dirsvc.get("ProfD", Ci.nsILocalFile);
       this.file.append("this file doesn't exist because nobody created it");
       this.folderId = bmsvc.createFolder(bmsvc.unfiledBookmarksFolder,
                                          "test folder",

--- a/browser/fuel/test/browser_ApplicationPrefs.js
+++ b/browser/fuel/test/browser_ApplicationPrefs.js
@@ -3,21 +3,21 @@ var testdata = {
   missing: "fuel.fuel-test-missing",
   dummy: "fuel.fuel-test",
   string: "browser.active_color",
   integer: "permissions.default.image",
   boolean: "browser.blink_allowed"
 };
 
 function test() {
-  // test getting non-existing values
+  // test getting nonexistent values
   var itemValue = Application.prefs.getValue(testdata.missing, "default");
-  is(itemValue, "default", "Check 'Application.prefs.getValue' for non-existing item");
+  is(itemValue, "default", "Check 'Application.prefs.getValue' for nonexistent item");
 
-  is(Application.prefs.get(testdata.missing), null, "Check 'Application.prefs.get' for non-existing item");
+  is(Application.prefs.get(testdata.missing), null, "Check 'Application.prefs.get' for nonexistent item");
 
   // test setting and getting a value
   Application.prefs.setValue(testdata.dummy, "dummy");
   itemValue = Application.prefs.getValue(testdata.dummy, "default");
   is(itemValue, "dummy", "Check 'Application.prefs.getValue' for existing item");
 
   // test for overwriting an existing value
   Application.prefs.setValue(testdata.dummy, "smarty");

--- a/browser/fuel/test/browser_ApplicationStorage.js
+++ b/browser/fuel/test/browser_ApplicationStorage.js
@@ -1,19 +1,19 @@
 function test() {
   // test for existence of values
   var hasItem = Application.storage.has("fuel-test-missing");
-  is(hasItem, false, "Check 'Application.storage.has' for non-existing item");
+  is(hasItem, false, "Check 'Application.storage.has' for nonexistent item");
   Application.storage.set("fuel-test", "dummy");
   hasItem = Application.storage.has("fuel-test");
   is(hasItem, true, "Check 'Application.storage.has' for existing item");
 
-  // test getting non-existing and existing values
+  // test getting nonexistent and existing values
   var itemValue = Application.storage.get("fuel-test-missing", "default");
-  is(itemValue, "default", "Check 'Application.storage.get' for non-existing item");
+  is(itemValue, "default", "Check 'Application.storage.get' for nonexistent item");
   itemValue = Application.storage.get("fuel-test", "default");
   is(itemValue, "dummy", "Check 'Application.storage.get' for existing item");
 
   // test for overwriting an existing value
   Application.storage.set("fuel-test", "smarty");
   itemValue = Application.storage.get("fuel-test", "default");
   is(itemValue, "smarty", "Check 'Application.storage.get' for overwritten item");
 

--- a/browser/installer/package-manifest.in
+++ b/browser/installer/package-manifest.in
@@ -17,17 +17,16 @@
 @APPNAME@/Contents/Plug-Ins/
 @APPNAME@/Contents/Resources/
 #endif
 
 [@AB_CD@]
 @BINPATH@/chrome/@AB_CD@.jar
 @BINPATH@/chrome/@AB_CD@.manifest
 @BINPATH@/@PREF_DIR@/firefox-l10n.js
-@BINPATH@/browserconfig.properties
 @BINPATH@/searchplugins/*
 @BINPATH@/defaults/profile/bookmarks.html
 @BINPATH@/defaults/profile/localstore.rdf
 @BINPATH@/defaults/profile/mimeTypes.rdf
 @BINPATH@/defaults/profile/chrome/*
 @BINPATH@/update.locale
 @BINPATH@/updater.ini
 @BINPATH@/dictionaries/*

--- a/browser/installer/removed-files.in
+++ b/browser/installer/removed-files.in
@@ -5,16 +5,17 @@
 # Inspector files are at the very end.
 .autoreg
 @DLL_PREFIX@jsj@DLL_SUFFIX@
 @DLL_PREFIX@sqlite3@DLL_SUFFIX@
 @DLL_PREFIX@xpcom_compat@DLL_SUFFIX@
 @DLL_PREFIX@xpistub@DLL_SUFFIX@
 @DLL_PREFIX@zlib@DLL_SUFFIX@
 LICENSE
+browserconfig.properties
 chrome.manifest
 chrome/US.jar
 chrome/app-chrome.manifest
 chrome/chrome.rdf
 chrome/chromelist.txt
 chrome/classic.jar
 chrome/classic.manifest
 chrome/comm.jar

--- a/browser/themes/winstripe/browser/browser-aero.css
+++ b/browser/themes/winstripe/browser/browser-aero.css
@@ -1,13 +1,12 @@
 %define WINSTRIPE_AERO
 %include browser.css
 %undef WINSTRIPE_AERO
 
-%if 0
 @media all and (-moz-windows-compositor) {
   #main-window:not(:-moz-lwtheme) {
     -moz-appearance: -moz-win-glass;
     background: transparent;
   }
 
   #navigator-toolbox:not(:-moz-lwtheme),
   #navigator-toolbox > toolbar {
@@ -68,17 +67,16 @@
     -moz-appearance: -moz-win-glass;
     -moz-border-radius: 0;
     border: none;
     font: normal 1.2em "Segoe UI";
     color: black;
     text-shadow: white -1px -1px .5em, white -1px 1px .5em, white 1px 1px .5em, white 1px -1px .5em;
   }
 }
-%endif
 
 @media not all and (-moz-windows-compositor) {
   #print-preview-toolbar:not(:-moz-lwtheme) {
     -moz-appearance: -moz-win-browsertabbar-toolbox;
   }
 }
 
 @media all and (-moz-windows-default-theme) {

--- a/config/autoconf.mk.in
+++ b/config/autoconf.mk.in
@@ -108,17 +108,16 @@ MOZ_LEAKY	= @MOZ_LEAKY@
 MOZ_MEMORY      = @MOZ_MEMORY@
 MOZ_JPROF       = @MOZ_JPROF@
 MOZ_SHARK       = @MOZ_SHARK@
 MOZ_CALLGRIND   = @MOZ_CALLGRIND@
 MOZ_VTUNE       = @MOZ_VTUNE@
 MOZ_TRACEVIS    = @MOZ_TRACEVIS@
 DEHYDRA_PATH    = @DEHYDRA_PATH@
 
-MOZ_XPCTOOLS    = @MOZ_XPCTOOLS@
 NS_TRACE_MALLOC = @NS_TRACE_MALLOC@
 USE_ELF_DYNSTR_GC = @USE_ELF_DYNSTR_GC@
 INCREMENTAL_LINKER = @INCREMENTAL_LINKER@
 MACOSX_DEPLOYMENT_TARGET = @MACOSX_DEPLOYMENT_TARGET@
 MOZ_MAIL_NEWS	= @MOZ_MAIL_NEWS@
 MOZ_PLAINTEXT_EDITOR_ONLY = @MOZ_PLAINTEXT_EDITOR_ONLY@
 BUILD_STATIC_LIBS = @BUILD_STATIC_LIBS@
 MOZ_ENABLE_LIBXUL = @MOZ_ENABLE_LIBXUL@

--- a/config/outofdate.pl
+++ b/config/outofdate.pl
@@ -36,17 +36,17 @@
 #
 # ***** END LICENSE BLOCK *****
 
 #
 #Input: [-d dir] foo1.java foo2.java
 #Compares with: foo1.class foo2.class (if -d specified, checks in 'dir', 
 #  otherwise assumes .class files in same directory as .java files)
 #Returns: list of input arguments which are newer than corresponding class
-#files (non-existent class files are considered to be real old :-)
+#files (nonexistent class files are considered to be real old :-)
 #
 
 $found = 1;
 
 # GLOBALS
 $SEP = 0; # the paltform independent path separator
 $CFG = 0; # the value of the -cfg flag
 

--- a/config/rules.mk
+++ b/config/rules.mk
@@ -1513,17 +1513,17 @@ SPACE := $(EMPTY) $(EMPTY)
 # and class paths to be in the DOS form (i.e. e:/builds/...).  This function
 # does the appropriate conversion on Windows, but is a noop on other systems.
 ifeq (,$(filter-out WINNT WINCE, $(HOST_OS_ARCH)))
 ifdef CYGWIN_WRAPPER
 normalizepath = $(foreach p,$(1),$(shell cygpath -m $(p)))
 else
 # assume MSYS
 #  We use 'pwd -W' to get DOS form of the path.  However, since the given path
-#  could be a file or a non-existent path, we cannot call 'pwd -W' directly
+#  could be a file or a nonexistent path, we cannot call 'pwd -W' directly
 #  on the path.  Instead, we extract the root path (i.e. "c:/"), call 'pwd -W'
 #  on it, then merge with the rest of the path.
 root-path = $(shell echo $(1) | sed -e "s|\(/[^/]*\)/\?\(.*\)|\1|")
 non-root-path = $(shell echo $(1) | sed -e "s|\(/[^/]*\)/\?\(.*\)|\2|")
 normalizepath = $(foreach p,$(1),$(if $(filter /%,$(1)),$(patsubst %/,%,$(shell cd $(call root-path,$(1)) && pwd -W))/$(call non-root-path,$(1)),$(1)))
 endif
 else
 normalizepath = $(1)

--- a/config/system-headers
+++ b/config/system-headers
@@ -207,16 +207,17 @@ curl/types.h
 curses.h
 cxxabi.h
 DateTimeUtils.h
 dbus/dbus.h
 dbus/dbus-glib.h
 dbus/dbus-glib-lowlevel.h
 ddeml.h
 Debug.h
+deque
 dem.h
 descrip.h
 Devices.h
 Dialogs.h
 direct.h
 dirent.h
 DiskInit.h
 dlfcn.h
@@ -269,16 +270,17 @@ freetype/ftcache.h
 freetype/ftglyph.h
 freetype/ftsynth.h
 freetype/ftoutln.h
 freetype/ttnameid.h
 freetype/tttables.h
 freetype/t1tables.h
 fribidi/fribidi.h
 FSp_fopen.h
+fstream
 fstream.h
 ft2build.h
 fts.h
 gconf/gconf-client.h
 Gdiplus.h
 gdk/gdk.h
 gdk/gdkkeysyms.h
 gdk/gdkprivate.h
@@ -324,16 +326,17 @@ inttypes.h
 iodef.h
 io.h
 IOKit/IOKitLib.h
 IOKit/IOMessage.h
 IOKit/pwr_mgt/IOPMLib.h
 iomanip
 iostream
 iostream.h
+iterator
 jar.h
 JavaControl.h
 JavaEmbedding/JavaControl.h
 JavaVM/jni.h
 JManager.h
 JNIEnvTests.h
 jni.h
 #if MOZ_NATIVE_JPEG==1
@@ -602,16 +605,17 @@ Process.h
 proto/dos.h
 proto/exec.h
 psap.h
 Pt.h
 pthread.h
 pwd.h
 Python.h
 QDOffscreen.h
+queue
 Quickdraw.h
 QuickDraw.h
 QuickTimeComponents.h
 quipu/attr.h
 rasdlg.h
 raserror.h
 ras.h
 regex.h
@@ -636,16 +640,17 @@ seccomon.h
 sec.h
 secmod.h
 secmodt.h
 secrng.h
 security.h
 secutil.h
 semaphore.h
 servprov.h
+set
 setjmp.h
 SFNTLayoutTypes.h
 SFNTTypes.h
 share.h
 shellapi.h
 shlguid.h
 shlobj.h
 sigcontext.h
@@ -829,16 +834,17 @@ unixio.h
 unixlib.h
 unknwn.h
 UPrinting.h
 UQuickTime.h
 UReanimator.h
 URegions.h
 URegistrar.h
 UResourceMgr.h
+utility
 urlhist.h
 urlmon.h
 UScrap.h
 UScreenPort.h
 UTCUtils.h
 UTETextAction.h
 UTEViewTextAction.h
 UTextEdit.h

--- a/configure.in
+++ b/configure.in
@@ -6268,17 +6268,17 @@ if test `echo "$MOZ_EXTENSIONS" | grep -
     AC_MSG_WARN([spellcheck is no longer an extension.])
     MOZ_EXTENSIONS=`echo $MOZ_EXTENSIONS | sed -e 's|spellcheck||g'`
 fi
 
 dnl Remove dupes
 MOZ_EXTENSIONS=`${PERL} ${srcdir}/build/unix/uniq.pl ${MOZ_EXTENSIONS}`
 
 dnl Ensure every extension exists, to avoid mostly-inscrutable error messages
-dnl when trying to build a non-existent extension.
+dnl when trying to build a nonexistent extension.
 for extension in $MOZ_EXTENSIONS; do
     if test ! -d "${srcdir}/extensions/${extension}"; then
         AC_MSG_ERROR([Unrecognized extension provided to --enable-extensions: ${extension}.])
     fi
 done
 
 
 dnl ========================================================
@@ -6523,25 +6523,16 @@ dnl leaky
 dnl ========================================================
 MOZ_ARG_ENABLE_BOOL(leaky,
 [  --enable-leaky          Build leaky memory tool],
     MOZ_LEAKY=1,
     MOZ_LEAKY=)
 
 
 dnl ========================================================
-dnl xpctools
-dnl ========================================================
-MOZ_ARG_ENABLE_BOOL(xpctools,
-[  --enable-xpctools       Build JS profiling tool],
-    MOZ_XPCTOOLS=1,
-    MOZ_XPCTOOLS= )
-
-
-dnl ========================================================
 dnl build the tests by default
 dnl ========================================================
 MOZ_ARG_DISABLE_BOOL(tests,
 [  --disable-tests         Do not build test libraries & programs],
     ENABLE_TESTS=,
     ENABLE_TESTS=1 )
 
 dnl ========================================================
@@ -6929,17 +6920,29 @@ MOZ_ARG_ENABLE_STRING(debug,
         MOZ_DEBUG_FLAGS=`echo $enableval | sed -e 's|\\\ | |g'`
         _MOZ_DEBUG_FLAGS_SET=1
     fi
   else
     MOZ_DEBUG=
   fi ],
   MOZ_DEBUG=)
 
-MOZ_DEBUG_ENABLE_DEFS="-DDEBUG -D_DEBUG -DTRACING"
+MOZ_DEBUG_ENABLE_DEFS="-DDEBUG -D_DEBUG"
+ case "${target_os}" in
+    beos*)
+        MOZ_DEBUG_ENABLE_DEFS="$MOZ_DEBUG_ENABLE_DEFS -DDEBUG_${USER}"
+        ;;
+    msvc*|mks*|cygwin*|mingw*|os2*|wince*|winmo*)
+        MOZ_DEBUG_ENABLE_DEFS="$MOZ_DEBUG_ENABLE_DEFS -DDEBUG_`echo ${USERNAME} | sed -e 's| |_|g'`"
+        ;;
+    *) 
+        MOZ_DEBUG_ENABLE_DEFS="$MOZ_DEBUG_ENABLE_DEFS -DDEBUG_`$WHOAMI`"
+        ;;
+  esac
+MOZ_DEBUG_ENABLE_DEFS="$MOZ_DEBUG_ENABLE_DEFS -DTRACING"
 
 MOZ_DEBUG_DISABLE_DEFS="-DNDEBUG -DTRIMMED"
 
 if test -n "$MOZ_DEBUG"; then
     AC_MSG_CHECKING([for valid debug flags])
     _SAVE_CFLAGS=$CFLAGS
     CFLAGS="$CFLAGS $MOZ_DEBUG_FLAGS"
     AC_TRY_COMPILE([#include <stdio.h>], 
@@ -8471,17 +8474,16 @@ AC_SUBST(MOZ_IMG_ENCODERS)
 AC_SUBST(MOZ_JSDEBUGGER)
 AC_SUBST(MOZ_PLUGINS)
 AC_SUBST(MOZ_LOG_REFCNT)
 AC_SUBST(MOZ_LEAKY)
 AC_SUBST(MOZ_JPROF)
 AC_SUBST(MOZ_SHARK)
 AC_SUBST(MOZ_CALLGRIND)
 AC_SUBST(MOZ_VTUNE)
-AC_SUBST(MOZ_XPCTOOLS)
 AC_SUBST(MOZ_JSLOADER)
 AC_SUBST(MOZ_USE_NATIVE_UCONV)
 AC_SUBST(MOZ_QUANTIFY)
 AC_SUBST(LIBICONV)
 AC_SUBST(MOZ_PLACES)
 AC_SUBST(MOZ_PLACES_BOOKMARKS)
 AC_SUBST(MOZ_STORAGE)
 AC_SUBST(MOZ_TOOLKIT_SEARCH)

--- a/content/base/src/nsAttrValue.cpp
+++ b/content/base/src/nsAttrValue.cpp
@@ -1094,16 +1094,33 @@ nsAttrValue::ParseNonNegativeIntValue(co
     return PR_FALSE;
   }
 
   SetIntValueAndType(originalVal, eInteger, nsnull);
 
   return PR_TRUE;
 }
 
+PRBool
+nsAttrValue::ParsePositiveIntValue(const nsAString& aString)
+{
+  ResetIfSet();
+
+  PRInt32 ec;
+  PRBool strict;
+  PRInt32 originalVal = StringToInteger(aString, &strict, &ec);
+  if (NS_FAILED(ec) || originalVal <= 0) {
+    return PR_FALSE;
+  }
+
+  SetIntValueAndType(originalVal, eInteger, nsnull);
+
+  return PR_TRUE;
+}
+
 void
 nsAttrValue::SetColorValue(nscolor aColor, const nsAString& aString)
 {
   nsStringBuffer* buf = GetStringBuffer(aString);
   if (!buf) {
     return;
   }
 

--- a/content/base/src/nsAttrValue.h
+++ b/content/base/src/nsAttrValue.h
@@ -254,16 +254,31 @@ public:
    * http://dev.w3.org/html5/spec/infrastructure.html#rules-for-parsing-non-negative-integers
    *
    * @param  aString the string to parse
    * @return whether the value is valid
    */
   PRBool ParseNonNegativeIntValue(const nsAString& aString);
 
   /**
+   * Parse a string value into a positive integer.
+   * This method follows the rules for parsing non-negative integer from:
+   * http://dev.w3.org/html5/spec/infrastructure.html#rules-for-parsing-non-negative-integers
+   * In addition of these rules, the value has to be greater than zero.
+   *
+   * This is generally used for parsing content attributes which reflecting IDL
+   * attributes are limited to only non-negative numbers greater than zero, see:
+   * http://dev.w3.org/html5/spec/common-dom-interfaces.html#limited-to-only-non-negative-numbers-greater-than-zero
+   *
+   * @param aString       the string to parse
+   * @return              whether the value was valid
+   */
+  PRBool ParsePositiveIntValue(const nsAString& aString);
+
+  /**
    * Parse a string into a color.
    *
    * @param aString the string to parse
    * @param aDocument the document (to find out whether we're in quirks mode)
    * @return whether the value could be parsed
    */
   PRBool ParseColor(const nsAString& aString, nsIDocument* aDocument);
 

--- a/content/base/src/nsImageLoadingContent.cpp
+++ b/content/base/src/nsImageLoadingContent.cpp
@@ -427,17 +427,17 @@ nsImageLoadingContent::RemoveObserver(im
     // splice it out
     ImageObserver* oldObserver = observer->mNext;
     observer->mNext = oldObserver->mNext;
     oldObserver->mNext = nsnull;  // so we don't destroy them all
     delete oldObserver;
   }
 #ifdef DEBUG
   else {
-    NS_WARNING("Asked to remove non-existent observer");
+    NS_WARNING("Asked to remove nonexistent observer");
   }
 #endif
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsImageLoadingContent::GetRequest(PRInt32 aRequestType,
                                   imgIRequest** aRequest)

--- a/content/base/test/file_bug416317.xhtml
+++ b/content/base/test/file_bug416317.xhtml
@@ -660,17 +660,17 @@
       t( "Broken Selector", "()" );
       t( "Broken Selector", "<>" );
       t( "Broken Selector", "{}" );
 
       t( "ID Selector", "#body", ["body"], false );
       t( "ID Selector w/ Element", "body#body", ["body"], false );
       t( "ID Selector w/ Element", "ul#first", [] );
       t( "ID selector with existing ID descendant", "#firstp #simon1", ["simon1"] );
-      t( "ID selector with non-existent descendant", "#firstp #foobar", [] );
+      t( "ID selector with nonexistent descendant", "#firstp #foobar", [] );
 
       t( "ID selector using UTF8", "#台北Táiběi", ["台北Táiběi"] );
       t( "Multiple ID selectors using UTF8", "#台北Táiběi, #台北", ["台北Táiběi","台北"] );
       t( "Descendant ID selector using UTF8", "div #台北", ["台北"] );
       t( "Child ID selector using UTF8", "form > #台北", ["台北"] );
   
       t( "Escaped ID", "#foo\\:bar", ["foo:bar"] );
       t( "Escaped ID", "#test\\.foo\\[5\\]bar", ["test.foo[5]bar"] );
@@ -681,17 +681,17 @@
   
       t( "ID Selector, child ID present", "#form > #radio1", ["radio1"] ); // bug #267
       t( "ID Selector, not an ancestor ID", "#form #first", [] );
       t( "ID Selector, not a child ID", "#form > #option1a", [] );
       
       t( "All Children of ID", "#foo > *", ["sndp", "en", "sap"] );
       t( "All Children of ID with no children", "#firstUL > *", [] );
 
-      t( "ID selector with non-existent ancestor", "#asdfasdf #foobar", [] ); // bug #986
+      t( "ID selector with nonexistent ancestor", "#asdfasdf #foobar", [] ); // bug #986
 
       //t( "body div#form", [], "ID selector within the context of another element" );
 
       t( "Class Selector", ".blog", ["mark","simon"] );
       t( "Class Selector", ".blog.link", ["simon"] );
       t( "Class Selector w/ Element", "a.blog", ["mark","simon"] );
       t( "Parent Class Selector", "p .blog", ["mark","simon"] );
   

--- a/content/base/test/test_bug390219.html
+++ b/content/base/test/test_bug390219.html
@@ -16,17 +16,17 @@ https://bugzilla.mozilla.org/show_bug.cg
   
 </div>
 <pre id="test">
 <script class="testbody" type="text/javascript">
 /** Test for Bug 390219 **/
 
 SimpleTest.waitForExplicitFinish();
 xhr = new XMLHttpRequest();
-xhr.open("GET", "non-existing_url", true);
+xhr.open("GET", "nonexistent_url", true);
 xhr.send(null);
 xhr.abort();
 xhr.open("GET", ".", true);
 xhr.onreadystatechange = function() {
   if (xhr.readyState == 4) {
     is(xhr.status, 200, "wrong status");
     SimpleTest.finish();
   }

--- a/content/base/test/test_classList.html
+++ b/content/base/test/test_classList.html
@@ -64,17 +64,17 @@ function checkModification(e, funcName, 
     is(e.code, expectedException, "wrong exception thrown " + contextMsg);
   }
   e.removeEventListener("DOMAttrModified", onAttrModified, false);
   if (expectedRes !== null)
     is(res, expectedRes, "wrong return value from " + funcName +
        " " + contextMsg);
 
   var expectedAfter = after;
-  // XUL returns an empty string when getting a non-existing class attribute.
+  // XUL returns an empty string when getting a nonexistent class attribute.
   if (e.namespaceURI == XUL_NS && expectedAfter === null)
     expectedAfter = "";
 
   is(e.getAttribute("class"), expectedAfter, "wrong class after modification " +
      contextMsg);
   var expectedMutation = before != after;
   is(gMutationEvents.length, expectedMutation ? 1 : 0,
      "unexpected mutation event count " + contextMsg);

--- a/content/base/test/test_fileapi.html
+++ b/content/base/test/test_fileapi.html
@@ -249,27 +249,27 @@ r.abort();
 is(reuseAbortHasRun, false, "abort() is a no-op unless loading");
 r.readAsText(asciiFile);
 r.readAsText(asciiFile);
 is(reuseAbortHasRun, true, "abort should fire sync");
 r.onload = getLoadHandler(testASCIIData, testASCIIData.length, "reuse-as-abort reading");
 expectedTestCount++;
 
 
-// Test reading from non-existing files
+// Test reading from nonexistent files
 r = new FileReader();
 var didThrow = false;
 try {
   r.readAsDataURL(nonExistingFile);
 } catch(ex) {
   didThrow = true;
 }
 // Once this test passes, we shoud test that onerror gets called and
 // that the FileReader object is in the right state during that call.
-todo(!didThrow, "shouldn't throw when opening non-existing file, should fire error instead");
+todo(!didThrow, "shouldn't throw when opening nonexistent file, should fire error instead");
 
 
 function getLoadHandler(expectedResult, expectedLength, testName) {
   return function (event) {
     is(event.target.readyState, FileReader.DONE,
        "readyState in test " + testName);
     is(event.target.error, null,
        "no error in test " + testName);

--- a/content/canvas/src/WebGLContextGL.cpp
+++ b/content/canvas/src/WebGLContextGL.cpp
@@ -2153,23 +2153,22 @@ WebGLContext::DOMElementToImageSurface(n
 
                 *dst++ = r;
                 *dst++ = g;
                 *dst++ = b;
                 *dst++ = a;
             }
         }
     } else if (surf->Format() == gfxASurface::ImageFormatRGB24) {
-        PRUint8* src = surf->Data();
         PRUint8* dst = surf->Data();
 
         // this wants some SSE love
 
         for (int j = 0; j < height; j++) {
-            src = surf->Data() + j * surf->Stride();
+            PRUint8* src = surf->Data() + j * surf->Stride();
             // note that dst's stride is always tightly packed
             for (int i = 0; i < width; i++) {
 #ifdef IS_LITTLE_ENDIAN
                 PRUint8 b = *src++;
                 PRUint8 g = *src++;
                 PRUint8 r = *src++;
                 src++;
 #else

--- a/content/html/content/src/nsGenericHTMLElement.h
+++ b/content/html/content/src/nsGenericHTMLElement.h
@@ -1102,16 +1102,41 @@ NS_NewHTML##_elementName##Element(nsINod
   }                                                                       \
   NS_IMETHODIMP                                                           \
   _class::Set##_method(const nsAString& aValue)                           \
   {                                                                       \
     return SetAttrHelper(nsGkAtoms::_atom, aValue);                       \
   }
 
 /**
+ * A macro to implement the getter and setter for a given content
+ * property that needs to set a positive integer. The method uses
+ * the generic GetAttr and SetAttr methods. This macro is much like
+ * the NS_IMPL_NON_NEGATIVE_INT_ATTR macro except the exception is
+ * thrown also when the value is equal to 0.
+ */
+#define NS_IMPL_POSITIVE_INT_ATTR(_class, _method, _atom)                 \
+  NS_IMPL_POSITIVE_INT_ATTR_DEFAULT_VALUE(_class, _method, _atom, 1)
+
+#define NS_IMPL_POSITIVE_INT_ATTR_DEFAULT_VALUE(_class, _method, _atom, _default)  \
+  NS_IMETHODIMP                                                           \
+  _class::Get##_method(PRInt32* aValue)                                   \
+  {                                                                       \
+    return GetIntAttr(nsGkAtoms::_atom, _default, aValue);                \
+  }                                                                       \
+  NS_IMETHODIMP                                                           \
+  _class::Set##_method(PRInt32 aValue)                                    \
+  {                                                                       \
+    if (aValue <= 0) {                                                    \
+      return NS_ERROR_DOM_INDEX_SIZE_ERR;                                 \
+    }                                                                     \
+    return SetIntAttr(nsGkAtoms::_atom, aValue);                          \
+  }
+
+/**
  * QueryInterface() implementation helper macros
  */
 
 #define NS_HTML_CONTENT_INTERFACE_TABLE_AMBIGUOUS_BEGIN(_class, _base)        \
   NS_NODE_OFFSET_AND_INTERFACE_TABLE_BEGIN(_class)                            \
     NS_INTERFACE_TABLE_ENTRY_AMBIGUOUS(_class, nsIDOMNode, _base)             \
     NS_INTERFACE_TABLE_ENTRY_AMBIGUOUS(_class, nsIDOMElement, _base)          \
     NS_INTERFACE_TABLE_ENTRY_AMBIGUOUS(_class, nsIDOMHTMLElement, _base)

--- a/content/html/content/src/nsHTMLSelectElement.cpp
+++ b/content/html/content/src/nsHTMLSelectElement.cpp
@@ -1201,17 +1201,18 @@ nsHTMLSelectElement::SetValue(const nsAS
   return rv;
 }
 
 
 NS_IMPL_BOOL_ATTR(nsHTMLSelectElement, Autofocus, autofocus)
 NS_IMPL_BOOL_ATTR(nsHTMLSelectElement, Disabled, disabled)
 NS_IMPL_BOOL_ATTR(nsHTMLSelectElement, Multiple, multiple)
 NS_IMPL_STRING_ATTR(nsHTMLSelectElement, Name, name)
-NS_IMPL_INT_ATTR_DEFAULT_VALUE(nsHTMLSelectElement, Size, size, 0)
+NS_IMPL_POSITIVE_INT_ATTR_DEFAULT_VALUE(nsHTMLSelectElement, Size, size,
+                                        GetDefaultSize())
 NS_IMPL_INT_ATTR_DEFAULT_VALUE(nsHTMLSelectElement, TabIndex, tabindex, 0)
 
 NS_IMETHODIMP
 nsHTMLSelectElement::Blur()
 {
   return nsGenericHTMLElement::Blur();
 }
 
@@ -1363,17 +1364,17 @@ nsHTMLSelectElement::DoneAddingChildren(
 
 PRBool
 nsHTMLSelectElement::ParseAttribute(PRInt32 aNamespaceID,
                                     nsIAtom* aAttribute,
                                     const nsAString& aValue,
                                     nsAttrValue& aResult)
 {
   if (aAttribute == nsGkAtoms::size && kNameSpaceID_None == aNamespaceID) {
-    return aResult.ParseIntWithBounds(aValue, 0);
+    return aResult.ParsePositiveIntValue(aValue);
   }
   return nsGenericHTMLElement::ParseAttribute(aNamespaceID, aAttribute, aValue,
                                               aResult);
 }
 
 static void
 MapAttributesIntoRule(const nsMappedAttributes* aAttributes,
                       nsRuleData* aData)

--- a/content/html/content/src/nsHTMLSelectElement.h
+++ b/content/html/content/src/nsHTMLSelectElement.h
@@ -468,16 +468,24 @@ protected:
   void VerifyOptionsArray();
 #endif
 
   virtual PRBool AcceptAutofocus() const
   {
     return PR_TRUE;
   }
 
+  /**
+   * Helper method to get the default size.
+   */
+  PRInt32 GetDefaultSize() const
+  {
+    return HasAttr(kNameSpaceID_None, nsGkAtoms::multiple) ? 4 : 1;
+  }
+
   /** The options[] array */
   nsRefPtr<nsHTMLOptionCollection> mOptions;
   /** false if the parser is in the middle of adding children. */
   PRPackedBool    mIsDoneAddingChildren;
   /** true if our disabled state has changed from the default **/
   PRPackedBool    mDisabledChanged;
   /** true if child nodes are being added or removed.
    *  Used by nsSafeOptionListMutation.

--- a/content/html/content/test/Makefile.in
+++ b/content/html/content/test/Makefile.in
@@ -172,12 +172,13 @@ include $(topsrcdir)/config/rules.mk
 		test_bug546995-1.html \
 		test_bug546995-2.html \
 		test_bug546995-3.html \
 		test_bug546995-4.html \
 		test_bug546995-5.html \
 		file_bug546995.html \
 		test_bug377624.html \
 		test_bug562932.html \
+		test_bug551846.html \
 		$(NULL)
 
 libs:: $(_TEST_FILES)
 	$(INSTALL) $(foreach f,$^,"$f") $(DEPTH)/_tests/testing/mochitest/tests/$(relativesrcdir)

new file mode 100644
--- /dev/null
+++ b/content/html/content/test/test_bug551846.html
@@ -0,0 +1,159 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=551846
+-->
+<head>
+  <title>Test for Bug 551846</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=551846">Mozilla Bug 551846</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  <select id='s'>
+    <option>Tulip</option>
+    <option>Lily</option>
+    <option>Gagea</option>
+    <option>Snowflake</option>
+    <option>Ismene</option>
+  </select>
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 551846 **/
+
+function checkSizeReflection(element, defaultValue)
+{
+  is(element.size, defaultValue, "Default size should be " + defaultValue);
+
+  element.setAttribute('size', -15);
+  is(element.size, defaultValue,
+    "The reflecting IDL attribute should return the default value when content attribute value is invalid");
+  is(element.getAttribute('size'), -15,
+    "The content attribute should containt the previously set value");
+
+  element.setAttribute('size', 0);
+  is(element.size, defaultValue,
+    "The reflecting IDL attribute should return the default value when content attribute value is invalid");
+
+  element.setAttribute('size', 2147483647); /* PR_INT32_MAX */
+  is(element.size, 2147483647,
+    "PR_INT32_MAX should be considered as a valid value");
+  is(element.getAttribute('size'), 2147483647,
+    "The content attribute should containt the previously set value");
+
+  element.setAttribute('size', -2147483648); /* PR_INT32_MIN */
+  is(element.size, defaultValue,
+    "The reflecting IDL attribute should return the default value when content attribute value is invalid");
+  is(element.getAttribute('size'), -2147483648,
+    "The content attribute should containt the previously set value");
+
+  element.setAttribute('size', 'non-numerical-value');
+  is(element.size, defaultValue,
+    "The reflecting IDL attribute should return the default value when content attribute value is invalid");
+  is(element.getAttribute('size'), 'non-numerical-value',
+    "The content attribute should containt the previously set value");
+
+  element.setAttribute('size', 4294967294); /* PR_INT32_MAX * 2 */
+  is(element.size, defaultValue,
+    "Value greater than PR_INT32_MAX should be considered as invalid");
+  is(element.getAttribute('size'), 4294967294,
+    "The content attribute should containt the previously set value");
+
+  element.setAttribute('size', -4294967296); /* PR_INT32_MIN * 2 */
+  is(element.size, defaultValue,
+    "The reflecting IDL attribute should return the default value when content attribute value is invalid");
+  is(element.getAttribute('size'), -4294967296,
+    "The content attribute should containt the previously set value");
+
+  element.size = defaultValue + 1;
+  element.removeAttribute('size');
+  is(element.size, defaultValue,
+    "When the attribute is removed, the size should be the default size");
+
+  element.setAttribute('size', 'foobar');
+  is(element.size, defaultValue,
+    "The reflecting IDL attribute should return the default value when content attribute value is invalid");
+  element.removeAttribute('size');
+  is(element.size, defaultValue,
+    "When the attribute is removed, the size should be the default size");
+}
+
+function checkSetSizeException(element)
+{
+  var caught = false;
+
+  try {
+    element.size = 1;
+  } catch(e) {
+    caught = true;
+  }
+  ok(!caught, "Setting a valid size shouldn't throw an exception");
+
+  caught = false;
+  try {
+    element.size = 0;
+  } catch(e) {
+    caught = true;
+  }
+  ok(caught, "Setting an invalid size from the IDL should throw an exception");
+
+  caught = false;
+  try {
+    element.size = -1;
+  } catch(e) {
+    caught = true;
+  }
+  ok(caught, "Setting an invalid size from the IDL should throw an exception");
+
+  caught = false;
+  try {
+    element.setAttribute('size', -10);
+  } catch(e) {
+    caught = true;
+  }
+  ok(!caught, "Setting an invalid size in the content attribute shouldn't throw an exception");
+
+  // reverting to defalut
+  element.removeAttribute('size');
+}
+
+function checkSizeWhenChangeMultiple(element)
+{
+  s.setAttribute('size', -1)
+  is(s.size, 1, "Size IDL attribute should be 1");
+
+  s.multiple = true;
+  is(s.size, 4, "Size IDL attribute should be 4");
+
+  is(s.getAttribute('size'), -1, "Size content attribute should be -1");
+
+  s.setAttribute('size', -2);
+  is(s.size, 4, "Size IDL attribute should be 4");
+
+  s.multiple = false;
+  is(s.size, 1, "Size IDL attribute should be 1");
+
+  is(s.getAttribute('size'), -2, "Size content attribute should be -2");
+}
+
+var s = document.getElementById('s');
+
+checkSizeReflection(s, 1);
+checkSetSizeException(s);
+
+s.setAttribute('multiple', 'true');
+checkSizeReflection(s, 4);
+checkSetSizeException(s);
+s.removeAttribute('multiple');
+
+checkSizeWhenChangeMultiple(s);
+
+</script>
+</pre>
+</body>
+</html>

--- a/content/html/document/src/nsHTMLContentSink.cpp
+++ b/content/html/document/src/nsHTMLContentSink.cpp
@@ -1759,17 +1759,17 @@ HTMLContentSink::BeginContext(PRInt32 aP
 
   // Create new context
   SinkContext* sc = new SinkContext(this);
   if (!sc) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
   if (!mCurrentContext) {
-    NS_ERROR("Non-existing context");
+    NS_ERROR("Nonexistent context");
 
     return NS_ERROR_FAILURE;
   }
 
   // Flush everything in the current context so that we don't have
   // to worry about insertions resulting in inconsistent frame creation.
   mCurrentContext->FlushTags();
 
@@ -1799,17 +1799,17 @@ HTMLContentSink::BeginContext(PRInt32 aP
   mContextStack.AppendElement(mCurrentContext);
   mCurrentContext = sc;
   return NS_OK;
 }
 
 NS_IMETHODIMP
 HTMLContentSink::EndContext(PRInt32 aPosition)
 {
-  NS_PRECONDITION(mCurrentContext && aPosition > -1, "non-existing context");
+  NS_PRECONDITION(mCurrentContext && aPosition > -1, "nonexistent context");
 
   PRUint32 n = mContextStack.Length() - 1;
   SinkContext* sc = mContextStack.ElementAt(n);
 
   const SinkContext::Node &bottom = mCurrentContext->mStack[0];
   
   NS_ASSERTION(sc->mStack[aPosition].mType == bottom.mType,
                "ending a wrong context");

--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@@ -2149,17 +2149,17 @@ nsHTMLDocument::Close()
       FlushPendingNotifications(Flush_Layout);
     }
 
     // Remove the wyciwyg channel request from the document load group
     // that we added in OpenCommon().  If all other requests between
     // document.open() and document.close() have completed, then this
     // method should cause the firing of an onload event.
     NS_ASSERTION(mWyciwygChannel, "nsHTMLDocument::Close(): Trying to remove "
-                 "non-existent wyciwyg channel!");
+                 "nonexistent wyciwyg channel!");
     RemoveWyciwygChannel();
     NS_ASSERTION(!mWyciwygChannel, "nsHTMLDocument::Close(): "
                  "nsIWyciwygChannel could not be removed!");
   }
 
   return NS_OK;
 }
 

--- a/content/media/nsBuiltinDecoderReader.h
+++ b/content/media/nsBuiltinDecoderReader.h
@@ -51,30 +51,30 @@
 
 class nsBuiltinDecoderStateMachine;
 
 // Stores info relevant to presenting media samples.
 class nsVideoInfo {
 public:
   nsVideoInfo()
     : mFramerate(0.0),
-      mAspectRatio(1.0),
+      mPixelAspectRatio(1.0),
       mCallbackPeriod(1),
       mAudioRate(0),
       mAudioChannels(0),
       mFrame(0,0),
       mHasAudio(PR_FALSE),
       mHasVideo(PR_FALSE)
   {}
 
   // Frames per second.
   float mFramerate;
 
-  // Aspect ratio, as stored in the metadata.
-  float mAspectRatio;
+  // Pixel aspect ratio, as stored in the metadata.
+  float mPixelAspectRatio;
 
   // Length of a video frame in milliseconds, or the callback period if
   // there's no audio.
   PRUint32 mCallbackPeriod;
 
   // Samples per second.
   PRUint32 mAudioRate;
 

--- a/content/media/nsBuiltinDecoderStateMachine.cpp
+++ b/content/media/nsBuiltinDecoderStateMachine.cpp
@@ -1025,17 +1025,17 @@ void nsBuiltinDecoderStateMachine::Rende
 
   if (aData->mDuplicate) {
     return;
   }
 
   nsRefPtr<Image> image = aData->mImage;
   if (image) {
     const nsVideoInfo& info = mReader->GetInfo();
-    mDecoder->SetVideoData(gfxIntSize(info.mPicture.width, info.mPicture.height), info.mAspectRatio, image);
+    mDecoder->SetVideoData(gfxIntSize(info.mPicture.width, info.mPicture.height), info.mPixelAspectRatio, image);
   }
 }
 
 PRInt64
 nsBuiltinDecoderStateMachine::GetAudioClock()
 {
   NS_ASSERTION(IsCurrentThread(mDecoder->mStateMachineThread), "Should be on state machine thread.");
   if (!mAudioStream || !HasAudio())

--- a/content/media/nsMediaDecoder.cpp
+++ b/content/media/nsMediaDecoder.cpp
@@ -65,17 +65,17 @@
 
 nsMediaDecoder::nsMediaDecoder() :
   mElement(0),
   mRGBWidth(-1),
   mRGBHeight(-1),
   mProgressTime(),
   mDataTime(),
   mVideoUpdateLock(nsnull),
-  mAspectRatio(1.0),
+  mPixelAspectRatio(1.0),
   mSizeChanged(PR_FALSE),
   mShuttingDown(PR_FALSE)
 {
   MOZ_COUNT_CTOR(nsMediaDecoder);
 }
 
 nsMediaDecoder::~nsMediaDecoder()
 {
@@ -121,24 +121,24 @@ void nsMediaDecoder::Invalidate()
   nsIFrame* frame = mElement->GetPrimaryFrame();
 
   {
     nsAutoLock lock(mVideoUpdateLock);
     if (mSizeChanged) {
       nsIntSize scaledSize(mRGBWidth, mRGBHeight);
       // Apply the aspect ratio to produce the intrinsic size we report
       // to the element.
-      if (mAspectRatio > 1.0) {
+      if (mPixelAspectRatio > 1.0) {
         // Increase the intrinsic width
         scaledSize.width =
-          ConditionDimension(mAspectRatio*scaledSize.width, scaledSize.width);
+          ConditionDimension(mPixelAspectRatio*scaledSize.width, scaledSize.width);
       } else {
         // Increase the intrinsic height
         scaledSize.height =
-          ConditionDimension(scaledSize.height/mAspectRatio, scaledSize.height);
+          ConditionDimension(scaledSize.height/mPixelAspectRatio, scaledSize.height);
       }
       mElement->UpdateMediaSize(scaledSize);
 
       mSizeChanged = PR_FALSE;
       if (frame) {
         nsPresContext* presContext = frame->PresContext();
         nsIPresShell *presShell = presContext->PresShell();
         presShell->FrameNeedsReflow(frame,
@@ -208,24 +208,24 @@ nsresult nsMediaDecoder::StopProgress()
 
   nsresult rv = mProgressTimer->Cancel();
   mProgressTimer = nsnull;
 
   return rv;
 }
 
 void nsMediaDecoder::SetVideoData(const gfxIntSize& aSize,
-                                  float aAspectRatio,
+                                  float aPixelAspectRatio,
                                   Image* aImage)
 {
   nsAutoLock lock(mVideoUpdateLock);
 
   if (mRGBWidth != aSize.width || mRGBHeight != aSize.height ||
-      mAspectRatio != aAspectRatio) {
+      mPixelAspectRatio != aPixelAspectRatio) {
     mRGBWidth = aSize.width;
     mRGBHeight = aSize.height;
-    mAspectRatio = aAspectRatio;
+    mPixelAspectRatio = aPixelAspectRatio;
     mSizeChanged = PR_TRUE;
   }
   if (mImageContainer && aImage) {
     mImageContainer->SetCurrentImage(aImage);
   }
 }

--- a/content/media/nsMediaDecoder.h
+++ b/content/media/nsMediaDecoder.h
@@ -226,17 +226,17 @@ public:
   // Gets the image container for the media element. Will return null if
   // the element is not a video element. This can be called from any
   // thread; ImageContainers can be used from any thread.
   ImageContainer* GetImageContainer() { return mImageContainer; }
 
   // Set the video width, height, pixel aspect ratio, and current image.
   // Ownership of the image is transferred to the decoder.
   void SetVideoData(const gfxIntSize& aSize,
-                    float aAspectRatio,
+                    float aPixelAspectRatio,
                     Image* aImage);
 
 protected:
 
   // Start timer to update download progress information.
   nsresult StartProgress();
 
   // Stop progress information timer.
@@ -278,17 +278,17 @@ protected:
   // in the midst of being changed.
   PRLock* mVideoUpdateLock;
 
   // Framerate of video being displayed in the element
   // expressed in numbers of frames per second.
   float mFramerate;
 
   // Pixel aspect ratio (ratio of the pixel width to pixel height)
-  float mAspectRatio;
+  float mPixelAspectRatio;
 
   // Has our size changed since the last repaint?
   PRPackedBool mSizeChanged;
 
   // True if the decoder is being shutdown. At this point all events that
   // are currently queued need to return immediately to prevent javascript
   // being run that operates on the element and decoder during shutdown.
   // Read/Write from the main thread only.

--- a/content/media/ogg/nsOggCodecState.cpp
+++ b/content/media/ogg/nsOggCodecState.cpp
@@ -144,17 +144,17 @@ PRBool nsOggCodecState::PageInFromBuffer
 }
 
 nsTheoraState::nsTheoraState(ogg_page* aBosPage) :
   nsOggCodecState(aBosPage),
   mSetup(0),
   mCtx(0),
   mFrameDuration(0),
   mFrameRate(0),
-  mAspectRatio(0)
+  mPixelAspectRatio(0)
 {
   MOZ_COUNT_CTOR(nsTheoraState);
   th_info_init(&mInfo);
   th_comment_init(&mComment);
 }
 
 nsTheoraState::~nsTheoraState() {
   MOZ_COUNT_DTOR(nsTheoraState);
@@ -186,17 +186,17 @@ PRBool nsTheoraState::Init() {
   if (f > PR_UINT32_MAX) {
     return mActive = PR_FALSE;
   }
   mFrameDuration = static_cast<PRUint32>(f);
 
   n = mInfo.aspect_numerator;
 
   d = mInfo.aspect_denominator;
-  mAspectRatio = (n == 0 || d == 0) ?
+  mPixelAspectRatio = (n == 0 || d == 0) ?
     1.0f : static_cast<float>(n) / static_cast<float>(d);
 
   // Ensure the frame isn't larger than our prescribed maximum.
   PRUint32 pixels;
   if (!MulOverflow32(mInfo.pic_width, mInfo.pic_height, pixels) ||
       pixels > MAX_VIDEO_WIDTH * MAX_VIDEO_HEIGHT ||
       pixels == 0)
   {

--- a/content/media/ogg/nsOggCodecState.h
+++ b/content/media/ogg/nsOggCodecState.h
@@ -185,17 +185,17 @@ public:
   th_dec_ctx* mCtx;
 
   // Frame duration in ms.
   PRUint32 mFrameDuration;
 
   // Number of frames per second.
   float mFrameRate;
 
-  float mAspectRatio;
+  float mPixelAspectRatio;
 };
 
 class nsSkeletonState : public nsOggCodecState {
 public:
   nsSkeletonState(ogg_page* aBosPage);
   virtual ~nsSkeletonState();
   virtual CodecType GetType() { return TYPE_SKELETON; }
   virtual PRBool DecodeHeader(ogg_packet* aPacket);

--- a/content/media/ogg/nsOggReader.cpp
+++ b/content/media/ogg/nsOggReader.cpp
@@ -245,26 +245,24 @@ nsresult nsOggReader::ReadMetadata()
     if (s != mVorbisState && s != mTheoraState) {
       s->Deactivate();
     }
   }
 
   // Initialize the first Theora and Vorbis bitstreams. According to the
   // Theora spec these can be considered the 'primary' bitstreams for playback.
   // Extract the metadata needed from these streams.
-  float aspectRatio = 0;
   // Set a default callback period for if we have no video data
   mCallbackPeriod = 1000 / AUDIO_FRAME_RATE;
   if (mTheoraState) {
     if (mTheoraState->Init()) {
       mCallbackPeriod = mTheoraState->mFrameDuration;
-      aspectRatio = mTheoraState->mAspectRatio;
       gfxIntSize sz(mTheoraState->mInfo.pic_width,
                     mTheoraState->mInfo.pic_height);
-      mDecoder->SetVideoData(sz, mTheoraState->mAspectRatio, nsnull);
+      mDecoder->SetVideoData(sz, mTheoraState->mPixelAspectRatio, nsnull);
     } else {
       mTheoraState = nsnull;
     }
   }
   if (mVorbisState) {
     mVorbisState->Init();
   }
 
@@ -272,17 +270,17 @@ nsresult nsOggReader::ReadMetadata()
   mInfo.mHasVideo = HasVideo();
   mInfo.mCallbackPeriod = mCallbackPeriod;
   if (HasAudio()) {
     mInfo.mAudioRate = mVorbisState->mInfo.rate;
     mInfo.mAudioChannels = mVorbisState->mInfo.channels;
   }
   if (HasVideo()) {
     mInfo.mFramerate = mTheoraState->mFrameRate;
-    mInfo.mAspectRatio = mTheoraState->mAspectRatio;
+    mInfo.mPixelAspectRatio = mTheoraState->mPixelAspectRatio;
     mInfo.mPicture.width = mTheoraState->mInfo.pic_width;
     mInfo.mPicture.height = mTheoraState->mInfo.pic_height;
     mInfo.mPicture.x = mTheoraState->mInfo.pic_x;
     mInfo.mPicture.y = mTheoraState->mInfo.pic_y;
     mInfo.mFrame.width = mTheoraState->mInfo.frame_width;
     mInfo.mFrame.height = mTheoraState->mInfo.frame_height;
   }
   mInfo.mDataOffset = mDataOffset;

--- a/content/svg/content/src/nsSVGAltGlyphElement.cpp
+++ b/content/svg/content/src/nsSVGAltGlyphElement.cpp
@@ -27,60 +27,54 @@
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
-#include "nsSVGStylableElement.h"
 #include "nsGkAtoms.h"
 #include "nsIDOMSVGAltGlyphElement.h"
 #include "nsIDOMSVGURIReference.h"
 #include "nsSVGString.h"
 #include "nsSVGTextPositioningElement.h"
 
-typedef nsSVGStylableElement nsSVGAltGlyphElementBase;
+typedef nsSVGTextPositioningElement nsSVGAltGlyphElementBase;
 
-class nsSVGAltGlyphElement : public nsSVGAltGlyphElementBase,
+class nsSVGAltGlyphElement : public nsSVGAltGlyphElementBase, // = nsIDOMSVGTextPositioningElement
                              public nsIDOMSVGAltGlyphElement,
-                             public nsIDOMSVGURIReference, 
-                             public nsSVGTextPositioningElement // = nsIDOMSVGTextPositioningElement
+                             public nsIDOMSVGURIReference
 {
 protected:
   friend nsresult NS_NewSVGAltGlyphElement(nsIContent **aResult,
                                            nsINodeInfo *aNodeInfo);
   nsSVGAltGlyphElement(nsINodeInfo* aNodeInfo);
-  nsresult Init();
   
 public:
   // interfaces:
   
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_NSIDOMSVGALTGLYPHELEMENT
   NS_DECL_NSIDOMSVGURIREFERENCE
 
   // xxx If xpcom allowed virtual inheritance we wouldn't need to
   // forward here :-(
   NS_FORWARD_NSIDOMNODE(nsSVGAltGlyphElementBase::)
   NS_FORWARD_NSIDOMELEMENT(nsSVGAltGlyphElementBase::)
   NS_FORWARD_NSIDOMSVGELEMENT(nsSVGAltGlyphElementBase::)
-  NS_FORWARD_NSIDOMSVGTEXTCONTENTELEMENT(nsSVGTextContentElement::)
-  NS_FORWARD_NSIDOMSVGTEXTPOSITIONINGELEMENT(nsSVGTextPositioningElement::)
+  NS_FORWARD_NSIDOMSVGTEXTCONTENTELEMENT(nsSVGAltGlyphElementBase::)
+  NS_FORWARD_NSIDOMSVGTEXTPOSITIONINGELEMENT(nsSVGAltGlyphElementBase::)
 
   // nsIContent interface
   NS_IMETHOD_(PRBool) IsAttributeMapped(const nsIAtom* aAttribute) const;
 
   virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
 
 protected:
-  virtual nsSVGTextContainerFrame* GetTextContainerFrame() {
-    return do_QueryFrame(GetPrimaryFrame(Flush_Layout));
-  }
 
   // nsSVGElement overrides
   virtual StringAttributesInfo GetStringInfo();
 
   virtual PRBool IsEventName(nsIAtom* aName);
 
   enum { HREF };
   nsSVGString mStringAttributes[1];
@@ -114,27 +108,16 @@ NS_INTERFACE_MAP_END_INHERITING(nsSVGAlt
 //----------------------------------------------------------------------
 // Implementation
 
 nsSVGAltGlyphElement::nsSVGAltGlyphElement(nsINodeInfo *aNodeInfo)
   : nsSVGAltGlyphElementBase(aNodeInfo)
 {
 }
 
-nsresult
-nsSVGAltGlyphElement::Init()
-{
-  nsresult rv = nsSVGAltGlyphElementBase::Init();
-  NS_ENSURE_SUCCESS(rv,rv);
-
-  rv = Initialise(this);
-  NS_ENSURE_SUCCESS(rv,rv);
-
-  return rv;
-}
 
 //----------------------------------------------------------------------
 // nsIDOMNode methods
 
 NS_IMPL_ELEMENT_CLONE_WITH_INIT(nsSVGAltGlyphElement)
 
 //----------------------------------------------------------------------
 // nsIDOMSVGURIReference methods

--- a/content/svg/content/src/nsSVGElement.h
+++ b/content/svg/content/src/nsSVGElement.h
@@ -189,17 +189,16 @@ protected:
   virtual nsresult AfterSetAttr(PRInt32 aNamespaceID, nsIAtom* aName,
                                 const nsAString* aValue, PRBool aNotify);
   virtual PRBool ParseAttribute(PRInt32 aNamespaceID, nsIAtom* aAttribute,
                                 const nsAString& aValue, nsAttrValue& aResult);
   static nsresult ReportAttributeParseFailure(nsIDocument* aDocument,
                                               nsIAtom* aAttribute,
                                               const nsAString& aValue);
 
-  friend class nsSVGTextPositioningElement;
   // Hooks for subclasses
   virtual PRBool IsEventName(nsIAtom* aName);
 
   void UpdateContentStyleRule();
 #ifdef MOZ_SMIL
   void UpdateAnimatedContentStyleRule();
   nsICSSStyleRule* GetAnimatedContentStyleRule();
 #endif // MOZ_SMIL

--- a/content/svg/content/src/nsSVGTSpanElement.cpp
+++ b/content/svg/content/src/nsSVGTSpanElement.cpp
@@ -31,57 +31,51 @@
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
-#include "nsSVGStylableElement.h"
 #include "nsGkAtoms.h"
 #include "nsIDOMSVGTSpanElement.h"
 #include "nsSVGSVGElement.h"
 #include "nsSVGTextPositioningElement.h"
 
-typedef nsSVGStylableElement nsSVGTSpanElementBase;
+typedef nsSVGTextPositioningElement nsSVGTSpanElementBase;
 
-class nsSVGTSpanElement : public nsSVGTSpanElementBase,
-                          public nsIDOMSVGTSpanElement,
-                          public nsSVGTextPositioningElement // = nsIDOMSVGTextPositioningElement
+class nsSVGTSpanElement : public nsSVGTSpanElementBase, // = nsIDOMSVGTextPositioningElement
+                          public nsIDOMSVGTSpanElement
 {
 protected:
   friend nsresult NS_NewSVGTSpanElement(nsIContent **aResult,
                                         nsINodeInfo *aNodeInfo);
   nsSVGTSpanElement(nsINodeInfo* aNodeInfo);
-  nsresult Init();
   
 public:
   // interfaces:
   
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_NSIDOMSVGTSPANELEMENT
 
   // xxx If xpcom allowed virtual inheritance we wouldn't need to
   // forward here :-(
   NS_FORWARD_NSIDOMNODE(nsSVGTSpanElementBase::)
   NS_FORWARD_NSIDOMELEMENT(nsSVGTSpanElementBase::)
   NS_FORWARD_NSIDOMSVGELEMENT(nsSVGTSpanElementBase::)
-  NS_FORWARD_NSIDOMSVGTEXTCONTENTELEMENT(nsSVGTextContentElement::)
-  NS_FORWARD_NSIDOMSVGTEXTPOSITIONINGELEMENT(nsSVGTextPositioningElement::)
+  NS_FORWARD_NSIDOMSVGTEXTCONTENTELEMENT(nsSVGTSpanElementBase::)
+  NS_FORWARD_NSIDOMSVGTEXTPOSITIONINGELEMENT(nsSVGTSpanElementBase::)
 
   // nsIContent interface
   NS_IMETHOD_(PRBool) IsAttributeMapped(const nsIAtom* aAttribute) const;
 
   virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
 
 protected:
-  virtual nsSVGTextContainerFrame* GetTextContainerFrame() {
-    return do_QueryFrame(GetPrimaryFrame(Flush_Layout));
-  }
 
   // nsSVGElement overrides
   virtual PRBool IsEventName(nsIAtom* aName);
 };
 
 
 NS_IMPL_NS_NEW_SVG_ELEMENT(TSpan)
 
@@ -107,28 +101,16 @@ NS_INTERFACE_MAP_END_INHERITING(nsSVGTSp
 
 nsSVGTSpanElement::nsSVGTSpanElement(nsINodeInfo *aNodeInfo)
   : nsSVGTSpanElementBase(aNodeInfo)
 {
 
 }
 
   
-nsresult
-nsSVGTSpanElement::Init()
-{
-  nsresult rv = nsSVGTSpanElementBase::Init();
-  NS_ENSURE_SUCCESS(rv,rv);
-
-  rv = Initialise(this);
-  NS_ENSURE_SUCCESS(rv,rv);
-
-  return rv;
-}
-
 //----------------------------------------------------------------------
 // nsIDOMNode methods
 
 
 NS_IMPL_ELEMENT_CLONE_WITH_INIT(nsSVGTSpanElement)
 
 
 //----------------------------------------------------------------------

--- a/content/svg/content/src/nsSVGTextContentElement.h
+++ b/content/svg/content/src/nsSVGTextContentElement.h
@@ -36,19 +36,35 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGTEXTCONTENTELEMENTBASE_H__
 #define __NS_SVGTEXTCONTENTELEMENTBASE_H__
 
 #include "nsIDOMSVGTextContentElement.h"
 #include "nsSVGTextContainerFrame.h"
+#include "nsSVGStylableElement.h"
 
-class nsSVGTextContentElement
+typedef nsSVGStylableElement nsSVGTextContentElementBase;
+
+/**
+ * Note that nsSVGTextElement does not inherit nsSVGTextPositioningElement, or
+ * this class - it reimplements us instead (see its documenting comment). The
+ * upshot is that any changes to this class also need to be made in
+ * nsSVGTextElement.
+ */
+class nsSVGTextContentElement : public nsSVGTextContentElementBase
 {
 public:
   NS_DECL_NSIDOMSVGTEXTCONTENTELEMENT
 
 protected:
-  virtual nsSVGTextContainerFrame* GetTextContainerFrame()=0;
+
+  nsSVGTextContentElement(nsINodeInfo *aNodeInfo)
+    : nsSVGTextContentElementBase(aNodeInfo)
+  {}
+
+  nsSVGTextContainerFrame* GetTextContainerFrame() {
+    return do_QueryFrame(GetPrimaryFrame(Flush_Layout));
+  }
 };
 
 #endif

--- a/content/svg/content/src/nsSVGTextElement.cpp
+++ b/content/svg/content/src/nsSVGTextElement.cpp
@@ -39,53 +39,74 @@
 #include "nsSVGGraphicElement.h"
 #include "nsGkAtoms.h"
 #include "nsIDOMSVGTextElement.h"
 #include "nsCOMPtr.h"
 #include "nsSVGSVGElement.h"
 #include "nsSVGTextPositioningElement.h"
 #include "nsIFrame.h"
 #include "nsDOMError.h"
+#include "nsSVGLengthList.h"
+#include "nsSVGAnimatedLengthList.h"
+#include "nsSVGNumberList.h"
+#include "nsSVGAnimatedNumberList.h"
 
 typedef nsSVGGraphicElement nsSVGTextElementBase;
 
+/**
+ * This class does not inherit nsSVGTextPositioningElement - it reimplements it
+ * instead.
+ *
+ * Ideally this class would inherit nsSVGTextPositioningElement in addition to
+ * nsSVGGraphicElement, but we don't want two instances of nsSVGStylableElement
+ * and all the classes it inherits. Instead we choose to inherit one of the
+ * classes (nsSVGGraphicElement) and reimplement the missing pieces from the
+ * other (nsSVGTextPositioningElement (and thus nsSVGTextContentElement)). Care
+ * must be taken when making changes to the reimplemented pieces to keep
+ * nsSVGTextPositioningElement in sync (and vice versa).
+ */
 class nsSVGTextElement : public nsSVGTextElementBase,
-                         public nsIDOMSVGTextElement,
-                         public nsSVGTextPositioningElement // = nsIDOMSVGTextPositioningElement
+                         public nsIDOMSVGTextElement // nsIDOMSVGTextPositioningElement
 {
 protected:
   friend nsresult NS_NewSVGTextElement(nsIContent **aResult,
                                        nsINodeInfo *aNodeInfo);
   nsSVGTextElement(nsINodeInfo* aNodeInfo);
   nsresult Init();
   
 public:
   // interfaces:
   
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_NSIDOMSVGTEXTELEMENT
+  NS_DECL_NSIDOMSVGTEXTPOSITIONINGELEMENT
+  NS_DECL_NSIDOMSVGTEXTCONTENTELEMENT
 
   // xxx If xpcom allowed virtual inheritance we wouldn't need to
   // forward here :-(
   NS_FORWARD_NSIDOMNODE(nsSVGTextElementBase::)
   NS_FORWARD_NSIDOMELEMENT(nsSVGTextElementBase::)
   NS_FORWARD_NSIDOMSVGELEMENT(nsSVGTextElementBase::)
-  NS_FORWARD_NSIDOMSVGTEXTCONTENTELEMENT(nsSVGTextContentElement::)
-  NS_FORWARD_NSIDOMSVGTEXTPOSITIONINGELEMENT(nsSVGTextPositioningElement::)
 
   // nsIContent interface
   NS_IMETHOD_(PRBool) IsAttributeMapped(const nsIAtom* aAttribute) const;
 
   virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
 
 protected:
-  virtual nsSVGTextContainerFrame* GetTextContainerFrame() {
+  nsSVGTextContainerFrame* GetTextContainerFrame() {
     return do_QueryFrame(GetPrimaryFrame(Flush_Layout));
   }
 
+  // nsIDOMSVGTextPositioning properties:
+  nsCOMPtr<nsIDOMSVGAnimatedLengthList> mX;
+  nsCOMPtr<nsIDOMSVGAnimatedLengthList> mY;
+  nsCOMPtr<nsIDOMSVGAnimatedLengthList> mdX;
+  nsCOMPtr<nsIDOMSVGAnimatedLengthList> mdY;
+  nsCOMPtr<nsIDOMSVGAnimatedNumberList> mRotate;
 };
 
 
 NS_IMPL_NS_NEW_SVG_ELEMENT(Text)
 
 
 //----------------------------------------------------------------------
 // nsISupports methods
@@ -113,34 +134,280 @@ nsSVGTextElement::nsSVGTextElement(nsINo
 }
   
 nsresult
 nsSVGTextElement::Init()
 {
   nsresult rv = nsSVGTextElementBase::Init();
   NS_ENSURE_SUCCESS(rv,rv);
 
-  rv = Initialise(this);
-  NS_ENSURE_SUCCESS(rv,rv);
+  // DOM property: nsIDOMSVGTextPositioningElement::x, #IMPLIED attrib: x
+  {
+    nsCOMPtr<nsIDOMSVGLengthList> lengthList;
+    rv = NS_NewSVGLengthList(getter_AddRefs(lengthList), this, nsSVGUtils::X);
+    NS_ENSURE_SUCCESS(rv,rv);
+    rv = NS_NewSVGAnimatedLengthList(getter_AddRefs(mX),
+                                     lengthList);
+    NS_ENSURE_SUCCESS(rv,rv);
+    rv = AddMappedSVGValue(nsGkAtoms::x, mX);
+    NS_ENSURE_SUCCESS(rv,rv);
+  }
+
+  // DOM property: nsIDOMSVGTextPositioningElement::y, #IMPLIED attrib: y
+  {
+    nsCOMPtr<nsIDOMSVGLengthList> lengthList;
+    rv = NS_NewSVGLengthList(getter_AddRefs(lengthList), this, nsSVGUtils::Y);
+    NS_ENSURE_SUCCESS(rv,rv);
+    rv = NS_NewSVGAnimatedLengthList(getter_AddRefs(mY),
+                                     lengthList);
+    NS_ENSURE_SUCCESS(rv,rv);
+    rv = AddMappedSVGValue(nsGkAtoms::y, mY);
+    NS_ENSURE_SUCCESS(rv,rv);
+  }
+
+  // DOM property: nsIDOMSVGTextPositioningElement::dx, #IMPLIED attrib: dx
+  {
+    nsCOMPtr<nsIDOMSVGLengthList> lengthList;
+    rv = NS_NewSVGLengthList(getter_AddRefs(lengthList), this, nsSVGUtils::X);
+    NS_ENSURE_SUCCESS(rv,rv);
+    rv = NS_NewSVGAnimatedLengthList(getter_AddRefs(mdX),
+                                     lengthList);
+    NS_ENSURE_SUCCESS(rv,rv);
+    rv = AddMappedSVGValue(nsGkAtoms::dx, mdX);
+    NS_ENSURE_SUCCESS(rv,rv);
+  }
+
+  // DOM property: nsIDOMSVGTextPositioningElement::dy, #IMPLIED attrib: dy
+  {
+    nsCOMPtr<nsIDOMSVGLengthList> lengthList;
+    rv = NS_NewSVGLengthList(getter_AddRefs(lengthList), this, nsSVGUtils::Y);
+    NS_ENSURE_SUCCESS(rv,rv);
+    rv = NS_NewSVGAnimatedLengthList(getter_AddRefs(mdY),
+                                     lengthList);
+    NS_ENSURE_SUCCESS(rv,rv);
+    rv = AddMappedSVGValue(nsGkAtoms::dy, mdY);
+    NS_ENSURE_SUCCESS(rv,rv);
+  }
+
+  // DOM property: nsIDOMSVGTextPositioningElement::rotate, #IMPLIED attrib: rotate
+  {
+    nsCOMPtr<nsIDOMSVGNumberList> numberList;
+    rv = NS_NewSVGNumberList(getter_AddRefs(numberList));
+    NS_ENSURE_SUCCESS(rv,rv);
+    rv = NS_NewSVGAnimatedNumberList(getter_AddRefs(mRotate),
+                                     numberList);
+    NS_ENSURE_SUCCESS(rv,rv);
+    rv = AddMappedSVGValue(nsGkAtoms::rotate, mRotate);
+    NS_ENSURE_SUCCESS(rv,rv);
+  }
 
   return rv;
 }
 
 //----------------------------------------------------------------------
 // nsIDOMNode methods
 
 
 NS_IMPL_ELEMENT_CLONE_WITH_INIT(nsSVGTextElement)
 
 
 //----------------------------------------------------------------------
 // nsIDOMSVGTextElement methods
 
 // - no methods -
 
+
+//----------------------------------------------------------------------
+// nsIDOMSVGTextPositioningElement methods
+
+/* readonly attribute nsIDOMSVGAnimatedLengthList x; */
+NS_IMETHODIMP
+nsSVGTextElement::GetX(nsIDOMSVGAnimatedLengthList * *aX)
+{
+  *aX = mX;
+  NS_IF_ADDREF(*aX);
+  return NS_OK;
+}
+
+/* readonly attribute nsIDOMSVGAnimatedLengthList y; */
+NS_IMETHODIMP
+nsSVGTextElement::GetY(nsIDOMSVGAnimatedLengthList * *aY)
+{
+  *aY = mY;
+  NS_IF_ADDREF(*aY);
+  return NS_OK;
+}
+
+/* readonly attribute nsIDOMSVGAnimatedLengthList dx; */
+NS_IMETHODIMP
+nsSVGTextElement::GetDx(nsIDOMSVGAnimatedLengthList * *aDx)
+{
+  *aDx = mdX;
+  NS_IF_ADDREF(*aDx);
+  return NS_OK;
+}
+
+/* readonly attribute nsIDOMSVGAnimatedLengthList dy; */
+NS_IMETHODIMP
+nsSVGTextElement::GetDy(nsIDOMSVGAnimatedLengthList * *aDy)
+{
+  *aDy = mdY;
+  NS_IF_ADDREF(*aDy);
+  return NS_OK;
+}
+
+/* readonly attribute nsIDOMSVGAnimatedNumberList rotate; */
+NS_IMETHODIMP
+nsSVGTextElement::GetRotate(nsIDOMSVGAnimatedNumberList * *aRotate)
+{
+  *aRotate = mRotate;
+  NS_IF_ADDREF(*aRotate);
+  return NS_OK;
+}
+
+
+//----------------------------------------------------------------------
+// nsIDOMSVGTextContentElement methods
+
+/* readonly attribute nsIDOMSVGAnimatedLength textLength; */
+NS_IMETHODIMP
+nsSVGTextElement::GetTextLength(nsIDOMSVGAnimatedLength * *aTextLength)
+{
+  NS_NOTYETIMPLEMENTED("nsSVGTextElement::GetTextLength");
+  return NS_ERROR_NOT_IMPLEMENTED;
+}
+
+/* readonly attribute nsIDOMSVGAnimatedEnumeration lengthAdjust; */
+NS_IMETHODIMP
+nsSVGTextElement::GetLengthAdjust(nsIDOMSVGAnimatedEnumeration * *aLengthAdjust)
+{
+  NS_NOTYETIMPLEMENTED("nsSVGTextElement::GetLengthAdjust");
+  return NS_ERROR_NOT_IMPLEMENTED;
+}
+
+/* long getNumberOfChars (); */
+NS_IMETHODIMP
+nsSVGTextElement::GetNumberOfChars(PRInt32 *_retval)
+{
+  *_retval = 0;
+
+  nsSVGTextContainerFrame* metrics = GetTextContainerFrame();
+  if (metrics)
+    *_retval = metrics->GetNumberOfChars();
+
+  return NS_OK;
+}
+
+/* float getComputedTextLength (); */
+NS_IMETHODIMP
+nsSVGTextElement::GetComputedTextLength(float *_retval)
+{
+  *_retval = 0.0;
+
+  nsSVGTextContainerFrame* metrics = GetTextContainerFrame();
+  if (metrics)
+    *_retval = metrics->GetComputedTextLength();
+
+  return NS_OK;
+}
+
+/* float getSubStringLength (in unsigned long charnum, in unsigned long nchars); */
+NS_IMETHODIMP
+nsSVGTextElement::GetSubStringLength(PRUint32 charnum, PRUint32 nchars, float *_retval)
+{
+  *_retval = 0.0f;
+  nsSVGTextContainerFrame* metrics = GetTextContainerFrame();
+  if (!metrics)
+    return NS_OK;
+
+  PRUint32 charcount = metrics->GetNumberOfChars();
+  if (charcount <= charnum || nchars > charcount - charnum)
+    return NS_ERROR_DOM_INDEX_SIZE_ERR;
+
+  if (nchars == 0)
+    return NS_OK;
+
+  *_retval = metrics->GetSubStringLength(charnum, nchars);
+  return NS_OK;
+}
+
+/* nsIDOMSVGPoint getStartPositionOfChar (in unsigned long charnum); */
+NS_IMETHODIMP
+nsSVGTextElement::GetStartPositionOfChar(PRUint32 charnum, nsIDOMSVGPoint **_retval)
+{
+  *_retval = nsnull;
+  nsSVGTextContainerFrame* metrics = GetTextContainerFrame();
+
+  if (!metrics) return NS_ERROR_FAILURE;
+
+  return metrics->GetStartPositionOfChar(charnum, _retval);
+}
+
+/* nsIDOMSVGPoint getEndPositionOfChar (in unsigned long charnum); */
+NS_IMETHODIMP
+nsSVGTextElement::GetEndPositionOfChar(PRUint32 charnum, nsIDOMSVGPoint **_retval)
+{
+  *_retval = nsnull;
+  nsSVGTextContainerFrame* metrics = GetTextContainerFrame();
+
+  if (!metrics) return NS_ERROR_FAILURE;
+
+  return metrics->GetEndPositionOfChar(charnum, _retval);
+}
+
+/* nsIDOMSVGRect getExtentOfChar (in unsigned long charnum); */
+NS_IMETHODIMP
+nsSVGTextElement::GetExtentOfChar(PRUint32 charnum, nsIDOMSVGRect **_retval)
+{
+  *_retval = nsnull;
+  nsSVGTextContainerFrame* metrics = GetTextContainerFrame();
+
+  if (!metrics) return NS_ERROR_FAILURE;
+
+  return metrics->GetExtentOfChar(charnum, _retval);
+}
+
+/* float getRotationOfChar (in unsigned long charnum); */
+NS_IMETHODIMP
+nsSVGTextElement::GetRotationOfChar(PRUint32 charnum, float *_retval)
+{
+  *_retval = 0.0;
+
+  nsSVGTextContainerFrame* metrics = GetTextContainerFrame();
+
+  if (!metrics) return NS_ERROR_FAILURE;
+
+  return metrics->GetRotationOfChar(charnum, _retval);
+}
+
+/* long getCharNumAtPosition (in nsIDOMSVGPoint point); */
+NS_IMETHODIMP
+nsSVGTextElement::GetCharNumAtPosition(nsIDOMSVGPoint *point, PRInt32 *_retval)
+{
+  if (!point)
+    return NS_ERROR_DOM_SVG_WRONG_TYPE_ERR;
+
+  *_retval = -1;
+
+  nsSVGTextContainerFrame* metrics = GetTextContainerFrame();
+  if (metrics)
+    *_retval = metrics->GetCharNumAtPosition(point);
+
+  return NS_OK;
+}
+
+/* void selectSubString (in unsigned long charnum, in unsigned long nchars); */
+NS_IMETHODIMP
+nsSVGTextElement::SelectSubString(PRUint32 charnum, PRUint32 nchars)
+{
+  NS_NOTYETIMPLEMENTED("nsSVGTextElement::SelectSubString");
+  return NS_ERROR_NOT_IMPLEMENTED;
+}
+
+
 //----------------------------------------------------------------------
 // nsIContent methods
 
 NS_IMETHODIMP_(PRBool)
 nsSVGTextElement::IsAttributeMapped(const nsIAtom* name) const
 {
   static const MappedAttributeEntry* const map[] = {
     sTextContentElementsMap,

--- a/content/svg/content/src/nsSVGTextPathElement.h
+++ b/content/svg/content/src/nsSVGTextPathElement.h
@@ -38,22 +38,21 @@
 #ifndef __NS_SVGTEXTPATHELEMENT_H__
 #define __NS_SVGTEXTPATHELEMENT_H__
 
 #include "nsSVGEnum.h"
 #include "nsSVGLength2.h"
 #include "nsSVGString.h"
 #include "nsSVGTextContentElement.h"
 
-typedef nsSVGStylableElement nsSVGTextPathElementBase;
+typedef nsSVGTextContentElement nsSVGTextPathElementBase;
 
-class nsSVGTextPathElement : public nsSVGTextPathElementBase,
+class nsSVGTextPathElement : public nsSVGTextPathElementBase, // = nsIDOMSVGTextContentElement
                              public nsIDOMSVGTextPathElement,
-                             public nsIDOMSVGURIReference,
-                             public nsSVGTextContentElement // = nsIDOMSVGTextContentElement
+                             public nsIDOMSVGURIReference
 {
 friend class nsSVGTextPathFrame;
 
 protected:
   friend nsresult NS_NewSVGTextPathElement(nsIContent **aResult,
                                         nsINodeInfo *aNodeInfo);
   nsSVGTextPathElement(nsINodeInfo* aNodeInfo);
   
@@ -64,29 +63,25 @@ public:
   NS_DECL_NSIDOMSVGTEXTPATHELEMENT
   NS_DECL_NSIDOMSVGURIREFERENCE
 
   // xxx If xpcom allowed virtual inheritance we wouldn't need to
   // forward here :-(
   NS_FORWARD_NSIDOMNODE(nsSVGTextPathElementBase::)
   NS_FORWARD_NSIDOMELEMENT(nsSVGTextPathElementBase::)
   NS_FORWARD_NSIDOMSVGELEMENT(nsSVGTextPathElementBase::)
-  NS_FORWARD_NSIDOMSVGTEXTCONTENTELEMENT(nsSVGTextContentElement::)
+  NS_FORWARD_NSIDOMSVGTEXTCONTENTELEMENT(nsSVGTextPathElementBase::)
 
   // nsIContent interface
   NS_IMETHOD_(PRBool) IsAttributeMapped(const nsIAtom* aAttribute) const;
 
   virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
 
 protected:
 
-  virtual nsSVGTextContainerFrame* GetTextContainerFrame() {
-    return do_QueryFrame(GetPrimaryFrame(Flush_Layout));
-  }
-
   virtual LengthAttributesInfo GetLengthInfo();
   virtual EnumAttributesInfo GetEnumInfo();
   virtual StringAttributesInfo GetStringInfo();
 
   virtual PRBool IsEventName(nsIAtom* aName);
 
   enum { STARTOFFSET };
   nsSVGLength2 mLengthAttributes[1];

--- a/content/svg/content/src/nsSVGTextPositioningElement.cpp
+++ b/content/svg/content/src/nsSVGTextPositioningElement.cpp
@@ -35,78 +35,80 @@
 
 #include "nsSVGTextPositioningElement.h"
 #include "nsSVGAnimatedLengthList.h"
 #include "nsSVGAnimatedNumberList.h"
 #include "nsSVGLengthList.h"
 #include "nsSVGNumberList.h"
 
 nsresult
-nsSVGTextPositioningElement::Initialise(nsSVGElement *aSVGElement)
+nsSVGTextPositioningElement::Init()
 {
-  nsresult rv;
+  nsresult rv = nsSVGTextPositioningElementBase::Init();
+  NS_ENSURE_SUCCESS(rv,rv);
+
   // Create mapped properties:
 
   // DOM property: nsIDOMSVGTextPositioningElement::x, #IMPLIED attrib: x
   {
     nsCOMPtr<nsIDOMSVGLengthList> lengthList;
-    rv = NS_NewSVGLengthList(getter_AddRefs(lengthList), aSVGElement, nsSVGUtils::X);
+    rv = NS_NewSVGLengthList(getter_AddRefs(lengthList), this, nsSVGUtils::X);
     NS_ENSURE_SUCCESS(rv,rv);
     rv = NS_NewSVGAnimatedLengthList(getter_AddRefs(mX),
                                      lengthList);
     NS_ENSURE_SUCCESS(rv,rv);
-    rv = aSVGElement->AddMappedSVGValue(nsGkAtoms::x, mX);
+    rv = AddMappedSVGValue(nsGkAtoms::x, mX);
     NS_ENSURE_SUCCESS(rv,rv);
   }
   
   // DOM property: nsIDOMSVGTextPositioningElement::y, #IMPLIED attrib: y
   {
     nsCOMPtr<nsIDOMSVGLengthList> lengthList;
-    rv = NS_NewSVGLengthList(getter_AddRefs(lengthList), aSVGElement, nsSVGUtils::Y);
+    rv = NS_NewSVGLengthList(getter_AddRefs(lengthList), this, nsSVGUtils::Y);
     NS_ENSURE_SUCCESS(rv,rv);
     rv = NS_NewSVGAnimatedLengthList(getter_AddRefs(mY),
                                      lengthList);
     NS_ENSURE_SUCCESS(rv,rv);
-    rv = aSVGElement->AddMappedSVGValue(nsGkAtoms::y, mY);
+    rv = AddMappedSVGValue(nsGkAtoms::y, mY);
     NS_ENSURE_SUCCESS(rv,rv);
   }
 
   // DOM property: nsIDOMSVGTextPositioningElement::dx, #IMPLIED attrib: dx
   {
     nsCOMPtr<nsIDOMSVGLengthList> lengthList;
-    rv = NS_NewSVGLengthList(getter_AddRefs(lengthList), aSVGElement, nsSVGUtils::X);
+    rv = NS_NewSVGLengthList(getter_AddRefs(lengthList), this, nsSVGUtils::X);
     NS_ENSURE_SUCCESS(rv,rv);
     rv = NS_NewSVGAnimatedLengthList(getter_AddRefs(mdX),
                                      lengthList);
     NS_ENSURE_SUCCESS(rv,rv);
-    rv = aSVGElement->AddMappedSVGValue(nsGkAtoms::dx, mdX);
+    rv = AddMappedSVGValue(nsGkAtoms::dx, mdX);
     NS_ENSURE_SUCCESS(rv,rv);
   }
   
   // DOM property: nsIDOMSVGTextPositioningElement::dy, #IMPLIED attrib: dy
   {
     nsCOMPtr<nsIDOMSVGLengthList> lengthList;
-    rv = NS_NewSVGLengthList(getter_AddRefs(lengthList), aSVGElement, nsSVGUtils::Y);
+    rv = NS_NewSVGLengthList(getter_AddRefs(lengthList), this, nsSVGUtils::Y);
     NS_ENSURE_SUCCESS(rv,rv);
     rv = NS_NewSVGAnimatedLengthList(getter_AddRefs(mdY),
                                      lengthList);
     NS_ENSURE_SUCCESS(rv,rv);
-    rv = aSVGElement->AddMappedSVGValue(nsGkAtoms::dy, mdY);
+    rv = AddMappedSVGValue(nsGkAtoms::dy, mdY);
     NS_ENSURE_SUCCESS(rv,rv);
   }
 
   // DOM property: nsIDOMSVGTextPositioningElement::rotate, #IMPLIED attrib: rotate
   {
     nsCOMPtr<nsIDOMSVGNumberList> numberList;
     rv = NS_NewSVGNumberList(getter_AddRefs(numberList));
     NS_ENSURE_SUCCESS(rv,rv);
     rv = NS_NewSVGAnimatedNumberList(getter_AddRefs(mRotate),
                                      numberList);
     NS_ENSURE_SUCCESS(rv,rv);
-    rv = aSVGElement->AddMappedSVGValue(nsGkAtoms::rotate, mRotate);
+    rv = AddMappedSVGValue(nsGkAtoms::rotate, mRotate);
     NS_ENSURE_SUCCESS(rv,rv);
   }
 
   return rv;
 }
 
 //----------------------------------------------------------------------
 // nsIDOMSVGTextPositioningElement methods

--- a/content/svg/content/src/nsSVGTextPositioningElement.h
+++ b/content/svg/content/src/nsSVGTextPositioningElement.h
@@ -36,23 +36,37 @@
 #ifndef __NS_SVGTEXTPOSITIONINGELEMENTBASE_H__
 #define __NS_SVGTEXTPOSITIONINGELEMENTBASE_H__
 
 #include "nsIDOMSVGTextPositionElem.h"
 #include "nsSVGTextContentElement.h"
 #include "nsIDOMSVGAnimatedLengthList.h"
 #include "nsIDOMSVGAnimatedNumberList.h"
 
-class nsSVGTextPositioningElement : public nsSVGTextContentElement
+class nsSVGElement;
+
+typedef nsSVGTextContentElement nsSVGTextPositioningElementBase;
+
+/**
+ * Note that nsSVGTextElement does not inherit this class - it reimplements it
+ * instead (see its documenting comment). The upshot is that any changes to
+ * this class also need to be made in nsSVGTextElement.
+ */
+class nsSVGTextPositioningElement : public nsSVGTextPositioningElementBase
 {
 public:
   NS_DECL_NSIDOMSVGTEXTPOSITIONINGELEMENT
 
 protected:
-  nsresult Initialise(nsSVGElement *aSVGElement);
+
+  nsSVGTextPositioningElement(nsINodeInfo *aNodeInfo)
+    : nsSVGTextPositioningElementBase(aNodeInfo)
+  {}
+
+  nsresult Init();
 
   // nsIDOMSVGTextPositioning properties:
   nsCOMPtr<nsIDOMSVGAnimatedLengthList> mX;
   nsCOMPtr<nsIDOMSVGAnimatedLengthList> mY;
   nsCOMPtr<nsIDOMSVGAnimatedLengthList> mdX;
   nsCOMPtr<nsIDOMSVGAnimatedLengthList> mdY;
   nsCOMPtr<nsIDOMSVGAnimatedNumberList> mRotate;
 };

--- a/content/xul/templates/src/nsXULTreeBuilder.cpp
+++ b/content/xul/templates/src/nsXULTreeBuilder.cpp
@@ -1703,22 +1703,19 @@ nsresult
 nsXULTreeBuilder::CloseContainer(PRInt32 aIndex)
 {
     NS_ASSERTION(aIndex >= 0 && aIndex < mRows.Count(), "bad row");
     if (aIndex < 0 || aIndex >= mRows.Count())
         return NS_ERROR_INVALID_ARG;
 
     nsTreeRows::iterator iter = mRows[aIndex];
 
-    nsTreeRows::Subtree& subtree = *(iter->mSubtree);
+    if (iter->mSubtree)
+        RemoveMatchesFor(*iter->mSubtree);
 
-    RemoveMatchesFor(subtree);
-
-    // Update the view
-    iter = mRows[aIndex];
 
     PRInt32 count = mRows.GetSubtreeSizeFor(iter);
     mRows.RemoveSubtreeFor(iter);
 
     iter->mContainerState = nsTreeRows::eContainerState_Closed;
 
     if (mBoxObject) {
         mBoxObject->InvalidateRow(aIndex);

--- a/docshell/resources/content/netError.xhtml
+++ b/docshell/resources/content/netError.xhtml
@@ -115,17 +115,17 @@
       {
         // Session history has the URL of the page that failed
         // to load, not the one of the error page. So, just call
         // reload(), which will also repost POST data correctly.
         try {
           location.reload();
         } catch (e) {
           // We probably tried to reload a URI that caused an exception to
-          // occur;  e.g. a non-existent file.
+          // occur;  e.g. a nonexistent file.
         }
 
         buttonEl.disabled = true;
       }
 
       function initPage()
       {
         var err = getErrorCode();

--- a/docshell/test/test_bug529119-1.html
+++ b/docshell/test/test_bug529119-1.html
@@ -6,17 +6,17 @@
 <script type="text/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>        
 <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css" />
 
 <script class="testbody" type="text/javascript">
 
 SimpleTest.waitForExplicitFinish();
 
 var workingURL = "http://mochi.test:8888/tests/docshell/test/bug529119-window.html";
-var faultyURL = "http://some-non-existent-domain-27489274c892748217cn2384.com/";
+var faultyURL = "http://some-nonexistent-domain-27489274c892748217cn2384.com/";
 
 var w = null;
 var phase = 0;
 var gotWrongPageOnTryAgainClick = false;
 
 function pollForPage(f, w)
 {
   // Start with polling after a delay, we might mistakenly take the current page

--- a/docshell/test/test_bug529119-2.html
+++ b/docshell/test/test_bug529119-2.html
@@ -6,17 +6,17 @@
 <script type="text/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>        
 <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css" />
 
 <script class="testbody" type="text/javascript">
 
 SimpleTest.waitForExplicitFinish();
 
 var workingURL = "http://mochi.test:8888/tests/docshell/test/bug529119-window.html";
-var faultyURL = "http://some-non-existent-domain-27489274c892748217cn2384.com/";
+var faultyURL = "http://some-nonexistent-domain-27489274c892748217cn2384.com/";
 
 var w = null;
 var phase = 0;
 
 function pollForPage(expectErrorPage, f, w)
 {
   // Start with polling after a delay, we might mistakenly take the current page
   // as an expected one.

--- a/dom/src/storage/nsDOMStorage.cpp
+++ b/dom/src/storage/nsDOMStorage.cpp
@@ -1294,17 +1294,17 @@ nsDOMStorage::SetSecure(const nsAString&
 
     return gStorageDB->SetSecure(this, aKey, aSecure);
   }
 #else
   return NS_ERROR_NOT_IMPLEMENTED;
 #endif
 
   nsSessionStorageEntry *entry = mItems.GetEntry(aKey);
-  NS_ASSERTION(entry, "Don't use SetSecure() with non-existing keys!");
+  NS_ASSERTION(entry, "Don't use SetSecure() with nonexistent keys!");
 
   if (entry) {
     entry->mItem->SetSecureInternal(aSecure);
   }  
 
   return NS_OK;
 }
 

--- a/editor/libeditor/html/nsHTMLAbsPosition.cpp
+++ b/editor/libeditor/html/nsHTMLAbsPosition.cpp
@@ -495,17 +495,17 @@ nsHTMLEditor::SetFinalPosition(PRInt32 a
   // keep track of that size
   mPositionedObjectX  = newX;
   mPositionedObjectY  = newY;
 
   return RefreshResizers();
 }
 
 void
-nsHTMLEditor::AddPositioningOffet(PRInt32 & aX, PRInt32 & aY)
+nsHTMLEditor::AddPositioningOffset(PRInt32 & aX, PRInt32 & aY)
 {
   // Get the positioning offset
   nsresult res;
   nsCOMPtr<nsIPrefBranch> prefBranch =
     do_GetService(NS_PREFSERVICE_CONTRACTID, &res);
   PRInt32 positioningOffset = 0;
   if (NS_SUCCEEDED(res) && prefBranch) {
     res = prefBranch->GetIntPref("editor.positioning.offset", &positioningOffset);
@@ -539,17 +539,17 @@ nsHTMLEditor::AbsolutelyPositionElement(
     PRInt32 x, y;
     GetElementOrigin(aElement, x, y);
 
     mHTMLCSSUtils->SetCSSProperty(aElement,
                                   nsEditProperty::cssPosition,
                                   NS_LITERAL_STRING("absolute"),
                                   PR_FALSE);
 
-    AddPositioningOffet(x, y);
+    AddPositioningOffset(x, y);
     SnapToGrid(x, y);
     SetElementPosition(aElement, x, y);
 
     // we may need to create a br if the positioned element is alone in its
     // container
     nsCOMPtr<nsIDOMNode> parentNode;
     res = aElement->GetParentNode(getter_AddRefs(parentNode));
     if (NS_FAILED(res)) return res;

--- a/editor/libeditor/html/nsHTMLEditor.h
+++ b/editor/libeditor/html/nsHTMLEditor.h
@@ -501,17 +501,17 @@ protected:
   NS_IMETHOD SplitCellIntoColumns(nsIDOMElement *aTable, PRInt32 aRowIndex, PRInt32 aColIndex,
                                   PRInt32 aColSpanLeft, PRInt32 aColSpanRight, nsIDOMElement **aNewCell);
 
   NS_IMETHOD SplitCellIntoRows(nsIDOMElement *aTable, PRInt32 aRowIndex, PRInt32 aColIndex,
                                PRInt32 aRowSpanAbove, PRInt32 aRowSpanBelow, nsIDOMElement **aNewCell);
 
   nsresult CopyCellBackgroundColor(nsIDOMElement *destCell, nsIDOMElement *sourceCell);
 
-  // Reduce rowspan/colspan when cells span into non-existent rows/columns
+  // Reduce rowspan/colspan when cells span into nonexistent rows/columns
   NS_IMETHOD FixBadRowSpan(nsIDOMElement *aTable, PRInt32 aRowIndex, PRInt32& aNewRowCount);
   NS_IMETHOD FixBadColSpan(nsIDOMElement *aTable, PRInt32 aColIndex, PRInt32& aNewColCount);
 
   // Fallback method: Call this after using ClearSelection() and you
   //  failed to set selection to some other content in the document
   NS_IMETHOD SetSelectionAtDocumentStart(nsISelection *aSelection);
 
 // End of Table Editing utilities
@@ -902,17 +902,17 @@ protected:
   nsCOMPtr<nsIDOMElement> mGrabber;
   nsCOMPtr<nsIDOMElement> mPositioningShadow;
 
   PRInt32      mGridSize;
 
   nsresult CreateGrabber(nsIDOMNode * aParentNode, nsIDOMElement ** aReturn);
   nsresult StartMoving(nsIDOMElement * aHandle);
   nsresult SetFinalPosition(PRInt32 aX, PRInt32 aY);
-  void     AddPositioningOffet(PRInt32 & aX, PRInt32 & aY);
+  void     AddPositioningOffset(PRInt32 & aX, PRInt32 & aY);
   void     SnapToGrid(PRInt32 & newX, PRInt32 & newY);
   nsresult GrabberClicked();
   nsresult EndMoving();
   nsresult CheckPositionedElementBGandFG(nsIDOMElement * aElement,
                                          nsAString & aReturn);
 
   /* INLINE TABLE EDITING */
 

--- a/editor/libeditor/html/nsWSRunObject.h
+++ b/editor/libeditor/html/nsWSRunObject.h
@@ -316,22 +316,22 @@ class NS_STACK_CLASS nsWSRunObject
     
     // member variables ---------------------------------------------------------
     
     nsCOMPtr<nsIDOMNode> mNode;           // the node passed to our constructor
     PRInt32 mOffset;                      // the offset passed to our contructor
     // together, the above represent the point at which we are building up ws info.
     
     PRBool  mPRE;                         // true if we are in preformatted whitespace context
-    nsCOMPtr<nsIDOMNode> mStartNode;      // node/offet where ws starts
+    nsCOMPtr<nsIDOMNode> mStartNode;      // node/offset where ws starts
     PRInt32 mStartOffset;                 // ...
     PRInt16 mStartReason;                 // reason why ws starts (eText, eOtherBlock, etc)
     nsCOMPtr<nsIDOMNode> mStartReasonNode;// the node that implicated by start reason
     
-    nsCOMPtr<nsIDOMNode> mEndNode;        // node/offet where ws ends
+    nsCOMPtr<nsIDOMNode> mEndNode;        // node/offset where ws ends
     PRInt32 mEndOffset;                   // ...
     PRInt16 mEndReason;                   // reason why ws ends (eText, eOtherBlock, etc)
     nsCOMPtr<nsIDOMNode> mEndReasonNode;  // the node that implicated by end reason
     
     nsCOMPtr<nsIDOMNode> mFirstNBSPNode;  // location of first nbsp in ws run, if any
     PRInt32 mFirstNBSPOffset;             // ...
     
     nsCOMPtr<nsIDOMNode> mLastNBSPNode;   // location of last nbsp in ws run, if any

--- a/editor/libeditor/html/tests/browserscope/lib/browserscope/README
+++ b/editor/libeditor/html/tests/browserscope/lib/browserscope/README
@@ -13,17 +13,17 @@ http://code.google.com/appengine/downloa
 For local development, just startup the server:
 ./pathto/google_appengine/dev_appserver.py --port=8080 browserscope
 
 You should then be able to access the local application at:
 http://localhost:8080/
 
 Note: the first time you hit the homepage it may take a little
 while - that's because it's trying to read out median times for all
-of the tests from a non-existent datastore and write to memcache.
+of the tests from a nonexistent datastore and write to memcache.
 Just be a lil patient.
 
 You can run the unit tests at:
   http://localhost:8080/test
 
 
 CONTRIBUTING
 ------------------

--- a/embedding/browser/webBrowser/nsWebBrowser.cpp
+++ b/embedding/browser/webBrowser/nsWebBrowser.cpp
@@ -1661,16 +1661,29 @@ NS_IMETHODIMP nsWebBrowser::EnsureDocShe
    NS_ENSURE_TRUE(mDocShellTreeOwner, NS_ERROR_OUT_OF_MEMORY);
 
    NS_ADDREF(mDocShellTreeOwner);
    mDocShellTreeOwner->WebBrowser(this);
    
    return NS_OK;
 }
 
+static void DrawThebesLayer(ThebesLayer* aLayer,
+                            gfxContext* aContext,
+                            const nsIntRegion& aRegionToDraw,
+                            void* aCallbackData)
+{
+  nscolor* color = static_cast<nscolor*>(aCallbackData);
+  aContext->NewPath();
+  aContext->SetColor(gfxRGBA(*color));
+  nsIntRect dirtyRect = aRegionToDraw.GetBounds();
+  aContext->Rectangle(gfxRect(dirtyRect.x, dirtyRect.y, dirtyRect.width, dirtyRect.height));
+  aContext->Fill();  
+}
+
 /* static */
 nsEventStatus nsWebBrowser::HandleEvent(nsGUIEvent *aEvent)
 {
   nsWebBrowser  *browser = nsnull;
   void          *data = nsnull;
   nsIWidget     *widget = aEvent->widget;
 
   if (!widget)
@@ -1691,29 +1704,17 @@ nsEventStatus nsWebBrowser::HandleEvent(
       layerManager->BeginTransaction();
       nsRefPtr<ThebesLayer> root = layerManager->CreateThebesLayer();
       nsPaintEvent* paintEvent = static_cast<nsPaintEvent*>(aEvent);
       nsIntRect dirtyRect = paintEvent->region.GetBounds();
       if (root) {
           root->SetVisibleRegion(dirtyRect);
           layerManager->SetRoot(root);
       }
-      layerManager->EndConstruction();
-      if (root) {
-          nsIntRegion toDraw;
-          gfxContext* ctx = root->BeginDrawing(&toDraw);
-          if (ctx) {
-              ctx->NewPath();
-              ctx->SetColor(gfxRGBA(browser->mBackgroundColor));
-              ctx->Rectangle(gfxRect(dirtyRect.x, dirtyRect.y, dirtyRect.width, dirtyRect.height));
-              ctx->Fill();
-          }
-      }
-      root->EndDrawing();
-      layerManager->EndTransaction();
+      layerManager->EndTransaction(DrawThebesLayer, &browser->mBackgroundColor);
       return nsEventStatus_eConsumeDoDefault;
     }
 
   case NS_ACTIVATE: {
 #if defined(DEBUG_smaug)
     nsCOMPtr<nsIDOMDocument> domDocument = do_GetInterface(browser->mDocShell);
     nsAutoString documentURI;
     if (domDocument) {

--- a/gfx/layers/Layers.h
+++ b/gfx/layers/Layers.h
@@ -117,17 +117,18 @@ class CanvasLayer;
  * root layer, and each container layer holds a reference to its children.
  */
 class THEBES_API LayerManager {
   NS_INLINE_DECL_REFCOUNTING(LayerManager)
 
 public:
   enum LayersBackend {
     LAYERS_BASIC = 0,
-    LAYERS_OPENGL
+    LAYERS_OPENGL,
+    LAYERS_D3D9
   };
 
   virtual ~LayerManager() {}
 
   /**
    * Start a new transaction. Nested transactions are not allowed so
    * there must be no transaction currently in progress.
    * This transaction will update the state of the window from which
@@ -138,24 +139,39 @@ public:
    * Start a new transaction. Nested transactions are not allowed so
    * there must be no transaction currently in progress. 
    * This transaction will render the contents of the layer tree to
    * the given target context. The rendering will be complete when
    * EndTransaction returns.
    */
   virtual void BeginTransactionWithTarget(gfxContext* aTarget) = 0;
   /**
-   * Finish the construction phase of the transaction and enter the
-   * drawing phase.
+   * Function called to draw the contents of each ThebesLayer.
+   * aRegionToDraw contains the region that needs to be drawn.
+   * This would normally be a subregion of the visible region. Drawing is
+   * not necessarily clipped to aRegionToDraw.
+   * The callee must draw all of aRegionToDraw.
+   * 
+   * aContext must not be used after the call has returned.
+   * We guarantee that buffered contents in the visible
+   * region are valid once drawing is complete.
    */
-  virtual void EndConstruction() = 0;
+  typedef void (* DrawThebesLayerCallback)(ThebesLayer* aLayer,
+                                           gfxContext* aContext,
+                                           const nsIntRegion& aRegionToDraw,
+                                           void* aCallbackData);
   /**
-   * Complete the transaction.
+   * Finish the construction phase of the transaction, perform the
+   * drawing phase, and end the transaction.
+   * During the drawing phase, all ThebesLayers in the tree are
+   * drawn in tree order, exactly once each, except for those layers
+   * where it is known that the visible region is empty.
    */
-  virtual void EndTransaction() = 0;
+  virtual void EndTransaction(DrawThebesLayerCallback aCallback,
+                              void* aCallbackData) = 0;
 
   /**
    * CONSTRUCTION PHASE ONLY
    * Set the root layer.
    */
   virtual void SetRoot(Layer* aLayer) = 0;
 
   /**
@@ -192,16 +208,18 @@ public:
   /**
    * Type of layer manager his is. This is to be used sparsely in order to
    * avoid a lot of Layers backend specific code. It should be used only when
    * Layers backend specific functionality is necessary.
    */
   virtual LayersBackend GetBackendType() = 0;
 };
 
+class ThebesLayer;
+
 /**
  * A Layer represents anything that can be rendered onto a destination
  * surface.
  */
 class THEBES_API Layer {
   NS_INLINE_DECL_REFCOUNTING(Layer)  
 
 public:
@@ -293,16 +311,22 @@ public:
   virtual Layer* GetFirstChild() { return nsnull; }
   const gfx3DMatrix& GetTransform() { return mTransform; }
 
   // This setter and getter can be used anytime.
   void SetUserData(void* aData) { mUserData = aData; }
   void* GetUserData() { return mUserData; }
 
   /**
+   * Dynamic downcast to a Thebes layer. Returns null if this is not
+   * a ThebesLayer.
+   */
+  virtual ThebesLayer* AsThebesLayer() { return nsnull; }
+  
+  /**
    * Only the implementation should call this. This is per-implementation
    * private data. Normally, all layers with a given layer manager
    * use the same type of ImplData.
    */
   void* ImplData() { return mImplData; }
 
   /**
    * Only the implementation should use these methods.
@@ -353,46 +377,17 @@ public:
   /**
    * CONSTRUCTION PHASE ONLY
    * Tell this layer that the content in some region has changed and
    * will need to be repainted. This area is removed from the valid
    * region.
    */
   virtual void InvalidateRegion(const nsIntRegion& aRegion) = 0;
 
-  /**
-   * DRAWING PHASE ONLY
-   * Start drawing into the layer. On return, aRegionToDraw contains the
-   * region that needs to be drawn in by the caller. This would normally
-   * be a subregion of the visible region. Drawing is not necessarily
-   * clipped to aRegionToDraw.
-   * 
-   * No other layer operations are allowed until we call EndDrawing on this
-   * layer. During the drawing phase, all ThebesLayers in the tree must be
-   * drawn in tree order, exactly once each, except for those layers
-   * where it is known that the visible region is empty. (Calling
-   * BeginDrawing on non-visible layers is allowed, but aRegionToDraw
-   * will return empty.)
-   * 
-   * When an empty region is returned in aRegionToDraw, BeginDrawing
-   * may return a null context.
-   * 
-   * The layer system will hold a reference to the returned gfxContext*
-   * until EndDrawing is called. The returned gfxContext must not be used
-   * after EndDrawing is called.
-   */
-  virtual gfxContext* BeginDrawing(nsIntRegion* aRegionToDraw) = 0;
-  /**
-   * DRAWING PHASE ONLY
-   * We've finished drawing into this layer. At this point the caller
-   * must have drawn all of aRegionToDraw that was returned by
-   * BeginDrawing, and we guarantee that buffered contents in the visible
-   * region are now valid.
-   */
-  virtual void EndDrawing() = 0;
+  virtual ThebesLayer* AsThebesLayer() { return this; }
 
 protected:
   ThebesLayer(LayerManager* aManager, void* aImplData)
     : Layer(aManager, aImplData) {}
 };
 
 /**
  * A Layer which other layers render into. It holds references to its

--- a/gfx/layers/Makefile.in
+++ b/gfx/layers/Makefile.in
@@ -37,26 +37,30 @@
 
 DEPTH       = ../..
 topsrcdir   = @top_srcdir@
 srcdir      = @srcdir@
 VPATH       = \
   $(srcdir) \
   $(srcdir)/basic \
   $(srcdir)/opengl \
+  $(srcdir)/d3d9 \
   $(NULL)
 
 include $(DEPTH)/config/autoconf.mk
 
 MODULE         = thebes
 LIBRARY_NAME   = layers
 LIBXUL_LIBRARY = 1
 FORCE_STATIC_LIB = 1
 
 DEFINES += -DIMPL_THEBES
+ifdef MOZ_DEBUG
+DEFINES += -DD3D_DEBUG_INFO
+endif
 
 EXPORTS = \
         BasicLayers.h \
         ImageLayers.h \
         Layers.h \
         LayerManagerOGL.h \
         $(NULL)
 
@@ -65,12 +69,27 @@ CPPSRCS = \
         BasicLayers.cpp \
         LayerManagerOGL.cpp \
         ColorLayerOGL.cpp \
         ThebesLayerOGL.cpp \
         ContainerLayerOGL.cpp \
         ImageLayerOGL.cpp \
 	CanvasLayerOGL.cpp \
         $(NULL)
+ 
+ifeq ($(MOZ_WIDGET_TOOLKIT),windows)
+ifndef WINCE
+EXPORTS += LayerManagerD3D9.h
+
+CPPSRCS += \
+        LayerManagerD3D9.cpp \
+        ThebesLayerD3D9.cpp \
+        ContainerLayerD3D9.cpp \
+        ImageLayerD3D9.cpp \
+        ColorLayerD3D9.cpp \
+        CanvasLayerD3D9.cpp \
+        $(NULL)
+endif
+endif
 
 include $(topsrcdir)/config/rules.mk
 
 CXXFLAGS += $(MOZ_CAIRO_CFLAGS)

--- a/gfx/layers/basic/BasicLayers.cpp
+++ b/gfx/layers/basic/BasicLayers.cpp
@@ -89,17 +89,19 @@ public:
   const nsIntRegion& GetVisibleRegion() { return mVisibleRegion; }
 
   /**
    * Layers that paint themselves, such as ImageLayers, should paint
    * in response to this method call. aContext will already have been
    * set up to account for all the properties of the layer (transform,
    * opacity, etc).
    */
-  virtual void Paint(gfxContext* aContext) {}
+  virtual void Paint(gfxContext* aContext,
+                     LayerManager::DrawThebesLayerCallback aCallback,
+                     void* aCallbackData) {}
 
 protected:
   nsIntRegion mVisibleRegion;
 };
 
 static BasicImplData*
 ToData(Layer* aLayer)
 {
@@ -235,50 +237,38 @@ public:
     mVisibleRegion = aRegion;
   }
   virtual void InvalidateRegion(const nsIntRegion& aRegion)
   {
     NS_ASSERTION(BasicManager()->InConstruction(),
                  "Can only set properties in construction phase");
   }
 
-  virtual gfxContext* BeginDrawing(nsIntRegion* aRegionToDraw);
-  virtual void EndDrawing();
+  virtual void Paint(gfxContext* aContext,
+                     LayerManager::DrawThebesLayerCallback aCallback,
+                     void* aCallbackData);
 
 protected:
   BasicLayerManager* BasicManager()
   {
     return static_cast<BasicLayerManager*>(mManager);
   }
 };
 
-gfxContext*
-BasicThebesLayer::BeginDrawing(nsIntRegion* aRegionToDraw)
+void
+BasicThebesLayer::Paint(gfxContext* aContext,
+                        LayerManager::DrawThebesLayerCallback aCallback,
+                        void* aCallbackData)
 {
-  NS_ASSERTION(BasicManager()->IsBeforeInTree(BasicManager()->GetLastPainted(), this),
-               "Painting layers out of order");
   NS_ASSERTION(BasicManager()->InDrawing(),
                "Can only draw in drawing phase");
   gfxContext* target = BasicManager()->GetTarget();
-  if (!target)
-    return nsnull;
-
-  BasicManager()->AdvancePaintingTo(this);
+  NS_ASSERTION(target, "We shouldn't be called if there's no target");
 
-  *aRegionToDraw = mVisibleRegion;
-  return target;
-}
-
-void
-BasicThebesLayer::EndDrawing()
-{
-  NS_ASSERTION(BasicManager()->InDrawing(),
-               "Can only draw in drawing phase");
-  NS_ASSERTION(BasicManager()->GetLastPainted() == this,
-               "Not currently drawing this layer");
+  aCallback(this, target, mVisibleRegion, aCallbackData);
 }
 
 class BasicImageLayer : public ImageLayer, BasicImplData {
 public:
   BasicImageLayer(BasicLayerManager* aLayerManager) :
     ImageLayer(aLayerManager, static_cast<BasicImplData*>(this))
   {
     MOZ_COUNT_CTOR(BasicImageLayer);
@@ -290,27 +280,31 @@ public:
 
   virtual void SetVisibleRegion(const nsIntRegion& aRegion)
   {
     NS_ASSERTION(BasicManager()->InConstruction(),
                  "Can only set properties in construction phase");
     mVisibleRegion = aRegion;
   }
 
-  virtual void Paint(gfxContext* aContext);
+  virtual void Paint(gfxContext* aContext,
+                     LayerManager::DrawThebesLayerCallback aCallback,
+                     void* aCallbackData);
 
 protected:
   BasicLayerManager* BasicManager()
   {
     return static_cast<BasicLayerManager*>(mManager);
   }
 };
 
 void
-BasicImageLayer::Paint(gfxContext* aContext)
+BasicImageLayer::Paint(gfxContext* aContext,
+                       LayerManager::DrawThebesLayerCallback aCallback,
+                       void* aCallbackData)
 {
   if (!mContainer)
     return;
 
   gfxIntSize size;
   nsRefPtr<gfxASurface> surface = mContainer->GetCurrentAsSurface(&size);
   if (!surface) {
     return;
@@ -360,27 +354,31 @@ public:
 
   virtual void SetVisibleRegion(const nsIntRegion& aRegion)
   {
     NS_ASSERTION(BasicManager()->InConstruction(),
                  "Can only set properties in construction phase");
     mVisibleRegion = aRegion;
   }
 
-  virtual void Paint(gfxContext* aContext);
+  virtual void Paint(gfxContext* aContext,
+                     LayerManager::DrawThebesLayerCallback aCallback,
+                     void* aCallbackData);
 
 protected:
   BasicLayerManager* BasicManager()
   {
     return static_cast<BasicLayerManager*>(mManager);
   }
 };
 
 void
-BasicColorLayer::Paint(gfxContext* aContext)
+BasicColorLayer::Paint(gfxContext* aContext,
+                       LayerManager::DrawThebesLayerCallback aCallback,
+                       void* aCallbackData)
 {
   aContext->SetColor(mColor);
   aContext->Paint();
 }
 
 class BasicCanvasLayer : public CanvasLayer,
                          BasicImplData
 {
@@ -392,17 +390,19 @@ public:
   }
   virtual ~BasicCanvasLayer()
   {
     MOZ_COUNT_DTOR(BasicCanvasLayer);
   }
 
   virtual void Initialize(const Data& aData);
   virtual void Updated(const nsIntRect& aRect);
-  virtual void Paint(gfxContext* aContext);
+  virtual void Paint(gfxContext* aContext,
+                     LayerManager::DrawThebesLayerCallback aCallback,
+                     void* aCallbackData);
 
 protected:
   nsRefPtr<gfxASurface> mSurface;
   nsRefPtr<mozilla::gl::GLContext> mGLContext;
 
   nsIntRect mBounds;
   nsIntRect mUpdatedRect;
 
@@ -479,17 +479,19 @@ BasicCanvasLayer::Updated(const nsIntRec
   }
 
   // sanity
   NS_ASSERTION(mUpdatedRect.IsEmpty() || mBounds.Contains(mUpdatedRect),
                "CanvasLayer: Updated rect bigger than bounds!");
 }
 
 void
-BasicCanvasLayer::Paint(gfxContext* aContext)
+BasicCanvasLayer::Paint(gfxContext* aContext,
+                        LayerManager::DrawThebesLayerCallback aCallback,
+                        void* aCallbackData)
 {
   nsRefPtr<gfxPattern> pat = new gfxPattern(mSurface);
 
   pat->SetFilter(mFilter);
   pat->SetExtend(gfxPattern::EXTEND_PAD);
 
   gfxRect r(0, 0, mBounds.width, mBounds.height);
   gfxMatrix m;
@@ -506,17 +508,17 @@ BasicCanvasLayer::Paint(gfxContext* aCon
   if (mNeedsYFlip) {
     aContext->SetMatrix(m);
   }
 
   mUpdatedRect.Empty();
 }
 
 BasicLayerManager::BasicLayerManager(gfxContext* aContext) :
-  mDefaultTarget(aContext), mLastPainted(nsnull)
+  mDefaultTarget(aContext)
 #ifdef DEBUG
   , mPhase(PHASE_NONE)
 #endif
 {
   MOZ_COUNT_CTOR(BasicLayerManager);
 }
 
 BasicLayerManager::~BasicLayerManager()
@@ -549,34 +551,33 @@ BasicLayerManager::BeginTransactionWithT
   NS_ASSERTION(mPhase == PHASE_NONE, "Nested transactions not allowed");
 #ifdef DEBUG
   mPhase = PHASE_CONSTRUCTION;
 #endif
   mTarget = aTarget;
 }
 
 void
-BasicLayerManager::EndConstruction()
+BasicLayerManager::EndTransaction(DrawThebesLayerCallback aCallback,
+                                  void* aCallbackData)
 {
   NS_ASSERTION(mRoot, "Root not set");
   NS_ASSERTION(mPhase == PHASE_CONSTRUCTION, "Should be in construction phase");
 #ifdef DEBUG
   mPhase = PHASE_DRAWING;
 #endif
-}
 
-void
-BasicLayerManager::EndTransaction()
-{
-  NS_ASSERTION(mPhase == PHASE_DRAWING, "Should be in drawing phase");
+  if (mTarget) {
+    PaintLayer(mRoot, aCallback, aCallbackData);
+    mTarget = nsnull;
+  }
+
 #ifdef DEBUG
   mPhase = PHASE_NONE;
 #endif
-  AdvancePaintingTo(nsnull);
-  mTarget = nsnull;
   // No retained layers supported for now
   mRoot = nsnull;
 }
 
 void
 BasicLayerManager::SetRoot(Layer* aLayer)
 {
   NS_ASSERTION(aLayer, "Root can't be null");
@@ -620,20 +621,24 @@ UseOpaqueSurface(Layer* aLayer)
   // in the container.
   BasicContainerLayer* parent =
     static_cast<BasicContainerLayer*>(aLayer->GetParent());
   return parent && parent->GetFirstChild() == aLayer &&
          UseOpaqueSurface(parent);
 }
 
 void
-BasicLayerManager::BeginPaintingLayer(Layer* aLayer)
+BasicLayerManager::PaintLayer(Layer* aLayer,
+                              DrawThebesLayerCallback aCallback,
+                              void* aCallbackData)
 {
   PRBool needsGroup = NeedsGroup(aLayer);
-  if ((needsGroup || NeedsState(aLayer)) && mTarget) {
+  PRBool needsSaveRestore = needsGroup || NeedsState(aLayer);
+
+ if (needsSaveRestore) {
     mTarget->Save();
 
     if (aLayer->GetClipRect()) {
       const nsIntRect& r = *aLayer->GetClipRect();
       mTarget->NewPath();
       mTarget->Rectangle(gfxRect(r.x, r.y, r.width, r.height), PR_TRUE);
       mTarget->Clip();
     }
@@ -662,76 +667,32 @@ BasicLayerManager::BeginPaintingLayer(La
       mTarget->SetMatrix(currentMatrix);
 
       gfxASurface::gfxContentType type = UseOpaqueSurface(aLayer)
           ? gfxASurface::CONTENT_COLOR : gfxASurface::CONTENT_COLOR_ALPHA;
       mTarget->PushGroup(type);
     }
   }
 
-  mLastPainted = aLayer;
+  ToData(aLayer)->Paint(mTarget, aCallback, aCallbackData);
+  for (Layer* child = aLayer->GetFirstChild(); child;
+       child = child->GetNextSibling()) {
+    PaintLayer(child, aCallback, aCallbackData);
+  }
 
-  // For layers that paint themselves (e.g., BasicImageLayer), paint
-  // them now.
-  ToData(aLayer)->Paint(mTarget);
-}
-
-void
-BasicLayerManager::EndPaintingLayer()
-{
-  PRBool needsGroup = NeedsGroup(mLastPainted);
-  if ((needsGroup || NeedsState(mLastPainted)) && mTarget) {
+  if (needsSaveRestore) {
     if (needsGroup) {
       mTarget->PopGroupToSource();
-      mTarget->Paint(mLastPainted->GetOpacity());
+      mTarget->Paint(aLayer->GetOpacity());
     }
 
     mTarget->Restore();
   }
 }
 
-void
-BasicLayerManager::AdvancePaintingTo(BasicThebesLayer* aLayer)
-{
-  NS_ASSERTION(!aLayer || IsBeforeInTree(mLastPainted, aLayer),
-               "Painting layers out of order");
-
-  // Traverse the layer tree from mLastPainted to aLayer, calling
-  // BeginPaintingLayer and EndPaintingLayer as we enter or exit layers.
-  do {
-    Layer* firstChild;
-    Layer* nextSibling;
-    // Advance mLastPainted one step through the tree in preorder
-    if (!mLastPainted) {
-      // This is the first AdvancePaintingTo call. Start at the root.
-      BeginPaintingLayer(mRoot);
-    } else if ((firstChild = mLastPainted->GetFirstChild()) != nsnull) {
-      // Descend into our first child, if there is one.
-      BeginPaintingLayer(firstChild);
-    } else if ((nextSibling = mLastPainted->GetNextSibling()) != nsnull) {
-      // There are no children to descend into. Leave this layer and
-      // advance to our next sibling, if there is one.
-      EndPaintingLayer();
-      BeginPaintingLayer(nextSibling);
-    } else {
-      // There are no children to descend into and we have no next sibling.
-      // Exit layers until we find a layer which has a next sibling
-      // (or we exit the root).
-      do {
-        EndPaintingLayer();
-        mLastPainted = mLastPainted->GetParent();
-      } while (mLastPainted && !mLastPainted->GetNextSibling());
-      if (mLastPainted) {
-        EndPaintingLayer();
-        BeginPaintingLayer(mLastPainted->GetNextSibling());
-      }
-    }
-  } while (mLastPainted != aLayer);
-}
-
 already_AddRefed<ThebesLayer>
 BasicLayerManager::CreateThebesLayer()
 {
   NS_ASSERTION(InConstruction(), "Only allowed in construction phase");
   nsRefPtr<ThebesLayer> layer = new BasicThebesLayer(this);
   return layer.forget();
 }
 
@@ -762,59 +723,10 @@ BasicLayerManager::CreateColorLayer()
 already_AddRefed<CanvasLayer>
 BasicLayerManager::CreateCanvasLayer()
 {
   NS_ASSERTION(InConstruction(), "Only allowed in construction phase");
   nsRefPtr<CanvasLayer> layer = new BasicCanvasLayer(this);
   return layer.forget();
 }
 
-#ifdef DEBUG
-static void
-AppendAncestors(Layer* aLayer, nsTArray<Layer*>* aAncestors)
-{
-  while (aLayer) {
-    aAncestors->AppendElement(aLayer);
-    aLayer = aLayer->GetParent();
-  }
-}
-
-PRBool
-BasicLayerManager::IsBeforeInTree(Layer* aBefore, Layer* aLayer)
-{
-  if (!aBefore) {
-    return PR_TRUE;
-  }
-  nsAutoTArray<Layer*,8> beforeAncestors, afterAncestors;
-  AppendAncestors(aBefore, &beforeAncestors);
-  AppendAncestors(aLayer, &afterAncestors);
-  PRInt32 beforeIndex = beforeAncestors.Length() - 1;
-  PRInt32 afterIndex = afterAncestors.Length() - 1;
-  NS_ASSERTION(beforeAncestors[beforeIndex] == mRoot, "aBefore not in tree?");
-  NS_ASSERTION(afterAncestors[afterIndex] == mRoot, "aLayer not in tree?");
-  --beforeIndex;
-  --afterIndex;
-  while (beforeIndex >= 0 && afterIndex >= 0) {
-    if (beforeAncestors[beforeIndex] != afterAncestors[afterIndex]) {
-      BasicContainerLayer* parent =
-        static_cast<BasicContainerLayer*>(beforeAncestors[beforeIndex + 1]);
-      for (Layer* child = parent->GetFirstChild();
-           child != afterAncestors[afterIndex];
-           child = child->GetNextSibling()) {
-        if (child == beforeAncestors[beforeIndex]) {
-          return PR_TRUE;
-        }
-      }
-      return PR_FALSE;
-    }
-    --beforeIndex;
-    --afterIndex;
-  }
-  if (afterIndex > 0) {
-    // aBefore is an ancestor of aLayer, so it's before aLayer in preorder
-    return PR_TRUE;
-  }
-  return PR_FALSE;
-}
-#endif
-
 }
 }

--- a/gfx/layers/basic/BasicLayers.h
+++ b/gfx/layers/basic/BasicLayers.h
@@ -73,62 +73,46 @@ public:
   /**
    * Set the default target context that will be used when BeginTransaction
    * is called. This can only be called outside a transaction.
    */
   void SetDefaultTarget(gfxContext* aContext);
 
   virtual void BeginTransaction();
   virtual void BeginTransactionWithTarget(gfxContext* aTarget);
-  virtual void EndConstruction();
-  virtual void EndTransaction();
+  virtual void EndTransaction(DrawThebesLayerCallback aCallback,
+                              void* aCallbackData);
 
   virtual void SetRoot(Layer* aLayer);
 
   virtual already_AddRefed<ThebesLayer> CreateThebesLayer();
   virtual already_AddRefed<ContainerLayer> CreateContainerLayer();
   virtual already_AddRefed<ImageLayer> CreateImageLayer();
   virtual already_AddRefed<CanvasLayer> CreateCanvasLayer();
   virtual already_AddRefed<ImageContainer> CreateImageContainer();
   virtual already_AddRefed<ColorLayer> CreateColorLayer();
   virtual LayersBackend GetBackendType() { return LAYERS_BASIC; }
 
 #ifdef DEBUG
   PRBool InConstruction() { return mPhase == PHASE_CONSTRUCTION; }
   PRBool InDrawing() { return mPhase == PHASE_DRAWING; }
-  PRBool IsBeforeInTree(Layer* aBefore, Layer* aLayer);
 #endif
-  // Prepares mTarget for painting into aLayer. Layers are painted
-  // in tree order, so this method essentially traverses the layer tree
-  // in preorder from mLastPainted to aLayer, doing whatever's needed
-  // as we exit container layers and enter new container layers, and
-  // drawing any non-ThebesLayers we encounter.
-  void AdvancePaintingTo(BasicThebesLayer* aLayer);
-  Layer* GetLastPainted() { return mLastPainted; }
   gfxContext* GetTarget() { return mTarget; }
 
 private:
-  // This gets called when we start painting aLayer. It can change
-  // the state of mTarget by saving state, setting clipping and/or
-  // pushing a group.
-  void BeginPaintingLayer(Layer* aLayer);
-  // This gets called when we finish painting aLayer. It can change
-  // the state of mTarget by popping a group and/or restoring the state.
-  void EndPaintingLayer();
+  // Paints aLayer to mTarget.
+  void PaintLayer(Layer* aLayer,
+                  DrawThebesLayerCallback aCallback,
+                  void* aCallbackData);
 
   nsRefPtr<Layer> mRoot;
   // The default context for BeginTransaction.
   nsRefPtr<gfxContext> mDefaultTarget;
-  // The context to draw into. This is always the context that
-  // our ThebesLayers will return.
+  // The context to draw into.
   nsRefPtr<gfxContext> mTarget;
-  // The most recently painted layer during the drawing phase of
-  // a transaction, or null if no layer has been painted in this
-  // transaction.
-  Layer* mLastPainted;
 
 #ifdef DEBUG
   enum TransactionPhase { PHASE_NONE, PHASE_CONSTRUCTION, PHASE_DRAWING };
   TransactionPhase mPhase;
 #endif
 };
 
 }

new file mode 100644
--- /dev/null
+++ b/gfx/layers/d3d9/CanvasLayerD3D9.cpp
@@ -0,0 +1,231 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Corporation code.
+ *
+ * The Initial Developer of the Original Code is Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Vladimir Vukicevic <vladimir@pobox.com>
+ *   Bas Schouten <bschouten@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "CanvasLayerD3D9.h"
+
+#include "gfxImageSurface.h"
+#include "gfxWindowsSurface.h"
+
+namespace mozilla {
+namespace layers {
+
+CanvasLayerD3D9::~CanvasLayerD3D9()
+{
+}
+
+void
+CanvasLayerD3D9::Initialize(const Data& aData)
+{
+  NS_ASSERTION(mSurface == nsnull, "BasicCanvasLayer::Initialize called twice!");
+
+  if (aData.mSurface) {
+    mSurface = aData.mSurface;
+    NS_ASSERTION(aData.mGLContext == nsnull,
+                 "CanvasLayer can't have both surface and GLContext");
+    mNeedsYFlip = PR_FALSE;
+  } else if (aData.mGLContext) {
+    mGLContext = aData.mGLContext;
+    mGLBufferIsPremultiplied = aData.mGLBufferIsPremultiplied;
+    mNeedsYFlip = PR_TRUE;
+  } else {
+    NS_ERROR("CanvasLayer created without mSurface or mGLContext?");
+  }
+
+  mBounds.SetRect(0, 0, aData.mSize.width, aData.mSize.height);
+
+  device()->CreateTexture(mBounds.width, mBounds.height, 1, 0,
+                          D3DFMT_A8R8G8B8, D3DPOOL_MANAGED,
+                          getter_AddRefs(mTexture), NULL);
+}
+
+void
+CanvasLayerD3D9::Updated(const nsIntRect& aRect)
+{
+  if (!mTexture) {
+    NS_WARNING("CanvasLayerD3D9::Updated called but no texture present!");
+    return;
+  }
+
+  if (mGLContext) {
+    // WebGL reads entire surface.
+    D3DLOCKED_RECT r;
+    mTexture->LockRect(0, &r, NULL, 0);
+
+    PRUint8 *destination;
+    if (r.Pitch != mBounds.width * 4) {
+      destination = new PRUint8[mBounds.width * mBounds.height * 4];
+    } else {
+      destination = (PRUint8*)r.pBits;
+    }
+
+    // We have to flush to ensure that any buffered GL operations are
+    // in the framebuffer before we read.
+    mGLContext->fFlush();
+
+    // For simplicity, we read the entire framebuffer for now -- in
+    // the future we should use aRect, though with WebGL we don't
+    // have an easy way to generate one.
+    mGLContext->fReadPixels(0, 0, mBounds.width, mBounds.height,
+                            LOCAL_GL_BGRA, LOCAL_GL_UNSIGNED_INT_8_8_8_8_REV,
+                            destination);
+
+    if (r.Pitch != mBounds.width * 4) {
+      for (int y = 0; y < mBounds.height; y++) {
+        memcpy((PRUint8*)r.pBits + r.Pitch * y,
+               destination + mBounds.width * 4 * y,
+               mBounds.width * 4);
+      }
+      delete [] destination;
+    }
+    mTexture->UnlockRect(0);
+  } else if (mSurface) {
+    RECT r;
+    r.left = aRect.x;
+    r.top = aRect.y;
+    r.right = aRect.XMost();
+    r.bottom = aRect.YMost();
+
+    D3DLOCKED_RECT lockedRect;
+    mTexture->LockRect(0, &lockedRect, &r, 0);
+
+    PRUint8 *startBits;
+    PRUint32 sourceStride;
+
+    nsRefPtr<gfxImageSurface> sourceSurface;
+
+    if (mSurface->GetType() == gfxASurface::SurfaceTypeWin32) {
+      sourceSurface = static_cast<gfxWindowsSurface*>(mSurface.get())->GetImageSurface();
+      startBits = sourceSurface->Data() + sourceSurface->Stride() * aRect.y +
+                  aRect.x * 4;
+      sourceStride = sourceSurface->Stride();
+    } else if (mSurface->GetType() == gfxASurface::SurfaceTypeImage) {
+      sourceSurface = static_cast<gfxImageSurface*>(sourceSurface.get());
+      if (sourceSurface->Format() != gfxASurface::ImageFormatARGB32 &&
+          sourceSurface->Format() != gfxASurface::ImageFormatRGB24)
+      {
+        mTexture->UnlockRect(0);
+        return;
+      }
+      startBits = sourceSurface->Data() + sourceSurface->Stride() * aRect.y +
+                  aRect.x * 4;
+      sourceStride = sourceSurface->Stride();
+    } else {
+      sourceSurface = new gfxImageSurface(gfxIntSize(aRect.width, aRect.height),
+                                          gfxASurface::ImageFormatARGB32);
+      nsRefPtr<gfxContext> ctx = new gfxContext(sourceSurface);
+      ctx->Translate(gfxPoint(-aRect.x, -aRect.y));
+      ctx->SetOperator(gfxContext::OPERATOR_SOURCE);
+      ctx->SetSource(sourceSurface);
+      ctx->Paint();
+      startBits = sourceSurface->Data();
+      sourceStride = sourceSurface->Stride();
+    }
+
+    for (int y = 0; y < aRect.height; y++) {
+      memcpy((PRUint8*)lockedRect.pBits + lockedRect.Pitch * y,
+             startBits + sourceStride * y,
+             aRect.width * 4);
+    }
+
+    mTexture->UnlockRect(0);    
+  }
+}
+
+LayerD3D9::LayerType
+CanvasLayerD3D9::GetType()
+{
+  return TYPE_CANVAS;
+}
+
+Layer*
+CanvasLayerD3D9::GetLayer()
+{
+  return this;
+}
+
+void
+CanvasLayerD3D9::RenderLayer()
+{
+  float quadTransform[4][4];
+  /*
+   * Matrix to transform the <0.0,0.0>, <1.0,1.0> quad to the correct position
+   * and size. To get pixel perfect mapping we offset the quad half a pixel
+   * to the top-left. We also flip the Y axis here, note we can only do this
+   * because we are in CULL_NONE mode!
+   * 
+   * See: http://msdn.microsoft.com/en-us/library/bb219690%28VS.85%29.aspx
+   */
+  memset(&quadTransform, 0, sizeof(quadTransform));
+  quadTransform[0][0] = (float)mBounds.width;
+  if (mNeedsYFlip) {
+    quadTransform[1][1] = (float)-mBounds.height;
+    quadTransform[3][1] = (float)mBounds.height - 0.5f;
+  } else {
+    quadTransform[1][1] = (float)mBounds.height;
+    quadTransform[3][1] = -0.5f;
+  }
+  quadTransform[2][2] = 1.0f;
+  quadTransform[3][0] = -0.5f;
+  quadTransform[3][3] = 1.0f;
+
+  device()->SetVertexShaderConstantF(0, &quadTransform[0][0], 4);
+
+  device()->SetVertexShaderConstantF(4, &mTransform._11, 4);
+
+  float opacity[4];
+  /*
+   * We always upload a 4 component float, but the shader will use only the
+   * first component since it's declared as a 'float'.
+   */
+  opacity[0] = GetOpacity();
+  device()->SetPixelShaderConstantF(0, opacity, 1);
+
+  mD3DManager->SetShaderMode(LayerManagerD3D9::RGBLAYER);
+
+  if (!mGLBufferIsPremultiplied) {
+    device()->SetRenderState(D3DRS_SRCBLEND, D3DBLEND_SRCALPHA);
+  }
+  device()->SetTexture(0, mTexture);
+  device()->DrawPrimitive(D3DPT_TRIANGLESTRIP, 0, 2);
+  if (!mGLBufferIsPremultiplied) {
+    device()->SetRenderState(D3DRS_SRCBLEND, D3DBLEND_ONE);
+  }
+}
+
+} /* namespace layers */
+} /* namespace mozilla */
\ No newline at end of file

new file mode 100644
--- /dev/null
+++ b/gfx/layers/d3d9/CanvasLayerD3D9.h
@@ -0,0 +1,90 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Corporation code.
+ *
+ * The Initial Developer of the Original Code is Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Vladimir Vukicevic <vladimir@pobox.com>
+ *   Bas Schouten <bschouten@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef GFX_CANVASLAYEROGL_H
+#define GFX_CANVASLAYEROGL_H
+
+#include "LayerManagerD3D9.h"
+#include "GLContext.h"
+#include "gfxASurface.h"
+
+namespace mozilla {
+namespace layers {
+
+class THEBES_API CanvasLayerD3D9 :
+  public CanvasLayer,
+  public LayerD3D9
+{
+public:
+  CanvasLayerD3D9(LayerManagerD3D9 *aManager)
+    : CanvasLayer(aManager, NULL),
+      LayerD3D9(aManager),
+      mTexture(0),
+      mGLBufferIsPremultiplied(PR_FALSE),
+      mNeedsYFlip(PR_FALSE)
+  { 
+      mImplData = static_cast<LayerD3D9*>(this);
+  }
+
+  ~CanvasLayerD3D9();
+
+  // CanvasLayer implementation
+  virtual void Initialize(const Data& aData);
+  virtual void Updated(const nsIntRect& aRect);
+
+  // LayerD3D9 implementation
+  virtual LayerType GetType();
+  virtual Layer* GetLayer();
+  virtual void RenderLayer();
+
+protected:
+  typedef mozilla::gl::GLContext GLContext;
+
+  nsRefPtr<gfxASurface> mSurface;
+  nsRefPtr<GLContext> mGLContext;
+  nsRefPtr<IDirect3DTexture9> mTexture;
+
+  nsIntRect mBounds;
+
+  PRPackedBool mGLBufferIsPremultiplied;
+  PRPackedBool mNeedsYFlip;
+};
+
+} /* layers */
+} /* mozilla */
+#endif /* GFX_CANVASLAYERD3D9_H */

new file mode 100644
--- /dev/null
+++ b/gfx/layers/d3d9/ColorLayerD3D9.cpp
@@ -0,0 +1,91 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Corporation code.
+ *
+ * The Initial Developer of the Original Code is Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2009
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Robert O'Callahan <robert@ocallahan.org>
+ *   Bas Schouten <bschouten@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "ColorLayerD3D9.h"
+
+namespace mozilla {
+namespace layers {
+
+LayerD3D9::LayerType
+ColorLayerD3D9::GetType()
+{
+  return TYPE_COLOR;
+}
+
+Layer*
+ColorLayerD3D9::GetLayer()
+{
+  return this;
+}
+
+void
+ColorLayerD3D9::RenderLayer()
+{
+  // XXX we might be able to improve performance by using 
+  // IDirect3DDevice9::Clear
+
+  float quadTransform[4][4];
+  nsIntRect visibleRect = mVisibleRegion.GetBounds();
+  // Transform the quad to the size of the visible area.
+  memset(&quadTransform, 0, sizeof(quadTransform));
+  quadTransform[0][0] = (float)visibleRect.width;
+  quadTransform[1][1] = (float)visibleRect.height;
+  quadTransform[2][2] = 1.0f;
+  quadTransform[3][0] = (float)visibleRect.x;
+  quadTransform[3][1] = (float)visibleRect.y;
+  quadTransform[3][3] = 1.0f;
+
+  device()->SetVertexShaderConstantF(0, &quadTransform[0][0], 4);
+  device()->SetVertexShaderConstantF(4, &mTransform._11, 4);
+
+  float color[4];
+  // color is premultiplied, so we need to adjust all channels
+  color[0] = (float)(mColor.r * GetOpacity());
+  color[1] = (float)(mColor.g * GetOpacity());
+  color[2] = (float)(mColor.b * GetOpacity());
+  color[3] = (float)(mColor.a * GetOpacity());
+
+  device()->SetPixelShaderConstantF(0, color, 1);
+
+  mD3DManager->SetShaderMode(LayerManagerD3D9::SOLIDCOLORLAYER);
+
+  device()->DrawPrimitive(D3DPT_TRIANGLESTRIP, 0, 2);
+}
+
+} /* layers */
+} /* mozilla */

new file mode 100644
--- /dev/null
+++ b/gfx/layers/d3d9/ColorLayerD3D9.h
@@ -0,0 +1,74 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Corporation code.
+ *
+ * The Initial Developer of the Original Code is Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2009
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Robert O'Callahan <robert@ocallahan.org>
+ *   Bas Schouten <bschouten@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef GFX_COLORLAYERD3D9_H
+#define GFX_COLORLAYERD3D9_H
+
+#include "LayerManagerD3D9.h"
+
+namespace mozilla {
+namespace layers {
+
+class THEBES_API ColorLayerD3D9 : public ColorLayer,
+                                 public LayerD3D9
+{
+public:
+  ColorLayerD3D9(LayerManagerD3D9 *aManager)
+    : ColorLayer(aManager, NULL)
+    , LayerD3D9(aManager)
+  { 
+    mImplData = static_cast<LayerD3D9*>(this);
+  }
+
+  virtual void SetVisibleRegion(const nsIntRegion& aRegion) { mVisibleRegion = aRegion; }
+
+  // LayerD3D9 Implementation
+  virtual LayerType GetType();
+
+  virtual Layer* GetLayer();
+
+  virtual void RenderLayer();
+
+protected:
+  nsIntRegion mVisibleRegion;
+};
+
+} /* layers */
+} /* mozilla */
+
+#endif /* GFX_COLORLAYERD3D9_H */