--- a/accessible/src/base/nsAccessibilityAtomList.h
+++ b/accessible/src/base/nsAccessibilityAtomList.h
@@ -59,17 +59,16 @@
 ACCESSIBILITY_ATOM(button, "button")
 ACCESSIBILITY_ATOM(checkbox, "checkbox")
 ACCESSIBILITY_ATOM(col, "col")
 ACCESSIBILITY_ATOM(_empty, "")
 ACCESSIBILITY_ATOM(_false, "false")
 ACCESSIBILITY_ATOM(image, "image")
 ACCESSIBILITY_ATOM(menu, "menu")
 ACCESSIBILITY_ATOM(menuButton, "menu-button")
-ACCESSIBILITY_ATOM(menugenerated, "menugenerated")
 ACCESSIBILITY_ATOM(multiple, "multiple")
 ACCESSIBILITY_ATOM(open, "open")
 ACCESSIBILITY_ATOM(password, "password")
 ACCESSIBILITY_ATOM(radio, "radio")
 ACCESSIBILITY_ATOM(reset, "reset")
 ACCESSIBILITY_ATOM(row, "row")
 ACCESSIBILITY_ATOM(submit, "submit")
 ACCESSIBILITY_ATOM(_true, "true")

--- a/accessible/src/base/nsCoreUtils.cpp
+++ b/accessible/src/base/nsCoreUtils.cpp
@@ -756,57 +756,16 @@ nsCoreUtils::IsColumnHidden(nsITreeColum
 {
   nsCOMPtr<nsIDOMElement> element;
   aColumn->GetElement(getter_AddRefs(element));
   nsCOMPtr<nsIContent> content = do_QueryInterface(element);
   return content->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::hidden,
                               nsAccessibilityAtoms::_true, eCaseMatters);
 }
 
-void
-nsCoreUtils::GeneratePopupTree(nsIContent *aContent, PRBool aIsAnon)
-{
-  // Set menugenerated="true" on the menupopup node to generate the sub-menu
-  // items if they have not been generated.
-
-  nsCOMPtr<nsIDOMNodeList> list;
-  if (aIsAnon) {    
-    nsIDocument* document = aContent->GetCurrentDoc();
-    if (document)
-      document->GetXBLChildNodesFor(aContent, getter_AddRefs(list));
-
-  } else {
-    list = aContent->GetChildNodesList();
-  }
-
-  PRUint32 length = 0;
-  if (!list || NS_FAILED(list->GetLength(&length)))
-    return;
-
-  for (PRUint32 idx = 0; idx < length; idx++) {
-    nsCOMPtr<nsIDOMNode> childNode;
-    list->Item(idx, getter_AddRefs(childNode));
-    nsCOMPtr<nsIContent> child(do_QueryInterface(childNode));
-
-    PRBool isPopup = child->NodeInfo()->Equals(nsAccessibilityAtoms::menupopup,
-                                               kNameSpaceID_XUL) ||
-                     child->NodeInfo()->Equals(nsAccessibilityAtoms::panel,
-                                               kNameSpaceID_XUL);
-    if (isPopup && !child->AttrValueIs(kNameSpaceID_None,
-                                       nsAccessibilityAtoms::menugenerated,
-                                       nsAccessibilityAtoms::_true,
-                                       eCaseMatters)) {
-
-      child->SetAttr(kNameSpaceID_None, nsAccessibilityAtoms::menugenerated,
-                     NS_LITERAL_STRING("true"), PR_TRUE);
-      return;
-    }
-  }
-}
-
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessibleDOMStringList
 ////////////////////////////////////////////////////////////////////////////////
 
 NS_IMPL_ISUPPORTS1(nsAccessibleDOMStringList, nsIDOMDOMStringList)
 
 NS_IMETHODIMP

--- a/accessible/src/base/nsCoreUtils.h
+++ b/accessible/src/base/nsCoreUtils.h
@@ -362,26 +362,16 @@ public:
   /**
    * Return true if the given node is table header element.
    */
   static PRBool IsHTMLTableHeader(nsIContent *aContent)
   {
     return aContent->NodeInfo()->Equals(nsAccessibilityAtoms::th) ||
       aContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::scope);
   }
-
-  /**
-   * Generates frames for popup subtree.
-   *
-   * @param aContent [in] DOM node containing the menupopup element as a child
-   * @param aIsAnon  [in] specifies whether popup should be searched inside of
-   *                  anonymous or explicit content
-   */
-  static void GeneratePopupTree(nsIContent *aContent,
-                                PRBool aIsAnon = PR_FALSE);
 };
 
 
 /**
  * nsIDOMDOMStringList implementation.
  */
 class nsAccessibleDOMStringList : public nsIDOMDOMStringList
 {

--- a/accessible/src/base/nsTextAttrs.cpp
+++ b/accessible/src/base/nsTextAttrs.cpp
@@ -39,17 +39,17 @@
 #include "nsTextAttrs.h"
 
 #include "nsAccUtils.h"
 #include "nsCoreUtils.h"
 #include "nsHyperTextAccessibleWrap.h"
 
 #include "gfxFont.h"
 #include "gfxUserFontSet.h"
-#include "nsIThebesFontMetrics.h"
+#include "nsFontMetrics.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 // Constants and structures
 
 /**
  * Item of the gCSSTextAttrsMap map.
  */
 struct nsCSSTextAttrMapItem
@@ -527,23 +527,22 @@ nsFontWeightTextAttr::GetFontWeight(nsIF
 {
   // nsFont::width isn't suitable here because it's necessary to expose real
   // value of font weight (used font might not have some font weight values).
   nsStyleFont* styleFont =
     (nsStyleFont*)(aFrame->GetStyleDataExternal(eStyleStruct_Font));
 
   gfxUserFontSet *fs = aFrame->PresContext()->GetUserFontSet();
 
-  nsCOMPtr<nsIFontMetrics> fm;
+  nsRefPtr<nsFontMetrics> fm;
   aFrame->PresContext()->DeviceContext()->
     GetMetricsFor(styleFont->mFont, aFrame->GetStyleVisibility()->mLanguage,
                   fs, *getter_AddRefs(fm));
 
-  nsCOMPtr<nsIThebesFontMetrics> tfm = do_QueryInterface(fm);
-  gfxFontGroup *fontGroup = tfm->GetThebesFontGroup();
+  gfxFontGroup *fontGroup = fm->GetThebesFontGroup();
   gfxFont *font = fontGroup->GetFontAt(0);
 
   // When there doesn't exist a bold font in the family and so the rendering of
   // a non-bold font face is changed so that the user sees what looks like a
   // bold font, i.e. synthetic bolding is used. IsSyntheticBold method is only
   // needed on Mac, but it is "safe" to use on all platforms.  (For non-Mac
   // platforms it always return false.)
   if (font->IsSyntheticBold())

--- a/accessible/src/html/nsHyperTextAccessible.cpp
+++ b/accessible/src/html/nsHyperTextAccessible.cpp
@@ -53,17 +53,16 @@
 #include "nsPIDOMWindow.h"        
 #include "nsIDOMDocumentView.h"
 #include "nsIDOMRange.h"
 #include "nsIDOMNSRange.h"
 #include "nsIDOMWindowInternal.h"
 #include "nsIDOMXULDocument.h"
 #include "nsIEditingSession.h"
 #include "nsIEditor.h"
-#include "nsIFontMetrics.h"
 #include "nsIFrame.h"
 #include "nsFrameSelection.h"
 #include "nsILineIterator.h"
 #include "nsIInterfaceRequestorUtils.h"
 #include "nsIPlaintextEditor.h"
 #include "nsIScrollableFrame.h"
 #include "nsISelection2.h"
 #include "nsISelectionPrivate.h"

--- a/accessible/src/msaa/nsTextAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsTextAccessibleWrap.cpp
@@ -37,17 +37,17 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsTextAccessibleWrap.h"
 #include "ISimpleDOMText_i.c"
 
 #include "nsCoreUtils.h"
 #include "nsDocAccessible.h"
 #include "nsIFrame.h"
-#include "nsIThebesFontMetrics.h"
+#include "nsFontMetrics.h"
 #include "nsPresContext.h"
 
 #include "gfxFont.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsTextAccessibleWrap Accessible
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -250,26 +250,24 @@ STDMETHODIMP nsTextAccessibleWrap::get_f
 __try {
   *aFontFamily = NULL;
 
   nsIFrame* frame = GetFrame();
   if (!frame) {
     return E_FAIL;
   }
 
-  nsCOMPtr<nsIFontMetrics> fm;
+  nsRefPtr<nsFontMetrics> fm;
   frame->PresContext()->DeviceContext()->
     GetMetricsFor(frame->GetStyleFont()->mFont,
                   frame->GetStyleVisibility()->mLanguage,
                   frame->PresContext()->GetUserFontSet(),
                   *getter_AddRefs(fm));
 
-  nsCOMPtr<nsIThebesFontMetrics> tfm = do_QueryInterface(fm);
-  const nsString& name = tfm->GetThebesFontGroup()->GetFontAt(0)->GetName();
-
+  const nsString& name = fm->GetThebesFontGroup()->GetFontAt(0)->GetName();
   if (name.IsEmpty())
     return S_FALSE;
 
   *aFontFamily = ::SysAllocStringLen(name.get(), name.Length());
   if (!*aFontFamily)
     return E_OUTOFMEMORY;
 
 } __except(FilterA11yExceptions(::GetExceptionCode(),

--- a/accessible/src/xul/nsXULColorPickerAccessible.cpp
+++ b/accessible/src/xul/nsXULColorPickerAccessible.cpp
@@ -112,29 +112,16 @@ nsXULColorPickerTileAccessible::NativeSt
 
 nsXULColorPickerAccessible::
   nsXULColorPickerAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
   nsXULColorPickerTileAccessible(aContent, aShell)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
-// nsXULColorPickerAccessible: nsAccessNode
-
-PRBool
-nsXULColorPickerAccessible::Init()
-{
-  if (!nsXULColorPickerTileAccessible::Init())
-    return PR_FALSE;
-
-  nsCoreUtils::GeneratePopupTree(mContent, PR_TRUE);
-  return PR_TRUE;
-}
-
-////////////////////////////////////////////////////////////////////////////////
 // nsXULColorPickerAccessible: nsAccessible
 
 PRUint64
 nsXULColorPickerAccessible::NativeState()
 {
   // Possible states: focused, focusable, unavailable(disabled).
 
   // get focus and disable status from base class

--- a/accessible/src/xul/nsXULColorPickerAccessible.h
+++ b/accessible/src/xul/nsXULColorPickerAccessible.h
@@ -63,19 +63,16 @@ public:
 /**
  * Used for colorpicker button (xul:colorpicker@type="button").
  */
 class nsXULColorPickerAccessible : public nsXULColorPickerTileAccessible
 {
 public:
   nsXULColorPickerAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
-  // nsAccessNode
-  virtual PRBool Init();
-
   // nsAccessible
   virtual PRUint32 NativeRole();
   virtual PRUint64 NativeState();
 
 protected:
 
   // nsAccessible
   virtual void CacheChildren();

--- a/accessible/src/xul/nsXULComboboxAccessible.cpp
+++ b/accessible/src/xul/nsXULComboboxAccessible.cpp
@@ -52,26 +52,16 @@
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULComboboxAccessible::
   nsXULComboboxAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
   nsAccessibleWrap(aContent, aShell)
 {
 }
 
-PRBool
-nsXULComboboxAccessible::Init()
-{
-  if (!nsAccessibleWrap::Init())
-    return PR_FALSE;
-
-  nsCoreUtils::GeneratePopupTree(mContent);
-  return PR_TRUE;
-}
-
 PRUint32
 nsXULComboboxAccessible::NativeRole()
 {
   if (mContent->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
                             nsAccessibilityAtoms::autocomplete, eIgnoreCase))
     return nsIAccessibleRole::ROLE_AUTOCOMPLETE;
   return nsIAccessibleRole::ROLE_COMBOBOX;
 }

--- a/accessible/src/xul/nsXULComboboxAccessible.h
+++ b/accessible/src/xul/nsXULComboboxAccessible.h
@@ -55,18 +55,15 @@ public:
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& aValue);
   NS_IMETHOD GetDescription(nsAString& aDescription);
   NS_IMETHOD DoAction(PRUint8 aIndex);
   NS_IMETHOD GetNumActions(PRUint8 *aNumActions);
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
 
-  // nsAccessNode
-  virtual PRBool Init();
-
   // nsAccessible
   virtual PRUint32 NativeRole();
   virtual PRUint64 NativeState();
   virtual PRBool GetAllowsAnonChildAccessibles();
 };
 
 #endif

--- a/accessible/src/xul/nsXULFormControlAccessible.cpp
+++ b/accessible/src/xul/nsXULFormControlAccessible.cpp
@@ -105,31 +105,16 @@ nsXULButtonAccessible::DoAction(PRUint8 
   if (aIndex != 0)
     return NS_ERROR_INVALID_ARG;
 
   DoCommand();
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
-// nsXULButtonAccessible: nsAccessNode
-
-PRBool
-nsXULButtonAccessible::Init()
-{
-  if (!nsAccessibleWrap::Init())
-    return PR_FALSE;
-
-  if (ContainsMenu())
-    nsCoreUtils::GeneratePopupTree(mContent);
-
-  return PR_TRUE;
-}
-
-////////////////////////////////////////////////////////////////////////////////
 // nsXULButtonAccessible: nsAccessible
 
 PRUint32
 nsXULButtonAccessible::NativeRole()
 {
   return nsIAccessibleRole::ROLE_PUSHBUTTON;
 }
 

--- a/accessible/src/xul/nsXULFormControlAccessible.h
+++ b/accessible/src/xul/nsXULFormControlAccessible.h
@@ -61,19 +61,16 @@ public:
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetNumActions(PRUint8 *_retval);
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
-  // nsAccessNode
-  virtual PRBool Init();
-
   // nsAccessible
   virtual PRUint32 NativeRole();
   virtual PRUint64 NativeState();
 
 protected:
 
   // nsAccessible
   virtual void CacheChildren();

--- a/accessible/src/xul/nsXULMenuAccessible.cpp
+++ b/accessible/src/xul/nsXULMenuAccessible.cpp
@@ -275,26 +275,16 @@ nsXULSelectableAccessible::SelectAll()
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULMenuitemAccessible::
   nsXULMenuitemAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
   nsAccessibleWrap(aContent, aShell)
 {
 }
 
-PRBool
-nsXULMenuitemAccessible::Init()
-{
-  if (!nsAccessibleWrap::Init())
-    return PR_FALSE;
-
-  nsCoreUtils::GeneratePopupTree(mContent);
-  return PR_TRUE;
-}
-
 PRUint64
 nsXULMenuitemAccessible::NativeState()
 {
   PRUint64 state = nsAccessible::NativeState();
 
   // Focused?
   if (mContent->HasAttr(kNameSpaceID_None,
                         nsAccessibilityAtoms::_moz_menuactive))

--- a/accessible/src/xul/nsXULMenuAccessible.h
+++ b/accessible/src/xul/nsXULMenuAccessible.h
@@ -84,19 +84,16 @@ public:
   // nsIAccessible
   NS_IMETHOD GetDescription(nsAString& aDescription);
   NS_IMETHOD GetKeyboardShortcut(nsAString& _retval);
   NS_IMETHOD GetDefaultKeyBinding(nsAString& aKeyBinding);
   NS_IMETHOD DoAction(PRUint8 index);
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD GetNumActions(PRUint8 *_retval);
 
-  // nsAccessNode
-  virtual PRBool Init();
-
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual PRUint32 NativeRole();
   virtual PRUint64 NativeState();
   virtual PRInt32 GetLevelInternal();
   virtual void GetPositionAndSizeInternal(PRInt32 *aPosInSet,
                                           PRInt32 *aSetSize);
 

--- a/accessible/tests/mochitest/actions/test_general.xul
+++ b/accessible/tests/mochitest/actions/test_general.xul
@@ -24,17 +24,22 @@
   <script type="application/javascript">
   <![CDATA[
     function doTest()
     {
       var actionsArray = [
         {
           ID: "menu",
           actionName: "click",
-          events: CLICK_EVENTS
+          events: CLICK_EVENTS,
+          // Wait for focus event, it guarantees us the submenu tree is created,
+          // that's necessary for next test.
+          eventSeq: [
+            new invokerChecker(EVENT_FOCUS, getNode("menu"))
+          ]
         },
         {
           ID: "submenu",
           actionName: "click",
           events: CLICK_EVENTS
         },
         {
           ID: "menuitem",

--- a/accessible/tests/mochitest/tree/Makefile.in
+++ b/accessible/tests/mochitest/tree/Makefile.in
@@ -46,31 +46,29 @@ include $(DEPTH)/config/autoconf.mk
 include $(topsrcdir)/config/rules.mk
 
 _TEST_FILES =\
 		dockids.html \
 	$(warning test_applicationacc.xul temporarily disabled, see bug 561508) \
 		test_aria_globals.html \
 		test_aria_imgmap.html \
 		test_button.xul \
-		test_colorpicker.xul \
 		test_combobox.xul \
 		test_cssoverflow.html \
 		test_dochierarchy.html \
 		test_dockids.html \
 		test_filectrl.html \
 		test_formctrl.html \
 		test_formctrl.xul \
 		test_gencontent.html \
 		test_groupbox.xul \
 		test_iframe.html \
 		test_img.html \
 		test_list.html \
 		test_media.html \
-		test_menu.xul \
 		test_select.html \
 		test_tabbox.xul \
 		test_tabbrowser.xul \
 		test_table.html \
 		test_tree.xul \
 		test_txtcntr.html \
 		test_txtctrl.html \
 		test_txtctrl.xul \

--- a/accessible/tests/mochitest/tree/test_button.xul
+++ b/accessible/tests/mochitest/tree/test_button.xul
@@ -19,132 +19,34 @@
   <script type="application/javascript">
   <![CDATA[
     ////////////////////////////////////////////////////////////////////////////
     // Test
 
     function doTest()
     {
       //////////////////////////////////////////////////////////////////////////
-      // button1
+      // button
 
       var accTree = {
         role: ROLE_PUSHBUTTON,
         name: "hello",
         children: [ ]
       };
       testAccessibleTree("button1", accTree);
 
       //////////////////////////////////////////////////////////////////////////
-      // button2
-
-      accTree = {
-        role: ROLE_PUSHBUTTON,
-        name: "hello",
-        children: [
-          {
-            role: ROLE_MENUPOPUP,
-            children: [
-              {
-                role: ROLE_MENUITEM
-              },
-              {
-                role: ROLE_MENUITEM
-              }
-            ]
-          }
-        ]
-      };
-      testAccessibleTree("button2", accTree);
-
-      //////////////////////////////////////////////////////////////////////////
-      // button3
-
-      accTree = {
-        role: ROLE_PUSHBUTTON,
-        name: "hello",
-        children: [
-          {
-            role: ROLE_MENUPOPUP,
-            children: [
-              {
-                role: ROLE_MENUITEM
-              },
-              {
-                role: ROLE_MENUITEM
-              }
-            ]
-          },
-          {
-            role: ROLE_PUSHBUTTON,
-            children: [
-            ]
-          }
-        ]
-      };
-      testAccessibleTree("button3", accTree);
-
-      //////////////////////////////////////////////////////////////////////////
-      // button4
+      // toolbarbutton
 
       var accTree = {
         role: ROLE_PUSHBUTTON,
         name: "hello",
         children: [ ]
       };
-      testAccessibleTree("button4", accTree);
-
-      //////////////////////////////////////////////////////////////////////////
-      // button5
-
-      accTree = {
-        role: ROLE_PUSHBUTTON,
-        name: "hello",
-        children: [
-          {
-            role: ROLE_MENUPOPUP,
-            children: [
-              {
-                role: ROLE_MENUITEM
-              },
-              {
-                role: ROLE_MENUITEM
-              }
-            ]
-          }
-        ]
-      };
-      testAccessibleTree("button5", accTree);
-
-      //////////////////////////////////////////////////////////////////////////
-      // button6
-
-      accTree = {
-        role: ROLE_PUSHBUTTON,
-        name: "hello",
-        children: [
-          {
-            role: ROLE_MENUPOPUP,
-            children: [
-              {
-                role: ROLE_MENUITEM
-              },
-              {
-                role: ROLE_MENUITEM
-              }
-            ]
-          },
-          {
-            role: ROLE_PUSHBUTTON,
-            children: [
-            ]
-          }
-        ]
-      };
-      testAccessibleTree("button6", accTree);
+      testAccessibleTree("button2", accTree);
 
       SimpleTest.finish()
     }
 
     SimpleTest.waitForExplicitFinish();
     addA11yLoadEvent(doTest);
   ]]>
   </script>
@@ -160,39 +62,14 @@
       <div id="content" style="display: none">
       </div>
       <pre id="test">
       </pre>
     </body>
 
     <vbox flex="1">
       <button id="button1" label="hello"/>
-      <button id="button2" type="menu" label="hello">
-        <menupopup>
-          <menuitem label="menuitem"/>
-          <menuitem label="menuitem"/>
-        </menupopup>
-      </button>
-      <button id="button3" type="menu-button" label="hello">
-        <menupopup>
-          <menuitem label="menuitem"/>
-          <menuitem label="menuitem"/>
-        </menupopup>
-      </button>
-
-      <toolbarbutton id="button4" label="hello"/>
-      <toolbarbutton id="button5" type="menu" label="hello">
-        <menupopup>
-          <menuitem label="menuitem"/>
-          <menuitem label="menuitem"/>
-        </menupopup>
-      </toolbarbutton>
-      <toolbarbutton id="button6" type="menu-button" label="hello">
-        <menupopup>
-          <menuitem label="menuitem"/>
-          <menuitem label="menuitem"/>
-        </menupopup>
-      </toolbarbutton>
+      <toolbarbutton id="button2" label="hello"/>
     </vbox>
   </hbox>
 
 </window>
 

deleted file mode 100644
--- a/accessible/tests/mochitest/tree/test_menu.xul
+++ /dev/null
@@ -1,86 +0,0 @@
-<?xml version="1.0"?>
-<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
-<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
-                 type="text/css"?>
-
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
-        title="Accessible XUL menu hierarchy tests">
-
-  <script type="application/javascript" 
-          src="chrome://mochikit/content/MochiKit/packed.js" />
-  <script type="application/javascript"
-          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js" />
-
-  <script type="application/javascript"
-          src="../common.js" />
-  <script type="application/javascript"
-          src="../role.js" />
-
-  <script type="application/javascript">
-  <![CDATA[
-    ////////////////////////////////////////////////////////////////////////////
-    // Test
-
-    function doTest()
-    {
-      if (LINUX || SOLARIS) {
-        // XXX: bug 527646
-
-        todo(false, "Failure on Linux and Solaris.");
-        SimpleTest.finish();
-        return;
-      }
-
-      var accTree = {
-        role: ROLE_PARENT_MENUITEM,
-        name: "menu",
-        children: [
-          {
-            role: ROLE_MENUPOPUP,
-            children: [
-              {
-                role: ROLE_MENUITEM
-              },
-              {
-                role: ROLE_MENUITEM
-              }
-            ]
-          }
-        ]
-      };
-      testAccessibleTree("menu", accTree);
-
-      SimpleTest.finish();
-    }
-
-    SimpleTest.waitForExplicitFinish();
-    addA11yLoadEvent(doTest);
-  ]]>
-  </script>
-
-  <hbox flex="1" style="overflow: auto;">
-    <body xmlns="http://www.w3.org/1999/xhtml">
-      <a target="_blank"
-         href="https://bugzilla.mozilla.org/show_bug.cgi?id=249292"
-         title="Ensure accessible children for toolbarbutton types 'menu' and 'menu-button'">
-        Mozilla Bug 249292
-      </a><br/>
-      <p id="display"></p>
-      <div id="content" style="display: none">
-      </div>
-      <pre id="test">
-      </pre>
-    </body>
-
-    <vbox flex="1">
-      <menu id="menu" label="menu">
-        <menupopup>
-          <menuitem label="menuitem"/>
-          <menuitem label="menuitem"/>
-        </menupopup>
-      </menu>
-    </vbox>
-  </hbox>
-
-</window>
-

--- a/accessible/tests/mochitest/treeupdate/Makefile.in
+++ b/accessible/tests/mochitest/treeupdate/Makefile.in
@@ -42,21 +42,24 @@ srcdir		= @srcdir@
 VPATH		= @srcdir@
 relativesrcdir  = accessible/treeupdate
 
 include $(DEPTH)/config/autoconf.mk
 include $(topsrcdir)/config/rules.mk
 
 _TEST_FILES =\
 		test_ariadialog.html \
+		test_colorpicker.xul \
+		test_contextmenu.xul \
 		test_doc.html \
 		test_gencontent.html \
 		test_list_editabledoc.html \
 		test_list.html \
 		test_menu.xul \
+		test_menubutton.xul \
 		test_recreation.html \
 		test_select.html \
 		test_textleaf.html \
 		test_visibility.html \
 		test_whitespace.html \
 		$(NULL)
 
 libs:: $(_TEST_FILES)

rename from accessible/tests/mochitest/tree/test_colorpicker.xul
rename to accessible/tests/mochitest/treeupdate/test_colorpicker.xul
--- a/accessible/tests/mochitest/tree/test_colorpicker.xul
+++ b/accessible/tests/mochitest/treeupdate/test_colorpicker.xul
@@ -10,60 +10,137 @@
           src="chrome://mochikit/content/MochiKit/packed.js" />
   <script type="application/javascript"
           src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js" />
 
   <script type="application/javascript"
           src="../common.js" />
   <script type="application/javascript"
           src="../role.js" />
+  <script type="application/javascript"
+          src="../events.js" />
 
   <script type="application/javascript">
   <![CDATA[
     ////////////////////////////////////////////////////////////////////////////
     // Test
 
+    function openColorpicker(aColorpickerID)
+    {
+      this.node = getNode(aColorpickerID);
+
+      this.eventSeq = [];
+
+      var it = new colorButtonIterator(this.node);
+      for (var btnNode = it.next(); btnNode = it.next(); btnNode)
+        this.eventSeq.push(new invokerChecker(EVENT_SHOW, btnNode));
+
+      var popupNode = getPopupNode(this.node);
+      this.eventSeq.push(new invokerChecker(EVENT_REORDER, popupNode));
+
+      this.invoke = function openColorpicker_invoke()
+      {
+        var tree =
+          { BUTTONDROPDOWNGRID: [
+            { ALERT: [ ] }
+          ] };
+        testAccessibleTree(this.node, tree);
+
+        this.node.showPopup();
+      }
+
+      this.finalCheck = function openColorpicker_finalCheck()
+      {
+        var tree =
+          { BUTTONDROPDOWNGRID: [
+            { ALERT: [ ] }
+          ] };
+
+        var colorButtons = tree.BUTTONDROPDOWNGRID[0].ALERT;
+        var it = new colorButtonIterator(this.node);
+        while (it.next()) {
+          var obj = { PUSHBUTTON: [ ] };
+          colorButtons.push(obj);
+        }
+
+        testAccessibleTree(this.node, tree);
+      }
+
+      this.getID = function openColorpicker_getID()
+      {
+        return "open colorpicker " + prettyName(aColorpickerID);
+      }
+    }
+
+    function getPopupNode(aColorpickerNode)
+    {
+      return aColorpickerNode.mPicker.parentNode;
+    }
+
+    function colorButtonIterator(aColorpickerNode)
+    {
+      this.container = aColorpickerNode.mPicker.mBox;
+      this.group = this.container.firstChild;
+      this.item = null;
+
+      this.next = function colorButtonIterator_next()
+      {
+        if (!this.group)
+          return null;
+
+        if (!this.item) {
+          this.item = this.group.firstChild;
+          return this.item;
+        }
+
+        if (this.item.nextSibling) {
+          this.item = this.item.nextSibling;
+          return this.item;
+        }
+
+        if (this.group.nextSibling) {
+          this.group = this.group.nextSibling;
+          this.item = this.group.firstChild;
+          return this.item;
+        }
+
+        this.group = null;
+        this.item = null;
+        return null;
+      }
+    }
+
+    //gA11yEventDumpToConsole = true; // debug stuff
+
+    var gQueue = null;
     function doTest()
     {
-      //////////////////////////////////////////////////////////////////////////
-      // button1
-
-      var accTree = {
-        role: ROLE_BUTTONDROPDOWNGRID,
-        children: [
-          {
-            role: ROLE_ALERT,
-            children: [ ]
-          }
-        ]
-      };
-
-      var colorButtons = accTree.children[0].children;
-      for (var idx = 0; idx < 70; idx++) {
-        var obj = { role: ROLE_PUSHBUTTON };
-        colorButtons.push(obj);
-      }
-
-      testAccessibleTree("colorpicker", accTree);
-
-      SimpleTest.finish()
+      gQueue = new eventQueue();
+      gQueue.push(new openColorpicker("colorpicker"));
+      gQueue.invoke(); // Will call SimpleTest.finish()
     }
 
     SimpleTest.waitForExplicitFinish();
     addA11yLoadEvent(doTest);
   ]]>
   </script>
 
   <hbox flex="1" style="overflow: auto;">
     <body xmlns="http://www.w3.org/1999/xhtml">
       <a target="_blank"
          href="https://bugzilla.mozilla.org/show_bug.cgi?id=249292"
          title="Ensure accessible children for toolbarbutton types 'menu' and 'menu-button'">
         Mozilla Bug 249292
-      </a><br/>
+      </a>
+      <a target="_blank"
+         href="https://bugzilla.mozilla.org/show_bug.cgi?id=630486"
+         title="Don't force accessible creation for popup children.">
+        Mozilla Bug 630486
+      </a>
+      <br/>
       <p id="display"></p>
       <div id="content" style="display: none">
       </div>
       <pre id="test">
       </pre>
     </body>
 
     <vbox flex="1">

new file mode 100644
--- /dev/null
+++ b/accessible/tests/mochitest/treeupdate/test_contextmenu.xul
@@ -0,0 +1,321 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        title="menu tree and events">
+
+  <script type="application/javascript" 
+          src="chrome://mochikit/content/MochiKit/packed.js" />
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js" />
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/EventUtils.js"/>
+
+  <script type="application/javascript"
+          src="../common.js" />
+  <script type="application/javascript"
+          src="../events.js" />
+  <script type="application/javascript"
+          src="../role.js" />
+
+  <script type="application/javascript">
+  <![CDATA[
+
+    function openMenu(aID, aTree)
+    {
+      this.eventSeq = [
+        new invokerChecker(EVENT_MENUPOPUP_START, getNode(aID))
+      ];
+
+      this.invoke = function openMenu_invoke()
+      {
+        var button = getNode("button");
+        getNode(aID).openPopup(button, "after_start", 0, 0, true, false);
+      }
+
+      this.finalCheck = function openMenu_finalCheck(aEvent)
+      {
+        testAccessibleTree(aID, aTree);
+      }
+
+      this.getID = function openMenu_getID()
+      {
+        return "open menu " + prettyName(aID);
+      }
+    }
+
+    function selectNextMenuItem(aID)
+    {
+      this.eventSeq = [
+        new invokerChecker(EVENT_FOCUS, getNode(aID))
+      ];
+
+      this.invoke = function selectMenuItem_invoke()
+      {
+        synthesizeKey("VK_DOWN", { });
+      }
+
+      this.getID = function selectMenuItem_getID()
+      {
+        return "select menuitem " + prettyName(aID);
+      }
+    }
+    
+    function openSubMenu(aSubMenuID, aItemID, aMenuID, aTree)
+    {
+      this.eventSeq = [
+        new invokerChecker(EVENT_FOCUS, getNode(aItemID)),
+      ];
+
+      this.invoke = function openSubMenu_invoke()
+      {
+        synthesizeKey("VK_ENTER", { });
+      }
+
+      this.finalCheck = function openSubMenu_finalCheck(aEvent)
+      {
+        testAccessibleTree(aMenuID, aTree);
+      }
+
+      this.getID = function openSubMenu_getID()
+      {
+        return "open submenu " + prettyName(aSubMenuID) + " focusing item " + prettyName(aItemID);
+      }
+    }
+
+    function closeSubMenu(aSubMenuID, aItemID)
+    {
+      this.eventSeq = [
+        new invokerChecker(EVENT_FOCUS, getNode(aItemID)),
+      ];
+
+      this.invoke = function closeSubMenu_invoke()
+      {
+        synthesizeKey("VK_ESCAPE", { });
+      }
+
+      this.getID = function closeSubMenu_getID()
+      {
+        return "close submenu " + prettyName(aSubMenuID) + " focusing item " + prettyName(aItemID);
+      }
+    }
+
+    function closeMenu(aID)
+    {
+      this.eventSeq = [
+        new invokerChecker(EVENT_MENUPOPUP_END, getNode(aID))
+      ];
+
+      this.invoke = function closeMenu_invoke()
+      {
+        synthesizeKey("VK_ESCAPE", { });
+      }
+
+      this.getID = function closeMenu_getID()
+      {
+        return "close menu " + prettyName(aID);
+      }
+    }
+
+    //gA11yEventDumpID = "eventdump";
+    //gA11yEventDumpToConsole = true;
+
+    var gQueue = null;
+    var gContextTree = {};
+
+    // Linux and Windows menu trees discrepancy: bug 527646.
+
+    /**
+     * Return the context menu tree before submenus were open.
+     */
+    function getMenuTree1()
+    {
+      if (LINUX || SOLARIS) {
+        var tree = {
+          role: ROLE_MENUPOPUP,
+          children: [
+            {
+              name: "item0",
+              role: ROLE_MENUITEM,
+              children: []
+            },
+            {
+              name: "item1",
+              role: ROLE_MENUITEM,
+              children: []
+            },
+            {
+              name: "item2",
+              role: ROLE_PARENT_MENUITEM,
+              children: [ ]
+            }
+          ]
+        };
+        return tree;
+      }
+
+      // Windows
+      var tree = {
+        role: ROLE_MENUPOPUP,
+        children: [
+          {
+            name: "item0",
+            role: ROLE_MENUITEM,
+            children: []
+          },
+          {
+            name: "item1",
+            role: ROLE_MENUITEM,
+            children: []
+          },
+          {
+            name: "item2",
+            role: ROLE_PARENT_MENUITEM,
+            children: [
+              {
+                name: "item2",
+                role: ROLE_MENUPOPUP,
+                children: [ ]
+              }
+            ]
+          }
+        ]
+      };
+      return tree;
+    }
+
+    /**
+     * Return context menu tree when submenu was open.
+     */
+    function getMenuTree2()
+    {
+      var tree = getMenuTree1();
+      if (LINUX || SOLARIS) {
+        var submenuTree =
+        {
+          name: "item2.0",
+          role: ROLE_PARENT_MENUITEM,
+          children: [ ]
+        };
+        tree.children[2].children.push(submenuTree);
+        return tree;
+      }
+
+      // Windows
+      var submenuTree =
+      {
+        name: "item2.0",
+        role: ROLE_PARENT_MENUITEM,
+        children: [
+          {
+            name: "item2.0",
+            role: ROLE_MENUPOPUP,
+            children: [ ]
+          }
+        ]
+      };
+
+      tree.children[2].children[0].children.push(submenuTree);
+      return tree;
+    }
+
+    /**
+     * Return context menu tree when subsub menu was open.
+     */
+    function getMenuTree3()
+    {
+      var tree = getMenuTree2();
+      var subsubmenuTree =
+      {
+        name: "item2.0.0",
+        role: ROLE_MENUITEM,
+        children: []
+      };
+
+      if (LINUX || SOLARIS)
+        tree.children[2].children[0].\(subsubmenuTree);
+      else
+        tree.children[2].children[0].children[0].children[0].children.push(subsubmenuTree);
+
+      return tree;
+    }
+
+
+    function doTests()
+    {
+      gQueue = new eventQueue();
+
+      // Check initial empty tree
+      testAccessibleTree("context", { MENUPOPUP: [] });
+
+      // Open context menu and check that menu item accesibles are created.
+      gQueue.push(new openMenu("context", getMenuTree1()));
+
+      // Select items and check focus event on them.
+      gQueue.push(new selectNextMenuItem("item0"));
+      gQueue.push(new selectNextMenuItem("item1"));
+      gQueue.push(new selectNextMenuItem("item2"));
+
+      // Open sub menu and check menu accessible tree and focus event.
+      gQueue.push(new openSubMenu("submenu2", "item2.0",
+                                  "context", getMenuTree2()));
+      gQueue.push(new openSubMenu("submenu2.0", "item2.0.0",
+                                  "context", getMenuTree3()));
+
+      // Close submenus and check that focus goes to parent.
+      gQueue.push(new closeSubMenu("submenu2.0", "item2.0"));
+      gQueue.push(new closeSubMenu("submenu2", "item2"));
+
+      gQueue.push(new closeMenu("context"));
+
+      gQueue.invoke(); // Will call SimpleTest.finish();
+    }
+
+    SimpleTest.waitForExplicitFinish();
+    addA11yLoadEvent(doTests);
+  ]]>
+  </script>
+
+  <hbox flex="1" style="overflow: auto;">
+  <body xmlns="http://www.w3.org/1999/xhtml">
+    <a target="_blank"
+       href="https://bugzilla.mozilla.org/show_bug.cgi?id=630194"
+       title="Update accessible tree when opening the menu popup">
+      Mozilla Bug 630194
+    </a>
+    <a target="_blank"
+       href="https://bugzilla.mozilla.org/show_bug.cgi?id=630486"
+       title="Don't force accessible creation for popup children.">
+      Mozilla Bug 630486
+    </a>
+  <p id="display"></p>
+    <div id="content" style="display: none">
+    </div>
+    <pre id="test">
+    </pre>
+  </body>
+
+    <vbox flex="1">
+
+      <menupopup id="context">
+        <menuitem id="item0" label="item0"/>
+        <menuitem id="item1" label="item1"/>
+        <menu id="item2" label="item2">
+          <menupopup id="submenu2">
+            <menu id="item2.0" label="item2.0">
+              <menupopup id="submenu2.0">
+                <menuitem id="item2.0.0" label="item2.0.0"/>
+              </menupopup>
+            </menu>
+          </menupopup>
+        </menu>
+      </menupopup>
+
+      <button context="context" id="button">btn</button>
+
+      <vbox id="eventdump" role="log"/>
+    </vbox>
+  </hbox>
+</window>

--- a/accessible/tests/mochitest/treeupdate/test_menu.xul
+++ b/accessible/tests/mochitest/treeupdate/test_menu.xul
@@ -1,277 +1,130 @@
 <?xml version="1.0"?>
 <?xml-stylesheet href="chrome://global/skin" type="text/css"?>
 <?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
                  type="text/css"?>
 
 <window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
-        title="menu tree and events">
+        title="Accessible XUL menu hierarchy tests">
 
   <script type="application/javascript" 
           src="chrome://mochikit/content/MochiKit/packed.js" />
   <script type="application/javascript"
           src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js" />
-  <script type="application/javascript"
-          src="chrome://mochikit/content/tests/SimpleTest/EventUtils.js"/>
 
   <script type="application/javascript"
           src="../common.js" />
   <script type="application/javascript"
-          src="../events.js" />
+          src="../role.js" />
   <script type="application/javascript"
-          src="../role.js" />
+          src="../events.js" />
 
   <script type="application/javascript">
   <![CDATA[
-    function openMenu(aID, aTree)
+    ////////////////////////////////////////////////////////////////////////////
+    // Invokers
+
+    function openMenu(aID)
     {
+      this.menuNode = getNode(aID),
+
       this.eventSeq = [
-        new invokerChecker(EVENT_MENUPOPUP_START, getNode(aID))
+        new invokerChecker(EVENT_FOCUS, this.menuNode)
       ];
 
       this.invoke = function openMenu_invoke()
       {
-        var button = getNode("button");
-        getNode(aID).openPopup(button, "after_start", 0, 0, true, false);
+        var tree;
+        if (LINUX || SOLARIS) {
+          tree =
+            { PARENT_MENUITEM: [ ] };
+
+        } else {
+          tree =
+            { PARENT_MENUITEM: [
+              { MENUPOPUP: [ ] }
+            ] };
+        }
+        testAccessibleTree(aID, tree);
+
+        // Show menu.
+        this.menuNode.open = true;
       }
 
-      this.finalCheck = function openMenu_finalCheck(aEvent)
+      this.finalCheck = function openMenu_finalCheck()
       {
-        testAccessibleTree(aID, aTree);
+        var tree;
+        if (LINUX || SOLARIS) {
+          tree =
+            { PARENT_MENUITEM: [
+              { MENUITEM: [ ] },
+              { MENUITEM: [ ] }
+            ] };
+
+        } else {
+          tree =
+            { PARENT_MENUITEM: [
+              { MENUPOPUP: [
+                { MENUITEM: [ ] },
+                { MENUITEM: [ ] }
+              ] }
+            ] };
+        }
+        testAccessibleTree(aID, tree);
       }
 
       this.getID = function openMenu_getID()
       {
         return "open menu " + prettyName(aID);
       }
     }
 
-    function selectNextMenuItem(aID)
-    {
-      this.eventSeq = [
-        new invokerChecker(EVENT_FOCUS, getNode(aID))
-      ];
-
-      this.invoke = function selectMenuItem_invoke()
-      {
-        synthesizeKey("VK_DOWN", { });
-      }
-
-      this.getID = function selectMenuItem_getID()
-      {
-        return "select menuitem " + prettyName(aID);
-      }
-    }
-    
-    function openSubMenu(aSubMenuID, aItemID)
-    {
-      this.eventSeq = [
-        new invokerChecker(EVENT_FOCUS, getNode(aItemID)),
-      ];
-
-      this.invoke = function openSubMenu_invoke()
-      {
-        synthesizeKey("VK_ENTER", { });
-      }
-
-      this.finalCheck = function openSubMenu_finalCheck(aEvent)
-      {
-        getAccessible(aItemID);
-      }
-
-      this.getID = function openSubMenu_getID()
-      {
-        return "open submenu " + prettyName(aSubMenuID) + " focusing item " + prettyName(aItemID);
-      }
-    }
-
-    function closeSubMenu(aSubMenuID, aItemID)
-    {
-      this.eventSeq = [
-        new invokerChecker(EVENT_FOCUS, getNode(aItemID)),
-      ];
-
-      this.invoke = function closeSubMenu_invoke()
-      {
-        synthesizeKey("VK_ESCAPE", { });
-      }
-
-      this.getID = function closeSubMenu_getID()
-      {
-        return "close submenu " + prettyName(aSubMenuID) + " focusing item " + prettyName(aItemID);
-      }
-    }
-
-    function closeMenu(aID)
-    {
-      this.eventSeq = [
-        new invokerChecker(EVENT_MENUPOPUP_END, getNode(aID))
-      ];
-
-      this.invoke = function closeMenu_invoke()
-      {
-        synthesizeKey("VK_ESCAPE", { });
-      }
-
-      this.getID = function closeMenu_getID()
-      {
-        return "close menu " + prettyName(aID);
-      }
-    }
-
-    //gA11yEventDumpID = "eventdump";
-    //gA11yEventDumpToConsole = true;
+    ////////////////////////////////////////////////////////////////////////////
+    // Test
 
     var gQueue = null;
-    var gContextTree = {};
-
-    // bug 527646
-    if (LINUX || SOLARIS) {
-      gContextTree = {
-        role: ROLE_MENUPOPUP,
-        children: [
-          {
-            name: "item0",
-            role: ROLE_MENUITEM,
-            children: []
-          },
-          {
-            name: "item1",
-            role: ROLE_MENUITEM,
-            children: []
-          },
-          {
-            name: "item2",
-            role: ROLE_PARENT_MENUITEM,
-            children: [
-              {
-                name: "item2.0",
-                role: ROLE_PARENT_MENUITEM,
-                children: [
-                  { 
-                    name: "item2.0.0",
-                    role: ROLE_MENUITEM,
-                    children: []
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      };
-    } else {
-      gContextTree = {
-        role: ROLE_MENUPOPUP,
-        children: [
-          {
-            name: "item0",
-            role: ROLE_MENUITEM,
-            children: []
-          },
-          {
-            name: "item1",
-            role: ROLE_MENUITEM,
-            children: []
-          },
-          {
-            name: "item2",
-            role: ROLE_PARENT_MENUITEM,
-            children: [
-              {
-                name: "item2",
-                role: ROLE_MENUPOPUP,
-                children: [
-                  {
-                    name: "item2.0",
-                    role: ROLE_PARENT_MENUITEM,
-                    children: [
-                      { 
-                        name: "item2.0",
-                        role: ROLE_MENUPOPUP,
-                        children: [
-                          { 
-                            name: "item2.0.0",
-                            role: ROLE_MENUITEM,
-                            children: []
-                          }
-                        ]
-                      }
-                    ]
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      };
-    }
-
-
-    function doTests()
+    function doTest()
     {
       gQueue = new eventQueue();
-
-      // Check initial empty tree
-      testAccessibleTree("context", { MENUPOPUP: [] });
-
-      // Open context menu and check that menu item accesibles are created.
-      gQueue.push(new openMenu("context", gContextTree));
-
-      // Select items and check focus event on them.
-      gQueue.push(new selectNextMenuItem("item0"));
-      gQueue.push(new selectNextMenuItem("item1"));
-      gQueue.push(new selectNextMenuItem("item2"));
-
-      // Open sub menu and check menu item accessibles and focus event.
-      gQueue.push(new openSubMenu("submenu2", "item2.0"));
-      gQueue.push(new openSubMenu("submenu2.0", "item2.0.0"));
-
-      // Close submenus and check that focus goes to parent.
-      gQueue.push(new closeSubMenu("submenu2.0", "item2.0"));
-      gQueue.push(new closeSubMenu("submenu2", "item2"));
-
-      gQueue.push(new closeMenu("context"));
-
+      gQueue.push(new openMenu("menu"));
       gQueue.invoke(); // Will call SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
-    addA11yLoadEvent(doTests);
+    addA11yLoadEvent(doTest);
   ]]>
   </script>
 
   <hbox flex="1" style="overflow: auto;">
-  <body xmlns="http://www.w3.org/1999/xhtml">
-    <a target="_blank"
-       href="https://bugzilla.mozilla.org/show_bug.cgi?id=630194"
-       title="Update accessible tree when opening the menu popup">
-      Mozilla Bug 630194
-    </a>
-  <p id="display"></p>
-    <div id="content" style="display: none">
-    </div>
-    <pre id="test">
-    </pre>
-  </body>
+    <body xmlns="http://www.w3.org/1999/xhtml">
+      <a target="_blank"
+         href="https://bugzilla.mozilla.org/show_bug.cgi?id=249292"
+         title="Ensure accessible children for toolbarbutton types 'menu' and 'menu-button'">
+        Mozilla Bug 249292
+      </a>
+      <a target="_blank"
+         href="https://bugzilla.mozilla.org/show_bug.cgi?id=630486"
+         title="Don't force accessible creation for popup children.">
+        Mozilla Bug 630486
+      </a>
+      <br/>
+      <p id="display"></p>
+      <div id="content" style="display: none">
+      </div>
+      <pre id="test">
+      </pre>
+    </body>
 
     <vbox flex="1">
-
-      <menupopup id="context">
-        <menuitem id="item0" label="item0"/>
-        <menuitem id="item1" label="item1"/>
-        <menu id="item2" label="item2">
-          <menupopup id="submenu2">
-            <menu id="item2.0" label="item2.0">
-              <menupopup id="submenu2.0">
-                <menuitem id="item2.0.0" label="item2.0.0"/>
-              </menupopup>
-            </menu>
+      <menubar>
+        <menu id="menu" label="menu">
+          <menupopup>
+            <menuitem label="menuitem"/>
+            <menuitem label="menuitem"/>
           </menupopup>
         </menu>
-      </menupopup>
-
-      <button context="context" id="button">btn</button>
-
-      <vbox id="eventdump" role="log"/>
+      </menubar>
     </vbox>
   </hbox>
+
 </window>
+

copy from accessible/tests/mochitest/tree/test_button.xul
copy to accessible/tests/mochitest/treeupdate/test_menubutton.xul
--- a/accessible/tests/mochitest/tree/test_button.xul
+++ b/accessible/tests/mochitest/treeupdate/test_menubutton.xul
@@ -10,187 +10,168 @@
           src="chrome://mochikit/content/MochiKit/packed.js" />
   <script type="application/javascript"
           src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js" />
 
   <script type="application/javascript"
           src="../common.js" />
   <script type="application/javascript"
           src="../role.js" />
+  <script type="application/javascript"
+          src="../events.js" />
 
   <script type="application/javascript">
   <![CDATA[
+
     ////////////////////////////////////////////////////////////////////////////
-    // Test
+    // Invokers
+
+    function openMenu(aButtonID)
+    {
+      this.buttonNode = getNode(aButtonID);
+      this.menupoupNode = this.buttonNode.firstChild;
+
+      this.eventSeq = [
+        new invokerChecker(EVENT_REORDER, this.menupoupNode)
+      ];
+
+      this.invoke = function openMenu_invoke()
+      {
+        var tree =
+          { PUSHBUTTON: [
+            { MENUPOPUP: [ ] }
+          ] };
+        testAccessibleTree(this.buttonNode, tree);
+
+        this.buttonNode.open = true;
+      }
+
+      this.finalCheck = function openMenu_finalCheck()
+      {
+        var tree =
+          { PUSHBUTTON: [
+            { MENUPOPUP: [
+              { MENUITEM: [ ] },
+              { MENUITEM: [ ] }
+            ] }
+          ] };
+        testAccessibleTree(this.buttonNode, tree);
+      }
+
+      this.getID = function openMenu_getID()
+      {
+        return "open menu for button " + prettyName(aButtonID);
+      }
+    }
+
+    function openMenuButton(aButtonID)
+    {
+      this.buttonNode = getNode(aButtonID);
+      this.menupoupNode = this.buttonNode.firstChild;
+
+      this.eventSeq = [
+        new invokerChecker(EVENT_REORDER, this.menupoupNode)
+      ];
+
+      this.invoke = function openMenu_invoke()
+      {
+        var tree =
+          { PUSHBUTTON: [
+            { MENUPOPUP: [ ] },
+            { PUSHBUTTON: [ ] }
+          ] };
+        testAccessibleTree(this.buttonNode, tree);
+
+        this.buttonNode.open = true;
+      }
+
+      this.finalCheck = function openMenu_finalCheck()
+      {
+        var tree =
+          { PUSHBUTTON: [
+            { MENUPOPUP: [
+              { MENUITEM: [ ] },
+              { MENUITEM: [ ] }
+            ] },
+            { PUSHBUTTON: [ ] }
+          ] };
+        testAccessibleTree(this.buttonNode, tree);
+      }
+
+      this.getID = function openMenu_getID()
+      {
+        return "open menu for menu button " + prettyName(aButtonID);
+      }
+    }
+
+    ////////////////////////////////////////////////////////////////////////////
+    // Do test
+
+    gA11yEventDumpToConsole = true; // debug stuff
+
+    var gQueue = null;
 
     function doTest()
     {
-      //////////////////////////////////////////////////////////////////////////
-      // button1
-
-      var accTree = {
-        role: ROLE_PUSHBUTTON,
-        name: "hello",
-        children: [ ]
-      };
-      testAccessibleTree("button1", accTree);
-
-      //////////////////////////////////////////////////////////////////////////
-      // button2
-
-      accTree = {
-        role: ROLE_PUSHBUTTON,
-        name: "hello",
-        children: [
-          {
-            role: ROLE_MENUPOPUP,
-            children: [
-              {
-                role: ROLE_MENUITEM
-              },
-              {
-                role: ROLE_MENUITEM
-              }
-            ]
-          }
-        ]
-      };
-      testAccessibleTree("button2", accTree);
-
-      //////////////////////////////////////////////////////////////////////////
-      // button3
-
-      accTree = {
-        role: ROLE_PUSHBUTTON,
-        name: "hello",
-        children: [
-          {
-            role: ROLE_MENUPOPUP,
-            children: [
-              {
-                role: ROLE_MENUITEM
-              },
-              {
-                role: ROLE_MENUITEM
-              }
-            ]
-          },
-          {
-            role: ROLE_PUSHBUTTON,
-            children: [
-            ]
-          }
-        ]
-      };
-      testAccessibleTree("button3", accTree);
+      gQueue = new eventQueue();
 
-      //////////////////////////////////////////////////////////////////////////
-      // button4
-
-      var accTree = {
-        role: ROLE_PUSHBUTTON,
-        name: "hello",
-        children: [ ]
-      };
-      testAccessibleTree("button4", accTree);
-
-      //////////////////////////////////////////////////////////////////////////
-      // button5
+      gQueue.push(new openMenu("button1"));
+      gQueue.push(new openMenuButton("button2"));
+      gQueue.push(new openMenu("button3"));
+      gQueue.push(new openMenuButton("button4"));
 
-      accTree = {
-        role: ROLE_PUSHBUTTON,
-        name: "hello",
-        children: [
-          {
-            role: ROLE_MENUPOPUP,
-            children: [
-              {
-                role: ROLE_MENUITEM
-              },
-              {
-                role: ROLE_MENUITEM
-              }
-            ]
-          }
-        ]
-      };
-      testAccessibleTree("button5", accTree);
-
-      //////////////////////////////////////////////////////////////////////////
-      // button6
-
-      accTree = {
-        role: ROLE_PUSHBUTTON,
-        name: "hello",
-        children: [
-          {
-            role: ROLE_MENUPOPUP,
-            children: [
-              {
-                role: ROLE_MENUITEM
-              },
-              {
-                role: ROLE_MENUITEM
-              }
-            ]
-          },
-          {
-            role: ROLE_PUSHBUTTON,
-            children: [
-            ]
-          }
-        ]
-      };
-      testAccessibleTree("button6", accTree);
-
-      SimpleTest.finish()
+      gQueue.invoke(); // SimpleTest.finish()
     }
 
     SimpleTest.waitForExplicitFinish();
     addA11yLoadEvent(doTest);
   ]]>
   </script>
 
   <hbox flex="1" style="overflow: auto;">
     <body xmlns="http://www.w3.org/1999/xhtml">
       <a target="_blank"
          href="https://bugzilla.mozilla.org/show_bug.cgi?id=249292"
          title="Ensure accessible children for toolbarbutton types 'menu' and 'menu-button'">
         Mozilla Bug 249292
-      </a><br/>
+      </a>
+      <a target="_blank"
+         href="https://bugzilla.mozilla.org/show_bug.cgi?id=630486"
+         title="Don't force accessible creation for popup children.">
+        Mozilla Bug 630486
+      </a>
+      <br/>
       <p id="display"></p>
       <div id="content" style="display: none">
       </div>
       <pre id="test">
       </pre>
     </body>
 
     <vbox flex="1">
-      <button id="button1" label="hello"/>
-      <button id="button2" type="menu" label="hello">
+      <button id="button1" type="menu" label="hello">
         <menupopup>
           <menuitem label="menuitem"/>
           <menuitem label="menuitem"/>
         </menupopup>
       </button>
-      <button id="button3" type="menu-button" label="hello">
+      <button id="button2" type="menu-button" label="hello">
         <menupopup>
           <menuitem label="menuitem"/>
           <menuitem label="menuitem"/>
         </menupopup>
       </button>
 
-      <toolbarbutton id="button4" label="hello"/>
-      <toolbarbutton id="button5" type="menu" label="hello">
+      <toolbarbutton id="button3" type="menu" label="hello">
         <menupopup>
           <menuitem label="menuitem"/>
           <menuitem label="menuitem"/>
         </menupopup>
       </toolbarbutton>
-      <toolbarbutton id="button6" type="menu-button" label="hello">
+      <toolbarbutton id="button4" type="menu-button" label="hello">
         <menupopup>
           <menuitem label="menuitem"/>
           <menuitem label="menuitem"/>
         </menupopup>
       </toolbarbutton>
     </vbox>
   </hbox>
 

--- a/browser/components/feeds/content/subscribe.xml
+++ b/browser/components/feeds/content/subscribe.xml
@@ -44,17 +44,17 @@
           xmlns="http://www.mozilla.org/xbl"
           xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
   <binding id="feedreaderUI">
     <content>
       <xul:vbox>
         <xul:hbox align="center">
           <xul:description anonid="subscribeUsingDescription" class="subscribeUsingDescription"/>
           <xul:menulist anonid="handlersMenuList" class="handlersMenuList" aria-labelledby="subscribeUsingDescription">
-            <xul:menupopup menugenerated="true" anonid="handlersMenuPopup" class="handlersMenuPopup">
+            <xul:menupopup anonid="handlersMenuPopup" class="handlersMenuPopup">
               <xul:menuitem anonid="liveBookmarksMenuItem" label="&feedLiveBookmarks;" class="menuitem-iconic liveBookmarksMenuItem" image="chrome://browser/skin/page-livemarks.png" selected="true"/>
               <xul:menuseparator/>
             </xul:menupopup>
           </xul:menulist>
         </xul:hbox>
         <xul:hbox>
           <xul:checkbox anonid="alwaysUse" class="alwaysUse" checked="false"/>
         </xul:hbox>

new file mode 100644
--- /dev/null
+++ b/build/stdc++compat.cpp
@@ -0,0 +1,114 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is a hack to avoid dependencies on recent libstdc++.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Mike Hommey <mh@glandium.org>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include <ostream>
+#include <istream>
+#ifdef DEBUG
+#include <string>
+#endif
+
+namespace std {
+#if (__GNUC__ == 4) && (__GNUC_MINOR__ >= 2)
+    /* Instantiate these templates to avoid GLIBCXX_3.4.9 symbol versions */
+    template ostream& ostream::_M_insert(double);
+    template ostream& ostream::_M_insert(long);
+    template ostream& ostream::_M_insert(unsigned long);
+    template ostream& __ostream_insert(ostream&, const char*, streamsize);
+    template istream& istream::_M_extract(double&);
+#endif
+#ifdef DEBUG
+#if (__GNUC__ == 4) && (__GNUC_MINOR__ >= 5)
+    /* Instantiate these templates to avoid GLIBCXX_3.4.14 symbol versions
+     * in debug builds */
+    template char *basic_string<char, char_traits<char>, allocator<char> >::_S_construct_aux_2(size_type, char, allocator<char> const&);
+    template wchar_t *basic_string<wchar_t, char_traits<wchar_t>, allocator<wchar_t> >::_S_construct_aux_2(size_type, wchar_t, allocator<wchar_t> const&);
+#endif
+#endif
+}
+
+namespace std __attribute__((visibility("default"))) {
+
+#if (__GNUC__ == 4) && (__GNUC_MINOR__ >= 5)
+    /* Hack to avoid GLIBCXX_3.4.14 symbol versions */
+    struct _List_node_base
+    {
+        void hook(_List_node_base * const __position) throw ();
+
+        void unhook() throw ();
+
+        void transfer(_List_node_base * const __first,
+                      _List_node_base * const __last) throw();
+
+        void _M_hook(_List_node_base * const __position) throw ();
+
+        void _M_unhook() throw ();
+
+        void _M_transfer(_List_node_base * const __first,
+                         _List_node_base * const __last) throw();
+    };
+
+    /* The functions actually have the same implementation */
+    void
+    _List_node_base::_M_hook(_List_node_base * const __position) throw ()
+    {
+        hook(__position);
+    }
+
+    void
+    _List_node_base::_M_unhook() throw ()
+    {
+        unhook();
+    }
+
+    void
+    _List_node_base::_M_transfer(_List_node_base * const __first,
+                                 _List_node_base * const __last) throw ()
+    {
+        transfer(__first, __last);
+    }
+#endif
+
+#if (__GNUC__ == 4) && (__GNUC_MINOR__ >= 4)
+    /* Hack to avoid GLIBCXX_3.4.11 symbol versions
+       An inline definition of ctype<char>::_M_widen_init() used to be in
+       locale_facets.h before GCC 4.4, but moved out of headers in more
+       recent versions.
+       It is actually safe to make it do nothing. */
+    void ctype<char>::_M_widen_init() const {}
+#endif
+
+}

--- a/build/unix/elfhack/Makefile.in
+++ b/build/unix/elfhack/Makefile.in
@@ -43,19 +43,22 @@ VPATH		= @srcdir@
 
 include $(DEPTH)/config/autoconf.mk
 
 INTERNAL_TOOLS = 1
 
 HOST_PROGRAM = elfhack
 NO_DIST_INSTALL = 1
 
+VPATH += $(topsrcdir)/build
+
 HOST_CPPSRCS = \
   elf.cpp \
   elfhack.cpp \
+  $(STDCXX_COMPAT) \
   $(NULL)
 
 OS_CXXFLAGS := $(filter-out -fno-exceptions,$(OS_CXXFLAGS)) -fexceptions
 
 ifneq (,$(filter %86,$(TARGET_CPU)))
 CPU := x86
 else
 ifneq (,$(filter arm%,$(TARGET_CPU)))

--- a/config/autoconf.mk.in
+++ b/config/autoconf.mk.in
@@ -112,16 +112,17 @@ MOZ_CALLGRIND   = @MOZ_CALLGRIND@
 MOZ_VTUNE       = @MOZ_VTUNE@
 MOZ_TRACE_JSCALLS = @MOZ_TRACE_JSCALLS@
 MOZ_TRACEVIS    = @MOZ_TRACEVIS@
 DEHYDRA_PATH    = @DEHYDRA_PATH@
 
 NS_TRACE_MALLOC = @NS_TRACE_MALLOC@
 USE_ELF_DYNSTR_GC = @USE_ELF_DYNSTR_GC@
 USE_ELF_HACK = @USE_ELF_HACK@
+STDCXX_COMPAT = @STDCXX_COMPAT@
 INCREMENTAL_LINKER = @INCREMENTAL_LINKER@
 MACOSX_DEPLOYMENT_TARGET = @MACOSX_DEPLOYMENT_TARGET@
 MOZ_MAIL_NEWS	= @MOZ_MAIL_NEWS@
 BUILD_STATIC_LIBS = @BUILD_STATIC_LIBS@
 MOZ_ENABLE_LIBXUL = @MOZ_ENABLE_LIBXUL@
 ENABLE_TESTS	= @ENABLE_TESTS@
 IBMBIDI = @IBMBIDI@
 MOZ_UNIVERSALCHARDET = @MOZ_UNIVERSALCHARDET@

--- a/config/config.mk
+++ b/config/config.mk
@@ -844,8 +844,12 @@ CREATE_PRECOMPLETE_CMD = $(PYTHON) $(cal
 EXPAND_LIBS = $(PYTHON) -I$(DEPTH)/config $(topsrcdir)/config/expandlibs.py
 EXPAND_LIBS_EXEC = $(PYTHON) $(topsrcdir)/config/pythonpath.py -I$(DEPTH)/config $(topsrcdir)/config/expandlibs_exec.py
 EXPAND_LIBS_GEN = $(PYTHON) $(topsrcdir)/config/pythonpath.py -I$(DEPTH)/config $(topsrcdir)/config/expandlibs_gen.py
 EXPAND_AR = $(EXPAND_LIBS_EXEC) --extract -- $(AR)
 EXPAND_CC = $(EXPAND_LIBS_EXEC) --uselist -- $(CC)
 EXPAND_CCC = $(EXPAND_LIBS_EXEC) --uselist -- $(CCC)
 EXPAND_LD = $(EXPAND_LIBS_EXEC) --uselist -- $(LD)
 EXPAND_MKSHLIB = $(EXPAND_LIBS_EXEC) --uselist -- $(MKSHLIB)
+
+ifdef STDCXX_COMPAT
+CHECK_STDCXX = objdump -p $(1) | grep -e 'GLIBCXX_3\.4\.\(9\|[1-9][0-9]\)' && echo "Error: We don't want these libstdc++ symbol versions to be used" && exit 1 || exit 0
+endif

--- a/config/rules.mk
+++ b/config/rules.mk
@@ -987,16 +987,17 @@ endif	# MSVC with manifest tool
 ifdef MOZ_PROFILE_GENERATE
 # touch it a few seconds into the future to work around FAT's
 # 2-second granularity
 	touch -t `date +%Y%m%d%H%M.%S -d "now+5seconds"` pgo.relink
 endif
 else # !WINNT || GNU_CC
 ifeq ($(CPP_PROG_LINK),1)
 	$(EXPAND_CCC) -o $@ $(CXXFLAGS) $(WRAP_MALLOC_CFLAGS) $(PROGOBJS) $(RESFILE) $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(LIBS_DIR) $(LIBS) $(OS_LIBS) $(EXTRA_LIBS) $(BIN_FLAGS) $(WRAP_MALLOC_LIB) $(EXE_DEF_FILE)
+	$(call CHECK_STDCXX,$@)
 else # ! CPP_PROG_LINK
 	$(EXPAND_CC) -o $@ $(CFLAGS) $(PROGOBJS) $(RESFILE) $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(LIBS_DIR) $(LIBS) $(OS_LIBS) $(EXTRA_LIBS) $(BIN_FLAGS) $(EXE_DEF_FILE)
 endif # CPP_PROG_LINK
 endif # WINNT && !GNU_CC
 endif # WINCE
 
 ifdef ENABLE_STRIP
 	$(STRIP) $@
@@ -1052,16 +1053,17 @@ ifdef MSMANIFEST_TOOL
 	@if test -f $@.manifest; then \
 		mt.exe -NOLOGO -MANIFEST $@.manifest -OUTPUTRESOURCE:$@\;1; \
 		rm -f $@.manifest; \
 	fi
 endif	# MSVC with manifest tool
 else
 ifeq ($(CPP_PROG_LINK),1)
 	$(EXPAND_CCC) $(WRAP_MALLOC_CFLAGS) $(CXXFLAGS) -o $@ $< $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(LIBS_DIR) $(LIBS) $(OS_LIBS) $(EXTRA_LIBS) $(WRAP_MALLOC_LIB) $(BIN_FLAGS)
+	$(call CHECK_STDCXX,$@)
 else
 	$(EXPAND_CC) $(WRAP_MALLOC_CFLAGS) $(CFLAGS) $(OUTOPTION)$@ $< $(WIN32_EXE_LDFLAGS) $(LDFLAGS) $(LIBS_DIR) $(LIBS) $(OS_LIBS) $(EXTRA_LIBS) $(WRAP_MALLOC_LIB) $(BIN_FLAGS)
 endif # CPP_PROG_LINK
 endif # WINNT && !GNU_CC
 endif # WINCE
 
 ifdef ENABLE_STRIP
 	$(STRIP) $@
@@ -1172,16 +1174,17 @@ ifdef DTRACE_LIB_DEPENDENT
 ifndef XP_MACOSX
 	dtrace -G -C -s $(MOZILLA_DTRACE_SRC) -o  $(DTRACE_PROBE_OBJ) $(shell $(EXPAND_LIBS) $(MOZILLA_PROBE_LIBS))
 endif
 	$(EXPAND_MKSHLIB) $(SHLIB_LDSTARTFILE) $(OBJS) $(LOBJS) $(SUB_SHLOBJS) $(DTRACE_PROBE_OBJ) $(MOZILLA_PROBE_LIBS) $(RESFILE) $(LDFLAGS) $(SHARED_LIBRARY_LIBS) $(EXTRA_DSO_LDOPTS) $(OS_LIBS) $(EXTRA_LIBS) $(DEF_FILE) $(SHLIB_LDENDFILE)
 	@$(RM) $(DTRACE_PROBE_OBJ)
 else # ! DTRACE_LIB_DEPENDENT
 	$(EXPAND_MKSHLIB) $(SHLIB_LDSTARTFILE) $(OBJS) $(DTRACE_PROBE_OBJ) $(LOBJS) $(SUB_SHLOBJS) $(RESFILE) $(LDFLAGS) $(SHARED_LIBRARY_LIBS) $(EXTRA_DSO_LDOPTS) $(OS_LIBS) $(EXTRA_LIBS) $(DEF_FILE) $(SHLIB_LDENDFILE)
 endif # DTRACE_LIB_DEPENDENT
+	$(call CHECK_STDCXX,$@)
 
 ifeq (_WINNT,$(GNU_CC)_$(OS_ARCH))
 ifdef MSMANIFEST_TOOL
 ifdef EMBED_MANIFEST_AT
 	@if test -f $@.manifest; then \
 		mt.exe -NOLOGO -MANIFEST $@.manifest -OUTPUTRESOURCE:$@\;$(EMBED_MANIFEST_AT); \
 		rm -f $@.manifest; \
 	fi

--- a/configure.in
+++ b/configure.in
@@ -6433,17 +6433,17 @@ if test -n "$LIBJPEG_TURBO_X86_ASM" -o -
     if test -z "$LIBJPEG_TURBO_AS" ; then
         AC_MSG_ERROR([yasm is required to build with libjpeg-turbo's optimized JPEG decoding routines, but you do not appear to have yasm installed.  Either install it or configure with --disable-libjpeg-turbo to use the pure C JPEG decoder.  See https://developer.mozilla.org/en/YASM for more details.])
     fi
 
     dnl Check that we have the right yasm version.  We require 1.0.1 or newer
     dnl on Linux and 1.1 or newer everywhere else.
     if test "$OS_ARCH" = "Linux" ; then
         if test "$_YASM_MAJOR_VERSION" -lt "1" -o \( "$_YASM_MAJOR_VERSION" -eq "1" -a "$_YASM_MINOR_VERSION" -eq "0" -a "$_YASM_RELEASE" -lt "1" \) ; then
-            AC_MSG_ERROR([yasm 1.0.1 or greater is required to build with libjpeg-turbo's optimized JPEG decoding routines, but you appear to have version $_YASM_MAJOR_VERSION.$_YASM_MINOR_VERSION.$_YASM_MINOR_VERSION.  Upgrade to the newest version or configure with --disable-libjpeg-turbo to use the pure C JPEG decoder.  See https://developer.mozilla.org/en/YASM for more details.])
+            AC_MSG_ERROR([yasm 1.0.1 or greater is required to build with libjpeg-turbo's optimized JPEG decoding routines, but you appear to have version $_YASM_MAJOR_VERSION.$_YASM_MINOR_VERSION.$_YASM_RELEASE.  Upgrade to the newest version or configure with --disable-libjpeg-turbo to use the pure C JPEG decoder.  See https://developer.mozilla.org/en/YASM for more details.])
         fi
     else
         if test "$_YASM_MAJOR_VERSION" -lt "1" -o \( "$_YASM_MAJOR_VERSION" -eq "1" -a "$_YASM_MINOR_VERSION" -lt "1" \) ; then
             AC_MSG_ERROR([yasm 1.1 or greater is required to build with libjpeg-turbo's optimized JPEG decoding routines, but you appear to have version $_YASM_MAJOR_VERSION.$_YASM_MINOR_VERSION.  Upgrade to the newest version or configure with --disable-libjpeg-turbo to use the pure C JPEG decoder.  See https://developer.mozilla.org/en/YASM for more details.])
         fi
     fi
 fi
 
@@ -7712,16 +7712,38 @@ if test "$USE_ELF_HACK" = 1; then
         ;;
     *)
         USE_ELF_HACK=
         ;;
     esac
 fi
 
 dnl ========================================================
+dnl = libstdc++ compatibility hacks
+dnl ========================================================
+
+STDCXX_COMPAT=stdc++compat.cpp
+MOZ_ARG_DISABLE_BOOL(stdcxx-compat,
+[  --disable-stdcxx-compat Disable libstdc++ compatibility],
+    STDCXX_COMPAT=)
+
+# Disable on platforms where it doesn't make sense
+if test -n "$STDCXX_COMPAT"; then
+    case "${OS_TARGET}" in
+    Linux)
+        ;;
+    *)
+        STDCXX_COMPAT=
+        ;;
+    esac
+fi
+
+AC_SUBST(STDCXX_COMPAT)
+
+dnl ========================================================
 dnl = 
 dnl = Profiling and Instrumenting
 dnl = 
 dnl ========================================================
 MOZ_ARG_HEADER(Profiling and Instrumenting)
 
 dnl ========================================================
 dnl = Enable timeline service, which provides lightweight

--- a/content/base/src/nsGkAtomList.h
+++ b/content/base/src/nsGkAtomList.h
@@ -556,17 +556,16 @@ GK_ATOM(maxwidth, "maxwidth")
 GK_ATOM(mayscript, "mayscript")
 GK_ATOM(media, "media")
 GK_ATOM(mediaType, "media-type")
 GK_ATOM(member, "member")
 GK_ATOM(menu, "menu")
 GK_ATOM(menubar, "menubar")
 GK_ATOM(menubutton, "menubutton")
 GK_ATOM(menuButton, "menu-button")
-GK_ATOM(menugenerated, "menugenerated")
 GK_ATOM(menuitem, "menuitem")
 GK_ATOM(menulist, "menulist")
 GK_ATOM(menupopup, "menupopup")
 GK_ATOM(message, "message")
 GK_ATOM(meta, "meta")
 GK_ATOM(meter, "meter")
 GK_ATOM(method, "method")
 GK_ATOM(middle, "middle")

--- a/content/events/src/nsEventStateManager.cpp
+++ b/content/events/src/nsEventStateManager.cpp
@@ -139,17 +139,17 @@
 
 #include "imgIContainer.h"
 #include "nsIProperties.h"
 #include "nsISupportsPrimitives.h"
 #include "nsEventDispatcher.h"
 
 #include "nsServiceManagerUtils.h"
 #include "nsITimer.h"
-#include "nsIFontMetrics.h"
+#include "nsFontMetrics.h"
 #include "nsIDOMXULDocument.h"
 #include "nsIDragService.h"
 #include "nsIDragSession.h"
 #include "nsDOMDataTransfer.h"
 #include "nsContentAreaDragDrop.h"
 #ifdef MOZ_XUL
 #include "nsTreeBodyFrame.h"
 #endif
@@ -2485,22 +2485,21 @@ GetScrollableLineHeight(nsIFrame* aTarge
     nsIScrollableFrame* sf = f->GetScrollTargetFrame();
     if (sf)
       return sf->GetLineScrollAmount().height;
   }
 
   // Fall back to the font height of the target frame.
   const nsStyleFont* font = aTargetFrame->GetStyleFont();
   const nsFont& f = font->mFont;
-  nsCOMPtr<nsIFontMetrics> fm = aTargetFrame->PresContext()->GetMetricsFor(f);
+  nsRefPtr<nsFontMetrics> fm = aTargetFrame->PresContext()->GetMetricsFor(f);
   NS_ASSERTION(fm, "FontMetrics is null!");
-  nscoord lineHeight = 0;
   if (fm)
-    fm->GetHeight(lineHeight);
-  return lineHeight;
+    return fm->MaxHeight();
+  return 0;
 }
 
 void
 nsEventStateManager::SendLineScrollEvent(nsIFrame* aTargetFrame,
                                          nsMouseScrollEvent* aEvent,
                                          nsPresContext* aPresContext,
                                          nsEventStatus* aStatus,
                                          PRInt32 aNumLines)

--- a/content/media/nsBuiltinDecoderReader.cpp
+++ b/content/media/nsBuiltinDecoderReader.cpp
@@ -203,18 +203,17 @@ VideoData* VideoData::Create(nsVideoInfo
   data.mStereoMode = aInfo.mStereoMode;
 
   videoImage->SetData(data); // Copies buffer
   return v.forget();
 }
 
 nsBuiltinDecoderReader::nsBuiltinDecoderReader(nsBuiltinDecoder* aDecoder)
   : mMonitor("media.decoderreader"),
-    mDecoder(aDecoder),
-    mDataOffset(0)
+    mDecoder(aDecoder)
 {
   MOZ_COUNT_CTOR(nsBuiltinDecoderReader);
 }
 
 nsBuiltinDecoderReader::~nsBuiltinDecoderReader()
 {
   ResetDecode();
   MOZ_COUNT_DTOR(nsBuiltinDecoderReader);

--- a/content/media/nsBuiltinDecoderReader.h
+++ b/content/media/nsBuiltinDecoderReader.h
@@ -87,20 +87,16 @@ public:
 
   // The picture region inside the video frame to be displayed.
   nsIntRect mPicture;
 
   // Display size of the video frame. The picture region will be scaled
   // to and displayed at this size.
   nsIntSize mDisplay;
 
-  // The offset of the first non-header page in the file, in bytes.
-  // Used to seek to the start of the media.
-  PRInt64 mDataOffset;
-
   // Indicates the frame layout for single track stereo videos.
   mozilla::layers::StereoMode mStereoMode;
 
   // PR_TRUE if we have an active audio bitstream.
   PRPackedBool mHasAudio;
 
   // PR_TRUE if we have an active video bitstream.
   PRPackedBool mHasVideo;
@@ -508,18 +504,14 @@ protected:
   // The lock which we hold whenever we read or decode. This ensures the thread
   // safety of the reader and its data fields.
   Monitor mMonitor;
 
   // Reference to the owning decoder object. Do not hold the
   // reader's monitor when accessing this.
   nsBuiltinDecoder* mDecoder;
 
-  // The offset of the start of the first non-header page in the file.
-  // Used to seek to media start time.
-  PRInt64 mDataOffset;
-
   // Stores presentation info required for playback. The reader's monitor
   // must be held when accessing this.
   nsVideoInfo mInfo;
 };
 
 #endif

--- a/content/media/nsBuiltinDecoderStateMachine.cpp
+++ b/content/media/nsBuiltinDecoderStateMachine.cpp
@@ -1552,20 +1552,19 @@ void nsBuiltinDecoderStateMachine::Wait(
 
 VideoData* nsBuiltinDecoderStateMachine::FindStartTime()
 {
   NS_ASSERTION(IsCurrentThread(mDecoder->mStateMachineThread), "Should be on state machine thread.");
   mDecoder->GetMonitor().AssertCurrentThreadIn();
   PRInt64 startTime = 0;
   mStartTime = 0;
   VideoData* v = nsnull;
-  PRInt64 dataOffset = mInfo.mDataOffset;
   {
     MonitorAutoExit exitMon(mDecoder->GetMonitor());
-    v = mReader->FindStartTime(dataOffset, startTime);
+    v = mReader->FindStartTime(0, startTime);
   }
   if (startTime != 0) {
     mStartTime = startTime;
     if (mGotDurationFromMetaData) {
       NS_ASSERTION(mEndTime != -1,
                    "We should have mEndTime as supplied duration here");
       // We were specified a duration from a Content-Duration HTTP header.
       // Adjust mEndTime so that mEndTime-mStartTime matches the specified

--- a/content/media/ogg/nsOggReader.cpp
+++ b/content/media/ogg/nsOggReader.cpp
@@ -102,17 +102,18 @@ nsOggReader::nsOggReader(nsBuiltinDecode
   : nsBuiltinDecoderReader(aDecoder),
     mTheoraState(nsnull),
     mVorbisState(nsnull),
     mSkeletonState(nsnull),
     mVorbisSerial(0),
     mTheoraSerial(0),
     mPageOffset(0),
     mTheoraGranulepos(-1),
-    mVorbisGranulepos(-1)
+    mVorbisGranulepos(-1),
+    mDataOffset(0)
 {
   MOZ_COUNT_CTOR(nsOggReader);
 }
 
 nsOggReader::~nsOggReader()
 {
   ogg_sync_clear(&mOggState);
   MOZ_COUNT_DTOR(nsOggReader);
@@ -319,17 +320,16 @@ nsresult nsOggReader::ReadMetadata(nsVid
                                mTheoraState->mInfo.pic_y,
                                mTheoraState->mInfo.pic_width,
                                mTheoraState->mInfo.pic_height);
     mInfo.mFrame = nsIntSize(mTheoraState->mInfo.frame_width,
                              mTheoraState->mInfo.frame_height);
     mInfo.mDisplay = nsIntSize(mInfo.mPicture.width,
                                mInfo.mPicture.height);
   }
-  mInfo.mDataOffset = mDataOffset;
 
   if (mSkeletonState && mSkeletonState->HasIndex()) {
     // Extract the duration info out of the index, so we don't need to seek to
     // the end of stream to get it.
     nsAutoTArray<PRUint32, 2> tracks;
     if (HasVideo()) {
       tracks.AppendElement(mTheoraState->mSerial);
     }
@@ -901,29 +901,34 @@ GetChecksum(ogg_page* page)
 
 VideoData* nsOggReader::FindStartTime(PRInt64 aOffset,
                                       PRInt64& aOutStartTime)
 {
   NS_ASSERTION(mDecoder->OnStateMachineThread(),
                "Should be on state machine thread.");
   nsMediaStream* stream = mDecoder->GetCurrentStream();
   NS_ENSURE_TRUE(stream != nsnull, nsnull);
-  nsresult res = stream->Seek(nsISeekableStream::NS_SEEK_SET, aOffset);
+  // Ensure aOffset is after mDataOffset, the offset of the first non-header page.
+  // This prevents us from trying to parse header pages as content pages.
+  NS_ASSERTION(mDataOffset > 0, "Must know mDataOffset by now");
+  PRInt64 offset = NS_MAX(mDataOffset, aOffset);
+  nsresult res = stream->Seek(nsISeekableStream::NS_SEEK_SET, offset);
   NS_ENSURE_SUCCESS(res, nsnull);
-  return nsBuiltinDecoderReader::FindStartTime(aOffset, aOutStartTime);
+  return nsBuiltinDecoderReader::FindStartTime(offset, aOutStartTime);
 }
 
 PRInt64 nsOggReader::FindEndTime(PRInt64 aEndOffset)
 {
   MonitorAutoEnter mon(mMonitor);
   NS_ASSERTION(mDecoder->OnStateMachineThread(),
                "Should be on state machine thread.");
   NS_ASSERTION(mDataOffset > 0,
                "Should have offset of first non-header page");
-  PRInt64 endTime = FindEndTime(mDataOffset, aEndOffset, PR_FALSE, &mOggState);
+  PRInt64 offset = NS_MAX(mDataOffset, aEndOffset);
+  PRInt64 endTime = FindEndTime(mDataOffset, offset, PR_FALSE, &mOggState);
   // Reset read head to start of media data.
   nsMediaStream* stream = mDecoder->GetCurrentStream();
   NS_ENSURE_TRUE(stream != nsnull, -1);
   nsresult res = stream->Seek(nsISeekableStream::NS_SEEK_SET, mDataOffset);
   NS_ENSURE_SUCCESS(res, -1);
   return endTime;
 }
 

--- a/content/media/ogg/nsOggReader.h
+++ b/content/media/ogg/nsOggReader.h
@@ -277,11 +277,16 @@ private:
   // the page we're about to read.
   PRInt64 mPageOffset;
 
   // The granulepos of the last decoded Theora frame.
   PRInt64 mTheoraGranulepos;
 
   // The granulepos of the last decoded Vorbis sample.
   PRInt64 mVorbisGranulepos;
+
+  // The offset of the first non-header page in the file, in bytes.
+  // Used to seek to the start of the media, and to prevent us trying to
+  // decode pages before this offset (the header pages) as content pages.
+  PRInt64 mDataOffset;
 };
 
 #endif

--- a/content/media/raw/nsRawReader.h
+++ b/content/media/raw/nsRawReader.h
@@ -107,17 +107,16 @@ public:
 
   virtual PRBool HasVideo()
   {
     return PR_TRUE;
   }
 
   virtual nsresult ReadMetadata(nsVideoInfo* aInfo);
   virtual nsresult Seek(PRInt64 aTime, PRInt64 aStartTime, PRInt64 aEndTime, PRInt64 aCurrentTime);
-  virtual PRInt64 FindEndTime(PRInt64 aEndOffset);
   virtual nsresult GetBuffered(nsTimeRanges* aBuffered, PRInt64 aStartTime);
 
 private:
   PRBool ReadFromStream(nsMediaStream *aStream, PRUint8 *aBuf,
                         PRUint32 aLength);
 
   nsRawVideoHeader mMetadata;
   PRUint32 mCurrentFrame;

--- a/content/media/wave/nsWaveReader.cpp
+++ b/content/media/wave/nsWaveReader.cpp
@@ -159,17 +159,16 @@ nsresult nsWaveReader::ReadMetadata(nsVi
   if (!loaded) {
     return NS_ERROR_FAILURE;
   }
 
   mInfo.mHasAudio = PR_TRUE;
   mInfo.mHasVideo = PR_FALSE;
   mInfo.mAudioRate = mSampleRate;
   mInfo.mAudioChannels = mChannels;
-  mInfo.mDataOffset = -1;
 
   *aInfo = mInfo;
 
   MonitorAutoExit exitReaderMon(mMonitor);
   MonitorAutoEnter decoderMon(mDecoder->GetMonitor());
 
   mDecoder->GetStateMachine()->SetDuration(
     static_cast<PRInt64>(BytesToTime(GetDataLength()) * USECS_PER_S));

--- a/content/media/webm/nsWebMReader.cpp
+++ b/content/media/webm/nsWebMReader.cpp
@@ -325,21 +325,16 @@ nsresult nsWebMReader::ReadMetadata(nsVi
           break;
         case 4:
           mInfo.mStereoMode = STEREO_MODE_BOTTOM_TOP;
           break;
         default:
           mInfo.mStereoMode = STEREO_MODE_MONO;
         }
       }
-
-      // mDataOffset is not used by the WebM backend.
-      // See bug 566779 for a suggestion to refactor
-      // and remove it.
-      mInfo.mDataOffset = -1;
     }
     else if (!mHasAudio && type == NESTEGG_TRACK_AUDIO) {
       nestegg_audio_params params;
       r = nestegg_track_audio_params(mContext, track, &params);
       if (r == -1) {
         Cleanup();
         return NS_ERROR_FAILURE;
       }

--- a/content/svg/content/src/SVGAnimatedNumberList.cpp
+++ b/content/svg/content/src/SVGAnimatedNumberList.cpp
@@ -38,17 +38,17 @@
 #include "DOMSVGAnimatedNumberList.h"
 #include "nsSVGElement.h"
 #include "nsSVGAttrTearoffTable.h"
 #ifdef MOZ_SMIL
 #include "nsSMILValue.h"
 #include "SVGNumberListSMILType.h"
 #endif // MOZ_SMIL
 
-using namespace mozilla;
+namespace mozilla {
 
 nsresult
 SVGAnimatedNumberList::SetBaseValueString(const nsAString& aValue)
 {
   SVGNumberList newBaseValue;
   nsresult rv = newBaseValue.SetValueFromString(aValue);
   if (NS_FAILED(rv)) {
     return rv;
@@ -209,8 +209,10 @@ SVGAnimatedNumberList::SMILAnimatedNumbe
 void
 SVGAnimatedNumberList::SMILAnimatedNumberList::ClearAnimValue()
 {
   if (mVal->mAnimVal) {
     mVal->ClearAnimValue(mElement, mAttrEnum);
   }
 }
 #endif // MOZ_SMIL
+
+} // namespace mozilla

--- a/content/svg/content/src/SVGAnimatedPathSegList.cpp
+++ b/content/svg/content/src/SVGAnimatedPathSegList.cpp
@@ -40,17 +40,17 @@
 #include "nsSVGAttrTearoffTable.h"
 #ifdef MOZ_SMIL
 #include "nsSMILValue.h"
 #include "SVGPathSegListSMILType.h"
 #endif // MOZ_SMIL
 
 // See the comments in this file's header!
 
-using namespace mozilla;
+namespace mozilla {
 
 nsresult
 SVGAnimatedPathSegList::SetBaseValueString(const nsAString& aValue)
 {
   SVGPathData newBaseValue;
 
   // The spec says that the path data is parsed and accepted up to the first
   // error encountered, so we don't return early if an error occurs. However,
@@ -233,8 +233,9 @@ void
 SVGAnimatedPathSegList::SMILAnimatedPathSegList::ClearAnimValue()
 {
   if (mVal->mAnimVal) {
     mVal->ClearAnimValue(mElement);
   }
 }
 #endif // MOZ_SMIL
 
+} // namespace mozilla

--- a/content/svg/content/src/SVGAnimatedPointList.cpp
+++ b/content/svg/content/src/SVGAnimatedPointList.cpp
@@ -40,17 +40,17 @@
 #include "nsSVGAttrTearoffTable.h"
 #ifdef MOZ_SMIL
 #include "nsSMILValue.h"
 #include "SVGPointListSMILType.h"
 #endif // MOZ_SMIL
 
 // See the comments in this file's header!
 
-using namespace mozilla;
+namespace mozilla {
 
 nsresult
 SVGAnimatedPointList::SetBaseValueString(const nsAString& aValue)
 {
   SVGPointList newBaseValue;
 
   // The spec says that the point data is parsed and accepted up to the first
   // error encountered, so we don't return early if an error occurs. However,
@@ -236,8 +236,9 @@ void
 SVGAnimatedPointList::SMILAnimatedPointList::ClearAnimValue()
 {
   if (mVal->mAnimVal) {
     mVal->ClearAnimValue(mElement);
   }
 }
 #endif // MOZ_SMIL
 
+} // namespace mozilla

--- a/content/svg/content/src/SVGLengthList.h
+++ b/content/svg/content/src/SVGLengthList.h
@@ -131,24 +131,24 @@ private:
   }
 
   PRBool InsertItem(PRUint32 aIndex, const SVGLength &aLength) {
     if (aIndex >= mLengths.Length()) aIndex = mLengths.Length();
     return !!mLengths.InsertElementAt(aIndex, aLength);
   }
 
   void ReplaceItem(PRUint32 aIndex, const SVGLength &aLength) {
-    NS_ASSERTION(aIndex < mLengths.Length(),
-                 "DOM wrapper caller should have raised INDEX_SIZE_ERR");
+    NS_ABORT_IF_FALSE(aIndex < mLengths.Length(),
+                      "DOM wrapper caller should have raised INDEX_SIZE_ERR");
     mLengths[aIndex] = aLength;
   }
 
   void RemoveItem(PRUint32 aIndex) {
-    NS_ASSERTION(aIndex < mLengths.Length(),
-                 "DOM wrapper caller should have raised INDEX_SIZE_ERR");
+    NS_ABORT_IF_FALSE(aIndex < mLengths.Length(),
+                      "DOM wrapper caller should have raised INDEX_SIZE_ERR");
     mLengths.RemoveElementAt(aIndex);
   }
 
   PRBool AppendItem(SVGLength aLength) {
     return !!mLengths.AppendElement(aLength);
   }
 
 protected:
@@ -217,17 +217,17 @@ public:
     mCanZeroPadList = aCanZeroPadList;
   }
 
   nsSVGElement* Element() const {
     return mElement; // .get();
   }
 
   PRUint8 Axis() const {
-    NS_ASSERTION(mElement, "Axis() isn't valid");
+    NS_ABORT_IF_FALSE(mElement, "Axis() isn't valid");
     return mAxis;
   }
 
   /**
    * The value returned by this function depends on which attribute this object
    * is for. If appending a list of zeros to the attribute's list would have no
    * affect on rendering (e.g. the attributes 'dx' and 'dy' on <text>), then
    * this method will return PR_TRUE. If appending a list of zeros to the

--- a/content/svg/content/src/SVGLengthListSMILType.cpp
+++ b/content/svg/content/src/SVGLengthListSMILType.cpp
@@ -117,26 +117,51 @@ SVGLengthListSMILType::Add(nsSMILValue& 
   // and *not* vice versa! It's okay in the case of adding a shorter list to a
   // longer list because during the add operation we'll end up adding the
   // zeros to actual specified values. It's *not* okay in the case of adding a
   // longer list to a shorter list because then we end up adding to implicit
   // zeros when we'd actually need to add to whatever the underlying values
   // should be, not zeros, and those values are not explicit or otherwise
   // available.
 
+  NS_ABORT_IF_FALSE(!dest.IsEmpty() || !valueToAdd.IsEmpty(),
+                    "Expecting at least one non-identity operand");
+
+  if (!valueToAdd.Element()) { // Adding identity value - no-op
+    NS_ABORT_IF_FALSE(valueToAdd.IsEmpty(),
+                      "Identity values should be empty");
+    return NS_OK;
+  }
+
+  if (!dest.Element()) { // Adding *to* an identity value
+    NS_ABORT_IF_FALSE(dest.IsEmpty(),
+                      "Identity values should be empty");
+    if (!dest.SetLength(valueToAdd.Length())) {
+      return NS_ERROR_OUT_OF_MEMORY;
+    }
+    for (PRUint32 i = 0; i < dest.Length(); ++i) {
+      dest[i].SetValueAndUnit(valueToAdd[i].GetValueInCurrentUnits() * aCount,
+                              valueToAdd[i].GetUnit());
+    }
+    dest.SetInfo(valueToAdd.Element(), valueToAdd.Axis(),
+                 valueToAdd.CanZeroPadList()); // propagate target element info!
+    return NS_OK;
+  }
+  NS_ABORT_IF_FALSE(dest.Element() == valueToAdd.Element(),
+                    "adding values from different elements...?");
+
+  // Zero-pad our |dest| list, if necessary.
   if (dest.Length() < valueToAdd.Length()) {
     if (!dest.CanZeroPadList()) {
       // nsSVGUtils::ReportToConsole
       return NS_ERROR_FAILURE;
     }
 
-    NS_ASSERTION(valueToAdd.CanZeroPadList() || dest.Length() == 0,
-                 "Only \"zero\" nsSMILValues from the SMIL engine should "
-                 "return PR_TRUE for CanZeroPadList() when the attribute "
-                 "being animated can't be zero padded");
+    NS_ABORT_IF_FALSE(valueToAdd.CanZeroPadList(),
+                      "values disagree about attribute's zero-paddibility");
 
     PRUint32 i = dest.Length();
     if (!dest.SetLength(valueToAdd.Length())) {
       return NS_ERROR_OUT_OF_MEMORY;
     }
     for (; i < valueToAdd.Length(); ++i) {
       dest[i].SetValueAndUnit(0.0f, valueToAdd[i].GetUnit());
     }
@@ -148,23 +173,24 @@ SVGLengthListSMILType::Add(nsSMILValue& 
       valToAdd = valueToAdd[i].GetValueInCurrentUnits();
     } else {
       // If units differ, we use the unit of the item in 'dest'.
       // We leave it to the frame code to check that values are finite.
       valToAdd = valueToAdd[i].GetValueInSpecifiedUnit(dest[i].GetUnit(),
                                                        dest.Element(),
                                                        dest.Axis());
     }
-    dest[i].SetValueAndUnit(dest[i].GetValueInCurrentUnits() + valToAdd,
-                            dest[i].GetUnit());
+    dest[i].SetValueAndUnit(
+      dest[i].GetValueInCurrentUnits() + valToAdd * aCount,
+      dest[i].GetUnit());
   }
 
-  // propagate flag:
-  dest.SetCanZeroPadList(dest.CanZeroPadList() &&
-                         valueToAdd.CanZeroPadList());
+  // propagate target element info!
+  dest.SetInfo(valueToAdd.Element(), valueToAdd.Axis(),
+               dest.CanZeroPadList() && valueToAdd.CanZeroPadList());
 
   return NS_OK;
 }
 
 nsresult
 SVGLengthListSMILType::ComputeDistance(const nsSMILValue& aFrom,
                                        const nsSMILValue& aTo,
                                        double& aDistance) const
@@ -176,18 +202,18 @@ SVGLengthListSMILType::ComputeDistance(c
     *static_cast<const SVGLengthListAndInfo*>(aFrom.mU.mPtr);
   const SVGLengthListAndInfo& to =
     *static_cast<const SVGLengthListAndInfo*>(aTo.mU.mPtr);
 
   // To understand this code, see the comments documenting our Init() method,
   // and documenting SVGLengthListAndInfo::CanZeroPadList().
 
   NS_ASSERTION((from.CanZeroPadList() == to.CanZeroPadList()) ||
-               (from.CanZeroPadList() && from.Length() == 0) ||
-               (to.CanZeroPadList() && to.Length() == 0),
+               (from.CanZeroPadList() && from.IsEmpty()) ||
+               (to.CanZeroPadList() && to.IsEmpty()),
                "Only \"zero\" nsSMILValues from the SMIL engine should "
                "return PR_TRUE for CanZeroPadList() when the attribute "
                "being animated can't be zero padded");
 
   if ((from.Length() < to.Length() && !from.CanZeroPadList()) ||
       (to.Length() < from.Length() && !to.CanZeroPadList())) {
     // nsSVGUtils::ReportToConsole
     return NS_ERROR_FAILURE;
@@ -251,18 +277,18 @@ SVGLengthListSMILType::Interpolate(const
     *static_cast<const SVGLengthListAndInfo*>(aEndVal.mU.mPtr);
   SVGLengthListAndInfo& result =
     *static_cast<SVGLengthListAndInfo*>(aResult.mU.mPtr);
 
   // To understand this code, see the comments documenting our Init() method,
   // and documenting SVGLengthListAndInfo::CanZeroPadList().
 
   NS_ASSERTION((start.CanZeroPadList() == end.CanZeroPadList()) ||
-               (start.CanZeroPadList() && start.Length() == 0) ||
-               (end.CanZeroPadList() && end.Length() == 0),
+               (start.CanZeroPadList() && start.IsEmpty()) ||
+               (end.CanZeroPadList() && end.IsEmpty()),
                "Only \"zero\" nsSMILValues from the SMIL engine should "
                "return PR_TRUE for CanZeroPadList() when the attribute "
                "being animated can't be zero padded");
 
   if ((start.Length() < end.Length() && !start.CanZeroPadList()) ||
       (end.Length() < start.Length() && !end.CanZeroPadList())) {
     // nsSVGUtils::ReportToConsole
     return NS_ERROR_FAILURE;
@@ -294,16 +320,16 @@ SVGLengthListSMILType::Interpolate(const
                               start[i].GetValueInCurrentUnits() * aUnitDistance,
                               start[i].GetUnit());
   }
   for (; i < end.Length(); ++i) {
     result[i].SetValueAndUnit(end[i].GetValueInCurrentUnits() * aUnitDistance,
                               end[i].GetUnit());
   }
 
-  // propagate flag:
-  result.SetCanZeroPadList(start.CanZeroPadList() &&
-                           end.CanZeroPadList());
+  // propagate target element info!
+  result.SetInfo(end.Element(), end.Axis(),
+                 start.CanZeroPadList() && end.CanZeroPadList());
 
   return NS_OK;
 }
 
 } // namespace mozilla

--- a/content/svg/content/src/SVGNumberList.cpp
+++ b/content/svg/content/src/SVGNumberList.cpp
@@ -42,17 +42,17 @@
 #include "nsContentUtils.h"
 #include "nsString.h"
 #include "nsSVGUtils.h"
 #include "string.h"
 #include "prdtoa.h"
 #include "nsTextFormatter.h"
 #include "nsCharSeparatedTokenizer.h"
 
-using namespace mozilla;
+namespace mozilla {
 
 nsresult
 SVGNumberList::CopyFrom(const SVGNumberList& rhs)
 {
   if (!mNumbers.SetCapacity(rhs.Length())) {
     // Yes, we do want fallible alloc here
     return NS_ERROR_OUT_OF_MEMORY;
   }
@@ -103,8 +103,10 @@ SVGNumberList::SetValueFromString(const 
     }
     temp.AppendItem(num);
   }
   if (tokenizer.lastTokenEndedWithSeparator()) {
     return NS_ERROR_DOM_SYNTAX_ERR; // trailing comma
   }
   return CopyFrom(temp);
 }
+
+} // namespace mozilla

--- a/content/svg/content/src/SVGNumberList.h
+++ b/content/svg/content/src/SVGNumberList.h
@@ -134,24 +134,24 @@ private:
   PRBool InsertItem(PRUint32 aIndex, const float &aNumber) {
     if (aIndex >= mNumbers.Length()) {
       aIndex = mNumbers.Length();
     }
     return !!mNumbers.InsertElementAt(aIndex, aNumber);
   }
 
   void ReplaceItem(PRUint32 aIndex, const float &aNumber) {
-    NS_ASSERTION(aIndex < mNumbers.Length(),
-                 "DOM wrapper caller should have raised INDEX_SIZE_ERR");
+    NS_ABORT_IF_FALSE(aIndex < mNumbers.Length(),
+                      "DOM wrapper caller should have raised INDEX_SIZE_ERR");
     mNumbers[aIndex] = aNumber;
   }
 
   void RemoveItem(PRUint32 aIndex) {
-    NS_ASSERTION(aIndex < mNumbers.Length(),
-                 "DOM wrapper caller should have raised INDEX_SIZE_ERR");
+    NS_ABORT_IF_FALSE(aIndex < mNumbers.Length(),
+                      "DOM wrapper caller should have raised INDEX_SIZE_ERR");
     mNumbers.RemoveElementAt(aIndex);
   }
 
   PRBool AppendItem(float aNumber) {
     return !!mNumbers.AppendElement(aNumber);
   }
 
 protected:

--- a/content/svg/content/src/SVGNumberListSMILType.cpp
+++ b/content/svg/content/src/SVGNumberListSMILType.cpp
@@ -51,17 +51,17 @@
  *
  * Note that we don't need to worry about that variation here, however. The way
  * that the SMIL engine creates and composites sandwich layers together allows
  * us to treat "identity" nsSMILValue objects as a number list of zeros. Such
  * identity nsSMILValues are identified by the fact that their
  # SVGNumberListAndInfo has not been given an element yet.
  */
 
-using namespace mozilla;
+namespace mozilla {
 
 /*static*/ SVGNumberListSMILType SVGNumberListSMILType::sSingleton;
 
 //----------------------------------------------------------------------
 // nsISMILType implementation
 
 void
 SVGNumberListSMILType::Init(nsSMILValue &aValue) const
@@ -235,8 +235,10 @@ SVGNumberListSMILType::Interpolate(const
     }
     return NS_OK;
   }
   for (PRUint32 i = 0; i < end.Length(); ++i) {
     result[i] = start[i] + (end[i] - start[i]) * aUnitDistance;
   }
   return NS_OK;
 }
+
+} // namespace mozilla

--- a/content/svg/content/src/SVGPathSegListSMILType.cpp
+++ b/content/svg/content/src/SVGPathSegListSMILType.cpp
@@ -34,17 +34,17 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "SVGPathSegListSMILType.h"
 #include "nsSMILValue.h"
 #include "SVGPathData.h"
 #include <math.h>
 
-using namespace mozilla;
+namespace mozilla {
 
 /*static*/ SVGPathSegListSMILType SVGPathSegListSMILType::sSingleton;
 
 //----------------------------------------------------------------------
 // nsISMILType implementation
 
 void
 SVGPathSegListSMILType::Init(nsSMILValue &aValue) const
@@ -464,8 +464,10 @@ SVGPathSegListSMILType::Interpolate(cons
 
     NS_ABORT_IF_FALSE(pStart == pStartDataEnd && pEnd == pEndDataEnd &&
                       pResult == result.end(),
                       "Very, very bad - path data corrupt");
   }
 
   return NS_OK;
 }
+
+} // namespace mozilla

--- a/content/svg/content/src/SVGPointList.cpp
+++ b/content/svg/content/src/SVGPointList.cpp
@@ -42,17 +42,17 @@
 #include "nsContentUtils.h"
 #include "nsString.h"
 #include "nsSVGUtils.h"
 #include "string.h"
 #include "prdtoa.h"
 #include "nsTextFormatter.h"
 #include "nsCharSeparatedTokenizer.h"
 
-using namespace mozilla;
+namespace mozilla {
 
 nsresult
 SVGPointList::CopyFrom(const SVGPointList& rhs)
 {
   if (!SetCapacity(rhs.Length())) {
     // Yes, we do want fallible alloc here
     return NS_ERROR_OUT_OF_MEMORY;
   }
@@ -147,8 +147,10 @@ SVGPointList::SetValueFromString(const n
     rv = NS_ERROR_DOM_SYNTAX_ERR; // trailing comma
   }
   nsresult rv2 = CopyFrom(temp);
   if (NS_FAILED(rv2)) {
     return rv2; // prioritize OOM error code over syntax errors
   }
   return rv;
 }
+
+} // namespace mozilla

--- a/content/svg/content/src/SVGPointList.h
+++ b/content/svg/content/src/SVGPointList.h
@@ -138,24 +138,24 @@ private:
   PRBool InsertItem(PRUint32 aIndex, const SVGPoint &aPoint) {
     if (aIndex >= mItems.Length()) {
       aIndex = mItems.Length();
     }
     return !!mItems.InsertElementAt(aIndex, aPoint);
   }
 
   void ReplaceItem(PRUint32 aIndex, const SVGPoint &aPoint) {
-    NS_ASSERTION(aIndex < mItems.Length(),
-                 "DOM wrapper caller should have raised INDEX_SIZE_ERR");
+    NS_ABORT_IF_FALSE(aIndex < mItems.Length(),
+                      "DOM wrapper caller should have raised INDEX_SIZE_ERR");
     mItems[aIndex] = aPoint;
   }
 
   void RemoveItem(PRUint32 aIndex) {
-    NS_ASSERTION(aIndex < mItems.Length(),
-                 "DOM wrapper caller should have raised INDEX_SIZE_ERR");
+    NS_ABORT_IF_FALSE(aIndex < mItems.Length(),
+                      "DOM wrapper caller should have raised INDEX_SIZE_ERR");
     mItems.RemoveElementAt(aIndex);
   }
 
   PRBool AppendItem(SVGPoint aPoint) {
     return !!mItems.AppendElement(aPoint);
   }
 
 protected:

--- a/content/svg/content/src/SVGPointListSMILType.cpp
+++ b/content/svg/content/src/SVGPointListSMILType.cpp
@@ -35,17 +35,17 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "SVGPointListSMILType.h"
 #include "nsSMILValue.h"
 #include "SVGPointList.h"
 #include "nsMathUtils.h"
 #include <math.h>
 
-using namespace mozilla;
+namespace mozilla {
 
 /*static*/ SVGPointListSMILType SVGPointListSMILType::sSingleton;
 
 //----------------------------------------------------------------------
 // nsISMILType implementation
 
 void
 SVGPointListSMILType::Init(nsSMILValue &aValue) const
@@ -220,8 +220,10 @@ SVGPointListSMILType::Interpolate(const 
     }
     return NS_OK;
   }
   for (PRUint32 i = 0; i < end.Length(); ++i) {
     result[i] = start[i] + (end[i] - start[i]) * aUnitDistance;
   }
   return NS_OK;
 }
+
+} // namespace mozilla

--- a/content/svg/content/test/test_SVGxxxList.xhtml
+++ b/content/svg/content/test/test_SVGxxxList.xhtml
@@ -75,16 +75,20 @@ To have the battery of generic tests run
   attr_val_3a:
   attr_val_3b:
     Two attribute values containing three different items.
   attr_val_4
     An attribute value containing four items.
   attr_val_5a:
   attr_val_5b:
     Two attribute values containing five different items.
+  attr_val_5b_firstItem_x3_constructor:
+    Function to construct a list-item that should match the first item in a
+    SVGXxxList after three repeats of a cumulative animation to attr_val_5b.
+    This function takes t.item_constructor as its only argument.
   item_constructor:
     Function to create a dummy list item.
   item_is:
     Function to compare two list items for equality, like "is()". If this
     property is omitted, it is assumed that we can just compare
     "item.value" (which is the case for most list types).
 */
 
@@ -99,17 +103,22 @@ var tests = [
     el_type: 'SVGTextElement',
     prop_type: 'SVGAnimatedLengthList',
     list_type: 'SVGLengthList',
     item_type: 'SVGLength',
     attr_val_3a: '10 20ex, 30in',
     attr_val_3b: '30in 10, 20ex',
     attr_val_4 : '10 20ex, 30in ,40cm',
     attr_val_5a: '10 20ex, 30in ,40cm , 50%',
-    attr_val_5b: '50% 10, 20ex ,30in , 40cm',
+    attr_val_5b: '20 50%, 20ex ,30in , 40cm',
+    attr_val_5b_firstItem_x3_constructor: function(constructor) {
+      var expected = constructor();
+      expected.value = 60;
+      return expected;
+    },
     item_constructor: function() {
       // We need this function literal to avoid "Illegal operation on
       // WrappedNative prototype object" NS_ERROR_XPC_BAD_OP_ON_WN_PROTO.
       return document.getElementById('svg').createSVGLength();
     }
   },
   {
     // SVGNumberList test:
@@ -122,16 +131,21 @@ var tests = [
     prop_type: 'SVGAnimatedNumberList',
     list_type: 'SVGNumberList',
     item_type: 'SVGNumber',
     attr_val_3a: '0 20 40',
     attr_val_3b: '60 40 20',
     attr_val_4 : '40 20 10 80',
     attr_val_5a: '90 30 60 20 70',
     attr_val_5b: '30 20 70 30 90',
+    attr_val_5b_firstItem_x3_constructor: function(constructor) {
+      var expected = constructor();
+      expected.value = 90;
+      return expected;
+    },
     item_constructor: function() {
       // We need this function literal to avoid "Illegal operation on
       // WrappedNative prototype object" NS_ERROR_XPC_BAD_OP_ON_WN_PROTO.
       return document.getElementById('svg').createSVGNumber();
     }
   },
   {
     // SVGNumberList test:
@@ -144,16 +158,21 @@ var tests = [
     prop_type: 'SVGAnimatedNumberList',
     list_type: 'SVGNumberList',
     item_type: 'SVGNumber',
     attr_val_3a: '0 .5 .2',
     attr_val_3b: '1 .7 .1',
     attr_val_4 : '.5 .3 .8 .2',
     attr_val_5a: '3 4 5 6 7',
     attr_val_5b: '7 6 5 4 3',
+    attr_val_5b_firstItem_x3_constructor: function(constructor) {
+      var expected = constructor();
+      expected.value = 21;
+      return expected;
+    },
     item_constructor: function() {
       // We need this function literal to avoid "Illegal operation on
       // WrappedNative prototype object" NS_ERROR_XPC_BAD_OP_ON_WN_PROTO.
       return document.getElementById('svg').createSVGNumber();
     }
   },
   {
     // SVGPointList test:
@@ -166,16 +185,22 @@ var tests = [
     prop_type: null,
     list_type: 'SVGPointList',
     item_type: 'SVGPoint',
     attr_val_3a: ' 10,10 50,50 90,10 ',
     attr_val_3b: ' 10,50 50,10 90,50 ',
     attr_val_4 : ' 10,10 50,50 90,10 200,100 ',
     attr_val_5a: ' 10,10 50,50 90,10 130,50 170,10 ',
     attr_val_5b: ' 50,10 50,10 90,50 130,10 170,50 ',
+    attr_val_5b_firstItem_x3_constructor: function(constructor) {
+      var expected = constructor();
+      expected.x = 150;
+      expected.y = 30;
+      return expected;
+    },
     item_constructor: function() {
       // XXX return different values each time
       return document.getElementById('svg').createSVGPoint();
     },
     item_is: function(itemA, itemB, message) {
       ok(typeof(itemA.x) != 'undefined' &&
          typeof(itemB.x) != 'undefined',
          'expecting x property');
@@ -198,27 +223,53 @@ var tests = [
     prop_type: null,
     list_type: 'SVGPathSegList',
     item_type: 'SVGPathSeg',
     attr_val_3a: 'M 10,10 L 50,50 L 90,10',
     attr_val_3b: 'M 10,50 L 50,10 L 90,50',
     attr_val_4 : 'M 10,10 L 50,50 L 90,10 M 200,100',
     attr_val_5a: 'M 10,10 L 50,50 L 90,10 L 130,50 L 170,10',
     attr_val_5b: 'M 50,10 L 50,10 L 90,50 L 130,10 L 170,50',
+    attr_val_5b_firstItem_x3_constructor: function(constructor) {
+      var expected = constructor();
+      is(expected.pathSegTypeAsLetter, "M",
+         "test error -- expected constructor to generate a segment of type M");
+      expected.x = 150;
+      expected.y = 30;
+      return expected;
+    },
     item_constructor: function() {
       // XXX return different values each time
       return document.getElementById('path').createSVGPathSegMovetoAbs(1, 1);
     },
     item_is: function(itemA, itemB, message) {
-      ok(typeof(itemA.pathSegType) != 'undefined' &&
-         typeof(itemB.pathSegType) != 'undefined',
-         'expecting pathSegType property');
+      ok(typeof(itemA.pathSegTypeAsLetter) != 'undefined' &&
+         typeof(itemB.pathSegTypeAsLetter) != 'undefined',
+         'expecting pathSegTypeAsLetter property');
+
+      // First: are we dealing  with the same type of segment?
+      is(itemA.pathSegTypeAsLetter, itemB.pathSegTypeAsLetter, message);
+      if (itemA.pathSegTypeAsLetter != itemB.pathSegTypeAsLetter)
+        return;  // The rest of this function is nonsense if types don't match.
 
-      // NOTE: Just comparing pathSegType - probably sufficient for our purposes
-      is(itemA.pathSegType, itemB.pathSegType, message);
+      // Make sure property-counts match (so we can iterate across itemA's
+      // properties and not worry about itemB having extra properties that
+      // we might be skipping over).
+      is(keys(itemA).length, keys(itemB).length,
+        'expecting same property-count when comparing path segs of same type.');
+
+      // Compare the properties, skipping the constant properties inherited
+      // from 'SVGPathSeg', and skipping the pathSegTypeAsLetter field since we
+      // already checked that above. 
+      for (var prop in itemA) {
+        if (!SVGPathSeg.hasOwnProperty(prop) &&
+            prop != 'pathSegTypeAsLetter') {
+          is(itemA[prop], itemB[prop], message);
+        }
+      }
     }
   },
 /*
   {
     // SVGPathSegList test:
     target_element_id: 'path',
     attr_name: 'd',
     prop_name: null, // SVGAnimatedPathData is an inherited interface!
@@ -233,22 +284,40 @@ var tests = [
     attr_val_4 : '',
     attr_val_5a: '',
     attr_val_5b: '',
     item_constructor: function() {
       // XXX return different values each time
       return SVGPathElement.createSVGPathSegLinetoAbs(1, 1);
     },
     item_is: function(itemA, itemB, message) {
-      ok(typeof(itemA.pathSegType) != 'undefined' &&
-         typeof(itemB.pathSegType) != 'undefined',
-         'expecting pathSegType property');
+      ok(typeof(itemA.pathSegTypeAsLetter) != 'undefined' &&
+         typeof(itemB.pathSegTypeAsLetter) != 'undefined',
+         'expecting pathSegTypeAsLetter property');
+
+      // First: are we dealing  with the same type of segment?
+      is(itemA.pathSegTypeAsLetter, itemB.pathSegTypeAsLetter, message);
+      if (itemA.pathSegTypeAsLetter != itemB.pathSegTypeAsLetter)
+        return;  // The rest of this function is nonsense if types don't match.
 
-      // NOTE: Just comparing pathSegType - probably sufficient for our purposes
-      is(itemA.pathSegType, itemB.pathSegType, message);
+      // Make sure property-counts match (so we can iterate across itemA's
+      // properties and not worry about itemB having extra properties that
+      // we might be skipping over).
+      is(keys(itemA).length, keys(itemB).length,
+        'expecting same property-count when comparing path segs of same type.');
+
+      // Compare the properties, skipping the constant properties inherited
+      // from 'SVGPathSeg', and skipping the pathSegTypeAsLetter field since we
+      // already checked that above. 
+      for (var prop in itemA) {
+        if (!SVGPathSeg.hasOwnProperty(prop) &&
+            prop != 'pathSegTypeAsLetter') {
+          is(itemA[prop], itemB[prop], message);
+        }
+      }
     }
   },
   {
     // SVGStringList test:
     target_element_id: 'g',
     attr_name: 'requiredFeatures', // requiredExtensions, systemLanguage, viewTarget
     prop_name: null, // SVGStringList attributes are not animatable
     bv_name: 'requiredFeatures',
@@ -294,22 +363,22 @@ var tests = [
   },
   */
 ];
 
 
 /*
 This function returns a DocumentFragment with three 'animate' element children. The duration of the three animations is as follows:
 
-  animation 1: |  *-----------*-----------*
+  animation 1: |  *-----------*-----------*-----------*
   animation 2: |     *--*
   animation 3: |                    *--*
-               |__________________________________> time (s)
-               |  |  |  |  |  |  |  |  |  |  |  |
-               0  1  2  3  4  5  6  7  8  9 10 11
+               |___________________________________________> time (s)
+               |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
+               0  1  2  3  4  5  6  7  8  9 10 11 12 13 14
 
 The first animation repeats once so that we can test state on a repeat animation.
 
 The second animation overrides the first animation for a short time, and has fewer list items than the first animation. This allows us to test object identity and other state on and after an overriding animation. Specifically, it allows us to check whether animVal list items are kept or discarded after the end of an overriding animation that has fewer items.
 
 The third animation has additive="sum", with fewer items than the lower priority animation 1, allowing us to test object identity and other state in that scenario. TODO: some type aware tests to check whether the composite fails or works?
 
 At t=0s and t=1s we test the effect of an attribute value changes in the absence and presence of SMIL animation respectively.
@@ -338,17 +407,18 @@ function create_animate_elements(test)
     var animate3 = document.createElementNS(SVG_NS, 'animate');
   }
 
   animate1.setAttribute('attributeName', test.attr_name);
   animate1.setAttribute('from', test.attr_val_5a);
   animate1.setAttribute('to', test.attr_val_5b);
   animate1.setAttribute('begin', '1s');
   animate1.setAttribute('dur', '4s');
-  animate1.setAttribute('repeatCount', '2');
+  animate1.setAttribute('repeatCount', '3');
+  animate1.setAttribute('accumulate', 'sum');
   animate1.setAttribute('fill', 'freeze');
   df.appendChild(animate1);
 
   animate2.setAttribute('attributeName', test.attr_name);
   animate2.setAttribute('from', test.attr_val_3a);
   animate2.setAttribute('to', test.attr_val_3b);
   animate2.setAttribute('begin', '2s');
   animate2.setAttribute('dur', '1s');
@@ -1212,35 +1282,41 @@ function run_animation_timeline_tests()
     // all SVGLengthList attributes allow a short list to be added to longer
     // list, they do not all allow a longer list to be added to shorter list.
     // Specifically that would not be good for 'x' and 'y' on <text> since
     // lengths there are not naturally zero. See the comment in
     // SVGLengthListSMILAttr::Add().
   }
 
 
-  /********************    t = 10s    ********************/
+  /********************    t = 13s    ********************/
 
-  svg.setCurrentTime(10); // all animations have finished, but one is frozen
+  svg.setCurrentTime(13); // all animations have finished, but one is frozen
 
   for each (var t in tests) {
     if (!t.animVal)
       continue;
 
     ok(t.baseVal.numberOfItems == t.old_baseVal_items.length &&
        t.baseVal.getItem(3) === t.old_baseVal_items[3],
        'When a SMIL animation ends, it should never affect the '+
        t.list_type+' for '+t.bv_path+', or its list items.');
 
     is(t.animVal.numberOfItems, 5,
        'Even though all SMIL animation have finished, the number '+
        'of items in the '+t.list_type+' for '+t.av_path+
        ' should still be more than the same as the number of items in '+
        t.bv_path+' since one of the animations is still frozen.');
 
+    var expected = t.attr_val_5b_firstItem_x3_constructor(t.item_constructor);
+    t.item_is(t.animVal.getItem(0), expected,
+      'animation with accumulate="sum" and repeatCount="3" for attribute "'+
+       t.attr_name+'" should end up at 3x the "to" value.');
+
+    // Unfreeze frozen animation (removing its effects)
     var frozen_animate_element =
       t.element.querySelector('animate[fill][attributeName="'+t.attr_name+'"]');
     frozen_animate_element.removeAttribute('fill');
 
     ok(t.animVal.numberOfItems == t.baseVal.numberOfItems,
        'Once all SMIL animation have finished and been un-frozen, the number '+
        'of items in the '+t.list_type+' for '+t.av_path+
        ' should be the same as the number of items in '+t.bv_path+'.');

--- a/gfx/src/Makefile.in
+++ b/gfx/src/Makefile.in
@@ -68,24 +68,23 @@ EXPORTS	= \
 	nsFont.h \
 	nsRect.h \
 	nsRegion.h \
 	nsPoint.h \
 	nsSize.h \
 	nsMargin.h \
 	nsTransform2D.h \
 	nsRenderingContext.h \
-	nsIFontMetrics.h \
+	nsFontMetrics.h \
 	nsIDeviceContext.h \
 	nsGfxCIID.h \
 	nsIRegion.h \
 	nsITheme.h \
 	nsThemeConstants.h \
 	gfxCrashReporterUtils.h \
-	nsIThebesFontMetrics.h \
 	nsBoundingMetrics.h \
 	$(NULL)
 
 ifdef MOZ_X11
 EXPORTS_NAMESPACES	= mozilla
 EXPORTS_mozilla		= X11Util.h
 endif
 
@@ -96,17 +95,17 @@ CPPSRCS = \
         nsRegion.cpp \
         nsTransform2D.cpp \
         nsScriptableRegion.cpp \
         gfxCrashReporterUtils.cpp \
         nsThebesDeviceContext.cpp \
         nsThebesRegion.cpp \
         nsThebesGfxFactory.cpp \
         nsRenderingContext.cpp \
-        nsThebesFontMetrics.cpp \
+        nsFontMetrics.cpp \
         nsThebesFontEnumerator.cpp \
        $(NULL)
 
 ifdef MOZ_X11
 CPPSRCS += X11Util.cpp
 endif
 
 ifeq ($(MOZ_WIDGET_TOOLKIT),android)

--- a/gfx/src/nsBoundingMetrics.h
+++ b/gfx/src/nsBoundingMetrics.h
@@ -38,17 +38,17 @@
 #ifndef __nsBoundingMetrics_h
 #define __nsBoundingMetrics_h
 
 #include "nsCoord.h"
 
 /* Struct used for accurate measurements of a string, in order to
  * allow precise positioning when processing MathML.  This is in its
  * own header file because some very-widely-included headers need it
- * but not the rest of nsIFontMetrics, or vice versa.
+ * but not the rest of nsFontMetrics, or vice versa.
  */
 
 #ifdef MOZ_MATHML
 struct nsBoundingMetrics {
 
     ///////////
     // Metrics that _exactly_ enclose the text:
 

rename from gfx/src/nsThebesFontMetrics.cpp
rename to gfx/src/nsFontMetrics.cpp
--- a/gfx/src/nsThebesFontMetrics.cpp
+++ b/gfx/src/nsFontMetrics.cpp
@@ -31,132 +31,162 @@
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
-#include "nsThebesFontMetrics.h"
+#include "nsFontMetrics.h"
 #include "nsBoundingMetrics.h"
+#include "nsRenderingContext.h"
 #include "nsThebesDeviceContext.h"
-#include "nsFont.h"
-
-#include "nsString.h"
-#include <stdio.h>
-
 #include "gfxTextRunCache.h"
-#include "gfxPlatform.h"
-#include "gfxUserFontSet.h"
+
+namespace {
 
-NS_IMPL_ISUPPORTS1(nsThebesFontMetrics, nsIFontMetrics)
+class AutoTextRun : public gfxTextRunCache::AutoTextRun {
+public:
+    AutoTextRun(nsFontMetrics* aMetrics, nsRenderingContext* aRC,
+                const char* aString, PRInt32 aLength)
+        : gfxTextRunCache::AutoTextRun(gfxTextRunCache::MakeTextRun(
+            reinterpret_cast<const PRUint8*>(aString), aLength,
+            aMetrics->GetThebesFontGroup(), aRC->ThebesContext(),
+            aMetrics->AppUnitsPerDevPixel(),
+            ComputeFlags(aMetrics)))
+    {}
+
+    AutoTextRun(nsFontMetrics* aMetrics, nsRenderingContext* aRC,
+                const PRUnichar* aString, PRInt32 aLength)
+        : gfxTextRunCache::AutoTextRun(gfxTextRunCache::MakeTextRun(
+            aString, aLength, aMetrics->GetThebesFontGroup(),
+            aRC->ThebesContext(),
+            aMetrics->AppUnitsPerDevPixel(),
+            ComputeFlags(aMetrics)))
+    {}
 
-#include <stdlib.h>
+private:
+    static PRUint32 ComputeFlags(nsFontMetrics* aMetrics) {
+        PRUint32 flags = 0;
+        if (aMetrics->GetTextRunRTL()) {
+            flags |= gfxTextRunFactory::TEXT_IS_RTL;
+        }
+        return flags;
+    }
+};
 
-nsThebesFontMetrics::nsThebesFontMetrics()
+class StubPropertyProvider : public gfxTextRun::PropertyProvider {
+public:
+    virtual void GetHyphenationBreaks(PRUint32 aStart, PRUint32 aLength,
+                                      PRPackedBool* aBreakBefore) {
+        NS_ERROR("This shouldn't be called because we never call BreakAndMeasureText");
+    }
+    virtual gfxFloat GetHyphenWidth() {
+        NS_ERROR("This shouldn't be called because we never enable hyphens");
+        return 0;
+    }
+    virtual void GetSpacing(PRUint32 aStart, PRUint32 aLength,
+                            Spacing* aSpacing) {
+        NS_ERROR("This shouldn't be called because we never enable spacing");
+    }
+};
+
+} // anon namespace
+
+nsFontMetrics::nsFontMetrics()
+    : mDeviceContext(nsnull), mP2A(-1), mTextRunRTL(PR_FALSE)
 {
-    mFontStyle = nsnull;
-    mFontGroup = nsnull;
 }
 
-nsThebesFontMetrics::~nsThebesFontMetrics()
+nsFontMetrics::~nsFontMetrics()
 {
     if (mDeviceContext)
         mDeviceContext->FontMetricsDeleted(this);
-    delete mFontStyle;
-    //delete mFontGroup;
 }
 
-NS_IMETHODIMP
-nsThebesFontMetrics::Init(const nsFont& aFont, nsIAtom* aLanguage,
-                          nsIDeviceContext *aContext, 
-                          gfxUserFontSet *aUserFontSet)
+nsresult
+nsFontMetrics::Init(const nsFont& aFont, nsIAtom* aLanguage,
+                    nsIDeviceContext *aContext,
+                    gfxUserFontSet *aUserFontSet)
 {
+    NS_ABORT_IF_FALSE(mP2A == -1, "already initialized");
+
     mFont = aFont;
     mLanguage = aLanguage;
     mDeviceContext = (nsThebesDeviceContext*)aContext;
     mP2A = mDeviceContext->AppUnitsPerDevPixel();
-    mIsRightToLeft = PR_FALSE;
-    mTextRunRTL = PR_FALSE;
-
-    gfxFloat size = gfxFloat(aFont.size) / mP2A;
 
-    PRBool printerFont = mDeviceContext->IsPrinterSurface();
-    mFontStyle = new gfxFontStyle(aFont.style, aFont.weight, aFont.stretch,
-                                  size, aLanguage,
-                                  aFont.sizeAdjust, aFont.systemFont,
-                                  printerFont,
-                                  aFont.featureSettings,
-                                  aFont.languageOverride);
+    gfxFontStyle style(aFont.style,
+                       aFont.weight,
+                       aFont.stretch,
+                       gfxFloat(aFont.size) / mP2A,
+                       aLanguage,
+                       aFont.sizeAdjust,
+                       aFont.systemFont,
+                       mDeviceContext->IsPrinterSurface(),
+                       aFont.featureSettings,
+                       aFont.languageOverride);
 
-    mFontGroup =
-        gfxPlatform::GetPlatform()->CreateFontGroup(aFont.name, mFontStyle, 
-                                                    aUserFontSet);
-    if (mFontGroup->FontListLength() < 1) 
+    mFontGroup = gfxPlatform::GetPlatform()->
+        CreateFontGroup(aFont.name, &style, aUserFontSet);
+    if (mFontGroup->FontListLength() < 1)
         return NS_ERROR_UNEXPECTED;
 
     return NS_OK;
 }
 
-NS_IMETHODIMP
-nsThebesFontMetrics::Destroy()
+void
+nsFontMetrics::Destroy()
 {
     mDeviceContext = nsnull;
-    return NS_OK;
 }
 
 // XXXTODO get rid of this macro
 #define ROUND_TO_TWIPS(x) (nscoord)floor(((x) * mP2A) + 0.5)
 #define CEIL_TO_TWIPS(x) (nscoord)NS_ceil((x) * mP2A)
 
-const gfxFont::Metrics& nsThebesFontMetrics::GetMetrics() const
+const gfxFont::Metrics& nsFontMetrics::GetMetrics() const
 {
     return mFontGroup->GetFontAt(0)->GetMetrics();
 }
 
-NS_IMETHODIMP
-nsThebesFontMetrics::GetXHeight(nscoord& aResult)
+nscoord
+nsFontMetrics::XHeight()
 {
-    aResult = ROUND_TO_TWIPS(GetMetrics().xHeight);
-    return NS_OK;
+    return ROUND_TO_TWIPS(GetMetrics().xHeight);
 }
 
-NS_IMETHODIMP
-nsThebesFontMetrics::GetSuperscriptOffset(nscoord& aResult)
+nscoord
+nsFontMetrics::SuperscriptOffset()
 {
-    aResult = ROUND_TO_TWIPS(GetMetrics().superscriptOffset);
-    return NS_OK;
+    return ROUND_TO_TWIPS(GetMetrics().superscriptOffset);
 }
 
-NS_IMETHODIMP
-nsThebesFontMetrics::GetSubscriptOffset(nscoord& aResult)
+nscoord
+nsFontMetrics::SubscriptOffset()
 {
-    aResult = ROUND_TO_TWIPS(GetMetrics().subscriptOffset);
-    return NS_OK;
+    return ROUND_TO_TWIPS(GetMetrics().subscriptOffset);
 }
 
-NS_IMETHODIMP
-nsThebesFontMetrics::GetStrikeout(nscoord& aOffset, nscoord& aSize)
+void
+nsFontMetrics::GetStrikeout(nscoord& aOffset, nscoord& aSize)
 {
     aOffset = ROUND_TO_TWIPS(GetMetrics().strikeoutOffset);
     aSize = ROUND_TO_TWIPS(GetMetrics().strikeoutSize);
-    return NS_OK;
 }
 
-NS_IMETHODIMP
-nsThebesFontMetrics::GetUnderline(nscoord& aOffset, nscoord& aSize)
+void
+nsFontMetrics::GetUnderline(nscoord& aOffset, nscoord& aSize)
 {
     aOffset = ROUND_TO_TWIPS(mFontGroup->GetUnderlineOffset());
     aSize = ROUND_TO_TWIPS(GetMetrics().underlineSize);
-
-    return NS_OK;
 }
 
-// GetHeight/GetMaxAscent/GetMaxDescent/GetMaxHeight must contain the
+// GetMaxAscent/GetMaxDescent/GetMaxHeight must contain the
 // text-decoration lines drawable area. See bug 421353.
 // BE CAREFUL for rounding each values. The logic MUST be same as
 // nsCSSRendering::GetTextDecorationRectInternal's.
 
 static gfxFloat ComputeMaxDescent(const gfxFont::Metrics& aMetrics,
                                   gfxFontGroup* aFontGroup)
 {
     gfxFloat offset = NS_floor(-aFontGroup->GetUnderlineOffset() + 0.5);
@@ -165,343 +195,175 @@ static gfxFloat ComputeMaxDescent(const 
     return PR_MAX(minDescent, aMetrics.maxDescent);
 }
 
 static gfxFloat ComputeMaxAscent(const gfxFont::Metrics& aMetrics)
 {
     return NS_floor(aMetrics.maxAscent + 0.5);
 }
 
-NS_IMETHODIMP
-nsThebesFontMetrics::GetHeight(nscoord &aHeight)
+nscoord
+nsFontMetrics::InternalLeading()
 {
-    aHeight = CEIL_TO_TWIPS(ComputeMaxAscent(GetMetrics())) +
-        CEIL_TO_TWIPS(ComputeMaxDescent(GetMetrics(), mFontGroup));
-    return NS_OK;
+    return ROUND_TO_TWIPS(GetMetrics().internalLeading);
 }
 
-NS_IMETHODIMP
-nsThebesFontMetrics::GetInternalLeading(nscoord &aLeading)
+nscoord
+nsFontMetrics::ExternalLeading()
 {
-    aLeading = ROUND_TO_TWIPS(GetMetrics().internalLeading);
-    return NS_OK;
+    return ROUND_TO_TWIPS(GetMetrics().externalLeading);
 }
 
-NS_IMETHODIMP
-nsThebesFontMetrics::GetExternalLeading(nscoord &aLeading)
+nscoord
+nsFontMetrics::EmHeight()
 {
-    aLeading = ROUND_TO_TWIPS(GetMetrics().externalLeading);
-    return NS_OK;
+    return ROUND_TO_TWIPS(GetMetrics().emHeight);
 }
 
-NS_IMETHODIMP
-nsThebesFontMetrics::GetEmHeight(nscoord &aHeight)
+nscoord
+nsFontMetrics::EmAscent()
 {
-    aHeight = ROUND_TO_TWIPS(GetMetrics().emHeight);
-    return NS_OK;
+    return ROUND_TO_TWIPS(GetMetrics().emAscent);
 }
 
-NS_IMETHODIMP
-nsThebesFontMetrics::GetEmAscent(nscoord &aAscent)
+nscoord
+nsFontMetrics::EmDescent()
 {
-    aAscent = ROUND_TO_TWIPS(GetMetrics().emAscent);
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-nsThebesFontMetrics::GetEmDescent(nscoord &aDescent)
-{
-    aDescent = ROUND_TO_TWIPS(GetMetrics().emDescent);
-    return NS_OK;
+    return ROUND_TO_TWIPS(GetMetrics().emDescent);
 }
 
-NS_IMETHODIMP
-nsThebesFontMetrics::GetMaxHeight(nscoord &aHeight)
+nscoord
+nsFontMetrics::MaxHeight()
 {
-    aHeight = CEIL_TO_TWIPS(ComputeMaxAscent(GetMetrics())) +
+    return CEIL_TO_TWIPS(ComputeMaxAscent(GetMetrics())) +
         CEIL_TO_TWIPS(ComputeMaxDescent(GetMetrics(), mFontGroup));
-    return NS_OK;
 }
 
-NS_IMETHODIMP
-nsThebesFontMetrics::GetMaxAscent(nscoord &aAscent)
+nscoord
+nsFontMetrics::MaxAscent()
 {
-    aAscent = CEIL_TO_TWIPS(ComputeMaxAscent(GetMetrics()));
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-nsThebesFontMetrics::GetMaxDescent(nscoord &aDescent)
-{
-    aDescent = CEIL_TO_TWIPS(ComputeMaxDescent(GetMetrics(), mFontGroup));
-    return NS_OK;
+    return CEIL_TO_TWIPS(ComputeMaxAscent(GetMetrics()));
 }
 
-NS_IMETHODIMP
-nsThebesFontMetrics::GetMaxAdvance(nscoord &aAdvance)
+nscoord
+nsFontMetrics::MaxDescent()
 {
-    aAdvance = CEIL_TO_TWIPS(GetMetrics().maxAdvance);
-    return NS_OK;
+    return CEIL_TO_TWIPS(ComputeMaxDescent(GetMetrics(), mFontGroup));
 }
 
-NS_IMETHODIMP
-nsThebesFontMetrics::GetLanguage(nsIAtom** aLanguage)
+nscoord
+nsFontMetrics::MaxAdvance()
 {
-    *aLanguage = mLanguage;
-    NS_IF_ADDREF(*aLanguage);
-    return NS_OK;
+    return CEIL_TO_TWIPS(GetMetrics().maxAdvance);
 }
 
-NS_IMETHODIMP
-nsThebesFontMetrics::GetFontHandle(nsFontHandle &aHandle)
-{
-    return NS_ERROR_NOT_IMPLEMENTED;
-}
-
-NS_IMETHODIMP
-nsThebesFontMetrics::GetAveCharWidth(nscoord& aAveCharWidth)
+nscoord
+nsFontMetrics::AveCharWidth()
 {
     // Use CEIL instead of ROUND for consistency with GetMaxAdvance
-    aAveCharWidth = CEIL_TO_TWIPS(GetMetrics().aveCharWidth);
-    return NS_OK;
+    return CEIL_TO_TWIPS(GetMetrics().aveCharWidth);
 }
 
-NS_IMETHODIMP
-nsThebesFontMetrics::GetSpaceWidth(nscoord& aSpaceCharWidth)
+nscoord
+nsFontMetrics::SpaceWidth()
 {
-    aSpaceCharWidth = CEIL_TO_TWIPS(GetMetrics().spaceWidth);
-    return NS_OK;
+    return CEIL_TO_TWIPS(GetMetrics().spaceWidth);
 }
 
 PRInt32
-nsThebesFontMetrics::GetMaxStringLength()
+nsFontMetrics::GetMaxStringLength()
 {
     const gfxFont::Metrics& m = GetMetrics();
     const double x = 32767.0 / m.maxAdvance;
     PRInt32 len = (PRInt32)floor(x);
     return PR_MAX(1, len);
 }
 
-class StubPropertyProvider : public gfxTextRun::PropertyProvider {
-public:
-    virtual void GetHyphenationBreaks(PRUint32 aStart, PRUint32 aLength,
-                                      PRPackedBool* aBreakBefore) {
-        NS_ERROR("This shouldn't be called because we never call BreakAndMeasureText");
-    }
-    virtual gfxFloat GetHyphenWidth() {
-        NS_ERROR("This shouldn't be called because we never enable hyphens");
+nscoord
+nsFontMetrics::GetWidth(const char* aString, PRUint32 aLength,
+                        nsRenderingContext *aContext)
+{
+    if (aLength == 0)
         return 0;
-    }
-    virtual void GetSpacing(PRUint32 aStart, PRUint32 aLength,
-                            Spacing* aSpacing) {
-        NS_ERROR("This shouldn't be called because we never enable spacing");
-    }
-};
-
-nsresult 
-nsThebesFontMetrics::GetWidth(const char* aString, PRUint32 aLength, nscoord& aWidth,
-                              nsRenderingContext *aContext)
-{
-    if (aLength == 0) {
-        aWidth = 0;
-        return NS_OK;
-    }
 
-    // callers that hit this should not be so stupid
-    if ((aLength == 1) && (aString[0] == ' '))
-        return GetSpaceWidth(aWidth);
-
-    StubPropertyProvider provider;
-    AutoTextRun textRun(this, aContext, aString, aLength);
-    if (!textRun.get())
-        return NS_ERROR_FAILURE;
-
-    aWidth = NSToCoordRound(textRun->GetAdvanceWidth(0, aLength, &provider));
-
-    return NS_OK;
-}
-
-nsresult
-nsThebesFontMetrics::GetWidth(const PRUnichar* aString, PRUint32 aLength,
-                              nscoord& aWidth, PRInt32 *aFontID,
-                              nsRenderingContext *aContext)
-{
-    if (aLength == 0) {
-        aWidth = 0;
-        return NS_OK;
-    }
-
-    // callers that hit this should not be so stupid
-    if ((aLength == 1) && (aString[0] == ' '))
-        return GetSpaceWidth(aWidth);
+    if (aLength == 1 && aString[0] == ' ')
+        return SpaceWidth();
 
     StubPropertyProvider provider;
     AutoTextRun textRun(this, aContext, aString, aLength);
-    if (!textRun.get())
-        return NS_ERROR_FAILURE;
-
-    aWidth = NSToCoordRound(textRun->GetAdvanceWidth(0, aLength, &provider));
-
-    return NS_OK;
-}
-
-// Get the text dimensions for this string
-nsresult
-nsThebesFontMetrics::GetTextDimensions(const PRUnichar* aString,
-                                    PRUint32 aLength,
-                                    nsTextDimensions& aDimensions, 
-                                    PRInt32* aFontID)
-{
-    return NS_OK;
+    return NSToCoordRound(textRun->GetAdvanceWidth(0, aLength, &provider));
 }
 
-nsresult
-nsThebesFontMetrics::GetTextDimensions(const char*         aString,
-                                   PRInt32             aLength,
-                                   PRInt32             aAvailWidth,
-                                   PRInt32*            aBreaks,
-                                   PRInt32             aNumBreaks,
-                                   nsTextDimensions&   aDimensions,
-                                   PRInt32&            aNumCharsFit,
-                                   nsTextDimensions&   aLastWordDimensions,
-                                   PRInt32*            aFontID)
+nscoord
+nsFontMetrics::GetWidth(const PRUnichar* aString, PRUint32 aLength,
+                        nsRenderingContext *aContext)
 {
-    return NS_OK;
-}
-nsresult
-nsThebesFontMetrics::GetTextDimensions(const PRUnichar*    aString,
-                                   PRInt32             aLength,
-                                   PRInt32             aAvailWidth,
-                                   PRInt32*            aBreaks,
-                                   PRInt32             aNumBreaks,
-                                   nsTextDimensions&   aDimensions,
-                                   PRInt32&            aNumCharsFit,
-                                   nsTextDimensions&   aLastWordDimensions,
-                                   PRInt32*            aFontID)
-{
-    return NS_OK;
+    if (aLength == 0)
+        return 0;
+
+    if (aLength == 1 && aString[0] == ' ')
+        return SpaceWidth();
+
+    StubPropertyProvider provider;
+    AutoTextRun textRun(this, aContext, aString, aLength);
+    return NSToCoordRound(textRun->GetAdvanceWidth(0, aLength, &provider));
 }
 
-// Draw a string using this font handle on the surface passed in.  
-nsresult
-nsThebesFontMetrics::DrawString(const char *aString, PRUint32 aLength,
-                                nscoord aX, nscoord aY,
-                                const nscoord* aSpacing,
-                                nsRenderingContext *aContext)
+// Draw a string using this font handle on the surface passed in.
+void
+nsFontMetrics::DrawString(const char *aString, PRUint32 aLength,
+                          nscoord aX, nscoord aY,
+                          nsRenderingContext *aContext)
 {
     if (aLength == 0)
-        return NS_OK;
+        return;
 
-    NS_ASSERTION(!aSpacing, "Spacing not supported here");
     StubPropertyProvider provider;
     AutoTextRun textRun(this, aContext, aString, aLength);
-    if (!textRun.get())
-        return NS_ERROR_FAILURE;
     gfxPoint pt(aX, aY);
     if (mTextRunRTL) {
         pt.x += textRun->GetAdvanceWidth(0, aLength, &provider);
     }
-    textRun->Draw(aContext->ThebesContext(), pt, 0, aLength,
-                  &provider, nsnull);
-    return NS_OK;
+    textRun->Draw(aContext->ThebesContext(), pt, 0, aLength, &provider, nsnull);
 }
 
-nsresult
-nsThebesFontMetrics::DrawString(const PRUnichar* aString, PRUint32 aLength,
-                                nscoord aX, nscoord aY,
-                                nsRenderingContext *aContext,
-                                nsRenderingContext *aTextRunConstructionContext)
+void
+nsFontMetrics::DrawString(const PRUnichar* aString, PRUint32 aLength,
+                          nscoord aX, nscoord aY,
+                          nsRenderingContext *aContext,
+                          nsRenderingContext *aTextRunConstructionContext)
 {
     if (aLength == 0)
-        return NS_OK;
+        return;
 
     StubPropertyProvider provider;
     AutoTextRun textRun(this, aTextRunConstructionContext, aString, aLength);
-    if (!textRun.get())
-        return NS_ERROR_FAILURE;
     gfxPoint pt(aX, aY);
     if (mTextRunRTL) {
         pt.x += textRun->GetAdvanceWidth(0, aLength, &provider);
     }
-    textRun->Draw(aContext->ThebesContext(), pt, 0, aLength,
-                  &provider, nsnull);
-    return NS_OK;
+    textRun->Draw(aContext->ThebesContext(), pt, 0, aLength, &provider, nsnull);
 }
 
 #ifdef MOZ_MATHML
-
-static void
-GetTextRunBoundingMetrics(gfxTextRun *aTextRun, PRUint32 aStart, PRUint32 aLength,
-                          nsRenderingContext *aContext,
-                          nsBoundingMetrics &aBoundingMetrics)
+nsBoundingMetrics
+nsFontMetrics::GetBoundingMetrics(const PRUnichar *aString, PRUint32 aLength,
+                                  nsRenderingContext *aContext)
 {
-    StubPropertyProvider provider;
-    gfxTextRun::Metrics theMetrics =
-        aTextRun->MeasureText(aStart, aLength, gfxFont::TIGHT_HINTED_OUTLINE_EXTENTS,
-                              aContext->ThebesContext(), &provider);
-        // note that TIGHT_HINTED_OUTLINE_EXTENTS can be expensive (on Windows)
-        // but this is only used for MathML positioning so it's not critical
-
-    aBoundingMetrics.leftBearing = NSToCoordFloor(theMetrics.mBoundingBox.X());
-    aBoundingMetrics.rightBearing = NSToCoordCeil(theMetrics.mBoundingBox.XMost());
-    aBoundingMetrics.width = NSToCoordRound(theMetrics.mAdvanceWidth);
-    aBoundingMetrics.ascent = NSToCoordCeil(- theMetrics.mBoundingBox.Y());
-    aBoundingMetrics.descent = NSToCoordCeil(theMetrics.mBoundingBox.YMost());
-}
-
-nsresult
-nsThebesFontMetrics::GetBoundingMetrics(const char *aString, PRUint32 aLength,
-                                        nsRenderingContext *aContext,
-                                        nsBoundingMetrics &aBoundingMetrics)
-{
-    if (aLength == 0) {
-        aBoundingMetrics = nsBoundingMetrics();
-        return NS_OK;
-    }
-
-    AutoTextRun textRun(this, aContext, aString, aLength);
-    if (!textRun.get())
-        return NS_ERROR_FAILURE;
-
-    GetTextRunBoundingMetrics(textRun.get(), 0, aLength, aContext, aBoundingMetrics);
-    return NS_OK;
-}
+    if (aLength == 0)
+        return nsBoundingMetrics();
 
-nsresult
-nsThebesFontMetrics::GetBoundingMetrics(const PRUnichar *aString, PRUint32 aLength,
-                                        nsRenderingContext *aContext,
-                                        nsBoundingMetrics &aBoundingMetrics)
-{
-    if (aLength == 0) {
-        aBoundingMetrics = nsBoundingMetrics();
-        return NS_OK;
-    }
-
+    StubPropertyProvider provider;
     AutoTextRun textRun(this, aContext, aString, aLength);
-    if (!textRun.get())
-        return NS_ERROR_FAILURE;
-
-    GetTextRunBoundingMetrics(textRun.get(), 0, aLength, aContext, aBoundingMetrics);
-    return NS_OK;
-}
-
-#endif /* MOZ_MATHML */
+    gfxTextRun::Metrics theMetrics =
+        textRun->MeasureText(0, aLength,
+                             gfxFont::TIGHT_HINTED_OUTLINE_EXTENTS,
+                             aContext->ThebesContext(), &provider);
 
-// Set the direction of the text rendering
-nsresult
-nsThebesFontMetrics::SetRightToLeftText(PRBool aIsRTL)
-{
-    mIsRightToLeft = aIsRTL;
-    return NS_OK;
+    nsBoundingMetrics m;
+    m.leftBearing  = NSToCoordFloor( theMetrics.mBoundingBox.X());
+    m.rightBearing = NSToCoordCeil(  theMetrics.mBoundingBox.XMost());
+    m.ascent       = NSToCoordCeil( -theMetrics.mBoundingBox.Y());
+    m.descent      = NSToCoordCeil(  theMetrics.mBoundingBox.YMost());
+    m.width        = NSToCoordRound( theMetrics.mAdvanceWidth);
+    return m;
 }
-
-// Set the direction of the text rendering
-PRBool
-nsThebesFontMetrics::GetRightToLeftText()
-{
-    return mIsRightToLeft;
-}
-
-/* virtual */ gfxUserFontSet*
-nsThebesFontMetrics::GetUserFontSet()
-{
-    return mFontGroup->GetUserFontSet();
-}
+#endif /* MOZ_MATHML */