--- a/browser/components/loop/MozLoopService.jsm
+++ b/browser/components/loop/MozLoopService.jsm
@@ -4,23 +4,29 @@
 
 "use strict";
 
 const { classes: Cc, interfaces: Ci, utils: Cu } = Components;
 
 Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Promise.jsm");
-let console = (Cu.import("resource://gre/modules/devtools/Console.jsm", {})).console;
+Cu.import("resource://gre/modules/osfile.jsm", this);
 
 this.EXPORTED_SYMBOLS = ["MozLoopService"];
 
+XPCOMUtils.defineLazyModuleGetter(this, "console",
+  "resource://gre/modules/devtools/Console.jsm");
+
 XPCOMUtils.defineLazyModuleGetter(this, "injectLoopAPI",
   "resource:///modules/loop/MozLoopAPI.jsm");
 
+XPCOMUtils.defineLazyModuleGetter(this, "convertToRTCStatsReport",
+  "resource://gre/modules/media/RTCStatsReport.jsm");
+
 XPCOMUtils.defineLazyModuleGetter(this, "Chat", "resource:///modules/Chat.jsm");
 
 XPCOMUtils.defineLazyModuleGetter(this, "CommonUtils",
                                   "resource://services-common/utils.js");
 
 XPCOMUtils.defineLazyModuleGetter(this, "CryptoUtils",
                                   "resource://services-crypto/utils.js");
 
@@ -28,16 +34,20 @@ XPCOMUtils.defineLazyModuleGetter(this, 
                                   "resource://services-common/hawkclient.js");
 
 XPCOMUtils.defineLazyModuleGetter(this, "deriveHawkCredentials",
                                   "resource://services-common/hawkrequest.js");
 
 XPCOMUtils.defineLazyModuleGetter(this, "MozLoopPushHandler",
                                   "resource:///modules/loop/MozLoopPushHandler.jsm");
 
+XPCOMUtils.defineLazyServiceGetter(this, "uuidgen",
+                                   "@mozilla.org/uuid-generator;1",
+                                   "nsIUUIDGenerator");
+
 /**
  * Internal helper methods and state
  *
  * The registration is a two-part process. First we need to connect to
  * and register with the push server. Then we need to take the result of that
  * and register with the Loop server.
  */
 let MozLoopServiceInternal = {
@@ -299,25 +309,90 @@ let MozLoopServiceInternal = {
         map[key] = {};
       map[key][property] = string.value;
     }
 
     return this._localizedStrings = map;
   },
 
   /**
+   * Saves loop logs to the saved-telemetry-pings folder.
+   *
+   * @param {Object} pc The peerConnection in question.
+   */
+  stageForTelemetryUpload: function(window, pc) {
+    window.WebrtcGlobalInformation.getAllStats(allStats => {
+      let internalFormat = allStats.reports[0]; // filtered on pc.id
+      window.WebrtcGlobalInformation.getLogging('', logs => {
+        let report = convertToRTCStatsReport(internalFormat);
+        let logStr = "";
+        logs.forEach(s => { logStr += s + "\n"; });
+
+        // We have stats and logs.
+
+        // Create worker job. ping = saved telemetry ping file header + payload
+        //
+        // Prepare payload according to https://wiki.mozilla.org/Loop/Telemetry
+
+        let ai = Services.appinfo;
+        let uuid = uuidgen.generateUUID().toString();
+        uuid = uuid.substr(1,uuid.length-2); // remove uuid curly braces
+
+        let directory = OS.Path.join(OS.Constants.Path.profileDir,
+                                     "saved-telemetry-pings");
+        let job = {
+          directory: directory,
+          filename: uuid + ".json",
+          ping: {
+            reason: "loop",
+            slug: uuid,
+            payload: {
+              ver: 1,
+              info: {
+                appUpdateChannel: ai.defaultUpdateChannel,
+                appBuildID: ai.appBuildID,
+                appName: ai.name,
+                appVersion: ai.version,
+                reason: "loop",
+                OS: ai.OS,
+                version: Services.sysinfo.getProperty("version")
+              },
+              report: "ice failure",
+              connectionstate: pc.iceConnectionState,
+              stats: report,
+              localSdp: internalFormat.localSdp,
+              remoteSdp: internalFormat.remoteSdp,
+              log: logStr
+            }
+          }
+        };
+
+        // Send job to worker to do log sanitation, transcoding and saving to
+        // disk for pickup by telemetry on next startup, which then uploads it.
+
+        let worker = new ChromeWorker("MozLoopWorker.js");
+        worker.onmessage = function(e) {
+          console.log(e.data.ok ?
+            "Successfully staged loop report for telemetry upload." :
+            ("Failed to stage loop report. Error: " + e.data.fail));
+        }
+        worker.postMessage(job);
+      });
+    }, pc.id);
+  },
+
+  /**
    * Opens the chat window
    *
    * @param {Object} contentWindow The window to open the chat window in, may
    *                               be null.
    * @param {String} title The title of the chat window.
    * @param {String} url The page to load in the chat window.
-   * @param {String} mode May be "minimized" or undefined.
    */
-  openChatWindow: function(contentWindow, title, url, mode) {
+  openChatWindow: function(contentWindow, title, url) {
     // So I guess the origin is the loop server!?
     let origin = this.loopServerUri;
     url = url.spec || url;
 
     let callback = chatbox => {
       // We need to use DOMContentLoaded as otherwise the injection will happen
       // in about:blank and then get lost.
       // Sadly we can't use chatbox.promiseChatLoaded() as promise chaining
@@ -327,18 +402,43 @@ let MozLoopServiceInternal = {
         return;
       }
 
       chatbox.addEventListener("DOMContentLoaded", function loaded(event) {
         if (event.target != chatbox.contentDocument) {
           return;
         }
         chatbox.removeEventListener("DOMContentLoaded", loaded, true);
-        injectLoopAPI(chatbox.contentWindow);
-      }, true);
+
+        let window = chatbox.contentWindow;
+        injectLoopAPI(window);
+
+        let ourID = window.QueryInterface(Ci.nsIInterfaceRequestor)
+            .getInterface(Ci.nsIDOMWindowUtils).currentInnerWindowID;
+
+        let onPCLifecycleChange = (pc, winID, type) => {
+          if (winID != ourID) {
+            return;
+          }
+          if (type == "iceconnectionstatechange") {
+            switch(pc.iceConnectionState) {
+              case "failed":
+              case "disconnected":
+                if (Services.telemetry.canSend ||
+                    Services.prefs.getBoolPref("toolkit.telemetry.test")) {
+                  this.stageForTelemetryUpload(window, pc);
+                }
+                break;
+            }
+          }
+        };
+
+        let pc_static = new window.mozRTCPeerConnectionStatic();
+        pc_static.registerPeerConnectionLifecycleCallback(onPCLifecycleChange);
+      }.bind(this), true);
     };
 
     Chat.open(contentWindow, origin, title, url, undefined, undefined, callback);
   }
 };
 
 /**
  * Public API

new file mode 100644
--- /dev/null
+++ b/browser/components/loop/MozLoopWorker.js
@@ -0,0 +1,161 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/**
+ * A worker dedicated to loop-report sanitation and writing for MozLoopService.
+ */
+
+"use strict";
+
+importScripts("resource://gre/modules/osfile.jsm");
+
+let File = OS.File;
+let Encoder = new TextEncoder();
+let Counter = 0;
+
+const MAX_LOOP_LOGS = 5;
+/**
+ * Communications with the controller.
+ *
+ * Accepts messages:
+ * { path: filepath, ping: data }
+ *
+ * Sends messages:
+ * { ok: true }
+ * { fail: serialized_form_of_OS.File.Error }
+ */
+
+onmessage = function(e) {
+  if (++Counter > MAX_LOOP_LOGS) {
+    postMessage({
+      fail: "Maximum " + MAX_LOOP_LOGS + "loop reports reached for this session"
+    });
+    return;
+  }
+
+  let directory = e.data.directory;
+  let filename = e.data.filename;
+  let ping = e.data.ping;
+
+  // Anonymize data
+  resetIpMask();
+  ping.payload.localSdp = redactSdp(ping.payload.localSdp);
+  ping.payload.remoteSdp = redactSdp(ping.payload.remoteSdp);
+  ping.payload.log = sanitizeLogs(ping.payload.log);
+
+  let pingStr = anonymizeIPv4(sanitizeUrls(JSON.stringify(ping)));
+
+  // Save to disk
+  let array = Encoder.encode(pingStr);
+  try {
+    File.makeDir(directory,
+                 { unixMode: OS.Constants.S_IRWXU, ignoreExisting: true });
+    File.writeAtomic(OS.Path.join(directory, filename), array);
+    postMessage({ ok: true });
+  } catch (ex if ex instanceof File.Error) {
+    // Instances of OS.File.Error know how to serialize themselves
+    postMessage({fail: File.Error.toMsg(ex)});
+  }
+};
+
+/**
+ * Mask upper 24-bits of ip address with fake numbers. Call resetIpMask() first.
+ */
+
+let IpMap = {};
+let IpCount = 0;
+
+function resetIpMask() {
+  IpMap = {};
+  IpCount = Math.floor(Math.random() * 16777215) + 1;
+}
+
+/**
+ * Masks upper 24-bits of ip address with fake numbers. Grunt function.
+ *
+ * @param {DOMString} ip address
+ */
+function maskIp(ip) {
+  let isInvalidOrRfc1918or3927 = function(p1, p2, p3, p4) {
+    let invalid = octet => octet < 0 || octet > 255;
+    return invalid(p1) || invalid(p2) || invalid(p3) || invalid(p4) ||
+    (p1 == 10) ||
+    (p1 == 172 && p2 >= 16 && p2 <= 31) ||
+    (p1 == 192 && p2 == 168) ||
+    (p1 == 169 && p2 == 254);
+  };
+
+  let [p1, p2, p3, p4] = ip.split(".");
+
+  if (isInvalidOrRfc1918or3927(p1, p2, p3, p4)) {
+    return ip;
+  }
+  let key = [p1, p2, p3].join();
+  if (!IpMap[key]) {
+    do {
+      IpCount = (IpCount + 1049039) % 16777216; // + prime % 2^24
+      p1 = (IpCount >> 16) % 256;
+      p2 = (IpCount >> 8) % 256;
+      p3 = IpCount % 256;
+    } while (isInvalidOrRfc1918or3927(p1, p2, p3, p4));
+    IpMap[key] = p1 + "." + p2 + "." + p3;
+  }
+  return IpMap[key] + "." + p4;
+}
+
+/**
+ * Partially masks ip numbers in input text.
+ *
+ * @param {DOMString} text Input text containing IP numbers as words.
+ */
+function anonymizeIPv4(text) {
+  return text.replace(/\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/g,
+                      maskIp.bind(this));
+}
+
+/**
+ * Sanitizes any urls of session information, like
+ *
+ *   - (id=31 url=https://call.services.mozilla.com/#call/ongoing/AQHYjqH_...)
+ *   + (id=31 url=https://call.services.mozilla.com/#call/xxxx)
+ *
+ *   - (id=35 url=about:loopconversation#incoming/1403134352854)
+ *   + (id=35 url=about:loopconversation#incoming/xxxx)
+ *
+ * @param {DOMString} text The text.
+ */
+function sanitizeUrls(text) {
+  let trimUrl = url => url.replace(/(#call|#incoming).*/g,
+                                   (match, type) => type + "/xxxx");
+  return text.replace(/\(id=(\d+) url=([^\)]+)\)/g,
+                      (match, id, url) =>
+                      "(id=" + id + " url=" + trimUrl(url) + ")");
+}
+
+/**
+ * Removes privacy sensitive information from SDP input text outright, like
+ *
+ *   a=fingerprint:sha-256 E9:DE:6A:FE:2A:2F:05: etc.
+ *   a=identity ...
+ *
+ * Redacts lines from match to EOL. Assumes \r\n\ linebreaks.
+ *
+ * @param {DOMString} sdp The sdp text.
+ */
+let redactSdp = sdp => sdp.replace(/\r\na=(fingerprint|identity):.*?\r\n/g,
+                                   "\r\n");
+
+/**
+ * Sanitizes log text of sensitive information, like
+ *
+ *   - srflx(IP4:192.168.1.3:60348/UDP|turn402-oak.tokbox.com:3478)
+ *   + srflx(IP4:192.168.1.3:60348/UDP|xxxx.xxx)
+ *
+ * @param {DOMString} log The log text.
+ */
+function sanitizeLogs(log) {
+  let rex = /(srflx|relay)\(IP4:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d{1,5}\/(UDP|TCP)\|[^\)]+\)/g;
+
+  return log.replace(rex, match => match.replace(/\|[^\)]+\)/, "|xxxx.xxx)"));
+}

--- a/browser/components/loop/moz.build
+++ b/browser/components/loop/moz.build
@@ -9,9 +9,10 @@ JAR_MANIFESTS += ['jar.mn']
 JS_MODULES_PATH = 'modules/loop'
 
 XPCSHELL_TESTS_MANIFESTS += ['test/xpcshell/xpcshell.ini']
 
 EXTRA_JS_MODULES += [
     'MozLoopAPI.jsm',
     'MozLoopPushHandler.jsm',
     'MozLoopService.jsm',
+    'MozLoopWorker.js',
 ]

--- a/browser/modules/WebappManager.jsm
+++ b/browser/modules/WebappManager.jsm
@@ -129,55 +129,49 @@ this.WebappManager = {
                              "webapps-notification-icon");
 
         let progressMeter = chromeDoc.createElement("progressmeter");
         progressMeter.setAttribute("mode", "undetermined");
         popupProgressContent.appendChild(progressMeter);
 
         let manifestURL = aData.app.manifestURL;
 
-        let cleanup = () => {
+        let nativeApp = new NativeApp(aData.app, jsonManifest,
+                                      aData.app.categories);
+
+        this.installations[manifestURL] = Promise.defer();
+        this.installations[manifestURL].promise.then(() => {
+          notifyInstallSuccess(aData.app, nativeApp, bundle);
+        }, (error) => {
+          Cu.reportError("Error installing webapp: " + error);
+        }).then(() => {
           popupProgressContent.removeChild(progressMeter);
           delete this.installations[manifestURL];
           if (Object.getOwnPropertyNames(this.installations).length == 0) {
             notification.remove();
           }
-        };
-
-        this.installations[manifestURL] = Promise.defer();
-        this.installations[manifestURL].promise.then(null, (error) => {
-          Cu.reportError("Error installing webapp: " + error);
-          cleanup();
         });
 
-        let nativeApp = new NativeApp(aData.app, jsonManifest,
-                                      aData.app.categories);
         let localDir;
         try {
           localDir = nativeApp.createProfile();
         } catch (ex) {
-          Cu.reportError("Error installing webapp: " + ex);
           DOMApplicationRegistry.denyInstall(aData);
-          cleanup();
           return;
         }
 
         DOMApplicationRegistry.confirmInstall(aData, localDir,
-          (aApp, aManifest, aZipPath) => Task.spawn((function*() {
+          Task.async(function*(aApp, aManifest, aZipPath) {
             try {
               yield nativeApp.install(aApp, aManifest, aZipPath);
-              yield this.installations[manifestURL].promise;
-              notifyInstallSuccess(aApp, nativeApp, bundle);
             } catch (ex) {
               Cu.reportError("Error installing webapp: " + ex);
-              // TODO: Notify user that the installation has failed
-            } finally {
-              cleanup();
+              throw ex;
             }
-          }).bind(this))
+          })
         );
       }
     };
 
     let requestingURI = chromeWin.makeURI(aData.from);
     let manifest = new ManifestHelper(jsonManifest, aData.app.origin);
 
     let host;

--- a/build/autoconf/ffi.m4
+++ b/build/autoconf/ffi.m4
@@ -83,22 +83,18 @@ if test -z "$BUILDING_JS" -o -n "$JS_STA
         ac_configure_args="$ac_configure_args CC=gcc CFLAGS=-maix32"
       else
         ac_configure_args="$ac_configure_args CC=gcc CFLAGS=-maix64"
       fi
     fi
 
     # Use a separate cache file for libffi, since it does things differently
     # from our configure.
-    mkdir -p $_objdir/js/src/ctypes/libffi
-    old_cache_file=$cache_file
-    cache_file=$_objdir/js/src/ctypes/libffi/config.cache
     old_config_files=$CONFIG_FILES
     unset CONFIG_FILES
     AC_OUTPUT_SUBDIRS(js/src/ctypes/libffi)
-    cache_file=$old_cache_file
     ac_configure_args="$_SUBDIR_CONFIG_ARGS"
     CONFIG_FILES=$old_config_files
   fi
 
 fi
 ])
 

--- a/build/autoconf/hooks.m4
+++ b/build/autoconf/hooks.m4
@@ -13,43 +13,55 @@ changequote([, ])dnl
 dnl Wrap AC_INIT_PREPARE to add the above trap.
 define([_MOZ_AC_INIT_PREPARE], defn([AC_INIT_PREPARE]))
 define([AC_INIT_PREPARE],
 [_MOZ_AC_INIT_PREPARE($1)
 MOZ_CONFIG_LOG_TRAP
 ])
 
 dnl Disable the trap when running sub-configures.
-define([_MOZ_AC_OUTPUT_SUBDIRS], defn([AC_OUTPUT_SUBDIRS]))
-define([MOZ_SUBCONFIGURE_WRAP],
-[ _CONFIG_SHELL=${CONFIG_SHELL-/bin/sh}
-case "$host" in
-*-mingw*)
+define(GEN_MOZ_AC_OUTPUT_SUBDIRS, [
+define([_MOZ_AC_OUTPUT_SUBDIRS], [
+patsubst($@, [$srcdir/$ac_config_dir], [$srcdir/$moz_config_srcdir])
+])
+])
+GEN_MOZ_AC_OUTPUT_SUBDIRS(defn([AC_OUTPUT_SUBDIRS]))
+
+define([AC_OUTPUT_SUBDIRS],
+[trap '' EXIT
+for moz_config_dir in $1; do
+  case "$moz_config_dir" in
+  *:*)
+    moz_config_srcdir=$(echo $moz_config_dir | awk -F: '{print [$]1}')
+    moz_config_dir=$(echo $moz_config_dir | awk -F: '{print [$]2}')
+    ;;
+  *)
+    moz_config_srcdir=$moz_config_dir
+    ;;
+  esac
+  _CONFIG_SHELL=${CONFIG_SHELL-/bin/sh}
+  case "$host" in
+  *-mingw*)
     _CONFIG_SHELL=$(cd $(dirname $_CONFIG_SHELL); pwd -W)/$(basename $_CONFIG_SHELL)
     if test ! -e "$_CONFIG_SHELL" -a -e "${_CONFIG_SHELL}.exe"; then
         _CONFIG_SHELL="${_CONFIG_SHELL}.exe"
     fi
     ;;
-esac
+  esac
 
-if test -d "$1"; then
-    (cd "$1"; $PYTHON $_topsrcdir/build/subconfigure.py dump "$_CONFIG_SHELL")
-else
-    mkdir -p "$1"
-fi
-$2
-(cd "$1"; $PYTHON $_topsrcdir/build/subconfigure.py adjust $ac_sub_configure)
-])
-
-define([AC_OUTPUT_SUBDIRS],
-[trap '' EXIT
-for moz_config_dir in $1; do
-  MOZ_SUBCONFIGURE_WRAP([$moz_config_dir],[
-    _MOZ_AC_OUTPUT_SUBDIRS($moz_config_dir)
-  ])
+  if test -d "$moz_config_dir"; then
+    (cd "$moz_config_dir"; eval $PYTHON $_topsrcdir/build/subconfigure.py dump "$_CONFIG_SHELL" $ac_configure_args)
+  else
+    mkdir -p "$moz_config_dir"
+  fi
+  _save_cache_file="$cache_file"
+  ifelse($2,,cache_file="$moz_config_dir/config.cache",cache_file="$2")
+  _MOZ_AC_OUTPUT_SUBDIRS($moz_config_dir)
+  cache_file="$_save_cache_file"
+  (cd "$moz_config_dir"; $PYTHON $_topsrcdir/build/subconfigure.py adjust $ac_sub_configure)
 done
 
 MOZ_CONFIG_LOG_TRAP
 ])
 
 dnl Print error messages in config.log as well as stderr
 define([AC_MSG_ERROR],
 [{ echo "configure: error: $1" 1>&2; echo "configure: error: $1" 1>&5; exit 1; }])

--- a/build/autoconf/icu.m4
+++ b/build/autoconf/icu.m4
@@ -149,37 +149,18 @@ if test -z "$BUILDING_JS" -o -n "$JS_STA
         ICU_CPPFLAGS="$ICU_CPPFLAGS -DUCONFIG_NO_BREAK_ITERATION"
         ICU_CPPFLAGS="$ICU_CPPFLAGS -DUCONFIG_NO_IDNA"
         # we don't need to pass data to and from legacy char* APIs
         ICU_CPPFLAGS="$ICU_CPPFLAGS -DU_CHARSET_IS_UTF8"
         # make sure to not accidentally pick up system-icu headers
         ICU_CPPFLAGS="$ICU_CPPFLAGS -I$icudir/common -I$icudir/i18n"
 
         ICU_CROSS_BUILD_OPT=""
-        ICU_SRCDIR=""
-        if test "$HOST_OS_ARCH" = "WINNT"; then
-    	ICU_SRCDIR="--srcdir=$(cd $srcdir/intl/icu/source; pwd -W)"
-        fi
 
         if test "$CROSS_COMPILE"; then
-    	# Building host tools.  It is necessary to build target binary.
-    	case "$HOST_OS_ARCH" in
-    	    Darwin)
-    		ICU_TARGET=MacOSX
-    		;;
-    	    Linux)
-    		ICU_TARGET=Linux
-    		;;
-    	    WINNT)
-    		ICU_TARGET=MSYS/MSVC
-    		;;
-            DragonFly|FreeBSD|NetBSD|OpenBSD|GNU_kFreeBSD)
-    		ICU_TARGET=BSD
-    		;;
-    	esac
     	# Remove _DEPEND_CFLAGS from HOST_FLAGS to avoid configure error
     	HOST_ICU_CFLAGS="$HOST_CFLAGS"
     	HOST_ICU_CXXFLAGS="$HOST_CXXFLAGS"
 
     	HOST_ICU_CFLAGS=`echo $HOST_ICU_CFLAGS | sed "s|$_DEPEND_CFLAGS||g"`
     	HOST_ICU_CXXFLAGS=`echo $HOST_ICU_CFXXLAGS | sed "s|$_DEPEND_CFLAGS||g"`
 
     	# ICU requires RTTI
@@ -191,34 +172,30 @@ if test -z "$BUILDING_JS" -o -n "$JS_STA
 
     	HOST_ICU_BUILD_OPTS=""
     	if test -n "$MOZ_DEBUG"; then
     	    HOST_ICU_BUILD_OPTS="$HOST_ICU_BUILD_OPTS --enable-debug"
     	fi
 
     	abs_srcdir=`(cd $srcdir; pwd)`
     	mkdir -p $_objdir/intl/icu/host
-    	(cd $_objdir/intl/icu/host
-    	 MOZ_SUBCONFIGURE_WRAP([.],[
-    	 AR="$HOST_AR" RANLIB="$HOST_RANLIB" \
-    	 CC="$HOST_CC" CXX="$HOST_CXX" LD="$HOST_LD" \
-    	 CFLAGS="$HOST_ICU_CFLAGS $HOST_OPTIMIZE_FLAGS" \
-    	 CPPFLAGS="$ICU_CPPFLAGS" \
-    	 CXXFLAGS="$HOST_ICU_CXXFLAGS $HOST_OPTIMIZE_FLAGS" \
-    	 LDFLAGS="$HOST_LDFLAGS" \
-    		$SHELL $abs_srcdir/intl/icu/source/runConfigureICU \
-    		$HOST_ICU_BUILD_OPTS \
-    		$ICU_TARGET \
-    	dnl Shell quoting is fun.
-    		${ICU_SRCDIR+"$ICU_SRCDIR"} \
-    		--enable-static --disable-shared \
-    		--enable-extras=no --enable-icuio=no --enable-layout=no \
-    		--enable-tests=no --enable-samples=no || exit 1
-    	 ])
-    	) || exit 1
+        (export AR="$HOST_AR"
+         export RANLIB="$HOST_RANLIB"
+         export CC="$HOST_CC"
+         export CXX="$HOST_CXX"
+         export CPP="$HOST_CPP"
+         export LD="$HOST_LD"
+         export CFLAGS="$HOST_ICU_CFLAGS $HOST_OPTIMIZE_FLAGS"
+         export CPPFLAGS="$ICU_CPPFLAGS"
+         export CXXFLAGS="$HOST_ICU_CXXFLAGS $HOST_OPTIMIZE_FLAGS"
+         export LDFLAGS="$HOST_LDFLAGS"
+         ac_configure_args="$HOST_ICU_BUILD_OPTS"
+         ac_configure_args="$ac_configure_args --enable-static --disable-shared --enable-extras=no --enable-icuio=no --enable-layout=no --enable-tests=no --enable-samples=no"
+         AC_OUTPUT_SUBDIRS(intl/icu/source:intl/icu/host)
+        ) || exit 1
     	# generate config/icucross.mk
     	$GMAKE -C $_objdir/intl/icu/host/ config/icucross.mk
 
     	# --with-cross-build requires absolute path
     	ICU_HOST_PATH=`cd $_objdir/intl/icu/host && pwd`
     	ICU_CROSS_BUILD_OPT="--with-cross-build=$ICU_HOST_PATH"
     	ICU_TARGET_OPT="--build=$build --host=$target"
         else
@@ -303,37 +280,26 @@ if test -z "$BUILDING_JS" -o -n "$JS_STA
           ICU_CXXFLAGS="$ICU_CXXFLAGS -DU_STATIC_IMPLEMENTATION"
           ICU_CFLAGS="$ICU_CFLAGS -DU_STATIC_IMPLEMENTATION"
           if test "$GNU_CC"; then
             ICU_CFLAGS="$ICU_CFLAGS -fvisibility=hidden"
             ICU_CXXFLAGS="$ICU_CXXFLAGS -fvisibility=hidden"
           fi
         fi
 
-        # We cannot use AC_OUTPUT_SUBDIRS since ICU tree is out of spidermonkey.
-        # When using AC_OUTPUT_SUBDIRS, objdir of ICU is out of objdir
-        # due to relative path.
-        # If building ICU moves into root of mozilla tree, we can use
-        # AC_OUTPUT_SUBDIR instead.
-        mkdir -p $_objdir/intl/icu/target
-        (cd $_objdir/intl/icu/target
-         MOZ_SUBCONFIGURE_WRAP([.],[
-           AR="$AR" CC="$CC" CXX="$CXX" LD="$LD" \
-           ARFLAGS="$ARFLAGS" \
-           CPPFLAGS="$ICU_CPPFLAGS $CPPFLAGS" \
-           CFLAGS="$ICU_CFLAGS" \
-           CXXFLAGS="$ICU_CXXFLAGS" \
-           LDFLAGS="$ICU_LDFLAGS $LDFLAGS" \
-           $SHELL $_topsrcdir/intl/icu/source/configure \
-    		$ICU_BUILD_OPTS \
-    		$ICU_CROSS_BUILD_OPT \
-    		$ICU_LINK_OPTS \
-    		${ICU_SRCDIR+"$ICU_SRCDIR"} \
-    		$ICU_TARGET_OPT \
-    		--disable-extras --disable-icuio --disable-layout \
-    		--disable-tests --disable-samples || exit 1
-           ])
+        (export AR="$AR"
+         export CC="$CC"
+         export CXX="$CXX"
+         export LD="$LD"
+         export ARFLAGS="$ARFLAGS"
+         export CPPFLAGS="$ICU_CPPFLAGS $CPPFLAGS"
+         export CFLAGS="$ICU_CFLAGS"
+         export CXXFLAGS="$ICU_CXXFLAGS"
+         export LDFLAGS="$ICU_LDFLAGS $LDFLAGS"
+         ac_configure_args="$ICU_BUILD_OPTS $ICU_CROSS_BUILD_OPT $ICU_LINK_OPTS $ICU_TARGET_OPT"
+         ac_configure_args="$ac_configure_args --disable-extras --disable-icuio --disable-layout --disable-tests --disable-samples"
+         AC_OUTPUT_SUBDIRS(intl/icu/source:intl/icu/target)
         ) || exit 1
     fi
 
 fi
 
 ])

--- a/build/sanitizers/lsan_suppressions.txt
+++ b/build/sanitizers/lsan_suppressions.txt
@@ -60,19 +60,16 @@ leak:event_base_once
 leak:nsLocalFile::OpenNSPRFileDesc
 
 # Bug 1023585 - Leak of array buffer in JSStructuredCloneWriter::transferOwnership(). m1
 leak:AllocateArrayBufferContents
 
 # Bug 1022010 - Small leak under _render_glyph_outline. bc1
 leak:_render_glyph_outline
 
-# Bug 1022954 - ScriptSource leaks sourceMapURL_ sometimes. dt
-leak:ScriptSource::setSourceMapURL
-
 # Bug 1023548 - Small leak under SECITEM_AllocItem_Util. bc1, bc3
 leak:SECITEM_AllocItem_Util
 
 # This is a one-time leak, so it is probably okay to ignore. bc1, oth
 leak:GlobalPrinters::InitializeGlobalPrinters
 leak:nsPSPrinterList::GetPrinterList
 
 # Bug 1028456 - More leaks with _PR_Getfd, in nsLocalFile::CopyToNative and do_create. bc1, bc3

--- a/build/subconfigure.py
+++ b/build/subconfigure.py
@@ -1,15 +1,16 @@
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 # This script is used to capture the content of config.status-generated
 # files and subsequently restore their timestamp if they haven't changed.
 
+import argparse
 import os
 import re
 import subprocess
 import sys
 import pickle
 
 class File(object):
     def __init__(self, path):
@@ -55,34 +56,64 @@ PRECIOUS_VARS = set([
 
 
 # Autoconf, in some of the sub-configures used in the tree, likes to error
 # out when "precious" variables change in value. The solution it gives to
 # straighten things is to either run make distclean or remove config.cache.
 # There's no reason not to do the latter automatically instead of failing,
 # doing the cleanup (which, on buildbots means a full clobber), and
 # restarting from scratch.
-def maybe_clear_cache():
+def maybe_clear_cache(args):
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--target', type=str)
+    parser.add_argument('--host', type=str)
+    parser.add_argument('--build', type=str)
+    args, others = parser.parse_known_args(args)
+    env = dict(os.environ)
+    for kind in ('target', 'host', 'build'):
+        arg = getattr(args, kind)
+        if arg is not None:
+            env['%s_alias' % kind] = arg
+    # configure can take variables assignments in its arguments, and that
+    # overrides whatever is in the environment.
+    for arg in others:
+        if arg[:1] != '-' and '=' in arg:
+            key, value = arg.split('=', 1)
+            env[key] = value
+
     comment = re.compile(r'^\s+#')
     cache = {}
     with open('config.cache') as f:
-        for line in f.readlines():
+        for line in f:
             if not comment.match(line) and '=' in line:
-                key, value = line.split('=', 1)
+                key, value = line.rstrip(os.linesep).split('=', 1)
+                # If the value is quoted, unquote it
+                if value[:1] == "'":
+                    value = value[1:-1].replace("'\\''", "'")
                 cache[key] = value
     for precious in PRECIOUS_VARS:
-        entry = 'ac_cv_env_%s_value' % precious
-        if entry in cache and (not precious in os.environ or os.environ[precious] != cache[entry]):
+        # If there is no entry at all for that precious variable, then
+        # its value is not precious for that particular configure.
+        if 'ac_cv_env_%s_set' % precious not in cache:
+            continue
+        is_set = cache.get('ac_cv_env_%s_set' % precious) == 'set'
+        value = cache.get('ac_cv_env_%s_value' % precious) if is_set else None
+        if value != env.get(precious):
+            print 'Removing config.cache because of %s value change from:' \
+                % precious
+            print '  %s' % (value if value is not None else 'undefined')
+            print 'to:'
+            print '  %s' % env.get(precious, 'undefined')
             os.remove('config.cache')
             return
 
 
-def dump(dump_file, shell):
+def dump(dump_file, shell, args):
     if os.path.exists('config.cache'):
-        maybe_clear_cache()
+        maybe_clear_cache(args)
     if not os.path.exists('config.status'):
         if os.path.exists(dump_file):
             os.remove(dump_file)
         return
 
     config_files = [File('config.status')]
 
     # Scan the config.status output for information about configuration files
@@ -127,11 +158,11 @@ def adjust(dump_file, configure):
 
     os.remove(dump_file)
 
 
 CONFIG_DUMP = 'config_files.pkl'
 
 if __name__ == '__main__':
     if sys.argv[1] == 'dump':
-        dump(CONFIG_DUMP, sys.argv[2])
+        dump(CONFIG_DUMP, sys.argv[2], sys.argv[3:])
     elif sys.argv[1] == 'adjust':
         adjust(CONFIG_DUMP, sys.argv[2] if len(sys.argv) > 2 else None)

--- a/build/valgrind/mach_commands.py
+++ b/build/valgrind/mach_commands.py
@@ -121,38 +121,45 @@ class MachCommands(MachCommandBase):
             # MACHTYPE is an odd bash-only environment variable that doesn't
             # show up in os.environ, so we have to get it another way.
             machtype = subprocess.check_output(['bash', '-c', 'echo $MACHTYPE']).rstrip()
             supps_file2 = os.path.join(supps_dir, machtype + '.sup')
             if os.path.isfile(supps_file2):
                 valgrind_args.append('--suppressions=' + supps_file2)
 
             exitcode = None
+            timeout = 1100
             try:
                 runner = FirefoxRunner(profile=profile,
                                        binary=self.get_binary_path(),
                                        cmdargs=firefox_args,
                                        env=env,
                                        process_args=kp_kwargs)
                 runner.start(debug_args=valgrind_args)
-                exitcode = runner.wait()
+                # This timeout is slightly less than the no-output timeout on
+                # TBPL, so we'll timeout here first and give an informative
+                # message.
+                exitcode = runner.wait(timeout=timeout)
 
             finally:
                 errs = outputHandler.error_count
                 supps = outputHandler.suppression_count
                 if errs != supps:
                     status = 1  # turns the TBPL job orange
-                    print('TEST-UNEXPECTED-FAILURE | valgrind-test | error parsing:', errs, "errors seen, but", supps, "generated suppressions seen")
+                    print('TEST-UNEXPECTED-FAIL | valgrind-test | error parsing: {} errors seen, but {} generated suppressions seen'.format(errs, supps))
 
                 elif errs == 0:
                     status = 0
                     print('TEST-PASS | valgrind-test | valgrind found no errors')
                 else:
                     status = 1  # turns the TBPL job orange
                     # We've already printed details of the errors.
 
-                if exitcode != 0:
+                if exitcode == None:
+                    status = 2  # turns the TBPL job red
+                    print('TEST-UNEXPECTED-FAIL | valgrind-test | Valgrind timed out (reached {} second limit)'.format(timeout))
+                elif exitcode != 0:
                     status = 2  # turns the TBPL job red
                     print('TEST-UNEXPECTED-FAIL | valgrind-test | non-zero exit code from Valgrind')
 
                 httpd.stop()
 
             return status

--- a/config/config.mk
+++ b/config/config.mk
@@ -69,16 +69,17 @@ endif
   TIERS \
   TOOL_DIRS \
   XPCSHELL_TESTS \
   XPIDL_MODULE \
   $(NULL)
 
 _DEPRECATED_VARIABLES := \
   ANDROID_RESFILES \
+  EXPORT_LIBRARY \
   LIBXUL_LIBRARY \
   MOCHITEST_A11Y_FILES \
   MOCHITEST_BROWSER_FILES \
   MOCHITEST_BROWSER_FILES_PARTS \
   MOCHITEST_CHROME_FILES \
   MOCHITEST_FILES \
   MOCHITEST_FILES_PARTS \
   MOCHITEST_METRO_FILES \
@@ -340,17 +341,16 @@ endif
 endif
 
 # If we are building this component into an extension/xulapp, it cannot be
 # statically linked. In the future we may want to add a xulapp meta-component
 # build option.
 
 ifdef XPI_NAME
 ifdef IS_COMPONENT
-EXPORT_LIBRARY=
 FORCE_STATIC_LIB=
 FORCE_SHARED_LIB=1
 endif
 endif
 
 ifndef SHARED_LIBRARY_NAME
 ifdef LIBRARY_NAME
 SHARED_LIBRARY_NAME=$(LIBRARY_NAME)

--- a/config/makefiles/target_binaries.mk
+++ b/config/makefiles/target_binaries.mk
@@ -1,28 +1,15 @@
 # -*- makefile -*-
 # vim:set ts=8 sw=8 sts=8 noet:
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-ifdef EXPORT_LIBRARY
-ifeq ($(EXPORT_LIBRARY),1)
-ifdef IS_COMPONENT
-EXPORT_LIBRARY = $(DEPTH)/staticlib/components
-else
-EXPORT_LIBRARY = $(DEPTH)/staticlib
-endif
-else
-# If EXPORT_LIBRARY has a value, we'll be installing there. We also need to cleanup there
-GARBAGE += $(foreach lib,$(LIBRARY),$(EXPORT_LIBRARY)/$(lib))
-endif
-endif # EXPORT_LIBRARY
-
 binaries libs:: $(SUBMAKEFILES) $(TARGETS)
 ifndef NO_DIST_INSTALL
 ifdef SHARED_LIBRARY
 ifdef IS_COMPONENT
 	$(INSTALL) $(IFLAGS2) $(SHARED_LIBRARY) $(FINAL_TARGET)/components
 ifndef NO_COMPONENTS_MANIFEST
 	$(call py_action,buildlist,$(FINAL_TARGET)/chrome.manifest 'manifest components/components.manifest')
 	$(call py_action,buildlist,$(FINAL_TARGET)/components/components.manifest 'binary-component $(SHARED_LIBRARY)')
@@ -36,22 +23,16 @@ ifndef NO_DIST_INSTALL
 ifneq (,$(strip $(PROGRAM)$(SIMPLE_PROGRAMS)))
 PROGRAMS_EXECUTABLES = $(SIMPLE_PROGRAMS) $(PROGRAM)
 PROGRAMS_DEST ?= $(FINAL_TARGET)
 PROGRAMS_TARGET := binaries libs
 INSTALL_TARGETS += PROGRAMS
 endif
 
 ifdef LIBRARY
-ifdef EXPORT_LIBRARY
-LIBRARY_FILES = $(LIBRARY)
-LIBRARY_DEST ?= $(EXPORT_LIBRARY)
-LIBRARY_TARGET = binaries libs
-INSTALL_TARGETS += LIBRARY
-endif
 ifdef DIST_INSTALL
 ifdef IS_COMPONENT
 $(error Shipping static component libs makes no sense.)
 else
 DIST_LIBRARY_FILES = $(LIBRARY)
 DIST_LIBRARY_DEST ?= $(DIST)/lib
 DIST_LIBRARY_TARGET = binaries libs
 INSTALL_TARGETS += DIST_LIBRARY

--- a/config/rules.mk
+++ b/config/rules.mk
@@ -828,17 +828,17 @@ endif
 $(filter %.$(LIB_SUFFIX),$(LIBRARY)): $(OBJS) $(EXTRA_DEPS) $(GLOBAL_DEPS)
 	$(REPORT_BUILD)
 	$(RM) $(LIBRARY)
 	$(EXPAND_AR) $(AR_FLAGS) $(OBJS) $(SHARED_LIBRARY_LIBS)
 
 $(filter-out %.$(LIB_SUFFIX),$(LIBRARY)): $(filter %.$(LIB_SUFFIX),$(LIBRARY)) $(OBJS) $(EXTRA_DEPS) $(GLOBAL_DEPS)
 # When we only build a library descriptor, blow out any existing library
 	$(REPORT_BUILD)
-	$(if $(filter %.$(LIB_SUFFIX),$(LIBRARY)),,$(RM) $(REAL_LIBRARY) $(EXPORT_LIBRARY:%=%/$(REAL_LIBRARY)))
+	$(if $(filter %.$(LIB_SUFFIX),$(LIBRARY)),,$(RM) $(REAL_LIBRARY))
 	$(EXPAND_LIBS_GEN) -o $@ $(OBJS) $(SHARED_LIBRARY_LIBS)
 
 ifeq ($(OS_ARCH),WINNT)
 # Import libraries are created by the rules creating shared libraries.
 # The rules to copy them to $(DIST)/lib depend on $(IMPORT_LIBRARY),
 # but make will happily consider the import library before it is refreshed
 # when rebuilding the corresponding shared library. Defining an empty recipe
 # for import libraries forces make to wait for the shared library recipe to

--- a/configure.in
+++ b/configure.in
@@ -8778,17 +8778,16 @@ AC_SUBST(OBJ_SUFFIX)
 AC_SUBST(BIN_SUFFIX)
 AC_SUBST(ASM_SUFFIX)
 AC_SUBST(IMPORT_LIB_SUFFIX)
 AC_SUBST(USE_N32)
 AC_SUBST(CC_VERSION)
 AC_SUBST(CXX_VERSION)
 AC_SUBST(MSMANIFEST_TOOL)
 AC_SUBST(NS_ENABLE_TSF)
-AC_SUBST(MOZ_APP_COMPONENT_LIBS)
 AC_SUBST(MOZ_APP_EXTRA_LIBS)
 
 AC_SUBST(MOZ_WAVE)
 AC_SUBST(MOZ_VORBIS)
 AC_SUBST(MOZ_TREMOR)
 AC_SUBST(MOZ_OPUS)
 AC_SUBST(MOZ_WEBM)
 AC_SUBST(MOZ_WMF)
@@ -9045,31 +9044,28 @@ if test -z "$MOZ_NATIVE_JEMALLOC" -a "$M
   fi
   EXTRA_CFLAGS="$CFLAGS"
   for var in AS CC CXX CPP LD AR RANLIB STRIP CPPFLAGS EXTRA_CFLAGS LDFLAGS; do
     ac_configure_args="$ac_configure_args $var='`eval echo \\${${var}}`'"
   done
   if test "$CROSS_COMPILE"; then
     ac_configure_args="$ac_configure_args je_cv_static_page_shift=12"
   fi
-  _save_cache_file="$cache_file"
-  cache_file=$_objdir/memory/jemalloc/src/config.cache
 
   if ! test -e memory/jemalloc; then
     mkdir -p memory/jemalloc
   fi
 
   dnl jemalloc's configure uses $srcdir in AC_CONFIG_HEADERS, which syntax uses
   dnl colons, conflicting with the windows-style path in $srcdir.
   dnl Turn it into a msys path just for jemalloc's configure
   _save_srcdir="$srcdir"
   srcdir=`cd $srcdir; pwd`
   AC_OUTPUT_SUBDIRS(memory/jemalloc/src)
   srcdir="$_save_srcdir"
-  cache_file="$_save_cache_file"
   ac_configure_args="$_SUBDIR_CONFIG_ARGS"
 fi
 
 # Run freetype configure script
 
 if test "$MOZ_TREE_FREETYPE"; then
    export CFLAGS="$CFLAGS $MOZ_DEBUG_FLAGS -std=c99"
    export CPPFLAGS="$CPPFLAGS $MOZ_DEBUG_FLAGS"
@@ -9083,17 +9079,17 @@ if test "$MOZ_TREE_FREETYPE"; then
    export ZLIB_LIBS="$MOZ_ZLIB_LIBS "
    export CONFIG_FILES="unix-cc.mk:unix-cc.in unix-def.mk:unix-def.in freetype-config freetype2.pc:freetype2.in"
    ac_configure_args="$ac_configure_args --host=$target --disable-shared --with-pic=yes --with-zlib=yes --without-bzip2 --with-png=yes --without-harfbuzz"
 
    if ! test -e modules; then
      mkdir modules
    fi
 
-   AC_OUTPUT_SUBDIRS(modules/freetype2)
+   AC_OUTPUT_SUBDIRS(modules/freetype2,$cache_file)
 fi
 
 if test -z "$direct_nspr_config"; then
     dnl ========================================================
     dnl = Setup a nice relatively clean build environment for
     dnl = sub-configures.
     dnl ========================================================
     CC="$_SUBDIR_CC"
@@ -9175,24 +9171,19 @@ if test -z "$MOZ_NATIVE_NSPR"; then
     if test -n "$MOZ_LINKER" -a "$ac_cv_func_dladdr" = no ; then
       # dladdr is supported by the new linker, even when the system linker doesn't
       # support it. Trick nspr into using dladdr when it's not supported.
       export CPPFLAGS="-include $_topsrcdir/mozglue/linker/dladdr.h $CPPFLAGS"
     fi
     export LDFLAGS="$LDFLAGS $NSPR_LDFLAGS"
     export CFLAGS="$CFLAGS $MOZ_FRAMEPTR_FLAGS"
 
-    # Use a separate cache file for NSPR since it uses autoconf 2.68.
-    _save_cache_file="$cache_file"
-    cache_file=$_objdir/nsprpub/config.cache
-
     AC_OUTPUT_SUBDIRS(nsprpub)
 
     # .. and restore them
-    cache_file="$_save_cache_file"
     CFLAGS="$_SAVE_CFLAGS"
     CPPFLAGS="$_SAVE_CPPFLAGS"
     LDFLAGS="$_SAVE_LDFLAGS"
 
     ac_configure_args="$_SUBDIR_CONFIG_ARGS"
 fi
 
 dnl ========================================================
@@ -9272,17 +9263,17 @@ export STLPORT_LIBS
 export JS_STANDALONE=no
 export MOZ_LINKER
 export ZLIB_IN_MOZGLUE
 
 if ! test -e js; then
     mkdir js
 fi
 
-AC_OUTPUT_SUBDIRS(js/src)
+AC_OUTPUT_SUBDIRS(js/src,$cache_file)
 ac_configure_args="$_SUBDIR_CONFIG_ARGS"
 
 fi # COMPILE_ENVIRONMENT && !LIBXUL_SDK_DIR
 
 export WRITE_MOZINFO=1
 dnl we need to run config.status after js/src subconfigure because we're
 dnl traversing its moz.build and we need its config.status for that.
 dnl However, writing our own config.status needs to happen before

--- a/content/base/public/nsContentUtils.h
+++ b/content/base/public/nsContentUtils.h
@@ -472,18 +472,17 @@ public:
   static nsIScriptSecurityManager* GetSecurityManager()
   {
     return sSecurityManager;
   }
 
   /**
    * Get the ContentSecurityPolicy for a JS context.
    **/
-  static bool GetContentSecurityPolicy(JSContext* aCx,
-                                       nsIContentSecurityPolicy** aCSP);
+  static bool GetContentSecurityPolicy(nsIContentSecurityPolicy** aCSP);
 
   // Returns the subject principal. Guaranteed to return non-null. May only
   // be called when nsContentUtils is initialized.
   static nsIPrincipal* SubjectPrincipal();
 
   // Returns the prinipal of the given JS object. This may only be called on
   // the main thread for objects from the main thread's JSRuntime.
   static nsIPrincipal* ObjectPrincipal(JSObject* aObj);

--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -6420,21 +6420,19 @@ nsContentUtils::FindInternalContentViewe
     }
     return docFactory.forget();
   }
 
   return nullptr;
 }
 
 bool
-nsContentUtils::GetContentSecurityPolicy(JSContext* aCx,
-                                         nsIContentSecurityPolicy** aCSP)
+nsContentUtils::GetContentSecurityPolicy(nsIContentSecurityPolicy** aCSP)
 {
   NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
-  MOZ_ASSERT(aCx == GetCurrentJSContext());
 
   nsCOMPtr<nsIContentSecurityPolicy> csp;
   nsresult rv = SubjectPrincipal()->GetCsp(getter_AddRefs(csp));
   if (NS_FAILED(rv)) {
     NS_ERROR("CSP: Failed to get CSP from principal.");
     return false;
   }
 

--- a/content/base/src/nsDOMFile.cpp
+++ b/content/base/src/nsDOMFile.cpp
@@ -935,17 +935,17 @@ public:
 
       size_t size = DOMMemoryFileDataOwnerMallocSizeOf(owner->mData);
 
       if (size < LARGE_OBJECT_MIN_SIZE) {
         smallObjectsTotal += size;
       } else {
         SHA1Sum sha1;
         sha1.update(owner->mData, owner->mLength);
-        uint8_t digest[SHA1Sum::HashSize]; // SHA1 digests are 20 bytes long.
+        uint8_t digest[SHA1Sum::kHashSize]; // SHA1 digests are 20 bytes long.
         sha1.finish(digest);
 
         nsAutoCString digestString;
         for (size_t i = 0; i < sizeof(digest); i++) {
           digestString.AppendPrintf("%02x", digest[i]);
         }
 
         nsresult rv = aCallback->Callback(

--- a/content/base/src/nsScriptLoader.cpp
+++ b/content/base/src/nsScriptLoader.cpp
@@ -1466,19 +1466,21 @@ nsScriptLoader::PrepareLoadedRequest(nsS
   if (httpChannel) {
     bool requestSucceeded;
     rv = httpChannel->GetRequestSucceeded(&requestSucceeded);
     if (NS_SUCCEEDED(rv) && !requestSucceeded) {
       return NS_ERROR_NOT_AVAILABLE;
     }
 
     nsAutoCString sourceMapURL;
-    httpChannel->GetResponseHeader(NS_LITERAL_CSTRING("X-SourceMap"), sourceMapURL);
-    aRequest->mHasSourceMapURL = true;
-    aRequest->mSourceMapURL = NS_ConvertUTF8toUTF16(sourceMapURL);
+    rv = httpChannel->GetResponseHeader(NS_LITERAL_CSTRING("X-SourceMap"), sourceMapURL);
+    if (NS_SUCCEEDED(rv)) {
+      aRequest->mHasSourceMapURL = true;
+      aRequest->mSourceMapURL = NS_ConvertUTF8toUTF16(sourceMapURL);
+    }
   }
 
   nsCOMPtr<nsIChannel> channel = do_QueryInterface(req);
   // If this load was subject to a CORS check; don't flag it with a
   // separate origin principal, so that it will treat our document's
   // principal as the origin principal
   if (aRequest->mCORSMode == CORS_NONE) {
     rv = nsContentUtils::GetSecurityManager()->

--- a/content/base/test/chrome/nochrome_bug765993.js
+++ b/content/base/test/chrome/nochrome_bug765993.js
@@ -1,4 +1,4 @@
-//@ sourceMappingURL=bar.js.map
+//# sourceMappingURL=bar.js.map
 
 // Define a single function to prevent script source from being gc'd
 function foo() {}

--- a/content/media/MediaDecoderStateMachine.cpp
+++ b/content/media/MediaDecoderStateMachine.cpp
@@ -8,16 +8,17 @@
 #include "windows.h"
 #include "mmsystem.h"
 #endif
 
 #include "mozilla/DebugOnly.h"
 #include <stdint.h>
 
 #include "MediaDecoderStateMachine.h"
+#include "MediaDecoderStateMachineScheduler.h"
 #include "AudioSink.h"
 #include "nsTArray.h"
 #include "MediaDecoder.h"
 #include "MediaDecoderReader.h"
 #include "mozilla/mozalloc.h"
 #include "VideoUtils.h"
 #include "mozilla/dom/TimeRanges.h"
 #include "nsDeque.h"
@@ -163,18 +164,21 @@ static TimeDuration UsecsToDuration(int6
 static int64_t DurationToUsecs(TimeDuration aDuration) {
   return static_cast<int64_t>(aDuration.ToSeconds() * USECS_PER_S);
 }
 
 MediaDecoderStateMachine::MediaDecoderStateMachine(MediaDecoder* aDecoder,
                                                    MediaDecoderReader* aReader,
                                                    bool aRealTime) :
   mDecoder(aDecoder),
+  mScheduler(new MediaDecoderStateMachineScheduler(
+      aDecoder->GetReentrantMonitor(),
+      &MediaDecoderStateMachine::TimeoutExpired,
+      MOZ_THIS_IN_INITIALIZER_LIST(), aRealTime)),
   mState(DECODER_STATE_DECODING_METADATA),
-  mInRunningStateMachine(false),
   mSyncPointInMediaStream(-1),
   mSyncPointInDecodedStream(-1),
   mPlayDuration(0),
   mStartTime(-1),
   mEndTime(-1),
   mFragmentEndTime(-1),
   mReader(aReader),
   mCurrentFrameTime(0),
@@ -193,40 +197,34 @@ MediaDecoderStateMachine::MediaDecoderSt
   mPositionChangeQueued(false),
   mAudioCompleted(false),
   mGotDurationFromMetaData(false),
   mDispatchedEventToDecode(false),
   mStopAudioThread(true),
   mQuickBuffering(false),
   mMinimizePreroll(false),
   mDecodeThreadWaiting(false),
-  mRealTime(aRealTime),
   mDispatchedDecodeMetadataTask(false),
   mDropAudioUntilNextDiscontinuity(false),
   mDropVideoUntilNextDiscontinuity(false),
   mDecodeToSeekTarget(false),
   mCurrentTimeBeforeSeek(0),
-  mLastFrameStatus(MediaDecoderOwner::NEXT_FRAME_UNINITIALIZED),
-  mTimerId(0)
+  mLastFrameStatus(MediaDecoderOwner::NEXT_FRAME_UNINITIALIZED)
 {
   MOZ_COUNT_CTOR(MediaDecoderStateMachine);
   NS_ASSERTION(NS_IsMainThread(), "Should be on main thread.");
 
-  // Only enable realtime mode when "media.realtime_decoder.enabled" is true.
-  if (Preferences::GetBool("media.realtime_decoder.enabled", false) == false)
-    mRealTime = false;
-
   mAmpleVideoFrames =
     std::max<uint32_t>(Preferences::GetUint("media.video-queue.default-size", 10), 3);
 
-  mBufferingWait = mRealTime ? 0 : BUFFERING_WAIT_S;
-  mLowDataThresholdUsecs = mRealTime ? 0 : LOW_DATA_THRESHOLD_USECS;
-
-  mVideoPrerollFrames = mRealTime ? 0 : mAmpleVideoFrames / 2;
-  mAudioPrerollUsecs = mRealTime ? 0 : LOW_AUDIO_USECS * 2;
+  mBufferingWait = mScheduler->IsRealTime() ? 0 : BUFFERING_WAIT_S;
+  mLowDataThresholdUsecs = mScheduler->IsRealTime() ? 0 : LOW_DATA_THRESHOLD_USECS;
+
+  mVideoPrerollFrames = mScheduler->IsRealTime() ? 0 : mAmpleVideoFrames / 2;
+  mAudioPrerollUsecs = mScheduler->IsRealTime() ? 0 : LOW_AUDIO_USECS * 2;
 
 #ifdef XP_WIN
   // Ensure high precision timers are enabled on Windows, otherwise the state
   // machine thread isn't woken up at reliable intervals to set the next frame,
   // and we drop frames while painting. Note that multiple calls to this
   // function per-process is OK, provided each call is matched by a corresponding
   // timeEndPeriod() call.
   timeBeginPeriod(1);
@@ -236,18 +234,16 @@ MediaDecoderStateMachine::MediaDecoderSt
 MediaDecoderStateMachine::~MediaDecoderStateMachine()
 {
   MOZ_ASSERT(NS_IsMainThread(), "Should be on main thread.");
   MOZ_COUNT_DTOR(MediaDecoderStateMachine);
   NS_ASSERTION(!mPendingWakeDecoder.get(),
                "WakeDecoder should have been revoked already");
 
   MOZ_ASSERT(!mDecodeTaskQueue, "Should be released in SHUTDOWN");
-  // No need to cancel the timer here for we've done that in SHUTDOWN.
-  MOZ_ASSERT(!mTimer, "Should be released in SHUTDOWN");
   mReader = nullptr;
 
 #ifdef XP_WIN
   timeEndPeriod(1);
 #endif
 }
 
 bool MediaDecoderStateMachine::HasFutureAudio() {
@@ -1058,34 +1054,25 @@ bool MediaDecoderStateMachine::IsPlaying
 
 nsresult MediaDecoderStateMachine::Init(MediaDecoderStateMachine* aCloneDonor)
 {
   MOZ_ASSERT(NS_IsMainThread());
 
   RefPtr<SharedThreadPool> decodePool(GetMediaDecodeThreadPool());
   NS_ENSURE_TRUE(decodePool, NS_ERROR_FAILURE);
 
-  RefPtr<SharedThreadPool> stateMachinePool(
-    SharedThreadPool::Get(NS_LITERAL_CSTRING("Media State Machine"), 1));
-  NS_ENSURE_TRUE(stateMachinePool, NS_ERROR_FAILURE);
-
   mDecodeTaskQueue = new MediaTaskQueue(decodePool.forget());
   NS_ENSURE_TRUE(mDecodeTaskQueue, NS_ERROR_FAILURE);
 
   MediaDecoderReader* cloneReader = nullptr;
   if (aCloneDonor) {
     cloneReader = aCloneDonor->mReader;
   }
 
-  mStateMachineThreadPool = stateMachinePool;
-
-  nsresult rv;
-  mTimer = do_CreateInstance("@mozilla.org/timer;1", &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
-  rv = mTimer->SetTarget(GetStateMachineThread());
+  nsresult rv = mScheduler->Init();
   NS_ENSURE_SUCCESS(rv, rv);
 
   // Note: This creates a cycle, broken in shutdown.
   mMediaDecodedListener =
     new MediaDataDecodedListener<MediaDecoderStateMachine>(this,
                                                            mDecodeTaskQueue);
   mReader->SetCallback(mMediaDecodedListener);
   mReader->SetTaskQueue(mDecodeTaskQueue);
@@ -1337,18 +1324,18 @@ void MediaDecoderStateMachine::Shutdown(
   NS_ASSERTION(NS_IsMainThread(), "Should be on main thread.");
 
   // Once we've entered the shutdown state here there's no going back.
   ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
 
   // Change state before issuing shutdown request to threads so those
   // threads can start exiting cleanly during the Shutdown call.
   DECODER_LOG(PR_LOG_DEBUG, "Changed state to SHUTDOWN");
-  ScheduleStateMachine();
   mState = DECODER_STATE_SHUTDOWN;
+  mScheduler->ScheduleAndShutdown();
   if (mAudioSink) {
     mAudioSink->PrepareToShutdown();
   }
   mDecoder->GetReentrantMonitor().NotifyAll();
 }
 
 void MediaDecoderStateMachine::StartDecoding()
 {
@@ -1748,16 +1735,17 @@ MediaDecoderStateMachine::StartAudioThre
   if (HasAudio() && !mAudioSink) {
     mAudioCompleted = false;
     mAudioSink = new AudioSink(this,
                                mAudioStartTime, mInfo.mAudio, mDecoder->GetAudioChannel());
     nsresult rv = mAudioSink->Init();
     if (NS_FAILED(rv)) {
       DECODER_LOG(PR_LOG_WARNING, "Changed state to SHUTDOWN because audio sink initialization failed");
       mState = DECODER_STATE_SHUTDOWN;
+      mScheduler->ScheduleAndShutdown();
       return rv;
     }
 
     mAudioSink->SetVolume(mVolume);
     mAudioSink->SetPlaybackRate(mPlaybackRate);
     mAudioSink->SetPreservesPitch(mPreservesPitch);
   }
   return NS_OK;
@@ -1825,18 +1813,18 @@ MediaDecoderStateMachine::DecodeError()
     // Already shutdown.
     return;
   }
 
   // Change state to shutdown before sending error report to MediaDecoder
   // and the HTMLMediaElement, so that our pipeline can start exiting
   // cleanly during the sync dispatch below.
   DECODER_LOG(PR_LOG_WARNING, "Decode error, changed state to SHUTDOWN due to error");
-  ScheduleStateMachine();
   mState = DECODER_STATE_SHUTDOWN;
+  mScheduler->ScheduleAndShutdown();
   mDecoder->GetReentrantMonitor().NotifyAll();
 
   // Dispatch the event to call DecodeError synchronously. This ensures
   // we're in shutdown state by the time we exit the decode thread.
   // If we just moved to shutdown state here on the decode thread, we may
   // cause the state machine to shutdown/free memory without closing its
   // media stream properly, and we'll get callbacks from the media stream
   // causing a crash.
@@ -1906,17 +1894,17 @@ nsresult MediaDecoderStateMachine::Decod
     AudioQueue().AddPopListener(decodeTask, mDecodeTaskQueue);
   }
   if (HasVideo()) {
     RefPtr<nsIRunnable> decodeTask(
       NS_NewRunnableMethod(this, &MediaDecoderStateMachine::DispatchVideoDecodeTaskIfNeeded));
     VideoQueue().AddPopListener(decodeTask, mDecodeTaskQueue);
   }
 
-  if (mRealTime) {
+  if (mScheduler->IsRealTime()) {
     SetStartTime(0);
     res = FinishDecodeMetadata();
     NS_ENSURE_SUCCESS(res, res);
   } else {
     if (HasAudio()) {
       ReentrantMonitorAutoExit unlock(mDecoder->GetReentrantMonitor());
       mReader->RequestAudioData();
     }
@@ -1935,17 +1923,17 @@ MediaDecoderStateMachine::FinishDecodeMe
   AssertCurrentThreadInMonitor();
   NS_ASSERTION(OnDecodeThread(), "Should be on decode thread.");
   DECODER_LOG(PR_LOG_DEBUG, "Decoding Media Headers");
 
   if (mState == DECODER_STATE_SHUTDOWN) {
     return NS_ERROR_FAILURE;
   }
 
-  if (!mRealTime) {
+  if (!mScheduler->IsRealTime()) {
 
     const VideoData* v = VideoQueue().PeekFront();
     const AudioData* a = AudioQueue().PeekFront();
 
     int64_t startTime = std::min<int64_t>(a ? a->mTime : INT64_MAX,
                                           v ? v->mTime : INT64_MAX);
     if (startTime == INT64_MAX) {
       startTime = 0;
@@ -2169,27 +2157,31 @@ MediaDecoderStateMachine::SeekCompleted(
   UpdatePlaybackPositionInternal(newCurrentTime);
   if (mDecoder->GetDecodedStream()) {
     SetSyncPointForMediaStream();
   }
 
   // Try to decode another frame to detect if we're at the end...
   DECODER_LOG(PR_LOG_DEBUG, "Seek completed, mCurrentFrameTime=%lld", mCurrentFrameTime);
 
+  // Prevent changes in playback position before 'seeked' is fired for we
+  // expect currentTime equals seek target in 'seeked' callback.
+  mScheduler->FreezeScheduling();
   {
     ReentrantMonitorAutoExit exitMon(mDecoder->GetReentrantMonitor());
     NS_DispatchToMainThread(stopEvent, NS_DISPATCH_SYNC);
   }
 
   // Reset quick buffering status. This ensures that if we began the
   // seek while quick-buffering, we won't bypass quick buffering mode
   // if we need to buffer after the seek.
   mQuickBuffering = false;
 
   ScheduleStateMachine();
+  mScheduler->ThawScheduling();
 }
 
 // Runnable to dispose of the decoder and state machine on the main thread.
 class nsDecoderDisposeEvent : public nsRunnable {
 public:
   nsDecoderDisposeEvent(already_AddRefed<MediaDecoder> aDecoder,
                         already_AddRefed<MediaDecoderStateMachine> aStateMachine)
     : mDecoder(aDecoder), mStateMachine(aStateMachine) {}
@@ -2287,18 +2279,16 @@ nsresult MediaDecoderStateMachine::RunSt
       // state machine) needs to finish and be released in order to allow
       // that. So we dispatch an event to run after this event runner has
       // finished and released its monitor/references. That event then will
       // dispatch an event to the main thread to release the decoder and
       // state machine.
       GetStateMachineThread()->Dispatch(
         new nsDispatchDisposeEvent(mDecoder, this), NS_DISPATCH_NORMAL);
 
-      mTimer->Cancel();
-      mTimer = nullptr;
       return NS_OK;
     }
 
     case DECODER_STATE_DORMANT: {
       if (IsPlaying()) {
         StopPlayback();
       }
       FlushDecoding();
@@ -2584,17 +2574,17 @@ void MediaDecoderStateMachine::AdvanceFr
   int64_t remainingTime = AUDIO_DURATION_USECS;
   NS_ASSERTION(clock_time >= mStartTime, "Should have positive clock time.");
   nsAutoPtr<VideoData> currentFrame;
 #ifdef PR_LOGGING
   int32_t droppedFrames = 0;
 #endif
   if (VideoQueue().GetSize() > 0) {
     VideoData* frame = VideoQueue().PeekFront();
-    while (mRealTime || clock_time >= frame->mTime) {
+    while (mScheduler->IsRealTime() || clock_time >= frame->mTime) {
       mVideoFrameEndTime = frame->GetEndTime();
       currentFrame = frame;
 #ifdef PR_LOGGING
       VERBOSE_LOG("discarding video frame %lld", frame->mTime);
       if (droppedFrames++) {
         VERBOSE_LOG("discarding video frame %lld (%d so far)", frame->mTime, droppedFrames-1);
       }
 #endif
@@ -2924,128 +2914,53 @@ nsresult MediaDecoderStateMachine::CallR
   AssertCurrentThreadInMonitor();
   NS_ASSERTION(OnStateMachineThread(), "Should be on state machine thread.");
 
   // If audio is being captured, stop the audio sink if it's running
   if (mAudioCaptured) {
     StopAudioThread();
   }
 
-  MOZ_ASSERT(!mInRunningStateMachine, "State machine cycles must run in sequence!");
-  mTimeout = TimeStamp();
-  mInRunningStateMachine = true;
-  nsresult res = RunStateMachine();
-  mInRunningStateMachine = false;
-  return res;
+  return RunStateMachine();
 }
 
-nsresult MediaDecoderStateMachine::TimeoutExpired(int aTimerId)
+nsresult MediaDecoderStateMachine::TimeoutExpired(void* aClosure)
 {
-  ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
-  NS_ASSERTION(OnStateMachineThread(), "Must be on state machine thread");
-  mTimer->Cancel();
-  if (mTimerId == aTimerId) {
-    return CallRunStateMachine();
-  } else {
-    return NS_OK;
-  }
+  MediaDecoderStateMachine* p = static_cast<MediaDecoderStateMachine*>(aClosure);
+  return p->CallRunStateMachine();
 }
 
 void MediaDecoderStateMachine::ScheduleStateMachineWithLockAndWakeDecoder() {
   ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
   DispatchAudioDecodeTaskIfNeeded();
   DispatchVideoDecodeTaskIfNeeded();
 }
 
-class TimerEvent : public nsITimerCallback, public nsRunnable {
-  NS_DECL_THREADSAFE_ISUPPORTS
-public:
-  TimerEvent(MediaDecoderStateMachine* aStateMachine, int aTimerId)
-    : mStateMachine(aStateMachine), mTimerId(aTimerId) {}
-
-  NS_IMETHOD Run() MOZ_OVERRIDE {
-    return mStateMachine->TimeoutExpired(mTimerId);
-  }
-
-  NS_IMETHOD Notify(nsITimer* aTimer) {
-    return mStateMachine->TimeoutExpired(mTimerId);
-  }
-private:
-  ~TimerEvent() {}
-
-  const nsRefPtr<MediaDecoderStateMachine> mStateMachine;
-  int mTimerId;
-};
-
-NS_IMPL_ISUPPORTS(TimerEvent, nsITimerCallback, nsIRunnable);
-
 nsresult MediaDecoderStateMachine::ScheduleStateMachine(int64_t aUsecs) {
-  AssertCurrentThreadInMonitor();
-  NS_ABORT_IF_FALSE(GetStateMachineThread(),
-    "Must have a state machine thread to schedule");
-
-  if (mState == DECODER_STATE_SHUTDOWN) {
-    return NS_ERROR_FAILURE;
-  }
-  aUsecs = std::max<int64_t>(aUsecs, 0);
-
-  TimeStamp timeout = TimeStamp::Now() + UsecsToDuration(aUsecs);
-  if (!mTimeout.IsNull() && timeout >= mTimeout) {
-    // We've already scheduled a timer set to expire at or before this time,
-    // or have an event dispatched to run the state machine.
-    return NS_OK;
-  }
-
-  uint32_t ms = static_cast<uint32_t>((aUsecs / USECS_PER_MS) & 0xFFFFFFFF);
-  if (mRealTime && ms > 40) {
-    ms = 40;
-  }
-
-  // Don't cancel the timer here for this function will be called from
-  // different threads.
-
-  nsresult rv = NS_ERROR_FAILURE;
-  nsRefPtr<TimerEvent> event = new TimerEvent(this, mTimerId+1);
-
-  if (ms == 0) {
-    // Dispatch a runnable to the state machine thread when delay is 0.
-    // It will has less latency than dispatching a runnable to the state
-    // machine thread which will then schedule a zero-delay timer.
-    rv = GetStateMachineThread()->Dispatch(event, NS_DISPATCH_NORMAL);
-  } else if (OnStateMachineThread()) {
-    rv = mTimer->InitWithCallback(event, ms, nsITimer::TYPE_ONE_SHOT);
-  } else {
-    MOZ_ASSERT(false, "non-zero delay timer should be only scheduled in state machine thread");
-  }
-
-  if (NS_SUCCEEDED(rv)) {
-    mTimeout = timeout;
-    ++mTimerId;
-  } else {
-    NS_WARNING("Failed to schedule state machine");
-  }
-
-  return rv;
+  return mScheduler->Schedule(aUsecs);
 }
 
 bool MediaDecoderStateMachine::OnDecodeThread() const
 {
   return mDecodeTaskQueue->IsCurrentThreadIn();
 }
 
 bool MediaDecoderStateMachine::OnStateMachineThread() const
 {
-  bool rv = false;
-  mStateMachineThreadPool->IsOnCurrentThread(&rv);
-  return rv;
+  return mScheduler->OnStateMachineThread();
 }
 
-nsIEventTarget* MediaDecoderStateMachine::GetStateMachineThread()
+nsIEventTarget* MediaDecoderStateMachine::GetStateMachineThread() const
 {
-  return mStateMachineThreadPool->GetEventTarget();
+  return mScheduler->GetStateMachineThread();
+}
+
+bool MediaDecoderStateMachine::IsStateMachineScheduled() const
+{
+  return mScheduler->IsScheduled();
 }
 
 void MediaDecoderStateMachine::SetPlaybackRate(double aPlaybackRate)
 {
   NS_ASSERTION(NS_IsMainThread(), "Should be on main thread.");
   NS_ASSERTION(aPlaybackRate != 0,
       "PlaybackRate == 0 should be handled before this function.");
   ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());

--- a/content/media/MediaDecoderStateMachine.h
+++ b/content/media/MediaDecoderStateMachine.h
@@ -95,16 +95,17 @@ class nsITimer;
 
 namespace mozilla {
 
 class AudioSegment;
 class VideoSegment;
 class MediaTaskQueue;
 class SharedThreadPool;
 class AudioSink;
+class MediaDecoderStateMachineScheduler;
 
 // GetCurrentTime is defined in winbase.h as zero argument macro forwarding to
 // GetTickCount() and conflicts with MediaDecoderStateMachine::GetCurrentTime
 // implementation.
 #ifdef GetCurrentTime
 #undef GetCurrentTime
 #endif
 
@@ -274,29 +275,30 @@ public:
   void NotifyDataArrived(const char* aBuffer, uint32_t aLength, int64_t aOffset);
 
   int64_t GetEndMediaTime() const {
     AssertCurrentThreadInMonitor();
     return mEndTime;
   }
 
   // Returns the shared state machine thread.
-  nsIEventTarget* GetStateMachineThread();
+  nsIEventTarget* GetStateMachineThread() const;
 
   // Calls ScheduleStateMachine() after taking the decoder lock. Also
   // notifies the decoder thread in case it's waiting on the decoder lock.
   void ScheduleStateMachineWithLockAndWakeDecoder();
 
   // Schedules the shared state machine thread to run the state machine
   // in aUsecs microseconds from now, if it's not already scheduled to run
   // earlier, in which case the request is discarded.
   nsresult ScheduleStateMachine(int64_t aUsecs = 0);
 
-  // Timer function to implement ScheduleStateMachine(aUsecs).
-  nsresult TimeoutExpired(int aGeneration);
+  // Callback function registered with MediaDecoderStateMachineScheduler
+  // to run state machine cycles.
+  static nsresult TimeoutExpired(void* aClosure);
 
   // Set the media fragment end time. aEndTime is in microseconds.
   void SetFragmentEndTime(int64_t aEndTime);
 
   // Drop reference to decoder.  Only called during shutdown dance.
   void BreakCycles() {
     if (mReader) {
       mReader->BreakCycles();
@@ -442,17 +444,17 @@ protected:
   // Dispatches an asynchronous event to update the media element's ready state.
   void UpdateReadyState();
 
   // Resets playback timing data. Called when we seek, on the decode thread.
   void ResetPlayback();
 
   // Orders the Reader to stop decoding, and blocks until the Reader
   // has stopped decoding and finished delivering samples, then calls
-  // ResetPlayback() to discard all enqueued data. 
+  // ResetPlayback() to discard all enqueued data.
   void FlushDecoding();
 
   // Returns the audio clock, if we have audio, or -1 if we don't.
   // Called on the state machine thread.
   int64_t GetAudioClock();
 
   // Get the video stream position, taking the |playbackRate| change into
   // account. This is a position in the media, not the duration of the playback
@@ -605,20 +607,17 @@ protected:
   // State machine thread run function. Defers to RunStateMachine().
   nsresult CallRunStateMachine();
 
   // Performs one "cycle" of the state machine. Polls the state, and may send
   // a video frame to be displayed, and generally manages the decode. Called
   // periodically via timer to ensure the video stays in sync.
   nsresult RunStateMachine();
 
-  bool IsStateMachineScheduled() const {
-    AssertCurrentThreadInMonitor();
-    return !mTimeout.IsNull();
-  }
+  bool IsStateMachineScheduled() const;
 
   // Returns true if we're not playing and the decode thread has filled its
   // decode buffers and is waiting. We can shut the decode thread down in this
   // case as it may not be needed again.
   bool IsPausedAndDecoderWaiting();
 
   // These return true if the respective stream's decode has not yet reached
   // the end of stream.
@@ -645,16 +644,20 @@ protected:
   // dropped its reference to the decoder. This enables the state machine to
   // keep using the decoder's monitor until the state machine has finished
   // shutting down, without fear of the monitor being destroyed. After
   // shutting down, the state machine will then release this reference,
   // causing the decoder to be destroyed. This is accessed on the decode,
   // state machine, audio and main threads.
   nsRefPtr<MediaDecoder> mDecoder;
 
+  // Used to schedule state machine cycles. This should never outlive
+  // the life cycle of the state machine.
+  const nsAutoPtr<MediaDecoderStateMachineScheduler> mScheduler;
+
   // Time at which the last video sample was requested. If it takes too long
   // before the sample arrives, we will increase the amount of audio we buffer.
   // This is necessary for legacy synchronous decoders to prevent underruns.
   TimeStamp mVideoDecodeStartTime;
 
   // Queue of audio frames. This queue is threadsafe, and is accessed from
   // the audio, decoder, state machine, and main threads.
   MediaQueue<AudioData> mAudioQueue;
@@ -669,29 +672,16 @@ protected:
   // Accessed on state machine, audio, main, and AV thread.
   State mState;
 
   // The task queue in which we run decode tasks. This is referred to as
   // the "decode thread", though in practise tasks can run on a different
   // thread every time they're called.
   RefPtr<MediaTaskQueue> mDecodeTaskQueue;
 
-  RefPtr<SharedThreadPool> mStateMachineThreadPool;
-
-  // Timer to run the state machine cycles. Used by
-  // ScheduleStateMachine(). Access protected by decoder monitor.
-  nsCOMPtr<nsITimer> mTimer;
-
-  // Timestamp at which the next state machine cycle will run.
-  // Access protected by decoder monitor.
-  TimeStamp mTimeout;
-
-  // Used to check if there are state machine cycles are running in sequence.
-  DebugOnly<bool> mInRunningStateMachine;
-
   // The time that playback started from the system clock. This is used for
   // timing the presentation of video frames when there's no audio.
   // Accessed only via the state machine thread.  Must be set via SetPlayStartTime.
   TimeStamp mPlayStartTime;
 
   // When we start writing decoded data to a new DecodedDataStream, or we
   // restart writing due to PlaybackStarted(), we record where we are in the
   // MediaStream and what that corresponds to in the media.
@@ -906,19 +896,16 @@ protected:
   // memory and CPU overhead.
   bool mMinimizePreroll;
 
   // True if the decode thread has gone filled its buffers and is now
   // waiting to be awakened before it continues decoding. Synchronized
   // by the decoder monitor.
   bool mDecodeThreadWaiting;
 
-  // True is we are decoding a realtime stream, like a camera stream
-  bool mRealTime;
-
   // True if we've dispatched a task to the decode task queue to call
   // ReadMetadata on the reader. We maintain a flag to ensure that we don't
   // dispatch multiple tasks to re-do the metadata loading.
   bool mDispatchedDecodeMetadataTask;
 
   // These two flags are true when we need to drop decoded samples that
   // we receive up to the next discontinuity. We do this when we seek;
   // the first sample in each stream after the seek is marked as being
@@ -937,15 +924,12 @@ protected:
 
   // Stores presentation info required for playback. The decoder monitor
   // must be held when accessing this.
   MediaInfo mInfo;
 
   mozilla::MediaMetadataManager mMetadataManager;
 
   MediaDecoderOwner::NextFrameStatus mLastFrameStatus;
-
-  // The id of timer tasks, used to ignore tasks that are scheduled previously.
-  int mTimerId;
 };
 
 } // namespace mozilla;
 #endif

new file mode 100644
--- /dev/null
+++ b/content/media/MediaDecoderStateMachineScheduler.cpp
@@ -0,0 +1,233 @@
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "MediaDecoderStateMachineScheduler.h"
+#include "SharedThreadPool.h"
+#include "mozilla/Preferences.h"
+#include "mozilla/ReentrantMonitor.h"
+#include "nsITimer.h"
+#include "nsComponentManagerUtils.h"
+#include "VideoUtils.h"
+
+namespace {
+class TimerEvent : public nsITimerCallback, public nsRunnable {
+  typedef mozilla::MediaDecoderStateMachineScheduler Scheduler;
+  NS_DECL_THREADSAFE_ISUPPORTS
+public:
+  TimerEvent(Scheduler* aScheduler, int aTimerId)
+    : mScheduler(aScheduler), mTimerId(aTimerId) {}
+
+  NS_IMETHOD Run() MOZ_OVERRIDE {
+    return mScheduler->TimeoutExpired(mTimerId);
+  }
+
+  NS_IMETHOD Notify(nsITimer* aTimer) MOZ_OVERRIDE {
+    return mScheduler->TimeoutExpired(mTimerId);
+  }
+private:
+  ~TimerEvent() {}
+  Scheduler* const mScheduler;
+  const int mTimerId;
+};
+
+NS_IMPL_ISUPPORTS(TimerEvent, nsITimerCallback, nsIRunnable);
+} // anonymous namespace
+
+static already_AddRefed<nsIEventTarget>
+CreateStateMachineThread()
+{
+  using mozilla::SharedThreadPool;
+  using mozilla::RefPtr;
+  RefPtr<SharedThreadPool> threadPool(
+      SharedThreadPool::Get(NS_LITERAL_CSTRING("Media State Machine"), 1));
+  nsCOMPtr<nsIEventTarget> rv = threadPool.get();
+  return rv.forget();
+}
+
+namespace mozilla {
+
+MediaDecoderStateMachineScheduler::MediaDecoderStateMachineScheduler(
+    ReentrantMonitor& aMonitor,
+    nsresult (*aTimeoutCallback)(void*),
+    void* aClosure, bool aRealTime)
+  : mTimeoutCallback(aTimeoutCallback)
+  , mClosure(aClosure)
+  // Only enable realtime mode when "media.realtime_decoder.enabled" is true.
+  , mRealTime(aRealTime &&
+              Preferences::GetBool("media.realtime_decoder.enabled", false))
+  , mMonitor(aMonitor)
+  , mEventTarget(CreateStateMachineThread())
+  , mTimer(do_CreateInstance("@mozilla.org/timer;1"))
+  , mTimerId(0)
+  , mState(SCHEDULER_STATE_NONE)
+  , mInRunningStateMachine(false)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_COUNT_CTOR(MediaDecoderStateMachineScheduler);
+}
+
+MediaDecoderStateMachineScheduler::~MediaDecoderStateMachineScheduler()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_COUNT_DTOR(MediaDecoderStateMachineScheduler);
+}
+
+nsresult
+MediaDecoderStateMachineScheduler::Init()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  NS_ENSURE_TRUE(mEventTarget, NS_ERROR_FAILURE);
+  nsresult rv = mTimer->SetTarget(mEventTarget);
+  NS_ENSURE_SUCCESS(rv, rv);
+  return NS_OK;
+}
+
+nsresult
+MediaDecoderStateMachineScheduler::Schedule(int64_t aUsecs)
+{
+  mMonitor.AssertCurrentThreadIn();
+
+  switch(mState) {
+  case SCHEDULER_STATE_SHUTDOWN:
+    return NS_ERROR_FAILURE;
+  case SCHEDULER_STATE_FROZEN:
+    mState = SCHEDULER_STATE_FROZEN_WITH_PENDING_TASK;
+  case SCHEDULER_STATE_FROZEN_WITH_PENDING_TASK:
+    return NS_OK;
+  case SCHEDULER_STATE_NONE:
+    break;
+  }
+
+  aUsecs = std::max<int64_t>(aUsecs, 0);
+
+  TimeStamp timeout = TimeStamp::Now() +
+    TimeDuration::FromMilliseconds(static_cast<double>(aUsecs) / USECS_PER_MS);
+
+  if (!mTimeout.IsNull() && timeout >= mTimeout) {
+    // We've already scheduled a timer set to expire at or before this time,
+    // or have an event dispatched to run the state machine.
+    return NS_OK;
+  }
+
+  uint32_t ms = static_cast<uint32_t>((aUsecs / USECS_PER_MS) & 0xFFFFFFFF);
+  if (IsRealTime() && ms > 40) {
+    ms = 40;
+  }
+
+  // Don't cancel the timer here for this function will be called from
+  // different threads.
+
+  nsresult rv = NS_ERROR_FAILURE;
+  nsRefPtr<TimerEvent> event = new TimerEvent(this, mTimerId+1);
+
+  if (ms == 0) {
+    // Dispatch a runnable to the state machine thread when delay is 0.
+    // It will has less latency than dispatching a runnable to the state
+    // machine thread which will then schedule a zero-delay timer.
+    rv = mEventTarget->Dispatch(event, NS_DISPATCH_NORMAL);
+  } else if (OnStateMachineThread()) {
+    rv = mTimer->InitWithCallback(event, ms, nsITimer::TYPE_ONE_SHOT);
+  } else {
+    MOZ_ASSERT(false, "non-zero delay timer should be only "
+                      "scheduled in state machine thread");
+  }
+
+  if (NS_SUCCEEDED(rv)) {
+    mTimeout = timeout;
+    ++mTimerId;
+  } else {
+    NS_WARNING("Failed to schedule state machine");
+  }
+
+  return rv;
+}
+
+nsresult
+MediaDecoderStateMachineScheduler::TimeoutExpired(int aTimerId)
+{
+  ReentrantMonitorAutoEnter mon(mMonitor);
+  MOZ_ASSERT(OnStateMachineThread());
+  MOZ_ASSERT(!mInRunningStateMachine,
+             "State machine cycles must run in sequence!");
+
+  mInRunningStateMachine = true;
+  // Only run state machine cycles when id matches.
+  nsresult rv = NS_OK;
+  if (mTimerId == aTimerId) {
+    ResetTimer();
+    rv = mTimeoutCallback(mClosure);
+  }
+  mInRunningStateMachine = false;
+
+  return rv;
+}
+
+void
+MediaDecoderStateMachineScheduler::ScheduleAndShutdown()
+{
+  mMonitor.AssertCurrentThreadIn();
+  if (IsFrozen()) {
+    ThawScheduling();
+  }
+  // Schedule next cycle to handle SHUTDOWN in state machine thread.
+  Schedule();
+  // This must be set after calling Schedule()
+  // which does nothing in shutdown state.
+  mState = SCHEDULER_STATE_SHUTDOWN;
+}
+
+bool
+MediaDecoderStateMachineScheduler::OnStateMachineThread() const
+{
+  bool rv = false;
+  mEventTarget->IsOnCurrentThread(&rv);
+  return rv;
+}
+
+bool
+MediaDecoderStateMachineScheduler::IsScheduled() const
+{
+  mMonitor.AssertCurrentThreadIn();
+  return !mTimeout.IsNull();
+}
+
+void
+MediaDecoderStateMachineScheduler::ResetTimer()
+{
+  mMonitor.AssertCurrentThreadIn();
+  mTimer->Cancel();
+  mTimeout = TimeStamp();
+}
+
+void MediaDecoderStateMachineScheduler::FreezeScheduling()
+{
+  mMonitor.AssertCurrentThreadIn();
+  if (mState == SCHEDULER_STATE_SHUTDOWN) {
+    return;
+  }
+  MOZ_ASSERT(mState == SCHEDULER_STATE_NONE);
+  mState = !IsScheduled() ? SCHEDULER_STATE_FROZEN :
+                            SCHEDULER_STATE_FROZEN_WITH_PENDING_TASK;
+  // Nullify pending timer task if any.
+  ++mTimerId;
+  mTimeout = TimeStamp();
+}
+
+void MediaDecoderStateMachineScheduler::ThawScheduling()
+{
+  mMonitor.AssertCurrentThreadIn();
+  if (mState == SCHEDULER_STATE_SHUTDOWN) {
+    return;
+  }
+  // We should be in frozen state and no pending timer task.
+  MOZ_ASSERT(IsFrozen() && !IsScheduled());
+  bool pendingTask = mState == SCHEDULER_STATE_FROZEN_WITH_PENDING_TASK;
+  mState = SCHEDULER_STATE_NONE;
+  if (pendingTask) {
+    Schedule();
+  }
+}
+
+} // namespace mozilla

new file mode 100644
--- /dev/null
+++ b/content/media/MediaDecoderStateMachineScheduler.h
@@ -0,0 +1,86 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef MediaDecoderStateMachineScheduler_h__
+#define MediaDecoderStateMachineScheduler_h__
+
+#include "nsCOMPtr.h"
+#include "mozilla/TimeStamp.h"
+#include "mozilla/DebugOnly.h"
+
+class nsITimer;
+class nsIEventTarget;
+
+namespace mozilla {
+
+class ReentrantMonitor;
+
+class MediaDecoderStateMachineScheduler {
+  enum State {
+    SCHEDULER_STATE_NONE,
+    SCHEDULER_STATE_FROZEN,
+    SCHEDULER_STATE_FROZEN_WITH_PENDING_TASK,
+    SCHEDULER_STATE_SHUTDOWN
+  };
+public:
+  MediaDecoderStateMachineScheduler(ReentrantMonitor& aMonitor,
+                                    nsresult (*aTimeoutCallback)(void*),
+                                    void* aClosure, bool aRealTime);
+  ~MediaDecoderStateMachineScheduler();
+  nsresult Init();
+  nsresult Schedule(int64_t aUsecs = 0);
+  void ScheduleAndShutdown();
+  nsresult TimeoutExpired(int aTimerId);
+  void FreezeScheduling();
+  void ThawScheduling();
+
+  bool OnStateMachineThread() const;
+  bool IsScheduled() const;
+
+  bool IsRealTime() const {
+    return mRealTime;
+  }
+
+  nsIEventTarget* GetStateMachineThread() const {
+    return mEventTarget;
+  }
+
+  bool IsFrozen() const {
+    return mState == SCHEDULER_STATE_FROZEN ||
+           mState == SCHEDULER_STATE_FROZEN_WITH_PENDING_TASK;
+  }
+
+private:
+  void ResetTimer();
+
+  // Callback function provided by MediaDecoderStateMachine to run
+  // state machine cycles.
+  nsresult (*const mTimeoutCallback)(void*);
+  // Since StateMachineScheduler will never outlive the state machine,
+  // it is safe to keep a raw pointer only to avoid reference cycles.
+  void* const mClosure;
+  // True is we are decoding a realtime stream, like a camera stream
+  const bool mRealTime;
+  // Monitor of the decoder
+  ReentrantMonitor& mMonitor;
+  // State machine thread
+  const nsCOMPtr<nsIEventTarget> mEventTarget;
+  // Timer to schedule callbacks to run the state machine cycles.
+  nsCOMPtr<nsITimer> mTimer;
+  // Timestamp at which the next state machine cycle will run.
+  TimeStamp mTimeout;
+  // The id of timer tasks, timer callback will only run if id matches.
+  int mTimerId;
+  // No more state machine cycles in shutdown state.
+  State mState;
+
+  // Used to check if state machine cycles are running in sequence.
+  DebugOnly<bool> mInRunningStateMachine;
+};
+
+} // namespace mozilla
+
+#endif // MediaDecoderStateMachineScheduler_h__

--- a/content/media/MediaResource.h
+++ b/content/media/MediaResource.h
@@ -142,16 +142,20 @@ public:
   }
 
   // Clears byte range values.
   void Clear() {
     mStart = 0;
     mEnd = 0;
   }
 
+  bool Contains(const MediaByteRange& aByteRange) const {
+    return aByteRange.mStart >= mStart && aByteRange.mEnd <= mEnd;
+  }
+
   int64_t mStart, mEnd;
 };
 
 // Represents a section of contiguous media, with a start and end offset, and
 // a timestamp representing the start time.
 class TimestampedMediaByteRange : public MediaByteRange {
 public:
   TimestampedMediaByteRange() : MediaByteRange(), mStartTime(-1) {}

--- a/content/media/fmp4/MP4Reader.cpp
+++ b/content/media/fmp4/MP4Reader.cpp
@@ -8,16 +8,17 @@
 #include "MediaResource.h"
 #include "nsSize.h"
 #include "VideoUtils.h"
 #include "mozilla/dom/HTMLMediaElement.h"
 #include "ImageContainer.h"
 #include "Layers.h"
 #include "SharedThreadPool.h"
 #include "mozilla/Preferences.h"
+#include "mozilla/dom/TimeRanges.h"
 
 using mozilla::layers::Image;
 using mozilla::layers::LayerManager;
 using mozilla::layers::LayersBackend;
 
 #ifdef PR_LOGGING
 PRLogModuleInfo* GetDemuxerLog() {
   static PRLogModuleInfo* log = nullptr;
@@ -548,9 +549,28 @@ MP4Reader::Seek(int64_t aTime,
   if (mDemuxer->HasValidAudio()) {
     mDemuxer->SeekAudio(
       mQueuedVideoSample ? mQueuedVideoSample->composition_timestamp : aTime);
   }
 
   return NS_OK;
 }
 
+nsresult
+MP4Reader::GetBuffered(dom::TimeRanges* aBuffered, int64_t aStartTime)
+{
+  nsTArray<MediaByteRange> ranges;
+  if (NS_FAILED(mDecoder->GetResource()->GetCachedRanges(ranges))) {
+    return NS_ERROR_FAILURE;
+  }
+
+  nsTArray<Interval<Microseconds>> timeRanges;
+  mDemuxer->ConvertByteRangesToTime(ranges, &timeRanges);
+
+  for (size_t i = 0; i < timeRanges.Length(); i++) {
+    aBuffered->Add((timeRanges[i].start - aStartTime) / 1000000.0,
+                   (timeRanges[i].end - aStartTime) / 1000000.0);
+  }
+
+  return NS_OK;
+}
+
 } // namespace mozilla

--- a/content/media/fmp4/MP4Reader.h
+++ b/content/media/fmp4/MP4Reader.h
@@ -47,16 +47,19 @@ public:
 
   virtual nsresult Seek(int64_t aTime,
                         int64_t aStartTime,
                         int64_t aEndTime,
                         int64_t aCurrentTime) MOZ_OVERRIDE;
 
   virtual bool IsMediaSeekable() MOZ_OVERRIDE;
 
+  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered,
+                               int64_t aStartTime) MOZ_OVERRIDE;
+
 private:
 
   // Destroys all decoder resources.
   void Shutdown();
 
   // Initializes mLayersBackendType if possible.
   void InitLayersBackendType();
 

--- a/content/media/fmp4/ffmpeg/FFmpegAACDecoder.cpp
+++ b/content/media/fmp4/ffmpeg/FFmpegAACDecoder.cpp
@@ -66,16 +66,17 @@ void
 FFmpegAACDecoder<LIBAV_VER>::DecodePacket(MP4Sample* aSample)
 {
   nsAutoPtr<AVFrame> frame(avcodec_alloc_frame());
   avcodec_get_frame_defaults(frame);
 
   AVPacket packet;
   av_init_packet(&packet);
 
+  aSample->Pad(FF_INPUT_BUFFER_PADDING_SIZE);
   packet.data = aSample->data;
   packet.size = aSample->size;
   packet.pos = aSample->byte_offset;
 
   int decoded;
   int bytesConsumed =
     avcodec_decode_audio4(&mCodecContext, frame.get(), &decoded, &packet);
 

--- a/content/media/fmp4/ffmpeg/FFmpegDataDecoder.cpp
+++ b/content/media/fmp4/ffmpeg/FFmpegDataDecoder.cpp
@@ -80,21 +80,24 @@ FFmpegDataDecoder<LIBAV_VER>::Init()
 
   // FFmpeg takes this as a suggestion for what format to use for audio samples.
   mCodecContext.request_sample_fmt = AV_SAMPLE_FMT_FLT;
 
   // FFmpeg will call back to this to negotiate a video pixel format.
   mCodecContext.get_format = ChoosePixelFormat;
 
   mCodecContext.thread_count = PR_GetNumberOfProcessors();
-  mCodecContext.thread_type = FF_THREAD_FRAME;
+  mCodecContext.thread_type = FF_THREAD_SLICE | FF_THREAD_FRAME;
   mCodecContext.thread_safe_callbacks = false;
 
+  mCodecContext.extradata_size = mExtraData.length();
+  for (int i = 0; i < FF_INPUT_BUFFER_PADDING_SIZE; i++) {
+    mExtraData.append(0);
+  }
   mCodecContext.extradata = mExtraData.begin();
-  mCodecContext.extradata_size = mExtraData.length();
 
   AVDictionary* opts = nullptr;
   if (avcodec_open2(&mCodecContext, codec, &opts) < 0) {
     NS_WARNING("Couldn't initialise ffmpeg decoder");
     return NS_ERROR_FAILURE;
   }
 
   if (mCodecContext.codec_type == AVMEDIA_TYPE_AUDIO &&

--- a/content/media/fmp4/ffmpeg/FFmpegH264Decoder.cpp
+++ b/content/media/fmp4/ffmpeg/FFmpegH264Decoder.cpp
@@ -48,16 +48,17 @@ FFmpegH264Decoder<LIBAV_VER>::Init()
 }
 
 void
 FFmpegH264Decoder<LIBAV_VER>::DecodeFrame(mp4_demuxer::MP4Sample* aSample)
 {
   AVPacket packet;
   av_init_packet(&packet);
 
+  aSample->Pad(FF_INPUT_BUFFER_PADDING_SIZE);
   packet.data = aSample->data;
   packet.size = aSample->size;
   packet.pts = aSample->composition_timestamp;
   packet.flags = aSample->is_sync_point ? AV_PKT_FLAG_KEY : 0;
   packet.pos = aSample->byte_offset;
 
   nsAutoPtr<AVFrame> frame(avcodec_alloc_frame());
   avcodec_get_frame_defaults(frame);
@@ -132,17 +133,21 @@ FFmpegH264Decoder<LIBAV_VER>::AllocateBu
     return avcodec_default_get_buffer(aCodecContext, aFrame);
   }
 }
 
 /* static */ void
 FFmpegH264Decoder<LIBAV_VER>::ReleaseBufferCb(AVCodecContext* aCodecContext,
                                               AVFrame* aFrame)
 {
-  reinterpret_cast<Image*>(aFrame->opaque)->Release();
+  Image* image = reinterpret_cast<Image*>(aFrame->opaque);
+  avcodec_default_release_buffer(aCodecContext, aFrame);
+  if (image) {
+    image->Release();
+  }
 }
 
 int
 FFmpegH264Decoder<LIBAV_VER>::AllocateYUV420PVideoBuffer(
   AVCodecContext* aCodecContext, AVFrame* aFrame)
 {
   // Older versions of ffmpeg require that edges be allocated* around* the
   // actual image.

--- a/content/media/gmp/GMPMessageUtils.h
+++ b/content/media/gmp/GMPMessageUtils.h
@@ -2,20 +2,35 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef GMPMessageUtils_h_
 #define GMPMessageUtils_h_
 
 #include "gmp-video-codec.h"
+#include "gmp-video-frame-encoded.h"
 
 namespace IPC {
 
 template <>
+struct ParamTraits<GMPErr>
+: public ContiguousEnumSerializer<GMPErr,
+                                  GMPNoErr,
+                                  GMPLastErr>
+{};
+
+template <>
+struct ParamTraits<GMPVideoFrameType>
+: public ContiguousEnumSerializer<GMPVideoFrameType,
+                                  kGMPKeyFrame,
+                                  kGMPSkipFrame>
+{};
+
+template <>
 struct ParamTraits<GMPVideoCodecComplexity>
 : public ContiguousEnumSerializer<GMPVideoCodecComplexity,
                                   kGMPComplexityNormal,
                                   kGMPComplexityInvalid>
 {};
 
 template <>
 struct ParamTraits<GMPVP8ResilienceMode>
@@ -34,67 +49,21 @@ struct ParamTraits<GMPVideoCodecType>
 template <>
 struct ParamTraits<GMPVideoCodecMode>
 : public ContiguousEnumSerializer<GMPVideoCodecMode,
                                   kGMPRealtimeVideo,
                                   kGMPCodecModeInvalid>
 {};
 
 template <>
-struct ParamTraits<GMPVideoCodecVP8>
-{
-  typedef GMPVideoCodecVP8 paramType;
-
-  static void Write(Message* aMsg, const paramType& aParam)
-  {
-    WriteParam(aMsg, aParam.mPictureLossIndicationOn);
-    WriteParam(aMsg, aParam.mFeedbackModeOn);
-    WriteParam(aMsg, aParam.mComplexity);
-    WriteParam(aMsg, aParam.mResilience);
-    WriteParam(aMsg, aParam.mNumberOfTemporalLayers);
-    WriteParam(aMsg, aParam.mDenoisingOn);
-    WriteParam(aMsg, aParam.mErrorConcealmentOn);
-    WriteParam(aMsg, aParam.mAutomaticResizeOn);
-    WriteParam(aMsg, aParam.mFrameDroppingOn);
-    WriteParam(aMsg, aParam.mKeyFrameInterval);
-  }
-
-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
-  {
-    if (ReadParam(aMsg, aIter, &(aResult->mPictureLossIndicationOn)) &&
-        ReadParam(aMsg, aIter, &(aResult->mFeedbackModeOn)) &&
-        ReadParam(aMsg, aIter, &(aResult->mComplexity)) &&
-        ReadParam(aMsg, aIter, &(aResult->mResilience)) &&
-        ReadParam(aMsg, aIter, &(aResult->mNumberOfTemporalLayers)) &&
-        ReadParam(aMsg, aIter, &(aResult->mDenoisingOn)) &&
-        ReadParam(aMsg, aIter, &(aResult->mErrorConcealmentOn)) &&
-        ReadParam(aMsg, aIter, &(aResult->mAutomaticResizeOn)) &&
-        ReadParam(aMsg, aIter, &(aResult->mFrameDroppingOn)) &&
-        ReadParam(aMsg, aIter, &(aResult->mKeyFrameInterval))) {
-      return true;
-    }
-
-    return false;
-  }
-
-  static void Log(const paramType& aParam, std::wstring* aLog)
-  {
-    aLog->append(StringPrintf(L"[%d, %d, %d, %d, %u, %d, %d, %d, %d, %d]",
-                              aParam.mPictureLossIndicationOn,
-                              aParam.mFeedbackModeOn,
-                              aParam.mComplexity,
-                              aParam.mResilience,
-                              aParam.mNumberOfTemporalLayers,
-                              aParam.mDenoisingOn,
-                              aParam.mErrorConcealmentOn,
-                              aParam.mAutomaticResizeOn,
-                              aParam.mFrameDroppingOn,
-                              aParam.mKeyFrameInterval));
-  }
-};
+struct ParamTraits<GMPBufferType>
+: public ContiguousEnumSerializer<GMPBufferType,
+                                  GMP_BufferSingle,
+                                  GMP_BufferInvalid>
+{};
 
 template <>
 struct ParamTraits<GMPSimulcastStream>
 {
   typedef GMPSimulcastStream paramType;
 
   static void Write(Message* aMsg, const paramType& aParam)
   {
@@ -131,40 +100,43 @@ struct ParamTraits<GMPSimulcastStream>
 
 template <>
 struct ParamTraits<GMPVideoCodec>
 {
   typedef GMPVideoCodec paramType;
 
   static void Write(Message* aMsg, const paramType& aParam)
   {
+    WriteParam(aMsg, aParam.mGMPApiVersion);
     WriteParam(aMsg, aParam.mCodecType);
     WriteParam(aMsg, nsAutoCString(aParam.mPLName));
     WriteParam(aMsg, aParam.mPLType);
     WriteParam(aMsg, aParam.mWidth);
     WriteParam(aMsg, aParam.mHeight);
     WriteParam(aMsg, aParam.mStartBitrate);
     WriteParam(aMsg, aParam.mMaxBitrate);
     WriteParam(aMsg, aParam.mMinBitrate);
     WriteParam(aMsg, aParam.mMaxFramerate);
-    if (aParam.mCodecType == kGMPVideoCodecVP8) {
-      WriteParam(aMsg, aParam.mCodecSpecific.mVP8);
-    } else {
-      MOZ_ASSERT(false, "Serializing unknown codec type!");
-    }
+    WriteParam(aMsg, aParam.mFrameDroppingOn);
+    WriteParam(aMsg, aParam.mKeyFrameInterval);
     WriteParam(aMsg, aParam.mQPMax);
     WriteParam(aMsg, aParam.mNumberOfSimulcastStreams);
     for (uint32_t i = 0; i < aParam.mNumberOfSimulcastStreams; i++) {
       WriteParam(aMsg, aParam.mSimulcastStream[i]);
     }
     WriteParam(aMsg, aParam.mMode);
   }
 
   static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
   {
+    // NOTE: make sure this matches any versions supported
+    if (!ReadParam(aMsg, aIter, &(aResult->mGMPApiVersion)) ||
+      aResult->mGMPApiVersion != kGMPVersion33) {
+        return false;
+    }
     if (!ReadParam(aMsg, aIter, &(aResult->mCodecType))) {
       return false;
     }
 
     nsAutoCString plName;
     if (!ReadParam(aMsg, aIter, &plName) ||
         plName.Length() > kGMPPayloadNameSize - 1) {
       return false;
@@ -173,26 +145,19 @@ struct ParamTraits<GMPVideoCodec>
     memset(aResult->mPLName + plName.Length(), 0, kGMPPayloadNameSize - plName.Length());
 
     if (!ReadParam(aMsg, aIter, &(aResult->mPLType)) ||
         !ReadParam(aMsg, aIter, &(aResult->mWidth)) ||
         !ReadParam(aMsg, aIter, &(aResult->mHeight)) ||
         !ReadParam(aMsg, aIter, &(aResult->mStartBitrate)) ||
         !ReadParam(aMsg, aIter, &(aResult->mMaxBitrate)) ||
         !ReadParam(aMsg, aIter, &(aResult->mMinBitrate)) ||
-        !ReadParam(aMsg, aIter, &(aResult->mMaxFramerate))) {
-      return false;
-    }
-
-    if (aResult->mCodecType == kGMPVideoCodecVP8) {
-      if (!ReadParam(aMsg, aIter, &(aResult->mCodecSpecific.mVP8))) {
-        return false;
-      }
-    } else {
-      MOZ_ASSERT(false, "De-serializing unknown codec type!");
+        !ReadParam(aMsg, aIter, &(aResult->mMaxFramerate)) ||
+        !ReadParam(aMsg, aIter, &(aResult->mFrameDroppingOn)) ||
+        !ReadParam(aMsg, aIter, &(aResult->mKeyFrameInterval))) {
       return false;
     }
 
     if (!ReadParam(aMsg, aIter, &(aResult->mQPMax)) ||
         !ReadParam(aMsg, aIter, &(aResult->mNumberOfSimulcastStreams))) {
       return false;
     }
 
@@ -221,109 +186,11 @@ struct ParamTraits<GMPVideoCodec>
     }
     aLog->append(StringPrintf(L"[%s, %u, %u]",
                               codecName,
                               aParam.mWidth,
                               aParam.mHeight));
   }
 };
 
-template <>
-struct ParamTraits<GMPCodecSpecificInfoVP8>
-{
-  typedef GMPCodecSpecificInfoVP8 paramType;
-
-  static void Write(Message* aMsg, const paramType& aParam)
-  {
-    WriteParam(aMsg, aParam.mHasReceivedSLI);
-    WriteParam(aMsg, aParam.mPictureIdSLI);
-    WriteParam(aMsg, aParam.mHasReceivedRPSI);
-    WriteParam(aMsg, aParam.mPictureIdRPSI);
-    WriteParam(aMsg, aParam.mPictureId);
-    WriteParam(aMsg, aParam.mNonReference);
-    WriteParam(aMsg, aParam.mSimulcastIdx);
-    WriteParam(aMsg, aParam.mTemporalIdx);
-    WriteParam(aMsg, aParam.mLayerSync);
-    WriteParam(aMsg, aParam.mTL0PicIdx);
-    WriteParam(aMsg, aParam.mKeyIdx);
-  }
-
-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
-  {
-    if (ReadParam(aMsg, aIter, &(aResult->mHasReceivedSLI)) &&
-        ReadParam(aMsg, aIter, &(aResult->mPictureIdSLI)) &&
-        ReadParam(aMsg, aIter, &(aResult->mHasReceivedRPSI)) &&
-        ReadParam(aMsg, aIter, &(aResult->mPictureIdRPSI)) &&
-        ReadParam(aMsg, aIter, &(aResult->mPictureId)) &&
-        ReadParam(aMsg, aIter, &(aResult->mNonReference)) &&
-        ReadParam(aMsg, aIter, &(aResult->mSimulcastIdx)) &&
-        ReadParam(aMsg, aIter, &(aResult->mTemporalIdx)) &&
-        ReadParam(aMsg, aIter, &(aResult->mLayerSync)) &&
-        ReadParam(aMsg, aIter, &(aResult->mTL0PicIdx)) &&
-        ReadParam(aMsg, aIter, &(aResult->mKeyIdx))) {
-      return true;
-    }
-    return false;
-  }
-
-  static void Log(const paramType& aParam, std::wstring* aLog)
-  {
-    aLog->append(StringPrintf(L"[%d, %u, %d, %u, %d, %d, %u, %u, %d, %d, %d]",
-                              aParam.mHasReceivedSLI,
-                              aParam.mPictureIdSLI,
-                              aParam.mHasReceivedRPSI,
-                              aParam.mPictureIdRPSI,
-                              aParam.mPictureId,
-                              aParam.mNonReference,
-                              aParam.mSimulcastIdx,
-                              aParam.mTemporalIdx,
-                              aParam.mLayerSync,
-                              aParam.mTL0PicIdx,
-                              aParam.mKeyIdx));
-  }
-};
-
-template <>
-struct ParamTraits<GMPCodecSpecificInfo>
-{
-  typedef GMPCodecSpecificInfo paramType;
-
-  static void Write(Message* aMsg, const paramType& aParam)
-  {
-    WriteParam(aMsg, aParam.mCodecType);
-    if (aParam.mCodecType == kGMPVideoCodecVP8) {
-      WriteParam(aMsg, aParam.mCodecSpecific.mVP8);
-    } else {
-      MOZ_ASSERT(false, "Serializing unknown codec type!");
-    }
-  }
-
-  static bool Read(const Message* aMsg, void** aIter, paramType* aResult)
-  {
-    if (!ReadParam(aMsg, aIter, &(aResult->mCodecType))) {
-      return false;
-    }
-
-    if (aResult->mCodecType == kGMPVideoCodecVP8) {
-      if (!ReadParam(aMsg, aIter, &(aResult->mCodecSpecific.mVP8))) {
-        return false;
-      }
-    } else {
-      MOZ_ASSERT(false, "De-serializing unknown codec type!");
-      return false;
-    }
-
-    return true;
-  }
-
-  static void Log(const paramType& aParam, std::wstring* aLog)
-  {
-    const char* codecName = nullptr;
-    if (aParam.mCodecType == kGMPVideoCodecVP8) {
-      codecName = "VP8";
-    }
-    aLog->append(StringPrintf(L"[%s]", codecName));
-  }
-};
-
 } // namespace IPC
 
 #endif // GMPMessageUtils_h_

--- a/content/media/gmp/GMPParent.h
+++ b/content/media/gmp/GMPParent.h
@@ -11,16 +11,17 @@
 #include "GMPVideoEncoderParent.h"
 #include "mozilla/gmp/PGMPParent.h"
 #include "nsCOMPtr.h"
 #include "nscore.h"
 #include "nsISupports.h"
 #include "nsString.h"
 #include "nsTArray.h"
 #include "nsIFile.h"
+#include "ThreadSafeRefcountingWithMainThreadDestruction.h"
 
 class nsILineInputStream;
 class nsIThread;
 
 namespace mozilla {
 namespace gmp {
 
 class GMPCapability
@@ -33,17 +34,17 @@ public:
 enum GMPState {
   GMPStateNotLoaded,
   GMPStateLoaded
 };
 
 class GMPParent MOZ_FINAL : public PGMPParent
 {
 public:
-  NS_INLINE_DECL_REFCOUNTING(GMPParent)
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING_WITH_MAIN_THREAD_DESTRUCTION(GMPParent)
 
   GMPParent();
 
   nsresult Init(nsIFile* aPluginDir);
   nsresult LoadProcess();
   void MaybeUnloadProcess();
   void UnloadProcess();
   bool SupportsAPI(const nsCString& aAPI, const nsCString& aTag);

--- a/content/media/gmp/GMPPlatform.cpp
+++ b/content/media/gmp/GMPPlatform.cpp
@@ -22,25 +22,26 @@ public:
   : mTask(aTask)
   {
     MOZ_ASSERT(mTask);
   }
 
   void Run()
   {
     mTask->Run();
+    mTask->Destroy();
     mTask = nullptr;
   }
 
 private:
   ~Runnable()
   {
   }
 
-  nsAutoPtr<GMPTask> mTask;
+  GMPTask* mTask;
 };
 
 class SyncRunnable MOZ_FINAL
 {
 public:
   NS_INLINE_DECL_THREADSAFE_REFCOUNTING(SyncRunnable)
 
   SyncRunnable(GMPTask* aTask, MessageLoop* aMessageLoop)
@@ -66,29 +67,30 @@ public:
     while (!mDone) {
       lock.Wait();
     }
   }
 
   void Run()
   {
     mTask->Run();
+    mTask->Destroy();
     mTask = nullptr;
     MonitorAutoLock lock(mMonitor);
     mDone = true;
     lock.Notify();
   }
 
 private:
   ~SyncRunnable()
   {
   }
 
   bool mDone;
-  nsAutoPtr<GMPTask> mTask;
+  GMPTask* mTask;
   MessageLoop* mMessageLoop;
   Monitor mMonitor;
 };
 
 GMPErr
 CreateThread(GMPThread** aThread)
 {
   if (!aThread) {
@@ -103,17 +105,16 @@ CreateThread(GMPThread** aThread)
 GMPErr
 RunOnMainThread(GMPTask* aTask)
 {
   if (!aTask || !sMainLoop) {
     return GMPGenericErr;
   }
 
   nsRefPtr<Runnable> r = new Runnable(aTask);
-
   sMainLoop->PostTask(FROM_HERE, NewRunnableMethod(r.get(), &Runnable::Run));
 
   return GMPNoErr;
 }
 
 GMPErr
 SyncRunOnMainThread(GMPTask* aTask)
 {
@@ -147,16 +148,19 @@ InitPlatformAPI(GMPPlatformAPI& aPlatfor
     sMainLoop = MessageLoop::current();
   }
 
   aPlatformAPI.version = 0;
   aPlatformAPI.createthread = &CreateThread;
   aPlatformAPI.runonmainthread = &RunOnMainThread;
   aPlatformAPI.syncrunonmainthread = &SyncRunOnMainThread;
   aPlatformAPI.createmutex = &CreateMutex;
+  aPlatformAPI.createrecord = nullptr;
+  aPlatformAPI.settimer = nullptr;
+  aPlatformAPI.getcurrenttime = nullptr;
 }
 
 GMPThreadImpl::GMPThreadImpl()
 : mMutex("GMPThreadImpl"),
   mThread("GMPThread")
 {
 }
 

--- a/content/media/gmp/GMPPlatform.h
+++ b/content/media/gmp/GMPPlatform.h
@@ -8,16 +8,18 @@
 
 #include "mozilla/Mutex.h"
 #include "gmp-platform.h"
 #include "base/thread.h"
 
 namespace mozilla {
 namespace gmp {
 
+class GMPChild;
+
 void InitPlatformAPI(GMPPlatformAPI& aPlatformAPI);
 
 class GMPThreadImpl : public GMPThread
 {
 public:
   GMPThreadImpl();
   virtual ~GMPThreadImpl();
 

--- a/content/media/gmp/GMPService.cpp
+++ b/content/media/gmp/GMPService.cpp
@@ -178,17 +178,17 @@ GeckoMediaPluginService::GetThread(nsITh
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 GeckoMediaPluginService::GetGMPVideoDecoder(nsTArray<nsCString>* aTags,
                                             const nsAString& aOrigin,
                                             GMPVideoHost** aOutVideoHost,
-                                            GMPVideoDecoder** aGMPVD)
+                                            GMPVideoDecoderProxy** aGMPVD)
 {
   MOZ_ASSERT(NS_GetCurrentThread() == mGMPThread);
   NS_ENSURE_ARG(aTags && aTags->Length() > 0);
   NS_ENSURE_ARG(aOutVideoHost);
   NS_ENSURE_ARG(aGMPVD);
 
   if (mShuttingDownOnGMPThread) {
     return NS_ERROR_FAILURE;
@@ -212,17 +212,17 @@ GeckoMediaPluginService::GetGMPVideoDeco
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 GeckoMediaPluginService::GetGMPVideoEncoder(nsTArray<nsCString>* aTags,
                                             const nsAString& aOrigin,
                                             GMPVideoHost** aOutVideoHost,
-                                            GMPVideoEncoder** aGMPVE)
+                                            GMPVideoEncoderProxy** aGMPVE)
 {
   MOZ_ASSERT(NS_GetCurrentThread() == mGMPThread);
   NS_ENSURE_ARG(aTags && aTags->Length() > 0);
   NS_ENSURE_ARG(aOutVideoHost);
   NS_ENSURE_ARG(aGMPVE);
 
   if (mShuttingDownOnGMPThread) {
     return NS_ERROR_FAILURE;
@@ -359,31 +359,51 @@ GeckoMediaPluginService::SelectPluginFor
         gmp->SetOrigin(aOrigin);
       }
       return gmp;
     }
   }
   return nullptr;
 }
 
+class CreateGMPParentTask : public nsRunnable {
+public:
+  NS_IMETHOD Run() {
+    MOZ_ASSERT(NS_IsMainThread());
+    mParent = new GMPParent();
+    return NS_OK;
+  }
+  already_AddRefed<GMPParent> GetParent() {
+    return mParent.forget();
+  }
+private:
+  nsRefPtr<GMPParent> mParent;
+};
 
 void
 GeckoMediaPluginService::AddOnGMPThread(const nsAString& aDirectory)
 {
   MOZ_ASSERT(NS_GetCurrentThread() == mGMPThread);
 
   nsCOMPtr<nsIFile> directory;
   nsresult rv = NS_NewLocalFile(aDirectory, false, getter_AddRefs(directory));
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return;
   }
 
-  nsRefPtr<GMPParent> gmp = new GMPParent();
+  // The GMPParent inherits from IToplevelProtocol, which must be created
+  // on the main thread to be threadsafe. See Bug 1035653.
+  nsRefPtr<CreateGMPParentTask> task(new CreateGMPParentTask());
+  nsCOMPtr<nsIThread> mainThread = do_GetMainThread();
+  MOZ_ASSERT(mainThread);
+  mozilla::SyncRunnable::DispatchToThread(mainThread, task);
+  nsRefPtr<GMPParent> gmp = task->GetParent();
   rv = gmp->Init(directory);
   if (NS_FAILED(rv)) {
+    NS_WARNING("Can't Create GMPParent");
     return;
   }
 
   mPlugins.AppendElement(gmp);
 }
 
 void
 GeckoMediaPluginService::RemoveOnGMPThread(const nsAString& aDirectory)

--- a/content/media/gmp/GMPService.h
+++ b/content/media/gmp/GMPService.h
@@ -1,16 +1,17 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef GMPService_h_
 #define GMPService_h_
 
+#include "nsString.h"
 #include "mozIGeckoMediaPluginService.h"
 #include "nsIObserver.h"
 #include "nsTArray.h"
 #include "mozilla/Mutex.h"
 #include "nsString.h"
 #include "nsCOMPtr.h"
 #include "nsIThread.h"
 #include "nsThreadUtils.h"

new file mode 100644
--- /dev/null
+++ b/content/media/gmp/GMPSharedMemManager.cpp
@@ -0,0 +1,116 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "GMPSharedMemManager.h"
+#include "GMPMessageUtils.h"
+#include "mozilla/ipc/SharedMemory.h"
+#include "mozilla/StaticPtr.h"
+#include "mozilla/ClearOnShutdown.h"
+
+namespace mozilla {
+namespace gmp {
+
+// Really one set of pools on each side of the plugin API.
+
+// YUV buffers go from Encoder parent to child; pool there, and then return
+// with Decoded() frames to the Decoder parent and goes into the parent pool.
+// Compressed (encoded) data goes from the Decoder parent to the child;
+// pool there, and then return with Encoded() frames and goes into the parent
+// pool.
+static StaticAutoPtr<nsTArray<ipc::Shmem>> sGmpFreelist[GMPSharedMemManager::kGMPNumTypes];
+static uint32_t sGMPShmemManagerCount = 0;
+
+GMPSharedMemManager::GMPSharedMemManager()
+{
+  if (!sGMPShmemManagerCount) {
+    for (uint32_t i = 0; i < GMPSharedMemManager::kGMPNumTypes; i++) {
+      sGmpFreelist[i] = new nsTArray<ipc::Shmem>();
+    }
+  }
+  sGMPShmemManagerCount++;
+}
+
+GMPSharedMemManager::~GMPSharedMemManager()
+{
+  MOZ_ASSERT(sGMPShmemManagerCount > 0);
+  sGMPShmemManagerCount--;
+  if (!sGMPShmemManagerCount) {
+    for (uint32_t i = 0; i < GMPSharedMemManager::kGMPNumTypes; i++) {
+      sGmpFreelist[i] = nullptr;
+    }
+  }
+}
+
+static nsTArray<ipc::Shmem>&
+GetGmpFreelist(GMPSharedMemManager::GMPMemoryClasses aTypes)
+{
+  return *(sGmpFreelist[aTypes]);
+}
+
+static uint32_t sGmpAllocated[GMPSharedMemManager::kGMPNumTypes]; // 0's
+
+bool
+GMPSharedMemManager::MgrAllocShmem(GMPMemoryClasses aClass, size_t aSize,
+                                   ipc::Shmem::SharedMemory::SharedMemoryType aType,
+                                   ipc::Shmem* aMem)
+{
+  CheckThread();
+
+  // first look to see if we have a free buffer large enough
+  for (uint32_t i = 0; i < GetGmpFreelist(aClass).Length(); i++) {
+    MOZ_ASSERT(GetGmpFreelist(aClass)[i].IsWritable());
+    if (aSize <= GetGmpFreelist(aClass)[i].Size<uint8_t>()) {
+      *aMem = GetGmpFreelist(aClass)[i];
+      GetGmpFreelist(aClass).RemoveElementAt(i);
+      return true;
+    }
+  }
+
+  // Didn't find a buffer free with enough space; allocate one
+  size_t pagesize = ipc::SharedMemory::SystemPageSize();
+  aSize = (aSize + (pagesize-1)) & ~(pagesize-1); // round up to page size
+  bool retval = Alloc(aSize, aType, aMem);
+  if (retval) {
+    sGmpAllocated[aClass]++;
+  }
+  return retval;
+}
+
+bool
+GMPSharedMemManager::MgrDeallocShmem(GMPMemoryClasses aClass, ipc::Shmem& aMem)
+{
+  CheckThread();
+
+  size_t size = aMem.Size<uint8_t>();
+  size_t total = 0;
+  // XXX This works; there are better pool algorithms.  We need to avoid
+  // "falling off a cliff" with too low a number
+  if (GetGmpFreelist(aClass).Length() > 10) {
+    Dealloc(GetGmpFreelist(aClass)[0]);
+    GetGmpFreelist(aClass).RemoveElementAt(0);
+    // The allocation numbers will be fubar on the Child!
+    sGmpAllocated[aClass]--;
+  }
+  for (uint32_t i = 0; i < GetGmpFreelist(aClass).Length(); i++) {
+    MOZ_ASSERT(GetGmpFreelist(aClass)[i].IsWritable());
+    total += GetGmpFreelist(aClass)[i].Size<uint8_t>();
+    if (size < GetGmpFreelist(aClass)[i].Size<uint8_t>()) {
+      GetGmpFreelist(aClass).InsertElementAt(i, aMem);
+      return true;
+    }
+  }
+  GetGmpFreelist(aClass).AppendElement(aMem);
+
+  return true;
+}
+
+uint32_t
+GMPSharedMemManager::NumInUse(GMPMemoryClasses aClass)
+{
+  return sGmpAllocated[aClass] - GetGmpFreelist(aClass).Length();
+}
+
+}
+}

--- a/content/media/gmp/GMPSharedMemManager.h
+++ b/content/media/gmp/GMPSharedMemManager.h
@@ -2,25 +2,53 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef GMPSharedMemManager_h_
 #define GMPSharedMemManager_h_
 
 #include "mozilla/ipc/Shmem.h"
+#include "nsTArray.h"
 
 namespace mozilla {
 namespace gmp {
 
 class GMPSharedMemManager
 {
 public:
-  virtual bool MgrAllocShmem(size_t aSize,
+  typedef enum {
+    kGMPFrameData = 0,
+    kGMPEncodedData,
+    kGMPNumTypes
+  } GMPMemoryClasses;
+
+  // This is a heuristic - max of 10 free in the Child pool, plus those
+  // in-use for the encoder and decoder at the given moment and not yet
+  // returned to the parent pool (which is not included).  If more than
+  // this are needed, we presume the client has either crashed or hung
+  // (perhaps temporarily).
+  static const uint32_t kGMPBufLimit = 20;
+
+  GMPSharedMemManager();
+  virtual ~GMPSharedMemManager();
+
+  virtual bool MgrAllocShmem(GMPMemoryClasses aClass, size_t aSize,
                              ipc::Shmem::SharedMemory::SharedMemoryType aType,
-                             ipc::Shmem* aMem) = 0;
-  virtual bool MgrDeallocShmem(ipc::Shmem& aMem) = 0;
+                             ipc::Shmem* aMem);
+  virtual bool MgrDeallocShmem(GMPMemoryClasses aClass, ipc::Shmem& aMem);
+
+  // So we can know if data is "piling up" for the plugin - I.e. it's hung or crashed
+  virtual uint32_t NumInUse(GMPMemoryClasses aClass);
+
+  // Parent and child impls will differ here
+  virtual void CheckThread() = 0;
+
+  // These have to be implemented using the AllocShmem/etc provided by the IPDL-generated interfaces,
+  // so have the Parent/Child implement them.
+  virtual bool Alloc(size_t aSize, ipc::Shmem::SharedMemory::SharedMemoryType aType, ipc::Shmem* aMem) = 0;
+  virtual void Dealloc(ipc::Shmem& aMem) = 0;
 };
 
 } // namespace gmp
 } // namespace mozilla
 
 #endif // GMPSharedMemManager_h_

--- a/content/media/gmp/GMPTypes.ipdlh
+++ b/content/media/gmp/GMPTypes.ipdlh
@@ -1,24 +1,27 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+using GMPBufferType from "gmp-video-codec.h";
+
 namespace mozilla {
 namespace gmp {
 
 struct GMPVideoEncodedFrameData
 {
-  int64_t mCaptureTime_ms;
   uint32_t mEncodedWidth;
   uint32_t mEncodedHeight;
-  uint32_t mTimeStamp;
+  uint64_t mTimestamp; // microseconds
+  uint64_t mDuration; // microseconds
   uint32_t mFrameType;
   uint32_t mSize;
+  GMPBufferType mBufferType;
   Shmem mBuffer;
   bool mCompleteFrame;
 };
 
 struct GMPPlaneData
 {
   int32_t mSize;
   int32_t mStride;
@@ -27,14 +30,14 @@ struct GMPPlaneData
 
 struct GMPVideoi420FrameData
 {
   GMPPlaneData mYPlane;
   GMPPlaneData mUPlane;
   GMPPlaneData mVPlane;
   int32_t mWidth;
   int32_t mHeight;
-  uint32_t mTimestamp;
-  int64_t mRenderTime_ms;
+  uint64_t mTimestamp; // microseconds
+  uint64_t mDuration; // microseconds
 };
 
 }
 }

--- a/content/media/gmp/GMPVideoDecoderChild.cpp
+++ b/content/media/gmp/GMPVideoDecoderChild.cpp
@@ -75,67 +75,89 @@ GMPVideoDecoderChild::ReceivedDecodedFra
 void
 GMPVideoDecoderChild::InputDataExhausted()
 {
   MOZ_ASSERT(mPlugin->GMPMessageLoop() == MessageLoop::current());
 
   SendInputDataExhausted();
 }
 
-bool
-GMPVideoDecoderChild::MgrAllocShmem(size_t aSize,
-                                    ipc::Shmem::SharedMemory::SharedMemoryType aType,
-                                    ipc::Shmem* aMem)
+void
+GMPVideoDecoderChild::DrainComplete()
 {
   MOZ_ASSERT(mPlugin->GMPMessageLoop() == MessageLoop::current());
 
-  return AllocShmem(aSize, aType, aMem);
+  SendDrainComplete();
 }
 
-bool
-GMPVideoDecoderChild::MgrDeallocShmem(Shmem& aMem)
+void
+GMPVideoDecoderChild::ResetComplete()
 {
   MOZ_ASSERT(mPlugin->GMPMessageLoop() == MessageLoop::current());
 
-  return DeallocShmem(aMem);
+  SendResetComplete();
+}
+
+void
+GMPVideoDecoderChild::CheckThread()
+{
+  MOZ_ASSERT(mPlugin->GMPMessageLoop() == MessageLoop::current());
 }
 
 bool
 GMPVideoDecoderChild::RecvInitDecode(const GMPVideoCodec& aCodecSettings,
+                                     const nsTArray<uint8_t>& aCodecSpecific,
                                      const int32_t& aCoreCount)
 {
   if (!mVideoDecoder) {
     return false;
   }
 
   // Ignore any return code. It is OK for this to fail without killing the process.
-  mVideoDecoder->InitDecode(aCodecSettings, this, aCoreCount);
-
+  mVideoDecoder->InitDecode(aCodecSettings,
+                            aCodecSpecific.Elements(),
+                            aCodecSpecific.Length(),
+                            this,
+                            aCoreCount);
   return true;
 }
 
 bool
 GMPVideoDecoderChild::RecvDecode(const GMPVideoEncodedFrameData& aInputFrame,
                                  const bool& aMissingFrames,
-                                 const GMPCodecSpecificInfo& aCodecSpecificInfo,
+                                 const nsTArray<uint8_t>& aCodecSpecificInfo,
                                  const int64_t& aRenderTimeMs)
 {
   if (!mVideoDecoder) {
     return false;
   }
 
   auto f = new GMPVideoEncodedFrameImpl(aInputFrame, &mVideoHost);
 
   // Ignore any return code. It is OK for this to fail without killing the process.
-  mVideoDecoder->Decode(f, aMissingFrames, aCodecSpecificInfo, aRenderTimeMs);
+  mVideoDecoder->Decode(f,
+                        aMissingFrames,
+                        aCodecSpecificInfo.Elements(),
+                        aCodecSpecificInfo.Length(),
+                        aRenderTimeMs);
 
   return true;
 }
 
 bool
+GMPVideoDecoderChild::RecvChildShmemForPool(Shmem& aFrameBuffer)
+{
+  if (aFrameBuffer.IsWritable()) {
+    mVideoHost.SharedMemMgr()->MgrDeallocShmem(GMPSharedMemManager::kGMPFrameData,
+                                               aFrameBuffer);
+  }
+  return true;
+}
+
+bool
 GMPVideoDecoderChild::RecvReset()
 {
   if (!mVideoDecoder) {
     return false;
   }
 
   // Ignore any return code. It is OK for this to fail without killing the process.
   mVideoDecoder->Reset();

--- a/content/media/gmp/GMPVideoDecoderChild.h
+++ b/content/media/gmp/GMPVideoDecoderChild.h
@@ -6,53 +6,75 @@
 #ifndef GMPVideoDecoderChild_h_
 #define GMPVideoDecoderChild_h_
 
 #include "nsString.h"
 #include "mozilla/gmp/PGMPVideoDecoderChild.h"
 #include "gmp-video-decode.h"
 #include "GMPSharedMemManager.h"
 #include "GMPVideoHost.h"
+#include "mozilla/gmp/GMPTypes.h"
 
 namespace mozilla {
 namespace gmp {
 
 class GMPChild;
 
 class GMPVideoDecoderChild : public PGMPVideoDecoderChild,
-                             public GMPDecoderCallback,
+                             public GMPVideoDecoderCallback,
                              public GMPSharedMemManager
 {
 public:
   GMPVideoDecoderChild(GMPChild* aPlugin);
   virtual ~GMPVideoDecoderChild();
 
   void Init(GMPVideoDecoder* aDecoder);
   GMPVideoHostImpl& Host();
 
-  // GMPDecoderCallback
+  // GMPVideoDecoderCallback
   virtual void Decoded(GMPVideoi420Frame* decodedFrame) MOZ_OVERRIDE;
   virtual void ReceivedDecodedReferenceFrame(const uint64_t pictureId) MOZ_OVERRIDE;
   virtual void ReceivedDecodedFrame(const uint64_t pictureId) MOZ_OVERRIDE;
   virtual void InputDataExhausted() MOZ_OVERRIDE;
+  virtual void DrainComplete() MOZ_OVERRIDE;
+  virtual void ResetComplete() MOZ_OVERRIDE;
 
   // GMPSharedMemManager
-  virtual bool MgrAllocShmem(size_t aSize,
-                             ipc::Shmem::SharedMemory::SharedMemoryType aType,
-                             ipc::Shmem* aMem) MOZ_OVERRIDE;
-  virtual bool MgrDeallocShmem(Shmem& aMem) MOZ_OVERRIDE;
+  virtual void CheckThread();
+  virtual bool Alloc(size_t aSize, Shmem::SharedMemory::SharedMemoryType aType, Shmem* aMem)
+  {
+#ifndef SHMEM_ALLOC_IN_CHILD
+    return CallNeedShmem(aSize, aMem);
+#else
+#ifdef GMP_SAFE_SHMEM
+    return AllocShmem(aSize, aType, aMem);
+#else
+    return AllocUnsafeShmem(aSize, aType, aMem);
+#endif
+#endif
+  }
+  virtual void Dealloc(Shmem& aMem)
+  {
+#ifndef SHMEM_ALLOC_IN_CHILD
+    SendParentShmemForPool(aMem);
+#else
+    DeallocShmem(aMem);
+#endif
+  }
 
 private:
   // PGMPVideoDecoderChild
-  virtual bool RecvInitDecode(const GMPVideoCodec& codecSettings,
-                              const int32_t& coreCount) MOZ_OVERRIDE;
-  virtual bool RecvDecode(const GMPVideoEncodedFrameData& inputFrame,
-                          const bool& missingFrames,
-                          const GMPCodecSpecificInfo& codecSpecificInfo,
-                          const int64_t& renderTimeMs) MOZ_OVERRIDE;
+  virtual bool RecvInitDecode(const GMPVideoCodec& aCodecSettings,
+                              const nsTArray<uint8_t>& aCodecSpecific,
+                              const int32_t& aCoreCount) MOZ_OVERRIDE;
+  virtual bool RecvDecode(const GMPVideoEncodedFrameData& aInputFrame,
+                          const bool& aMissingFrames,
+                          const nsTArray<uint8_t>& aCodecSpecificInfo,
+                          const int64_t& aRenderTimeMs) MOZ_OVERRIDE;
+  virtual bool RecvChildShmemForPool(Shmem& aFrameBuffer) MOZ_OVERRIDE;
   virtual bool RecvReset() MOZ_OVERRIDE;
   virtual bool RecvDrain() MOZ_OVERRIDE;
   virtual bool RecvDecodingComplete() MOZ_OVERRIDE;
 
   GMPChild* mPlugin;
   GMPVideoDecoder* mVideoDecoder;
   GMPVideoHostImpl mVideoHost;
 };

--- a/content/media/gmp/GMPVideoDecoderParent.cpp
+++ b/content/media/gmp/GMPVideoDecoderParent.cpp
@@ -7,16 +7,17 @@
 #include "GMPVideoEncodedFrameImpl.h"
 #include "GMPVideoi420FrameImpl.h"
 #include "GMPParent.h"
 #include <stdio.h>
 #include "mozilla/unused.h"
 #include "GMPMessageUtils.h"
 #include "nsAutoRef.h"
 #include "nsThreadUtils.h"
+#include "mozilla/gmp/GMPTypes.h"
 
 template <>
 class nsAutoRefTraits<GMPVideoEncodedFrame> : public nsPointerRefTraits<GMPVideoEncodedFrame>
 {
 public:
   static void Release(GMPVideoEncodedFrame* aFrame) { aFrame->Destroy(); }
 };
 
@@ -37,160 +38,159 @@ GMPVideoDecoderParent::~GMPVideoDecoderP
 }
 
 GMPVideoHostImpl&
 GMPVideoDecoderParent::Host()
 {
   return mVideoHost;
 }
 
-bool
-GMPVideoDecoderParent::MgrAllocShmem(size_t aSize,
-                                     ipc::Shmem::SharedMemory::SharedMemoryType aType,
-                                     ipc::Shmem* aMem)
-{
-  MOZ_ASSERT(mPlugin->GMPThread() == NS_GetCurrentThread());
-
-  return AllocShmem(aSize, aType, aMem);
-}
-
-bool
-GMPVideoDecoderParent::MgrDeallocShmem(Shmem& aMem)
-{
-  MOZ_ASSERT(mPlugin->GMPThread() == NS_GetCurrentThread());
-
-  return DeallocShmem(aMem);
-}
-
-GMPVideoErr
+nsresult
 GMPVideoDecoderParent::InitDecode(const GMPVideoCodec& aCodecSettings,
-                                  GMPDecoderCallback* aCallback,
+                                  const nsTArray<uint8_t>& aCodecSpecific,
+                                  GMPVideoDecoderCallback* aCallback,
                                   int32_t aCoreCount)
 {
   if (!mCanSendMessages) {
     NS_WARNING("Trying to use an invalid GMP video decoder!");
-    return GMPVideoGenericErr;
+    return NS_ERROR_FAILURE;
   }
 
   MOZ_ASSERT(mPlugin->GMPThread() == NS_GetCurrentThread());
 
   if (!aCallback) {
-    return GMPVideoGenericErr;
+    return NS_ERROR_FAILURE;
   }
   mCallback = aCallback;
 
-  if (!SendInitDecode(aCodecSettings, aCoreCount)) {
-    return GMPVideoGenericErr;
+  if (!SendInitDecode(aCodecSettings, aCodecSpecific, aCoreCount)) {
+    return NS_ERROR_FAILURE;
   }
 
   // Async IPC, we don't have access to a return value.
-  return GMPVideoNoErr;
+  return NS_OK;
 }
 
-GMPVideoErr
+nsresult
 GMPVideoDecoderParent::Decode(GMPVideoEncodedFrame* aInputFrame,
                               bool aMissingFrames,
-                              const GMPCodecSpecificInfo& aCodecSpecificInfo,
+                              const nsTArray<uint8_t>& aCodecSpecificInfo,
                               int64_t aRenderTimeMs)
 {
   nsAutoRef<GMPVideoEncodedFrame> autoDestroy(aInputFrame);
 
   if (!mCanSendMessages) {
     NS_WARNING("Trying to use an invalid GMP video decoder!");
-    return GMPVideoGenericErr;
+    return NS_ERROR_FAILURE;
   }
 
   MOZ_ASSERT(mPlugin->GMPThread() == NS_GetCurrentThread());
 
   auto inputFrameImpl = static_cast<GMPVideoEncodedFrameImpl*>(aInputFrame);
 
   GMPVideoEncodedFrameData frameData;
   inputFrameImpl->RelinquishFrameData(frameData);
 
+  // Very rough kill-switch if the plugin stops processing.  If it's merely
+  // hung and continues, we'll come back to life eventually.
+  // 3* is because we're using 3 buffers per frame for i420 data for now.
+  if (NumInUse(kGMPFrameData) > 3*GMPSharedMemManager::kGMPBufLimit ||
+      NumInUse(kGMPEncodedData) > GMPSharedMemManager::kGMPBufLimit) {
+    return NS_ERROR_FAILURE;
+  }
+
   if (!SendDecode(frameData,
                   aMissingFrames,
                   aCodecSpecificInfo,
                   aRenderTimeMs)) {
-    return GMPVideoGenericErr;
+    return NS_ERROR_FAILURE;
   }
 
   // Async IPC, we don't have access to a return value.
-  return GMPVideoNoErr;
+  return NS_OK;
 }
 
-GMPVideoErr
+nsresult
 GMPVideoDecoderParent::Reset()
 {
   if (!mCanSendMessages) {
     NS_WARNING("Trying to use an invalid GMP video decoder!");
-    return GMPVideoGenericErr;
+    return NS_ERROR_FAILURE;
   }
 
   MOZ_ASSERT(mPlugin->GMPThread() == NS_GetCurrentThread());
 
   if (!SendReset()) {
-    return GMPVideoGenericErr;
+    return NS_ERROR_FAILURE;
   }
 
   // Async IPC, we don't have access to a return value.
-  return GMPVideoNoErr;
+  return NS_OK;
 }
 
-GMPVideoErr
+nsresult
 GMPVideoDecoderParent::Drain()
 {
   if (!mCanSendMessages) {
     NS_WARNING("Trying to use an invalid GMP video decoder!");
-    return GMPVideoGenericErr;
+    return NS_ERROR_FAILURE;
   }
 
   MOZ_ASSERT(mPlugin->GMPThread() == NS_GetCurrentThread());
 
   if (!SendDrain()) {
-    return GMPVideoGenericErr;
+    return NS_ERROR_FAILURE;
   }
 
   // Async IPC, we don't have access to a return value.
-  return GMPVideoNoErr;
+  return NS_OK;
 }
 
 // Note: Consider keeping ActorDestroy sync'd up when making changes here.
-void
+nsresult
 GMPVideoDecoderParent::DecodingComplete()
 {
   if (!mCanSendMessages) {
     NS_WARNING("Trying to use an invalid GMP video decoder!");
-    return;
+    return NS_ERROR_FAILURE;
   }
 
   MOZ_ASSERT(mPlugin->GMPThread() == NS_GetCurrentThread());
 
   mCanSendMessages = false;
 
   mCallback = nullptr;
 
   mVideoHost.DoneWithAPI();
 
   unused << SendDecodingComplete();
+
+  return NS_OK;
 }
 
 // Note: Keep this sync'd up with DecodingComplete
 void
 GMPVideoDecoderParent::ActorDestroy(ActorDestroyReason aWhy)
 {
   if (mPlugin) {
     // Ignore any return code. It is OK for this to fail without killing the process.
     mPlugin->VideoDecoderDestroyed(this);
     mPlugin = nullptr;
   }
   mCanSendMessages = false;
   mCallback = nullptr;
   mVideoHost.ActorDestroyed();
 }
 
+void
+GMPVideoDecoderParent::CheckThread()
+{
+  MOZ_ASSERT(mPlugin->GMPThread() == NS_GetCurrentThread());
+}
+
 bool
 GMPVideoDecoderParent::RecvDecoded(const GMPVideoi420FrameData& aDecodedFrame)
 {
   if (!mCallback) {
     return false;
   }
 
   auto f = new GMPVideoi420FrameImpl(aDecodedFrame, &mVideoHost);
@@ -236,16 +236,69 @@ GMPVideoDecoderParent::RecvInputDataExha
 
   // Ignore any return code. It is OK for this to fail without killing the process.
   mCallback->InputDataExhausted();
 
   return true;
 }
 
 bool
+GMPVideoDecoderParent::RecvDrainComplete()
+{
+  if (!mCallback) {
+    return false;
+  }
+
+  // Ignore any return code. It is OK for this to fail without killing the process.
+  mCallback->DrainComplete();
+
+  return true;
+}
+
+bool
+GMPVideoDecoderParent::RecvResetComplete()
+{
+  if (!mCallback) {
+    return false;
+  }
+
+  // Ignore any return code. It is OK for this to fail without killing the process.
+  mCallback->ResetComplete();
+
+  return true;
+}
+
+bool
+GMPVideoDecoderParent::RecvParentShmemForPool(Shmem& aEncodedBuffer)
+{
+  if (aEncodedBuffer.IsWritable()) {
+    mVideoHost.SharedMemMgr()->MgrDeallocShmem(GMPSharedMemManager::kGMPEncodedData,
+                                               aEncodedBuffer);
+  }
+  return true;
+}
+
+bool
+GMPVideoDecoderParent::AnswerNeedShmem(const uint32_t& aFrameBufferSize,
+                                       Shmem* aMem)
+{
+  ipc::Shmem mem;
+
+  if (!mVideoHost.SharedMemMgr()->MgrAllocShmem(GMPSharedMemManager::kGMPFrameData,
+                                                aFrameBufferSize,
+                                                ipc::SharedMemory::TYPE_BASIC, &mem))
+  {
+    return false;
+  }
+  *aMem = mem;
+  mem = ipc::Shmem();
+  return true;
+}
+
+bool
 GMPVideoDecoderParent::Recv__delete__()
 {
   if (mPlugin) {
     // Ignore any return code. It is OK for this to fail without killing the process.
     mPlugin->VideoDecoderDestroyed(this);
     mPlugin = nullptr;
   }
 

--- a/content/media/gmp/GMPVideoDecoderParent.h
+++ b/content/media/gmp/GMPVideoDecoderParent.h
@@ -7,64 +7,80 @@
 #define GMPVideoDecoderParent_h_
 
 #include "mozilla/RefPtr.h"
 #include "gmp-video-decode.h"
 #include "mozilla/gmp/PGMPVideoDecoderParent.h"
 #include "GMPMessageUtils.h"
 #include "GMPSharedMemManager.h"
 #include "GMPVideoHost.h"
+#include "GMPVideoDecoderProxy.h"
 
 namespace mozilla {
 namespace gmp {
 
 class GMPParent;
 
-class GMPVideoDecoderParent MOZ_FINAL : public GMPVideoDecoder
-                                      , public PGMPVideoDecoderParent
+class GMPVideoDecoderParent MOZ_FINAL : public PGMPVideoDecoderParent
                                       , public GMPSharedMemManager
+                                      , public GMPVideoDecoderProxy
 {
 public:
   NS_INLINE_DECL_REFCOUNTING(GMPVideoDecoderParent)
 
   GMPVideoDecoderParent(GMPParent *aPlugin);
 
   GMPVideoHostImpl& Host();
 
-  // GMPSharedMemManager
-  virtual bool MgrAllocShmem(size_t aSize,
-                             ipc::Shmem::SharedMemory::SharedMemoryType aType,
-                             ipc::Shmem* aMem) MOZ_OVERRIDE;
-  virtual bool MgrDeallocShmem(Shmem& aMem) MOZ_OVERRIDE;
+  // GMPVideoDecoder
+  virtual nsresult InitDecode(const GMPVideoCodec& aCodecSettings,
+                              const nsTArray<uint8_t>& aCodecSpecific,
+                              GMPVideoDecoderCallback* aCallback,
+                              int32_t aCoreCount) MOZ_OVERRIDE;
+  virtual nsresult Decode(GMPVideoEncodedFrame* aInputFrame,
+                          bool aMissingFrames,
+                          const nsTArray<uint8_t>& aCodecSpecificInfo,
+                          int64_t aRenderTimeMs = -1) MOZ_OVERRIDE;
+  virtual nsresult Reset() MOZ_OVERRIDE;
+  virtual nsresult Drain() MOZ_OVERRIDE;
+  virtual nsresult DecodingComplete() MOZ_OVERRIDE;
 
-  // GMPVideoDecoder
-  virtual GMPVideoErr InitDecode(const GMPVideoCodec& aCodecSettings,
-                                 GMPDecoderCallback* aCallback,
-                                 int32_t aCoreCount) MOZ_OVERRIDE;
-  virtual GMPVideoErr Decode(GMPVideoEncodedFrame* aInputFrame,
-                             bool aMissingFrames,
-                             const GMPCodecSpecificInfo& aCodecSpecificInfo,
-                             int64_t aRenderTimeMs = -1) MOZ_OVERRIDE;
-  virtual GMPVideoErr Reset() MOZ_OVERRIDE;
-  virtual GMPVideoErr Drain() MOZ_OVERRIDE;
-  virtual void DecodingComplete() MOZ_OVERRIDE;
+  // GMPSharedMemManager
+  virtual void CheckThread();
+  virtual bool Alloc(size_t aSize, Shmem::SharedMemory::SharedMemoryType aType, Shmem* aMem)
+  {
+#ifdef GMP_SAFE_SHMEM
+    return AllocShmem(aSize, aType, aMem);
+#else
+    return AllocUnsafeShmem(aSize, aType, aMem);
+#endif
+  }
+  virtual void Dealloc(Shmem& aMem)
+  {
+    DeallocShmem(aMem);
+  }
 
 private:
   ~GMPVideoDecoderParent();
 
   // PGMPVideoDecoderParent
   virtual void ActorDestroy(ActorDestroyReason aWhy) MOZ_OVERRIDE;
   virtual bool RecvDecoded(const GMPVideoi420FrameData& aDecodedFrame) MOZ_OVERRIDE;
   virtual bool RecvReceivedDecodedReferenceFrame(const uint64_t& aPictureId) MOZ_OVERRIDE;
   virtual bool RecvReceivedDecodedFrame(const uint64_t& aPictureId) MOZ_OVERRIDE;
   virtual bool RecvInputDataExhausted() MOZ_OVERRIDE;
+  virtual bool RecvDrainComplete() MOZ_OVERRIDE;
+  virtual bool RecvResetComplete() MOZ_OVERRIDE;
+  virtual bool RecvParentShmemForPool(Shmem& aEncodedBuffer) MOZ_OVERRIDE;
+  virtual bool AnswerNeedShmem(const uint32_t& aFrameBufferSize,
+                               Shmem* aMem) MOZ_OVERRIDE;
   virtual bool Recv__delete__() MOZ_OVERRIDE;
 
   bool mCanSendMessages;
   GMPParent* mPlugin;
-  GMPDecoderCallback* mCallback;
+  GMPVideoDecoderCallback* mCallback;
   GMPVideoHostImpl mVideoHost;
 };
 
 } // namespace gmp
 } // namespace mozilla
 
 #endif // GMPVideoDecoderParent_h_

new file mode 100644
--- /dev/null
+++ b/content/media/gmp/GMPVideoDecoderProxy.h
@@ -0,0 +1,33 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef GMPVideoDecoderProxy_h_
+#define GMPVideoDecoderProxy_h_
+
+#include "nsTArray.h"
+#include "gmp-video-decode.h"
+#include "gmp-video-frame-i420.h"
+#include "gmp-video-frame-encoded.h"
+
+// A proxy to GMPVideoDecoder in the child process.
+// GMPVideoDecoderParent exposes this to users the GMP.
+// This enables Gecko to pass nsTArrays to the child GMP and avoid
+// an extra copy when doing so.
+class GMPVideoDecoderProxy {
+public:
+  virtual nsresult InitDecode(const GMPVideoCodec& aCodecSettings,
+                              const nsTArray<uint8_t>& aCodecSpecific,
+                              GMPVideoDecoderCallback* aCallback,
+                              int32_t aCoreCount) = 0;
+  virtual nsresult Decode(GMPVideoEncodedFrame* aInputFrame,
+                          bool aMissingFrames,
+                          const nsTArray<uint8_t>& aCodecSpecificInfo,
+                          int64_t aRenderTimeMs = -1) = 0;
+  virtual nsresult Reset() = 0;
+  virtual nsresult Drain() = 0;
+  virtual nsresult DecodingComplete() = 0;
+};
+
+#endif

--- a/content/media/gmp/GMPVideoEncodedFrameImpl.cpp
+++ b/content/media/gmp/GMPVideoEncodedFrameImpl.cpp
@@ -9,51 +9,59 @@
 #include "GMPSharedMemManager.h"
 
 namespace mozilla {
 namespace gmp {
 
 GMPVideoEncodedFrameImpl::GMPVideoEncodedFrameImpl(GMPVideoHostImpl* aHost)
 : mEncodedWidth(0),
   mEncodedHeight(0),
-  mTimeStamp(0),
-  mCaptureTime_ms(0),
+  mTimeStamp(0ll),
+  mDuration(0ll),
   mFrameType(kGMPDeltaFrame),
   mSize(0),
   mCompleteFrame(false),
-  mHost(aHost)
+  mHost(aHost),
+  mBufferType(GMP_BufferSingle)
 {
   MOZ_ASSERT(aHost);
   aHost->EncodedFrameCreated(this);
 }
 
 GMPVideoEncodedFrameImpl::GMPVideoEncodedFrameImpl(const GMPVideoEncodedFrameData& aFrameData,
                                                    GMPVideoHostImpl* aHost)
 : mEncodedWidth(aFrameData.mEncodedWidth()),
   mEncodedHeight(aFrameData.mEncodedHeight()),
-  mTimeStamp(aFrameData.mTimeStamp()),
-  mCaptureTime_ms(aFrameData.mCaptureTime_ms()),
+  mTimeStamp(aFrameData.mTimestamp()),
+  mDuration(aFrameData.mDuration()),
   mFrameType(static_cast<GMPVideoFrameType>(aFrameData.mFrameType())),
   mSize(aFrameData.mSize()),
   mCompleteFrame(aFrameData.mCompleteFrame()),
   mHost(aHost),
-  mBuffer(aFrameData.mBuffer())
+  mBuffer(aFrameData.mBuffer()),
+  mBufferType(aFrameData.mBufferType())
 {
   MOZ_ASSERT(aHost);
   aHost->EncodedFrameCreated(this);
 }
 
 GMPVideoEncodedFrameImpl::~GMPVideoEncodedFrameImpl()
 {
   DestroyBuffer();
   if (mHost) {
     mHost->EncodedFrameDestroyed(this);
   }
 }
 
+const GMPEncryptedBufferData*
+GMPVideoEncodedFrameImpl::GetDecryptionData() const
+{
+  return nullptr;
+}
+
 GMPVideoFrameFormat
 GMPVideoEncodedFrameImpl::GetFrameFormat()
 {
   return kGMPEncodedVideoFrame;
 }
 
 void
 GMPVideoEncodedFrameImpl::DoneWithAPI()
@@ -75,79 +83,82 @@ GMPVideoEncodedFrameImpl::ActorDestroyed
   mHost = nullptr;
 }
 
 bool
 GMPVideoEncodedFrameImpl::RelinquishFrameData(GMPVideoEncodedFrameData& aFrameData)
 {
   aFrameData.mEncodedWidth() = mEncodedWidth;
   aFrameData.mEncodedHeight() = mEncodedHeight;
-  aFrameData.mTimeStamp() = mTimeStamp;
-  aFrameData.mCaptureTime_ms() = mCaptureTime_ms;
+  aFrameData.mTimestamp() = mTimeStamp;
+  aFrameData.mDuration() = mDuration;
   aFrameData.mFrameType() = mFrameType;
   aFrameData.mSize() = mSize;
   aFrameData.mCompleteFrame() = mCompleteFrame;
   aFrameData.mBuffer() = mBuffer;
+  aFrameData.mBufferType() = mBufferType;
 
   // This method is called right before Shmem is sent to another process.
   // We need to effectively zero out our member copy so that we don't
   // try to delete Shmem we don't own later.
   mBuffer = ipc::Shmem();
 
   return true;
 }
 
 void
 GMPVideoEncodedFrameImpl::DestroyBuffer()
 {
   if (mHost && mBuffer.IsWritable()) {
-    mHost->SharedMemMgr()->MgrDeallocShmem(mBuffer);
+    mHost->SharedMemMgr()->MgrDeallocShmem(GMPSharedMemManager::kGMPEncodedData, mBuffer);
   }
   mBuffer = ipc::Shmem();
 }
 
-GMPVideoErr
+GMPErr
 GMPVideoEncodedFrameImpl::CreateEmptyFrame(uint32_t aSize)
 {
-  DestroyBuffer();
-
-  if (aSize != 0) {
-    if (!mHost->SharedMemMgr()->MgrAllocShmem(aSize, ipc::SharedMemory::TYPE_BASIC, &mBuffer) ||
+  if (aSize == 0) {
+    DestroyBuffer();
+  } else if (aSize > AllocatedSize()) {
+    DestroyBuffer();
+    if (!mHost->SharedMemMgr()->MgrAllocShmem(GMPSharedMemManager::kGMPEncodedData, aSize,
+                                              ipc::SharedMemory::TYPE_BASIC, &mBuffer) ||
         !Buffer()) {
-      return GMPVideoAllocErr;
+      return GMPAllocErr;
     }
   }
-
   mSize = aSize;
 
-  return GMPVideoNoErr;
+  return GMPNoErr;
 }
 
-GMPVideoErr
+GMPErr
 GMPVideoEncodedFrameImpl::CopyFrame(const GMPVideoEncodedFrame& aFrame)
 {
   auto& f = static_cast<const GMPVideoEncodedFrameImpl&>(aFrame);
 
   if (f.mSize != 0) {
-    GMPVideoErr err = CreateEmptyFrame(f.mSize);
-    if (err != GMPVideoNoErr) {
+    GMPErr err = CreateEmptyFrame(f.mSize);
+    if (err != GMPNoErr) {
       return err;
     }
     memcpy(Buffer(), f.Buffer(), f.mSize);
   }
   mEncodedWidth = f.mEncodedWidth;
   mEncodedHeight = f.mEncodedHeight;
   mTimeStamp = f.mTimeStamp;
-  mCaptureTime_ms = f.mCaptureTime_ms;
+  mDuration = f.mDuration;
   mFrameType = f.mFrameType;
-  mSize = f.mSize;
+  mSize = f.mSize; // already set...
   mCompleteFrame = f.mCompleteFrame;
+  mBufferType = f.mBufferType;
   // Don't copy host, that should have been set properly on object creation via host.
 
-  return GMPVideoNoErr;
+  return GMPNoErr;
 }
 
 void
 GMPVideoEncodedFrameImpl::SetEncodedWidth(uint32_t aEncodedWidth)
 {
   mEncodedWidth = aEncodedWidth;
 }
 
@@ -165,37 +176,37 @@ GMPVideoEncodedFrameImpl::SetEncodedHeig
 
 uint32_t
 GMPVideoEncodedFrameImpl::EncodedHeight()
 {
   return mEncodedHeight;
 }
 
 void
-GMPVideoEncodedFrameImpl::SetTimeStamp(uint32_t aTimeStamp)
+GMPVideoEncodedFrameImpl::SetTimeStamp(uint64_t aTimeStamp)
 {
   mTimeStamp = aTimeStamp;
 }
 
-uint32_t
+uint64_t
 GMPVideoEncodedFrameImpl::TimeStamp()
 {
   return mTimeStamp;
 }
 
 void
-GMPVideoEncodedFrameImpl::SetCaptureTime(int64_t aCaptureTime)
+GMPVideoEncodedFrameImpl::SetDuration(uint64_t aDuration)
 {
-  mCaptureTime_ms = aCaptureTime;
+  mDuration = aDuration;
 }
 
-int64_t
-GMPVideoEncodedFrameImpl::CaptureTime()
+uint64_t
+GMPVideoEncodedFrameImpl::Duration() const
 {
-  return mCaptureTime_ms;
+  return mDuration;
 }
 
 void
 GMPVideoEncodedFrameImpl::SetFrameType(GMPVideoFrameType aFrameType)
 {
   mFrameType = aFrameType;
 }
 
@@ -212,17 +223,18 @@ GMPVideoEncodedFrameImpl::SetAllocatedSi
     return;
   }
 
   if (!mHost) {
     return;
   }
 
   ipc::Shmem new_mem;
-  if (!mHost->SharedMemMgr()->MgrAllocShmem(aNewSize, ipc::SharedMemory::TYPE_BASIC, &new_mem) ||
+  if (!mHost->SharedMemMgr()->MgrAllocShmem(GMPSharedMemManager::kGMPEncodedData, aNewSize,
+                                            ipc::SharedMemory::TYPE_BASIC, &new_mem) ||
       !new_mem.get<uint8_t>()) {
     return;
   }
 
   if (mBuffer.IsReadable()) {
     memcpy(new_mem.get<uint8_t>(), Buffer(), mSize);
   }
 
@@ -277,10 +289,22 @@ GMPVideoEncodedFrameImpl::Buffer()
 }
 
 void
 GMPVideoEncodedFrameImpl::Destroy()
 {
   delete this;
 }
 
+GMPBufferType
+GMPVideoEncodedFrameImpl::BufferType() const
+{
+  return mBufferType;
+}
+
+void
+GMPVideoEncodedFrameImpl::SetBufferType(GMPBufferType aBufferType)
+{
+  mBufferType = aBufferType;
+}
+
 } // namespace gmp
 } // namespace mozilla