--- a/browser/themes/shared/controlcenter/panel.inc.css
+++ b/browser/themes/shared/controlcenter/panel.inc.css
@@ -394,16 +394,21 @@ description#identity-popup-content-verif
 }
 
 #identity-popup-content-blocking-content:not([enabled]) #identity-popup-content-blocking-disabled-label {
   display: -moz-box;
   background-color: #d70022;
   stroke: #d70022;
 }
 
+#identity-popup-content-blocking-content:not([contentBlockingUI]):not([enabled]) #identity-popup-content-blocking-disabled-label {
+  background-color: #b1b1b3;
+  stroke: #b1b1b3;
+}
+
 #identity-popup-content-blocking-content:not([enabled]) #identity-popup-content-blocking-disabled-label-exception {
   display: none;
 }
 
 #identity-popup-content-blocking-disabled-label > label {
   margin: 0;
   line-height: 18px;
 }

--- a/browser/themes/shared/incontentprefs/privacy.css
+++ b/browser/themes/shared/incontentprefs/privacy.css
@@ -122,25 +122,33 @@
   margin: 16px 0;
 }
 
 .content-blocking-category-labels {
   padding-inline-start: 4px;
   margin-inline-start: 25px !important;
 }
 
-#trackingProtectionMenu,
-#blockCookiesCB {
+#trackingProtectionMenu {
   margin-top: 0.75em;
 }
 
 #blockCookiesCBDeck {
   max-width: 444px;
 }
 
+#blockCookiesCBDeck:not([selectedIndex]) > .warning-description,
+#blockCookiesCBDeck[selectedIndex="0"] > .warning-description {
+  display: none;
+}
+
+#blockCookiesCBDeck > .warning-description {
+  margin-bottom: 0.75em !important;
+}
+
 #changeBlockListLink {
   font-size: 90%;
   /* In order to override the margins set in preferences.inc.css, we have to use !important. */
   margin-top: 1em !important;
 }
 
 .content-blocking-category-description {
   font-size: 90%;

--- a/devtools/client/application/test/browser.ini
+++ b/devtools/client/application/test/browser.ini
@@ -7,16 +7,17 @@ support-files =
   service-workers/debug.html
   service-workers/dynamic-registration.html
   service-workers/empty.html
   service-workers/empty-sw.js
   service-workers/scope-page.html
   service-workers/simple.html
   service-workers/simple-unicode.html
   !/devtools/client/debugger/new/test/mochitest/helpers.js
+  !/devtools/client/debugger/new/test/mochitest/helpers/context.js
   !/devtools/client/shared/test/frame-script-utils.js
   !/devtools/client/shared/test/shared-head.js
   !/devtools/client/shared/test/telemetry-test-helpers.js
 
 [browser_application_panel_debug-service-worker.js]
 [browser_application_panel_list-domain-workers.js]
 [browser_application_panel_list-several-workers.js]
 [browser_application_panel_list-single-worker.js]

--- a/devtools/client/application/test/browser_application_panel_debug-service-worker.js
+++ b/devtools/client/application/test/browser_application_panel_debug-service-worker.js
@@ -3,16 +3,21 @@
 
 "use strict";
 
 /* import-globals-from ../../debugger/new/test/mochitest/helpers.js */
 Services.scriptloader.loadSubScript(
   "chrome://mochitests/content/browser/devtools/client/debugger/new/test/mochitest/helpers.js",
   this);
 
+/* import-globals-from ../../debugger/new/test/mochitest/helpers/context.js */
+Services.scriptloader.loadSubScript(
+  "chrome://mochitests/content/browser/devtools/client/debugger/new/test/mochitest/helpers/context.js",
+  this);
+
 const TAB_URL = URL_ROOT + "service-workers/debug.html";
 
 add_task(async function() {
   await enableApplicationPanel();
 
   const { panel, tab, target } = await openNewTabAndApplicationPanel(TAB_URL);
   const doc = panel.panelWin.document;
 

--- a/devtools/client/canvasdebugger/test/browser.ini
+++ b/devtools/client/canvasdebugger/test/browser.ini
@@ -12,16 +12,17 @@ support-files =
   doc_simple-canvas-transparent.html
   doc_webgl-bindings.html
   doc_webgl-enum.html
   doc_webgl-drawArrays.html
   doc_webgl-drawElements.html
   head.js
   !/devtools/client/shared/test/frame-script-utils.js
   !/devtools/client/shared/test/shared-head.js
+  !/devtools/client/debugger/new/test/mochitest/helpers/context.js
   !/devtools/client/shared/test/telemetry-test-helpers.js
 
 [browser_canvas-actor-test-01.js]
 [browser_canvas-actor-test-02.js]
 [browser_canvas-actor-test-03.js]
 [browser_canvas-actor-test-04.js]
 [browser_canvas-actor-test-05.js]
 [browser_canvas-actor-test-06.js]

--- a/devtools/client/canvasdebugger/test/browser_canvas-frontend-call-stack-01.js
+++ b/devtools/client/canvasdebugger/test/browser_canvas-frontend-call-stack-01.js
@@ -1,20 +1,16 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 /**
  * Tests if the a function call's stack is properly displayed in the UI.
  */
 
-// Force the old debugger UI since it's directly used (see Bug 1301705)
-Services.prefs.setBoolPref("devtools.debugger.new-debugger-frontend", false);
-registerCleanupFunction(function() {
-  Services.prefs.clearUserPref("devtools.debugger.new-debugger-frontend");
-});
+requestLongerTimeout(2);
 
 async function ifTestingSupported() {
   const { target, panel } = await initCanvasDebuggerFrontend(SIMPLE_CANVAS_DEEP_STACK_URL);
   const { window, $, $all, EVENTS, SnapshotsListView, CallsListView } = panel.panelWin;
 
   await reload(target);
 
   const recordingFinished = once(window, EVENTS.SNAPSHOT_RECORDING_FINISHED);
@@ -65,18 +61,14 @@ async function ifTestingSupported() {
     "doc_simple-canvas-deep-stack.html:35",
     "The fourth function on the stack has the correct location.");
 
   const jumpedToSource = once(window, EVENTS.SOURCE_SHOWN_IN_JS_DEBUGGER);
   EventUtils.sendMouseEvent({ type: "mousedown" }, $(".call-item-stack-fn-location", callItem.target));
   await jumpedToSource;
 
   const toolbox = await gDevTools.getToolbox(target);
-  const { panelWin: { DebuggerView: view } } = toolbox.getPanel("jsdebugger");
-
-  is(view.Sources.selectedValue, getSourceActor(view.Sources, SIMPLE_CANVAS_DEEP_STACK_URL),
-    "The expected source was shown in the debugger.");
-  is(view.editor.getCursor().line, 25,
-    "The expected source line is highlighted in the debugger.");
+  const dbg = createDebuggerContext(toolbox);
+  await validateDebuggerLocation(dbg, SIMPLE_CANVAS_DEEP_STACK_URL, 26);
 
   await teardown(panel);
   finish();
 }

--- a/devtools/client/canvasdebugger/test/browser_canvas-frontend-call-stack-02.js
+++ b/devtools/client/canvasdebugger/test/browser_canvas-frontend-call-stack-02.js
@@ -1,21 +1,17 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 /**
  * Tests if the a function call's stack is properly displayed in the UI
  * and jumping to source in the debugger for the topmost call item works.
  */
 
-// Force the old debugger UI since it's directly used (see Bug 1301705)
-Services.prefs.setBoolPref("devtools.debugger.new-debugger-frontend", false);
-registerCleanupFunction(function() {
-  Services.prefs.clearUserPref("devtools.debugger.new-debugger-frontend");
-});
+requestLongerTimeout(2);
 
 async function ifTestingSupported() {
   const { target, panel } = await initCanvasDebuggerFrontend(SIMPLE_CANVAS_DEEP_STACK_URL);
   const { window, $, $all, EVENTS, SnapshotsListView, CallsListView } = panel.panelWin;
 
   await reload(target);
 
   const recordingFinished = once(window, EVENTS.SNAPSHOT_RECORDING_FINISHED);
@@ -40,18 +36,14 @@ async function ifTestingSupported() {
   ok($all(".call-item-stack-fn", callItem.target).length >= 4,
      "There should be at least 4 functions on the stack for the draw call.");
 
   const jumpedToSource = once(window, EVENTS.SOURCE_SHOWN_IN_JS_DEBUGGER);
   EventUtils.sendMouseEvent({ type: "mousedown" }, $(".call-item-location", callItem.target));
   await jumpedToSource;
 
   const toolbox = await gDevTools.getToolbox(target);
-  const { panelWin: { DebuggerView: view } } = toolbox.getPanel("jsdebugger");
-
-  is(view.Sources.selectedValue, getSourceActor(view.Sources, SIMPLE_CANVAS_DEEP_STACK_URL),
-    "The expected source was shown in the debugger.");
-  is(view.editor.getCursor().line, 23,
-    "The expected source line is highlighted in the debugger.");
+  const dbg = createDebuggerContext(toolbox);
+  await validateDebuggerLocation(dbg, SIMPLE_CANVAS_DEEP_STACK_URL, 24);
 
   await teardown(panel);
   finish();
 }

--- a/devtools/client/canvasdebugger/test/head.js
+++ b/devtools/client/canvasdebugger/test/head.js
@@ -1,21 +1,27 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 /* eslint no-unused-vars: [2, {"vars": "local"}] */
 /* import-globals-from ../../shared/test/shared-head.js */
+/* import-globals-from ../../debugger/new/test/mochitest/helpers/context.js */
 
 "use strict";
 
 // Load the shared-head file first.
 Services.scriptloader.loadSubScript(
   "chrome://mochitests/content/browser/devtools/client/shared/test/shared-head.js",
   this);
 
+// Import helpers for the new debugger
+Services.scriptloader.loadSubScript(
+  "chrome://mochitests/content/browser/devtools/client/debugger/new/test/mochitest/helpers/context.js",
+  this);
+
 var { generateUUID } = Cc["@mozilla.org/uuid-generator;1"].getService(Ci.nsIUUIDGenerator);
 
 var { DebuggerClient } = require("devtools/shared/client/debugger-client");
 var { DebuggerServer } = require("devtools/server/main");
 var { CallWatcherFront } = require("devtools/shared/fronts/call-watcher");
 var { CanvasFront } = require("devtools/shared/fronts/canvas");
 var { Toolbox } = require("devtools/client/framework/toolbox");
 var { isWebGLSupported } = require("devtools/client/shared/webgl-utils");
@@ -168,8 +174,18 @@ function teardown({target}) {
     removeTab(tab);
   });
 }
 
 function getSourceActor(aSources, aURL) {
   const item = aSources.getItemForAttachment(a => a.source.url === aURL);
   return item ? item.value : null;
 }
+
+async function validateDebuggerLocation(dbg, url, line) {
+  const location = dbg.selectors.getSelectedLocation(dbg.getState());
+  const sourceUrl = dbg.selectors.getSelectedSource(dbg.getState()).url;
+
+  is(sourceUrl, url,
+    "The expected source was shown in the debugger.");
+  is(location.line, line,
+    "The expected source line is highlighted in the debugger.");
+}

--- a/devtools/client/debugger/new/test/mochitest/browser.ini
+++ b/devtools/client/debugger/new/test/mochitest/browser.ini
@@ -1,15 +1,16 @@
 [DEFAULT]
 tags = devtools
 subsuite = devtools
 skip-if = (os == 'linux' && debug && bits == 32)
 support-files =
   head.js
   helpers.js
+  helpers/context.js
   !/devtools/client/shared/test/shared-head.js
   !/devtools/client/shared/test/telemetry-test-helpers.js
   ## START-SOURCEMAPPED-FIXTURES - Generated by examples/sourcemapped/build.js
   examples/sourcemapped/polyfill-bundle.js
   examples/sourcemapped/output/parcel/babel-bindings-with-flow.js
   examples/sourcemapped/output/parcel/babel-bindings-with-flow.map
   examples/sourcemapped/output/parcel/babel-classes.js
   examples/sourcemapped/output/parcel/babel-classes.map

--- a/devtools/client/debugger/new/test/mochitest/helpers.js
+++ b/devtools/client/debugger/new/test/mochitest/helpers.js
@@ -1,16 +1,21 @@
 /* Any copyright is dedicated to the Public Domain.
  * http://creativecommons.org/publicdomain/zero/1.0/ */
 
 /**
  * Helper methods to drive with the debugger during mochitests. This file can be safely
  * required from other panel test files.
  */
 
+// Import helpers for the new debugger
+Services.scriptloader.loadSubScript(
+  "chrome://mochitests/content/browser/devtools/client/debugger/new/test/mochitest/helpers/context.js",
+  this);
+
 var { Toolbox } = require("devtools/client/framework/toolbox");
 var { Task } = require("devtools/shared/task");
 var asyncStorage = require("devtools/shared/async-storage");
 
 const sourceUtils = {
   isLoaded: source => source.loadedState === "loaded"
 };
 
@@ -457,33 +462,16 @@ function isSelectedFrameSelected(dbg, st
   const isLoaded = source.loadedState && sourceUtils.isLoaded(source);
   if (!isLoaded) {
     return false;
   }
 
   return source.id == sourceId;
 }
 
-function createDebuggerContext(toolbox) {
-  const panel = toolbox.getPanel("jsdebugger");
-  const win = panel.panelWin;
-  const { store, client, selectors, actions } = panel.getVarsForTests();
-
-  return {
-    actions: actions,
-    selectors: selectors,
-    getState: store.getState,
-    store: store,
-    client: client,
-    toolbox: toolbox,
-    win: win,
-    panel: panel
-  };
-}
-
 /**
  * Clear all the debugger related preferences.
  */
 function clearDebuggerPreferences() {
   asyncStorage.clear()
   Services.prefs.clearUserPref("devtools.recordreplay.enabled");
   Services.prefs.clearUserPref("devtools.debugger.pause-on-exceptions");
   Services.prefs.clearUserPref("devtools.debugger.pause-on-caught-exceptions");

new file mode 100644
--- /dev/null
+++ b/devtools/client/debugger/new/test/mochitest/helpers/context.js
@@ -0,0 +1,23 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+/**
+ * Helper method to create a "dbg" context for other tools to use
+ */
+
+function createDebuggerContext(toolbox) {
+  const panel = toolbox.getPanel("jsdebugger");
+  const win = panel.panelWin;
+  const { store, client, selectors, actions } = panel.getVarsForTests();
+
+  return {
+    actions: actions,
+    selectors: selectors,
+    getState: store.getState,
+    store: store,
+    client: client,
+    toolbox: toolbox,
+    win: win,
+    panel: panel
+  };
+}
\ No newline at end of file

--- a/devtools/client/framework/test/browser.ini
+++ b/devtools/client/framework/test/browser.ini
@@ -40,16 +40,17 @@ support-files =
   browser_toolbox_options_enable_serviceworkers_testing_frame_script.js
   browser_toolbox_options_enable_serviceworkers_testing.html
   serviceworker.js
   sjs_code_reload.sjs
   sjs_code_bundle_reload_map.sjs
   test_browser_toolbox_debugger.js
   !/devtools/client/debugger/new/test/mochitest/head.js
   !/devtools/client/debugger/new/test/mochitest/helpers.js
+  !/devtools/client/debugger/new/test/mochitest/helpers/context.js
   !/devtools/client/shared/test/frame-script-utils.js
   !/devtools/client/shared/test/shared-head.js
   !/devtools/client/shared/test/shared-redux-head.js
   !/devtools/client/shared/test/telemetry-test-helpers.js
 
 [browser_browser_toolbox.js]
 skip-if = coverage # Bug 1387827
 [browser_browser_toolbox_debugger.js]

--- a/devtools/client/framework/test/browser_browser_toolbox_debugger.js
+++ b/devtools/client/framework/test/browser_browser_toolbox_debugger.js
@@ -14,16 +14,17 @@ PromiseTestUtils.whitelistRejectionsGlob
 
 // On debug test runner, it takes about 50s to run the test.
 requestLongerTimeout(4);
 
 const { fetch } = require("devtools/shared/DevToolsUtils");
 
 const debuggerHeadURL = CHROME_URL_ROOT + "../../debugger/new/test/mochitest/head.js";
 const helpersURL = CHROME_URL_ROOT + "../../debugger/new/test/mochitest/helpers.js";
+const helpersContextURL = CHROME_URL_ROOT + "../../debugger/new/test/mochitest/helpers/context.js";
 const testScriptURL = CHROME_URL_ROOT + "test_browser_toolbox_debugger.js";
 
 add_task(async function runTest() {
   await new Promise(done => {
     const options = {"set": [
       ["devtools.debugger.prompt-connection", false],
       ["devtools.debugger.remote-enabled", true],
       ["devtools.chrome.enabled", true],
@@ -119,25 +120,26 @@ add_task(async function runTest() {
     }
   }).toSource().replace(/^\(function\(\) \{|\}\)$/g, "");
   /* eslint-enable no-unused-vars */
   // Stringify testHead's function and remove `(function {` prefix and `})` suffix
   // to ensure inner symbols gets exposed to next pieces of code
   // Then inject new debugger head file
   let { content: debuggerHead } = await fetch(debuggerHeadURL);
 
+  // Also include the debugger helpers which are separated from debugger's head to be
+  // reused in other modules.
+  const { content: debuggerHelpers } = await fetch(helpersURL);
+  const { content: debuggerContextHelpers } = await fetch(helpersContextURL);
+  debuggerHead = debuggerHead + debuggerContextHelpers + debuggerHelpers;
+
   // We remove its import of shared-head, which isn't available in browser toolbox process
   // And isn't needed thanks to testHead's symbols
   debuggerHead = debuggerHead.replace(/Services.scriptloader.loadSubScript[^\)]*\);/g, "");
 
-  // Also include the debugger helpers which are separated from debugger's head to be
-  // reused in other modules.
-  const { content: debuggerHelpers } = await fetch(helpersURL);
-  debuggerHead = debuggerHead + debuggerHelpers;
-
   // Finally, fetch the debugger test script that is going to be execute in the browser
   // toolbox process
   const testScript = (await fetch(testScriptURL)).content;
   const source =
     "try { let testUrl = \"" + testUrl + "\";" + testHead + debuggerHead + testScript + "} catch (e) {" +
     "  dump('Exception: '+ e + ' at ' + e.fileName + ':' + " +
     "       e.lineNumber + '\\nStack: ' + e.stack + '\\n');" +
     "}";

--- a/devtools/client/framework/test/browser_keybindings_01.js
+++ b/devtools/client/framework/test/browser_keybindings_01.js
@@ -46,22 +46,16 @@ function buildDevtoolsKeysetMap(keyset) 
 
 function setupKeyBindingsTest() {
   for (const win of gDevToolsBrowser._trackedBrowserWindows) {
     buildDevtoolsKeysetMap(win.document.getElementById("devtoolsKeyset"));
   }
 }
 
 add_task(async function() {
-  // Use the new debugger frontend because the old one swallows the netmonitor shortcut:
-  // https://bugzilla.mozilla.org/show_bug.cgi?id=1370442#c7
-  await SpecialPowers.pushPrefEnv({set: [
-    ["devtools.debugger.new-debugger-frontend", true]
-  ]});
-
   await addTab(TEST_URL);
   await new Promise(done => waitForFocus(done));
 
   setupKeyBindingsTest();
 
   info("Test the first inspector key (there are 2 of them on Mac)");
   const inspectorKeys = allKeys.filter(({ toolId }) => {
     return toolId === "inspector" || toolId === "inspectorMac";

--- a/devtools/client/framework/test/browser_source_map-01.js
+++ b/devtools/client/framework/test/browser_source_map-01.js
@@ -16,18 +16,16 @@ PromiseTestUtils.whitelistRejectionsGlob
 PromiseTestUtils.whitelistRejectionsGlobally(/Component not initialized/);
 
 // Empty page
 const PAGE_URL = `${URL_ROOT}doc_empty-tab-01.html`;
 const JS_URL = `${URL_ROOT}code_binary_search.js`;
 const COFFEE_URL = `${URL_ROOT}code_binary_search.coffee`;
 
 add_task(async function() {
-  await pushPref("devtools.debugger.new-debugger-frontend", true);
-
   const toolbox = await openNewTabAndToolbox(PAGE_URL, "jsdebugger");
   const service = toolbox.sourceMapURLService;
 
   // Inject JS script
   const sourceSeen = waitForSourceLoad(toolbox, JS_URL);
   await createScript(JS_URL);
   await sourceSeen;
 

--- a/devtools/client/framework/test/browser_source_map-absolute.js
+++ b/devtools/client/framework/test/browser_source_map-absolute.js
@@ -11,18 +11,16 @@ const { PromiseTestUtils } = scopedCuImp
 PromiseTestUtils.whitelistRejectionsGlobally(/this\.worker is null/);
 
 // Empty page
 const PAGE_URL = `${URL_ROOT}doc_empty-tab-01.html`;
 const JS_URL = `${URL_ROOT}code_binary_search_absolute.js`;
 const ORIGINAL_URL = `${URL_ROOT}code_binary_search.coffee`;
 
 add_task(async function() {
-  await pushPref("devtools.debugger.new-debugger-frontend", true);
-
   const toolbox = await openNewTabAndToolbox(PAGE_URL, "jsdebugger");
   const service = toolbox.sourceMapURLService;
 
   // Inject JS script
   const sourceSeen = waitForSourceLoad(toolbox, JS_URL);
   await createScript(JS_URL);
   await sourceSeen;
 

--- a/devtools/client/framework/test/browser_source_map-inline.js
+++ b/devtools/client/framework/test/browser_source_map-inline.js
@@ -13,18 +13,16 @@ PromiseTestUtils.whitelistRejectionsGlob
 
 const TEST_ROOT = "http://example.com/browser/devtools/client/framework/test/";
 // Empty page
 const PAGE_URL = `${TEST_ROOT}doc_empty-tab-01.html`;
 const JS_URL = `${TEST_ROOT}code_inline_bundle.js`;
 const ORIGINAL_URL = "webpack:///code_inline_original.js";
 
 add_task(async function() {
-  await pushPref("devtools.debugger.new-debugger-frontend", true);
-
   const toolbox = await openNewTabAndToolbox(PAGE_URL, "jsdebugger");
   const service = toolbox.sourceMapURLService;
 
   // Inject JS script
   const sourceSeen = waitForSourceLoad(toolbox, JS_URL);
   await createScript(JS_URL);
   await sourceSeen;
 

--- a/devtools/client/framework/test/browser_source_map-reload.js
+++ b/devtools/client/framework/test/browser_source_map-reload.js
@@ -11,18 +11,16 @@ const JS_URL = URL_ROOT + "sjs_code_relo
 
 const ORIGINAL_URL_1 = "webpack:///code_reload_1.js";
 const ORIGINAL_URL_2 = "webpack:///code_reload_2.js";
 
 const GENERATED_LINE = 86;
 const ORIGINAL_LINE = 13;
 
 add_task(async function() {
-  await pushPref("devtools.debugger.new-debugger-frontend", true);
-
   // Start with the empty page, then navigate, so that we can properly
   // listen for new sources arriving.
   const toolbox = await openNewTabAndToolbox(INITIAL_URL, "webconsole");
   const service = toolbox.sourceMapURLService;
   const tab = toolbox.target.tab;
 
   let sourceSeen = waitForSourceLoad(toolbox, JS_URL);
   tab.linkedBrowser.loadURI(PAGE_URL);

--- a/devtools/client/framework/test/browser_toolbox_split_console.js
+++ b/devtools/client/framework/test/browser_toolbox_split_console.js
@@ -9,22 +9,16 @@
 //  * toolbox.useKeyWithSplitConsole()
 //  * toolbox.isSplitConsoleFocused
 
 let gToolbox = null;
 let panelWin = null;
 
 const URL = "data:text/html;charset=utf8,test split console key delegation";
 
-// Force the old debugger UI since it's directly used (see Bug 1301705)
-Services.prefs.setBoolPref("devtools.debugger.new-debugger-frontend", false);
-registerCleanupFunction(function() {
-  Services.prefs.clearUserPref("devtools.debugger.new-debugger-frontend");
-});
-
 add_task(async function() {
   const tab = await addTab(URL);
   const target = TargetFactory.forTab(tab);
   gToolbox = await gDevTools.showToolbox(target, "jsdebugger");
   panelWin = gToolbox.getPanel("jsdebugger").panelWin;
 
   await gToolbox.openSplitConsole();
   await testIsSplitConsoleFocused();

--- a/devtools/client/framework/test/browser_toolbox_view_source_01.js
+++ b/devtools/client/framework/test/browser_toolbox_view_source_01.js
@@ -6,39 +6,26 @@
 /**
  * Tests that Toolbox#viewSourceInDebugger works when debugger is not
  * yet opened.
  */
 
 var URL = `${URL_ROOT}doc_viewsource.html`;
 var JS_URL = `${URL_ROOT}code_math.js`;
 
-// Force the old debugger UI since it's directly used (see Bug 1301705)
-Services.prefs.setBoolPref("devtools.debugger.new-debugger-frontend", false);
-registerCleanupFunction(function() {
-  Services.prefs.clearUserPref("devtools.debugger.new-debugger-frontend");
-});
-
 async function viewSource() {
   const toolbox = await openNewTabAndToolbox(URL);
 
   await toolbox.viewSourceInDebugger(JS_URL, 2);
 
   const debuggerPanel = toolbox.getPanel("jsdebugger");
   ok(debuggerPanel, "The debugger panel was opened.");
   is(toolbox.currentToolId, "jsdebugger", "The debugger panel was selected.");
 
-  const { DebuggerView } = debuggerPanel.panelWin;
-  const Sources = DebuggerView.Sources;
-
-  is(Sources.selectedValue, getSourceActor(Sources, JS_URL),
-    "The correct source is shown in the debugger.");
-  is(DebuggerView.editor.getCursor().line + 1, 2,
-    "The correct line is highlighted in the debugger's source editor.");
-
+  assertSelectedLocationInDebugger(debuggerPanel, 2, undefined);
   await closeToolboxAndTab(toolbox);
   finish();
 }
 
 function test() {
   viewSource().then(finish, (aError) => {
     ok(false, "Got an error: " + aError.message + "\n" + aError.stack);
     finish();

--- a/devtools/client/framework/test/browser_toolbox_view_source_02.js
+++ b/devtools/client/framework/test/browser_toolbox_view_source_02.js
@@ -5,47 +5,27 @@
 
 /**
  * Tests that Toolbox#viewSourceInDebugger works when debugger is already loaded.
  */
 
 var URL = `${URL_ROOT}doc_viewsource.html`;
 var JS_URL = `${URL_ROOT}code_math.js`;
 
-// Force the old debugger UI since it's directly used (see Bug 1301705)
-Services.prefs.setBoolPref("devtools.debugger.new-debugger-frontend", false);
-registerCleanupFunction(function() {
-  Services.prefs.clearUserPref("devtools.debugger.new-debugger-frontend");
-});
-
 async function viewSource() {
   const toolbox = await openNewTabAndToolbox(URL);
-  const { panelWin: debuggerWin } = await toolbox.selectTool("jsdebugger");
-  const debuggerEvents = debuggerWin.EVENTS;
-  const { DebuggerView } = debuggerWin;
-  const Sources = DebuggerView.Sources;
-
-  await debuggerWin.once(debuggerEvents.SOURCE_SHOWN);
-  ok("A source was shown in the debugger.");
-
-  is(Sources.selectedValue, getSourceActor(Sources, JS_URL),
-    "The correct source is initially shown in the debugger.");
-  is(DebuggerView.editor.getCursor().line, 0,
-    "The correct line is initially highlighted in the debugger's source editor.");
+  await toolbox.selectTool("jsdebugger");
 
   await toolbox.viewSourceInDebugger(JS_URL, 2);
 
   const debuggerPanel = toolbox.getPanel("jsdebugger");
   ok(debuggerPanel, "The debugger panel was opened.");
   is(toolbox.currentToolId, "jsdebugger", "The debugger panel was selected.");
 
-  is(Sources.selectedValue, getSourceActor(Sources, JS_URL),
-    "The correct source is shown in the debugger.");
-  is(DebuggerView.editor.getCursor().line + 1, 2,
-    "The correct line is highlighted in the debugger's source editor.");
+  assertSelectedLocationInDebugger(debuggerPanel, 2, undefined);
 
   await closeToolboxAndTab(toolbox);
   finish();
 }
 
 function test() {
   viewSource().then(finish, (aError) => {
     ok(false, "Got an error: " + aError.message + "\n" + aError.stack);

--- a/devtools/client/framework/test/head.js
+++ b/devtools/client/framework/test/head.js
@@ -366,8 +366,16 @@ async function resizeWindow(toolbox, wid
   const originalHeight = hostWindow.outerHeight;
   const toWidth = width || originalWidth;
   const toHeight = height || originalHeight;
 
   const onResize = once(hostWindow, "resize");
   hostWindow.resizeTo(toWidth, toHeight);
   await onResize;
 }
+
+function assertSelectedLocationInDebugger(debuggerPanel, line, column) {
+  const location = debuggerPanel._selectors.getSelectedLocation(
+    debuggerPanel._getState()
+  );
+  is(location.line, line);
+  is(location.column, column);
+}

--- a/devtools/client/framework/toolbox-options.js
+++ b/devtools/client/framework/toolbox-options.js
@@ -363,21 +363,16 @@ OptionsPanel.prototype = {
     const isNightly = AppConstants.NIGHTLY_BUILD;
     if (!isNightly) {
       return;
     }
 
     // Labels for these new buttons are nightly only and mostly intended for working on
     // devtools.
     const prefDefinitions = [{
-      pref: "devtools.debugger.new-debugger-frontend",
-      label: L10N.getStr("toolbox.options.enableNewDebugger.label"),
-      id: "devtools-new-debugger",
-      parentId: "debugger-options"
-    }, {
       pref: "devtools.performance.new-panel-enabled",
       label: "Enable new performance recorder (then re-open DevTools)",
       id: "devtools-new-performance",
       parentId: "context-options"
     }];
 
     const createPreferenceOption = ({pref, label, id}) => {
       const inputLabel = this.panelDoc.createElement("label");

--- a/devtools/client/framework/toolbox-process-window.js
+++ b/devtools/client/framework/toolbox-process-window.js
@@ -103,17 +103,16 @@ var connect = async function() {
 function setPrefDefaults() {
   Services.prefs.setBoolPref("devtools.inspector.showUserAgentStyles", true);
   Services.prefs.setBoolPref("devtools.performance.ui.show-platform-data", true);
   Services.prefs.setBoolPref("devtools.inspector.showAllAnonymousContent", true);
   Services.prefs.setBoolPref("browser.dom.window.dump.enabled", true);
   Services.prefs.setBoolPref("devtools.command-button-noautohide.enabled", true);
   // Bug 1225160 - Using source maps with browser debugging can lead to a crash
   Services.prefs.setBoolPref("devtools.debugger.source-maps-enabled", false);
-  Services.prefs.setBoolPref("devtools.debugger.new-debugger-frontend", true);
   Services.prefs.setBoolPref("devtools.preference.new-panel-enabled", false);
   Services.prefs.setBoolPref("layout.css.emulate-moz-box-with-flex", false);
 
   Services.prefs.setBoolPref("devtools.performance.enabled", false);
 }
 
 window.addEventListener("load", async function() {
   gShortcuts = new KeyShortcuts({window});

--- a/devtools/client/inspector/markup/test/browser.ini
+++ b/devtools/client/inspector/markup/test/browser.ini
@@ -65,16 +65,17 @@ support-files =
   lib_react_16.2.0_min.js
   lib_react_dom_15.3.1_min.js
   lib_react_dom_15.4.1.js
   lib_react_dom_16.2.0_min.js
   lib_react_with_addons_15.3.1_min.js
   lib_react_with_addons_15.4.1.js
   react_external_listeners.js
   !/devtools/client/debugger/new/test/mochitest/helpers.js
+  !/devtools/client/debugger/new/test/mochitest/helpers/context.js
   !/devtools/client/inspector/test/head.js
   !/devtools/client/inspector/test/shared-head.js
   !/devtools/client/shared/test/shared-head.js
   !/devtools/client/shared/test/shared-redux-head.js
   !/devtools/client/shared/test/telemetry-test-helpers.js
   !/devtools/client/shared/test/test-actor.js
   !/devtools/client/shared/test/test-actor-registry.js
 

--- a/devtools/client/inspector/markup/test/browser_markup_shadowdom_open_debugger.js
+++ b/devtools/client/inspector/markup/test/browser_markup_shadowdom_open_debugger.js
@@ -10,16 +10,21 @@
 // Test that the markup view is correctly updated to show those items if the custom
 // element definition happens after opening the inspector.
 
 /* import-globals-from ../../../debugger/new/test/mochitest/helpers.js */
 Services.scriptloader.loadSubScript(
   "chrome://mochitests/content/browser/devtools/client/debugger/new/test/mochitest/helpers.js",
   this);
 
+/* import-globals-from ../../../debugger/new/test/mochitest/helpers/context.js */
+Services.scriptloader.loadSubScript(
+  "chrome://mochitests/content/browser/devtools/client/debugger/new/test/mochitest/helpers/context.js",
+  this);
+
 const TEST_URL = `data:text/html;charset=utf-8,` + encodeURIComponent(`
 <test-component></test-component>
 <other-component>some-content</other-component>
 
 <script>
   "use strict";
   window.attachTestComponent = function() {
     customElements.define("test-component", class extends HTMLElement {

--- a/devtools/client/shared/view-source.js
+++ b/devtools/client/shared/view-source.js
@@ -1,17 +1,16 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 "use strict";
 
 var Services = require("Services");
 var { gDevTools } = require("devtools/client/framework/devtools");
-var { getSourceText } = require("devtools/client/debugger/content/queries");
 
 /**
  * Tries to open a Stylesheet file in the Style Editor. If the file is not
  * found, it is opened in source view instead.
  * Returns a promise resolving to a boolean indicating whether or not
  * the source was able to be displayed in the StyleEditor, as the built-in
  * Firefox View Source is the fallback.
  *
@@ -46,83 +45,24 @@ exports.viewSourceInStyleEditor = async 
  * @param {string} sourceURL
  * @param {number} sourceLine
  * @param {string} [reason=unknown]
  *
  * @return {Promise<boolean>}
  */
 exports.viewSourceInDebugger = async function(toolbox, sourceURL, sourceLine,
                                               reason = "unknown") {
-  // If the Debugger was already open, switch to it and try to show the
-  // source immediately. Otherwise, initialize it and wait for the sources
-  // to be added first.
-  const debuggerAlreadyOpen = toolbox.getPanel("jsdebugger");
   const dbg = await toolbox.loadTool("jsdebugger");
-
-  // New debugger frontend
-  if (Services.prefs.getBoolPref("devtools.debugger.new-debugger-frontend")) {
-    const source = dbg.getSource(sourceURL);
-    if (source) {
-      await toolbox.selectTool("jsdebugger", reason);
-      dbg.selectSource(sourceURL, sourceLine);
-      return true;
-    }
-
-    exports.viewSource(toolbox, sourceURL, sourceLine);
-    return false;
-  }
-
-  const win = dbg.panelWin;
-
-  // Old debugger frontend
-  if (!debuggerAlreadyOpen) {
-    await win.DebuggerController.waitForSourcesLoaded();
-  }
-
-  const { DebuggerView } = win;
-  const { Sources } = DebuggerView;
-
-  const item = Sources.getItemForAttachment(a => a.source.url === sourceURL);
-  if (item) {
+  const source = dbg.getSource(sourceURL);
+  if (source) {
     await toolbox.selectTool("jsdebugger", reason);
-
-    // Determine if the source has already finished loading. There's two cases
-    // in which we need to wait for the source to be shown:
-    // 1) The requested source is not yet selected and will be shown once it is
-    //    selected and loaded
-    // 2) The requested source is selected BUT the source text is still loading.
-    const { actor } = item.attachment.source;
-    const state = win.DebuggerController.getState();
-
-    // (1) Is the source selected?
-    const selected = state.sources.selectedSource;
-    const isSelected = selected === actor;
-
-    // (2) Has the source text finished loading?
-    let isLoading = false;
-
-    // Only check if the source is loading when the source is already selected.
-    // If the source is not selected, we will select it below and the already
-    // pending load will be cancelled and this check is useless.
-    if (isSelected) {
-      const sourceTextInfo = getSourceText(state, selected);
-      isLoading = sourceTextInfo && sourceTextInfo.loading;
-    }
-
-    // Select the requested source
-    DebuggerView.setEditorLocation(actor, sourceLine, { noDebug: true });
-
-    // Wait for it to load
-    if (!isSelected || isLoading) {
-      await win.DebuggerController.waitForSourceShown(sourceURL);
-    }
+    dbg.selectSource(sourceURL, sourceLine);
     return true;
   }
 
-  // If not found, still attempt to open in View Source
   exports.viewSource(toolbox, sourceURL, sourceLine);
   return false;
 };
 
 /**
  * Tries to open a JavaScript file in the corresponding Scratchpad.
  *
  * @param {string} sourceURL

--- a/devtools/client/webconsole/test/mochitest/browser.ini
+++ b/devtools/client/webconsole/test/mochitest/browser.ini
@@ -151,16 +151,18 @@ support-files =
   test-trackingprotection-securityerrors.html
   test-webconsole-error-observer.html
   test-websocket.html
   test-websocket.js
   testscript.js
   !/devtools/client/netmonitor/test/sjs_cors-test-server.sjs
   !/image/test/mochitest/blue.png
   !/devtools/client/shared/test/shared-head.js
+  !/devtools/client/debugger/new/test/mochitest/helpers.js
+  !/devtools/client/debugger/new/test/mochitest/helpers/context.js
   !/devtools/client/shared/test/telemetry-test-helpers.js
   !/devtools/client/shared/test/test-actor.js
   !/devtools/client/shared/test/test-actor-registry.js
 
 [browser_console.js]
 [browser_console_clear_cache.js]
 [browser_console_clear_method.js]
 skip-if = true # Bug 1437843
@@ -246,17 +248,16 @@ tags = mcb
 [browser_webconsole_cd_iframe.js]
 [browser_webconsole_certificate_messages.js]
 [browser_webconsole_clear_cache.js]
 [browser_webconsole_click_function_to_source.js]
 [browser_webconsole_clickable_urls.js]
 [browser_webconsole_close_unfocused_window.js]
 [browser_webconsole_closing_after_completion.js]
 [browser_webconsole_close_sidebar.js]
-[browser_webconsole_closure_inspection.js]
 skip-if = true # Bug 1405250
 [browser_webconsole_console_api_iframe.js]
 [browser_webconsole_console_dir.js]
 [browser_webconsole_console_dir_uninspectable.js]
 [browser_webconsole_console_error_expand_object.js]
 [browser_webconsole_console_group.js]
 [browser_webconsole_console_logging_workers_api.js]
 [browser_webconsole_console_table.js]

--- a/devtools/client/webconsole/test/mochitest/browser_jsterm_autocomplete_in_debugger_stackframe.js
+++ b/devtools/client/webconsole/test/mochitest/browser_jsterm_autocomplete_in_debugger_stackframe.js
@@ -3,32 +3,35 @@
 /* Any copyright is dedicated to the Public Domain.
  * http://creativecommons.org/publicdomain/zero/1.0/ */
 
 // Test that makes sure web console autocomplete happens in the user-selected
 // stackframe from the js debugger.
 
 "use strict";
 
+// Import helpers for the new debugger
+/* import-globals-from ../../../debugger/new/test/mochitest/helpers.js */
+Services.scriptloader.loadSubScript(
+  "chrome://mochitests/content/browser/devtools/client/debugger/new/test/mochitest/helpers.js",
+  this);
+
 const TEST_URI = "http://example.com/browser/devtools/client/webconsole/" +
                  "test/mochitest/test-autocomplete-in-stackframe.html";
 
 add_task(async function() {
   // Run test with legacy JsTerm
   await pushPref("devtools.webconsole.jsterm.codeMirror", false);
   await performTests();
   // And then run it with the CodeMirror-powered one.
   await pushPref("devtools.webconsole.jsterm.codeMirror", true);
   await performTests();
 });
 
 async function performTests() {
-  // Force the old debugger UI since it's directly used (see Bug 1301705)
-  await pushPref("devtools.debugger.new-debugger-frontend", false);
-
   const { jsterm } = await openNewTabAndConsole(TEST_URI);
   const {
     autocompletePopup: popup,
   } = jsterm;
 
   const target = TargetFactory.forTab(gBrowser.selectedTab);
   const toolbox = gDevTools.getToolbox(target);
 
@@ -55,34 +58,36 @@ async function performTests() {
     `"foo1Obj." gave the expected suggestions`);
 
   // Test if 'foo1Obj.prop2.' gives 'prop21'
   await jstermComplete("foo1Obj.prop2.");
   ok(getPopupLabels(popup).includes("prop21"),
     `"foo1Obj.prop2." gave the expected suggestions`);
 
   info("Opening Debugger");
-  const {panel} = await openDebugger();
+  await openDebugger();
+  const dbg = createDebuggerContext(toolbox);
 
   info("Waiting for pause");
-  const stackFrames = await pauseDebugger(panel);
+  await pauseDebugger(dbg);
+  const stackFrames = dbg.selectors.getCallStackFrames(dbg.getState());
 
   info("Opening Console again");
   await toolbox.selectTool("webconsole");
 
   // Test if 'foo' gives 'foo3' and 'foo1' but not 'foo2', since we are paused in
   // the `secondCall` function (called by `firstCall`, which we call in `pauseDebugger`).
   await jstermComplete("foo");
   is(getPopupLabels(popup).join("-"), "foo1-foo1Obj-foo3-foo3Obj",
     `"foo" gave the expected suggestions`);
 
   await openDebugger();
 
   // Select the frame for the `firstCall` function.
-  stackFrames.selectFrame(1);
+  await dbg.actions.selectFrame(stackFrames[1]);
 
   info("openConsole");
   await toolbox.selectTool("webconsole");
 
   // Test if 'foo' gives 'foo2' and 'foo1' but not 'foo3', since we are now in the
   // `firstCall` frame.
   await jstermComplete("foo");
   is(getPopupLabels(popup).join("-"), "foo1-foo1Obj-foo2-foo2Obj",
@@ -104,23 +109,15 @@ async function performTests() {
   await jstermComplete("foo2Obj[0].");
   is(getPopupLabels(popup).length, 0, "no items for foo2Obj[0]");
 }
 
 function getPopupLabels(popup) {
   return popup.getItems().map(item => item.label);
 }
 
-function pauseDebugger(debuggerPanel) {
-  const debuggerWin = debuggerPanel.panelWin;
-  const debuggerController = debuggerWin.DebuggerController;
-  const thread = debuggerController.activeThread;
-
-  return new Promise(resolve => {
-    thread.addOneTimeListener("framesadded", () =>
-      resolve(debuggerController.StackFrames));
-
-    info("firstCall()");
-    ContentTask.spawn(gBrowser.selectedBrowser, {}, function() {
-      content.wrappedJSObject.firstCall();
-    });
+async function pauseDebugger(dbg) {
+  info("Waiting for debugger to pause");
+  ContentTask.spawn(gBrowser.selectedBrowser, {}, async function() {
+    content.wrappedJSObject.firstCall();
   });
+  await waitForPaused(dbg);
 }

--- a/devtools/client/webconsole/test/mochitest/browser_webconsole_click_function_to_source.js
+++ b/devtools/client/webconsole/test/mochitest/browser_webconsole_click_function_to_source.js
@@ -2,45 +2,53 @@
 /* vim: set ft=javascript ts=2 et sw=2 tw=80: */
 /* Any copyright is dedicated to the Public Domain.
  * http://creativecommons.org/publicdomain/zero/1.0/ */
 
 // Tests that clicking on a function displays its source in the debugger. See Bug 1050691.
 
 "use strict";
 
+// Import helpers for the new debugger
+/* import-globals-from ../../../debugger/new/test/mochitest/helpers.js */
+Services.scriptloader.loadSubScript(
+  "chrome://mochitests/content/browser/devtools/client/debugger/new/test/mochitest/helpers.js",
+  this);
+
+requestLongerTimeout(5);
+
 const TEST_URI = "http://example.com/browser/devtools/client/webconsole/" +
                  "test/mochitest/" +
                  "test-click-function-to-source.html";
 
-// Force the old debugger UI since it's directly used (see Bug 1301705)
-pushPref("devtools.debugger.new-debugger-frontend", false);
+const TEST_SCRIPT_URI = "http://example.com/browser/devtools/client/webconsole/" +
+                 "test/mochitest/" +
+                 "test-click-function-to-source.js";
 
 add_task(async function() {
   const hud = await openNewTabAndConsole(TEST_URI);
 
   info("Open the Debugger panel.");
-  const {panel} = await openDebugger();
-  const panelWin = panel.panelWin;
+  await openDebugger();
 
   info("And right after come back to the Console panel.");
   await openConsole();
 
   info("Log a function");
   const onLoggedFunction = waitForMessage(hud, "function foo");
   ContentTask.spawn(gBrowser.selectedBrowser, {}, function() {
     content.wrappedJSObject.foo();
   });
   const {node} = await onLoggedFunction;
   const jumpIcon = node.querySelector(".jump-definition");
   ok(jumpIcon, "A jump to definition button is rendered, as expected");
 
   info("Click on the jump to definition button.");
-  const onEditorLocationSet = panelWin.once(panelWin.EVENTS.EDITOR_LOCATION_SET);
   jumpIcon.click();
-  await onEditorLocationSet;
 
-  const {editor} = panelWin.DebuggerView;
-  const {line, ch} = editor.getCursor();
-  // Source editor starts counting line and column numbers from 0.
-  is(line, 8, "Debugger is open at the expected line");
-  is(ch, 0, "Debugger is open at the expected character");
+  const toolbox = gDevTools.getToolbox(hud.target);
+  const dbg = createDebuggerContext(toolbox);
+  await waitForSelectedSource(dbg, TEST_SCRIPT_URI);
+
+  const pendingLocation = dbg.selectors.getPendingSelectedLocation(dbg.getState());
+  const {line} = pendingLocation;
+  is(line, 9, "Debugger is open at the expected line");
 });

deleted file mode 100644
--- a/devtools/client/webconsole/test/mochitest/browser_webconsole_closure_inspection.js
+++ /dev/null
@@ -1,104 +0,0 @@
-/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
-/* vim: set ft=javascript ts=2 et sw=2 tw=80: */
-/* Any copyright is dedicated to the Public Domain.
- * http://creativecommons.org/publicdomain/zero/1.0/ */
-
-// XXX Remove this when the file is migrated to the new frontend.
-/* eslint-disable no-undef */
-
-// Check that inspecting a closure in the variables view sidebar works when
-// execution is paused.
-
-"use strict";
-
-const TEST_URI = "http://example.com/browser/devtools/client/webconsole/" +
-                 "test/mochitest/test-closures.html";
-
-var gWebConsole, gJSTerm, gVariablesView;
-
-// Force the old debugger UI since it's directly used (see Bug 1301705)
-Services.prefs.setBoolPref("devtools.debugger.new-debugger-frontend", false);
-registerCleanupFunction(function() {
-  Services.prefs.clearUserPref("devtools.debugger.new-debugger-frontend");
-});
-
-function test() {
-  registerCleanupFunction(() => {
-    gWebConsole = gJSTerm = gVariablesView = null;
-  });
-
-  function fetchScopes(hud, toolbox, panelWin, deferred) {
-    panelWin.once(panelWin.EVENTS.FETCHED_SCOPES, () => {
-      ok(true, "Scopes were fetched");
-      toolbox.selectTool("webconsole").then(() => consoleOpened(hud));
-      deferred.resolve();
-    });
-  }
-
-  loadTab(TEST_URI).then(() => {
-    openConsole().then((hud) => {
-      openDebugger().then(({ toolbox, panelWin }) => {
-        const deferred = defer();
-        fetchScopes(hud, toolbox, panelWin, deferred);
-
-        // eslint-disable-next-line
-        ContentTask.spawn(gBrowser.selectedBrowser, {}, () => {
-          const button = content.document.querySelector("button");
-          ok(button, "button element found");
-          button.click();
-        });
-
-        return deferred.promise;
-      });
-    });
-  });
-}
-
-function consoleOpened(hud) {
-  gWebConsole = hud;
-  gJSTerm = hud.jsterm;
-  gJSTerm.execute("window.george.getName");
-
-  waitForMessages({
-    webconsole: gWebConsole,
-    messages: [{
-      text: "getName()",
-      category: CATEGORY_OUTPUT,
-      objects: true,
-    }],
-  }).then(onExecuteGetName);
-}
-
-function onExecuteGetName(results) {
-  const clickable = results[0].clickableElements[0];
-  ok(clickable, "clickable object found");
-
-  gJSTerm.once("variablesview-fetched", onGetNameFetch);
-  const contextMenu =
-      gWebConsole.iframeWindow.document.getElementById("output-contextmenu");
-  waitForContextMenu(contextMenu, clickable, () => {
-    const openInVarView = contextMenu.querySelector("#menu_openInVarView");
-    ok(openInVarView.disabled === false,
-       "the \"Open In Variables View\" context menu item should be clickable");
-    // EventUtils.synthesizeMouseAtCenter seems to fail here in Mac OSX
-    openInVarView.click();
-  });
-}
-
-function onGetNameFetch(view) {
-  gVariablesView = view._variablesView;
-  ok(gVariablesView, "variables view object");
-
-  findVariableViewProperties(view, [
-    { name: /_pfactory/, value: "" },
-  ], { webconsole: gWebConsole }).then(onExpandClosure);
-}
-
-function onExpandClosure(results) {
-  const prop = results[0].matchedProp;
-  ok(prop, "matched the name property in the variables view");
-
-  gVariablesView.window.focus();
-  gJSTerm.once("sidebar-closed", finishTest);
-  EventUtils.synthesizeKey("VK_ESCAPE", {}, gVariablesView.window);
-}

--- a/devtools/client/webconsole/test/mochitest/browser_webconsole_eval_in_debugger_stackframe.js
+++ b/devtools/client/webconsole/test/mochitest/browser_webconsole_eval_in_debugger_stackframe.js
@@ -3,23 +3,26 @@
 /* Any copyright is dedicated to the Public Domain.
  * http://creativecommons.org/publicdomain/zero/1.0/ */
 
 // Test that makes sure web console eval happens in the user-selected stackframe
 // from the js debugger.
 
 "use strict";
 
+// Import helpers for the new debugger
+/* import-globals-from ../../../debugger/new/test/mochitest/helpers.js */
+Services.scriptloader.loadSubScript(
+  "chrome://mochitests/content/browser/devtools/client/debugger/new/test/mochitest/helpers.js",
+  this);
+
 const TEST_URI = "http://example.com/browser/devtools/client/webconsole/" +
                  "test/mochitest/test-eval-in-stackframe.html";
 
 add_task(async function() {
-  // Force the old debugger UI since it's directly used (see Bug 1301705).
-  await pushPref("devtools.debugger.new-debugger-frontend", false);
-
   info("open the console");
   const hud = await openNewTabAndConsole(TEST_URI);
   const {jsterm} = hud;
 
   info("Check `foo` value");
   let onResultMessage = waitForMessage(hud, "globalFooBug783499");
   jsterm.execute("foo");
   await onResultMessage;
@@ -27,47 +30,46 @@ add_task(async function() {
 
   info("Assign and check `foo2` value");
   onResultMessage = waitForMessage(hud, "newFoo");
   jsterm.execute("foo2 = 'newFoo'; window.foo2");
   await onResultMessage;
   ok(true, "'newFoo' is displayed after adding `foo2`");
 
   info("Open the debugger and then select the console again");
-  const {panel} = await openDebugger();
-  const {activeThread, StackFrames: stackFrames} = panel.panelWin.DebuggerController;
+  await openDebugger();
+  const toolbox = gDevTools.getToolbox(hud.target);
+  const dbg = createDebuggerContext(toolbox);
 
   await openConsole();
 
   info("Check `foo + foo2` value");
   onResultMessage = waitForMessage(hud, "globalFooBug783499newFoo");
   jsterm.execute("foo + foo2");
   await onResultMessage;
 
   info("Select the debugger again");
   await openDebugger();
+  await pauseDebugger(dbg);
 
-  const onFirstCallFramesAdded = activeThread.addOneTimeListener("framesadded");
-  // firstCall calls secondCall, which has a debugger statement, so we'll be paused.
-  ContentTask.spawn(gBrowser.selectedBrowser, {}, function() {
-    content.wrappedJSObject.firstCall();
-  });
-  await onFirstCallFramesAdded;
+  const stackFrames = dbg.selectors.getCallStackFrames(dbg.getState());
 
   info("frames added, select the console again");
   await openConsole();
 
   info("Check `foo + foo2` value when paused");
   onResultMessage = waitForMessage(hud, "globalFooBug783499foo2SecondCall");
   jsterm.execute("foo + foo2");
   ok(true, "`foo + foo2` from `secondCall()`");
 
   info("select the debugger and select the frame (1)");
   await openDebugger();
-  stackFrames.selectFrame(1);
+
+  await dbg.actions.selectFrame(stackFrames[1]);
+
   await openConsole();
 
   info("Check `foo + foo2 + foo3` value when paused on a given frame");
   onResultMessage = waitForMessage(hud, "fooFirstCallnewFoofoo3FirstCall");
   jsterm.execute("foo + foo2 + foo3");
   await onResultMessage;
   ok(true, "`foo + foo2 + foo3` from `firstCall()`");
 
@@ -77,8 +79,16 @@ add_task(async function() {
   ok(true, "`foo + foo3` updated in `firstCall()`");
 
   await ContentTask.spawn(gBrowser.selectedBrowser, null, function() {
     is(content.wrappedJSObject.foo, "globalFooBug783499", "`foo` in content window");
     is(content.wrappedJSObject.foo2, "newFoo", "`foo2` in content window");
     ok(!content.wrappedJSObject.foo3, "`foo3` was not added to the content window");
   });
 });
+
+async function pauseDebugger(dbg) {
+  info("Waiting for debugger to pause");
+  ContentTask.spawn(gBrowser.selectedBrowser, {}, async function() {
+    content.wrappedJSObject.firstCall();
+  });
+  await waitForPaused(dbg);
+}

--- a/devtools/client/webconsole/test/mochitest/browser_webconsole_eval_in_debugger_stackframe2.js
+++ b/devtools/client/webconsole/test/mochitest/browser_webconsole_eval_in_debugger_stackframe2.js
@@ -4,44 +4,48 @@
  * http://creativecommons.org/publicdomain/zero/1.0/ */
 
 // Test to make sure that web console commands can fire while paused at a
 // breakpoint that was triggered from a JS call.  Relies on asynchronous js
 // evaluation over the protocol - see Bug 1088861.
 
 "use strict";
 
+// Import helpers for the new debugger
+/* import-globals-from ../../../debugger/new/test/mochitest/helpers.js */
+Services.scriptloader.loadSubScript(
+  "chrome://mochitests/content/browser/devtools/client/debugger/new/test/mochitest/helpers.js",
+  this);
+
 const TEST_URI = "http://example.com/browser/devtools/client/webconsole/" +
                  "test/mochitest/test-eval-in-stackframe.html";
 
 add_task(async function() {
-  // Force the old debugger UI since it's directly used (see Bug 1301705).
-  await pushPref("devtools.debugger.new-debugger-frontend", false);
-
   info("open the console");
   const hud = await openNewTabAndConsole(TEST_URI);
   const {jsterm} = hud;
 
   info("open the debugger");
-  const {panel} = await openDebugger();
-  const {activeThread} = panel.panelWin.DebuggerController;
+  await openDebugger();
 
-  const onFirstCallFramesAdded = activeThread.addOneTimeListener("framesadded");
+  const toolbox = gDevTools.getToolbox(hud.target);
+  const dbg = createDebuggerContext(toolbox);
+
   // firstCall calls secondCall, which has a debugger statement, so we'll be paused.
   const onFirstCallMessageReceived = waitForMessage(hud, "undefined");
 
   const unresolvedSymbol = Symbol();
   let firstCallEvaluationResult = unresolvedSymbol;
   onFirstCallMessageReceived.then(message => {
     firstCallEvaluationResult = message;
   });
   jsterm.execute("firstCall()");
 
   info("Waiting for a frame to be added");
-  await onFirstCallFramesAdded;
+  await waitForPaused(dbg);
 
   info("frames added, select the console again");
   await openConsole();
 
   info("Executing basic command while paused");
   let onMessageReceived = waitForMessage(hud, "3");
   jsterm.execute("1 + 2");
   let message = await onMessageReceived;
@@ -52,14 +56,14 @@ add_task(async function() {
   jsterm.execute("foo + foo2");
   message = await onMessageReceived;
   ok(message, "`foo + foo2` was evaluated as expected with debugger paused");
 
   info("Checking the first command, which is the last to resolve since it paused");
   ok(firstCallEvaluationResult === unresolvedSymbol, "firstCall was not evaluated yet");
 
   info("Resuming the thread");
-  activeThread.resume();
+  dbg.actions.resume(dbg.getState());
 
   message = await onFirstCallMessageReceived;
   ok(firstCallEvaluationResult !== unresolvedSymbol,
     "firstCall() returned correct value");
 });

--- a/devtools/client/webconsole/test/mochitest/browser_webconsole_location_debugger_link.js
+++ b/devtools/client/webconsole/test/mochitest/browser_webconsole_location_debugger_link.js
@@ -14,19 +14,16 @@ const { PromiseTestUtils } = scopedCuImp
 PromiseTestUtils.whitelistRejectionsGlobally(/this\.worker is null/);
 
 requestLongerTimeout(2);
 
 const TEST_URI = "http://example.com/browser/devtools/client/webconsole/" +
                  "test/mochitest/test-location-debugger-link.html";
 
 add_task(async function() {
-  // Force the new debugger UI, in case this gets uplifted with the old
-  // debugger still turned on
-  await pushPref("devtools.debugger.new-debugger-frontend", true);
   await pushPref("devtools.webconsole.filter.error", true);
   await pushPref("devtools.webconsole.filter.log", true);
 
   // On e10s, the exception thrown in test-location-debugger-link-errors.js
   // is triggered in child process and is ignored by test harness
   if (!Services.appinfo.browserTabsRemoteAutostart) {
     expectUncaughtException();
   }

--- a/devtools/client/webconsole/test/mochitest/browser_webconsole_object_inspector_while_debugging_and_inspecting.js
+++ b/devtools/client/webconsole/test/mochitest/browser_webconsole_object_inspector_while_debugging_and_inspecting.js
@@ -3,33 +3,39 @@
 /* Any copyright is dedicated to the Public Domain.
  * http://creativecommons.org/publicdomain/zero/1.0/ */
 
 // Test that makes sure web console eval works while the js debugger paused the
 // page, and while the inspector is active. See bug 886137.
 
 "use strict";
 
+// Import helpers for the new debugger
+/* import-globals-from ../../../debugger/new/test/mochitest/helpers.js */
+Services.scriptloader.loadSubScript(
+  "chrome://mochitests/content/browser/devtools/client/debugger/new/test/mochitest/helpers.js",
+  this);
+
 const TEST_URI = "https://example.com/browser/devtools/client/webconsole/" +
                  "test/mochitest/test-eval-in-stackframe.html";
 
 add_task(async function() {
-  // Force the old debugger UI since it's directly used (see Bug 1301705)
-  await pushPref("devtools.debugger.new-debugger-frontend", false);
   const hud = await openNewTabAndConsole(TEST_URI);
 
   info("Switch to the debugger");
   await openDebugger();
 
   info("Switch to the inspector");
   const target = TargetFactory.forTab(gBrowser.selectedTab);
   await gDevTools.showToolbox(target, "inspector");
 
   info("Call firstCall() and wait for the debugger statement to be reached.");
-  await waitForFrameAdded();
+  const toolbox = gDevTools.getToolbox(target);
+  const dbg = createDebuggerContext(toolbox);
+  await pauseDebugger(dbg);
 
   info("Switch back to the console");
   await gDevTools.showToolbox(target, "webconsole");
 
   info("Test logging and inspecting objects while on a breakpoint.");
   const jsterm = hud.jsterm;
 
   const onMessage = waitForMessage(hud, '{ testProp2: "testValue2" }');
@@ -58,21 +64,15 @@ add_task(async function() {
   const oiNodes = oi.querySelectorAll(".node");
   is(oiNodes.length, 3, "There is the expected number of nodes in the tree");
 
   ok(oiNodes[0].textContent.includes(`{\u2026}`));
   ok(oiNodes[1].textContent.includes(`testProp2: "testValue2"`));
   ok(oiNodes[2].textContent.includes(`<prototype>: Object { \u2026 }`));
 });
 
-async function waitForFrameAdded() {
-  const target = TargetFactory.forTab(gBrowser.selectedTab);
-  const toolbox = gDevTools.getToolbox(target);
-  const thread = toolbox.threadClient;
-
-  info("Waiting for framesadded");
-  await new Promise(resolve => {
-    thread.addOneTimeListener("framesadded", resolve);
-    ContentTask.spawn(gBrowser.selectedBrowser, {}, async function() {
-      content.wrappedJSObject.firstCall();
-    });
+async function pauseDebugger(dbg) {
+  info("Waiting for debugger to pause");
+  ContentTask.spawn(gBrowser.selectedBrowser, {}, async function() {
+    content.wrappedJSObject.firstCall();
   });
+  await waitForPaused(dbg);
 }

--- a/devtools/client/webconsole/test/mochitest/browser_webconsole_optimized_out_vars.js
+++ b/devtools/client/webconsole/test/mochitest/browser_webconsole_optimized_out_vars.js
@@ -3,57 +3,61 @@
 /* Any copyright is dedicated to the Public Domain.
  * http://creativecommons.org/publicdomain/zero/1.0/ */
 
 // Check that inspecting an optimized out variable works when execution is
 // paused.
 
 "use strict";
 
+// Import helpers for the new debugger
+/* import-globals-from ../../../debugger/new/test/mochitest/helpers.js */
+Services.scriptloader.loadSubScript(
+    "chrome://mochitests/content/browser/devtools/client/debugger/new/test/mochitest/helpers.js",
+    this);
+
 const TEST_URI = "http://example.com/browser/devtools/client/webconsole/" +
                  "test/mochitest/" +
                  "test-closure-optimized-out.html";
 
 add_task(async function() {
-  // Force the old debugger UI since it's directly used (see Bug 1301705)
-  await pushPref("devtools.debugger.new-debugger-frontend", false);
-
   const hud = await openNewTabAndConsole(TEST_URI);
-  const { toolbox, panel: debuggerPanel } = await openDebugger();
+  await openDebugger();
 
-  const sources = debuggerPanel.panelWin.DebuggerView.Sources;
-  await debuggerPanel.addBreakpoint({ actor: sources.values[0], line: 18 });
-  await ensureThreadClientState(debuggerPanel, "resumed");
+  const toolbox = gDevTools.getToolbox(hud.target);
+  const dbg = createDebuggerContext(toolbox);
 
-  const { FETCHED_SCOPES } = debuggerPanel.panelWin.EVENTS;
-  const fetchedScopes = debuggerPanel.panelWin.once(FETCHED_SCOPES);
+  await addBreakpoint(dbg, "test-closure-optimized-out.html", 18);
+  await waitForThreadEvents(dbg, "resumed");
 
   // Cause the debuggee to pause
-  ContentTask.spawn(gBrowser.selectedBrowser, {}, async function() {
-    const button = content.document.querySelector("button");
-    button.click();
-  });
-
-  await fetchedScopes;
-  ok(true, "Scopes were fetched");
+  await pauseDebugger(dbg);
 
   await toolbox.selectTool("webconsole");
 
   // This is the meat of the test: evaluate the optimized out variable.
   const onMessage = waitForMessage(hud, "optimized out");
   hud.jsterm.execute("upvar");
 
   info("Waiting for optimized out message");
   await onMessage;
 
   ok(true, "Optimized out message logged");
+
+  info("Open the debugger");
+  await openDebugger();
+
+  info("Resume");
+  await resume(dbg);
+
+  info("Remove the breakpoint");
+  const source = findSource(dbg, "test-closure-optimized-out.html");
+  await removeBreakpoint(dbg, source.id, 18);
 });
 
-// Debugger helper functions adapted from devtools/client/debugger/test/head.js.
-
-async function ensureThreadClientState(debuggerPanel, state) {
-  const thread = debuggerPanel.panelWin.gThreadClient;
-  info(`Thread is: '${thread.state}'.`);
-  if (thread.state != state) {
-    info("Waiting for thread event: '${state}'.");
-    await thread.addOneTimeListener(state);
-  }
+async function pauseDebugger(dbg) {
+  info("Waiting for debugger to pause");
+  ContentTask.spawn(gBrowser.selectedBrowser, {}, async function() {
+    const button = content.document.querySelector("button");
+    button.click();
+  });
+  await waitForPaused(dbg);
 }

--- a/devtools/client/webconsole/test/mochitest/browser_webconsole_sourcemap_nosource.js
+++ b/devtools/client/webconsole/test/mochitest/browser_webconsole_sourcemap_nosource.js
@@ -20,19 +20,16 @@ const PAGE_URL = `data:text/html,
 
   <body>
     <script src="${JS_URL}"></script>
   </body>
 
 </html>`;
 
 add_task(async function() {
-  // Force the new debugger UI, in case this gets uplifted with the old
-  // debugger still turned on
-  await pushPref("devtools.debugger.new-debugger-frontend", true);
   await pushPref("devtools.source-map.client-service.enabled", true);
 
   const hud = await openNewTabAndConsole(PAGE_URL);
   const toolbox = hud.ui.consoleOutput.toolbox;
 
   info("Finding \"here\" message and waiting for source map to be applied");
   await waitFor(() => {
     const node = findMessage(hud, "here");

--- a/devtools/client/webconsole/test/mochitest/browser_webconsole_stacktrace_location_debugger_link.js
+++ b/devtools/client/webconsole/test/mochitest/browser_webconsole_stacktrace_location_debugger_link.js
@@ -14,22 +14,18 @@ const { PromiseTestUtils } = scopedCuImp
 PromiseTestUtils.whitelistRejectionsGlobally(/Component not initialized/);
 PromiseTestUtils.whitelistRejectionsGlobally(/this\.worker is null/);
 
 const TEST_URI = "http://example.com/browser/devtools/client/webconsole/" +
                  "test/mochitest/" +
                  "test-stacktrace-location-debugger-link.html";
 
 add_task(async function() {
-  // Force the new debugger UI, in case this gets uplifted with the old
-  // debugger still turned on
-  Services.prefs.setBoolPref("devtools.debugger.new-debugger-frontend", true);
   Services.prefs.setBoolPref("devtools.webconsole.filter.log", true);
   registerCleanupFunction(async function() {
-    Services.prefs.clearUserPref("devtools.debugger.new-debugger-frontend");
     Services.prefs.clearUserPref("devtools.webconsole.filter.log");
   });
 
   const hud = await openNewTabAndConsole(TEST_URI);
   const target = TargetFactory.forTab(gBrowser.selectedTab);
   const toolbox = gDevTools.getToolbox(target);
 
   await testOpenInDebugger(hud, toolbox, "console.trace()");

--- a/devtools/client/webconsole/test/mochitest/head.js
+++ b/devtools/client/webconsole/test/mochitest/head.js
@@ -14,16 +14,22 @@ Services.scriptloader.loadSubScript(
 
 // shared-head.js handles imports, constants, and utility functions
 // Load the shared-head file first.
 /* import-globals-from ../../../shared/test/shared-head.js */
 Services.scriptloader.loadSubScript(
   "chrome://mochitests/content/browser/devtools/client/shared/test/shared-head.js",
   this);
 
+// Import helpers for the new debugger
+/* import-globals-from ../../../debugger/new/test/mochitest/helpers/context.js */
+Services.scriptloader.loadSubScript(
+  "chrome://mochitests/content/browser/devtools/client/debugger/new/test/mochitest/helpers/context.js",
+  this);
+
 var {HUDService} = require("devtools/client/webconsole/hudservice");
 var WCUL10n = require("devtools/client/webconsole/webconsole-l10n");
 const DOCS_GA_PARAMS = `?${new URLSearchParams({
   "utm_source": "mozilla",
   "utm_medium": "firefox-console-errors",
   "utm_campaign": "default"
 })}`;
 const STATUS_CODES_GA_PARAMS = `?${new URLSearchParams({
@@ -530,19 +536,27 @@ async function openDebugger(options = {}
       panel: toolbox.getCurrentPanel()
     };
   }
 
   toolbox = await gDevTools.showToolbox(target, "jsdebugger");
   const panel = toolbox.getCurrentPanel();
 
   // Do not clear VariableView lazily so it doesn't disturb test ending.
-  panel._view.Variables.lazyEmpty = false;
+  if (panel._view) {
+    panel._view.Variables.lazyEmpty = false;
+  }
 
-  await panel.panelWin.DebuggerController.waitForSourcesLoaded();
+  // Old debugger
+  if (panel.panelWin && panel.panelWin.DebuggerController) {
+    await panel.panelWin.DebuggerController.waitForSourcesLoaded();
+  } else {
+    // New debugger
+    await toolbox.threadClient.getSources();
+  }
   return {target, toolbox, panel};
 }
 
 async function openInspector(options = {}) {
   if (!options.tab) {
     options.tab = gBrowser.selectedTab;
   }
 

--- a/devtools/server/tests/unit/test_objectgrips-17.js
+++ b/devtools/server/tests/unit/test_objectgrips-17.js
@@ -86,16 +86,23 @@ async function testPrincipal(globalPrinc
   for (const globalHasXrays of [true, false]) {
     gIsOpaque = gSubsumes && globalPrincipal !== systemPrincipal
                 && (sameOrigin && gDebuggeeHasXrays || globalHasXrays);
     for (gGlobalIsInvisible of [true, false]) {
       gGlobal = Cu.Sandbox(globalPrincipal, {
         wantXrays: globalHasXrays,
         invisibleToDebugger: gGlobalIsInvisible
       });
+      // Previously, the Sandbox constructor would (bizarrely) waive xrays on
+      // the return Sandbox if wantXrays was false. This has now been fixed,
+      // but we need to mimic that behavior here to make the test continue
+      // to pass.
+      if (!globalHasXrays) {
+        gGlobal = Cu.waiveXrays(gGlobal);
+      }
       await test();
     }
   }
 }
 
 function test() {
   return new Promise(function(resolve) {
     gThreadClient.addOneTimeListener("paused", async function(event, packet) {

--- a/dom/base/IframeSandboxKeywordList.h
+++ b/dom/base/IframeSandboxKeywordList.h
@@ -20,8 +20,10 @@ SANDBOX_KEYWORD("allow-pointer-lock", al
 SANDBOX_KEYWORD("allow-orientation-lock", alloworientationlock,
 		SANDBOXED_ORIENTATION_LOCK)
 SANDBOX_KEYWORD("allow-popups", allowpopups, SANDBOXED_AUXILIARY_NAVIGATION)
 SANDBOX_KEYWORD("allow-modals", allowmodals, SANDBOXED_MODALS)
 SANDBOX_KEYWORD("allow-popups-to-escape-sandbox", allowpopupstoescapesandbox,
                 SANDBOX_PROPAGATES_TO_AUXILIARY_BROWSING_CONTEXTS)
 SANDBOX_KEYWORD("allow-presentation", allowpresentation,
                 SANDBOXED_PRESENTATION)
+SANDBOX_KEYWORD("allow-storage-access-by-user-activation",
+                allowstorageaccessbyuseractivatetion, SANDBOXED_STORAGE_ACCESS)

--- a/dom/base/nsContentList.cpp
+++ b/dom/base/nsContentList.cpp
@@ -20,16 +20,17 @@
 #include "nsGkAtoms.h"
 #include "mozilla/dom/HTMLCollectionBinding.h"
 #include "mozilla/dom/NodeListBinding.h"
 #include "mozilla/Likely.h"
 #include "nsGenericHTMLElement.h"
 #include "jsfriendapi.h"
 #include <algorithm>
 #include "mozilla/dom/NodeInfoInlines.h"
+#include "mozilla/MruCache.h"
 
 #include "PLDHashTable.h"
 
 #ifdef DEBUG_CONTENT_LIST
 #include "nsIContentIterator.h"
 #define ASSERT_IN_SYNC AssertInSync()
 #else
 #define ASSERT_IN_SYNC PR_BEGIN_MACRO PR_END_MACRO
@@ -167,25 +168,30 @@ nsIContent*
 nsEmptyContentList::Item(uint32_t aIndex)
 {
   return nullptr;
 }
 
 // Hashtable for storing nsContentLists
 static PLDHashTable* gContentListHashTable;
 
-#define RECENTLY_USED_CONTENT_LIST_CACHE_SIZE 31
-static nsContentList*
-  sRecentlyUsedContentLists[RECENTLY_USED_CONTENT_LIST_CACHE_SIZE] = {};
+struct ContentListCache :
+  public MruCache<nsContentListKey, nsContentList*, ContentListCache>
+{
+  static HashNumber Hash(const nsContentListKey& aKey)
+  {
+    return aKey.GetHash();
+  }
+  static bool Match(const nsContentListKey& aKey, const nsContentList* aVal)
+  {
+    return aVal->MatchesKey(aKey);
+  }
+};
 
-static MOZ_ALWAYS_INLINE uint32_t
-RecentlyUsedCacheIndex(const nsContentListKey& aKey)
-{
-  return aKey.GetHash() % RECENTLY_USED_CONTENT_LIST_CACHE_SIZE;
-}
+static ContentListCache sRecentlyUsedContentLists;
 
 struct ContentListHashEntry : public PLDHashEntryHdr
 {
   nsContentList* mContentList;
 };
 
 static PLDHashNumber
 ContentListHashtableHashKey(const void *key)
@@ -210,20 +216,19 @@ NS_GetContentList(nsINode* aRootNode,
                   int32_t  aMatchNameSpaceId,
                   const nsAString& aTagname)
 {
   NS_ASSERTION(aRootNode, "content list has to have a root");
 
   RefPtr<nsContentList> list;
   nsContentListKey hashKey(aRootNode, aMatchNameSpaceId, aTagname,
                            aRootNode->OwnerDoc()->IsHTMLDocument());
-  uint32_t recentlyUsedCacheIndex = RecentlyUsedCacheIndex(hashKey);
-  nsContentList* cachedList = sRecentlyUsedContentLists[recentlyUsedCacheIndex];
-  if (cachedList && cachedList->MatchesKey(hashKey)) {
-    list = cachedList;
+  auto p = sRecentlyUsedContentLists.Lookup(hashKey);
+  if (p) {
+    list = p.Data();
     return list.forget();
   }
 
   static const PLDHashTableOps hash_table_ops =
   {
     ContentListHashtableHashKey,
     ContentListHashtableMatchEntry,
     PLDHashTable::MoveEntryStub,
@@ -255,17 +260,17 @@ NS_GetContentList(nsINode* aRootNode,
       htmlAtom = xmlAtom;
     }
     list = new nsContentList(aRootNode, aMatchNameSpaceId, htmlAtom, xmlAtom);
     if (entry) {
       entry->mContentList = list;
     }
   }
 
-  sRecentlyUsedContentLists[recentlyUsedCacheIndex] = list;
+  p.Set(list);
   return list.forget();
 }
 
 #ifdef DEBUG
 const nsCacheableFuncStringContentList::ContentListType
   nsCachableElementsByNameNodeList::sType = nsCacheableFuncStringContentList::eNodeList;
 const nsCacheableFuncStringContentList::ContentListType
   nsCacheableFuncStringHTMLCollection::sType = nsCacheableFuncStringContentList::eHTMLCollection;
@@ -923,20 +928,17 @@ nsContentList::RemoveFromHashtable()
 {
   if (mFunc) {
     // This can't be in the table anyway
     return;
   }
 
   nsDependentAtomString str(mXMLMatchAtom);
   nsContentListKey key(mRootNode, mMatchNameSpaceId, str, mIsHTMLDocument);
-  uint32_t recentlyUsedCacheIndex = RecentlyUsedCacheIndex(key);
-  if (sRecentlyUsedContentLists[recentlyUsedCacheIndex] == this) {
-    sRecentlyUsedContentLists[recentlyUsedCacheIndex] = nullptr;
-  }
+  sRecentlyUsedContentLists.Remove(key);
 
   if (!gContentListHashTable)
     return;
 
   gContentListHashTable->Remove(&key);
 
   if (gContentListHashTable->EntryCount() == 0) {
     delete gContentListHashTable;

--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -112,16 +112,17 @@
 #include "nsIPermissionManager.h"
 #include "nsIPrincipal.h"
 #include "ExpandedPrincipal.h"
 #include "mozilla/NullPrincipal.h"
 
 #include "nsIDOMWindow.h"
 #include "nsPIDOMWindow.h"
 #include "nsFocusManager.h"
+#include "nsICookieService.h"
 
 // for radio group stuff
 #include "nsIRadioVisitor.h"
 #include "nsIFormControl.h"
 
 #include "nsBidiUtils.h"
 
 #include "nsContentCreatorFunctions.h"
@@ -13542,16 +13543,222 @@ nsIDocument::GetSelection(ErrorResult& a
 
   if (!window->IsCurrentInnerWindow()) {
     return nullptr;
   }
 
   return nsGlobalWindowInner::Cast(window)->GetSelection(aRv);
 }
 
+already_AddRefed<mozilla::dom::Promise>
+nsIDocument::HasStorageAccess(mozilla::ErrorResult& aRv)
+{
+  nsIGlobalObject* global = GetScopeObject();
+  if (!global) {
+    aRv.Throw(NS_ERROR_NOT_AVAILABLE);
+    return nullptr;
+  }
+
+  RefPtr<Promise> promise = Promise::Create(global, aRv);
+  if (aRv.Failed()) {
+    return nullptr;
+  }
+
+  if (NodePrincipal()->GetIsNullPrincipal()) {
+    promise->MaybeResolve(false);
+    return promise.forget();
+  }
+
+  if (IsTopLevelContentDocument()) {
+    promise->MaybeResolve(true);
+    return promise.forget();
+  }
+
+  nsCOMPtr<nsIDocument> topLevelDoc = GetTopLevelContentDocument();
+  if (!topLevelDoc) {
+    aRv.Throw(NS_ERROR_NOT_AVAILABLE);
+    return nullptr;
+  }
+  if (topLevelDoc->NodePrincipal()->Equals(NodePrincipal())) {
+    promise->MaybeResolve(true);
+    return promise.forget();
+  }
+
+  if (StaticPrefs::browser_contentblocking_enabled() &&
+      StaticPrefs::network_cookie_cookieBehavior() ==
+        nsICookieService::BEHAVIOR_REJECT_TRACKER) {
+    // If we need to abide by Content Blocking cookie restrictions, ensure to
+    // first do all of our storage access checks.  If storage access isn't
+    // disabled in our document, given that we're a third-party, we must either
+    // not be a tracker, or be whitelisted for some reason (e.g. a storage
+    // access permission being granted).  In that case, resolve the promise and
+    // say we have obtained storage access.
+    if (!nsContentUtils::StorageDisabledByAntiTracking(this, nullptr)) {
+      // Note, storage might be allowed because the top-level document is on
+      // the content blocking allowlist!  In that case, don't provide special
+      // treatment here.
+      bool isOnAllowList = false;
+      if (NS_SUCCEEDED(AntiTrackingCommon::IsOnContentBlockingAllowList(
+                         topLevelDoc->GetDocumentURI(), isOnAllowList)) &&
+          !isOnAllowList) {
+        promise->MaybeResolve(true);
+        return promise.forget();
+      }
+    }
+  }
+
+  nsPIDOMWindowInner* inner = GetInnerWindow();
+  nsGlobalWindowOuter* outer = nullptr;
+  if (inner) {
+    outer = nsGlobalWindowOuter::Cast(inner->GetOuterWindow());
+    promise->MaybeResolve(outer->HasStorageAccess());
+  } else {
+    promise->MaybeRejectWithUndefined();
+  }
+  return promise.forget();
+}
+
+already_AddRefed<mozilla::dom::Promise>
+nsIDocument::RequestStorageAccess(mozilla::ErrorResult& aRv)
+{
+  nsIGlobalObject* global = GetScopeObject();
+  if (!global) {
+    aRv.Throw(NS_ERROR_NOT_AVAILABLE);
+    return nullptr;
+  }
+
+  RefPtr<Promise> promise = Promise::Create(global, aRv);
+  if (aRv.Failed()) {
+    return nullptr;
+  }
+
+  // Step 1. If the document already has been granted access, resolve.
+  nsPIDOMWindowInner* inner = GetInnerWindow();
+  nsGlobalWindowOuter* outer = nullptr;
+  if (inner) {
+    outer = nsGlobalWindowOuter::Cast(inner->GetOuterWindow());
+    if (outer->HasStorageAccess()) {
+      promise->MaybeResolveWithUndefined();
+      return promise.forget();
+    }
+  }
+
+  // Step 2. If the document has a null origin, reject.
+  if (NodePrincipal()->GetIsNullPrincipal()) {
+    promise->MaybeRejectWithUndefined();
+    return promise.forget();
+  }
+
+  // Only enforce third-party checks when there is a reason to enforce them.
+  if (StaticPrefs::network_cookie_cookieBehavior() !=
+        nsICookieService::BEHAVIOR_ACCEPT) {
+    // Step 3. If the document's frame is the main frame, resolve.
+    if (IsTopLevelContentDocument()) {
+      promise->MaybeResolveWithUndefined();
+      return promise.forget();
+    }
+
+    // Step 4. If the sub frame's origin is equal to the main frame's, resolve.
+    nsCOMPtr<nsIDocument> topLevelDoc = GetTopLevelContentDocument();
+    if (!topLevelDoc) {
+      aRv.Throw(NS_ERROR_NOT_AVAILABLE);
+      return nullptr;
+    }
+    if (topLevelDoc->NodePrincipal()->Equals(NodePrincipal())) {
+      promise->MaybeResolveWithUndefined();
+      return promise.forget();
+    }
+  }
+
+  // Step 5. If the sub frame is not sandboxed, skip to step 7.
+  // Step 6. If the sub frame doesn't have the token
+  //         "allow-storage-access-by-user-activation", reject.
+  if (mSandboxFlags & SANDBOXED_STORAGE_ACCESS) {
+    promise->MaybeRejectWithUndefined();
+    return promise.forget();
+  }
+
+  // Step 7. If the sub frame's parent frame is not the top frame, reject.
+  nsIDocument* parent = GetParentDocument();
+  if (parent && !parent->IsTopLevelContentDocument()) {
+    promise->MaybeRejectWithUndefined();
+    return promise.forget();
+  }
+
+  // Step 8. If the browser is not processing a user gesture, reject.
+  if (!EventStateManager::IsHandlingUserInput()) {
+    promise->MaybeRejectWithUndefined();
+    return promise.forget();
+  }
+
+  // Step 9. Check any additional rules that the browser has.
+  //         Examples: Whitelists, blacklists, on-device classification,
+  //         user settings, anti-clickjacking heuristics, or prompting the
+  //         user for explicit permission. Reject if some rule is not fulfilled.
+
+  if (nsContentUtils::IsInPrivateBrowsing(this)) {
+    // If the document is in PB mode, it doesn't have access to its persistent
+    // cookie jar, so reject the promise here.
+    promise->MaybeRejectWithUndefined();
+    return promise.forget();
+  }
+
+  bool granted = true;
+  bool isTrackingWindow = false;
+  if (StaticPrefs::browser_contentblocking_enabled() &&
+      StaticPrefs::network_cookie_cookieBehavior() ==
+        nsICookieService::BEHAVIOR_REJECT_TRACKER) {
+    // Only do something special for third-party tracking content.
+    if (nsContentUtils::StorageDisabledByAntiTracking(this, nullptr)) {
+      // Note: If this has returned true, the top-level document is guaranteed
+      // to not be on the Content Blocking allow list.
+      DebugOnly<bool> isOnAllowList = false;
+      MOZ_ASSERT_IF(NS_SUCCEEDED(AntiTrackingCommon::IsOnContentBlockingAllowList(
+                                   parent->GetDocumentURI(), isOnAllowList)),
+                    !isOnAllowList);
+
+      isTrackingWindow = true;
+      // TODO: prompt for permission
+    }
+  }
+
+  // Step 10. Grant the document access to cookies and store that fact for
+  //          the purposes of future calls to hasStorageAccess() and
+  //          requestStorageAccess().
+  if (granted && inner) {
+    outer->SetHasStorageAccess(true);
+    if (isTrackingWindow) {
+      nsCOMPtr<nsIURI> uri = GetDocumentURI();
+      if (NS_WARN_IF(!uri)) {
+        aRv.Throw(NS_ERROR_NOT_AVAILABLE);
+        return nullptr;
+      }
+      nsAutoString origin;
+      nsresult rv = nsContentUtils::GetUTFOrigin(uri, origin);
+      if (NS_WARN_IF(NS_FAILED(rv))) {
+        aRv.Throw(rv);
+        return nullptr;
+      }
+      AntiTrackingCommon::AddFirstPartyStorageAccessGrantedFor(origin,
+                                                               inner,
+                                                               AntiTrackingCommon::eStorageAccessAPI)
+        ->Then(GetCurrentThreadSerialEventTarget(), __func__,
+               [promise] (bool) {
+                 promise->MaybeResolveWithUndefined();
+               },
+               [promise] (bool) {
+                 promise->MaybeRejectWithUndefined();
+               });
+    } else {
+      promise->MaybeResolveWithUndefined();
+    }
+  }
+  return promise.forget();
+}
+
 void
 nsIDocument::RecordNavigationTiming(ReadyState aReadyState)
 {
   if (!XRE_IsContentProcess()) {
     return;
   }
   if (!IsTopLevelContentDocument()) {
     return;

--- a/dom/base/nsGlobalWindowInner.cpp
+++ b/dom/base/nsGlobalWindowInner.cpp
@@ -6269,16 +6269,22 @@ nsGlobalWindowInner::GetTopLevelPrincipa
   }
 
   return topLevelPrincipal;
 }
 
 nsIPrincipal*
 nsGlobalWindowInner::GetTopLevelStorageAreaPrincipal()
 {
+  if (mDoc && ((mDoc->GetSandboxFlags() & SANDBOXED_STORAGE_ACCESS) != 0 ||
+               nsContentUtils::IsInPrivateBrowsing(mDoc))) {
+    // Storage access is disabled
+    return nullptr;
+  }
+
   nsPIDOMWindowOuter* outerWindow = GetParentInternal();
   if (!outerWindow) {
     // No outer window available!
     return nullptr;
   }
 
   if (!outerWindow->IsTopLevelWindow()) {
     return nullptr;

--- a/dom/base/nsGlobalWindowOuter.cpp
+++ b/dom/base/nsGlobalWindowOuter.cpp
@@ -11,16 +11,17 @@
 #include "mozilla/MemoryReporting.h"
 
 // Local Includes
 #include "Navigator.h"
 #include "nsContentSecurityManager.h"
 #include "nsScreen.h"
 #include "nsHistory.h"
 #include "nsDOMNavigationTiming.h"
+#include "nsICookieService.h"
 #include "nsIDOMStorageManager.h"
 #include "nsISecureBrowserUI.h"
 #include "nsIWebProgressListener.h"
 #include "mozilla/AntiTrackingCommon.h"
 #include "mozilla/dom/ContentFrameMessageManager.h"
 #include "mozilla/dom/EventTarget.h"
 #include "mozilla/dom/LocalStorage.h"
 #include "mozilla/dom/Storage.h"
@@ -86,16 +87,17 @@
 #include "mozilla/dom/ToJSValue.h"
 #include "nsJSPrincipals.h"
 #include "mozilla/Attributes.h"
 #include "mozilla/Debug.h"
 #include "mozilla/EventListenerManager.h"
 #include "mozilla/EventStates.h"
 #include "mozilla/MouseEvents.h"
 #include "mozilla/ProcessHangMonitor.h"
+#include "mozilla/StaticPrefs.h"
 #include "mozilla/ThrottledEventQueue.h"
 #include "AudioChannelService.h"
 #include "nsAboutProtocolUtils.h"
 #include "nsCharTraits.h" // NS_IS_HIGH/LOW_SURROGATE
 #include "PostMessageEvent.h"
 #include "mozilla/dom/DocGroup.h"
 #include "mozilla/dom/TabGroup.h"
 
@@ -824,16 +826,17 @@ nsGlobalWindowOuter::nsGlobalWindowOuter
     mHadOriginalOpener(false),
     mIsPopupSpam(false),
     mBlockScriptedClosingFlag(false),
     mWasOffline(false),
     mCreatingInnerWindow(false),
     mIsChrome(false),
     mAllowScriptsToClose(false),
     mTopLevelOuterContentWindow(false),
+    mHasStorageAccess(false),
     mSerial(0),
 #ifdef DEBUG
     mSetOpenerWindowCalled(false),
 #endif
     mCleanedUp(false),
 #ifdef DEBUG
     mIsValidatingTabGroup(false),
 #endif
@@ -2010,16 +2013,35 @@ nsGlobalWindowOuter::SetNewDocument(nsID
 
   PreloadLocalStorage();
 
   // If we have a recorded interesting Large-Allocation header status, report it
   // to the newly attached document.
   ReportLargeAllocStatus();
   mLargeAllocStatus = LargeAllocStatus::NONE;
 
+  mHasStorageAccess = false;
+  nsIURI* uri = aDocument->GetDocumentURI();
+  if (newInnerWindow) {
+    if (StaticPrefs::browser_contentblocking_enabled() &&
+        StaticPrefs::network_cookie_cookieBehavior() ==
+          nsICookieService::BEHAVIOR_REJECT_TRACKER &&
+        nsContentUtils::IsThirdPartyWindowOrChannel(newInnerWindow, nullptr,
+                                                    uri) &&
+        nsContentUtils::IsTrackingResourceWindow(newInnerWindow)) {
+      // Grant storage access by default if the first-party storage access
+      // permission has been granted already.
+      // Don't notify in this case, since we would be notifying the user needlessly.
+      mHasStorageAccess =
+        AntiTrackingCommon::IsFirstPartyStorageAccessGrantedFor(newInnerWindow,
+                                                                uri,
+                                                                nullptr);
+    }
+  }
+
   return NS_OK;
 }
 
 void
 nsGlobalWindowOuter::PreloadLocalStorage()
 {
   if (!Storage::StoragePrefIsEnabled()) {
     return;
@@ -2919,17 +2941,17 @@ nsGlobalWindowOuter::IndexedGetterOuter(
 
   return windows->IndexedGetter(aIndex);
 }
 
 nsIControllers*
 nsGlobalWindowOuter::GetControllersOuter(ErrorResult& aError)
 {
   if (!mControllers) {
-    mControllers = NS_NewXULControllers();
+    mControllers = new nsXULControllers();
     if (!mControllers) {
       aError.Throw(NS_ERROR_FAILURE);
       return nullptr;
     }
 
     // Add in the default controller
     nsCOMPtr<nsIController> controller =
       nsBaseCommandController::CreateWindowController();

--- a/dom/base/nsGlobalWindowOuter.h
+++ b/dom/base/nsGlobalWindowOuter.h
@@ -959,16 +959,25 @@ public:
   bool WindowExists(const nsAString& aName, bool aForceNoOpener,
                     bool aLookForCallerOnJSStack);
 
   already_AddRefed<nsIWidget> GetMainWidget();
   nsIWidget* GetNearestWidget() const;
 
   bool IsInModalState();
 
+  bool HasStorageAccess() const
+  {
+    return mHasStorageAccess;
+  }
+  void SetHasStorageAccess(bool aHasStorageAccess)
+  {
+    mHasStorageAccess = aHasStorageAccess;
+  }
+
   // Convenience functions for the many methods that need to scale
   // from device to CSS pixels or vice versa.  Note: if a presentation
   // context is not available, they will assume a 1:1 ratio.
   int32_t DevToCSSIntPixels(int32_t px);
   int32_t CSSToDevIntPixels(int32_t px);
   nsIntSize DevToCSSIntPixels(nsIntSize px);
   nsIntSize CSSToDevIntPixels(nsIntSize px);
 
@@ -1083,16 +1092,19 @@ protected:
   bool                          mIsChrome : 1;
 
   // whether scripts may close the window,
   // even if "dom.allow_scripts_to_close_windows" is false.
   bool                   mAllowScriptsToClose : 1;
 
   bool mTopLevelOuterContentWindow : 1;
 
+  // whether storage access has been granted to this frame.
+  bool mHasStorageAccess : 1;
+
   nsCOMPtr<nsIScriptContext>    mContext;
   nsWeakPtr                     mOpener;
   nsCOMPtr<nsIControllers>      mControllers;
 
   // For |window.arguments|, via |openDialog|.
   nsCOMPtr<nsIArray>            mArguments;
 
   RefPtr<nsDOMWindowList>     mFrames;

--- a/dom/base/nsIDocument.h
+++ b/dom/base/nsIDocument.h
@@ -1233,16 +1233,21 @@ public:
 
   /**
    * Return the root element for this document.
    */
   Element* GetRootElement() const;
 
   mozilla::dom::Selection* GetSelection(mozilla::ErrorResult& aRv);
 
+  already_AddRefed<mozilla::dom::Promise>
+    HasStorageAccess(mozilla::ErrorResult& aRv);
+  already_AddRefed<mozilla::dom::Promise>
+    RequestStorageAccess(mozilla::ErrorResult& aRv);
+
   /**
    * Gets the event target to dispatch key events to if there is no focused
    * content in the document.
    */
   virtual nsIContent* GetUnfocusedKeyEventTarget();
 
   /**
    * Retrieve information about the viewport as a data structure.

--- a/dom/base/nsJSTimeoutHandler.cpp
+++ b/dom/base/nsJSTimeoutHandler.cpp
@@ -4,16 +4,17 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include <algorithm>
 
 #include "mozilla/Attributes.h"
 #include "mozilla/Likely.h"
 #include "mozilla/Maybe.h"
+#include "mozilla/dom/CSPEvalChecker.h"
 #include "mozilla/dom/FunctionBinding.h"
 #include "mozilla/dom/WorkerPrivate.h"
 #include "nsCOMPtr.h"
 #include "nsContentUtils.h"
 #include "nsError.h"
 #include "nsGlobalWindow.h"
 #include "nsIContentSecurityPolicy.h"
 #include "nsIDocument.h"
@@ -40,17 +41,18 @@ public:
                            ErrorResult& aError);
   nsJSScriptTimeoutHandler(JSContext* aCx, nsGlobalWindowInner* aWindow,
                            const nsAString& aExpression, bool* aAllowEval,
                            ErrorResult& aError);
   nsJSScriptTimeoutHandler(JSContext* aCx, WorkerPrivate* aWorkerPrivate,
                            Function& aFunction,
                            nsTArray<JS::Heap<JS::Value>>&& aArguments);
   nsJSScriptTimeoutHandler(JSContext* aCx, WorkerPrivate* aWorkerPrivate,
-                           const nsAString& aExpression);
+                           const nsAString& aExpression, bool* aAllowEval,
+                           ErrorResult& aRv);
 
   virtual const nsAString& GetHandlerText() override;
 
   virtual Function* GetCallback() override
   {
     return mFunction;
   }
 
@@ -158,64 +160,16 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
   NS_INTERFACE_MAP_ENTRY(nsIScriptTimeoutHandler)
   NS_INTERFACE_MAP_ENTRY(nsITimeoutHandler)
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsJSScriptTimeoutHandler)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsJSScriptTimeoutHandler)
 
-static bool
-CheckCSPForEval(JSContext* aCx, nsGlobalWindowInner* aWindow,
-                const nsAString& aExpression, ErrorResult& aError)
-{
-  // if CSP is enabled, and setTimeout/setInterval was called with a string,
-  // disable the registration and log an error
-  nsCOMPtr<nsIDocument> doc = aWindow->GetExtantDoc();
-  if (!doc) {
-    // if there's no document, we don't have to do anything.
-    return true;
-  }
-
-  nsCOMPtr<nsIContentSecurityPolicy> csp;
-  aError = doc->NodePrincipal()->GetCsp(getter_AddRefs(csp));
-  if (aError.Failed()) {
-    return false;
-  }
-
-  if (!csp) {
-    return true;
-  }
-
-  bool allowsEval = true;
-  bool reportViolation = false;
-  aError = csp->GetAllowsEval(&reportViolation, &allowsEval);
-  if (aError.Failed()) {
-    return false;
-  }
-
-  if (reportViolation) {
-    // Get the calling location.
-    uint32_t lineNum = 0;
-    uint32_t columnNum = 0;
-    nsAutoString fileNameString;
-    if (!nsJSUtils::GetCallingLocation(aCx, fileNameString, &lineNum,
-                                       &columnNum)) {
-      fileNameString.AssignLiteral("unknown");
-    }
-
-    csp->LogViolationDetails(nsIContentSecurityPolicy::VIOLATION_TYPE_EVAL,
-                             nullptr, // triggering element
-                             fileNameString, aExpression, lineNum, columnNum,
-                             EmptyString(), EmptyString());
-  }
-
-  return allowsEval;
-}
-
 nsJSScriptTimeoutHandler::nsJSScriptTimeoutHandler()
   : mLineNo(0)
   , mColumn(0)
 {
 }
 
 nsJSScriptTimeoutHandler::nsJSScriptTimeoutHandler(JSContext* aCx,
                                                    nsGlobalWindowInner *aWindow,
@@ -247,18 +201,19 @@ nsJSScriptTimeoutHandler::nsJSScriptTime
 {
   if (!aWindow->GetContextInternal() || !aWindow->FastGetGlobalJSObject()) {
     // This window was already closed, or never properly initialized,
     // don't let a timer be scheduled on such a window.
     aError.Throw(NS_ERROR_NOT_INITIALIZED);
     return;
   }
 
-  *aAllowEval = CheckCSPForEval(aCx, aWindow, aExpression, aError);
-  if (aError.Failed() || !*aAllowEval) {
+  aError = CSPEvalChecker::CheckForWindow(aCx, aWindow, aExpression,
+                                          aAllowEval);
+  if (NS_WARN_IF(aError.Failed()) || !*aAllowEval) {
     return;
   }
 
   Init(aCx);
 }
 
 nsJSScriptTimeoutHandler::nsJSScriptTimeoutHandler(JSContext* aCx,
                                                    WorkerPrivate* aWorkerPrivate,
@@ -271,24 +226,32 @@ nsJSScriptTimeoutHandler::nsJSScriptTime
   MOZ_ASSERT(aWorkerPrivate);
   aWorkerPrivate->AssertIsOnWorkerThread();
 
   Init(aCx, std::move(aArguments));
 }
 
 nsJSScriptTimeoutHandler::nsJSScriptTimeoutHandler(JSContext* aCx,
                                                    WorkerPrivate* aWorkerPrivate,
-                                                   const nsAString& aExpression)
+                                                   const nsAString& aExpression,
+                                                   bool* aAllowEval,
+                                                   ErrorResult& aError)
   : mLineNo(0)
   , mColumn(0)
   , mExpr(aExpression)
 {
   MOZ_ASSERT(aWorkerPrivate);
   aWorkerPrivate->AssertIsOnWorkerThread();
 
+  aError = CSPEvalChecker::CheckForWorker(aCx, aWorkerPrivate, aExpression,
+                                          aAllowEval);
+  if (NS_WARN_IF(aError.Failed()) || !*aAllowEval) {
+    return;
+  }
+
   Init(aCx);
 }
 
 nsJSScriptTimeoutHandler::~nsJSScriptTimeoutHandler()
 {
   ReleaseJSObjects();
 }
 
@@ -371,14 +334,20 @@ NS_CreateJSTimeoutHandler(JSContext *aCx
 
   RefPtr<nsJSScriptTimeoutHandler> handler =
     new nsJSScriptTimeoutHandler(aCx, aWorkerPrivate, aFunction, std::move(args));
   return handler.forget();
 }
 
 already_AddRefed<nsIScriptTimeoutHandler>
 NS_CreateJSTimeoutHandler(JSContext* aCx, WorkerPrivate* aWorkerPrivate,
-                          const nsAString& aExpression)
+                          const nsAString& aExpression, ErrorResult& aRv)
 {
+  bool allowEval = false;
   RefPtr<nsJSScriptTimeoutHandler> handler =
-    new nsJSScriptTimeoutHandler(aCx, aWorkerPrivate, aExpression);
+    new nsJSScriptTimeoutHandler(aCx, aWorkerPrivate, aExpression, &allowEval,
+                                 aRv);
+  if (aRv.Failed() || !allowEval) {
+    return nullptr;
+  }
+
   return handler.forget();
 }

--- a/dom/base/nsNodeInfoManager.cpp
+++ b/dom/base/nsNodeInfoManager.cpp
@@ -42,17 +42,17 @@ static const uint32_t kInitialNodeInfoHa
 
 nsNodeInfoManager::nsNodeInfoManager()
   : mNodeInfoHash(kInitialNodeInfoHashSize),
     mDocument(nullptr),
     mNonDocumentNodeInfos(0),
     mTextNodeInfo(nullptr),
     mCommentNodeInfo(nullptr),
     mDocumentNodeInfo(nullptr),
-    mRecentlyUsedNodeInfos{},
+    mRecentlyUsedNodeInfos(),
     mSVGEnabled(eTriUnset),
     mMathMLEnabled(eTriUnset)
 {
   nsLayoutStatics::AddRef();
 
   if (gNodeInfoManagerLeakPRLog)
     MOZ_LOG(gNodeInfoManagerLeakPRLog, LogLevel::Debug,
            ("NODEINFOMANAGER %p created", this));
@@ -149,20 +149,19 @@ nsNodeInfoManager::GetNodeInfo(nsAtom *a
                                int32_t aNamespaceID, uint16_t aNodeType,
                                nsAtom* aExtraName /* = nullptr */)
 {
   CheckValidNodeInfo(aNodeType, aName, aNamespaceID, aExtraName);
 
   NodeInfo::NodeInfoInner tmpKey(aName, aPrefix, aNamespaceID, aNodeType,
                                  aExtraName);
 
-  uint32_t index = tmpKey.Hash() % RECENTLY_USED_NODEINFOS_SIZE;
-  NodeInfo* ni = mRecentlyUsedNodeInfos[index];
-  if (ni && tmpKey == ni->mInner) {
-    RefPtr<NodeInfo> nodeInfo = ni;
+  auto p = mRecentlyUsedNodeInfos.Lookup(tmpKey);
+  if (p) {
+    RefPtr<NodeInfo> nodeInfo = p.Data();
     return nodeInfo.forget();
   }
 
   // We don't use LookupForAdd here as that would end up storing the temporary
   // key instead of using `mInner`.
   RefPtr<NodeInfo> nodeInfo = mNodeInfoHash.Get(&tmpKey);
   if (!nodeInfo) {
     ++mNonDocumentNodeInfos;
@@ -171,17 +170,17 @@ nsNodeInfoManager::GetNodeInfo(nsAtom *a
     }
 
     nodeInfo = new NodeInfo(aName, aPrefix, aNamespaceID, aNodeType, aExtraName, this);
     mNodeInfoHash.Put(&nodeInfo->mInner, nodeInfo);
   }
 
   // Have to do the swap thing, because already_AddRefed<nsNodeInfo>
   // doesn't cast to already_AddRefed<mozilla::dom::NodeInfo>
-  mRecentlyUsedNodeInfos[index] = nodeInfo;
+  p.Set(nodeInfo);
   return nodeInfo.forget();
 }
 
 
 nsresult
 nsNodeInfoManager::GetNodeInfo(const nsAString& aName, nsAtom *aPrefix,
                                int32_t aNamespaceID, uint16_t aNodeType,
                                NodeInfo** aNodeInfo)
@@ -191,37 +190,36 @@ nsNodeInfoManager::GetNodeInfo(const nsA
   {
     RefPtr<nsAtom> nameAtom = NS_Atomize(aName);
     CheckValidNodeInfo(aNodeType, nameAtom, aNamespaceID, nullptr);
   }
 #endif
 
   NodeInfo::NodeInfoInner tmpKey(aName, aPrefix, aNamespaceID, aNodeType);
 
-  uint32_t index = tmpKey.Hash() % RECENTLY_USED_NODEINFOS_SIZE;
-  NodeInfo* ni = mRecentlyUsedNodeInfos[index];
-  if (ni && ni->mInner == tmpKey) {
-    RefPtr<NodeInfo> nodeInfo = ni;
+  auto p = mRecentlyUsedNodeInfos.Lookup(tmpKey);
+  if (p) {
+    RefPtr<NodeInfo> nodeInfo = p.Data();
     nodeInfo.forget(aNodeInfo);
     return NS_OK;
   }
 
   RefPtr<NodeInfo> nodeInfo = mNodeInfoHash.Get(&tmpKey);
   if (!nodeInfo) {
     ++mNonDocumentNodeInfos;
     if (mNonDocumentNodeInfos == 1) {
       NS_IF_ADDREF(mDocument);
     }
 
     RefPtr<nsAtom> nameAtom = NS_Atomize(aName);
     nodeInfo = new NodeInfo(nameAtom, aPrefix, aNamespaceID, aNodeType, nullptr, this);
     mNodeInfoHash.Put(&nodeInfo->mInner, nodeInfo);
   }
 
-  mRecentlyUsedNodeInfos[index] = nodeInfo;
+  p.Set(nodeInfo);
   nodeInfo.forget(aNodeInfo);
 
   return NS_OK;
 }
 
 
 nsresult
 nsNodeInfoManager::GetNodeInfo(const nsAString& aName, nsAtom *aPrefix,
@@ -336,21 +334,17 @@ nsNodeInfoManager::RemoveNodeInfo(NodeIn
     if (aNodeInfo == mTextNodeInfo) {
       mTextNodeInfo = nullptr;
     }
     else if (aNodeInfo == mCommentNodeInfo) {
       mCommentNodeInfo = nullptr;
     }
   }
 
-  uint32_t index = aNodeInfo->mInner.Hash() % RECENTLY_USED_NODEINFOS_SIZE;
-  if (mRecentlyUsedNodeInfos[index] == aNodeInfo) {
-    mRecentlyUsedNodeInfos[index] = nullptr;
-  }
-
+  mRecentlyUsedNodeInfos.Remove(aNodeInfo->mInner);
   DebugOnly<bool> ret = mNodeInfoHash.Remove(&aNodeInfo->mInner);
   MOZ_ASSERT(ret, "Can't find mozilla::dom::NodeInfo to remove!!!");
 }
 
 bool
 nsNodeInfoManager::InternalSVGEnabled()
 {
   // If the svg.disabled pref. is true, convert all SVG nodes into

--- a/dom/base/nsNodeInfoManager.h
+++ b/dom/base/nsNodeInfoManager.h
@@ -8,30 +8,29 @@
  * A class for handing out nodeinfos and ensuring sharing of them as needed.
  */
 
 #ifndef nsNodeInfoManager_h___
 #define nsNodeInfoManager_h___
 
 #include "mozilla/Attributes.h"           // for final
 #include "mozilla/dom/NodeInfo.h"
+#include "mozilla/MruCache.h"
 #include "nsCOMPtr.h"                     // for member
 #include "nsCycleCollectionParticipant.h" // for NS_DECL_CYCLE_*
 #include "nsDataHashtable.h"
 #include "nsStringFwd.h"
 
 class nsBindingManager;
 class nsAtom;
 class nsIDocument;
 class nsIPrincipal;
 class nsWindowSizes;
 template<class T> struct already_AddRefed;
 
-#define RECENTLY_USED_NODEINFOS_SIZE 31
-
 class nsNodeInfoManager final
 {
 private:
   ~nsNodeInfoManager();
 
 public:
   nsNodeInfoManager();
 
@@ -149,23 +148,40 @@ private:
   {
   public:
     explicit NodeInfoInnerKey(KeyTypePointer aKey) : nsPtrHashKey(aKey) {}
     ~NodeInfoInnerKey() = default;
     bool KeyEquals(KeyTypePointer aKey) const { return *mKey == *aKey; }
     static PLDHashNumber HashKey(KeyTypePointer aKey) { return aKey->Hash(); }
   };
 
+  struct NodeInfoCache : public mozilla::MruCache<
+                              mozilla::dom::NodeInfo::NodeInfoInner,
+                              mozilla::dom::NodeInfo*,
+                              NodeInfoCache>
+  {
+    static mozilla::HashNumber Hash(
+        const mozilla::dom::NodeInfo::NodeInfoInner& aKey)
+    {
+      return aKey.Hash();
+    }
+    static bool Match(const mozilla::dom::NodeInfo::NodeInfoInner& aKey,
+                      const mozilla::dom::NodeInfo* aVal)
+    {
+      return aKey == aVal->mInner;
+    }
+  };
+
   nsDataHashtable<NodeInfoInnerKey, mozilla::dom::NodeInfo*> mNodeInfoHash;
   nsIDocument * MOZ_NON_OWNING_REF mDocument; // WEAK
   uint32_t mNonDocumentNodeInfos;
   nsCOMPtr<nsIPrincipal> mPrincipal; // Never null after Init() succeeds.
   nsCOMPtr<nsIPrincipal> mDefaultPrincipal; // Never null after Init() succeeds
   mozilla::dom::NodeInfo * MOZ_NON_OWNING_REF mTextNodeInfo; // WEAK to avoid circular ownership
   mozilla::dom::NodeInfo * MOZ_NON_OWNING_REF mCommentNodeInfo; // WEAK to avoid circular ownership
   mozilla::dom::NodeInfo * MOZ_NON_OWNING_REF mDocumentNodeInfo; // WEAK to avoid circular ownership
   RefPtr<nsBindingManager> mBindingManager;
-  mozilla::dom::NodeInfo* mRecentlyUsedNodeInfos[RECENTLY_USED_NODEINFOS_SIZE];
+  NodeInfoCache mRecentlyUsedNodeInfos;
   Tri mSVGEnabled;
   Tri mMathMLEnabled;
 };
 
 #endif /* nsNodeInfoManager_h___ */

--- a/dom/base/nsSandboxFlags.h
+++ b/dom/base/nsSandboxFlags.h
@@ -107,10 +107,15 @@ const unsigned long SANDBOX_PROPAGATES_T
  */
 const unsigned long SANDBOXED_ORIENTATION_LOCK = 0x2000;
 
 /**
  * This flag disables the Presentation API.
  */
 const unsigned long SANDBOXED_PRESENTATION = 0x4000;
 
-const unsigned long SANDBOX_ALL_FLAGS = 0x7FFF;
+/**
+ * This flag disables access to the first-party storage area by user activation.
+ */
+const unsigned long SANDBOXED_STORAGE_ACCESS = 0x8000;
+
+const unsigned long SANDBOX_ALL_FLAGS = 0xFFFF;
 #endif

--- a/dom/commandhandler/moz.build
+++ b/dom/commandhandler/moz.build
@@ -22,17 +22,16 @@ XPIDL_SOURCES += [
     'nsIControllerContext.idl',
     'nsPICommandUpdater.idl',
 ]
 
 XPIDL_MODULE = 'commandhandler'
 
 UNIFIED_SOURCES += [
     'nsBaseCommandController.cpp',
-    'nsCommandGroup.cpp',
     'nsCommandManager.cpp',
     'nsCommandParams.cpp',
     'nsControllerCommandTable.cpp',
 ]
 
 LOCAL_INCLUDES += [
     '/dom/base',
 ]

deleted file mode 100644
--- a/dom/commandhandler/nsCommandGroup.cpp
+++ /dev/null
@@ -1,296 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsString.h"
-#include "nsReadableUtils.h"
-#include "nsTArray.h"
-#include "nsSimpleEnumerator.h"
-#include "nsXPCOM.h"
-#include "nsSupportsPrimitives.h"
-#include "nsIComponentManager.h"
-#include "nsCommandGroup.h"
-#include "nsIControllerCommand.h"
-#include "nsCRT.h"
-
-class nsGroupsEnumerator : public nsSimpleEnumerator
-{
-public:
-  explicit nsGroupsEnumerator(
-    nsControllerCommandGroup::GroupsHashtable& aInHashTable);
-
-  NS_DECL_NSISIMPLEENUMERATOR
-
-  const nsID& DefaultInterface() override
-  {
-    return NS_GET_IID(nsISupportsCString);
-  }
-
-protected:
-  ~nsGroupsEnumerator() override;
-
-  nsresult Initialize();
-
-protected:
-  nsControllerCommandGroup::GroupsHashtable& mHashTable;
-  int32_t mIndex;
-  const char** mGroupNames;  // array of pointers to char16_t* in the hash table
-  bool mInitted;
-};
-
-nsGroupsEnumerator::nsGroupsEnumerator(
-      nsControllerCommandGroup::GroupsHashtable& aInHashTable)
-  : mHashTable(aInHashTable)
-  , mIndex(-1)
-  , mGroupNames(nullptr)
-  , mInitted(false)
-{
-}
-
-nsGroupsEnumerator::~nsGroupsEnumerator()
-{
-  delete[] mGroupNames;
-}
-
-NS_IMETHODIMP
-nsGroupsEnumerator::HasMoreElements(bool* aResult)
-{
-  nsresult rv = NS_OK;
-
-  NS_ENSURE_ARG_POINTER(aResult);
-
-  if (!mInitted) {
-    rv = Initialize();
-    if (NS_FAILED(rv)) {
-      return rv;
-    }
-  }
-
-  *aResult = (mIndex < static_cast<int32_t>(mHashTable.Count()) - 1);
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsGroupsEnumerator::GetNext(nsISupports** aResult)
-{
-  nsresult rv = NS_OK;
-
-  NS_ENSURE_ARG_POINTER(aResult);
-
-  if (!mInitted) {
-    rv = Initialize();
-    if (NS_FAILED(rv)) {
-      return rv;
-    }
-  }
-
-  mIndex++;
-  if (mIndex >= static_cast<int32_t>(mHashTable.Count())) {
-    return NS_ERROR_FAILURE;
-  }
-
-  const char* thisGroupName = mGroupNames[mIndex];
-
-  nsCOMPtr<nsISupportsCString> supportsString =
-    do_CreateInstance(NS_SUPPORTS_CSTRING_CONTRACTID, &rv);
-  if (NS_FAILED(rv)) {
-    return rv;
-  }
-
-  supportsString->SetData(nsDependentCString(thisGroupName));
-  return CallQueryInterface(supportsString, aResult);
-}
-
-nsresult
-nsGroupsEnumerator::Initialize()
-{
-  if (mInitted) {
-    return NS_OK;
-  }
-
-  mGroupNames = new const char*[mHashTable.Count()];
-  if (!mGroupNames) {
-    return NS_ERROR_OUT_OF_MEMORY;
-  }
-
-  mIndex = 0;
-  for (auto iter = mHashTable.Iter(); !iter.Done(); iter.Next()) {
-    mGroupNames[mIndex] = iter.Key().Data();
-    mIndex++;
-  }
-
-  mIndex = -1;
-  mInitted = true;
-  return NS_OK;
-}
-
-class nsNamedGroupEnumerator : public nsSimpleEnumerator
-{
-public:
-  explicit nsNamedGroupEnumerator(nsTArray<nsCString>* aInArray);
-
-  NS_DECL_NSISIMPLEENUMERATOR
-
-  const nsID& DefaultInterface() override
-  {
-    return NS_GET_IID(nsISupportsCString);
-  }
-
-protected:
-  ~nsNamedGroupEnumerator() override;
-
-  nsTArray<nsCString>* mGroupArray;
-  int32_t mIndex;
-};
-
-nsNamedGroupEnumerator::nsNamedGroupEnumerator(nsTArray<nsCString>* aInArray)
-  : mGroupArray(aInArray)
-  , mIndex(-1)
-{
-}
-
-nsNamedGroupEnumerator::~nsNamedGroupEnumerator()
-{
-}
-
-NS_IMETHODIMP
-nsNamedGroupEnumerator::HasMoreElements(bool* aResult)
-{
-  NS_ENSURE_ARG_POINTER(aResult);
-
-  int32_t arrayLen = mGroupArray ? mGroupArray->Length() : 0;
-  *aResult = (mIndex < arrayLen - 1);
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsNamedGroupEnumerator::GetNext(nsISupports** aResult)
-{
-  NS_ENSURE_ARG_POINTER(aResult);
-
-  if (!mGroupArray) {
-    return NS_ERROR_FAILURE;
-  }
-
-  mIndex++;
-  if (mIndex >= int32_t(mGroupArray->Length())) {
-    return NS_ERROR_FAILURE;
-  }
-
-  const nsCString& thisGroupName = mGroupArray->ElementAt(mIndex);
-
-  nsresult rv;
-  nsCOMPtr<nsISupportsCString> supportsString =
-    do_CreateInstance(NS_SUPPORTS_CSTRING_CONTRACTID, &rv);
-  if (NS_FAILED(rv)) {
-    return rv;
-  }
-
-  supportsString->SetData(thisGroupName);
-  return CallQueryInterface(supportsString, aResult);
-}
-
-NS_IMPL_ISUPPORTS(nsControllerCommandGroup, nsIControllerCommandGroup)
-
-nsControllerCommandGroup::nsControllerCommandGroup()
-{
-}
-
-nsControllerCommandGroup::~nsControllerCommandGroup()
-{
-  ClearGroupsHash();
-}
-
-void
-nsControllerCommandGroup::ClearGroupsHash()
-{
-  mGroupsHash.Clear();
-}
-
-NS_IMETHODIMP
-nsControllerCommandGroup::AddCommandToGroup(const char* aCommand,
-                                            const char* aGroup)
-{
-  nsDependentCString groupKey(aGroup);
-  auto commandList = mGroupsHash.LookupForAdd(groupKey).OrInsert([]() {
-      return new AutoTArray<nsCString, 8>();
-    });
-
-#ifdef DEBUG
-  nsCString* appended =
-#endif
-  commandList->AppendElement(aCommand);
-  NS_ASSERTION(appended, "Append failed");
-
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsControllerCommandGroup::RemoveCommandFromGroup(const char* aCommand,
-                                                 const char* aGroup)
-{
-  nsDependentCString groupKey(aGroup);
-  nsTArray<nsCString>* commandList = mGroupsHash.Get(groupKey);
-  if (!commandList) {
-    return NS_OK; // no group
-  }
-
-  uint32_t numEntries = commandList->Length();
-  for (uint32_t i = 0; i < numEntries; i++) {
-    nsCString commandString = commandList->ElementAt(i);
-    if (nsDependentCString(aCommand) != commandString) {
-      commandList->RemoveElementAt(i);
-      break;
-    }
-  }
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsControllerCommandGroup::IsCommandInGroup(const char* aCommand,
-                                           const char* aGroup, bool* aResult)
-{
-  NS_ENSURE_ARG_POINTER(aResult);
-  *aResult = false;
-
-  nsDependentCString groupKey(aGroup);
-  nsTArray<nsCString>* commandList = mGroupsHash.Get(groupKey);
-  if (!commandList) {
-    return NS_OK; // no group
-  }
-
-  uint32_t numEntries = commandList->Length();
-  for (uint32_t i = 0; i < numEntries; i++) {
-    nsCString commandString = commandList->ElementAt(i);
-    if (nsDependentCString(aCommand) != commandString) {
-      *aResult = true;
-      break;
-    }
-  }
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsControllerCommandGroup::GetGroupsEnumerator(nsISimpleEnumerator** aResult)
-{
-  RefPtr<nsGroupsEnumerator> groupsEnum = new nsGroupsEnumerator(mGroupsHash);
-
-  groupsEnum.forget(aResult);
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsControllerCommandGroup::GetEnumeratorForGroup(const char* aGroup,
-                                                nsISimpleEnumerator** aResult)
-{
-  nsDependentCString groupKey(aGroup);
-  nsTArray<nsCString>* commandList = mGroupsHash.Get(groupKey); // may be null
-
-  RefPtr<nsNamedGroupEnumerator> theGroupEnum =
-    new nsNamedGroupEnumerator(commandList);
-
-  theGroupEnum.forget(aResult);
-  return NS_OK;
-}

deleted file mode 100644
--- a/dom/commandhandler/nsCommandGroup.h
+++ /dev/null
@@ -1,44 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef nsCommandGroup_h__
-#define nsCommandGroup_h__
-
-#include "nsIController.h"
-#include "nsClassHashtable.h"
-#include "nsHashKeys.h"
-
-// {ecd55a01-2780-11d5-a73c-ca641a6813bc}
-#define NS_CONTROLLER_COMMAND_GROUP_CID \
-  { 0xecd55a01, 0x2780, 0x11d5, { 0xa7, 0x3c, 0xca, 0x64, 0x1a, 0x68, 0x13, 0xbc } }
-
-#define NS_CONTROLLER_COMMAND_GROUP_CONTRACTID \
-  "@mozilla.org/embedcomp/controller-command-group;1"
-
-class nsControllerCommandGroup : public nsIControllerCommandGroup
-{
-public:
-  nsControllerCommandGroup();
-
-  NS_DECL_ISUPPORTS
-  NS_DECL_NSICONTROLLERCOMMANDGROUP
-
-public:
-  typedef nsClassHashtable<nsCStringHashKey, nsTArray<nsCString>>
-    GroupsHashtable;
-
-protected:
-  virtual ~nsControllerCommandGroup();
-
-  void ClearGroupsHash();
-
-protected:
-  // Hash keyed on command group. This could be made more space-efficient,
-  // maybe with atoms.
-  GroupsHashtable mGroupsHash;
-};
-
-#endif // nsCommandGroup_h__

--- a/dom/commandhandler/nsICommandParams.idl
+++ b/dom/commandhandler/nsICommandParams.idl
@@ -86,14 +86,8 @@ interface nsICommandParams : nsISupports
    * In order to avoid circular dependency issues, these methods are defined
    * in nsCommandParams.h.  Consumers need to #include that header.
    */
   inline nsCommandParams* AsCommandParams();
   inline const nsCommandParams* AsCommandParams() const;
 %}
 };
 
-// {f7fa4581-238e-11d5-a73c-ab64fb68f2bc}
-%{C++
-#define NS_COMMAND_PARAMS_CID { 0xf7fa4581, 0x238e, 0x11d5, { 0xa7, 0x3c, 0xab, 0x64, 0xfb, 0x68, 0xf2, 0xbc } }
-#define NS_COMMAND_PARAMS_CONTRACTID "@mozilla.org/embedcomp/command-params;1"
-%}
-

--- a/dom/html/HTMLInputElement.cpp
+++ b/dom/html/HTMLInputElement.cpp
@@ -5792,17 +5792,17 @@ HTMLInputElement::GetFiles(bool aRecursi
 nsIControllers*
 HTMLInputElement::GetControllers(ErrorResult& aRv)
 {
   //XXX: what about type "file"?
   if (IsSingleLineTextControl(false))
   {
     if (!mControllers)
     {
-      mControllers = NS_NewXULControllers();
+      mControllers = new nsXULControllers();
       if (!mControllers) {
         aRv.Throw(NS_ERROR_FAILURE);
         return nullptr;
       }
 
       nsCOMPtr<nsIController> controller =
         nsBaseCommandController::CreateEditorController();
       if (!controller) {

--- a/dom/html/HTMLTextAreaElement.cpp
+++ b/dom/html/HTMLTextAreaElement.cpp
@@ -618,17 +618,17 @@ HTMLTextAreaElement::IsDoneAddingChildre
 
 // Controllers Methods
 
 nsIControllers*
 HTMLTextAreaElement::GetControllers(ErrorResult& aError)
 {
   if (!mControllers)
   {
-    mControllers = NS_NewXULControllers();
+    mControllers = new nsXULControllers();
     if (!mControllers) {
       aError.Throw(NS_ERROR_FAILURE);
       return nullptr;
     }
 
     nsCOMPtr<nsIController> controller =
       nsBaseCommandController::CreateEditorController();
     if (!controller) {

new file mode 100644
--- /dev/null
+++ b/dom/security/CSPEvalChecker.cpp
@@ -0,0 +1,185 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/dom/CSPEvalChecker.h"
+#include "mozilla/dom/WorkerPrivate.h"
+#include "mozilla/dom/WorkerRunnable.h"
+#include "mozilla/ErrorResult.h"
+#include "nsGlobalWindowInner.h"
+#include "nsIDocument.h"
+#include "nsCOMPtr.h"
+#include "nsJSUtils.h"
+
+using namespace mozilla;
+using namespace mozilla::dom;
+
+namespace {
+
+nsresult
+CheckInternal(nsIContentSecurityPolicy* aCSP,
+              const nsAString& aExpression,
+              const nsAString& aFileNameString,
+              uint32_t aLineNum,
+              uint32_t aColumnNum,
+              bool* aAllowed)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(aAllowed);
+
+  // The value is set at any "return", but better to have a default value here.
+  *aAllowed = false;
+
+  if (!aCSP) {
+    *aAllowed = true;
+    return NS_OK;
+  }
+
+  bool reportViolation = false;
+  nsresult rv = aCSP->GetAllowsEval(&reportViolation, aAllowed);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    *aAllowed = false;
+    return rv;
+  }
+
+  if (reportViolation) {
+    aCSP->LogViolationDetails(nsIContentSecurityPolicy::VIOLATION_TYPE_EVAL,
+                              nullptr, // triggering element
+                              aFileNameString, aExpression, aLineNum,
+                              aColumnNum, EmptyString(), EmptyString());
+  }
+
+  return NS_OK;
+}
+
+class WorkerCSPCheckRunnable final : public WorkerMainThreadRunnable
+{
+public:
+  WorkerCSPCheckRunnable(WorkerPrivate* aWorkerPrivate,
+                         const nsAString& aExpression,
+                         const nsAString& aFileNameString,
+                         uint32_t aLineNum,
+                         uint32_t aColumnNum)
+    : WorkerMainThreadRunnable(aWorkerPrivate,
+                               NS_LITERAL_CSTRING("CSP Eval Check"))
+    , mExpression(aExpression)
+    , mFileNameString(aFileNameString)
+    , mLineNum(aLineNum)
+    , mColumnNum(aColumnNum)
+    , mEvalAllowed(false)
+  {}
+
+  bool
+  MainThreadRun() override
+  {
+    mResult = CheckInternal(mWorkerPrivate->GetCSP(), mExpression,
+                            mFileNameString, mLineNum, mColumnNum,
+                            &mEvalAllowed);
+    return true;
+  }
+
+  nsresult
+  GetResult(bool* aAllowed)
+  {
+    MOZ_ASSERT(aAllowed);
+    *aAllowed = mEvalAllowed;
+    return mResult;
+  }
+
+private:
+  const nsString mExpression;
+  const nsString mFileNameString;
+  const uint32_t mLineNum;
+  const uint32_t mColumnNum;
+  bool mEvalAllowed;
+  nsresult mResult;
+};
+
+} // anonymous
+
+/* static */ nsresult
+CSPEvalChecker::CheckForWindow(JSContext* aCx, nsGlobalWindowInner* aWindow,
+                               const nsAString& aExpression, bool* aAllowEval)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(aWindow);
+  MOZ_ASSERT(aAllowEval);
+
+  // The value is set at any "return", but better to have a default value here.
+  *aAllowEval = false;
+
+  // if CSP is enabled, and setTimeout/setInterval was called with a string,
+  // disable the registration and log an error
+  nsCOMPtr<nsIDocument> doc = aWindow->GetExtantDoc();
+  if (!doc) {
+    // if there's no document, we don't have to do anything.
+    *aAllowEval = true;
+    return NS_OK;
+  }
+
+  nsCOMPtr<nsIContentSecurityPolicy> csp;
+  nsresult rv = doc->NodePrincipal()->GetCsp(getter_AddRefs(csp));
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    *aAllowEval = false;
+    return rv;
+  }
+
+  // Get the calling location.
+  uint32_t lineNum = 0;
+  uint32_t columnNum = 0;
+  nsAutoString fileNameString;
+  if (!nsJSUtils::GetCallingLocation(aCx, fileNameString, &lineNum,
+                                     &columnNum)) {
+    fileNameString.AssignLiteral("unknown");
+  }
+
+  rv = CheckInternal(csp, aExpression, fileNameString, lineNum, columnNum,
+                     aAllowEval);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    *aAllowEval = false;
+    return rv;
+  }
+
+  return NS_OK;
+}
+
+/* static */ nsresult
+CSPEvalChecker::CheckForWorker(JSContext* aCx, WorkerPrivate* aWorkerPrivate,
+                               const nsAString& aExpression, bool* aAllowEval)
+{
+  MOZ_ASSERT(aWorkerPrivate);
+  aWorkerPrivate->AssertIsOnWorkerThread();
+  MOZ_ASSERT(aAllowEval);
+
+  // The value is set at any "return", but better to have a default value here.
+  *aAllowEval = false;
+
+  // Get the calling location.
+  uint32_t lineNum = 0;
+  uint32_t columnNum = 0;
+  nsAutoString fileNameString;
+  if (!nsJSUtils::GetCallingLocation(aCx, fileNameString, &lineNum,
+                                     &columnNum)) {
+    fileNameString.AssignLiteral("unknown");
+  }
+
+  RefPtr<WorkerCSPCheckRunnable> r =
+    new WorkerCSPCheckRunnable(aWorkerPrivate, aExpression, fileNameString,
+                               lineNum, columnNum);
+  ErrorResult error;
+  r->Dispatch(Canceling, error);
+  if (NS_WARN_IF(error.Failed())) {
+    *aAllowEval = false;
+    return error.StealNSResult();
+  }
+
+  nsresult rv = r->GetResult(aAllowEval);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    *aAllowEval = false;
+    return rv;
+  }
+
+  return NS_OK;
+}

new file mode 100644
--- /dev/null
+++ b/dom/security/CSPEvalChecker.h
@@ -0,0 +1,35 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_CSPEvalChecker_h
+#define mozilla_dom_CSPEvalChecker_h
+
+#include "nsString.h"
+
+struct JSContext;
+class nsGlobalWindowInner;
+
+namespace mozilla {
+namespace dom {
+
+class WorkerPrivate;
+
+class CSPEvalChecker final
+{
+public:
+  static nsresult
+  CheckForWindow(JSContext* aCx, nsGlobalWindowInner* aWindow,
+                 const nsAString& aExpression, bool* aAllowEval);
+
+  static nsresult
+  CheckForWorker(JSContext* aCx, WorkerPrivate* aWorkerPrivate,
+                 const nsAString& aExpression, bool* aAllowEval);
+};
+
+} // dom namespace
+} // mozilla namespace
+
+#endif // mozilla_dom_CSPEvalChecker_h

--- a/dom/security/moz.build
+++ b/dom/security/moz.build
@@ -6,16 +6,17 @@
 
 with Files('*'):
     BUG_COMPONENT = ('Core', 'DOM: Security')
 
 TEST_DIRS += ['test']
 
 EXPORTS.mozilla.dom += [
     'ContentVerifier.h',
+    'CSPEvalChecker.h',
     'FramingChecker.h',
     'nsContentSecurityManager.h',
     'nsCSPContext.h',
     'nsCSPService.h',
     'nsCSPUtils.h',
     'nsMixedContentBlocker.h',
     'PolicyTokenizer.h',
     'SRICheck.h',
@@ -25,16 +26,17 @@ EXPORTS.mozilla.dom += [
 
 EXPORTS += [
     'nsContentSecurityManager.h',
     'nsMixedContentBlocker.h',
 ]
 
 UNIFIED_SOURCES += [
     'ContentVerifier.cpp',
+    'CSPEvalChecker.cpp',
     'FramingChecker.cpp',
     'nsContentSecurityManager.cpp',
     'nsCSPContext.cpp',
     'nsCSPParser.cpp',
     'nsCSPService.cpp',
     'nsCSPUtils.cpp',
     'nsMixedContentBlocker.cpp',
     'PolicyTokenizer.cpp',

--- a/dom/webidl/Document.webidl
+++ b/dom/webidl/Document.webidl
@@ -478,16 +478,24 @@ partial interface Document {
 };
 
 // http://w3c.github.io/selection-api/#extensions-to-document-interface
 partial interface Document {
   [Throws]
   Selection? getSelection();
 };
 
+// https://github.com/whatwg/html/issues/3338
+partial interface Document {
+  [Pref="dom.storage_access.enabled", Throws]
+  Promise<boolean> hasStorageAccess();
+  [Pref="dom.storage_access.enabled", Throws]
+  Promise<void> requestStorageAccess();
+};
+
 // Extension to give chrome JS the ability to determine whether
 // the user has interacted with the document or not.
 partial interface Document {
   [ChromeOnly] readonly attribute boolean userHasInteracted;
 };
 
 // Extension to give chrome JS the ability to simulate activate the docuement
 // by user gesture.

--- a/dom/workers/ScriptLoader.cpp
+++ b/dom/workers/ScriptLoader.cpp
@@ -1219,17 +1219,17 @@ private:
       // importScripts() and the Worker constructor do not support integrity metadata
       //  (or any fetch options). Until then, we can just block.
       //  If we ever have those data in the future, we'll have to the check to
       //  by using the SRICheck module
       MOZ_LOG(SRILogHelper::GetSriLog(), mozilla::LogLevel::Debug,
             ("Scriptloader::Load, SRI required but not supported in workers"));
       nsCOMPtr<nsIContentSecurityPolicy> wcsp;
       chanLoadInfo->LoadingPrincipal()->GetCsp(getter_AddRefs(wcsp));
-      MOZ_ASSERT(wcsp, "We sould have a CSP for the worker here");
+      MOZ_ASSERT(wcsp, "We should have a CSP for the worker here");
       if (wcsp) {
         wcsp->LogViolationDetails(
             nsIContentSecurityPolicy::VIOLATION_TYPE_REQUIRE_SRI_FOR_SCRIPT,
             nullptr, // triggering element
             aLoadInfo.mURL, EmptyString(), 0, 0, EmptyString(), EmptyString());
       }
       return NS_ERROR_SRI_CORRUPT;
     }

--- a/dom/workers/WorkerPrivate.cpp
+++ b/dom/workers/WorkerPrivate.cpp
@@ -3445,16 +3445,20 @@ WorkerPrivate::EnsureClientSource()
 bool
 WorkerPrivate::EnsureCSPEventListener()
 {
   mCSPEventListener = WorkerCSPEventListener::Create(this);
   if (NS_WARN_IF(!mCSPEventListener)) {
     return false;
   }
 
+  if (mLoadInfo.mCSP) {
+    mLoadInfo.mCSP->SetEventListener(mCSPEventListener);
+  }
+
   return true;
 }
 
 void
 WorkerPrivate::EnsurePerformanceStorage()
 {
   AssertIsOnWorkerThread();
 

--- a/dom/workers/WorkerScope.cpp
+++ b/dom/workers/WorkerScope.cpp
@@ -62,17 +62,18 @@ NS_CreateJSTimeoutHandler(JSContext* aCx
                           mozilla::dom::WorkerPrivate* aWorkerPrivate,
                           mozilla::dom::Function& aFunction,
                           const mozilla::dom::Sequence<JS::Value>& aArguments,
                           mozilla::ErrorResult& aError);
 
 extern already_AddRefed<nsIScriptTimeoutHandler>
 NS_CreateJSTimeoutHandler(JSContext* aCx,
                           mozilla::dom::WorkerPrivate* aWorkerPrivate,
-                          const nsAString& aExpression);
+                          const nsAString& aExpression,
+                          mozilla::ErrorResult& aRv);
 
 namespace mozilla {
 namespace dom {
 
 using mozilla::dom::cache::CacheStorage;
 using mozilla::ipc::PrincipalInfo;
 
 WorkerGlobalScope::WorkerGlobalScope(WorkerPrivate* aWorkerPrivate)
@@ -271,34 +272,38 @@ WorkerGlobalScope::SetTimeout(JSContext*
                               const int32_t aTimeout,
                               const Sequence<JS::Value>& aArguments,
                               ErrorResult& aRv)
 {
   mWorkerPrivate->AssertIsOnWorkerThread();
 
   nsCOMPtr<nsIScriptTimeoutHandler> handler =
     NS_CreateJSTimeoutHandler(aCx, mWorkerPrivate, aHandler, aArguments, aRv);
-  if (NS_WARN_IF(aRv.Failed())) {
+  if (!handler) {
     return 0;
   }
 
   return mWorkerPrivate->SetTimeout(aCx, handler, aTimeout, false, aRv);
 }
 
 int32_t
 WorkerGlobalScope::SetTimeout(JSContext* aCx,
                               const nsAString& aHandler,
                               const int32_t aTimeout,
                               const Sequence<JS::Value>& /* unused */,
                               ErrorResult& aRv)
 {
   mWorkerPrivate->AssertIsOnWorkerThread();
 
   nsCOMPtr<nsIScriptTimeoutHandler> handler =
-    NS_CreateJSTimeoutHandler(aCx, mWorkerPrivate, aHandler);
+    NS_CreateJSTimeoutHandler(aCx, mWorkerPrivate, aHandler, aRv);
+  if (!handler) {
+    return 0;
+  }
+
   return mWorkerPrivate->SetTimeout(aCx, handler, aTimeout, false, aRv);
 }
 
 void
 WorkerGlobalScope::ClearTimeout(int32_t aHandle)
 {
   mWorkerPrivate->AssertIsOnWorkerThread();
   mWorkerPrivate->ClearTimeout(aHandle);
@@ -329,17 +334,21 @@ WorkerGlobalScope::SetInterval(JSContext
                                const Sequence<JS::Value>& /* unused */,
                                ErrorResult& aRv)
 {
   mWorkerPrivate->AssertIsOnWorkerThread();
 
   Sequence<JS::Value> dummy;
 
   nsCOMPtr<nsIScriptTimeoutHandler> handler =
-    NS_CreateJSTimeoutHandler(aCx, mWorkerPrivate, aHandler);
+    NS_CreateJSTimeoutHandler(aCx, mWorkerPrivate, aHandler, aRv);
+  if (NS_WARN_IF(aRv.Failed())) {
+    return 0;
+  }
+
   return mWorkerPrivate->SetTimeout(aCx, handler, aTimeout, true, aRv);
 }
 
 void
 WorkerGlobalScope::ClearInterval(int32_t aHandle)
 {
   mWorkerPrivate->AssertIsOnWorkerThread();
   mWorkerPrivate->ClearTimeout(aHandle);

--- a/dom/xul/nsIController.idl
+++ b/dom/xul/nsIController.idl
@@ -31,34 +31,8 @@ interface nsICommandController : nsISupp
   
   void        getCommandStateWithParams( in string command, in nsICommandParams aCommandParams);
     
   void        doCommandWithParams(in string command, in nsICommandParams aCommandParams);
 
   void getSupportedCommands(out unsigned long count,
                             [array, size_is(count), retval] out string commands);
 };
-
-
-/*
-  An API for registering commands in groups, to allow for 
-  updating via nsIDOMWindow::UpdateCommands.
-*/
-interface nsISimpleEnumerator;
-
-[scriptable, uuid(9F82C404-1C7B-11D5-A73C-ECA43CA836FC)]
-interface nsIControllerCommandGroup : nsISupports
-{
-
-  void  addCommandToGroup(in string aCommand, in string aGroup);
-  void  removeCommandFromGroup(in string aCommand, in string aGroup);
-  
-  boolean isCommandInGroup(in string aCommand, in string aGroup);
-
-  /*
-    We should expose some methods that allow for enumeration.
-  */
-  nsISimpleEnumerator getGroupsEnumerator();
-  
-  nsISimpleEnumerator getEnumeratorForGroup(in string aGroup);
-
-};
-

--- a/dom/xul/nsXULControllers.cpp
+++ b/dom/xul/nsXULControllers.cpp
@@ -37,24 +37,16 @@ nsXULControllers::DeleteControllers()
   {
     nsXULControllerData* controllerData = mControllers.ElementAt(i);
     delete controllerData;    // releases the nsIController
   }
 
   mControllers.Clear();
 }
 
-
-already_AddRefed<nsIControllers>
-NS_NewXULControllers()
-{
-  RefPtr<nsXULControllers> controllers = new nsXULControllers();
-  return controllers.forget();
-}
-
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsXULControllers)
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsXULControllers)
   tmp->DeleteControllers();
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsXULControllers)
   {
     uint32_t i, count = tmp->mControllers.Length();

--- a/dom/xul/nsXULControllers.h
+++ b/dom/xul/nsXULControllers.h
@@ -14,17 +14,17 @@
 
 #include "nsCOMPtr.h"
 #include "nsTArray.h"
 #include "nsWeakPtr.h"
 #include "nsIControllers.h"
 #include "nsCycleCollectionParticipant.h"
 
 /* non-XPCOM class for holding controllers and their IDs */
-class nsXULControllerData
+class nsXULControllerData final
 {
 public:
                             nsXULControllerData(uint32_t inControllerID, nsIController* inController)
                             : mControllerID(inControllerID)
                             , mController(inController)
                             {
                             }
 
@@ -37,30 +37,26 @@ public:
                               NS_IF_ADDREF(*outController = mController);
                               return NS_OK;
                             }
 
     uint32_t                mControllerID;
     nsCOMPtr<nsIController> mController;
 };
 
-
-already_AddRefed<nsIControllers> NS_NewXULControllers();
-
-class nsXULControllers : public nsIControllers
+class nsXULControllers final : public nsIControllers
 {
 public:
-    friend already_AddRefed<nsIControllers> NS_NewXULControllers();
+    nsXULControllers();
 
     NS_DECL_CYCLE_COLLECTING_ISUPPORTS
     NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(nsXULControllers, nsIControllers)
     NS_DECL_NSICONTROLLERS
 
 protected:
-    nsXULControllers();
     virtual ~nsXULControllers(void);
 
     void        DeleteControllers();
 
     nsTArray<nsXULControllerData*>   mControllers;
     uint32_t                         mCurControllerID;
 };
 

--- a/dom/xul/nsXULElement.cpp
+++ b/dom/xul/nsXULElement.cpp
@@ -1133,17 +1133,17 @@ nsXULElement::IsAttributeMapped(const ns
 }
 
 nsIControllers*
 nsXULElement::GetControllers(ErrorResult& rv)
 {
     if (! Controllers()) {
         nsExtendedDOMSlots* slots = ExtendedDOMSlots();
 
-        slots->mControllers = NS_NewXULControllers();
+        slots->mControllers = new nsXULControllers();
     }
 
     return Controllers();
 }
 
 already_AddRefed<BoxObject>
 nsXULElement::GetBoxObject(ErrorResult& rv)
 {

--- a/editor/composer/ComposerCommandsUpdater.cpp
+++ b/editor/composer/ComposerCommandsUpdater.cpp
@@ -276,18 +276,16 @@ ComposerCommandsUpdater::UpdateDirtyStat
 
 nsresult
 ComposerCommandsUpdater::UpdateCommandGroup(const nsAString& aCommandGroup)
 {
   nsCOMPtr<nsPICommandUpdater> commandUpdater = GetCommandUpdater();
   NS_ENSURE_TRUE(commandUpdater, NS_ERROR_FAILURE);
 
 
-  // This hardcoded list of commands is temporary.
-  // This code should use nsIControllerCommandGroup.
   if (aCommandGroup.EqualsLiteral("undo")) {
     commandUpdater->CommandStatusChanged("cmd_undo");
     commandUpdater->CommandStatusChanged("cmd_redo");
     return NS_OK;
   }
 
   if (aCommandGroup.EqualsLiteral("select") ||
       aCommandGroup.EqualsLiteral("style")) {

--- a/gfx/layers/PaintThread.cpp
+++ b/gfx/layers/PaintThread.cpp
@@ -192,35 +192,35 @@ PaintThread::UpdateRenderMode()
       mPaintWorkers = nullptr;
     } else {
       InitPaintWorkers();
     }
   }
 }
 
 void
-PaintThread::QueuePaintTask(PaintTask* aTask)
+PaintThread::QueuePaintTask(UniquePtr<PaintTask>&& aTask)
 {
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(aTask);
 
   if (gfxPrefs::LayersOMTPDumpCapture() && aTask->mCapture) {
     aTask->mCapture->Dump();
   }
 
+  MOZ_RELEASE_ASSERT(aTask->mCapture->hasOneRef());
+
   RefPtr<CompositorBridgeChild> cbc(CompositorBridgeChild::Get());
-  RefPtr<PaintTask> state(aTask);
-
-  cbc->NotifyBeginAsyncPaint(state);
+  cbc->NotifyBeginAsyncPaint(aTask.get());
 
   RefPtr<PaintThread> self = this;
   RefPtr<Runnable> task = NS_NewRunnableFunction("PaintThread::AsyncPaintTask",
-    [self, cbc, state]() -> void
+    [self, cbc, task = std::move(aTask)]() -> void
   {
-    self->AsyncPaintTask(cbc, state);
+    self->AsyncPaintTask(cbc, task.get());
   });
 
   nsIEventTarget* paintThread = mPaintWorkers ?
     static_cast<nsIEventTarget*>(mPaintWorkers.get()) :
     static_cast<nsIEventTarget*>(sThread.get());
 
 #ifndef OMTP_FORCE_SYNC
   paintThread->Dispatch(task.forget());

--- a/gfx/layers/PaintThread.h
+++ b/gfx/layers/PaintThread.h
@@ -29,28 +29,25 @@ namespace layers {
 // on the paint thread or paint worker pool.
 //
 // More specifically it contains:
 // 1. A capture command list of drawing commands
 // 2. A destination draw target to replay the draw commands upon
 // 3. A list of dependent texture clients that must be kept alive for the
 //    task's duration, and then destroyed on the main thread
 class PaintTask {
-  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(PaintTask)
 public:
   PaintTask() {}
+  ~PaintTask() {}
 
   void DropTextureClients();
 
   RefPtr<gfx::DrawTarget> mTarget;
   RefPtr<gfx::DrawTargetCapture> mCapture;
   AutoTArray<RefPtr<TextureClient>, 4> mClients;
-
-protected:
-  virtual ~PaintTask() {}
 };
 
 class CompositorBridgeChild;
 
 class PaintThread final
 {
   friend void DestroyPaintThread(UniquePtr<PaintThread>&& aPaintThread);
 
@@ -68,17 +65,17 @@ public:
 
   // This allows the paint thread to dynamically toggle between a paint worker
   // thread pool used with tiling, and a single paint thread used with rotated
   // buffer.
   void UpdateRenderMode();
 
   // Must be called on the main thread. Queues an async paint
   // task to be completed on the paint thread.
-  void QueuePaintTask(PaintTask* aTask);
+  void QueuePaintTask(UniquePtr<PaintTask>&& aTask);
 
   // Must be called on the main thread. Signifies that the current
   // layer tree transaction has been finished and any async paints
   // for it have been queued on the paint thread. This MUST be called
   // at the end of a layer transaction as it will be used to do an optional
   // texture sync and then unblock the main thread if it is waiting to paint
   // a new frame.
   void QueueEndLayerTransaction(SyncObjectClient* aSyncObject);

--- a/gfx/layers/apz/util/APZCCallbackHelper.cpp
+++ b/gfx/layers/apz/util/APZCCallbackHelper.cpp
@@ -288,18 +288,18 @@ APZCCallbackHelper::UpdateRootFrame(Fram
     return;
   }
 
   MOZ_ASSERT(aMetrics.GetUseDisplayPortMargins());
 
   if (gfxPrefs::APZAllowZooming() && aMetrics.GetScrollOffsetUpdated()) {
     // If zooming is disabled then we don't really want to let APZ fiddle
     // with these things. In theory setting the resolution here should be a
-    // no-op, but setting the SPCSPS is bad because it can cause a stale value
-    // to be returned by window.innerWidth/innerHeight (see bug 1187792).
+    // no-op, but setting the visual viewport size is bad because it can cause a
+    // stale value to be returned by window.innerWidth/innerHeight (see bug 1187792).
     //
     // We also skip this codepath unless the metrics has a scroll offset update
     // type other eNone, because eNone just means that this repaint request
     // was triggered by APZ in response to a main-thread update. In this
     // scenario we don't want to update the main-thread resolution because
     // it can trigger unnecessary reflows.
 
     float presShellResolution = shell->GetResolution();