--- a/accessible/src/base/NotificationController.cpp
+++ b/accessible/src/base/NotificationController.cpp
@@ -53,18 +53,16 @@ NotificationController::~NotificationCon
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // NotificationCollector: AddRef/Release and cycle collection
 
 NS_IMPL_CYCLE_COLLECTING_NATIVE_ADDREF(NotificationController)
 NS_IMPL_CYCLE_COLLECTING_NATIVE_RELEASE(NotificationController)
 
-NS_IMPL_CYCLE_COLLECTION_NATIVE_CLASS(NotificationController)
-
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(NotificationController)
   if (tmp->mDocument)
     tmp->Shutdown();
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(NotificationController)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mDocument)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mHangingChildDocuments)
@@ -860,26 +858,18 @@ NotificationController::ContentInsertion
     }
 
     node = node->GetNextSibling();
   }
 
   return haveToUpdate;
 }
 
-NS_IMPL_CYCLE_COLLECTION_NATIVE_CLASS(NotificationController::ContentInsertion)
-
-NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(NotificationController::ContentInsertion)
-  NS_IMPL_CYCLE_COLLECTION_UNLINK(mContainer)
-NS_IMPL_CYCLE_COLLECTION_UNLINK_END
-
-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(NotificationController::ContentInsertion)
-  NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mContainer");
-  cb.NoteXPCOMChild(static_cast<nsIAccessible*>(tmp->mContainer.get()));
-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+NS_IMPL_CYCLE_COLLECTION_1(NotificationController::ContentInsertion,
+                           mContainer)
 
 NS_IMPL_CYCLE_COLLECTION_ROOT_NATIVE(NotificationController::ContentInsertion,
                                      AddRef)
 NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(NotificationController::ContentInsertion,
                                        Release)
 
 void
 NotificationController::ContentInsertion::Process()

--- a/accessible/src/generic/DocAccessible.cpp
+++ b/accessible/src/generic/DocAccessible.cpp
@@ -99,18 +99,16 @@ DocAccessible::~DocAccessible()
 {
   NS_ASSERTION(!mPresShell, "LastRelease was never called!?!");
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsISupports
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(DocAccessible)
-
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(DocAccessible, Accessible)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mDocumentNode)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mNotificationController)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mVirtualCursor)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mChildDocuments)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mAccessibleCache)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 

--- a/accessible/src/msaa/HyperTextAccessibleWrap.cpp
+++ b/accessible/src/msaa/HyperTextAccessibleWrap.cpp
@@ -4,19 +4,27 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "HyperTextAccessibleWrap.h"
 
 #include "nsEventShell.h"
 
+#include "mozilla/StaticPtr.h"
+
 using namespace mozilla;
 using namespace mozilla::a11y;
 
+StaticRefPtr<Accessible> HyperTextAccessibleWrap::sLastTextChangeAcc;
+StaticAutoPtr<nsString> HyperTextAccessibleWrap::sLastTextChangeString;
+uint32_t HyperTextAccessibleWrap::sLastTextChangeStart = 0;
+uint32_t HyperTextAccessibleWrap::sLastTextChangeEnd = 0;
+bool HyperTextAccessibleWrap::sLastTextChangeWasInsert = false;
+
 NS_IMPL_ISUPPORTS_INHERITED0(HyperTextAccessibleWrap,
                              HyperTextAccessible)
 
 STDMETHODIMP
 HyperTextAccessibleWrap::QueryInterface(REFIID aIID, void** aInstancePtr)
 {
   if (!aInstancePtr)
     return E_FAIL;
@@ -44,55 +52,50 @@ HyperTextAccessibleWrap::QueryInterface(
 nsresult
 HyperTextAccessibleWrap::HandleAccEvent(AccEvent* aEvent)
 {
   uint32_t eventType = aEvent->GetEventType();
 
   if (eventType == nsIAccessibleEvent::EVENT_TEXT_REMOVED ||
       eventType == nsIAccessibleEvent::EVENT_TEXT_INSERTED) {
     Accessible* accessible = aEvent->GetAccessible();
-    if (accessible) {
-      nsCOMPtr<nsIWinAccessNode> winAccessNode(do_QueryObject(accessible));
-      if (winAccessNode) {
-        void *instancePtr = NULL;
-        nsresult rv = winAccessNode->QueryNativeInterface(IID_IAccessibleText,
-                                                          &instancePtr);
-        if (NS_SUCCEEDED(rv)) {
-          NS_IF_RELEASE(gTextEvent);
-          NS_IF_ADDREF(gTextEvent = downcast_accEvent(aEvent));
+    if (accessible && accessible->IsHyperText()) {
+      sLastTextChangeAcc = accessible;
+      if (!sLastTextChangeString)
+        sLastTextChangeString = new nsString();
 
-          (static_cast<IUnknown*>(instancePtr))->Release();
-        }
-      }
+      AccTextChangeEvent* event = downcast_accEvent(aEvent);
+      event->GetModifiedText(*sLastTextChangeString);
+      sLastTextChangeStart = event->GetStartOffset();
+      sLastTextChangeEnd = sLastTextChangeStart + event->GetLength();
+      sLastTextChangeWasInsert = event->IsTextInserted();
     }
   }
 
   return HyperTextAccessible::HandleAccEvent(aEvent);
 }
 
 nsresult
 HyperTextAccessibleWrap::GetModifiedText(bool aGetInsertedText,
                                          nsAString& aText,
                                          uint32_t* aStartOffset,
                                          uint32_t* aEndOffset)
 {
   aText.Truncate();
   *aStartOffset = 0;
   *aEndOffset = 0;
 
-  if (!gTextEvent)
+  if (!sLastTextChangeAcc)
     return NS_OK;
 
-  bool isInserted = gTextEvent->IsTextInserted();
-  if (aGetInsertedText != isInserted)
+  if (aGetInsertedText != sLastTextChangeWasInsert)
     return NS_OK;
 
-  Accessible* targetAcc = gTextEvent->GetAccessible();
-  if (targetAcc != this)
+  if (sLastTextChangeAcc != this)
     return NS_OK;
 
-  *aStartOffset = gTextEvent->GetStartOffset();
-  *aEndOffset = *aStartOffset + gTextEvent->GetLength();
-  gTextEvent->GetModifiedText(aText);
+  *aStartOffset = sLastTextChangeStart;
+  *aEndOffset = sLastTextChangeEnd;
+  aText.Append(*sLastTextChangeString);
 
   return NS_OK;
 }
 

--- a/accessible/src/msaa/HyperTextAccessibleWrap.h
+++ b/accessible/src/msaa/HyperTextAccessibleWrap.h
@@ -8,16 +8,19 @@
 #ifndef mozilla_a11y_HyperTextAccessibleWrap_h__
 #define mozilla_a11y_HyperTextAccessibleWrap_h__
 
 #include "HyperTextAccessible.h"
 #include "ia2AccessibleEditableText.h"
 #include "ia2AccessibleHypertext.h"
 
 namespace mozilla {
+template<class T> class StaticAutoPtr;
+template<class T> class StaticRefPtr;
+
 namespace a11y {
 
 class HyperTextAccessibleWrap : public HyperTextAccessible,
                                 public ia2AccessibleHypertext,
                                 public ia2AccessibleEditableText
 {
 public:
   HyperTextAccessibleWrap(nsIContent* aContent, DocAccessible* aDoc) :
@@ -31,14 +34,22 @@ public:
 
   // Accessible
   virtual nsresult HandleAccEvent(AccEvent* aEvent);
 
 protected:
   virtual nsresult GetModifiedText(bool aGetInsertedText, nsAString& aText,
                                    uint32_t *aStartOffset,
                                    uint32_t *aEndOffset);
+
+  static StaticRefPtr<Accessible> sLastTextChangeAcc;
+  static StaticAutoPtr<nsString> sLastTextChangeString;
+  static bool sLastTextChangeWasInsert;
+  static uint32_t sLastTextChangeStart;
+  static uint32_t sLastTextChangeEnd;
+
+  friend void PlatformInit();
 };
 
 } // namespace a11y
 } // namespace mozilla
 
 #endif

--- a/accessible/src/msaa/Platform.cpp
+++ b/accessible/src/msaa/Platform.cpp
@@ -3,31 +3,34 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "Platform.h"
 
 #include "AccEvent.h"
 #include "Compatibility.h"
-#include "nsAccessNodeWrap.h"
+#include "HyperTextAccessibleWrap.h"
 #include "nsWinUtils.h"
 
+#include "mozilla/ClearOnShutdown.h"
+
 using namespace mozilla;
 using namespace mozilla::a11y;
 
 void
 a11y::PlatformInit()
 {
   Compatibility::Init();
 
   nsWinUtils::MaybeStartWindowEmulation();
+  ClearOnShutdown(&HyperTextAccessibleWrap::sLastTextChangeAcc);
+  ClearOnShutdown(&HyperTextAccessibleWrap::sLastTextChangeString);
 }
 
 void
 a11y::PlatformShutdown()
 {
-  NS_IF_RELEASE(nsAccessNodeWrap::gTextEvent);
   ::DestroyCaret();
 
   nsWinUtils::ShutdownWindowEmulation();
 }
 

--- a/accessible/src/msaa/nsAccessNodeWrap.cpp
+++ b/accessible/src/msaa/nsAccessNodeWrap.cpp
@@ -22,18 +22,16 @@
 #include "nsIDOMHTMLElement.h"
 #include "nsINameSpaceManager.h"
 #include "nsPIDOMWindow.h"
 #include "nsIServiceManager.h"
 
 using namespace mozilla;
 using namespace mozilla::a11y;
 
-AccTextChangeEvent* nsAccessNodeWrap::gTextEvent = nullptr;
-
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessNodeWrap
 ////////////////////////////////////////////////////////////////////////////////
 
 nsAccessNodeWrap::
   nsAccessNodeWrap(nsIContent* aContent, DocAccessible* aDoc) :
   nsAccessNode(aContent, aDoc)
 {

--- a/accessible/src/msaa/nsAccessNodeWrap.h
+++ b/accessible/src/msaa/nsAccessNodeWrap.h
@@ -42,18 +42,16 @@
   } MOZ_SEH_EXCEPT(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(),       \
                                                           GetExceptionInformation())) \
   { }                                                                                 \
   return E_FAIL;
 
 namespace mozilla {
 namespace a11y {
 
-class AccTextChangeEvent;
-
 #ifdef __GNUC__
 // Inheriting from both XPCOM and MSCOM interfaces causes a lot of warnings
 // about virtual functions being hidden by each other. This is done by
 // design, so silence the warning.
 #pragma GCC diagnostic ignored "-Woverloaded-virtual"
 #endif
 
 class nsAccessNodeWrap : public nsAccessNode,
@@ -78,25 +76,16 @@ public: // construction, destruction
                                                  void** aInstancePtr);
 
     static int FilterA11yExceptions(unsigned int aCode, EXCEPTION_POINTERS *aExceptionInfo);
 
   static LRESULT CALLBACK WindowProc(HWND hWnd, UINT Msg,
                                      WPARAM WParam, LPARAM lParam);
 
   static nsRefPtrHashtable<nsPtrHashKey<void>, DocAccessible> sHWNDCache;
-
-protected:
-
-  /**
-   * It is used in HyperTextAccessibleWrap for IA2::newText/oldText
-   * implementation.
-   */
-  static AccTextChangeEvent* gTextEvent;
-  friend void PlatformShutdown();
 };
 
 } // namespace a11y
 } // namespace mozilla
 
 /**
  * Converts nsresult to HRESULT.
  */

--- a/aclocal.m4
+++ b/aclocal.m4
@@ -21,16 +21,17 @@ builtin(include, build/autoconf/gcc-pr39
 builtin(include, build/autoconf/llvm-pr8927.m4)dnl
 builtin(include, build/autoconf/frameptr.m4)dnl
 builtin(include, build/autoconf/compiler-opts.m4)dnl
 builtin(include, build/autoconf/expandlibs.m4)dnl
 builtin(include, build/autoconf/arch.m4)dnl
 builtin(include, build/autoconf/android.m4)dnl
 builtin(include, build/autoconf/zlib.m4)dnl
 builtin(include, build/autoconf/linux.m4)dnl
+builtin(include, build/autoconf/python-virtualenv.m4)dnl
 
 MOZ_PROG_CHECKMSYS()
 
 # Read the user's .mozconfig script.  We can't do this in
 # configure.in: autoconf puts the argument parsing code above anything
 # expanded from configure.in, and we need to get the configure options
 # from .mozconfig in place before that argument parsing code.
 MOZ_READ_MOZCONFIG(.)

--- a/b2g/chrome/content/shell.js
+++ b/b2g/chrome/content/shell.js
@@ -734,17 +734,18 @@ var AlertsHelper = {
     function send(appName, appIcon) {
       shell.sendChromeEvent({
         type: "desktop-notification",
         id: uid,
         icon: imageUrl,
         title: title,
         text: text,
         appName: appName,
-        appIcon: appIcon
+        appIcon: appIcon,
+        manifestURL: manifestUrl
       });
     }
 
     if (!manifestUrl || !manifestUrl.length) {
       send(null, null);
     }
 
     // If we have a manifest URL, get the icon and title from the manifest

--- a/b2g/confvars.sh
+++ b/b2g/confvars.sh
@@ -5,17 +5,17 @@
 MOZ_APP_BASENAME=B2G
 MOZ_APP_VENDOR=Mozilla
 
 MOZ_APP_VERSION=21.0a1
 MOZ_APP_UA_NAME=Firefox
 
 MOZ_UA_OS_AGNOSTIC=1
 
-MOZ_B2G_VERSION=1.0.0-prerelease
+MOZ_B2G_VERSION=1.0.0.0-prerelease
 MOZ_B2G_OS_NAME=Boot2Gecko
 
 MOZ_BRANDING_DIRECTORY=b2g/branding/unofficial
 MOZ_OFFICIAL_BRANDING_DIRECTORY=b2g/branding/official
 # MOZ_APP_DISPLAYNAME is set by branding/configure.sh
 
 MOZ_SAFE_BROWSING=
 MOZ_SERVICES_COMMON=1

new file mode 100644
--- /dev/null
+++ b/b2g/test/b2g-unittest-requirements.txt
@@ -0,0 +1,2 @@
+mozprocess==0.8
+mozdevice==0.18

--- a/browser/base/content/browser-social.js
+++ b/browser/base/content/browser-social.js
@@ -964,18 +964,21 @@ var SocialToolbar = {
           dynamicResizer.start(panel, notificationFrame);
           setTimeout(function() {
             dispatchPanelEvent("socialFrameShow");
           }, 0);
         }, true);
       }
     });
 
-    let toolbarButtonIcon = document.getAnonymousElementByAttribute(aToolbarButton, "class", "toolbarbutton-icon");
-    panel.openPopup(toolbarButtonIcon, "bottomcenter topright", 0, 0, false, false);
+    let navBar = document.getElementById("nav-bar");
+    let anchor = navBar.getAttribute("mode") == "text" ?
+                   document.getAnonymousElementByAttribute(aToolbarButton, "class", "toolbarbutton-text") :
+                   document.getAnonymousElementByAttribute(aToolbarButton, "class", "toolbarbutton-icon");
+    panel.openPopup(anchor, "bottomcenter topright", 0, 0, false, false);
   },
 
   setPanelErrorMessage: function SocialToolbar_setPanelErrorMessage(aNotificationFrame) {
     if (!aNotificationFrame)
       return;
 
     let src = aNotificationFrame.getAttribute("src");
     aNotificationFrame.removeAttribute("src");

--- a/browser/components/downloads/content/allDownloadsViewOverlay.js
+++ b/browser/components/downloads/content/allDownloadsViewOverlay.js
@@ -36,16 +36,32 @@ const DOWNLOAD_VIEW_SUPPORTED_COMMANDS =
  ["cmd_delete", "cmd_copy", "cmd_paste", "cmd_selectAll",
   "downloadsCmd_pauseResume", "downloadsCmd_cancel",
   "downloadsCmd_open", "downloadsCmd_show", "downloadsCmd_retry",
   "downloadsCmd_openReferrer", "downloadsCmd_clearDownloads"];
 
 const NOT_AVAILABLE = Number.MAX_VALUE;
 
 /**
+ * Download a URL.
+ *
+ * @param aURL
+ *        the url to download (nsIURI object)
+ * @param [optional] aFileName
+ *        the destination file name
+ */
+function DownloadURL(aURL, aFileName) {
+  // For private browsing, try to get document out of the most recent browser
+  // window, or provide our own if there's no browser window.
+  let browserWin = RecentWindow.getMostRecentBrowserWindow();
+  let initiatingDoc = browserWin ? browserWin.document : document;
+  saveURL(aURL, aFileName, null, true, true, undefined, initiatingDoc);
+}
+
+/**
  * A download element shell is responsible for handling the commands and the
  * displayed data for a single download view element. The download element
  * could represent either a past download (for which we get data from places)  or
  * a "session" download (using a data-item object. See DownloadsCommon.jsm), or both.
  *
  * Once initialized with either a data item or a places node, the created richlistitem
  * can be accessed through the |element| getter, and can then be inserted/removed from
  * a richlistbox.
@@ -155,17 +171,17 @@ DownloadElementShell.prototype = {
 
   get _downloadURIObj() {
     if (!("__downloadURIObj" in this))
       this.__downloadURIObj = NetUtil.newURI(this.downloadURI);
     return this.__downloadURIObj;
   },
 
   _getIcon: function DES__getIcon() {
-    let metaData = this._getDownloadMetaData();
+    let metaData = this.getDownloadMetaData();
     if ("filePath" in metaData)
       return "moz-icon://" + metaData.filePath + "?size=32";
 
     if (this._placesNode) {
       // Try to extract an extension from the uri.
       let ext = this._downloadURIObj.QueryInterface(Ci.nsIURL).fileExtension;
       if (ext)
         return "moz-icon://." + ext + "?size=32";
@@ -208,17 +224,17 @@ DownloadElementShell.prototype = {
   },
 
   _fetchTargetFileInfo: function DES__fetchTargetFileInfo(aUpdateMetaDataAndStatusUI = false) {
     if (this._targetFileInfoFetched)
       throw new Error("_fetchTargetFileInfo should not be called if the information was already fetched");
     if (!this.active)
       throw new Error("Trying to _fetchTargetFileInfo on an inactive download shell");
 
-    let path = this._getDownloadMetaData().filePath;
+    let path = this.getDownloadMetaData().filePath;
 
     // In previous version, the target file annotations were not set,
     // so we cannot tell where is the file.
     if (path === undefined) {
       this._targetFileInfoFetched = true;
       this._targetFileExists = false;
       if (aUpdateMetaDataAndStatusUI) {
         this._metaData = null;
@@ -280,34 +296,34 @@ DownloadElementShell.prototype = {
    *
    * - state - any download state defined in nsIDownloadManager.  If this field
    *   is not set, the download state is unknown.
    * - endTime: the end time of the download.
    * - filePath: the downloaded file path on the file system, when it
    *   was downloaded.  The file may not exist.  This is set for session
    *   downloads that have a local file set, and for history downloads done
    *   after the landing of bug 591289.
+   * - fileName: the downloaded file name on the file system. Set if filePath
+   *   is set.
    * - displayName: the user-facing label for the download.  This is always
    *   set.  If available, it's set to the downloaded file name.  If not,
    *   the places title for the download uri is used it's set.  As a last
    *   resort, we fallback to the download uri.
    * - fileSize (only set for downloads which completed succesfully):
    *   the downloaded file size.  For downloads done after the landing of
    *   bug 826991, this value is "static" - that is, it does not necessarily
    *   mean that the file is in place and has this size.
    */
-  _getDownloadMetaData: function DES__getDownloadMetaData() {
-    if (!this.active)
-      throw new Error("_getDownloadMetaData called for an inactive item.");
-
+  getDownloadMetaData: function DES_getDownloadMetaData() {
     if (!this._metaData) {
       if (this._dataItem) {
         this._metaData = {
           state:       this._dataItem.state,
           endTime:     this._dataItem.endTime,
+          fileName:    this._dataItem.target,
           displayName: this._dataItem.target
         };
         if (this._dataItem.done)
           this._metaData.fileSize = this._dataItem.maxBytes;
         if (this._dataItem.localFile)
           this._metaData.filePath = this._dataItem.localFile.path;
       }
       else {
@@ -323,18 +339,19 @@ DownloadElementShell.prototype = {
           }
 
           // This is actually the start-time, but it's the best we can get.
           this._metaData.endTime = this._placesNode.time / 1000;
         }
 
         try {
           let targetFileURI = this._getAnnotation(DESTINATION_FILE_URI_ANNO);
-          [this._metaData.filePath, this._metaData.displayName] =
+          [this._metaData.filePath, this._metaData.fileName] =
             this._extractFilePathAndNameFromFileURI(targetFileURI);
+          this._metaData.displayName = this._metaData.fileName;
         }
         catch(ex) {
           this._metaData.displayName = this._placesNode.title || this.downloadURI;
         }
       }
     }
     return this._metaData;
   },
@@ -368,17 +385,17 @@ DownloadElementShell.prototype = {
         return s.stateScanning;
       }
 
       throw new Error("_getStatusText called with a bogus download state");
     }
 
     // This is a not-in-progress or history download.
     let stateLabel = "";
-    let state = this._getDownloadMetaData().state;
+    let state = this.getDownloadMetaData().state;
     switch (state) {
       case nsIDM.DOWNLOAD_FAILED:
         stateLabel = s.stateFailed;
         break;
       case nsIDM.DOWNLOAD_CANCELED:
         stateLabel = s.stateCanceled;
         break;
       case nsIDM.DOWNLOAD_BLOCKED_PARENTAL:
@@ -387,17 +404,17 @@ DownloadElementShell.prototype = {
       case nsIDM.DOWNLOAD_BLOCKED_POLICY:
         stateLabel = s.stateBlockedPolicy;
         break;
       case nsIDM.DOWNLOAD_DIRTY:
         stateLabel = s.stateDirty;
         break;
       case nsIDM.DOWNLOAD_FINISHED:{
         // For completed downloads, show the file size (e.g. "1.5 MB")
-        let metaData = this._getDownloadMetaData();
+        let metaData = this.getDownloadMetaData();
         if ("fileSize" in metaData) {
           let [size, unit] = DownloadUtils.convertByteUnits(metaData.fileSize);
           stateLabel = s.sizeWithUnits(size, unit);
           break;
         }
         // Fallback to default unknown state.
       }
       default:
@@ -405,17 +422,17 @@ DownloadElementShell.prototype = {
         break;
     }
 
     // TODO (bug 829201): history downloads should get the referrer from Places.
     let referrer = this._dataItem && this._dataItem.referrer ||
                    this.downloadURI;
     let [displayHost, fullHost] = DownloadUtils.getURIHost(referrer);
 
-    let date = new Date(this._getDownloadMetaData().endTime);
+    let date = new Date(this.getDownloadMetaData().endTime);
     let [displayDate, fullDate] = DownloadUtils.getReadableDates(date);
 
     // We use the same XUL label to display the state, the host name, and the
     // end time.
     let firstPart = s.statusSeparator(stateLabel, displayHost);
     return s.statusSeparator(firstPart, displayDate);
   },
 
@@ -431,17 +448,17 @@ DownloadElementShell.prototype = {
 
   // Updates the download state attribute (and by that hide/unhide the
   // appropriate buttons and context menu items), the status text label,
   // and the progress meter.
   _updateDownloadStatusUI: function  DES__updateDownloadStatusUI() {
     if (!this.active)
       throw new Error("_updateDownloadStatusUI called for an inactive item.");
 
-    let state = this._getDownloadMetaData().state;
+    let state = this.getDownloadMetaData().state;
     if (state !== undefined)
       this._element.setAttribute("state", state);
 
     this._element.setAttribute("status", this._getStatusText());
 
     // For past-downloads, we're done. For session-downloads, we may also need
     // to update the progress-meter.
     if (!this._dataItem)
@@ -469,105 +486,108 @@ DownloadElementShell.prototype = {
     if (this._progressElement) {
       let event = document.createEvent("Events");
       event.initEvent("ValueChange", true, true);
       this._progressElement.dispatchEvent(event);
     }
   },
 
   _updateDisplayNameAndIcon: function DES__updateDisplayNameAndIcon() {
-    let metaData = this._getDownloadMetaData();
+    let metaData = this.getDownloadMetaData();
     this._element.setAttribute("displayName", metaData.displayName);
     this._element.setAttribute("image", this._getIcon());
   },
 
   _updateUI: function DES__updateUI() {
     if (!this.active)
       throw new Error("Trying to _updateUI on an inactive download shell");
 
     this._metaData = null;
     this._targetFileInfoFetched = false;
 
     this._updateDisplayNameAndIcon();
 
     // For history downloads done in past releases, the downloads/metaData
     // annotation is not set, and therefore we cannot tell the download
     // state without the target file information.
-    if (this._dataItem || this._getDownloadMetaData().state !== undefined)
+    if (this._dataItem || this.getDownloadMetaData().state !== undefined)
       this._updateDownloadStatusUI();
     else
       this._fetchTargetFileInfo(true);
   },
 
   placesNodeIconChanged: function DES_placesNodeIconChanged() {
     if (!this._dataItem)
       this._element.setAttribute("image", this._getIcon());
   },
 
   placesNodeTitleChanged: function DES_placesNodeTitleChanged() {
     // If there's a file path, we use the leaf name for the title.
-    if (!this._dataItem && this.active && !this._getDownloadMetaData().filePath) {
+    if (!this._dataItem && this.active && !this.getDownloadMetaData().filePath) {
       this._metaData = null;
       this._updateDisplayNameAndIcon();
     }
   },
 
   placesNodeAnnotationChanged: function DES_placesNodeAnnotationChanged(aAnnoName) {
     this._annotations.delete(aAnnoName);
     if (!this._dataItem && this.active) {
       if (aAnnoName == DOWNLOAD_META_DATA_ANNO) {
-        let metaData = this._getDownloadMetaData();
+        let metaData = this.getDownloadMetaData();
         let annotatedMetaData = this._getAnnotatedMetaData();
         metaData.endTme = annotatedMetaData.endTime;
         if ("fileSize" in annotatedMetaData)
           metaData.fileSize = annotatedMetaData.fileSize;
         else
           delete metaData.fileSize;
 
         if (metaData.state != annotatedMetaData.state) {
           metaData.state = annotatedMetaData.state;
           if (this._element.selected)
             goUpdateDownloadCommands();
         }
 
         this._updateDownloadStatusUI();
       }
       else if (aAnnoName == DESTINATION_FILE_URI_ANNO) {
-        let metaData = this._getDownloadMetaData();
+        let metaData = this.getDownloadMetaData();
         let targetFileURI = this._getAnnotation(DESTINATION_FILE_URI_ANNO);
-        [metaData.filePath, metaData.displayName] =
+        [metaData.filePath, metaData.fileName] =
             this._extractFilePathAndNameFromFileURI(targetFileURI);
+        metaData.displayName = metaData.fileName;
         this._updateDisplayNameAndIcon();
 
         if (this._targetFileInfoFetched) {
           // This will also update the download commands if necessary.
           this._targetFileInfoFetched = false;
           this._fetchTargetFileInfo();
         }
       }
     }
   },
 
   /* DownloadView */
   onStateChange: function DES_onStateChange(aOldState) {
-    let metaData = this._getDownloadMetaData();
+    let metaData = this.getDownloadMetaData();
     metaData.state = this.dataItem.state;
     if (aOldState != nsIDM.DOWNLOAD_FINISHED && aOldState != metaData.state) {
       // See comment in DVI_onStateChange in downloads.js (the panel-view)
       this._element.setAttribute("image", this._getIcon() + "&state=normal");
       metaData.fileSize = this._dataItem.maxBytes;
       if (this._targetFileInfoFetched) {
         this._targetFileInfoFetched = false;
         this._fetchTargetFileInfo();
       }
     }
 
     this._updateDownloadStatusUI();
     if (this._element.selected)
       goUpdateDownloadCommands();
+    else
+      goUpdateCommand("downloadsCmd_clearDownloads");
   },
 
   /* DownloadView */
   onProgressChange: function DES_onProgressChange() {
     this._updateDownloadStatusUI();
   },
 
   /* nsIController */
@@ -583,30 +603,30 @@ DownloadElementShell.prototype = {
         if (this._dataItem && !this._dataItem.openable)
           return false;
 
         if (this._targetFileInfoFetched)
           return this._targetFileExists;
 
         // If the target file information is not yet fetched,
         // temporarily assume that the file is in place.
-        return this._getDownloadMetaData().state == nsIDM.DOWNLOAD_FINISHED;
+        return this.getDownloadMetaData().state == nsIDM.DOWNLOAD_FINISHED;
       }
       case "downloadsCmd_show": {
         // TODO: Bug 827010 - Handle part-file asynchronously.
         if (this._dataItem &&
             this._dataItem.partFile && this._dataItem.partFile.exists())
           return true;
 
         if (this._targetFileInfoFetched)
           return this._targetFileExists;
 
         // If the target file information is not yet fetched,
         // temporarily assume that the file is in place.
-        return this._getDownloadMetaData().state == nsIDM.DOWNLOAD_FINISHED;
+        return this.getDownloadMetaData().state == nsIDM.DOWNLOAD_FINISHED;
       }
       case "downloadsCmd_pauseResume":
         return this._dataItem && this._dataItem.inProgress && this._dataItem.resumable;
       case "downloadsCmd_retry":
         // An history download can always be retried.
         return !this._dataItem || this._dataItem.canRetry;
       case "downloadsCmd_openReferrer":
         return this._dataItem && !!this._dataItem.referrer;
@@ -620,42 +640,36 @@ DownloadElementShell.prototype = {
     }
     return false;
   },
 
   _retryAsHistoryDownload: function DES__retryAsHistoryDownload() {
     // In future we may try to download into the same original target uri, when
     // we have it.  Though that requires verifying the path is still valid and
     // may surprise the user if he wants to be requested every time.
-
-    // For private browsing, try to get document out of the most recent browser
-    // window, or provide our own if there's no browser window.
-    let browserWin = RecentWindow.getMostRecentBrowserWindow();
-    let initiatingDoc = browserWin ? browserWin.document : document;
-    saveURL(this.downloadURI, this._getDownloadMetaData().displayName, null, true, true, undefined,
-            initiatingDoc);
+    DownloadURL(this.downloadURI, this.getDownloadMetaData().fileName);
   },
 
   /* nsIController */
   doCommand: function DES_doCommand(aCommand) {
     switch (aCommand) {
       case "downloadsCmd_open": {
         let file = this._dataItem ?
           this.dataItem.localFile :
-          new FileUtils.File(this._getDownloadMetaData().filePath);
+          new FileUtils.File(this.getDownloadMetaData().filePath);
 
         DownloadsCommon.openDownloadedFile(file, null, window);
         break;
       }
       case "downloadsCmd_show": {
         if (this._dataItem) {
           this._dataItem.showLocalFile();
         }
         else {
-          let file = new FileUtils.File(this._getDownloadMetaData().filePath);
+          let file = new FileUtils.File(this.getDownloadMetaData().filePath);
           DownloadsCommon.showDownloadedFile(file);
         }
         break;
       }
       case "downloadsCmd_openReferrer": {
         openURL(this._dataItem.referrer);
         break;
       }
@@ -686,18 +700,18 @@ DownloadElementShell.prototype = {
 
   // Returns whether or not the download handled by this shell should
   // show up in the search results for the given term.  Both the display
   // name for the download and the url are searched.
   matchesSearchTerm: function DES_matchesSearchTerm(aTerm) {
     if (!aTerm)
       return true;
     aTerm = aTerm.toLowerCase();
-    return this._getDownloadMetaData().displayName.toLowerCase().indexOf(aTerm) != -1 ||
-           this.downloadURI.toLowerCase().indexOf(aTerm) != -1;
+    return this.getDownloadMetaData().displayName.toLowerCase().contains(aTerm) ||
+           this.downloadURI.toLowerCase().contains(aTerm);
   },
 
   // Handles return kepress on the element (the keypress listener is
   // set in the DownloadsPlacesView object).
   doDefaultCommand: function DES_doDefaultCommand() {
     function getDefaultCommandForState(aState) {
       switch (aState) {
         case nsIDM.DOWNLOAD_FINISHED:
@@ -715,17 +729,17 @@ DownloadElementShell.prototype = {
           return "downloadsCmd_show";
         case nsIDM.DOWNLOAD_BLOCKED_PARENTAL:
         case nsIDM.DOWNLOAD_DIRTY:
         case nsIDM.DOWNLOAD_BLOCKED_POLICY:
           return "downloadsCmd_openReferrer";
       }
       return "";
     }
-    let command = getDefaultCommandForState(this._getDownloadMetaData().state);
+    let command = getDefaultCommandForState(this.getDownloadMetaData().state);
     if (this.isCommandEnabled(command))
       this.doCommand(command);
   },
 
   /**
    * At the first time an item is selected, we don't yet have
    * the target file information.  Thus the call to goUpdateDownloadCommands
    * in DPV_onSelect would result in best-guess enabled/disabled result.
@@ -749,17 +763,17 @@ DownloadElementShell.prototype = {
  * A richlistitem in this view can represent either a past download or a session
  * download, or both. Session downloads are shown first in the view, and as long
  * as they exist they "collapses" their history "counterpart" (So we don't show two
  * items for every download).
  */
 function DownloadsPlacesView(aRichListBox, aActive = true) {
   this._richlistbox = aRichListBox;
   this._richlistbox._placesView = this;
-  this._richlistbox.controllers.appendController(this);
+  window.controllers.insertControllerAt(0, this);
 
   // Map download URLs to download element shells regardless of their type
   this._downloadElementsShellsForURI = new Map();
 
   // Map download data items to their element shells.
   this._viewItemsForDataItems = new WeakMap();
 
   // Points to the last session download element. We keep track of this
@@ -773,17 +787,17 @@ function DownloadsPlacesView(aRichListBo
   // Register as a downloads view. The places data will be initialized by
   // the places setter.
   this._initiallySelectedElement = null;
   let downloadsData = DownloadsCommon.getData(window.opener || window);
   downloadsData.addView(this);
 
   // Make sure to unregister the view if the window is closed.
   window.addEventListener("unload", function() {
-    this._richlistbox.controllers.removeController(this);
+    window.controllers.removeController(this);
     downloadsData.removeView(this);
     this.result = null;
   }.bind(this), true);
   // Resizing the window may change items visibility.
   window.addEventListener("resize", function() {
     this._ensureVisibleElementsAreActive();
   }.bind(this), true);
 }
@@ -954,31 +968,34 @@ DownloadsPlacesView.prototype = {
       if (this.searchTerm) {
         newOrUpdatedShell.element.hidden =
           !newOrUpdatedShell.element._shell.matchesSearchTerm(this.searchTerm);
       }
     }
 
     // If aDocumentFragment is defined this is a batch change, so it's up to
     // the caller to append the fragment and activate the visible shells.
-    if (!aDocumentFragment)
+    if (!aDocumentFragment) {
       this._ensureVisibleElementsAreActive();
+      goUpdateCommand("downloadsCmd_clearDownloads");
+    }
   },
 
   _removeElement: function DPV__removeElement(aElement) {
     // If the element was selected exclusively, select its next
     // sibling first, if any.
     if (aElement.nextSibling &&
         this._richlistbox.selectedItems &&
         this._richlistbox.selectedItems.length > 0 &&
         this._richlistbox.selectedItems[0] == aElement) {
       this._richlistbox.selectItem(aElement.nextSibling);
     }
     this._richlistbox.removeChild(aElement);
     this._ensureVisibleElementsAreActive();
+    goUpdateCommand("downloadsCmd_clearDownloads");
   },
 
   _removeHistoryDownloadFromView:
   function DPV__removeHistoryDownloadFromView(aPlacesNode) {
     let downloadURI = aPlacesNode.uri;
     let shellsForURI = this._downloadElementsShellsForURI.get(downloadURI, null);
     if (shellsForURI) {
       for (let shell of shellsForURI) {
@@ -1167,28 +1184,27 @@ DownloadsPlacesView.prototype = {
       }
       catch(ex) {
         Cu.reportError(ex);
       }
     }
 
     this._appendDownloadsFragment(elementsToAppendFragment);
     this._ensureVisibleElementsAreActive();
+    goUpdateDownloadCommands();
   },
 
   _appendDownloadsFragment: function DPV__appendDownloadsFragment(aDOMFragment) {
     // Workaround multiple reflows hang by removing the richlistbox
     // and adding it back when we're done.
     let parentNode = this._richlistbox.parentNode;
     let nextSibling = this._richlistbox.nextSibling;
-    this._richlistbox.controllers.removeController(this);
     parentNode.removeChild(this._richlistbox);
     this._richlistbox.appendChild(aDOMFragment);
     parentNode.insertBefore(this._richlistbox, nextSibling);
-    this._richlistbox.controllers.appendController(this);
   },
 
   nodeInserted: function DPV_nodeInserted(aParent, aPlacesNode) {
     this._addDownloadData(null, aPlacesNode);
   },
 
   nodeRemoved: function DPV_nodeRemoved(aParent, aPlacesNode, aOldIndex) {
     this._removeHistoryDownloadFromView(aPlacesNode);
@@ -1281,37 +1297,63 @@ DownloadsPlacesView.prototype = {
 
   onDataItemRemoved: function DPV_onDataItemRemoved(aDataItem) {
     this._removeSessionDownloadFromView(aDataItem);
   },
 
   getViewItem: function(aDataItem)
     this._viewItemsForDataItems.get(aDataItem, null),
 
-  supportsCommand: function(aCommand)
-    DOWNLOAD_VIEW_SUPPORTED_COMMANDS.indexOf(aCommand) != -1,
+  supportsCommand: function DPV_supportsCommand(aCommand) {
+    if (DOWNLOAD_VIEW_SUPPORTED_COMMANDS.indexOf(aCommand) != -1) {
+      // The clear-downloads command may be performed by the toolbar-button,
+      // which can be focused on OS X.  Thus enable this command even if the
+      // richlistbox is not focused.
+      // For other commands, be prudent and disable them unless the richlistview
+      // is focused. It's important to make the decision here rather than in
+      // isCommandEnabled.  Otherwise our controller may "steal" commands from
+      // other controls in the window (see goUpdateCommand &
+      // getControllerForCommand).
+      if (document.activeElement == this._richlistbox ||
+          aCommand == "downloadsCmd_clearDownloads") {
+        return true;
+      }
+    }
+    return false;
+  },
 
   isCommandEnabled: function DPV_isCommandEnabled(aCommand) {
-    let selectedElements = this._richlistbox.selectedItems;
     switch (aCommand) {
       case "cmd_copy":
-        return selectedElements && selectedElements.length > 0;
+        return this._richlistbox.selectedItems.length > 0;
       case "cmd_selectAll":
         return true;
       case "cmd_paste":
         return this._canDownloadClipboardURL();
       case "downloadsCmd_clearDownloads":
-        return !!this._richlistbox.firstChild;
+        return this._canClearDownloads();
       default:
-        return Array.every(selectedElements, function(element) {
+        return Array.every(this._richlistbox.selectedItems, function(element) {
           return element._shell.isCommandEnabled(aCommand);
         });
     }
   },
 
+  _canClearDownloads: function DPV__canClearDownloads() {
+    // Downloads can be cleared if there's at least one removeable download in
+    // the list (either a history download or a completed session download).
+    // Because history downloads are always removable and are listed after the
+    // session downloads, check from bottom to top.
+    for (let elt = this._richlistbox.lastChild; elt; elt = elt.previousSibling) {
+      if (elt._shell.placesNode || !elt._shell.dataItem.inProgress)
+        return true;
+    }
+    return false;
+  },
+
   _copySelectedDownloadsToClipboard:
   function DPV__copySelectedDownloadsToClipboard() {
     let selectedElements = this._richlistbox.selectedItems;
     let urls = [e._shell.downloadURI for each (e in selectedElements)];
 
     Cc["@mozilla.org/widget/clipboardhelper;1"].
     getService(Ci.nsIClipboardHelper).copyString(urls.join("\n"), document);
   },
@@ -1342,17 +1384,17 @@ DownloadsPlacesView.prototype = {
 
   _canDownloadClipboardURL: function DPV__canDownloadClipboardURL() {
     let [url, name] = this._getURLFromClipboardData();
     return url != "";
   },
 
   _downloadURLFromClipboard: function DPV__downloadURLFromClipboard() {
     let [url, name] = this._getURLFromClipboardData();
-    saveURL(url, name || url, null, true, true, undefined, document);
+    DownloadURL(url, name);
   },
 
   doCommand: function DPV_doCommand(aCommand) {
     switch (aCommand) {
       case "cmd_copy":
         this._copySelectedDownloadsToClipboard();
         break;
       case "cmd_selectAll":
@@ -1367,16 +1409,19 @@ DownloadsPlacesView.prototype = {
         } else {
           Services.downloads.cleanUp();
         }
         if (this.result) {
           Cc["@mozilla.org/browser/download-history;1"]
             .getService(Ci.nsIDownloadHistory)
             .removeAllDownloads();
         }
+        // There may be no selection or focus change as a result
+        // of these change, and we want the command updated immediately.
+        goUpdateCommand("downloadsCmd_clearDownloads");
         break;
       default: {
         let selectedElements = this._richlistbox.selectedItems;
         for (let element of selectedElements) {
           element._shell.doCommand(aCommand);
         }
       }
     }
@@ -1387,17 +1432,17 @@ DownloadsPlacesView.prototype = {
   onContextMenu: function DPV_onContextMenu(aEvent)
   {
     let element = this._richlistbox.selectedItem;
     if (!element || !element._shell)
       return false;
 
     // Set the state attribute so that only the appropriate items are displayed.
     let contextMenu = document.getElementById("downloadsContextMenu");
-    let state = element._shell._getDownloadMetaData().state;
+    let state = element._shell.getDownloadMetaData().state;
     if (state !== undefined)
       contextMenu.setAttribute("state", state);
     else
       contextMenu.removeAttribute("state");
 
     return true;
   },
 
@@ -1442,16 +1487,61 @@ DownloadsPlacesView.prototype = {
   onSelect: function DPV_onSelect() {
     goUpdateDownloadCommands();
 
     let selectedElements = this._richlistbox.selectedItems;
     for (let elt of selectedElements) {
       if (elt._shell)
         elt._shell.onSelect();
     }
+  },
+
+  onDragStart: function DPV_onDragStart(aEvent) {
+    // TODO Bug 831358: Support d&d for multiple selection.
+    // For now, we just drag the first element.
+    let selectedItem = this._richlistbox.selectedItem;
+    if (!selectedItem)
+      return;
+
+    let metaData = selectedItem._shell.getDownloadMetaData();
+    if (!("filePath" in metaData))
+      return;
+    let file = new FileUtils.File(metaData.filePath);
+    if (!file.exists())
+      return;
+
+    let dt = aEvent.dataTransfer;
+    dt.mozSetDataAt("application/x-moz-file", file, 0);
+    let url = Services.io.newFileURI(file).spec;
+    dt.setData("text/uri-list", url);
+    dt.setData("text/plain", url);
+    dt.effectAllowed = "copyMove";
+    dt.addElement(selectedItem);
+  },
+
+  onDragOver: function DPV_onDragOver(aEvent) {
+    let types = aEvent.dataTransfer.types;
+    if (types.contains("text/uri-list") ||
+        types.contains("text/x-moz-url") ||
+        types.contains("text/plain")) {
+      aEvent.preventDefault();
+    }
+  },
+
+  onDrop: function DPV_onDrop(aEvent) {
+    let dt = aEvent.dataTransfer;
+    // If dragged item is from our source, do not try to
+    // redownload already downloaded file.
+    if (dt.mozGetDataAt("application/x-moz-file", 0))
+      return;
+
+    let name = { };
+    let url = Services.droppedLinkHandler.dropLink(aEvent, name);
+    if (url)
+      DownloadURL(url, name.value);
   }
 };
 
 for (let methodName of ["load", "applyFilter", "selectNode", "selectItems"]) {
   DownloadsPlacesView.prototype[methodName] = function() {
     throw new Error("|" + methodName + "| is not implemented by the downloads view.");
   }
 }

--- a/browser/components/downloads/content/allDownloadsViewOverlay.xul
+++ b/browser/components/downloads/content/allDownloadsViewOverlay.xul
@@ -41,16 +41,19 @@
 
   <richlistbox flex="1"
                seltype="multiple"
                id="downloadsRichListBox" context="downloadsContextMenu"
                onscroll="return this._placesView.onScroll();"
                onkeypress="return this._placesView.onKeyPress(event);"
                ondblclick="return this._placesView.onDoubleClick(event);"
                oncontextmenu="return this._placesView.onContextMenu(event);"
+               ondragstart="this._placesView.onDragStart(event);"
+               ondragover="this._placesView.onDragOver(event);"
+               ondrop="this._placesView.onDrop(event);"
                onfocus="goUpdateDownloadCommands();"
                onselect="this._placesView.onSelect();"
                onblur="goUpdateDownloadCommands();"/>
 
   <commandset id="downloadCommands"
               commandupdater="true"
               events="focus,select,contextmenu"
               oncommandupdate="goUpdateDownloadCommands();">

--- a/browser/components/downloads/src/DownloadsCommon.jsm
+++ b/browser/components/downloads/src/DownloadsCommon.jsm
@@ -731,21 +731,21 @@ DownloadsDataCtor.prototype = {
    * Removes the data item with the specified identifier.
    *
    * This method can be called at most once per download identifier.
    */
   _removeDataItem: function DD_removeDataItem(aDownloadId)
   {
     if (aDownloadId in this.dataItems) {
       let dataItem = this.dataItems[aDownloadId];
+      this.dataItems[aDownloadId] = null;
       this._views.forEach(
         function (view) view.onDataItemRemoved(dataItem)
       );
     }
-    this.dataItems[aDownloadId] = null;
   },
 
   //////////////////////////////////////////////////////////////////////////////
   //// Persistent data loading
 
   /**
    * Represents an executing statement, allowing its cancellation.
    */

--- a/browser/components/nsBrowserContentHandler.js
+++ b/browser/components/nsBrowserContentHandler.js
@@ -507,17 +507,17 @@ nsBrowserContentHandler.prototype = {
     }
     if (cmdLine.handleFlag("preferences", false)) {
       openPreferences();
       cmdLine.preventDefault = true;
     }
     if (cmdLine.handleFlag("silent", false))
       cmdLine.preventDefault = true;
 #ifdef MOZ_PER_WINDOW_PRIVATE_BROWSING
-    if (cmdLine.findFlag("private-window", false) >= 0) {
+    if (cmdLine.handleFlag("private-window", false)) {
       openWindow(null, this.chromeURL, "_blank",
         "chrome,dialog=no,private,all" + this.getFeatures(cmdLine),
         "about:privatebrowsing");
       cmdLine.preventDefault = true;
     }
 #else
     if (cmdLine.findFlag("private-toggle", false) >= 0)
       cmdLine.preventDefault = true;

--- a/browser/components/places/content/places.js
+++ b/browser/components/places/content/places.js
@@ -1239,16 +1239,17 @@ let gPrivateBrowsingListener = {
 
 let ContentArea = {
   _specialViews: new Map(),
 
   init: function CA_init() {
     this._deck = document.getElementById("placesViewsDeck");
     this._toolbar = document.getElementById("placesToolbar");
     ContentTree.init();
+    this._setupView();
   },
 
   /**
    * Gets the content view to be used for loading the given query.
    * If a custom view was set by setContentViewForQueryString, that
    * view would be returned, else the default tree view is returned
    *
    * @param aQueryString
@@ -1375,20 +1376,16 @@ let ContentTree = {
   }),
 
   openSelectedNode: function CT_openSelectedNode(aEvent) {
     let view = this.view;
     PlacesUIUtils.openNodeWithEvent(view.selectedNode, aEvent, view);
   },
 
   onClick: function CT_onClick(aEvent) {
-    // Only handle clicks on tree children.
-    if (aEvent.target.localName != "treechildren")
-      return;
-
     let node = this.view.selectedNode;
     if (node) {
       let doubleClick = aEvent.button == 0 && aEvent.detail == 2;
       let middleClick = aEvent.button == 1 && aEvent.detail == 1;
       if (PlacesUtils.nodeIsURI(node) && (doubleClick || middleClick)) {
         // Open associated uri in the browser.
         this.openSelectedNode(aEvent);
       }

--- a/browser/components/places/content/places.xul
+++ b/browser/components/places/content/places.xul
@@ -368,18 +368,17 @@
               flex="1"
               type="places"
               flatList="true"
               selectfirstnode="true"
               enableColumnDrag="true"
               onfocus="PlacesOrganizer.updateDetailsPane(event)"
               onselect="PlacesOrganizer.updateDetailsPane(event)"
               onkeypress="ContentTree.onKeyPress(event);"
-              onopenflatcontainer="PlacesOrganizer.openFlatContainer(aContainer);"
-              onclick="ContentTree.onClick(event);">
+              onopenflatcontainer="PlacesOrganizer.openFlatContainer(aContainer);">
           <treecols id="placeContentColumns" context="placesColumnsContext">
             <treecol label="&col.name.label;" id="placesContentTitle" anonid="title" flex="5" primary="true" ordinal="1" 
                       persist="width hidden ordinal sortActive sortDirection"/>
             <splitter class="tree-splitter"/>
             <treecol label="&col.tags.label;" id="placesContentTags" anonid="tags" flex="2"
                       persist="width hidden ordinal sortActive sortDirection"/>
             <splitter class="tree-splitter"/>
             <treecol label="&col.url.label;" id="placesContentUrl" anonid="url" flex="5"
@@ -398,17 +397,17 @@
                       persist="width hidden ordinal sortActive sortDirection"/>
             <splitter class="tree-splitter"/>
             <treecol label="&col.dateadded.label;" id="placesContentDateAdded" anonid="dateAdded" flex="1" hidden="true"
                       persist="width hidden ordinal sortActive sortDirection"/>
             <splitter class="tree-splitter"/>
             <treecol label="&col.lastmodified.label;" id="placesContentLastModified" anonid="lastModified" flex="1" hidden="true"
                       persist="width hidden ordinal sortActive sortDirection"/>
           </treecols>
-          <treechildren flex="1"/>
+          <treechildren flex="1" onclick="ContentTree.onClick(event);"/>
         </tree>
       </deck>
       <deck id="detailsDeck" style="height: 11em;">
         <vbox id="itemsCountBox" align="center">
           <spacer flex="3"/>
           <label id="itemsCountText"/>
           <spacer flex="1"/>
           <description id="selectItemDescription">

--- a/browser/components/privatebrowsing/test/browser/perwindow/Makefile.in
+++ b/browser/components/privatebrowsing/test/browser/perwindow/Makefile.in
@@ -10,16 +10,19 @@ relativesrcdir  = @relativesrcdir@
 
 include $(DEPTH)/config/autoconf.mk
 
 MOCHITEST_BROWSER_FILES =  \
 		head.js \
 		browser_privatebrowsing_certexceptionsui.js \
 		browser_privatebrowsing_concurrent.js \
 		browser_privatebrowsing_concurrent_page.html \
+		browser_privatebrowsing_cookieacceptdialog.js \
+		browser_privatebrowsing_cookieacceptdialog.html \
+		browser_privatebrowsing_crh.js \
 		browser_privatebrowsing_downloadLastDir.js \
 		browser_privatebrowsing_downloadLastDir_c.js \
 		browser_privatebrowsing_downloadLastDir_toggle.js \
 		browser_privatebrowsing_DownloadLastDirWithCPS.js \
 		browser_privatebrowsing_geoprompt.js \
 		browser_privatebrowsing_geoprompt_page.html \
 		browser_privatebrowsing_lastpbcontextexited.js \
 		browser_privatebrowsing_localStorage.js \
@@ -43,18 +46,9 @@ MOCHITEST_BROWSER_FILES =  \
 		browser_privatebrowsing_windowtitle.js \
 		browser_privatebrowsing_windowtitle_page.html \
 		browser_privatebrowsing_zoom.js \
 		browser_privatebrowsing_zoomrestore.js \
 		popup.html \
 		title.sjs \
 		$(NULL)
 
-# Temporarily disabled on OS X for bug 822284
-ifneq ($(MOZ_WIDGET_TOOLKIT),cocoa)
-MOCHITEST_BROWSER_FILES += \
-		browser_privatebrowsing_cookieacceptdialog.js \
-		browser_privatebrowsing_cookieacceptdialog.html \
-		browser_privatebrowsing_crh.js \
-		$(NULL)
-endif
-
 include $(topsrcdir)/config/rules.mk

--- a/browser/components/privatebrowsing/test/browser/perwindow/browser_privatebrowsing_cookieacceptdialog.js
+++ b/browser/components/privatebrowsing/test/browser/perwindow/browser_privatebrowsing_cookieacceptdialog.js
@@ -55,85 +55,98 @@ function test() {
       isSecure: false,
       expires: time,
       status: 0,
       policy: 0,
       isSession: false,
       expiry: time,
       isHttpOnly: true,
       QueryInterface: function(iid) {
-        const validIIDs = [Ci.nsISupports,
-                           Ci.nsICookie,
-                           Ci.nsICookie2];
+        const validIIDs = [Ci.nsISupports, Ci.nsICookie, Ci.nsICookie2];
         for (var i = 0; i < validIIDs.length; ++i)
           if (iid == validIIDs[i])
             return this;
         throw Cr.NS_ERROR_NO_INTERFACE;
       }
     };
     cp.cookieDialog(aWindow, cookie, "mozilla.org", 10, false, remember);
   }
 
   function checkSettingDialog(aIsPrivateWindow, aWindow, aCallback) {
-    aWindow.gBrowser.selectedTab = aWindow.gBrowser.addTab();
     let selectedBrowser = aWindow.gBrowser.selectedBrowser;
 
     function onLoad() {
+      if (aWindow.content.location.href != TEST_URL) {
+        selectedBrowser.loadURI(TEST_URL);
+        return;
+      }
       selectedBrowser.removeEventListener("load", onLoad, true);
       Services.ww.unregisterNotification(observer);
 
-      ok(aIsPrivateWindow, "Confirm setting dialog is not displayed for private window");
+      ok(aIsPrivateWindow,
+         "Confirm setting dialog is not displayed for private window");
 
       executeSoon(aCallback);
     }
     selectedBrowser.addEventListener("load", onLoad, true);
 
     function observer(aSubject, aTopic, aData) {
       if (aTopic != "domwindowopened")
         return;
       selectedBrowser.removeEventListener("load", onLoad, true);
       Services.ww.unregisterNotification(observer);
-
-      ok(!aIsPrivateWindow, "Confirm setting dialog is displayed for normal window");
-
+      ok(!aIsPrivateWindow,
+         "Confirm setting dialog is displayed for normal window");
       let win = aSubject.QueryInterface(Ci.nsIDOMWindow);
       executeSoon(function () {
-        win.close();
-        executeSoon(aCallback);
+        info("Wait for window close");
+        waitForWindowClose(win, aCallback);
       });
     }
     Services.ww.registerNotification(observer);
 
     selectedBrowser.loadURI(TEST_URL);
   }
 
-  var windowsToClose = [];
-  function testOnWindow(options, callback) {
-    var win = OpenBrowserWindow(options);
-    win.addEventListener("load", function onLoad() {
-      win.removeEventListener("load", onLoad, false);
-      windowsToClose.push(win);
-      callback(win);
-    }, false);
+  let windowsToClose = [];
+  function testOnWindow(aIsPrivate, aCallback) {
+    whenNewWindowLoaded({private: aIsPrivate}, function(aWin) {
+      windowsToClose.push(aWin);
+      aCallback(aWin);
+    });
   }
 
   registerCleanupFunction(function() {
+    Services.prefs.clearUserPref("network.cookie.lifetimePolicy");
     windowsToClose.forEach(function(win) {
-      Services.prefs.clearUserPref("network.cookie.lifetimePolicy");
       win.close();
     });
   });
 
-  // ask all cookies
+  // Ask all cookies
   Services.prefs.setIntPref("network.cookie.lifetimePolicy", 1);
 
-  testOnWindow({private: true}, function(aPrivWin) {
+  testOnWindow(true, function(aPrivWin) {
+    info("Test on private window");
     checkRememberOption(true, aPrivWin, function() {
       checkSettingDialog(true, aPrivWin, function() {
-        testOnWindow(undefined, function(aWin) {
+        testOnWindow(false, function(aWin) {
+          info("Test on public window");
           checkRememberOption(false, aWin, function() {
             checkSettingDialog(false, aWin, finish);
           });
         });
       });
     });
   });
 }
+
+function waitForWindowClose(aWin, aCallback) {
+  function observer(aSubject, aTopic, aData) {
+    if (aTopic == "domwindowclosed") {
+      info("Window closed");
+      Services.ww.unregisterNotification(observer);
+      executeSoon(aCallback);
+    }
+  }
+  Services.ww.registerNotification(observer);
+  aWin.close();
+}

--- a/browser/components/privatebrowsing/test/browser/perwindow/browser_privatebrowsing_crh.js
+++ b/browser/components/privatebrowsing/test/browser/perwindow/browser_privatebrowsing_crh.js
@@ -18,31 +18,42 @@ function test() {
       is(crhCommand.hasAttribute("disabled"), aPrivateMode,
         "Clear Recent History command should be disabled according to the private browsing mode");
 
       executeSoon(aCallback);
     });
   };
 
   let windowsToClose = [];
-  function testOnWindow(options, callback) {
-    let win = OpenBrowserWindow(options);
-    win.addEventListener("load", function onLoad() {
-      win.removeEventListener("load", onLoad, false);
-      windowsToClose.push(win);
-      callback(win);
-    }, false);
+  let testURI = "about:blank";
+
+  function testOnWindow(aIsPrivate, aCallback) {
+    whenNewWindowLoaded({private: aIsPrivate}, function(aWin) {
+      windowsToClose.push(aWin);
+      aWin.gBrowser.selectedBrowser.addEventListener("load", function onLoad() {
+        if (aWin.content.location.href != testURI) {
+          aWin.gBrowser.loadURI(testURI);
+          return;
+        }
+        aWin.gBrowser.selectedBrowser.removeEventListener("load", onLoad, true);
+        executeSoon(function() aCallback(aWin));
+      }, true);
+
+      aWin.gBrowser.loadURI(testURI);
+    });
   };
 
   registerCleanupFunction(function() {
     windowsToClose.forEach(function(win) {
       win.close();
     });
   });
 
-  testOnWindow({private: true}, function(win) {
+  testOnWindow(true, function(win) {
+    info("Test on private window");
     checkDisableOption(true, win, function() {
-      testOnWindow({}, function(win) {
+      testOnWindow(false, function(win) {
+        info("Test on public window");
         checkDisableOption(false, win, finish);
       });
     });
   });
 }

--- a/browser/components/privatebrowsing/test/browser/perwindow/browser_privatebrowsing_lastpbcontextexited.js
+++ b/browser/components/privatebrowsing/test/browser/perwindow/browser_privatebrowsing_lastpbcontextexited.js
@@ -1,26 +1,49 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 function test() {
   // We need to open a new window for this so that its docshell would get destroyed
   // when clearing the PB mode flag.
-  let newWin = OpenBrowserWindow({private: true});
+  function runTest(aCloseWindow, aCallback) {
+    let newWin = OpenBrowserWindow({private: true});
+    SimpleTest.waitForFocus(function() {
+      let expectedExiting = true;
+      let expectedExited = false;
+      let observerExiting = {
+        observe: function(aSubject, aTopic, aData) {
+          is(aTopic, "last-pb-context-exiting", "Correct topic should be dispatched (exiting)");
+          is(expectedExiting, true, "notification not expected yet (exiting)");
+          expectedExited = true;
+          Services.obs.removeObserver(observerExiting, "last-pb-context-exiting", false);
+        }
+      };
+      let observerExited = {
+        observe: function(aSubject, aTopic, aData) {
+          is(aTopic, "last-pb-context-exited", "Correct topic should be dispatched (exited)");
+          is(expectedExited, true, "notification not expected yet (exited)");
+          Services.obs.removeObserver(observerExited, "last-pb-context-exited", false);
+          aCallback();
+        }
+      };
+      Services.obs.addObserver(observerExiting, "last-pb-context-exiting", false);
+      Services.obs.addObserver(observerExited, "last-pb-context-exited", false);
+      expectedExiting = true;
+      aCloseWindow(newWin);
+      newWin = null;
+      SpecialPowers.forceGC();
+    }, newWin);
+  }
+
   waitForExplicitFinish();
-  SimpleTest.waitForFocus(function() {
-    let expected = false;
-    let observer = {
-      observe: function(aSubject, aTopic, aData) {
-        is(aTopic, "last-pb-context-exited", "Correct topic should be dispatched");
-        is(expected, true, "notification not expected yet");
-        Services.obs.removeObserver(observer, "last-pb-context-exited", false);
-        finish();
-      }
-    };
-    Services.obs.addObserver(observer, "last-pb-context-exited", false);
-    expected = true;
-    newWin.close(); // this will cause the docshells to leave PB mode
-    newWin = null;
-    SpecialPowers.forceGC();
-  }, newWin);
+
+  runTest(function(newWin) {
+      // Simulate pressing the window close button
+      newWin.document.getElementById("cmd_closeWindow").doCommand();
+    }, function () {
+      runTest(function(newWin) {
+          // Simulate closing the last tab
+          newWin.document.getElementById("cmd_close").doCommand();
+        }, finish);
+    });
 }

--- a/browser/components/shell/test/browser_420786.js
+++ b/browser/components/shell/test/browser_420786.js
@@ -72,14 +72,24 @@ function onPageLoad() {
 function test() {
   var osString = Cc["@mozilla.org/xre/app-info;1"].
                  getService(Ci.nsIXULRuntime).OS;
   if (osString != "Linux") {
     todo(false, "This test is Linux specific for now.");
     return;
   }
 
+  try {
+    // If GSettings is available, then the GConf tests
+    // will fail
+    var gsettings = Cc["@mozilla.org/gsettings-service;1"].
+                    getService(Ci.nsIGSettingsService).
+                    getCollectionForSchema("org.gnome.desktop.background");
+    todo(false, "This test doesn't work when GSettings is available");
+    return;
+  } catch(e) { }
+
   gBrowser.selectedTab = gBrowser.addTab();
   gBrowser.selectedBrowser.addEventListener("load", onPageLoad, true);
   content.location = "about:logo";
 
   waitForExplicitFinish();
 }

--- a/browser/components/shell/test/unit/test_421977.js
+++ b/browser/components/shell/test/unit/test_421977.js
@@ -62,16 +62,25 @@ function checkShellToGConfColor(aShellCo
 }
 
 function run_test() {
 
   // This test is Linux specific for now
   if (!("@mozilla.org/gnome-gconf-service;1" in Cc))
     return;
 
+  try {
+    // If GSettings is available, then the GConf tests
+    // will fail
+    var gsettings = Cc["@mozilla.org/gsettings-service;1"].
+                    getService(Ci.nsIGSettingsService).
+                    getCollectionForSchema("org.gnome.desktop.background");
+    return;
+  } catch(e) { }
+
   gGConf = Cc["@mozilla.org/gnome-gconf-service;1"].
            getService(Ci.nsIGConfService);
 
   gShell = Cc["@mozilla.org/browser/shell-service;1"].
            getService(Ci.nsIShellService);
 
   // Save the original background color so that we can restore it
   // after the test.

--- a/build/ConfigStatus.py
+++ b/build/ConfigStatus.py
@@ -6,49 +6,28 @@
 # drop-in replacement for autoconf 2.13's config.status, with features
 # borrowed from autoconf > 2.5, and additional features.
 
 from __future__ import with_statement
 from optparse import OptionParser
 import sys, re, os, posixpath, ntpath
 import errno
 from StringIO import StringIO
+from os.path import relpath
+
 # Standalone js doesn't have virtualenv.
 sys.path.append(os.path.join(os.path.dirname(__file__), '..', 'config'))
 from Preprocessor import Preprocessor
 
 # Basic logging facility
 verbose = False
 def log(string):
     if verbose:
         print >>sys.stderr, string
 
-# We need relpath, but it is introduced in python 2.6
-# http://docs.python.org/library/os.path.html
-def my_relpath(path, start):
-    """
-    Return a relative version of a path
-    from /usr/lib/python2.6/posixpath.py
-    """
-
-    if not path:
-        raise ValueError("no path specified")
-
-    start_list = os.path.abspath(start).split(os.path.sep)
-    path_list = os.path.abspath(path).split(os.path.sep)
-
-    # Work out how much of the filepath is shared by start and path.
-    i = len(os.path.commonprefix([start_list, path_list]))
-
-    rel_list = [os.path.pardir] * (len(start_list)-i) + path_list[i:]
-    if not rel_list:
-        return os.curdir
-    return os.path.join(*rel_list)
-
-relpath = getattr(os.path, "relpath", my_relpath)
 
 def ensureParentDir(file):
     '''Ensures the directory parent to the given file exists'''
     dir = os.path.dirname(file)
     if dir and not os.path.exists(dir):
         try:
             os.makedirs(dir)
         except OSError, error:

new file mode 100644
--- /dev/null
+++ b/build/autoconf/python-virtualenv.m4
@@ -0,0 +1,77 @@
+dnl This Source Code Form is subject to the terms of the Mozilla Public
+dnl License, v. 2.0. If a copy of the MPL was not distributed with this
+dnl file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+AC_DEFUN([MOZ_PYTHON],
+[
+
+dnl We honor the Python path defined in an environment variable. This is used
+dnl to pass the virtualenv's Python from the main configure to SpiderMonkey's
+dnl configure, for example.
+if test -z "$PYTHON"; then
+  MOZ_PATH_PROGS(PYTHON, $PYTHON python2.7 python)
+  if test -z "$PYTHON"; then
+      AC_MSG_ERROR([python was not found in \$PATH])
+  fi
+else
+  AC_MSG_RESULT([Using Python from environment variable \$PYTHON])
+fi
+
+_virtualenv_topsrcdir=
+_virtualenv_populate_path=
+
+dnl If this is a mozilla-central, we'll find the virtualenv in the top
+dnl source directory. If this is a SpiderMonkey build, we assume we're at
+dnl js/src and try to find the virtualenv from the mozilla-central root.
+for base in $MOZILLA_CENTRAL_PATH $_topsrcdir $_topsrcdir/../..; do
+  possible=$base/build/virtualenv/populate_virtualenv.py
+
+  if test -e $possible; then
+    _virtualenv_topsrcdir=$base
+    _virtualenv_populate_path=$possible
+    break
+  fi
+done
+
+if test -z $_virtualenv_populate_path; then
+    AC_MSG_ERROR([Unable to find Virtualenv population script. In order
+to build, you will need mozilla-central's virtualenv.
+
+If you are building from a mozilla-central checkout, you should never see this
+message. If you are building from a source archive, the source archive was
+likely not created properly (it is missing the virtualenv files).
+
+If you have a copy of mozilla-central available, define the
+MOZILLA_CENTRAL_PATH environment variable to the top source directory of
+mozilla-central and relaunch configure.])
+
+fi
+
+if test -z $DONT_POPULATE_VIRTUALENV; then
+  AC_MSG_RESULT([Creating Python environment])
+  dnl This verifies our Python version is sane and ensures the Python
+  dnl virtualenv is present and up to date. It sanitizes the environment
+  dnl for us, so we don't need to clean anything out.
+  $PYTHON $_virtualenv_populate_path \
+    $_virtualenv_topsrcdir $MOZ_BUILD_ROOT/_virtualenv || exit 1
+
+  case "$host_os" in
+  mingw*)
+    PYTHON=`cd $MOZ_BUILD_ROOT && pwd -W`/_virtualenv/Scripts/python.exe
+    ;;
+  *)
+    PYTHON=$MOZ_BUILD_ROOT/_virtualenv/bin/python
+    ;;
+  esac
+fi
+
+AC_SUBST(PYTHON)
+
+AC_MSG_CHECKING([Python environment is Mozilla virtualenv])
+$PYTHON -c "import mozbuild.base"
+if test "$?" != 0; then
+    AC_MSG_ERROR([Python environment does not appear to be sane.])
+fi
+AC_MSG_RESULT([yes])
+])
+

--- a/build/automation.py.in
+++ b/build/automation.py.in
@@ -269,48 +269,47 @@ class Automation(object):
   def setupPermissionsDatabase(self, profileDir, permissions):
     # Open database and create table
     permDB = sqlite3.connect(os.path.join(profileDir, "permissions.sqlite"))
     cursor = permDB.cursor();
 
     cursor.execute("PRAGMA user_version=3");
 
     # SQL copied from nsPermissionManager.cpp
-    cursor.execute("""CREATE TABLE moz_hosts (
-       id INTEGER PRIMARY KEY,
-       host TEXT,
-       type TEXT,
-       permission INTEGER,
-       expireType INTEGER,
-       expireTime INTEGER,
-       appId INTEGER,
-       isInBrowserElement INTEGER)""")
+    cursor.execute("""CREATE TABLE IF NOT EXISTS moz_hosts (
+      id INTEGER PRIMARY KEY,
+      host TEXT,
+      type TEXT,
+      permission INTEGER,
+      expireType INTEGER,
+      expireTime INTEGER,
+      appId INTEGER,
+      isInBrowserElement INTEGER)""")
 
     # Insert desired permissions
-    c = 0
     for perm in permissions.keys():
       for host,allow in permissions[perm]:
-        c += 1
-        cursor.execute("INSERT INTO moz_hosts values(?, ?, ?, ?, 0, 0, 0, 0)",
-                       (c, host, perm, 1 if allow else 2))
+        cursor.execute("INSERT INTO moz_hosts values(NULL, ?, ?, ?, 0, 0, 0, 0)",
+                       (host, perm, 1 if allow else 2))
 
     # Commit and close
     permDB.commit()
     cursor.close()
 
   def setupTestApps(self, profileDir, apps):
-    webappJSONTemplate = Template(""""$name": {
-"origin": "$origin",
-"installOrigin": "$origin",
-"receipt": null,
-"installTime": 132333986000,
-"manifestURL": "$manifestURL",
-"localId": $localId,
-"appStatus": $appStatus,
-"csp": "$csp"
+    webappJSONTemplate = Template(""""$id": {
+  "origin": "$origin",
+  "installOrigin": "$origin",
+  "receipt": null,
+  "installTime": 132333986000,
+  "manifestURL": "$manifestURL",
+  "localId": $localId,
+  "id": "$id",
+  "appStatus": $appStatus,
+  "csp": "$csp"
 }""")
 
     manifestTemplate = Template("""{
   "name": "$name",
   "csp": "$csp",
   "description": "$description",
   "launch_path": "/",
   "developer": {
@@ -328,46 +327,109 @@ class Automation(object):
   "default_locale": "en-US",
   "icons": {
   }
 }
 """)
 
     # Create webapps/webapps.json
     webappsDir = os.path.join(profileDir, "webapps")
-    os.mkdir(webappsDir);
+    if not os.access(webappsDir, os.F_OK):
+      os.mkdir(webappsDir)
+
+    lineRe = re.compile(r'(.*?)"(.*?)": (.*)')
+
+    webappsJSONFilename = os.path.join(webappsDir, "webapps.json")
+    webappsJSON = []
+    if os.access(webappsJSONFilename, os.F_OK):
+      # If there is an existing webapps.json file (which will be the case for
+      # b2g), we parse the data in the existing file before appending test
+      # test apps to it.
+      startId = 1
+      webappsJSONFile = open(webappsJSONFilename, "r")
+      contents = webappsJSONFile.read()
 
-    webappsJSON = []
+      for app_content in contents.split('},'):
+        app = {}
+        # ghetto json parser needed due to lack of json/simplejson on test slaves
+        for line in app_content.split('\n'):
+          m = lineRe.match(line)
+          if m:
+            value = m.groups()[2]
+            # remove any trailing commas
+            if value[-1:] == ',':
+              value = value[:-1]
+            # set the app name from a line that looks like this:
+            # "name.gaiamobile.org": {
+            if value == '{':
+              app['id'] = m.groups()[1]
+            # parse string, None, bool and int types
+            elif value[0:1] == '"':
+              app[m.groups()[1]] = value[1:-1]
+            elif value == "null":
+              app[m.groups()[1]] = None
+            elif value == "true":
+              app[m.groups()[1]] = True
+            elif value == "false":
+              app[m.groups()[1]] = False
+            else:
+              app[m.groups()[1]] = int(value)
+        if app:
+          webappsJSON.append(app)
+
+      webappsJSONFile.close()
+
+    startId = 1
+    for app in webappsJSON:
+      if app['localId'] >= startId:
+        startId = app['localId'] + 1
+      if not app.get('csp'):
+        app['csp'] = ''
+      if not app.get('appStatus'):
+        app['appStatus'] = 3
+
     for localId, app in enumerate(apps):
-      app['localId'] = localId + 1 # Has to be 1..n
-      webappsJSON.append(webappJSONTemplate.substitute(app))
-    webappsJSON = '{\n' + ',\n'.join(webappsJSON) + '\n}\n'
+      app['localId'] = localId + startId # localId must be from 1..N
+      if not app.get('id'):
+        app['id'] = app['name']
+      webappsJSON.append(app)
 
-    webappsJSONFile = open(os.path.join(webappsDir, "webapps.json"), "a")
-    webappsJSONFile.write(webappsJSON)
+    contents = []
+    for app in webappsJSON:
+      contents.append(webappJSONTemplate.substitute(app))
+    contents = '{\n' + ',\n'.join(contents) + '\n}\n'
+
+    webappsJSONFile = open(webappsJSONFilename, "w")
+    webappsJSONFile.write(contents)
     webappsJSONFile.close()
 
     # Create manifest file for each app.
     for app in apps:
       manifest = manifestTemplate.substitute(app)
 
       manifestDir = os.path.join(webappsDir, app['name'])
       os.mkdir(manifestDir)
 
       manifestFile = open(os.path.join(manifestDir, "manifest.webapp"), "a")
       manifestFile.write(manifest)
       manifestFile.close()
 
-  def initializeProfile(self, profileDir, extraPrefs = [], useServerLocations = False):
+  def initializeProfile(self, profileDir, extraPrefs=[],
+                        useServerLocations=False,
+                        initialProfile=None):
     " Sets up the standard testing profile."
 
     prefs = []
     # Start with a clean slate.
     shutil.rmtree(profileDir, True)
-    os.mkdir(profileDir)
+
+    if initialProfile:
+      shutil.copytree(initialProfile, profileDir)
+    else:
+      os.mkdir(profileDir)
 
     # Set up permissions database
     locations = self.readLocations()
     self.setupPermissionsDatabase(profileDir,
       {'allowXULXBL':[(l.host, 'noxul' not in l.options) for l in locations]});
 
     part = """\
 user_pref("social.skipLoadingProviders", true);
@@ -595,49 +657,49 @@ user_pref("camino.use_system_proxy_setti
       },
       {
         'name': 'https_example_csp_certified',
         'csp': "default-src *; script-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline'",
         'origin': 'https://example.com',
         'manifestURL': 'https://example.com/manifest_csp_cert.webapp',
         'description': 'https://example.com Certified App with manifest policy',
         'appStatus': _APP_STATUS_CERTIFIED
-      }, 
+      },
       {
         'name': 'https_example_csp_installed',
         'csp': "default-src *; script-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline'",
         'origin': 'https://example.com',
         'manifestURL': 'https://example.com/manifest_csp_inst.webapp',
         'description': 'https://example.com Installed App with manifest policy',
         'appStatus': _APP_STATUS_INSTALLED
-      }, 
+      },
       {
         'name': 'https_example_csp_privileged',
         'csp': "default-src *; script-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline'",
         'origin': 'https://example.com',
         'manifestURL': 'https://example.com/manifest_csp_priv.webapp',
         'description': 'https://example.com Privileged App with manifest policy',
         'appStatus': _APP_STATUS_PRIVILEGED
-      }, 
+      },
       {
         'name': 'https_a_domain_certified',
-        'csp' : "",
+        'csp': "",
         'origin': 'https://acertified.com',
         'manifestURL': 'https://acertified.com/manifest.webapp',
         'description': 'https://acertified.com Certified App',
         'appStatus': _APP_STATUS_CERTIFIED
-      }, 
+      },
       {
         'name': 'https_a_domain_privileged',
         'csp': "",
         'origin': 'https://aprivileged.com',
         'manifestURL': 'https://aprivileged.com/manifest.webapp',
         'description': 'https://aprivileged.com Privileged App ',
         'appStatus': _APP_STATUS_PRIVILEGED
-      }, 
+      },
     ];
     self.setupTestApps(profileDir, apps)
 
   def addCommonOptions(self, parser):
     "Adds command-line options which are common to mochitest and reftest."
 
     parser.add_option("--setpref",
                       action = "append", type = "string",
@@ -1028,17 +1090,17 @@ user_pref("camino.use_system_proxy_setti
 
   def checkForCrashes(self, profileDir, symbolsPath):
     return automationutils.checkForCrashes(os.path.join(profileDir, "minidumps"), symbolsPath, self.lastTestSeen)
 
   def runApp(self, testURL, env, app, profileDir, extraArgs,
              runSSLTunnel = False, utilityPath = None,
              xrePath = None, certPath = None,
              debuggerInfo = None, symbolsPath = None,
-             timeout = -1, maxTime = None):
+             timeout = -1, maxTime = None, onLaunch = None):
     """
     Run the app, log the duration it took to execute, return the status code.
     Kills the app if it runs for longer than |maxTime| seconds, or outputs nothing for |timeout| seconds.
     """
 
     if utilityPath == None:
       utilityPath = self.DIST_BIN
     if xrePath == None:
@@ -1085,16 +1147,21 @@ user_pref("camino.use_system_proxy_setti
     self.lastTestSeen = "automation.py"
     proc = self.Process([cmd] + args,
                  env = self.environment(env, xrePath = xrePath,
                                    crashreporter = not debuggerInfo),
                  stdout = outputPipe,
                  stderr = subprocess.STDOUT)
     self.log.info("INFO | automation.py | Application pid: %d", proc.pid)
 
+    if onLaunch is not None:
+      # Allow callers to specify an onLaunch callback to be fired after the
+      # app is launched.
+      onLaunch()
+
     status = self.waitForFinish(proc, utilityPath, timeout, maxTime, startTime, debuggerInfo, symbolsPath)
     self.log.info("INFO | automation.py | Application ran for: %s", str(datetime.now() - startTime))
 
     # Do a final check for zombie child processes.
     zombieProcesses = self.checkForZombies(processLog)
 
     crashed = self.checkForCrashes(profileDir, symbolsPath)
 

--- a/build/mobile/b2gautomation.py
+++ b/build/mobile/b2gautomation.py
@@ -43,17 +43,17 @@ class B2GRemoteAutomation(Automation):
         self._is_emulator = False
         self.test_script = None
         self.test_script_args = None
 
         # Default our product to b2g
         self._product = "b2g"
         self.lastTestSeen = "b2gautomation.py"
         # Default log finish to mochitest standard
-        self.logFinish = 'INFO SimpleTest FINISHED' 
+        self.logFinish = 'INFO SimpleTest FINISHED'
         Automation.__init__(self)
 
     def setEmulator(self, is_emulator):
         self._is_emulator = is_emulator
 
     def setDeviceManager(self, deviceManager):
         self._devicemanager = deviceManager
 
@@ -80,17 +80,17 @@ class B2GRemoteAutomation(Automation):
         # so no copying of os.environ
         if env is None:
             env = {}
 
         # We always hide the results table in B2G; it's much slower if we don't.
         env['MOZ_HIDE_RESULTS_TABLE'] = '1'
         return env
 
-    def waitForNet(self): 
+    def waitForNet(self):
         active = False
         time_out = 0
         while not active and time_out < 40:
             data = self._devicemanager._runCmd(['shell', '/system/bin/netcfg']).stdout.readlines()
             data.pop(0)
             for line in data:
                 if (re.search(r'UP\s+(?:[0-9]{1,3}\.){3}[0-9]{1,3}', line)):
                     active = True
@@ -101,25 +101,30 @@ class B2GRemoteAutomation(Automation):
 
     def checkForCrashes(self, directory, symbolsPath):
         # XXX: This will have to be updated after crash reporting on b2g
         # is in place.
         dumpDir = tempfile.mkdtemp()
         self._devicemanager.getDirectory(self._remoteProfile + '/minidumps/', dumpDir)
         crashed = automationutils.checkForCrashes(dumpDir, symbolsPath, self.lastTestSeen)
         try:
-          shutil.rmtree(dumpDir)
+            shutil.rmtree(dumpDir)
         except:
-          print "WARNING: unable to remove directory: %s" % (dumpDir)
+            print "WARNING: unable to remove directory: %s" % (dumpDir)
         return crashed
 
-    def initializeProfile(self, profileDir, extraPrefs = [], useServerLocations = False):
+    def initializeProfile(self,  profileDir, extraPrefs=[],
+                          useServerLocations=False,
+                          initialProfile=None):
         # add b2g specific prefs
         extraPrefs.extend(["browser.manifestURL='dummy (bug 772307)'"])
-        return Automation.initializeProfile(self, profileDir, extraPrefs, useServerLocations)
+        return Automation.initializeProfile(self, profileDir,
+                                            extraPrefs,
+                                            useServerLocations,
+                                            initialProfile)
 
     def buildCommandLine(self, app, debuggerInfo, profileDir, testURL, extraArgs):
         # if remote profile is specified, use that instead
         if (self._remoteProfile):
             profileDir = self._remoteProfile
 
         cmd, args = Automation.buildCommandLine(self, app, debuggerInfo, profileDir, testURL, extraArgs)
 
@@ -160,17 +165,17 @@ class B2GRemoteAutomation(Automation):
     def getDeviceStatus(self, serial=None):
         # Get the current status of the device.  If we know the device
         # serial number, we look for that, otherwise we use the (presumably
         # only) device shown in 'adb devices'.
         serial = serial or self._devicemanager.deviceSerial
         status = 'unknown'
 
         for line in self._devicemanager._runCmd(['devices']).stdout.readlines():
-            result =  re.match('(.*?)\t(.*)', line)
+            result = re.match('(.*?)\t(.*)', line)
             if result:
                 thisSerial = result.group(1)
                 if not serial or thisSerial == serial:
                     serial = thisSerial
                     status = result.group(2)
 
         return (serial, status)
 
@@ -218,19 +223,19 @@ class B2GRemoteAutomation(Automation):
 
         # reboot device so it starts up with the mochitest profile
         # XXX:  We could potentially use 'stop b2g' + 'start b2g' to achieve
         # a similar effect; will see which is more stable while attempting
         # to bring up the continuous integration.
         if not self._is_emulator:
             self.rebootDevice()
             time.sleep(5)
-            #wait for wlan to come up 
+            #wait for wlan to come up
             if not self.waitForNet():
-                raise Exception("network did not come up, please configure the network" + 
+                raise Exception("network did not come up, please configure the network" +
                                 " prior to running before running the automation framework")
 
         # stop b2g
         self._devicemanager._runCmd(['shell', 'stop', 'b2g'])
         time.sleep(5)
 
         # relaunch b2g inside b2g instance
         instance = self.B2GInstance(self._devicemanager)
@@ -329,15 +334,38 @@ class B2GRemoteAutomation(Automation):
             lines = []
             while True:
                 try:
                     lines.append(self.queue.get_nowait())
                 except Queue.Empty:
                     break
             return '\n'.join(lines)
 
-        def wait(self, timeout = None):
+        def wait(self, timeout=None):
             # this should never happen
             raise Exception("'wait' called on B2GInstance")
 
         def kill(self):
             # this should never happen
             raise Exception("'kill' called on B2GInstance")
+
+
+class B2GDesktopAutomation(Automation):
+
+    def buildCommandLine(self, app, debuggerInfo, profileDir, testURL, extraArgs):
+        """ build the application command line """
+
+        cmd = os.path.abspath(app)
+        args = []
+
+        if debuggerInfo:
+            args.extend(debuggerInfo["args"])
+            args.append(cmd)
+            cmd = os.path.abspath(debuggerInfo["path"])
+
+        if self.IS_MAC:
+            args.append("-foreground")
+
+        profileDirectory = profileDir + "/"
+
+        args.extend(("-profile", profileDirectory))
+        args.extend(extraArgs)
+        return cmd, args

--- a/build/unix/elfhack/elf.cpp
+++ b/build/unix/elfhack/elf.cpp
@@ -254,17 +254,25 @@ Elf::Elf(std::ifstream &file)
         if (phdr.p_type == PT_PHDR)
             segment->addSection(phdr_section);
         for (int j = 1; j < ehdr->e_shnum; j++)
             if (phdr.contains(sections[j]))
                 segment->addSection(sections[j]);
         // Make sure that our view of segments corresponds to the original
         // ELF file.
         assert(segment->getFileSize() == phdr.p_filesz);
-        assert(segment->getMemSize() == phdr.p_memsz);
+        // gold makes TLS segments end on an aligned virtual address, even
+        // when the underlying section ends before that, while bfd ld
+        // doesn't. It's fine if we don't keep that alignment.
+        unsigned int memsize = segment->getMemSize();
+        if (phdr.p_type == PT_TLS && memsize != phdr.p_memsz) {
+            unsigned int align = segment->getAlign();
+            memsize = (memsize + align - 1) & ~(align - 1);
+        }
+        assert(memsize == phdr.p_memsz);
         segments.push_back(segment);
     }
 
     new (&eh_entry) ElfLocation(ehdr->e_entry, this);
 }
 
 Elf::~Elf()
 {

--- a/build/unix/elfhack/test.c
+++ b/build/unix/elfhack/test.c
@@ -117,18 +117,22 @@ static int ret = 1;
 int print_status() {
     fprintf(stderr, "%s\n", ret ? "FAIL" : "PASS");
     return ret;
 }
 
 /* On ARM, this creates a .tbss section before .init_array, which
  * elfhack could then pick instead of .init_array.
  * Also, when .tbss is big enough, elfhack may wrongfully consider
- * following sections as part of the PT_TLS segment. */
-__thread int foo[1024];
+ * following sections as part of the PT_TLS segment.
+ * Finally, gold makes TLS segments end on an aligned virtual address,
+ * even when the underlying section ends before that, and elfhack
+ * sanity checks may yield an error. */
+__thread int foo;
+__thread long long int bar[512];
 
 void end_test() {
     static int count = 0;
     /* Only exit when both constructors have been called */
     if (++count == 2)
         ret = 0;
 }
 

--- a/build/valgrind/cross-architecture.sup
+++ b/build/valgrind/cross-architecture.sup
@@ -250,16 +250,24 @@
    Bug 812423
    Memcheck:Leak
    fun:malloc
    fun:_ZN2js15ArgumentsObject6createI18CopyStackFrameArgsEEPS0_P9JSContextN2JS6HandleIP8JSScriptEENS7_IP10JSFunctionEEjRT_
    fun:_ZN2js15ArgumentsObject14createExpectedEP9JSContextPNS_10StackFrameE
    ...
 }
 {
+   Bug 812423
+   Memcheck:Leak
+   fun:malloc
+   fun:_ZN2js15ArgumentsObject6createI13CopyFrameArgsEEPS0_P9JSContextN2JS6HandleIP8JSScriptEENS7_IP10JSFunctionEEjRT_
+   fun:_ZN2js15ArgumentsObject14createExpectedEP9JSContextNS_16AbstractFramePtrE
+   ...
+}
+{
    Bug 823782
    Memcheck:Leak
    fun:malloc
    ...
    fun:_ZN2js6ctypes7LibraryL7DeclareEP9JSContextjPN2JS5ValueE
    ...
 }
 {

--- a/build/virtualenv/populate_virtualenv.py
+++ b/build/virtualenv/populate_virtualenv.py
@@ -240,22 +240,18 @@ class VirtualenvManager(object):
         program = [sys.executable, setup]
         program.extend(arguments)
 
         # We probably could call the contents of this file inside the context
         # of this interpreter using execfile() or similar. However, if global
         # variables like sys.path are adjusted, this could cause all kinds of
         # havoc. While this may work, invoking a new process is safer.
 
-        # TODO Use check_output when we require Python 2.7.
-        fn = getattr(subprocess, 'check_output',
-                VirtualenvManager._check_output)
-
         try:
-            output = fn(program, cwd=directory, stderr=subprocess.STDOUT)
+            output = subprocess.check_output(program, cwd=directory, stderr=subprocess.STDOUT)
             print(output)
         except subprocess.CalledProcessError as e:
             if 'Python.h: No such file or directory' in e.output:
                 print('WARNING: Python.h not found. Install Python development headers.')
             else:
                 print(e.output)
 
             raise Exception('Error installing package: %s' % directory)
@@ -289,31 +285,16 @@ class VirtualenvManager(object):
 
         If you run a random Python script and wish to "activate" the
         virtualenv, you can simply instantiate an instance of this class
         and call .ensure() and .activate() to make the virtualenv active.
         """
 
         execfile(self.activate_path, dict(__file__=self.activate_path))
 
-    # TODO Eliminate when we require Python 2.7.
-    @staticmethod
-    def _check_output(*args, **kwargs):
-        """Python 2.6 compatible implementation of subprocess.check_output."""
-        proc = subprocess.Popen(stdout=subprocess.PIPE, *args, **kwargs)
-        output, unused_err = proc.communicate()
-        retcode = proc.poll()
-        if retcode:
-            cmd = kwargs.get('args', args[0])
-            e = subprocess.CalledProcessError(retcode, cmd)
-            e.output = output
-            raise e
-
-        return output
-
 
 def verify_python_version(log_handle):
     """Ensure the current version of Python is sufficient."""
     major, minor = sys.version_info[:2]
 
     if major != MINIMUM_PYTHON_MAJOR or minor < MINIMUM_PYTHON_MINOR:
         log_handle.write('Python %d.%d or greater (but not Python 3) is '
             'required to build. ' %

--- a/configure.in
+++ b/configure.in
@@ -142,39 +142,17 @@ if test -e $_objdir/CLOBBER; then
     echo "	***"
     exit 1
     break;
   fi
 else
   touch $_objdir/CLOBBER
 fi
 
-MOZ_PATH_PROGS(PYTHON, $PYTHON python2.7 python)
-if test -z "$PYTHON"; then
-    AC_MSG_ERROR([python was not found in \$PATH])
-fi
-
-AC_MSG_RESULT([Creating Python environment])
-dnl This verifies our Python version is sane and ensures the Python
-dnl virtualenv is present and up to date. It sanitizes the environment
-dnl for us, so we don't need to clean anything out.
-$PYTHON $_topsrcdir/build/virtualenv/populate_virtualenv.py \
-    $_topsrcdir $MOZ_BUILD_ROOT/_virtualenv || exit 1
-
-dnl Create a virtualenv where we can install local Python packages
-case "$host_os" in
-mingw*)
-    PYTHON=`cd $MOZ_BUILD_ROOT && pwd -W`/_virtualenv/Scripts/python.exe
-    ;;
-*)
-    PYTHON=$MOZ_BUILD_ROOT/_virtualenv/bin/python
-    ;;
-esac
-
-AC_SUBST(PYTHON)
+MOZ_PYTHON
 
 MOZ_DEFAULT_COMPILER
 
 COMPILE_ENVIRONMENT=1
 MOZ_ARG_DISABLE_BOOL(compile-environment,
 [  --disable-compile-environment
                           Disable compiler/library checks.],
     COMPILE_ENVIRONMENT= )
@@ -1398,16 +1376,19 @@ if test -n "$MOZ_LLVM_HACKS"; then
 fi
 AC_SUBST(MOZ_NO_WLZDEFS)
 AC_SUBST(MOZ_CFLAGS_NSS)
 
 dnl ========================================================
 dnl GNU specific defaults
 dnl ========================================================
 if test "$GNU_CC"; then
+    # Per bug 719659 comment 2, some of the headers on ancient build machines
+    # may require gnu89 inline semantics.  But otherwise, we use C99.
+    CFLAGS="$CFLAGS -std=gnu99 -fgnu89-inline"
     # FIXME: Let us build with strict aliasing. bug 414641.
     CFLAGS="$CFLAGS -fno-strict-aliasing"
     MKSHLIB='$(CXX) $(CXXFLAGS) $(DSO_PIC_CFLAGS) $(DSO_LDOPTS) -Wl,-h,$@ -o $@'
     MKCSHLIB='$(CC) $(CFLAGS) $(DSO_PIC_CFLAGS) $(DSO_LDOPTS) -Wl,-h,$@ -o $@'
     DSO_LDOPTS='-shared'
     if test "$GCC_USE_GNU_LD"; then
         # Some tools like ASan use a runtime library that is only
         # linked against executables, so we must allow undefined
@@ -9342,15 +9323,18 @@ if test -n "$MOZ_GLUE_PROGRAM_LDFLAGS"; 
 fi
 if test "$MOZ_NATIVE_ZLIB" != 1 -a "$OS_ARCH" = "WINNT"; then
    MOZ_ZLIB_LIBS=
 fi
 export MOZ_NATIVE_ZLIB
 export MOZ_ZLIB_CFLAGS
 export MOZ_ZLIB_LIBS
 export MOZ_APP_NAME
+export DONT_POPULATE_VIRTUALENV=1
+export PYTHON
+export MOZILLA_CENTRAL_PATH=$_topsrcdir
 export STLPORT_CPPFLAGS
 export STLPORT_LDFLAGS
 export STLPORT_LIBS
 AC_OUTPUT_SUBDIRS(js/src)
 ac_configure_args="$_SUBDIR_CONFIG_ARGS"
 
 fi # COMPILE_ENVIRONMENT && !LIBXUL_SDK_DIR

--- a/content/base/public/nsContentUtils.h
+++ b/content/base/public/nsContentUtils.h
@@ -433,16 +433,23 @@ public:
   {
     return sSecurityManager;
   }
 
   // Returns the subject principal. Guaranteed to return non-null. May only
   // be called when nsContentUtils is initialized.
   static nsIPrincipal* GetSubjectPrincipal();
 
+  // Returns the principal of the given JS object. This should never be null
+  // for any object in the XPConnect runtime.
+  //
+  // In general, being interested in the principal of an object is enough to
+  // guarantee that the return value is non-null.
+  static nsIPrincipal* GetObjectPrincipal(JSObject* aObj);
+
   static nsresult GenerateStateKey(nsIContent* aContent,
                                    const nsIDocument* aDocument,
                                    nsACString& aKey);
 
   /**
    * Create a new nsIURI from aSpec, using aBaseURI as the base.  The
    * origin charset of the new nsIURI will be the document charset of
    * aDocument.
@@ -2205,16 +2212,17 @@ private:
   // Combined code for PushNull() and Push(JSContext*)
   bool DoPush(JSContext* cx);
 
   nsCOMPtr<nsIScriptContext> mScx;
   bool mScriptIsRunning;
   bool mPushedSomething;
 #ifdef DEBUG
   JSContext* mPushedContext;
+  unsigned mCompartmentDepthOnEntry;
 #endif
 };
 
 class NS_STACK_CLASS nsAutoScriptBlocker {
 public:
   nsAutoScriptBlocker(MOZ_GUARD_OBJECT_NOTIFIER_ONLY_PARAM) {
     MOZ_GUARD_OBJECT_NOTIFIER_INIT;
     nsContentUtils::AddScriptBlocker();

--- a/content/base/src/EventSource.cpp
+++ b/content/base/src/EventSource.cpp
@@ -74,18 +74,16 @@ EventSource::~EventSource()
 {
   Close();
 }
 
 //-----------------------------------------------------------------------------
 // EventSource::nsISupports
 //-----------------------------------------------------------------------------
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(EventSource)
-
 NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_BEGIN(EventSource)
   bool isBlack = tmp->IsBlack();
   if (isBlack || tmp->mWaitingForOnStopRequest) {
     if (tmp->mListenerManager) {
       tmp->mListenerManager->MarkForCC();
     }
     if (!isBlack && tmp->PreservingWrapper()) {
       xpc_UnmarkGrayObject(tmp->GetWrapperPreserveColor());
@@ -525,25 +523,17 @@ public:
 
     return NS_OK;
   }
 
 private:
   nsRefPtr<EventSource> mEventSource;
 };
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(AsyncVerifyRedirectCallbackFwr)
-
-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(AsyncVerifyRedirectCallbackFwr)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mEventSource)
-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
-
-NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(AsyncVerifyRedirectCallbackFwr)
-  NS_IMPL_CYCLE_COLLECTION_UNLINK(mEventSource)
-NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+NS_IMPL_CYCLE_COLLECTION_1(AsyncVerifyRedirectCallbackFwr, mEventSource)
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(AsyncVerifyRedirectCallbackFwr)
   NS_INTERFACE_MAP_ENTRY(nsISupports)
   NS_INTERFACE_MAP_ENTRY(nsIAsyncVerifyRedirectCallback)
 NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(AsyncVerifyRedirectCallbackFwr)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(AsyncVerifyRedirectCallbackFwr)

--- a/content/base/src/FileIOObject.cpp
+++ b/content/base/src/FileIOObject.cpp
@@ -24,18 +24,16 @@ NS_IMPL_ADDREF_INHERITED(FileIOObject, n
 NS_IMPL_RELEASE_INHERITED(FileIOObject, nsDOMEventTargetHelper)
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(FileIOObject)
   NS_INTERFACE_MAP_ENTRY(nsITimerCallback)
   NS_INTERFACE_MAP_ENTRY(nsIStreamListener)
   NS_INTERFACE_MAP_ENTRY(nsIRequestObserver)
 NS_INTERFACE_MAP_END_INHERITING(nsDOMEventTargetHelper)
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(FileIOObject)
-
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(FileIOObject,
                                                   nsDOMEventTargetHelper)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mProgressNotifier)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mError)
   // Can't traverse mChannel because it's a multithreaded object.
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(FileIOObject,

--- a/content/base/src/FragmentOrElement.cpp
+++ b/content/base/src/FragmentOrElement.cpp
@@ -958,18 +958,16 @@ FragmentOrElement::FireNodeInserted(nsID
     }
   }
 }
 
 //----------------------------------------------------------------------
 
 // nsISupports implementation
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(FragmentOrElement)
-
 #define SUBTREE_UNBINDINGS_PER_RUNNABLE 500
 
 class ContentUnbinder : public nsRunnable
 {
 public:
   ContentUnbinder()
   {
     nsLayoutStatics::AddRef();

--- a/content/base/src/WebSocket.cpp
+++ b/content/base/src/WebSocket.cpp
@@ -571,18 +571,16 @@ WebSocket::Constructor(JSContext* aCx,
   if (NS_FAILED(rv)) {
     aRv.Throw(rv);
     return nullptr;
   }
 
   return webSocket.forget();
 }
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(WebSocket)
-
 NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_BEGIN(WebSocket)
   bool isBlack = tmp->IsBlack();
   if (isBlack|| tmp->mKeepingAlive) {
     if (tmp->mListenerManager) {
       tmp->mListenerManager->MarkForCC();
     }
     if (!isBlack && tmp->PreservingWrapper()) {
       xpc_UnmarkGrayObject(tmp->GetWrapperPreserveColor());

--- a/content/base/src/nsContentIterator.cpp
+++ b/content/base/src/nsContentIterator.cpp
@@ -1141,17 +1141,16 @@ protected:
 };
 
 NS_IMPL_ADDREF_INHERITED(nsContentSubtreeIterator, nsContentIterator)
 NS_IMPL_RELEASE_INHERITED(nsContentSubtreeIterator, nsContentIterator)
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(nsContentSubtreeIterator)
 NS_INTERFACE_MAP_END_INHERITING(nsContentIterator)
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsContentSubtreeIterator)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsContentSubtreeIterator, nsContentIterator)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mRange)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsContentSubtreeIterator, nsContentIterator)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mRange)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 

--- a/content/base/src/nsContentList.cpp
+++ b/content/base/src/nsContentList.cpp
@@ -39,17 +39,16 @@
 #endif
 
 using namespace mozilla::dom;
 
 nsBaseContentList::~nsBaseContentList()
 {
 }
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsBaseContentList)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsBaseContentList)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mElements)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsBaseContentList)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_SCRIPT_OBJECTS
   if (nsCCUncollectableMarker::sGeneration && tmp->IsBlack() &&
       MOZ_LIKELY(!cb.WantAllTraces())) {
@@ -140,17 +139,16 @@ nsBaseContentList::IndexOf(nsIContent *a
 }
 
 int32_t
 nsBaseContentList::IndexOf(nsIContent* aContent)
 {
   return IndexOf(aContent, true);
 }
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsSimpleContentList)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsSimpleContentList,
                                                   nsBaseContentList)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mRoot)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsSimpleContentList,
                                                 nsBaseContentList)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mRoot)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END

--- a/content/base/src/nsContentSink.cpp
+++ b/content/base/src/nsContentSink.cpp
@@ -62,17 +62,16 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
   NS_INTERFACE_MAP_ENTRY(nsICSSLoaderObserver)
   NS_INTERFACE_MAP_ENTRY(nsISupportsWeakReference)
   NS_INTERFACE_MAP_ENTRY(nsIDocumentObserver)
   NS_INTERFACE_MAP_ENTRY(nsIMutationObserver)
   NS_INTERFACE_MAP_ENTRY(nsITimerCallback)
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIDocumentObserver)
 NS_INTERFACE_MAP_END
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsContentSink)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsContentSink)
   if (tmp->mDocument) {
     tmp->mDocument->RemoveObserver(tmp);
   }
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mDocument)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mParser)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mNodeInfoManager)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mScriptLoader)

--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -2326,16 +2326,27 @@ nsContentUtils::GetSubjectPrincipal()
   // When the ssm says the subject is null, that means system principal.
   if (!subject)
     sSecurityManager->GetSystemPrincipal(getter_AddRefs(subject));
 
   return subject;
 }
 
 // static
+nsIPrincipal*
+nsContentUtils::GetObjectPrincipal(JSObject* aObj)
+{
+  // This is duplicated from nsScriptSecurityManager. We don't call through there
+  // because the API unnecessarily requires a JSContext for historical reasons.
+  JSCompartment *compartment = js::GetObjectCompartment(aObj);
+  JSPrincipals *principals = JS_GetCompartmentPrincipals(compartment);
+  return nsJSPrincipals::get(principals);
+}
+
+// static
 nsresult
 nsContentUtils::NewURIWithDocumentCharset(nsIURI** aResult,
                                           const nsAString& aSpec,
                                           nsIDocument* aDocument,
                                           nsIURI* aBaseURI)
 {
   return NS_NewURI(aResult, aSpec,
                    aDocument ? aDocument->GetDocumentCharacterSet().get() : nullptr,
@@ -3071,16 +3082,18 @@ nsCxPusher::DoPush(JSContext* cx)
     mScriptIsRunning = false;
     mScx = nullptr;
     return false;
   }
 
   mPushedSomething = true;
 #ifdef DEBUG
   mPushedContext = cx;
+  if (cx)
+    mCompartmentDepthOnEntry = js::GetEnterCompartmentDepth(cx);
 #endif
   return true;
 }
 
 bool
 nsCxPusher::PushNull()
 {
   return DoPush(nullptr);
@@ -3095,16 +3108,24 @@ nsCxPusher::Pop()
     mPushedSomething = false;
 
     NS_ASSERTION(!mScriptIsRunning, "Huh, this can't be happening, "
                  "mScriptIsRunning can't be set here!");
 
     return;
   }
 
+  // When we push a context, we may save the frame chain and pretend like we
+  // haven't entered any compartment. This gets restored on Pop(), but we can
+  // run into trouble if a Push/Pop are interleaved with a
+  // JSAutoEnterCompartment. Make sure the compartment depth right before we
+  // pop is the same as it was right after we pushed.
+  MOZ_ASSERT_IF(mPushedContext, mCompartmentDepthOnEntry ==
+                                js::GetEnterCompartmentDepth(mPushedContext));
+
   JSContext *unused;
   stack->Pop(&unused);
 
   NS_ASSERTION(unused == mPushedContext, "Unexpected context popped");
 
   if (!mScriptIsRunning && mScx) {
     // No JS is running in the context, but executing the event handler might have
     // caused some JS to run. Tell the script context that it's done.

--- a/content/base/src/nsDOMAttribute.cpp
+++ b/content/base/src/nsDOMAttribute.cpp
@@ -42,18 +42,16 @@ nsDOMAttribute::nsDOMAttribute(nsDOMAttr
   NS_ABORT_IF_FALSE(mNodeInfo, "We must get a nodeinfo here!");
   NS_ABORT_IF_FALSE(mNodeInfo->NodeType() == nsIDOMNode::ATTRIBUTE_NODE,
                     "Wrong nodeType");
 
   // We don't add a reference to our content. It will tell us
   // to drop our reference when it goes away.
 }
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsDOMAttribute)
-
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsDOMAttribute)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_SCRIPT_OBJECTS
 
   if (!nsINode::Traverse(tmp, cb)) {
     return NS_SUCCESS_INTERRUPTED_TRAVERSE;
   }
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 

--- a/content/base/src/nsDOMAttributeMap.cpp
+++ b/content/base/src/nsDOMAttributeMap.cpp
@@ -50,18 +50,16 @@ nsDOMAttributeMap::~nsDOMAttributeMap()
 
 void
 nsDOMAttributeMap::DropReference()
 {
   mAttributeCache.Enumerate(RemoveMapRef, nullptr);
   mContent = nullptr;
 }
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsDOMAttributeMap)
-
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsDOMAttributeMap)
   tmp->DropReference();
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 
 PLDHashOperator
 TraverseMapEntry(nsAttrHashKey::KeyType aKey, nsRefPtr<nsDOMAttribute>& aData,
                  void* aUserArg)

--- a/content/base/src/nsDOMDataChannel.cpp
+++ b/content/base/src/nsDOMDataChannel.cpp
@@ -97,18 +97,16 @@ private:
   {
     DC_BINARY_TYPE_ARRAYBUFFER,
     DC_BINARY_TYPE_BLOB,
   } mBinaryType;
 };
 
 DOMCI_DATA(DataChannel, nsDOMDataChannel)
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsDOMDataChannel)
-
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsDOMDataChannel,
                                                   nsDOMEventTargetHelper)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsDOMDataChannel,
                                                 nsDOMEventTargetHelper)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 

--- a/content/base/src/nsDOMFileReader.cpp
+++ b/content/base/src/nsDOMFileReader.cpp
@@ -50,18 +50,16 @@ using namespace mozilla;
 
 #define LOAD_STR "load"
 #define LOADSTART_STR "loadstart"
 #define LOADEND_STR "loadend"
 
 using mozilla::dom::EncodingUtils;
 using mozilla::dom::FileIOObject;
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsDOMFileReader)
-
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsDOMFileReader,
                                                   FileIOObject)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mFile)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mPrincipal)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsDOMFileReader,
                                                 FileIOObject)

--- a/content/base/src/nsDOMMutationObserver.cpp
+++ b/content/base/src/nsDOMMutationObserver.cpp
@@ -39,18 +39,16 @@ nsINodeList*
 nsDOMMutationRecord::RemovedNodes()
 {
   if (!mRemovedNodes) {
     mRemovedNodes = new nsSimpleContentList(mTarget);
   }
   return mRemovedNodes;
 }
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsDOMMutationRecord)
-
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsDOMMutationRecord)
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsDOMMutationRecord)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsDOMMutationRecord)
 
@@ -335,18 +333,16 @@ nsMutationReceiver::ContentRemoved(nsIDo
 void nsMutationReceiver::NodeWillBeDestroyed(const nsINode *aNode)
 {
   NS_ASSERTION(!mParent, "Shouldn't have mParent here!");
   Disconnect(true);
 }
 
 // Observer
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsDOMMutationObserver)
-
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsDOMMutationObserver)
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsDOMMutationObserver)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsDOMMutationObserver)
 

--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -1469,18 +1469,16 @@ nsDocument::~nsDocument()
   // We don't want to leave residual locks on images. Make sure we're in an
   // unlocked state, and then clear the table.
   SetImageLockingState(false);
   mImageTracker.Clear();
 
   mPlugins.Clear();
 }
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsDocument)
-
 NS_INTERFACE_TABLE_HEAD(nsDocument)
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_DOCUMENT_INTERFACE_TABLE_BEGIN(nsDocument)
     NS_INTERFACE_TABLE_ENTRY(nsDocument, nsIDocument)
     NS_INTERFACE_TABLE_ENTRY(nsDocument, nsIDOMDocumentXBL)
     NS_INTERFACE_TABLE_ENTRY(nsDocument, nsIScriptObjectPrincipal)
     NS_INTERFACE_TABLE_ENTRY(nsDocument, nsIDOMEventTarget)
     NS_INTERFACE_TABLE_ENTRY(nsDocument, nsISupportsWeakReference)

--- a/content/base/src/nsDocumentEncoder.cpp
+++ b/content/base/src/nsDocumentEncoder.cpp
@@ -159,18 +159,16 @@ protected:
   // Used when context has already been serialized for
   // table cell selections (where parent is <tr>)
   bool              mDisableContextSerialize;
   bool              mIsCopying;  // Set to true only while copying
   bool              mNodeIsContainer;
   nsStringBuffer*   mCachedBuffer;
 };
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsDocumentEncoder)
-
 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsDocumentEncoder)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsDocumentEncoder)
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsDocumentEncoder)
    NS_INTERFACE_MAP_ENTRY(nsIDocumentEncoder)
    NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 

--- a/content/base/src/nsFrameLoader.cpp
+++ b/content/base/src/nsFrameLoader.cpp
@@ -252,18 +252,16 @@ nsContentView::GetId(nsContentViewId* aI
 // does not count chrome frames when determining depth, nor does it
 // prevent chrome recursion.  Number is fairly arbitrary, but meant to
 // keep number of shells to a reasonable number on accidental recursion with a
 // small (but not 1) branching factor.  With large branching factors the number
 // of shells can rapidly become huge and run us out of memory.  To solve that,
 // we'd need to re-institute a fixed version of bug 98158.
 #define MAX_DEPTH_CONTENT_FRAMES 10
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsFrameLoader)
-
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsFrameLoader)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mDocShell)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mMessageManager)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mChildMessageManager)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsFrameLoader)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mDocShell)

--- a/content/base/src/nsFrameMessageManager.cpp
+++ b/content/base/src/nsFrameMessageManager.cpp
@@ -52,18 +52,16 @@ IsChromeProcess()
   if (!rt)
     return true;
 
   uint32_t type;
   rt->GetProcessType(&type);
   return type == nsIXULRuntime::PROCESS_TYPE_DEFAULT;
 }
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsFrameMessageManager)
-
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsFrameMessageManager)
   uint32_t count = tmp->mListeners.Length();
   for (uint32_t i = 0; i < count; i++) {
     NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mListeners[i] mListener");
     cb.NoteXPCOMChild(tmp->mListeners[i].mListener.get());
   }
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mChildManagers)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END

--- a/content/base/src/nsGenericDOMDataNode.cpp
+++ b/content/base/src/nsGenericDOMDataNode.cpp
@@ -57,18 +57,16 @@ nsGenericDOMDataNode::~nsGenericDOMDataN
 {
   NS_PRECONDITION(!IsInDoc(),
                   "Please remove this from the document properly");
   if (GetParent()) {
     NS_RELEASE(mParent);
   }
 }
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsGenericDOMDataNode)
-
 NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(nsGenericDOMDataNode)
   nsINode::Trace(tmp, aCallback, aClosure);
 NS_IMPL_CYCLE_COLLECTION_TRACE_END
 
 NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_BEGIN(nsGenericDOMDataNode)
   return Element::CanSkip(tmp, aRemovingAllowed);
 NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_END
 

--- a/content/base/src/nsInProcessTabChildGlobal.cpp
+++ b/content/base/src/nsInProcessTabChildGlobal.cpp
@@ -150,18 +150,16 @@ nsInProcessTabChildGlobal::Init()
   nsIURI* docURI = mOwner->OwnerDoc()->GetDocumentURI();
   if (mGlobal && NS_SUCCEEDED(mGlobal->GetJSObject(&global)) && docURI) {
     xpc::SetLocationForGlobal(global, docURI);
   }
 
   return NS_OK;
 }
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsInProcessTabChildGlobal)
-
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsInProcessTabChildGlobal,
                                                 nsDOMEventTargetHelper)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mMessageManager)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mGlobal)
   nsFrameScriptExecutor::Unlink(tmp);
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsInProcessTabChildGlobal,

--- a/content/base/src/nsNodeInfo.cpp
+++ b/content/base/src/nsNodeInfo.cpp
@@ -143,17 +143,16 @@ nsNodeInfo::nsNodeInfo(nsIAtom *aName, n
       NS_ABORT_IF_FALSE(aNodeType == UINT16_MAX,
                         "Unknown node type");
   }
 }
 
 
 // nsISupports
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsNodeInfo)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_0(nsNodeInfo)
 
 static const char* kNSURIs[] = {
   " ([none])",
   " (xmlns)",
   " (xml)",
   " (xhtml)",
   " (XLink)",

--- a/content/base/src/nsNodeInfoManager.cpp
+++ b/content/base/src/nsNodeInfoManager.cpp
@@ -124,18 +124,16 @@ nsNodeInfoManager::~nsNodeInfoManager()
   if (gNodeInfoManagerLeakPRLog)
     PR_LOG(gNodeInfoManagerLeakPRLog, PR_LOG_DEBUG,
            ("NODEINFOMANAGER %p destroyed", this));
 #endif
 
   nsLayoutStatics::Release();
 }
 
-
-NS_IMPL_CYCLE_COLLECTION_NATIVE_CLASS(nsNodeInfoManager)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_0(nsNodeInfoManager)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsNodeInfoManager)
   if (tmp->mDocument &&
       nsCCUncollectableMarker::InGeneration(cb,
                                             tmp->mDocument->GetMarkedCCGeneration())) {
     return NS_SUCCESS_INTERRUPTED_TRAVERSE;
   }
   if (tmp->mNonDocumentNodeInfos) {

--- a/content/base/src/nsNodeIterator.cpp
+++ b/content/base/src/nsNodeIterator.cpp
@@ -151,17 +151,16 @@ nsNodeIterator::~nsNodeIterator()
     if (!mDetached && mRoot)
         mRoot->RemoveMutationObserver(this);
 }
 
 /*
  * nsISupports and cycle collection stuff
  */
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsNodeIterator)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsNodeIterator)
     if (!tmp->mDetached && tmp->mRoot)
         tmp->mRoot->RemoveMutationObserver(tmp);
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mRoot)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mFilter)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsNodeIterator)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mRoot)

--- a/content/base/src/nsRange.cpp
+++ b/content/base/src/nsRange.cpp
@@ -248,18 +248,16 @@ nsRange::CreateRange(nsIDOMNode* aStartP
   range.forget(aRange);
   return rv;
 }
 
 /******************************************************
  * nsISupports
  ******************************************************/
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsRange)
-
 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsRange)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsRange)
 
 DOMCI_DATA(Range, nsRange)
 
 // QueryInterface implementation for nsRange
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsRange)
   NS_INTERFACE_MAP_ENTRY(nsIDOMRange)

--- a/content/base/src/nsScriptLoader.cpp
+++ b/content/base/src/nsScriptLoader.cpp
@@ -17,16 +17,17 @@
 #include "mozilla/dom/Element.h"
 #include "nsGkAtoms.h"
 #include "nsNetUtil.h"
 #include "nsIScriptGlobalObject.h"
 #include "nsIScriptContext.h"
 #include "nsIScriptRuntime.h"
 #include "nsIScriptSecurityManager.h"
 #include "nsIPrincipal.h"
+#include "nsJSPrincipals.h"
 #include "nsContentPolicyUtils.h"
 #include "nsIHttpChannel.h"
 #include "nsIHttpChannelInternal.h"
 #include "nsIScriptElement.h"
 #include "nsIDOMHTMLScriptElement.h"
 #include "nsIDocShell.h"
 #include "nsContentUtils.h"
 #include "nsUnicharUtils.h"
@@ -850,23 +851,28 @@ nsScriptLoader::EvaluateScript(nsScriptL
   nsCOMPtr<nsIScriptElement> oldCurrent = mCurrentScript;
   mCurrentScript = aRequest->mElement;
 
   // It's very important to use aRequest->mURI, not the final URI of the channel
   // aRequest ended up getting script data from, as the script filename.
   nsAutoCString url;
   nsContentUtils::GetWrapperSafeScriptFilename(mDocument, aRequest->mURI, url);
 
-  bool isUndefined;
-  rv = context->EvaluateString(aScript, globalObject->GetGlobalJSObject(),
-                               mDocument->NodePrincipal(),
-                               aRequest->mOriginPrincipal,
-                               url.get(), aRequest->mLineNo,
-                               JSVersion(aRequest->mJSVersion), nullptr,
-                               &isUndefined);
+  JSVersion version = JSVersion(aRequest->mJSVersion);
+  if (version != JSVERSION_UNKNOWN) {
+    JS::CompileOptions options(context->GetNativeContext());
+    options.setFileAndLine(url.get(), aRequest->mLineNo)
+           .setVersion(JSVersion(aRequest->mJSVersion));
+    if (aRequest->mOriginPrincipal) {
+      options.setOriginPrincipals(nsJSPrincipals::get(aRequest->mOriginPrincipal));
+    }
+    JS::Value ignored;
+    rv = context->EvaluateString(aScript, *globalObject->GetGlobalJSObject(),
+                                 options, /* aCoerceToString = */ false, &ignored);
+  }
 
   // Put the old script back in case it wants to do anything else.
   mCurrentScript = oldCurrent;
 
   JSContext *cx = nullptr; // Initialize this to keep GCC happy.
   cx = context->GetNativeContext();
   JSAutoRequest ar(cx);
   context->SetProcessingScriptTag(oldProcessingScriptTag);

--- a/content/base/src/nsXMLHttpRequest.cpp
+++ b/content/base/src/nsXMLHttpRequest.cpp
@@ -333,18 +333,16 @@ XMLHttpRequestAuthPrompt::PromptPassword
                                          bool* aRetval)
 {
   *aRetval = false;
   return NS_OK;
 }
 
 /////////////////////////////////////////////
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsXHREventTarget)
-
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsXHREventTarget,
                                                   nsDOMEventTargetHelper)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsXHREventTarget,
                                                 nsDOMEventTargetHelper)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
@@ -561,18 +559,16 @@ nsXMLHttpRequest::ResetResponse()
 }
 
 void
 nsXMLHttpRequest::SetRequestObserver(nsIRequestObserver* aObserver)
 {
   mRequestObserver = aObserver;
 }
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsXMLHttpRequest)
-
 NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_BEGIN(nsXMLHttpRequest)
   bool isBlack = tmp->IsBlack();
   if (isBlack || tmp->mWaitingForOnStopRequest) {
     if (tmp->mListenerManager) {
       tmp->mListenerManager->MarkForCC();
     }
     if (!isBlack && tmp->PreservingWrapper()) {
       xpc_UnmarkGrayObject(tmp->GetWrapperPreserveColor());
@@ -3506,25 +3502,17 @@ public:
 
     return NS_OK;
   }
 
 private:
   nsRefPtr<nsXMLHttpRequest> mXHR;
 };
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(AsyncVerifyRedirectCallbackForwarder)
-
-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(AsyncVerifyRedirectCallbackForwarder)
-NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mXHR)
-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
-
-NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(AsyncVerifyRedirectCallbackForwarder)
-  NS_IMPL_CYCLE_COLLECTION_UNLINK(mXHR)
-NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+NS_IMPL_CYCLE_COLLECTION_1(AsyncVerifyRedirectCallbackForwarder, mXHR)
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(AsyncVerifyRedirectCallbackForwarder)
   NS_INTERFACE_MAP_ENTRY(nsISupports)
   NS_INTERFACE_MAP_ENTRY(nsIAsyncVerifyRedirectCallback)
 NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(AsyncVerifyRedirectCallbackForwarder)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(AsyncVerifyRedirectCallbackForwarder)
@@ -4007,18 +3995,16 @@ nsXMLHttpProgressEvent::nsXMLHttpProgres
   mInner = aInner;
   mCurProgress = aCurrentProgress;
   mMaxProgress = aMaxProgress;
 }
 
 nsXMLHttpProgressEvent::~nsXMLHttpProgressEvent()
 {}
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsXMLHttpProgressEvent)
-
 DOMCI_DATA(XMLHttpProgressEvent, nsXMLHttpProgressEvent)
 
 // QueryInterface implementation for nsXMLHttpProgressEvent
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsXMLHttpProgressEvent)
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIDOMProgressEvent)
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsIDOMEvent, nsIDOMProgressEvent)
   NS_INTERFACE_MAP_ENTRY(nsIDOMProgressEvent)
   NS_INTERFACE_MAP_ENTRY(nsIDOMLSProgressEvent)
@@ -4085,18 +4071,16 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIStreamListener)
 NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsXMLHttpRequestXPCOMifier)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsXMLHttpRequestXPCOMifier)
 
 // Can't NS_IMPL_CYCLE_COLLECTION_1 because mXHR has ambiguous
 // inheritance from nsISupports.
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsXMLHttpRequestXPCOMifier)
-
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsXMLHttpRequestXPCOMifier)
 if (tmp->mXHR) {
   tmp->mXHR->mXPCOMifier = nullptr;
 }
 NS_IMPL_CYCLE_COLLECTION_UNLINK(mXHR)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsXMLHttpRequestXPCOMifier)

--- a/content/base/test/test_websocket_basic.html
+++ b/content/base/test/test_websocket_basic.html
@@ -119,23 +119,23 @@ function testWebSocket2() {
       is(e.data, testMessage + messageCount, "[2] Received message");
     if (messageCount % displayInterval == 1) {
       gTestElement.textContent += " " + messageCount;
     }
   };
 }
 
 /**
- * Sends 100+1 test messages, then receives them, calling forcegc() at each step.
+ * Sends testcount+1 test messages, then receives them, calling forcegc() at each step.
  */
 function testWebSocket3() {
   gTestElement.textContent = "Running testWebSocket3() [can take a little while]";
 
   const displayInterval = 10;
-  const testCount = 100;
+  const testCount = 10;
   const testMessage = "test message 3.";
 
   var messageCount = 0;
 
   ws = new WebSocket(kUrl, "test");
   // Set this before onopen() is called,
   // otherwise its display would be delayed by forcegc() calls...
   gTestElement.textContent += "\nSending :";

--- a/content/canvas/src/CanvasRenderingContext2D.cpp
+++ b/content/canvas/src/CanvasRenderingContext2D.cpp
@@ -1631,19 +1631,19 @@ CanvasRenderingContext2D::BeginPath()
 {
   mPath = nullptr;
   mPathBuilder = nullptr;
   mDSPathBuilder = nullptr;
   mPathTransformWillUpdate = false;
 }
 
 void
-CanvasRenderingContext2D::Fill()
+CanvasRenderingContext2D::Fill(const CanvasWindingRule& winding)
 {
-  EnsureUserSpacePath();
+  EnsureUserSpacePath(winding);
 
   if (!mPath) {
     return;
   }
 
   mgfx::Rect bounds;
 
   if (NeedToDrawShadow()) {
@@ -1682,19 +1682,19 @@ CanvasRenderingContext2D::Stroke()
   AdjustedTarget(this, bounds.IsEmpty() ? nullptr : &bounds)->
     Stroke(mPath, CanvasGeneralPattern().ForStyle(this, STYLE_STROKE, mTarget),
            strokeOptions, DrawOptions(state.globalAlpha, UsedOperation()));
 
   Redraw();
 }
 
 void
-CanvasRenderingContext2D::Clip()
+CanvasRenderingContext2D::Clip(const CanvasWindingRule& winding)
 {
-  EnsureUserSpacePath();
+  EnsureUserSpacePath(winding);
 
   if (!mPath) {
     return;
   }
 
   mTarget->PushClip(mPath);
   CurrentState().clipsPushed.push_back(mPath);
 }
@@ -1843,19 +1843,21 @@ CanvasRenderingContext2D::EnsureWritable
     mDSPathBuilder =
       mPath->TransformedCopyToBuilder(mPathToDS, fillRule);
     mPathTransformWillUpdate = false;
     mPath = nullptr;
   }
 }
 
 void
-CanvasRenderingContext2D::EnsureUserSpacePath()
+CanvasRenderingContext2D::EnsureUserSpacePath(const CanvasWindingRule& winding)
 {
   FillRule fillRule = CurrentState().fillRule;
+  if(winding == CanvasWindingRuleValues::Evenodd)
+    fillRule = FILL_EVEN_ODD;
 
   if (!mPath && !mPathBuilder && !mDSPathBuilder) {
     EnsureTarget();
     mPathBuilder = mTarget->CreatePathBuilder(fillRule);
   }
 
   if (mPathBuilder) {
     mPath = mPathBuilder->Finish();
@@ -2831,29 +2833,31 @@ CanvasRenderingContext2D::SetMozDashOffs
 {
   ContextState& state = CurrentState();
   if (!state.dash.IsEmpty()) {
     state.dashOffset = mozDashOffset;
   }
 }
 
 bool
-CanvasRenderingContext2D::IsPointInPath(double x, double y)
+CanvasRenderingContext2D::IsPointInPath(double x, double y, const CanvasWindingRule& winding)
 {
   if (!FloatValidate(x,y)) {
     return false;
   }
 
-  EnsureUserSpacePath();
+  EnsureUserSpacePath(winding);
   if (!mPath) {
     return false;
   }
+
   if (mPathTransformWillUpdate) {
     return mPath->ContainsPoint(Point(x, y), mPathToDS);
   }
+
   return mPath->ContainsPoint(Point(x, y), mTarget->GetTransform());
 }
 
 bool
 CanvasRenderingContext2D::IsPointInStroke(double x, double y)
 {
   if (!FloatValidate(x,y)) {
     return false;

--- a/content/canvas/src/CanvasRenderingContext2D.h
+++ b/content/canvas/src/CanvasRenderingContext2D.h
@@ -12,16 +12,17 @@
 #include "nsColor.h"
 #include "mozilla/dom/HTMLCanvasElement.h"
 #include "nsHTMLVideoElement.h"
 #include "CanvasUtils.h"
 #include "gfxFont.h"
 #include "mozilla/ErrorResult.h"
 #include "mozilla/dom/ImageData.h"
 #include "mozilla/dom/UnionTypes.h"
+#include "mozilla/dom/CanvasRenderingContext2DBinding.h"
 
 #define NS_CANVASGRADIENTAZURE_PRIVATE_IID \
     {0x28425a6a, 0x90e0, 0x4d42, {0x9c, 0x75, 0xff, 0x60, 0x09, 0xb3, 0x10, 0xa8}}
 #define NS_CANVASPATTERNAZURE_PRIVATE_IID \
     {0xc9bacc25, 0x28da, 0x421e, {0x9a, 0x4b, 0xbb, 0xd6, 0x93, 0x05, 0x12, 0xbc}}
 
 class nsIDOMXULElement;
 
@@ -233,20 +234,20 @@ public:
     StyleColorToString(CurrentState().shadowColor, shadowColor);
   }
 
   void SetShadowColor(const nsAString& shadowColor);
   void ClearRect(double x, double y, double w, double h);
   void FillRect(double x, double y, double w, double h);
   void StrokeRect(double x, double y, double w, double h);
   void BeginPath();
-  void Fill();
+  void Fill(const CanvasWindingRule& winding);
   void Stroke();
-  void Clip();
-  bool IsPointInPath(double x, double y);
+  void Clip(const CanvasWindingRule& winding);
+  bool IsPointInPath(double x, double y, const CanvasWindingRule& winding);
   bool IsPointInStroke(double x, double y);
   void FillText(const nsAString& text, double x, double y,
                 const mozilla::dom::Optional<double>& maxWidth,
                 mozilla::ErrorResult& error);
   void StrokeText(const nsAString& text, double x, double y,
                   const mozilla::dom::Optional<double>& maxWidth,
                   mozilla::ErrorResult& error);
   already_AddRefed<nsIDOMTextMetrics>
@@ -582,17 +583,17 @@ protected:
   /* This function ensures there is a writable pathbuilder available, this
    * pathbuilder may be working in user space or in device space or
    * device space.
    * After calling this function mPathTransformWillUpdate will be false
    */
   void EnsureWritablePath();
 
   // Ensures a path in UserSpace is available.
-  void EnsureUserSpacePath();
+  void EnsureUserSpacePath(const CanvasWindingRule& winding = CanvasWindingRuleValues::Nonzero);
 
   /**
    * Needs to be called before updating the transform. This makes a call to
    * EnsureTarget() so you don't have to.
    */
   void TransformWillUpdate();
 
   // Report the fillRule has changed.

--- a/content/canvas/src/ImageData.cpp
+++ b/content/canvas/src/ImageData.cpp
@@ -17,18 +17,16 @@ namespace dom {
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(ImageData)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(ImageData)
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(ImageData)
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(ImageData)
-
 NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(ImageData)
   NS_IMPL_CYCLE_COLLECTION_TRACE_JS_MEMBER_CALLBACK(mData)
 NS_IMPL_CYCLE_COLLECTION_TRACE_END
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(ImageData)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_SCRIPT_OBJECTS
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 

--- a/content/canvas/src/WebGLUniformLocation.cpp
+++ b/content/canvas/src/WebGLUniformLocation.cpp
@@ -19,24 +19,16 @@ WebGLUniformLocation::WebGLUniformLocati
     , mProgram(program)
     , mProgramGeneration(program->Generation())
     , mLocation(location)
     , mInfo(info)
 {
     mElementSize = info.ElementSize();
 }
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(WebGLUniformLocation)
-
-NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(WebGLUniformLocation)
-  NS_IMPL_CYCLE_COLLECTION_UNLINK(mProgram)
-NS_IMPL_CYCLE_COLLECTION_UNLINK_END
-
-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(WebGLUniformLocation)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mProgram)
-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+NS_IMPL_CYCLE_COLLECTION_1(WebGLUniformLocation, mProgram)
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(WebGLUniformLocation)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(WebGLUniformLocation)
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(WebGLUniformLocation)
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END

--- a/content/canvas/test/Makefile.in
+++ b/content/canvas/test/Makefile.in
@@ -31,16 +31,17 @@ MOCHITEST_FILES = \
 	image_red.png \
 	image_transparent.png \
 	image_green.png \
 	image_green-redirect \
 	image_green-redirect^headers^ \
 	test_drawImageIncomplete.html \
 	test_canvas_font_setter.html \
 	test_2d.clearRect.image.offscreen.html \
+	test_2d.clip.winding.html \
 	test_2d.composite.canvas.destination-atop.html \
 	test_2d.composite.canvas.destination-in.html \
 	test_2d.composite.canvas.source-in.html \
 	test_2d.composite.canvas.source-out.html \
 	test_2d.composite.canvas.multiply.html \
 	test_2d.composite.canvas.screen.html \
 	test_2d.composite.canvas.overlay.html \
 	test_2d.composite.canvas.darken.html \
@@ -88,16 +89,18 @@ MOCHITEST_FILES = \
 	test_2d.composite.uncovered.fill.soft-light.html \
 	test_2d.composite.uncovered.fill.difference.html \
 	test_2d.composite.uncovered.fill.exclusion.html \
 	test_2d.composite.uncovered.fill.hue.html \
 	test_2d.composite.uncovered.fill.saturation.html \
 	test_2d.composite.uncovered.fill.color.html \
 	test_2d.composite.uncovered.fill.luminosity.html \
 	test_2d.drawImage.zerocanvas.html \
+	test_2d.fill.winding.html \
+	test_2d.isPointInPath.winding.html \
 	test_2d.strokeRect.zero.5.html \
 	test_toBlob.html \
 	test_toDataURL_alpha.html \
 	test_toDataURL_lowercase_ascii.html \
 	test_toDataURL_parameters.html \
 	test_mozGetAsFile.html \
 	test_canvas_strokeStyle_getter.html \
 	test_bug613794.html \

new file mode 100644
--- /dev/null
+++ b/content/canvas/test/test_2d.clip.winding.html
@@ -0,0 +1,53 @@
+<!DOCTYPE HTML>
+<title>Canvas test: 2d.clip.winding</title>
+<script src="/MochiKit/MochiKit.js"></script>
+<script src="/tests/SimpleTest/SimpleTest.js"></script>
+<link rel="stylesheet" href="/tests/SimpleTest/test.css">
+<body>
+<canvas id="c" width="100" height="100"><p class="fallback">FAIL (fallback content)</p></canvas>
+<script>
+function isPixel(ctx, x,y, r,g,b,a, pos, colour, d) {
+    var pixel = ctx.getImageData(x, y, 1, 1);
+    var pr = pixel.data[0],
+        pg = pixel.data[1],
+        pb = pixel.data[2],
+        pa = pixel.data[3];
+    ok(r-d <= pr && pr <= r+d &&
+       g-d <= pg && pg <= g+d &&
+       b-d <= pb && pb <= b+d &&
+       a-d <= pa && pa <= a+d,
+       "pixel "+pos+" is "+pr+","+pg+","+pb+","+pa+"; expected "+colour+" +/- "+d);
+}
+
+SimpleTest.waitForExplicitFinish();
+addLoadEvent(function () {
+
+var canvas = document.getElementById('c');
+var ctx = canvas.getContext('2d');
+
+ctx.fillStyle = 'rgb(255,0,0)';
+ctx.fillRect(0, 0, 100, 100);
+ctx.fillStyle = 'rgb(0,255,0)';
+ctx.beginPath();
+ctx.rect(0, 0, 100, 100);
+ctx.rect(25, 25, 50, 50);
+ctx.clip();
+ctx.beginPath();
+ctx.fillRect(0, 0, 100, 100);
+isPixel(ctx, 50,50, 0,255,0,255, "50,50", "0,255,0,255", 5);
+
+ctx.fillStyle = 'rgb(255,0,0)';
+ctx.fillRect(0, 0, 100, 100);
+ctx.fillStyle = 'rgb(0,255,0)';
+ctx.beginPath();
+ctx.rect(0, 0, 100, 100);
+ctx.rect(25, 25, 50, 50);
+ctx.clip('evenodd');
+ctx.fillRect(0, 0, 100, 100);
+isPixel(ctx, 50,50, 255,0,0,255, "50,50", "255,0,0,255", 5);
+
+SimpleTest.finish();
+
+});
+</script>
+