--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@@ -977,18 +977,23 @@ pref("osfile.reset_worker_delay", 5000);
 // APZC preferences.
 //
 // Gaia relies heavily on scroll events for now, so lets fire them
 // more often than the default value (100).
 pref("apz.asyncscroll.throttle", 40);
 pref("apz.pan_repaint_interval", 16);
 
 // APZ physics settings, tuned by UX designers
+pref("apz.fling_curve_function_x1", "0.0");
+pref("apz.fling_curve_function_y1", "0.0");
+pref("apz.fling_curve_function_x2", "0.58");
+pref("apz.fling_curve_function_y2", "1.0");
+pref("apz.fling_curve_threshold_inches_per_ms", "0.03");
+pref("apz.fling_friction", "0.003");
 pref("apz.max_velocity_inches_per_ms", "0.07");
-pref("apz.fling_friction", "0.003");
 
 // Tweak default displayport values to reduce the risk of running out of
 // memory when zooming in
 pref("apz.x_skate_size_multiplier", "1.25");
 pref("apz.y_skate_size_multiplier", "1.5");
 pref("apz.x_stationary_size_multiplier", "1.5");
 pref("apz.y_stationary_size_multiplier", "1.8");
 pref("apz.enlarge_displayport_when_clipped", true);

--- a/b2g/config/dolphin/sources.xml
+++ b/b2g/config/dolphin/sources.xml
@@ -10,17 +10,17 @@
   <!--original fetch url was git://codeaurora.org/-->
   <remote fetch="https://git.mozilla.org/external/caf" name="caf"/>
   <!--original fetch url was https://git.mozilla.org/releases-->
   <remote fetch="https://git.mozilla.org/releases" name="mozillaorg"/>
   <!-- B2G specific things. -->
   <project name="platform_build" path="build" remote="b2g" revision="3a2947df41a480de1457a6dcdbf46ad0af70d8e0">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="cddf7f505c4c280bacb74c22af3fa4959ccb555a"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="8ae6598f3ab7b0c34ac42a73083ddb74266affba"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="28be739bcdcbc9eb91c0bdbff1f7d3eab717969b"/>

--- a/b2g/config/emulator-ics/sources.xml
+++ b/b2g/config/emulator-ics/sources.xml
@@ -14,17 +14,17 @@
   <!--original fetch url was git://github.com/apitrace/-->
   <remote fetch="https://git.mozilla.org/external/apitrace" name="apitrace"/>
   <default remote="caf" revision="refs/tags/android-4.0.4_r2.1" sync-j="4"/>
   <!-- Gonk specific things and forks -->
   <project name="platform_build" path="build" remote="b2g" revision="70eb0cb0977d6295e7da8896f9efb9f3ca1c13ea">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="cddf7f505c4c280bacb74c22af3fa4959ccb555a"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="8ae6598f3ab7b0c34ac42a73083ddb74266affba"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="cd88d860656c31c7da7bb310d6a160d0011b0961"/>
   <project name="platform_external_qemu" path="external/qemu" remote="b2g" revision="c058843242068d0df7c107e09da31b53d2e08fa6"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="28be739bcdcbc9eb91c0bdbff1f7d3eab717969b"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="dd924f92906085b831bf1cbbc7484d3c043d613c"/>

--- a/b2g/config/emulator-jb/sources.xml
+++ b/b2g/config/emulator-jb/sources.xml
@@ -12,17 +12,17 @@
   <!--original fetch url was https://git.mozilla.org/releases-->
   <remote fetch="https://git.mozilla.org/releases" name="mozillaorg"/>
   <!-- B2G specific things. -->
   <project name="platform_build" path="build" remote="b2g" revision="8986df0f82e15ac2798df0b6c2ee3435400677ac">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="cddf7f505c4c280bacb74c22af3fa4959ccb555a"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="8ae6598f3ab7b0c34ac42a73083ddb74266affba"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="28be739bcdcbc9eb91c0bdbff1f7d3eab717969b"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <!-- Stock Android things -->
   <project groups="linux" name="platform/prebuilts/clang/linux-x86/3.1" path="prebuilts/clang/linux-x86/3.1" revision="5c45f43419d5582949284eee9cef0c43d866e03b"/>
   <project groups="linux" name="platform/prebuilts/clang/linux-x86/3.2" path="prebuilts/clang/linux-x86/3.2" revision="3748b4168e7bd8d46457d4b6786003bc6a5223ce"/>

--- a/b2g/config/emulator-kk/sources.xml
+++ b/b2g/config/emulator-kk/sources.xml
@@ -10,17 +10,17 @@
   <!--original fetch url was git://codeaurora.org/-->
   <remote fetch="https://git.mozilla.org/external/caf" name="caf"/>
   <!--original fetch url was https://git.mozilla.org/releases-->
   <remote fetch="https://git.mozilla.org/releases" name="mozillaorg"/>
   <!-- B2G specific things. -->
   <project name="platform_build" path="build" remote="b2g" revision="3a2947df41a480de1457a6dcdbf46ad0af70d8e0">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="cddf7f505c4c280bacb74c22af3fa4959ccb555a"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="8ae6598f3ab7b0c34ac42a73083ddb74266affba"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="28be739bcdcbc9eb91c0bdbff1f7d3eab717969b"/>

--- a/b2g/config/emulator/sources.xml
+++ b/b2g/config/emulator/sources.xml
@@ -14,17 +14,17 @@
   <!--original fetch url was git://github.com/apitrace/-->
   <remote fetch="https://git.mozilla.org/external/apitrace" name="apitrace"/>
   <default remote="caf" revision="refs/tags/android-4.0.4_r2.1" sync-j="4"/>
   <!-- Gonk specific things and forks -->
   <project name="platform_build" path="build" remote="b2g" revision="70eb0cb0977d6295e7da8896f9efb9f3ca1c13ea">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="cddf7f505c4c280bacb74c22af3fa4959ccb555a"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="8ae6598f3ab7b0c34ac42a73083ddb74266affba"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="cd88d860656c31c7da7bb310d6a160d0011b0961"/>
   <project name="platform_external_qemu" path="external/qemu" remote="b2g" revision="c058843242068d0df7c107e09da31b53d2e08fa6"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="28be739bcdcbc9eb91c0bdbff1f7d3eab717969b"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="dd924f92906085b831bf1cbbc7484d3c043d613c"/>

--- a/b2g/config/flame-kk/sources.xml
+++ b/b2g/config/flame-kk/sources.xml
@@ -10,17 +10,17 @@
   <!--original fetch url was git://codeaurora.org/-->
   <remote fetch="https://git.mozilla.org/external/caf" name="caf"/>
   <!--original fetch url was https://git.mozilla.org/releases-->
   <remote fetch="https://git.mozilla.org/releases" name="mozillaorg"/>
   <!-- B2G specific things. -->
   <project name="platform_build" path="build" remote="b2g" revision="3a2947df41a480de1457a6dcdbf46ad0af70d8e0">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="cddf7f505c4c280bacb74c22af3fa4959ccb555a"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="8ae6598f3ab7b0c34ac42a73083ddb74266affba"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="28be739bcdcbc9eb91c0bdbff1f7d3eab717969b"/>
@@ -121,16 +121,18 @@
   <project name="platform/system/netd" path="system/netd" revision="a6531f7befb49b1c81bc0de7e51c5482b308e1c5"/>
   <project name="platform/system/security" path="system/security" revision="ee8068b9e7bfb2770635062fc9c2035be2142bd8"/>
   <project name="platform/system/vold" path="system/vold" revision="42fa2a0f14f965970a4b629a176bbd2666edf017"/>
   <project name="platform/external/icu4c" path="external/icu4c" revision="d3ec7428eb276db43b7ed0544e09344a6014806c"/>
   <remove-project name="platform/frameworks/base"/>
   <remove-project name="platform/frameworks/native"/>
   <remove-project name="platform/hardware/libhardware"/>
   <remove-project name="platform/external/bluetooth/bluedroid"/>
+  <remove-project name="platform/system/media"/>
+  <project name="platform/system/media" path="system/media" revision="c1332c21c608f4932a6d7e83450411cde53315ef"/>
   <!--original fetch url was git://github.com/t2m-foxfone/-->
   <remote fetch="https://git.mozilla.org/external/t2m-foxfone" name="t2m"/>
   <default remote="caf" revision="LNX.LA.3.5.2.1.1" sync-j="4"/>
   <!-- Flame specific things -->
   <project name="device/generic/armv7-a-neon" path="device/generic/armv7-a-neon" revision="1bb28abbc215f45220620af5cd60a8ac1be93722"/>
   <project name="device/qcom/common" path="device/qcom/common" revision="54c32c2ddef066fbdf611d29e4b7c47e0363599e"/>
   <project name="device-flame" path="device/t2m/flame" remote="b2g" revision="48835395daa6a49b281db62c50805bd6ca24077e"/>
   <project name="codeaurora_kernel_msm" path="kernel" remote="b2g" revision="3c4f041e3e3dc676f2111caf20a186ec0467dbdb"/>

--- a/b2g/config/flame/sources.xml
+++ b/b2g/config/flame/sources.xml
@@ -12,17 +12,17 @@
   <!--original fetch url was https://git.mozilla.org/releases-->
   <remote fetch="https://git.mozilla.org/releases" name="mozillaorg"/>
   <!-- B2G specific things. -->
   <project name="platform_build" path="build" remote="b2g" revision="8986df0f82e15ac2798df0b6c2ee3435400677ac">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="cddf7f505c4c280bacb74c22af3fa4959ccb555a"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="8ae6598f3ab7b0c34ac42a73083ddb74266affba"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="28be739bcdcbc9eb91c0bdbff1f7d3eab717969b"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <!-- Stock Android things -->
   <project groups="linux" name="platform/prebuilts/clang/linux-x86/3.1" path="prebuilts/clang/linux-x86/3.1" revision="e95b4ce22c825da44d14299e1190ea39a5260bde"/>
   <project groups="linux" name="platform/prebuilts/clang/linux-x86/3.2" path="prebuilts/clang/linux-x86/3.2" revision="471afab478649078ad7c75ec6b252481a59e19b8"/>

--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,9 +1,9 @@
 {
     "git": {
         "git_revision": "", 
         "remote": "", 
         "branch": ""
     }, 
-    "revision": "4763231f664a8a94cbea98b35b84749b51a961c9", 
+    "revision": "5b7182e0e489747ff07ca952f5a99dc21a0226c9", 
     "repo_path": "/integration/gaia-central"
 }

--- a/b2g/config/hamachi/sources.xml
+++ b/b2g/config/hamachi/sources.xml
@@ -12,17 +12,17 @@
   <!--original fetch url was git://github.com/apitrace/-->
   <remote fetch="https://git.mozilla.org/external/apitrace" name="apitrace"/>
   <default remote="caf" revision="b2g/ics_strawberry" sync-j="4"/>
   <!-- Gonk specific things and forks -->
   <project name="platform_build" path="build" remote="b2g" revision="70eb0cb0977d6295e7da8896f9efb9f3ca1c13ea">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="cddf7f505c4c280bacb74c22af3fa4959ccb555a"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="8ae6598f3ab7b0c34ac42a73083ddb74266affba"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="28be739bcdcbc9eb91c0bdbff1f7d3eab717969b"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="6426040f1be4a844082c9769171ce7f5341a5528"/>
   <project name="platform/bionic" path="bionic" revision="d2eb6c7b6e1bc7643c17df2d9d9bcb1704d0b9ab"/>

--- a/b2g/config/helix/sources.xml
+++ b/b2g/config/helix/sources.xml
@@ -10,17 +10,17 @@
   <!--original fetch url was https://git.mozilla.org/releases-->
   <remote fetch="https://git.mozilla.org/releases" name="mozillaorg"/>
   <default remote="caf" revision="b2g/ics_strawberry" sync-j="4"/>
   <!-- Gonk specific things and forks -->
   <project name="platform_build" path="build" remote="b2g" revision="70eb0cb0977d6295e7da8896f9efb9f3ca1c13ea">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="cddf7f505c4c280bacb74c22af3fa4959ccb555a"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="8ae6598f3ab7b0c34ac42a73083ddb74266affba"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
   <project name="gonk-patches" path="patches" remote="b2g" revision="223a2421006e8f5da33f516f6891c87cae86b0f6"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="6426040f1be4a844082c9769171ce7f5341a5528"/>
   <project name="platform/bionic" path="bionic" revision="d2eb6c7b6e1bc7643c17df2d9d9bcb1704d0b9ab"/>

--- a/b2g/config/nexus-4/sources.xml
+++ b/b2g/config/nexus-4/sources.xml
@@ -12,17 +12,17 @@
   <!--original fetch url was https://git.mozilla.org/releases-->
   <remote fetch="https://git.mozilla.org/releases" name="mozillaorg"/>
   <!-- B2G specific things. -->
   <project name="platform_build" path="build" remote="b2g" revision="8986df0f82e15ac2798df0b6c2ee3435400677ac">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="cddf7f505c4c280bacb74c22af3fa4959ccb555a"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="8ae6598f3ab7b0c34ac42a73083ddb74266affba"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="28be739bcdcbc9eb91c0bdbff1f7d3eab717969b"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <!-- Stock Android things -->
   <project groups="linux" name="platform/prebuilts/clang/linux-x86/3.1" path="prebuilts/clang/linux-x86/3.1" revision="5c45f43419d5582949284eee9cef0c43d866e03b"/>
   <project groups="linux" name="platform/prebuilts/clang/linux-x86/3.2" path="prebuilts/clang/linux-x86/3.2" revision="3748b4168e7bd8d46457d4b6786003bc6a5223ce"/>

--- a/b2g/config/wasabi/sources.xml
+++ b/b2g/config/wasabi/sources.xml
@@ -12,17 +12,17 @@
   <!--original fetch url was git://github.com/apitrace/-->
   <remote fetch="https://git.mozilla.org/external/apitrace" name="apitrace"/>
   <default remote="caf" revision="ics_chocolate_rb4.2" sync-j="4"/>
   <!-- Gonk specific things and forks -->
   <project name="platform_build" path="build" remote="b2g" revision="70eb0cb0977d6295e7da8896f9efb9f3ca1c13ea">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="cddf7f505c4c280bacb74c22af3fa4959ccb555a"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="8ae6598f3ab7b0c34ac42a73083ddb74266affba"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="45c54a55e31758f7e54e5eafe0d01d387f35897a"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="28be739bcdcbc9eb91c0bdbff1f7d3eab717969b"/>
   <project name="gonk-patches" path="patches" remote="b2g" revision="223a2421006e8f5da33f516f6891c87cae86b0f6"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="6426040f1be4a844082c9769171ce7f5341a5528"/>

--- a/browser/base/content/test/general/browser.ini
+++ b/browser/base/content/test/general/browser.ini
@@ -309,19 +309,19 @@ skip-if = os == "mac" || e10s # bug 9670
 [browser_ctrlTab.js]
 skip-if = e10s # Bug ????? - thumbnail captures need e10s love (tabPreviews_capture fails with Argument 1 of CanvasRenderingContext2D.drawWindow does not implement interface Window.)
 [browser_customize_popupNotification.js]
 skip-if = e10s
 [browser_datareporting_notification.js]
 run-if = datareporting
 [browser_devedition.js]
 [browser_devices_get_user_media.js]
-skip-if = buildapp == 'mulet' || os == "linux" || e10s # linux: bug 976544 & bug 1060315; e10s: Bug 973001 - appears user media notifications only happen in the child and don't make their way to the parent?
+skip-if = buildapp == 'mulet' || (os == "linux" && debug) || e10s # linux: bug 976544; e10s: bug 1071623
 [browser_devices_get_user_media_about_urls.js]
-skip-if = e10s # Bug 973001 - appears user media notifications only happen in the child and don't make their way to the parent?
+skip-if = e10s # Bug 1071623
 [browser_discovery.js]
 skip-if = e10s # Bug 918663 - DOMLinkAdded events don't make their way to chrome
 [browser_double_close_tab.js]
 skip-if = e10s
 [browser_duplicateIDs.js]
 [browser_drag.js]
 skip-if = true # browser_drag.js is disabled, as it needs to be updated for the new behavior from bug 320638.
 [browser_favicon_change.js]

--- a/browser/base/content/test/general/browser_devices_get_user_media.js
+++ b/browser/base/content/test/general/browser_devices_get_user_media.js
@@ -173,59 +173,59 @@ function getMediaCaptureState() {
     return "CameraAndMicrophone";
   if (hasVideo.value)
     return "Camera";
   if (hasAudio.value)
     return "Microphone";
   return "none";
 }
 
-function closeStream(aAlreadyClosed) {
+function* closeStream(aAlreadyClosed) {
   expectNoObserverCalled();
 
   info("closing the stream");
   content.wrappedJSObject.closeStream();
 
   if (!aAlreadyClosed)
     yield promiseObserverCalled("recording-device-events");
 
   yield promiseNoPopupNotification("webRTC-sharingDevices");
   if (!aAlreadyClosed)
     expectObserverCalled("recording-window-ended");
 
-  assertWebRTCIndicatorStatus(null);
+  yield* assertWebRTCIndicatorStatus(null);
 }
 
 function checkDeviceSelectors(aAudio, aVideo) {
   let micSelector = document.getElementById("webRTC-selectMicrophone");
   if (aAudio)
     ok(!micSelector.hidden, "microphone selector visible");
   else
     ok(micSelector.hidden, "microphone selector hidden");
 
   let cameraSelector = document.getElementById("webRTC-selectCamera");
   if (aVideo)
     ok(!cameraSelector.hidden, "camera selector visible");
   else
     ok(cameraSelector.hidden, "camera selector hidden");
 }
 
-function checkSharingUI(aExpected) {
+function* checkSharingUI(aExpected) {
   yield promisePopupNotification("webRTC-sharingDevices");
 
-  assertWebRTCIndicatorStatus(aExpected);
+  yield* assertWebRTCIndicatorStatus(aExpected);
 }
 
-function checkNotSharing() {
+function* checkNotSharing() {
   is(getMediaCaptureState(), "none", "expected nothing to be shared");
 
   ok(!PopupNotifications.getNotification("webRTC-sharingDevices"),
      "no webRTC-sharingDevices popup notification");
 
-  assertWebRTCIndicatorStatus(null);
+  yield* assertWebRTCIndicatorStatus(null);
 }
 
 const permissionError = "error: PermissionDeniedError: The user did not grant permission for the operation.";
 
 let gTests = [
 
 {
   desc: "getUserMedia audio+video",
@@ -388,17 +388,17 @@ let gTests = [
     });
 
     // reset the menuitems to have no impact on the following tests.
     enableDevice("Camera", true);
     enableDevice("Microphone", true);
 
     expectObserverCalled("getUserMedia:response:deny");
     expectObserverCalled("recording-window-ended");
-    checkNotSharing();
+    yield checkNotSharing();
   }
 },
 
 {
   desc: "getUserMedia audio+video, user clicks \"Don't Share\"",
   run: function checkDontShare() {
     yield promisePopupNotificationShown("webRTC-shareDevices", () => {
       info("requesting devices");
@@ -408,17 +408,17 @@ let gTests = [
     checkDeviceSelectors(true, true);
 
     yield promiseMessage(permissionError, () => {
       activateSecondaryAction(kActionDeny);
     });
 
     expectObserverCalled("getUserMedia:response:deny");
     expectObserverCalled("recording-window-ended");
-    checkNotSharing();
+    yield checkNotSharing();
   }
 },
 
 {
   desc: "getUserMedia audio+video: stop sharing",
   run: function checkStopSharing() {
     yield promisePopupNotificationShown("webRTC-shareDevices", () => {
       info("requesting devices");
@@ -447,17 +447,17 @@ let gTests = [
     expectObserverCalled("recording-window-ended");
 
     if (gObservedTopics["recording-device-events"] == 1) {
       todo(false, "Got the 'recording-device-events' notification twice, likely because of bug 962719");
       gObservedTopics["recording-device-events"] = 0;
     }
 
     expectNoObserverCalled();
-    checkNotSharing();
+    yield checkNotSharing();
 
     // the stream is already closed, but this will do some cleanup anyway
     yield closeStream(true);
   }
 },
 
 {
   desc: "getUserMedia prompt: Always/Never Share",

--- a/browser/base/content/test/general/browser_devices_get_user_media_about_urls.js
+++ b/browser/base/content/test/general/browser_devices_get_user_media_about_urls.js
@@ -105,30 +105,30 @@ function getMediaCaptureState() {
     return "CameraAndMicrophone";
   if (hasVideo.value)
     return "Camera";
   if (hasAudio.value)
     return "Microphone";
   return "none";
 }
 
-function closeStream(aAlreadyClosed) {
+function* closeStream(aAlreadyClosed) {
   expectNoObserverCalled();
 
   info("closing the stream");
   content.wrappedJSObject.closeStream();
 
   if (!aAlreadyClosed)
     yield promiseObserverCalled("recording-device-events");
 
   yield promiseNoPopupNotification("webRTC-sharingDevices");
   if (!aAlreadyClosed)
     expectObserverCalled("recording-window-ended");
 
-  assertWebRTCIndicatorStatus(null);
+  yield* assertWebRTCIndicatorStatus(null);
 }
 
 function loadPage(aUrl) {
   let deferred = Promise.defer();
 
   gTab.linkedBrowser.addEventListener("load", function onload() {
     gTab.linkedBrowser.removeEventListener("load", onload, true);
 

--- a/browser/base/content/test/general/head.js
+++ b/browser/base/content/test/general/head.js
@@ -662,17 +662,32 @@ function assertWebRTCIndicatorStatus(exp
     is(menu && !menu.hidden, !!expected, "WebRTC menu should be " + expectedState);
   }
 
   if (!("nsISystemStatusBar" in Ci)) {
     let indicator = Services.wm.getEnumerator("Browser:WebRTCGlobalIndicator");
     let hasWindow = indicator.hasMoreElements();
     is(hasWindow, !!expected, "popup " + msg);
     if (hasWindow) {
-      let docElt = indicator.getNext().document.documentElement;
+      let document = indicator.getNext().document;
+      let docElt = document.documentElement;
+
+      if (document.readyState != "complete") {
+        info("Waiting for the sharing indicator's document to load");
+        let deferred = Promise.defer();
+        document.addEventListener("readystatechange",
+                                  function onReadyStateChange() {
+          if (document.readyState != "complete")
+            return;
+          document.removeEventListener("readystatechange", onReadyStateChange);
+          deferred.resolve();
+        });
+        yield deferred.promise;
+      }
+
       for (let item of ["video", "audio", "screen"]) {
         let expectedValue = (expected && expected[item]) ? "true" : "";
         is(docElt.getAttribute("sharing" + item), expectedValue,
            item + " global indicator attribute as expected");
       }
 
       ok(!indicator.hasMoreElements(), "only one global indicator window");
     }

--- a/browser/components/customizableui/test/browser.ini
+++ b/browser/components/customizableui/test/browser.ini
@@ -64,29 +64,29 @@ skip-if = os == "linux"
 [browser_941083_invalidate_wrapper_cache_createWidget.js]
 [browser_942581_unregisterArea_keeps_placements.js]
 [browser_943683_migration_test.js]
 [browser_944887_destroyWidget_should_destroy_in_palette.js]
 [browser_945739_showInPrivateBrowsing_customize_mode.js]
 [browser_947914_button_addons.js]
 skip-if = os == "linux" # Intermittent failures
 [browser_947914_button_copy.js]
-skip-if = os == "linux" # Intermittent failures
+skip-if = os == "linux" || e10s # Intermittent failures on Linux, e10s issues are bug 1091561
 [browser_947914_button_cut.js]
-skip-if = os == "linux" # Intermittent failures
+skip-if = os == "linux" || e10s # Intermittent failures on Linux, e10s issues are bug 1091561
 [browser_947914_button_find.js]
 skip-if = os == "linux" # Intermittent failures
 [browser_947914_button_history.js]
 skip-if = os == "linux" # Intermittent failures
 [browser_947914_button_newPrivateWindow.js]
 skip-if = os == "linux" # Intermittent failures
 [browser_947914_button_newWindow.js]
 skip-if = os == "linux" # Intermittent failures
 [browser_947914_button_paste.js]
-skip-if = os == "linux" # Intermittent failures
+skip-if = os == "linux" || e10s # Intermittent failures on Linux, e10s issues are bug 1091561
 [browser_947914_button_print.js]
 skip-if = os == "linux" || (os == "win" && e10s) # Intermittent failures on Linux, e10s issues on Windows (bug 1088714)
 [browser_947914_button_savePage.js]
 skip-if = os == "linux" # Intermittent failures
 [browser_947914_button_zoomIn.js]
 skip-if = os == "linux" # Intermittent failures
 [browser_947914_button_zoomOut.js]
 skip-if = os == "linux" # Intermittent failures

--- a/browser/devtools/canvasdebugger/test/browser.ini
+++ b/browser/devtools/canvasdebugger/test/browser.ini
@@ -14,17 +14,16 @@ support-files =
 [browser_canvas-actor-test-03.js]
 [browser_canvas-actor-test-04.js]
 [browser_canvas-actor-test-05.js]
 [browser_canvas-actor-test-06.js]
 [browser_canvas-actor-test-07.js]
 [browser_canvas-actor-test-08.js]
 [browser_canvas-actor-test-09.js]
 [browser_canvas-actor-test-10.js]
-skip-if = e10s # Bug 1058879 - canvas debugger tests disabled with e10s
 [browser_canvas-frontend-call-highlight.js]
 [browser_canvas-frontend-call-list.js]
 [browser_canvas-frontend-call-search.js]
 [browser_canvas-frontend-call-stack-01.js]
 [browser_canvas-frontend-call-stack-02.js]
 [browser_canvas-frontend-call-stack-03.js]
 [browser_canvas-frontend-clear.js]
 [browser_canvas-frontend-img-screenshots.js]

--- a/browser/devtools/canvasdebugger/test/browser_canvas-actor-test-10.js
+++ b/browser/devtools/canvasdebugger/test/browser_canvas-actor-test-10.js
@@ -3,18 +3,17 @@
 
 /**
  * Tests that the correct framebuffer, renderbuffer and textures are re-bound
  * after generating screenshots using the actor.
  */
 
 function ifTestingSupported() {
   let { target, front } = yield initCanvasDebuggerBackend(WEBGL_BINDINGS_URL);
-  // XXX - use of |debuggee| here is incompatible with e10s - bug 1058879.
-  let debuggee = target.window.wrappedJSObject
+  loadFrameScripts();
 
   let navigated = once(target, "navigate");
 
   yield front.setup({ reload: true });
   ok(true, "The front was setup up successfully.");
 
   yield navigated;
   ok(true, "Target automatically navigated when the front was set up.");
@@ -32,30 +31,36 @@ function ifTestingSupported() {
     "The first screenshot has the correct width.");
   is(firstScreenshot.height, CanvasFront.WEBGL_SCREENSHOT_MAX_HEIGHT,
     "The first screenshot has the correct height.");
   is(firstScreenshot.flipped, true,
     "The first screenshot has the correct 'flipped' flag.");
   is(firstScreenshot.pixels.length, 0,
     "The first screenshot should be empty.");
 
-  let gl = debuggee.gl;
-  is(gl.getParameter(gl.FRAMEBUFFER_BINDING), debuggee.customFramebuffer,
+  is((yield evalInDebuggee("gl.getParameter(gl.FRAMEBUFFER_BINDING) === customFramebuffer")),
+    true,
     "The debuggee's gl context framebuffer wasn't changed.");
-  is(gl.getParameter(gl.RENDERBUFFER_BINDING), debuggee.customRenderbuffer,
+  is((yield evalInDebuggee("gl.getParameter(gl.RENDERBUFFER_BINDING) === customRenderbuffer")),
+    true,
     "The debuggee's gl context renderbuffer wasn't changed.");
-  is(gl.getParameter(gl.TEXTURE_BINDING_2D), debuggee.customTexture,
+  is((yield evalInDebuggee("gl.getParameter(gl.TEXTURE_BINDING_2D) === customTexture")),
+    true,
     "The debuggee's gl context texture binding wasn't changed.");
-  is(gl.getParameter(gl.VIEWPORT)[0], 128,
+  is((yield evalInDebuggee("gl.getParameter(gl.VIEWPORT)[0]")),
+    128,
     "The debuggee's gl context viewport's left coord. wasn't changed.");
-  is(gl.getParameter(gl.VIEWPORT)[1], 256,
+  is((yield evalInDebuggee("gl.getParameter(gl.VIEWPORT)[1]")),
+    256,
     "The debuggee's gl context viewport's left coord. wasn't changed.");
-  is(gl.getParameter(gl.VIEWPORT)[2], 384,
+  is((yield evalInDebuggee("gl.getParameter(gl.VIEWPORT)[2]")),
+    384,
     "The debuggee's gl context viewport's left coord. wasn't changed.");
-  is(gl.getParameter(gl.VIEWPORT)[3], 512,
+  is((yield evalInDebuggee("gl.getParameter(gl.VIEWPORT)[3]")),
+    512,
     "The debuggee's gl context viewport's left coord. wasn't changed.");
 
   let secondScreenshot = yield snapshotActor.generateScreenshotFor(functionCalls[1]);
   is(secondScreenshot.index, 1,
     "The second screenshot has the correct index.");
   is(secondScreenshot.width, CanvasFront.WEBGL_SCREENSHOT_MAX_HEIGHT,
     "The second screenshot has the correct width.");
   is(secondScreenshot.height, CanvasFront.WEBGL_SCREENSHOT_MAX_HEIGHT,
@@ -70,27 +75,33 @@ function ifTestingSupported() {
     "The second screenshot has the correct red component.");
   is(new Uint8Array(secondScreenshot.pixels.buffer)[1], 0,
     "The second screenshot has the correct green component.");
   is(new Uint8Array(secondScreenshot.pixels.buffer)[2], 255,
     "The second screenshot has the correct blue component.");
   is(new Uint8Array(secondScreenshot.pixels.buffer)[3], 255,
     "The second screenshot has the correct alpha component.");
 
-  gl = debuggee.gl;
-  is(gl.getParameter(gl.FRAMEBUFFER_BINDING), debuggee.customFramebuffer,
+  is((yield evalInDebuggee("gl.getParameter(gl.FRAMEBUFFER_BINDING) === customFramebuffer")),
+    true,
     "The debuggee's gl context framebuffer still wasn't changed.");
-  is(gl.getParameter(gl.RENDERBUFFER_BINDING), debuggee.customRenderbuffer,
+  is((yield evalInDebuggee("gl.getParameter(gl.RENDERBUFFER_BINDING) === customRenderbuffer")),
+    true,
     "The debuggee's gl context renderbuffer still wasn't changed.");
-  is(gl.getParameter(gl.TEXTURE_BINDING_2D), debuggee.customTexture,
+  is((yield evalInDebuggee("gl.getParameter(gl.TEXTURE_BINDING_2D) === customTexture")),
+    true,
     "The debuggee's gl context texture binding still wasn't changed.");
-  is(gl.getParameter(gl.VIEWPORT)[0], 128,
+  is((yield evalInDebuggee("gl.getParameter(gl.VIEWPORT)[0]")),
+    128,
     "The debuggee's gl context viewport's left coord. still wasn't changed.");
-  is(gl.getParameter(gl.VIEWPORT)[1], 256,
+  is((yield evalInDebuggee("gl.getParameter(gl.VIEWPORT)[1]")),
+    256,
     "The debuggee's gl context viewport's left coord. still wasn't changed.");
-  is(gl.getParameter(gl.VIEWPORT)[2], 384,
+  is((yield evalInDebuggee("gl.getParameter(gl.VIEWPORT)[2]")),
+    384,
     "The debuggee's gl context viewport's left coord. still wasn't changed.");
-  is(gl.getParameter(gl.VIEWPORT)[3], 512,
+  is((yield evalInDebuggee("gl.getParameter(gl.VIEWPORT)[3]")),
+    512,
     "The debuggee's gl context viewport's left coord. still wasn't changed.");
 
   yield removeTab(target.tab);
   finish();
 }

--- a/browser/devtools/canvasdebugger/test/head.js
+++ b/browser/devtools/canvasdebugger/test/head.js
@@ -6,29 +6,31 @@ const { classes: Cc, interfaces: Ci, uti
 
 let { Services } = Cu.import("resource://gre/modules/Services.jsm", {});
 
 // Disable logging for all the tests. Both the debugger server and frontend will
 // be affected by this pref.
 let gEnableLogging = Services.prefs.getBoolPref("devtools.debugger.log");
 Services.prefs.setBoolPref("devtools.debugger.log", false);
 
+let { generateUUID } = Cc['@mozilla.org/uuid-generator;1'].getService(Ci.nsIUUIDGenerator);
 let { Task } = Cu.import("resource://gre/modules/Task.jsm", {});
 let { Promise: promise } = Cu.import("resource://gre/modules/Promise.jsm", {});
 let { gDevTools } = Cu.import("resource:///modules/devtools/gDevTools.jsm", {});
 let { devtools } = Cu.import("resource://gre/modules/devtools/Loader.jsm", {});
 let { DebuggerServer } = Cu.import("resource://gre/modules/devtools/dbg-server.jsm", {});
 let { DebuggerClient } = Cu.import("resource://gre/modules/devtools/dbg-client.jsm", {});
-
 let { CallWatcherFront } = devtools.require("devtools/server/actors/call-watcher");
 let { CanvasFront } = devtools.require("devtools/server/actors/canvas");
 let TiltGL = devtools.require("devtools/tilt/tilt-gl");
 let TargetFactory = devtools.TargetFactory;
 let Toolbox = devtools.Toolbox;
+let mm = null
 
+const FRAME_SCRIPT_UTILS_URL = "chrome://browser/content/devtools/frame-script-utils.js";
 const EXAMPLE_URL = "http://example.com/browser/browser/devtools/canvasdebugger/test/";
 const SIMPLE_CANVAS_URL = EXAMPLE_URL + "doc_simple-canvas.html";
 const SIMPLE_BITMASKS_URL = EXAMPLE_URL + "doc_simple-canvas-bitmasks.html";
 const SIMPLE_CANVAS_TRANSPARENT_URL = EXAMPLE_URL + "doc_simple-canvas-transparent.html";
 const SIMPLE_CANVAS_DEEP_STACK_URL = EXAMPLE_URL + "doc_simple-canvas-deep-stack.html";
 const WEBGL_ENUM_URL = EXAMPLE_URL + "doc_webgl-enum.html";
 const WEBGL_BINDINGS_URL = EXAMPLE_URL + "doc_webgl-bindings.html";
 
@@ -43,16 +45,25 @@ registerCleanupFunction(() => {
   Services.prefs.setBoolPref("devtools.canvasdebugger.enabled", gToolEnabled);
 
   // Some of yhese tests use a lot of memory due to GL contexts, so force a GC
   // to help fragmentation.
   info("Forcing GC after canvas debugger test.");
   Cu.forceGC();
 });
 
+/**
+ * Call manually in tests that use frame script utils after initializing
+ * the shader editor. Call after init but before navigating to different pages.
+ */
+function loadFrameScripts () {
+  mm = gBrowser.selectedBrowser.messageManager;
+  mm.loadFrameScript(FRAME_SCRIPT_UTILS_URL, false);
+}
+
 function addTab(aUrl, aWindow) {
   info("Adding tab: " + aUrl);
 
   let deferred = promise.defer();
   let targetWindow = aWindow || window;
   let targetBrowser = targetWindow.gBrowser;
 
   targetWindow.focus();
@@ -227,8 +238,35 @@ function initCanvasDebuggerFrontend(aUrl
 function teardown(aPanel) {
   info("Destroying the specified canvas debugger.");
 
   return promise.all([
     once(aPanel, "destroyed"),
     removeTab(aPanel.target.tab)
   ]);
 }
+
+/**
+ * Takes a string `script` and evaluates it directly in the content
+ * in potentially a different process.
+ */
+function evalInDebuggee (script) {
+  let deferred = promise.defer();
+
+  if (!mm) {
+    throw new Error("`loadFrameScripts()` must be called when using MessageManager.");
+  }
+
+  let id = generateUUID().toString();
+  mm.sendAsyncMessage("devtools:test:eval", { script: script, id: id });
+  mm.addMessageListener("devtools:test:eval:response", handler);
+
+  function handler ({ data }) {
+    if (id !== data.id) {
+      return;
+    }
+
+    mm.removeMessageListener("devtools:test:eval:response", handler);
+    deferred.resolve(data.value);
+  }
+
+  return deferred.promise;
+}

--- a/browser/devtools/commandline/test/browser_cmd_settings.js
+++ b/browser/devtools/commandline/test/browser_cmd_settings.js
@@ -20,59 +20,59 @@ function spawnTest() {
   // Setup
   let options = yield helpers.openTab(TEST_URI);
 
   require("devtools/commandline/commands-index");
   let gcli = require("gcli/index");
   yield gcli.load();
   let settings = gcli.settings;
 
-  let tiltEnabled = settings.get("devtools.tilt.enabled");
+  let hideIntroEnabled = settings.get("devtools.gcli.hideIntro");
   let tabSize = settings.get("devtools.editor.tabsize");
   let remoteHost = settings.get("devtools.debugger.remote-host");
 
-  let tiltEnabledOrig = prefBranch.getBoolPref("devtools.tilt.enabled");
+  let hideIntroOrig = prefBranch.getBoolPref("devtools.gcli.hideIntro");
   let tabSizeOrig = prefBranch.getIntPref("devtools.editor.tabsize");
   let remoteHostOrig = prefBranch.getComplexValue(
           "devtools.debugger.remote-host",
           Components.interfaces.nsISupportsString).data;
 
-  info("originally: devtools.tilt.enabled = " + tiltEnabledOrig);
+  info("originally: devtools.gcli.hideIntro = " + hideIntroOrig);
   info("originally: devtools.editor.tabsize = " + tabSizeOrig);
   info("originally: devtools.debugger.remote-host = " + remoteHostOrig);
 
   // Actual tests
-  is(tiltEnabled.value, tiltEnabledOrig, "tiltEnabled default");
+  is(hideIntroEnabled.value, hideIntroOrig, "hideIntroEnabled default");
   is(tabSize.value, tabSizeOrig, "tabSize default");
   is(remoteHost.value, remoteHostOrig, "remoteHost default");
 
-  tiltEnabled.setDefault();
+  hideIntroEnabled.setDefault();
   tabSize.setDefault();
   remoteHost.setDefault();
 
-  let tiltEnabledDefault = tiltEnabled.value;
+  let hideIntroEnabledDefault = hideIntroEnabled.value;
   let tabSizeDefault = tabSize.value;
   let remoteHostDefault = remoteHost.value;
 
-  tiltEnabled.value = false;
+  hideIntroEnabled.value = false;
   tabSize.value = 42;
-  remoteHost.value = "example.com"
+  remoteHost.value = "example.com";
 
-  is(tiltEnabled.value, false, "tiltEnabled basic");
+  is(hideIntroEnabled.value, false, "hideIntroEnabled basic");
   is(tabSize.value, 42, "tabSize basic");
   is(remoteHost.value, "example.com", "remoteHost basic");
 
-  function tiltEnabledCheck(ev) {
-    is(ev.setting, tiltEnabled, "tiltEnabled event setting");
-    is(ev.value, true, "tiltEnabled event value");
-    is(ev.setting.value, true, "tiltEnabled event setting value");
+  function hideIntroEnabledCheck(ev) {
+    is(ev.setting, hideIntroEnabled, "hideIntroEnabled event setting");
+    is(ev.value, true, "hideIntroEnabled event value");
+    is(ev.setting.value, true, "hideIntroEnabled event setting value");
   }
-  tiltEnabled.onChange.add(tiltEnabledCheck);
-  tiltEnabled.value = true;
-  is(tiltEnabled.value, true, "tiltEnabled change");
+  hideIntroEnabled.onChange.add(hideIntroEnabledCheck);
+  hideIntroEnabled.value = true;
+  is(hideIntroEnabled.value, true, "hideIntroEnabled change");
 
   function tabSizeCheck(ev) {
     is(ev.setting, tabSize, "tabSize event setting");
     is(ev.value, 1, "tabSize event value");
     is(ev.setting.value, 1, "tabSize event setting value");
   }
   tabSize.onChange.add(tabSizeCheck);
   tabSize.value = 1;
@@ -82,39 +82,39 @@ function spawnTest() {
     is(ev.setting, remoteHost, "remoteHost event setting");
     is(ev.value, "y.com", "remoteHost event value");
     is(ev.setting.value, "y.com", "remoteHost event setting value");
   }
   remoteHost.onChange.add(remoteHostCheck);
   remoteHost.value = "y.com";
   is(remoteHost.value, "y.com", "remoteHost change");
 
-  tiltEnabled.onChange.remove(tiltEnabledCheck);
+  hideIntroEnabled.onChange.remove(hideIntroEnabledCheck);
   tabSize.onChange.remove(tabSizeCheck);
   remoteHost.onChange.remove(remoteHostCheck);
 
   function remoteHostReCheck(ev) {
     is(ev.setting, remoteHost, "remoteHost event reset");
     is(ev.value, null, "remoteHost event revalue");
     is(ev.setting.value, null, "remoteHost event setting revalue");
   }
   remoteHost.onChange.add(remoteHostReCheck);
 
-  tiltEnabled.setDefault();
+  hideIntroEnabled.setDefault();
   tabSize.setDefault();
   remoteHost.setDefault();
 
   remoteHost.onChange.remove(remoteHostReCheck);
 
-  is(tiltEnabled.value, tiltEnabledDefault, "tiltEnabled reset");
+  is(hideIntroEnabled.value, hideIntroEnabledDefault, "hideIntroEnabled reset");
   is(tabSize.value, tabSizeDefault, "tabSize reset");
   is(remoteHost.value, remoteHostDefault, "remoteHost reset");
 
   // Cleanup
-  prefBranch.setBoolPref("devtools.tilt.enabled", tiltEnabledOrig);
+  prefBranch.setBoolPref("devtools.gcli.hideIntro", hideIntroOrig);
   prefBranch.setIntPref("devtools.editor.tabsize", tabSizeOrig);
   supportsString.data = remoteHostOrig;
   prefBranch.setComplexValue("devtools.debugger.remote-host",
           Components.interfaces.nsISupportsString,
           supportsString);
 
   yield helpers.closeTab(options);
 }

--- a/browser/devtools/framework/target.js
+++ b/browser/devtools/framework/target.js
@@ -340,16 +340,20 @@ TabTarget.prototype = {
   get isAddon() {
     return !!(this._form && this._form.addonActor);
   },
 
   get isLocalTab() {
     return !!this._tab;
   },
 
+  get isMultiProcess() {
+    return !this.window;
+  },
+
   get isThreadPaused() {
     return !!this._isThreadPaused;
   },
 
   /**
    * Adds remote protocol capabilities to the target, so that it can be used
    * for tools that support the Remote Debugging Protocol even for local
    * connections.

--- a/browser/devtools/framework/test/browser_toolbox_options_disable_buttons.js
+++ b/browser/devtools/framework/test/browser_toolbox_options_disable_buttons.js
@@ -69,37 +69,42 @@ function testPreferenceAndUIStateIsConsi
     let check = checkNodes.filter(node=>node.id === tool.id)[0];
     is (check.checked, isVisible, "Checkbox should be selected based on current pref for " + tool.id);
   }
 }
 
 function testToggleToolboxButtons() {
   let checkNodes = [...panelWin.document.querySelectorAll("#enabled-toolbox-buttons-box > checkbox")];
   let toolboxButtonNodes = [...doc.querySelectorAll(".command-button")];
-  let visibleButtons = toolboxButtonNodes.filter(button=>!button.hasAttribute("hidden"));
   let toggleableTools = toolbox.toolboxButtons;
 
+  // Tilt is disabled in E10S mode so we skip the tilt button if E10S is
+  // enabled.
+  if (toolbox.target.isMultiProcess) {
+    toolboxButtonNodes = [...doc.querySelectorAll(".command-button:not(#command-button-tilt)")];
+  }
+
   is (checkNodes.length, toggleableTools.length, "All of the buttons are toggleable." );
   is (checkNodes.length, toolboxButtonNodes.length, "All of the DOM buttons are toggleable." );
 
   for (let tool of toggleableTools) {
     let id = tool.id;
     let matchedCheckboxes = checkNodes.filter(node=>node.id === id);
     let matchedButtons = toolboxButtonNodes.filter(button=>button.id === id);
     ok (matchedCheckboxes.length === 1,
       "There should be a single toggle checkbox for: " + id);
     ok (matchedButtons.length === 1,
       "There should be a DOM button for: " + id);
     is (matchedButtons[0], tool.button,
       "DOM buttons should match for: " + id);
 
     is (matchedCheckboxes[0].getAttribute("label"), tool.label,
-      "The label for checkbox matches the tool definition.")
+      "The label for checkbox matches the tool definition.");
     is (matchedButtons[0].getAttribute("tooltiptext"), tool.label,
-      "The tooltip for button matches the tool definition.")
+      "The tooltip for button matches the tool definition.");
   }
 
   // Store modified pref names so that they can be cleared on error.
   for (let tool of toggleableTools) {
     let pref = tool.visibilityswitch;
     modifiedPrefs.push(pref);
   }
 

--- a/browser/devtools/framework/toolbox-options.js
+++ b/browser/devtools/framework/toolbox-options.js
@@ -177,16 +177,20 @@ OptionsPanel.prototype = {
       checkbox.setAttribute("id", tool.id);
       checkbox.setAttribute("label", tool.label);
       checkbox.setAttribute("checked", InfallibleGetBoolPref(tool.visibilityswitch));
       checkbox.addEventListener("command", onCheckboxClick.bind(this, checkbox));
       return checkbox;
     };
 
     for (let tool of toggleableButtons) {
+      if (this.toolbox.target.isMultiProcess && tool.id === "command-button-tilt") {
+        continue;
+      }
+
       enabledToolbarButtonsBox.appendChild(createCommandCheckbox(tool));
     }
   },
 
   setupToolsList: function() {
     let defaultToolsBox = this.panelDoc.getElementById("default-tools-box");
     let additionalToolsBox = this.panelDoc.getElementById("additional-tools-box");
     let toolsNotSupportedLabel = this.panelDoc.getElementById("tools-not-supported-label");

--- a/browser/devtools/framework/toolbox.js
+++ b/browser/devtools/framework/toolbox.js
@@ -686,24 +686,31 @@ Toolbox.prototype = {
    */
   get toolboxButtons() {
     return ToolboxButtons.map(options => {
       let button = this.doc.getElementById(options.id);
       // Some buttons may not exist inside of Browser Toolbox
       if (!button) {
         return false;
       }
+
+      // Disable tilt in E10S mode. Removing it from the list of toolbox buttons
+      // allows a bunch of tests to pass without modification.
+      if (this.target.isMultiProcess && options.id === "command-button-tilt") {
+        return false;
+      }
+
       return {
         id: options.id,
         button: button,
         label: button.getAttribute("tooltiptext"),
         visibilityswitch: "devtools." + options.id + ".enabled",
         isTargetSupported: options.isTargetSupported ? options.isTargetSupported
                                                      : target => target.isLocalTab
-      }
+      };
     }).filter(button=>button);
   },
 
   /**
    * Ensure the visibility of each toolbox button matches the
    * preference value.  Simply hide buttons that are preffed off.
    */
   setToolboxButtonsVisibility: function() {
@@ -719,16 +726,28 @@ Toolbox.prototype = {
       if (button) {
         if (on) {
           button.removeAttribute("hidden");
         } else {
           button.setAttribute("hidden", "true");
         }
       }
     });
+
+    // Tilt is handled separately because it is disabled in E10S mode. Because
+    // we have removed tilt from toolboxButtons we have to deal with it here.
+    let tiltEnabled = !this.target.isMultiProcess &&
+                      Services.prefs.getBoolPref("devtools.command-button-tilt.enabled");
+    let tiltButton = this.doc.getElementById("command-button-tilt");
+
+    if (tiltEnabled) {
+      tiltButton.removeAttribute("hidden");
+    } else {
+      tiltButton.setAttribute("hidden", "true");
+    }
   },
 
   /**
    * Build a tab for one tool definition and add to the toolbox
    *
    * @param {string} toolDefinition
    *        Tool definition of the tool to build a tab for.
    */

--- a/browser/devtools/shared/frame-script-utils.js
+++ b/browser/devtools/shared/frame-script-utils.js
@@ -17,11 +17,20 @@ addMessageListener("devtools:test:reload
   content.location.reload(data.forceget);
 });
 
 addMessageListener("devtools:test:console", function ({ data }) {
   let method = data.shift();
   content.console[method].apply(content.console, data);
 });
 
+// To eval in content, look at `evalInDebuggee` in the head.js of canvasdebugger
+// for an example.
+addMessageListener("devtools:test:eval", function ({ data }) {
+  sendAsyncMessage("devtools:test:eval:response", {
+    value: content.eval(data.script),
+    id: data.id
+  });
+});
+
 addEventListener("load", function() {
   sendAsyncMessage("devtools:test:load");
 }, true);

--- a/browser/devtools/shared/test/browser.ini
+++ b/browser/devtools/shared/test/browser.ini
@@ -44,16 +44,18 @@ support-files =
 [browser_tableWidget_basic.js]
 [browser_tableWidget_keyboard_interaction.js]
 [browser_tableWidget_mouse_interaction.js]
 skip-if = buildapp == 'mulet'
 [browser_telemetry_button_paintflashing.js]
 [browser_telemetry_button_responsive.js]
 [browser_telemetry_button_scratchpad.js]
 [browser_telemetry_button_tilt.js]
+skip-if = e10s # Bug 1086492 - Disable tilt for e10s
+               # Bug 937166 - Make tilt work in E10S mode
 [browser_telemetry_sidebar.js]
 [browser_telemetry_toolbox.js]
 [browser_telemetry_toolboxtabs_canvasdebugger.js]
 [browser_telemetry_toolboxtabs_inspector.js]
 [browser_telemetry_toolboxtabs_jsdebugger.js]
 [browser_telemetry_toolboxtabs_jsprofiler.js]
 [browser_telemetry_toolboxtabs_netmonitor.js]
 [browser_telemetry_toolboxtabs_options.js]

--- a/browser/devtools/tilt/test/browser.ini
+++ b/browser/devtools/tilt/test/browser.ini
@@ -1,10 +1,11 @@
 [DEFAULT]
-skip-if = e10s # Bug ?????? - devtools tests disabled with e10s
+skip-if = e10s # Bug 1086492 - Disable tilt for e10s
+               # Bug 937166 - Make tilt work in E10S mode
 subsuite = devtools
 support-files = head.js
 
 [browser_tilt_01_lazy_getter.js]
 [browser_tilt_02_notifications-seq.js]
 [browser_tilt_02_notifications-tabs.js]
 [browser_tilt_02_notifications.js]
 [browser_tilt_03_tab_switch.js]

--- a/browser/devtools/tilt/tilt-commands.js
+++ b/browser/devtools/tilt/tilt-commands.js
@@ -15,23 +15,29 @@ Object.defineProperty(this, "TiltManager
   },
   enumerable: true
 });
 
 exports.items = [
 {
   name: 'tilt',
   description: gcli.lookup("tiltDesc"),
-  manual: gcli.lookup("tiltManual")
+  manual: gcli.lookup("tiltManual"),
+  hidden: true
 },
 {
   name: 'tilt open',
   description: gcli.lookup("tiltOpenDesc"),
   manual: gcli.lookup("tiltOpenManual"),
+  hidden: true,
   exec: function(args, context) {
+    if (isMultiProcess(context)) {
+      return gcli.lookupFormat("notAvailableInE10S", [this.name]);
+    }
+
     let chromeWindow = context.environment.chromeDocument.defaultView;
     let Tilt = TiltManager.getTiltForBrowser(chromeWindow);
     if (!Tilt.currentInstance) {
       Tilt.toggle();
     }
   }
 },
 {
@@ -54,25 +60,30 @@ exports.items = [
       if (aTarget.tab) {
         let browserWindow = aTarget.tab.ownerDocument.defaultView;
         let tilt = TiltManager.getTiltForBrowser(browserWindow);
         tilt.off("change", aChangeHandler);
       }
     },
   },
   exec: function(args, context) {
+    if (isMultiProcess(context)) {
+      return gcli.lookupFormat("notAvailableInE10S", [this.name]);
+    }
+
     let chromeWindow = context.environment.chromeDocument.defaultView;
     let Tilt = TiltManager.getTiltForBrowser(chromeWindow);
     Tilt.toggle();
   }
 },
 {
   name: 'tilt translate',
   description: gcli.lookup("tiltTranslateDesc"),
   manual: gcli.lookup("tiltTranslateManual"),
+  hidden: true,
   params: [
     {
       name: "x",
       type: "number",
       defaultValue: 0,
       description: gcli.lookup("tiltTranslateXDesc"),
       manual: gcli.lookup("tiltTranslateXManual")
     },
@@ -80,27 +91,32 @@ exports.items = [
       name: "y",
       type: "number",
       defaultValue: 0,
       description: gcli.lookup("tiltTranslateYDesc"),
       manual: gcli.lookup("tiltTranslateYManual")
     }
   ],
   exec: function(args, context) {
+    if (isMultiProcess(context)) {
+      return gcli.lookupFormat("notAvailableInE10S", [this.name]);
+    }
+
     let chromeWindow = context.environment.chromeDocument.defaultView;
     let Tilt = TiltManager.getTiltForBrowser(chromeWindow);
     if (Tilt.currentInstance) {
       Tilt.currentInstance.controller.arcball.translate([args.x, args.y]);
     }
   }
 },
 {
   name: 'tilt rotate',
   description: gcli.lookup("tiltRotateDesc"),
   manual: gcli.lookup("tiltRotateManual"),
+  hidden: true,
   params: [
     {
       name: "x",
       type: { name: 'number', min: -360, max: 360, step: 10 },
       defaultValue: 0,
       description: gcli.lookup("tiltRotateXDesc"),
       manual: gcli.lookup("tiltRotateXManual")
     },
@@ -115,61 +131,84 @@ exports.items = [
       name: "z",
       type: { name: 'number', min: -360, max: 360, step: 10 },
       defaultValue: 0,
       description: gcli.lookup("tiltRotateZDesc"),
       manual: gcli.lookup("tiltRotateZManual")
     }
   ],
   exec: function(args, context) {
+    if (isMultiProcess(context)) {
+      return gcli.lookupFormat("notAvailableInE10S", [this.name]);
+    }
+
     let chromeWindow = context.environment.chromeDocument.defaultView;
     let Tilt = TiltManager.getTiltForBrowser(chromeWindow);
     if (Tilt.currentInstance) {
       Tilt.currentInstance.controller.arcball.rotate([args.x, args.y, args.z]);
     }
   }
 },
 {
   name: 'tilt zoom',
   description: gcli.lookup("tiltZoomDesc"),
   manual: gcli.lookup("tiltZoomManual"),
+  hidden: true,
   params: [
     {
       name: "zoom",
       type: { name: 'number' },
       description: gcli.lookup("tiltZoomAmountDesc"),
       manual: gcli.lookup("tiltZoomAmountManual")
     }
   ],
   exec: function(args, context) {
+    if (isMultiProcess(context)) {
+      return gcli.lookupFormat("notAvailableInE10S", [this.name]);
+    }
+
     let chromeWindow = context.environment.chromeDocument.defaultView;
     let Tilt = TiltManager.getTiltForBrowser(chromeWindow);
 
     if (Tilt.currentInstance) {
       Tilt.currentInstance.controller.arcball.zoom(-args.zoom);
     }
   }
 },
 {
   name: 'tilt reset',
   description: gcli.lookup("tiltResetDesc"),
   manual: gcli.lookup("tiltResetManual"),
+  hidden: true,
   exec: function(args, context) {
+    if (isMultiProcess(context)) {
+      return gcli.lookupFormat("notAvailableInE10S", [this.name]);
+    }
+
     let chromeWindow = context.environment.chromeDocument.defaultView;
     let Tilt = TiltManager.getTiltForBrowser(chromeWindow);
 
     if (Tilt.currentInstance) {
       Tilt.currentInstance.controller.arcball.reset();
     }
   }
 },
 {
   name: 'tilt close',
   description: gcli.lookup("tiltCloseDesc"),
   manual: gcli.lookup("tiltCloseManual"),
+  hidden: true,
   exec: function(args, context) {
+    if (isMultiProcess(context)) {
+      return gcli.lookupFormat("notAvailableInE10S", [this.name]);
+    }
+
     let chromeWindow = context.environment.chromeDocument.defaultView;
     let Tilt = TiltManager.getTiltForBrowser(chromeWindow);
 
     Tilt.destroy(Tilt.currentWindowId);
   }
 }
 ];
+
+function isMultiProcess(context) {
+  return !context.environment.window;
+}

--- a/browser/locales/en-US/chrome/browser/devtools/gclicommands.properties
+++ b/browser/locales/en-US/chrome/browser/devtools/gclicommands.properties
@@ -15,16 +15,20 @@
 # LOCALIZATION NOTE (helpDesc) A very short string used to describe the
 # function of the help command.
 helpDesc=Get help on the available commands
 
 # LOCALIZATION NOTE (helpAvailable) Used in the output of the help command to
 # explain the contents of the command help table.
 helpAvailable=Available Commands
 
+# LOCALIZATION NOTE (notAvailableInE10S) Used in the output of any command that
+# is not compatible with multiprocess mode (E10S).
+notAvailableInE10S=The command '%1$S' is not available in multiprocess mode (E10S)
+
 # LOCALIZATION NOTE (consoleDesc) A very short string used to describe the
 # function of the console command.
 consoleDesc=Commands to control the console
 
 # LOCALIZATION NOTE (consoleManual) A longer description describing the
 # set of commands that control the console.
 consoleManual=Filter, clear and close the web console
 

--- a/browser/modules/UITour.jsm
+++ b/browser/modules/UITour.jsm
@@ -96,16 +96,18 @@ this.UITour = {
                                                         "class",
                                                         "toolbarbutton-icon");
       },
       widgetName: "PanelUI-customize",
     }],
     ["help",        {query: "#PanelUI-help"}],
     ["home",        {query: "#home-button"}],
     ["loop",        {query: "#loop-call-button"}],
+    ["devtools",    {query: "#developer-button"}],
+    ["webide",      {query: "#webide-button"}],
     ["forget", {
       query: "#panic-button",
       widgetName: "panic-button",
       allowAdd: true }],
     ["privateWindow",  {query: "#privatebrowsing-button"}],
     ["quit",        {query: "#PanelUI-quit"}],
     ["search",      {
       query: "#searchbar",

--- a/browser/modules/test/browser_UITour_availableTargets.js
+++ b/browser/modules/test/browser_UITour_availableTargets.js
@@ -4,16 +4,18 @@
 "use strict";
 
 let gTestTab;
 let gContentAPI;
 let gContentWindow;
 
 Components.utils.import("resource:///modules/UITour.jsm");
 
+let hasWebIDE = Services.prefs.getBoolPref("devtools.webide.widget.enabled");
+
 function test() {
   requestLongerTimeout(2);
   UITourTest();
 }
 
 function searchEngineTargets() {
   let engines = Services.search.getVisibleEngines();
   return ["searchEngine-" + engine.identifier
@@ -29,23 +31,27 @@ let tests = [
         "addons",
         "appMenu",
         "backForward",
         "bookmarks",
         "customize",
         "help",
         "home",
         "loop",
+        "devtools",
         "pinnedTab",
         "privateWindow",
         "quit",
         "search",
         "searchProvider",
         "urlbar",
-      ].concat(searchEngineTargets()));
+        ...searchEngineTargets(),
+        ...(hasWebIDE ? ["webide"] : [])
+      ]);
+
       ok(UITour.availableTargetsCache.has(window),
          "Targets should now be cached");
       done();
     });
   },
 
   function test_availableTargets_changeWidgets(done) {
     CustomizableUI.removeWidgetFromArea("bookmarks-menu-button");
@@ -55,24 +61,28 @@ let tests = [
       ok_targets(data, [
         "accountStatus",
         "addons",
         "appMenu",
         "backForward",
         "customize",
         "help",
         "loop",
+        "devtools",
         "home",
         "pinnedTab",
         "privateWindow",
         "quit",
         "search",
         "searchProvider",
         "urlbar",
-      ].concat(searchEngineTargets()));
+        ...searchEngineTargets(),
+        ...(hasWebIDE ? ["webide"] : [])
+      ]);
+
       ok(UITour.availableTargetsCache.has(window),
          "Targets should now be cached again");
       CustomizableUI.reset();
       ok(!UITour.availableTargetsCache.has(window),
          "Targets should not be cached after reset");
       done();
     });
   },
@@ -88,21 +98,24 @@ let tests = [
         "addons",
         "appMenu",
         "backForward",
         "bookmarks",
         "customize",
         "help",
         "home",
         "loop",
+        "devtools",
         "pinnedTab",
         "privateWindow",
         "quit",
         "urlbar",
+        ...(hasWebIDE ? ["webide"] : [])
       ]);
+
       CustomizableUI.reset();
       done();
     });
   },
 ];
 
 function ok_targets(actualData, expectedTargets) {
   // Depending on how soon after page load this is called, the selected tab icon

--- a/dom/icc/IccCardLockError.cpp
+++ b/dom/icc/IccCardLockError.cpp
@@ -7,38 +7,35 @@
 
 namespace mozilla {
 namespace dom {
 
 NS_IMPL_ISUPPORTS_INHERITED0(IccCardLockError, DOMError)
 
 /* static */ already_AddRefed<IccCardLockError>
 IccCardLockError::Constructor(const GlobalObject& aGlobal,
-                              const nsAString& aLockType,
                               const nsAString& aName,
                               int16_t aRetryCount,
                               ErrorResult& aRv)
 {
   nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(aGlobal.GetAsSupports());
   if (!window) {
     aRv.Throw(NS_ERROR_FAILURE);
     return nullptr;
   }
 
   nsRefPtr<IccCardLockError> result =
-    new IccCardLockError(window, aName, aLockType, aRetryCount);
+    new IccCardLockError(window, aName, aRetryCount);
   return result.forget();
 }
 
 IccCardLockError::IccCardLockError(nsPIDOMWindow* aWindow,
                                    const nsAString& aName,
-                                   const nsAString& aLockType,
                                    int16_t aRetryCount)
   : DOMError(aWindow, aName)
-  , mLockType(aLockType)
   , mRetryCount(aRetryCount)
 {
 }
 
 JSObject*
 IccCardLockError::WrapObject(JSContext* aCx)
 {
   return IccCardLockErrorBinding::Wrap(aCx, this);

--- a/dom/icc/IccCardLockError.h
+++ b/dom/icc/IccCardLockError.h
@@ -11,44 +11,36 @@ namespace mozilla {
 namespace dom {
 
 class IccCardLockError MOZ_FINAL : public DOMError
 {
 public:
   NS_DECL_ISUPPORTS_INHERITED
 
   IccCardLockError(nsPIDOMWindow* aWindow, const nsAString& aName,
-                   const nsAString& aLockType, int16_t aRetryCount);
+                   int16_t aRetryCount);
 
   static already_AddRefed<IccCardLockError>
-  Constructor(const GlobalObject& aGlobal, const nsAString& aLockType,
-              const nsAString& aName, int16_t aRetryCount,
-              ErrorResult& aRv);
+  Constructor(const GlobalObject& aGlobal, const nsAString& aName,
+              int16_t aRetryCount, ErrorResult& aRv);
 
   virtual JSObject*
   WrapObject(JSContext* aCx) MOZ_OVERRIDE;
 
   // WebIDL interface
 
-  void
-  GetLockType(nsString& aLockType) const
-  {
-    aLockType = mLockType;
-  }
-
   int16_t
   RetryCount() const
   {
     return mRetryCount;
   }
 
 private:
   ~IccCardLockError() {}
 
 private:
-  nsString mLockType;
   int16_t mRetryCount;
 };
 
 } // namespace dom
 } // namespace mozilla
 
 #endif // mozilla_dom_IccCardLockError_h

--- a/dom/icc/tests/marionette/test_icc_card_lock.js
+++ b/dom/icc/tests/marionette/test_icc_card_lock.js
@@ -12,17 +12,16 @@ taskHelper.push(function testPinChangeFa
      pin: "1111",
      newPin: "0000"});
 
   ok(request instanceof DOMRequest,
      "request instanceof " + request.constructor);
 
   request.onerror = function onerror() {
     is(request.error.name, "IncorrectPassword");
-    is(request.error.lockType, "pin");
     // The default pin retries is 3, failed once becomes to 2
     is(request.error.retryCount, 2);
 
     // Reset pin retries by passing correct pin code.
     let resetRequest = icc.setCardLock(
       {lockType: "pin",
        pin: "0000",
        newPin: "0000"});

--- a/dom/icc/tests/marionette/test_stk_display_text.js
+++ b/dom/icc/tests/marionette/test_stk_display_text.js
@@ -184,11 +184,45 @@ let tests = [
             "1E" +
             "F6" + // 8BIT + Class 2
             "546F6F6C6B697420546573742047524F" +
             "55503A307846302C2038424954",
    func: testDisplayText,
    expect: {name: "display_text_cmd_20",
             commandQualifier: 0x00,
             text: "Toolkit Test GROUP:0xF0, 8BIT"}},
+  // Bug 1088573: this test case is to ensure that we provide |length| argument
+  // in |integer| format to GsmPDUHelper.readSeptetsToString().
+  {command: "D0" +
+            "81" + // 2-byte length encoded:
+            "FC" + // 252
+            "810301210082028102" +
+            "8D" +
+            "81" + // 2-byte length encoded:
+            "F0" + // 240
+            "00" + // 7BIT
+            "C332A85D9ECFC3E732685E068DDF6DF8" +
+            "7B5E0691CB20D96D061A87E5E131BD2C" +
+            "2FCF416537A8FD269741E3771B2E2FCF" +
+            "E76517685806B5CBF379F85C0695E774" +
+            "50D86C4E8FD165D0BC2E07C1D9F579BA" +
+            "5C97CF41E5B13CEC9E83CA7490BB0C22" +
+            "BFD374103C3C0795E9F232882E7FBBE3" +
+            "F5B20B24BBCD40E5391DC42E83DCEFB6" +
+            "585E06B5C3F874BBDE0691CBA071581E" +
+            "1ED3CBF2F21C14369BD3637458CC2EBB" +
+            "40C3329D5E0699DFEE313DFD76BBC3EC" +
+            "34BD0C0A83CAF432280C87CBDF757BB9" +
+            "0C8287E5207619346D1E73A0783D0D9A" +
+            "9FCA733A885C96BFEBEC32280C9A6689" +
+            "CE621654768382D529551A64268B2E",
+   func: testDisplayText,
+   expect: {name: "display_text_cmd_21",
+            commandQualifier: 0x00,
+            text: "Ce message se compose de 273 caracteres en mode " +
+                  "compresse. Ce message est affiche sur plusieurs " +
+                  "ecrans et ne doit pas etre tronque. 273 est le " +
+                  "nombre maximum de caracteres affichable. Cette " +
+                  "fonctionnalite a ete approuvee par le SMG9 qui s'est " +
+                  "deroule a SYDNEY en AUSTRALIE."}},
 ];
 
 runNextTest();

--- a/dom/mobileconnection/Assertions.cpp
+++ b/dom/mobileconnection/Assertions.cpp
@@ -23,10 +23,29 @@ ASSERT_NETWORK_SELECTION_MODE_EQUALITY(M
 
 ASSERT_MOBILE_RADIO_STATE_EQUALITY(Enabling, MOBILE_RADIO_STATE_ENABLING);
 ASSERT_MOBILE_RADIO_STATE_EQUALITY(Enabled, MOBILE_RADIO_STATE_ENABLED);
 ASSERT_MOBILE_RADIO_STATE_EQUALITY(Disabling, MOBILE_RADIO_STATE_DISABLING);
 ASSERT_MOBILE_RADIO_STATE_EQUALITY(Disabled, MOBILE_RADIO_STATE_DISABLED);
 
 #undef ASSERT_MOBILE_RADIO_STATE_EQUALITY
 
+#define ASSERT_PREFERRED_NETWORK_TYPE_EQUALITY(webidlState, xpidlState) \
+  static_assert(static_cast<int32_t>(MobilePreferredNetworkType::webidlState) == nsIMobileConnection::xpidlState, \
+                "MobilePreferredNetworkType::" #webidlState " should equal to nsIMobileConnection::" #xpidlState)
+
+ASSERT_PREFERRED_NETWORK_TYPE_EQUALITY(Wcdma_gsm, PREFERRED_NETWORK_TYPE_WCDMA_GSM);
+ASSERT_PREFERRED_NETWORK_TYPE_EQUALITY(Gsm, PREFERRED_NETWORK_TYPE_GSM_ONLY);
+ASSERT_PREFERRED_NETWORK_TYPE_EQUALITY(Wcdma, PREFERRED_NETWORK_TYPE_WCDMA_ONLY);
+ASSERT_PREFERRED_NETWORK_TYPE_EQUALITY(Wcdma_gsm_auto, PREFERRED_NETWORK_TYPE_WCDMA_GSM_AUTO);
+ASSERT_PREFERRED_NETWORK_TYPE_EQUALITY(Cdma_evdo, PREFERRED_NETWORK_TYPE_CDMA_EVDO);
+ASSERT_PREFERRED_NETWORK_TYPE_EQUALITY(Cdma, PREFERRED_NETWORK_TYPE_CDMA_ONLY);
+ASSERT_PREFERRED_NETWORK_TYPE_EQUALITY(Evdo, PREFERRED_NETWORK_TYPE_EVDO_ONLY);
+ASSERT_PREFERRED_NETWORK_TYPE_EQUALITY(Wcdma_gsm_cdma_evdo, PREFERRED_NETWORK_TYPE_WCDMA_GSM_CDMA_EVDO);
+ASSERT_PREFERRED_NETWORK_TYPE_EQUALITY(Lte_cdma_evdo, PREFERRED_NETWORK_TYPE_LTE_CDMA_EVDO);
+ASSERT_PREFERRED_NETWORK_TYPE_EQUALITY(Lte_wcdma_gsm, PREFERRED_NETWORK_TYPE_LTE_WCDMA_GSM);
+ASSERT_PREFERRED_NETWORK_TYPE_EQUALITY(Lte_wcdma_gsm_cdma_evdo, PREFERRED_NETWORK_TYPE_LTE_WCDMA_GSM_CDMA_EVDO);
+ASSERT_PREFERRED_NETWORK_TYPE_EQUALITY(Lte, PREFERRED_NETWORK_TYPE_LTE_ONLY);
+
+#undef ASSERT_PREFERRED_NETWORK_TYPE_EQUALITY
+
 } // namespace dom
 } // namespace mozilla

--- a/dom/mobileconnection/MobileConnection.cpp
+++ b/dom/mobileconnection/MobileConnection.cpp
@@ -472,18 +472,17 @@ already_AddRefed<DOMRequest>
 MobileConnection::SetPreferredNetworkType(MobilePreferredNetworkType& aType,
                                           ErrorResult& aRv)
 {
   if (!mMobileConnection) {
     aRv.Throw(NS_ERROR_FAILURE);
     return nullptr;
   }
 
-  nsAutoString type;
-  CONVERT_ENUM_TO_STRING(MobilePreferredNetworkType, aType, type);
+  int32_t type = static_cast<int32_t>(aType);
 
   nsRefPtr<DOMRequest> request = new DOMRequest(GetOwner());
   nsRefPtr<MobileConnectionCallback> requestCallback =
     new MobileConnectionCallback(GetOwner(), request);
 
   nsresult rv =
     mMobileConnection->SetPreferredNetworkType(type, requestCallback);
   if (NS_FAILED(rv)) {

--- a/dom/mobileconnection/MobileConnectionCallback.cpp
+++ b/dom/mobileconnection/MobileConnectionCallback.cpp
@@ -10,16 +10,23 @@
 #include "mozilla/dom/ToJSValue.h"
 #include "nsJSUtils.h"
 #include "nsServiceManagerUtils.h"
 
 namespace mozilla {
 namespace dom {
 namespace mobileconnection {
 
+#define CONVERT_ENUM_TO_STRING(_enumType, _enum, _string)               \
+{                                                                       \
+  uint32_t index = uint32_t(_enum);                                     \
+  _string.AssignASCII(_enumType##Values::strings[index].value,          \
+                      _enumType##Values::strings[index].length);        \
+}
+
 NS_IMPL_ISUPPORTS(MobileConnectionCallback, nsIMobileConnectionCallback)
 
 MobileConnectionCallback::MobileConnectionCallback(nsPIDOMWindow* aWindow,
                                                    DOMRequest* aRequest)
   : mWindow(aWindow)
   , mRequest(aRequest)
 {
 }
@@ -345,16 +352,28 @@ MobileConnectionCallback::NotifyGetClirS
     JS_ClearPendingException(cx);
     return NS_ERROR_TYPE_ERR;
   }
 
   return NotifySuccess(jsResult);
 };
 
 NS_IMETHODIMP
+MobileConnectionCallback::NotifyGetPreferredNetworkTypeSuccess(int32_t aType)
+{
+  MOZ_ASSERT(aType < static_cast<int32_t>(MobilePreferredNetworkType::EndGuard_));
+  MobilePreferredNetworkType type = static_cast<MobilePreferredNetworkType>(aType);
+
+  nsAutoString typeString;
+  CONVERT_ENUM_TO_STRING(MobilePreferredNetworkType, type, typeString);
+
+  return NotifySuccessWithString(typeString);
+};
+
+NS_IMETHODIMP
 MobileConnectionCallback::NotifyError(const nsAString& aName,
                                       const nsAString& aMessage,
                                       const nsAString& aServiceCode,
                                       uint16_t aInfo,
                                       uint8_t aArgc)
 {
   nsCOMPtr<nsIDOMRequestService> rs = do_GetService(DOMREQUEST_SERVICE_CONTRACTID);
   NS_ENSURE_TRUE(rs, NS_ERROR_FAILURE);

--- a/dom/mobileconnection/gonk/MobileConnectionService.js
+++ b/dom/mobileconnection/gonk/MobileConnectionService.js
@@ -769,17 +769,17 @@ MobileConnectionProvider.prototype = {
 
     this._radioInterface.sendWorkerMessage("getPreferredNetworkType", null,
                                            (function(aResponse) {
       if (aResponse.errorMsg) {
         aCallback.notifyError(aResponse.errorMsg);
         return false;
       }
 
-      aCallback.notifySuccessWithString(aResponse.type);
+      aCallback.notifyGetPreferredNetworkTypeSuccess(aResponse.type);
       return false;
     }).bind(this));
   },
 
   setRoamingPreference: function(aMode, aCallback) {
     this._radioInterface.sendWorkerMessage("setRoamingPreference",
                                            {mode: aMode},
                                            (function(aResponse) {

--- a/dom/mobileconnection/interfaces/nsIMobileConnectionService.idl
+++ b/dom/mobileconnection/interfaces/nsIMobileConnectionService.idl
@@ -119,17 +119,17 @@ interface nsIMobileConnectionListener : 
    */
   void notifyNetworkSelectionModeChanged();
 };
 
 %{C++
 #define NO_ADDITIONAL_INFORMATION 0
 %}
 
-[scriptable, builtinclass, uuid(05568ae9-9873-46c6-9acd-0f6994cde756)]
+[scriptable, builtinclass, uuid(413e8bff-9f65-41a0-953f-b82e6cdbc00d)]
 interface nsIMobileConnectionCallback : nsISupports
 {
   /**
    * notify*Success*() will be called, when request is succeed.
    */
   void notifySuccess();
 
   void notifySuccessWithString(in DOMString result);
@@ -161,16 +161,18 @@ interface nsIMobileConnectionCallback : 
 
 
   void notifyGetCallBarringSuccess(in unsigned short program,
                                    in boolean enabled,
                                    in unsigned short serviceClass);
 
   void notifyGetClirStatusSuccess(in unsigned short n, in unsigned short m);
 
+  void notifyGetPreferredNetworkTypeSuccess(in long type);
+
   /**
    * notifyError() will be called, when request is failed.
    */
   [optional_argc]
   void notifyError(in DOMString name,
                    [optional] in DOMString message,
                    [optional] in DOMString serviceCode,
                    [optional] in unsigned short additionalInformation);
@@ -228,17 +230,17 @@ interface nsIMobileConnectionService : n
 
 %{C++
 template<typename T> struct already_AddRefed;
 
 already_AddRefed<nsIMobileConnectionService>
 NS_CreateMobileConnectionService();
 %}
 
-[scriptable, uuid(99818dc7-e770-4249-87e2-2de0a928ed08)]
+[scriptable, uuid(d6b15551-d290-4e38-9749-d21eb35cdaf1)]
 interface nsIMobileConnection : nsISupports
 {
   /*
    * ICC service class.
    */
   const long ICC_SERVICE_CLASS_NONE       = 0; // not available
   const long ICC_SERVICE_CLASS_VOICE      = (1 << 0);
   const long ICC_SERVICE_CLASS_DATA       = (1 << 1);
@@ -305,16 +307,32 @@ interface nsIMobileConnection : nsISuppo
    * Mobile Radio State.
    */
   const long MOBILE_RADIO_STATE_UNKNOWN   = -1;
   const long MOBILE_RADIO_STATE_ENABLING  = 0;
   const long MOBILE_RADIO_STATE_ENABLED   = 1;
   const long MOBILE_RADIO_STATE_DISABLING = 2;
   const long MOBILE_RADIO_STATE_DISABLED  = 3;
 
+  /**
+   * Preferred network type.
+   */
+  const long PREFERRED_NETWORK_TYPE_WCDMA_GSM               = 0;
+  const long PREFERRED_NETWORK_TYPE_GSM_ONLY                = 1;
+  const long PREFERRED_NETWORK_TYPE_WCDMA_ONLY              = 2;
+  const long PREFERRED_NETWORK_TYPE_WCDMA_GSM_AUTO          = 3;
+  const long PREFERRED_NETWORK_TYPE_CDMA_EVDO               = 4;
+  const long PREFERRED_NETWORK_TYPE_CDMA_ONLY               = 5;
+  const long PREFERRED_NETWORK_TYPE_EVDO_ONLY               = 6;
+  const long PREFERRED_NETWORK_TYPE_WCDMA_GSM_CDMA_EVDO     = 7;
+  const long PREFERRED_NETWORK_TYPE_LTE_CDMA_EVDO           = 8;
+  const long PREFERRED_NETWORK_TYPE_LTE_WCDMA_GSM           = 9;
+  const long PREFERRED_NETWORK_TYPE_LTE_WCDMA_GSM_CDMA_EVDO = 10;
+  const long PREFERRED_NETWORK_TYPE_LTE_ONLY                = 11;
+
   readonly attribute unsigned long serviceId;
 
   /**
    * Called when any one who is interested in receiving unsolicited messages
    * from this nsIMobileConnection instance.
    */
   void registerListener(in nsIMobileConnectionListener listener);
   void unregisterListener(in nsIMobileConnectionListener listener);
@@ -413,44 +431,39 @@ interface nsIMobileConnection : nsISuppo
    * 'GenericFailure'.
    */
   void selectNetworkAutomatically(in nsIMobileConnectionCallback requestCallback);
 
   /**
    * Set preferred network type.
    *
    * @param type
-   *        DOMString indicates the desired preferred network type.
-   *        Possible values: 'wcdma/gsm', 'gsm', 'wcdma', 'wcdma/gsm-auto',
-   *        'cdma/evdo', 'cdma', 'evdo', 'wcdma/gsm/cdma/evdo',
-   *        'lte/cdma/evdo', 'lte/wcdma/gsm', 'lte/wcdma/gsm/cdma/evdo' or
-   *        'lte'.
+   *        One of the nsIMobileConnection.PREFERRED_NETWORK_TYPE_* values.
    * @param requestCallback
    *        Called when request is finished.
    *
    * If successful, the notifySuccess() will be called.
    *
    * Otherwise, the notifyError() will be called, and the error will be either
    * 'RadioNotAvailable', 'RequestNotSupported', 'InvalidParameter',
    * 'IllegalSIMorME', or 'GenericFailure'.
    */
-  void setPreferredNetworkType(in DOMString type,
+  void setPreferredNetworkType(in long type,
                                in nsIMobileConnectionCallback requestCallback);
 
   /**
    * Query current preferred network type.
    *
    * @param requestCallback
    *        Called when request is finished.
    *
-   * If successful, the notifySuccessString() will be called. And the result
-   * will be a string indicating the current preferred network type. The value
-   * will be either 'wcdma/gsm', 'gsm', 'wcdma', 'wcdma/gsm-auto', 'cdma/evdo',
-   * 'cdma', 'evdo', 'wcdma/gsm/cdma/evdo', 'lte/cdma/evdo', 'lte/wcdma/gsm',
-   * 'lte/wcdma/gsm/cdma/evdo' or 'lte'.
+   * If successful, the notifyGetPreferredNetworkTypeSuccess() will be called,
+   * and the result 'type' will be one of the
+   * nsIMobileConnection.PREFERRED_NETWORK_TYPE_* values, indicating the current
+   * preferred network type.
    *
    * Otherwise, the notifyError() will be called, and the error will be either
    * 'RadioNotAvailable', 'RequestNotSupported', 'IllegalSIMorME', or
    * 'GenericFailure'.
    */
   void getPreferredNetworkType(in nsIMobileConnectionCallback requestCallback);
 
   /**

--- a/dom/mobileconnection/ipc/MobileConnectionChild.cpp
+++ b/dom/mobileconnection/ipc/MobileConnectionChild.cpp
@@ -173,21 +173,20 @@ NS_IMETHODIMP
 MobileConnectionChild::SelectNetworkAutomatically(nsIMobileConnectionCallback* aCallback)
 {
   return SendRequest(SelectNetworkAutoRequest(), aCallback)
     ? NS_OK : NS_ERROR_FAILURE;
 }
 
 
 NS_IMETHODIMP
-MobileConnectionChild::SetPreferredNetworkType(const nsAString& aType,
+MobileConnectionChild::SetPreferredNetworkType(int32_t aType,
                                                nsIMobileConnectionCallback* aCallback)
 {
-  return SendRequest(SetPreferredNetworkTypeRequest(nsAutoString(aType)),
-                     aCallback)
+  return SendRequest(SetPreferredNetworkTypeRequest(aType), aCallback)
     ? NS_OK : NS_ERROR_FAILURE;
 }
 
 NS_IMETHODIMP
 MobileConnectionChild::GetPreferredNetworkType(nsIMobileConnectionCallback* aCallback)
 {
   return SendRequest(GetPreferredNetworkTypeRequest(), aCallback)
     ? NS_OK : NS_ERROR_FAILURE;
@@ -657,16 +656,22 @@ MobileConnectionRequestChild::DoReply(co
 bool
 MobileConnectionRequestChild::DoReply(const MobileConnectionReplySuccessClirStatus& aReply)
 {
   return NS_SUCCEEDED(mRequestCallback->NotifyGetClirStatusSuccess(aReply.n(),
                                                                    aReply.m()));
 }
 
 bool
+MobileConnectionRequestChild::DoReply(const MobileConnectionReplySuccessPreferredNetworkType& aReply)
+{
+  return NS_SUCCEEDED(mRequestCallback->NotifyGetPreferredNetworkTypeSuccess(aReply.type()));
+}
+
+bool
 MobileConnectionRequestChild::DoReply(const MobileConnectionReplyError& aReply)
 {
   return NS_SUCCEEDED(mRequestCallback->NotifyError(aReply.message()));
 }
 
 bool
 MobileConnectionRequestChild::DoReply(const MobileConnectionReplyErrorMmi& aReply)
 {
@@ -710,16 +715,18 @@ MobileConnectionRequestChild::Recv__dele
     case MobileConnectionReply::TMobileConnectionReplySuccessMmi:
       return DoReply(aReply.get_MobileConnectionReplySuccessMmi());
     case MobileConnectionReply::TMobileConnectionReplySuccessCallForwarding:
       return DoReply(aReply.get_MobileConnectionReplySuccessCallForwarding());
     case MobileConnectionReply::TMobileConnectionReplySuccessCallBarring:
       return DoReply(aReply.get_MobileConnectionReplySuccessCallBarring());
     case MobileConnectionReply::TMobileConnectionReplySuccessClirStatus:
       return DoReply(aReply.get_MobileConnectionReplySuccessClirStatus());
+    case MobileConnectionReply::TMobileConnectionReplySuccessPreferredNetworkType:
+      return DoReply(aReply.get_MobileConnectionReplySuccessPreferredNetworkType());
     case MobileConnectionReply::TMobileConnectionReplyError:
       return DoReply(aReply.get_MobileConnectionReplyError());
     case MobileConnectionReply::TMobileConnectionReplyErrorMmi:
       return DoReply(aReply.get_MobileConnectionReplyErrorMmi());
     default:
       MOZ_CRASH("Received invalid response type!");
   }
 

--- a/dom/mobileconnection/ipc/MobileConnectionChild.h
+++ b/dom/mobileconnection/ipc/MobileConnectionChild.h
@@ -159,16 +159,19 @@ public:
 
   bool
   DoReply(const MobileConnectionReplySuccessCallBarring& aReply);
 
   bool
   DoReply(const MobileConnectionReplySuccessClirStatus& aReply);
 
   bool
+  DoReply(const MobileConnectionReplySuccessPreferredNetworkType& aReply);
+
+  bool
   DoReply(const MobileConnectionReplyError& aReply);
 
   bool
   DoReply(const MobileConnectionReplyErrorMmi& aReply);
 
 protected:
   virtual
   ~MobileConnectionRequestChild()

--- a/dom/mobileconnection/ipc/MobileConnectionParent.cpp
+++ b/dom/mobileconnection/ipc/MobileConnectionParent.cpp
@@ -638,16 +638,22 @@ MobileConnectionRequestParent::NotifyGet
 NS_IMETHODIMP
 MobileConnectionRequestParent::NotifyGetClirStatusSuccess(uint16_t aN,
                                                           uint16_t aM)
 {
   return SendReply(MobileConnectionReplySuccessClirStatus(aN, aM));
 }
 
 NS_IMETHODIMP
+MobileConnectionRequestParent::NotifyGetPreferredNetworkTypeSuccess(int32_t aType)
+{
+  return SendReply(MobileConnectionReplySuccessPreferredNetworkType(aType));
+}
+
+NS_IMETHODIMP
 MobileConnectionRequestParent::NotifyError(const nsAString& aName,
                                            const nsAString& aMessage,
                                            const nsAString& aServiceCode,
                                            uint16_t aInfo,
                                            uint8_t aArgc)
 {
   if (aArgc == 0) {
     nsAutoString error(aName);

--- a/dom/mobileconnection/ipc/PMobileConnection.ipdl
+++ b/dom/mobileconnection/ipc/PMobileConnection.ipdl
@@ -67,17 +67,17 @@ struct SelectNetworkRequest
 };
 
 struct SelectNetworkAutoRequest
 {
 };
 
 struct SetPreferredNetworkTypeRequest
 {
-  nsString type;
+  int32_t type;
 };
 
 struct GetPreferredNetworkTypeRequest
 {
 };
 
 struct SetRoamingPreferenceRequest
 {

--- a/dom/mobileconnection/ipc/PMobileConnectionRequest.ipdl
+++ b/dom/mobileconnection/ipc/PMobileConnectionRequest.ipdl
@@ -65,16 +65,21 @@ struct MobileConnectionReplySuccessCallB
 };
 
 struct MobileConnectionReplySuccessClirStatus
 {
   uint16_t n;
   uint16_t m;
 };
 
+struct MobileConnectionReplySuccessPreferredNetworkType
+{
+  int32_t type;
+};
+
 // Error
 struct MobileConnectionReplyError
 {
   nsString message;
 };
 
 struct MobileConnectionReplyErrorMmi
 {
@@ -90,16 +95,17 @@ union MobileConnectionReply
   MobileConnectionReplySuccess;
   MobileConnectionReplySuccessString;
   MobileConnectionReplySuccessBoolean;
   MobileConnectionReplySuccessNetworks;
   MobileConnectionReplySuccessMmi;
   MobileConnectionReplySuccessCallForwarding;
   MobileConnectionReplySuccessCallBarring;
   MobileConnectionReplySuccessClirStatus;
+  MobileConnectionReplySuccessPreferredNetworkType;
   // Error
   MobileConnectionReplyError;
   MobileConnectionReplyErrorMmi;
 };
 
 } // namespace mobileconnection
 } // namespace dom
 } // namespace mozilla

--- a/dom/system/gonk/GonkGPSGeolocationProvider.cpp
+++ b/dom/system/gonk/GonkGPSGeolocationProvider.cpp
@@ -27,32 +27,36 @@
 #include "nsIInterfaceRequestorUtils.h"
 #include "nsINetworkManager.h"
 #include "nsIObserverService.h"
 #include "nsJSUtils.h"
 #include "nsPrintfCString.h"
 #include "nsServiceManagerUtils.h"
 #include "nsThreadUtils.h"
 #include "prtime.h"
+#include "mozilla/dom/BindingUtils.h"
+#include "mozilla/dom/ScriptSettings.h"
+#include "mozilla/dom/SettingChangeNotificationBinding.h"
 
 #ifdef MOZ_B2G_RIL
 #include "nsIIccInfo.h"
 #include "nsIMobileConnectionInfo.h"
 #include "nsIMobileConnectionService.h"
 #include "nsIMobileCellInfo.h"
 #include "nsIRadioInterfaceLayer.h"
 #endif
 
 #ifdef AGPS_TYPE_INVALID
 #define AGPS_HAVE_DUAL_APN
 #endif
 
 #define FLUSH_AIDE_DATA 0
 
 using namespace mozilla;
+using namespace mozilla::dom;
 
 static const int kDefaultPeriod = 1000; // ms
 static bool gDebug_isLoggingEnabled = false;
 static bool gDebug_isGPSLocationIgnored = false;
 static const char* kNetworkConnStateChangedTopic = "network-connection-state-changed";
 static const char* kMozSettingsChangedTopic = "mozsettings-changed";
 // Both of these settings can be toggled in the Gaia Developer settings screen.
 static const char* kSettingDebugEnabled = "geolocation.debugging.enabled";
@@ -395,19 +399,31 @@ void
 GonkGPSGeolocationProvider::RequestSettingValue(const char* aKey)
 {
   MOZ_ASSERT(aKey);
   nsCOMPtr<nsISettingsService> ss = do_GetService("@mozilla.org/settingsService;1");
   if (!ss) {
     MOZ_ASSERT(ss);
     return;
   }
+
   nsCOMPtr<nsISettingsServiceLock> lock;
-  ss->CreateLock(nullptr, getter_AddRefs(lock));
-  lock->Get(aKey, this);
+  nsresult rv = ss->CreateLock(nullptr, getter_AddRefs(lock));
+  if (NS_FAILED(rv)) {
+    nsContentUtils::LogMessageToConsole(
+      "geo: error while createLock setting '%s': %d\n", aKey, rv);
+    return;
+  }
+
+  rv = lock->Get(aKey, this);
+  if (NS_FAILED(rv)) {
+    nsContentUtils::LogMessageToConsole(
+      "geo: error while get setting '%s': %d\n", aKey, rv);
+    return;
+  }
 }
 
 #ifdef MOZ_B2G_RIL
 void
 GonkGPSGeolocationProvider::RequestDataConnection()
 {
   MOZ_ASSERT(NS_IsMainThread());
 
@@ -809,32 +825,32 @@ GonkGPSGeolocationProvider::NetworkLocat
   return NS_OK;
 }
 
 NS_IMETHODIMP
 GonkGPSGeolocationProvider::Startup()
 {
   MOZ_ASSERT(NS_IsMainThread());
 
+  if (mStarted) {
+    return NS_OK;
+  }
+
   RequestSettingValue(kSettingDebugEnabled);
   RequestSettingValue(kSettingDebugGpsIgnored);
 
   // Setup an observer to watch changes to the setting.
   nsCOMPtr<nsIObserverService> observerService = services::GetObserverService();
   if (observerService) {
     nsresult rv = observerService->AddObserver(this, kMozSettingsChangedTopic, false);
     if (NS_FAILED(rv)) {
       NS_WARNING("geo: Gonk GPS AddObserver failed");
     }
   }
 
-  if (mStarted) {
-    return NS_OK;
-  }
-
   if (!mInitThread) {
     nsresult rv = NS_NewThread(getter_AddRefs(mInitThread));
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
   mInitThread->Dispatch(NS_NewRunnableMethod(this, &GonkGPSGeolocationProvider::Init),
                         NS_DISPATCH_NORMAL);
 
@@ -863,28 +879,36 @@ GonkGPSGeolocationProvider::Watch(nsIGeo
 NS_IMETHODIMP
 GonkGPSGeolocationProvider::Shutdown()
 {
   MOZ_ASSERT(NS_IsMainThread());
 
   if (!mStarted) {
     return NS_OK;
   }
+
   mStarted = false;
   if (mNetworkLocationProvider) {
     mNetworkLocationProvider->Shutdown();
     mNetworkLocationProvider = nullptr;
   }
 
   nsCOMPtr<nsIObserverService> obs = services::GetObserverService();
   if (obs) {
+    nsresult rv;
 #ifdef MOZ_B2G_RIL
-    obs->RemoveObserver(this, kNetworkConnStateChangedTopic);
+    rv = obs->RemoveObserver(this, kNetworkConnStateChangedTopic);
+    if (NS_FAILED(rv)) {
+      NS_WARNING("geo: Gonk GPS network state RemoveObserver failed");
+    }
 #endif
-    obs->RemoveObserver(this, kMozSettingsChangedTopic);
+    rv = obs->RemoveObserver(this, kMozSettingsChangedTopic);
+    if (NS_FAILED(rv)) {
+      NS_WARNING("geo: Gonk GPS mozsettings RemoveObserver failed");
+    }
   }
 
   mInitThread->Dispatch(NS_NewRunnableMethod(this, &GonkGPSGeolocationProvider::ShutdownGPS),
                         NS_DISPATCH_NORMAL);
 
   return NS_OK;
 }
 
@@ -986,18 +1010,40 @@ GonkGPSGeolocationProvider::Observe(nsIS
       return NS_OK;
     }
 
     RequestSettingValue("ril.supl.apn");
   }
 #endif
 
   if (!strcmp(aTopic, kMozSettingsChangedTopic)) {
-    RequestSettingValue(kSettingDebugEnabled);
-    RequestSettingValue(kSettingDebugGpsIgnored);
+    // Read changed setting value
+    AutoJSAPI jsapi;
+    jsapi.Init();
+    JSContext* cx = jsapi.cx();
+    RootedDictionary<SettingChangeNotification> setting(cx);
+    if (!WrappedJSToDictionary(cx, aSubject, setting)) {
+      return NS_OK;
+    }
+
+    if (setting.mKey.EqualsASCII(kSettingDebugGpsIgnored)) {
+      nsContentUtils::LogMessageToConsole("geo: received mozsettings-changed: ignoring\n");
+      gDebug_isGPSLocationIgnored =
+        setting.mValue.isBoolean() ? setting.mValue.toBoolean() : false;
+      if (gDebug_isLoggingEnabled) {
+        nsContentUtils::LogMessageToConsole("geo: Debug: GPS ignored %d\n",
+                                            gDebug_isGPSLocationIgnored);
+      }
+      return NS_OK;
+    } else if (setting.mKey.EqualsASCII(kSettingDebugEnabled)) {
+      nsContentUtils::LogMessageToConsole("geo: received mozsettings-changed: logging\n");
+      gDebug_isLoggingEnabled =
+        setting.mValue.isBoolean() ? setting.mValue.toBoolean() : false;
+      return NS_OK;
+    }
   }
 
   return NS_OK;
 }
 
 /** nsISettingsServiceCallback **/
 
 NS_IMETHODIMP
@@ -1015,28 +1061,18 @@ GonkGPSGeolocationProvider::Handle(const
       nsAutoJSString apn;
       if (!apn.init(cx, aResult.toString())) {
         return NS_ERROR_FAILURE;
       }
       if (!apn.IsEmpty()) {
         SetAGpsDataConn(apn);
       }
     }
-  } else
+  }
 #endif // MOZ_B2G_RIL
-  if (aName.EqualsASCII(kSettingDebugGpsIgnored)) {
-    gDebug_isGPSLocationIgnored = aResult.isBoolean() ? aResult.toBoolean() : false;
-    if (gDebug_isLoggingEnabled) {
-      nsContentUtils::LogMessageToConsole("geo: Debug: GPS ignored %d\n", gDebug_isGPSLocationIgnored);
-    }
-    return NS_OK;
-  } else if (aName.EqualsASCII(kSettingDebugEnabled)) {
-    gDebug_isLoggingEnabled = aResult.isBoolean() ? aResult.toBoolean() : false;
-    return NS_OK;
-  }
   return NS_OK;
 }
 
 NS_IMETHODIMP
 GonkGPSGeolocationProvider::HandleError(const nsAString& aErrorMessage)
 {
   return NS_OK;
 }

--- a/dom/system/gonk/RILContentHelper.js
+++ b/dom/system/gonk/RILContentHelper.js
@@ -678,18 +678,17 @@ RILContentHelper.prototype = {
         delete this._windowsMap[requestId];
 
         if (data.success) {
           let result = new MobileIccCardLockResult(data);
           this.fireRequestSuccess(requestId, result);
         } else {
           if (data.rilMessageType == "iccSetCardLock" ||
               data.rilMessageType == "iccUnlockCardLock") {
-            let cardLockError = new requestWindow.IccCardLockError(data.lockType,
-                                                                   data.errorMsg,
+            let cardLockError = new requestWindow.IccCardLockError(data.errorMsg,
                                                                    data.retryCount);
             this.fireRequestDetailedError(requestId, cardLockError);
           } else {
             this.fireRequestError(requestId, data.errorMsg);
           }
         }
         break;
       }

--- a/dom/system/gonk/ril_worker.js
+++ b/dom/system/gonk/ril_worker.js
@@ -1328,18 +1328,18 @@ RilObject.prototype = {
 
   /**
    * Set the preferred network type.
    *
    * @param options An object contains a valid value of
    *                RIL_PREFERRED_NETWORK_TYPE_TO_GECKO as its `type` attribute.
    */
   setPreferredNetworkType: function(options) {
-    let networkType = RIL_PREFERRED_NETWORK_TYPE_TO_GECKO.indexOf(options.type);
-    if (networkType < 0) {
+    let networkType = options.type;
+    if (networkType < 0 || networkType >= RIL_PREFERRED_NETWORK_TYPE_TO_GECKO.length) {
       options.errorMsg = GECKO_ERROR_INVALID_PARAMETER;
       this.sendChromeMessage(options);
       return;
     }
 
     let Buf = this.context.Buf;
     Buf.newParcel(REQUEST_SET_PREFERRED_NETWORK_TYPE, options);
     Buf.writeInt32(1);
@@ -5869,16 +5869,22 @@ RilObject.prototype[REQUEST_SET_CALL_FOR
   }
   this.sendChromeMessage(options);
 };
 RilObject.prototype[REQUEST_QUERY_CALL_WAITING] =
   function REQUEST_QUERY_CALL_WAITING(length, options) {
   options.success = (options.rilRequestError === 0);
   if (!options.success) {
     options.errorMsg = RIL_ERROR_TO_GECKO_ERROR[options.rilRequestError];
+
+    if (options.callback) {
+      // Prevent DataCloneError when sending chrome messages.
+      delete options.callback;
+    }
+
     this.sendChromeMessage(options);
     return;
   }
 
   if (options.callback) {
     options.callback.call(this, options);
     return;
   }
@@ -5889,16 +5895,22 @@ RilObject.prototype[REQUEST_QUERY_CALL_W
                      ((Buf.readInt32() & ICC_SERVICE_CLASS_VOICE) == 0x01));
   this.sendChromeMessage(options);
 };
 
 RilObject.prototype[REQUEST_SET_CALL_WAITING] = function REQUEST_SET_CALL_WAITING(length, options) {
   options.success = (options.rilRequestError === 0);
   if (!options.success) {
     options.errorMsg = RIL_ERROR_TO_GECKO_ERROR[options.rilRequestError];
+
+    if (options.callback) {
+      // Prevent DataCloneError when sending chrome messages.
+      delete options.callback;
+    }
+
     this.sendChromeMessage(options);
     return;
   }
 
   if (options.callback) {
     options.callback.call(this, options);
     return;
   }
@@ -6287,18 +6299,17 @@ RilObject.prototype[REQUEST_SET_PREFERRE
 };
 RilObject.prototype[REQUEST_GET_PREFERRED_NETWORK_TYPE] = function REQUEST_GET_PREFERRED_NETWORK_TYPE(length, options) {
   if (options.rilRequestError) {
     options.errorMsg = RIL_ERROR_TO_GECKO_ERROR[options.rilRequestError];
     this.sendChromeMessage(options);
     return;
   }
 
-  let networkType = this.context.Buf.readInt32List()[0];
-  options.type = RIL_PREFERRED_NETWORK_TYPE_TO_GECKO[networkType];
+  options.type = this.context.Buf.readInt32List()[0];
   this.sendChromeMessage(options);
 };
 RilObject.prototype[REQUEST_GET_NEIGHBORING_CELL_IDS] = function REQUEST_GET_NEIGHBORING_CELL_IDS(length, options) {
   if (options.rilRequestError) {
     options.errorMsg = RIL_ERROR_TO_GECKO_ERROR[options.rilRequestError];
     this.sendChromeMessage(options);
     return;
   }
@@ -8514,17 +8525,17 @@ GsmPDUHelperObject.prototype = {
       }
     };
 
     msg.body = null;
     msg.data = null;
     switch (msg.encoding) {
       case PDU_DCS_MSG_CODING_7BITS_ALPHABET:
         msg.body = this.readSeptetsToString.call(bufAdapter,
-                                                 (length * 8 / 7), 0,
+                                                 Math.floor(length * 8 / 7), 0,
                                                  PDU_NL_IDENTIFIER_DEFAULT,
                                                  PDU_NL_IDENTIFIER_DEFAULT);
         if (msg.hasLanguageIndicator) {
           msg.language = msg.body.substring(0, 2);
           msg.body = msg.body.substring(3);
         }
         break;
 
@@ -8611,17 +8622,17 @@ GsmPDUHelperObject.prototype = {
     Buf.seekIncoming(-numOfPages * (CB_MSG_PAGE_INFO_SIZE + 1));
 
     switch (msg.encoding) {
       case PDU_DCS_MSG_CODING_7BITS_ALPHABET: {
         let body;
         msg.body = "";
         for (let i = 0; i < numOfPages; i++) {
           body = this.readSeptetsToString.call(bufAdapter,
-                                               (pageLengths[i] * 8 / 7),
+                                               Math.floor(pageLengths[i] * 8 / 7),
                                                0,
                                                PDU_NL_IDENTIFIER_DEFAULT,
                                                PDU_NL_IDENTIFIER_DEFAULT);
           if (msg.hasLanguageIndicator) {
             if (!msg.language) {
               msg.language = body.substring(0, 2);
             }
             body = body.substring(3);
@@ -8841,17 +8852,17 @@ GsmPDUHelperObject.prototype = {
     let shouldIncludeCountryInitials = !!(codingInfo & 0x08);
     let spareBits = codingInfo & 0x07;
     let resultString;
 
     switch (textEncoding) {
     case 0:
       // GSM Default alphabet.
       resultString = this.readSeptetsToString(
-        ((len - 1) * 8 - spareBits) / 7, 0,
+        Math.floor(((len - 1) * 8 - spareBits) / 7), 0,
         PDU_NL_IDENTIFIER_DEFAULT,
         PDU_NL_IDENTIFIER_DEFAULT);
       break;
     case 1:
       // UCS2 encoded.
       resultString = this.readUCS2String(len - 1);
       break;
     default:
@@ -11256,17 +11267,18 @@ StkProactiveCmdHelperObject.prototype = 
     let GsmPDUHelper = this.context.GsmPDUHelper;
     let text = {
       codingScheme: GsmPDUHelper.readHexOctet()
     };
 
     length--; // -1 for the codingScheme.
     switch (text.codingScheme & 0x0c) {
       case STK_TEXT_CODING_GSM_7BIT_PACKED:
-        text.textString = GsmPDUHelper.readSeptetsToString(length * 8 / 7, 0, 0, 0);
+        text.textString =
+          GsmPDUHelper.readSeptetsToString(Math.floor(length * 8 / 7), 0, 0, 0);
         break;
       case STK_TEXT_CODING_GSM_8BIT:
         text.textString =
           this.context.ICCPDUHelper.read8BitUnpackedToString(length);
         break;
       case STK_TEXT_CODING_UCS2:
         text.textString = GsmPDUHelper.readUCS2String(length);
         break;

--- a/dom/tv/FakeTVService.cpp
+++ b/dom/tv/FakeTVService.cpp
@@ -1,28 +1,122 @@
 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "mozilla/dom/TVServiceRunnables.h"
+#include "mozilla/dom/TVTypes.h"
 #include "nsCOMPtr.h"
 #include "nsIMutableArray.h"
+#include "nsITimer.h"
 #include "nsServiceManagerUtils.h"
+#include "prtime.h"
 #include "FakeTVService.h"
 
 namespace mozilla {
 namespace dom {
 
-NS_IMPL_ISUPPORTS(FakeTVService, nsITVService)
+NS_IMPL_CYCLE_COLLECTION_CLASS(FakeTVService)
+
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(FakeTVService)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mSourceListener)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mTuners)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mChannels)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mPrograms)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mEITBroadcastedTimer)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mScanCompleteTimer)
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(FakeTVService)
+  tmp->Shutdown();
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mSourceListener)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mTuners)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mChannels)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mPrograms)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mEITBroadcastedTimer)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mScanCompleteTimer)
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+
+NS_IMPL_CYCLE_COLLECTING_ADDREF(FakeTVService)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(FakeTVService)
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(FakeTVService)
+  NS_INTERFACE_MAP_ENTRY(nsITVService)
+  NS_INTERFACE_MAP_ENTRY(nsISupports)
+NS_INTERFACE_MAP_END
+
+FakeTVService::FakeTVService()
+{
+  Init();
+}
+
+FakeTVService::~FakeTVService()
+{
+  Shutdown();
+}
+
+void
+FakeTVService::Init()
+{
+  const char* sourceTypes1[2] = {"dvb-t", "dvb-c"};
+  nsCOMPtr<nsITVTunerData> tunerData1 = MockTuner(NS_LITERAL_STRING("1"), 2, sourceTypes1);
+  mTuners.AppendElement(tunerData1);
+  const char* sourceTypes2[1] = {"dvb-s"};
+  nsCOMPtr<nsITVTunerData> tunerData2 = MockTuner(NS_LITERAL_STRING("2"), 1, sourceTypes2);
+  mTuners.AppendElement(tunerData2);
+
+  nsCOMPtr<nsITVChannelData> channelData1 =
+    MockChannel(NS_LITERAL_STRING("networkId1"), NS_LITERAL_STRING("transportStreamId1"),
+                NS_LITERAL_STRING("serviceId1"), NS_LITERAL_STRING("tv"),
+                NS_LITERAL_STRING("1"), NS_LITERAL_STRING("name1"), true, true);
+  mChannels.AppendElement(channelData1);
+  nsCOMPtr<nsITVChannelData> channelData2 =
+    MockChannel(NS_LITERAL_STRING("networkId2"), NS_LITERAL_STRING("transportStreamId2"),
+                NS_LITERAL_STRING("serviceId2"), NS_LITERAL_STRING("radio"),
+                NS_LITERAL_STRING("2"), NS_LITERAL_STRING("name2"), true, true);
+  mChannels.AppendElement(channelData2);
+
+  uint64_t now = PR_Now();
+  const char* audioLanguages1[2] = {"eng", "jpn"};
+  const char* subtitleLanguages1[2] = {"fre", "spa"};
+  nsCOMPtr<nsITVProgramData> programData1 =
+    MockProgram(NS_LITERAL_STRING("eventId1"), NS_LITERAL_STRING("title1"),
+                now - 1, 3600000,
+                NS_LITERAL_STRING("description1"), NS_LITERAL_STRING("rating1"),
+                2, audioLanguages1, 2, subtitleLanguages1);
+  mPrograms.AppendElement(programData1);
+  nsCOMPtr<nsITVProgramData> programData2 =
+      MockProgram(NS_LITERAL_STRING("eventId2"), NS_LITERAL_STRING("title2"),
+                  now + 3600000 , 3600000,
+                  NS_LITERAL_STRING(""), NS_LITERAL_STRING(""),
+                  0, nullptr, 0, nullptr);
+  mPrograms.AppendElement(programData2);
+}
+
+void
+FakeTVService::Shutdown()
+{
+  if (mEITBroadcastedTimer) {
+    mEITBroadcastedTimer->Cancel();
+  }
+  if (mScanCompleteTimer) {
+    mScanCompleteTimer->Cancel();
+  }
+}
 
 /* virtual */ NS_IMETHODIMP
 FakeTVService::GetSourceListener(nsITVSourceListener** aSourceListener)
 {
+  if (!mSourceListener) {
+    *aSourceListener = nullptr;
+    return NS_OK;
+  }
+
   *aSourceListener = mSourceListener;
   NS_ADDREF(*aSourceListener);
   return NS_OK;
 }
 
 /* virtual */ NS_IMETHODIMP
 FakeTVService::SetSourceListener(nsITVSourceListener* aSourceListener)
 {
@@ -37,76 +131,210 @@ FakeTVService::GetTuners(nsITVServiceCal
     return NS_ERROR_INVALID_ARG;
   }
 
   nsCOMPtr<nsIMutableArray> tunerDataList = do_CreateInstance(NS_ARRAY_CONTRACTID);
   if (!tunerDataList) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
-  // TODO Implement in follow-up patches.
+  for (uint32_t i = 0; i < mTuners.Length(); i++) {
+    tunerDataList->AppendElement(mTuners[i], false);
+  }
 
   nsCOMPtr<nsIRunnable> runnable =
     new TVServiceNotifyRunnable(aCallback, tunerDataList);
   return NS_DispatchToCurrentThread(runnable);
 }
 
 /* virtual */ NS_IMETHODIMP
 FakeTVService::SetSource(const nsAString& aTunerId,
                          const nsAString& aSourceType,
                          nsITVServiceCallback* aCallback)
 {
   if (!aCallback) {
     return NS_ERROR_INVALID_ARG;
   }
 
-  // TODO Implement in follow-up patches.
+  for (uint32_t i = 0; i < mTuners.Length(); i++) {
+    nsString tunerId;
+    mTuners[i]->GetId(tunerId);
+    if (aTunerId.Equals(tunerId)) {
+      uint32_t sourceTypeCount;
+      char** sourceTypes;
+      mTuners[i]->GetSupportedSourceTypes(&sourceTypeCount, &sourceTypes);
+      for (uint32_t j = 0; j < sourceTypeCount; j++) {
+        nsString sourceType;
+        sourceType.AssignASCII(sourceTypes[j]);
+        if (aSourceType.Equals(sourceType)) {
+          NS_FREE_XPCOM_ALLOCATED_POINTER_ARRAY(sourceTypeCount, sourceTypes);
+          nsCOMPtr<nsIRunnable> runnable =
+            new TVServiceNotifyRunnable(aCallback, nullptr);
+          return NS_DispatchToCurrentThread(runnable);
+        }
+      }
+      NS_FREE_XPCOM_ALLOCATED_POINTER_ARRAY(sourceTypeCount, sourceTypes);
+    }
+  }
 
   nsCOMPtr<nsIRunnable> runnable =
-    new TVServiceNotifyRunnable(aCallback, nullptr);
+    new TVServiceNotifyRunnable(aCallback, nullptr, nsITVServiceCallback::TV_ERROR_FAILURE);
   return NS_DispatchToCurrentThread(runnable);
 }
 
+class EITBroadcastedCallback : public nsITimerCallback
+{
+public:
+  NS_DECL_ISUPPORTS
+
+  EITBroadcastedCallback(const nsAString& aTunerId,
+                         const nsAString& aSourceType,
+                         nsITVSourceListener* aSourceListener,
+                         nsITVChannelData* aChannelData)
+    : mTunerId(aTunerId)
+    , mSourceType(aSourceType)
+    , mSourceListener(aSourceListener)
+    , mChannelData(aChannelData)
+  {}
+
+  NS_IMETHODIMP
+  Notify(nsITimer* aTimer)
+  {
+    // Notify mock EIT broadcasting.
+    nsITVProgramData** programDataList =
+      static_cast<nsITVProgramData **>(NS_Alloc(1 * sizeof(nsITVProgramData*)));
+    programDataList[0] = new TVProgramData();
+    programDataList[0]->SetEventId(NS_LITERAL_STRING("eventId"));
+    programDataList[0]->SetTitle(NS_LITERAL_STRING("title"));
+    programDataList[0]->SetStartTime(PR_Now() + 3600000);
+    programDataList[0]->SetDuration(3600000);
+    programDataList[0]->SetDescription(NS_LITERAL_STRING("description"));
+    programDataList[0]->SetRating(NS_LITERAL_STRING("rating"));
+    programDataList[0]->SetAudioLanguages(0, nullptr);
+    programDataList[0]->SetSubtitleLanguages(0, nullptr);
+    nsresult rv = mSourceListener->NotifyEITBroadcasted(mTunerId, mSourceType,
+                                                        mChannelData,
+                                                        programDataList, 1);
+    NS_FREE_XPCOM_ALLOCATED_POINTER_ARRAY(1, programDataList);
+    return rv;
+  }
+
+private:
+  ~EITBroadcastedCallback() {}
+
+  nsString mTunerId;
+  nsString mSourceType;
+  nsCOMPtr<nsITVSourceListener> mSourceListener;
+  nsCOMPtr<nsITVChannelData> mChannelData;
+};
+
+NS_IMPL_ISUPPORTS(EITBroadcastedCallback, nsITimerCallback)
+
+class ScanCompleteCallback : public nsITimerCallback
+{
+public:
+  NS_DECL_ISUPPORTS
+
+  ScanCompleteCallback(const nsAString& aTunerId,
+                       const nsAString& aSourceType,
+                       nsITVSourceListener* aSourceListener)
+    : mTunerId(aTunerId)
+    , mSourceType(aSourceType)
+    , mSourceListener(aSourceListener)
+  {}
+
+  NS_IMETHODIMP
+  Notify(nsITimer* aTimer)
+  {
+    return mSourceListener->NotifyChannelScanComplete(mTunerId, mSourceType);
+  }
+
+private:
+  ~ScanCompleteCallback() {}
+
+  nsString mTunerId;
+  nsString mSourceType;
+  nsCOMPtr<nsITVSourceListener> mSourceListener;
+};
+
+NS_IMPL_ISUPPORTS(ScanCompleteCallback, nsITimerCallback)
+
 /* virtual */ NS_IMETHODIMP
 FakeTVService::StartScanningChannels(const nsAString& aTunerId,
                                      const nsAString& aSourceType,
                                      nsITVServiceCallback* aCallback)
 {
   if (!aCallback) {
     return NS_ERROR_INVALID_ARG;
   }
 
-  // TODO Implement in follow-up patches.
-
   nsCOMPtr<nsIRunnable> runnable =
     new TVServiceNotifyRunnable(aCallback, nullptr);
-  return NS_DispatchToCurrentThread(runnable);
+  nsresult rv = NS_DispatchToCurrentThread(runnable);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (IsAllowed(aTunerId, aSourceType)) {
+    rv = mSourceListener->NotifyChannelScanned(aTunerId, aSourceType, mChannels[0]);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    // Set a timer. |notifyEITBroadcasted| will be called after the timer
+    // fires (10ms). (The timer could be canceled if |StopScanningChannels| gets
+    // called before firing.)
+    mEITBroadcastedTimer = do_CreateInstance(NS_TIMER_CONTRACTID);
+    NS_ENSURE_TRUE(mEITBroadcastedTimer, NS_ERROR_OUT_OF_MEMORY);
+    nsRefPtr<EITBroadcastedCallback> eitBroadcastedCb =
+      new EITBroadcastedCallback(aTunerId, aSourceType, mSourceListener, mChannels[0]);
+    rv = mEITBroadcastedTimer->InitWithCallback(eitBroadcastedCb, 10,
+                                                nsITimer::TYPE_ONE_SHOT);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    // Set a timer. |notifyChannelScanComplete| will be called after the timer
+    // fires (20ms). (The timer could be canceled if |StopScanningChannels| gets
+    // called before firing.)
+    mScanCompleteTimer = do_CreateInstance(NS_TIMER_CONTRACTID);
+    NS_ENSURE_TRUE(mScanCompleteTimer, NS_ERROR_OUT_OF_MEMORY);
+    nsRefPtr<ScanCompleteCallback> scanCompleteCb =
+      new ScanCompleteCallback(aTunerId, aSourceType, mSourceListener);
+    rv = mScanCompleteTimer->InitWithCallback(scanCompleteCb, 20,
+                                              nsITimer::TYPE_ONE_SHOT);
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
+
+  return NS_OK;
 }
 
 /* virtual */ NS_IMETHODIMP
 FakeTVService::StopScanningChannels(const nsAString& aTunerId,
                                     const nsAString& aSourceType,
                                     nsITVServiceCallback* aCallback)
 {
   if (!aCallback) {
     return NS_ERROR_INVALID_ARG;
   }
 
-  // TODO Implement in follow-up patches.
+  if (mEITBroadcastedTimer) {
+    mEITBroadcastedTimer->Cancel();
+    mEITBroadcastedTimer = nullptr;
+  }
+  if (mScanCompleteTimer) {
+    mScanCompleteTimer->Cancel();
+    mScanCompleteTimer = nullptr;
+  }
+  nsresult rv = mSourceListener->NotifyChannelScanStopped(aTunerId, aSourceType);
+  NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsIRunnable> runnable =
     new TVServiceNotifyRunnable(aCallback, nullptr);
   return NS_DispatchToCurrentThread(runnable);
 }
 
 /* virtual */ NS_IMETHODIMP
 FakeTVService::ClearScannedChannelsCache()
 {
-  // TODO Implement in follow-up patches.
-
+  // Fake service doesn't support channel cache, so there's nothing to do here.
   return NS_OK;
 }
 
 /* virtual */ NS_IMETHODIMP
 FakeTVService::SetChannel(const nsAString& aTunerId,
                           const nsAString& aSourceType,
                           const nsAString& aChannelNumber,
                           nsITVServiceCallback* aCallback)
@@ -115,20 +343,36 @@ FakeTVService::SetChannel(const nsAStrin
     return NS_ERROR_INVALID_ARG;
   }
 
   nsCOMPtr<nsIMutableArray> channelDataList = do_CreateInstance(NS_ARRAY_CONTRACTID);
   if (!channelDataList) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
-  // TODO Implement in follow-up patches.
+  if (IsAllowed(aTunerId, aSourceType)) {
+    for (uint32_t i = 0; i < mChannels.Length(); i++) {
+      nsString channelNumber;
+      mChannels[i]->GetNumber(channelNumber);
+      if (aChannelNumber.Equals(channelNumber)) {
+        channelDataList->AppendElement(mChannels[i], false);
+        break;
+      }
+    }
+  }
 
-  nsCOMPtr<nsIRunnable> runnable =
-    new TVServiceNotifyRunnable(aCallback, channelDataList);
+  uint32_t length;
+  nsresult rv = channelDataList->GetLength(&length);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIRunnable> runnable = new TVServiceNotifyRunnable(
+    aCallback,
+    (length == 1) ? channelDataList : nullptr,
+    (length == 1) ? nsITVServiceCallback::TV_ERROR_OK : nsITVServiceCallback::TV_ERROR_FAILURE
+  );
   return NS_DispatchToCurrentThread(runnable);
 }
 
 /* virtual */ NS_IMETHODIMP
 FakeTVService::GetChannels(const nsAString& aTunerId,
                            const nsAString& aSourceType,
                            nsITVServiceCallback* aCallback)
 {
@@ -136,17 +380,21 @@ FakeTVService::GetChannels(const nsAStri
     return NS_ERROR_INVALID_ARG;
   }
 
   nsCOMPtr<nsIMutableArray> channelDataList = do_CreateInstance(NS_ARRAY_CONTRACTID);
   if (!channelDataList) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
-  // TODO Implement in follow-up patches.
+  if (IsAllowed(aTunerId, aSourceType)) {
+    for (uint32_t i = 0; i < mChannels.Length(); i++) {
+      channelDataList->AppendElement(mChannels[i], false);
+    }
+  }
 
   nsCOMPtr<nsIRunnable> runnable =
     new TVServiceNotifyRunnable(aCallback, channelDataList);
   return NS_DispatchToCurrentThread(runnable);
 }
 
 /* virtual */ NS_IMETHODIMP
 FakeTVService::GetPrograms(const nsAString& aTunerId,
@@ -160,17 +408,24 @@ FakeTVService::GetPrograms(const nsAStri
     return NS_ERROR_INVALID_ARG;
   }
 
   nsCOMPtr<nsIMutableArray> programDataList = do_CreateInstance(NS_ARRAY_CONTRACTID);
   if (!programDataList) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
-  // TODO Implement in follow-up patches.
+  // Only return mock programs for the first channel.
+  nsString channelNumber;
+  mChannels[0]->GetNumber(channelNumber);
+  if (IsAllowed(aTunerId, aSourceType) && aChannelNumber.Equals(channelNumber)) {
+    for (uint32_t i = 0; i < mPrograms.Length(); i++) {
+      programDataList->AppendElement(mPrograms[i], false);
+    }
+  }
 
   nsCOMPtr<nsIRunnable> runnable =
     new TVServiceNotifyRunnable(aCallback, programDataList);
   return NS_DispatchToCurrentThread(runnable);
 }
 
 /* virtual */ NS_IMETHODIMP
 FakeTVService::GetOverlayId(const nsAString& aTunerId,
@@ -187,10 +442,91 @@ FakeTVService::GetOverlayId(const nsAStr
 
   // TODO Implement in follow-up patches.
 
   nsCOMPtr<nsIRunnable> runnable =
     new TVServiceNotifyRunnable(aCallback, overlayIds);
   return NS_DispatchToCurrentThread(runnable);
 }
 
+bool
+FakeTVService::IsAllowed(const nsAString& aTunerId,
+                         const nsAString& aSourceType)
+{
+  // Only allow for the first source of the first tuner.
+  nsString tunerId;
+  mTuners[0]->GetId(tunerId);
+  if (!aTunerId.Equals(tunerId)) {
+    return false;
+  }
+
+  uint32_t sourceTypeCount;
+  char** sourceTypes;
+  mTuners[0]->GetSupportedSourceTypes(&sourceTypeCount, &sourceTypes);
+  nsString sourceType;
+  sourceType.AssignASCII(sourceTypes[0]);
+  NS_FREE_XPCOM_ALLOCATED_POINTER_ARRAY(sourceTypeCount, sourceTypes);
+  if (!aSourceType.Equals(sourceType)) {
+    return false;
+  }
+
+  return true;
+}
+
+already_AddRefed<nsITVTunerData>
+FakeTVService::MockTuner(const nsAString& aId,
+                         uint32_t aSupportedSourceTypeCount,
+                         const char** aSupportedSourceTypes)
+{
+  nsCOMPtr<nsITVTunerData> tunerData = new TVTunerData();
+  tunerData->SetId(aId);
+  tunerData->SetSupportedSourceTypes(aSupportedSourceTypeCount, aSupportedSourceTypes);
+  return tunerData.forget();
+}
+
+already_AddRefed<nsITVChannelData>
+FakeTVService::MockChannel(const nsAString& aNetworkId,
+                           const nsAString& aTransportStreamId,
+                           const nsAString& aServiceId,
+                           const nsAString& aType,
+                           const nsAString& aNumber,
+                           const nsAString& aName,
+                           bool aIsEmergency,
+                           bool aIsFree)
+{
+  nsCOMPtr<nsITVChannelData> channelData = new TVChannelData();
+  channelData->SetNetworkId(aNetworkId);
+  channelData->SetTransportStreamId(aTransportStreamId);
+  channelData->SetServiceId(aServiceId);
+  channelData->SetType(aType);
+  channelData->SetNumber(aNumber);
+  channelData->SetName(aName);
+  channelData->SetIsEmergency(aIsEmergency);
+  channelData->SetIsFree(aIsFree);
+  return channelData.forget();
+}
+
+already_AddRefed<nsITVProgramData>
+FakeTVService::MockProgram(const nsAString& aEventId,
+                           const nsAString& aTitle,
+                           uint64_t aStartTime,
+                           uint64_t aDuration,
+                           const nsAString& aDescription,
+                           const nsAString& aRating,
+                           uint32_t aAudioLanguageCount,
+                           const char** aAudioLanguages,
+                           uint32_t aSubtitleLanguageCount,
+                           const char** aSubtitleLanguages)
+{
+  nsCOMPtr<nsITVProgramData> programData = new TVProgramData();
+  programData->SetEventId(aEventId);
+  programData->SetTitle(aTitle);
+  programData->SetStartTime(aStartTime);
+  programData->SetDuration(aDuration);
+  programData->SetDescription(aDescription);
+  programData->SetRating(aRating);
+  programData->SetAudioLanguages(aAudioLanguageCount, aAudioLanguages);
+  programData->SetSubtitleLanguages(aSubtitleLanguageCount, aSubtitleLanguages);
+  return programData.forget();
+}
+
 } // namespace dom
 } // namespace mozilla

--- a/dom/tv/FakeTVService.h
+++ b/dom/tv/FakeTVService.h
@@ -3,38 +3,82 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef mozilla_dom_FakeTVService_h
 #define mozilla_dom_FakeTVService_h
 
 #include "nsCOMPtr.h"
+#include "nsCycleCollectionParticipant.h"
 #include "nsITVService.h"
+#include "nsTArray.h"
 
 #define FAKE_TV_SERVICE_CONTRACTID \
   "@mozilla.org/tv/faketvservice;1"
 #define FAKE_TV_SERVICE_CID \
   { 0x60fb3c53, 0x017f, 0x4340, { 0x91, 0x1b, 0xd5, 0x5c, 0x31, 0x28, 0x88, 0xb6 } }
 
+class nsITimer;
+class nsITVTunerData;
+class nsITVChannelData;
+class nsITVProgramData;
+
 namespace mozilla {
 namespace dom {
 
 class FakeTVService MOZ_FINAL : public nsITVService
 {
 public:
-  NS_DECL_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTION_CLASS(FakeTVService)
   NS_DECL_NSITVSERVICE
 
-  FakeTVService() {}
-
-  // TODO More members might be added in follow-up patches to help testing.
+  FakeTVService();
 
 private:
-  ~FakeTVService() {}
+  ~FakeTVService();
+
+  void Init();
+
+  void Shutdown();
+
+  bool IsAllowed(const nsAString& aTunerId,
+                 const nsAString& aSourceType);
+
+  already_AddRefed<nsITVTunerData> MockTuner(const nsAString& aId,
+                                             uint32_t aSupportedSourceTypeCount,
+                                             const char** aSupportedSourceTypes);
+
+  already_AddRefed<nsITVChannelData> MockChannel(const nsAString& aNetworkId,
+                                                 const nsAString& aTransportStreamId,
+                                                 const nsAString& aServiceId,
+                                                 const nsAString& aType,
+                                                 const nsAString& aNumber,
+                                                 const nsAString& aName,
+                                                 bool aIsEmergency,
+                                                 bool aIsFree);
+
+  already_AddRefed<nsITVProgramData> MockProgram(const nsAString& aEventId,
+                                                 const nsAString& aTitle,
+                                                 uint64_t aStartTime,
+                                                 uint64_t aDuration,
+                                                 const nsAString& aDescription,
+                                                 const nsAString& aRating,
+                                                 uint32_t aAudioLanguageCount,
+                                                 const char** aAudioLanguages,
+                                                 uint32_t aSubtitleLanguageCount,
+                                                 const char** aSubtitleLanguages);
 
   nsCOMPtr<nsITVSourceListener> mSourceListener;
+
+  // The real implementation may want to use more efficient data structures.
+  nsTArray<nsCOMPtr<nsITVTunerData>> mTuners;
+  nsTArray<nsCOMPtr<nsITVChannelData>> mChannels;
+  nsTArray<nsCOMPtr<nsITVProgramData>> mPrograms;
+  nsCOMPtr<nsITimer> mEITBroadcastedTimer;
+  nsCOMPtr<nsITimer> mScanCompleteTimer;
 };
 
 } // namespace dom
 } // namespace mozilla
 
 #endif // mozilla_dom_FakeTVService_h

--- a/dom/tv/TVListeners.cpp
+++ b/dom/tv/TVListeners.cpp
@@ -7,49 +7,40 @@
 #include "mozilla/dom/TVSource.h"
 #include "mozilla/dom/TVTuner.h"
 #include "mozilla/dom/TVUtils.h"
 #include "TVListeners.h"
 
 namespace mozilla {
 namespace dom {
 
-NS_IMPL_ISUPPORTS(TVSourceListener, nsITVSourceListener)
+NS_IMPL_CYCLE_COLLECTION(TVSourceListener, mSources)
+
+NS_IMPL_CYCLE_COLLECTING_ADDREF(TVSourceListener)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(TVSourceListener)
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(TVSourceListener)
+  NS_INTERFACE_MAP_ENTRY(nsITVSourceListener)
+  NS_INTERFACE_MAP_ENTRY(nsISupports)
+NS_INTERFACE_MAP_END
 
 void
 TVSourceListener::RegisterSource(TVSource* aSource)
 {
-  nsString tunerId;
-  nsRefPtr<TVTuner> tuner = aSource->Tuner();
-  tuner->GetId(tunerId);
-
-  nsRefPtrHashtable<nsStringHashKey, TVSource>* tunerSources = nullptr;
-  if (!mSources.Get(tunerId, &tunerSources)) {
-    tunerSources = new nsRefPtrHashtable<nsStringHashKey, TVSource>();
-    mSources.Put(tunerId, tunerSources);
-  }
-
-  nsString sourceType = ToTVSourceTypeStr(aSource->Type());
-  tunerSources->Put(sourceType, aSource);
+  mSources.AppendElement(aSource);
 }
 
 void
 TVSourceListener::UnregisterSource(TVSource* aSource)
 {
-  nsString tunerId;
-  nsRefPtr<TVTuner> tuner = aSource->Tuner();
-  tuner->GetId(tunerId);
-
-  nsRefPtrHashtable<nsStringHashKey, TVSource>* tunerSources = nullptr;
-  if (!mSources.Get(tunerId, &tunerSources)) {
-    return;
+  for (uint32_t i = 0; i < mSources.Length(); i++) {
+    if (mSources[i] == aSource) {
+      mSources.RemoveElementsAt(i, 1);
+    }
   }
-
-  nsString sourceType = ToTVSourceTypeStr(aSource->Type());
-  tunerSources->Remove(sourceType);
 }
 
 /* virtual */ NS_IMETHODIMP
 TVSourceListener::NotifyChannelScanned(const nsAString& aTunerId,
                                        const nsAString& aSourceType,
                                        nsITVChannelData* aChannelData)
 {
   nsRefPtr<TVSource> source = GetSource(aTunerId, aSourceType);
@@ -86,20 +77,26 @@ TVSourceListener::NotifyEITBroadcasted(c
   source->NotifyEITBroadcasted(aChannelData, aProgramDataList, aCount);
   return NS_OK;
 }
 
 already_AddRefed<TVSource>
 TVSourceListener::GetSource(const nsAString& aTunerId,
                             const nsAString& aSourceType)
 {
-  nsRefPtrHashtable<nsStringHashKey, TVSource>* tunerSources = nullptr;
-  if (!mSources.Get(aTunerId, &tunerSources)) {
-    return nullptr;
+  for (uint32_t i = 0; i < mSources.Length(); i++) {
+    nsString tunerId;
+    nsRefPtr<TVTuner> tuner = mSources[i]->Tuner();
+    tuner->GetId(tunerId);
+
+    nsString sourceType = ToTVSourceTypeStr(mSources[i]->Type());
+
+    if (aTunerId.Equals(tunerId) && aSourceType.Equals(sourceType)) {
+      nsRefPtr<TVSource> source = mSources[i];
+      return source.forget();
+    }
   }
 
-  nsRefPtr<TVSource> source;
-  tunerSources->Get(aSourceType, getter_AddRefs(source));
-  return source.forget();
+  return nullptr;
 }
 
 } // namespace dom
 } // namespace mozilla

--- a/dom/tv/TVListeners.h
+++ b/dom/tv/TVListeners.h
@@ -2,42 +2,40 @@
 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef mozilla_dom_TVListeners_h
 #define mozilla_dom_TVListeners_h
 
-#include "nsClassHashtable.h"
+#include "mozilla/dom/TVSource.h"
+#include "nsCycleCollectionParticipant.h"
 #include "nsITVService.h"
-#include "nsRefPtrHashtable.h"
+#include "nsTArray.h"
 
 namespace mozilla {
 namespace dom {
 
-class TVSource;
-
 class TVSourceListener : public nsITVSourceListener
 {
 public:
-  NS_DECL_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTION_CLASS(TVSourceListener)
   NS_DECL_NSITVSOURCELISTENER
 
   void RegisterSource(TVSource* aSource);
 
   void UnregisterSource(TVSource* aSource);
 
 private:
   ~TVSourceListener() {}
 
   already_AddRefed<TVSource> GetSource(const nsAString& aTunerId,
                                        const nsAString& aSourceType);
 
-  // The tuner ID acts as the key of the outer table; whereas the source type is
-  // the key for the inner one.
-  nsClassHashtable<nsStringHashKey, nsRefPtrHashtable<nsStringHashKey, TVSource>> mSources;
+  nsTArray<nsRefPtr<TVSource>> mSources;
 };
 
 } // namespace dom
 } // namespace mozilla
 
 #endif // mozilla_dom_TVListeners_h

--- a/dom/tv/TVTypes.cpp
+++ b/dom/tv/TVTypes.cpp
@@ -12,16 +12,22 @@ namespace mozilla {
 namespace dom {
 
 /*
  * Implementation of TVTunerData
  */
 
 NS_IMPL_ISUPPORTS(TVTunerData, nsITVTunerData)
 
+TVTunerData::TVTunerData()
+  : mSupportedSourceTypes(nullptr)
+  , mCount(0)
+{
+}
+
 TVTunerData::~TVTunerData()
 {
   if (mSupportedSourceTypes) {
     NS_FREE_XPCOM_ALLOCATED_POINTER_ARRAY(mCount, mSupportedSourceTypes);
   }
 }
 
 /* virtual */ NS_IMETHODIMP
@@ -92,16 +98,26 @@ TVTunerData::SetSupportedSourceTypes(uin
 
 
 /*
  * Implementation of TVChannelData
  */
 
 NS_IMPL_ISUPPORTS(TVChannelData, nsITVChannelData)
 
+TVChannelData::TVChannelData()
+  : mIsEmergency(false)
+  , mIsFree(false)
+{
+}
+
+TVChannelData::~TVChannelData()
+{
+}
+
 /* virtual */ NS_IMETHODIMP
 TVChannelData::GetNetworkId(nsAString& aNetworkId)
 {
   aNetworkId = mNetworkId;
   return NS_OK;
 }
 
 /* virtual */ NS_IMETHODIMP
@@ -239,16 +255,24 @@ TVChannelData::SetIsFree(bool aIsFree)
 
 
 /*
  * Implementation of TVProgramData
  */
 
 NS_IMPL_ISUPPORTS(TVProgramData, nsITVProgramData)
 
+TVProgramData::TVProgramData()
+  : mAudioLanguages(nullptr)
+  , mAudioLanguageCount(0)
+  , mSubtitleLanguages(nullptr)
+  , mSubtitleLanguageCount(0)
+{
+}
+
 TVProgramData::~TVProgramData()
 {
   if (mAudioLanguages) {
     NS_FREE_XPCOM_ALLOCATED_POINTER_ARRAY(mAudioLanguageCount, mAudioLanguages);
   }
   if (mSubtitleLanguages) {
     NS_FREE_XPCOM_ALLOCATED_POINTER_ARRAY(mSubtitleLanguageCount, mSubtitleLanguages);
   }

--- a/dom/tv/TVTypes.h
+++ b/dom/tv/TVTypes.h
@@ -13,32 +13,36 @@ namespace mozilla {
 namespace dom {
 
 class TVTunerData MOZ_FINAL : public nsITVTunerData
 {
 public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSITVTUNERDATA
 
+  TVTunerData();
+
 private:
   ~TVTunerData();
 
   nsString mId;
   char** mSupportedSourceTypes;
   uint32_t mCount;
 };
 
 class TVChannelData MOZ_FINAL : public nsITVChannelData
 {
 public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSITVCHANNELDATA
 
+  TVChannelData();
+
 private:
-  ~TVChannelData() {}
+  ~TVChannelData();
 
   nsString mNetworkId;
   nsString mTransportStreamId;
   nsString mServiceId;
   nsString mType;
   nsString mNumber;
   nsString mName;
   bool mIsEmergency;
@@ -46,16 +50,18 @@ private:
 };
 
 class TVProgramData MOZ_FINAL : public nsITVProgramData
 {
 public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSITVPROGRAMDATA
 
+  TVProgramData();
+
 private:
   ~TVProgramData();
 
   nsString mEventId;
   nsString mTitle;
   uint64_t mStartTime;
   uint64_t mDuration;
   nsString mDescription;

--- a/dom/tv/moz.build
+++ b/dom/tv/moz.build
@@ -1,16 +1,14 @@
 # -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-TEST_DIRS += ['test']
-
 EXPORTS.mozilla.dom += [
     'FakeTVService.h',
     'TVChannel.h',
     'TVListeners.h',
     'TVManager.h',
     'TVProgram.h',
     'TVServiceCallbacks.h',
     'TVServiceFactory.h',
@@ -35,11 +33,15 @@ UNIFIED_SOURCES += [
 ]
 
 XPIDL_SOURCES += [
     'nsITVService.idl',
 ]
 
 XPIDL_MODULE = 'dom_tv'
 
+MOCHITEST_MANIFESTS += ['test/mochitest/mochitest.ini']
+
+XPCSHELL_TESTS_MANIFESTS += ['test/xpcshell/xpcshell.ini']
+
 include('/ipc/chromium/chromium-config.mozbuild')
 
 FINAL_LIBRARY = 'xul'

rename from dom/tv/test/file_app.sjs
rename to dom/tv/test/mochitest/file_app.sjs
--- a/dom/tv/test/file_app.sjs
+++ b/dom/tv/test/mochitest/file_app.sjs
@@ -1,9 +1,9 @@
-var gBasePath = "tests/dom/tv/test/";
+var gBasePath = "tests/dom/tv/test/mochitest/";
 
 function handleRequest(request, response) {
   var query = getQuery(request);
 
   var testToken = '';
   if ('testToken' in query) {
     testToken = query.testToken;
   }

rename from dom/tv/test/file_app.template.webapp
rename to dom/tv/test/mochitest/file_app.template.webapp
--- a/dom/tv/test/file_app.template.webapp
+++ b/dom/tv/test/mochitest/file_app.template.webapp
@@ -1,6 +1,6 @@
 {
   "name": "TV Test App (hosted)",
   "description": "Hosted TV test app used for mochitest.",
-  "launch_path": "/tests/dom/tv/test/TESTTOKEN",
+  "launch_path": "/tests/dom/tv/test/mochitest/TESTTOKEN",
   "icons": { "128": "default_icon" }
 }

new file mode 100644
--- /dev/null
+++ b/dom/tv/test/mochitest/file_tv_get_channels.html
@@ -0,0 +1,60 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test GetChannels for TV API</title>
+</head>
+<body>
+<div id="content"></div>
+  <script type="application/javascript" src="./test_helpers.js"></script>
+  <script type="application/javascript;version=1.7">
+
+  ok('tv' in navigator, "navigator.tv should exist.");
+
+  navigator.tv.getTuners().then(
+    function(aTuners) {
+      ok(aTuners.length > 0, "Got at least 1 tuner.");
+
+      aTuners[0].getSources().then(
+        function(aSources) {
+          ok(aSources.length > 0, "Got at least 1 source.");
+
+          aSources[0].getChannels().then(
+            function(aChannels) {
+              ok(aChannels.length > 0, "Got at least 1 channel.");
+
+              for (var i = 0; i < aChannels.length; i++) {
+                var channel = aChannels[i];
+                ok(channel instanceof TVChannel, "Channel " + i + " should be in right type.")
+                ok('source' in channel, "Channel " + i + " should have a source.");
+                ok('networkId' in channel, "Channel " + i + " should have a network ID.");
+                ok('transportStreamId' in channel, "Channel " + i + " should have a transport stream ID.");
+                ok('serviceId' in channel, "Channel " + i + " should have a service ID.");
+                ok('type' in channel, "Channel " + i + " should have a type.");
+                ok('name' in channel, "Channel " + i + " should have a name.");
+                ok('number' in channel, "Channel " + i + " should have a number.");
+              }
+
+              finish();
+            },
+            function(aError) {
+              ok(false, "Error occurred when getting channels: " + aError);
+              finish();
+            }
+          );
+        },
+        function(aError) {
+          ok(false, "Error occurred when getting sources: " + aError);
+          finish();
+        }
+      );
+    },
+    function(aError) {
+      ok(false, "Error occurred when getting tuners: " + aError);
+      finish();
+    }
+  );
+
+  </script>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/dom/tv/test/mochitest/file_tv_get_channels_during_scanning.html
@@ -0,0 +1,58 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test an error case for GetChannels during scanning for TV API</title>
+</head>
+<body>
+<div id="content"></div>
+  <script type="application/javascript" src="./test_helpers.js"></script>
+  <script type="application/javascript;version=1.7">
+
+  ok('tv' in navigator, "navigator.tv should exist.");
+
+  navigator.tv.getTuners().then(
+  function(aTuners) {
+    ok(aTuners.length > 0, "Got at least 1 tuner.");
+
+    aTuners[0].getSources().then(
+      function(aSources) {
+        ok(aSources.length > 0, "Got at least 1 source.");
+        var source = aSources[0];
+
+        // TODO Bug 1088818 - Modify the behavior of channel scanning.
+        source.startScanning({}).then(
+          function() {
+            source.getChannels().then(
+              function() {
+                ok(false, "Getting channels during scanning should get error.");
+                  finish();
+                },
+                function(aError) {
+                  is(aError.name, "InvalidStateError",
+                     "InvalidStateError should be expected.");
+                  finish();
+                }
+              );
+            },
+            function(aError) {
+              ok(false, "Error occurred when starting scanning: " + aError);
+              finish();
+            }
+          );
+        },
+        function(aError) {
+          ok(false, "Error occurred when getting sources: " + aError);
+          finish();
+        }
+      );
+    },
+    function(aError) {
+      ok(false, "Error occurred when getting tuners: " + aError);
+      finish();
+    }
+  );
+
+  </script>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/dom/tv/test/mochitest/file_tv_get_current_program.html
@@ -0,0 +1,68 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test GetCurrentProgram for TV API</title>
+</head>
+<body>
+<div id="content"></div>
+  <script type="application/javascript" src="./test_helpers.js"></script>
+  <script type="application/javascript;version=1.7">
+
+  ok('tv' in navigator, "navigator.tv should exist.");
+
+  navigator.tv.getTuners().then(
+    function(aTuners) {
+      ok(aTuners.length > 0, "Got at least 1 tuner.");
+
+      aTuners[0].getSources().then(
+        function(aSources) {
+          ok(aSources.length > 0, "Got at least 1 source.");
+
+          aSources[0].getChannels().then(
+            function(aChannels) {
+              ok(aChannels.length > 0, "Got at least 1 channel.");
+
+              aChannels[0].getCurrentProgram().then(
+                function(aCurrentProgram) {
+                  ok(aCurrentProgram, "Got the current program.");
+                  ok(aCurrentProgram instanceof TVProgram, "The current program should be in the right type.")
+                  ok('channel' in aCurrentProgram, "The current program should have a channel.");
+                  ok('eventId' in aCurrentProgram, "The current program should have an event ID.");
+                  ok('title' in aCurrentProgram, "The current program should have a title.");
+                  ok('startTime' in aCurrentProgram, "The current program should have start time.");
+                  ok('duration' in aCurrentProgram, "The current program should have duration.");
+                  ok(aCurrentProgram.getAudioLanguages().length >= 0,
+                     "The current program may have audio language(s).");
+                  ok(aCurrentProgram.getSubtitleLanguages().length >= 0,
+                     "The current program may have subtitle language(s).");
+
+                  finish();
+                },
+                function(aError) {
+                  ok(false, "Error occurred when getting programs: " + aError);
+                  finish();
+                }
+              );
+            },
+            function(aError) {
+              ok(false, "Error occurred when getting channels: " + aError);
+              finish();
+            }
+          );
+        },
+        function(aError) {
+          ok(false, "Error occurred when getting sources: " + aError);
+          finish();
+        }
+      );
+    },
+    function(aError) {
+      ok(false, "Error occurred when getting tuners: " + aError);
+      finish();
+    }
+  );
+
+  </script>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/dom/tv/test/mochitest/file_tv_get_programs.html
@@ -0,0 +1,71 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test GetPrograms for TV API</title>
+</head>
+<body>
+<div id="content"></div>
+  <script type="application/javascript" src="./test_helpers.js"></script>
+  <script type="application/javascript;version=1.7">
+
+  ok('tv' in navigator, "navigator.tv should exist.");
+
+  navigator.tv.getTuners().then(
+    function(aTuners) {
+      ok(aTuners.length > 0, "Got at least 1 tuner.");
+
+      aTuners[0].getSources().then(
+        function(aSources) {
+          ok(aSources.length > 0, "Got at least 1 source.");
+
+          aSources[0].getChannels().then(
+            function(aChannels) {
+              ok(aChannels.length > 0, "Got at least 1 channel.");
+
+              aChannels[0].getPrograms().then(
+                function(aPrograms) {
+                  ok(aPrograms.length > 0, "Got at least 1 program.");
+
+                  for (var i = 0; i < aPrograms.length; i++) {
+                    var program = aPrograms[i];
+                    ok(program instanceof TVProgram, "Program " + i + " should be in the right type.")
+                    ok('channel' in program, "Program " + i + " should have a channel.");
+                    ok('eventId' in program, "Program " + i + " should have an event ID.");
+                    ok('title' in program, "Program " + i + " should have a title.");
+                    ok('startTime' in program, "Program " + i + " should have start time.");
+                    ok('duration' in program, "Program " + i + " should have duration.");
+                    ok(program.getAudioLanguages().length >= 0,
+                       "Program " + i + " may have audio language(s).");
+                    ok(program.getSubtitleLanguages().length >= 0,
+                       "Program " + i + " may have subtitle language(s).");
+                  }
+
+                  finish();
+                },
+                function(aError) {
+                  ok(false, "Error occurred when getting programs: " + aError);
+                  finish();
+                }
+              );
+            },
+            function(aError) {
+              ok(false, "Error occurred when getting channels: " + aError);
+              finish();
+            }
+          );
+        },
+        function(aError) {
+          ok(false, "Error occurred when getting sources: " + aError);
+          finish();
+        }
+      );
+    },
+    function(aError) {
+      ok(false, "Error occurred when getting tuners: " + aError);
+      finish();
+    }
+  );
+  </script>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/dom/tv/test/mochitest/file_tv_get_sources.html
@@ -0,0 +1,49 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test GetSources for TV API</title>
+</head>
+<body>
+<div id="content"></div>
+  <script type="application/javascript" src="./test_helpers.js"></script>
+  <script type="application/javascript;version=1.7">
+
+  ok('tv' in navigator, "navigator.tv should exist.");
+
+  navigator.tv.getTuners().then(
+    function(aTuners) {
+      ok(aTuners.length > 0, "Got at least 1 tuner.");
+
+      aTuners[0].getSources().then(
+        function(aSources) {
+          ok(aSources.length > 0, "Got at least 1 source.");
+          for (var i = 0; i < aSources.length; i++) {
+            var source = aSources[i];
+            ok(source instanceof TVSource, "Source " + i + " should be in the right type.");
+            ok('tuner' in source, "Source " + i + " should have a tuner.");
+            ok('type' in source, "Source " + i + " should have a type.");
+            ok('isScanning' in source, "Source " + i + " should have isScanning.");
+            ok(!source.isScanning,
+               "Source " + i + " should not be scanning by default.");
+            ok(!source.currentChannel,
+               "Source " + i + " should have no current channel by default.");
+          }
+
+          finish();
+        },
+        function(aError) {
+          ok(false, "Error occurred when getting sources: " + aError);
+          finish();
+        }
+      );
+    },
+    function(aError) {
+      ok(false, "Error occurred when getting tuners: " + aError);
+      finish();
+    }
+  );
+
+  </script>
+</body>
+</html>

new file mode 100644
--- /dev/null
+++ b/dom/tv/test/mochitest/file_tv_get_tuners.html
@@ -0,0 +1,38 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test GetTuners for TV API</title>
+</head>
+<body>
+<div id="content"></div>
+  <script type="application/javascript" src="./test_helpers.js"></script>
+  <script type="application/javascript;version=1.7">
+
+  ok('tv' in navigator, "navigator.tv should exist.");
+
+  navigator.tv.getTuners().then(
+    function(aTuners) {
+      ok(aTuners.length > 0, "Got at least 1 tuner.");
+      for (var i = 0; i < aTuners.length; i++) {
+        var tuner = aTuners[i];
+        ok(tuner instanceof TVTuner, "Tuner " + i + " should be in the right type.");
+        ok('id' in tuner, "Tuner " + i + " should have an ID.");
+        ok(tuner.getSupportedSourceTypes().length > 0,
+           "Tuner " + i + " should have supported source type(s).");
+        ok(!tuner.currentSource,
+           "Tuner " + i + " should have no current source by default.");
+        ok(!tuner.stream, "Tuner " + i + " should have no stream by default.");
+      }
+
+      finish();
+    },
+    function(aError) {
+      ok(false, "Error occurred when getting tuners: " + aError);
+      finish();
+    }
+  );
+
+  </script>
+</body>
+</html>

rename from dom/tv/test/file_tv_non_permitted_app.html
rename to dom/tv/test/mochitest/file_tv_non_permitted_app.html
--- a/dom/tv/test/file_tv_non_permitted_app.html
+++ b/dom/tv/test/mochitest/file_tv_non_permitted_app.html
@@ -1,24 +1,17 @@
 <!DOCTYPE HTML>
 <html>
 <head>
   <meta charset="utf-8">
   <title>Test the availability of TV Manager API for non-permitted Apps</title>
 </head>
 <body>
 <div id="content"></div>
+  <script type="application/javascript" src="./test_helpers.js"></script>
   <script type="application/javascript;version=1.7">
 
-  function ok(a, msg) {
-    alert((a ? 'OK' : 'KO')+ ' ' + msg)
-  }
-
-  function finish() {
-    alert('DONE');
-  }
-
   ok(!('tv' in navigator),
      "navigator.tv should not exist for non-permitted app.");
   finish();
   </script>
 </body>
 </html>