--- a/accessible/src/base/nsAccessible.cpp
+++ b/accessible/src/base/nsAccessible.cpp
@@ -2725,64 +2725,77 @@ nsAccessible::InvalidateChildren()
   mEmbeddedObjCollector = nsnull;
   mChildren.Clear();
   mChildrenFlags = eChildrenUninitialized;
 }
 
 PRBool
 nsAccessible::AppendChild(nsAccessible* aChild)
 {
+  if (!aChild)
+    return PR_FALSE;
+
   if (!mChildren.AppendElement(aChild))
     return PR_FALSE;
 
   if (!nsAccUtils::IsEmbeddedObject(aChild))
     mChildrenFlags = eMixedChildren;
 
   aChild->BindToParent(this, mChildren.Length() - 1);
   return PR_TRUE;
 }
 
 PRBool
 nsAccessible::InsertChildAt(PRUint32 aIndex, nsAccessible* aChild)
 {
+  if (!aChild)
+    return PR_FALSE;
+
   if (!mChildren.InsertElementAt(aIndex, aChild))
     return PR_FALSE;
 
-  for (PRUint32 idx = aIndex + 1; idx < mChildren.Length(); idx++)
-    mChildren[idx]->mIndexInParent++;
+  for (PRUint32 idx = aIndex + 1; idx < mChildren.Length(); idx++) {
+    NS_ASSERTION(mChildren[idx]->mIndexInParent == idx - 1, "Accessible child index doesn't match");
+    mChildren[idx]->mIndexInParent = idx;
+  }
 
   if (nsAccUtils::IsText(aChild))
     mChildrenFlags = eMixedChildren;
 
   mEmbeddedObjCollector = nsnull;
 
   aChild->BindToParent(this, aIndex);
   return PR_TRUE;
 }
 
 PRBool
 nsAccessible::RemoveChild(nsAccessible* aChild)
 {
-  if (aChild->mParent != this || aChild->mIndexInParent == -1)
+  if (!aChild)
     return PR_FALSE;
 
-  if (aChild->mIndexInParent >= mChildren.Length() ||
-      mChildren[aChild->mIndexInParent] != aChild) {
+  PRInt32 index = aChild->mIndexInParent;
+  if (aChild->mParent != this || index == -1)
+    return PR_FALSE;
+
+  if (index >= mChildren.Length() || mChildren[index] != aChild) {
     NS_ERROR("Child is bound to parent but parent hasn't this child at its index!");
     aChild->UnbindFromParent();
     return PR_FALSE;
   }
 
-  for (PRUint32 idx = aChild->mIndexInParent + 1; idx < mChildren.Length(); idx++)
-    mChildren[idx]->mIndexInParent--;
-
-  mChildren.RemoveElementAt(aChild->mIndexInParent);
-  mEmbeddedObjCollector = nsnull;
+  for (PRUint32 idx = index + 1; idx < mChildren.Length(); idx++) {
+    NS_ASSERTION(mChildren[idx]->mIndexInParent == idx, "Accessible child index doesn't match");
+    mChildren[idx]->mIndexInParent = idx - 1;
+  }
 
   aChild->UnbindFromParent();
+  mChildren.RemoveElementAt(index);
+  mEmbeddedObjCollector = nsnull;
+
   return PR_TRUE;
 }
 
 nsAccessible*
 nsAccessible::GetParent()
 {
   if (mParent)
     return mParent;

--- a/accessible/src/base/nsDocAccessible.cpp
+++ b/accessible/src/base/nsDocAccessible.cpp
@@ -674,18 +674,20 @@ nsDocAccessible::Shutdown()
   if (mParent) {
     nsDocAccessible* parentDocument = mParent->GetDocAccessible();
     if (parentDocument)
       parentDocument->RemoveChildDocument(this);
 
     mParent->RemoveChild(this);
   }
 
-  PRUint32 childDocCount = mChildDocuments.Length();
-  for (PRUint32 idx = 0; idx < childDocCount; idx++)
+  // Walk the array backwards because child documents remove themselves from the
+  // array as they are shutdown.
+  PRInt32 childDocCount = mChildDocuments.Length();
+  for (PRInt32 idx = childDocCount - 1; idx >= 0; idx--)
     mChildDocuments[idx]->Shutdown();
 
   mChildDocuments.Clear();
 
   mWeakShell = nsnull;  // Avoid reentrancy
 
   mNodeToAccessibleMap.Clear();
   ClearCache(mAccessibleCache);

--- a/accessible/src/base/nsOuterDocAccessible.cpp
+++ b/accessible/src/base/nsOuterDocAccessible.cpp
@@ -191,18 +191,23 @@ nsOuterDocAccessible::InvalidateChildren
   // accessible is created and appended as a child when it's requested.
 
   mChildrenFlags = eChildrenUninitialized;
 }
 
 PRBool
 nsOuterDocAccessible::AppendChild(nsAccessible *aAccessible)
 {
-  NS_ASSERTION(!mChildren.Length(),
-               "Previous child document of outerdoc accessible wasn't removed!");
+  // We keep showing the old document for a bit after creating the new one,
+  // and while building the new DOM and frame tree. That's done on purpose
+  // to avoid weird flashes of default background color.
+  // The old viewer will be destroyed after the new one is created.
+  // For a11y, it should be safe to shut down the old document now.
+  if (mChildren.Length())
+    mChildren[0]->Shutdown();
 
   if (!nsAccessible::AppendChild(aAccessible))
     return PR_FALSE;
 
   NS_LOG_ACCDOCCREATE("append document to outerdoc",
                       aAccessible->GetDocumentNode())
   NS_LOG_ACCDOCCREATE_ACCADDRESS("outerdoc", this)
 

--- a/browser/base/content/browser.css
+++ b/browser/base/content/browser.css
@@ -46,17 +46,17 @@ tabbrowser {
 
 .tab-throbber,
 .tab-label,
 .tab-icon-image,
 .tab-close-button {
   -moz-transition: opacity .25s;
 }
 
-.tabbrowser-tab[pinned] {
+.tabbrowser-tabs:not([pinnedonly]) > .tabbrowser-tab[pinned] {
   position: fixed;
   display: block; /* position:fixed already does this (bug 579776), but let's be explicit */
 }
 
 #alltabs-popup {
   -moz-binding: url("chrome://browser/content/tabbrowser.xml#tabbrowser-alltabs-popup");
 }
 

--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -827,41 +827,58 @@
                                           true, false);
             }
 
             // TabSelect events are suppressed during preview mode to avoid confusing extensions and other bits of code
             // that might rely upon the other changes suppressed.
             // Focus is suppressed in the event that the main browser window is minimized - focusing a tab would restore the window
             if (!this._previewMode) {
               // We've selected the new tab, so go ahead and notify listeners.
-              var event = document.createEvent("Events");
+              let event = document.createEvent("Events");
               event.initEvent("TabSelect", true, false);
               this.mCurrentTab.dispatchEvent(event);
 
               this._tabAttrModified(oldTab);
               this._tabAttrModified(this.mCurrentTab);
 
-              // Change focus to the new browser unless the findbar is focused.
-              if (!gFindBarInitialized ||
-                  gFindBar.hidden ||
-                  gFindBar.getElement("findbar-textbox").getAttribute("focused") != "true") {
-
-                var fm = Components.classes["@mozilla.org/focus-manager;1"].
-                           getService(Components.interfaces.nsIFocusManager);
-                var newFocusedElement = fm.getFocusedElementForWindow(window.content, true, {});
+              // Adjust focus
+              do {
+                // Focus the location bar if it was previously focused for that tab.
+                // In full screen mode, only bother making the location bar visible
+                // if the tab is a blank one.
+                oldBrowser._urlbarFocused = (gURLBar && gURLBar.focused);
+                if (newBrowser._urlbarFocused && gURLBar) {
+                  if (!window.fullScreen) {
+                    gURLBar.focus();
+                    break;
+                  } else if (isTabEmpty(this.mCurrentTab)) {
+                    focusAndSelectUrlBar();
+                    break;
+                  }
+                }
+
+                // If the find bar is focused, keep it focused.
+                if (gFindBarInitialized &&
+                    !gFindBar.hidden &&
+                    gFindBar.getElement("findbar-textbox").getAttribute("focused") == "true")
+                  break;
+
+                // Otherwise, focus the content area.
+                let fm = Cc["@mozilla.org/focus-manager;1"].getService(Ci.nsIFocusManager);
+                let newFocusedElement = fm.getFocusedElementForWindow(window.content, true, {});
 
                 // for anchors, use FLAG_SHOWRING so that it is clear what link was
                 // last clicked when switching back to that tab
-                var focusFlags = fm.FLAG_NOSCROLL;
+                let focusFlags = fm.FLAG_NOSCROLL;
                 if (newFocusedElement &&
                     (newFocusedElement instanceof HTMLAnchorElement ||
                      newFocusedElement.getAttributeNS("http://www.w3.org/1999/xlink", "type") == "simple"))
                   focusFlags |= fm.FLAG_SHOWRING;
                 fm.setFocus(newBrowser, focusFlags);
-              }
+              } while (false);
             }
           ]]>
         </body>
       </method>
 
       <method name="_tabAttrModified">
         <parameter name="aTab"/>
         <body><![CDATA[
@@ -1897,25 +1914,21 @@
       </property>
 
       <!-- Moves a tab to a new browser window, unless it's already the only tab
            in the current window, in which case this will do nothing. -->
       <method name="replaceTabWithWindow">
         <parameter name="aTab"/>
         <body>
           <![CDATA[
-            if (this.visibleTabs.length == 1)
+            if (this.tabs.length == 1)
               return null;
 
             // tell a new window to take the "dropped" tab
-            return Services.ww.openWindow(window,
-                                          getBrowserURL(),
-                                          null,
-                                          "chrome,dialog=no,all",
-                                          aTab);
+            return window.openDialog(getBrowserURL(), "_blank", "dialog=no,all", aTab);
           ]]>
         </body>
       </method>
 
       <method name="moveTabTo">
         <parameter name="aTab"/>
         <parameter name="aIndex"/>
         <body>
@@ -2703,21 +2716,28 @@
               tabStrip.scrollByPixels(-1);
           } catch (e) {}
         ]]></body>
       </method>
 
       <method name="_positionPinnedTabs">
         <body><![CDATA[
           var width = 0;
-          var scrollButtonWidth = this.getAttribute("overflow") != "true" ? 0 :
+          var pinnedOnly = (this.tabbrowser._numPinnedTabs == this.tabbrowser.visibleTabs.length);
+
+          if (pinnedOnly)
+            this.tabbrowser.tabContainer.setAttribute("pinnedonly", "true");
+          else
+            this.tabbrowser.tabContainer.removeAttribute("pinnedonly");
+
+          var scrollButtonWidth = (this.getAttribute("overflow") != "true" || pinnedOnly) ? 0 :
                                   this.mTabstrip._scrollButtonDown.scrollWidth;
           for (var i = this.tabbrowser._numPinnedTabs - 1; i >= 0; i--) {
             let tab = this.childNodes[i];
-            width += tab.scrollWidth;
+            width += pinnedOnly ? 0 : tab.scrollWidth;
             tab.style.MozMarginStart = - (width + scrollButtonWidth) + "px";
           }
           this.style.MozMarginStart = width + "px";
           this.mTabstrip.ensureElementIsVisible(this.selectedItem, false);
         ]]></body>
       </method>
 
       <method name="handleEvent">

--- a/browser/base/content/tabview/groupitems.js
+++ b/browser/base/content/tabview/groupitems.js
@@ -1015,74 +1015,72 @@ GroupItem.prototype = Utils.extend(new I
           opacity: .2,
           top: childBB.top + childBB.height - parentBB.top + padding,
           left: parentBB.width/2 - this.$expander.width()/2
         });
   },
 
   // ----------
   // Function: shouldStack
-  // Returns true if the groupItem, given "count", should stack (instead of grid).
+  // Returns true if the groupItem should stack (instead of grid).
   shouldStack: function GroupItem_shouldStack(count) {
     if (count <= 1)
       return false;
 
     var bb = this.getContentBounds();
     var options = {
-      pretend: true,
-      count: count
+      return: 'widthAndColumns',
+      count: count || this._children.length
     };
+    let {childWidth, columns} = Items.arrange(null, bb, options);
 
-    var rects = Items.arrange(null, bb, options);
-    return (rects[0].width < 55);
+    let shouldStack = childWidth < TabItems.minTabWidth * 1.35;
+    this._columns = shouldStack ? null : columns;
+
+    return shouldStack;
   },
 
   // ----------
   // Function: arrange
   // Lays out all of the children.
   //
   // Parameters:
   //   options - passed to <Items.arrange> or <_stackArrange>
   arrange: function GroupItem_arrange(options) {
     if (this.expanded) {
       this.topChild = null;
       var box = new Rect(this.expanded.bounds);
       box.inset(8, 8);
       Items.arrange(this._children, box, Utils.extend({}, options, {z: 99999}));
     } else {
       var bb = this.getContentBounds();
-      var count = this._children.length;
-      if (!this.shouldStack(count)) {
+      if (!this.shouldStack()) {
         if (!options)
           options = {};
 
-        var animate;
-        if (typeof options.animate == 'undefined')
-          animate = true;
-        else
-          animate = options.animate;
-
         this._children.forEach(function(child) {
             child.removeClass("stacked")
         });
 
         this.topChild = null;
 
-        var arrangeOptions = Utils.copy(options);
-        Utils.extend(arrangeOptions, {
-          pretend: true,
-          count: count
-        });
-
-        if (!count) {
+        if (!this._children.length) {
           this.xDensity = 0;
           this.yDensity = 0;
           return;
         }
 
+        var arrangeOptions = Utils.copy(options);
+        Utils.extend(arrangeOptions, {
+          columns: this._columns
+        });
+
+        // Items.arrange will rearrange the children, but also return an array
+        // of the Rect's used.
+
         var rects = Items.arrange(this._children, bb, arrangeOptions);
 
         // yDensity = (the distance of the bottom of the last tab to the top of the content area)
         // / (the total available content height)
         this.yDensity = (rects[rects.length - 1].bottom - bb.top) / (bb.height);
 
         // xDensity = (the distance from the left of the content area to the right of the rightmost
         // tab) / (the total available content width)
@@ -1093,25 +1091,16 @@ GroupItem.prototype = Utils.extend(new I
         for each (var rect in rects) {
           if (rect.right > rightMostRight)
             rightMostRight = rect.right;
           else
             break;
         }
         this.xDensity = (rightMostRight - bb.left) / (bb.width);
 
-        this._children.forEach(function(child, index) {
-          if (!child.locked.bounds) {
-            child.setBounds(rects[index], !animate);
-            child.setRotation(0);
-            if (options.z)
-              child.setZ(options.z);
-          }
-        });
-
         this._isStacked = false;
       } else
         this._stackArrange(bb, options);
     }
 
     if (this._isStacked && !this.expanded) this.showExpandControl();
     else this.hideExpandControl();
   },

--- a/browser/base/content/tabview/items.js
+++ b/browser/base/content/tabview/items.js
@@ -596,17 +596,17 @@ Item.prototype = {
       var startSent;
       var startEvent;
       var droppables;
       var dropTarget;
 
       // ___ mousemove
       var handleMouseMove = function(e) {
         // positioning
-        var mouse = new Point(e.pageX, e.pageY);		
+        var mouse = new Point(e.pageX, e.pageY);
         if (!startSent) {
           if(Math.abs(mouse.x - startMouse.x) > self.dragOptions.minDragDistance ||
              Math.abs(mouse.y - startMouse.y) > self.dragOptions.minDragDistance) {
             if (typeof self.dragOptions.start == "function")
               self.dragOptions.start.apply(self,
                   [startEvent, {position: {left: startPos.x, top: startPos.y}}]);
             startSent = true;
           }
@@ -887,49 +887,51 @@ let Items = {
   },
 
   // ----------
   // Function: arrange
   // Arranges the given items in a grid within the given bounds,
   // maximizing item size but maintaining standard tab aspect ratio for each
   //
   // Parameters:
-  //   items - an array of <Item>s. Can be null if the pretend and count options are set.
+  //   items - an array of <Item>s. Can be null, in which case we won't
+  //     actually move anything.
   //   bounds - a <Rect> defining the space to arrange within
   //   options - an object with various properites (see below)
   //
   // Possible "options" properties:
   //   animate - whether to animate; default: true.
   //   z - the z index to set all the items; default: don't change z.
-  //   pretend - whether to collect and return the rectangle rather than moving the items; default: false
-  //   count - overrides the item count for layout purposes; default: the actual item count
+  //   return - if set to 'widthAndColumns', it'll return an object with the
+  //     width of children and the columns.
+  //   count - overrides the item count for layout purposes;
+  //     default: the actual item count
   //   padding - pixels between each item
+  //   columns - (int) a preset number of columns to use
   //
   // Returns:
-  //   the list of rectangles if the pretend option is set; otherwise null
+  //   an object with the width value of the child items and the number of columns, 
+  //   if the return option is set to 'widthAndColumns'; otherwise the list of <Rect>s
   arrange: function Items_arrange(items, bounds, options) {
-    var animate;
-    if (!options || typeof options.animate == 'undefined')
-      animate = true;
-    else
-      animate = options.animate;
-
     if (typeof options == 'undefined')
       options = {};
 
-    var rects = null;
-    if (options.pretend)
-      rects = [];
+    var animate = true;
+    if (typeof options.animate != 'undefined')
+      animate = options.animate;
+    var immediately = !animate;
+
+    var rects = [];
 
     var tabAspect = TabItems.tabHeight / TabItems.tabWidth;
     var count = options.count || (items ? items.length : 0);
     if (!count)
       return rects;
 
-    var columns = 1;
+    var columns = options.columns || 1;
     // We'll assume for the time being that all the items have the same styling
     // and that the margin is the same width around.
     var itemMargin = items && items.length ?
                        parseInt(iQ(items[0].container).css('margin-left')) : 0;
     var padding = itemMargin * 2;
     var yScale = 1.1; // to allow for titles
     var rows;
     var tabWidth;
@@ -949,45 +951,41 @@ let Items = {
       columns++;
       figure();
     }
 
     if (rows == 1) {
       tabWidth = Math.min(tabWidth, (bounds.height - 2 * itemMargin) / tabAspect);
       tabHeight = tabWidth * tabAspect;
     }
+    
+    if (options.return == 'widthAndColumns')
+      return {childWidth: tabWidth, columns: columns};
 
     var box = new Rect(bounds.left, bounds.top, tabWidth, tabHeight);
-    var row = 0;
     var column = 0;
-    var immediately;
 
-    var a;
-    for (a = 0; a < count; a++) {
-      immediately = !animate;
-
-      if (rects)
-        rects.push(new Rect(box));
-      else if (items && a < items.length) {
-        var item = items[a];
+    for (let a = 0; a < count; a++) {
+      rects.push(new Rect(box));
+      if (items && a < items.length) {
+        let item = items[a];
         if (!item.locked.bounds) {
           item.setBounds(box, immediately);
           item.setRotation(0);
           if (options.z)
             item.setZ(options.z);
         }
       }
 
       box.left += box.width + padding;
       column++;
       if (column == columns) {
         box.left = bounds.left;
         box.top += (box.height * yScale) + padding;
         column = 0;
-        row++;
       }
     }
 
     return rects;
   },
 
   // ----------
   // Function: unsquish

--- a/browser/base/content/test/Makefile.in
+++ b/browser/base/content/test/Makefile.in
@@ -140,30 +140,32 @@ endif
                  browser_bug555224.js \
                  browser_bug555767.js \
                  browser_bug556061.js \
                  browser_bug559991.js \
                  browser_bug561623.js \
                  browser_bug561636.js \
                  browser_bug562649.js \
                  browser_bug563588.js \
+                 browser_bug565575.js \
                  browser_bug575561.js \
                  browser_bug577121.js \
                  browser_bug579872.js \
                  browser_bug580956.js \
                  browser_bug581242.js \
                  browser_bug581253.js \
                  browser_bug581947.js \
                  browser_bug585785.js \
                  browser_bug585830.js \
                  browser_bug592338.js \
                  browser_bug594131.js \
                  browser_bug595507.js \
                  browser_bug596687.js \
                  browser_bug597218.js \
+                 browser_bug609700.js \
                  browser_contextSearchTabPosition.js \
                  browser_ctrlTab.js \
                  browser_discovery.js \
                  browser_duplicateIDs.js \
                  browser_gestureSupport.js \
                  browser_getshortcutoruri.js \
                  browser_hide_removing.js \
                  browser_inspector_initialization.js \

new file mode 100644
--- /dev/null
+++ b/browser/base/content/test/browser_bug565575.js
@@ -0,0 +1,13 @@
+function test() {
+  gBrowser.selectedBrowser.focus();
+  BrowserOpenTab();
+  ok(gURLBar.focused, "location bar is focused for a new tab");
+
+  gBrowser.selectedTab = gBrowser.tabs[0];
+  ok(!gURLBar.focused, "location bar isn't focused for the previously selected tab");
+
+  gBrowser.selectedTab = gBrowser.tabs[1];
+  ok(gURLBar.focused, "location bar is re-focused when selecting the new tab");
+
+  gBrowser.removeCurrentTab();
+}

new file mode 100644
--- /dev/null
+++ b/browser/base/content/test/browser_bug609700.js
@@ -0,0 +1,20 @@
+function test() {
+  waitForExplicitFinish();
+
+  Services.ww.registerNotification(function (aSubject, aTopic, aData) {
+    if (aTopic == "domwindowopened") {
+      Services.ww.unregisterNotification(arguments.callee);
+
+      ok(true, "duplicateTabIn opened a new window");
+
+      aSubject.addEventListener("load", function () {
+        executeSoon(function () {
+          aSubject.close();
+          finish();
+        });
+      }, false);
+    }
+  });
+
+  duplicateTabIn(gBrowser.selectedTab, "window");
+}

--- a/browser/base/content/test/browser_tabfocus.js
+++ b/browser/base/content/test/browser_tabfocus.js
@@ -39,21 +39,18 @@ function test() {
     is(focusedWindow.value, browser1.contentWindow, "initial frame focus in tab 1");
     is(fm.getFocusedElementForWindow(browser2.contentWindow, false, focusedWindow), null, "initial focus in tab 2");
     is(focusedWindow.value, browser2.contentWindow, "initial frame focus in tab 2");
 
     expectFocusShift(function () gBrowser.selectedTab = tab2,
                      browser2.contentWindow, null, true,
                      "focusedElement after tab change, focus in new tab");
 
-    // switching tabs when the urlbar is focused and nothing in the new tab is focused
+    // switching tabs when nothing in the new tab is focused
     // should focus the browser
-    expectFocusShift(function () gURLBar.focus(),
-                     window, gURLBar.inputField, true,
-                     "url field focused");
     expectFocusShift(function () gBrowser.selectedTab = tab1,
                      browser1.contentWindow, null, true,
                      "focusedElement after tab change, focus in new tab");
 
     // focusing a button in the current tab should focus it
     var button1 = browser1.contentDocument.getElementById("button1");
     expectFocusShift(function () button1.focus(),
                      browser1.contentWindow, button1, true,
@@ -84,16 +81,19 @@ function test() {
 
     // focusing the url field should switch active focus away from the tab but
     // not clear what would be the focus in the tab 
     button1.focus();
     expectFocusShift(function () gURLBar.focus(),
                      window, gURLBar.inputField, true,
                      "focusedWindow after url field focused");
     is(fm.getFocusedElementForWindow(browser2.contentWindow, false, {}), button2, "url field focused, button in tab");
+    expectFocusShift(function () gURLBar.blur(),
+                     window, null, true,
+                     "focusedWindow after browser focused");
 
     // when a chrome element is focused, switching tabs to a tab with a button
     // with the current focus should focus the button
     expectFocusShift(function () gBrowser.selectedTab = tab1,
                      browser1.contentWindow, button1, true,
                      "focusedWindow after tab change, focus in url field, button focused in new tab");
     is(fm.getFocusedElementForWindow(browser2.contentWindow, false, {}), button2, "after switch tab, focus in unfocused tab");
 

--- a/browser/components/migration/content/migration.js
+++ b/browser/components/migration/content/migration.js
@@ -32,16 +32,18 @@
 # the provisions above, a recipient may use your version of this file under
 # the terms of any one of the MPL, the GPL or the LGPL.
 #
 # ***** END LICENSE BLOCK *****
 
 const kIMig = Components.interfaces.nsIBrowserProfileMigrator;
 const kIPStartup = Components.interfaces.nsIProfileStartup;
 const kProfileMigratorContractIDPrefix = "@mozilla.org/profile/migrator;1?app=browser&type=";
+const Cc = Components.classes;
+const Ci = Components.interfaces;
 
 var MigrationWizard = {
   _source: "",                  // Source Profile Migrator ContractID suffix
   _itemsFlags: kIMig.ALL,       // Selected Import Data Sources (16-bit bitfield)
   _selectedProfile: null,       // Selected Profile name to import from
   _wiz: null,
   _migrator: null,
   _autoMigrate: null,
@@ -49,16 +51,17 @@ var MigrationWizard = {
 
   init: function ()
   {
     var os = Components.classes["@mozilla.org/observer-service;1"]
                        .getService(Components.interfaces.nsIObserverService);
     os.addObserver(this, "Migration:Started", false);
     os.addObserver(this, "Migration:ItemBeforeMigrate", false);
     os.addObserver(this, "Migration:ItemAfterMigrate", false);
+    os.addObserver(this, "Migration:ItemError", false);
     os.addObserver(this, "Migration:Ended", false);
 
     this._wiz = document.documentElement;
 
     if ("arguments" in window && window.arguments.length > 1) {
       this._source = window.arguments[0];
       this._migrator = window.arguments[1].QueryInterface(kIMig);
       this._autoMigrate = window.arguments[2].QueryInterface(kIPStartup);
@@ -76,16 +79,17 @@ var MigrationWizard = {
 
   uninit: function ()
   {
     var os = Components.classes["@mozilla.org/observer-service;1"]
                        .getService(Components.interfaces.nsIObserverService);
     os.removeObserver(this, "Migration:Started");
     os.removeObserver(this, "Migration:ItemBeforeMigrate");
     os.removeObserver(this, "Migration:ItemAfterMigrate");
+    os.removeObserver(this, "Migration:ItemError");
     os.removeObserver(this, "Migration:Ended");
   },
 
   // 1 - Import Source
   onImportSourcePageShow: function ()
   {
     // Reference to the "From File" radio button 
     var fromfile = null;
@@ -484,16 +488,45 @@ var MigrationWizard = {
         setTimeout(close, 5000);
       }
       else {
         this._wiz.canAdvance = true;
         var nextButton = this._wiz.getButton("next");
         nextButton.click();
       }
       break;
+    case "Migration:ItemError":
+      var type = "undefined";
+      switch (parseInt(aData)) {
+      case Ci.nsIBrowserProfileMigrator.SETTINGS:
+        type = "settings";
+        break;
+      case Ci.nsIBrowserProfileMigrator.COOKIES:
+        type = "cookies";
+        break;
+      case Ci.nsIBrowserProfileMigrator.HISTORY:
+        type = "history";
+        break;
+      case Ci.nsIBrowserProfileMigrator.FORMDATA:
+        type = "form data";
+        break;
+      case Ci.nsIBrowserProfileMigrator.PASSWORDS:
+        type = "passwords";
+        break;
+      case Ci.nsIBrowserProfileMigrator.BOOKMARKS:
+        type = "bookmarks";
+        break;
+      case Ci.nsIBrowserProfileMigrator.OTHERDATA:
+        type = "misc. data";
+        break;
+      }
+      Cc["@mozilla.org/consoleservice;1"]
+        .getService(Ci.nsIConsoleService)
+        .logStringMessage("some " + type + " did not successfully migrate.");
+      break;
     }
   },
 
   onDonePageShow: function ()
   {
     this._wiz.getButton("cancel").disabled = true;
     this._wiz.canRewind = false;
     this._listItems("doneItems");

--- a/browser/components/migration/src/nsBrowserProfileMigratorUtils.h
+++ b/browser/components/migration/src/nsBrowserProfileMigratorUtils.h
@@ -34,29 +34,31 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef browserprofilemigratorutils___h___
 #define browserprofilemigratorutils___h___
 
 #define MIGRATION_ITEMBEFOREMIGRATE "Migration:ItemBeforeMigrate"
+#define MIGRATION_ITEMMIGRATEERROR  "Migration:ItemError"
 #define MIGRATION_ITEMAFTERMIGRATE  "Migration:ItemAfterMigrate"
 #define MIGRATION_STARTED           "Migration:Started"
 #define MIGRATION_ENDED             "Migration:Ended"
 
 #define NOTIFY_OBSERVERS(message, item) \
   mObserverService->NotifyObservers(nsnull, message, item)
 
 #define COPY_DATA(func, replace, itemIndex) \
-  if (NS_SUCCEEDED(rv) && (aItems & itemIndex || !aItems)) { \
+  if ((aItems & itemIndex || !aItems)) { \
     nsAutoString index; \
     index.AppendInt(itemIndex); \
     NOTIFY_OBSERVERS(MIGRATION_ITEMBEFOREMIGRATE, index.get()); \
-    rv = func(replace); \
+    if (NS_FAILED(func(replace))) \
+      NOTIFY_OBSERVERS(MIGRATION_ITEMMIGRATEERROR, index.get()); \
     NOTIFY_OBSERVERS(MIGRATION_ITEMAFTERMIGRATE, index.get()); \
   }
 
 #define NC_URI(property) \
   NS_LITERAL_CSTRING("http://home.netscape.com/NC-rdf#"#property)
 
 #define BATCH_ACTION_HISTORY 0
 #define BATCH_ACTION_HISTORY_REPLACE 1

--- a/browser/components/migration/src/nsIEProfileMigrator.cpp
+++ b/browser/components/migration/src/nsIEProfileMigrator.cpp
@@ -65,16 +65,18 @@
 #include "nsISimpleEnumerator.h"
 #include "nsISupportsArray.h"
 #include "nsIProfileMigrator.h"
 #include "nsIBrowserProfileMigrator.h"
 #include "nsIObserverService.h"
 #include "nsILocalFileWin.h"
 #include "nsAutoPtr.h"
 
+#include "prnetdb.h"
+
 #include <objbase.h>
 #include <shlguid.h>
 #include <urlhist.h>
 #include <comdef.h>
 #include <shlobj.h>
 #include <intshcut.h>
 
 #include "nsIBrowserHistory.h"
@@ -1914,24 +1916,30 @@ nsIEProfileMigrator::CopyCookiesFromBuff
     PL_strncpy(hostCopyConstructor, host, hostLength);
     hostCopyConstructor += hostLength;
 
     *hostCopyConstructor = '\0';
 
     nsDependentCString stringName(name),
                        stringPath(path);
 
-    // delete any possible extant matching host cookie
-    if (hostCopy[0] == '.')
+    // delete any possible extant matching host cookie and
+    // check if we're dealing with an IPv4/IPv6 hostname.
+    PRBool isIPAddress = PR_FALSE;
+    if (hostCopy[0] == '.') {
       aCookieManager->Remove(nsDependentCString(hostCopy+1),
                              stringName, stringPath, PR_FALSE);
+      PRNetAddr addr;
+      if (PR_StringToNetAddr(hostCopy+1, &addr) == PR_SUCCESS)
+        isIPAddress = PR_TRUE;
+    }
 
     nsresult onerv;
     // Add() makes a new domain cookie
-    onerv = aCookieManager->Add(nsDependentCString(hostCopy),
+    onerv = aCookieManager->Add(nsDependentCString(hostCopy + (isIPAddress ? 1 : 0)),
                                 stringPath,
                                 stringName,
                                 nsDependentCString(value),
                                 flagsValue & 0x1, // isSecure
                                 PR_FALSE, // isHttpOnly
                                 PR_FALSE, // isSession
                                 PRInt64(expirationDate));
     if (NS_FAILED(onerv)) {

--- a/browser/components/sessionstore/src/nsSessionStore.js
+++ b/browser/components/sessionstore/src/nsSessionStore.js
@@ -740,34 +740,69 @@ SessionStoreService.prototype = {
       let followUp = this._statesToRestore[aWindow.__SS_restoreID].windows.length == 1;
       this.restoreWindow(aWindow, this._statesToRestore[aWindow.__SS_restoreID], true, followUp);
     }
     else if (this._restoreLastWindow && aWindow.toolbar.visible &&
              this._closedWindows.length &&
              !this._inPrivateBrowsing) {
       // default to the most-recently closed window
       // don't use popup windows
-      let state = null;
-      let newClosedWindows = this._closedWindows.filter(function(aWinState) {
-        if (!state && !aWinState.isPopup) {
-          state = aWinState;
-          return false;
+      let closedWindowState = null;
+      let closedWindowIndex;
+      for (let i = 0; i < this._closedWindows.length; i++) {
+        // Take the first non-popup, point our object at it, and break out.
+        if (!this._closedWindows[i].isPopup) {
+          closedWindowState = this._closedWindows[i];
+          closedWindowIndex = i;
+          break;
         }
-        return true;
-      });
-      if (state) {
-        delete state.hidden;
+      }
+
+      if (closedWindowState) {
+        let newWindowState;
 #ifndef XP_MACOSX
-        if (!this._doResumeSession())
+        if (!this._doResumeSession()) {
 #endif
-          state.tabs = state.tabs.filter(function (tab) tab.pinned);
-        if (state.tabs.length > 0) {
-          this._closedWindows = newClosedWindows;
+          // We want to split the window up into pinned tabs and unpinned tabs.
+          // Pinned tabs should be restored. If there are any remaining tabs,
+          // they should be added back to _closedWindows.
+          // We'll cheat a little bit and reuse _prepDataForDeferredRestore
+          // even though it wasn't built exactly for this.
+          let [appTabsState, normalTabsState] =
+            this._prepDataForDeferredRestore(JSON.stringify({ windows: [closedWindowState] }));
+
+          // These are our pinned tabs, which we should restore
+          if (appTabsState.windows.length) {
+            newWindowState = appTabsState.windows[0];
+            delete newWindowState.__lastSessionWindowID;
+          }
+
+          // In case there were no unpinned tabs, remove the window from _closedWindows
+          if (!normalTabsState.windows.length) {
+            this._closedWindows.splice(closedWindowIndex, 1);
+          }
+          // Or update _closedWindows with the modified state
+          else {
+            delete normalTabsState.windows[0].__lastSessionWindowID;
+            this._closedWindows[closedWindowIndex] = normalTabsState.windows[0];
+          }
+#ifndef XP_MACOSX
+        }
+        else {
+          // If we're just restoring the window, make sure it gets removed from
+          // _closedWindows.
+          this._closedWindows.splice(closedWindowIndex, 1);
+          newWindowState = closedWindowState;
+          delete newWindowState.hidden;
+        }
+#endif
+        if (newWindowState) {
+          // Ensure that the window state isn't hidden
           this._restoreCount = 1;
-          state = { windows: [state] };
+          let state = { windows: [newWindowState] };
           this.restoreWindow(aWindow, state, this._isCmdLineEmpty(aWindow, state));
         }
       }
       // we actually restored the session just now.
       this._prefBranch.setBoolPref("sessionstore.resume_session_once", false);
     }
     if (this._restoreLastWindow && aWindow.toolbar.visible) {
       // always reset (if not a popup window)

--- a/browser/components/sessionstore/test/browser/Makefile.in
+++ b/browser/components/sessionstore/test/browser/Makefile.in
@@ -115,16 +115,17 @@ include $(topsrcdir)/config/rules.mk
 	browser_524745.js \
 	browser_528776.js \
 	browser_579868.js \
 	browser_579879.js \
 	browser_580512.js \
 	browser_581593.js \
 	browser_586147.js \
 	browser_586068-cascaded_restore.js \
+	browser_589246.js \
 	browser_590268.js \
 	browser_600545.js \
 	$(NULL)
 
 ifneq ($(OS_ARCH),Darwin)
 _BROWSER_TEST_FILES += \
 	browser_597071.js \
 	$(NULL)

new file mode 100644
--- /dev/null
+++ b/browser/components/sessionstore/test/browser/browser_589246.js
@@ -0,0 +1,276 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is sessionstore test code.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ * Paul O’Shannessy <paul@oshannessy.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+// Mirrors WINDOW_ATTRIBUTES IN nsSessionStore.js
+const WINDOW_ATTRIBUTES = ["width", "height", "screenX", "screenY", "sizemode"];
+
+Cu.import("resource://gre/modules/Services.jsm");
+let ss = Cc["@mozilla.org/browser/sessionstore;1"].
+         getService(Ci.nsISessionStore);
+
+let stateBackup = ss.getBrowserState();
+
+let originalWarnOnClose = gPrefService.getBoolPref("browser.tabs.warnOnClose");
+let originalStartupPage = gPrefService.getIntPref("browser.startup.page");
+let originalWindowType = document.documentElement.getAttribute("windowtype");
+
+let gotLastWindowClosedTopic = false;
+let shouldPinTab = false;
+let shouldOpenTabs = false;
+let shouldCloseTab = false;
+let testNum = 0;
+let afterTestCallback;
+
+// Set state so we know the closed windows content
+let testState = {
+  windows: [
+    { tabs: [{ entries: [{ url: "http://example.org" }] }] }
+  ],
+  _closedWindows: []
+};
+
+// We'll push a set of conditions and callbacks into this array
+// Ideally we would also test win/linux under a complete set of conditions, but
+// the tests for osx mirror the other set of conditions possible on win/linux.
+let tests = [];
+
+// the third & fourth test share a condition check, keep it DRY
+function checkOSX34Generator(num) {
+  return function(aPreviousState, aCurState) {
+    // In here, we should have restored the pinned tab, so only the unpinned tab
+    // should be in aCurState. So let's shape our expectations.
+    let expectedState = JSON.parse(aPreviousState);
+    expectedState[0].tabs.shift();
+    // size attributes are stripped out in _prepDataForDeferredRestore in nsSessionStore.
+    // This isn't the best approach, but neither is comparing JSON strings
+    WINDOW_ATTRIBUTES.forEach(function (attr) delete expectedState[0][attr]);
+
+    is(aCurState, JSON.stringify(expectedState),
+       "test #" + num + ": closedWindowState is as expected");
+  };
+}
+function checkNoWindowsGenerator(num) {
+  return function(aPreviousState, aCurState) {
+    is(aCurState, "[]", "test #" + num + ": there should be no closedWindowsLeft");
+  };
+}
+
+// The first test has 0 pinned tabs and 1 unpinned tab
+tests.push({
+  pinned: false,
+  extra: false,
+  close: false,
+  checkWinLin: checkNoWindowsGenerator(1),
+  checkOSX: function(aPreviousState, aCurState) {
+    is(aCurState, aPreviousState, "test #1: closed window state is unchanged");
+  }
+});
+
+// The second test has 1 pinned tab and 0 unpinned tabs.
+tests.push({
+  pinned: true,
+  extra: false,
+  close: false,
+  checkWinLin: checkNoWindowsGenerator(2),
+  checkOSX: checkNoWindowsGenerator(2)
+});
+
+// The third test has 1 pinned tab and 2 unpinned tabs.
+tests.push({
+  pinned: true,
+  extra: true,
+  close: false,
+  checkWinLin: checkNoWindowsGenerator(3),
+  checkOSX: checkOSX34Generator(3)
+});
+
+// The fourth test has 1 pinned tab, 2 unpinned tabs, and closes one unpinned tab.
+tests.push({
+  pinned: true,
+  extra: true,
+  close: "one",
+  checkWinLin: checkNoWindowsGenerator(4),
+  checkOSX: checkOSX34Generator(4)
+});
+
+// The fifth test has 1 pinned tab, 2 unpinned tabs, and closes both unpinned tabs.
+tests.push({
+  pinned: true,
+  extra: true,
+  close: "both",
+  checkWinLin: checkNoWindowsGenerator(5),
+  checkOSX: checkNoWindowsGenerator(5)
+});
+
+
+function test() {
+  /** Test for Bug 589246 - Closed window state getting corrupted when closing
+      and reopening last browser window without exiting browser **/
+  waitForExplicitFinish();
+  // windows opening & closing, so extending the timeout
+  requestLongerTimeout(2);
+
+  // We don't want the quit dialog pref
+  gPrefService.setBoolPref("browser.tabs.warnOnClose", false);
+  // Ensure that we would restore the session (important for Windows)
+  gPrefService.setIntPref("browser.startup.page", 3);
+
+  runNextTestOrFinish();
+}
+
+function runNextTestOrFinish() {
+  if (tests.length) {
+    setupForTest(tests.shift())
+  }
+  else {
+    // some state is cleaned up at the end of each test, but not all
+    ["browser.tabs.warnOnClose", "browser.startup.page"].forEach(function(p) {
+      if (gPrefService.prefHasUserValue(p))
+        gPrefService.clearUserPref(p);
+    });
+
+    ss.setBrowserState(stateBackup);
+    executeSoon(finish);
+  }
+}
+
+function setupForTest(aConditions) {
+  // reset some checks
+  gotLastWindowClosedTopic = false;
+  shouldPinTab = aConditions.pinned;
+  shouldOpenTabs = aConditions.extra;
+  shouldCloseTab = aConditions.close;
+  testNum++;
+
+  // set our test callback
+  afterTestCallback = /Mac/.test(navigator.platform) ? aConditions.checkOSX
+                                                     : aConditions.checkWinLin;
+
+  // Add observers
+  Services.obs.addObserver(onLastWindowClosed, "browser-lastwindow-close-granted", false);
+
+  // Set the state
+  Services.obs.addObserver(onStateRestored, "sessionstore-browser-state-restored", false);
+  ss.setBrowserState(JSON.stringify(testState));
+}
+
+function onStateRestored(aSubject, aTopic, aData) {
+  info("test #" + testNum + ": onStateRestored");
+  Services.obs.removeObserver(onStateRestored, "sessionstore-browser-state-restored", false);
+
+  // change this window's windowtype so that closing a new window will trigger
+  // browser-lastwindow-close-granted.
+  document.documentElement.setAttribute("windowtype", "navigator:testrunner");
+
+  let newWin = openDialog(location, "_blank", "chrome,all,dialog=no", "http://example.com");
+  newWin.addEventListener("load", function(aEvent) {
+    newWin.removeEventListener("load", arguments.callee, false);
+
+    newWin.gBrowser.selectedBrowser.addEventListener("load", function() {
+      newWin.gBrowser.selectedBrowser.removeEventListener("load", arguments.callee, true);
+
+      // pin this tab
+      if (shouldPinTab)
+        newWin.gBrowser.pinTab(newWin.gBrowser.selectedTab);
+
+      newWin.addEventListener("unload", onWindowUnloaded, false);
+      // Open a new tab as well. On Windows/Linux this will be restored when the
+      // new window is opened below (in onWindowUnloaded). On OS X we'll just
+      // restore the pinned tabs, leaving the unpinned tab in the closedWindowsData.
+      if (shouldOpenTabs) {
+        let newTab = newWin.gBrowser.addTab("about:config");
+        let newTab2 = newWin.gBrowser.addTab("about:buildconfig");
+
+        newTab.linkedBrowser.addEventListener("load", function() {
+          newTab.linkedBrowser.removeEventListener("load", arguments.callee, true);
+
+          if (shouldCloseTab == "one") {
+            newWin.gBrowser.removeTab(newTab2);
+          }
+          else if (shouldCloseTab == "both") {
+            newWin.gBrowser.removeTab(newTab);
+            newWin.gBrowser.removeTab(newTab2);
+          }
+          newWin.BrowserTryToCloseWindow();
+        }, true);
+      }
+      else {
+        newWin.BrowserTryToCloseWindow();
+      }
+    }, true);
+  }, false);
+}
+
+// This will be called before the window is actually closed
+function onLastWindowClosed(aSubject, aTopic, aData) {
+  info("test #" + testNum + ": onLastWindowClosed");
+  Services.obs.removeObserver(onLastWindowClosed, "browser-lastwindow-close-granted", false);
+  gotLastWindowClosedTopic = true;
+}
+
+// This is the unload event listener on the new window (from onStateRestored).
+// Unload is fired after the window is closed, so sessionstore has already
+// updated _closedWindows (which is important). We'll open a new window here
+// which should actually trigger the bug.
+function onWindowUnloaded() {
+  info("test #" + testNum + ": onWindowClosed");
+  ok(gotLastWindowClosedTopic, "test #" + testNum + ": browser-lastwindow-close-granted was notified prior");
+
+  let previousClosedWindowData = ss.getClosedWindowData();
+
+  // Now we want to open a new window
+  let newWin = openDialog(location, "_blank", "chrome,all,dialog=no", "about:robots");
+  newWin.addEventListener("load", function(aEvent) {
+    newWin.removeEventListener("load", arguments.callee, false);
+
+    newWin.gBrowser.selectedBrowser.addEventListener("load", function () {
+      // Good enough for checking the state
+      afterTestCallback(previousClosedWindowData, ss.getClosedWindowData());
+      afterTestCleanup(newWin);
+    }, true);
+
+  }, false);
+}
+
+function afterTestCleanup(aNewWin) {
+  executeSoon(function() {
+    aNewWin.close();
+    document.documentElement.setAttribute("windowtype", originalWindowType);
+    runNextTestOrFinish();
+  });
+}
+

--- a/browser/installer/package-manifest.in
+++ b/browser/installer/package-manifest.in
@@ -380,18 +380,16 @@
 #endif
 @BINPATH@/components/nsINIProcessor.manifest
 @BINPATH@/components/nsINIProcessor.js
 @BINPATH@/components/nsPrompter.manifest
 @BINPATH@/components/nsPrompter.js
 #ifdef MOZ_SERVICES_SYNC
 @BINPATH@/components/SyncComponents.manifest
 @BINPATH@/components/Weave.js
-@BINPATH@/components/WeaveCrypto.manifest
-@BINPATH@/components/WeaveCrypto.js
 #endif
 
 ; Modules
 @BINPATH@/modules/*
 
 ; Safe Browsing
 @BINPATH@/components/nsSafebrowsingApplication.manifest
 @BINPATH@/components/nsSafebrowsingApplication.js

--- a/browser/installer/removed-files.in
+++ b/browser/installer/removed-files.in
@@ -62,16 +62,18 @@ components/nsCloseAllWindows.js
 components/nsDictionary.js
 components/nsExtensionManager.js
 components/nsInterfaceInfoToIDL.js
 components/nsScriptableIO.js
 components/nsUrlClassifierTable.js
 components/nsXmlRpcClient.js
 components/pluginGlue.js
 components/sidebar.xpt
+components/WeaveCrypto.js
+components/WeaveCrypto.manifest
 components/xmlextras.xpt
 components/xpcom.xpt
 components/xpti.dat
 components/xptitemp.dat
 defaults/pref/all.js
 defaults/pref/bug259708.js
 defaults/pref/bug307259.js
 defaults/pref/reporter.js
@@ -616,17 +618,16 @@ xpicleanup@BIN_SUFFIX@
   components/nsUrlClassifierLib.js
   components/nsUrlClassifierListManager.js
   components/nsURLFormatter.js
   components/nsWebHandlerApp.js
   components/PlacesProtocolHandler.js
   components/storage-Legacy.js
   components/storage-mozStorage.js
   components/txEXSLTRegExFunctions.js
-  components/WeaveCrypto.js
   components/Weave.js
   components/WebContentConverter.js
   defaults/autoconfig/platform.js
   defaults/autoconfig/prefcalls.js
   defaults/pref/firefox-branding.js
   defaults/pref/firefox.js
   defaults/pref/firefox-l10n.js
   defaults/pref/services-sync.js

--- a/browser/themes/winstripe/browser/browser-aero.css
+++ b/browser/themes/winstripe/browser/browser-aero.css
@@ -28,29 +28,22 @@
     border-top: none;
     -moz-border-left-colors: rgba(255,255,255,.5) rgba(83,42,6,.9);
     -moz-border-bottom-colors: rgba(255,255,255,.5) rgba(83,42,6,.9);
     -moz-border-right-colors: rgba(255,255,255,.5) rgba(83,42,6,.9);
     box-shadow: 0 1px 0 rgba(255,255,255,.25) inset,
                 0 0 2px 1px rgba(255,255,255,.25) inset;
   }
 
-  #main-window[privatebrowsingmode=temporary] #appmenu-button:not(:-moz-window-inactive) {
+  #main-window[privatebrowsingmode=temporary] #appmenu-button {
     -moz-border-left-colors: rgba(255,255,255,.5) rgba(43,8,65,.9);
     -moz-border-bottom-colors: rgba(255,255,255,.5) rgba(43,8,65,.9);
     -moz-border-right-colors: rgba(255,255,255,.5) rgba(43,8,65,.9);
   }
 
-  #appmenu-button:-moz-window-inactive {
-    -moz-border-left-colors: rgba(255,255,255,.4) rgba(0,0,0,.5);
-    -moz-border-bottom-colors: rgba(255,255,255,.4) rgba(0,0,0,.5);
-    -moz-border-right-colors: rgba(255,255,255,.4) rgba(0,0,0,.5);
-    box-shadow: 0 0 0 1px rgba(255,255,255,.25) inset;
-  }
-
   /* Bug 413060, comment 16: Vista Aero is a special case where we use a
      tooltip appearance for the address bar popup panels */
   #identity-popup,
   #editBookmarkPanel {
     -moz-appearance: tooltip;
     color: InfoText;
   }
 

--- a/browser/themes/winstripe/browser/browser.css
+++ b/browser/themes/winstripe/browser/browser.css
@@ -121,26 +121,21 @@
   color: white;
   text-shadow: 0 0 1px rgba(0,0,0,.7),
                0 1px 1.5px rgba(0,0,0,.5);
   font-weight: bold;
   padding: .1em 1.5em .15em;
   margin: 0;
 }
 
-#main-window[privatebrowsingmode=temporary] #appmenu-button:not(:-moz-window-inactive) {
+#main-window[privatebrowsingmode=temporary] #appmenu-button {
   background-image: -moz-linear-gradient(rgb(153,38,211), rgb(105,19,163) 95%);
   border-color: rgba(43,8,65,.9);
 }
 
-#appmenu-button:-moz-window-inactive {
-  background-image: none;
-  border-color: rgba(0,0,0,.4);
-}
-
 #appmenu-button:hover:not(:active):not([open]) {
   background-image: -moz-radial-gradient(center bottom, farthest-side, rgba(252,240,89,.5) 10%, rgba(252,240,89,0) 70%),
                     -moz-radial-gradient(center bottom, farthest-side, rgb(236,133,0), rgba(255,229,172,0)),
                     -moz-linear-gradient(rgb(246,170,69), rgb(209,74,0) 95%);
   border-color: rgba(83,42,6,.9);
   box-shadow: 0 1px 0 rgba(255,255,255,.1) inset,
               0 0 1.5px 1px rgba(250,234,169,.7) inset,
               0 -1px 0 rgba(250,234,169,.5) inset;

--- a/chrome/src/nsChromeRegistryChrome.cpp
+++ b/chrome/src/nsChromeRegistryChrome.cpp
@@ -452,28 +452,28 @@ EnumerateOverride(nsIURI* aURIKey,
     chromeURI, overrideURI
   };
   overrides->AppendElement(override);
   return (PLDHashOperator)PL_DHASH_NEXT;
 }
 
 struct EnumerationArgs
 {
-  nsTArray<ChromePackage>& packages;
+  InfallibleTArray<ChromePackage>& packages;
   const nsCString& selectedLocale;
   const nsCString& selectedSkin;
 };
 
 void
 nsChromeRegistryChrome::SendRegisteredChrome(
     mozilla::dom::PContentParent* aParent)
 {
-  nsTArray<ChromePackage> packages;
-  nsTArray<ResourceMapping> resources;
-  nsTArray<OverrideMapping> overrides;
+  InfallibleTArray<ChromePackage> packages;
+  InfallibleTArray<ResourceMapping> resources;
+  InfallibleTArray<OverrideMapping> overrides;
 
   EnumerationArgs args = {
     packages, mSelectedLocale, mSelectedSkin
   };
   PL_DHashTableEnumerate(&mPackagesHash, CollectPackages, &args);
 
   nsCOMPtr<nsIIOService> io (do_GetIOService());
   NS_ENSURE_TRUE(io, );

--- a/config/autoconf.mk.in
+++ b/config/autoconf.mk.in
@@ -607,17 +607,16 @@ OS_TEST=@OS_TEST@
 SOLARIS_SUNPRO_CC = @SOLARIS_SUNPRO_CC@
 SOLARIS_SUNPRO_CXX = @SOLARIS_SUNPRO_CXX@
 
 # For AIX build
 AIX_OBJMODEL = @AIX_OBJMODEL@
 
 # For OS/2 build
 MOZ_OS2_TOOLS = @MOZ_OS2_TOOLS@
-MOZ_OS2_USE_DECLSPEC = @MOZ_OS2_USE_DECLSPEC@
 MOZ_OS2_HIGH_MEMORY = @MOZ_OS2_HIGH_MEMORY@
 
 HAVE_XIE=@HAVE_XIE@
 
 MOZ_PSM=@MOZ_PSM@
 
 # Gssapi (krb5) libraries and headers for the Negotiate auth method
 GSSAPI_INCLUDES = @GSSAPI_INCLUDES@

--- a/config/rules.mk
+++ b/config/rules.mk
@@ -1244,36 +1244,20 @@ endif
 ifeq ($(OS_ARCH),OS2)
 $(DEF_FILE): $(OBJS) $(SHARED_LIBRARY_LIBS)
 	rm -f $@
 	echo LIBRARY $(SHARED_LIBRARY_NAME) INITINSTANCE TERMINSTANCE > $@
 	echo PROTMODE >> $@
 	echo CODE    LOADONCALL MOVEABLE DISCARDABLE >> $@
 	echo DATA    PRELOAD MOVEABLE MULTIPLE NONSHARED >> $@
 	echo EXPORTS >> $@
-ifeq ($(IS_COMPONENT),1)
-ifeq ($(HAS_EXTRAEXPORTS),1)
-ifndef MOZ_OS2_USE_DECLSPEC
-	$(FILTER) $(OBJS) $(SHARED_LIBRARY_LIBS) >> $@
-endif	
-else
-	echo    _NSModule >> $@
-endif
-else
-ifndef MOZ_OS2_USE_DECLSPEC
-	$(FILTER) $(OBJS) $(SHARED_LIBRARY_LIBS) >> $@
-endif	
-endif
+
 	$(ADD_TO_DEF_FILE)
 
-ifdef MOZ_OS2_USE_DECLSPEC
 $(IMPORT_LIBRARY): $(SHARED_LIBRARY)
-else
-$(IMPORT_LIBRARY): $(DEF_FILE)
-endif
 	rm -f $@
 	$(IMPLIB) $@ $^
 	$(RANLIB) $@
 endif # OS/2
 
 $(HOST_LIBRARY): $(HOST_OBJS) Makefile
 	rm -f $@
 	$(HOST_AR) $(HOST_AR_FLAGS) $(HOST_OBJS)

--- a/configure.in
+++ b/configure.in
@@ -2637,17 +2637,17 @@ ia64*-hpux*)
     DSO_PIC_CFLAGS=
     AR=emxomfar
     AR_FLAGS='r $@'
     CFLAGS="$CFLAGS -Zomf"
     CXXFLAGS="$CXXFLAGS -Zomf"
     DSO_LDOPTS='-Zdll'
     BIN_FLAGS='-Zlinker /ST:0x100000'
     IMPLIB='emximp -o'
-    FILTER='emxexp -o'
+    FILTER='true'
     LDFLAGS='-Zmap'
     WARNINGS_AS_ERRORS='-Werror'
     MOZ_DEBUG_FLAGS="-g -fno-inline"
     MOZ_OPTIMIZE_FLAGS="-O2"
     MOZ_OPTIMIZE_LDFLAGS="-s -Zlinker /EXEPACK:2 -Zlinker /PACKCODE -Zlinker /PACKDATA"
     DYNAMIC_XPCOM_LIBS='-L$(LIBXUL_DIST)/lib $(LIBXUL_DIST)/lib/xpcom.lib $(LIBXUL_DIST)/lib/xpcom_core.lib $(LIBXUL_DIST)/lib/mozalloc.lib'
     LIBXUL_LIBS='-L$(LIBXUL_DIST)/lib $(LIBXUL_DIST)/lib/xpcom.lib $(LIBXUL_DIST)/lib/xul.lib $(LIBXUL_DIST)/lib/mozalloc.lib'
     TARGET_MD_ARCH=os2
@@ -2673,19 +2673,18 @@ ia64*-hpux*)
     _DEFINES_CXXFLAGS="$_DEFINES_CXXFLAGS -Uunix -U__unix -U__unix__"
 
     AC_CACHE_CHECK(for __declspec(dllexport),
         ac_os2_declspec,
         [AC_TRY_COMPILE([__declspec(dllexport) void ac_os2_declspec(void) {}],
                         [return 0;],
                         ac_os2_declspec="yes",
                         ac_os2_declspec="no")])
-    if test "$ac_os2_declspec" = "yes"; then
-        FILTER='true'
-        MOZ_OS2_USE_DECLSPEC='1'
+    if test "$ac_os2_declspec" != "yes"; then
+        AC_MSG_ERROR([Compiler does not support __declspec(dllexport), install GCC-4.3.2 or newer])
     fi
     ;;
 
 alpha*-*-osf*)
     if test "$GNU_CC"; then
       MKSHLIB='$(CXX) $(CXXFLAGS) $(DSO_PIC_CFLAGS) $(DSO_LDOPTS) -Wl,-soname,$@ -o $@'
       MKCSHLIB='$(CC) $(CFLAGS) $(DSO_PIC_CFLAGS) $(DSO_LDOPTS) -Wl,-soname,$@ -o $@'
 
@@ -8929,17 +8928,16 @@ AC_SUBST(XPCOM_LIBS)
 AC_SUBST(XPCOM_FROZEN_LDOPTS)
 AC_SUBST(XPCOM_GLUE_LDOPTS)
 AC_SUBST(XPCOM_STANDALONE_GLUE_LDOPTS)
 
 AC_SUBST(USE_DEPENDENT_LIBS)
 
 AC_SUBST(MOZ_BUILD_ROOT)
 AC_SUBST(MOZ_OS2_TOOLS)
-AC_SUBST(MOZ_OS2_USE_DECLSPEC)
 
 AC_SUBST(MOZ_POST_DSO_LIB_COMMAND)
 AC_SUBST(MOZ_POST_PROGRAM_COMMAND)
 AC_SUBST(MOZ_TIMELINE)
 AC_SUBST(OGLES_SDK_DIR)
 
 AC_SUBST(MOZ_APP_NAME)
 AC_SUBST(MOZ_APP_DISPLAYNAME)

--- a/content/base/public/nsContentUtils.h
+++ b/content/base/public/nsContentUtils.h
@@ -1695,16 +1695,24 @@ public:
    * A sub document isn't tabbable when it's a zombie document.
    *
    * @param aElement element to test.
    *
    * @return Whether the subdocument is tabbable.
    */
   static bool IsSubDocumentTabbable(nsIContent* aContent);
 
+  /**
+   * Flushes the layout tree (recursively)
+   *
+   * @param aWindow the window the flush should start at
+   *
+   */
+  static void FlushLayoutForTree(nsIDOMWindow* aWindow);
+
 private:
 
   static PRBool InitializeEventTable();
 
   static nsresult EnsureStringBundle(PropertiesFile aFile);
 
   static nsIDOMScriptObjectFactory *GetDOMScriptObjectFactory();
 

--- a/content/base/public/nsINode.h
+++ b/content/base/public/nsINode.h
@@ -733,17 +733,17 @@ public:
    * observer that is already observing the node must not be added without
    * being removed first.
    */
   void AddMutationObserver(nsIMutationObserver* aMutationObserver)
   {
     nsSlots* s = GetSlots();
     if (s) {
       NS_ASSERTION(s->mMutationObservers.IndexOf(aMutationObserver) ==
-                   nsTArray_base::NoIndex,
+                   nsTArray<int>::NoIndex,
                    "Observer already in the list");
       s->mMutationObservers.AppendElement(aMutationObserver);
     }
   }
 
   /**
    * Same as above, but only adds the observer if its not observing
    * the node already.

--- a/content/base/src/nsAttrValue.h
+++ b/content/base/src/nsAttrValue.h
@@ -53,18 +53,19 @@
 #include "nsCOMPtr.h"
 
 typedef PRUptrdiff PtrBits;
 class nsAString;
 class nsIAtom;
 class nsICSSStyleRule;
 class nsISVGValue;
 class nsIDocument;
-template<class E> class nsTArray;
-template<class E> class nsTPtrArray;
+template<class E, class A> class nsTArray;
+template<class E, class A> class nsTPtrArray;
+struct nsTArrayDefaultAllocator;
 
 #define NS_ATTRVALUE_MAX_STRINGLENGTH_ATOM 12
 
 #define NS_ATTRVALUE_BASETYPE_MASK (PtrBits(3))
 #define NS_ATTRVALUE_POINTERVALUE_MASK (~NS_ATTRVALUE_BASETYPE_MASK)
 
 #define NS_ATTRVALUE_INTEGERTYPE_BITS 4
 #define NS_ATTRVALUE_INTEGERTYPE_MASK (PtrBits((1 << NS_ATTRVALUE_INTEGERTYPE_BITS) - 1))
@@ -376,17 +377,17 @@ private:
   // aStrict is set PR_TRUE if stringifying the return value equals with
   // aValue.
   PRInt32 StringToInteger(const nsAString& aValue,
                           PRBool* aStrict,
                           PRInt32* aErrorCode,
                           PRBool aCanBePercent = PR_FALSE,
                           PRBool* aIsPercent = nsnull) const;
 
-  static nsTPtrArray<const EnumTable>* sEnumTableArray;
+  static nsTPtrArray<const EnumTable, nsTArrayDefaultAllocator>* sEnumTableArray;
 
   PtrBits mBits;
 };
 
 /**
  * Implementation of inline methods
  */
 

--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -6298,16 +6298,50 @@ nsContentUtils::IsSubDocumentTabbable(ns
   contentViewer->GetPreviousViewer(getter_AddRefs(zombieViewer));
 
   // If there are 2 viewers for the current docshell, that
   // means the current document is a zombie document.
   // Only navigate into the subdocument if it's not a zombie.
   return !zombieViewer;
 }
 
+void
+nsContentUtils::FlushLayoutForTree(nsIDOMWindow* aWindow)
+{
+    nsCOMPtr<nsPIDOMWindow> piWin = do_QueryInterface(aWindow);
+    if (!piWin)
+        return;
+
+    // Note that because FlushPendingNotifications flushes parents, this
+    // is O(N^2) in docshell tree depth.  However, the docshell tree is
+    // usually pretty shallow.
+
+    nsCOMPtr<nsIDOMDocument> domDoc;
+    aWindow->GetDocument(getter_AddRefs(domDoc));
+    nsCOMPtr<nsIDocument> doc = do_QueryInterface(domDoc);
+    if (doc) {
+        doc->FlushPendingNotifications(Flush_Layout);
+    }
+
+    nsCOMPtr<nsIDocShellTreeNode> node =
+        do_QueryInterface(piWin->GetDocShell());
+    if (node) {
+        PRInt32 i = 0, i_end;
+        node->GetChildCount(&i_end);
+        for (; i < i_end; ++i) {
+            nsCOMPtr<nsIDocShellTreeItem> item;
+            node->GetChildAt(i, getter_AddRefs(item));
+            nsCOMPtr<nsIDOMWindow> win = do_GetInterface(item);
+            if (win) {
+                FlushLayoutForTree(win);
+            }
+        }
+    }
+}
+
 void nsContentUtils::RemoveNewlines(nsString &aString)
 {
   // strip CR/LF and null
   static const char badChars[] = {'\r', '\n', 0};
   aString.StripChars(badChars);
 }
 
 void

--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -200,16 +200,18 @@ static NS_DEFINE_CID(kDOMEventGroupCID, 
 #include "nsHTMLStyleSheet.h"
 #include "nsHTMLCSSStyleSheet.h"
 
 #include "mozilla/dom/Link.h"
 #include "nsIHTMLDocument.h"
 
 using namespace mozilla::dom;
 
+typedef nsTArray<Link*> LinkArray;
+
 
 #ifdef PR_LOGGING
 static PRLogModuleInfo* gDocumentLeakPRLog;
 static PRLogModuleInfo* gCspPRLog;
 #endif
 
 #define NAME_NOT_VALID ((nsBaseContentList*)1)
 
@@ -3897,17 +3899,17 @@ nsDocument::InternalAllowXULXBL()
   return PR_FALSE;
 }
 
 // Note: We don't hold a reference to the document observer; we assume
 // that it has a live reference to the document.
 void
 nsDocument::AddObserver(nsIDocumentObserver* aObserver)
 {
-  NS_ASSERTION(mObservers.IndexOf(aObserver) == nsTArray_base::NoIndex,
+  NS_ASSERTION(mObservers.IndexOf(aObserver) == nsTArray<int>::NoIndex,
                "Observer already in the list");
   mObservers.AppendElement(aObserver);
   AddMutationObserver(aObserver);
 }
 
 PRBool
 nsDocument::RemoveObserver(nsIDocumentObserver* aObserver)
 {
@@ -5538,18 +5540,20 @@ nsDocument::GetAnimationController()
   if (mAnimationController && shell) {
     nsPresContext *context = shell->GetPresContext();
     if (context &&
         context->ImageAnimationMode() == imgIContainer::kDontAnimMode) {
       mAnimationController->Pause(nsSMILTimeContainer::PAUSE_USERPREF);
     }
   }
 
-  // If we're hidden (or being hidden), notify the animation controller.
-  if (!mIsShowing) {
+  // If we're hidden (or being hidden), notify the newly-created animation
+  // controller. (Skip this check for SVG-as-an-image documents, though,
+  // because they don't get OnPageShow / OnPageHide calls).
+  if (!mIsShowing && !mIsBeingUsedAsImage) {
     mAnimationController->OnPageHide();
   }
 
   return mAnimationController;
 }
 #endif // MOZ_SMIL
 
 struct DirTable {
@@ -7541,33 +7545,33 @@ nsDocument::DestroyElementMaps()
   mStyledLinks.Clear();
   mIdentifierMap.Clear();
 }
 
 static
 PLDHashOperator
 EnumerateStyledLinks(nsPtrHashKey<Link>* aEntry, void* aArray)
 {
-  nsTArray<Link*>* array = static_cast<nsTArray<Link*>*>(aArray);
+  LinkArray* array = static_cast<LinkArray*>(aArray);
   (void)array->AppendElement(aEntry->GetKey());
   return PL_DHASH_NEXT;
 }
 
 void
 nsDocument::RefreshLinkHrefs()
 {
   // Get a list of all links we know about.  We will reset them, which will
   // remove them from the document, so we need a copy of what is in the
   // hashtable.
-  nsTArray<Link*> linksToNotify(mStyledLinks.Count());
+  LinkArray linksToNotify(mStyledLinks.Count());
   (void)mStyledLinks.EnumerateEntries(EnumerateStyledLinks, &linksToNotify);
 
   // Reset all of our styled links.
   MOZ_AUTO_DOC_UPDATE(this, UPDATE_CONTENT_STATE, PR_TRUE);
-  for (nsTArray_base::size_type i = 0; i < linksToNotify.Length(); i++) {
+  for (LinkArray::size_type i = 0; i < linksToNotify.Length(); i++) {
     linksToNotify[i]->ResetLinkState(true);
   }
 }
 
 NS_IMETHODIMP
 nsDocument::GetScriptTypeID(PRUint32 *aScriptType)
 {
     NS_ERROR("No default script type here - ask some element");

--- a/content/base/src/nsFrameLoader.cpp
+++ b/content/base/src/nsFrameLoader.cpp
@@ -718,18 +718,17 @@ nsFrameLoader::ShowRemoteFrame(const nsI
 
   // FIXME/bug 589337: Show()/Hide() is pretty expensive for
   // cross-process layers; need to figure out what behavior we really
   // want here.  For now, hack.
   if (!mRemoteBrowserShown) {
     mRemoteBrowser->Show(size);
     mRemoteBrowserShown = PR_TRUE;
 
-    nsCOMPtr<nsIChromeFrameMessageManager> dummy;
-    GetMessageManager(getter_AddRefs(dummy)); // Initialize message manager.
+    EnsureMessageManager();
   } else {
     mRemoteBrowser->Move(size);
   }
 
   return true;
 }
 #endif
 

--- a/content/base/src/nsFrameMessageManager.cpp
+++ b/content/base/src/nsFrameMessageManager.cpp
@@ -229,17 +229,17 @@ nsFrameMessageManager::SendSyncMessage()
   NS_ASSERTION(!IsWindowLevel(), "Should not call SendSyncMessage in chrome");
   NS_ASSERTION(!mParentManager, "Should not have parent manager in content!");
   if (mSyncCallback) {
     NS_ENSURE_TRUE(mCallbackData, NS_ERROR_NOT_INITIALIZED);
     nsString messageName;
     nsString json;
     nsresult rv = GetParamsForMessage(messageName, json);
     NS_ENSURE_SUCCESS(rv, rv);
-    nsTArray<nsString> retval;
+    InfallibleTArray<nsString> retval;
     if (mSyncCallback(mCallbackData, messageName, json, &retval)) {
       nsAXPCNativeCallContext* ncc = nsnull;
       rv = nsContentUtils::XPConnect()->GetCurrentNativeCallContext(&ncc);
       NS_ENSURE_SUCCESS(rv, rv);
       NS_ENSURE_STATE(ncc);
 
       JSContext* ctx = nsnull;
       rv = ncc->GetJSContext(&ctx);
@@ -321,17 +321,17 @@ nsFrameMessageManager::GetDocShell(nsIDo
   return NS_OK;
 }
 
 nsresult
 nsFrameMessageManager::ReceiveMessage(nsISupports* aTarget,
                                       const nsAString& aMessage,
                                       PRBool aSync, const nsAString& aJSON,
                                       JSObject* aObjectsArray,
-                                      nsTArray<nsString>* aJSONRetVal,
+                                      InfallibleTArray<nsString>* aJSONRetVal,
                                       JSContext* aContext)
 {
   JSContext* ctx = mContext ? mContext : aContext;
   if (!ctx) {
     nsContentUtils::ThreadJSContextStack()->GetSafeJSContext(&ctx);
   }
   if (mListeners.Length()) {
     nsCOMPtr<nsIAtom> name = do_GetAtom(aMessage);
@@ -737,17 +737,17 @@ bool SendAsyncMessageToChildProcess(void
     return cp->SendAsyncMessage(nsString(aMessage), nsString(aJSON));
   }
   return true;
 }
 
 bool SendSyncMessageToParentProcess(void* aCallbackData,
                                     const nsAString& aMessage,
                                     const nsAString& aJSON,
-                                    nsTArray<nsString>* aJSONRetVal)
+                                    InfallibleTArray<nsString>* aJSONRetVal)
 {
   mozilla::dom::ContentChild* cc =
     mozilla::dom::ContentChild::GetSingleton();
   if (cc) {
     return
       cc->SendSyncMessage(nsString(aMessage), nsString(aJSON), aJSONRetVal);
   }
   return true;

--- a/content/base/src/nsFrameMessageManager.h
+++ b/content/base/src/nsFrameMessageManager.h
@@ -61,17 +61,17 @@ struct nsMessageListenerInfo
   nsCOMPtr<nsIFrameMessageListener> mListener;
   nsCOMPtr<nsIAtom> mMessage;
 };
 
 typedef bool (*nsLoadScriptCallback)(void* aCallbackData, const nsAString& aURL);
 typedef bool (*nsSyncMessageCallback)(void* aCallbackData,
                                       const nsAString& aMessage,
                                       const nsAString& aJSON,
-                                      nsTArray<nsString>* aJSONRetVal);
+                                      InfallibleTArray<nsString>* aJSONRetVal);
 typedef bool (*nsAsyncMessageCallback)(void* aCallbackData,
                                        const nsAString& aMessage,
                                        const nsAString& aJSON);
 
 class nsFrameMessageManager : public nsIContentFrameMessageManager,
                               public nsIChromeFrameMessageManager
 {
 public:
@@ -124,17 +124,17 @@ public:
   NS_DECL_NSIFRAMEMESSAGEMANAGER
   NS_DECL_NSISYNCMESSAGESENDER
   NS_DECL_NSICONTENTFRAMEMESSAGEMANAGER
   NS_DECL_NSICHROMEFRAMEMESSAGEMANAGER
 
   nsresult ReceiveMessage(nsISupports* aTarget, const nsAString& aMessage,
                           PRBool aSync, const nsAString& aJSON,
                           JSObject* aObjectsArray,
-                          nsTArray<nsString>* aJSONRetVal,
+                          InfallibleTArray<nsString>* aJSONRetVal,
                           JSContext* aContext = nsnull);
   void AddChildManager(nsFrameMessageManager* aManager,
                        PRBool aLoadScripts = PR_TRUE);
   void RemoveChildManager(nsFrameMessageManager* aManager)
   {
     mChildManagers.RemoveObject(aManager);
   }
 

--- a/content/base/src/nsInProcessTabChildGlobal.cpp
+++ b/content/base/src/nsInProcessTabChildGlobal.cpp
@@ -49,17 +49,17 @@
 #include "nsScriptLoader.h"
 #include "nsIJSContextStack.h"
 #include "nsFrameLoader.h"
 #include "nsIPrivateDOMEvent.h"
 
 bool SendSyncMessageToParent(void* aCallbackData,
                              const nsAString& aMessage,
                              const nsAString& aJSON,
-                             nsTArray<nsString>* aJSONRetVal)
+                             InfallibleTArray<nsString>* aJSONRetVal)
 {
   nsInProcessTabChildGlobal* tabChild =
     static_cast<nsInProcessTabChildGlobal*>(aCallbackData);
   nsCOMPtr<nsIContent> owner = tabChild->mOwner;
   nsTArray<nsCOMPtr<nsIRunnable> > asyncMessages;
   asyncMessages.SwapElements(tabChild->mASyncMessages);
   PRUint32 len = asyncMessages.Length();
   for (PRUint32 i = 0; i < len; ++i) {

--- a/content/base/src/nsScriptElement.cpp
+++ b/content/base/src/nsScriptElement.cpp
@@ -10,17 +10,17 @@
  * Software distributed under the License is distributed on an "AS IS" basis,
  * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
  * for the specific language governing rights and limitations under the
  * License.
  *
  * The Original Code is Mozilla Code.
  *
  * The Initial Developer of the Original Code is
- * Mozilla Corporation.
+ * the Mozilla Foundation.
  * Portions created by the Initial Developer are Copyright (C) 2006
  * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
  *   Jonas Sicking <jonas@sicking.cc> (original developer)
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -141,65 +141,35 @@ void
 nsScriptElement::ContentInserted(nsIDocument *aDocument,
                                  nsIContent* aContainer,
                                  nsIContent* aChild,
                                  PRInt32 aIndexInContainer)
 {
   MaybeProcessScript();
 }
 
-static PRBool
-InNonScriptingContainer(nsIContent* aNode)
-{
-  aNode = aNode->GetParent();
-  while (aNode) {
-    // XXX noframes and noembed are currently unconditionally not
-    // displayed and processed. This might change if we support either
-    // prefs or per-document container settings for not allowing
-    // frames or plugins.
-    if (aNode->IsHTML()) {
-      nsIAtom *localName = aNode->Tag();
-      if (localName == nsGkAtoms::iframe ||
-          localName == nsGkAtoms::noframes ||
-          localName == nsGkAtoms::noembed) {
-        return PR_TRUE;
-      }
-    }
-    aNode = aNode->GetParent();
-  }
-
-  return PR_FALSE;
-}
-
 nsresult
 nsScriptElement::MaybeProcessScript()
 {
   nsCOMPtr<nsIContent> cont =
     do_QueryInterface((nsIScriptElement*) this);
 
   NS_ASSERTION(cont->DebugGetSlots()->mMutationObservers.Contains(this),
                "You forgot to add self as observer");
 
   if (mAlreadyStarted || !mDoneAddingChildren || !cont->IsInDoc() ||
       mMalformed || !HasScriptContent()) {
     return NS_OK;
   }
 
   FreezeUriAsyncDefer();
 
-  if (InNonScriptingContainer(cont)) {
-    // Make sure to flag ourselves as evaluated
-    mAlreadyStarted = PR_TRUE;
-    return NS_OK;
-  }
-
-  nsresult scriptresult = NS_OK;
   nsRefPtr<nsScriptLoader> loader = cont->GetOwnerDoc()->ScriptLoader();
   mAlreadyStarted = PR_TRUE;
-  scriptresult = loader->ProcessScriptElement(this);
+  nsresult scriptresult = loader->ProcessScriptElement(this);
 
   // The only error we don't ignore is NS_ERROR_HTMLPARSER_BLOCK
   // However we don't want to override other success values
   // (such as NS_CONTENT_SCRIPT_IS_EVENTHANDLER)
   if (NS_FAILED(scriptresult) &&
       scriptresult != NS_ERROR_HTMLPARSER_BLOCK) {
     scriptresult = NS_OK;
   }

--- a/content/base/test/test_bug453736.html
+++ b/content/base/test/test_bug453736.html
@@ -8,62 +8,28 @@ https://bugzilla.mozilla.org/show_bug.cg
   <script type="application/javascript" src="/MochiKit/packed.js"></script>
   <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
 </head>
 <body>
 <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=453736">Mozilla Bug 453736</a>
 <p id="display"></p>
 <div id="content" style="display: none">
-
 </div>
 <pre id="test">
 <script type="application/javascript">
-
 /** Test for Bug 453736 **/
 SimpleTest.waitForExplicitFinish();
 addLoadEvent(function() {
   const scriptCreationFuncs = [
     function() { return document.createElement("script"); },
     function() { return document.createElementNS("http://www.w3.org/2000/svg", "script"); }
   ];
 
-  const noScriptContainers = ["iframe", "noframes", "noembed"];
-  for (var i = 0; i < noScriptContainers.length; ++i) {
-    for each (var func in scriptCreationFuncs) {
-      var cont = noScriptContainers[i];
-      var node = document.createElement(cont);
-      document.body.appendChild(node);
-      var s = func();
-      s.setAttribute("type", "application/javascript");
-      s.appendChild(document.createTextNode('window["'+cont+'ScriptRan"] = true'));
-
-      window[cont+"ScriptRan"] = false;
-      document.body.appendChild(s.cloneNode(true));
-      is(window[cont+"ScriptRan"], true,
-         "Clone of non-inserted script created with " + func +" should run");
-   
-      window[cont+"ScriptRan"] = false;
-      node.appendChild(s);
-      is(window[cont+"ScriptRan"], false,
-         "Script created with " + func +" shouldn't run when inserting in <"+cont+">");
-
-      window[cont+"ScriptRan"] = false;
-      document.body.appendChild(s);
-      is(window[cont+"ScriptRan"], false,
-         "Script created with " + func + " shouldn't run when moving out of <"+cont+">");
-
-      window[cont+"ScriptRan"] = false;
-      document.body.appendChild(s.cloneNode(true));
-      is(window[cont+"ScriptRan"], false,
-         "Clone of script inside <" + cont + "> created with " + func + " shouldn't run");
-    }
-  }
-
-  const scriptContainers = ["div"];
+  const scriptContainers = ["div", "iframe", "noframes", "noembed"];
   for (var i = 0; i < scriptContainers.length; ++i) {
     for each (var func in scriptCreationFuncs) {
       var cont = scriptContainers[i];
       var node = document.createElement(cont);
       document.body.appendChild(node);
       var s = func();
       s.setAttribute("type", "application/javascript");
       s.appendChild(document.createTextNode('window["'+cont+'ScriptRan"] = true'));
@@ -82,16 +48,12 @@ addLoadEvent(function() {
       document.body.appendChild(s.cloneNode(true));
       is(window[cont+"ScriptRan"], false,
          "Clone of script inside <" + cont + "> created with " + func + " shouldn't run");
     }
   }
 
   SimpleTest.finish();
 });
-
-
-
-
 </script>
 </pre>
 </body>
 </html>

--- a/content/canvas/src/DocumentRendererChild.cpp
+++ b/content/canvas/src/DocumentRendererChild.cpp
@@ -59,62 +59,28 @@
 using namespace mozilla::ipc;
 
 DocumentRendererChild::DocumentRendererChild()
 {}
 
 DocumentRendererChild::~DocumentRendererChild()
 {}
 
-static void
-FlushLayoutForTree(nsIDOMWindow* aWindow)
-{
-    nsCOMPtr<nsPIDOMWindow> piWin = do_QueryInterface(aWindow);
-    if (!piWin)
-        return;
-
-    // Note that because FlushPendingNotifications flushes parents, this
-    // is O(N^2) in docshell tree depth.  However, the docshell tree is
-    // usually pretty shallow.
-
-    nsCOMPtr<nsIDOMDocument> domDoc;
-    aWindow->GetDocument(getter_AddRefs(domDoc));
-    nsCOMPtr<nsIDocument> doc = do_QueryInterface(domDoc);
-    if (doc) {
-        doc->FlushPendingNotifications(Flush_Layout);
-    }
-
-    nsCOMPtr<nsIDocShellTreeNode> node =
-        do_QueryInterface(piWin->GetDocShell());
-    if (node) {
-        PRInt32 i = 0, i_end;
-        node->GetChildCount(&i_end);
-        for (; i < i_end; ++i) {
-            nsCOMPtr<nsIDocShellTreeItem> item;
-            node->GetChildAt(i, getter_AddRefs(item));
-            nsCOMPtr<nsIDOMWindow> win = do_GetInterface(item);
-            if (win) {
-                FlushLayoutForTree(win);
-            }
-        }
-    }
-}
-
 bool
 DocumentRendererChild::RenderDocument(nsIDOMWindow *window,
                                       const nsRect& documentRect,
                                       const gfxMatrix& transform,
                                       const nsString& bgcolor,
                                       PRUint32 renderFlags,
                                       PRBool flushLayout, 
                                       const nsIntSize& renderSize,
                                       nsCString& data)
 {
     if (flushLayout)
-        FlushLayoutForTree(window);
+        nsContentUtils::FlushLayoutForTree(window);
 
     nsCOMPtr<nsPresContext> presContext;
     nsCOMPtr<nsPIDOMWindow> win = do_QueryInterface(window);
     if (win) {
         nsIDocShell* docshell = win->GetDocShell();
         if (docshell) {
             docshell->GetPresContext(getter_AddRefs(presContext));
         }

--- a/content/canvas/src/nsCanvasRenderingContext2D.cpp
+++ b/content/canvas/src/nsCanvasRenderingContext2D.cpp
@@ -3557,51 +3557,16 @@ nsCanvasRenderingContext2D::GetGlobalCom
     else CANVAS_OP_TO_THEBES_OP("xor", XOR)
     else return NS_ERROR_FAILURE;
 
 #undef CANVAS_OP_TO_THEBES_OP
 
     return NS_OK;
 }
 
-
-static void
-FlushLayoutForTree(nsIDOMWindow* aWindow)
-{
-    nsCOMPtr<nsPIDOMWindow> piWin = do_QueryInterface(aWindow);
-    if (!piWin)
-        return;
-
-    // Note that because FlushPendingNotifications flushes parents, this
-    // is O(N^2) in docshell tree depth.  However, the docshell tree is
-    // usually pretty shallow.
-
-    nsCOMPtr<nsIDOMDocument> domDoc;
-    aWindow->GetDocument(getter_AddRefs(domDoc));
-    nsCOMPtr<nsIDocument> doc = do_QueryInterface(domDoc);
-    if (doc) {
-        doc->FlushPendingNotifications(Flush_Layout);
-    }
-
-    nsCOMPtr<nsIDocShellTreeNode> node =
-        do_QueryInterface(piWin->GetDocShell());
-    if (node) {
-        PRInt32 i = 0, i_end;
-        node->GetChildCount(&i_end);
-        for (; i < i_end; ++i) {
-            nsCOMPtr<nsIDocShellTreeItem> item;
-            node->GetChildAt(i, getter_AddRefs(item));
-            nsCOMPtr<nsIDOMWindow> win = do_GetInterface(item);
-            if (win) {
-                FlushLayoutForTree(win);
-            }
-        }
-    }
-}
-
 NS_IMETHODIMP
 nsCanvasRenderingContext2D::DrawWindow(nsIDOMWindow* aWindow, float aX, float aY,
                                        float aW, float aH,
                                        const nsAString& aBGColor,
                                        PRUint32 flags)
 {
     NS_ENSURE_ARG(aWindow != nsnull);
 
@@ -3620,17 +3585,17 @@ nsCanvasRenderingContext2D::DrawWindow(n
     if (!nsContentUtils::IsCallerTrustedForRead()) {
       // not permitted to use DrawWindow
       // XXX ERRMSG we need to report an error to developers here! (bug 329026)
         return NS_ERROR_DOM_SECURITY_ERR;
     }
 
     // Flush layout updates
     if (!(flags & nsIDOMCanvasRenderingContext2D::DRAWWINDOW_DO_NOT_FLUSH))
-        FlushLayoutForTree(aWindow);
+        nsContentUtils::FlushLayoutForTree(aWindow);
 
     nsRefPtr<nsPresContext> presContext;
     nsCOMPtr<nsPIDOMWindow> win = do_QueryInterface(aWindow);
     if (win) {
         nsIDocShell* docshell = win->GetDocShell();
         if (docshell) {
             docshell->GetPresContext(getter_AddRefs(presContext));
         }

--- a/content/html/content/src/nsHTMLCanvasElement.cpp
+++ b/content/html/content/src/nsHTMLCanvasElement.cpp
@@ -368,18 +368,17 @@ nsHTMLCanvasElement::MozGetAsFileImpl(co
 }
 
 nsresult
 nsHTMLCanvasElement::GetContextHelper(const nsAString& aContextId,
                                       nsICanvasRenderingContextInternal **aContext)
 {
   NS_ENSURE_ARG(aContext);
 
-  nsCString ctxId;
-  ctxId.Assign(NS_LossyConvertUTF16toASCII(aContextId));
+  NS_LossyConvertUTF16toASCII ctxId(aContextId);
 
   // check that ctxId is clamped to A-Za-z0-9_-
   for (PRUint32 i = 0; i < ctxId.Length(); i++) {
     if ((ctxId[i] < 'A' || ctxId[i] > 'Z') &&
         (ctxId[i] < 'a' || ctxId[i] > 'z') &&
         (ctxId[i] < '0' || ctxId[i] > '9') &&
         (ctxId[i] != '-') &&
         (ctxId[i] != '_'))

--- a/content/html/content/src/nsHTMLInputElement.cpp
+++ b/content/html/content/src/nsHTMLInputElement.cpp
@@ -16,16 +16,17 @@
  *
  * The Initial Developer of the Original Code is
  * Netscape Communications Corporation.
  * Portions created by the Initial Developer are Copyright (C) 1998
  * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
  *   Pierre Phaneuf <pp@ludusdesign.com>
+ *   Geoff Lankow <geoff@darktrojan.net>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either of the GNU General Public License Version 2 or later (the "GPL"),
  * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
  * in which case the provisions of the GPL or the LGPL are applicable instead
  * of those above. If you wish to allow use of your version of this file only
  * under the terms of either the GPL or the LGPL, and not to allow others to
  * use your version of this file under the terms of the MPL, indicate your
@@ -535,16 +536,19 @@ UploadLastDir::FetchLastUsedDirectory(ns
 
 nsresult
 UploadLastDir::StoreLastUsedDirectory(nsIURI* aURI, nsILocalFile* aFile)
 {
   NS_PRECONDITION(aURI, "aURI is null");
   NS_PRECONDITION(aFile, "aFile is null");
   nsCOMPtr<nsIFile> parentFile;
   aFile->GetParent(getter_AddRefs(parentFile));
+  if (!parentFile) {
+    return NS_OK;
+  }
   nsCOMPtr<nsILocalFile> localFile = do_QueryInterface(parentFile);
 
   // Store the data in memory instead of the CPS during private browsing mode
   if (mInPrivateBrowsing) {
     nsCOMPtr<nsIContentURIGrouper> hostnameGrouperService =
       do_GetService(NS_HOSTNAME_GROUPER_SERVICE_CONTRACTID);
     if (!hostnameGrouperService)
       return NS_ERROR_NOT_AVAILABLE;

--- a/content/html/content/src/nsHTMLSelectElement.cpp
+++ b/content/html/content/src/nsHTMLSelectElement.cpp
@@ -1212,18 +1212,17 @@ nsHTMLSelectElement::SetValue(const nsAS
   return rv;
 }
 
 
 NS_IMPL_BOOL_ATTR(nsHTMLSelectElement, Autofocus, autofocus)
 NS_IMPL_BOOL_ATTR(nsHTMLSelectElement, Disabled, disabled)
 NS_IMPL_BOOL_ATTR(nsHTMLSelectElement, Multiple, multiple)
 NS_IMPL_STRING_ATTR(nsHTMLSelectElement, Name, name)
-NS_IMPL_POSITIVE_INT_ATTR_DEFAULT_VALUE(nsHTMLSelectElement, Size, size,
-                                        GetDefaultSize())
+NS_IMPL_POSITIVE_INT_ATTR_DEFAULT_VALUE(nsHTMLSelectElement, Size, size, 0)
 NS_IMPL_INT_ATTR(nsHTMLSelectElement, TabIndex, tabindex)
 
 NS_IMETHODIMP
 nsHTMLSelectElement::Blur()
 {
   return nsGenericHTMLElement::Blur();
 }
 

--- a/content/html/content/src/nsHTMLSelectElement.h
+++ b/content/html/content/src/nsHTMLSelectElement.h
@@ -490,24 +490,16 @@ protected:
   void VerifyOptionsArray();
 #endif
 
   virtual PRBool AcceptAutofocus() const
   {
     return PR_TRUE;
   }
 
-  /**
-   * Helper method to get the default size.
-   */
-  PRInt32 GetDefaultSize() const
-  {
-    return HasAttr(kNameSpaceID_None, nsGkAtoms::multiple) ? 4 : 1;
-  }
-
   /** The options[] array */
   nsRefPtr<nsHTMLOptionCollection> mOptions;
   /** false if the parser is in the middle of adding children. */
   PRPackedBool    mIsDoneAddingChildren;
   /** true if our disabled state has changed from the default **/
   PRPackedBool    mDisabledChanged;
   /** true if child nodes are being added or removed.
    *  Used by nsSafeOptionListMutation.

--- a/content/html/content/test/Makefile.in
+++ b/content/html/content/test/Makefile.in
@@ -235,12 +235,13 @@ include $(topsrcdir)/config/rules.mk
 		test_bug596350.html \
 		test_bug600155.html \
 		test_bug556007.html \
 		test_bug606817.html \
 		test_bug297761.html \
 		file_bug297761.html \
 		test_bug607145.html \
 		test_bug601061.html \
+		reflect.js \
 		$(NULL)
 
 libs:: $(_TEST_FILES)
 	$(INSTALL) $(foreach f,$^,"$f") $(DEPTH)/_tests/testing/mochitest/tests/$(relativesrcdir)

copy from content/html/content/test/test_bug601061.html
copy to content/html/content/test/reflect.js
--- a/content/html/content/test/test_bug601061.html
+++ b/content/html/content/test/reflect.js
@@ -1,27 +1,12 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=601061
--->
-<head>
-  <title>Test for Bug 601061</title>
-  <script type="application/javascript" src="/MochiKit/packed.js"></script>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=601061">Mozilla Bug 601061</a>
-<p id="display"></p>
-<pre id="test">
-<script type="application/javascript">
-
-/** Test for Bug 601061 **/
-
+/**
+ * Checks that a given attribute name for a given element is correctly reflected
+ * as an unsigned int.
+ */
 function reflectUnsignedInt(aElement, aAttr, aNonNull, aDefault)
 {
   function checkGetter(aElement, aAttr, aValue)
   {
     is(aElement[aAttr], aValue, "." + aAttr + " should be equals " + aValue);
     is(aElement.getAttribute(aAttr), aValue,
        "@" + aAttr + " should be equals " + aValue);
   }
@@ -103,16 +88,8 @@ function reflectUnsignedInt(aElement, aA
   is(aElement.getAttribute(aAttr), 0, "@" + aAttr + " should be equals to 0");
   if (aNonNull) {
     is(aElement[aAttr], aDefault,
        "." + aAttr + " should be equals to " + aDefault);
   } else {
     is(aElement[aAttr], 0, "." + aAttr + " should be equals to 0");
   }
 }
-
-var input = document.createElement("input");
-reflectUnsignedInt(input, "size", true, 20);
-
-</script>
-</pre>
-</body>
-</html>

--- a/content/html/content/test/test_bug551846.html
+++ b/content/html/content/test/test_bug551846.html
@@ -117,43 +117,43 @@ function checkSetSizeException(element)
     caught = true;
   }
   ok(!caught, "Setting an invalid size in the content attribute shouldn't throw an exception");
 
   // reverting to defalut
   element.removeAttribute('size');
 }
 
-function checkSizeWhenChangeMultiple(element)
+function checkSizeWhenChangeMultiple(element, aDefaultNonMultiple, aDefaultMultiple)
 {
   s.setAttribute('size', -1)
-  is(s.size, 1, "Size IDL attribute should be 1");
+  is(s.size, aDefaultNonMultiple, "Size IDL attribute should be 1");
 
   s.multiple = true;
-  is(s.size, 4, "Size IDL attribute should be 4");
+  is(s.size, aDefaultMultiple, "Size IDL attribute should be 4");
 
   is(s.getAttribute('size'), -1, "Size content attribute should be -1");
 
   s.setAttribute('size', -2);
-  is(s.size, 4, "Size IDL attribute should be 4");
+  is(s.size, aDefaultMultiple, "Size IDL attribute should be 4");
 
   s.multiple = false;
-  is(s.size, 1, "Size IDL attribute should be 1");
+  is(s.size, aDefaultNonMultiple, "Size IDL attribute should be 1");
 
   is(s.getAttribute('size'), -2, "Size content attribute should be -2");
 }
 
 var s = document.getElementById('s');
 
-checkSizeReflection(s, 1);
+checkSizeReflection(s, 0);
 checkSetSizeException(s);
 
 s.setAttribute('multiple', 'true');
-checkSizeReflection(s, 4);
+checkSizeReflection(s, 0);
 checkSetSizeException(s);
 s.removeAttribute('multiple');
 
-checkSizeWhenChangeMultiple(s);
+checkSizeWhenChangeMultiple(s, 0, 0);
 
 </script>
 </pre>
 </body>
 </html>

--- a/content/html/content/test/test_bug601061.html
+++ b/content/html/content/test/test_bug601061.html
@@ -2,117 +2,25 @@
 <html>
 <!--
 https://bugzilla.mozilla.org/show_bug.cgi?id=601061
 -->
 <head>
   <title>Test for Bug 601061</title>
   <script type="application/javascript" src="/MochiKit/packed.js"></script>
   <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="reflect.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
 </head>
 <body>
 <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=601061">Mozilla Bug 601061</a>
 <p id="display"></p>
 <pre id="test">
 <script type="application/javascript">
 
 /** Test for Bug 601061 **/
 
-function reflectUnsignedInt(aElement, aAttr, aNonNull, aDefault)
-{
-  function checkGetter(aElement, aAttr, aValue)
-  {
-    is(aElement[aAttr], aValue, "." + aAttr + " should be equals " + aValue);
-    is(aElement.getAttribute(aAttr), aValue,
-       "@" + aAttr + " should be equals " + aValue);
-  }
-
-  if (!aDefault) {
-    if (aNonNull) {
-      aDefault = 1;
-    } else {
-      aDefault = 0;
-    }
-  }
-
-  // Check default value.
-  is(aElement[aAttr], aDefault, "default value should be " + aDefault);
-  ok(!aElement.hasAttribute(aAttr), aAttr + " shouldn't be present");
-
-  var values = [ 1, 3, 42, 2147483647 ];
-
-  for each (var value in values) {
-    aElement[aAttr] = value;
-    checkGetter(aElement, aAttr, value);
-  }
-
-  for each (var value in values) {
-    aElement.setAttribute(aAttr, value);
-    checkGetter(aElement, aAttr, value);
-  }
-
-  // -3000000000 is equivalent to 1294967296 when using the IDL attribute.
-  aElement[aAttr] = -3000000000;
-  checkGetter(aElement, aAttr, 1294967296);
-  // When setting the content atribute, it's a string so it will be unvalid.
-  aElement.setAttribute(aAttr, -3000000000);
-  is(aElement.getAttribute(aAttr), -3000000000,
-     "@" + aAttr + " should be equals to " + -3000000000);
-  is(aElement[aAttr], aDefault,
-     "." + aAttr + " should be equals to " + aDefault);
-
-  var nonValidValues = [
-    /* invalid value, value in the unsigned int range */
-    [ -2147483648, 2147483648 ],
-    [ -1,          4294967295 ],
-    [ 3147483647,  3147483647 ],
-  ];
-
-  for each (var values in nonValidValues) {
-    aElement[aAttr] = values[0];
-    is(aElement.getAttribute(aAttr), values[1],
-       "@" + aAttr + " should be equals to " + values[1]);
-    is(aElement[aAttr], aDefault,
-       "." + aAttr + " should be equals to " + aDefault);
-  }
-
-  for each (var values in nonValidValues) {
-    aElement.setAttribute(aAttr, values[0]);
-    is(aElement.getAttribute(aAttr), values[0],
-       "@" + aAttr + " should be equals to " + values[0]);
-    is(aElement[aAttr], aDefault,
-       "." + aAttr + " should be equals to " + aDefault);
-  }
-
-  // Setting to 0 should throw an error if aNonNull is true.
-  var caught = false;
-  try {
-    aElement[aAttr] = 0;
-  } catch(e) {
-    caught = true;
-    is(e.code, DOMException.INDEX_SIZE_ERR, "exception should be INDEX_SIZE_ERR");
-  }
-
-  if (aNonNull) {
-    ok(caught, "an exception should have been caught");
-  } else {
-    ok(!caught, "no exception should have been caught");
-  }
-
-  // If 0 is set in @aAttr, it will be ignored when calling .aAttr.
-  aElement.setAttribute(aAttr, 0);
-  is(aElement.getAttribute(aAttr), 0, "@" + aAttr + " should be equals to 0");
-  if (aNonNull) {
-    is(aElement[aAttr], aDefault,
-       "." + aAttr + " should be equals to " + aDefault);
-  } else {
-    is(aElement[aAttr], 0, "." + aAttr + " should be equals to 0");
-  }
-}
-
-var input = document.createElement("input");
-reflectUnsignedInt(input, "size", true, 20);
+reflectUnsignedInt(document.createElement("input"), "size", true, 20);
 
 </script>
 </pre>
 </body>
 </html>

--- a/content/media/test/test_timeupdate_seek.html
+++ b/content/media/test/test_timeupdate_seek.html
@@ -15,59 +15,64 @@
 // WHATWG spec.
 //
 // http://www.whatwg.org/specs/web-apps/current-work/multipage/video.html#seeking
 
 var manager = new MediaTestManager;
 
 function do_loadedmetadata(e) {
   var v = e.target;
-  if (e._finished)
+  if (v._finished)
     return false;
 
-  v._seekTime = Math.round(v.duration / 2);
-  v.currentTime=v._seekTime;
+  var duration = v.duration;
+  v._seekTime = Math.round(duration / 2);
+  ok(!isNaN(duration), v._name + ": duration must be non NaN");
+  ok(v._seekTime >= 0.0, v._name + ": must have non-negative seek target");
+  ok(!isNaN(v._seekTime), v._name + ": seek target must be non NaN");
+  v.currentTime = v._seekTime;
   return false;
 }
 
 function do_seeking(e) {
   var v = e.target;
   if (v._finished)
     return false;
 
   v._seeking = true;
   ok(v.currentTime == v._seekTime,
-     "Check currentTime of " + v.currentTime +
-     " is requested seek time of " + v._seekTime +
-     " in " + v._name);
+      v._name + ": currentTime of " + v.currentTime +
+     " should be requested seek time of " + v._seekTime);
   return false;
 }
 
 function do_timeupdate(e) {
   var v = e.target;
   if (v._finished)
     return false;
 
   ok(v.currentTime == v._seekTime,
-     "Check currentTime of " + v.currentTime +
-     " is requested seek time of " + v._seekTime +
-     " in " + v._name);
-  v._finished= true;
+      v._name + ": currentTime of " + v.currentTime +
+     " should be  requested seek time of " + v._seekTime);
+  v._finished = true;
   v.pause();
   v.parentNode.removeChild(v);
+  v.src = "";
+  ok(true, v._name + ": finished");
   manager.finished(v.token);
   return false;
 }
 
 function startTest(test, token) {
   var type = /^video/.test(test.type) ? "video" : "audio";
   var v = document.createElement(type);
   v.token = token;
   manager.started(token);
   v.src = test.name;
+  ok(true, test.name + ": started");
   v._name = test.name;
   v._seeking = false;
   v._finished = false;
   v.addEventListener("loadedmetadata", do_loadedmetadata, false);
   v.addEventListener("seeking", do_seeking, false);
   v.addEventListener("timeupdate", do_timeupdate, false);
   document.body.appendChild(v);
 }

new file mode 100644
--- /dev/null
+++ b/content/smil/crashtests/572938-1.svg
@@ -0,0 +1,12 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+  xmlns:xlink="http://www.w3.org/1999/xlink">
+  <defs>
+    <text id="myText">Used Text Element
+      <set attributeName="display" to="none"/>
+    </text>
+  </defs>
+  <use xlink:href="#myText" x="20" y="40"/>
+  <text x="20" y="60">Normal Text Element
+    <set attributeName="display" to="none"/>
+  </text>
+</svg>

new file mode 100644
--- /dev/null
+++ b/content/smil/crashtests/572938-2.svg
@@ -0,0 +1,22 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+  xmlns:xlink="http://www.w3.org/1999/xlink"
+  class="reftest-wait">
+
+    <script>
+    function boom()
+    {
+      document.getElementById("circleID").removeChild(
+        document.getElementById("at"));
+      document.documentElement.removeAttribute("class");
+    }
+    window.addEventListener("load", boom, false);
+    </script>
+
+    <circle id="circleID">
+        <animate/>
+        <animateTransform id="at" attributeName="transform"/>
+    </circle>
+    <animate attributeName="stroke-width"/>
+    <use xlink:href="#circleID"/>
+
+</svg>

new file mode 100644
--- /dev/null
+++ b/content/smil/crashtests/572938-3.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+  xmlns:xlink="http://www.w3.org/1999/xlink">
+  <defs>
+    <text id="a">Text A</text>
+    <text id="b">Text B</text>
+  </defs>
+  <use xlink:href="#a" x="20" y="40">
+    <set attributeName="xlink:href" to="#b" dur="2s"/>
+  </use>
+</svg>

new file mode 100644
--- /dev/null
+++ b/content/smil/crashtests/572938-4.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+   xmlns:xlink="http://www.w3.org/1999/xlink">
+<g id="a">
+ <path d=""><animate/></path>
+</g>
+<g display="none">
+<use xlink:href="#a" x="80"/>
+<set attributeName="display" to="inline"/>
+</g>
+</svg>

new file mode 100644
--- /dev/null
+++ b/content/smil/crashtests/605345-1.svg
@@ -0,0 +1,25 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait">
+<script>
+<![CDATA[
+
+function boom()
+{
+  var anim = document.getElementById("a");
+  var newSvg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+  var oldSvg = document.removeChild(document.documentElement);
+  document.appendChild(newSvg);
+  document.removeChild(document.documentElement);
+  newSvg.pauseAnimations();
+  document.appendChild(newSvg);
+  newSvg.appendChild(anim);
+
+  oldSvg.removeAttribute("class");
+}
+
+window.addEventListener("load", function() { setTimeout(boom, 200); }, false);
+
+]]>
+</script>
+<animate id="a"/>
+</svg>

new file mode 100644
--- /dev/null
+++ b/content/smil/crashtests/608549-1.svg
@@ -0,0 +1,29 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait">
+<script>
+<![CDATA[
+
+function boom()
+{
+  try {
+    document.getElementById("set").beginElementAt(NaN);
+    return;
+  } catch (e) {}
+  try {
+    document.getElementById("set").endElementAt(NaN);
+    return;
+  } catch (e) {}
+
+  // If we got here we threw both exceptions and skipped both early-returns, as
+  // expected.
+  document.documentElement.removeAttribute("class");
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+
+<set id="set" attributeName="fill" to="green" begin="indefinite"/>
+
+</svg>

--- a/content/smil/crashtests/crashtests.list
+++ b/content/smil/crashtests/crashtests.list
@@ -11,16 +11,22 @@ load 541297-1.svg
 load 547333-1.svg
 load 548899-1.svg
 load 551620-1.svg
 load 554202-1.svg
 load 554202-2.svg
 load 554141-1.svg
 load 555026-1.svg
 load 556841-1.svg
+load 572938-1.svg
+load 572938-2.svg
+load 572938-3.svg
+load 572938-4.svg
 load 588287-1.svg
 load 588287-2.svg
 load 590425-1.html
 load 592477-1.xhtml
 load 594653-1.svg
 load 596796-1.svg
+load 605345-1.svg
 load 606101-1.svg
+load 608549-1.svg
 load 608295-1.html

--- a/content/smil/nsSMILAnimationController.cpp
+++ b/content/smil/nsSMILAnimationController.cpp
@@ -69,19 +69,17 @@ GetRefreshDriverForDoc(nsIDocument* aDoc
 }
 
 //----------------------------------------------------------------------
 // ctors, dtors, factory methods
 
 nsSMILAnimationController::nsSMILAnimationController()
   : mResampleNeeded(PR_FALSE),
     mDeferredStartSampling(PR_FALSE),
-#ifdef DEBUG
     mRunningSample(PR_FALSE),
-#endif
     mDocument(nsnull)
 {
   mAnimationElementTable.Init();
   mChildContainerTable.Init();
 }
 
 nsSMILAnimationController::~nsSMILAnimationController()
 {
@@ -184,17 +182,16 @@ nsSMILAnimationController::WillRefresh(m
 
 //----------------------------------------------------------------------
 // Animation element registration methods:
 
 void
 nsSMILAnimationController::RegisterAnimationElement(
                                   nsISMILAnimationElement* aAnimationElement)
 {
-  NS_ASSERTION(!mRunningSample, "Registering content during sample.");
   mAnimationElementTable.PutEntry(aAnimationElement);
   if (mDeferredStartSampling) {
     mDeferredStartSampling = PR_FALSE;
     if (mChildContainerTable.Count()) {
       // mAnimationElementTable was empty, but now we've added its 1st element
       NS_ABORT_IF_FALSE(mAnimationElementTable.Count() == 1,
                         "we shouldn't have deferred sampling if we already had "
                         "animations registered");
@@ -202,17 +199,16 @@ nsSMILAnimationController::RegisterAnima
     } // else, don't sample until a time container is registered (via AddChild)
   }
 }
 
 void
 nsSMILAnimationController::UnregisterAnimationElement(
                                   nsISMILAnimationElement* aAnimationElement)
 {
-  NS_ASSERTION(!mRunningSample, "Unregistering content during sample.");
   mAnimationElementTable.RemoveEntry(aAnimationElement);
 }
 
 //----------------------------------------------------------------------
 // Page show/hide
 
 void
 nsSMILAnimationController::OnPageShow()
@@ -357,26 +353,21 @@ void
 nsSMILAnimationController::DoSample()
 {
   DoSample(PR_TRUE); // Skip unchanged time containers
 }
 
 void
 nsSMILAnimationController::DoSample(PRBool aSkipUnchangedContainers)
 {
-  // Reset resample flag -- do this before flushing styles since flushing styles
-  // will also flush animation resample requests
   mResampleNeeded = PR_FALSE;
+  // Set running sample flag -- do this before flushing styles so that when we
+  // flush styles we don't end up requesting extra samples
+  mRunningSample = PR_TRUE;
   mDocument->FlushPendingNotifications(Flush_Style);
-#ifdef DEBUG
-  mRunningSample = PR_TRUE;
-#endif
-  // Reset resample flag again -- flushing styles may have set this flag but
-  // since we're about to do a sample now, reset it
-  mResampleNeeded = PR_FALSE;
 
   // STEP 1: Bring model up to date
   // (i)  Rewind elements where necessary
   // (ii) Run milestone samples
   RewindElements();
   DoMilestoneSamples();
 
   // STEP 2: Sample the child time containers
@@ -440,19 +431,17 @@ nsSMILAnimationController::DoSample(PRBo
   }
 
   // STEP 5: Compose currently-animated attributes.
   // XXXdholbert: This step traverses our animation targets in an effectively
   // random order. For animation from/to 'inherit' values to work correctly
   // when the inherited value is *also* being animated, we really should be
   // traversing our animated nodes in an ancestors-first order (bug 501183)
   currentCompositorTable->EnumerateEntries(DoComposeAttribute, nsnull);
-#ifdef DEBUG
   mRunningSample = PR_FALSE;
-#endif
 
   // Update last compositor table
   mLastCompositorTable = currentCompositorTable.forget();
 
   NS_ASSERTION(!mResampleNeeded, "Resample dirty flag set during sample!");
 }
 
 void

--- a/content/smil/nsSMILAnimationController.h
+++ b/content/smil/nsSMILAnimationController.h
@@ -89,17 +89,22 @@ public:
   // Methods for registering and enumerating animation elements
   void RegisterAnimationElement(nsISMILAnimationElement* aAnimationElement);
   void UnregisterAnimationElement(nsISMILAnimationElement* aAnimationElement);
 
   // Methods for resampling all animations
   // (A resample performs the same operations as a sample but doesn't advance
   // the current time and doesn't check if the container is paused)
   void Resample() { DoSample(PR_FALSE); }
-  void SetResampleNeeded() { mResampleNeeded = PR_TRUE; }
+  void SetResampleNeeded()
+  {
+    if (!mRunningSample) {
+      mResampleNeeded = PR_TRUE;
+    }
+  }
   void FlushResampleRequests()
   {
     if (!mResampleNeeded)
       return;
 
     Resample();
   }
 
@@ -198,19 +203,17 @@ protected:
   TimeContainerHashtable     mChildContainerTable;
   mozilla::TimeStamp         mCurrentSampleTime;
   mozilla::TimeStamp         mStartTime;
   PRPackedBool               mResampleNeeded;
   // If we're told to start sampling but there are no animation elements we just
   // record the time, set the following flag, and then wait until we have an
   // animation element. Then we'll reset this flag and actually start sampling.
   PRPackedBool               mDeferredStartSampling;
-#ifdef DEBUG
   PRPackedBool               mRunningSample;
-#endif
 
   // Store raw ptr to mDocument.  It owns the controller, so controller
   // shouldn't outlive it
   nsIDocument* mDocument;
 
   // Contains compositors used in our last sample.  We keep this around
   // so we can detect when an element/attribute used to be animated,
   // but isn't anymore for some reason. (e.g. if its <animate> element is

--- a/content/smil/nsSMILAnimationFunction.cpp
+++ b/content/smil/nsSMILAnimationFunction.cpp
@@ -241,17 +241,17 @@ nsSMILAnimationFunction::ComposeResult(c
 
   // If this interval is active, we must have a non-negative mSampleTime
   NS_ABORT_IF_FALSE(mSampleTime >= 0 || !mIsActive,
       "Negative sample time for active animation");
   NS_ABORT_IF_FALSE(mSimpleDuration.IsResolved() ||
       mSimpleDuration.IsIndefinite() || mLastValue,
       "Unresolved simple duration for active or frozen animation");
 
-  nsSMILValue result(aResult.mType);
+  nsSMILValue result;
 
   if (mSimpleDuration.IsIndefinite() ||
       (values.Length() == 1 && TreatSingleValueAsStatic())) {
     // Indefinite duration or only one value set: Always set the first value
     result = values[0];
 
   } else if (mLastValue) {
 
@@ -397,25 +397,29 @@ nsSMILAnimationFunction::InterpolateResu
   if (calcMode != CALC_DISCRETE) {
     // Get the normalised progress between adjacent values
     const nsSMILValue* from = nsnull;
     const nsSMILValue* to = nsnull;
     // Init to -1 to make sure that if we ever forget to set this, the
     // NS_ABORT_IF_FALSE that tests that intervalProgress is in range will fail.
     double intervalProgress = -1.f;
     if (IsToAnimation()) {
-      from = &aBaseValue;
-      to = &aValues[0];
-      if (calcMode == CALC_PACED) {
-        // Note: key[Times/Splines/Points] are ignored for calcMode="paced"
-        intervalProgress = simpleProgress;
+      if (aBaseValue.IsNull()) {
+        rv = NS_ERROR_FAILURE;
       } else {
-        double scaledSimpleProgress =
-          ScaleSimpleProgress(simpleProgress, calcMode);
-        intervalProgress = ScaleIntervalProgress(scaledSimpleProgress, 0);
+        from = &aBaseValue;
+        to = &aValues[0];
+        if (calcMode == CALC_PACED) {
+          // Note: key[Times/Splines/Points] are ignored for calcMode="paced"
+          intervalProgress = simpleProgress;
+        } else {
+          double scaledSimpleProgress =
+            ScaleSimpleProgress(simpleProgress, calcMode);
+          intervalProgress = ScaleIntervalProgress(scaledSimpleProgress, 0);
+        }
       }
     } else {
       if (calcMode == CALC_PACED) {
         rv = ComputePacedPosition(aValues, simpleProgress,
                                   intervalProgress, from, to);
         // Note: If the above call fails, we'll skip the "from->Interpolate"
         // call below, and we'll drop into the CALC_DISCRETE section
         // instead. (as the spec says we should, because our failure was

--- a/content/smil/nsSMILAnimationFunction.h
+++ b/content/smil/nsSMILAnimationFunction.h
@@ -196,17 +196,17 @@ public:
   /**
    * Indicates if this animation will replace the passed in result rather than
    * adding to it. Animations that replace the underlying value may be called
    * without first calling lower priority animations.
    *
    * @return  True if the animation will replace, false if it will add or
    *          otherwise build on the passed in value.
    */
-  PRBool WillReplace() const;
+  virtual PRBool WillReplace() const;
 
   /**
    * Indicates if the parameters for this animation have changed since the last
    * time it was composited. This allows rendering to be performed only when
    * necessary, particularly when no animations are active.
    *
    * Note that the caller is responsible for determining if the animation
    * target has changed (with help from my UpdateCachedTarget() method).

--- a/content/smil/nsSMILCSSProperty.cpp
+++ b/content/smil/nsSMILCSSProperty.cpp
@@ -97,28 +97,31 @@ nsSMILCSSProperty::nsSMILCSSProperty(nsC
 nsSMILValue
 nsSMILCSSProperty::GetBaseValue() const
 {
   // To benefit from Return Value Optimization and avoid copy constructor calls
   // due to our use of return-by-value, we must return the exact same object
   // from ALL return points. This function must only return THIS variable:
   nsSMILValue baseValue;
 
-  // SPECIAL CASE: Shorthands
-  if (nsCSSProps::IsShorthand(mPropID)) {
+  // SPECIAL CASE: (a) Shorthands
+  //               (b) 'display'
+  if (nsCSSProps::IsShorthand(mPropID) || mPropID == eCSSProperty_display) {
     // We can't look up the base (computed-style) value of shorthand
-    // properties, because they aren't guaranteed to have a consistent computed
-    // value.  However, that's not a problem, because it turns out the caller
-    // isn't going to end up using the value we return anyway. Base values only
-    // get used when there's interpolation or addition, and the shorthand
-    // properties we know about don't support those operations. So, we can just
-    // return a dummy value (initialized with the right type, so as not to
-    // indicate failure).
-    nsSMILValue tmpVal(&nsSMILCSSValueType::sSingleton);
-    baseValue.Swap(tmpVal);
+    // properties because they aren't guaranteed to have a consistent computed
+    // value.
+    //
+    // Also, although we can look up the base value of the display property,
+    // doing so involves clearing and resetting the property which can cause
+    // frames to be recreated which we'd like to avoid.
+    //
+    // In either case, simply returning a null-typed nsSMILValue to indicate
+    // failure is acceptable because the caller only uses base values when
+    // there's interpolation or addition, and for both the shorthand properties
+    // we know about and the display property those operations aren't supported.
     return baseValue;
   }
 
   // GENERAL CASE: Non-Shorthands
   // (1) Put empty string in override style for property mPropID
   // (saving old override style value, so we can set it again when we're done)
   nsCOMPtr<nsIDOMCSSStyleDeclaration> overrideStyle;
   mElement->GetSMILOverrideStyle(getter_AddRefs(overrideStyle));

--- a/content/smil/nsSMILCompositor.cpp
+++ b/content/smil/nsSMILCompositor.cpp
@@ -103,32 +103,35 @@ nsSMILCompositor::ComposeAttribute()
   nsSMILAnimationFunction::Comparator comparator;
   mAnimationFunctions.Sort(comparator);
 
   // THIRD: Step backwards through animation functions to find out
   // which ones we actually care about.
   PRUint32 firstFuncToCompose = GetFirstFuncToAffectSandwich();
 
   // FOURTH: Get & cache base value
-  nsSMILValue sandwichResultValue = smilAttr->GetBaseValue();
-  if (sandwichResultValue.IsNull()) {
-    NS_WARNING("nsISMILAttr::GetBaseValue failed");
-    return;
+  nsSMILValue sandwichResultValue;
+  if (!mAnimationFunctions[firstFuncToCompose]->WillReplace()) {
+    sandwichResultValue = smilAttr->GetBaseValue();
   }
   UpdateCachedBaseValue(sandwichResultValue);
 
   if (!mForceCompositing) {
     return;
   }
 
   // FIFTH: Compose animation functions
   PRUint32 length = mAnimationFunctions.Length();
   for (PRUint32 i = firstFuncToCompose; i < length; ++i) {
     mAnimationFunctions[i]->ComposeResult(*smilAttr, sandwichResultValue);
   }
+  if (sandwichResultValue.IsNull()) {
+    smilAttr->ClearAnimValue();
+    return;
+  }
 
   // SIXTH: Set the animated value to the final composited result.
   nsresult rv = smilAttr->SetAnimValue(sandwichResultValue);
   if (NS_FAILED(rv)) {
     NS_WARNING("nsISMILAttr::SetAnimValue failed");
   }
 }
 

--- a/content/smil/nsSMILSetAnimationFunction.cpp
+++ b/content/smil/nsSMILSetAnimationFunction.cpp
@@ -119,8 +119,14 @@ PRBool
 nsSMILSetAnimationFunction::GetAttr(nsIAtom* aAttName,
                                     nsAString& aResult) const
 {
   if (IsDisallowedAttribute(aAttName))
     return nsnull;
 
   return nsSMILAnimationFunction::GetAttr(aAttName, aResult);
 }
+
+PRBool
+nsSMILSetAnimationFunction::WillReplace() const
+{
+  return PR_TRUE;
+}

--- a/content/smil/nsSMILSetAnimationFunction.h
+++ b/content/smil/nsSMILSetAnimationFunction.h
@@ -79,13 +79,14 @@ protected:
   // that value whenever the animation is active (no interpolation or anything).
   NS_OVERRIDE virtual PRBool TreatSingleValueAsStatic() const {
     return PR_TRUE;
   }
   NS_OVERRIDE virtual PRBool             HasAttr(nsIAtom* aAttName) const;
   NS_OVERRIDE virtual const nsAttrValue* GetAttr(nsIAtom* aAttName) const;
   NS_OVERRIDE virtual PRBool             GetAttr(nsIAtom* aAttName,
                                                  nsAString& aResult) const;
+  NS_OVERRIDE virtual PRBool WillReplace() const;
 
   PRBool IsDisallowedAttribute(const nsIAtom* aAttribute) const;
 };
 
 #endif // NS_SMILSETANIMATIONFUNCTION_H_

--- a/content/smil/nsSMILTimeContainer.cpp
+++ b/content/smil/nsSMILTimeContainer.cpp
@@ -210,16 +210,24 @@ nsSMILTimeContainer::Sample()
   mNeedsPauseSample = PR_FALSE;
 }
 
 nsresult
 nsSMILTimeContainer::SetParent(nsSMILTimeContainer* aParent)
 {
   if (mParent) {
     mParent->RemoveChild(*this);
+    // When we're not attached to a parent time container, GetParentTime() will
+    // return 0. We need to adjust our pause state information to be relative to
+    // this new time base.
+    // Note that since "current time = parent time - parent offset" setting the
+    // parent offset and pause start as follows preserves our current time even
+    // while parent time = 0.
+    mParentOffset = -mCurrentTime;
+    mPauseStart = 0L;
   }
 
   mParent = aParent;
 
   nsresult rv = NS_OK;
   if (mParent) {
     rv = mParent->AddChild(*this);
   }
@@ -309,16 +317,17 @@ nsSMILTimeContainer::Unlink()
   mMilestoneEntries.Clear();
 }
 
 void
 nsSMILTimeContainer::UpdateCurrentTime()
 {
   nsSMILTime now = IsPaused() ? mPauseStart : GetParentTime();
   mCurrentTime = now - mParentOffset;
+  NS_ABORT_IF_FALSE(mCurrentTime >= 0, "Container has negative time");
 }
 
 void
 nsSMILTimeContainer::NotifyTimeChange()
 {
   // Called when the container time is changed with respect to the document
   // time. When this happens time dependencies in other time containers need to
   // re-resolve their times because begin and end times are stored in container

--- a/content/smil/nsSMILTimedElement.cpp
+++ b/content/smil/nsSMILTimedElement.cpp
@@ -1099,16 +1099,20 @@ nsSMILTimedElement::IsTimeDependent(cons
     return PR_FALSE;
 
   return thisBegin->IsDependentOn(*otherBegin);
 }
 
 void
 nsSMILTimedElement::BindToTree(nsIContent* aContextNode)
 {
+  // Reset previously registered milestone since we may be registering with
+  // a different time container now.
+  mPrevRegisteredMilestone = sMaxMilestone;
+
   // If we were already active then clear all our timing information and start
   // afresh
   if (mElementState != STATE_STARTUP) {
     mSeekState = SEEK_NOT_SEEKING;
     Rewind();
   }
 
   // Resolve references to other parts of the tree
@@ -1117,18 +1121,16 @@ nsSMILTimedElement::BindToTree(nsIConten
     mBeginSpecs[i]->ResolveReferences(aContextNode);
   }
 
   count = mEndSpecs.Length();
   for (PRUint32 j = 0; j < count; ++j) {
     mEndSpecs[j]->ResolveReferences(aContextNode);
   }
 
-  // Register new milestone
-  mPrevRegisteredMilestone = sMaxMilestone;
   RegisterMilestone();
 }
 
 void
 nsSMILTimedElement::HandleTargetElementChange(Element* aNewTarget)
 {
   PRUint32 count = mBeginSpecs.Length();
   for (PRUint32 i = 0; i < count; ++i) {

--- a/content/smil/test/smilAnimateMotionValueLists.js
+++ b/content/smil/test/smilAnimateMotionValueLists.js
@@ -108,17 +108,23 @@ const gInvalidToBy = [
 const gValidPath = [
  "m0 0     L30 30",
  "M20,20L10    10",
  "M20,20 L30, 30h20",
  "m50 50", "M50 50",
  "m0 0", "M0, 0"
 ];
 
+// paths must start with at least a valid "M" segment to be valid
 const gInvalidPath = [
- "m0 0 L30,,30",
- "M20 20em",
  "M20in 20",
  "h30",
  "L50 50",
  "abc",
+];
+
+// paths that at least start with a valid "M" segment are valid - the spec says
+// to parse everything up to the first invalid token
+const gValidPathWithErrors = [
+ "M20 20em",
+ "m0 0 L30,,30",
  "M10 10 L50 50 abc",
 ];

--- a/content/smil/test/test_smilAnimateMotionInvalidValues.xhtml
+++ b/content/smil/test/test_smilAnimateMotionInvalidValues.xhtml
@@ -152,16 +152,17 @@ function main()
   testAttr("to", gValidToBy, true, false);
   testAttr("to", gInvalidToBy, false, false);
 
   testAttr("by", gValidToBy, true, false);
   testAttr("by", gInvalidToBy, false, false);
 
   testAttr("path", gValidPath, true, false);
   testAttr("path", gInvalidPath, false, false);
+  testAttr("path", gValidPathWithErrors, true, false);
 
   testMpathElem(gValidPath, true, false);
   testMpathElem(gInvalidPath, false, false);
 
   SimpleTest.finish();
 }
 
 window.addEventListener("load", main, false);

new file mode 100644
--- /dev/null
+++ b/content/svg/content/src/DOMSVGPathSeg.cpp
@@ -0,0 +1,1056 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla SVG Project code.
+ *
+ * The Initial Developer of the Original Code is the Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "DOMSVGPathSeg.h"
+#include "DOMSVGPathSegList.h"
+#include "SVGPathSegUtils.h"
+#include "SVGAnimatedPathSegList.h"
+#include "nsSVGElement.h"
+#include "nsIDOMSVGPathSeg.h"
+#include "nsDOMError.h"
+
+// See the architecture comment in DOMSVGPathSegList.h.
+
+using namespace mozilla;
+
+// We could use NS_IMPL_CYCLE_COLLECTION_1, except that in Unlink() we need to
+// clear our list's weak ref to us to be safe. (The other option would be to
+// not unlink and rely on the breaking of the other edges in the cycle, as
+// NS_SVG_VAL_IMPL_CYCLE_COLLECTION does.)
+NS_IMPL_CYCLE_COLLECTION_CLASS(DOMSVGPathSeg)
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(DOMSVGPathSeg)
+  // We may not belong to a list, so we must null check tmp->mList.
+  if (tmp->mList) {
+    tmp->mList->ItemAt(tmp->mListIndex) = nsnull;
+  }
+NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mList)
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(DOMSVGPathSeg)
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mList)
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+
+NS_IMPL_CYCLE_COLLECTING_ADDREF(DOMSVGPathSeg)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(DOMSVGPathSeg)
+
+DOMCI_DATA(SVGPathSeg, DOMSVGPathSeg)
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(DOMSVGPathSeg)
+  NS_INTERFACE_MAP_ENTRY(DOMSVGPathSeg) // pseudo-interface
+  NS_INTERFACE_MAP_ENTRY(nsIDOMSVGPathSeg)
+  NS_INTERFACE_MAP_ENTRY(nsISupports)
+NS_INTERFACE_MAP_END
+
+
+DOMSVGPathSeg::DOMSVGPathSeg(DOMSVGPathSegList *aList,
+                             PRUint32 aListIndex,
+                             PRBool aIsAnimValItem)
+  : mList(aList)
+  , mListIndex(aListIndex)
+  , mIsAnimValItem(aIsAnimValItem)
+{
+  // These shifts are in sync with the members in the header.
+  NS_ABORT_IF_FALSE(aList &&
+                    aListIndex < (1U << 31), "bad arg");
+
+  NS_ABORT_IF_FALSE(IndexIsValid(), "Bad index for DOMSVGPathSeg!");
+}
+
+DOMSVGPathSeg::DOMSVGPathSeg()
+  : mList(nsnull)
+  , mListIndex(0)
+  , mIsAnimValItem(PR_FALSE)
+{
+}
+
+NS_IMETHODIMP
+DOMSVGPathSeg::GetPathSegType(PRUint16 *aPathSegType)
+{
+  *aPathSegType = PRUint16(Type());
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+DOMSVGPathSeg::GetPathSegTypeAsLetter(nsAString &aPathSegTypeAsLetter)
+{
+  aPathSegTypeAsLetter = SVGPathSegUtils::GetPathSegTypeAsLetter(Type());
+  return NS_OK;
+}
+
+void
+DOMSVGPathSeg::InsertingIntoList(DOMSVGPathSegList *aList,
+                                 PRUint32 aListIndex,
+                                 PRBool aIsAnimValItem)
+{
+  NS_ABORT_IF_FALSE(!HasOwner(), "Inserting item that is already in a list");
+
+  mList = aList;
+  mListIndex = aListIndex;
+  mIsAnimValItem = aIsAnimValItem;
+
+  NS_ABORT_IF_FALSE(IndexIsValid(), "Bad index for DOMSVGPathSeg!");
+}
+
+void
+DOMSVGPathSeg::RemovingFromList()
+{
+  PRUint32 argCount = SVGPathSegUtils::ArgCountForType(Type());
+  // InternalItem() + 1, because the args come after the encoded seg type
+  memcpy(PtrToMemberArgs(), InternalItem() + 1, argCount * sizeof(float));
+  mList = nsnull;
+  mIsAnimValItem = PR_FALSE;
+}
+
+void
+DOMSVGPathSeg::ToSVGPathSegEncodedData(float* aRaw)
+{
+  NS_ABORT_IF_FALSE(aRaw, "null pointer");
+  PRUint32 argCount = SVGPathSegUtils::ArgCountForType(Type());
+  if (IsInList()) {
+    // 1 + argCount, because we're copying the encoded seg type and args
+    memcpy(aRaw, InternalItem(), (1 + argCount) * sizeof(float));
+  } else {
+    aRaw[0] = SVGPathSegUtils::EncodeType(Type());
+    // aRaw + 1, because the args go after the encoded seg type
+    memcpy(aRaw + 1, PtrToMemberArgs(), argCount * sizeof(float));
+  }
+}
+
+float*
+DOMSVGPathSeg::InternalItem()
+{
+  PRUint32 dataIndex = mList->mItems[mListIndex].mInternalDataIndex;
+  return &(mList->InternalList().mData[dataIndex]);
+}
+
+#ifdef DEBUG
+PRBool
+DOMSVGPathSeg::IndexIsValid()
+{
+  SVGAnimatedPathSegList *alist = Element()->GetAnimPathSegList();
+  return (mIsAnimValItem &&
+          mListIndex < alist->GetAnimValue().CountItems()) ||
+         (!mIsAnimValItem &&
+          mListIndex < alist->GetBaseValue().CountItems());
+}
+#endif
+
+
+////////////////////////////////////////////////////////////////////////
+// Implementation of DOMSVGPathSeg sub-classes below this point
+
+#define CHECK_ARG_COUNT_IN_SYNC(segType)                                      \
+          NS_ABORT_IF_FALSE(NS_ARRAY_LENGTH(mArgs) ==                         \
+            SVGPathSegUtils::ArgCountForType(PRUint32(segType)) ||            \
+            PRUint32(segType) == nsIDOMSVGPathSeg::PATHSEG_CLOSEPATH,         \
+            "Arg count/array size out of sync")
+
+#define IMPL_SVGPATHSEG_SUBCLASS_COMMON(segName, segType)                     \
+  DOMSVGPathSeg##segName(const float *aArgs)                                  \
+    : DOMSVGPathSeg()                                                         \
+  {                                                                           \
+    CHECK_ARG_COUNT_IN_SYNC(segType);                                         \
+    memcpy(mArgs, aArgs,                                                      \
+        SVGPathSegUtils::ArgCountForType(PRUint32(segType)) * sizeof(float)); \
+  }                                                                           \
+  DOMSVGPathSeg##segName(DOMSVGPathSegList *aList,                            \
+                         PRUint32 aListIndex,                                 \
+                         PRBool aIsAnimValItem)                               \
+    : DOMSVGPathSeg(aList, aListIndex, aIsAnimValItem)                        \
+  {                                                                           \
+    CHECK_ARG_COUNT_IN_SYNC(segType);                                         \
+  }                                                                           \
+  /* From DOMSVGPathSeg: */                                                   \
+  virtual PRUint32                                                            \
+  Type() const                                                                \
+  {                                                                           \
+    return segType;                                                           \
+  }                                                                           \
+  virtual DOMSVGPathSeg*                                                      \
+  Clone()                                                                     \
+  {                                                                           \
+    /* InternalItem() + 1, because we're skipping the encoded seg type */     \
+    float *args = IsInList() ? InternalItem() + 1 : mArgs;                    \
+    return new DOMSVGPathSeg##segName(args);                                  \
+  }                                                                           \
+  virtual float*                                                              \
+  PtrToMemberArgs()                                                           \
+  {                                                                           \
+    return mArgs;                                                             \
+  }
+
+#define IMPL_NSISUPPORTS_SVGPATHSEG_SUBCLASS(segName)                         \
+  /* Forward to the CYCLE_COLLECTING_ADDREF on our base class */              \
+  NS_IMPL_ADDREF_INHERITED(DOMSVGPathSeg##segName, DOMSVGPathSeg)             \
+  NS_IMPL_RELEASE_INHERITED(DOMSVGPathSeg##segName, DOMSVGPathSeg)            \
+                                                                              \
+  DOMCI_DATA(SVGPathSeg##segName, DOMSVGPathSeg##segName)                     \
+                                                                              \
+  NS_INTERFACE_MAP_BEGIN(DOMSVGPathSeg##segName)                              \
+    NS_INTERFACE_MAP_ENTRY(nsIDOMSVGPathSeg##segName)                         \
+    NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(SVGPathSeg##segName)                 \
+  NS_INTERFACE_MAP_END_INHERITING(DOMSVGPathSeg)
+
+#define IMPL_PROP_WITH_TYPE(segName, propName, index, type)                   \
+  /* attribute type propName; */                                              \
+  NS_IMETHODIMP                                                               \
+  DOMSVGPathSeg##segName::Get##propName(type *a##propName)                    \
+  {                                                                           \
+    if (mIsAnimValItem && HasOwner()) {                                       \
+      Element()->FlushAnimations(); /* May make HasOwner() == PR_FALSE */     \
+    }                                                                         \
+    *a##propName = type(HasOwner() ? InternalItem()[1+index] : mArgs[index]); \
+    return NS_OK;                                                             \
+  }                                                                           \
+  NS_IMETHODIMP                                                               \
+  DOMSVGPathSeg##segName::Set##propName(type a##propName)                     \
+  {                                                                           \
+    if (mIsAnimValItem) {                                                     \
+      return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR;                        \
+    }                                                                         \
+    NS_ENSURE_FINITE(float(a##propName), NS_ERROR_ILLEGAL_VALUE);             \
+    if (HasOwner()) {                                                         \
+      InternalItem()[1+index] = float(a##propName);                           \
+      NS_ABORT_IF_FALSE(IsInList(), "DidChangePathSegList() is wrong");       \
+      Element()->DidChangePathSegList(PR_TRUE);                               \
+      if (mList->AttrIsAnimating()) {                                         \
+        Element()->AnimationNeedsResample();                                  \
+      }                                                                       \
+    } else {                                                                  \
+      mArgs[index] = float(a##propName);                                      \
+    }                                                                         \
+    return NS_OK;                                                             \
+  }
+
+// For float, the normal type of arguments
+#define IMPL_FLOAT_PROP(segName, propName, index) \
+  IMPL_PROP_WITH_TYPE(segName, propName, index, float)
+
+// For the boolean flags in arc commands
+#define IMPL_BOOL_PROP(segName, propName, index) \
+  IMPL_PROP_WITH_TYPE(segName, propName, index, PRBool)
+
+
+////////////////////////////////////////////////////////////////////////
+
+class DOMSVGPathSegClosePath
+  : public DOMSVGPathSeg
+  , public nsIDOMSVGPathSegClosePath
+{
+public:
+  DOMSVGPathSegClosePath()
+    : DOMSVGPathSeg()
+  {
+  }
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIDOMSVGPATHSEGCLOSEPATH
+  IMPL_SVGPATHSEG_SUBCLASS_COMMON(ClosePath, PATHSEG_CLOSEPATH)
+
+protected:
+  // To allow IMPL_SVGPATHSEG_SUBCLASS_COMMON above to compile we need an
+  // mArgs, but since C++ doesn't allow zero-sized arrays we need to give it
+  // one (unused) element.
+  float mArgs[1];
+};
+
+IMPL_NSISUPPORTS_SVGPATHSEG_SUBCLASS(ClosePath)
+
+
+////////////////////////////////////////////////////////////////////////
+
+class DOMSVGPathSegMovetoAbs
+  : public DOMSVGPathSeg
+  , public nsIDOMSVGPathSegMovetoAbs
+{
+public:
+  DOMSVGPathSegMovetoAbs(float x, float y)
+    : DOMSVGPathSeg()
+  {
+    mArgs[0] = x;
+    mArgs[1] = y;
+  }
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIDOMSVGPATHSEGMOVETOABS
+  IMPL_SVGPATHSEG_SUBCLASS_COMMON(MovetoAbs, PATHSEG_MOVETO_ABS)
+
+protected:
+  float mArgs[2];
+};
+
+IMPL_NSISUPPORTS_SVGPATHSEG_SUBCLASS(MovetoAbs)
+
+IMPL_FLOAT_PROP(MovetoAbs, X, 0)
+IMPL_FLOAT_PROP(MovetoAbs, Y, 1)
+
+
+////////////////////////////////////////////////////////////////////////
+
+class DOMSVGPathSegMovetoRel
+  : public DOMSVGPathSeg
+  , public nsIDOMSVGPathSegMovetoRel
+{
+public:
+  DOMSVGPathSegMovetoRel(float x, float y)
+    : DOMSVGPathSeg()
+  {
+    mArgs[0] = x;
+    mArgs[1] = y;
+  }
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIDOMSVGPATHSEGMOVETOREL
+  IMPL_SVGPATHSEG_SUBCLASS_COMMON(MovetoRel, PATHSEG_MOVETO_REL)
+
+protected:
+  float mArgs[2];
+};
+
+IMPL_NSISUPPORTS_SVGPATHSEG_SUBCLASS(MovetoRel)
+
+IMPL_FLOAT_PROP(MovetoRel, X, 0)
+IMPL_FLOAT_PROP(MovetoRel, Y, 1)
+
+
+
+////////////////////////////////////////////////////////////////////////
+
+class DOMSVGPathSegLinetoAbs
+  : public DOMSVGPathSeg
+  , public nsIDOMSVGPathSegLinetoAbs
+{
+public:
+  DOMSVGPathSegLinetoAbs(float x, float y)
+    : DOMSVGPathSeg()
+  {
+    mArgs[0] = x;
+    mArgs[1] = y;
+  }
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIDOMSVGPATHSEGLINETOABS
+  IMPL_SVGPATHSEG_SUBCLASS_COMMON(LinetoAbs, PATHSEG_LINETO_ABS)
+
+protected:
+  float mArgs[2];
+};
+
+IMPL_NSISUPPORTS_SVGPATHSEG_SUBCLASS(LinetoAbs)
+
+IMPL_FLOAT_PROP(LinetoAbs, X, 0)
+IMPL_FLOAT_PROP(LinetoAbs, Y, 1)
+
+
+////////////////////////////////////////////////////////////////////////
+
+class DOMSVGPathSegLinetoRel
+  : public DOMSVGPathSeg
+  , public nsIDOMSVGPathSegLinetoRel
+{
+public:
+  DOMSVGPathSegLinetoRel(float x, float y)
+    : DOMSVGPathSeg()
+  {
+    mArgs[0] = x;
+    mArgs[1] = y;
+  }
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIDOMSVGPATHSEGLINETOREL
+  IMPL_SVGPATHSEG_SUBCLASS_COMMON(LinetoRel, PATHSEG_LINETO_REL)
+
+protected:
+  float mArgs[2];
+};
+
+IMPL_NSISUPPORTS_SVGPATHSEG_SUBCLASS(LinetoRel)
+
+IMPL_FLOAT_PROP(LinetoRel, X, 0)
+IMPL_FLOAT_PROP(LinetoRel, Y, 1)
+
+
+////////////////////////////////////////////////////////////////////////
+
+class DOMSVGPathSegCurvetoCubicAbs
+  : public DOMSVGPathSeg
+  , public nsIDOMSVGPathSegCurvetoCubicAbs
+{
+public:
+  DOMSVGPathSegCurvetoCubicAbs(float x1, float y1,
+                               float x2, float y2,
+                               float x, float y)
+    : DOMSVGPathSeg()
+  {
+    mArgs[0] = x1;
+    mArgs[1] = y1;
+    mArgs[2] = x2;
+    mArgs[3] = y2;
+    mArgs[4] = x;
+    mArgs[5] = y;
+  }
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIDOMSVGPATHSEGCURVETOCUBICABS
+  IMPL_SVGPATHSEG_SUBCLASS_COMMON(CurvetoCubicAbs, PATHSEG_CURVETO_CUBIC_ABS)
+
+protected:
+  float mArgs[6];
+};
+
+IMPL_NSISUPPORTS_SVGPATHSEG_SUBCLASS(CurvetoCubicAbs)
+
+IMPL_FLOAT_PROP(CurvetoCubicAbs, X1, 0)
+IMPL_FLOAT_PROP(CurvetoCubicAbs, Y1, 1)
+IMPL_FLOAT_PROP(CurvetoCubicAbs, X2, 2)
+IMPL_FLOAT_PROP(CurvetoCubicAbs, Y2, 3)
+IMPL_FLOAT_PROP(CurvetoCubicAbs, X, 4)
+IMPL_FLOAT_PROP(CurvetoCubicAbs, Y, 5)
+
+
+////////////////////////////////////////////////////////////////////////
+
+class DOMSVGPathSegCurvetoCubicRel
+  : public DOMSVGPathSeg
+  , public nsIDOMSVGPathSegCurvetoCubicRel
+{
+public:
+  DOMSVGPathSegCurvetoCubicRel(float x1, float y1,
+                               float x2, float y2,
+                               float x, float y)
+    : DOMSVGPathSeg()
+  {
+    mArgs[0] = x1;
+    mArgs[1] = y1;
+    mArgs[2] = x2;
+    mArgs[3] = y2;
+    mArgs[4] = x;
+    mArgs[5] = y;
+  }
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIDOMSVGPATHSEGCURVETOCUBICREL
+  IMPL_SVGPATHSEG_SUBCLASS_COMMON(CurvetoCubicRel, PATHSEG_CURVETO_CUBIC_REL)
+
+protected:
+  float mArgs[6];
+};
+
+IMPL_NSISUPPORTS_SVGPATHSEG_SUBCLASS(CurvetoCubicRel)
+
+IMPL_FLOAT_PROP(CurvetoCubicRel, X1, 0)
+IMPL_FLOAT_PROP(CurvetoCubicRel, Y1, 1)
+IMPL_FLOAT_PROP(CurvetoCubicRel, X2, 2)
+IMPL_FLOAT_PROP(CurvetoCubicRel, Y2, 3)
+IMPL_FLOAT_PROP(CurvetoCubicRel, X, 4)
+IMPL_FLOAT_PROP(CurvetoCubicRel, Y, 5)
+
+
+////////////////////////////////////////////////////////////////////////
+
+class DOMSVGPathSegCurvetoQuadraticAbs
+  : public DOMSVGPathSeg
+  , public nsIDOMSVGPathSegCurvetoQuadraticAbs
+{
+public:
+  DOMSVGPathSegCurvetoQuadraticAbs(float x1, float y1,
+                                   float x, float y)
+    : DOMSVGPathSeg()
+  {
+    mArgs[0] = x1;
+    mArgs[1] = y1;
+    mArgs[2] = x;
+    mArgs[3] = y;
+  }
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIDOMSVGPATHSEGCURVETOQUADRATICABS
+  IMPL_SVGPATHSEG_SUBCLASS_COMMON(CurvetoQuadraticAbs, PATHSEG_CURVETO_QUADRATIC_ABS)
+
+protected:
+  float mArgs[4];
+};
+
+IMPL_NSISUPPORTS_SVGPATHSEG_SUBCLASS(CurvetoQuadraticAbs)
+
+IMPL_FLOAT_PROP(CurvetoQuadraticAbs, X1, 0)
+IMPL_FLOAT_PROP(CurvetoQuadraticAbs, Y1, 1)
+IMPL_FLOAT_PROP(CurvetoQuadraticAbs, X, 2)
+IMPL_FLOAT_PROP(CurvetoQuadraticAbs, Y, 3)
+
+
+////////////////////////////////////////////////////////////////////////
+
+class DOMSVGPathSegCurvetoQuadraticRel
+  : public DOMSVGPathSeg
+  , public nsIDOMSVGPathSegCurvetoQuadraticRel
+{
+public:
+  DOMSVGPathSegCurvetoQuadraticRel(float x1, float y1,
+                                   float x, float y)
+    : DOMSVGPathSeg()
+  {
+    mArgs[0] = x1;
+    mArgs[1] = y1;
+    mArgs[2] = x;
+    mArgs[3] = y;
+  }
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIDOMSVGPATHSEGCURVETOQUADRATICREL
+  IMPL_SVGPATHSEG_SUBCLASS_COMMON(CurvetoQuadraticRel, PATHSEG_CURVETO_QUADRATIC_REL)
+
+protected:
+  float mArgs[4];
+};
+
+IMPL_NSISUPPORTS_SVGPATHSEG_SUBCLASS(CurvetoQuadraticRel)
+
+IMPL_FLOAT_PROP(CurvetoQuadraticRel, X1, 0)
+IMPL_FLOAT_PROP(CurvetoQuadraticRel, Y1, 1)
+IMPL_FLOAT_PROP(CurvetoQuadraticRel, X, 2)
+IMPL_FLOAT_PROP(CurvetoQuadraticRel, Y, 3)
+
+
+////////////////////////////////////////////////////////////////////////
+
+class DOMSVGPathSegArcAbs
+  : public DOMSVGPathSeg
+  , public nsIDOMSVGPathSegArcAbs
+{
+public:
+  DOMSVGPathSegArcAbs(float r1, float r2, float angle,
+                      PRBool largeArcFlag, PRBool sweepFlag,
+                      float x, float y)
+    : DOMSVGPathSeg()
+  {
+    mArgs[0] = r1;
+    mArgs[1] = r2;
+    mArgs[2] = angle;
+    mArgs[3] = largeArcFlag;
+    mArgs[4] = sweepFlag;
+    mArgs[5] = x;
+    mArgs[6] = y;
+  }
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIDOMSVGPATHSEGARCABS
+  IMPL_SVGPATHSEG_SUBCLASS_COMMON(ArcAbs, PATHSEG_ARC_ABS)
+
+protected:
+  float mArgs[7];
+};
+
+IMPL_NSISUPPORTS_SVGPATHSEG_SUBCLASS(ArcAbs)
+
+IMPL_FLOAT_PROP(ArcAbs, R1, 0)
+IMPL_FLOAT_PROP(ArcAbs, R2, 1)
+IMPL_FLOAT_PROP(ArcAbs, Angle, 2)
+IMPL_BOOL_PROP(ArcAbs, LargeArcFlag, 3)
+IMPL_BOOL_PROP(ArcAbs, SweepFlag, 4)
+IMPL_FLOAT_PROP(ArcAbs, X, 5)
+IMPL_FLOAT_PROP(ArcAbs, Y, 6)
+
+
+////////////////////////////////////////////////////////////////////////
+
+class DOMSVGPathSegArcRel
+  : public DOMSVGPathSeg
+  , public nsIDOMSVGPathSegArcRel
+{
+public:
+  DOMSVGPathSegArcRel(float r1, float r2, float angle,
+                      PRBool largeArcFlag, PRBool sweepFlag,
+                      float x, float y)
+    : DOMSVGPathSeg()
+  {
+    mArgs[0] = r1;
+    mArgs[1] = r2;
+    mArgs[2] = angle;
+    mArgs[3] = largeArcFlag;
+    mArgs[4] = sweepFlag;
+    mArgs[5] = x;
+    mArgs[6] = y;
+  }
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIDOMSVGPATHSEGARCREL
+  IMPL_SVGPATHSEG_SUBCLASS_COMMON(ArcRel, PATHSEG_ARC_REL)
+
+protected:
+  float mArgs[7];
+};
+
+IMPL_NSISUPPORTS_SVGPATHSEG_SUBCLASS(ArcRel)
+
+IMPL_FLOAT_PROP(ArcRel, R1, 0)
+IMPL_FLOAT_PROP(ArcRel, R2, 1)
+IMPL_FLOAT_PROP(ArcRel, Angle, 2)
+IMPL_BOOL_PROP(ArcRel, LargeArcFlag, 3)
+IMPL_BOOL_PROP(ArcRel, SweepFlag, 4)
+IMPL_FLOAT_PROP(ArcRel, X, 5)
+IMPL_FLOAT_PROP(ArcRel, Y, 6)
+
+
+////////////////////////////////////////////////////////////////////////
+
+class DOMSVGPathSegLinetoHorizontalAbs
+  : public DOMSVGPathSeg
+  , public nsIDOMSVGPathSegLinetoHorizontalAbs
+{
+public:
+  DOMSVGPathSegLinetoHorizontalAbs(float x)
+    : DOMSVGPathSeg()
+  {
+    mArgs[0] = x;
+  }
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIDOMSVGPATHSEGLINETOHORIZONTALABS
+  IMPL_SVGPATHSEG_SUBCLASS_COMMON(LinetoHorizontalAbs, PATHSEG_LINETO_HORIZONTAL_ABS)
+
+protected:
+  float mArgs[1];
+};
+
+IMPL_NSISUPPORTS_SVGPATHSEG_SUBCLASS(LinetoHorizontalAbs)
+
+IMPL_FLOAT_PROP(LinetoHorizontalAbs, X, 0)
+
+
+////////////////////////////////////////////////////////////////////////
+
+class DOMSVGPathSegLinetoHorizontalRel
+  : public DOMSVGPathSeg
+  , public nsIDOMSVGPathSegLinetoHorizontalRel
+{
+public:
+  DOMSVGPathSegLinetoHorizontalRel(float x)
+    : DOMSVGPathSeg()
+  {
+    mArgs[0] = x;
+  }
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIDOMSVGPATHSEGLINETOHORIZONTALREL
+  IMPL_SVGPATHSEG_SUBCLASS_COMMON(LinetoHorizontalRel, PATHSEG_LINETO_HORIZONTAL_REL)
+
+protected:
+  float mArgs[1];
+};
+
+IMPL_NSISUPPORTS_SVGPATHSEG_SUBCLASS(LinetoHorizontalRel)
+
+IMPL_FLOAT_PROP(LinetoHorizontalRel, X, 0)
+
+
+////////////////////////////////////////////////////////////////////////
+
+class DOMSVGPathSegLinetoVerticalAbs
+  : public DOMSVGPathSeg
+  , public nsIDOMSVGPathSegLinetoVerticalAbs
+{
+public:
+  DOMSVGPathSegLinetoVerticalAbs(float y)
+    : DOMSVGPathSeg()
+  {
+    mArgs[0] = y;
+  }
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIDOMSVGPATHSEGLINETOVERTICALABS
+  IMPL_SVGPATHSEG_SUBCLASS_COMMON(LinetoVerticalAbs, PATHSEG_LINETO_VERTICAL_ABS)
+
+protected:
+  float mArgs[1];
+};
+
+IMPL_NSISUPPORTS_SVGPATHSEG_SUBCLASS(LinetoVerticalAbs)
+
+IMPL_FLOAT_PROP(LinetoVerticalAbs, Y, 0)
+
+
+////////////////////////////////////////////////////////////////////////
+
+class DOMSVGPathSegLinetoVerticalRel
+  : public DOMSVGPathSeg
+  , public nsIDOMSVGPathSegLinetoVerticalRel
+{
+public:
+  DOMSVGPathSegLinetoVerticalRel(float y)
+    : DOMSVGPathSeg()
+  {
+    mArgs[0] = y;
+  }
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIDOMSVGPATHSEGLINETOVERTICALREL
+  IMPL_SVGPATHSEG_SUBCLASS_COMMON(LinetoVerticalRel, PATHSEG_LINETO_VERTICAL_REL)
+
+protected:
+  float mArgs[1];
+};
+
+IMPL_NSISUPPORTS_SVGPATHSEG_SUBCLASS(LinetoVerticalRel)
+
+IMPL_FLOAT_PROP(LinetoVerticalRel, Y, 0)
+
+
+////////////////////////////////////////////////////////////////////////
+
+class DOMSVGPathSegCurvetoCubicSmoothAbs
+  : public DOMSVGPathSeg
+  , public nsIDOMSVGPathSegCurvetoCubicSmoothAbs
+{
+public:
+  DOMSVGPathSegCurvetoCubicSmoothAbs(float x2, float y2,
+                                     float x, float y)
+    : DOMSVGPathSeg()
+  {
+    mArgs[0] = x2;
+    mArgs[1] = y2;
+    mArgs[2] = x;
+    mArgs[3] = y;
+  }
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIDOMSVGPATHSEGCURVETOCUBICSMOOTHABS
+  IMPL_SVGPATHSEG_SUBCLASS_COMMON(CurvetoCubicSmoothAbs, PATHSEG_CURVETO_CUBIC_SMOOTH_ABS)
+
+protected:
+  float mArgs[4];
+};
+
+IMPL_NSISUPPORTS_SVGPATHSEG_SUBCLASS(CurvetoCubicSmoothAbs)
+
+IMPL_FLOAT_PROP(CurvetoCubicSmoothAbs, X2, 0)
+IMPL_FLOAT_PROP(CurvetoCubicSmoothAbs, Y2, 1)
+IMPL_FLOAT_PROP(CurvetoCubicSmoothAbs, X, 2)
+IMPL_FLOAT_PROP(CurvetoCubicSmoothAbs, Y, 3)
+
+
+////////////////////////////////////////////////////////////////////////
+
+class DOMSVGPathSegCurvetoCubicSmoothRel
+  : public DOMSVGPathSeg
+  , public nsIDOMSVGPathSegCurvetoCubicSmoothRel
+{
+public:
+  DOMSVGPathSegCurvetoCubicSmoothRel(float x2, float y2,
+                                     float x, float y)
+    : DOMSVGPathSeg()
+  {
+    mArgs[0] = x2;
+    mArgs[1] = y2;
+    mArgs[2] = x;
+    mArgs[3] = y;
+  }
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIDOMSVGPATHSEGCURVETOCUBICSMOOTHREL
+  IMPL_SVGPATHSEG_SUBCLASS_COMMON(CurvetoCubicSmoothRel, PATHSEG_CURVETO_CUBIC_SMOOTH_REL)
+
+protected:
+  float mArgs[4];
+};
+
+IMPL_NSISUPPORTS_SVGPATHSEG_SUBCLASS(CurvetoCubicSmoothRel)
+
+IMPL_FLOAT_PROP(CurvetoCubicSmoothRel, X2, 0)
+IMPL_FLOAT_PROP(CurvetoCubicSmoothRel, Y2, 1)
+IMPL_FLOAT_PROP(CurvetoCubicSmoothRel, X, 2)
+IMPL_FLOAT_PROP(CurvetoCubicSmoothRel, Y, 3)
+
+
+////////////////////////////////////////////////////////////////////////
+
+class DOMSVGPathSegCurvetoQuadraticSmoothAbs
+  : public DOMSVGPathSeg
+  , public nsIDOMSVGPathSegCurvetoQuadraticSmoothAbs
+{
+public:
+  DOMSVGPathSegCurvetoQuadraticSmoothAbs(float x, float y)
+    : DOMSVGPathSeg()
+  {
+    mArgs[0] = x;
+    mArgs[1] = y;
+  }
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIDOMSVGPATHSEGCURVETOQUADRATICSMOOTHABS
+  IMPL_SVGPATHSEG_SUBCLASS_COMMON(CurvetoQuadraticSmoothAbs, PATHSEG_CURVETO_QUADRATIC_SMOOTH_ABS)
+
+protected:
+  float mArgs[2];
+};
+
+IMPL_NSISUPPORTS_SVGPATHSEG_SUBCLASS(CurvetoQuadraticSmoothAbs)
+
+IMPL_FLOAT_PROP(CurvetoQuadraticSmoothAbs, X, 0)
+IMPL_FLOAT_PROP(CurvetoQuadraticSmoothAbs, Y, 1)
+
+
+////////////////////////////////////////////////////////////////////////
+
+class DOMSVGPathSegCurvetoQuadraticSmoothRel
+  : public DOMSVGPathSeg
+  , public nsIDOMSVGPathSegCurvetoQuadraticSmoothRel
+{
+public:
+  DOMSVGPathSegCurvetoQuadraticSmoothRel(float x, float y)
+    : DOMSVGPathSeg()
+  {
+    mArgs[0] = x;
+    mArgs[1] = y;
+  }
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIDOMSVGPATHSEGCURVETOQUADRATICSMOOTHREL
+  IMPL_SVGPATHSEG_SUBCLASS_COMMON(CurvetoQuadraticSmoothRel, PATHSEG_CURVETO_QUADRATIC_SMOOTH_REL)
+
+protected:
+  float mArgs[2];
+};
+
+IMPL_NSISUPPORTS_SVGPATHSEG_SUBCLASS(CurvetoQuadraticSmoothRel)
+
+IMPL_FLOAT_PROP(CurvetoQuadraticSmoothRel, X, 0)
+IMPL_FLOAT_PROP(CurvetoQuadraticSmoothRel, Y, 1)
+
+
+
+// This must come after DOMSVGPathSegClosePath et. al. have been declared.
+/* static */ DOMSVGPathSeg*
+DOMSVGPathSeg::CreateFor(DOMSVGPathSegList *aList,
+                         PRUint32 aListIndex,
+                         PRBool aIsAnimValItem)
+{
+  PRUint32 dataIndex = aList->mItems[aListIndex].mInternalDataIndex;
+  float *data = &aList->InternalList().mData[dataIndex];
+  PRUint32 type = SVGPathSegUtils::DecodeType(data[0]);
+
+  switch (type)
+  {
+  case nsIDOMSVGPathSeg::PATHSEG_CLOSEPATH:
+    return new DOMSVGPathSegClosePath(aList, aListIndex, aIsAnimValItem);
+  case nsIDOMSVGPathSeg::PATHSEG_MOVETO_ABS:
+    return new DOMSVGPathSegMovetoAbs(aList, aListIndex, aIsAnimValItem);
+  case nsIDOMSVGPathSeg::PATHSEG_MOVETO_REL:
+    return new DOMSVGPathSegMovetoRel(aList, aListIndex, aIsAnimValItem);
+  case nsIDOMSVGPathSeg::PATHSEG_LINETO_ABS:
+    return new DOMSVGPathSegLinetoAbs(aList, aListIndex, aIsAnimValItem);
+  case nsIDOMSVGPathSeg::PATHSEG_LINETO_REL:
+    return new DOMSVGPathSegLinetoRel(aList, aListIndex, aIsAnimValItem);
+  case nsIDOMSVGPathSeg::PATHSEG_CURVETO_CUBIC_ABS:
+    return new DOMSVGPathSegCurvetoCubicAbs(aList, aListIndex, aIsAnimValItem);
+  case nsIDOMSVGPathSeg::PATHSEG_CURVETO_CUBIC_REL:
+    return new DOMSVGPathSegCurvetoCubicRel(aList, aListIndex, aIsAnimValItem);
+  case nsIDOMSVGPathSeg::PATHSEG_CURVETO_QUADRATIC_ABS:
+    return new DOMSVGPathSegCurvetoQuadraticAbs(aList, aListIndex, aIsAnimValItem);
+  case nsIDOMSVGPathSeg::PATHSEG_CURVETO_QUADRATIC_REL:
+    return new DOMSVGPathSegCurvetoQuadraticRel(aList, aListIndex, aIsAnimValItem);
+  case nsIDOMSVGPathSeg::PATHSEG_ARC_ABS:
+    return new DOMSVGPathSegArcAbs(aList, aListIndex, aIsAnimValItem);
+  case nsIDOMSVGPathSeg::PATHSEG_ARC_REL:
+    return new DOMSVGPathSegArcRel(aList, aListIndex, aIsAnimValItem);
+  case nsIDOMSVGPathSeg::PATHSEG_LINETO_HORIZONTAL_ABS:
+    return new DOMSVGPathSegLinetoHorizontalAbs(aList, aListIndex, aIsAnimValItem);
+  case nsIDOMSVGPathSeg::PATHSEG_LINETO_HORIZONTAL_REL:
+    return new DOMSVGPathSegLinetoHorizontalRel(aList, aListIndex, aIsAnimValItem);
+  case nsIDOMSVGPathSeg::PATHSEG_LINETO_VERTICAL_ABS:
+    return new DOMSVGPathSegLinetoVerticalAbs(aList, aListIndex, aIsAnimValItem);
+  case nsIDOMSVGPathSeg::PATHSEG_LINETO_VERTICAL_REL:
+    return new DOMSVGPathSegLinetoVerticalRel(aList, aListIndex, aIsAnimValItem);
+  case nsIDOMSVGPathSeg::PATHSEG_CURVETO_CUBIC_SMOOTH_ABS:
+    return new DOMSVGPathSegCurvetoCubicSmoothAbs(aList, aListIndex, aIsAnimValItem);
+  case nsIDOMSVGPathSeg::PATHSEG_CURVETO_CUBIC_SMOOTH_REL:
+    return new DOMSVGPathSegCurvetoCubicSmoothRel(aList, aListIndex, aIsAnimValItem);
+  case nsIDOMSVGPathSeg::PATHSEG_CURVETO_QUADRATIC_SMOOTH_ABS:
+    return new DOMSVGPathSegCurvetoQuadraticSmoothAbs(aList, aListIndex, aIsAnimValItem);
+  case nsIDOMSVGPathSeg::PATHSEG_CURVETO_QUADRATIC_SMOOTH_REL:
+    return new DOMSVGPathSegCurvetoQuadraticSmoothRel(aList, aListIndex, aIsAnimValItem);
+  default:
+    NS_NOTREACHED("Invalid path segment type");
+    return nsnull;
+  }
+}
+
+
+
+
+nsIDOMSVGPathSeg*
+NS_NewSVGPathSegClosePath()
+{
+  return new DOMSVGPathSegClosePath();
+}
+
+nsIDOMSVGPathSeg*
+NS_NewSVGPathSegMovetoAbs(float x, float y)
+{
+  return new DOMSVGPathSegMovetoAbs(x, y);
+}
+
+nsIDOMSVGPathSeg*
+NS_NewSVGPathSegMovetoRel(float x, float y)
+{
+  return new DOMSVGPathSegMovetoRel(x, y);
+}
+
+nsIDOMSVGPathSeg*
+NS_NewSVGPathSegLinetoAbs(float x, float y)
+{
+  return new DOMSVGPathSegLinetoAbs(x, y);
+}
+
+nsIDOMSVGPathSeg*
+NS_NewSVGPathSegLinetoRel(float x, float y)
+{
+  return new DOMSVGPathSegLinetoRel(x, y);
+}
+
+nsIDOMSVGPathSeg*
+NS_NewSVGPathSegCurvetoCubicAbs(float x, float y,
+                                float x1, float y1,
+                                float x2, float y2)
+{
+  // Note that we swap from DOM API argument order to the argument order used
+  // in the <path> element's 'd' attribute (i.e. we put the arguments for the
+  // end point of the segment last instead of first).
+
+  return new DOMSVGPathSegCurvetoCubicAbs(x1, y1, x2, y2, x, y);
+}
+
+nsIDOMSVGPathSeg*
+NS_NewSVGPathSegCurvetoCubicRel(float x, float y,
+                                float x1, float y1,
+                                float x2, float y2)
+{
+  // See comment in NS_NewSVGPathSegCurvetoCubicAbs!
+
+  return new DOMSVGPathSegCurvetoCubicRel(x1, y1, x2, y2, x, y);
+}
+
+nsIDOMSVGPathSeg*
+NS_NewSVGPathSegCurvetoQuadraticAbs(float x, float y,
+                                    float x1, float y1)
+{
+  // See comment in NS_NewSVGPathSegCurvetoCubicAbs!
+
+  return new DOMSVGPathSegCurvetoQuadraticAbs(x1, y1, x, y);
+}
+
+nsIDOMSVGPathSeg*
+NS_NewSVGPathSegCurvetoQuadraticRel(float x, float y,
+                                    float x1, float y1)
+{
+  // See comment in NS_NewSVGPathSegCurvetoCubicAbs!
+
+  return new DOMSVGPathSegCurvetoQuadraticRel(x1, y1, x, y);
+}
+
+nsIDOMSVGPathSeg*
+NS_NewSVGPathSegArcAbs(float x, float y,
+                       float r1, float r2, float angle,
+                       PRBool largeArcFlag, PRBool sweepFlag)
+{
+  // See comment in NS_NewSVGPathSegCurvetoCubicAbs!
+
+  return new DOMSVGPathSegArcAbs(r1, r2, angle, largeArcFlag, sweepFlag, x, y);
+}
+
+nsIDOMSVGPathSeg*
+NS_NewSVGPathSegArcRel(float x, float y,
+                       float r1, float r2, float angle,
+                       PRBool largeArcFlag, PRBool sweepFlag)
+{
+  // See comment in NS_NewSVGPathSegCurvetoCubicAbs!
+
+  return new DOMSVGPathSegArcRel(r1, r2, angle, largeArcFlag, sweepFlag, x, y);
+}
+
+nsIDOMSVGPathSeg*
+NS_NewSVGPathSegLinetoHorizontalAbs(float x)
+{
+  return new DOMSVGPathSegLinetoHorizontalAbs(x);
+}
+
+nsIDOMSVGPathSeg*
+NS_NewSVGPathSegLinetoHorizontalRel(float x)
+{
+  return new DOMSVGPathSegLinetoHorizontalRel(x);
+}
+
+nsIDOMSVGPathSeg*
+NS_NewSVGPathSegLinetoVerticalAbs(float y)
+{
+  return new DOMSVGPathSegLinetoVerticalAbs(y);
+}
+
+nsIDOMSVGPathSeg*
+NS_NewSVGPathSegLinetoVerticalRel(float y)
+{
+  return new DOMSVGPathSegLinetoVerticalRel(y);
+}
+
+nsIDOMSVGPathSeg*
+NS_NewSVGPathSegCurvetoCubicSmoothAbs(float x, float y,
+                                      float x2, float y2)
+{
+  // See comment in NS_NewSVGPathSegCurvetoCubicAbs!
+
+  return new DOMSVGPathSegCurvetoCubicSmoothAbs(x2, y2, x, y);
+}
+
+nsIDOMSVGPathSeg*
+NS_NewSVGPathSegCurvetoCubicSmoothRel(float x, float y,
+                                      float x2, float y2)
+{
+  // See comment in NS_NewSVGPathSegCurvetoCubicAbs!
+
+  return new DOMSVGPathSegCurvetoCubicSmoothRel(x2, y2, x, y);
+}
+
+nsIDOMSVGPathSeg*
+NS_NewSVGPathSegCurvetoQuadraticSmoothAbs(float x, float y)
+{
+  return new DOMSVGPathSegCurvetoQuadraticSmoothAbs(x, y);
+}
+
+nsIDOMSVGPathSeg*
+NS_NewSVGPathSegCurvetoQuadraticSmoothRel(float x, float y)
+{
+  return new DOMSVGPathSegCurvetoQuadraticSmoothRel(x, y);
+}
+