Merge m-c to fx-team.
authorRyan VanderMeulen <ryanvm@gmail.com>
Mon, 18 Feb 2013 11:07:20 -0500
changeset 122275 c080abd4eb7ad97826149d053aa0b2efb9646249
parent 122274 02524d3d9d8acbcc524da38ba21590905424d0dd (current diff)
parent 122219 645cb4fbf390452b445ebc3778b8a81257cd32f8 (diff)
child 122276 5d7a14c71f51454dfce3250e9a957ff432e37280
push id24328
push userttaubert@mozilla.com
push dateTue, 19 Feb 2013 09:39:45 +0000
treeherdermozilla-central@3f0f2fc4bd0f [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone21.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Merge m-c to fx-team.
content/svg/content/src/nsSVGFilterElement.cpp
content/svg/content/src/nsSVGFilterElement.h
dom/interfaces/svg/nsIDOMSVGFilterElement.idl
--- a/accessible/src/base/TextAttrs.cpp
+++ b/accessible/src/base/TextAttrs.cpp
@@ -446,17 +446,19 @@ TextAttrsMgr::FontFamilyTextAttr::
 bool
 TextAttrsMgr::FontFamilyTextAttr::
   GetFontFamily(nsIFrame* aFrame, nsString& aFamily)
 {
   nsRefPtr<nsFontMetrics> fm;
   nsLayoutUtils::GetFontMetricsForFrame(aFrame, getter_AddRefs(fm));
 
   gfxFontGroup* fontGroup = fm->GetThebesFontGroup();
-  aFamily = fontGroup->GetFamilyNameAt(0);
+  gfxFont* font = fontGroup->GetFontAt(0);
+  gfxFontEntry* fontEntry = font->GetFontEntry();
+  aFamily = fontEntry->FamilyName();
   return true;
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // FontSizeTextAttr
 ////////////////////////////////////////////////////////////////////////////////
 
--- a/content/events/test/test_eventctors.html
+++ b/content/events/test/test_eventctors.html
@@ -157,16 +157,57 @@ var dict = { get detail() { throw "foo";
 try {
   e = new CustomEvent("hello", dict);
 } catch (exp) {
   ex = true;
 }
 ok(ex, "Should have thrown an exception!");
 ex = false;
 
+// BlobEvent
+
+try {
+  e = new BlobEvent();
+} catch(exp) {
+  ex = true;
+}
+ok(ex, "First parameter is required!");
+ex = false;
+
+e = new BlobEvent("hello");
+ok(e.type, "hello", "Wrong event type!");
+ok(!e.isTrusted, "Event shouldn't be trusted!");
+ok(!e.bubbles, "Event shouldn't bubble!");
+ok(!e.cancelable, "Event shouldn't be cancelable!");
+document.dispatchEvent(e);
+is(receivedEvent, e, "Wrong event!");
+
+var blob = Blob();
+e = new BlobEvent("hello", { bubbles: true, cancelable: true, data: blob });
+ok(e.type, "hello", "Wrong event type!");
+ok(!e.isTrusted, "Event shouldn't be trusted!");
+ok(e.bubbles, "Event should bubble!");
+ok(e.cancelable, "Event should be cancelable!");
+is(e.data, blob , "Wrong event.data!");
+document.dispatchEvent(e);
+is(receivedEvent, e, "Wrong event!");
+
+
+e = new BlobEvent("hello", {data: blob});
+ok(e.type, "hello", "Wrong event type!");
+ok(!e.isTrusted, "Event shouldn't be trusted!");
+ok(!e.bubbles, "Event shouldn't bubble!");
+ok(!e.cancelable, "Event should be cancelable1!");
+is(e.data, blob , "Wrong event.data!");
+
+e = new BlobEvent("hello", { data: null });
+is(e.data, null, "Wrong event.data!");
+ok(!e.bubbles, "Event shouldn't bubble!");
+ok(!e.cancelable, "Event shouldn't be cancelable!");
+blob = null;
 // CloseEvent
 
 try {
   e = new CloseEvent();
 } catch(exp) {
   ex = true;
 }
 ok(ex, "First parameter is required!");
--- a/content/svg/content/src/Makefile.in
+++ b/content/svg/content/src/Makefile.in
@@ -38,17 +38,16 @@ CPPSRCS		= \
 		nsISVGPoint.cpp \
 		nsSVGAngle.cpp \
 		nsSVGBoolean.cpp \
 		nsSVGClass.cpp \
 		nsSVGDataParser.cpp \
 		nsSVGElement.cpp \
 		nsSVGEnum.cpp \
 		nsSVGFeatures.cpp \
-		nsSVGFilterElement.cpp \
 		nsSVGFilters.cpp \
 		nsSVGInteger.cpp \
 		nsSVGIntegerPair.cpp \
 		nsSVGLength2.cpp \
 		nsSVGNumber2.cpp \
 		nsSVGNumberPair.cpp \
 		nsSVGPathDataParser.cpp \
 		nsSVGPathGeometryElement.cpp \
@@ -76,16 +75,17 @@ CPPSRCS		= \
 		SVGAttrValueWrapper.cpp \
 		SVGClipPathElement.cpp \
 		SVGCircleElement.cpp \
 		SVGContentUtils.cpp \
 		SVGDefsElement.cpp \
 		SVGDescElement.cpp \
 		SVGElementFactory.cpp \
 		SVGEllipseElement.cpp \
+		SVGFilterElement.cpp \
 		SVGForeignObjectElement.cpp \
 		SVGFragmentIdentifier.cpp \
 		SVGGElement.cpp \
 		SVGGradientElement.cpp \
 		SVGGraphicsElement.cpp \
 		SVGImageElement.cpp \
 		SVGIntegerPairSMILType.cpp \
 		SVGLength.cpp \
@@ -161,20 +161,21 @@ EXPORTS_mozilla/dom = \
 	SVGAnimatedBoolean.h \
 	SVGAnimatedLength.h \
 	SVGAnimateElement.h \
 	SVGAnimateTransformElement.h \
 	SVGAnimateMotionElement.h \
 	SVGAnimationElement.h \
 	SVGClipPathElement.h \
 	SVGCircleElement.h \
-  SVGComponentTransferFunctionElement.h \
+	SVGComponentTransferFunctionElement.h \
 	SVGDefsElement.h \
 	SVGDescElement.h \
 	SVGEllipseElement.h \
+	SVGFilterElement.h \
 	SVGForeignObjectElement.h \
 	SVGGElement.h \
 	SVGGradientElement.h \
 	SVGGraphicsElement.h \
 	SVGImageElement.h \
 	SVGLineElement.h \
 	SVGMarkerElement.h \
 	SVGMaskElement.h \
--- a/content/svg/content/src/SVGClipPathElement.cpp
+++ b/content/svg/content/src/SVGClipPathElement.cpp
@@ -19,27 +19,26 @@ SVGClipPathElement::WrapNode(JSContext *
 {
   return SVGClipPathElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
 }
 
 nsSVGElement::EnumInfo SVGClipPathElement::sEnumInfo[1] =
 {
   { &nsGkAtoms::clipPathUnits,
     sSVGUnitTypesMap,
-    nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE
+    SVG_UNIT_TYPE_USERSPACEONUSE
   }
 };
 
 //----------------------------------------------------------------------
 // nsISupports methods
 
-NS_IMPL_ISUPPORTS_INHERITED4(SVGClipPathElement, SVGClipPathElementBase,
+NS_IMPL_ISUPPORTS_INHERITED3(SVGClipPathElement, SVGClipPathElementBase,
                              nsIDOMNode, nsIDOMElement,
-                             nsIDOMSVGElement,
-                             nsIDOMSVGUnitTypes)
+                             nsIDOMSVGElement)
 
 //----------------------------------------------------------------------
 // Implementation
 
 SVGClipPathElement::SVGClipPathElement(already_AddRefed<nsINodeInfo> aNodeInfo)
   : SVGClipPathElementBase(aNodeInfo)
 {
   SetIsDOMBinding();
--- a/content/svg/content/src/SVGClipPathElement.h
+++ b/content/svg/content/src/SVGClipPathElement.h
@@ -1,33 +1,31 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef mozilla_dom_SVGClipPathElement_h
 #define mozilla_dom_SVGClipPathElement_h
 
-#include "nsIDOMSVGUnitTypes.h"
 #include "nsSVGEnum.h"
 #include "mozilla/dom/SVGTransformableElement.h"
 
 class nsSVGClipPathFrame;
 
 nsresult NS_NewSVGClipPathElement(nsIContent **aResult,
                                   already_AddRefed<nsINodeInfo> aNodeInfo);
 
 namespace mozilla {
 namespace dom {
 
 typedef SVGTransformableElement SVGClipPathElementBase;
 
 class SVGClipPathElement MOZ_FINAL : public SVGClipPathElementBase,
-                                     public nsIDOMSVGElement,
-                                     public nsIDOMSVGUnitTypes
+                                     public nsIDOMSVGElement
 {
   friend class ::nsSVGClipPathFrame;
 
 protected:
   friend nsresult (::NS_NewSVGClipPathElement(nsIContent **aResult,
                                               already_AddRefed<nsINodeInfo> aNodeInfo));
   SVGClipPathElement(already_AddRefed<nsINodeInfo> aNodeInfo);
   virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
rename from content/svg/content/src/nsSVGFilterElement.cpp
rename to content/svg/content/src/SVGFilterElement.cpp
--- a/content/svg/content/src/nsSVGFilterElement.cpp
+++ b/content/svg/content/src/SVGFilterElement.cpp
@@ -2,180 +2,180 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "mozilla/Util.h"
 
 #include "nsGkAtoms.h"
 #include "nsCOMPtr.h"
-#include "nsSVGFilterElement.h"
+#include "mozilla/dom/SVGFilterElement.h"
+#include "mozilla/dom/SVGFilterElementBinding.h"
 #include "nsSVGEffects.h"
 
-using namespace mozilla;
+NS_IMPL_NS_NEW_NAMESPACED_SVG_ELEMENT(Filter)
+
+namespace mozilla {
+namespace dom {
 
-nsSVGElement::LengthInfo nsSVGFilterElement::sLengthInfo[4] =
+JSObject*
+SVGFilterElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+{
+  return SVGFilterElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+}
+
+nsSVGElement::LengthInfo SVGFilterElement::sLengthInfo[4] =
 {
   { &nsGkAtoms::x, -10, nsIDOMSVGLength::SVG_LENGTHTYPE_PERCENTAGE, SVGContentUtils::X },
   { &nsGkAtoms::y, -10, nsIDOMSVGLength::SVG_LENGTHTYPE_PERCENTAGE, SVGContentUtils::Y },
   { &nsGkAtoms::width, 120, nsIDOMSVGLength::SVG_LENGTHTYPE_PERCENTAGE, SVGContentUtils::X },
   { &nsGkAtoms::height, 120, nsIDOMSVGLength::SVG_LENGTHTYPE_PERCENTAGE, SVGContentUtils::Y },
 };
 
-nsSVGElement::IntegerPairInfo nsSVGFilterElement::sIntegerPairInfo[1] =
+nsSVGElement::IntegerPairInfo SVGFilterElement::sIntegerPairInfo[1] =
 {
   { &nsGkAtoms::filterRes, 0 }
 };
 
-nsSVGElement::EnumInfo nsSVGFilterElement::sEnumInfo[2] =
+nsSVGElement::EnumInfo SVGFilterElement::sEnumInfo[2] =
 {
   { &nsGkAtoms::filterUnits,
     sSVGUnitTypesMap,
-    nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX
+    SVG_UNIT_TYPE_OBJECTBOUNDINGBOX
   },
   { &nsGkAtoms::primitiveUnits,
     sSVGUnitTypesMap,
-    nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE
+    SVG_UNIT_TYPE_USERSPACEONUSE
   }
 };
 
-nsSVGElement::StringInfo nsSVGFilterElement::sStringInfo[1] =
+nsSVGElement::StringInfo SVGFilterElement::sStringInfo[1] =
 {
   { &nsGkAtoms::href, kNameSpaceID_XLink, true }
 };
 
-NS_IMPL_NS_NEW_SVG_ELEMENT(Filter)
-
 //----------------------------------------------------------------------
 // nsISupports methods
 
-NS_IMPL_ADDREF_INHERITED(nsSVGFilterElement,nsSVGFilterElementBase)
-NS_IMPL_RELEASE_INHERITED(nsSVGFilterElement,nsSVGFilterElementBase)
-
-DOMCI_NODE_DATA(SVGFilterElement, nsSVGFilterElement)
-
-NS_INTERFACE_TABLE_HEAD(nsSVGFilterElement)
-  NS_NODE_INTERFACE_TABLE5(nsSVGFilterElement, nsIDOMNode, nsIDOMElement,
-                           nsIDOMSVGElement,
-                           nsIDOMSVGFilterElement,
-                           nsIDOMSVGURIReference)
-  NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(SVGFilterElement)
-NS_INTERFACE_MAP_END_INHERITING(nsSVGFilterElementBase)
+NS_IMPL_ISUPPORTS_INHERITED4(SVGFilterElement, SVGFilterElementBase,
+                             nsIDOMNode, nsIDOMElement,
+                             nsIDOMSVGElement, nsIDOMSVGURIReference)
 
 //----------------------------------------------------------------------
 // Implementation
 
-nsSVGFilterElement::nsSVGFilterElement(already_AddRefed<nsINodeInfo> aNodeInfo)
-  : nsSVGFilterElementBase(aNodeInfo)
+SVGFilterElement::SVGFilterElement(already_AddRefed<nsINodeInfo> aNodeInfo)
+  : SVGFilterElementBase(aNodeInfo)
 {
+  SetIsDOMBinding();
 }
 
 //----------------------------------------------------------------------
 // nsIDOMNode methods
 
 
-NS_IMPL_ELEMENT_CLONE_WITH_INIT(nsSVGFilterElement)
+NS_IMPL_ELEMENT_CLONE_WITH_INIT(SVGFilterElement)
 
 
 //----------------------------------------------------------------------
-// nsIDOMSVGFilterElement methods
 
-/* readonly attribute nsIDOMSVGAnimatedLength x; */
-NS_IMETHODIMP nsSVGFilterElement::GetX(nsIDOMSVGAnimatedLength * *aX)
+already_AddRefed<SVGAnimatedLength>
+SVGFilterElement::X()
 {
-  return mLengthAttributes[X].ToDOMAnimatedLength(aX, this);
+  return mLengthAttributes[ATTR_X].ToDOMAnimatedLength(this);
 }
 
-/* readonly attribute nsIDOMSVGAnimatedLength y; */
-NS_IMETHODIMP nsSVGFilterElement::GetY(nsIDOMSVGAnimatedLength * *aY)
+already_AddRefed<SVGAnimatedLength>
+SVGFilterElement::Y()
 {
-  return mLengthAttributes[Y].ToDOMAnimatedLength(aY, this);
+   return mLengthAttributes[ATTR_Y].ToDOMAnimatedLength(this);
 }
 
-/* readonly attribute nsIDOMSVGAnimatedLength width; */
-NS_IMETHODIMP nsSVGFilterElement::GetWidth(nsIDOMSVGAnimatedLength * *aWidth)
+already_AddRefed<SVGAnimatedLength>
+SVGFilterElement::Width()
 {
-  return mLengthAttributes[WIDTH].ToDOMAnimatedLength(aWidth, this);
+  return mLengthAttributes[ATTR_WIDTH].ToDOMAnimatedLength(this);
 }
 
-/* readonly attribute nsIDOMSVGAnimatedLength height; */
-NS_IMETHODIMP nsSVGFilterElement::GetHeight(nsIDOMSVGAnimatedLength * *aHeight)
+already_AddRefed<SVGAnimatedLength>
+SVGFilterElement::Height()
 {
-  return mLengthAttributes[HEIGHT].ToDOMAnimatedLength(aHeight, this);
-}
-
-/* readonly attribute nsIDOMSVGAnimatedEnumeration filterUnits; */
-NS_IMETHODIMP nsSVGFilterElement::GetFilterUnits(nsIDOMSVGAnimatedEnumeration * *aUnits)
-{
-  return mEnumAttributes[FILTERUNITS].ToDOMAnimatedEnum(aUnits, this);
+  return mLengthAttributes[ATTR_HEIGHT].ToDOMAnimatedLength(this);
 }
 
-/* readonly attribute nsIDOMSVGAnimatedEnumeration primitiveUnits; */
-NS_IMETHODIMP nsSVGFilterElement::GetPrimitiveUnits(nsIDOMSVGAnimatedEnumeration * *aUnits)
+already_AddRefed<nsIDOMSVGAnimatedEnumeration>
+SVGFilterElement::FilterUnits()
 {
-  return mEnumAttributes[PRIMITIVEUNITS].ToDOMAnimatedEnum(aUnits, this);
+  return mEnumAttributes[FILTERUNITS].ToDOMAnimatedEnum(this);
 }
 
-/* readonly attribute nsIDOMSVGAnimatedEnumeration filterResY; */
-NS_IMETHODIMP nsSVGFilterElement::GetFilterResX(nsIDOMSVGAnimatedInteger * *aFilterResX)
+already_AddRefed<nsIDOMSVGAnimatedEnumeration>
+SVGFilterElement::PrimitiveUnits()
 {
-  return mIntegerPairAttributes[FILTERRES].ToDOMAnimatedInteger(aFilterResX,
-                                                                nsSVGIntegerPair::eFirst,
+  return mEnumAttributes[PRIMITIVEUNITS].ToDOMAnimatedEnum(this);
+}
+
+already_AddRefed<nsIDOMSVGAnimatedInteger>
+SVGFilterElement::FilterResX()
+{
+  return mIntegerPairAttributes[FILTERRES].ToDOMAnimatedInteger(nsSVGIntegerPair::eFirst,
                                                                 this);
 }
 
-/* readonly attribute nsIDOMSVGAnimatedEnumeration filterResY; */
-NS_IMETHODIMP nsSVGFilterElement::GetFilterResY(nsIDOMSVGAnimatedInteger * *aFilterResY)
+already_AddRefed<nsIDOMSVGAnimatedInteger>
+SVGFilterElement::FilterResY()
 {
-  return mIntegerPairAttributes[FILTERRES].ToDOMAnimatedInteger(aFilterResY,
-                                                                nsSVGIntegerPair::eSecond,
+  return mIntegerPairAttributes[FILTERRES].ToDOMAnimatedInteger(nsSVGIntegerPair::eSecond,
                                                                 this);
 }
 
-/* void setFilterRes (in unsigned long filterResX, in unsigned long filterResY);
- */
-NS_IMETHODIMP
-nsSVGFilterElement::SetFilterRes(uint32_t filterResX, uint32_t filterResY)
+void
+SVGFilterElement::SetFilterRes(uint32_t filterResX, uint32_t filterResY)
 {
   mIntegerPairAttributes[FILTERRES].SetBaseValues(filterResX, filterResY, this);
-  return NS_OK;
 }
 
 //----------------------------------------------------------------------
 // nsIDOMSVGURIReference methods
 
-/* readonly attribute nsIDOMSVGAnimatedString href; */
-NS_IMETHODIMP 
-nsSVGFilterElement::GetHref(nsIDOMSVGAnimatedString * *aHref)
+NS_IMETHODIMP
+SVGFilterElement::GetHref(nsIDOMSVGAnimatedString** aHref)
 {
-  return mStringAttributes[HREF].ToDOMAnimatedString(aHref, this);
+  *aHref = Href().get();
+  return NS_OK;
+}
+
+already_AddRefed<nsIDOMSVGAnimatedString>
+SVGFilterElement::Href()
+{
+  return mStringAttributes[HREF].ToDOMAnimatedString(this);
 }
 
 //----------------------------------------------------------------------
 // nsIContent methods
 
 NS_IMETHODIMP_(bool)
-nsSVGFilterElement::IsAttributeMapped(const nsIAtom* name) const
+SVGFilterElement::IsAttributeMapped(const nsIAtom* name) const
 {
   static const MappedAttributeEntry* const map[] = {
     sFEFloodMap,
     sFiltersMap,
     sFontSpecificationMap,
     sGradientStopMap,
     sLightingEffectsMap,
     sMarkersMap,
     sTextContentElementsMap,
     sViewportsMap
   };
   return FindAttributeDependence(name, map) ||
-    nsSVGFilterElementBase::IsAttributeMapped(name);
+    SVGFilterElementBase::IsAttributeMapped(name);
 }
 
 void
-nsSVGFilterElement::Invalidate()
+SVGFilterElement::Invalidate()
 {
   nsTObserverArray<nsIMutationObserver*> *observers = GetMutationObservers();
 
   if (observers && !observers->IsEmpty()) {
     nsTObserverArray<nsIMutationObserver*>::ForwardIterator iter(*observers);
     while (iter.HasMore()) {
       nsCOMPtr<nsIMutationObserver> obs(iter.GetNext());
       nsCOMPtr<nsISVGFilterProperty> filter = do_QueryInterface(obs);
@@ -184,43 +184,46 @@ nsSVGFilterElement::Invalidate()
     }
   }
 }
 
 //----------------------------------------------------------------------
 // nsSVGElement methods
 
 /* virtual */ bool
-nsSVGFilterElement::HasValidDimensions() const
+SVGFilterElement::HasValidDimensions() const
 {
-  return (!mLengthAttributes[WIDTH].IsExplicitlySet() ||
-           mLengthAttributes[WIDTH].GetAnimValInSpecifiedUnits() > 0) &&
-         (!mLengthAttributes[HEIGHT].IsExplicitlySet() || 
-           mLengthAttributes[HEIGHT].GetAnimValInSpecifiedUnits() > 0);
+  return (!mLengthAttributes[ATTR_WIDTH].IsExplicitlySet() ||
+           mLengthAttributes[ATTR_WIDTH].GetAnimValInSpecifiedUnits() > 0) &&
+         (!mLengthAttributes[ATTR_HEIGHT].IsExplicitlySet() ||
+           mLengthAttributes[ATTR_HEIGHT].GetAnimValInSpecifiedUnits() > 0);
 }
 
 nsSVGElement::LengthAttributesInfo
-nsSVGFilterElement::GetLengthInfo()
+SVGFilterElement::GetLengthInfo()
 {
   return LengthAttributesInfo(mLengthAttributes, sLengthInfo,
                               ArrayLength(sLengthInfo));
 }
 
 nsSVGElement::IntegerPairAttributesInfo
-nsSVGFilterElement::GetIntegerPairInfo()
+SVGFilterElement::GetIntegerPairInfo()
 {
   return IntegerPairAttributesInfo(mIntegerPairAttributes, sIntegerPairInfo,
                                    ArrayLength(sIntegerPairInfo));
 }
 
 nsSVGElement::EnumAttributesInfo
-nsSVGFilterElement::GetEnumInfo()
+SVGFilterElement::GetEnumInfo()
 {
   return EnumAttributesInfo(mEnumAttributes, sEnumInfo,
                             ArrayLength(sEnumInfo));
 }
 
 nsSVGElement::StringAttributesInfo
-nsSVGFilterElement::GetStringInfo()
+SVGFilterElement::GetStringInfo()
 {
   return StringAttributesInfo(mStringAttributes, sStringInfo,
                               ArrayLength(sStringInfo));
 }
+
+} // namespace dom
+} // namespace mozilla
rename from content/svg/content/src/nsSVGFilterElement.h
rename to content/svg/content/src/SVGFilterElement.h
--- a/content/svg/content/src/nsSVGFilterElement.h
+++ b/content/svg/content/src/SVGFilterElement.h
@@ -1,82 +1,103 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifndef __NS_SVGFILTERELEMENT_H__
-#define __NS_SVGFILTERELEMENT_H__
+#ifndef mozilla_dom_SVGFilterElement_h
+#define mozilla_dom_SVGFilterElement_h
 
-#include "nsIDOMSVGFilterElement.h"
-#include "nsIDOMSVGUnitTypes.h"
 #include "nsIDOMSVGURIReference.h"
 #include "nsSVGEnum.h"
 #include "nsSVGElement.h"
 #include "nsSVGIntegerPair.h"
 #include "nsSVGLength2.h"
 #include "nsSVGString.h"
 
-typedef nsSVGElement nsSVGFilterElementBase;
+typedef nsSVGElement SVGFilterElementBase;
+
+class nsSVGFilterFrame;
+class nsAutoFilterInstance;
+
+nsresult NS_NewSVGFilterElement(nsIContent **aResult,
+                                already_AddRefed<nsINodeInfo> aNodeInfo);
 
-class nsSVGFilterElement : public nsSVGFilterElementBase,
-                           public nsIDOMSVGFilterElement,
-                           public nsIDOMSVGURIReference,
-                           public nsIDOMSVGUnitTypes
+namespace mozilla {
+namespace dom {
+class SVGAnimatedLength;
+
+class SVGFilterElement : public SVGFilterElementBase,
+                         public nsIDOMSVGElement,
+                         public nsIDOMSVGURIReference
 {
-  friend class nsSVGFilterFrame;
-  friend class nsAutoFilterInstance;
+  friend class ::nsSVGFilterFrame;
+  friend class ::nsAutoFilterInstance;
 
 protected:
-  friend nsresult NS_NewSVGFilterElement(nsIContent **aResult,
-                                         already_AddRefed<nsINodeInfo> aNodeInfo);
-  nsSVGFilterElement(already_AddRefed<nsINodeInfo> aNodeInfo);
+  friend nsresult (::NS_NewSVGFilterElement(nsIContent **aResult,
+                                            already_AddRefed<nsINodeInfo> aNodeInfo));
+  SVGFilterElement(already_AddRefed<nsINodeInfo> aNodeInfo);
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
 
 public:
   // interfaces:
 
   NS_DECL_ISUPPORTS_INHERITED
-  NS_DECL_NSIDOMSVGFILTERELEMENT
   NS_DECL_NSIDOMSVGURIREFERENCE
 
   // xxx I wish we could use virtual inheritance
   NS_FORWARD_NSIDOMNODE_TO_NSINODE
   NS_FORWARD_NSIDOMELEMENT_TO_GENERIC
-  NS_FORWARD_NSIDOMSVGELEMENT(nsSVGFilterElementBase::)
+  NS_FORWARD_NSIDOMSVGELEMENT(SVGFilterElementBase::)
 
   // nsIContent
   virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
   NS_IMETHOD_(bool) IsAttributeMapped(const nsIAtom* aAttribute) const;
 
   // Invalidate users of this filter
   void Invalidate();
 
-  virtual nsXPCClassInfo* GetClassInfo();
-
   virtual nsIDOMNode* AsDOMNode() { return this; }
 
   // nsSVGSVGElement methods:
   virtual bool HasValidDimensions() const;
+
+  // WebIDL
+  already_AddRefed<SVGAnimatedLength> X();
+  already_AddRefed<SVGAnimatedLength> Y();
+  already_AddRefed<SVGAnimatedLength> Width();
+  already_AddRefed<SVGAnimatedLength> Height();
+  already_AddRefed<nsIDOMSVGAnimatedEnumeration> FilterUnits();
+  already_AddRefed<nsIDOMSVGAnimatedEnumeration> PrimitiveUnits();
+  already_AddRefed<nsIDOMSVGAnimatedInteger> FilterResX();
+  already_AddRefed<nsIDOMSVGAnimatedInteger> FilterResY();
+  void SetFilterRes(uint32_t filterResX, uint32_t filterResY);
+  already_AddRefed<nsIDOMSVGAnimatedString> Href();
+
 protected:
 
   virtual LengthAttributesInfo GetLengthInfo();
   virtual IntegerPairAttributesInfo GetIntegerPairInfo();
   virtual EnumAttributesInfo GetEnumInfo();
   virtual StringAttributesInfo GetStringInfo();
 
-  enum { X, Y, WIDTH, HEIGHT };
+  enum { ATTR_X, ATTR_Y, ATTR_WIDTH, ATTR_HEIGHT };
   nsSVGLength2 mLengthAttributes[4];
   static LengthInfo sLengthInfo[4];
 
   enum { FILTERRES };
   nsSVGIntegerPair mIntegerPairAttributes[1];
   static IntegerPairInfo sIntegerPairInfo[1];
 
   enum { FILTERUNITS, PRIMITIVEUNITS };
   nsSVGEnum mEnumAttributes[2];
   static EnumInfo sEnumInfo[2];
 
   enum { HREF };
   nsSVGString mStringAttributes[1];
   static StringInfo sStringInfo[1];
 };
 
-#endif
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_SVGFilterElement_h
--- a/content/svg/content/src/SVGGradientElement.cpp
+++ b/content/svg/content/src/SVGGradientElement.cpp
@@ -31,17 +31,17 @@ nsSVGEnumMapping SVGGradientElement::sSp
   {&nsGkAtoms::repeat, SVG_SPREADMETHOD_REPEAT},
   {nullptr, 0}
 };
 
 nsSVGElement::EnumInfo SVGGradientElement::sEnumInfo[2] =
 {
   { &nsGkAtoms::gradientUnits,
     sSVGUnitTypesMap,
-    nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX
+    SVG_UNIT_TYPE_OBJECTBOUNDINGBOX
   },
   { &nsGkAtoms::spreadMethod,
     sSpreadMethodMap,
     SVG_SPREADMETHOD_PAD
   }
 };
 
 nsSVGElement::StringInfo SVGGradientElement::sStringInfo[1] =
@@ -52,17 +52,16 @@ nsSVGElement::StringInfo SVGGradientElem
 //----------------------------------------------------------------------
 // nsISupports methods
 
 NS_IMPL_ADDREF_INHERITED(SVGGradientElement, SVGGradientElementBase)
 NS_IMPL_RELEASE_INHERITED(SVGGradientElement, SVGGradientElementBase)
 
 NS_INTERFACE_MAP_BEGIN(SVGGradientElement)
   NS_INTERFACE_MAP_ENTRY(nsIDOMSVGURIReference)
-  NS_INTERFACE_MAP_ENTRY(nsIDOMSVGUnitTypes)
 NS_INTERFACE_MAP_END_INHERITING(SVGGradientElementBase)
 
 //----------------------------------------------------------------------
 // Implementation
 
 SVGGradientElement::SVGGradientElement(already_AddRefed<nsINodeInfo> aNodeInfo)
   : SVGGradientElementBase(aNodeInfo)
 {
--- a/content/svg/content/src/SVGGradientElement.h
+++ b/content/svg/content/src/SVGGradientElement.h
@@ -2,17 +2,16 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef __NS_SVGGRADIENTELEMENT_H__
 #define __NS_SVGGRADIENTELEMENT_H__
 
 #include "nsIDOMSVGURIReference.h"
-#include "nsIDOMSVGUnitTypes.h"
 #include "nsSVGElement.h"
 #include "nsSVGLength2.h"
 #include "nsSVGEnum.h"
 #include "nsSVGString.h"
 #include "SVGAnimatedTransformList.h"
 
 static const unsigned short SVG_SPREADMETHOD_UNKNOWN = 0;
 static const unsigned short SVG_SPREADMETHOD_PAD     = 1;
@@ -37,17 +36,16 @@ class DOMSVGAnimatedTransformList;
 namespace dom {
 
 //--------------------- Gradients------------------------
 
 typedef nsSVGElement SVGGradientElementBase;
 
 class SVGGradientElement : public SVGGradientElementBase
                          , public nsIDOMSVGURIReference
-                         , public nsIDOMSVGUnitTypes
 {
   friend class ::nsSVGGradientFrame;
 
 protected:
   SVGGradientElement(already_AddRefed<nsINodeInfo> aNodeInfo);
   virtual JSObject*
   WrapNode(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap) MOZ_OVERRIDE = 0;
 
--- a/content/svg/content/src/SVGMaskElement.cpp
+++ b/content/svg/content/src/SVGMaskElement.cpp
@@ -33,34 +33,34 @@ nsSVGElement::LengthInfo SVGMaskElement:
   { &nsGkAtoms::width, 120, nsIDOMSVGLength::SVG_LENGTHTYPE_PERCENTAGE, SVGContentUtils::X },
   { &nsGkAtoms::height, 120, nsIDOMSVGLength::SVG_LENGTHTYPE_PERCENTAGE, SVGContentUtils::Y },
 };
 
 nsSVGElement::EnumInfo SVGMaskElement::sEnumInfo[2] =
 {
   { &nsGkAtoms::maskUnits,
     sSVGUnitTypesMap,
-    nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX
+    SVG_UNIT_TYPE_OBJECTBOUNDINGBOX
   },
   { &nsGkAtoms::maskContentUnits,
     sSVGUnitTypesMap,
-    nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE
+    SVG_UNIT_TYPE_USERSPACEONUSE
   }
 };
 
 //----------------------------------------------------------------------
 // nsISupports methods
 
 NS_IMPL_ADDREF_INHERITED(SVGMaskElement,SVGMaskElementBase)
 NS_IMPL_RELEASE_INHERITED(SVGMaskElement,SVGMaskElementBase)
 
 NS_INTERFACE_TABLE_HEAD(SVGMaskElement)
-  NS_NODE_INTERFACE_TABLE5(SVGMaskElement, nsIDOMNode, nsIDOMElement,
+  NS_NODE_INTERFACE_TABLE4(SVGMaskElement, nsIDOMNode, nsIDOMElement,
                            nsIDOMSVGElement,
-                           nsIDOMSVGMaskElement, nsIDOMSVGUnitTypes)
+                           nsIDOMSVGMaskElement)
   NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(SVGMaskElement)
 NS_INTERFACE_MAP_END_INHERITING(SVGMaskElementBase)
 
 //----------------------------------------------------------------------
 // Implementation
 
 SVGMaskElement::SVGMaskElement(already_AddRefed<nsINodeInfo> aNodeInfo)
   : SVGMaskElementBase(aNodeInfo)
--- a/content/svg/content/src/SVGMaskElement.h
+++ b/content/svg/content/src/SVGMaskElement.h
@@ -2,17 +2,16 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef mozilla_dom_SVGMaskElement_h
 #define mozilla_dom_SVGMaskElement_h
 
 #include "nsIDOMSVGMaskElement.h"
-#include "nsIDOMSVGUnitTypes.h"
 #include "nsSVGEnum.h"
 #include "nsSVGLength2.h"
 #include "nsSVGElement.h"
 
 class nsSVGMaskFrame;
 
 nsresult NS_NewSVGMaskElement(nsIContent **aResult,
                               already_AddRefed<nsINodeInfo> aNodeInfo);
@@ -20,18 +19,17 @@ nsresult NS_NewSVGMaskElement(nsIContent
 namespace mozilla {
 namespace dom {
 
 //--------------------- Masks ------------------------
 
 typedef nsSVGElement SVGMaskElementBase;
 
 class SVGMaskElement MOZ_FINAL : public SVGMaskElementBase,
-                                 public nsIDOMSVGMaskElement,
-                                 public nsIDOMSVGUnitTypes
+                                 public nsIDOMSVGMaskElement
 {
   friend class ::nsSVGMaskFrame;
 
 protected:
   friend nsresult (::NS_NewSVGMaskElement(nsIContent **aResult,
                                           already_AddRefed<nsINodeInfo> aNodeInfo));
   SVGMaskElement(already_AddRefed<nsINodeInfo> aNodeInfo);
   virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
--- a/content/svg/content/src/SVGPatternElement.cpp
+++ b/content/svg/content/src/SVGPatternElement.cpp
@@ -33,37 +33,36 @@ nsSVGElement::LengthInfo SVGPatternEleme
   { &nsGkAtoms::width, 0, nsIDOMSVGLength::SVG_LENGTHTYPE_PERCENTAGE, SVGContentUtils::X },
   { &nsGkAtoms::height, 0, nsIDOMSVGLength::SVG_LENGTHTYPE_PERCENTAGE, SVGContentUtils::Y },
 };
 
 nsSVGElement::EnumInfo SVGPatternElement::sEnumInfo[2] =
 {
   { &nsGkAtoms::patternUnits,
     sSVGUnitTypesMap,
-    nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX
+    SVG_UNIT_TYPE_OBJECTBOUNDINGBOX
   },
   { &nsGkAtoms::patternContentUnits,
     sSVGUnitTypesMap,
-    nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE
+    SVG_UNIT_TYPE_USERSPACEONUSE
   }
 };
 
 nsSVGElement::StringInfo SVGPatternElement::sStringInfo[1] =
 {
   { &nsGkAtoms::href, kNameSpaceID_XLink, true }
 };
 
 //----------------------------------------------------------------------
 // nsISupports methods
 
-NS_IMPL_ISUPPORTS_INHERITED5(SVGPatternElement, SVGPatternElementBase,
+NS_IMPL_ISUPPORTS_INHERITED4(SVGPatternElement, SVGPatternElementBase,
                              nsIDOMNode, nsIDOMElement,
                              nsIDOMSVGElement,
-                             nsIDOMSVGURIReference,
-                             nsIDOMSVGUnitTypes)
+                             nsIDOMSVGURIReference)
 
 //----------------------------------------------------------------------
 // Implementation
 
 SVGPatternElement::SVGPatternElement(already_AddRefed<nsINodeInfo> aNodeInfo)
   : SVGPatternElementBase(aNodeInfo)
 {
   SetIsDOMBinding();
--- a/content/svg/content/src/SVGPatternElement.h
+++ b/content/svg/content/src/SVGPatternElement.h
@@ -1,17 +1,16 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef mozilla_dom_SVGPatternElement_h
 #define mozilla_dom_SVGPatternElement_h
 
-#include "nsIDOMSVGUnitTypes.h"
 #include "nsIDOMSVGURIReference.h"
 #include "nsSVGEnum.h"
 #include "nsSVGLength2.h"
 #include "nsSVGString.h"
 #include "nsSVGElement.h"
 #include "nsSVGViewBox.h"
 #include "SVGAnimatedPreserveAspectRatio.h"
 #include "SVGAnimatedTransformList.h"
@@ -25,18 +24,17 @@ namespace mozilla {
 class DOMSVGAnimatedTransformList;
 
 namespace dom {
 
 typedef nsSVGElement SVGPatternElementBase;
 
 class SVGPatternElement MOZ_FINAL : public SVGPatternElementBase,
                                     public nsIDOMSVGElement,
-                                    public nsIDOMSVGURIReference,
-                                    public nsIDOMSVGUnitTypes
+                                    public nsIDOMSVGURIReference
 {
   friend class ::nsSVGPatternFrame;
 
 protected:
   friend nsresult (::NS_NewSVGPatternElement(nsIContent **aResult,
                                              already_AddRefed<nsINodeInfo> aNodeInfo));
   SVGPatternElement(already_AddRefed<nsINodeInfo> aNodeInfo);
   virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
--- a/content/svg/content/src/nsSVGElement.cpp
+++ b/content/svg/content/src/nsSVGElement.cpp
@@ -44,17 +44,16 @@
 #include "nsSVGString.h"
 #include "SVGAnimatedNumberList.h"
 #include "SVGAnimatedLengthList.h"
 #include "SVGAnimatedPointList.h"
 #include "SVGAnimatedPathSegList.h"
 #include "SVGAnimatedTransformList.h"
 #include "SVGContentUtils.h"
 #include "DOMSVGTests.h"
-#include "nsIDOMSVGUnitTypes.h"
 #include "nsSVGRect.h"
 #include "nsIFrame.h"
 #include "prdtoa.h"
 #include <stdarg.h>
 #include "nsSMILMappedAttribute.h"
 #include "SVGMotionSMILAttr.h"
 #include "nsAttrValueOrString.h"
 #include "nsSMILAnimationController.h"
@@ -67,18 +66,18 @@ using namespace mozilla::dom;
 // This is needed to ensure correct handling of calls to the
 // vararg-list methods in this file:
 //   nsSVGElement::GetAnimated{Length,Number,Integer}Values
 // See bug 547964 for details:
 PR_STATIC_ASSERT(sizeof(void*) == sizeof(nullptr));
 
 
 nsSVGEnumMapping nsSVGElement::sSVGUnitTypesMap[] = {
-  {&nsGkAtoms::userSpaceOnUse, nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE},
-  {&nsGkAtoms::objectBoundingBox, nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX},
+  {&nsGkAtoms::userSpaceOnUse, SVG_UNIT_TYPE_USERSPACEONUSE},
+  {&nsGkAtoms::objectBoundingBox, SVG_UNIT_TYPE_OBJECTBOUNDINGBOX},
   {nullptr, 0}
 };
 
 nsSVGElement::nsSVGElement(already_AddRefed<nsINodeInfo> aNodeInfo)
   : nsSVGElementBase(aNodeInfo)
 {
 }
 
--- a/content/svg/content/src/nsSVGElement.h
+++ b/content/svg/content/src/nsSVGElement.h
@@ -33,16 +33,21 @@ class nsSVGNumber2;
 class nsSVGNumberPair;
 class nsSVGString;
 class nsSVGViewBox;
 
 namespace mozilla {
 namespace dom {
 class CSSValue;
 class SVGSVGElement;
+
+static const unsigned short SVG_UNIT_TYPE_UNKNOWN           = 0;
+static const unsigned short SVG_UNIT_TYPE_USERSPACEONUSE    = 1;
+static const unsigned short SVG_UNIT_TYPE_OBJECTBOUNDINGBOX = 2;
+
 }
 
 class SVGAnimatedNumberList;
 class SVGNumberList;
 class SVGAnimatedLengthList;
 class SVGUserUnitList;
 class SVGAnimatedPointList;
 class SVGAnimatedPathSegList;
--- a/content/svg/content/src/nsSVGFilters.cpp
+++ b/content/svg/content/src/nsSVGFilters.cpp
@@ -10,33 +10,32 @@
 #include "nsSVGNumber2.h"
 #include "nsSVGNumberPair.h"
 #include "nsSVGInteger.h"
 #include "nsSVGIntegerPair.h"
 #include "nsSVGBoolean.h"
 #include "nsIDOMSVGFilters.h"
 #include "nsCOMPtr.h"
 #include "nsSVGFilterInstance.h"
-#include "nsIDOMSVGFilterElement.h"
 #include "nsSVGEnum.h"
 #include "SVGNumberList.h"
 #include "SVGAnimatedNumberList.h"
 #include "DOMSVGAnimatedNumberList.h"
 #include "nsSVGFilters.h"
 #include "nsLayoutUtils.h"
 #include "nsSVGUtils.h"
 #include "nsStyleContext.h"
 #include "nsIDocument.h"
 #include "nsIFrame.h"
 #include "gfxContext.h"
 #include "gfxMatrix.h"
 #include "imgIContainer.h"
 #include "nsNetUtil.h"
 #include "nsIInterfaceRequestorUtils.h"
-#include "nsSVGFilterElement.h"
+#include "mozilla/dom/SVGFilterElement.h"
 #include "nsSVGString.h"
 #include "nsSVGEffects.h"
 #include "gfxUtils.h"
 #include "SVGContentUtils.h"
 #include <algorithm>
 #include "nsContentUtils.h"
 #include "mozilla/dom/SVGComponentTransferFunctionElement.h"
 #include "mozilla/dom/SVGFEFuncAElementBinding.h"
@@ -5749,19 +5748,18 @@ nsSVGFEImageElement::Notify(imgIRequest*
 }
 
 //----------------------------------------------------------------------
 // helper methods
 
 void
 nsSVGFEImageElement::Invalidate()
 {
-  nsCOMPtr<nsIDOMSVGFilterElement> filter = do_QueryInterface(GetParent());
-  if (filter) {
-    static_cast<nsSVGFilterElement*>(GetParent())->Invalidate();
+  if (GetParent()->IsSVG(nsGkAtoms::filter)) {
+    static_cast<SVGFilterElement*>(GetParent())->Invalidate();
   }
 }
 
 //---------------------Displacement------------------------
 
 typedef nsSVGFE nsSVGFEDisplacementMapElementBase;
 
 class nsSVGFEDisplacementMapElement : public nsSVGFEDisplacementMapElementBase,
--- a/content/svg/content/src/nsSVGIntegerPair.cpp
+++ b/content/svg/content/src/nsSVGIntegerPair.cpp
@@ -168,30 +168,37 @@ nsSVGIntegerPair::SetAnimValue(const int
   aSVGElement->DidAnimateIntegerPair(mAttrEnum);
 }
 
 nsresult
 nsSVGIntegerPair::ToDOMAnimatedInteger(nsIDOMSVGAnimatedInteger **aResult,
                                        PairIndex aIndex,
                                        nsSVGElement *aSVGElement)
 {
+  *aResult = ToDOMAnimatedInteger(aIndex, aSVGElement).get();
+  return NS_OK;
+}
+
+already_AddRefed<nsIDOMSVGAnimatedInteger>
+nsSVGIntegerPair::ToDOMAnimatedInteger(PairIndex aIndex,
+                                       nsSVGElement* aSVGElement)
+{
   nsRefPtr<DOMAnimatedInteger> domAnimatedInteger =
     aIndex == eFirst ? sSVGFirstAnimatedIntegerTearoffTable.GetTearoff(this) :
                        sSVGSecondAnimatedIntegerTearoffTable.GetTearoff(this);
   if (!domAnimatedInteger) {
     domAnimatedInteger = new DOMAnimatedInteger(this, aIndex, aSVGElement);
     if (aIndex == eFirst) {
       sSVGFirstAnimatedIntegerTearoffTable.AddTearoff(this, domAnimatedInteger);
     } else {
       sSVGSecondAnimatedIntegerTearoffTable.AddTearoff(this, domAnimatedInteger);
     }
   }
 
-  domAnimatedInteger.forget(aResult);
-  return NS_OK;
+  return domAnimatedInteger.forget();
 }
 
 nsSVGIntegerPair::DOMAnimatedInteger::~DOMAnimatedInteger()
 {
   if (mIndex == eFirst) {
     sSVGFirstAnimatedIntegerTearoffTable.RemoveTearoff(mVal);
   } else {
     sSVGSecondAnimatedIntegerTearoffTable.RemoveTearoff(mVal);
--- a/content/svg/content/src/nsSVGIntegerPair.h
+++ b/content/svg/content/src/nsSVGIntegerPair.h
@@ -52,17 +52,20 @@ public:
   // If this returns false, the animated value is still valid, that is,
   // useable, and represents the default base value of the attribute.
   bool IsExplicitlySet() const
     { return mIsAnimated || mIsBaseSet; }
 
   nsresult ToDOMAnimatedInteger(nsIDOMSVGAnimatedInteger **aResult,
                                 PairIndex aIndex,
                                 nsSVGElement* aSVGElement);
-  // Returns a new nsISMILAttr object that the caller must delete
+  already_AddRefed<nsIDOMSVGAnimatedInteger>
+    ToDOMAnimatedInteger(PairIndex aIndex,
+                         nsSVGElement* aSVGElement);
+   // Returns a new nsISMILAttr object that the caller must delete
   nsISMILAttr* ToSMILAttr(nsSVGElement* aSVGElement);
 
 private:
 
   int32_t mAnimVal[2];
   int32_t mBaseVal[2];
   uint8_t mAttrEnum; // element specified tracking for attribute
   bool mIsAnimated;
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -315,26 +315,24 @@
 #include "nsIDOMSVGAnimatedLength.h"
 #include "nsIDOMSVGAnimatedNumber.h"
 #include "nsIDOMSVGAnimatedRect.h"
 #include "nsIDOMSVGAnimatedString.h"
 #include "nsIDOMTimeEvent.h"
 #include "nsIDOMSVGDocument.h"
 #include "nsIDOMSVGElement.h"
 #include "nsIDOMSVGEvent.h"
-#include "nsIDOMSVGFilterElement.h"
 #include "nsIDOMSVGFilters.h"
 #include "nsIDOMSVGImageElement.h"
 #include "nsIDOMSVGLength.h"
 #include "nsIDOMSVGMarkerElement.h"
 #include "nsIDOMSVGMaskElement.h"
 #include "nsIDOMSVGNumber.h"
 #include "nsIDOMSVGRect.h"
 #include "nsIDOMSVGTitleElement.h"
-#include "nsIDOMSVGUnitTypes.h"
 #include "nsIDOMSVGURIReference.h"
 #include "nsIDOMSVGZoomEvent.h"
 
 #include "nsIImageDocument.h"
 
 // Storage includes
 #include "nsDOMStorage.h"
 
@@ -1069,18 +1067,16 @@ static nsDOMClassInfoData sClassInfoData
   NS_DEFINE_CLASSINFO_DATA(SVGFESpecularLightingElement, nsElementSH,
                            ELEMENT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(SVGFESpotLightElement, nsElementSH,
                            ELEMENT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(SVGFETileElement, nsElementSH,
                            ELEMENT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(SVGFETurbulenceElement, nsElementSH,
                            ELEMENT_SCRIPTABLE_FLAGS)
-  NS_DEFINE_CLASSINFO_DATA(SVGFilterElement, nsElementSH,
-                           ELEMENT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(SVGImageElement, nsElementSH,
                            ELEMENT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(SVGMarkerElement, nsElementSH,
                            ELEMENT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(SVGMaskElement, nsElementSH,
                            ELEMENT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(SVGTitleElement, nsElementSH,
                            ELEMENT_SCRIPTABLE_FLAGS)
@@ -3007,38 +3003,30 @@ nsDOMClassInfo::Init()
   DOM_CLASSINFO_MAP_END
 
   DOM_CLASSINFO_MAP_BEGIN(SVGFETurbulenceElement, nsIDOMSVGFETurbulenceElement)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMSVGFETurbulenceElement)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMSVGFilterPrimitiveStandardAttributes)
     DOM_CLASSINFO_SVG_ELEMENT_MAP_ENTRIES
   DOM_CLASSINFO_MAP_END
 
-  DOM_CLASSINFO_MAP_BEGIN(SVGFilterElement, nsIDOMSVGFilterElement)
-    DOM_CLASSINFO_MAP_ENTRY(nsIDOMSVGFilterElement)
-    DOM_CLASSINFO_MAP_ENTRY(nsIDOMSVGURIReference)
-    DOM_CLASSINFO_MAP_ENTRY(nsIDOMSVGUnitTypes)
-    DOM_CLASSINFO_SVG_ELEMENT_MAP_ENTRIES
-  DOM_CLASSINFO_MAP_END
-
   DOM_CLASSINFO_MAP_BEGIN(SVGImageElement, nsIDOMSVGImageElement)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMSVGImageElement)
     DOM_CLASSINFO_MAP_ENTRY(nsIImageLoadingContent)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMSVGURIReference)
     DOM_CLASSINFO_SVG_GRAPHIC_ELEMENT_MAP_ENTRIES
   DOM_CLASSINFO_MAP_END
 
   DOM_CLASSINFO_MAP_BEGIN(SVGMarkerElement, nsIDOMSVGMarkerElement)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMSVGMarkerElement)
     DOM_CLASSINFO_SVG_ELEMENT_MAP_ENTRIES
   DOM_CLASSINFO_MAP_END
 
   DOM_CLASSINFO_MAP_BEGIN(SVGMaskElement, nsIDOMSVGMaskElement)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMSVGMaskElement)
-    DOM_CLASSINFO_MAP_ENTRY(nsIDOMSVGUnitTypes)
     DOM_CLASSINFO_SVG_ELEMENT_MAP_ENTRIES
   DOM_CLASSINFO_MAP_END
 
   DOM_CLASSINFO_MAP_BEGIN(SVGTitleElement, nsIDOMSVGTitleElement)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMSVGTitleElement)
     DOM_CLASSINFO_SVG_ELEMENT_MAP_ENTRIES
   DOM_CLASSINFO_MAP_END
 
--- a/dom/base/nsDOMClassInfoClasses.h
+++ b/dom/base/nsDOMClassInfoClasses.h
@@ -214,17 +214,16 @@ DOMCI_CLASS(SVGFEMergeElement)
 DOMCI_CLASS(SVGFEMergeNodeElement)
 DOMCI_CLASS(SVGFEMorphologyElement)
 DOMCI_CLASS(SVGFEOffsetElement)
 DOMCI_CLASS(SVGFEPointLightElement)
 DOMCI_CLASS(SVGFESpecularLightingElement)
 DOMCI_CLASS(SVGFESpotLightElement)
 DOMCI_CLASS(SVGFETileElement)
 DOMCI_CLASS(SVGFETurbulenceElement)
-DOMCI_CLASS(SVGFilterElement)
 DOMCI_CLASS(SVGImageElement)
 DOMCI_CLASS(SVGMarkerElement)
 DOMCI_CLASS(SVGMaskElement)
 DOMCI_CLASS(SVGTitleElement)
 DOMCI_CLASS(SVGUnknownElement)
 
 // other SVG classes
 DOMCI_CLASS(SVGAnimatedEnumeration)
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@@ -3235,17 +3235,17 @@ DOMGCSliceCallback(JSRuntime *aRt, JS::G
     nsJSContext::KillInterSliceGCTimer();
 
     sCCollectedWaitingForGC = 0;
     sCleanupsSinceLastGC = 0;
     sNeedsFullCC = true;
     sHasRunGC = true;
     nsJSContext::MaybePokeCC();
 
-    if (aDesc.isCompartment) {
+    if (aDesc.isCompartment_) {
       ++sCompartmentGCCount;
       if (!sFullGCTimer && !sShuttingDown) {
         CallCreateInstance("@mozilla.org/timer;1", &sFullGCTimer);
         JS::gcreason::Reason reason = JS::gcreason::FULL_GC_TIMER;
         sFullGCTimer->InitWithFuncCallback(FullGCTimerFired,
                                            reinterpret_cast<void *>(reason),
                                            NS_FULL_GC_DELAY,
                                            nsITimer::TYPE_ONE_SHOT);
--- a/dom/bluetooth/BluetoothUtils.cpp
+++ b/dom/bluetooth/BluetoothUtils.cpp
@@ -36,20 +36,19 @@ SetJsObject(JSContext* aContext,
 
   for (uint32_t i = 0; i < arr.Length(); i++) {
     jsval val;
     const BluetoothValue& v = arr[i].value();
     JSString* jsData;
 
     switch(v.type()) {
       case BluetoothValue::TnsString:
-        jsData =
-          JS_NewStringCopyN(aContext,
-                            NS_ConvertUTF16toUTF8(v.get_nsString()).get(),
-                            v.get_nsString().Length());
+        jsData = JS_NewUCStringCopyN(aContext,
+                                     v.get_nsString().BeginReading(),
+                                     v.get_nsString().Length());
         NS_ENSURE_TRUE(jsData, false);
         val = STRING_TO_JSVAL(jsData);
         break;
       case BluetoothValue::Tuint32_t:
         val = INT_TO_JSVAL(v.get_uint32_t());
         break;
       case BluetoothValue::Tbool:
         val = BOOLEAN_TO_JSVAL(v.get_bool());
--- a/dom/interfaces/events/Makefile.in
+++ b/dom/interfaces/events/Makefile.in
@@ -53,15 +53,16 @@ XPIDLSRCS =					\
 	nsIDOMAnimationEvent.idl		\
 	nsIDOMPopStateEvent.idl			\
 	nsIDOMCloseEvent.idl			\
 	nsIDOMTouchEvent.idl			\
 	nsIDOMHashChangeEvent.idl		\
 	nsIDOMCustomEvent.idl			\
 	nsIDOMCompositionEvent.idl		\
 	nsIDOMWheelEvent.idl			\
+	nsIDOMBlobEvent.idl			\
 	$(NULL)
 
 include $(topsrcdir)/config/rules.mk
 
 XPIDL_FLAGS += \
   -I$(topsrcdir)/dom/interfaces/base \
   $(NULL)
new file mode 100644
--- /dev/null
+++ b/dom/interfaces/events/nsIDOMBlobEvent.idl
@@ -0,0 +1,31 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsIDOMEvent.idl"
+interface nsIDOMBlob;
+/**
+ * The nsIDOMBlobEvent interface is used for server-sent events
+ *
+ * For more information on this interface, please see
+ * https://dvcs.w3.org/hg/dap/raw-file/tip/media-stream-capture/RecordingProposal.html
+ */
+[scriptable, builtinclass, uuid(84293ee0-68f5-11e2-9906-cf63ba8c6e43)]
+interface nsIDOMBlobEvent : nsIDOMEvent
+{
+  /**
+   * Custom blob data associated with this event.
+   */
+  readonly attribute nsIDOMBlob data;
+  
+  [noscript]
+  void initBlobEvent(in DOMString aType,
+                     in boolean aCanBubble,
+                     in boolean aCancelable,
+                     in nsIDOMBlob aData);
+};
+
+dictionary BlobEventInit : EventInit {
+  nsIDOMBlob data;
+};
--- a/dom/interfaces/svg/Makefile.in
+++ b/dom/interfaces/svg/Makefile.in
@@ -22,17 +22,16 @@ XPIDLSRCS	= \
 		nsIDOMSVGAnimatedInteger.idl \
 		nsIDOMSVGAnimatedLength.idl \
 		nsIDOMSVGAnimatedNumber.idl \
 		nsIDOMSVGAnimatedRect.idl \
 		nsIDOMSVGAnimatedString.idl \
 		nsIDOMSVGDocument.idl \
 		nsIDOMSVGElement.idl \
 		nsIDOMSVGEvent.idl \
-		nsIDOMSVGFilterElement.idl \
 		nsIDOMSVGFilters.idl \
 		nsIDOMSVGImageElement.idl \
 		nsIDOMSVGLength.idl \
 		nsIDOMSVGMarkerElement.idl \
 		nsIDOMSVGMaskElement.idl \
 		nsIDOMSVGNumber.idl \
 		nsIDOMSVGRect.idl \
 		nsIDOMSVGStringList.idl \
deleted file mode 100644
--- a/dom/interfaces/svg/nsIDOMSVGFilterElement.idl
+++ /dev/null
@@ -1,43 +0,0 @@
-/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsIDOMSVGElement.idl"
-
-interface nsIDOMSVGAnimatedLength;
-interface nsIDOMSVGAnimatedEnumeration;
-interface nsIDOMSVGAnimatedInteger;
-
-[scriptable, uuid(974C7633-0258-4BE7-B1AE-E0ED1964C87F)]
-interface nsIDOMSVGFilterElement
-  : nsIDOMSVGElement
-/*
-        The SVG DOM makes use of multiple interface inheritance.
-        Since XPCOM only supports single interface inheritance,
-        the best thing that we can do is to promise that whenever
-        an object implements _this_ interface it will also
-        implement the following interfaces. (We then have to QI to
-        hop between them.)
-        
-    nsIDOMSVGElement,
-    nsIDOMSVGURIReference,
-    nsIDOMSVGLangSpace,
-    nsIDOMSVGExternalResourcesRequired,
-    nsIDOMSVGStylable,
-*/
-{ 
-    readonly attribute nsIDOMSVGAnimatedEnumeration filterUnits;
-    readonly attribute nsIDOMSVGAnimatedEnumeration primitiveUnits;
-    readonly attribute nsIDOMSVGAnimatedLength      x;
-    readonly attribute nsIDOMSVGAnimatedLength      y;
-    readonly attribute nsIDOMSVGAnimatedLength      width;
-    readonly attribute nsIDOMSVGAnimatedLength      height;
-
-    readonly attribute nsIDOMSVGAnimatedInteger    filterResX;
-    readonly attribute nsIDOMSVGAnimatedInteger    filterResY;
-
-    void setFilterRes (in unsigned long filterResX, in unsigned long filterResY);
-};
-
-
--- a/dom/media/PeerConnection.js
+++ b/dom/media/PeerConnection.js
@@ -330,19 +330,18 @@ PeerConnection.prototype = {
    * We check for basic structure and well-formed stun/turn urls, but not
    * validity of servers themselves, before passing along to C++.
    * ErrorMsg is passed in to detail which array-entry failed, if any.
    */
   _mustValidateRTCConfiguration: function(rtcConfig, errorMsg) {
     function isObject(obj) {
       return obj && (typeof obj === "object");
     }
-    function isArray(obj) {
-      return isObject(obj) &&
-        (Object.prototype.toString.call(obj) === "[object Array]");
+    function isArraylike(obj) {
+      return isObject(obj) && ("length" in obj);
     }
     function nicerNewURI(uriStr, errorMsg) {
       let ios = Cc['@mozilla.org/network/io-service;1'].getService(Ci.nsIIOService);
       try {
         return ios.newURI(uriStr, null, null);
       } catch (e if (e.result == Cr.NS_ERROR_MALFORMED_URI)) {
         throw new Error(errorMsg + " - malformed URI: " + uriStr);
       }
@@ -354,55 +353,97 @@ PeerConnection.prototype = {
       }
       if (server.credential && isObject(server.credential)) {
         throw new Error (errorMsg + " - invalid credential");
       }
     }
     if (!isObject(rtcConfig)) {
       throw new Error (errorMsg);
     }
-    if (!isArray(rtcConfig.iceServers)) {
+    if (!isArraylike(rtcConfig.iceServers)) {
       throw new Error (errorMsg + " - iceServers [] property not present");
     }
-    for (let i=0; i < rtcConfig.iceServers.length; i++) {
+    let len = rtcConfig.iceServers.length;
+    for (let i=0; i < len; i++) {
       mustValidateServer (rtcConfig.iceServers[i], errorMsg);
     }
   },
 
   /**
    * Constraints look like this:
    *
    * {
-   *   mandatory: {"foo": true, "bar": 10, "baz": "boo"},
-   *   optional: [{"foo": true}, {"bar": 10}]
+   *   mandatory: {"OfferToReceiveAudio": true, "OfferToReceiveVideo": true },
+   *   optional: [{"VoiceActivityDetection": true}, {"FooBar": 10}]
    * }
    *
-   * We check for basic structure but not the validity of the constraints
-   * themselves before passing them along to C++.
+   * We check for basic structure of constraints and the validity of
+   * mandatory constraints against those we support (fail if we don't).
+   * Unknown optional constraints may be of any type.
    */
-  _validateConstraints: function(constraints) {
+  _mustValidateConstraints: function(constraints, errorMsg) {
     function isObject(obj) {
       return obj && (typeof obj === "object");
     }
-    function isArray(obj) {
-      return isObject(obj) &&
-        (Object.prototype.toString.call(obj) === "[object Array]");
+    function isArraylike(obj) {
+      return isObject(obj) && ("length" in obj);
     }
-
-    if (!isObject(constraints)) {
-      return false;
+    const SUPPORTED_CONSTRAINTS = {
+      OfferToReceiveAudio:1,
+      OfferToReceiveVideo:1,
+      MozDontOfferDataChannel:1
+    };
+    const OTHER_KNOWN_CONSTRAINTS = {
+      VoiceActivityDetection:1,
+      IceTransports:1,
+      RequestIdentity:1
+    };
+    // Parse-aid: Testing for pilot error of missing outer block avoids
+    // otherwise silent no-op since both mandatory and optional are optional
+    if (!isObject(constraints) || Array.isArray(constraints)) {
+      throw new Error(errorMsg);
     }
-    if (constraints.mandatory && !isObject(constraints.mandatory)) {
-      return false;
+    if (constraints.mandatory) {
+      // Testing for pilot error of using [] on mandatory here throws nicer msg
+      // (arrays would throw in loop below regardless but with more cryptic msg)
+      if (!isObject(constraints.mandatory) || Array.isArray(constraints.mandatory)) {
+        throw new Error(errorMsg + " - malformed mandatory constraints");
+      }
+      for (let constraint in constraints.mandatory) {
+        if (!(constraint in SUPPORTED_CONSTRAINTS) &&
+            constraints.mandatory.hasOwnProperty(constraint)) {
+          throw new Error (errorMsg + " - " +
+                           ((constraint in OTHER_KNOWN_CONSTRAINTS)?
+                            "unsupported" : "unknown") +
+                           " mandatory constraint: " + constraint);
+        }
+      }
     }
-    if (constraints.optional && !isArray(constraints.optional)) {
-      return false;
+    if (constraints.optional) {
+      if (!isArraylike(constraints.optional)) {
+        throw new Error(errorMsg + " - malformed optional constraint array");
+      }
+      let len = constraints.optional.length;
+      for (let i = 0; i < len; i += 1) {
+        if (!isObject(constraints.optional[i])) {
+          throw new Error(errorMsg + " - malformed optional constraint: " +
+                          constraints.optional[i]);
+        }
+        let constraints_per_entry = 0;
+        for (let constraint in constraints.optional[i]) {
+          if (constraints.optional[i].hasOwnProperty(constraint)) {
+            if (constraints_per_entry) {
+              throw new Error (errorMsg +
+                               " - optional constraint must be single key/value pair");
+            }
+            constraints_per_entry += 1;
+          }
+        }
+      }
     }
-
-    return true;
   },
 
   // Ideally, this should be of the form _checkState(state),
   // where the state is taken from an enumeration containing
   // the valid peer connection states defined in the WebRTC
   // spec. See Bug 831756.
   _checkClosed: function() {
     if (this._closed) {
@@ -410,20 +451,17 @@ PeerConnection.prototype = {
     }
   },
 
   createOffer: function(onSuccess, onError, constraints) {
     if (!constraints) {
       constraints = {};
     }
 
-    if (!this._validateConstraints(constraints)) {
-      throw new Error("createOffer passed invalid constraints");
-    }
-
+    this._mustValidateConstraints(constraints, "createOffer passed invalid constraints");
     this._onCreateOfferSuccess = onSuccess;
     this._onCreateOfferFailure = onError;
 
     this._queueOrRun({
       func: this._pc.createOffer,
       args: [constraints],
       wait: true
     });
@@ -462,19 +500,17 @@ PeerConnection.prototype = {
     this._pc.createAnswer(constraints);
   },
 
   createAnswer: function(onSuccess, onError, constraints, provisional) {
     if (!constraints) {
       constraints = {};
     }
 
-    if (!this._validateConstraints(constraints)) {
-      throw new Error("createAnswer passed invalid constraints");
-    }
+    this._mustValidateConstraints(constraints, "createAnswer passed invalid constraints");
 
     if (!provisional) {
       provisional = false;
     }
 
     this._queueOrRun({
       func: this._createAnswer,
       args: [onSuccess, onError, constraints, provisional],
--- a/dom/media/tests/mochitest/Makefile.in
+++ b/dom/media/tests/mochitest/Makefile.in
@@ -28,16 +28,17 @@ MOCHITEST_FILES = \
   test_peerConnection_basicAudio.html \
   test_peerConnection_basicAudioVideo.html \
   test_peerConnection_basicAudioVideoCombined.html \
   test_peerConnection_basicVideo.html \
   test_peerConnection_bug822674.html \
   test_peerConnection_bug827843.html \
   test_peerConnection_bug825703.html \
   test_peerConnection_bug834153.html \
+  test_peerConnection_bug835370.html \
   test_peerConnection_bug840344.html \
   head.js \
   mediaStreamPlayback.js \
   pc.js \
   $(NULL)
 
 # The following tests are leaking and cannot be run by default yet
 ifdef MOZ_WEBRTC_LEAKING_TESTS
new file mode 100644
--- /dev/null
+++ b/dom/media/tests/mochitest/test_peerConnection_bug835370.html
@@ -0,0 +1,67 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=825703
+-->
+<head>
+  <meta charset="utf-8">
+    <title>Bug 835370: PeerConnection.createOffer valid/invalid constraints permutations</title>
+    <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+    <script type="application/javascript" src="/MochiKit/MochiKit.js"></script>
+    <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+    <script type="application/javascript" src="head.js"></script>
+  </meta>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=825703">PeerConnection.createOffer constraints valid/invalid constraints permutations</a>
+<p id="display"></p>
+<pre id="test">
+<script class="testbody" type="application/javascript">
+runTest(function () {
+  var pconnect  = new mozRTCPeerConnection();
+  var pconnects = new mozRTCPeerConnection();
+
+  function step1(offer) {}
+  function failed(code) {}
+
+  var exception = null;
+  try { pconnects.createOffer(step1, failed); } catch (e) { exception = e; }
+  ok(!exception, "createOffer(step1, failed) succeeds");
+  exception = null;
+  try { pconnect.createOffer(step1, failed, 1); } catch (e) { exception = e; }
+  ok(exception, "createOffer(step1, failed, 1) throws");
+  exception = null;
+  try { pconnect.createOffer(step1, failed, []); } catch (e) { exception = e; }
+  ok(exception, "createOffer(step1, failed, []) throws");
+  exception = null;
+  try { pconnects.createOffer(step1, failed, {}); } catch (e) { exception = e; }
+  ok(!exception, "createOffer(step1, failed, {}) succeeds");
+  exception = null;
+  try { pconnect.createOffer(step1, failed, { mandatory: [] }); } catch (e) { exception = e; }
+  ok(exception, "createOffer(step1, failed, { mandatory: [] }) throws");
+  exception = null;
+  try { pconnect.createOffer(step1, failed, { mandatory: { FooBar: true } }); } catch (e) { exception = e; }
+  ok(exception, "createOffer(step1, failed, { mandatory: { FooBar: true } }) throws");
+  exception = null;
+  try { pconnect.createOffer(step1, failed, { optional: {} }); } catch (e) { exception = e; }
+  ok(exception, "createOffer(step1, failed, { optional: {} }) throws");
+  exception = null;
+  try { pconnects.createOffer(step1, failed, { optional: [] }); } catch (e) { exception = e; }
+  ok(!exception, "createOffer(step1, failed, { optional: [] }) succeeds");
+  exception = null;
+  try { pconnect.createOffer(step1, failed, { optional: [1] }); } catch (e) { exception = e; }
+  ok(exception, "createOffer(step1, failed, { optional: [1] }) throws");
+  exception = null;
+  try { pconnect.createOffer(step1, failed, { optional: [{ OfferToReceiveVideo: false, OfferToReceiveAudio: true, }] }); } catch (e) { exception = e; }
+  ok(exception, "createOffer(step1, failed, { optional: [{ OfferToReceiveVideo: false, OfferToReceiveAudio: true, }] }) throws");
+  exception = null;
+  try { pconnects.createOffer(step1, failed, { mandatory: { OfferToReceiveVideo: false, OfferToReceiveAudio: true, MozDontOfferDataChannel: true}, optional: [{ VoiceActivityDetection: true }, { FooBar: "42"  }] }); } catch (e) { exception = e; }
+  ok(!exception, "createOffer(step1, failed, { mandatory: { OfferToReceiveVideo: false, OfferToReceiveAudio: true, MozDontOfferDataChannel: true}, optional: [{ VoiceActivityDetection: true }, { FooBar: \"42\"  }] }) succeeds");
+  pconnect = null;
+  pconnects = null;
+  SimpleTest.finish();
+}, true);
+</script>
+</pre>
+</body>
+</html>
--- a/dom/system/gonk/RadioInterfaceLayer.js
+++ b/dom/system/gonk/RadioInterfaceLayer.js
@@ -581,17 +581,23 @@ RadioInterfaceLayer.prototype = {
       case "cardstatechange":
         this.rilContext.cardState = message.cardState;
         this._sendTargetMessage("mobileconnection", "RIL:CardStateChanged", message);
         break;
       case "setCallWaiting":
         this.handleCallWaitingStatusChange(message);
         break;
       case "sms-received":
-        this.handleSmsReceived(message);
+        let ackOk = this.handleSmsReceived(message);
+        if (ackOk) {
+          this.worker.postMessage({
+            rilMessageType: "ackSMS",
+            result: RIL.PDU_FCS_OK
+          });
+        }
         return;
       case "sms-sent":
         this.handleSmsSent(message);
         return;
       case "sms-delivery":
         this.handleSmsDelivery(message);
         return;
       case "sms-send-failed":
@@ -1428,35 +1434,35 @@ RadioInterfaceLayer.prototype = {
     // Dispatch to registered handler if application port addressing is
     // available. Note that the destination port can possibly be zero when
     // representing a UDP/TCP port.
     if (message.header && message.header.destinationPort != null) {
       let handler = this.portAddressedSmsApps[message.header.destinationPort];
       if (handler) {
         handler(message);
       }
-      return;
+      return true;
     }
 
     if (message.encoding == RIL.PDU_DCS_MSG_CODING_8BITS_ALPHABET) {
       // Don't know how to handle binary data yet.
-      return;
+      return true;
     }
 
     // TODO: Bug #768441
     // For now we don't store indicators persistently. When the mwi.discard
     // flag is false, we'll need to persist the indicator to EFmwis.
     // See TS 23.040 9.2.3.24.2
 
     let mwi = message.mwi;
     if (mwi) {
       mwi.returnNumber = message.sender || null;
       mwi.returnMessage = message.fullBody || null;
       this._sendTargetMessage("voicemail", "RIL:VoicemailNotification", mwi);
-      return;
+      return true;
     }
 
     let notifyReceived = function notifyReceived(rv, sms) {
       let success = Components.isSuccessCode(rv);
 
       // Acknowledge the reception of the SMS.
       message.rilMessageType = "ackSMS";
       if (!success) {
@@ -1500,16 +1506,19 @@ RadioInterfaceLayer.prototype = {
                                              message.sender || null,
                                              message.receiver || null,
                                              message.fullBody || null,
                                              message.messageClass,
                                              message.timestamp,
                                              false);
       notifyReceived(Cr.NS_OK, sms);
     }
+
+    // SMS ACK will be sent in notifyReceived. Return false here.
+    return false;
   },
 
   /**
    * Local storage for sent SMS messages.
    */
   _sentSmsEnvelopes: null,
   createSmsEnvelope: function createSmsEnvelope(options) {
     let i;
--- a/dom/tests/mochitest/general/test_interfaces.html
+++ b/dom/tests/mochitest/general/test_interfaces.html
@@ -527,17 +527,18 @@ var interfaceNamesInGlobalScope =
     "RTCSessionDescription",
     "RTCIceCandidate",
     "RTCPeerConnection",
     "LocalMediaStream",
     "CSSConditionRule",
     "CSSGroupingRule",
     "AsyncScrollEventDetail",
     "MozSmsSegmentInfo",
-    "DOMCursor"
+    "DOMCursor",
+    "BlobEvent"
   ]
 
 for (var i in SpecialPowers.Components.interfaces) {
   var s = i.toString();
   var name = null;
   if (s.indexOf("nsIDOM") == 0) {
     name = s.substring("nsIDOM".length);
   } else if (s.indexOf("nsI") == 0) {
--- a/dom/webidl/DummyBinding.webidl
+++ b/dom/webidl/DummyBinding.webidl
@@ -5,16 +5,16 @@
  */
 
 // Dummy bindings that we need to force generation of things that
 // aren't actually referenced anywhere in IDL yet but are used in C++.
 
 interface DummyInterface {
   readonly attribute OnErrorEventHandlerNonNull onErrorEventHandler;
   FilePropertyBag fileBag();
-  RTCIceServer rtcIceServer();
+  RTCConfiguration rtcConfiguration();
   CFStateChangeEventDict cfstateChangeEvent();
   USSDReceivedEventDict ussdReceivedEvent();
 };
 
 interface DummyInterfaceWorkers {
   BlobPropertyBag blobBag();
 };
new file mode 100644
--- /dev/null
+++ b/dom/webidl/RTCConfiguration.webidl
@@ -0,0 +1,14 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+dictionary RTCIceServer {
+    DOMString  url;
+    DOMString? credential = null;
+};
+
+dictionary RTCConfiguration {
+    sequence<RTCIceServer> iceServers;
+};
new file mode 100644
--- /dev/null
+++ b/dom/webidl/SVGFilterElement.webidl
@@ -0,0 +1,32 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * The origin of this IDL file is
+ * http://www.w3.org/TR/SVG2/
+ *
+ * Copyright © 2012 W3C® (MIT, ERCIM, Keio), All Rights Reserved. W3C
+ * liability, trademark and document use rules apply.
+ */
+
+interface SVGAnimatedEnumeration;
+interface SVGAnimatedInteger;
+
+interface SVGFilterElement : SVGElement {
+  readonly attribute SVGAnimatedEnumeration filterUnits;
+  readonly attribute SVGAnimatedEnumeration primitiveUnits;
+  readonly attribute SVGAnimatedLength x;
+  readonly attribute SVGAnimatedLength y;
+  readonly attribute SVGAnimatedLength width;
+  readonly attribute SVGAnimatedLength height;
+  readonly attribute SVGAnimatedInteger filterResX;
+  readonly attribute SVGAnimatedInteger filterResY;
+
+  void setFilterRes(unsigned long filterResX, unsigned long filterResY);
+  // ImageData apply(ImageData source);
+};
+
+SVGFilterElement implements SVGURIReference;
+SVGFilterElement implements SVGUnitTypes;
+
--- a/dom/webidl/SVGUnitTypes.webidl
+++ b/dom/webidl/SVGUnitTypes.webidl
@@ -5,15 +5,14 @@
  *
  * The origin of this IDL file is
  * https://svgwg.org/svg2-draft/
  *
  * Copyright © 2012 W3C® (MIT, ERCIM, Keio), All Rights Reserved. W3C
  * liability, trademark and document use rules apply.
  */
 
-[NoInterfaceObject]
 interface SVGUnitTypes {
   // Unit Types
   const unsigned short SVG_UNIT_TYPE_UNKNOWN = 0;
   const unsigned short SVG_UNIT_TYPE_USERSPACEONUSE = 1;
   const unsigned short SVG_UNIT_TYPE_OBJECTBOUNDINGBOX = 2;
 };
--- a/dom/webidl/WebIDL.mk
+++ b/dom/webidl/WebIDL.mk
@@ -119,17 +119,17 @@ webidl_files = \
   PaintRequestList.webidl \
   PannerNode.webidl \
   Performance.webidl \
   PerformanceNavigation.webidl \
   PerformanceTiming.webidl \
   ProcessingInstruction.webidl \
   Rect.webidl \
   RGBColor.webidl \
-  RTCIceServer.webidl \
+  RTCConfiguration.webidl \
   Screen.webidl \
   SVGAElement.webidl \
   SVGAltGlyphElement.webidl \
   SVGAngle.webidl \
   SVGAnimatedAngle.webidl \
   SVGAnimatedBoolean.webidl \
   SVGAnimatedLength.webidl \
   SVGAnimatedLengthList.webidl \
@@ -144,16 +144,17 @@ webidl_files = \
   SVGAnimationElement.webidl \
   SVGCircleElement.webidl \
   SVGClipPathElement.webidl \
   SVGComponentTransferFunctionElement.webidl \
   SVGDefsElement.webidl \
   SVGDescElement.webidl \
   SVGElement.webidl \
   SVGEllipseElement.webidl \
+  SVGFilterElement.webidl \
   SVGFEFuncAElement.webidl \
   SVGFEFuncBElement.webidl \
   SVGFEFuncGElement.webidl \
   SVGFEFuncRElement.webidl \
   SVGFitToViewBox.webidl \
   SVGForeignObjectElement.webidl \
   SVGGElement.webidl \
   SVGGradientElement.webidl \
--- a/editor/libeditor/base/nsEditor.cpp
+++ b/editor/libeditor/base/nsEditor.cpp
@@ -4561,18 +4561,17 @@ nsEditor::CreateTxnForDeleteSelection(ED
   // Check whether the selection is collapsed and we should do nothing:
   if (selection->Collapsed() && aAction == eNone) {
     return NS_OK;
   }
 
   // allocate the out-param transaction
   nsRefPtr<EditAggregateTxn> aggTxn = new EditAggregateTxn();
 
-  uint32_t rangeCount = selection->GetRangeCount();
-  for (uint32_t rangeIdx = 0; rangeIdx < rangeCount; ++rangeIdx) {
+  for (uint32_t rangeIdx = 0; rangeIdx < selection->GetRangeCount(); ++rangeIdx) {
     nsRefPtr<nsRange> range = selection->GetRangeAt(rangeIdx);
     NS_ENSURE_STATE(range);
 
     // Same with range as with selection; if it is collapsed and action
     // is eNone, do nothing.
     if (!range->Collapsed()) {
       nsRefPtr<DeleteRangeTxn> txn = new DeleteRangeTxn();
       txn->Init(this, range, &mRangeUpdater);
--- a/gfx/skia/include/core/SkPostConfig.h
+++ b/gfx/skia/include/core/SkPostConfig.h
@@ -63,20 +63,18 @@
  * The clang static analyzer likes to know that when the program is not
  * expected to continue (crash, assertion failure, etc). It will notice that
  * some combination of parameters lead to a function call that does not return.
  * It can then make appropriate assumptions about the parameters in code
  * executed only if the non-returning function was *not* called.
  */
 #if !defined(SkNO_RETURN_HINT)
     #if SK_HAS_COMPILER_FEATURE(attribute_analyzer_noreturn)
-        namespace {
-            inline void SkNO_RETURN_HINT() __attribute__((analyzer_noreturn));
-            inline void SkNO_RETURN_HINT() {}
-        }
+        inline void SkNO_RETURN_HINT() __attribute__((analyzer_noreturn));
+        inline void SkNO_RETURN_HINT() {}
     #else
         #define SkNO_RETURN_HINT() do {} while (false)
     #endif
 #endif
 
 #if defined(SK_ZLIB_INCLUDE) && defined(SK_SYSTEM_ZLIB)
     #error "cannot define both SK_ZLIB_INCLUDE and SK_SYSTEM_ZLIB"
 #elif defined(SK_ZLIB_INCLUDE) || defined(SK_SYSTEM_ZLIB)
new file mode 100644
--- /dev/null
+++ b/gfx/skia/patches/0011-Bug-839347-no-anon-namespace-around-SkNO_RETURN_HINT.patch
@@ -0,0 +1,31 @@
+# HG changeset patch
+# Parent 2c6da9f02606f7a02f635d99ef8cf669d3bc5c4b
+# User Daniel Holbert <dholbert@cs.stanford.edu>
+Bug 839347: Move SkNO_RETURN_HINT out of anonymous namespace so that clang won't warn about it being unused. r=mattwoodrow
+
+diff --git a/gfx/skia/include/core/SkPostConfig.h b/gfx/skia/include/core/SkPostConfig.h
+--- a/gfx/skia/include/core/SkPostConfig.h
++++ b/gfx/skia/include/core/SkPostConfig.h
+@@ -63,20 +63,18 @@
+  * The clang static analyzer likes to know that when the program is not
+  * expected to continue (crash, assertion failure, etc). It will notice that
+  * some combination of parameters lead to a function call that does not return.
+  * It can then make appropriate assumptions about the parameters in code
+  * executed only if the non-returning function was *not* called.
+  */
+ #if !defined(SkNO_RETURN_HINT)
+     #if SK_HAS_COMPILER_FEATURE(attribute_analyzer_noreturn)
+-        namespace {
+-            inline void SkNO_RETURN_HINT() __attribute__((analyzer_noreturn));
+-            inline void SkNO_RETURN_HINT() {}
+-        }
++        inline void SkNO_RETURN_HINT() __attribute__((analyzer_noreturn));
++        inline void SkNO_RETURN_HINT() {}
+     #else
+         #define SkNO_RETURN_HINT() do {} while (false)
+     #endif
+ #endif
+ 
+ #if defined(SK_ZLIB_INCLUDE) && defined(SK_SYSTEM_ZLIB)
+     #error "cannot define both SK_ZLIB_INCLUDE and SK_SYSTEM_ZLIB"
+ #elif defined(SK_ZLIB_INCLUDE) || defined(SK_SYSTEM_ZLIB)
--- a/gfx/skia/patches/README
+++ b/gfx/skia/patches/README
@@ -3,8 +3,9 @@ The original patches are archived in arc
 
 See the relevant bugs in bugzilla for information on these patches:
 
 0001-Bug-777614-Re-add-our-SkUserConfig.h-r-nrc.patch
 0004-Bug-777614-Re-apply-bug-719872-Fix-crash-on-Android-.patch
 0005-Bug-777614-Re-apply-bug-687188-Expand-the-gradient-c.patch
 0009-Bug-777614-Re-apply-759683-Handle-compilers-that-don.patch
 0010-Bug-836892-Add-new-blending-modes-to-SkXfermode.patch
+0011-Bug-839347-no-anon-namespace-around-SkNO_RETURN_HINT.patch
--- a/gfx/thebes/gfxFont.cpp
+++ b/gfx/thebes/gfxFont.cpp
@@ -163,31 +163,16 @@ uint16_t gfxFontEntry::GetUVSGlyph(uint3
 nsresult gfxFontEntry::ReadCMAP()
 {
     NS_ASSERTION(false, "using default no-op implementation of ReadCMAP");
     mCharacterMap = new gfxCharacterMap();
     return NS_OK;
 }
 
 nsString
-gfxFontEntry::FamilyName()
-{
-    FallibleTArray<uint8_t> nameTable;
-    nsresult rv = GetFontTable(TRUETYPE_TAG('n','a','m','e'), nameTable);
-    if (NS_SUCCEEDED(rv)) {
-        nsAutoString name;
-        rv = gfxFontUtils::GetFamilyNameFromTable(nameTable, name);
-        if (NS_SUCCEEDED(rv)) {
-            return name;
-        }
-    }
-    return Name();
-}
-
-nsString
 gfxFontEntry::RealFaceName()
 {
     FallibleTArray<uint8_t> nameTable;
     nsresult rv = GetFontTable(TRUETYPE_TAG('n','a','m','e'), nameTable);
     if (NS_SUCCEEDED(rv)) {
         nsAutoString name;
         rv = gfxFontUtils::GetFullNameFromTable(nameTable, name);
         if (NS_SUCCEEDED(rv)) {
--- a/gfx/thebes/gfxFont.h
+++ b/gfx/thebes/gfxFont.h
@@ -227,29 +227,28 @@ public:
     { }
 
     virtual ~gfxFontEntry();
 
     // unique name for the face, *not* the family; not necessarily the
     // "real" or user-friendly name, may be an internal identifier
     const nsString& Name() const { return mName; }
 
+    // family name
+    const nsString& FamilyName() const { return mFamilyName; }
+
     // The following two methods may be relatively expensive, as they
     // will (usually, except on Linux) load and parse the 'name' table;
     // they are intended only for the font-inspection API, not for
     // perf-critical layout/drawing work.
 
     // The "real" name of the face, if available from the font resource;
     // returns Name() if nothing better is available.
     virtual nsString RealFaceName();
 
-    // The family name (if available) that would be used in css font-family
-    // properties; returns Name() if nothing better available.
-    virtual nsString FamilyName();
-
     uint16_t Weight() const { return mWeight; }
     int16_t Stretch() const { return mStretch; }
 
     bool IsUserFont() const { return mIsUserFont; }
     bool IsLocalUserFont() const { return mIsLocalUserFont; }
     bool IsFixedPitch() const { return mFixedPitch; }
     bool IsItalic() const { return mItalic; }
     bool IsBold() const { return mWeight >= 600; } // bold == weights 600 and above
@@ -330,16 +329,17 @@ public:
 
     // For memory reporting
     virtual void SizeOfExcludingThis(nsMallocSizeOfFun aMallocSizeOf,
                                      FontListSizes*    aSizes) const;
     virtual void SizeOfIncludingThis(nsMallocSizeOfFun aMallocSizeOf,
                                      FontListSizes*    aSizes) const;
 
     nsString         mName;
+    nsString         mFamilyName;
 
     bool             mItalic      : 1;
     bool             mFixedPitch  : 1;
     bool             mIsProxy     : 1;
     bool             mIsValid     : 1;
     bool             mIsBadUnderlineFont : 1;
     bool             mIsUserFont  : 1;
     bool             mIsLocalUserFont  : 1;
@@ -556,16 +556,17 @@ public:
     void AddFontEntry(nsRefPtr<gfxFontEntry> aFontEntry) {
         // bug 589682 - set the IgnoreGDEF flag on entries for Italic faces
         // of Times New Roman, because of buggy table in those fonts
         if (aFontEntry->IsItalic() && !aFontEntry->IsUserFont() &&
             Name().EqualsLiteral("Times New Roman"))
         {
             aFontEntry->mIgnoreGDEF = true;
         }
+        aFontEntry->mFamilyName = Name();
         mAvailableFonts.AppendElement(aFontEntry);
     }
 
     // note that the styles for this family have been added
     void SetHasStyles(bool aHasStyles) { mHasStyles = aHasStyles; }
 
     // choose a specific face to match a style using CSS font matching
     // rules (weight matching occurs here).  may return a face that doesn't
@@ -3101,29 +3102,16 @@ public:
                      "Whoever was caching this font group should have "
                      "called UpdateFontList on it");
         NS_ASSERTION(mFonts.Length() > uint32_t(i) && mFonts[i].Font(), 
                      "Requesting a font index that doesn't exist");
 
         return mFonts[i].Font();
     }
 
-    // Return the family name of the primary font in the group.
-    // Note that gfxPangoFontGroup (for the Linux/Fontconfig backend),
-    // which does not have gfxFontFamily objects, must override this.
-    virtual nsString GetFamilyNameAt(int32_t i) {
-        NS_ASSERTION(!mUserFontSet || mCurrGeneration == GetGeneration(),
-                     "Whoever was caching this font group should have "
-                     "called UpdateFontList on it");
-        NS_ASSERTION(mFonts.Length() > uint32_t(i) && mFonts[i].Family(),
-                     "No fonts in the group!");
-
-        return mFonts[i].Family()->Name();
-    }
-
     uint32_t FontListLength() const {
         return mFonts.Length();
     }
 
     bool Equals(const gfxFontGroup& other) const {
         return mFamilies.Equals(other.mFamilies) &&
             mStyle.Equals(other.mStyle);
     }
--- a/gfx/thebes/gfxPangoFonts.cpp
+++ b/gfx/thebes/gfxPangoFonts.cpp
@@ -170,18 +170,16 @@ public:
             (cairo_font_face_get_user_data(aFace, &sFontEntryKey));
     }
 
     // override the gfxFontEntry impl to read the name from fontconfig
     // instead of trying to get the 'name' table, as we don't implement
     // GetFontTable() here
     virtual nsString RealFaceName();
 
-    virtual nsString FamilyName();
-
     // This is needed to make gfxFontEntry::HasCharacter(aCh) work.
     virtual bool TestCharacterMap(uint32_t aCh)
     {
         for (uint32_t i = 0; i < mPatterns.Length(); ++i) {
             if (HasChar(mPatterns[i], aCh)) {
                 return true;
             }
         }
@@ -229,30 +227,16 @@ gfxFcFontEntry::RealFaceName()
             }
             return result;
         }
     }
     // fall back to gfxFontEntry implementation (only works for sfnt fonts)
     return gfxFontEntry::RealFaceName();
 }
 
-nsString
-gfxFcFontEntry::FamilyName()
-{
-    FcChar8 *name;
-    if (!mPatterns.IsEmpty()) {
-        if (FcPatternGetString(mPatterns[0],
-                               FC_FAMILY, 0, &name) == FcResultMatch) {
-            return NS_ConvertUTF8toUTF16((const char*)name);
-        }
-    }
-    // fall back to gfxFontEntry implementation (only works for sfnt fonts)
-    return gfxFontEntry::FamilyName();
-}
-
 #ifdef MOZ_GRAPHITE
 void
 gfxFcFontEntry::CheckForGraphiteTables()
 {
     FcChar8 *capability;
     mHasGraphiteTables =
         !mPatterns.IsEmpty() &&
         FcPatternGetString(mPatterns[0],
@@ -340,16 +324,22 @@ public:
         : gfxFcFontEntry(aName), mFontFace(aFontFace)
     {
         cairo_font_face_reference(mFontFace);
         cairo_font_face_set_user_data(mFontFace, &sFontEntryKey, this, NULL);
         mPatterns.AppendElement();
         // mPatterns is an nsAutoTArray with 1 space always available, so the
         // AppendElement always succeeds.
         mPatterns[0] = aFontPattern;
+
+        FcChar8 *name;
+        if (FcPatternGetString(aFontPattern,
+                               FC_FAMILY, 0, &name) == FcResultMatch) {
+            mFamilyName = NS_ConvertUTF8toUTF16((const char*)name);
+        }
     }
 
     ~gfxSystemFcFontEntry()
     {
         cairo_font_face_set_user_data(mFontFace, &sFontEntryKey, NULL, NULL);
         cairo_font_face_destroy(mFontFace);
     }
 private:
@@ -788,26 +778,16 @@ public:
     // The PangoFont returned is owned by the gfxFcFont
     PangoFont *GetPangoFont() {
         if (!mPangoFont) {
             MakePangoFont();
         }
         return mPangoFont;
     }
 
-    nsString GetFamilyName() {
-        PangoFontDescription *desc = pango_font_describe(GetPangoFont());
-        const char *name = pango_font_description_get_family(desc);
-        if (name) {
-            return NS_ConvertUTF8toUTF16(name);
-        } else {
-            return GetFontEntry()->FamilyName();
-        }
-    }
-
 protected:
     virtual bool ShapeText(gfxContext      *aContext,
                            const PRUnichar *aText,
                            uint32_t         aOffset,
                            uint32_t         aLength,
                            int32_t          aScript,
                            gfxShapedText   *aShapedText,
                            bool             aPreferPlatformShaping);
@@ -1980,32 +1960,16 @@ gfxPangoFontGroup::GetFontAt(int32_t i)
                  "Whoever was caching this font group should have "
                  "called UpdateFontList on it");
 
     NS_PRECONDITION(i == 0, "Only have one font");
 
     return GetBaseFont();
 }
 
-nsString
-gfxPangoFontGroup::GetFamilyNameAt(int32_t i)
-{
-    gfxFcFont* font = static_cast<gfxFcFont*>(GetFontAt(i));
-
-    if (font->GetFontEntry()->IsUserFont()) {
-        gfxFontFamily* family =
-            GetUserFontSet()->FindFamilyFor(font->GetFontEntry());
-        if (family) { // should never fail, but just in case...
-            return family->Name();
-        }
-    }
-
-    return font->GetFamilyName();
-}
-
 void
 gfxPangoFontGroup::UpdateFontList()
 {
     if (!mUserFontSet)
         return;
 
     uint64_t newGeneration = mUserFontSet->GetGeneration();
     if (newGeneration == mCurrGeneration)
--- a/gfx/thebes/gfxPangoFonts.h
+++ b/gfx/thebes/gfxPangoFonts.h
@@ -28,18 +28,16 @@ public:
                        const gfxFontStyle *aStyle,
                        gfxUserFontSet *aUserFontSet);
     virtual ~gfxPangoFontGroup ();
 
     virtual gfxFontGroup *Copy(const gfxFontStyle *aStyle);
 
     virtual gfxFont *GetFontAt(int32_t i);
 
-    virtual nsString GetFamilyNameAt(int32_t i);
-
     virtual void UpdateFontList();
 
     virtual already_AddRefed<gfxFont>
         FindFontForChar(uint32_t aCh, uint32_t aPrevCh, int32_t aRunScript,
                         gfxFont *aPrevMatchedFont,
                         uint8_t *aMatchType);
 
     static void Shutdown();
--- a/gfx/thebes/gfxQuaternion.h
+++ b/gfx/thebes/gfxQuaternion.h
@@ -34,23 +34,23 @@ struct THEBES_API gfxQuaternion : public
     gfxQuaternion Slerp(const gfxQuaternion &aOther, gfxFloat aCoeff) {
         gfxFloat dot = mozilla::clamped(DotProduct(aOther), -1.0, 1.0);
         if (dot == 1.0) {
             return *this;
         }
 
         gfxFloat theta = acos(dot);
         gfxFloat rsintheta = 1/sqrt(1 - dot*dot);
-        gfxFloat w = sin(aCoeff*theta)*rsintheta;
+        gfxFloat rightWeight = sin(aCoeff*theta)*rsintheta;
 
         gfxQuaternion left = *this;
         gfxQuaternion right = aOther;
 
-        left *= cos(aCoeff*theta) - dot*w;
-        right *= w;
+        left *= cos(aCoeff*theta) - dot*rightWeight;
+        right *= rightWeight;
 
         return left + right;
     }
 
     gfx3DMatrix ToMatrix() {
         gfx3DMatrix temp;
 
         temp[0][0] = 1 - 2 * (y * y + z * z);
--- a/gfx/thebes/gfxUserFontSet.cpp
+++ b/gfx/thebes/gfxUserFontSet.cpp
@@ -532,17 +532,16 @@ gfxUserFontSet::LoadNext(gfxMixedFontFam
                         uint32_t bufferLength = 0;
 
                         // sync load font immediately
                         rv = SyncLoadFontData(aProxyEntry, &currSrc,
                                               buffer, bufferLength);
                         if (NS_SUCCEEDED(rv) &&
                             (fe = LoadFont(aFamily, aProxyEntry,
                                            buffer, bufferLength))) {
-                            UserFontCache::CacheFont(fe);
                             return STATUS_LOADED;
                         } else {
                             LogMessage(aFamily, aProxyEntry,
                                        "font load failed",
                                        nsIScriptError::errorFlag, rv);
                         }
                     } else {
                         // otherwise load font async
@@ -667,18 +666,18 @@ gfxUserFontSet::LoadFont(gfxMixedFontFam
             nsAutoCString fontURI;
             aProxy->mSrcList[aProxy->mSrcIndex].mURI->GetSpec(fontURI);
             LOG(("userfonts (%p) [src %d] loaded uri: (%s) for (%s) gen: %8.8x\n",
                  this, aProxy->mSrcIndex, fontURI.get(),
                  NS_ConvertUTF16toUTF8(aFamily->Name()).get(),
                  uint32_t(mGeneration)));
         }
 #endif
+        ReplaceFontEntry(aFamily, aProxy, fe);
         UserFontCache::CacheFont(fe);
-        ReplaceFontEntry(aFamily, aProxy, fe);
     } else {
 #ifdef PR_LOGGING
         if (LOG_ENABLED()) {
             nsAutoCString fontURI;
             aProxy->mSrcList[aProxy->mSrcIndex].mURI->GetSpec(fontURI);
             LOG(("userfonts (%p) [src %d] failed uri: (%s) for (%s)"
                  " error making platform font\n",
                  this, aProxy->mSrcIndex, fontURI.get(),
@@ -759,26 +758,29 @@ gfxUserFontSet::UserFontCache::Entry::Ke
         return false;
     }
 
     const gfxFontEntry *fe = aKey->mFontEntry;
     if (mFontEntry->mItalic           != fe->mItalic          ||
         mFontEntry->mWeight           != fe->mWeight          ||
         mFontEntry->mStretch          != fe->mStretch         ||
         mFontEntry->mFeatureSettings  != fe->mFeatureSettings ||
-        mFontEntry->mLanguageOverride != fe->mLanguageOverride) {
+        mFontEntry->mLanguageOverride != fe->mLanguageOverride ||
+        mFontEntry->mFamilyName       != fe->mFamilyName) {
         return false;
     }
 
     return true;
 }
 
 void
 gfxUserFontSet::UserFontCache::CacheFont(gfxFontEntry *aFontEntry)
 {
+    NS_ASSERTION(aFontEntry->mFamilyName.Length() != 0,
+                 "caching a font associated with no family yet");
     if (!sUserFonts) {
         sUserFonts = new nsTHashtable<Entry>;
         sUserFonts->Init();
     }
 
     gfxUserFontData *data = aFontEntry->mUserFontData;
     sUserFonts->PutEntry(Key(data->mURI, data->mPrincipal, aFontEntry));
 }
--- a/gfx/thebes/gfxUserFontSet.h
+++ b/gfx/thebes/gfxUserFontSet.h
@@ -74,27 +74,29 @@ public:
     gfxMixedFontFamily(const nsAString& aName)
         : gfxFontFamily(aName) { }
 
     virtual ~gfxMixedFontFamily() { }
 
     void AddFontEntry(gfxFontEntry *aFontEntry) {
         nsRefPtr<gfxFontEntry> fe = aFontEntry;
         mAvailableFonts.AppendElement(fe);
+        aFontEntry->mFamilyName = Name();
         ResetCharacterMap();
     }
 
     void ReplaceFontEntry(gfxFontEntry *aOldFontEntry,
                           gfxFontEntry *aNewFontEntry) {
         uint32_t numFonts = mAvailableFonts.Length();
         for (uint32_t i = 0; i < numFonts; i++) {
             gfxFontEntry *fe = mAvailableFonts[i];
             if (fe == aOldFontEntry) {
                 // note that this may delete aOldFontEntry, if there's no
                 // other reference to it except from its family
+                aNewFontEntry->mFamilyName = Name();
                 mAvailableFonts[i] = aNewFontEntry;
                 break;
             }
         }
         ResetCharacterMap();
     }
 
     void RemoveFontEntry(gfxFontEntry *aFontEntry) {
@@ -298,16 +300,17 @@ public:
             static KeyTypePointer KeyToPointer(KeyType aKey) { return &aKey; }
 
             static PLDHashNumber HashKey(const KeyTypePointer aKey) {
                 uint32_t principalHash;
                 aKey->mPrincipal->GetHashValue(&principalHash);
                 return mozilla::HashGeneric(principalHash,
                                             nsURIHashKey::HashKey(aKey->mURI),
                                             HashFeatures(aKey->mFontEntry->mFeatureSettings),
+                                            mozilla::HashString(aKey->mFontEntry->mFamilyName),
                                             ((uint32_t)aKey->mFontEntry->mItalic |
                                              (aKey->mFontEntry->mWeight << 1) |
                                              (aKey->mFontEntry->mStretch << 10) ) ^
                                              aKey->mFontEntry->mLanguageOverride);
             }
 
             enum { ALLOW_MEMMOVE = false };
 
--- a/ipc/chromium/src/chrome/common/ipc_message_utils.h
+++ b/ipc/chromium/src/chrome/common/ipc_message_utils.h
@@ -261,31 +261,31 @@ struct ParamTraitsFundamental<double> {
 
 template <class P>
 struct ParamTraitsFixed : ParamTraitsFundamental<P> {};
 
 template <>
 struct ParamTraitsFixed<int16_t> {
   typedef int16_t param_type;
   static void Write(Message* m, const param_type& p) {
-    m->WriteInt(p);
+    m->WriteInt16(p);
   }
   static bool Read(const Message* m, void** iter, param_type* r) {
     return m->ReadInt16(iter, r);
   }
   static void Log(const param_type& p, std::wstring* l) {
     l->append(StringPrintf(L"%hd", p));
   }
 };
 
 template <>
 struct ParamTraitsFixed<uint16_t> {
   typedef uint16_t param_type;
   static void Write(Message* m, const param_type& p) {
-    m->WriteInt(p);
+    m->WriteUInt16(p);
   }
   static bool Read(const Message* m, void** iter, param_type* r) {
     return m->ReadUInt16(iter, r);
   }
   static void Log(const param_type& p, std::wstring* l) {
     l->append(StringPrintf(L"%hu", p));
   }
 };
--- a/js/public/CharacterEncoding.h
+++ b/js/public/CharacterEncoding.h
@@ -23,61 +23,61 @@ namespace JS {
  * string containing characters beyond U+00FF.
  */
 class Latin1Chars : public mozilla::Range<unsigned char>
 {
     typedef mozilla::Range<unsigned char> Base;
 
   public:
     Latin1Chars() : Base() {}
-    Latin1Chars(char *bytes, size_t length) : Base(reinterpret_cast<unsigned char *>(bytes), length) {}
-    Latin1Chars(const char *bytes, size_t length)
-      : Base(reinterpret_cast<unsigned char *>(const_cast<char *>(bytes)), length)
+    Latin1Chars(char *aBytes, size_t aLength) : Base(reinterpret_cast<unsigned char *>(aBytes), aLength) {}
+    Latin1Chars(const char *aBytes, size_t aLength)
+      : Base(reinterpret_cast<unsigned char *>(const_cast<char *>(aBytes)), aLength)
     {}
 };
 
 /*
  * A Latin1Chars, but with \0 termination for C compatibility.
  */
 class Latin1CharsZ : public mozilla::RangedPtr<unsigned char>
 {
     typedef mozilla::RangedPtr<unsigned char> Base;
 
   public:
     Latin1CharsZ() : Base(NULL, 0) {}
 
-    Latin1CharsZ(char *bytes, size_t length)
-      : Base(reinterpret_cast<unsigned char *>(bytes), length)
+    Latin1CharsZ(char *aBytes, size_t aLength)
+      : Base(reinterpret_cast<unsigned char *>(aBytes), aLength)
     {
-        JS_ASSERT(bytes[length] == '\0');
+        JS_ASSERT(aBytes[aLength] == '\0');
     }
 
-    Latin1CharsZ(unsigned char *bytes, size_t length)
-      : Base(bytes, length)
+    Latin1CharsZ(unsigned char *aBytes, size_t aLength)
+      : Base(aBytes, aLength)
     {
-        JS_ASSERT(bytes[length] == '\0');
+        JS_ASSERT(aBytes[aLength] == '\0');
     }
 
     char *c_str() { return reinterpret_cast<char *>(get()); }
 };
 
 /*
  * SpiderMonkey also deals directly with UTF-8 encoded text in some places.
  */
 class UTF8CharsZ : public mozilla::RangedPtr<unsigned char>
 {
     typedef mozilla::RangedPtr<unsigned char> Base;
 
   public:
     UTF8CharsZ() : Base(NULL, 0) {}
 
-    UTF8CharsZ(char *bytes, size_t length)
-      : Base(reinterpret_cast<unsigned char *>(bytes), length)
+    UTF8CharsZ(char *aBytes, size_t aLength)
+      : Base(reinterpret_cast<unsigned char *>(aBytes), aLength)
     {
-        JS_ASSERT(bytes[length] == '\0');
+        JS_ASSERT(aBytes[aLength] == '\0');
     }
 };
 
 /*
  * SpiderMonkey uses a 2-byte character representation: it is a
  * 2-byte-at-a-time view of a UTF-16 byte stream. This is similar to UCS-2,
  * but unlike UCS-2, we do not strip UTF-16 extension bytes. This allows a
  * sufficiently dedicated JavaScript program to be fully unicode-aware by
@@ -85,33 +85,33 @@ class UTF8CharsZ : public mozilla::Range
  * string.
  */
 class TwoByteChars : public mozilla::Range<jschar>
 {
     typedef mozilla::Range<jschar> Base;
 
   public:
     TwoByteChars() : Base() {}
-    TwoByteChars(jschar *chars, size_t length) : Base(chars, length) {}
-    TwoByteChars(const jschar *chars, size_t length) : Base(const_cast<jschar *>(chars), length) {}
+    TwoByteChars(jschar *aChars, size_t aLength) : Base(aChars, aLength) {}
+    TwoByteChars(const jschar *aChars, size_t aLength) : Base(const_cast<jschar *>(aChars), aLength) {}
 };
 
 /*
  * A non-convertible variant of TwoByteChars that does not refer to characters
  * inlined inside a JSShortString or a JSInlineString. StableTwoByteChars are
  * thus safe to hold across a GC.
  */
 class StableTwoByteChars : public mozilla::Range<jschar>
 {
     typedef mozilla::Range<jschar> Base;
 
   public:
     StableTwoByteChars() : Base() {}
-    StableTwoByteChars(jschar *chars, size_t length) : Base(chars, length) {}
-    StableTwoByteChars(const jschar *chars, size_t length) : Base(const_cast<jschar *>(chars), length) {}
+    StableTwoByteChars(jschar *aChars, size_t aLength) : Base(aChars, aLength) {}
+    StableTwoByteChars(const jschar *aChars, size_t aLength) : Base(const_cast<jschar *>(aChars), aLength) {}
 };
 
 /*
  * A TwoByteChars, but \0 terminated for compatibility with JSFlatString.
  */
 class TwoByteCharsZ : public mozilla::RangedPtr<jschar>
 {
     typedef mozilla::RangedPtr<jschar> Base;
--- a/js/public/GCAPI.h
+++ b/js/public/GCAPI.h
@@ -116,20 +116,20 @@ enum GCProgress {
 
     GC_CYCLE_BEGIN,
     GC_SLICE_BEGIN,
     GC_SLICE_END,
     GC_CYCLE_END
 };
 
 struct JS_FRIEND_API(GCDescription) {
-    bool isCompartment;
+    bool isCompartment_;
 
     GCDescription(bool isCompartment)
-      : isCompartment(isCompartment) {}
+      : isCompartment_(isCompartment) {}
 
     jschar *formatMessage(JSRuntime *rt) const;
     jschar *formatJSON(JSRuntime *rt, uint64_t timestamp) const;
 };
 
 typedef void
 (* GCSliceCallback)(JSRuntime *rt, GCProgress progress, const GCDescription &desc);
 
--- a/js/public/HashTable.h
+++ b/js/public/HashTable.h
@@ -659,36 +659,36 @@ class HashTable : private AllocPolicy
     // |if (p) p->...|. Ptr objects must not be used after any mutating hash
     // table operations unless |generation()| is tested.
     class Ptr
     {
         friend class HashTable;
         typedef void (Ptr::* ConvertibleToBool)();
         void nonNull() {}
 
-        Entry *entry;
+        Entry *entry_;
 
       protected:
-        Ptr(Entry &entry) : entry(&entry) {}
+        Ptr(Entry &entry) : entry_(&entry) {}
 
       public:
         // Leaves Ptr uninitialized.
         Ptr() {
 #ifdef DEBUG
-            entry = (Entry *)0xbad;
+            entry_ = (Entry *)0xbad;
 #endif
         }
 
-        bool found() const                    { return entry->isLive(); }
+        bool found() const                    { return entry_->isLive(); }
         operator ConvertibleToBool() const    { return found() ? &Ptr::nonNull : 0; }
-        bool operator==(const Ptr &rhs) const { JS_ASSERT(found() && rhs.found()); return entry == rhs.entry; }
+        bool operator==(const Ptr &rhs) const { JS_ASSERT(found() && rhs.found()); return entry_ == rhs.entry_; }
         bool operator!=(const Ptr &rhs) const { return !(*this == rhs); }
 
-        T &operator*() const                  { return entry->get(); }
-        T *operator->() const                 { return &entry->get(); }
+        T &operator*() const                  { return entry_->get(); }
+        T *operator->() const                 { return &entry_->get(); }
     };
 
     // A Ptr that can be used to add a key after a failed lookup.
     class AddPtr : public Ptr
     {
         friend class HashTable;
         HashNumber keyHash;
         mozilla::DebugOnly<uint64_t> mutationCount;
@@ -919,32 +919,32 @@ class HashTable : private AllocPolicy
         JS_ASSERT(!initialized());
 
         // Correct for sMaxAlphaFrac such that the table will not resize
         // when adding 'length' entries.
         if (length > sMaxInit) {
             this->reportAllocOverflow();
             return false;
         }
-        uint32_t capacity = (length * sInvMaxAlpha) >> 7;
+        uint32_t newCapacity = (length * sInvMaxAlpha) >> 7;
 
-        if (capacity < sMinCapacity)
-            capacity = sMinCapacity;
+        if (newCapacity < sMinCapacity)
+            newCapacity = sMinCapacity;
 
         // FIXME: use JS_CEILING_LOG2 when PGO stops crashing (bug 543034).
         uint32_t roundUp = sMinCapacity, roundUpLog2 = sMinCapacityLog2;
-        while (roundUp < capacity) {
+        while (roundUp < newCapacity) {
             roundUp <<= 1;
             ++roundUpLog2;
         }
 
-        capacity = roundUp;
-        JS_ASSERT(capacity <= sMaxCapacity);
+        newCapacity = roundUp;
+        JS_ASSERT(newCapacity <= sMaxCapacity);
 
-        table = createTable(*this, capacity);
+        table = createTable(*this, newCapacity);
         if (!table)
             return false;
 
         setTableSizeLog2(roundUpLog2);
         METER(memset(&stats, 0, sizeof(stats)));
         return true;
     }
 
@@ -1359,30 +1359,30 @@ class HashTable : private AllocPolicy
         ReentrancyGuard g(*this);
         JS_ASSERT(mutationCount == p.mutationCount);
         JS_ASSERT(table);
         JS_ASSERT(!p.found());
         JS_ASSERT(!(p.keyHash & sCollisionBit));
 
         // Changing an entry from removed to live does not affect whether we
         // are overloaded and can be handled separately.
-        if (p.entry->isRemoved()) {
+        if (p.entry_->isRemoved()) {
             METER(stats.addOverRemoved++);
             removedCount--;
             p.keyHash |= sCollisionBit;
         } else {
-            // Preserve the validity of |p.entry|.
+            // Preserve the validity of |p.entry_|.
             RebuildStatus status = checkOverloaded();
             if (status == RehashFailed)
                 return false;
             if (status == Rehashed)
-                p.entry = &findFreeEntry(p.keyHash);
+                p.entry_ = &findFreeEntry(p.keyHash);
         }
 
-        p.entry->setLive(p.keyHash, rhs);
+        p.entry_->setLive(p.keyHash, rhs);
         entryCount++;
         mutationCount++;
         return true;
     }
 
     template <class U>
     void putNewInfallible(const Lookup &l, const U &u)
     {
@@ -1413,27 +1413,27 @@ class HashTable : private AllocPolicy
     }
 
     template <class U>
     bool relookupOrAdd(AddPtr& p, const Lookup &l, const U &u)
     {
         p.mutationCount = mutationCount;
         {
             ReentrancyGuard g(*this);
-            p.entry = &lookup(l, p.keyHash, sCollisionBit);
+            p.entry_ = &lookup(l, p.keyHash, sCollisionBit);
         }
         return p.found() || add(p, u);
     }
 
     void remove(Ptr p)
     {
         JS_ASSERT(table);
         ReentrancyGuard g(*this);
         JS_ASSERT(p.found());
-        remove(*p.entry);
+        remove(*p.entry_);
         checkUnderloaded();
     }
 
 #undef METER
 };
 
 }  // namespace detail
 }  // namespace js
--- a/js/public/MemoryMetrics.h
+++ b/js/public/MemoryMetrics.h
@@ -312,17 +312,17 @@ struct RuntimeStats
       , gcHeapUnusedChunks(0)
       , gcHeapUnusedArenas(0)
       , gcHeapUnusedGcThings(0)
       , gcHeapChunkAdmin(0)
       , gcHeapGcThings(0)
       , totals()
       , compartmentStatsVector()
       , currCompartmentStats(NULL)
-      , mallocSizeOf(mallocSizeOf)
+      , mallocSizeOf_(mallocSizeOf)
     {}
 
     RuntimeSizes runtime;
 
     // If you add a new number, remember to update the constructor!
 
     // Here's a useful breakdown of the GC heap.
     //
@@ -352,37 +352,37 @@ struct RuntimeStats
     size_t gcHeapGcThings;
 
     // The sum of all compartment's measurements.
     CompartmentStats totals;
  
     js::Vector<CompartmentStats, 0, js::SystemAllocPolicy> compartmentStatsVector;
     CompartmentStats *currCompartmentStats;
 
-    JSMallocSizeOfFun mallocSizeOf;
+    JSMallocSizeOfFun mallocSizeOf_;
 
     virtual void initExtraCompartmentStats(JSCompartment *c, CompartmentStats *cstats) = 0;
 };
 
 #ifdef JS_THREADSAFE
 
 class ObjectPrivateVisitor
 {
 public:
     // Within CollectRuntimeStats, this method is called for each JS object
     // that has an nsISupports pointer.
     virtual size_t sizeOfIncludingThis(nsISupports *aSupports) = 0;
 
     // A callback that gets a JSObject's nsISupports pointer, if it has one.
     // Note: this function does *not* addref |iface|.
     typedef JSBool(*GetISupportsFun)(JSObject *obj, nsISupports **iface);
-    GetISupportsFun getISupports;
+    GetISupportsFun getISupports_;
 
     ObjectPrivateVisitor(GetISupportsFun getISupports)
-      : getISupports(getISupports)
+      : getISupports_(getISupports)
     {}
 };
 
 extern JS_PUBLIC_API(bool)
 CollectRuntimeStats(JSRuntime *rt, RuntimeStats *rtStats, ObjectPrivateVisitor *opv);
 
 extern JS_PUBLIC_API(int64_t)
 GetExplicitNonHeapForRuntime(JSRuntime *rt, JSMallocSizeOfFun mallocSizeOf);
--- a/js/public/Vector.h
+++ b/js/public/Vector.h
@@ -373,25 +373,25 @@ class Vector : private AllocPolicy
 
     const T &back() const {
         JS_ASSERT(!entered && !empty());
         return *(end() - 1);
     }
 
     class Range {
         friend class Vector;
-        T *cur, *end;
-        Range(T *cur, T *end) : cur(cur), end(end) {}
+        T *cur_, *end_;
+        Range(T *cur, T *end) : cur_(cur), end_(end) {}
       public:
         Range() {}
-        bool empty() const { return cur == end; }
-        size_t remain() const { return end - cur; }
-        T &front() const { return *cur; }
-        void popFront() { JS_ASSERT(!empty()); ++cur; }
-        T popCopyFront() { JS_ASSERT(!empty()); return *cur++; }
+        bool empty() const { return cur_ == end_; }
+        size_t remain() const { return end_ - cur_; }
+        T &front() const { return *cur_; }
+        void popFront() { JS_ASSERT(!empty()); ++cur_; }
+        T popCopyFront() { JS_ASSERT(!empty()); return *cur_++; }
     };
 
     Range all() {
         return Range(begin(), end());
     }
 
     /* mutators */
 
@@ -442,21 +442,21 @@ class Vector : private AllocPolicy
      * memory has been pre-reserved.
      */
     void infallibleAppend(const T &t) {
         internalAppend(t);
     }
     void infallibleAppendN(const T &t, size_t n) {
         internalAppendN(t, n);
     }
-    template <class U> void infallibleAppend(const U *begin, const U *end) {
-        internalAppend(begin, mozilla::PointerRangeSize(begin, end));
+    template <class U> void infallibleAppend(const U *aBegin, const U *aEnd) {
+        internalAppend(aBegin, mozilla::PointerRangeSize(aBegin, aEnd));
     }
-    template <class U> void infallibleAppend(const U *begin, size_t length) {
-        internalAppend(begin, length);
+    template <class U> void infallibleAppend(const U *aBegin, size_t aLength) {
+        internalAppend(aBegin, aLength);
     }
     template <class U, size_t O, class BP> void infallibleAppend(const Vector<U,O,BP> &other) {
         internalAppend(other);
     }
 
     void popBack();
 
     T popCopy();
@@ -911,22 +911,22 @@ Vector<T,N,AP>::append(const U *insBegin
 #endif
     internalAppend(insBegin, needed);
     return true;
 }
 
 template <class T, size_t N, class AP>
 template <class U>
 JS_ALWAYS_INLINE void
-Vector<T,N,AP>::internalAppend(const U *insBegin, size_t length)
+Vector<T,N,AP>::internalAppend(const U *insBegin, size_t insLength)
 {
-    JS_ASSERT(mLength + length <= mReserved);
+    JS_ASSERT(mLength + insLength <= mReserved);
     JS_ASSERT(mReserved <= mCapacity);
-    Impl::copyConstruct(endNoCheck(), insBegin, insBegin + length);
-    mLength += length;
+    Impl::copyConstruct(endNoCheck(), insBegin, insBegin + insLength);
+    mLength += insLength;
 }
 
 template <class T, size_t N, class AP>
 template <class U, size_t O, class BP>
 inline bool
 Vector<T,N,AP>::append(const Vector<U,O,BP> &other)
 {
     return append(other.begin(), other.end());
@@ -938,19 +938,19 @@ inline void
 Vector<T,N,AP>::internalAppend(const Vector<U,O,BP> &other)
 {
     internalAppend(other.begin(), other.length());
 }
 
 template <class T, size_t N, class AP>
 template <class U>
 JS_ALWAYS_INLINE bool
-Vector<T,N,AP>::append(const U *insBegin, size_t length)
+Vector<T,N,AP>::append(const U *insBegin, size_t insLength)
 {
-    return this->append(insBegin, insBegin + length);
+    return this->append(insBegin, insBegin + insLength);
 }
 
 template <class T, size_t N, class AP>
 JS_ALWAYS_INLINE void
 Vector<T,N,AP>::popBack()
 {
     REENTRANCY_GUARD_ET_AL;
     JS_ASSERT(!empty());
@@ -989,45 +989,45 @@ Vector<T,N,AP>::extractRawBuffer()
         mReserved = 0;
 #endif
     }
     return ret;
 }
 
 template <class T, size_t N, class AP>
 inline void
-Vector<T,N,AP>::replaceRawBuffer(T *p, size_t length)
+Vector<T,N,AP>::replaceRawBuffer(T *p, size_t aLength)
 {
     REENTRANCY_GUARD_ET_AL;
 
     /* Destroy what we have. */
     Impl::destroy(beginNoCheck(), endNoCheck());
     if (!usingInlineStorage())
         this->free_(beginNoCheck());
 
     /* Take in the new buffer. */
-    if (length <= sInlineCapacity) {
+    if (aLength <= sInlineCapacity) {
         /*
          * We convert to inline storage if possible, even though p might
          * otherwise be acceptable.  Maybe this behaviour should be
          * specifiable with an argument to this function.
          */
         mBegin = (T *)storage.addr();
-        mLength = length;
+        mLength = aLength;
         mCapacity = sInlineCapacity;
-        Impl::moveConstruct(mBegin, p, p + length);
-        Impl::destroy(p, p + length);
+        Impl::moveConstruct(mBegin, p, p + aLength);
+        Impl::destroy(p, p + aLength);
         this->free_(p);
     } else {
         mBegin = p;
-        mLength = length;
-        mCapacity = length;
+        mLength = aLength;
+        mCapacity = aLength;
     }
 #ifdef DEBUG
-    mReserved = length;
+    mReserved = aLength;
 #endif
 }
 
 template <class T, size_t N, class AP>
 inline size_t
 Vector<T,N,AP>::sizeOfExcludingThis(JSMallocSizeOfFun mallocSizeOf) const
 {
     return usingInlineStorage() ? 0 : mallocSizeOf(beginNoCheck());
--- a/js/src/gc/Root.h
+++ b/js/src/gc/Root.h
@@ -1052,26 +1052,26 @@ inline void MaybeCheckStackRoots(JSConte
 namespace gc {
 struct Cell;
 } /* namespace gc */
 
 /* Base class for automatic read-only object rooting during compilation. */
 class CompilerRootNode
 {
   protected:
-    CompilerRootNode(js::gc::Cell *ptr) : next(NULL), ptr(ptr) {}
+    CompilerRootNode(js::gc::Cell *ptr) : next(NULL), ptr_(ptr) {}
 
   public:
-    void **address() { return (void **)&ptr; }
+    void **address() { return (void **)&ptr_; }
 
   public:
     CompilerRootNode *next;
 
   protected:
-    js::gc::Cell *ptr;
+    js::gc::Cell *ptr_;
 };
 
 }  /* namespace js */
 
 ForwardDeclareJS(Script);
 ForwardDeclareJS(Function);
 ForwardDeclareJS(Object);
 
--- a/js/src/gc/RootMarking.cpp
+++ b/js/src/gc/RootMarking.cpp
@@ -367,24 +367,24 @@ ConservativeGCData::recordStackTop()
 #if defined(_MSC_VER)
 # pragma warning(pop)
 #endif
 }
 
 void
 AutoIdArray::trace(JSTracer *trc)
 {
-    JS_ASSERT(tag == IDARRAY);
+    JS_ASSERT(tag_ == IDARRAY);
     gc::MarkIdRange(trc, idArray->length, idArray->vector, "JSAutoIdArray.idArray");
 }
 
 inline void
 AutoGCRooter::trace(JSTracer *trc)
 {
-    switch (tag) {
+    switch (tag_) {
       case JSVAL:
         MarkValueRoot(trc, &static_cast<AutoValueRooter *>(this)->val, "JS::AutoValueRooter.val");
         return;
 
       case PARSER:
         static_cast<frontend::Parser *>(this)->trace(trc);
         return;
 
@@ -421,35 +421,35 @@ AutoGCRooter::trace(JSTracer *trc)
             JSObject *tmp = JS_FUNC_TO_DATA_PTR(JSObject *, desc.setter);
             MarkObjectRoot(trc, &tmp, "Descriptor::set");
             desc.setter = JS_DATA_TO_FUNC_PTR(JSStrictPropertyOp, tmp);
         }
         return;
       }
 
       case OBJECT:
-        if (static_cast<AutoObjectRooter *>(this)->obj)
-            MarkObjectRoot(trc, &static_cast<AutoObjectRooter *>(this)->obj,
-                           "JS::AutoObjectRooter.obj");
+        if (static_cast<AutoObjectRooter *>(this)->obj_)
+            MarkObjectRoot(trc, &static_cast<AutoObjectRooter *>(this)->obj_,
+                           "JS::AutoObjectRooter.obj_");
         return;
 
       case ID:
         MarkIdRoot(trc, &static_cast<AutoIdRooter *>(this)->id_, "JS::AutoIdRooter.id_");
         return;
 
       case VALVECTOR: {
         AutoValueVector::VectorImpl &vector = static_cast<AutoValueVector *>(this)->vector;
         MarkValueRootRange(trc, vector.length(), vector.begin(), "js::AutoValueVector.vector");
         return;
       }
 
       case STRING:
-        if (static_cast<AutoStringRooter *>(this)->str)
-            MarkStringRoot(trc, &static_cast<AutoStringRooter *>(this)->str,
-                           "JS::AutoStringRooter.str");
+        if (static_cast<AutoStringRooter *>(this)->str_)
+            MarkStringRoot(trc, &static_cast<AutoStringRooter *>(this)->str_,
+                           "JS::AutoStringRooter.str_");
         return;
 
       case IDVECTOR: {
         AutoIdVector::VectorImpl &vector = static_cast<AutoIdVector *>(this)->vector;
         MarkIdRootRange(trc, vector.length(), vector.begin(), "js::AutoIdVector.vector");
         return;
       }
 
@@ -618,33 +618,33 @@ AutoGCRooter::trace(JSTracer *trc)
          * RemapAllWrappersForObject; see comment there.
          */
         for (WrapperValue *p = vector.begin(); p < vector.end(); p++)
             MarkValueUnbarriered(trc, &p->get(), "js::AutoWrapperVector.vector");
         return;
       }
     }
 
-    JS_ASSERT(tag >= 0);
-    MarkValueRootRange(trc, tag, static_cast<AutoArrayRooter *>(this)->array,
+    JS_ASSERT(tag_ >= 0);
+    MarkValueRootRange(trc, tag_, static_cast<AutoArrayRooter *>(this)->array,
                        "JS::AutoArrayRooter.array");
 }
 
 /* static */ void
 AutoGCRooter::traceAll(JSTracer *trc)
 {
     for (js::AutoGCRooter *gcr = trc->runtime->autoGCRooters; gcr; gcr = gcr->down)
         gcr->trace(trc);
 }
 
 /* static */ void
 AutoGCRooter::traceAllWrappers(JSTracer *trc)
 {
     for (js::AutoGCRooter *gcr = trc->runtime->autoGCRooters; gcr; gcr = gcr->down) {
-        if (gcr->tag == WRAPVECTOR || gcr->tag == WRAPPER)
+        if (gcr->tag_ == WRAPVECTOR || gcr->tag_ == WRAPPER)
             gcr->trace(trc);
     }
 }
 
 void
 Shape::Range::AutoRooter::trace(JSTracer *trc)
 {
     if (r->cursor)
--- a/js/src/ion/CompilerRoot.h
+++ b/js/src/ion/CompilerRoot.h
@@ -28,26 +28,26 @@ class CompilerRoot : public CompilerRoot
             setRoot(ptr);
     }
 
   public:
     // Sets the pointer and inserts into root list. The pointer becomes read-only.
     void setRoot(T root) {
         CompilerRootNode *&rootList = GetIonContext()->temp->rootList();
 
-        JS_ASSERT(!ptr);
-        ptr = root;
+        JS_ASSERT(!ptr_);
+        ptr_ = root;
         next = rootList;
         rootList = this;
     }
 
   public:
-    operator T () const { return static_cast<T>(ptr); }
-    operator Unrooted<T> () const { return static_cast<T>(ptr); }
-    T operator ->() const { return static_cast<T>(ptr); }
+    operator T () const { return static_cast<T>(ptr_); }
+    operator Unrooted<T> () const { return static_cast<T>(ptr_); }
+    T operator ->() const { return static_cast<T>(ptr_); }
 
   private:
     CompilerRoot() MOZ_DELETE;
     CompilerRoot(const CompilerRoot<T> &) MOZ_DELETE;
     CompilerRoot<T> &operator =(const CompilerRoot<T> &) MOZ_DELETE;
 };
 
 typedef CompilerRoot<JSObject*> CompilerRootObject;
--- a/js/src/jsalloc.cpp
+++ b/js/src/jsalloc.cpp
@@ -8,16 +8,16 @@
 #include "jsalloc.h"
 #include "jscntxt.h"
 
 using namespace js;
 
 void *
 TempAllocPolicy::onOutOfMemory(void *p, size_t nbytes)
 {
-    return cx->runtime->onOutOfMemory(p, nbytes, cx);
+    return cx_->runtime->onOutOfMemory(p, nbytes, cx_);
 }
 
 void
 TempAllocPolicy::reportAllocOverflow() const
 {
-    js_ReportAllocationOverflow(cx);
+    js_ReportAllocationOverflow(cx_);
 }
--- a/js/src/jsalloc.h
+++ b/js/src/jsalloc.h
@@ -46,29 +46,29 @@ class SystemAllocPolicy
  * the lifetime of the container, this policy may only be used for containers
  * whose lifetime is a shorter than the given JSContext.
  *
  * FIXME bug 647103 - rewrite this in terms of temporary allocation functions,
  * not the system ones.
  */
 class TempAllocPolicy
 {
-    JSContext *const cx;
+    JSContext *const cx_;
 
     /*
      * Non-inline helper to call JSRuntime::onOutOfMemory with minimal
      * code bloat.
      */
     JS_FRIEND_API(void *) onOutOfMemory(void *p, size_t nbytes);
 
   public:
-    TempAllocPolicy(JSContext *cx) : cx(cx) {}
+    TempAllocPolicy(JSContext *cx) : cx_(cx) {}
 
     JSContext *context() const {
-        return cx;
+        return cx_;
     }
 
     void *malloc_(size_t bytes) {
         void *p = js_malloc(bytes);
         if (JS_UNLIKELY(!p))
             p = onOutOfMemory(NULL, bytes);
         return p;
     }
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -7064,17 +7064,17 @@ JS_CallOnce(JSCallOnceType *once, JSInit
         return func();
     } else {
         return JS_TRUE;
     }
 #endif
 }
 
 AutoGCRooter::AutoGCRooter(JSContext *cx, ptrdiff_t tag)
-  : down(cx->runtime->autoGCRooters), tag(tag), stackTop(&cx->runtime->autoGCRooters)
+  : down(cx->runtime->autoGCRooters), tag_(tag), stackTop(&cx->runtime->autoGCRooters)
 {
     JS_ASSERT(this != *stackTop);
     *stackTop = this;
 }
 
 #ifdef DEBUG
 JS_PUBLIC_API(void)
 JS::AssertArgumentsAreSane(JSContext *cx, const JS::Value &value)
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -103,17 +103,17 @@ class JS_PUBLIC_API(AutoGCRooter) {
 
     /*
      * Discriminates actual subclass of this being used.  If non-negative, the
      * subclass roots an array of values of the length stored in this field.
      * If negative, meaning is indicated by the corresponding value in the enum
      * below.  Any other negative value indicates some deeper problem such as
      * memory corruption.
      */
-    ptrdiff_t tag;
+    ptrdiff_t tag_;
 
     enum {
         JSVAL =        -1, /* js::AutoValueRooter */
         VALARRAY =     -2, /* js::AutoValueArray */
         PARSER =       -3, /* js::frontend::Parser */
         SHAPEVECTOR =  -4, /* js::AutoShapeVector */
         IDARRAY =      -6, /* js::AutoIdArray */
         DESCRIPTORS =  -7, /* js::AutoPropDescArrayRooter */
@@ -172,138 +172,138 @@ class AutoValueRooter : private AutoGCRo
 
     /*
      * If you are looking for Object* overloads, use AutoObjectRooter instead;
      * rooting Object*s as a js::Value requires discerning whether or not it is
      * a function object. Also, AutoObjectRooter is smaller.
      */
 
     void set(Value v) {
-        JS_ASSERT(tag == JSVAL);
+        JS_ASSERT(tag_ == JSVAL);
         val = v;
     }
 
     const Value &value() const {
-        JS_ASSERT(tag == JSVAL);
+        JS_ASSERT(tag_ == JSVAL);
         return val;
     }
 
     Value *addr() {
-        JS_ASSERT(tag == JSVAL);
+        JS_ASSERT(tag_ == JSVAL);
         return &val;
     }
 
     const Value &jsval_value() const {
-        JS_ASSERT(tag == JSVAL);
+        JS_ASSERT(tag_ == JSVAL);
         return val;
     }
 
     Value *jsval_addr() {
-        JS_ASSERT(tag == JSVAL);
+        JS_ASSERT(tag_ == JSVAL);
         return &val;
     }
 
     friend void AutoGCRooter::trace(JSTracer *trc);
 
   private:
     Value val;
     MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
 };
 
 class AutoObjectRooter : private AutoGCRooter
 {
   public:
     AutoObjectRooter(JSContext *cx, JSObject *obj = NULL
                      MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
-      : AutoGCRooter(cx, OBJECT), obj(obj)
+      : AutoGCRooter(cx, OBJECT), obj_(obj)
     {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
     }
 
     void setObject(JSObject *obj) {
-        this->obj = obj;
+        obj_ = obj;
     }
 
     JSObject * object() const {
-        return obj;
+        return obj_;
     }
 
     JSObject ** addr() {
-        return &obj;
+        return &obj_;
     }
 
     friend void AutoGCRooter::trace(JSTracer *trc);
 
   private:
-    JSObject *obj;
+    JSObject *obj_;
     MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
 };
 
 class AutoStringRooter : private AutoGCRooter {
   public:
     AutoStringRooter(JSContext *cx, JSString *str = NULL
                      MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
-      : AutoGCRooter(cx, STRING), str(str)
+      : AutoGCRooter(cx, STRING), str_(str)
     {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
     }
 
     void setString(JSString *str) {
-        this->str = str;
+        str_ = str;
     }
 
     JSString * string() const {
-        return str;
+        return str_;
     }
 
     JSString ** addr() {
-        return &str;
+        return &str_;
     }
 
     JSString * const * addr() const {
-        return &str;
+        return &str_;
     }
 
     friend void AutoGCRooter::trace(JSTracer *trc);
 
   private:
-    JSString *str;
+    JSString *str_;
     MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
 };
 
 class AutoArrayRooter : private AutoGCRooter {
   public:
     AutoArrayRooter(JSContext *cx, size_t len, Value *vec
                     MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
       : AutoGCRooter(cx, len), array(vec), skip(cx, array, len)
     {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
-        JS_ASSERT(tag >= 0);
+        JS_ASSERT(tag_ >= 0);
     }
 
     void changeLength(size_t newLength) {
-        tag = ptrdiff_t(newLength);
-        JS_ASSERT(tag >= 0);
+        tag_ = ptrdiff_t(newLength);
+        JS_ASSERT(tag_ >= 0);
     }
 
     void changeArray(Value *newArray, size_t newLength) {
         changeLength(newLength);
         array = newArray;
     }
 
     Value *array;
 
     MutableHandleValue handleAt(size_t i)
     {
-        JS_ASSERT(i < size_t(tag));
+        JS_ASSERT(i < size_t(tag_));
         return MutableHandleValue::fromMarkedLocation(&array[i]);
     }
     HandleValue handleAt(size_t i) const
     {
-        JS_ASSERT(i < size_t(tag));
+        JS_ASSERT(i < size_t(tag_));
         return HandleValue::fromMarkedLocation(&array[i]);
     }
 
     friend void AutoGCRooter::trace(JSTracer *trc);
 
   private:
     MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
 
@@ -702,23 +702,23 @@ class CallReceiver
         return JS::MutableHandleValue::fromMarkedLocation(&argv_[-2]);
     }
 
     Value *spAfterCall() const {
         setUsedRval();
         return argv_ - 1;
     }
 
-    void setCallee(Value calleev) const {
+    void setCallee(Value aCalleev) const {
         clearUsedRval();
-        argv_[-2] = calleev;
+        argv_[-2] = aCalleev;
     }
 
-    void setThis(Value thisv) const {
-        argv_[-1] = thisv;
+    void setThis(Value aThisv) const {
+        argv_[-1] = aThisv;
     }
 };
 
 JS_ALWAYS_INLINE CallReceiver
 CallReceiverFromArgv(Value *argv)
 {
     CallReceiver receiver;
     receiver.clearUsedRval();
@@ -1504,19 +1504,19 @@ JSVAL_IS_UNIVERSAL(jsval v)
     return !JSVAL_IS_GCTHING(v);
 }
 
 namespace JS {
 
 class AutoIdRooter : private AutoGCRooter
 {
   public:
-    explicit AutoIdRooter(JSContext *cx, jsid id = INT_TO_JSID(0)
+    explicit AutoIdRooter(JSContext *cx, jsid aId = INT_TO_JSID(0)
                           MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
-      : AutoGCRooter(cx, ID), id_(id)
+      : AutoGCRooter(cx, ID), id_(aId)
     {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
     }
 
     jsid id() {
         return id_;
     }
 
@@ -4991,25 +4991,25 @@ JS_AbortIfWrongThread(JSRuntime *rt);
 extern JS_PUBLIC_API(void)
 JS_ClearRuntimeThread(JSRuntime *rt);
 
 extern JS_PUBLIC_API(void)
 JS_SetRuntimeThread(JSRuntime *rt);
 
 class JSAutoSetRuntimeThread
 {
-    JSRuntime *runtime;
+    JSRuntime *runtime_;
 
   public:
-    JSAutoSetRuntimeThread(JSRuntime *runtime) : runtime(runtime) {
-        JS_SetRuntimeThread(runtime);
+    JSAutoSetRuntimeThread(JSRuntime *runtime) : runtime_(runtime) {
+        JS_SetRuntimeThread(runtime_);
     }
 
     ~JSAutoSetRuntimeThread() {
-        JS_ClearRuntimeThread(runtime);
+        JS_ClearRuntimeThread(runtime_);
     }
 };
 
 /************************************************************************/
 
 /*
  * JS_IsConstructing must be called from within a native given the
  * native's original cx and vp arguments. If JS_IsConstructing is true,
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -1577,20 +1577,25 @@ js::array_sort(JSContext *cx, unsigned a
                 ++undefs;
                 continue;
             }
             vec.infallibleAppend(v);
             allStrings = allStrings && v.isString();
             allInts = allInts && v.isInt32();
         }
 
+
+        /*
+         * If the array only contains holes, we're done.  But if it contains
+         * undefs, those must be sorted to the front of the array.
+         */
         n = vec.length();
-        if (n == 0) {
+        if (n == 0 && undefs == 0) {
             args.rval().setObject(*obj);
-            return true; /* The array has only holes and undefs. */
+            return true;
         }
 
         /* Here len == n + undefs + number_of_holes. */
         if (fval.isNull()) {
             /*
              * Sort using the default comparator converting all elements to
              * strings.
              */
--- a/js/src/jsclass.h
+++ b/js/src/jsclass.h
@@ -35,79 +35,79 @@ SPECIALID_TO_JSID(const SpecialId &sid);
  * Special values are encoded using SpecialId, which is layout-compatible but
  * non-interconvertible with jsid.  A SpecialId is used for JSID_VOID, which
  * does not occur in JS scripts but may be used to indicate the absence of a
  * valid identifier.  In the future, a SpecialId may also be an object used by
  * Harmony-proposed private names.
  */
 class SpecialId
 {
-    uintptr_t bits;
+    uintptr_t bits_;
 
     /* Needs access to raw bits. */
     friend JS_ALWAYS_INLINE jsid SPECIALID_TO_JSID(const SpecialId &sid);
     friend class PropertyId;
 
     static const uintptr_t TYPE_VOID = JSID_TYPE_VOID;
     static const uintptr_t TYPE_OBJECT = JSID_TYPE_OBJECT;
     static const uintptr_t TYPE_MASK = JSID_TYPE_MASK;
 
-    SpecialId(uintptr_t bits) : bits(bits) { }
+    SpecialId(uintptr_t bits) : bits_(bits) { }
 
   public:
-    SpecialId() : bits(TYPE_VOID) { }
+    SpecialId() : bits_(TYPE_VOID) { }
 
     /* Object-valued */
 
     SpecialId(JSObject &obj)
-      : bits(uintptr_t(&obj) | TYPE_OBJECT)
+      : bits_(uintptr_t(&obj) | TYPE_OBJECT)
     {
         JS_ASSERT(&obj != NULL);
         JS_ASSERT((uintptr_t(&obj) & TYPE_MASK) == 0);
     }
 
     bool isObject() const {
-        return (bits & TYPE_MASK) == TYPE_OBJECT && bits != TYPE_OBJECT;
+        return (bits_ & TYPE_MASK) == TYPE_OBJECT && bits_ != TYPE_OBJECT;
     }
 
     JSObject *toObject() const {
         JS_ASSERT(isObject());
-        return reinterpret_cast<JSObject *>(bits & ~TYPE_MASK);
+        return reinterpret_cast<JSObject *>(bits_ & ~TYPE_MASK);
     }
 
     /* Empty */
 
     static SpecialId empty() {
         SpecialId sid(TYPE_OBJECT);
         JS_ASSERT(sid.isEmpty());
         return sid;
     }
 
     bool isEmpty() const {
-        return bits == TYPE_OBJECT;
+        return bits_ == TYPE_OBJECT;
     }
 
     /* Void */
 
     static SpecialId voidId() {
         SpecialId sid(TYPE_VOID);
         JS_ASSERT(sid.isVoid());
         return sid;
     }
 
     bool isVoid() const {
-        return bits == TYPE_VOID;
+        return bits_ == TYPE_VOID;
     }
 };
 
 static JS_ALWAYS_INLINE jsid
 SPECIALID_TO_JSID(const SpecialId &sid)
 {
     jsid id;
-    JSID_BITS(id) = sid.bits;
+    JSID_BITS(id) = sid.bits_;
     JS_ASSERT_IF(sid.isObject(), JSID_IS_OBJECT(id) && JSID_TO_OBJECT(id) == sid.toObject());
     JS_ASSERT_IF(sid.isVoid(), JSID_IS_VOID(id));
     JS_ASSERT_IF(sid.isEmpty(), JSID_IS_EMPTY(id));
     return id;
 }
 
 static JS_ALWAYS_INLINE bool
 JSID_IS_SPECIAL(jsid id)
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -2237,26 +2237,26 @@ class RuntimeAllocPolicy
     void reportAllocOverflow() const {}
 };
 
 /*
  * FIXME bug 647103 - replace these *AllocPolicy names.
  */
 class ContextAllocPolicy
 {
-    JSContext *const cx;
+    JSContext *const cx_;
 
   public:
-    ContextAllocPolicy(JSContext *cx) : cx(cx) {}
-    JSContext *context() const { return cx; }
-    void *malloc_(size_t bytes) { return cx->malloc_(bytes); }
-    void *calloc_(size_t bytes) { return cx->calloc_(bytes); }
-    void *realloc_(void *p, size_t oldBytes, size_t bytes) { return cx->realloc_(p, oldBytes, bytes); }
+    ContextAllocPolicy(JSContext *cx) : cx_(cx) {}
+    JSContext *context() const { return cx_; }
+    void *malloc_(size_t bytes) { return cx_->malloc_(bytes); }
+    void *calloc_(size_t bytes) { return cx_->calloc_(bytes); }
+    void *realloc_(void *p, size_t oldBytes, size_t bytes) { return cx_->realloc_(p, oldBytes, bytes); }
     void free_(void *p) { js_free(p); }
-    void reportAllocOverflow() const { js_ReportAllocationOverflow(cx); }
+    void reportAllocOverflow() const { js_ReportAllocationOverflow(cx_); }
 };
 
 JSBool intrinsic_ThrowError(JSContext *cx, unsigned argc, Value *vp);
 JSBool intrinsic_NewDenseArray(JSContext *cx, unsigned argc, Value *vp);
 JSBool intrinsic_UnsafeSetElement(JSContext *cx, unsigned argc, Value *vp);
 JSBool intrinsic_ForceSequential(JSContext *cx, unsigned argc, Value *vp);
 JSBool intrinsic_NewParallelArray(JSContext *cx, unsigned argc, Value *vp);
 
--- a/js/src/jsfriendapi.h
+++ b/js/src/jsfriendapi.h
@@ -650,20 +650,20 @@ class ProfileEntry
         return sp == NULL;
     }
 
     uint32_t line() volatile { JS_ASSERT(!js()); return idx; }
     JSScript *script() volatile { JS_ASSERT(js()); return script_; }
     void *stackAddress() volatile { return sp; }
     const char *label() volatile { return string; }
 
-    void setLine(uint32_t line) volatile { JS_ASSERT(!js()); idx = line; }
-    void setLabel(const char *string) volatile { this->string = string; }
-    void setStackAddress(void *sp) volatile { this->sp = sp; }
-    void setScript(JSScript *script) volatile { script_ = script; }
+    void setLine(uint32_t aLine) volatile { JS_ASSERT(!js()); idx = aLine; }
+    void setLabel(const char *aString) volatile { string = aString; }
+    void setStackAddress(void *aSp) volatile { sp = aSp; }
+    void setScript(JSScript *aScript) volatile { script_ = aScript; }
 
     /* we can't know the layout of JSScript, so look in vm/SPSProfiler.cpp */
     JS_FRIEND_API(jsbytecode *) pc() volatile;
     JS_FRIEND_API(void) setPC(jsbytecode *pc) volatile;
 
     static size_t offsetOfString() { return offsetof(ProfileEntry, string); }
     static size_t offsetOfStackAddress() { return offsetof(ProfileEntry, sp); }
     static size_t offsetOfPCIdx() { return offsetof(ProfileEntry, idx); }
--- a/js/src/jsmemorymetrics.cpp
+++ b/js/src/jsmemorymetrics.cpp
@@ -84,17 +84,17 @@ StatsCompartmentCallback(JSRuntime *rt, 
 
     // CollectRuntimeStats reserves enough space.
     MOZ_ALWAYS_TRUE(rtStats->compartmentStatsVector.growBy(1));
     CompartmentStats &cStats = rtStats->compartmentStatsVector.back();
     rtStats->initExtraCompartmentStats(compartment, &cStats);
     rtStats->currCompartmentStats = &cStats;
 
     // Measure the compartment object itself, and things hanging off it.
-    compartment->sizeOfIncludingThis(rtStats->mallocSizeOf,
+    compartment->sizeOfIncludingThis(rtStats->mallocSizeOf_,
                                      &cStats.compartmentObject,
                                      &cStats.typeInference,
                                      &cStats.shapesCompartmentTables,
                                      &cStats.crossCompartmentWrappersTable,
                                      &cStats.regexpCompartment,
                                      &cStats.debuggeesSet);
 }
 
@@ -143,34 +143,34 @@ StatsCellCallback(JSRuntime *rt, void *d
             cStats->gcHeapObjectsDenseArray += thingSize;
         } else if (obj->isCrossCompartmentWrapper()) {
             cStats->gcHeapObjectsCrossCompartmentWrapper += thingSize;
         } else {
             cStats->gcHeapObjectsOrdinary += thingSize;
         }
 
         ObjectsExtraSizes objectsExtra;
-        obj->sizeOfExcludingThis(rtStats->mallocSizeOf, &objectsExtra);
+        obj->sizeOfExcludingThis(rtStats->mallocSizeOf_, &objectsExtra);
         cStats->objectsExtra.add(objectsExtra);
 
         // JSObject::sizeOfExcludingThis() doesn't measure objectsExtraPrivate,
         // so we do it here.
         if (ObjectPrivateVisitor *opv = closure->opv) {
             nsISupports *iface;
-            if (opv->getISupports(obj, &iface) && iface) {
+            if (opv->getISupports_(obj, &iface) && iface) {
                 cStats->objectsExtra.private_ += opv->sizeOfIncludingThis(iface);
             }
         }
         break;
     }
     case JSTRACE_STRING:
     {
         JSString *str = static_cast<JSString *>(thing);
 
-        size_t strSize = str->sizeOfExcludingThis(rtStats->mallocSizeOf);
+        size_t strSize = str->sizeOfExcludingThis(rtStats->mallocSizeOf_);
 
         // If we can't grow hugeStrings, let's just call this string non-huge.
         // We're probably about to OOM anyway.
         if (strSize >= HugeStringInfo::MinSize() && cStats->hugeStrings.growBy(1)) {
             cStats->gcHeapStringsNormal += thingSize;
             HugeStringInfo &info = cStats->hugeStrings.back();
             info.length = str->length();
             info.size = strSize;
@@ -183,17 +183,17 @@ StatsCellCallback(JSRuntime *rt, void *d
             cStats->stringCharsNonHuge += strSize;
         }
         break;
     }
     case JSTRACE_SHAPE:
     {
         UnrootedShape shape = static_cast<RawShape>(thing);
         size_t propTableSize, kidsSize;
-        shape->sizeOfExcludingThis(rtStats->mallocSizeOf, &propTableSize, &kidsSize);
+        shape->sizeOfExcludingThis(rtStats->mallocSizeOf_, &propTableSize, &kidsSize);
         if (shape->inDictionary()) {
             cStats->gcHeapShapesDict += thingSize;
             cStats->shapesExtraDictTables += propTableSize;
             JS_ASSERT(kidsSize == 0);
         } else {
             if (shape->base()->getObjectParent() == shape->compartment()->maybeGlobal()) {
                 cStats->gcHeapShapesTreeGlobalParented += thingSize;
             } else {
@@ -208,29 +208,29 @@ StatsCellCallback(JSRuntime *rt, void *d
     {
         cStats->gcHeapShapesBase += thingSize;
         break;
     }
     case JSTRACE_SCRIPT:
     {
         JSScript *script = static_cast<JSScript *>(thing);
         cStats->gcHeapScripts += thingSize;
-        cStats->scriptData += script->sizeOfData(rtStats->mallocSizeOf);
+        cStats->scriptData += script->sizeOfData(rtStats->mallocSizeOf_);
 #ifdef JS_METHODJIT
-        cStats->jaegerData += script->sizeOfJitScripts(rtStats->mallocSizeOf);
+        cStats->jaegerData += script->sizeOfJitScripts(rtStats->mallocSizeOf_);
 # ifdef JS_ION
-        cStats->ionData += ion::MemoryUsed(script, rtStats->mallocSizeOf);
+        cStats->ionData += ion::MemoryUsed(script, rtStats->mallocSizeOf_);
 # endif
 #endif
 
         ScriptSource *ss = script->scriptSource();
         SourceSet::AddPtr entry = closure->seenSources.lookupForAdd(ss);
         if (!entry) {
             closure->seenSources.add(entry, ss); // Not much to be done on failure.
-            rtStats->runtime.scriptSources += ss->sizeOfIncludingThis(rtStats->mallocSizeOf);
+            rtStats->runtime.scriptSources += ss->sizeOfIncludingThis(rtStats->mallocSizeOf_);
         }
         break;
     }
     case JSTRACE_IONCODE:
     {
 #ifdef JS_METHODJIT
 # ifdef JS_ION
         cStats->gcHeapIonCodes += thingSize;
@@ -238,17 +238,17 @@ StatsCellCallback(JSRuntime *rt, void *d
 # endif
 #endif
         break;
     }
     case JSTRACE_TYPE_OBJECT:
     {
         types::TypeObject *obj = static_cast<types::TypeObject *>(thing);
         cStats->gcHeapTypeObjects += thingSize;
-        cStats->typeInference.typeObjects += obj->sizeOfExcludingThis(rtStats->mallocSizeOf);
+        cStats->typeInference.typeObjects += obj->sizeOfExcludingThis(rtStats->mallocSizeOf_);
         break;
     }
     }
     // Yes, this is a subtraction:  see StatsArenaCallback() for details.
     cStats->gcHeapUnusedGcThings -= thingSize;
 }
 
 JS_PUBLIC_API(bool)
@@ -270,17 +270,17 @@ JS::CollectRuntimeStats(JSRuntime *rt, R
     IteratorClosure closure(rtStats, opv);
     if (!closure.init())
         return false;
     rtStats->runtime.scriptSources = 0;
     IterateCompartmentsArenasCells(rt, &closure, StatsCompartmentCallback,
                                    StatsArenaCallback, StatsCellCallback);
 
     // Take the "explicit/js/runtime/" measurements.
-    rt->sizeOfIncludingThis(rtStats->mallocSizeOf, &rtStats->runtime);
+    rt->sizeOfIncludingThis(rtStats->mallocSizeOf_, &rtStats->runtime);
 
     rtStats->gcHeapGcThings = 0;
     for (size_t i = 0; i < rtStats->compartmentStatsVector.length(); i++) {
         CompartmentStats &cStats = rtStats->compartmentStatsVector[i];
 
         rtStats->totals.add(cStats);
         rtStats->gcHeapGcThings += cStats.gcHeapThingsSize();
     }
--- a/js/src/jsproxy.h
+++ b/js/src/jsproxy.h
@@ -48,17 +48,17 @@ class JS_FRIEND_API(Wrapper);
  * the derived traps in terms of the fundamental ones. This allows consumers of
  * this class to define any custom behavior they want.
  */
 class JS_FRIEND_API(BaseProxyHandler) {
     void *mFamily;
     bool mHasPrototype;
   protected:
     // Subclasses may set this in their constructor.
-    void setHasPrototype(bool hasPrototype) { mHasPrototype = hasPrototype; }
+    void setHasPrototype(bool aHasPrototype) { mHasPrototype = aHasPrototype; }
 
   public:
     explicit BaseProxyHandler(void *family);
     virtual ~BaseProxyHandler();
 
     bool hasPrototype() {
         return mHasPrototype;
     }
--- a/js/src/jsutil.h
+++ b/js/src/jsutil.h
@@ -49,19 +49,19 @@ struct AlignmentTestStruct
   (sizeof(js::AlignmentTestStruct<t_>) - sizeof(t_))
 
 template <class T>
 class AlignedPtrAndFlag
 {
     uintptr_t bits;
 
   public:
-    AlignedPtrAndFlag(T *t, bool flag) {
+    AlignedPtrAndFlag(T *t, bool aFlag) {
         JS_ASSERT((uintptr_t(t) & 1) == 0);
-        bits = uintptr_t(t) | uintptr_t(flag);
+        bits = uintptr_t(t) | uintptr_t(aFlag);
     }
 
     T *ptr() const {
         return (T *)(bits & ~uintptr_t(1));
     }
 
     bool flag() const {
         return (bits & 1) != 0;
@@ -75,19 +75,19 @@ class AlignedPtrAndFlag
     void setFlag() {
         bits |= 1;
     }
 
     void unsetFlag() {
         bits &= ~uintptr_t(1);
     }
 
-    void set(T *t, bool flag) {
+    void set(T *t, bool aFlag) {
         JS_ASSERT((uintptr_t(t) & 1) == 0);
-        bits = uintptr_t(t) | flag;
+        bits = uintptr_t(t) | aFlag;
     }
 };
 
 template <class T>
 static inline void
 Reverse(T *beg, T *end)
 {
     while (beg != end) {
@@ -157,27 +157,27 @@ ImplicitCast(U &u)
 }
 
 template<typename T>
 class AutoScopedAssign
 {
   public:
     AutoScopedAssign(T *addr, const T &value
                      MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
-        : addr(addr), old(*addr)
+        : addr_(addr), old(*addr_)
     {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
-        *addr = value;
+        *addr_ = value;
     }
 
-    ~AutoScopedAssign() { *addr = old; }
+    ~AutoScopedAssign() { *addr_ = old; }
 
   private:
     MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
-    T *addr;
+    T *addr_;
     T old;
 };
 
 template <class T>
 JS_ALWAYS_INLINE static void
 PodZero(T *t)
 {
     memset(t, 0, sizeof(T));
new file mode 100644
--- /dev/null
+++ b/js/src/tests/ecma_5/Array/sort-array-with-holes-and-undefined.js
@@ -0,0 +1,32 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 664528;
+var summary =
+  "Sorting an array containing only holes and |undefined| should move all " +
+  "|undefined| to the start of the array";
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+var a = [, , , undefined];
+a.sort();
+
+assertEq(a.hasOwnProperty(0), true);
+assertEq(a[0], undefined);
+assertEq(a.hasOwnProperty(1), false);
+assertEq(a.hasOwnProperty(2), false);
+assertEq(a.hasOwnProperty(3), false);
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");
--- a/js/xpconnect/src/dictionary_helper_gen.conf
+++ b/js/xpconnect/src/dictionary_helper_gen.conf
@@ -23,16 +23,18 @@ dictionaries = [
      [ 'ArchiveReaderOptions', 'nsIDOMArchiveReader.idl' ],
      [ 'SmsThreadListItem', 'nsISmsRequest.idl' ]
    ]
 
 # include file names
 special_includes = [
     'nsContentUtils.h',
     'XPCQuickStubs.h',
-    'nsIDOMApplicationRegistry.h'
+    'nsIDOMApplicationRegistry.h',
+    'nsIDOMFile.h'
   ]
 
 # name of the type to not include using #include "typename.h"
 exclude_automatic_type_include = [
     'nsISupports',
-    'mozIDOMApplication'
+    'mozIDOMApplication',
+    'nsIDOMBlob'
   ]
--- a/js/xpconnect/src/event_impl_gen.conf.in
+++ b/js/xpconnect/src/event_impl_gen.conf.in
@@ -36,23 +36,26 @@ simple_events = [
     'MozWifiStatusChangeEvent',
     'MozWifiConnectionInfoEvent',
     'MozCellBroadcastEvent',
     'MozVoicemailEvent',
     'USSDReceivedEvent',
 #endif
     'MozSmsEvent',
     'DeviceStorageChangeEvent',
-    'PopupBlockedEvent'
+    'PopupBlockedEvent',
+    'BlobEvent'
   ]
 
 """ include file names """
 special_includes = [
     'DictionaryHelpers.h',
     'nsContentUtils.h',
-    'nsIDOMApplicationRegistry.h'
+    'nsIDOMApplicationRegistry.h',
+    'nsIDOMFile.h'
   ]
 
 """ name of the type to not include using #include "typename.h" """
 exclude_automatic_type_include = [
     'nsISupports',
-    'mozIDOMApplication'
+    'mozIDOMApplication',
+    'nsIDOMBlob'
   ]
--- a/layout/base/nsPresArena.cpp
+++ b/layout/base/nsPresArena.cpp
@@ -327,16 +327,17 @@ struct nsPresArena::State {
                         "different sizes for same object type code");
     }
 
     void* result;
     if (len > 0) {
       // LIFO behavior for best cache utilization
       result = list->mEntries.ElementAt(len - 1);
       list->mEntries.RemoveElementAt(len - 1);
+      MOZ_MAKE_MEM_UNDEFINED(result, list->mEntrySize);
 #if defined(DEBUG)
       {
         char* p = reinterpret_cast<char*>(result);
         char* limit = p + list->mEntrySize;
         for (; p < limit; p += sizeof(uintptr_t)) {
           uintptr_t val = *reinterpret_cast<uintptr_t*>(p);
           NS_ABORT_IF_FALSE(val == ARENA_POISON,
                             nsPrintfCString("PresArena: poison overwritten; "
@@ -345,17 +346,16 @@ struct nsPresArena::State {
                                             "errors in bits %.16llx",
                                             uint64_t(ARENA_POISON),
                                             uint64_t(val),
                                             uint64_t(ARENA_POISON ^ val)
                                             ).get());
         }
       }
 #endif
-      MOZ_MAKE_MEM_UNDEFINED(result, list->mEntrySize);
       return result;
     }
 
     // Allocate a new chunk from the arena
     list->mEntriesEverAllocated++;
     PL_ARENA_ALLOCATE(result, &mPool, aSize);
     if (!result) {
       NS_RUNTIMEABORT("out of memory");
--- a/layout/base/nsPresContext.cpp
+++ b/layout/base/nsPresContext.cpp
@@ -1655,17 +1655,19 @@ nsPresContext::UIResolutionChangedSubdoc
 }
 
 void
 nsPresContext::UIResolutionChangedInternal()
 {
   mPendingUIResolutionChanged = false;
 
   mDeviceContext->CheckDPIChange();
-  AppUnitsPerDevPixelChanged();
+  if (uint32_t(mCurAppUnitsPerDevPixel) != AppUnitsPerDevPixel()) {
+    AppUnitsPerDevPixelChanged();
+  }
 
   mDocument->EnumerateSubDocuments(UIResolutionChangedSubdocumentCallback,
                                    nullptr);
 }
 
 void
 nsPresContext::RebuildAllStyleData(nsChangeHint aExtraHint)
 {
--- a/layout/forms/nsRangeFrame.cpp
+++ b/layout/forms/nsRangeFrame.cpp
@@ -264,16 +264,19 @@ nsRangeFrame::ReflowAnonymousContent(nsP
 
     // Find the x/y position of the thumb frame such that it will be positioned
     // as described above. These coordinates are with respect to the
     // nsRangeFrame's border-box.
     nscoord thumbX, thumbY;
 
     if (isHorizontal) {
       thumbX = NSToCoordRound(rangeFrameContentBoxWidth * valueAsFraction);
+      if (StyleVisibility()->mDirection == NS_STYLE_DIRECTION_RTL) {
+        thumbX = rangeFrameContentBoxWidth - thumbX;
+      }
       thumbY = rangeFrameContentBoxHeight / 2;
     } else {
       thumbX = rangeFrameContentBoxWidth / 2;
       // For vertical range zero is at the bottom, so subtract from height:
       thumbY = rangeFrameContentBoxHeight -
                  NSToCoordRound(rangeFrameContentBoxHeight * valueAsFraction);
     }
 
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/842132-1.html
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+  var e = document.body;
+  var sel = window.getSelection();
+
+  window.getSelection().removeAllRanges();
+  var r0 = document.createRange();
+  r0.setStart(e, 0);
+  r0.setEnd(e, 1);
+  window.getSelection().addRange(r0);
+  var r1 = document.createRange();
+  r1.setStart(e, 1);
+  r1.setEnd(e, 1);
+  window.getSelection().addRange(r1);
+
+  window.getSelection().deleteFromDocument();
+}
+
+</script>
+</head>
+
+<body onload="boom();" contenteditable="true">x</body>
+</html>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -423,8 +423,9 @@ test-pref(layout.css.flexbox.enabled,tru
 test-pref(layout.css.flexbox.enabled,true) load 737313-3.html
 load 762764-1.html
 load 786740-1.html
 asserts(12) test-pref(layout.css.flexbox.enabled,true) load 798020-1.html
 test-pref(layout.css.flexbox.enabled,true) load 798235-1.html
 test-pref(layout.css.flexbox.enabled,true) load 799207-1.html
 asserts(12) test-pref(layout.css.flexbox.enabled,true) load 799207-2.html
 test-pref(layout.css.flexbox.enabled,true) load 804089-1.xhtml
+load 842132-1.html
--- a/layout/generic/nsSelection.cpp
+++ b/layout/generic/nsSelection.cpp
@@ -2925,19 +2925,19 @@ nsFrameSelection::DeleteFromDocument()
     return NS_ERROR_NULL_POINTER;
 
   mDomSelections[index]->GetIsCollapsed( &isCollapsed);
   if (isCollapsed)
   {
     return NS_OK;
   }
 
-  uint32_t rangeCount = mDomSelections[index]->GetRangeCount();
-  for (uint32_t rangeIdx = 0; rangeIdx < rangeCount; ++rangeIdx) {
-    nsRefPtr<nsRange> range = mDomSelections[index]->GetRangeAt(rangeIdx);
+  nsRefPtr<mozilla::Selection> selection = mDomSelections[index];
+  for (uint32_t rangeIdx = 0; rangeIdx < selection->GetRangeCount(); ++rangeIdx) {
+    nsRefPtr<nsRange> range = selection->GetRangeAt(rangeIdx);
     res = range->DeleteContents();
     if (NS_FAILED(res))
       return res;
   }
 
   // Collapse to the new location.
   // If we deleted one character, then we move back one element.
   // FIXME  We don't know how to do this past frame boundaries yet.
--- a/layout/inspector/src/nsFontFace.cpp
+++ b/layout/inspector/src/nsFontFace.cpp
@@ -69,55 +69,16 @@ nsFontFace::GetName(nsAString & aName)
   }
   return NS_OK;
 }
 
 /* readonly attribute DOMString CSSFamilyName; */
 NS_IMETHODIMP
 nsFontFace::GetCSSFamilyName(nsAString & aCSSFamilyName)
 {
-  if (mFontEntry->IsUserFont()) {
-    // for a user font, find CSS family name from the @font-face rule
-    nsUserFontSet* fontSet =
-      static_cast<nsUserFontSet*>(mFontGroup->GetUserFontSet());
-    if (fontSet) {
-      nsCSSFontFaceRule* rule = fontSet->FindRuleForEntry(mFontEntry);
-      if (rule) {
-        nsCOMPtr<nsIDOMCSSStyleDeclaration> style;
-        nsresult rv = rule->GetStyle(getter_AddRefs(style));
-        if (NS_SUCCEEDED(rv)) {
-          nsString familyName;
-          rv = style->GetPropertyValue(NS_LITERAL_STRING("font-family"),
-                                       aCSSFamilyName);
-          if (NS_SUCCEEDED(rv)) {
-            // GetPropertyValue gives us the name in "quotes"; strip them off.
-            // XXX What about possible CSS escapes - should we unescape here?
-            // Or don't we care, as this is just for display/debugging use?
-            if (aCSSFamilyName[0] == '"' &&
-                aCSSFamilyName[aCSSFamilyName.Length() - 1] == '"') {
-              aCSSFamilyName.Truncate(aCSSFamilyName.Length() - 1);
-              aCSSFamilyName.Cut(0, 1);
-            }
-            return NS_OK;
-          }
-        }
-      }
-    }
-  }
-
-  // look through the font-group's list for this entry
-  uint32_t count = mFontGroup->FontListLength();
-  for (uint32_t i = 0; i < count; ++i) {
-    if (mFontGroup->GetFontAt(i)->GetFontEntry() == mFontEntry) {
-      aCSSFamilyName = mFontGroup->GetFamilyNameAt(i);
-      return NS_OK;
-    }
-  }
-
-  // if it wasn't found there, query the font entry itself
   aCSSFamilyName = mFontEntry->FamilyName();
   return NS_OK;
 }
 
 /* readonly attribute nsIDOMCSSFontFaceRule rule; */
 NS_IMETHODIMP
 nsFontFace::GetRule(nsIDOMCSSFontFaceRule **aRule)
 {
--- a/layout/mathml/nsMathMLChar.cpp
+++ b/layout/mathml/nsMathMLChar.cpp
@@ -921,17 +921,18 @@ SetFontFamily(nsStyleContext*      aStyl
     nsRefPtr<nsFontMetrics> fm;
     aRenderingContext.DeviceContext()->GetMetricsFor(font,
       aStyleContext->StyleFont()->mLanguage,
       aStyleContext->PresContext()->GetUserFontSet(),
       *getter_AddRefs(fm));
     // Set the font if it is an unicode table
     // or if the same family name has been found
     if (aGlyphTable == &gGlyphTableList->mUnicodeTable ||
-        fm->GetThebesFontGroup()->GetFamilyNameAt(0) == family) {
+        fm->GetThebesFontGroup()->GetFontAt(0)->GetFontEntry()->
+        FamilyName() == family) {
       aFont.name = family;
       aRenderingContext.SetFont(fm);
     } else {
       return false; // We did not set the font
     }
   }
   return true;
 }
new file mode 100644
--- /dev/null
+++ b/layout/reftests/forms/input/range/input-range-direction-unthemed-1-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+  <body>
+    <input type='range' value=30 style="-moz-appearance:none;">
+  </body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/reftests/forms/input/range/input-range-direction-unthemed-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+  <!-- Test: that direction:rtl behaves correctly -->
+  <body>
+    <input type='range' value=70 style="-moz-appearance:none; direction:rtl;">
+  </body>
+</html>
--- a/layout/reftests/forms/input/range/reftest.list
+++ b/layout/reftests/forms/input/range/reftest.list
@@ -9,8 +9,11 @@ default-preferences pref(dom.experimenta
 # dynamic type changes:
 == input-to-range-from-other-type-unthemed-1.html input-to-range-from-other-type-unthemed-1-ref.html
 == input-from-range-to-other-type-unthemed-1.html input-from-range-to-other-type-unthemed-1-ref.html
 
 # for different values:
 != input-range-different-fraction-of-range-unthemed-1.html input-range-different-fraction-of-range-unthemed-1-notref.html
 == input-range-same-fraction-of-range-unthemed-1.html input-range-same-fraction-of-range-unthemed-1-ref.html
 
+# 'direction' property:
+== input-range-direction-unthemed-1.html input-range-direction-unthemed-1-ref.html
+
--- a/layout/style/Loader.cpp
+++ b/layout/style/Loader.cpp
@@ -1134,17 +1134,17 @@ Loader::CreateSheet(nsIURI* aURI,
                                           &debugEqual)) && debugEqual),
                      "Principals should be the same");
 #endif
       }
 
       // Then alternate sheets
       if (!sheet) {
         aSheetState = eSheetPending;
-        SheetLoadData* loadData = nullptr;
+        loadData = nullptr;
         mPendingDatas.Get(&key, &loadData);
         if (loadData) {
           sheet = loadData->mSheet;
           LOG(("  From pending: %p", sheet.get()));
 
 #ifdef DEBUG
           bool debugEqual;
           NS_ASSERTION((!aLoaderPrincipal && !loadData->mLoaderPrincipal) ||
--- a/layout/style/Makefile.in
+++ b/layout/style/Makefile.in
@@ -17,16 +17,21 @@ endif
 
 MODULE		= layout
 LIBRARY_NAME	= gkstyle_s
 LIBXUL_LIBRARY	= 1
 ifndef _MSC_VER
 FAIL_ON_WARNINGS = 1
 endif # !_MSC_VER
 
+ifdef GNU_CC
+OS_CFLAGS := $(OS_CFLAGS) -Wshadow
+OS_CXXFLAGS := $(OS_CXXFLAGS) -Wshadow
+endif
+
 EXPORTS_NAMESPACES = mozilla/css mozilla/dom
 
 EXPORTS		= \
 		AnimationCommon.h \
 		nsAnimationManager.h \
 		nsCSSAnonBoxList.h \
 		nsCSSAnonBoxes.h \
 		nsCSSFontDescList.h \
new file mode 100644
--- /dev/null
+++ b/layout/style/crashtests/842134.html
@@ -0,0 +1,1 @@
+<!doctype html><style>body { marker: url(#m) url(#m); }</style>
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@@ -83,8 +83,9 @@ skip-if(Android||browserIsRemote) load 7
 skip-if(browserIsRemote) load 786108-2.html # Bug 795534
 load 788836.html
 load 806310-1.html
 load 812824.html
 load 822842.html
 load 822766-1.html
 load 827591-1.html
 load 840898.html
+load 842134.html
--- a/layout/style/nsCSSScanner.cpp
+++ b/layout/style/nsCSSScanner.cpp
@@ -1025,16 +1025,17 @@ nsCSSScanner::NextURL(nsCSSToken& aToken
     if (MOZ_UNLIKELY(aToken.mType == eCSSToken_Bad_String)) {
       aToken.mType = eCSSToken_Bad_URL;
       return true;
     }
     MOZ_ASSERT(aToken.mType == eCSSToken_String, "unexpected token type");
 
   } else {
     // Otherwise, this is the start of a non-quoted url (which may be empty).
+    aToken.mSymbol = PRUnichar(0);
     GatherText(IS_URL_CHAR, aToken.mIdent);
   }
 
   // Consume trailing whitespace and then look for a close parenthesis.
   SkipWhitespace();
   ch = Peek();
   if (MOZ_LIKELY(ch < 0 || ch == ')')) {
     Advance();
--- a/layout/style/nsCSSValue.h
+++ b/layout/style/nsCSSValue.h
@@ -30,40 +30,40 @@ class nsPresContext;
 class nsIURI;
 template <class T>
 class nsPtrHashKey;
 
 // Deletes a linked list iteratively to avoid blowing up the stack (bug 456196).
 #define NS_CSS_DELETE_LIST_MEMBER(type_, ptr_, member_)                        \
   {                                                                            \
     type_ *cur = (ptr_)->member_;                                              \
-    (ptr_)->member_ = nullptr;                                                  \
+    (ptr_)->member_ = nullptr;                                                 \
     while (cur) {                                                              \
-      type_ *next = cur->member_;                                              \
-      cur->member_ = nullptr;                                                   \
+      type_ *dlm_next = cur->member_;                                          \
+      cur->member_ = nullptr;                                                  \
       delete cur;                                                              \
-      cur = next;                                                              \
+      cur = dlm_next;                                                          \
     }                                                                          \
   }
 
 // Clones a linked list iteratively to avoid blowing up the stack.
 // If it fails to clone the entire list then 'to_' is deleted and
 // we return null.
 #define NS_CSS_CLONE_LIST_MEMBER(type_, from_, member_, to_, args_)            \
   {                                                                            \
     type_ *dest = (to_);                                                       \
-    (to_)->member_ = nullptr;                                                   \
+    (to_)->member_ = nullptr;                                                  \
     for (const type_ *src = (from_)->member_; src; src = src->member_) {       \
-      type_ *clone = src->Clone args_;                                         \
-      if (!clone) {                                                            \
+      type_ *clm_clone = src->Clone args_;                                     \
+      if (!clm_clone) {                                                        \
         delete (to_);                                                          \
-        return nullptr;                                                         \
+        return nullptr;                                                        \
       }                                                                        \
-      dest->member_ = clone;                                                   \
-      dest = clone;                                                            \
+      dest->member_ = clm_clone;                                               \
+      dest = clm_clone;                                                        \
     }                                                                          \
   }
 
 namespace mozilla {
 namespace css {
 
 struct URLValue {
   // Methods are not inline because using an nsIPrincipal means requiring
--- a/layout/style/nsFontFaceLoader.cpp
+++ b/layout/style/nsFontFaceLoader.cpp
@@ -726,49 +726,49 @@ nsUserFontSet::LogMessage(gfxMixedFontFa
                                nsCSSProps::kFontWeightKTable);
   if (weightKeywordString.Length() > 0) {
     weightKeyword = weightKeywordString.get();
   } else {
     sprintf(weightKeywordBuf, "%u", aProxy->Weight());
     weightKeyword = weightKeywordBuf;
   }
 
-  nsPrintfCString
-    msg("downloadable font: %s "
+  nsPrintfCString message
+       ("downloadable font: %s "
         "(font-family: \"%s\" style:%s weight:%s stretch:%s src index:%d)",
         aMessage,
         familyName.get(),
         aProxy->IsItalic() ? "italic" : "normal",
         weightKeyword,
         nsCSSProps::ValueToKeyword(aProxy->Stretch(),
                                    nsCSSProps::kFontStretchKTable).get(),
         aProxy->mSrcIndex);
 
   if (NS_FAILED(aStatus)) {
-    msg.Append(": ");
+    message.Append(": ");
     switch (aStatus) {
     case NS_ERROR_DOM_BAD_URI:
-      msg.Append("bad URI or cross-site access not allowed");
+      message.Append("bad URI or cross-site access not allowed");
       break;
     case NS_ERROR_CONTENT_BLOCKED:
-      msg.Append("content blocked");
+      message.Append("content blocked");
       break;
     default:
-      msg.Append("status=");
-      msg.AppendInt(static_cast<uint32_t>(aStatus));
+      message.Append("status=");
+      message.AppendInt(static_cast<uint32_t>(aStatus));
       break;
     }
   }
-  msg.Append("\nsource: ");
-  msg.Append(fontURI);
+  message.Append("\nsource: ");
+  message.Append(fontURI);
 
 #ifdef PR_LOGGING
   if (PR_LOG_TEST(GetUserFontsLog(), PR_LOG_DEBUG)) {
     PR_LOG(GetUserFontsLog(), PR_LOG_DEBUG,
-           ("userfonts (%p) %s", this, msg.get()));
+           ("userfonts (%p) %s", this, message.get()));
   }
 #endif
 
   // try to give the user an indication of where the rule came from
   nsCSSFontFaceRule* rule = FindRuleForEntry(aProxy);
   nsString href;
   nsString text;
   nsresult rv;
@@ -782,17 +782,17 @@ nsUserFontSet::LogMessage(gfxMixedFontFa
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
   nsCOMPtr<nsIScriptError> scriptError =
     do_CreateInstance(NS_SCRIPTERROR_CONTRACTID, &rv);
   NS_ENSURE_SUCCESS(rv, rv);
 
   uint64_t innerWindowID = GetPresContext()->Document()->InnerWindowID();
-  rv = scriptError->InitWithWindowID(NS_ConvertUTF8toUTF16(msg),
+  rv = scriptError->InitWithWindowID(NS_ConvertUTF8toUTF16(message),
                                      href,         // file
                                      text,         // src line
                                      0, 0,         // line & column number
                                      aFlags,       // flags
                                      "CSS Loader", // category (make separate?)
                                      innerWindowID);
   if (NS_SUCCEEDED(rv)) {
     console->LogMessage(scriptError);
--- a/layout/style/nsRuleNode.cpp
+++ b/layout/style/nsRuleNode.cpp
@@ -3936,32 +3936,32 @@ nsRuleNode::ComputeTextResetData(void* a
     text->mTextOverflow.mRight.mType = NS_STYLE_TEXT_OVERFLOW_STRING;
     textOverflowValue->GetStringValue(text->mTextOverflow.mRight.mString);
     text->mTextOverflow.mLeft.mType = NS_STYLE_TEXT_OVERFLOW_CLIP;
     text->mTextOverflow.mLeft.mString.Truncate();
     text->mTextOverflow.mLogicalDirections = true;
   } else if (eCSSUnit_Pair == textOverflowValue->GetUnit()) {
     // Two values were specified.
     text->mTextOverflow.mLogicalDirections = false;
-    const nsCSSValuePair& textOverflowValue =
-      aRuleData->ValueForTextOverflow()->GetPairValue();
-
-    const nsCSSValue *textOverflowLeftValue = &textOverflowValue.mXValue;
+    const nsCSSValuePair& textOverflowValuePair =
+      textOverflowValue->GetPairValue();
+
+    const nsCSSValue *textOverflowLeftValue = &textOverflowValuePair.mXValue;
     if (eCSSUnit_Enumerated == textOverflowLeftValue->GetUnit()) {
       SetDiscrete(*textOverflowLeftValue, text->mTextOverflow.mLeft.mType,
                   canStoreInRuleTree,
                   SETDSC_ENUMERATED, parentText->mTextOverflow.mLeft.mType,
                   NS_STYLE_TEXT_OVERFLOW_CLIP, 0, 0, 0, 0);
       text->mTextOverflow.mLeft.mString.Truncate();
     } else if (eCSSUnit_String == textOverflowLeftValue->GetUnit()) {
       textOverflowLeftValue->GetStringValue(text->mTextOverflow.mLeft.mString);
       text->mTextOverflow.mLeft.mType = NS_STYLE_TEXT_OVERFLOW_STRING;
     }
 
-    const nsCSSValue *textOverflowRightValue = &textOverflowValue.mYValue;
+    const nsCSSValue *textOverflowRightValue = &textOverflowValuePair.mYValue;
     if (eCSSUnit_Enumerated == textOverflowRightValue->GetUnit()) {
       SetDiscrete(*textOverflowRightValue, text->mTextOverflow.mRight.mType,
                   canStoreInRuleTree,
                   SETDSC_ENUMERATED, parentText->mTextOverflow.mRight.mType,
                   NS_STYLE_TEXT_OVERFLOW_CLIP, 0, 0, 0, 0);
       text->mTextOverflow.mRight.mString.Truncate();
     } else if (eCSSUnit_String == textOverflowRightValue->GetUnit()) {
       textOverflowRightValue->GetStringValue(text->mTextOverflow.mRight.mString);
--- a/layout/svg/nsSVGFilterFrame.cpp
+++ b/layout/svg/nsSVGFilterFrame.cpp
@@ -8,23 +8,25 @@
 
 // Keep others in (case-insensitive) order:
 #include "gfxASurface.h"
 #include "gfxUtils.h"
 #include "nsGkAtoms.h"
 #include "nsRenderingContext.h"
 #include "nsSVGEffects.h"
 #include "nsSVGElement.h"
-#include "nsSVGFilterElement.h"
+#include "mozilla/dom/SVGFilterElement.h"
 #include "nsSVGFilterInstance.h"
 #include "nsSVGFilterPaintCallback.h"
 #include "nsSVGIntegrationUtils.h"
 #include "nsSVGUtils.h"
 #include "nsContentUtils.h"
 
+using namespace mozilla::dom;
+
 nsIFrame*
 NS_NewSVGFilterFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsSVGFilterFrame(aContext);
 }
 
 NS_IMPL_FRAMEARENA_HELPERS(nsSVGFilterFrame)
 
@@ -133,22 +135,22 @@ private:
 nsAutoFilterInstance::nsAutoFilterInstance(nsIFrame *aTarget,
                                            nsSVGFilterFrame *aFilterFrame,
                                            nsSVGFilterPaintCallback *aPaint,
                                            const nsRect *aPostFilterDirtyRect,
                                            const nsRect *aPreFilterDirtyRect,
                                            const nsRect *aPreFilterVisualOverflowRectOverride,
                                            const gfxRect *aOverrideBBox)
 {
-  const nsSVGFilterElement *filter = aFilterFrame->GetFilterContent();
+  const SVGFilterElement *filter = aFilterFrame->GetFilterContent();
 
   uint16_t filterUnits =
-    aFilterFrame->GetEnumValue(nsSVGFilterElement::FILTERUNITS);
+    aFilterFrame->GetEnumValue(SVGFilterElement::FILTERUNITS);
   uint16_t primitiveUnits =
-    aFilterFrame->GetEnumValue(nsSVGFilterElement::PRIMITIVEUNITS);
+    aFilterFrame->GetEnumValue(SVGFilterElement::PRIMITIVEUNITS);
 
   gfxRect bbox = aOverrideBBox ? *aOverrideBBox : nsSVGUtils::GetBBox(aTarget);
 
   // Get the filter region (in the filtered element's user space):
 
   // XXX if filterUnits is set (or has defaulted) to objectBoundingBox, we
   // should send a warning to the error console if the author has used lengths
   // with units. This is a common mistake and can result in filterRes being
@@ -158,20 +160,20 @@ nsAutoFilterInstance::nsAutoFilterInstan
   // deprecate that, since it's too confusing for a bare number to be sometimes
   // interpreted as a fraction of the bounding box and sometimes as user-space
   // units). So really only percentage values should be used in this case.
   
   nsSVGLength2 XYWH[4];
   NS_ABORT_IF_FALSE(sizeof(filter->mLengthAttributes) == sizeof(XYWH),
                     "XYWH size incorrect");
   memcpy(XYWH, filter->mLengthAttributes, sizeof(filter->mLengthAttributes));
-  XYWH[0] = *aFilterFrame->GetLengthValue(nsSVGFilterElement::X);
-  XYWH[1] = *aFilterFrame->GetLengthValue(nsSVGFilterElement::Y);
-  XYWH[2] = *aFilterFrame->GetLengthValue(nsSVGFilterElement::WIDTH);
-  XYWH[3] = *aFilterFrame->GetLengthValue(nsSVGFilterElement::HEIGHT);
+  XYWH[0] = *aFilterFrame->GetLengthValue(SVGFilterElement::ATTR_X);
+  XYWH[1] = *aFilterFrame->GetLengthValue(SVGFilterElement::ATTR_Y);
+  XYWH[2] = *aFilterFrame->GetLengthValue(SVGFilterElement::ATTR_WIDTH);
+  XYWH[3] = *aFilterFrame->GetLengthValue(SVGFilterElement::ATTR_HEIGHT);
   // The filter region in user space, in user units:
   gfxRect filterRegion = nsSVGUtils::GetRelativeRect(filterUnits,
     XYWH, bbox, aTarget);
 
   if (filterRegion.Width() <= 0 || filterRegion.Height() <= 0) {
     // 0 disables rendering, < 0 is error. dispatch error console warning
     // or error as appropriate.
     return;
@@ -180,17 +182,17 @@ nsAutoFilterInstance::nsAutoFilterInstan
   // Calculate filterRes (the width and height of the pixel buffer of the
   // temporary offscreen surface that we would/will create to paint into when
   // painting the entire filtered element) and, if necessary, adjust
   // filterRegion out slightly so that it aligns with pixel boundaries of this
   // buffer:
 
   gfxIntSize filterRes;
   const nsSVGIntegerPair* filterResAttrs =
-    aFilterFrame->GetIntegerPairValue(nsSVGFilterElement::FILTERRES);
+    aFilterFrame->GetIntegerPairValue(SVGFilterElement::FILTERRES);
   if (filterResAttrs->IsExplicitlySet()) {
     int32_t filterResX = filterResAttrs->GetAnimValue(nsSVGIntegerPair::eFirst);
     int32_t filterResY = filterResAttrs->GetAnimValue(nsSVGIntegerPair::eSecond);
     if (filterResX <= 0 || filterResY <= 0) {
       // 0 disables rendering, < 0 is error. dispatch error console warning?
       return;
     }
 
@@ -276,95 +278,95 @@ nsAutoFilterInstance::nsAutoFilterInstan
                             preFilterVisualOverflowRect, postFilterDirtyRect,
                             preFilterDirtyRect, primitiveUnits);
 }
 
 uint16_t
 nsSVGFilterFrame::GetEnumValue(uint32_t aIndex, nsIContent *aDefault)
 {
   nsSVGEnum& thisEnum =
-    static_cast<nsSVGFilterElement *>(mContent)->mEnumAttributes[aIndex];
+    static_cast<SVGFilterElement *>(mContent)->mEnumAttributes[aIndex];
 
   if (thisEnum.IsExplicitlySet())
     return thisEnum.GetAnimValue();
 
   AutoFilterReferencer filterRef(this);
 
   nsSVGFilterFrame *next = GetReferencedFilterIfNotInUse();
   return next ? next->GetEnumValue(aIndex, aDefault) :
-    static_cast<nsSVGFilterElement *>(aDefault)->
+    static_cast<SVGFilterElement *>(aDefault)->
       mEnumAttributes[aIndex].GetAnimValue();
 }
 
 const nsSVGIntegerPair *
 nsSVGFilterFrame::GetIntegerPairValue(uint32_t aIndex, nsIContent *aDefault)
 {
   const nsSVGIntegerPair *thisIntegerPair =
-    &static_cast<nsSVGFilterElement *>(mContent)->mIntegerPairAttributes[aIndex];
+    &static_cast<SVGFilterElement *>(mContent)->mIntegerPairAttributes[aIndex];
 
   if (thisIntegerPair->IsExplicitlySet())
     return thisIntegerPair;
 
   AutoFilterReferencer filterRef(this);
 
   nsSVGFilterFrame *next = GetReferencedFilterIfNotInUse();
   return next ? next->GetIntegerPairValue(aIndex, aDefault) :
-    &static_cast<nsSVGFilterElement *>(aDefault)->mIntegerPairAttributes[aIndex];
+    &static_cast<SVGFilterElement *>(aDefault)->mIntegerPairAttributes[aIndex];
 }
 
 const nsSVGLength2 *
 nsSVGFilterFrame::GetLengthValue(uint32_t aIndex, nsIContent *aDefault)
 {
   const nsSVGLength2 *thisLength =
-    &static_cast<nsSVGFilterElement *>(mContent)->mLengthAttributes[aIndex];
+    &static_cast<SVGFilterElement *>(mContent)->mLengthAttributes[aIndex];
 
   if (thisLength->IsExplicitlySet())
     return thisLength;
 
   AutoFilterReferencer filterRef(this);
 
   nsSVGFilterFrame *next = GetReferencedFilterIfNotInUse();
   return next ? next->GetLengthValue(aIndex, aDefault) :
-    &static_cast<nsSVGFilterElement *>(aDefault)->mLengthAttributes[aIndex];
+    &static_cast<SVGFilterElement *>(aDefault)->mLengthAttributes[aIndex];
 }
 
-const nsSVGFilterElement *
+const SVGFilterElement *
 nsSVGFilterFrame::GetFilterContent(nsIContent *aDefault)
 {
   for (nsIContent* child = mContent->GetFirstChild();
        child;
        child = child->GetNextSibling()) {
     nsRefPtr<nsSVGFE> primitive;
     CallQueryInterface(child, (nsSVGFE**)getter_AddRefs(primitive));
     if (primitive) {
-      return static_cast<nsSVGFilterElement *>(mContent);
+      return static_cast<SVGFilterElement *>(mContent);
     }
   }
 
   AutoFilterReferencer filterRef(this);
 
   nsSVGFilterFrame *next = GetReferencedFilterIfNotInUse();
   return next ? next->GetFilterContent(aDefault) :
-    static_cast<nsSVGFilterElement *>(aDefault);
+    static_cast<SVGFilterElement *>(aDefault);
 }
 
 nsSVGFilterFrame *
 nsSVGFilterFrame::GetReferencedFilter()
 {
   if (mNoHRefURI)
     return nullptr;
 
   nsSVGPaintingProperty *property = static_cast<nsSVGPaintingProperty*>
     (Properties().Get(nsSVGEffects::HrefProperty()));
 
   if (!property) {
     // Fetch our Filter element's xlink:href attribute
-    nsSVGFilterElement *filter = static_cast<nsSVGFilterElement *>(mContent);
+    SVGFilterElement *filter = static_cast<SVGFilterElement *>(mContent);
     nsAutoString href;
-    filter->mStringAttributes[nsSVGFilterElement::HREF].GetAnimValue(href, filter);
+    filter->mStringAttributes[SVGFilterElement::HREF].GetAnimValue(href, filter);
     if (href.IsEmpty()) {
       mNoHRefURI = true;
       return nullptr; // no URL
     }
 
     // Convert href to an nsIURI
     nsCOMPtr<nsIURI> targetURI;
     nsCOMPtr<nsIURI> base = mContent->GetBaseURI();
--- a/layout/svg/nsSVGFilterFrame.h
+++ b/layout/svg/nsSVGFilterFrame.h
@@ -14,20 +14,25 @@
 
 class nsIAtom;
 class nsIContent;
 class nsIFrame;
 class nsIPresShell;
 class nsRenderingContext;
 class nsStyleContext;
 class nsSVGFilterPaintCallback;
-class nsSVGFilterElement;
 class nsSVGIntegerPair;
 class nsSVGLength2;
 
+namespace mozilla {
+namespace dom {
+class SVGFilterElement;
+}
+}
+
 typedef nsSVGContainerFrame nsSVGFilterFrameBase;
 
 class nsSVGFilterFrame : public nsSVGFilterFrameBase
 {
   friend nsIFrame*
   NS_NewSVGFilterFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 protected:
   nsSVGFilterFrame(nsStyleContext* aContext)
@@ -124,18 +129,18 @@ private:
   {
     return GetIntegerPairValue(aIndex, mContent);
   }
   const nsSVGLength2 *GetLengthValue(uint32_t aIndex, nsIContent *aDefault);
   const nsSVGLength2 *GetLengthValue(uint32_t aIndex)
   {
     return GetLengthValue(aIndex, mContent);
   }
-  const nsSVGFilterElement *GetFilterContent(nsIContent *aDefault);
-  const nsSVGFilterElement *GetFilterContent()
+  const mozilla::dom::SVGFilterElement *GetFilterContent(nsIContent *aDefault);
+  const mozilla::dom::SVGFilterElement *GetFilterContent()
   {
     return GetFilterContent(mContent);
   }
 
   // This flag is used to detect loops in xlink:href processing
   bool                              mLoopFlag;
   bool                              mNoHRefURI;
 };
--- a/layout/svg/nsSVGFilterInstance.cpp
+++ b/layout/svg/nsSVGFilterInstance.cpp
@@ -4,33 +4,32 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 // Main header first:
 #include "nsSVGFilterInstance.h"
 
 // Keep others in (case-insensitive) order:
 #include "gfxPlatform.h"
 #include "gfxUtils.h"
-#include "nsIDOMSVGUnitTypes.h"
 #include "nsISVGChildFrame.h"
 #include "nsRenderingContext.h"
-#include "nsSVGFilterElement.h"
+#include "mozilla/dom/SVGFilterElement.h"
 #include "nsSVGFilterPaintCallback.h"
 #include "nsSVGUtils.h"
 #include "SVGContentUtils.h"
 
 float
 nsSVGFilterInstance::GetPrimitiveNumber(uint8_t aCtxType, float aValue) const
 {
   nsSVGLength2 val;
   val.Init(aCtxType, 0xff, aValue,
            nsIDOMSVGLength::SVG_LENGTHTYPE_NUMBER);
 
   float value;
-  if (mPrimitiveUnits == nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
+  if (mPrimitiveUnits == mozilla::dom::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
     value = nsSVGUtils::ObjectSpace(mTargetBBox, &val);
   } else {
     value = nsSVGUtils::UserSpace(mTargetFrame, &val);
   }
 
   switch (aCtxType) {
   case SVGContentUtils::X:
     return value * mFilterSpaceSize.width / mFilterRegion.Width();
--- a/layout/svg/nsSVGFilterInstance.h
+++ b/layout/svg/nsSVGFilterInstance.h
@@ -17,19 +17,24 @@
 #include "nsSVGFilters.h"
 #include "nsSVGNumber2.h"
 #include "nsSVGNumberPair.h"
 #include "nsTArray.h"
 
 class gfxASurface;
 class gfxImageSurface;
 class nsIFrame;
-class nsSVGFilterElement;
 class nsSVGFilterPaintCallback;
 
+namespace mozilla {
+namespace dom {
+class SVGFilterElement;
+}
+}
+
 /**
  * This class performs all filter processing.
  * 
  * We build a graph of the filter image data flow, essentially
  * converting the filter graph to SSA. This lets us easily propagate
  * analysis data (such as bounding-boxes) over the filter primitive graph.
  *
  * Definition of "filter space": filter space is a coordinate system that is
@@ -68,17 +73,17 @@ public:
    *   call ComputeSourceNeededRect() or Render().
    * @param aPreFilterDirtyRect [optional] The bounds of the pre-filter area of
    *   the filtered element that changed, in filter space. Only required if you
    *   will call ComputePostFilterDirtyRect().
    * @param aPrimitiveUnits The value from the 'primitiveUnits' attribute.
    */
   nsSVGFilterInstance(nsIFrame *aTargetFrame,
                       nsSVGFilterPaintCallback *aPaintCallback,
-                      const nsSVGFilterElement *aFilterElement,
+                      const mozilla::dom::SVGFilterElement *aFilterElement,
                       const gfxRect &aTargetBBox,
                       const gfxRect& aFilterRegion,
                       const nsIntSize& aFilterSpaceSize,
                       const gfxMatrix &aFilterSpaceToDeviceSpaceTransform,
                       const gfxMatrix &aFilterSpaceToFrameSpaceInCSSPxTransform,
                       const nsIntRect& aTargetBounds,
                       const nsIntRect& aPostFilterDirtyRect,
                       const nsIntRect& aPreFilterDirtyRect,
@@ -381,17 +386,17 @@ private:
   }
 
   /**
    * The frame for the element that is currently being filtered.
    */
   nsIFrame*               mTargetFrame;
 
   nsSVGFilterPaintCallback* mPaintCallback;
-  const nsSVGFilterElement* mFilterElement;
+  const mozilla::dom::SVGFilterElement* mFilterElement;
 
   /**
    * The SVG bbox of the element that is being filtered, in user space.
    */
   gfxRect                 mTargetBBox;
 
   gfxMatrix               mFilterSpaceToDeviceSpaceTransform;
   gfxMatrix               mFilterSpaceToFrameSpaceInCSSPxTransform;
--- a/layout/svg/nsSVGGradientFrame.cpp
+++ b/layout/svg/nsSVGGradientFrame.cpp
@@ -176,27 +176,27 @@ nsSVGGradientFrame::GetGradientTransform
 
 gfxMatrix
 nsSVGGradientFrame::GetGradientTransform(nsIFrame *aSource,
                                          const gfxRect *aOverrideBounds)
 {
   gfxMatrix bboxMatrix;
 
   uint16_t gradientUnits = GetGradientUnits();
-  if (gradientUnits == nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE) {
+  if (gradientUnits == SVG_UNIT_TYPE_USERSPACEONUSE) {
     // If this gradient is applied to text, our caller
     // will be the glyph, which is not a container, so we
     // need to get the parent
     if (aSource->GetContent()->IsNodeOfType(nsINode::eTEXT))
       mSource = aSource->GetParent();
     else
       mSource = aSource;
   } else {
     NS_ASSERTION(
-      gradientUnits == nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX,
+      gradientUnits == SVG_UNIT_TYPE_OBJECTBOUNDINGBOX,
       "Unknown gradientUnits type");
     // objectBoundingBox is the default anyway
 
     gfxRect bbox =
       aOverrideBounds ? *aOverrideBounds : nsSVGUtils::GetBBox(aSource);
     bboxMatrix =
       gfxMatrix(bbox.Width(), 0, 0, bbox.Height(), bbox.X(), bbox.Y());
   }
@@ -469,22 +469,22 @@ nsSVGLinearGradientFrame::GetLengthValue
     "Got unexpected null element from GetLinearGradientWithLength");
   const nsSVGLength2 &length = lengthElement->mLengthAttributes[aIndex];
 
   // Object bounding box units are handled by setting the appropriate
   // transform in GetGradientTransform, but we need to handle user
   // space units as part of the individual Get* routines.  Fixes 323669.
 
   uint16_t gradientUnits = GetGradientUnits();
-  if (gradientUnits == nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE) {
+  if (gradientUnits == SVG_UNIT_TYPE_USERSPACEONUSE) {
     return nsSVGUtils::UserSpace(mSource, &length);
   }
 
   NS_ASSERTION(
-    gradientUnits == nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX,
+    gradientUnits == SVG_UNIT_TYPE_OBJECTBOUNDINGBOX,
     "Unknown gradientUnits type");
 
   return length.GetAnimValue(static_cast<SVGSVGElement*>(nullptr));
 }
 
 dom::SVGLinearGradientElement*
 nsSVGLinearGradientFrame::GetLinearGradientWithLength(uint32_t aIndex,
   dom::SVGLinearGradientElement* aDefault)
@@ -600,22 +600,22 @@ nsSVGRadialGradientFrame::GetLengthValue
 {
   const nsSVGLength2 &length = aElement.mLengthAttributes[aIndex];
 
   // Object bounding box units are handled by setting the appropriate
   // transform in GetGradientTransform, but we need to handle user
   // space units as part of the individual Get* routines.  Fixes 323669.
 
   uint16_t gradientUnits = GetGradientUnits();
-  if (gradientUnits == nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE) {
+  if (gradientUnits == SVG_UNIT_TYPE_USERSPACEONUSE) {
     return nsSVGUtils::UserSpace(mSource, &length);
   }
 
   NS_ASSERTION(
-    gradientUnits == nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX,
+    gradientUnits == SVG_UNIT_TYPE_OBJECTBOUNDINGBOX,
     "Unknown gradientUnits type");
 
   return length.GetAnimValue(static_cast<SVGSVGElement*>(nullptr));
 }
 
 dom::SVGRadialGradientElement*
 nsSVGRadialGradientFrame::GetRadialGradientWithLength(uint32_t aIndex,
   dom::SVGRadialGradientElement* aDefault)
--- a/layout/svg/nsSVGMaskFrame.cpp
+++ b/layout/svg/nsSVGMaskFrame.cpp
@@ -41,17 +41,17 @@ nsSVGMaskFrame::ComputeMaskAlpha(nsRende
   }
   AutoMaskReferencer maskRef(this);
 
   SVGMaskElement *mask = static_cast<SVGMaskElement*>(mContent);
 
   uint16_t units =
     mask->mEnumAttributes[SVGMaskElement::MASKUNITS].GetAnimValue();
   gfxRect bbox;
-  if (units == nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
+  if (units == SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
     bbox = nsSVGUtils::GetBBox(aParent);
   }
 
   gfxRect maskArea = nsSVGUtils::GetRelativeRect(units,
     &mask->mLengthAttributes[SVGMaskElement::ATTR_X], bbox, aParent);
 
   gfxContext *gfx = aContext->ThebesContext();
 
--- a/layout/svg/nsSVGPatternFrame.cpp
+++ b/layout/svg/nsSVGPatternFrame.cpp
@@ -150,35 +150,35 @@ nsSVGPatternFrame::GetCanvasTM(uint32_t 
 // attribute ‘viewBox’ is specified". We still need to include a bbox scale
 // if the viewBox is specified and _patternUnits_ is set to or defaults to
 // objectBoundingBox though, since in that case the viewBox is relative to the bbox
 static bool
 IncludeBBoxScale(const nsSVGViewBox& aViewBox,
                  uint32_t aPatternContentUnits, uint32_t aPatternUnits)
 {
   return (!aViewBox.IsExplicitlySet() &&
-          aPatternContentUnits == nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) ||
+          aPatternContentUnits == SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) ||
          (aViewBox.IsExplicitlySet() &&
-          aPatternUnits == nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX);
+          aPatternUnits == SVG_UNIT_TYPE_OBJECTBOUNDINGBOX);
 }
 
 // Given the matrix for the pattern element's own transform, this returns a
 // combined matrix including the transforms applicable to its target.
 static gfxMatrix
 GetPatternMatrix(uint16_t aPatternUnits,
                  const gfxMatrix &patternTransform,
                  const gfxRect &bbox,
                  const gfxRect &callerBBox,
                  const gfxMatrix &callerCTM)
 {
   // We really want the pattern matrix to handle translations
   gfxFloat minx = bbox.X();
   gfxFloat miny = bbox.Y();
 
-  if (aPatternUnits == nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
+  if (aPatternUnits == SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
     minx += callerBBox.X();
     miny += callerBBox.Y();
   }
 
   float scale = 1.0f / nsSVGUtils::MaxExpansion(callerCTM);
   gfxMatrix patternMatrix = patternTransform;
   patternMatrix.Scale(scale, scale);
   patternMatrix.Translate(gfxPoint(minx, miny));
@@ -588,17 +588,17 @@ nsSVGPatternFrame::GetPatternRect(uint16
 
   // Get the pattern x,y,width, and height
   const nsSVGLength2 *tmpX, *tmpY, *tmpHeight, *tmpWidth;
   tmpX = GetLengthValue(SVGPatternElement::ATTR_X);
   tmpY = GetLengthValue(SVGPatternElement::ATTR_Y);
   tmpHeight = GetLengthValue(SVGPatternElement::ATTR_HEIGHT);
   tmpWidth = GetLengthValue(SVGPatternElement::ATTR_WIDTH);
 
-  if (aPatternUnits == nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
+  if (aPatternUnits == SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
     x = nsSVGUtils::ObjectSpace(aTargetBBox, tmpX);
     y = nsSVGUtils::ObjectSpace(aTargetBBox, tmpY);
     width = nsSVGUtils::ObjectSpace(aTargetBBox, tmpWidth);
     height = nsSVGUtils::ObjectSpace(aTargetBBox, tmpHeight);
   } else {
     float scale = nsSVGUtils::MaxExpansion(aTargetCTM);
     x = nsSVGUtils::UserSpace(aTarget, tmpX) * scale;
     y = nsSVGUtils::UserSpace(aTarget, tmpY) * scale;
--- a/layout/svg/nsSVGUtils.cpp
+++ b/layout/svg/nsSVGUtils.cpp
@@ -18,17 +18,16 @@
 #include "mozilla/gfx/2D.h"
 #include "mozilla/Preferences.h"
 #include "nsCSSFrameConstructor.h"
 #include "nsDisplayList.h"
 #include "nsFrameList.h"
 #include "nsGkAtoms.h"
 #include "nsIContent.h"
 #include "nsIDocument.h"
-#include "nsIDOMSVGUnitTypes.h"
 #include "nsIFrame.h"
 #include "nsINameSpaceManager.h"
 #include "nsIPresShell.h"
 #include "nsISVGChildFrame.h"
 #include "nsPresContext.h"
 #include "nsRenderingContext.h"
 #include "nsStyleCoord.h"
 #include "nsStyleStruct.h"
@@ -1255,17 +1254,17 @@ nsSVGUtils::GetBBox(nsIFrame *aFrame, ui
   return nsSVGIntegrationUtils::GetSVGBBoxForNonSVGFrame(aFrame);
 }
 
 gfxRect
 nsSVGUtils::GetRelativeRect(uint16_t aUnits, const nsSVGLength2 *aXYWH,
                             const gfxRect &aBBox, nsIFrame *aFrame)
 {
   float x, y, width, height;
-  if (aUnits == nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
+  if (aUnits == SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
     x = aBBox.X() + ObjectSpace(aBBox, &aXYWH[0]);
     y = aBBox.Y() + ObjectSpace(aBBox, &aXYWH[1]);
     width = ObjectSpace(aBBox, &aXYWH[2]);
     height = ObjectSpace(aBBox, &aXYWH[3]);
   } else {
     x = UserSpace(aFrame, &aXYWH[0]);
     y = UserSpace(aFrame, &aXYWH[1]);
     width = UserSpace(aFrame, &aXYWH[2]);
@@ -1321,18 +1320,17 @@ nsSVGUtils::MaxExpansion(const gfxMatrix
 }
 
 gfxMatrix
 nsSVGUtils::AdjustMatrixForUnits(const gfxMatrix &aMatrix,
                                  nsSVGEnum *aUnits,
                                  nsIFrame *aFrame)
 {
   if (aFrame &&
-      aUnits->GetAnimValue() ==
-      nsIDOMSVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
+      aUnits->GetAnimValue() == SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
     gfxRect bbox = GetBBox(aFrame);
     return gfxMatrix().Scale(bbox.Width(), bbox.Height()) *
            gfxMatrix().Translate(gfxPoint(bbox.X(), bbox.Y())) *
            aMatrix;
   }
   return aMatrix;
 }
 
--- a/media/libcubeb/README_MOZILLA
+++ b/media/libcubeb/README_MOZILLA
@@ -1,8 +1,8 @@
 The source from this directory was copied from the cubeb 
 git repository using the update.sh script.  The only changes
 made were those applied by update.sh and the addition of
 Makefile.in build files for the Mozilla build system.
 
 The cubeb git repository is: git://github.com/kinetiknz/cubeb.git
 
-The git commit ID used was e945dbd052793a7faba3e9064d03bd6781b02692.
+The git commit ID used was 49f2565ff54192821b9b717988399a875d3b1c61.
--- a/media/libcubeb/src/cubeb_winmm.c
+++ b/media/libcubeb/src/cubeb_winmm.c
@@ -326,18 +326,26 @@ cubeb_stream_init(cubeb * context, cubeb
 
   if (stream_params.rate < 1 || stream_params.rate > 192000 ||
       stream_params.channels < 1 || stream_params.channels > 32 ||
       latency < 1 || latency > 2000) {
     return CUBEB_ERROR_INVALID_FORMAT;
   }
 
   memset(&wfx, 0, sizeof(wfx));
-  wfx.Format.wFormatTag = WAVE_FORMAT_EXTENSIBLE;
-  wfx.Format.cbSize = sizeof(wfx) - sizeof(wfx.Format);
+  if (stream_params.channels > 2) {
+    wfx.Format.wFormatTag = WAVE_FORMAT_EXTENSIBLE;
+    wfx.Format.cbSize = sizeof(wfx) - sizeof(wfx.Format);
+  } else {
+    wfx.Format.wFormatTag = WAVE_FORMAT_PCM;
+    if (stream_params.format == CUBEB_SAMPLE_FLOAT32LE) {
+      wfx.Format.wFormatTag = WAVE_FORMAT_IEEE_FLOAT;
+    }
+    wfx.Format.cbSize = 0;
+  }
   wfx.Format.nChannels = stream_params.channels;
   wfx.Format.nSamplesPerSec = stream_params.rate;
 
   /* XXX fix channel mappings */
   wfx.dwChannelMask = SPEAKER_FRONT_LEFT | SPEAKER_FRONT_RIGHT;
 
   switch (stream_params.format) {
   case CUBEB_SAMPLE_S16LE:
--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
@@ -38,17 +38,17 @@
 #ifdef MOZILLA_INTERNAL_API
 #include "nsContentUtils.h"
 #include "nsDOMJSUtils.h"
 #include "nsIScriptError.h"
 #include "nsPrintfCString.h"
 #include "nsURLHelper.h"
 #include "nsNetUtil.h"
 #include "mozilla/dom/BindingUtils.h"
-#include "mozilla/dom/RTCIceServerBinding.h"
+#include "mozilla/dom/RTCConfigurationBinding.h"
 #include "MediaStreamList.h"
 #include "nsIScriptGlobalObject.h"
 #include "jsapi.h"
 #endif
 
 #ifndef USE_FAKE_MEDIA_STREAMS
 #include "MediaSegment.h"
 #endif
@@ -342,53 +342,40 @@ Warn(JSContext* aCx, const nsCString& aM
 
 /**
  * In JS, an RTCConfiguration looks like this:
  *
  * { "iceServers": [ { url:"stun:23.21.150.121" },
  *                   { url:"turn:user@turn.example.org", credential:"mypass"} ] }
  *
  * This function converts an already-validated jsval that looks like the above
- * into an RTCConfiguration object.
+ * into an IceConfiguration object.
  */
 nsresult
 PeerConnectionImpl::ConvertRTCConfiguration(const JS::Value& aSrc,
-                                            RTCConfiguration *aDst,
+                                            IceConfiguration *aDst,
                                             JSContext* aCx)
 {
 #ifdef MOZILLA_INTERNAL_API
   if (!aSrc.isObject()) {
     return NS_ERROR_FAILURE;
   }
-  JSObject& config = aSrc.toObject();
-  JSAutoCompartment ac(aCx, &config);
-  JS::Value jsServers;
-  if (!(JS_GetProperty(aCx, &config, "iceServers", &jsServers) && jsServers.isObject())) {
-    return NS_ERROR_FAILURE;
-  }
-  JSObject& servers = jsServers.toObject();
-  uint32_t len;
-  if (!(IsArrayLike(aCx, &servers) && JS_GetArrayLength(aCx, &servers, &len))) {
+  JSAutoCompartment ac(aCx, &aSrc.toObject());
+  RTCConfiguration config;
+  if (!(config.Init(aCx, nullptr, aSrc) && config.mIceServers.WasPassed())) {
     return NS_ERROR_FAILURE;
   }
-  for (uint32_t i = 0; i < len; i++) {
-    nsresult rv;
-    // XXXbz once this moves to WebIDL, remove the RTCIceServer hack
-    // in DummyBinding.webidl.
-    RTCIceServer server;
-    {
-      JS::Value v;
-      if (!(JS_GetElement(aCx, &servers, i, &v) && server.Init(aCx, nullptr, v))) {
-        return NS_ERROR_FAILURE;
-      }
-    }
+  for (uint32_t i = 0; i < config.mIceServers.Value().Length(); i++) {
+    // XXXbz once this moves to WebIDL, remove RTCConfiguration in DummyBinding.webidl.
+    RTCIceServer& server = config.mIceServers.Value()[i];
     if (!server.mUrl.WasPassed()) {
       return NS_ERROR_FAILURE;
     }
     nsRefPtr<nsIURI> url;
+    nsresult rv;
     rv = NS_NewURI(getter_AddRefs(url), server.mUrl.Value());
     NS_ENSURE_SUCCESS(rv, rv);
     bool isStun = false, isStuns = false, isTurn = false, isTurns = false;
     url->SchemeIs("stun", &isStun);
     url->SchemeIs("stuns", &isStuns);
     url->SchemeIs("turn", &isTurn);
     url->SchemeIs("turns", &isTurns);
     if (!(isStun || isStuns || isTurn || isTurns)) {
@@ -445,17 +432,17 @@ PeerConnectionImpl::Initialize(IPeerConn
                                JSContext* aCx)
 {
   return Initialize(aObserver, aWindow, nullptr, &aRTCConfiguration, aThread, aCx);
 }
 
 nsresult
 PeerConnectionImpl::Initialize(IPeerConnectionObserver* aObserver,
                                nsIDOMWindow* aWindow,
-                               const RTCConfiguration* aConfiguration,
+                               const IceConfiguration* aConfiguration,
                                const JS::Value* aRTCConfiguration,
                                nsIThread* aThread,
                                JSContext* aCx)
 {
   nsresult res;
 
 #ifdef MOZILLA_INTERNAL_API
   MOZ_ASSERT(NS_IsMainThread());
@@ -495,17 +482,17 @@ PeerConnectionImpl::Initialize(IPeerConn
   }
 
   // Connect ICE slots.
   mMedia->SignalIceGatheringCompleted.connect(this, &PeerConnectionImpl::IceGatheringCompleted);
   mMedia->SignalIceCompleted.connect(this, &PeerConnectionImpl::IceCompleted);
 
   // Initialize the media object.
   if (aRTCConfiguration) {
-    RTCConfiguration ic;
+    IceConfiguration ic;
     res = ConvertRTCConfiguration(*aRTCConfiguration, &ic, aCx);
     NS_ENSURE_SUCCESS(res, res);
     res = mMedia->Init(ic.getServers());
   } else {
     res = mMedia->Init(aConfiguration->getServers());
   }
   if (NS_FAILED(res)) {
     CSFLogError(logTag, "%s: Couldn't initialize media object", __FUNCTION__);
@@ -769,18 +756,18 @@ PeerConnectionImpl::NotifyDataChannel(al
                 NS_DISPATCH_NORMAL);
 #endif
 }
 
 /**
  * Constraints look like this:
  *
  * {
- *    "mandatory": {"foo":"hello", "bar": false, "baz": 10},
- *    "optional": [{"hello":"foo"}, {"baz": false}]
+ *   mandatory: {"OfferToReceiveAudio": true, "OfferToReceiveVideo": true },
+ *   optional: [{"VoiceActivityDetection": true}, {"FooBar": 10}]
  * }
  *
  * Optional constraints are ordered, and hence in an array. This function
  * converts a jsval that looks like the above into a MediaConstraints object.
  */
 nsresult
 PeerConnectionImpl::ConvertConstraints(
   const JS::Value& aConstraints, MediaConstraints* aObj, JSContext* aCx)
@@ -792,26 +779,26 @@ PeerConnectionImpl::ConvertConstraints(
   if (!JS_GetProperty(aCx, &constraints, "mandatory", &mandatory)) {
     return NS_ERROR_FAILURE;
   }
   if (!mandatory.isNullOrUndefined()) {
     if (!mandatory.isObject()) {
       return NS_ERROR_FAILURE;
     }
 
-    JSObject* opts = JSVAL_TO_OBJECT(mandatory);
+    JSObject* opts = &mandatory.toObject();
     JS::AutoIdArray mandatoryOpts(aCx, JS_Enumerate(aCx, opts));
 
     // Iterate over each property.
     for (size_t i = 0; i < mandatoryOpts.length(); i++) {
       JS::Value option, optionName;
       if (!JS_GetPropertyById(aCx, opts, mandatoryOpts[i], &option) ||
           !JS_IdToValue(aCx, mandatoryOpts[i], &optionName) ||
           // We only support boolean constraints for now.
-          !JSVAL_IS_BOOLEAN(option)) {
+          !option.isBoolean()) {
         return NS_ERROR_FAILURE;
       }
       JSString* optionNameString = JS_ValueToString(aCx, optionName);
       if (!optionNameString) {
         return NS_ERROR_OUT_OF_MEMORY;
       }
       NS_ConvertUTF16toUTF8 stringVal(JS_GetStringCharsZ(aCx, optionNameString));
       aObj->setBooleanConstraint(stringVal.get(), JSVAL_TO_BOOLEAN(option), true);
@@ -822,33 +809,49 @@ PeerConnectionImpl::ConvertConstraints(
   if (!JS_GetProperty(aCx, &constraints, "optional", &optional)) {
     return NS_ERROR_FAILURE;
   }
   if (!optional.isNullOrUndefined()) {
     if (!optional.isObject()) {
       return NS_ERROR_FAILURE;
     }
 
-    JSObject* opts = JSVAL_TO_OBJECT(optional);
+    JSObject* array = &optional.toObject();
     uint32_t length;
-    if (!JS_IsArrayObject(aCx, opts) ||
-        !JS_GetArrayLength(aCx, opts, &length)) {
+    if (!JS_GetArrayLength(aCx, array, &length)) {
       return NS_ERROR_FAILURE;
     }
     for (uint32_t i = 0; i < length; i++) {
-      JS::Value val;
-      if (!JS_GetElement(aCx, opts, i, &val) ||
-          !val.isObject()) {
+      JS::Value element;
+      if (!JS_GetElement(aCx, array, i, &element) ||
+          !element.isObject()) {
+        return NS_ERROR_FAILURE;
+      }
+      JSObject* opts = &element.toObject();
+      JS::AutoIdArray optionalOpts(aCx, JS_Enumerate(aCx, opts));
+      // Expect one property per entry.
+      if (optionalOpts.length() != 1) {
         return NS_ERROR_FAILURE;
       }
-      // Extract name & value and store.
-      // FIXME: MediaConstraints does not support optional constraints?
+      JS::Value option, optionName;
+      if (!JS_GetPropertyById(aCx, opts, optionalOpts[0], &option) ||
+          !JS_IdToValue(aCx, optionalOpts[0], &optionName)) {
+        return NS_ERROR_FAILURE;
+      }
+      // Ignore constraints other than boolean, as that's all we support.
+      if (option.isBoolean()) {
+        JSString* optionNameString = JS_ValueToString(aCx, optionName);
+        if (!optionNameString) {
+          return NS_ERROR_OUT_OF_MEMORY;
+        }
+        NS_ConvertUTF16toUTF8 stringVal(JS_GetStringCharsZ(aCx, optionNameString));
+        aObj->setBooleanConstraint(stringVal.get(), JSVAL_TO_BOOLEAN(option), false);
+      }
     }
   }
-
   return NS_OK;
 }
 
 NS_IMETHODIMP
 PeerConnectionImpl::CreateOffer(const JS::Value& aConstraints, JSContext* aCx)
 {
   PC_AUTO_ENTER_API_CALL(true);
 
--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.h
+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.h
@@ -60,17 +60,17 @@ public:
   void setBooleanConstraint(const std::string& constraint, bool enabled, bool mandatory);
 
   void buildArray(cc_media_constraints_t** constraintarray);
 
 private:
   constraints_map  mConstraints;
 };
 
-class RTCConfiguration
+class IceConfiguration
 {
 public:
   bool addServer(const std::string& addr, uint16_t port)
   {
     NrIceStunServer* server(NrIceStunServer::Create(addr, port));
     if (!server) {
       return false;
     }
@@ -136,17 +136,17 @@ public:
     kRoleAnswerer
   };
 
   NS_DECL_ISUPPORTS
   NS_DECL_IPEERCONNECTION
 
   static PeerConnectionImpl* CreatePeerConnection();
   static nsresult ConvertRTCConfiguration(const JS::Value& aSrc,
-    RTCConfiguration *aDst, JSContext* aCx);
+    IceConfiguration *aDst, JSContext* aCx);
   static nsresult ConvertConstraints(
     const JS::Value& aConstraints, MediaConstraints* aObj, JSContext* aCx);
   static nsresult MakeMediaStream(nsIDOMWindow* aWindow,
                                   uint32_t aHint, nsIDOMMediaStream** aStream);
 
   Role GetRole() const {
     PC_AUTO_ENTER_API_CALL_NO_CHECK();
     return mRole;
@@ -204,35 +204,35 @@ public:
   // Create a fake media stream
   nsresult CreateFakeMediaStream(uint32_t hint, nsIDOMMediaStream** retval);
 
   nsPIDOMWindow* GetWindow() const {
     PC_AUTO_ENTER_API_CALL_NO_CHECK();
     return mWindow;
   }
 
-  // Initialize PeerConnection from an RTCConfiguration object.
+  // Initialize PeerConnection from an IceConfiguration object.
   nsresult Initialize(IPeerConnectionObserver* aObserver,
                       nsIDOMWindow* aWindow,
-                      const RTCConfiguration& aConfiguration,
+                      const IceConfiguration& aConfiguration,
                       nsIThread* aThread) {
     return Initialize(aObserver, aWindow, &aConfiguration, nullptr, aThread, nullptr);
   }
 
   // Validate constraints and construct a MediaConstraints object
   // from a JS::Value.
   NS_IMETHODIMP CreateOffer(MediaConstraints& aConstraints);
   NS_IMETHODIMP CreateAnswer(MediaConstraints& aConstraints);
 
 private:
   PeerConnectionImpl(const PeerConnectionImpl&rhs);
   PeerConnectionImpl& operator=(PeerConnectionImpl);
   nsresult Initialize(IPeerConnectionObserver* aObserver,
                       nsIDOMWindow* aWindow,
-                      const RTCConfiguration* aConfiguration,
+                      const IceConfiguration* aConfiguration,
                       const JS::Value* aRTCConfiguration,
                       nsIThread* aThread,
                       JSContext* aCx);
   NS_IMETHODIMP CreateOfferInt(MediaConstraints& constraints);
   NS_IMETHODIMP CreateAnswerInt(MediaConstraints& constraints);
 
   nsresult CloseInt(bool aIsSynchronous);
   void ChangeReadyState(ReadyState aReadyState);
--- a/media/webrtc/signaling/test/signaling_unittests.cpp
+++ b/media/webrtc/signaling/test/signaling_unittests.cpp
@@ -529,17 +529,17 @@ class SignalingAgent {
   void Init_m(nsCOMPtr<nsIThread> thread)
   {
     pc = sipcc::PeerConnectionImpl::CreatePeerConnection();
     ASSERT_TRUE(pc);
 
     pObserver = new TestObserver(pc);
     ASSERT_TRUE(pObserver);
 
-    sipcc::RTCConfiguration cfg;
+    sipcc::IceConfiguration cfg;
     cfg.addServer("23.21.150.121", 3478);
     ASSERT_EQ(pc->Initialize(pObserver, nullptr, cfg, thread), NS_OK);
 
   }
 
   void Init(nsCOMPtr<nsIThread> thread)
   {
     thread->Dispatch(
@@ -557,17 +557,17 @@ class SignalingAgent {
     pc = sipcc::PeerConnectionImpl::CreatePeerConnection();
     if (!pc)
       return false;
 
     pObserver = new TestObserver(pc);
     if (!pObserver)
       return false;
 
-    sipcc::RTCConfiguration cfg;
+    sipcc::IceConfiguration cfg;
     cfg.addServer("23.21.150.121", 3478);
     if (NS_FAILED(pc->Initialize(pObserver, nullptr, cfg, thread)))
       return false;
 
     return true;
   }
 
   bool InitAllowFail(nsCOMPtr<nsIThread> thread)
--- a/mfbt/RangedPtr.h
+++ b/mfbt/RangedPtr.h
@@ -49,22 +49,22 @@ class RangedPtr
     typedef void (RangedPtr::* ConvertibleToBool)();
     void nonNull() {}
 
     void checkSanity() {
       MOZ_ASSERT(rangeStart <= ptr);
       MOZ_ASSERT(ptr <= rangeEnd);
     }
 
-    /* Creates a new pointer for |ptr|, restricted to this pointer's range. */
-    RangedPtr<T> create(T *ptr) const {
+    /* Creates a new pointer for |p|, restricted to this pointer's range. */
+    RangedPtr<T> create(T *p) const {
 #ifdef DEBUG
-      return RangedPtr<T>(ptr, rangeStart, rangeEnd);
+      return RangedPtr<T>(p, rangeStart, rangeEnd);
 #else
-      return RangedPtr<T>(ptr, NULL, size_t(0));
+      return RangedPtr<T>(p, NULL, size_t(0));
 #endif
     }
 
     uintptr_t asUintptr() const { return uintptr_t(ptr); }
 
   public:
     RangedPtr(T* p, T* start, T* end)
       : ptr(p)
--- a/mfbt/Scoped.h
+++ b/mfbt/Scoped.h
@@ -75,19 +75,19 @@ class Scoped
   public:
     typedef typename Traits::type Resource;
 
     explicit Scoped(MOZ_GUARD_OBJECT_NOTIFIER_ONLY_PARAM)
       : value(Traits::empty())
     {
       MOZ_GUARD_OBJECT_NOTIFIER_INIT;
     }
-    explicit Scoped(const Resource& value
+    explicit Scoped(const Resource& v
                     MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
-      : value(value)
+      : value(v)
     {
       MOZ_GUARD_OBJECT_NOTIFIER_INIT;
     }
     ~Scoped() {
       Traits::release(value);
     }
 
     // Constant getter
--- a/mfbt/WeakPtr.h
+++ b/mfbt/WeakPtr.h
@@ -86,17 +86,17 @@ class SupportsWeakPtr
 
   private:
     friend class WeakPtr<T>;
 
     // This can live beyond the lifetime of the class derived from SupportsWeakPtr.
     class WeakReference : public RefCounted<WeakReference>
     {
       public:
-        explicit WeakReference(T* ptr) : ptr(ptr) {}
+        explicit WeakReference(T* p) : ptr(p) {}
         T* get() const {
           return ptr;
         }
 
       private:
         friend class WeakPtr<T>;
         friend class SupportsWeakPtr<T>;
         void detach() {
--- a/tools/profiler/sps_sampler.h
+++ b/tools/profiler/sps_sampler.h
@@ -252,28 +252,28 @@ private:
 class StackEntry : public js::ProfileEntry
 {
 public:
 
   bool isCopyLabel() volatile {
     return !((uintptr_t)stackAddress() & 0x1);
   }
 
-  void setStackAddressCopy(void *sp, bool copy) volatile {
+  void setStackAddressCopy(void *sparg, bool copy) volatile {
     // Tagged pointer. Less significant bit used to track if mLabel needs a
     // copy. Note that we don't need the last bit of the stack address for
     // proper ordering. This is optimized for encoding within the JS engine's
     // instrumentation, so we do the extra work here of encoding a bit.
     // Last bit 1 = Don't copy, Last bit 0 = Copy.
     if (copy) {
       setStackAddress(reinterpret_cast<void*>(
-                        reinterpret_cast<uintptr_t>(sp) & ~0x1));
+                        reinterpret_cast<uintptr_t>(sparg) & ~0x1));
     } else {
       setStackAddress(reinterpret_cast<void*>(
-                        reinterpret_cast<uintptr_t>(sp) | 0x1));
+                        reinterpret_cast<uintptr_t>(sparg) | 0x1));
     }
   }
 };
 
 // the SamplerStack members are read by signal
 // handlers, so the mutation of them needs to be signal-safe.
 struct ProfileStack
 {
--- a/widget/android/GfxInfo.cpp
+++ b/widget/android/GfxInfo.cpp
@@ -350,17 +350,58 @@ GfxInfo::GetFeatureStatusImpl(int32_t aF
         *aStatus = nsIGfxInfo::FEATURE_BLOCKED_DEVICE;
         return NS_OK;
       }
     }
 
     if (aFeature == FEATURE_STAGEFRIGHT) {
       NS_LossyConvertUTF16toASCII cManufacturer(mManufacturer);
       NS_LossyConvertUTF16toASCII cModel(mModel);
-      if (CompareVersions(mOSVersion.get(), "4.0.0") < 0)
+      if (CompareVersions(mOSVersion.get(), "2.2.0") >= 0 &&
+          CompareVersions(mOSVersion.get(), "2.3.0") < 0)
+      {
+        // Froyo LG devices are whitelisted.
+        // All other Froyo
+        bool isWhitelisted =
+          cManufacturer.Equals("lge", nsCaseInsensitiveCStringComparator());
+
+        if (!isWhitelisted) {
+          *aStatus = nsIGfxInfo::FEATURE_BLOCKED_DEVICE;
+          return NS_OK;
+        }
+      }
+      else if (CompareVersions(mOSVersion.get(), "2.3.0") >= 0 &&
+          CompareVersions(mOSVersion.get(), "2.4.0") < 0)
+      {
+        // Gingerbread HTC devices are whitelisted.
+        // Gingerbread Samsung devices are whitelisted.
+        // All other Gingerbread devices are blacklisted.
+	bool isWhitelisted =
+          cManufacturer.Equals("htc", nsCaseInsensitiveCStringComparator()) ||
+          cManufacturer.Equals("samsung", nsCaseInsensitiveCStringComparator());
+
+        if (!isWhitelisted) {
+          *aStatus = nsIGfxInfo::FEATURE_BLOCKED_DEVICE;
+          return NS_OK;
+        }
+      }
+      else if (CompareVersions(mOSVersion.get(), "3.0.0") >= 0 &&
+          CompareVersions(mOSVersion.get(), "4.0.0") < 0)
+      {
+        // Honeycomb Samsung devices are whitelisted.
+        // All other Honeycomb devices are blacklisted.
+	bool isWhitelisted =
+          cManufacturer.Equals("samsung", nsCaseInsensitiveCStringComparator());
+
+        if (!isWhitelisted) {
+          *aStatus = nsIGfxInfo::FEATURE_BLOCKED_DEVICE;
+          return NS_OK;
+        }
+      }
+      else if (CompareVersions(mOSVersion.get(), "4.0.0") < 0)
       {
         *aStatus = nsIGfxInfo::FEATURE_BLOCKED_OS_VERSION;
         return NS_OK;
       }
       else if (CompareVersions(mOSVersion.get(), "4.1.0") < 0)
       {
         bool isWhitelisted =
           cManufacturer.Equals("samsung", nsCaseInsensitiveCStringComparator()) ||