--- a/dom/base/ScriptSettings.cpp
+++ b/dom/base/ScriptSettings.cpp
@@ -4,17 +4,16 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "mozilla/dom/ScriptSettings.h"
 #include "mozilla/ThreadLocal.h"
 #include "mozilla/Assertions.h"
 
 #include "jsapi.h"
-#include "xpcprivate.h" // For AutoCxPusher guts
 #include "xpcpublic.h"
 #include "nsIGlobalObject.h"
 #include "nsIDocShell.h"
 #include "nsIScriptGlobalObject.h"
 #include "nsIScriptContext.h"
 #include "nsContentUtils.h"
 #include "nsGlobalWindow.h"
 #include "nsPIDOMWindow.h"
@@ -33,57 +32,76 @@ class ScriptSettingsStack {
 public:
   static ScriptSettingsStackEntry* Top() {
     return sScriptSettingsTLS.get();
   }
 
   static void Push(ScriptSettingsStackEntry *aEntry) {
     MOZ_ASSERT(!aEntry->mOlder);
     // Whenever JSAPI use is disabled, the next stack entry pushed must
-    // always be a candidate entry point.
-    MOZ_ASSERT_IF(!Top() || Top()->NoJSAPI(), aEntry->mIsCandidateEntryPoint);
+    // not be an AutoIncumbentScript.
+    MOZ_ASSERT_IF(!Top() || Top()->NoJSAPI(),
+                  !aEntry->IsIncumbentScript());
+    // Whenever the top entry is not an incumbent canidate, the next stack entry
+    // pushed must not be an AutoIncumbentScript.
+    MOZ_ASSERT_IF(Top() && !Top()->IsIncumbentCandidate(),
+                  !aEntry->IsIncumbentScript());
 
     aEntry->mOlder = Top();
     sScriptSettingsTLS.set(aEntry);
   }
 
   static void Pop(ScriptSettingsStackEntry *aEntry) {
     MOZ_ASSERT(aEntry == Top());
     sScriptSettingsTLS.set(aEntry->mOlder);
   }
 
   static nsIGlobalObject* IncumbentGlobal() {
     ScriptSettingsStackEntry *entry = Top();
-    if (!entry) {
-      return nullptr;
+    while (entry) {
+      if (entry->IsIncumbentCandidate()) {
+        return entry->mGlobalObject;
+      }
+      entry = entry->mOlder;
     }
-    return entry->mGlobalObject;
+    return nullptr;
   }
 
   static ScriptSettingsStackEntry* EntryPoint() {
     ScriptSettingsStackEntry *entry = Top();
-    if (!entry) {
-      return nullptr;
-    }
     while (entry) {
-      if (entry->mIsCandidateEntryPoint)
+      if (entry->IsEntryCandidate()) {
         return entry;
+      }
       entry = entry->mOlder;
     }
-    MOZ_CRASH("Non-empty stack should always have an entry point");
+    return nullptr;
   }
 
   static nsIGlobalObject* EntryGlobal() {
     ScriptSettingsStackEntry *entry = EntryPoint();
     if (!entry) {
       return nullptr;
     }
     return entry->mGlobalObject;
   }
 
+#ifdef DEBUG
+  static ScriptSettingsStackEntry* TopNonIncumbentScript() {
+    ScriptSettingsStackEntry *entry = Top();
+    while (entry) {
+      if (!entry->IsIncumbentScript()) {
+        return entry;
+      }
+      entry = entry->mOlder;
+    }
+    return nullptr;
+  }
+#endif // DEBUG
+
 };
 
 static unsigned long gRunToCompletionListeners = 0;
 
 void
 UseEntryScriptProfiling()
 {
   MOZ_ASSERT(NS_IsMainThread());
@@ -118,45 +136,33 @@ DestroyScriptSettings()
 
 bool
 ScriptSettingsInitialized()
 {
   return sScriptSettingsTLSInitialized;
 }
 
 ScriptSettingsStackEntry::ScriptSettingsStackEntry(nsIGlobalObject *aGlobal,
-                                                   bool aCandidate)
+                                                   Type aType)
   : mGlobalObject(aGlobal)
-  , mIsCandidateEntryPoint(aCandidate)
+  , mType(aType)
   , mOlder(nullptr)
 {
-  MOZ_ASSERT(mGlobalObject);
-  MOZ_ASSERT(mGlobalObject->GetGlobalJSObject(),
+  MOZ_ASSERT_IF(IsIncumbentCandidate() && !NoJSAPI(), mGlobalObject);
+  MOZ_ASSERT(!mGlobalObject || mGlobalObject->GetGlobalJSObject(),
              "Must have an actual JS global for the duration on the stack");
-  MOZ_ASSERT(JS_IsGlobalObject(mGlobalObject->GetGlobalJSObject()),
+  MOZ_ASSERT(!mGlobalObject ||
+             JS_IsGlobalObject(mGlobalObject->GetGlobalJSObject()),
              "No outer windows allowed");
-
-  ScriptSettingsStack::Push(this);
-}
-
-// This constructor is only for use by AutoNoJSAPI.
-ScriptSettingsStackEntry::ScriptSettingsStackEntry()
-   : mGlobalObject(nullptr)
-   , mIsCandidateEntryPoint(true)
-   , mOlder(nullptr)
-{
-  ScriptSettingsStack::Push(this);
 }
 
 ScriptSettingsStackEntry::~ScriptSettingsStackEntry()
 {
   // We must have an actual JS global for the entire time this is on the stack.
   MOZ_ASSERT_IF(mGlobalObject, mGlobalObject->GetGlobalJSObject());
-
-  ScriptSettingsStack::Pop(this);
 }
 
 // If the entry or incumbent global ends up being something that the subject
 // principal doesn't subsume, we don't want to use it. This never happens on
 // the web, but can happen with asymmetric privilege relationships (i.e.
 // nsExpandedPrincipal and System Principal).
 //
 // The most correct thing to use instead would be the topmost global on the
@@ -266,36 +272,53 @@ GetWebIDLCallerPrincipal()
   if (!entry || entry->NoJSAPI()) {
     return nullptr;
   }
   AutoEntryScript* aes = static_cast<AutoEntryScript*>(entry);
 
   return aes->mWebIDLCallerPrincipal;
 }
 
+bool
+IsJSAPIActive()
+{
+  ScriptSettingsStackEntry* topEntry = ScriptSettingsStack::Top();
+  return topEntry && !topEntry->NoJSAPI();
+}
+
 AutoJSAPI::AutoJSAPI()
-  : mCx(nullptr)
+  : ScriptSettingsStackEntry(nullptr, eJSAPI)
+  , mCx(nullptr)
   , mIsMainThread(false) // For lack of anything better
 {
 }
 
 AutoJSAPI::~AutoJSAPI()
 {
   if (!mCx) {
     // No need to do anything here: we never managed to Init, so can't have an
     // exception on our (nonexistent) JSContext.  We also don't need to restore
-    // any state on it.
+    // any state on it.  Finally, we never made it to pushing outselves onto the
+    // ScriptSettingsStack, so shouldn't pop.
+    MOZ_ASSERT(ScriptSettingsStack::Top() != this);
     return;
   }
 
   ReportException();
 
   if (mOldWarningReporter.isSome()) {
     JS::SetWarningReporter(JS_GetRuntime(cx()), mOldWarningReporter.value());
   }
+
+  // Leave the request before popping.
+  if (mIsMainThread) {
+    mAutoRequest.reset();
+  }
+
+  ScriptSettingsStack::Pop(this);
 }
 
 void
 WarningOnlyErrorReporter(JSContext* aCx, const char* aMessage,
                          JSErrorReport* aRep);
 
 void
 AutoJSAPI::InitInternal(nsIGlobalObject* aGlobalObject, JSObject* aGlobal,
@@ -308,26 +331,24 @@ AutoJSAPI::InitInternal(nsIGlobalObject*
 #ifdef DEBUG
   bool haveException = JS_IsExceptionPending(aCx);
 #endif // DEBUG
 
   mCx = aCx;
   mIsMainThread = aIsMainThread;
   mGlobalObject = aGlobalObject;
   if (aIsMainThread) {
-    // This Rooted<> is necessary only as long as AutoCxPusher::AutoCxPusher
-    // can GC, which is only possible because XPCJSContextStack::Push calls
-    // nsIPrincipal.Equals. Once that is removed, the Rooted<> will no longer
-    // be necessary.
-    JS::Rooted<JSObject*> global(JS_GetRuntime(aCx), aGlobal);
-    mCxPusher.emplace(mCx);
-    mAutoNullableCompartment.emplace(mCx, global);
-  } else {
-    mAutoNullableCompartment.emplace(mCx, aGlobal);
+    // We _could_ just unconditionally emplace mAutoRequest here.  It's just not
+    // needed on worker threads, and we're hoping to kill it on the main thread
+    // too.
+    mAutoRequest.emplace(mCx);
   }
+  mAutoNullableCompartment.emplace(mCx, aGlobal);
+
+  ScriptSettingsStack::Push(this);
 
   JSRuntime* rt = JS_GetRuntime(aCx);
   mOldWarningReporter.emplace(JS::GetWarningReporter(rt));
 
   JS::SetWarningReporter(rt, WarningOnlyErrorReporter);
 
 #ifdef DEBUG
   if (haveException) {
@@ -393,18 +414,20 @@ AutoJSAPI::InitInternal(nsIGlobalObject*
     }
     MOZ_ASSERT(false, "We had an exception; we should not have");
   }
 #endif // DEBUG
 }
 
 AutoJSAPI::AutoJSAPI(nsIGlobalObject* aGlobalObject,
                      bool aIsMainThread,
-                     JSContext* aCx)
-  : mIsMainThread(aIsMainThread)
+                     JSContext* aCx,
+                     Type aType)
+  : ScriptSettingsStackEntry(aGlobalObject, aType)
+  , mIsMainThread(aIsMainThread)
 {
   MOZ_ASSERT(aGlobalObject);
   MOZ_ASSERT(aGlobalObject->GetGlobalJSObject(), "Must have a JS global");
   MOZ_ASSERT(aCx);
   MOZ_ASSERT(aIsMainThread == NS_IsMainThread());
 
   InitInternal(aGlobalObject, aGlobalObject->GetGlobalJSObject(), aCx,
                aIsMainThread);
@@ -578,17 +601,17 @@ AutoJSAPI::ReportException()
     NS_WARNING("OOMed while acquiring uncaught exception from JSAPI");
     ClearException();
   }
 }
 
 bool
 AutoJSAPI::PeekException(JS::MutableHandle<JS::Value> aVal)
 {
-  MOZ_ASSERT_IF(mIsMainThread, CxPusherIsStackTop());
+  MOZ_ASSERT_IF(mIsMainThread, IsStackTop());
   MOZ_ASSERT(HasException());
   MOZ_ASSERT(js::GetContextCompartment(cx()));
   if (!JS_GetPendingException(cx(), aVal)) {
     return false;
   }
   return true;
 }
 
@@ -597,23 +620,31 @@ AutoJSAPI::StealException(JS::MutableHan
 {
   if (!PeekException(aVal)) {
     return false;
   }
   JS_ClearPendingException(cx());
   return true;
 }
 
+#ifdef DEBUG
+bool
+AutoJSAPI::IsStackTop() const
+{
+  return ScriptSettingsStack::TopNonIncumbentScript() == this;
+}
+#endif // DEBUG
+
 AutoEntryScript::AutoEntryScript(nsIGlobalObject* aGlobalObject,
                                  const char *aReason,
                                  bool aIsMainThread,
                                  JSContext* aCx)
   : AutoJSAPI(aGlobalObject, aIsMainThread,
-              aCx ? aCx : nsContentUtils::GetSafeJSContext())
-  , ScriptSettingsStackEntry(aGlobalObject, /* aCandidate = */ true)
+              aCx ? aCx : nsContentUtils::GetSafeJSContext(),
+              eEntryScript)
   , mWebIDLCallerPrincipal(nullptr)
 {
   MOZ_ASSERT(aGlobalObject);
   MOZ_ASSERT_IF(!aCx, aIsMainThread); // cx is mandatory off-main-thread.
   MOZ_ASSERT_IF(aCx && aIsMainThread, aCx == nsContentUtils::GetSafeJSContext());
 
   if (aIsMainThread && gRunToCompletionListeners > 0) {
     mDocShellEntryMonitor.emplace(cx(), aReason);
@@ -707,90 +738,52 @@ AutoEntryScript::DocshellEntryMonitor::E
   // Not really worth checking GetRecordProfileTimelineMarkers here.
   if (window && window->GetDocShell()) {
     nsCOMPtr<nsIDocShell> docShellForJSRunToCompletion = window->GetDocShell();
     docShellForJSRunToCompletion->NotifyJSRunToCompletionStop();
   }
 }
 
 AutoIncumbentScript::AutoIncumbentScript(nsIGlobalObject* aGlobalObject)
-  : ScriptSettingsStackEntry(aGlobalObject, /* aCandidate = */ false)
+  : ScriptSettingsStackEntry(aGlobalObject, eIncumbentScript)
   , mCallerOverride(nsContentUtils::GetCurrentJSContextForThread())
 {
+  ScriptSettingsStack::Push(this);
 }
 
-AutoNoJSAPI::AutoNoJSAPI(bool aIsMainThread)
-  : ScriptSettingsStackEntry()
+AutoIncumbentScript::~AutoIncumbentScript()
 {
-  if (aIsMainThread) {
-    mCxPusher.emplace(static_cast<JSContext*>(nullptr),
-                      /* aAllowNull = */ true);
-  }
+  ScriptSettingsStack::Pop(this);
 }
 
-danger::AutoCxPusher::AutoCxPusher(JSContext* cx, bool allowNull)
+AutoNoJSAPI::AutoNoJSAPI()
+  : ScriptSettingsStackEntry(nullptr, eNoJSAPI)
 {
-  MOZ_ASSERT_IF(!allowNull, cx);
-
-  XPCJSContextStack *stack = XPCJSRuntime::Get()->GetJSContextStack();
-  stack->Push(cx);
-
-#ifdef DEBUG
-  mStackDepthAfterPush = stack->Count();
-  mPushedContext = cx;
-  mCompartmentDepthOnEntry = cx ? js::GetEnterCompartmentDepth(cx) : 0;
-#endif
-
-  // Enter a request and a compartment for the duration that the cx is on the
-  // stack if non-null.
-  if (cx) {
-    mAutoRequest.emplace(cx);
-  }
+  ScriptSettingsStack::Push(this);
 }
 
-danger::AutoCxPusher::~AutoCxPusher()
+AutoNoJSAPI::~AutoNoJSAPI()
 {
-  // Leave the request before popping.
-  mAutoRequest.reset();
-
-  // When we push a context, we may save the frame chain and pretend like we
-  // haven't entered any compartment. This gets restored on Pop(), but we can
-  // run into trouble if a Push/Pop are interleaved with a
-  // JSAutoEnterCompartment. Make sure the compartment depth right before we
-  // pop is the same as it was right after we pushed.
-  MOZ_ASSERT_IF(mPushedContext, mCompartmentDepthOnEntry ==
-                                js::GetEnterCompartmentDepth(mPushedContext));
-  MOZ_ASSERT(mPushedContext == nsXPConnect::XPConnect()->GetCurrentJSContext());
-  XPCJSRuntime::Get()->GetJSContextStack()->Pop();
+  ScriptSettingsStack::Pop(this);
 }
 
-#ifdef DEBUG
-bool
-danger::AutoCxPusher::IsStackTop() const
-{
-  uint32_t currentDepth = XPCJSRuntime::Get()->GetJSContextStack()->Count();
-  MOZ_ASSERT(currentDepth >= mStackDepthAfterPush);
-  return currentDepth == mStackDepthAfterPush;
-}
-#endif
-
 } // namespace dom
 
 AutoJSContext::AutoJSContext(MOZ_GUARD_OBJECT_NOTIFIER_ONLY_PARAM_IN_IMPL)
   : mCx(nullptr)
 {
   JS::AutoSuppressGCAnalysis nogc;
   MOZ_ASSERT(!mCx, "mCx should not be initialized!");
+  MOZ_ASSERT(NS_IsMainThread());
 
   MOZ_GUARD_OBJECT_NOTIFIER_INIT;
 
-  nsXPConnect *xpc = nsXPConnect::XPConnect();
-  mCx = xpc->GetCurrentJSContext();
-
-  if (!mCx) {
+  if (IsJSAPIActive()) {
+    mCx = nsContentUtils::GetSafeJSContext();
+  } else {
     mJSAPI.Init();
     mCx = mJSAPI.cx();
   }
 }
 
 AutoJSContext::operator JSContext*() const
 {
   return mCx;

--- a/dom/base/ScriptSettings.h
+++ b/dom/base/ScriptSettings.h
@@ -22,44 +22,16 @@ class nsPIDOMWindowInner;
 class nsGlobalWindow;
 class nsIScriptContext;
 class nsIDocument;
 class nsIDocShell;
 
 namespace mozilla {
 namespace dom {
 
-// For internal use only - use AutoJSAPI instead.
-namespace danger {
-
-/**
- * Fundamental cx pushing class. All other cx pushing classes are implemented
- * in terms of this class.
- */
-class MOZ_STACK_CLASS AutoCxPusher
-{
-public:
-  explicit AutoCxPusher(JSContext *aCx, bool aAllowNull = false);
-  ~AutoCxPusher();
-
-  // Returns true if this AutoCxPusher performed the push that is currently at
-  // the top of the cx stack.
-  bool IsStackTop() const;
-
-private:
-  mozilla::Maybe<JSAutoRequest> mAutoRequest;
-#ifdef DEBUG
-  uint32_t mStackDepthAfterPush;
-  JSContext* mPushedContext;
-  unsigned mCompartmentDepthOnEntry;
-#endif
-};
-
-} /* namespace danger */
-
 /*
  * System-wide setup/teardown routines. Init and Destroy should be invoked
  * once each, at startup and shutdown (respectively).
  */
 void InitScriptSettings();
 void DestroyScriptSettings();
 bool ScriptSettingsInitialized();
 
@@ -145,74 +117,84 @@ nsIPrincipal* GetWebIDLCallerPrincipal()
 // This may be used by callers that know that their incumbent global is non-
 // null (i.e. they know there have been no System Caller pushes since the
 // inner-most script execution).
 inline JSObject& IncumbentJSGlobal()
 {
   return *GetIncumbentGlobal()->GetGlobalJSObject();
 }
 
+// Returns whether JSAPI is active right now.  If it is not, working with a
+// JSContext you grab from somewhere random is not OK and you should be doing
+// AutoJSAPI or AutoEntryScript to get yourself a properly set up JSContext.
+bool IsJSAPIActive();
+
 class ScriptSettingsStack;
 class ScriptSettingsStackEntry {
   friend class ScriptSettingsStack;
 
 public:
   ~ScriptSettingsStackEntry();
 
-  bool NoJSAPI() { return !mGlobalObject; }
+  bool NoJSAPI() const { return mType == eNoJSAPI; }
+  bool IsEntryCandidate() const {
+    return mType == eEntryScript || mType == eNoJSAPI;
+  }
+  bool IsIncumbentCandidate() { return mType != eJSAPI; }
+  bool IsIncumbentScript() { return mType == eIncumbentScript; }
 
 protected:
-  ScriptSettingsStackEntry(nsIGlobalObject *aGlobal, bool aCandidate);
+  enum Type {
+    eEntryScript,
+    eIncumbentScript,
+    eJSAPI,
+    eNoJSAPI
+  };
+
+  ScriptSettingsStackEntry(nsIGlobalObject *aGlobal,
+                           Type aEntryType);
 
   nsCOMPtr<nsIGlobalObject> mGlobalObject;
-  bool mIsCandidateEntryPoint;
+  Type mType;
 
 private:
-  // This constructor is only for use by AutoNoJSAPI.
-  friend class AutoNoJSAPI;
-  ScriptSettingsStackEntry();
-
   ScriptSettingsStackEntry *mOlder;
 };
 
 /*
  * For any interaction with JSAPI, an AutoJSAPI (or one of its subclasses)
  * must be on the stack.
  *
  * This base class should be instantiated as-is when the caller wants to use
  * JSAPI but doesn't expect to run script. The caller must then call one of its
  * Init functions before being able to access the JSContext through cx().
  * Its current duties are as-follows (see individual Init comments for details):
  *
  * * Grabbing an appropriate JSContext, and, on the main thread, pushing it onto
  *   the JSContext stack.
  * * Entering an initial (possibly null) compartment, to ensure that the
  *   previously entered compartment for that JSContext is not used by mistake.
+ * * Reporting any exceptions left on the JSRuntime, unless the caller steals
+ *   or silences them.
+ * * On main thread, entering a JSAutoRequest.
  *
  * Additionally, the following duties are planned, but not yet implemented:
  *
- * * De-poisoning the JSRuntime to allow manipulation of JSAPI. We can't
- *   actually implement this poisoning until all the JSContext pushing in the
- *   system goes through AutoJSAPI (see bug 951991). For now, this de-poisoning
+ * * De-poisoning the JSRuntime to allow manipulation of JSAPI. This requires
+ *   implementing the poisoning first.  For now, this de-poisoning
  *   effectively corresponds to having a non-null cx on the stack.
- * * Reporting any exceptions left on the JSRuntime, unless the caller steals
- *   or silences them.
- * * Entering a JSAutoRequest. At present, this is handled by the cx pushing
- *   on the main thread, and by other code on workers. Depending on the order
- *   in which various cleanup lands, this may never be necessary, because
- *   JSAutoRequests may go away.
  *
  * In situations where the consumer expects to run script, AutoEntryScript
  * should be used, which does additional manipulation of the script settings
  * stack. In bug 991758, we'll add hard invariants to SpiderMonkey, such that
  * any attempt to run script without an AutoEntryScript on the stack will
  * fail. This prevents system code from accidentally triggering script
  * execution at inopportune moments via surreptitious getters and proxies.
  */
-class MOZ_STACK_CLASS AutoJSAPI {
+class MOZ_STACK_CLASS AutoJSAPI : protected ScriptSettingsStackEntry {
 public:
   // Trivial constructor. One of the Init functions must be called before
   // accessing the JSContext through cx().
   AutoJSAPI();
 
   ~AutoJSAPI();
 
   // This uses the SafeJSContext (or worker equivalent), and enters a null
@@ -253,29 +235,29 @@ public:
   bool Init(nsPIDOMWindowInner* aWindow);
   bool Init(nsPIDOMWindowInner* aWindow, JSContext* aCx);
 
   bool Init(nsGlobalWindow* aWindow);
   bool Init(nsGlobalWindow* aWindow, JSContext* aCx);
 
   JSContext* cx() const {
     MOZ_ASSERT(mCx, "Must call Init before using an AutoJSAPI");
-    MOZ_ASSERT_IF(mIsMainThread, CxPusherIsStackTop());
+    MOZ_ASSERT(IsStackTop());
     return mCx;
   }
 
 #ifdef DEBUG
-  bool CxPusherIsStackTop() const { return mCxPusher->IsStackTop(); }
+  bool IsStackTop() const;
 #endif
 
   // If HasException, report it.  Otherwise, a no-op.
   void ReportException();
 
   bool HasException() const {
-    MOZ_ASSERT_IF(NS_IsMainThread(), CxPusherIsStackTop());
+    MOZ_ASSERT(IsStackTop());
     return JS_IsExceptionPending(cx());
   };
 
   // Transfers ownership of the current exception from the JS engine to the
   // caller. Callers must ensure that HasException() is true, and that cx()
   // is in a non-null compartment.
   //
   // Note that this fails if and only if we OOM while wrapping the exception
@@ -286,35 +268,31 @@ public:
   // Callers must ensure that HasException() is true, and that cx() is in a
   // non-null compartment.
   //
   // Note that this fails if and only if we OOM while wrapping the exception
   // into the current compartment.
   bool PeekException(JS::MutableHandle<JS::Value> aVal);
 
   void ClearException() {
-    MOZ_ASSERT_IF(NS_IsMainThread(), CxPusherIsStackTop());
+    MOZ_ASSERT(IsStackTop());
     JS_ClearPendingException(cx());
   }
 
 protected:
   // Protected constructor, allowing subclasses to specify a particular cx to
   // be used. This constructor initialises the AutoJSAPI, so Init must NOT be
   // called on subclasses that use this.
   // If aGlobalObject, its associated JS global or aCx are null this will cause
   // an assertion, as will setting aIsMainThread incorrectly.
-  AutoJSAPI(nsIGlobalObject* aGlobalObject, bool aIsMainThread, JSContext* aCx);
+  AutoJSAPI(nsIGlobalObject* aGlobalObject, bool aIsMainThread, JSContext* aCx,
+            Type aType);
 
 private:
-  // We need to hold a strong ref to our global object, so it won't go away
-  // while we're being used.  This _could_ become a JS::Rooted<JSObject*> if we
-  // grabbed our JSContext in our constructor instead of waiting for Init(), so
-  // we could construct this at that point.  It might be worth it do to that.
-  RefPtr<nsIGlobalObject> mGlobalObject;
-  mozilla::Maybe<danger::AutoCxPusher> mCxPusher;
+  mozilla::Maybe<JSAutoRequest> mAutoRequest;
   mozilla::Maybe<JSAutoNullableCompartment> mAutoNullableCompartment;
   JSContext *mCx;
 
   // Whether we're mainthread or not; set when we're initialized.
   bool mIsMainThread;
   Maybe<JS::WarningReporter> mOldWarningReporter;
 
   void InitInternal(nsIGlobalObject* aGlobalObject, JSObject* aGlobal,
@@ -326,18 +304,17 @@ private:
 
 /*
  * A class that represents a new script entry point.
  *
  * |aReason| should be a statically-allocated C string naming the reason we're
  * invoking JavaScript code: "setTimeout", "event", and so on. The devtools use
  * these strings to label JS execution in timeline and profiling displays.
  */
-class MOZ_STACK_CLASS AutoEntryScript : public AutoJSAPI,
-                                        protected ScriptSettingsStackEntry {
+class MOZ_STACK_CLASS AutoEntryScript : public AutoJSAPI {
 public:
   AutoEntryScript(nsIGlobalObject* aGlobalObject,
                   const char *aReason,
                   bool aIsMainThread = NS_IsMainThread(),
                   // Note: aCx is mandatory off-main-thread.
                   JSContext* aCx = nullptr);
 
   AutoEntryScript(JSObject* aObject, // Any object from the relevant global
@@ -402,33 +379,34 @@ private:
 };
 
 /*
  * A class that can be used to force a particular incumbent script on the stack.
  */
 class AutoIncumbentScript : protected ScriptSettingsStackEntry {
 public:
   explicit AutoIncumbentScript(nsIGlobalObject* aGlobalObject);
+  ~AutoIncumbentScript();
+
 private:
   JS::AutoHideScriptedCaller mCallerOverride;
 };
 
 /*
  * A class to put the JS engine in an unusable state. The subject principal
  * will become System, the information on the script settings stack is
  * rendered inaccessible, and JSAPI may not be manipulated until the class is
  * either popped or an AutoJSAPI instance is subsequently pushed.
  *
  * This class may not be instantiated if an exception is pending.
  */
 class AutoNoJSAPI : protected ScriptSettingsStackEntry {
 public:
-  explicit AutoNoJSAPI(bool aIsMainThread = NS_IsMainThread());
-private:
-  mozilla::Maybe<danger::AutoCxPusher> mCxPusher;
+  explicit AutoNoJSAPI();
+  ~AutoNoJSAPI();
 };
 
 } // namespace dom
 
 /**
  * Use AutoJSContext when you need a JS context on the stack but don't have one
  * passed as a parameter. AutoJSContext will take care of finding the most
  * appropriate JS context and release it when leaving the stack.

--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -5464,17 +5464,20 @@ nsContentUtils::GetContextForEventHandle
 }
 
 /* static */
 JSContext *
 nsContentUtils::GetCurrentJSContext()
 {
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(IsInitialized());
-  return sXPConnect->GetCurrentJSContext();
+  if (!IsJSAPIActive()) {
+    return nullptr;
+  }
+  return GetSafeJSContext();
 }
 
 /* static */
 JSContext *
 nsContentUtils::GetSafeJSContext()
 {
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(IsInitialized());

--- a/dom/base/nsGkAtomList.h
+++ b/dom/base/nsGkAtomList.h
@@ -1333,17 +1333,16 @@ GK_ATOM(xulcontentsgenerated, "xulconten
 GK_ATOM(yes, "yes")
 GK_ATOM(z_index, "z-index")
 GK_ATOM(zeroDigit, "zero-digit")
 
 
 GK_ATOM(percentage, "%")
 GK_ATOM(A, "A")
 GK_ATOM(alignment_baseline, "alignment-baseline")
-GK_ATOM(allowReorder, "allowReorder")
 GK_ATOM(amplitude, "amplitude")
 GK_ATOM(animate, "animate")
 GK_ATOM(animateColor, "animateColor")
 GK_ATOM(animateMotion, "animateMotion")
 GK_ATOM(animateTransform, "animateTransform")
 GK_ATOM(arithmetic, "arithmetic")
 GK_ATOM(atop, "atop")
 GK_ATOM(azimuth, "azimuth")

--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -1986,16 +1986,23 @@ ContentParent::RecvDeallocateLayerTreeId
     // You can't deallocate layer tree ids that you didn't allocate
     KillHard("DeallocateLayerTreeId");
   }
   return true;
 }
 
 namespace {
 
+void
+DelayedDeleteSubprocess(GeckoChildProcessHost* aSubprocess)
+{
+  RefPtr<DeleteTask<GeckoChildProcessHost>> task = new DeleteTask<GeckoChildProcessHost>(aSubprocess);
+  XRE_GetIOMessageLoop()->PostTask(task.forget());
+}
+
 // This runnable only exists to delegate ownership of the
 // ContentParent to this runnable, until it's deleted by the event
 // system.
 struct DelayedDeleteContentParentTask : public Runnable
 {
   explicit DelayedDeleteContentParentTask(ContentParent* aObj) : mObj(aObj) { }
 
   // No-op
@@ -2117,20 +2124,19 @@ ContentParent::ActorDestroy(ActorDestroy
   MOZ_ASSERT(idleService);
   RefPtr<ParentIdleListener> listener;
   for (int32_t i = mIdleListeners.Length() - 1; i >= 0; --i) {
     listener = static_cast<ParentIdleListener*>(mIdleListeners[i].get());
     idleService->RemoveIdleObserver(listener, listener->mTime);
   }
   mIdleListeners.Clear();
 
-  if (mSubprocess) {
-    mSubprocess->DissociateActor();
-    mSubprocess = nullptr;
-  }
+  MessageLoop::current()->
+    PostTask(NewRunnableFunction(DelayedDeleteSubprocess, mSubprocess));
+  mSubprocess = nullptr;
 
   // IPDL rules require actors to live on past ActorDestroy, but it
   // may be that the kungFuDeathGrip above is the last reference to
   // |this|.  If so, when we go out of scope here, we're deleted and
   // all hell breaks loose.
   //
   // This runnable ensures that a reference to |this| lives on at
   // least until after the current task finishes running.
@@ -3316,31 +3322,31 @@ ContentParent::DeallocPAPZParent(PAPZPar
   return true;
 }
 
 PCompositorBridgeParent*
 ContentParent::AllocPCompositorBridgeParent(mozilla::ipc::Transport* aTransport,
                                             base::ProcessId aOtherProcess)
 {
   return GPUProcessManager::Get()->CreateTabCompositorBridge(
-    aTransport, aOtherProcess, mSubprocess);
+    aTransport, aOtherProcess);
 }
 
 gfx::PVRManagerParent*
 ContentParent::AllocPVRManagerParent(Transport* aTransport,
                                      ProcessId aOtherProcess)
 {
   return gfx::VRManagerParent::CreateCrossProcess(aTransport, aOtherProcess);
 }
 
 PImageBridgeParent*
 ContentParent::AllocPImageBridgeParent(mozilla::ipc::Transport* aTransport,
                                        base::ProcessId aOtherProcess)
 {
-  return ImageBridgeParent::Create(aTransport, aOtherProcess, mSubprocess);
+  return ImageBridgeParent::Create(aTransport, aOtherProcess);
 }
 
 PBackgroundParent*
 ContentParent::AllocPBackgroundParent(Transport* aTransport,
                                       ProcessId aOtherProcess)
 {
   return BackgroundParent::Alloc(this, aTransport, aOtherProcess);
 }

--- a/dom/media/gmp/GMPProcessParent.h
+++ b/dom/media/gmp/GMPProcessParent.h
@@ -6,17 +6,16 @@
 
 #ifndef GMPProcessParent_h
 #define GMPProcessParent_h 1
 
 #include "mozilla/Attributes.h"
 #include "base/basictypes.h"
 #include "base/file_path.h"
 #include "base/thread.h"
-#include "base/waitable_event.h"
 #include "chrome/common/child_process_host.h"
 #include "mozilla/ipc/GeckoChildProcessHost.h"
 
 class nsIRunnable;
 
 namespace mozilla {
 namespace gmp {
 
@@ -30,17 +29,16 @@ public:
   // after timeoutMs, this method will return false.
   bool Launch(int32_t aTimeoutMs);
 
   void Delete(nsCOMPtr<nsIRunnable> aCallback = nullptr);
 
   bool CanShutdown() override { return true; }
   const std::string& GetPluginFilePath() { return mGMPPath; }
 
-  using mozilla::ipc::GeckoChildProcessHost::GetShutDownEvent;
   using mozilla::ipc::GeckoChildProcessHost::GetChannel;
   using mozilla::ipc::GeckoChildProcessHost::GetChildProcessHandle;
 
 private:
   void DoDelete();
 
   std::string mGMPPath;
   nsCOMPtr<nsIRunnable> mDeletedCallback;

--- a/dom/media/webaudio/test/browser_bug1181073.js
+++ b/dom/media/webaudio/test/browser_bug1181073.js
@@ -18,16 +18,26 @@ add_task(function*() {
         content.window.clearInterval(id);
         resolve(end - start);
       }, 0);
     });
   });
 
   ok(time > 2000, "Interval is throttled with no webaudio (" + time + " ms)");
 
+  // Set up a listener for the oscillator's demise
+  let oscillatorDemisePromise = ContentTask.spawn(browser, null, function() {
+    return new Promise(resolve => {
+      let observer = () => resolve();
+      // Record the observer on the content object so we can throw it out later
+      content.__bug1181073_observer = observer;
+      Services.obs.addObserver(observer, "webaudio-node-demise", false);
+    });
+  });
+
   time = yield ContentTask.spawn(browser, null, function () {
     return new Promise(resolve => {
       // Start playing audio, save it on the window so it doesn't get GCed
       let audioCtx = content.window.audioCtx = new content.window.AudioContext();
       let oscillator = audioCtx.createOscillator();
       oscillator.type = 'square';
       oscillator.frequency.value = 3000;
       oscillator.start();
@@ -41,16 +51,17 @@ add_task(function*() {
       }, 0);
     });
   });
 
   ok(time < 1000, "Interval is not throttled with audio playing (" + time + " ms)");
 
   // Destroy the oscillator, but not the audio context
   yield new Promise(resolve => SpecialPowers.exactGC(browser.contentWindow, resolve));
+  yield oscillatorDemisePromise;
 
   time = yield ContentTask.spawn(browser, null, function () {
     return new Promise(resolve => {
       let start = content.performance.now();
       let id = content.window.setInterval(function() {
         let end = content.performance.now();
         content.window.clearInterval(id);
         resolve(end - start);

--- a/dom/plugins/ipc/PluginProcessParent.h
+++ b/dom/plugins/ipc/PluginProcessParent.h
@@ -8,17 +8,16 @@
 #define dom_plugins_PluginProcessParent_h 1
 
 #include "mozilla/Attributes.h"
 #include "base/basictypes.h"
 
 #include "base/file_path.h"
 #include "base/task.h"
 #include "base/thread.h"
-#include "base/waitable_event.h"
 #include "chrome/common/child_process_host.h"
 
 #include "mozilla/ipc/GeckoChildProcessHost.h"
 #include "mozilla/ipc/TaskFactory.h"
 #include "mozilla/UniquePtr.h"
 #include "nsCOMPtr.h"
 #include "nsIRunnable.h"
 
@@ -61,17 +60,16 @@ public:
 
     virtual bool CanShutdown() override
     {
         return true;
     }
 
     const std::string& GetPluginFilePath() { return mPluginFilePath; }
 
-    using mozilla::ipc::GeckoChildProcessHost::GetShutDownEvent;
     using mozilla::ipc::GeckoChildProcessHost::GetChannel;
 
     void SetCallRunnableImmediately(bool aCallImmediately);
     virtual bool WaitUntilConnected(int32_t aTimeoutMs = 0) override;
 
     virtual void OnChannelConnected(int32_t peer_pid) override;
     virtual void OnChannelError() override;
 

--- a/dom/svg/SVGSwitchElement.cpp
+++ b/dom/svg/SVGSwitchElement.cpp
@@ -122,24 +122,20 @@ SVGSwitchElement::IsAttributeMapped(cons
 }
 
 //----------------------------------------------------------------------
 // Implementation Helpers:
 
 nsIContent *
 SVGSwitchElement::FindActiveChild() const
 {
-  bool allowReorder = AttrValueIs(kNameSpaceID_None,
-                                  nsGkAtoms::allowReorder,
-                                  nsGkAtoms::yes, eCaseMatters);
-
   const nsAdoptingString& acceptLangs =
     Preferences::GetLocalizedString("intl.accept_languages");
 
-  if (allowReorder && !acceptLangs.IsEmpty()) {
+  if (!acceptLangs.IsEmpty()) {
     int32_t bestLanguagePreferenceRank = -1;
     nsIContent *bestChild = nullptr;
     nsIContent *defaultChild = nullptr;
     for (nsIContent* child = nsINode::GetFirstChild();
          child;
          child = child->GetNextSibling()) {
 
       if (!child->IsElement()) {

--- a/dom/svg/test/test_switch.xhtml
+++ b/dom/svg/test/test_switch.xhtml
@@ -53,31 +53,17 @@ function run1()
 {
   try {
     var doc = $("svg").contentDocument;
     var s = doc.getElementById("s");
     var first = doc.getElementById("first");
     var second = doc.getElementById("second");
     var third = doc.getElementById("third");
   
-    /* test for an exact match */
-    second.setAttribute("systemLanguage", "en-gb");
-    checkBounds(s, 75, 100, 50, 50);
-  
-    /* test for a close match i.e. the same language prefix */
-    second.setAttribute("systemLanguage", "en-us");
-    checkWidth(s, 50);
-
-    /* test that we pick the first match */
-    first.setAttribute("systemLanguage", "it");
-    checkWidth(s, 70);
-
-    /* this time with reordering */
     first.setAttribute("systemLanguage", "fr");
-    s.setAttribute("allowReorder", "yes");
 
     /* test for an exact match */
     second.setAttribute("systemLanguage", "en-gb");
     checkWidth(s, 50);
 
     /* test for a close match i.e. the same language prefix */
     second.setAttribute("systemLanguage", "en-us");
     checkWidth(s, 50);

--- a/editor/libeditor/PlaceholderTxn.cpp
+++ b/editor/libeditor/PlaceholderTxn.cpp
@@ -27,23 +27,27 @@ PlaceholderTxn::PlaceholderTxn() :  Edit
 PlaceholderTxn::~PlaceholderTxn()
 {
 }
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(PlaceholderTxn)
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(PlaceholderTxn,
                                                 EditAggregateTxn)
-  ImplCycleCollectionUnlink(*tmp->mStartSel);
+  if (tmp->mStartSel) {
+    ImplCycleCollectionUnlink(*tmp->mStartSel);
+  }
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mEndSel);
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(PlaceholderTxn,
                                                   EditAggregateTxn)
-  ImplCycleCollectionTraverse(cb, *tmp->mStartSel, "mStartSel", 0);
+  if (tmp->mStartSel) {
+    ImplCycleCollectionTraverse(cb, *tmp->mStartSel, "mStartSel", 0);
+  }
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mEndSel);
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(PlaceholderTxn)
   NS_INTERFACE_MAP_ENTRY(nsIAbsorbingTransaction)
   NS_INTERFACE_MAP_ENTRY(nsISupportsWeakReference)
 NS_INTERFACE_MAP_END_INHERITING(EditAggregateTxn)
 

--- a/gfx/ipc/GPUProcessHost.cpp
+++ b/gfx/ipc/GPUProcessHost.cpp
@@ -187,23 +187,31 @@ GPUProcessHost::KillHard(const char* aRe
     NS_WARNING("failed to kill subprocess!");
   }
 
   SetAlreadyDead();
   XRE_GetIOMessageLoop()->PostTask(
     NewRunnableFunction(&ProcessWatcher::EnsureProcessTerminated, handle, /*force=*/true));
 }
 
+static void
+DelayedDeleteSubprocess(GeckoChildProcessHost* aSubprocess)
+{
+  XRE_GetIOMessageLoop()->
+    PostTask(mozilla::MakeAndAddRef<DeleteTask<GeckoChildProcessHost>>(aSubprocess));
+}
+
 void
 GPUProcessHost::DestroyProcess()
 {
   // Cancel all tasks. We don't want anything triggering after our caller
   // expects this to go away.
   {
     MonitorAutoLock lock(mMonitor);
     mTaskFactory.RevokeAll();
   }
 
-  DissociateActor();
+  MessageLoop::current()->
+    PostTask(NewRunnableFunction(DelayedDeleteSubprocess, this));
 }
 
 } // namespace gfx
 } // namespace mozilla

--- a/gfx/ipc/GPUProcessManager.cpp
+++ b/gfx/ipc/GPUProcessManager.cpp
@@ -165,20 +165,19 @@ GPUProcessManager::CreateTopLevelComposi
     aUseAPZ,
     aUseExternalSurfaceSize,
     aSurfaceWidth,
     aSurfaceHeight);
 }
 
 PCompositorBridgeParent*
 GPUProcessManager::CreateTabCompositorBridge(ipc::Transport* aTransport,
-                                             base::ProcessId aOtherProcess,
-                                             ipc::GeckoChildProcessHost* aSubprocess)
+                                             base::ProcessId aOtherProcess)
 {
-  return CompositorBridgeParent::Create(aTransport, aOtherProcess, aSubprocess);
+  return CompositorBridgeParent::Create(aTransport, aOtherProcess);
 }
 
 already_AddRefed<APZCTreeManager>
 GPUProcessManager::GetAPZCTreeManagerForLayers(uint64_t aLayersId)
 {
   return CompositorBridgeParent::GetAPZCTreeManager(aLayersId);
 }
 

--- a/gfx/ipc/GPUProcessManager.h
+++ b/gfx/ipc/GPUProcessManager.h
@@ -65,18 +65,17 @@ public:
     CSSToLayoutDeviceScale aScale,
     bool aUseAPZ,
     bool aUseExternalSurfaceSize,
     int aSurfaceWidth,
     int aSurfaceHeight);
 
   layers::PCompositorBridgeParent* CreateTabCompositorBridge(
     ipc::Transport* aTransport,
-    base::ProcessId aOtherProcess,
-    ipc::GeckoChildProcessHost* aSubprocess);
+    base::ProcessId aOtherProcess);
 
   // This returns a reference to the APZCTreeManager to which
   // pan/zoom-related events can be sent.
   already_AddRefed<APZCTreeManager> GetAPZCTreeManagerForLayers(uint64_t aLayersId);
 
   // Allocate an ID that can be used to refer to a layer tree and
   // associated resources that live only on the compositor thread.
   //

--- a/gfx/layers/ipc/CompositorBridgeParent.cpp
+++ b/gfx/layers/ipc/CompositorBridgeParent.cpp
@@ -63,17 +63,16 @@
 #include "nsXULAppAPI.h"                // for XRE_GetIOMessageLoop
 #include "nsIXULRuntime.h"              // for BrowserTabsRemoteAutostart
 #ifdef XP_WIN
 #include "mozilla/layers/CompositorD3D11.h"
 #include "mozilla/layers/CompositorD3D9.h"
 #endif
 #include "GeckoProfiler.h"
 #include "mozilla/ipc/ProtocolTypes.h"
-#include "mozilla/ipc/GeckoChildProcessHost.h"
 #include "mozilla/unused.h"
 #include "mozilla/Hal.h"
 #include "mozilla/HalTypes.h"
 #include "mozilla/StaticPtr.h"
 #ifdef MOZ_ENABLE_PROFILER_SPS
 #include "ProfilerMarkers.h"
 #endif
 #include "mozilla/VsyncDispatcher.h"
@@ -1814,17 +1813,16 @@ class CrossProcessCompositorBridgeParent
                                                  public ShmemAllocator
 {
   friend class CompositorBridgeParent;
 
 public:
   explicit CrossProcessCompositorBridgeParent(Transport* aTransport)
     : CompositorBridgeParentIPCAllocator("CrossProcessCompositorBridgeParent")
     , mTransport(aTransport)
-    , mSubprocess(nullptr)
     , mNotifyAfterRemotePaint(false)
     , mDestroyCalled(false)
   {
     MOZ_ASSERT(NS_IsMainThread());
     // Always run destructor on the main thread
     SetMessageLoopToPostDestructionTo(MessageLoop::current());
   }
 
@@ -1993,17 +1991,16 @@ private:
 
   void DeferredDestroy();
 
   // There can be many CPCPs, and IPDL-generated code doesn't hold a
   // reference to top-level actors.  So we hold a reference to
   // ourself.  This is released (deferred) in ActorDestroy().
   RefPtr<CrossProcessCompositorBridgeParent> mSelfRef;
   Transport* mTransport;
-  ipc::GeckoChildProcessHost* mSubprocess;
 
   RefPtr<CompositorThreadHolder> mCompositorThreadHolder;
   // If true, we should send a RemotePaintIsReady message when the layer transaction
   // is received
   bool mNotifyAfterRemotePaint;
   bool mDestroyCalled;
 };
 
@@ -2153,28 +2150,23 @@ OpenCompositor(CrossProcessCompositorBri
                Transport* aTransport, ProcessId aOtherPid,
                MessageLoop* aIOLoop)
 {
   DebugOnly<bool> ok = aCompositor->Open(aTransport, aOtherPid, aIOLoop);
   MOZ_ASSERT(ok);
 }
 
 /*static*/ PCompositorBridgeParent*
-CompositorBridgeParent::Create(Transport* aTransport, ProcessId aOtherPid, GeckoChildProcessHost* aProcessHost)
+CompositorBridgeParent::Create(Transport* aTransport, ProcessId aOtherPid)
 {
   gfxPlatform::InitLayersIPC();
 
   RefPtr<CrossProcessCompositorBridgeParent> cpcp =
     new CrossProcessCompositorBridgeParent(aTransport);
 
-  if (aProcessHost) {
-    cpcp->mSubprocess = aProcessHost;
-    aProcessHost->AssociateActor();
-  }
-
   cpcp->mSelfRef = cpcp;
   CompositorLoop()->PostTask(
     NewRunnableFunction(OpenCompositor, cpcp.get(),
                         aTransport, aOtherPid, XRE_GetIOMessageLoop()));
   // The return value is just compared to null for success checking,
   // we're not sharing a ref.
   return cpcp.get();
 }
@@ -2272,21 +2264,16 @@ CrossProcessCompositorBridgeParent::Recv
 }
 
 void
 CrossProcessCompositorBridgeParent::ActorDestroy(ActorDestroyReason aWhy)
 {
   RefPtr<CompositorLRU> lru = CompositorLRU::GetSingleton();
   lru->Remove(this);
 
-  if (mSubprocess) {
-    mSubprocess->DissociateActor();
-    mSubprocess = nullptr;
-  }
-
   // We must keep this object alive untill the code handling message
   // reception is finished on this thread.
   MessageLoop::current()->PostTask(NewRunnableMethod(this, &CrossProcessCompositorBridgeParent::DeferredDestroy));
 }
 
 PLayerTransactionParent*
 CrossProcessCompositorBridgeParent::AllocPLayerTransactionParent(
   const nsTArray<LayersBackend>&,
@@ -2753,17 +2740,17 @@ CrossProcessCompositorBridgeParent::Clon
   base::ProcessHandle aPeerProcess,
   mozilla::ipc::ProtocolCloneContext* aCtx)
 {
   for (unsigned int i = 0; i < aFds.Length(); i++) {
     if (aFds[i].protocolId() == (unsigned)GetProtocolId()) {
       Transport* transport = OpenDescriptor(aFds[i].fd(),
                                             Transport::MODE_SERVER);
       PCompositorBridgeParent* compositor =
-        CompositorBridgeParent::Create(transport, base::GetProcId(aPeerProcess), mSubprocess);
+        CompositorBridgeParent::Create(transport, base::GetProcId(aPeerProcess));
       compositor->CloneManagees(this, aCtx);
       compositor->IToplevelProtocol::SetTransport(transport);
       // The reference to the compositor thread is held in OnChannelConnected().
       // We need to do this for cloned actors, too.
       compositor->OnChannelConnected(base::GetProcId(aPeerProcess));
       return compositor;
     }
   }

--- a/gfx/layers/ipc/CompositorBridgeParent.h
+++ b/gfx/layers/ipc/CompositorBridgeParent.h
@@ -46,17 +46,16 @@ namespace mozilla {
 class CancelableRunnable;
 
 namespace gfx {
 class DrawTarget;
 class GPUProcessManager;
 } // namespace gfx
 
 namespace ipc {
-class GeckoChildProcessHost;
 class Shmem;
 } // namespace ipc
 
 namespace layers {
 
 class APZCTreeManager;
 class AsyncCompositionManager;
 class Compositor;
@@ -395,17 +394,17 @@ public:
   static void SetControllerForLayerTree(uint64_t aLayersId,
                                         GeckoContentController* aController);
 
   /**
    * A new child process has been configured to push transactions
    * directly to us.  Transport is to its thread context.
    */
   static PCompositorBridgeParent*
-  Create(Transport* aTransport, ProcessId aOtherProcess, mozilla::ipc::GeckoChildProcessHost* aProcessHost);
+  Create(Transport* aTransport, ProcessId aOtherProcess);
 
   struct LayerTreeState {
     LayerTreeState();
     ~LayerTreeState();
     RefPtr<Layer> mRoot;
     RefPtr<GeckoContentController> mController;
     CompositorBridgeParent* mParent;
     LayerManagerComposite* mLayerManager;

--- a/gfx/layers/ipc/ImageBridgeParent.cpp
+++ b/gfx/layers/ipc/ImageBridgeParent.cpp
@@ -11,17 +11,16 @@
 #include "base/process.h"               // for ProcessId
 #include "base/task.h"                  // for CancelableTask, DeleteTask, etc
 #include "mozilla/gfx/Point.h"                   // for IntSize
 #include "mozilla/Hal.h"                // for hal::SetCurrentThreadPriority()
 #include "mozilla/HalTypes.h"           // for hal::THREAD_PRIORITY_COMPOSITOR
 #include "mozilla/ipc/MessageChannel.h" // for MessageChannel, etc
 #include "mozilla/ipc/ProtocolUtils.h"
 #include "mozilla/ipc/Transport.h"      // for Transport
-#include "mozilla/ipc/GeckoChildProcessHost.h"
 #include "mozilla/media/MediaSystemResourceManagerParent.h" // for MediaSystemResourceManagerParent
 #include "mozilla/layers/CompositableTransactionParent.h"
 #include "mozilla/layers/LayerManagerComposite.h"
 #include "mozilla/layers/LayersMessages.h"  // for EditReply
 #include "mozilla/layers/LayersSurfaces.h"  // for PGrallocBufferParent
 #include "mozilla/layers/PCompositableParent.h"
 #include "mozilla/layers/PImageBridgeParent.h"
 #include "mozilla/layers/TextureHostOGL.h"  // for TextureHostOGL
@@ -53,17 +52,16 @@ CompositorThreadHolder* GetCompositorThr
 ImageBridgeParent::ImageBridgeParent(MessageLoop* aLoop,
                                      Transport* aTransport,
                                      ProcessId aChildProcessId)
   : CompositableParentManager("ImageBridgeParent")
   , mMessageLoop(aLoop)
   , mTransport(aTransport)
   , mSetChildThreadPriority(false)
   , mClosed(false)
-  , mSubprocess(nullptr)
 {
   MOZ_ASSERT(NS_IsMainThread());
   sMainLoop = MessageLoop::current();
 
   // top-level actors must be destroyed on the main thread.
   SetMessageLoopToPostDestructionTo(sMainLoop);
 
   // creates the map only if it has not been created already, so it is safe
@@ -95,21 +93,16 @@ ImageBridgeParent::~ImageBridgeParent()
 }
 
 void
 ImageBridgeParent::ActorDestroy(ActorDestroyReason aWhy)
 {
   // Can't alloc/dealloc shmems from now on.
   mClosed = true;
 
-  if (mSubprocess) {
-    mSubprocess->DissociateActor();
-    mSubprocess = nullptr;
-  }
-
   MessageLoop::current()->PostTask(NewRunnableMethod(this, &ImageBridgeParent::DeferredDestroy));
 
   // It is very important that this method gets called at shutdown (be it a clean
   // or an abnormal shutdown), because DeferredDestroy is what clears mSelfRef.
   // If mSelfRef is not null and ActorDestroy is not called, the ImageBridgeParent
   // is leaked which causes the CompositorThreadHolder to be leaked and
   // CompsoitorParent's shutdown ends up spinning the event loop forever, waiting
   // for the compositor thread to terminate.
@@ -198,26 +191,21 @@ static void
 ConnectImageBridgeInParentProcess(ImageBridgeParent* aBridge,
                                   Transport* aTransport,
                                   base::ProcessId aOtherPid)
 {
   aBridge->Open(aTransport, aOtherPid, XRE_GetIOMessageLoop(), ipc::ParentSide);
 }
 
 /*static*/ PImageBridgeParent*
-ImageBridgeParent::Create(Transport* aTransport, ProcessId aChildProcessId, GeckoChildProcessHost* aProcessHost)
+ImageBridgeParent::Create(Transport* aTransport, ProcessId aChildProcessId)
 {
   MessageLoop* loop = CompositorThreadHolder::Loop();
   RefPtr<ImageBridgeParent> bridge = new ImageBridgeParent(loop, aTransport, aChildProcessId);
 
-  if (aProcessHost) {
-    bridge->mSubprocess = aProcessHost;
-    aProcessHost->AssociateActor();
-  }
-
   loop->PostTask(NewRunnableFunction(ConnectImageBridgeInParentProcess,
                                      bridge.get(), aTransport, aChildProcessId));
   return bridge.get();
 }
 
 bool ImageBridgeParent::RecvWillClose()
 {
   // If there is any texture still alive we have to force it to deallocate the
@@ -364,17 +352,17 @@ IToplevelProtocol*
 ImageBridgeParent::CloneToplevel(const InfallibleTArray<ProtocolFdMapping>& aFds,
                                  base::ProcessHandle aPeerProcess,
                                  mozilla::ipc::ProtocolCloneContext* aCtx)
 {
   for (unsigned int i = 0; i < aFds.Length(); i++) {
     if (aFds[i].protocolId() == unsigned(GetProtocolId())) {
       Transport* transport = OpenDescriptor(aFds[i].fd(),
                                             Transport::MODE_SERVER);
-      PImageBridgeParent* bridge = Create(transport, base::GetProcId(aPeerProcess), mSubprocess);
+      PImageBridgeParent* bridge = Create(transport, base::GetProcId(aPeerProcess));
       bridge->CloneManagees(this, aCtx);
       bridge->IToplevelProtocol::SetTransport(transport);
       // The reference to the compositor thread is held in OnChannelConnected().
       // We need to do this for cloned actors, too.
       bridge->OnChannelConnected(base::GetProcId(aPeerProcess));
       return bridge;
     }
   }

--- a/gfx/layers/ipc/ImageBridgeParent.h
+++ b/gfx/layers/ipc/ImageBridgeParent.h
@@ -23,17 +23,16 @@ class MessageLoop;
 
 namespace base {
 class Thread;
 } // namespace base
 
 namespace mozilla {
 namespace ipc {
 class Shmem;
-class GeckoChildProcessHost;
 } // namespace ipc
 
 namespace layers {
 
 /**
  * ImageBridgeParent is the manager Protocol of ImageContainerParent.
  * It's purpose is mainly to setup the IPDL connection. Most of the
  * interesting stuff is in ImageContainerParent.
@@ -50,17 +49,17 @@ public:
   ImageBridgeParent(MessageLoop* aLoop, Transport* aTransport, ProcessId aChildProcessId);
   ~ImageBridgeParent();
 
   virtual ShmemAllocator* AsShmemAllocator() override { return this; }
 
   virtual void ActorDestroy(ActorDestroyReason aWhy) override;
 
   static PImageBridgeParent*
-  Create(Transport* aTransport, ProcessId aChildProcessId, ipc::GeckoChildProcessHost* aProcessHost);
+  Create(Transport* aTransport, ProcessId aChildProcessId);
 
   // CompositableParentManager
   virtual void SendAsyncMessage(const InfallibleTArray<AsyncParentMessageData>& aMessage) override;
 
   virtual void NotifyNotUsed(PTextureParent* aTexture, uint64_t aTransactionId) override;
 
   virtual base::ProcessId GetChildProcessId() override
   {
@@ -150,18 +149,16 @@ private:
   Transport* mTransport;
   // This keeps us alive until ActorDestroy(), at which point we do a
   // deferred destruction of ourselves.
   RefPtr<ImageBridgeParent> mSelfRef;
 
   bool mSetChildThreadPriority;
   bool mClosed;
 
-  ipc::GeckoChildProcessHost* mSubprocess;
-
   /**
    * Map of all living ImageBridgeParent instances
    */
   static std::map<base::ProcessId, ImageBridgeParent*> sImageBridges;
 
   static MessageLoop* sMainLoop;
 
   RefPtr<CompositorThreadHolder> mCompositorThreadHolder;

--- a/gfx/ycbcr/yuv_convert_arm.cpp
+++ b/gfx/ycbcr/yuv_convert_arm.cpp
@@ -11,17 +11,21 @@
 
 #ifdef HAVE_YCBCR_TO_RGB565
 
 namespace mozilla {
 
 namespace gfx {
 
 #  if defined(MOZILLA_MAY_SUPPORT_NEON)
+#  if defined(__clang__)
+void __attribute((noinline))
+#  else
 void __attribute((noinline,optimize("-fomit-frame-pointer")))
+#  endif
     yuv42x_to_rgb565_row_neon(uint16 *dst,
                               const uint8 *y,
                               const uint8 *u,
                               const uint8 *v,
                               int n,
                               int oddflag)
 {
     static __attribute__((aligned(16))) uint16 acc_r[8] = {

--- a/ipc/chromium/moz.build
+++ b/ipc/chromium/moz.build
@@ -22,22 +22,20 @@ UNIFIED_SOURCES += [
     'src/base/revocable_store.cc',
     'src/base/string_piece.cc',
     'src/base/string_util.cc',
     'src/base/thread.cc',
     'src/base/time.cc',
     'src/base/timer.cc',
     'src/chrome/common/child_process.cc',
     'src/chrome/common/child_process_host.cc',
-    'src/chrome/common/child_process_info.cc',
     'src/chrome/common/child_thread.cc',
     'src/chrome/common/chrome_switches.cc',
     'src/chrome/common/ipc_channel.cc',
     'src/chrome/common/ipc_message.cc',
-    'src/chrome/common/notification_service.cc',
 ]
 
 if os_win:
     SOURCES += [
         'src/base/condition_variable_win.cc',
         'src/base/cpu.cc',
         'src/base/file_util_win.cc',
         'src/base/lock_impl_win.cc',
@@ -49,17 +47,16 @@ if os_win:
         'src/base/process_win.cc',
         'src/base/rand_util_win.cc',
         'src/base/shared_memory_win.cc',
         'src/base/sys_info_win.cc',
         'src/base/sys_string_conversions_win.cc',
         'src/base/thread_local_storage_win.cc',
         'src/base/thread_local_win.cc',
         'src/base/time_win.cc',
-        'src/base/waitable_event_watcher_win.cc',
         'src/base/waitable_event_win.cc',
         'src/base/win_util.cc',
         'src/chrome/common/ipc_channel_win.cc',
         'src/chrome/common/process_watcher_win.cc',
         'src/chrome/common/transport_dib_win.cc',
     ]
 elif not CONFIG['MOZ_SYSTEM_LIBEVENT']:
     DIRS += ['src/third_party']
@@ -77,17 +74,16 @@ if os_posix:
         'src/base/process_util_posix.cc',
         'src/base/rand_util_posix.cc',
         'src/base/shared_memory_posix.cc',
         'src/base/string16.cc',
         'src/base/sys_info_posix.cc',
         'src/base/thread_local_posix.cc',
         'src/base/thread_local_storage_posix.cc',
         'src/base/waitable_event_posix.cc',
-        'src/base/waitable_event_watcher_posix.cc',
         'src/chrome/common/file_descriptor_set_posix.cc',
         'src/chrome/common/ipc_channel_posix.cc',
         'src/chrome/common/process_watcher_posix_sigchld.cc',
     ]
 
 if os_macosx:
     UNIFIED_SOURCES += [
         'src/base/chrome_application_mac.mm',

--- a/ipc/chromium/src/base/waitable_event.h
+++ b/ipc/chromium/src/base/waitable_event.h
@@ -49,26 +49,16 @@ class TimeDelta;
 class WaitableEvent {
  public:
   // If manual_reset is true, then to set the event state to non-signaled, a
   // consumer must call the Reset method.  If this parameter is false, then the
   // system automatically resets the event state to non-signaled after a single
   // waiting thread has been released.
   WaitableEvent(bool manual_reset, bool initially_signaled);
 
-#if defined(OS_WIN)
-  // Create a WaitableEvent from an Event HANDLE which has already been
-  // created. This objects takes ownership of the HANDLE and will close it when
-  // deleted.
-  explicit WaitableEvent(HANDLE event_handle);
-
-  // Releases ownership of the handle from this object.
-  HANDLE Release();
-#endif
-
   ~WaitableEvent();
 
   // Put the event in the un-signaled state.
   void Reset();
 
   // Put the event in the signaled state.  Causing any thread blocked on Wait
   // to be woken up.
   void Signal();

deleted file mode 100644
--- a/ipc/chromium/src/base/waitable_event_watcher.h
+++ /dev/null
@@ -1,156 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_WAITABLE_EVENT_WATCHER_H_
-#define BASE_WAITABLE_EVENT_WATCHER_H_
-
-#include "build/build_config.h"
-
-#if defined(OS_WIN)
-#include "base/object_watcher.h"
-#else
-#include "base/message_loop.h"
-#include "base/waitable_event.h"
-#include "nsAutoPtr.h"
-#endif
-
-namespace base {
-
-class Flag;
-class AsyncWaiter;
-class AsyncCallbackTask;
-class WaitableEvent;
-
-// -----------------------------------------------------------------------------
-// This class provides a way to wait on a WaitableEvent asynchronously.
-//
-// Each instance of this object can be waiting on a single WaitableEvent. When
-// the waitable event is signaled, a callback is made in the thread of a given
-// MessageLoop. This callback can be deleted by deleting the waiter.
-//
-// Typical usage:
-//
-//   class MyClass : public base::WaitableEventWatcher::Delegate {
-//    public:
-//     void DoStuffWhenSignaled(WaitableEvent *waitable_event) {
-//       watcher_.StartWatching(waitable_event, this);
-//     }
-//     virtual void OnWaitableEventSignaled(WaitableEvent* waitable_event) {
-//       // OK, time to do stuff!
-//     }
-//    private:
-//     base::WaitableEventWatcher watcher_;
-//   };
-//
-// In the above example, MyClass wants to "do stuff" when waitable_event
-// becomes signaled. WaitableEventWatcher makes this task easy. When MyClass
-// goes out of scope, the watcher_ will be destroyed, and there is no need to
-// worry about OnWaitableEventSignaled being called on a deleted MyClass
-// pointer.
-//
-// BEWARE: With automatically reset WaitableEvents, a signal may be lost if it
-// occurs just before a WaitableEventWatcher is deleted. There is currently no
-// safe way to stop watching an automatic reset WaitableEvent without possibly
-// missing a signal.
-//
-// NOTE: you /are/ allowed to delete the WaitableEvent while still waiting on
-// it with a Watcher. It will act as if the event was never signaled.
-// -----------------------------------------------------------------------------
-
-class WaitableEventWatcher
-#if defined(OS_POSIX)
-    : public MessageLoop::DestructionObserver
-#endif
-{
- public:
-
-  WaitableEventWatcher();
-  ~WaitableEventWatcher();
-
-  class Delegate {
-   public:
-    virtual ~Delegate() { }
-
-    // -------------------------------------------------------------------------
-    // This is called on the MessageLoop thread when WaitableEvent has been
-    // signaled.
-    //
-    // Note: the event may not be signaled by the time that this function is
-    // called. This indicates only that it has been signaled at some point in
-    // the past.
-    // -------------------------------------------------------------------------
-    virtual void OnWaitableEventSignaled(WaitableEvent* waitable_event) = 0;
-  };
-
-  // ---------------------------------------------------------------------------
-  // When @event is signaled, the given delegate is called on the thread of the
-  // current message loop when StartWatching is called. The delegate is not
-  // deleted.
-  // ---------------------------------------------------------------------------
-  bool StartWatching(WaitableEvent* event, Delegate* delegate);
-
-  // ---------------------------------------------------------------------------
-  // Cancel the current watch. Must be called from the same thread which
-  // started the watch.
-  //
-  // Does nothing if no event is being watched, nor if the watch has completed.
-  // The delegate will *not* be called for the current watch after this
-  // function returns. Since the delegate runs on the same thread as this
-  // function, it cannot be called during this function either.
-  // ---------------------------------------------------------------------------
-  void StopWatching();
-
-  // ---------------------------------------------------------------------------
-  // Return the currently watched event, or NULL if no object is currently being
-  // watched.
-  // ---------------------------------------------------------------------------
-  WaitableEvent* GetWatchedEvent();
-
- private:
-  WaitableEvent* event_;
-
-#if defined(OS_WIN)
-  // ---------------------------------------------------------------------------
-  // The helper class exists because, if WaitableEventWatcher were to inherit
-  // from ObjectWatcher::Delegate, then it couldn't also have an inner class
-  // called Delegate (at least on Windows). Thus this object exists to proxy
-  // the callback function
-  // ---------------------------------------------------------------------------
-  class ObjectWatcherHelper : public ObjectWatcher::Delegate {
-   public:
-    ObjectWatcherHelper(WaitableEventWatcher* watcher);
-
-    // -------------------------------------------------------------------------
-    // Implementation of ObjectWatcher::Delegate
-    // -------------------------------------------------------------------------
-    void OnObjectSignaled(HANDLE h);
-
-   private:
-    WaitableEventWatcher *const watcher_;
-  };
-
-  void OnObjectSignaled();
-
-  Delegate* delegate_;
-  ObjectWatcherHelper helper_;
-  ObjectWatcher watcher_;
-#else
-  // ---------------------------------------------------------------------------
-  // Implementation of MessageLoop::DestructionObserver
-  // ---------------------------------------------------------------------------
-  void WillDestroyCurrentMessageLoop();
-
-  MessageLoop* message_loop_;
-  RefPtr<Flag> cancel_flag_;
-  AsyncWaiter* waiter_;
-  RefPtr<AsyncCallbackTask> callback_task_;
-  RefPtr<WaitableEvent::WaitableEventKernel> kernel_;
-#endif
-};
-
-}  // namespace base
-
-#endif  // BASE_WAITABLE_EVENT_WATCHER_H_

deleted file mode 100644
--- a/ipc/chromium/src/base/waitable_event_watcher_posix.cc
+++ /dev/null
@@ -1,287 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "base/waitable_event_watcher.h"
-
-#include "base/condition_variable.h"
-#include "base/lock.h"
-#include "base/message_loop.h"
-#include "base/waitable_event.h"
-
-#include "nsISupportsImpl.h"
-#include "nsAutoPtr.h"
-#include "mozilla/Attributes.h"
-
-namespace base {
-
-// -----------------------------------------------------------------------------
-// WaitableEventWatcher (async waits).
-//
-// The basic design is that we add an AsyncWaiter to the wait-list of the event.
-// That AsyncWaiter has a pointer to MessageLoop, and a Task to be posted to it.
-// The MessageLoop ends up running the task, which calls the delegate.
-//
-// Since the wait can be canceled, we have a thread-safe Flag object which is
-// set when the wait has been canceled. At each stage in the above, we check the
-// flag before going onto the next stage. Since the wait may only be canceled in
-// the MessageLoop which runs the Task, we are assured that the delegate cannot
-// be called after canceling...
-
-// -----------------------------------------------------------------------------
-// A thread-safe, reference-counted, write-once flag.
-// -----------------------------------------------------------------------------
-class Flag final {
- public:
-  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(Flag)
-  Flag() { flag_ = false; }
-
-  void Set() {
-    AutoLock locked(lock_);
-    flag_ = true;
-  }
-
-  bool value() const {
-    AutoLock locked(lock_);
-    return flag_;
-  }
-
- protected:
-  ~Flag() {}
- private:
-  mutable Lock lock_;
-  bool flag_;
-};
-
-// -----------------------------------------------------------------------------
-// This is an asynchronous waiter which posts a task to a MessageLoop when
-// fired. An AsyncWaiter may only be in a single wait-list.
-// -----------------------------------------------------------------------------
-class AsyncWaiter final : public WaitableEvent::Waiter {
- public:
-  AsyncWaiter(MessageLoop* message_loop,
-              already_AddRefed<mozilla::Runnable> task, Flag* flag)
-      : message_loop_(message_loop),
-        cb_task_(task),
-        flag_(flag) { }
-
-  bool Fire(WaitableEvent* event) {
-    if (flag_->value()) {
-      // If the callback has been canceled, we don't enqueue the task, we just
-      // delete it instead.
-      cb_task_ = nullptr;
-    } else {
-      message_loop_->PostTask(cb_task_.forget());
-    }
-
-    // We are removed from the wait-list by the WaitableEvent itself. It only
-    // remains to delete ourselves.
-    delete this;
-
-    // We can always return true because an AsyncWaiter is never in two
-    // different wait-lists at the same time.
-    return true;
-  }
-
-  // See StopWatching for discussion
-  bool Compare(void* tag) {
-    return tag == flag_.get();
-  }
-
- private:
-  MessageLoop *const message_loop_;
-  RefPtr<mozilla::Runnable> cb_task_;
-  RefPtr<Flag> flag_;
-};
-
-// -----------------------------------------------------------------------------
-// For async waits we need to make a callback in a MessageLoop thread. We do
-// this by posting this task, which calls the delegate and keeps track of when
-// the event is canceled.
-// -----------------------------------------------------------------------------
-class AsyncCallbackTask : public mozilla::Runnable {
- public:
-  AsyncCallbackTask(Flag* flag, WaitableEventWatcher::Delegate* delegate,
-                    WaitableEvent* event)
-      : flag_(flag),
-        delegate_(delegate),
-        event_(event) {
-  }
-
-  NS_IMETHOD Run() override {
-    // Runs in MessageLoop thread.
-    if (!flag_->value()) {
-      // This is to let the WaitableEventWatcher know that the event has occured
-      // because it needs to be able to return NULL from GetWatchedObject
-      flag_->Set();
-      delegate_->OnWaitableEventSignaled(event_);
-    }
-
-    return NS_OK;
-    // We are deleted by the MessageLoop
-  }
-
- private:
-  RefPtr<Flag> flag_;
-  WaitableEventWatcher::Delegate *const delegate_;
-  WaitableEvent *const event_;
-};
-
-WaitableEventWatcher::WaitableEventWatcher()
-    : event_(NULL),
-      message_loop_(NULL),
-      cancel_flag_(NULL) {
-}
-
-WaitableEventWatcher::~WaitableEventWatcher() {
-  StopWatching();
-}
-
-// -----------------------------------------------------------------------------
-// The Handle is how the user cancels a wait. After deleting the Handle we
-// insure that the delegate cannot be called.
-// -----------------------------------------------------------------------------
-bool WaitableEventWatcher::StartWatching
-    (WaitableEvent* event, WaitableEventWatcher::Delegate* delegate) {
-  MessageLoop *const current_ml = MessageLoop::current();
-  DCHECK(current_ml) << "Cannot create WaitableEventWatcher without a "
-                        "current MessageLoop";
-
-  // A user may call StartWatching from within the callback function. In this
-  // case, we won't know that we have finished watching, expect that the Flag
-  // will have been set in AsyncCallbackTask::Run()
-  if (cancel_flag_.get() && cancel_flag_->value()) {
-    if (message_loop_) {
-      message_loop_->RemoveDestructionObserver(this);
-      message_loop_ = NULL;
-    }
-
-    cancel_flag_ = NULL;
-  }
-
-  DCHECK(!cancel_flag_.get()) << "StartWatching called while still watching";
-
-  cancel_flag_ = new Flag;
-  callback_task_ = new AsyncCallbackTask(cancel_flag_, delegate, event);
-  WaitableEvent::WaitableEventKernel* kernel = event->kernel_.get();
-
-  AutoLock locked(kernel->lock_);
-
-  if (kernel->signaled_) {
-    if (!kernel->manual_reset_)
-      kernel->signaled_ = false;
-
-    // No hairpinning - we can't call the delegate directly here. We have to
-    // enqueue a task on the MessageLoop as normal.
-    RefPtr<AsyncCallbackTask> addrefedTask = callback_task_;
-    current_ml->PostTask(addrefedTask.forget());
-    return true;
-  }
-
-  message_loop_ = current_ml;
-  current_ml->AddDestructionObserver(this);
-
-  event_ = event;
-  kernel_ = kernel;
-  RefPtr<AsyncCallbackTask> addrefedTask = callback_task_;
-  waiter_ = new AsyncWaiter(current_ml, addrefedTask.forget(), cancel_flag_);
-  event->Enqueue(waiter_);
-
-  return true;
-}
-
-void WaitableEventWatcher::StopWatching() {
-  if (message_loop_) {
-    message_loop_->RemoveDestructionObserver(this);
-    message_loop_ = NULL;
-  }
-
-  if (!cancel_flag_.get())  // if not currently watching...
-    return;
-
-  if (cancel_flag_->value()) {
-    // In this case, the event has fired, but we haven't figured that out yet.
-    // The WaitableEvent may have been deleted too.
-    cancel_flag_ = NULL;
-    return;
-  }
-
-  if (!kernel_.get()) {
-    // We have no kernel. This means that we never enqueued a Waiter on an
-    // event because the event was already signaled when StartWatching was
-    // called.
-    //
-    // In this case, a task was enqueued on the MessageLoop and will run.
-    // We set the flag in case the task hasn't yet run. The flag will stop the
-    // delegate getting called. If the task has run then we have the last
-    // reference to the flag and it will be deleted immedately after.
-    cancel_flag_->Set();
-    cancel_flag_ = NULL;
-    return;
-  }
-
-  AutoLock locked(kernel_->lock_);
-  // We have a lock on the kernel. No one else can signal the event while we
-  // have it.
-
-  // We have a possible ABA issue here. If Dequeue was to compare only the
-  // pointer values then it's possible that the AsyncWaiter could have been
-  // fired, freed and the memory reused for a different Waiter which was
-  // enqueued in the same wait-list. We would think that that waiter was our
-  // AsyncWaiter and remove it.
-  //
-  // To stop this, Dequeue also takes a tag argument which is passed to the
-  // virtual Compare function before the two are considered a match. So we need
-  // a tag which is good for the lifetime of this handle: the Flag. Since we
-  // have a reference to the Flag, its memory cannot be reused while this object
-  // still exists. So if we find a waiter with the correct pointer value, and
-  // which shares a Flag pointer, we have a real match.
-  if (kernel_->Dequeue(waiter_, cancel_flag_.get())) {
-    // Case 2: the waiter hasn't been signaled yet; it was still on the wait
-    // list. We've removed it, thus we can delete it and the task (which cannot
-    // have been enqueued with the MessageLoop because the waiter was never
-    // signaled)
-    delete waiter_;
-    callback_task_ = nullptr;
-    cancel_flag_ = NULL;
-    return;
-  }
-
-  // Case 3: the waiter isn't on the wait-list, thus it was signaled. It may
-  // not have run yet, so we set the flag to tell it not to bother enqueuing the
-  // task on the MessageLoop, but to delete it instead. The Waiter deletes
-  // itself once run.
-  cancel_flag_->Set();
-  cancel_flag_ = NULL;
-
-  // If the waiter has already run then the task has been enqueued. If the Task
-  // hasn't yet run, the flag will stop the delegate from getting called. (This
-  // is thread safe because one may only delete a Handle from the MessageLoop
-  // thread.)
-  //
-  // If the delegate has already been called then we have nothing to do. The
-  // task has been deleted by the MessageLoop.
-}
-
-WaitableEvent* WaitableEventWatcher::GetWatchedEvent() {
-  if (!cancel_flag_.get())
-    return NULL;
-
-  if (cancel_flag_->value())
-    return NULL;
-
-  return event_;
-}
-
-// -----------------------------------------------------------------------------
-// This is called when the MessageLoop which the callback will be run it is
-// deleted. We need to cancel the callback as if we had been deleted, but we
-// will still be deleted at some point in the future.
-// -----------------------------------------------------------------------------
-void WaitableEventWatcher::WillDestroyCurrentMessageLoop() {
-  StopWatching();
-}
-
-}  // namespace base

deleted file mode 100644
--- a/ipc/chromium/src/base/waitable_event_watcher_win.cc
+++ /dev/null
@@ -1,62 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "base/waitable_event_watcher.h"
-
-#include "base/compiler_specific.h"
-#include "base/object_watcher.h"
-#include "base/waitable_event.h"
-
-namespace base {
-
-WaitableEventWatcher::ObjectWatcherHelper::ObjectWatcherHelper(
-    WaitableEventWatcher* watcher)
-    : watcher_(watcher) {
-};
-
-void WaitableEventWatcher::ObjectWatcherHelper::OnObjectSignaled(HANDLE h) {
-  watcher_->OnObjectSignaled();
-}
-
-
-WaitableEventWatcher::WaitableEventWatcher()
-    : event_(NULL),
-      ALLOW_THIS_IN_INITIALIZER_LIST(helper_(this)),
-      delegate_(NULL) {
-}
-
-WaitableEventWatcher::~WaitableEventWatcher() {
-}
-
-bool WaitableEventWatcher::StartWatching(WaitableEvent* event,
-                                         Delegate* delegate) {
-  delegate_ = delegate;
-  event_ = event;
-
-  return watcher_.StartWatching(event->handle(), &helper_);
-}
-
-void WaitableEventWatcher::StopWatching() {
-  delegate_ = NULL;
-  event_ = NULL;
-  watcher_.StopWatching();
-}
-
-WaitableEvent* WaitableEventWatcher::GetWatchedEvent() {
-  return event_;
-}
-
-void WaitableEventWatcher::OnObjectSignaled() {
-  WaitableEvent* event = event_;
-  Delegate* delegate = delegate_;
-  event_ = NULL;
-  delegate_ = NULL;
-  DCHECK(event);
-
-  delegate->OnWaitableEventSignaled(event);
-}
-
-}  // namespace base

--- a/ipc/chromium/src/base/waitable_event_win.cc
+++ b/ipc/chromium/src/base/waitable_event_win.cc
@@ -16,31 +16,20 @@ namespace base {
 
 WaitableEvent::WaitableEvent(bool manual_reset, bool signaled)
     : handle_(CreateEvent(NULL, manual_reset, signaled, NULL)) {
   // We're probably going to crash anyways if this is ever NULL, so we might as
   // well make our stack reports more informative by crashing here.
   CHECK(handle_);
 }
 
-WaitableEvent::WaitableEvent(HANDLE handle)
-    : handle_(handle) {
-  CHECK(handle) << "Tried to create WaitableEvent from NULL handle";
-}
-
 WaitableEvent::~WaitableEvent() {
   CloseHandle(handle_);
 }
 
-HANDLE WaitableEvent::Release() {
-  HANDLE rv = handle_;
-  handle_ = INVALID_HANDLE_VALUE;
-  return rv;
-}
-
 void WaitableEvent::Reset() {
   ResetEvent(handle_);
 }
 
 void WaitableEvent::Signal() {
   SetEvent(handle_);
 }
 

--- a/ipc/chromium/src/chrome/common/child_process.cc
+++ b/ipc/chromium/src/chrome/common/child_process.cc
@@ -8,54 +8,23 @@
 
 #include "base/basictypes.h"
 #include "base/string_util.h"
 #include "chrome/common/child_thread.h"
 
 ChildProcess* ChildProcess::child_process_;
 
 ChildProcess::ChildProcess(ChildThread* child_thread)
-    : child_thread_(child_thread),
-      ref_count_(0),
-      shutdown_event_(true, false) {
+    : child_thread_(child_thread) {
   DCHECK(!child_process_);
   child_process_ = this;
   if (child_thread_.get())  // null in unittests.
     child_thread_->Run();
 }
 
 ChildProcess::~ChildProcess() {
   DCHECK(child_process_ == this);
 
-  // Signal this event before destroying the child process.  That way all
-  // background threads can cleanup.
-  // For example, in the renderer the RenderThread instances will be able to
-  // notice shutdown before the render process begins waiting for them to exit.
-  shutdown_event_.Signal();
-
   if (child_thread_.get())
     child_thread_->Stop();
 
   child_process_ = NULL;
 }
-
-void ChildProcess::AddRefProcess() {
-  DCHECK(!child_thread_.get() ||  // null in unittests.
-         MessageLoop::current() == child_thread_->message_loop());
-  ref_count_++;
-}
-
-void ChildProcess::ReleaseProcess() {
-  DCHECK(!child_thread_.get() ||  // null in unittests.
-         MessageLoop::current() == child_thread_->message_loop());
-  DCHECK(ref_count_);
-  DCHECK(child_process_);
-  if (--ref_count_)
-    return;
-
-  if (child_thread_.get())  // null in unittests.
-    child_thread_->OnProcessFinalRelease();
-}
-
-base::WaitableEvent* ChildProcess::GetShutDownEvent() {
-  DCHECK(child_process_);
-  return &child_process_->shutdown_event_;
-}

--- a/ipc/chromium/src/chrome/common/child_process.h
+++ b/ipc/chromium/src/chrome/common/child_process.h
@@ -24,46 +24,23 @@ class ChildProcess {
   // Child processes should have an object that derives from this class.  The
   // constructor will return once ChildThread has started.
   explicit ChildProcess(ChildThread* child_thread);
   virtual ~ChildProcess();
 
   // Getter for this process' main thread.
   ChildThread* child_thread() { return child_thread_.get(); }
 
-  // A global event object that is signalled when the main thread's message
-  // loop exits.  This gives background threads a way to observe the main
-  // thread shutting down.  This can be useful when a background thread is
-  // waiting for some information from the browser process.  If the browser
-  // process goes away prematurely, the background thread can at least notice
-  // the child processes's main thread exiting to determine that it should give
-  // up waiting.
-  // For example, see the renderer code used to implement
-  // webkit_glue::GetCookies.
-  base::WaitableEvent* GetShutDownEvent();
-
-  // These are used for ref-counting the child process.  The process shuts
-  // itself down when the ref count reaches 0.
-  // For example, in the renderer process, generally each tab managed by this
-  // process will hold a reference to the process, and release when closed.
-  void AddRefProcess();
-  void ReleaseProcess();
-
   // Getter for the one ChildProcess object for this process.
   static ChildProcess* current() { return child_process_; }
 
  private:
   // NOTE: make sure that child_thread_ is listed before shutdown_event_, since
   // it depends on it (indirectly through IPC::SyncChannel).
   mozilla::UniquePtr<ChildThread> child_thread_;
 
-  int ref_count_;
-
-  // An event that will be signalled when we shutdown.
-  base::WaitableEvent shutdown_event_;
-
   // The singleton instance for this process.
   static ChildProcess* child_process_;
 
   DISALLOW_EVIL_CONSTRUCTORS(ChildProcess);
 };
 
 #endif  // CHROME_COMMON_CHILD_PROCESS_H__

--- a/ipc/chromium/src/chrome/common/child_process_host.cc
+++ b/ipc/chromium/src/chrome/common/child_process_host.cc
@@ -11,74 +11,27 @@
 #include "base/message_loop.h"
 #include "base/process_util.h"
 #include "base/singleton.h"
 #include "base/waitable_event.h"
 #include "mozilla/ipc/ProcessChild.h"
 #include "mozilla/ipc/BrowserProcessSubThread.h"
 #include "mozilla/ipc/Transport.h"
 typedef mozilla::ipc::BrowserProcessSubThread ChromeThread;
-#include "chrome/common/notification_service.h"
-#include "chrome/common/notification_type.h"
 #include "chrome/common/process_watcher.h"
-#include "chrome/common/result_codes.h"
 
 using mozilla::ipc::FileDescriptor;
 
-namespace {
-typedef std::list<ChildProcessHost*> ChildProcessList;
-
-// The NotificationTask is used to notify about plugin process connection/
-// disconnection. It is needed because the notifications in the
-// NotificationService must happen in the main thread.
-class ChildNotificationTask : public mozilla::Runnable {
- public:
-  ChildNotificationTask(
-      NotificationType notification_type, ChildProcessInfo* info)
-      : notification_type_(notification_type), info_(*info) { }
-
-  NS_IMETHOD Run() {
-    NotificationService::current()->
-        Notify(notification_type_, NotificationService::AllSources(),
-               Details<ChildProcessInfo>(&info_));
-    return NS_OK;
-  }
-
- private:
-  NotificationType notification_type_;
-  ChildProcessInfo info_;
-};
-
-}  // namespace
-
-
-
-ChildProcessHost::ChildProcessHost(ProcessType type)
-    :
-      ChildProcessInfo(type),
-      ALLOW_THIS_IN_INITIALIZER_LIST(listener_(this)),
-      opening_channel_(false),
-      process_event_(nullptr) {
-  Singleton<ChildProcessList>::get()->push_back(this);
+ChildProcessHost::ChildProcessHost()
+    : ALLOW_THIS_IN_INITIALIZER_LIST(listener_(this)),
+      opening_channel_(false) {
 }
 
 
 ChildProcessHost::~ChildProcessHost() {
-  Singleton<ChildProcessList>::get()->remove(this);
-
-  if (handle()) {
-    watcher_.StopWatching();
-    ProcessWatcher::EnsureProcessTerminated(handle());
-
-#if defined(OS_WIN)
-    // Above call took ownership, so don't want WaitableEvent to assert because
-    // the handle isn't valid anymore.
-    process_event_->Release();
-#endif
-  }
 }
 
 bool ChildProcessHost::CreateChannel() {
   channel_id_ = IPC::Channel::GenerateVerifiedChannelID(std::wstring());
   channel_.reset(new IPC::Channel(
       channel_id_, IPC::Channel::MODE_SERVER, &listener_));
   if (!channel_->Connect())
     return false;
@@ -99,121 +52,30 @@ bool ChildProcessHost::CreateChannel(Fil
     return false;
   }
 
   opening_channel_ = true;
 
   return true;
 }
 
-void ChildProcessHost::SetHandle(base::ProcessHandle process) {
-#if defined(OS_WIN)
-  process_event_.reset(new base::WaitableEvent(process));
-
-  DCHECK(!handle());
-  set_handle(process);
-  watcher_.StartWatching(process_event_.get(), this);
-#endif
-}
-
-void ChildProcessHost::InstanceCreated() {
-  Notify(NotificationType(NotificationType::CHILD_INSTANCE_CREATED));
-}
-
-bool ChildProcessHost::Send(IPC::Message* msg) {
-  if (!channel_.get()) {
-    delete msg;
-    return false;
-  }
-  return channel_->Send(msg);
-}
-
-void ChildProcessHost::Notify(NotificationType type) {
-  MessageLoop* loop = ChromeThread::GetMessageLoop(ChromeThread::IO);
-  if (!loop)
-      loop = mozilla::ipc::ProcessChild::message_loop();
-  if (!loop)
-      loop = MessageLoop::current();
-  RefPtr<ChildNotificationTask> task = new ChildNotificationTask(type, this);
-  loop->PostTask(task.forget());
-}
-
-void ChildProcessHost::OnWaitableEventSignaled(base::WaitableEvent *event) {
-#if defined(OS_WIN)
-  HANDLE object = event->handle();
-  DCHECK(handle());
-  DCHECK_EQ(object, handle());
-
-  bool did_crash = base::DidProcessCrash(NULL, object);
-  if (did_crash) {
-    // Report that this child process crashed.
-    Notify(NotificationType(NotificationType::CHILD_PROCESS_CRASHED));
-  }
-  // Notify in the main loop of the disconnection.
-  Notify(NotificationType(NotificationType::CHILD_PROCESS_HOST_DISCONNECTED));
-#endif
-}
-
 ChildProcessHost::ListenerHook::ListenerHook(ChildProcessHost* host)
     : host_(host) {
 }
 
 void ChildProcessHost::ListenerHook::OnMessageReceived(
     IPC::Message&& msg) {
-
-  bool msg_is_ok = true;
-  bool handled = false;
-
-  if (!handled) {
-      host_->OnMessageReceived(mozilla::Move(msg));
-  }
-
-  if (!msg_is_ok)
-    base::KillProcess(host_->handle(), ResultCodes::KILLED_BAD_MESSAGE, false);
-
+  host_->OnMessageReceived(mozilla::Move(msg));
 }
 
 void ChildProcessHost::ListenerHook::OnChannelConnected(int32_t peer_pid) {
   host_->opening_channel_ = false;
   host_->OnChannelConnected(peer_pid);
-
-  // Notify in the main loop of the connection.
-  host_->Notify(NotificationType(NotificationType::CHILD_PROCESS_HOST_CONNECTED));
 }
 
 void ChildProcessHost::ListenerHook::OnChannelError() {
   host_->opening_channel_ = false;
   host_->OnChannelError();
 }
 
 void ChildProcessHost::ListenerHook::GetQueuedMessages(std::queue<IPC::Message>& queue) {
   host_->GetQueuedMessages(queue);
 }
-
-ChildProcessHost::Iterator::Iterator() : all_(true) {
-  iterator_ = Singleton<ChildProcessList>::get()->begin();
-}
-
-ChildProcessHost::Iterator::Iterator(ProcessType type)
-    : all_(false), type_(type) {
-  iterator_ = Singleton<ChildProcessList>::get()->begin();
-  if (!Done() && (*iterator_)->type() != type_)
-    ++(*this);
-}
-
-ChildProcessHost* ChildProcessHost::Iterator::operator++() {
-  do {
-    ++iterator_;
-    if (Done())
-      break;
-
-    if (!all_ && (*iterator_)->type() != type_)
-      continue;
-
-    return *iterator_;
-  } while (true);
-
-  return NULL;
-}
-
-bool ChildProcessHost::Iterator::Done() {
-  return iterator_ == Singleton<ChildProcessList>::get()->end();
-}

--- a/ipc/chromium/src/chrome/common/child_process_host.h
+++ b/ipc/chromium/src/chrome/common/child_process_host.h
@@ -7,102 +7,54 @@
 #ifndef CHROME_COMMON_CHILD_PROCESS_HOST_H_
 #define CHROME_COMMON_CHILD_PROCESS_HOST_H_
 
 #include "build/build_config.h"
 
 #include <list>
 
 #include "base/basictypes.h"
-#include "base/waitable_event_watcher.h"
-#include "chrome/common/child_process_info.h"
 #include "chrome/common/ipc_channel.h"
 #include "mozilla/UniquePtr.h"
 
 namespace mozilla {
 namespace ipc {
 class FileDescriptor;
 }
 }
 
-class NotificationType;
-
 // Plugins/workers and other child processes that live on the IO thread should
 // derive from this class.
-class ChildProcessHost :
-                         public IPC::Message::Sender,
-                         public ChildProcessInfo,
-                         public base::WaitableEventWatcher::Delegate,
-                         public IPC::Channel::Listener {
+class ChildProcessHost : public IPC::Channel::Listener {
  public:
   virtual ~ChildProcessHost();
 
-  // ResourceDispatcherHost::Receiver implementation:
-  virtual bool Send(IPC::Message* msg);
-
-  // The Iterator class allows iteration through either all child processes, or
-  // ones of a specific type, depending on which constructor is used.  Note that
-  // this should be done from the IO thread and that the iterator should not be
-  // kept around as it may be invalidated on subsequent event processing in the
-  // event loop.
-  class Iterator {
-   public:
-    Iterator();
-    explicit Iterator(ProcessType type);
-    ChildProcessHost* operator->() { return *iterator_; }
-    ChildProcessHost* operator*() { return *iterator_; }
-    ChildProcessHost* operator++();
-    bool Done();
-
-   private:
-    bool all_;
-    ProcessType type_;
-    std::list<ChildProcessHost*>::iterator iterator_;
-  };
-
  protected:
-  explicit ChildProcessHost(ProcessType type);
+  explicit ChildProcessHost();
 
   // Derived classes return true if it's ok to shut down the child process.
   virtual bool CanShutdown() = 0;
 
   // Creates the IPC channel.  Returns true iff it succeeded.
   bool CreateChannel();
 
   bool CreateChannel(mozilla::ipc::FileDescriptor& aFileDescriptor);
 
-  // Once the subclass gets a handle to the process, it needs to tell
-  // ChildProcessHost using this function.
-  void SetHandle(base::ProcessHandle handle);
-
-  // Notifies us that an instance has been created on this child process.
-  void InstanceCreated();
-
   // IPC::Channel::Listener implementation:
   virtual void OnMessageReceived(IPC::Message&& msg) { }
   virtual void OnChannelConnected(int32_t peer_pid) { }
   virtual void OnChannelError() { }
 
   bool opening_channel() { return opening_channel_; }
   const std::wstring& channel_id() { return channel_id_; }
 
-  base::WaitableEvent* GetProcessEvent() { return process_event_.get(); }
-
   const IPC::Channel& channel() const { return *channel_; }
   IPC::Channel* channelp() const { return channel_.get(); }
 
  private:
-  // Sends the given notification to the notification service on the UI thread.
-  void Notify(NotificationType type);
-
- protected:
-  // WaitableEventWatcher::Delegate implementation:
-  virtual void OnWaitableEventSignaled(base::WaitableEvent *event);
-
- private:
   // By using an internal class as the IPC::Channel::Listener, we can intercept
   // OnMessageReceived/OnChannelConnected and do our own processing before
   // calling the subclass' implementation.
   class ListenerHook : public IPC::Channel::Listener {
    public:
     explicit ListenerHook(ChildProcessHost* host);
     virtual void OnMessageReceived(IPC::Message&& msg);
     virtual void OnChannelConnected(int32_t peer_pid);
@@ -117,16 +69,11 @@ class ChildProcessHost :
   // True while we're waiting the channel to be opened.
   bool opening_channel_;
 
   // The IPC::Channel.
   mozilla::UniquePtr<IPC::Channel> channel_;
 
   // IPC Channel's id.
   std::wstring channel_id_;
-
-  // Used to watch the child process handle.
-  base::WaitableEventWatcher watcher_;
-
-  mozilla::UniquePtr<base::WaitableEvent> process_event_;
 };
 
 #endif  // CHROME_COMMON_CHILD_PROCESS_HOST_H_

deleted file mode 100644
--- a/ipc/chromium/src/chrome/common/child_process_info.cc
+++ /dev/null
@@ -1,46 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-// Copyright (c) 2009 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chrome/common/child_process_info.h"
-
-#include <limits>
-
-#include "base/logging.h"
-
-std::wstring ChildProcessInfo::GetTypeNameInEnglish(
-    ChildProcessInfo::ProcessType type) {
-  switch (type) {
-    case BROWSER_PROCESS:
-      return L"Browser";
-    case RENDER_PROCESS:
-      return L"Tab";
-    case PLUGIN_PROCESS:
-      return L"Plug-in";
-    case WORKER_PROCESS:
-      return L"Web Worker";
-    case UNKNOWN_PROCESS:
-      default:
-      DCHECK(false) << "Unknown child process type!";
-      return L"Unknown";
-    }
-}
-
-std::wstring ChildProcessInfo::GetLocalizedTitle() const {
-  return name_;
-}
-
-ChildProcessInfo::ChildProcessInfo(ProcessType type) {
-  // This constructor is only used by objects which derive from this class,
-  // which means *this* is a real object that refers to a child process, and not
-  // just a simple object that contains information about it.  So add it to our
-  // list of running processes.
-  type_ = type;
-  pid_ = -1;
-}
-
-
-ChildProcessInfo::~ChildProcessInfo() {
-}
\ No newline at end of file

deleted file mode 100644
--- a/ipc/chromium/src/chrome/common/child_process_info.h
+++ /dev/null
@@ -1,103 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-// Copyright (c) 2009 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CHROME_COMMON_CHILD_PROCESS_INFO_H_
-#define CHROME_COMMON_CHILD_PROCESS_INFO_H_
-
-#include <string>
-
-#include "base/process.h"
-
-// Holds information about a child process.
-class ChildProcessInfo {
- public:
-  enum ProcessType {
-    BROWSER_PROCESS,
-    RENDER_PROCESS,
-    PLUGIN_PROCESS,
-    WORKER_PROCESS,
-    UNKNOWN_PROCESS
-  };
-
-  // Returns the type of the process.
-  ProcessType type() const { return type_; }
-
-  // Returns the name of the process.  i.e. for plugins it might be Flash, while
-  // for workers it might be the domain that it's from.
-  std::wstring name() const { return name_; }
-
-  // Getter to the process handle.
-  base::ProcessHandle handle() const { return process_.handle(); }
-
-  virtual int GetProcessId() const {
-    if (pid_ != -1)
-      return pid_;
-
-    pid_ = process_.pid();
-    return pid_;
-  }
-  void SetProcessBackgrounded() const { process_.SetProcessBackgrounded(true); }
-
-  // Returns an English name of the process type, should only be used for non
-  // user-visible strings, or debugging pages like about:memory.
-  static std::wstring GetTypeNameInEnglish(ProcessType type);
-
-  // Returns a localized title for the child process.  For example, a plugin
-  // process would be "Plug-in: Flash" when name is "Flash".
-  std::wstring GetLocalizedTitle() const;
-
-  ChildProcessInfo(const ChildProcessInfo& original) {
-    type_ = original.type_;
-    name_ = original.name_;
-    process_ = original.process_;
-    pid_ = original.pid_;
-  }
-
-  ChildProcessInfo& operator=(const ChildProcessInfo& original) {
-    if (&original != this) {
-      type_ = original.type_;
-      name_ = original.name_;
-      process_ = original.process_;
-      pid_ = original.pid_;
-    }
-    return *this;
-  }
-
-  virtual ~ChildProcessInfo();
-
-  // We define the < operator so that the ChildProcessInfo can be used as a key
-  // in a std::map.
-  bool operator <(const ChildProcessInfo& rhs) const {
-    if (process_.handle() != rhs.process_.handle())
-      return process_ .handle() < rhs.process_.handle();
-    return false;
-  }
-
-  bool operator ==(const ChildProcessInfo& rhs) const {
-    return process_.handle() == rhs.process_.handle();
-  }
-
- protected:
-  void set_type(ProcessType aType) { type_ = aType; }
-  void set_name(const std::wstring& aName) { name_ = aName; }
-  void set_handle(base::ProcessHandle aHandle) {
-    process_.set_handle(aHandle);
-    pid_ = -1;
-  }
-
-  // Derived objects need to use this constructor so we know what type we are.
-  explicit ChildProcessInfo(ProcessType type);
-
- private:
-  ProcessType type_;
-  std::wstring name_;
-  mutable int pid_;  // Cache of the process id.
-
-  // The handle to the process.
-  mutable base::Process process_;
-};
-
-#endif  // CHROME_COMMON_CHILD_PROCESS_INFO_H_

--- a/ipc/chromium/src/chrome/common/child_thread.cc
+++ b/ipc/chromium/src/chrome/common/child_thread.cc
@@ -6,24 +6,20 @@
 
 #include "chrome/common/child_thread.h"
 
 #include "base/string_util.h"
 #include "base/command_line.h"
 #include "chrome/common/child_process.h"
 #include "chrome/common/chrome_switches.h"
 
-// V8 needs a 1MB stack size.
-const size_t ChildThread::kV8StackSize = 1024 * 1024;
-
 ChildThread::ChildThread(Thread::Options options)
     : Thread("Chrome_ChildThread"),
       owner_loop_(MessageLoop::current()),
-      options_(options),
-      check_with_browser_before_shutdown_(false) {
+      options_(options) {
   DCHECK(owner_loop_);
   channel_name_ = CommandLine::ForCurrentProcess()->GetSwitchValue(
       switches::kProcessChannelID);
 }
 
 ChildThread::~ChildThread() {
 }
 
@@ -50,29 +46,17 @@ void ChildThread::OnChannelError() {
 void ChildThread::MarkThread() {
     NuwaMarkCurrentThread(nullptr, nullptr);
     if (!NuwaCheckpointCurrentThread()) {
         NS_RUNTIMEABORT("Should not be here!");
     }
 }
 #endif
 
-bool ChildThread::Send(IPC::Message* msg) {
-  if (!channel_.get()) {
-    delete msg;
-    return false;
-  }
-
-  return channel_->Send(msg);
-}
-
 void ChildThread::OnMessageReceived(IPC::Message&& msg) {
-  if (msg.routing_id() == MSG_ROUTING_CONTROL) {
-    OnControlMessageReceived(msg);
-  }
 }
 
 ChildThread* ChildThread::current() {
   return ChildProcess::current()->child_thread();
 }
 
 void ChildThread::Init() {
   channel_ = mozilla::MakeUnique<IPC::Channel>(channel_name_,
@@ -81,16 +65,8 @@ void ChildThread::Init() {
 
 }
 
 void ChildThread::CleanUp() {
   // Need to destruct the SyncChannel to the browser before we go away because
   // it caches a pointer to this thread.
   channel_ = nullptr;
 }
-
-void ChildThread::OnProcessFinalRelease() {
-  if (!check_with_browser_before_shutdown_) {
-    RefPtr<mozilla::Runnable> task = new MessageLoop::QuitTask();
-    owner_loop_->PostTask(task.forget());
-    return;
-  }
-}

--- a/ipc/chromium/src/chrome/common/child_thread.h
+++ b/ipc/chromium/src/chrome/common/child_thread.h
@@ -10,50 +10,29 @@
 #include "base/thread.h"
 #include "chrome/common/ipc_channel.h"
 #include "mozilla/UniquePtr.h"
 
 class ResourceDispatcher;
 
 // Child processes's background thread should derive from this class.
 class ChildThread : public IPC::Channel::Listener,
-                    public IPC::Message::Sender,
                     public base::Thread {
  public:
   // Creates the thread.
   explicit ChildThread(Thread::Options options);
   virtual ~ChildThread();
 
-  // IPC::Message::Sender implementation:
-  virtual bool Send(IPC::Message* msg);
-
-  // See documentation on MessageRouter for AddRoute and RemoveRoute
-  void AddRoute(int32_t routing_id, IPC::Channel::Listener* listener);
-  void RemoveRoute(int32_t routing_id);
-
-  MessageLoop* owner_loop() { return owner_loop_; }
-
  protected:
   friend class ChildProcess;
 
   // Starts the thread.
   bool Run();
 
-  // Overrides the channel name.  Used for --single-process mode.
-  void SetChannelName(const std::wstring& name) { channel_name_ = name; }
-
-  // Called when the process refcount is 0.
-  void OnProcessFinalRelease();
-
  protected:
-  // The required stack size if V8 runs on a thread.
-  static const size_t kV8StackSize;
-
-  virtual void OnControlMessageReceived(const IPC::Message& msg) { }
-
   // Returns the one child thread.
   static ChildThread* current();
 
   IPC::Channel* channel() { return channel_.get(); }
 
   // Thread implementation.
   virtual void Init();
   virtual void CleanUp();
@@ -70,17 +49,12 @@ class ChildThread : public IPC::Channel:
   // The message loop used to run tasks on the thread that started this thread.
   MessageLoop* owner_loop_;
 
   std::wstring channel_name_;
   mozilla::UniquePtr<IPC::Channel> channel_;
 
   Thread::Options options_;
 
-  // If true, checks with the browser process before shutdown.  This avoids race
-  // conditions if the process refcount is 0 but there's an IPC message inflight
-  // that would addref it.
-  bool check_with_browser_before_shutdown_;
-
   DISALLOW_EVIL_CONSTRUCTORS(ChildThread);
 };
 
 #endif  // CHROME_COMMON_CHILD_THREAD_H_

--- a/ipc/chromium/src/chrome/common/ipc_channel.h
+++ b/ipc/chromium/src/chrome/common/ipc_channel.h
@@ -11,17 +11,17 @@
 
 #include <queue>
 #include "chrome/common/ipc_message.h"
 
 namespace IPC {
 
 //------------------------------------------------------------------------------
 
-class Channel : public Message::Sender {
+class Channel {
   // Security tests need access to the pipe handle.
   friend class ChannelTest;
 
  public:
   // Implemented by consumers of a Channel to receive messages.
   class Listener {
    public:
     virtual ~Listener() {}
@@ -100,17 +100,17 @@ class Channel : public Message::Sender {
 
   // Send a message over the Channel to the listener on the other end.
   //
   // |message| must be allocated using operator new.  This object will be
   // deleted once the contents of the Message have been sent.
   //
   // If you Send() a message on a Close()'d channel, we delete the message
   // immediately.
-  virtual bool Send(Message* message) override;
+  bool Send(Message* message);
 
   // Unsound_IsClosed() and Unsound_NumQueuedMessages() are safe to call from
   // any thread, but the value returned may be out of date, because we don't
   // use any synchronization when reading or writing it.
   bool Unsound_IsClosed() const;
   uint32_t Unsound_NumQueuedMessages() const;
 
 #if defined(OS_POSIX)

--- a/ipc/chromium/src/chrome/common/ipc_message.h
+++ b/ipc/chromium/src/chrome/common/ipc_message.h
@@ -33,28 +33,16 @@ namespace IPC {
 class Channel;
 class Message;
 struct LogData;
 
 class Message : public Pickle {
  public:
   typedef uint32_t msgid_t;
 
-  // Implemented by objects that can send IPC messages across a channel.
-  class Sender {
-   public:
-    virtual ~Sender() {}
-
-    // Sends the given IPC message.  The implementor takes ownership of the
-    // given Message regardless of whether or not this method succeeds.  This
-    // is done to make this method easier to use.  Returns true on success and
-    // false otherwise.
-    virtual bool Send(Message* msg) = 0;
-  };
-
   enum PriorityValue {
     PRIORITY_NORMAL = 1,
     PRIORITY_HIGH = 2,
     PRIORITY_URGENT = 3
   };
 
   enum MessageCompression {
     COMPRESSION_NONE,

deleted file mode 100644
--- a/ipc/chromium/src/chrome/common/notification_details.h
+++ /dev/null
@@ -1,54 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// This file defines the type used to provide details for NotificationService
-// notifications.
-
-#ifndef CHROME_COMMON_NOTIFICATION_DETAILS_H__
-#define CHROME_COMMON_NOTIFICATION_DETAILS_H__
-
-#include "base/basictypes.h"
-
-// Do not declare a NotificationDetails directly--use either
-// "Details<detailsclassname>(detailsclasspointer)" or
-// NotificationService::NoDetails().
-class NotificationDetails {
- public:
-  NotificationDetails() : ptr_(NULL) {}
-  NotificationDetails(const NotificationDetails& other) : ptr_(other.ptr_) {}
-  ~NotificationDetails() {}
-
-  // NotificationDetails can be used as the index for a map; this method
-  // returns the pointer to the current details as an identifier, for use as a
-  // map index.
-  uintptr_t map_key() const { return reinterpret_cast<uintptr_t>(ptr_); }
-
-  bool operator!=(const NotificationDetails& other) const {
-    return ptr_ != other.ptr_;
-  }
-
-  bool operator==(const NotificationDetails& other) const {
-    return ptr_ == other.ptr_;
-  }
-
- protected:
-  explicit NotificationDetails(void* ptr) : ptr_(ptr) {}
-
-  void* ptr_;
-};
-
-template <class T>
-class Details : public NotificationDetails {
- public:
-  explicit Details(T* ptr) : NotificationDetails(ptr) {}
-  explicit Details(const NotificationDetails& other)
-    : NotificationDetails(other) {}
-
-  T* operator->() const { return ptr(); }
-  T* ptr() const { return static_cast<T*>(ptr_); }
-};
-
-#endif  // CHROME_COMMON_NOTIFICATION_DETAILS_H__

deleted file mode 100644
--- a/ipc/chromium/src/chrome/common/notification_observer.h
+++ /dev/null
@@ -1,25 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-// Copyright (c) 2009 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CHROME_COMMON_NOTIFICATION_OBSERVER_H_
-#define CHROME_COMMON_NOTIFICATION_OBSERVER_H_
-
-class NotificationDetails;
-class NotificationSource;
-class NotificationType;
-
-// This is the base class for notification observers. When a matching
-// notification is posted to the notification service, Observe is called.
-class NotificationObserver {
- public:
-  virtual ~NotificationObserver();
-
-  virtual void Observe(NotificationType type,
-                       const NotificationSource& source,
-                       const NotificationDetails& details) = 0;
-};
-
-#endif  // CHROME_COMMON_NOTIFICATION_OBSERVER_H_

deleted file mode 100644
--- a/ipc/chromium/src/chrome/common/notification_registrar.h
+++ /dev/null
@@ -1,55 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CHROME_COMMON_NOTIFICATION_REGISTRAR_H_
-#define CHROME_COMMON_NOTIFICATION_REGISTRAR_H_
-
-#include <vector>
-
-#include "base/basictypes.h"
-#include "chrome/common/notification_observer.h"
-
-// Aids in registering for notifications and ensures that all registered
-// notifications are unregistered when the class is destroyed.
-//
-// The intended use is that you make a NotificationRegistrar member in your
-// class and use it to register your notifications instead of going through the
-// notification service directly. It will automatically unregister them for
-// you.
-class NotificationRegistrar {
- public:
-  // This class must not be derived from (we don't have a virtual destructor so
-  // it won't work). Instead, use it as a member in your class.
-  NotificationRegistrar();
-  ~NotificationRegistrar();
-
-  // Wrappers around NotificationService::[Add|Remove]Observer.
-  void Add(NotificationObserver* observer,
-           NotificationType type,
-           const NotificationSource& source);
-  void Remove(NotificationObserver* observer,
-              NotificationType type,
-              const NotificationSource& source);
-
-  // Unregisters all notifications.
-  void RemoveAll();
-
- private:
-  struct Record;
-
-  // We keep registered notifications in a simple vector. This means we'll do
-  // brute-force searches when removing them individually, but individual
-  // removal is uncommon, and there will typically only be a couple of
-  // notifications anyway.
-  typedef std::vector<Record> RecordVector;
-
-  // Lists all notifications we're currently registered for.
-  RecordVector registered_;
-
-  DISALLOW_COPY_AND_ASSIGN(NotificationRegistrar);
-};
-
-#endif  // CHROME_COMMON_NOTIFICATION_REGISTRAR_H_

deleted file mode 100644
--- a/ipc/chromium/src/chrome/common/notification_service.cc
+++ /dev/null
@@ -1,145 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chrome/common/notification_service.h"
-#include "base/thread_local.h"
-
-static base::ThreadLocalPointer<NotificationService>& get_tls_ptr() {
-  static base::ThreadLocalPointer<NotificationService> tls_ptr;
-  return tls_ptr;
-}
-
-// static
-NotificationService* NotificationService::current() {
-  return get_tls_ptr().Get();
-}
-
-// static
-bool NotificationService::HasKey(const NotificationSourceMap& map,
-                                 const NotificationSource& source) {
-  return map.find(source.map_key()) != map.end();
-}
-
-NotificationService::NotificationService() {
-  DCHECK(current() == NULL);
-#ifndef NDEBUG
-  memset(observer_counts_, 0, sizeof(observer_counts_));
-#endif
-
-  get_tls_ptr().Set(this);
-}
-
-void NotificationService::AddObserver(NotificationObserver* observer,
-                                      NotificationType type,
-                                      const NotificationSource& source) {
-  DCHECK(type.value < NotificationType::NOTIFICATION_TYPE_COUNT);
-
-  // We have gotten some crashes where the observer pointer is NULL. The problem
-  // is that this happens when we actually execute a notification, so have no
-  // way of knowing who the bad observer was. We want to know when this happens
-  // in release mode so we know what code to blame the crash on (since this is
-  // guaranteed to crash later).
-  CHECK(observer);
-
-  NotificationObserverList* observer_list;
-  if (HasKey(observers_[type.value], source)) {
-    observer_list = observers_[type.value][source.map_key()];
-  } else {
-    observer_list = new NotificationObserverList;
-    observers_[type.value][source.map_key()] = observer_list;
-  }
-
-  observer_list->AddObserver(observer);
-#ifndef NDEBUG
-  ++observer_counts_[type.value];
-#endif
-}
-
-void NotificationService::RemoveObserver(NotificationObserver* observer,
-                                         NotificationType type,
-                                         const NotificationSource& source) {
-  DCHECK(type.value < NotificationType::NOTIFICATION_TYPE_COUNT);
-  DCHECK(HasKey(observers_[type.value], source));
-
-  NotificationObserverList* observer_list =
-      observers_[type.value][source.map_key()];
-  if (observer_list) {
-    observer_list->RemoveObserver(observer);
-#ifndef NDEBUG
-    --observer_counts_[type.value];
-#endif
-  }
-
-  // TODO(jhughes): Remove observer list from map if empty?
-}
-
-void NotificationService::Notify(NotificationType type,
-                                 const NotificationSource& source,
-                                 const NotificationDetails& details) {
-  DCHECK(type.value > NotificationType::ALL) <<
-      "Allowed for observing, but not posting.";
-  DCHECK(type.value < NotificationType::NOTIFICATION_TYPE_COUNT);
-
-  // There's no particular reason for the order in which the different
-  // classes of observers get notified here.
-
-  // Notify observers of all types and all sources
-  if (HasKey(observers_[NotificationType::ALL], AllSources()) &&
-      source != AllSources()) {
-    FOR_EACH_OBSERVER(NotificationObserver,
-       *observers_[NotificationType::ALL][AllSources().map_key()],
-       Observe(type, source, details));
-  }
-
-  // Notify observers of all types and the given source
-  if (HasKey(observers_[NotificationType::ALL], source)) {
-    FOR_EACH_OBSERVER(NotificationObserver,
-        *observers_[NotificationType::ALL][source.map_key()],
-        Observe(type, source, details));
-  }
-
-  // Notify observers of the given type and all sources
-  if (HasKey(observers_[type.value], AllSources()) &&
-      source != AllSources()) {
-    FOR_EACH_OBSERVER(NotificationObserver,
-                      *observers_[type.value][AllSources().map_key()],
-                      Observe(type, source, details));
-  }
-
-  // Notify observers of the given type and the given source
-  if (HasKey(observers_[type.value], source)) {
-    FOR_EACH_OBSERVER(NotificationObserver,
-                      *observers_[type.value][source.map_key()],
-                      Observe(type, source, details));
-  }
-}
-
-
-NotificationService::~NotificationService() {
-  get_tls_ptr().Set(NULL);
-
-#ifndef NDEBUG
-  for (int i = 0; i < NotificationType::NOTIFICATION_TYPE_COUNT; i++) {
-    if (observer_counts_[i] > 0) {
-      // This may not be completely fixable -- see
-      // http://code.google.com/p/chromium/issues/detail?id=11010 .
-      // But any new leaks should be fixed.
-      CHROMIUM_LOG(WARNING) << observer_counts_[i] << " notification observer(s) leaked"
-                            << " of notification type " << i;
-    }
-  }
-#endif
-
-  for (int i = 0; i < NotificationType::NOTIFICATION_TYPE_COUNT; i++) {
-    NotificationSourceMap omap = observers_[i];
-    for (NotificationSourceMap::iterator it = omap.begin();
-         it != omap.end(); ++it) {
-      delete it->second;
-    }
-  }
-}
-
-NotificationObserver::~NotificationObserver() {}

deleted file mode 100644
--- a/ipc/chromium/src/chrome/common/notification_service.h
+++ /dev/null
@@ -1,102 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// This file describes a central switchboard for notifications that might
-// happen in various parts of the application, and allows users to register
-// observers for various classes of events that they're interested in.
-
-#ifndef CHROME_COMMON_NOTIFICATION_SERVICE_H_
-#define CHROME_COMMON_NOTIFICATION_SERVICE_H_
-
-#include <map>
-
-#include "base/observer_list.h"
-#include "chrome/common/notification_details.h"
-#include "chrome/common/notification_observer.h"
-#include "chrome/common/notification_source.h"
-#include "chrome/common/notification_type.h"
-
-class NotificationObserver;
-
-class NotificationService {
- public:
-  // Returns the NotificationService object for the current thread, or NULL if
-  // none.
-  static NotificationService* current();
-
-  // Normally instantiated when the thread is created.  Not all threads have
-  // a NotificationService.  Only one instance should be created per thread.
-  NotificationService();
-  ~NotificationService();
-
-  // Registers a NotificationObserver to be called whenever a matching
-  // notification is posted.  Observer is a pointer to an object subclassing
-  // NotificationObserver to be notified when an event matching the other two
-  // parameters is posted to this service.  Type is the type of events to
-  // be notified about (or NOTIFY_ALL to receive events of all types).
-  // Source is a NotificationSource object (created using
-  // "Source<classname>(pointer)"), if this observer only wants to
-  // receive events from that object, or NotificationService::AllSources()
-  // to receive events from all sources.
-  //
-  // A given observer can be registered only once for each combination of
-  // type and source.  If the same object is registered more than once,
-  // it must be removed for each of those combinations of type and source later.
-  //
-  // The caller retains ownership of the object pointed to by observer.
-  void AddObserver(NotificationObserver* observer,
-                   NotificationType type, const NotificationSource& source);
-
-  // Removes the object pointed to by observer from receiving notifications
-  // that match type and source.  If no object matching the parameters is
-  // currently registered, this method is a no-op.
-  void RemoveObserver(NotificationObserver* observer,
-                      NotificationType type, const NotificationSource& source);
-
-  // Synchronously posts a notification to all interested observers.
-  // Source is a reference to a NotificationSource object representing
-  // the object originating the notification (can be
-  // NotificationService::AllSources(), in which case
-  // only observers interested in all sources will be notified).
-  // Details is a reference to an object containing additional data about
-  // the notification.  If no additional data is needed, NoDetails() is used.
-  // There is no particular order in which the observers will be notified.
-  void Notify(NotificationType type,
-              const NotificationSource& source,
-              const NotificationDetails& details);
-
-  // Returns a NotificationSource that represents all notification sources
-  // (for the purpose of registering an observer for events from all sources).
-  static Source<void> AllSources() { return Source<void>(NULL); }
-
-  // Returns a NotificationDetails object that represents a lack of details
-  // associated with a notification.  (This is effectively a null pointer.)
-  static Details<void> NoDetails() { return Details<void>(NULL); }
-
- private:
-  typedef base::ObserverList<NotificationObserver> NotificationObserverList;
-  typedef std::map<uintptr_t, NotificationObserverList*> NotificationSourceMap;
-
-  // Convenience function to determine whether a source has a
-  // NotificationObserverList in the given map;
-  static bool HasKey(const NotificationSourceMap& map,
-                     const NotificationSource& source);
-
-  // Keeps track of the observers for each type of notification.
-  // Until we get a prohibitively large number of notification types,
-  // a simple array is probably the fastest way to dispatch.
-  NotificationSourceMap observers_[NotificationType::NOTIFICATION_TYPE_COUNT];
-
-#ifndef NDEBUG
-  // Used to check to see that AddObserver and RemoveObserver calls are
-  // balanced.
-  int observer_counts_[NotificationType::NOTIFICATION_TYPE_COUNT];
-#endif
-
-  DISALLOW_COPY_AND_ASSIGN(NotificationService);
-};
-
-#endif  // CHROME_COMMON_NOTIFICATION_SERVICE_H_

deleted file mode 100644
--- a/ipc/chromium/src/chrome/common/notification_source.h
+++ /dev/null
@@ -1,53 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// This file defines the type used to provide sources for NotificationService
-// notifications.
-
-#ifndef CHROME_COMMON_NOTIFICATION_SOURCE_H__
-#define CHROME_COMMON_NOTIFICATION_SOURCE_H__
-
-#include "base/basictypes.h"
-
-// Do not declare a NotificationSource directly--use either
-// "Source<sourceclassname>(sourceclasspointer)" or
-// NotificationService::AllSources().
-class NotificationSource {
- public:
-  NotificationSource(const NotificationSource& other) : ptr_(other.ptr_) { }
-  ~NotificationSource() {}
-
-  // NotificationSource can be used as the index for a map; this method
-  // returns the pointer to the current source as an identifier, for use as a
-  // map index.
-  uintptr_t map_key() const { return reinterpret_cast<uintptr_t>(ptr_); }
-
-  bool operator!=(const NotificationSource& other) const {
-    return ptr_ != other.ptr_;
-  }
-  bool operator==(const NotificationSource& other) const {
-    return ptr_ == other.ptr_;
-  }
-
- protected:
-  explicit NotificationSource(void* ptr) : ptr_(ptr) {}
-
-  void* ptr_;
-};
-
-template <class T>
-class Source : public NotificationSource {
- public:
-  explicit Source(T* ptr) : NotificationSource(ptr) {}
-
-  explicit Source(const NotificationSource& other)
-    : NotificationSource(other) {}
-
-  T* operator->() const { return ptr(); }
-  T* ptr() const { return static_cast<T*>(ptr_); }
-};
-
-#endif  // CHROME_COMMON_NOTIFICATION_SOURCE_H__

deleted file mode 100644
--- a/ipc/chromium/src/chrome/common/notification_type.h
+++ /dev/null
@@ -1,576 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CHROME_COMMON_NOTIFICATION_TYPE_H_
-#define CHROME_COMMON_NOTIFICATION_TYPE_H_
-
-// This file describes various types used to describe and filter notifications
-// that pass through the NotificationService.
-//
-// It is written as an enum inside a class so that it can be forward declared.
-// You're not allowed to forward declare an enum, and we want to forward
-// declare this since it's required by NotificationObserver which is included
-// by a lot of header files.
-//
-// Since this class encapsulates an integral value, it should be passed by
-// value.
-class NotificationType {
- public:
-  enum Type {
-    // General -----------------------------------------------------------------
-
-    // Special signal value to represent an interest in all notifications.
-    // Not valid when posting a notification.
-    ALL = 0,
-
-    // The app is done processing user actions, now is a good time to do
-    // some background work.
-    IDLE,
-
-    // Means that the app has just started doing something in response to a
-    // user action, and that background processes shouldn't run if avoidable.
-    BUSY,
-
-    // This is sent when the user does a gesture resulting in a noteworthy
-    // action taking place. This is typically used for logging. The source is
-    // the profile, and the details is a wstring identifying the action.
-    USER_ACTION,
-
-    // NavigationController ----------------------------------------------------
-
-    // A new pending navigation has been created. Pending entries are created
-    // when the user requests the navigation. We don't know if it will actually
-    // happen until it does (at this point, it will be "committed." Note that
-    // renderer- initiated navigations such as link clicks will never be
-    // pending.
-    //
-    // This notification is called after the pending entry is created, but
-    // before we actually try to navigate. The source will be the
-    // NavigationController that owns the pending entry, and there are no
-    // details.
-    NAV_ENTRY_PENDING,
-
-    // A new non-pending navigation entry has been created. This will
-    // correspond to one NavigationController entry being created (in the case
-    // of new navigations) or renavigated to (for back/forward navigations).
-    //
-    // The source will be the navigation controller doing the commit. The
-    // details will be NavigationController::LoadCommittedDetails.
-    NAV_ENTRY_COMMITTED,
-
-    // Indicates that the NavigationController given in the Source has
-    // decreased its back/forward list count by removing entries from either
-    // the front or back of its list. This is usually the result of going back
-    // and then doing a new navigation, meaning all the "forward" items are
-    // deleted.
-    //
-    // This normally happens as a result of a new navigation. It will be
-    // followed by a NAV_ENTRY_COMMITTED message for the new page that
-    // caused the pruning. It could also be a result of removing an item from
-    // the list to fix up after interstitials.
-    //
-    // The details are NavigationController::PrunedDetails.
-    NAV_LIST_PRUNED,
-
-    // Indicates that a NavigationEntry has changed. The source will be the
-    // NavigationController that owns the NavigationEntry. The details will be
-    // a NavigationController::EntryChangedDetails struct.
-    //
-    // This will NOT be sent on navigation, interested parties should also
-    // listen for NAV_ENTRY_COMMITTED to handle that case. This will be
-    // sent when the entry is updated outside of navigation (like when a new
-    // title comes).
-    NAV_ENTRY_CHANGED,
-
-    // Other load-related (not from NavigationController) ----------------------
-
-    // A content load is starting.  The source will be a
-    // Source<NavigationController> corresponding to the tab in which the load
-    // is occurring.  No details are expected for this notification.
-    LOAD_START,
-
-    // A content load has stopped. The source will be a
-    // Source<NavigationController> corresponding to the tab in which the load
-    // is occurring.  Details in the form of a LoadNotificationDetails object
-    // are optional.
-    LOAD_STOP,
-
-    // A frame is staring a provisional load.  The source is a
-    // Source<NavigationController> corresponding to the tab in which the load
-    // occurs.  Details is a bool specifying if the load occurs in the main
-    // frame (or a sub-frame if false).
-    FRAME_PROVISIONAL_LOAD_START,
-
-    // Content was loaded from an in-memory cache.  The source will be a
-    // Source<NavigationController> corresponding to the tab in which the load
-    // occurred.  Details in the form of a LoadFromMemoryCacheDetails object
-    // are provided.
-    LOAD_FROM_MEMORY_CACHE,
-
-    // A provisional content load has failed with an error.  The source will be
-    // a Source<NavigationController> corresponding to the tab in which the
-    // load occurred.  Details in the form of a ProvisionalLoadDetails object
-    // are provided.
-    FAIL_PROVISIONAL_LOAD_WITH_ERROR,
-
-    // A response has been received for a resource request.  The source will be
-    // a Source<NavigationController> corresponding to the tab in which the
-    // request was issued.  Details in the form of a ResourceRequestDetails
-    // object are provided.
-    RESOURCE_RESPONSE_STARTED,
-
-    // The response to a resource request has completed.  The source will be a
-    // Source<NavigationController> corresponding to the tab in which the
-    // request was issued.  Details in the form of a ResourceRequestDetails
-    // object are provided.
-    RESOURCE_RESPONSE_COMPLETED,
-
-    // A redirect was received while requesting a resource.  The source will be
-    // a Source<NavigationController> corresponding to the tab in which the
-    // request was issued.  Details in the form of a ResourceRedirectDetails
-    // are provided.
-    RESOURCE_RECEIVED_REDIRECT,
-
-    // The SSL state of a page has changed in some visible way.  For example,
-    // if an insecure resource is loaded on a secure page.  Note that a
-    // toplevel load commit will also update the SSL state (since the
-    // NavigationEntry is new) and this message won't always be sent in that
-    // case.  Listen to this notification if you need to refresh SSL-related UI
-    // elements.
-    //
-    // The source will be the navigation controller associated with the load.
-    // There are no details.  The entry changed will be the active entry of the
-    // controller.
-    SSL_VISIBLE_STATE_CHANGED,
-
-    // The SSL state of the browser has changed in some internal way.  For
-    // example, the user might have explicitly allowed some broken certificate
-    // or a secure origin might have included some insecure content.  Listen to
-    // this notifiation if you need to keep track of our internal SSL state.
-    //
-    // The source will be the navigation controller associated with the state
-    // change.  There are no details.
-    SSL_INTERNAL_STATE_CHANGED,
-
-    // Lets resource handlers and other interested observers know when the
-    // message filter is being deleted and can no longer be used.
-    RESOURCE_MESSAGE_FILTER_SHUTDOWN,
-
-    // Views -------------------------------------------------------------------
-
-    // Notification that a view was removed from a view hierarchy.  The source
-    // is the view, the details is the parent view.
-    VIEW_REMOVED,
-
-    // Browser-window ----------------------------------------------------------
-
-    // This message is sent after a window has been opened.  The source is a
-    // Source<Browser> with a pointer to the new window.  No details are
-    // expected.
-    BROWSER_OPENED,
-
-    // This message is sent after a window has been closed.  The source is a
-    // Source<Browser> with a pointer to the closed window.  Details is a
-    // boolean that if true indicates that the application will be closed as a
-    // result of this browser window closure (i.e. this was the last opened
-    // browser window).  Note that the boolean pointed to by Details is only
-    // valid for the duration of this call.
-    BROWSER_CLOSED,
-
-    // This message is sent when the last window considered to be an
-    // "application window" has been closed. Dependent/dialog/utility windows
-    // can use this as a way to know that they should also close. No source or
-    // details are passed.
-    ALL_APPWINDOWS_CLOSED,
-
-    // Indicates a new top window has been created. The source is the
-    // WindowWin.
-    WINDOW_CREATED,
-
-    // Indicates that a top window has been closed.  The source is the HWND
-    // that was closed, no details are expected.
-    WINDOW_CLOSED,
-
-    // Sent when an info bubble has been created but not yet shown. The source
-    // is the InfoBubble.
-    INFO_BUBBLE_CREATED,
-
-    // Tabs --------------------------------------------------------------------
-
-    // This notification is sent after a tab has been appended to the
-    // tab_strip.  The source is a Source<NavigationController> with a pointer
-    // to controller for the added tab. There are no details.
-    TAB_PARENTED,
-
-    // This message is sent before a tab has been closed.  The source is a
-    // Source<NavigationController> with a pointer to the controller for the
-    // closed tab.  No details are expected.
-    //
-    // See also TAB_CLOSED.
-    TAB_CLOSING,
-
-    // Notification that a tab has been closed. The source is the
-    // NavigationController with no details.
-    TAB_CLOSED,
-
-    // This notification is sent when a render view host has connected to a
-    // renderer process. The source is a Source<TabContents> with a pointer to
-    // the TabContents.  A TAB_CONTENTS_DISCONNECTED notification is
-    // guaranteed before the source pointer becomes junk.  No details are
-    // expected.
-    TAB_CONTENTS_CONNECTED,
-
-    // This notification is sent when a TabContents swaps its render view host
-    // with another one, possibly changing processes. The source is a
-    // Source<TabContents> with a pointer to the TabContents.  A
-    // TAB_CONTENTS_DISCONNECTED notification is guaranteed before the
-    // source pointer becomes junk.  No details are expected.
-    TAB_CONTENTS_SWAPPED,
-
-    // This message is sent after a TabContents is disconnected from the
-    // renderer process.  The source is a Source<TabContents> with a pointer to
-    // the TabContents (the pointer is usable).  No details are expected.
-    TAB_CONTENTS_DISCONNECTED,
-
-    // This message is sent when a new InfoBar has been added to a TabContents.
-    // The source is a Source<TabContents> with a pointer to the TabContents
-    // the InfoBar was added to. The details is a Details<InfoBarDelegate> with
-    // a pointer to an object implementing the InfoBarDelegate interface for
-    // the InfoBar that was added.
-    TAB_CONTENTS_INFOBAR_ADDED,
-
-    // This message is sent when an InfoBar is about to be removed from a
-    // TabContents. The source is a Source<TabContents> with a pointer to the
-    // TabContents the InfoBar was removed from. The details is a
-    // Details<InfoBarDelegate> with a pointer to an object implementing the
-    // InfoBarDelegate interface for the InfoBar that was removed.
-    TAB_CONTENTS_INFOBAR_REMOVED,
-
-    // This is sent when an externally hosted tab is created. The details
-    // contain the ExternalTabContainer that contains the tab
-    EXTERNAL_TAB_CREATED,
-
-    // This is sent when an externally hosted tab is closed.  No details are
-    // expected.
-    EXTERNAL_TAB_CLOSED,
-
-    // Indicates that the new page tab has finished loading. This is used for
-    // performance testing to see how fast we can load it after startup, and is
-    // only called once for the lifetime of the browser. The source is unused.
-    // Details is an integer: the number of milliseconds elapsed between
-    // starting and finishing all painting.
-    INITIAL_NEW_TAB_UI_LOAD,
-
-    // This notification is sent when a TabContents is being hidden, e.g. due
-    // to switching away from this tab.  The source is a Source<TabContents>.
-    TAB_CONTENTS_HIDDEN,
-
-    // This notification is sent when a TabContents is being destroyed. Any
-    // object holding a reference to a TabContents can listen to that
-    // notification to properly reset the reference. The source is a
-    // Source<TabContents>.
-    TAB_CONTENTS_DESTROYED,
-
-    // Stuff inside the tabs ---------------------------------------------------
-
-    // This message is sent after a constrained window has been closed.  The
-    // source is a Source<ConstrainedWindow> with a pointer to the closed child
-    // window.  (The pointer isn't usable, except for identification.) No
-    // details are expected.
-    CWINDOW_CLOSED,
-
-    // Indicates that a RenderProcessHost is destructing. The source will be the
-    // RenderProcessHost that corresponds to the process.
-    RENDERER_PROCESS_TERMINATED,
-
-    // Indicates that a render process was closed (meaning it exited, but the
-    // RenderProcessHost might be reused).  The source will be the corresponding
-    // RenderProcessHost.  The details will be a bool which is true if the
-    // process crashed.  This may get sent along with
-    // RENDERER_PROCESS_TERMINATED.
-    RENDERER_PROCESS_CLOSED,
-
-    // Indicates that a render process has become unresponsive for a period of
-    // time. The source will be the RenderWidgetHost that corresponds to the
-    // hung view, and no details are expected.
-    RENDERER_PROCESS_HANG,
-
-    // Indicates that a render process is created in the sandbox. The source
-    // will be the RenderProcessHost that corresponds to the created process
-    // and the detail is a bool telling us if the process got created on the
-    // sandbox desktop or not.
-    RENDERER_PROCESS_IN_SBOX,
-
-    // This is sent to notify that the RenderViewHost displayed in a
-    // TabContents has changed.  Source is the TabContents for which the change
-    // happened, details is the previous RenderViewHost (can be NULL when the
-    // first RenderViewHost is set).
-    RENDER_VIEW_HOST_CHANGED,
-
-    // This is sent when a RenderWidgetHost is being destroyed. The source is
-    // the RenderWidgetHost, the details are not used.
-    RENDER_WIDGET_HOST_DESTROYED,
-
-    // Notification from TabContents that we have received a response from the
-    // renderer after using the dom inspector.
-    DOM_INSPECT_ELEMENT_RESPONSE,
-
-    // Notification from TabContents that we have received a response from the
-    // renderer in response to a dom automation controller action.
-    DOM_OPERATION_RESPONSE,
-
-    // Sent when the bookmark bubble hides. The source is the profile, the
-    // details unused.
-    BOOKMARK_BUBBLE_HIDDEN,
-
-    // This notification is sent when the result of a find-in-page search is
-    // available with the browser process. The source is a Source<TabContents>
-    // with a pointer to the TabContents. Details encompass a
-    // FindNotificationDetail object that tells whether the match was found or
-    // not found.
-    FIND_RESULT_AVAILABLE,
-
-    // This is sent when the users preference for when the bookmark bar should
-    // be shown changes. The source is the profile, and the details are
-    // NoDetails.
-    BOOKMARK_BAR_VISIBILITY_PREF_CHANGED,
-
-    // Used to monitor web cache usage by notifying whenever the
-    // CacheManagerHost observes new UsageStats. The source will be the
-    // RenderProcessHost that corresponds to the new statistics. Details are a
-    // UsageStats object sent by the renderer, and should be copied - ptr not
-    // guaranteed to be valid after the notification.
-    WEB_CACHE_STATS_OBSERVED,
-
-    // Child Processes ---------------------------------------------------------
-
-    // This notification is sent when a child process host has connected to a
-    // child process.  There is no usable source, since it is sent from an
-    // ephemeral task; register for AllSources() to receive this notification.
-    // The details are in a Details<ChildProcessInfo>.
-    CHILD_PROCESS_HOST_CONNECTED,
-
-    // This message is sent after a ChildProcessHost is disconnected from the
-    // child process.  There is no usable source, since it is sent from an
-    // ephemeral task; register for AllSources() to receive this notification.
-    // The details are in a Details<ChildProcessInfo>.
-    CHILD_PROCESS_HOST_DISCONNECTED,
-
-    // This message is sent when a child process disappears unexpectedly.
-    // There is no usable source, since it is sent from an ephemeral task;
-    // register for AllSources() to receive this notification.  The details are
-    // in a Details<ChildProcessInfo>.
-    CHILD_PROCESS_CRASHED,
-
-    // This message indicates that an instance of a particular child was
-    // created in a page.  (If one page contains several regions rendered by
-    // the same child, this notification will occur once for each region
-    // during the page load.)
-    //
-    // There is no usable source, since it is sent from an ephemeral task;
-    // register for AllSources() to receive this notification.  The details are
-    // in a Details<ChildProcessInfo>.
-    CHILD_INSTANCE_CREATED,
-
-    // This is sent when network interception is disabled for a plugin, or the
-    // plugin is unloaded.  This should only be sent/received on the browser IO
-    // thread or the plugin thread. The source is the plugin that is disabling
-    // interception.  No details are expected.
-    CHROME_PLUGIN_UNLOADED,
-
-    // This is sent when a login prompt is shown.  The source is the
-    // Source<NavigationController> for the tab in which the prompt is shown.
-    // Details are a LoginNotificationDetails which provide the LoginHandler
-    // that should be given authentication.
-    AUTH_NEEDED,
-
-    // This is sent when authentication credentials have been supplied (either
-    // by the user or by an automation service), but before we've actually
-    // received another response from the server.  The source is the
-    // Source<NavigationController> for the tab in which the prompt was shown.
-    // No details are expected.
-    AUTH_SUPPLIED,
-
-    // History -----------------------------------------------------------------
-
-    // Sent when a history service is created on the main thread. This is sent
-    // after history is created, but before it has finished loading. Use
-    // HISTORY_LOADED is you need to know when loading has completed.
-    // The source is the profile that the history service belongs to, and the
-    // details is the pointer to the newly created HistoryService object.
-    HISTORY_CREATED,
-
-    // Sent when a history service has finished loading. The source is the
-    // profile that the history service belongs to, and the details is the
-    // HistoryService.
-    HISTORY_LOADED,
-
-    // Sent when a URL that has been typed has been added or modified. This is
-    // used by the in-memory URL database (used by autocomplete) to track
-    // changes to the main history system.
-    //
-    // The source is the profile owning the history service that changed, and
-    // the details is history::URLsModifiedDetails that lists the modified or
-    // added URLs.
-    HISTORY_TYPED_URLS_MODIFIED,
-
-    // Sent when the user visits a URL.
-    //
-    // The source is the profile owning the history service that changed, and
-    // the details is history::URLVisitedDetails.
-    HISTORY_URL_VISITED,
-
-    // Sent when one or more URLs are deleted.
-    //
-    // The source is the profile owning the history service that changed, and
-    // the details is history::URLsDeletedDetails that lists the deleted URLs.
-    HISTORY_URLS_DELETED,
-
-    // Sent by history when the favicon of a URL changes.  The source is the
-    // profile, and the details is history::FavIconChangeDetails (see
-    // history_notifications.h).
-    FAVICON_CHANGED,
-
-    // Bookmarks ---------------------------------------------------------------
-
-    // Sent when the starred state of a URL changes. A URL is starred if there
-    // is at least one bookmark for it. The source is a Profile and the details
-    // is history::URLsStarredDetails that contains the list of URLs and
-    // whether they were starred or unstarred.
-    URLS_STARRED,
-
-    // Sent when the bookmark bar model finishes loading. This source is the
-    // Profile, and the details aren't used.
-    BOOKMARK_MODEL_LOADED,
-
-    // Sent when the spellchecker object changes. Note that this is not sent
-    // the first time the spellchecker gets initialized. The source is the
-    // profile, the details is SpellcheckerReinitializedDetails defined in
-    // profile.
-    SPELLCHECKER_REINITIALIZED,
-
-    // Sent when the bookmark bubble is shown for a particular URL. The source
-    // is the profile, the details the URL.
-    BOOKMARK_BUBBLE_SHOWN,
-
-    // Non-history storage services --------------------------------------------
-
-    // Notification that the TemplateURLModel has finished loading from the
-    // database. The source is the TemplateURLModel, and the details are
-    // NoDetails.
-    TEMPLATE_URL_MODEL_LOADED,
-
-    // Notification triggered when a web application has been installed or
-    // uninstalled. Any application view should reload its data.  The source is
-    // the profile. No details are provided.
-    WEB_APP_INSTALL_CHANGED,
-
-    // This is sent to a pref observer when a pref is changed.
-    PREF_CHANGED,
-
-    // Sent when a default request context has been created, so calling
-    // Profile::GetDefaultRequestContext() will not return NULL.  This is sent
-    // on the thread where Profile::GetRequestContext() is first called, which
-    // should be the UI thread.
-    DEFAULT_REQUEST_CONTEXT_AVAILABLE,
-
-    // Autocomplete ------------------------------------------------------------
-
-    // Sent by the autocomplete controller at least once per query, each time
-    // new matches are available, subject to rate-limiting/coalescing to reduce
-    // the number of updates.  There are no details.
-    AUTOCOMPLETE_CONTROLLER_RESULT_UPDATED,
-
-    // Sent by the autocomplete controller once per query, immediately after
-    // synchronous matches become available.  There are no details.
-    AUTOCOMPLETE_CONTROLLER_SYNCHRONOUS_MATCHES_AVAILABLE,
-
-    // This is sent when an item of the Omnibox popup is selected. The source
-    // is the profile.
-    OMNIBOX_OPENED_URL,
-
-    // Sent by the autocomplete edit when it is destroyed.
-    AUTOCOMPLETE_EDIT_DESTROYED,
-
-    // Sent when the main Google URL has been updated.  Some services cache
-    // this value and need to update themselves when it changes.  See
-    // google_util::GetGoogleURLAndUpdateIfNecessary().
-    GOOGLE_URL_UPDATED,
-
-    // Printing ----------------------------------------------------------------
-
-    // Notification from a PrintedDocument that it has been updated. It may be
-    // that a printed page has just been generated or that the document's
-    // number of pages has been calculated. Details is the new page or NULL if
-    // only the number of pages in the document has been updated.
-    PRINTED_DOCUMENT_UPDATED,
-
-    // Notification from PrintJob that an event occured. It can be that a page
-    // finished printing or that the print job failed. Details is
-    // PrintJob::EventDetails.
-    PRINT_JOB_EVENT,
-
-    // Shutdown ----------------------------------------------------------------
-
-    // Sent on the browser IO thread when an URLRequestContext is released by
-    // its owning Profile.  The source is a pointer to the URLRequestContext.
-    URL_REQUEST_CONTEXT_RELEASED,
-
-    // Sent when WM_ENDSESSION has been received, after the browsers have been
-    // closed but before browser process has been shutdown. The source/details
-    // are all source and no details.
-    SESSION_END,
-
-    // Personalization ---------------------------------------------------------
-
-    PERSONALIZATION,
-    PERSONALIZATION_CREATED,
-
-    // User Scripts ------------------------------------------------------------
-
-    // Sent when there are new user scripts available.  The details are a
-    // pointer to SharedMemory containing the new scripts.
-    USER_SCRIPTS_LOADED,
-
-    // Extensions --------------------------------------------------------------
-
-    // Sent when new extensions are loaded. The details are an ExtensionList*.
-    EXTENSIONS_LOADED,
-
-    // Sent when new extensions are installed. The details are a FilePath.
-    EXTENSION_INSTALLED,
-
-    // Debugging ---------------------------------------------------------------
-
-    // Sent from ~RenderViewHost. The source is the RenderViewHost.
-    RENDER_VIEW_HOST_DELETED,
-
-    // Count (must be last) ----------------------------------------------------
-    // Used to determine the number of notification types.  Not valid as
-    // a type parameter when registering for or posting notifications.
-    NOTIFICATION_TYPE_COUNT
-  };
-
-  explicit NotificationType(Type v) : value(v) {}
-
-  bool operator==(NotificationType t) const { return value == t.value; }
-  bool operator!=(NotificationType t) const { return value != t.value; }
-
-  // Comparison to explicit enum values.
-  bool operator==(Type v) const { return value == v; }
-  bool operator!=(Type v) const { return value != v; }
-
-  Type value;
-};
-
-inline bool operator==(NotificationType::Type a, NotificationType b) {
-  return a == b.value;
-}
-inline bool operator!=(NotificationType::Type a, NotificationType b) {
-  return a != b.value;
-}
-
-#endif  // CHROME_COMMON_NOTIFICATION_TYPE_H_