--- a/.hgtags
+++ b/.hgtags
@@ -66,8 +66,9 @@ 138f593553b66c9f815e8f57870c19d6347f7702
 9eae975b3d6fb7748fe5a3c0113d449b1c7cc0b2 AURORA_BASE_20110524
 138f593553b66c9f815e8f57870c19d6347f7702 UPDATE_PACKAGING_R14
 462c726144bc1fb45b61e774f64ac5d61b4e047c UPDATE_PACKAGING_R14
 5eb553dd2ceae5f88d80f27afc5ef3935c5d43b0 AURORA_BASE_20110705
 41b84b87c816403e1b74963d8094cff0406c989e AURORA_BASE_20110816
 c0983049bcaa9551e5f276d5a77ce154c151e0b0 AURORA_BASE_20110927
 462c726144bc1fb45b61e774f64ac5d61b4e047c UPDATE_PACKAGING_R15
 54bfd8bf682e295ffd7f22fa921ca343957b6c1c AURORA_BASE_20111108
+a8506ab2c65480cf2f85f54e203ea746522c62bb AURORA_BASE_20111220

--- a/Makefile.in
+++ b/Makefile.in
@@ -57,16 +57,17 @@ TIERS += base
 
 #
 # tier "base" - basic setup
 #
 tier_base_dirs = \
 	config \
 	build \
 	probes \
+	mfbt \
 	$(NULL)
 
 ifndef LIBXUL_SDK
 ifeq (android,$(MOZ_WIDGET_TOOLKIT))
 tier_base_dirs += other-licenses/android other-licenses/skia-npapi
 endif
 
 tier_base_dirs += memory

--- a/accessible/build/nsAccessibilityFactory.cpp
+++ b/accessible/build/nsAccessibilityFactory.cpp
@@ -57,17 +57,16 @@ NS_ConstructAccessibilityService(nsISupp
     }
     rv = accessibility->QueryInterface(aIID, aResult);
     NS_ASSERTION(NS_SUCCEEDED(rv), "unable to find correct interface");
     NS_RELEASE(accessibility);
     return rv;
 }
 
 NS_DEFINE_NAMED_CID(NS_ACCESSIBILITY_SERVICE_CID);
-NS_DEFINE_NAMED_CID(NS_ACCESSIBLE_RETRIEVAL_CID);
 
 static const mozilla::Module::CIDEntry kA11yCIDs[] = {
     { &kNS_ACCESSIBILITY_SERVICE_CID, false, NULL, NS_ConstructAccessibilityService },
     { NULL }
 };
 
 static const mozilla::Module::ContractIDEntry kA11yContracts[] = {
     { "@mozilla.org/accessibilityService;1", &kNS_ACCESSIBILITY_SERVICE_CID },

--- a/accessible/src/base/nsAccUtils.cpp
+++ b/accessible/src/base/nsAccUtils.cpp
@@ -435,17 +435,18 @@ nsAccUtils::GetTextAccessibleFromSelecti
     return nsnull;
   }
 
   do {
     nsHyperTextAccessible* textAcc = accessible->AsHyperText();
     if (textAcc)
       return textAcc;
 
-  } while (accessible = accessible->Parent());
+    accessible = accessible->Parent();
+  } while (accessible);
 
   NS_NOTREACHED("We must reach document accessible implementing nsIAccessibleText!");
   return nsnull;
 }
 
 nsresult
 nsAccUtils::ConvertToScreenCoords(PRInt32 aX, PRInt32 aY,
                                   PRUint32 aCoordinateType,

--- a/accessible/src/base/nsDocAccessible.cpp
+++ b/accessible/src/base/nsDocAccessible.cpp
@@ -1560,24 +1560,24 @@ nsDocAccessible::AddDependentIDsFor(nsAc
 {
   for (PRUint32 idx = 0; idx < kRelationAttrsLen; idx++) {
     nsIAtom* relAttr = *kRelationAttrs[idx];
     if (aRelAttr && aRelAttr != relAttr)
       continue;
 
     if (relAttr == nsGkAtoms::_for) {
       if (!aRelProvider->GetContent()->IsHTML() ||
-          aRelProvider->GetContent()->Tag() != nsGkAtoms::label &&
-          aRelProvider->GetContent()->Tag() != nsGkAtoms::output)
+          (aRelProvider->GetContent()->Tag() != nsGkAtoms::label &&
+           aRelProvider->GetContent()->Tag() != nsGkAtoms::output))
         continue;
 
     } else if (relAttr == nsGkAtoms::control) {
       if (!aRelProvider->GetContent()->IsXUL() ||
-          aRelProvider->GetContent()->Tag() != nsGkAtoms::label &&
-          aRelProvider->GetContent()->Tag() != nsGkAtoms::description)
+          (aRelProvider->GetContent()->Tag() != nsGkAtoms::label &&
+           aRelProvider->GetContent()->Tag() != nsGkAtoms::description))
         continue;
     }
 
     IDRefsIterator iter(aRelProvider->GetContent(), relAttr);
     while (true) {
       const nsDependentSubstring id = iter.NextID();
       if (id.IsEmpty())
         break;

--- a/accessible/src/html/nsHTMLTableAccessible.cpp
+++ b/accessible/src/html/nsHTMLTableAccessible.cpp
@@ -101,19 +101,17 @@ nsHTMLTableCellAccessible::NativeState()
 {
   PRUint64 state = nsHyperTextAccessibleWrap::NativeState();
 
   nsIFrame *frame = mContent->GetPrimaryFrame();
   NS_ASSERTION(frame, "No frame for valid cell accessible!");
 
   if (frame) {
     state |= states::SELECTABLE;
-    bool isSelected = false;
-    frame->GetSelected(&isSelected);
-    if (isSelected)
+    if (frame->IsSelected())
       state |= states::SELECTED;
   }
 
   return state;
 }
 
 nsresult
 nsHTMLTableCellAccessible::GetAttributesInternal(nsIPersistentProperties *aAttributes)

--- a/accessible/src/xul/nsXULTreeGridAccessible.cpp
+++ b/accessible/src/xul/nsXULTreeGridAccessible.cpp
@@ -1247,18 +1247,22 @@ nsXULTreeGridCellAccessible::RelationByT
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeGridCellAccessible: public implementation
 
 PRInt32
 nsXULTreeGridCellAccessible::GetColumnIndex() const
 {
   PRInt32 index = 0;
   nsCOMPtr<nsITreeColumn> column = mColumn;
-  while (column = nsCoreUtils::GetPreviousSensibleColumn(column))
+  while (true) {
+    column = nsCoreUtils::GetPreviousSensibleColumn(column);
+    if (!column)
+      break;
     index++;
+  }
 
   return index;
 }
 
 void
 nsXULTreeGridCellAccessible::CellInvalidated()
 {
   nsAutoString textEquiv;

--- a/accessible/tests/mochitest/table/test_table_1.html
+++ b/accessible/tests/mochitest/table/test_table_1.html
@@ -21,28 +21,34 @@ function doTest()
 
   var cell = getNode("col2b");
   var range = document.createRange();
   range.selectNode(cell);
   s.addRange(range);
 
   is(accTable.selectedCellCount, 1, "only one cell selected");
   cell = getNode("col2a");
+  range = document.createRange();
   range.selectNode(cell);
   s.addRange(range);
   cell = getNode("col2c");
+  range = document.createRange();
   range.selectNode(cell);
   s.addRange(range);
   is(accTable.selectedColumnCount, 1, "only one column selected");
+
   cell = getNode("row2a");
+  range = document.createRange();
   range.selectNode(cell);
   s.addRange(range);
   cell = getNode("row2b");
+  range = document.createRange();
   range.selectNode(cell);
   s.addRange(range);
+  range = document.createRange();
   cell = getNode("row2c");
   range.selectNode(cell);
   s.addRange(range);
 
   is(accTable.selectedRowCount, 1, "no cells selected");
 
   var columnDescription;
   works = true;

--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@@ -44,18 +44,18 @@ pref("browser.chromeURL", "chrome://brow
 pref("browser.homescreenURL", "file:///system/home/homescreen.html");
 #else
 pref("browser.homescreenURL", "file:///data/local/homescreen.html,file:///system/home/homescreen.html");
 #endif
 
 // Device pixel to CSS px ratio, in percent. Set to -1 to calculate based on display density.
 pref("browser.viewport.scaleRatio", -1);
 
-/* allow scrollbars to float above chrome ui */
-pref("ui.scrollbarsCanOverlapContent", 1);
+/* disable text selection */
+pref("browser.ignoreNativeFrameTextSelection", true);
 
 /* cache prefs */
 pref("browser.cache.disk.enable", false);
 pref("browser.cache.disk.capacity", 0); // kilobytes
 pref("browser.cache.disk.smart_size.enabled", false);
 pref("browser.cache.disk.smart_size.first_run", false);
 
 pref("browser.cache.memory.enable", true);

new file mode 100644
--- /dev/null
+++ b/b2g/chrome/content/content.css
@@ -0,0 +1,112 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla B2G.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+@namespace url("http://www.w3.org/1999/xhtml");
+@namespace xul url("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul");
+
+/* Style the scrollbars */
+xul|window xul|scrollbar {
+  display: none;
+}
+
+html xul|scrollbar {
+  display: block;
+}
+
+xul|scrollbar[orient="vertical"] {
+  -moz-appearance: none !important;
+  position: relative;
+  margin-left: -8px;
+  min-width: 8px;
+  max-width: 8px;
+  background-color: transparent !important;
+  background-image: none !important;
+  border: 0px solid transparent !important;
+}
+
+xul|scrollbar[orient="vertical"]:-moz-locale-dir(rtl) {
+  margin-left: 2px;
+  margin-right: -10px;
+}
+
+xul|scrollbar[orient="vertical"] xul|thumb {
+  max-width: 6px !important;
+  min-width: 6px !important;
+}
+
+xul|scrollbar[orient="horizontal"] {
+  -moz-appearance: none !important;
+  position: relative;
+  min-height: 8px;
+  max-height: 8px;
+  margin-top: -8px;
+  background-color: transparent !important;
+  background-image: none !important;
+  border: 0px solid transparent !important;
+}
+
+xul|scrollbar[orient="horizontal"] xul|thumb {
+  max-height: 6px !important;
+  min-height: 6px !important;
+}
+
+xul|scrollbox {
+  overflow-y: scroll;
+  overflow-x: scroll;
+}
+
+xul|scrollbarbutton {
+  min-height: 8px !important;
+  min-width: 8px !important;
+  -moz-appearance: none !important;
+  visibility: hidden;
+}
+
+xul|scrollbarbutton[sbattr="scrollbar-up-top"],
+xul|scrollbarbutton[sbattr="scrollbar-bottom-top"] {
+  display: none;
+}
+
+xul|thumb {
+  background-color: rgba(0, 0, 0, 0.4) !important;
+  -moz-border-top-colors: none !important;
+  -moz-border-bottom-colors: none !important;
+  -moz-border-right-colors: none !important;
+  -moz-border-left-colors: none !important;
+  border: 1px solid rgba(255, 255, 255, 0.4) !important;
+  -moz-border-radius: 3px;
+}
+

--- a/b2g/chrome/jar.mn
+++ b/b2g/chrome/jar.mn
@@ -4,11 +4,12 @@ chrome.jar:
 % content branding %content/branding/
 % content browser %content/
 
 * content/shell.xul                     (content/shell.xul)
   content/shell.js                      (content/shell.js)
   content/touch.js                      (content/touch.js)
   content/commandUtil.js                (content/commandUtil.js)
   content/httpd.js                      (content/httpd.js)
+  content/content.css                   (content/content.css)
 
 % override chrome://global/content/netError.xhtml chrome://browser/content/netError.xhtml
   content/netError.xhtml                (content/netError.xhtml)

--- a/b2g/components/B2GComponents.manifest
+++ b/b2g/components/B2GComponents.manifest
@@ -0,0 +1,2 @@
+# Scrollbars
+category agent-style-sheets browser-content-stylesheet chrome://browser/content/content.css

--- a/browser/app/blocklist.xml
+++ b/browser/app/blocklist.xml
@@ -220,9 +220,9 @@
             <feature>DIRECT3D_9_LAYERS</feature>
       <featureStatus>BLOCKED_DRIVER_VERSION</featureStatus>
       <driverVersion>7.0.0.0</driverVersion>
       <driverVersionComparator>GREATER_THAN_OR_EQUAL</driverVersionComparator>
     </gfxBlacklistEntry>
     </gfxItems>
 
 
-</blocklist>
+</blocklist>
\ No newline at end of file

--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -76,16 +76,20 @@ pref("extensions.blocklist.interval", 86
 // blocking them.
 pref("extensions.blocklist.level", 2);
 pref("extensions.blocklist.url", "https://addons.mozilla.org/blocklist/3/%APP_ID%/%APP_VERSION%/%PRODUCT%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/%PING_COUNT%/%TOTAL_PING_COUNT%/%DAYS_SINCE_LAST_PING%/");
 pref("extensions.blocklist.detailsURL", "https://www.mozilla.com/%LOCALE%/blocklist/");
 pref("extensions.blocklist.itemURL", "https://addons.mozilla.org/%LOCALE%/%APP%/blocked/%blockID%");
 
 pref("extensions.update.autoUpdateDefault", true);
 
+pref("extensions.hotfix.id", "firefox-hotfix@mozilla.org");
+pref("extensions.hotfix.cert.checkAttributes", true);
+pref("extensions.hotfix.certs.1.sha1Fingerprint", "foo");
+
 // Disable add-ons installed into the shared user and shared system areas by
 // default. This does not include the application directory. See the SCOPE
 // constants in AddonManager.jsm for values to use here
 pref("extensions.autoDisableScopes", 15);
 
 // Dictionary download preference
 pref("browser.dictionaries.download.url", "https://addons.mozilla.org/%LOCALE%/firefox/dictionaries/");
 
@@ -922,22 +926,28 @@ pref("browser.taskbar.lists.frequent.ena
 pref("browser.taskbar.lists.recent.enabled", false);
 pref("browser.taskbar.lists.maxListItemCount", 7);
 pref("browser.taskbar.lists.tasks.enabled", true);
 pref("browser.taskbar.lists.refreshInSeconds", 120);
 #endif
 
 #ifdef MOZ_SERVICES_SYNC
 // The sync engines to use.
-pref("services.sync.registerEngines", "Bookmarks,Form,History,Password,Prefs,Tab");
+pref("services.sync.registerEngines", "Bookmarks,Form,History,Password,Prefs,Tab,Addons");
 // Preferences to be synced by default
 pref("services.sync.prefs.sync.accessibility.blockautorefresh", true);
 pref("services.sync.prefs.sync.accessibility.browsewithcaret", true);
 pref("services.sync.prefs.sync.accessibility.typeaheadfind", true);
 pref("services.sync.prefs.sync.accessibility.typeaheadfind.linksonly", true);
+pref("services.sync.prefs.sync.addons.ignoreUserEnabledChanges", true);
+// The addons prefs related to repository verification are intentionally
+// not synced for security reasons. If a system is compromised, a user
+// could weaken the pref locally, install an add-on from an untrusted
+// source, and this would propagate automatically to other,
+// uncompromised Sync-connected devices.
 pref("services.sync.prefs.sync.app.update.mode", true);
 pref("services.sync.prefs.sync.browser.download.manager.closeWhenDone", true);
 pref("services.sync.prefs.sync.browser.download.manager.retention", true);
 pref("services.sync.prefs.sync.browser.download.manager.scanWhenDone", true);
 pref("services.sync.prefs.sync.browser.download.manager.showWhenStarting", true);
 pref("services.sync.prefs.sync.browser.formfill.enable", true);
 pref("services.sync.prefs.sync.browser.link.open_newwindow", true);
 pref("services.sync.prefs.sync.browser.offline-apps.notify", true);

--- a/browser/base/content/aboutDialog.js
+++ b/browser/base/content/aboutDialog.js
@@ -35,16 +35,18 @@
 # the provisions above, a recipient may use your version of this file under
 # the terms of any one of the MPL, the GPL or the LGPL.
 #
 # ***** END LICENSE BLOCK ***** -->
 
 // Services = object with smart getters for common XPCOM services
 Components.utils.import("resource://gre/modules/Services.jsm");
 
+const PREF_EM_HOTFIX_ID = "extensions.hotfix.id";
+
 function init(aEvent)
 {
   if (aEvent.target != document)
     return;
 
   try {
     var distroId = Services.prefs.getCharPref("distribution.id");
     if (distroId) {
@@ -60,22 +62,24 @@ function init(aEvent)
       distroIdField.value = distroId + " - " + distroVersion;
       distroIdField.style.display = "block";
     }
   }
   catch (e) {
     // Pref is unset
   }
 
-  // Include the build ID if this is an "a#" (nightly or aurora) build
+  // Include the build ID and display warning if this is an "a#" (nightly or aurora) build
   let version = Services.appinfo.version;
   if (/a\d+$/.test(version)) {
     let buildID = Services.appinfo.appBuildID;
     let buildDate = buildID.slice(0,4) + "-" + buildID.slice(4,6) + "-" + buildID.slice(6,8);
     document.getElementById("version").textContent += " (" + buildDate + ")";
+    document.getElementById("experimental").hidden = false;
+    document.getElementById("communityDesc").hidden = true;
   }
 
 #ifdef MOZ_OFFICIAL_BRANDING
   // Hide the Charlton trademark attribution for non-en-US/en-GB
   // DO NOT REMOVE without consulting people involved with bug 616193
   let chromeRegistry = Components.classes["@mozilla.org/chrome/chrome-registry;1"].
                        getService(Components.interfaces.nsIXULChromeRegistry);
   let currentLocale = chromeRegistry.getSelectedLocale("global");
@@ -373,16 +377,21 @@ appUpdater.prototype =
       return this;
     }
   },
 
   /**
    * Checks the compatibility of add-ons for the application update.
    */
   checkAddonCompatibility: function() {
+    try {
+      var hotfixID = Services.prefs.getCharPref(PREF_EM_HOTFIX_ID);
+    }
+    catch (e) { }
+
     var self = this;
     AddonManager.getAllAddons(function(aAddons) {
       self.addons = [];
       self.addonsCheckedCount = 0;
       aAddons.forEach(function(aAddon) {
         // Protect against code that overrides the add-ons manager and doesn't
         // implement the isCompatibleWith or the findUpdates method.
         if (!("isCompatibleWith" in aAddon) || !("findUpdates" in aAddon)) {
@@ -397,19 +406,20 @@ appUpdater.prototype =
         // If an add-on isn't appDisabled and isn't userDisabled then it is
         // either active now or the user expects it to be active after the
         // restart. If that is the case and the add-on is not installed by the
         // application and is not compatible with the new application version
         // then the user should be warned that the add-on will become
         // incompatible. If an addon's type equals plugin it is skipped since
         // checking plugins compatibility information isn't supported and
         // getting the scope property of a plugin breaks in some environments
-        // (see bug 566787).
+        // (see bug 566787). The hotfix add-on is also ignored as it shouldn't
+        // block the user from upgrading.
         try {
-          if (aAddon.type != "plugin" &&
+          if (aAddon.type != "plugin" && aAddon.id != hotfixID &&
               !aAddon.appDisabled && !aAddon.userDisabled &&
               aAddon.scope != AddonManager.SCOPE_APPLICATION &&
               aAddon.isCompatible &&
               !aAddon.isCompatibleWith(self.update.appVersion,
                                        self.update.platformVersion))
             self.addons.push(aAddon);
         }
         catch (e) {

--- a/browser/base/content/aboutDialog.xul
+++ b/browser/base/content/aboutDialog.xul
@@ -115,18 +115,29 @@
 #endif
           </vbox>
 
 #ifdef MOZ_UPDATER
           <description class="text-blurb" id="currentChannelText">
             &channel.description.start;<label id="currentChannel"/>&channel.description.end;
           </description>
 #endif
+          <vbox id="experimental" hidden="true">
+            <description class="text-blurb" id="warningDesc">
+              &warningDesc.version;
+#ifdef MOZ_TELEMETRY_REPORTING
+              &warningDesc.telemetry;
+#endif
+            </description>
+            <description class="text-blurb" id="communityExperimentalDesc">
+              &community.exp.start;<label class="text-link" href="http://www.mozilla.org/">&community.exp.mozillaLink;</label>&community.exp.middle;<label class="text-link" href="about:credits">&community.exp.creditsLink;</label>&community.exp.end;
+            </description>
+          </vbox>
           <description class="text-blurb" id="communityDesc">
-            &community.start2;<label class="text-link" href="http://www.mozilla.org/">&community.mozillaLink;</label>&community.middle2;<label class="text-link" href="about:credits">&community.creditsLink;</label>&community.end2;
+            &community.start2;<label class="text-link" href="http://www.mozilla.org/">&community.mozillaLink;</label>&community.middle2;<label class="text-link" href="about:credits">&community.creditsLink;</label>&community.end3;
           </description>
           <description class="text-blurb" id="contributeDesc">
             &contribute.start;<label class="text-link" href="http://www.mozilla.org/contribute/">&contribute.getInvolvedLink;</label>&contribute.end;
           </description>
         </vbox>
       </vbox>
     </hbox>
     <vbox id="bottomBox">

--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -2192,24 +2192,17 @@ function openLocation() {
 function openLocationCallback()
 {
   // make sure the DOM is ready
   setTimeout(function() { this.openLocation(); }, 0);
 }
 
 function BrowserOpenTab()
 {
-  if (!gBrowser) {
-    // If there are no open browser windows, open a new one
-    window.openDialog("chrome://browser/content/", "_blank",
-                      "chrome,all,dialog=no", "about:blank");
-    return;
-  }
-  gBrowser.loadOneTab("about:blank", {inBackground: false});
-  focusAndSelectUrlBar();
+  openUILinkIn("about:blank", "tab");
 }
 
 /* Called from the openLocation dialog. This allows that dialog to instruct
    its opener to open a new window and then step completely out of the way.
    Anything less byzantine is causing horrible crashes, rather believably,
    though oddly only on Linux. */
 function delayedOpenWindow(chrome, flags, href, postData)
 {
@@ -3006,19 +2999,20 @@ function getMarkupDocumentViewer()
  *       which performs the same function, but for embedded clients that
  *       don't use a XUL/JS layer. It is important that the logic of
  *       these two routines be kept more or less in sync.
  *       (pinkerton)
  **/
 function FillInHTMLTooltip(tipElement)
 {
   var retVal = false;
-  // Don't show the tooltip if the tooltip node is a XUL element or a document.
+  // Don't show the tooltip if the tooltip node is a XUL element, a document or is disconnected.
   if (tipElement.namespaceURI == "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" ||
-      !tipElement.ownerDocument)
+      !tipElement.ownerDocument ||
+      tipElement.ownerDocument.compareDocumentPosition(tipElement) == document.DOCUMENT_POSITION_DISCONNECTED)
     return retVal;
 
   const XLinkNS = "http://www.w3.org/1999/xlink";
 
 
   var titleText = null;
   var XLinkTitleText = null;
   var SVGTitleText = null;
@@ -3036,20 +3030,20 @@ function FillInHTMLTooltip(tipElement)
     // If the element is barred from constraint validation or valid,
     // the validation message will be the empty string.
     titleText = tipElement.validationMessage;
   }
 
   while (!titleText && !XLinkTitleText && !SVGTitleText && tipElement) {
     if (tipElement.nodeType == Node.ELEMENT_NODE) {
       titleText = tipElement.getAttribute("title");
-      if ((tipElement instanceof HTMLAnchorElement && tipElement.href) ||
-          (tipElement instanceof HTMLAreaElement && tipElement.href) ||
-          (tipElement instanceof HTMLLinkElement && tipElement.href) ||
-          (tipElement instanceof SVGAElement && tipElement.hasAttributeNS(XLinkNS, "href"))) {
+      if ((tipElement instanceof HTMLAnchorElement ||
+           tipElement instanceof HTMLAreaElement ||
+           tipElement instanceof HTMLLinkElement ||
+           tipElement instanceof SVGAElement) && tipElement.href) {
         XLinkTitleText = tipElement.getAttributeNS(XLinkNS, "title");
       }
       if (lookingForSVGTitle &&
           (!(tipElement instanceof SVGElement) ||
            tipElement.parentNode.nodeType == Node.DOCUMENT_NODE)) {
         lookingForSVGTitle = false;
       }
       if (lookingForSVGTitle) {
@@ -8794,17 +8788,17 @@ function switchToTabHavingURI(aURI, aOpe
       return true;
   }
 
   // No opened tab has that url.
   if (aOpenNew) {
     if (isBrowserWindow && isTabEmpty(gBrowser.selectedTab))
       gBrowser.selectedBrowser.loadURI(aURI.spec);
     else
-      openUILinkIn(aURI.spec, "tab", { inBackground: false });
+      openUILinkIn(aURI.spec, "tab");
   }
 
   return false;
 }
 
 function restoreLastSession() {
   let ss = Cc["@mozilla.org/browser/sessionstore;1"].
            getService(Ci.nsISessionStore);
@@ -8904,30 +8898,26 @@ function safeModeRestart()
  *
  * delta is the offset to the history entry that you want to load.
  */
 function duplicateTabIn(aTab, where, delta) {
   let newTab = Cc['@mozilla.org/browser/sessionstore;1']
                  .getService(Ci.nsISessionStore)
                  .duplicateTab(window, aTab, delta);
 
-  var loadInBackground =
-    getBoolPref("browser.tabs.loadBookmarksInBackground", false);
-
   switch (where) {
     case "window":
       gBrowser.hideTab(newTab);
       gBrowser.replaceTabWithWindow(newTab);
       break;
     case "tabshifted":
-      loadInBackground = !loadInBackground;
-      // fall through
+      // A background tab has been opened, nothing else to do here.
+      break;
     case "tab":
-      if (!loadInBackground)
-        gBrowser.selectedTab = newTab;
+      gBrowser.selectedTab = newTab;
       break;
   }
 }
 
 /*
  * When addons are installed/uninstalled, check and see if the number of items
  * on the add-on bar changed:
  * - If an add-on was installed, incrementing the count, show the bar.

--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@@ -50,16 +50,17 @@
 # and other provisions required by the GPL or the LGPL. If you do not delete
 # the provisions above, a recipient may use your version of this file under
 # the terms of any one of the MPL, the GPL or the LGPL.
 #
 # ***** END LICENSE BLOCK *****
 
 <?xml-stylesheet href="chrome://browser/content/browser.css" type="text/css"?>
 <?xml-stylesheet href="chrome://browser/content/places/places.css" type="text/css"?>
+<?xml-stylesheet href="chrome://browser/skin/devtools/common.css" type="text/css"?>
 <?xml-stylesheet href="chrome://browser/skin/devtools/webconsole.css" type="text/css"?>
 <?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
 
 <?xul-overlay href="chrome://global/content/editMenuOverlay.xul"?>
 <?xul-overlay href="chrome://browser/content/baseMenuOverlay.xul"?>
 <?xul-overlay href="chrome://browser/content/places/placesOverlay.xul"?>
 
 # All DTD information is stored in a separate file so that it can be shared by
@@ -966,59 +967,65 @@
                   contentcontextmenu="contentAreaContextMenu"
                   autocompletepopup="PopupAutoComplete"
                   onclick="return contentAreaClick(event, false);"/>
       <statuspanel id="statusbar-display" inactive="true"/>
     </vbox>
     <splitter id="devtools-side-splitter" hidden="true"/>
     <vbox id="devtools-sidebar-box" hidden="true"
           style="min-width: 18em; width: 22em; max-width: 42em;" persist="width">
-      <toolbar id="devtools-sidebar-toolbar" nowindowdrag="true"/>
+      <toolbar id="devtools-sidebar-toolbar"
+               class="devtools-toolbar"
+               nowindowdrag="true"/>
       <deck id="devtools-sidebar-deck" flex="1"/>
     </vbox>
     <vbox id="browser-border-end" hidden="true" layer="true"/>
   </hbox>
 
   <hbox id="full-screen-warning-container" hidden="true" fadeout="true">
     <hbox style="width: 100%;" pack="center"> <!-- Inner hbox needed due to bug 579776. -->
       <hbox id="full-screen-warning-message">
         <description id="full-screen-warning-text" value="&domFullScreenWarning.label;"></description>
       </hbox>
     </hbox>
   </hbox>
 
   <vbox id="browser-bottombox" layer="true">
     <toolbar id="inspector-toolbar"
+             class="devtools-toolbar"
              nowindowdrag="true"
              hidden="true">
       <vbox flex="1">
         <resizer id="inspector-top-resizer" flex="1" 
                  class="inspector-resizer"
                  dir="top" disabled="true"
                  element="inspector-tree-box"/>
         <hbox>
 #ifdef XP_MACOSX
           <toolbarbutton id="highlighter-closebutton"
                          oncommand="InspectorUI.closeInspectorUI(false);"
                          tooltiptext="&inspectCloseButton.tooltiptext;"/>
 #endif
           <toolbarbutton id="inspector-inspect-toolbutton"
+                         class="devtools-toolbarbutton"
                          label="&inspectButton.label;"
                          accesskey="&inspectButton.accesskey;"
                          command="Inspector:Inspect"/>
           <arrowscrollbox id="inspector-breadcrumbs"
                           flex="1" orient="horizontal"
                           clicktoscroll="true"/>
           <hbox id="inspector-tools">
             <toolbarbutton id="inspector-3D-button"
+                           class="devtools-toolbarbutton"
                            hidden="true"
                            label="&inspect3DButton.label;"
                            accesskey="&inspect3DButton.accesskey;"
                            command="Inspector:Tilt"/>
             <toolbarbutton id="inspector-style-button"
+                           class="devtools-toolbarbutton"
                            label="&inspectStyleButton.label;"
                            accesskey="&inspectStyleButton.accesskey;"
                            command="Inspector:Sidebar"/>
             <!-- registered tools go here -->
           </hbox>
 #ifndef XP_MACOSX
           <toolbarbutton id="highlighter-closebutton"
                          oncommand="InspectorUI.closeInspectorUI(false);"

--- a/browser/base/content/sanitize.js
+++ b/browser/base/content/sanitize.js
@@ -199,34 +199,23 @@ Sanitizer.prototype = {
       {
         return true;
       }
     },
 
     offlineApps: {
       clear: function ()
       {
-        const Cc = Components.classes;
-        const Ci = Components.interfaces;
-        var cacheService = Cc["@mozilla.org/network/cache-service;1"].
-                           getService(Ci.nsICacheService);
-        try {
-          // Offline app data is "timeless", and doesn't respect
-          // the setting of timespan, it always clears everything
-          cacheService.evictEntries(Ci.nsICache.STORE_OFFLINE);
-        } catch(er) {}
-
-        var storageManagerService = Cc["@mozilla.org/dom/storagemanager;1"].
-                                    getService(Ci.nsIDOMStorageManager);
-        storageManagerService.clearOfflineApps();
+        Components.utils.import("resource:///modules/offlineAppCache.jsm");
+        OfflineAppCacheHelper.clear();
       },
 
       get canClear()
       {
-          return true;
+        return true;
       }
     },
 
     history: {
       clear: function ()
       {
         var globalHistory = Components.classes["@mozilla.org/browser/global-history;2"]
                                       .getService(Components.interfaces.nsIBrowserHistory);

--- a/browser/base/content/sanitize.xul
+++ b/browser/base/content/sanitize.xul
@@ -88,16 +88,17 @@
 
     <preferences id="sanitizePreferences">
       <preference id="privacy.cpd.history"               name="privacy.cpd.history"               type="bool"/>
       <preference id="privacy.cpd.formdata"              name="privacy.cpd.formdata"              type="bool"/>
       <preference id="privacy.cpd.downloads"             name="privacy.cpd.downloads"             type="bool" disabled="true"/>
       <preference id="privacy.cpd.cookies"               name="privacy.cpd.cookies"               type="bool"/>
       <preference id="privacy.cpd.cache"                 name="privacy.cpd.cache"                 type="bool"/>
       <preference id="privacy.cpd.sessions"              name="privacy.cpd.sessions"              type="bool"/>
+      <preference id="privacy.cpd.offlineApps"           name="privacy.cpd.offlineApps"           type="bool"/>
       <preference id="privacy.cpd.siteSettings"          name="privacy.cpd.siteSettings"          type="bool"/>
     </preferences>
     
     <preferences id="nonItemPreferences">
       <preference id="privacy.sanitize.timeSpan"
                   name="privacy.sanitize.timeSpan"
                   type="int"/>
     </preferences>
@@ -170,17 +171,17 @@
               class="expander-down"
               persist="class"
               oncommand="gSanitizePromptDialog.toggleItemList();"/>
       <label id="detailsExpanderLabel"
              value="&detailsProgressiveDisclosure.label;"
              accesskey="&detailsProgressiveDisclosure.accesskey;"
              control="detailsExpander"/>
     </hbox>
-    <listbox id="itemList" rows="6" collapsed="true" persist="collapsed">
+    <listbox id="itemList" rows="7" collapsed="true" persist="collapsed">
       <listitem label="&itemHistoryAndDownloads.label;"
                 type="checkbox"
                 accesskey="&itemHistoryAndDownloads.accesskey;"
                 preference="privacy.cpd.history"
                 onsyncfrompreference="return gSanitizePromptDialog.onReadGeneric();"/>
       <listitem label="&itemFormSearchHistory.label;"
                 type="checkbox"
                 accesskey="&itemFormSearchHistory.accesskey;"
@@ -196,16 +197,21 @@
                 accesskey="&itemCache.accesskey;"
                 preference="privacy.cpd.cache"
                 onsyncfrompreference="return gSanitizePromptDialog.onReadGeneric();"/>
       <listitem label="&itemActiveLogins.label;"
                 type="checkbox"
                 accesskey="&itemActiveLogins.accesskey;"
                 preference="privacy.cpd.sessions"
                 onsyncfrompreference="return gSanitizePromptDialog.onReadGeneric();"/>
+      <listitem label="&itemOfflineApps.label;"
+                type="checkbox"
+                accesskey="&itemOfflineApps.accesskey;"
+                preference="privacy.cpd.offlineApps"
+                onsyncfrompreference="return gSanitizePromptDialog.onReadGeneric();"/>
       <listitem label="&itemSitePreferences.label;"
                 type="checkbox"
                 accesskey="&itemSitePreferences.accesskey;"
                 preference="privacy.cpd.siteSettings"
                 noduration="true"
                 onsyncfrompreference="return gSanitizePromptDialog.onReadGeneric();"/>
     </listbox>
 

--- a/browser/base/content/syncSetup.js
+++ b/browser/base/content/syncSetup.js
@@ -577,17 +577,18 @@ var gSyncSetup = {
       this.completePairing();
     }
 
     if (!this._resettingSync) {
       function isChecked(element) {
         return document.getElementById(element).hasAttribute("checked");
       }
 
-      let prefs = ["engine.bookmarks", "engine.passwords", "engine.history", "engine.tabs", "engine.prefs"];
+      let prefs = ["engine.bookmarks", "engine.passwords", "engine.history",
+                   "engine.tabs", "engine.prefs", "engine.addons"];
       for (let i = 0;i < prefs.length;i++) {
         Weave.Svc.Prefs.set(prefs[i], isChecked(prefs[i]));
       }
       this._handleNoScript(false);
       if (Weave.Svc.Prefs.get("firstSync", "") == "notReady")
         Weave.Svc.Prefs.reset("firstSync");
 
       Weave.Service.persistLogin();

--- a/browser/base/content/syncSetup.xul
+++ b/browser/base/content/syncSetup.xul
@@ -115,17 +115,17 @@
     </hbox>
   </wizardpage>
 
   <wizardpage id="pickSetupType"
               label="&syncBrand.fullName.label;"
               onpageshow="gSyncSetup.onPageShow()">
     <vbox align="center" flex="1">
       <description style="padding: 0 7em;">
-        &setup.pickSetupType.description;
+        &setup.pickSetupType.description2;
       </description>
       <spacer flex="3"/>
       <button id="newAccount"
               class="accountChoiceButton"
               label="&button.createNewAccount.label;"
               oncommand="gSyncSetup.startNewAccountSetup()"
               align="center"/>
       <spacer flex="1"/>
@@ -423,16 +423,20 @@
             <checkbox label="&engine.history.label;"
                       accesskey="&engine.history.accesskey;"
                       id="engine.history"
                       checked="true"/>
             <checkbox label="&engine.tabs.label;"
                       accesskey="&engine.tabs.accesskey;"
                       id="engine.tabs"
                       checked="true"/>
+            <checkbox label="&engine.addons.label;"
+                      accesskey="&engine.addons.accesskey;"
+                      id="engine.addons"
+                      checked="true"/>
           </vbox>
         </row>
       </rows>
     </grid>
     </groupbox>
 
     <groupbox id="mergeOptions">
       <radiogroup id="mergeChoiceRadio" pack="start">

--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -611,17 +611,18 @@
             onLocationChange: function (aWebProgress, aRequest, aLocation,
                                         aFlags) {
               // OnLocationChange is called for both the top-level content
               // and the subframes.
               let topLevel = aWebProgress.DOMWindow == this.mBrowser.contentWindow;
 
               if (topLevel) {
                 // The document loaded correctly, clear the value if we should
-                if (this.mBrowser.userTypedClear > 0)
+                if (this.mBrowser.userTypedClear > 0 ||
+                    (aRequest && !Components.isSuccessCode(aRequest.status)))
                   this.mBrowser.userTypedValue = null;
 
                 // Clear out the missing plugins list since it's related to the
                 // previous location.
                 this.mBrowser.missingPlugins = null;
 
                 // Don't clear the favicon if this onLocationChange was
                 // triggered by a pushState or a replaceState.  See bug 550565.
@@ -1259,18 +1260,20 @@
               t.setAttribute("fadein", "true");
               setTimeout(function (tabContainer) {
                 tabContainer._handleNewTab(t);
               }, 0, this.tabContainer);
             } else {
               setTimeout(function (tabContainer) {
                 if (t.pinned)
                   tabContainer._handleNewTab(t);
-                else
+                else {
+                  t._animStartTime = Date.now();
                   t.setAttribute("fadein", "true");
+                }
               }, 0, this.tabContainer);
             }
 
             this.tabContainer.appendChild(t);
 
             // invalidate cache, because tabContainer is about to change
             this._browsers = null;
 
@@ -1521,16 +1524,18 @@
                 this._removingTabs.length > 3 /* don't want lots of concurrent animations */ ||
                 aTab.getAttribute("fadein") != "true" /* fade-in transition hasn't been triggered yet */ ||
                 window.getComputedStyle(aTab).maxWidth == "0.1px" /* fade-in transition hasn't moved yet */ ||
                 !Services.prefs.getBoolPref("browser.tabs.animate")) {
               this._endRemoveTab(aTab);
               return;
             }
 
+            aTab._animStartTime = Date.now();
+
             this._blurTab(aTab);
             aTab.style.maxWidth = ""; // ensure that fade-out transition happens
             aTab.removeAttribute("fadein");
 
             setTimeout(function (tab, tabbrowser) {
               if (tab.parentNode &&
                   window.getComputedStyle(tab).maxWidth == "0.1px") {
                 NS_ASSERT(false, "Giving up waiting for the tab closing animation to finish (bug 608589)");
@@ -3252,16 +3257,24 @@
       <handler event="TabSelect" action="this._handleTabSelect();"/>
 
       <handler event="transitionend"><![CDATA[
         if (event.propertyName != "max-width")
           return;
 
         var tab = event.target;
 
+        if (tab._animStartTime) {
+          Services.telemetry.getHistogramById(tab.closing ?
+                                              "FX_TAB_ANIM_CLOSE_MS" :
+                                              "FX_TAB_ANIM_OPEN_MS")
+                            .add(Date.now() - tab._animStartTime);
+          tab._animStartTime = 0;
+        }
+
         if (tab.getAttribute("fadein") == "true") {
           if (tab._fullyOpen)
             this.adjustTabstrip();
           else
             this._handleNewTab(tab);
         } else if (tab.closing) {
           this.tabbrowser._endRemoveTab(tab);
         }

--- a/browser/base/content/test/Makefile.in
+++ b/browser/base/content/test/Makefile.in
@@ -159,16 +159,17 @@ endif
                  browser_bug594131.js \
                  browser_bug595507.js \
                  browser_bug596687.js \
                  browser_bug597218.js \
                  browser_bug598923.js \
                  browser_bug599325.js \
                  browser_bug609700.js \
                  browser_bug616836.js \
+                 browser_bug623155.js \
                  browser_bug623893.js \
                  browser_bug624734.js \
                  browser_bug647886.js \
                  browser_bug655584.js \
                  browser_bug664672.js \
                  browser_bug710878.js \
                  browser_canonizeURL.js \
                  browser_findbarClose.js \
@@ -249,16 +250,17 @@ endif
                  browser_addon_bar_aomlistener.js \
                  test_bug628179.html \
                  browser_wyciwyg_urlbarCopying.js \
                  test_wyciwyg_copying.html \
                  authenticate.sjs \
                  browser_minimize.js \
 								 browser_aboutSyncProgress.js \
                  browser_middleMouse_inherit.js \
+                 redirect_bug623155.sjs \
                  $(NULL)
 
 ifneq (cocoa,$(MOZ_WIDGET_TOOLKIT))
 _BROWSER_FILES += \
 		browser_bug462289.js \
 		$(NULL)
 else
 _BROWSER_FILES += \

--- a/browser/base/content/test/browser_bug594131.js
+++ b/browser/base/content/test/browser_bug594131.js
@@ -30,31 +30,26 @@
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 function test() {
-  let backgroundPref = "browser.tabs.loadBookmarksInBackground";
   let newTab = gBrowser.addTab("http://example.com");
   waitForExplicitFinish();
   newTab.linkedBrowser.addEventListener("load", mainPart, true);
-  
-  Services.prefs.setBoolPref(backgroundPref, true);
-  
+
   function mainPart() {
     newTab.linkedBrowser.removeEventListener("load", mainPart, true);
 
     gBrowser.pinTab(newTab);
     gBrowser.selectedTab = newTab;
-    
-    openUILinkIn("http://example.org/", "current");
+
+    openUILinkIn("http://example.org/", "current", { inBackground: true });
     isnot(gBrowser.selectedTab, newTab, "shouldn't load in background");
-    
-    if (Services.prefs.prefHasUserValue(backgroundPref))
-      Services.prefs.clearUserPref(backgroundPref);
+
     gBrowser.removeTab(newTab);
     gBrowser.removeTab(gBrowser.tabs[1]); // example.org tab
     finish();
   }
 }

new file mode 100644
--- /dev/null
+++ b/browser/base/content/test/browser_bug623155.js
@@ -0,0 +1,134 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+const REDIRECT_FROM = "https://example.com/browser/browser/base/content/test/" +
+                      "redirect_bug623155.sjs";
+
+const REDIRECT_TO = "https://www.bank1.com/"; // Bad-cert host.
+
+function isRedirectedURISpec(aURISpec) {
+  return isRedirectedURI(Services.io.newURI(aURISpec, null, null));
+}
+
+function isRedirectedURI(aURI) {
+  // Compare only their before-hash portion.
+  return Services.io.newURI(REDIRECT_TO, null, null)
+                 .equalsExceptRef(aURI);
+}
+
+/*
+   Test.
+
+1. Load
+https://example.com/browser/browser/base/content/test/redirect_bug623155.sjs#BG
+   in a background tab.
+
+2. The redirected URI is <https://www.bank1.com/#BG>, which displayes a cert
+   error page.
+
+3. Switch the tab to foreground.
+
+4. Check the URLbar's value, expecting <https://www.bank1.com/#BG>
+
+5. Load
+https://example.com/browser/browser/base/content/test/redirect_bug623155.sjs#FG
+   in the foreground tab.
+
+6. The redirected URI is <https://www.bank1.com/#FG>. And this is also
+   a cert-error page.
+
+7. Check the URLbar's value, expecting <https://www.bank1.com/#FG>
+
+8. End.
+
+ */
+
+function test() {
+  waitForExplicitFinish();
+
+  // Load a URI in the background.
+  gNewTab = gBrowser.addTab(REDIRECT_FROM + "#BG");
+  gBrowser.getBrowserForTab(gNewTab)
+          .webProgress
+          .addProgressListener(gWebProgressListener,
+                               Components.interfaces.nsIWebProgress
+                                                    .NOTIFY_LOCATION);
+}
+
+var gWebProgressListener = {
+  QueryInterface: function(aIID) {
+    if (aIID.equals(Components.interfaces.nsIWebProgressListener) ||
+        aIID.equals(Components.interfaces.nsISupportsWeakReference) ||
+        aIID.equals(Components.interfaces.nsISupports))
+      return this;
+    throw Components.results.NS_NOINTERFACE;
+  },
+
+  // ---------------------------------------------------------------------------
+  // NOTIFY_LOCATION mode should work fine without these methods.
+  //
+  //onStateChange: function() {},
+  //onStatusChange: function() {},
+  //onProgressChange: function() {},
+  //onSecurityChange: function() {},
+  //----------------------------------------------------------------------------
+
+  onLocationChange: function(aWebProgress, aRequest, aLocation, aFlags) {
+    if (!aRequest) {
+      // This is bug 673752, or maybe initial "about:blank".
+      return;
+    }
+
+    ok(gNewTab, "There is a new tab.");
+    ok(isRedirectedURI(aLocation), 
+       "onLocationChange catches only redirected URI.");
+
+    if (aLocation.ref == "BG") {
+      // This is background tab's request.
+      isnot(gNewTab, gBrowser.selectedTab, "This is a background tab.");
+    } else if (aLocation.ref == "FG") {
+      // This is foreground tab's request.
+      is(gNewTab, gBrowser.selectedTab, "This is a foreground tab.");
+    }
+    else {
+      // We shonuld not reach here.
+      ok(false, "This URI hash is not expected:" + aLocation.ref);
+    }
+
+    let isSelectedTab = (gNewTab == gBrowser.selectedTab);
+    setTimeout(delayed, 0, isSelectedTab);
+  }
+};
+
+function delayed(aIsSelectedTab) {
+  // Switch tab and confirm URL bar.
+  if (!aIsSelectedTab) {
+    gBrowser.selectedTab = gNewTab;
+  }
+
+  ok(isRedirectedURISpec(content.location.href),
+     "The content area is redirected. aIsSelectedTab:" + aIsSelectedTab);
+  is(gURLBar.value, content.location.href,
+     "The URL bar shows the content URI. aIsSelectedTab:" + aIsSelectedTab);
+
+  if (!aIsSelectedTab) {
+    // If this was a background request, go on a foreground request.
+    content.location = REDIRECT_FROM + "#FG";
+  }
+  else {
+    // Othrewise, nothing to do remains.
+    finish();
+  }
+}
+
+/* Cleanup */
+registerCleanupFunction(function() {
+  if (gNewTab) {
+    gBrowser.getBrowserForTab(gNewTab)
+            .webProgress
+            .removeProgressListener(gWebProgressListener);
+
+    gBrowser.removeTab(gNewTab);
+  }
+  gNewTab = null;
+});

--- a/browser/base/content/test/browser_sanitizeDialog.js
+++ b/browser/base/content/test/browser_sanitizeDialog.js
@@ -458,16 +458,118 @@ var gAllTests = [
       this.checkDetails(false);
 
       // Show details
       this.toggleDetails();
       this.checkDetails(true);
       this.cancelDialog();
     };
     wh.open();
+  },
+  function () {
+    // Test for offline apps data and cache deletion
+
+    // Prepare stuff, we will work with www.example.com
+    var URL = "http://www.example.com";
+
+    var ios = Cc["@mozilla.org/network/io-service;1"]
+              .getService(Ci.nsIIOService);
+    var URI = ios.newURI(URL, null, null);
+
+    var sm = Cc["@mozilla.org/scriptsecuritymanager;1"]
+             .getService(Ci.nsIScriptSecurityManager);
+    var principal = sm.getCodebasePrincipal(URI);
+
+    // Give www.example.com privileges to store offline data
+    var pm = Cc["@mozilla.org/permissionmanager;1"]
+             .getService(Ci.nsIPermissionManager);
+    pm.add(URI, "offline-app", Ci.nsIPermissionManager.ALLOW_ACTION);
+    pm.add(URI, "offline-app", Ci.nsIOfflineCacheUpdateService.ALLOW_NO_WARN);
+
+    // Store some user data to localStorage
+    var dsm = Cc["@mozilla.org/dom/storagemanager;1"]
+             .getService(Ci.nsIDOMStorageManager);
+    var localStorage = dsm.getLocalStorageForPrincipal(principal, URL);
+    localStorage.setItem("test", "value");
+
+    // Store something to the offline cache
+    const nsICache = Components.interfaces.nsICache;
+    var cs = Components.classes["@mozilla.org/network/cache-service;1"]
+             .getService(Components.interfaces.nsICacheService);
+    var session = cs.createSession(URL + "/manifest", nsICache.STORE_OFFLINE, nsICache.STREAM_BASED);
+    var cacheEntry = session.openCacheEntry(URL, nsICache.ACCESS_READ_WRITE, false);
+    var stream = cacheEntry.openOutputStream(0);
+    var content = "content";
+    stream.write(content, content.length);
+    stream.close();
+    cacheEntry.close();
+
+    // Open the dialog
+    let wh = new WindowHelper();
+    wh.onload = function () {
+      this.selectDuration(Sanitizer.TIMESPAN_EVERYTHING);
+      // Show details
+      this.toggleDetails();
+      // Clear only offlineApps
+      this.uncheckAllCheckboxes();
+      this.checkPrefCheckbox("offlineApps", true);
+      this.acceptDialog();
+
+      // Check all has been deleted (data, cache)
+      is(localStorage.length, 0, "DOM storage cleared");
+
+      var size = -1;
+      var visitor = {
+        visitDevice: function (deviceID, deviceInfo)
+        {
+          if (deviceID == "offline")
+            size = deviceInfo.totalSize;
+
+          // Do not enumerate entries
+          return false;
+        },
+
+        visitEntry: function (deviceID, entryInfo)
+        {
+          // Do not enumerate entries.
+          return false;
+        }
+      };
+      cs.visitEntries(visitor);
+      is(size, 0, "offline application cache entries evicted");
+    };
+    wh.open();
+  },
+  function () {
+    // Test for offline apps permission deletion
+
+    // Prepare stuff, we will work with www.example.com
+    var URL = "http://www.example.com";
+
+    var ios = Cc["@mozilla.org/network/io-service;1"]
+              .getService(Ci.nsIIOService);
+    var URI = ios.newURI(URL, null, null);
+
+    // Open the dialog
+    let wh = new WindowHelper();
+    wh.onload = function () {
+      this.selectDuration(Sanitizer.TIMESPAN_EVERYTHING);
+      // Show details
+      this.toggleDetails();
+      // Clear only offlineApps
+      this.uncheckAllCheckboxes();
+      this.checkPrefCheckbox("siteSettings", true);
+      this.acceptDialog();
+
+      // Check all has been deleted (privileges, data, cache)
+      var pm = Cc["@mozilla.org/permissionmanager;1"]
+               .getService(Ci.nsIPermissionManager);
+      is(pm.testPermission(URI, "offline-app"), 0, "offline-app permissions removed");
+    };
+    wh.open();
   }
 ];
 
 // Used as the download database ID for a new download.  Incremented for each
 // new download.  See addDownloadWithMinutesAgo().
 var gDownloadId = 5555551;
 
 // Index in gAllTests of the test currently being run.  Incremented for each
@@ -552,26 +654,34 @@ WindowHelper.prototype = {
     is(cb.length, 1, "found checkbox for " + pref + " preference");
     if (cb[0].checked != aCheckState)
       cb[0].click();
   },
 
   /**
    * Makes sure all the checkboxes are checked.
    */
-  checkAllCheckboxes: function () {
+  _checkAllCheckboxesCustom: function (check) {
     var cb = this.win.document.querySelectorAll("#itemList > [preference]");
     ok(cb.length > 1, "found checkboxes for preferences");
     for (var i = 0; i < cb.length; ++i) {
       var pref = this.win.document.getElementById(cb[i].getAttribute("preference"));
-      if (!pref.value)
+      if (!!pref.value ^ check)
         cb[i].click();
     }
   },
 
+  checkAllCheckboxes: function () {
+    this._checkAllCheckboxesCustom(true);
+  },
+
+  uncheckAllCheckboxes: function () {
+    this._checkAllCheckboxesCustom(false);
+  },
+
   /**
    * @return The details progressive disclosure button
    */
   getDetailsButton: function () {
     return this.win.document.getElementById("detailsExpander");
   },
 
   /**

--- a/browser/base/content/test/browser_sanitizeDialog_treeView.js
+++ b/browser/base/content/test/browser_sanitizeDialog_treeView.js
@@ -396,18 +396,19 @@ WindowHelper.prototype = {
    *        The amount and direction to move
    */
   moveGrippyBy: function (aDelta) {
     if (aDelta === 0)
       return;
     let key = aDelta < 0 ? "UP" : "DOWN";
     let abs = Math.abs(aDelta);
     let treechildren = this.getTree().treeBoxObject.treeBody;
+    treechildren.focus();
     for (let i = 0; i < abs; i++) {
-      EventUtils.sendKey(key, treechildren);
+      EventUtils.sendKey(key);
     }
   },
 
   /**
    * Selects a duration in the duration dropdown.
    *
    * @param aDurVal
    *        One of the Sanitizer.TIMESPAN_* values

new file mode 100644
--- /dev/null
+++ b/browser/base/content/test/redirect_bug623155.sjs
@@ -0,0 +1,16 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/
+ */
+
+const REDIRECT_TO = "https://www.bank1.com/"; // Bad-cert host.
+
+function handleRequest(aRequest, aResponse) {
+ // Set HTTP Status
+ aResponse.setStatusLine(aRequest.httpVersion, 301, "Moved Permanently");
+
+ // Set redirect URI, mirroring the hash value.
+ let hash = (/\#.+/.test(aRequest.path))? 
+              "#" + aRequest.path.split("#")[1]:
+              "";
+ aResponse.setHeader("Location", REDIRECT_TO + hash);
+}

--- a/browser/base/content/urlbarBindings.xml
+++ b/browser/base/content/urlbarBindings.xml
@@ -358,18 +358,16 @@
             if (isMouseEvent)
               where = whereToOpenLink(aTriggeringEvent, false, false);
 
             if (where == "current") {
               loadCurrent();
             } else {
               this.handleRevert();
               let params = { allowThirdPartyFixup: true, postData: postData };
-              if (altEnter)
-                params.inBackground = false;
               if (!this.valueIsTyped)
                 params.isUTF8 = true;
               openUILinkIn(url, where, params);
             }
           } else {
             loadCurrent();
           }
         ]]></body>
@@ -939,17 +937,17 @@
       </method>
 
     </implementation>
   </binding>
 
   <binding id="geolocation-notification" extends="chrome://global/content/bindings/notification.xml#popup-notification">
     <content align="start">
       <xul:image class="popup-notification-icon"
-                 xbl:inherits="popupid"/>
+                 xbl:inherits="popupid,src=icon"/>
       <xul:vbox flex="1">
         <xul:description class="popup-notification-description"
                          xbl:inherits="xbl:text=label"/>
         <xul:spacer flex="1"/>
         <xul:hbox class="popup-notification-button-container"
                   pack="end" align="center">
           <xul:label anonid="learnmore" class="text-link geolocation-text-link"/>
           <xul:spacer flex="1"/>
@@ -983,17 +981,17 @@
         link.href = formatter.formatURLPref("browser.geolocation.warning.infoURL");
       ]]></constructor>
     </implementation>
   </binding>
 
   <binding id="addon-progress-notification" extends="chrome://global/content/bindings/notification.xml#popup-notification">
     <content align="start">
       <xul:image class="popup-notification-icon"
-                 xbl:inherits="popupid"/>
+                 xbl:inherits="popupid,src=icon"/>
       <xul:vbox flex="1">
         <xul:description class="popup-notification-description addon-progress-description"
                          xbl:inherits="xbl:text=label"/>
         <xul:spacer flex="1"/>
         <xul:hbox align="center">
           <xul:progressmeter anonid="progressmeter" flex="1" mode="undetermined" class="popup-progress-meter"/>
           <xul:button anonid="cancel" class="popup-progress-cancel" oncommand="document.getBindingParent(this).cancel()"/>
         </xul:hbox>

--- a/browser/base/content/utilityOverlay.js
+++ b/browser/base/content/utilityOverlay.js
@@ -95,22 +95,17 @@ function openUILink( url, e, ignoreButto
  * The event may be a mouse event (click, double-click, middle-click) or keypress event (enter).
  *
  * On Windows, the modifiers are:
  * Ctrl        new tab, selected
  * Shift       new window
  * Ctrl+Shift  new tab, in background
  * Alt         save
  *
- * You can swap Ctrl and Ctrl+shift by toggling the hidden pref
- * browser.tabs.loadBookmarksInBackground (not browser.tabs.loadInBackground, which
- * is for content area links).
- *
- * Middle-clicking is the same as Ctrl+clicking (it opens a new tab) and it is
- * subject to the shift modifier and pref in the same way.
+ * Middle-clicking is the same as Ctrl+clicking (it opens a new tab).
  *
  * Exceptions: 
  * - Alt is ignored for menu items selected using the keyboard so you don't accidentally save stuff.  
  *    (Currently, the Alt isn't sent here at all for menu items, but that will change in bug 126189.)
  * - Alt is hard to use in context menus, because pressing Alt closes the menu.
  * - Alt can't be used on the bookmarks toolbar because Alt is used for "treat this as something draggable".
  * - The button is ignored for the middle-click-paste-URL feature, since it's always a middle-click.
  */
@@ -241,20 +236,20 @@ function openLinkIn(url, where, params) 
     sa.AppendElement(aPostData);
     sa.AppendElement(allowThirdPartyFixupSupports);
 
     Services.ww.openWindow(w || window, getBrowserURL(),
                            null, "chrome,dialog=no,all", sa);
     return;
   }
 
-  let loadInBackground = aInBackground;
+  let loadInBackground = where == "current" ? false : aInBackground;
   if (loadInBackground == null) {
     loadInBackground = aFromChrome ?
-                         getBoolPref("browser.tabs.loadBookmarksInBackground") :
+                         false :
                          getBoolPref("browser.tabs.loadInBackground");
   }
 
   if (where == "current" && w.gBrowser.selectedTab.pinned) {
     try {
       let uriObj = Services.io.newURI(url, null, null);
       if (!uriObj.schemeIs("javascript") &&
           w.gBrowser.currentURI.host != uriObj.host) {
@@ -298,16 +293,19 @@ function openLinkIn(url, where, params) 
   // content but don't raise the window, since the URI we just loaded may have
   // resulted in a new frontmost window (e.g. "javascript:window.open('');").
   var fm = Components.classes["@mozilla.org/focus-manager;1"].
              getService(Components.interfaces.nsIFocusManager);
   if (window == fm.activeWindow)
     w.content.focus();
   else
     w.gBrowser.selectedBrowser.focus();
+
+  if (!loadInBackground && url == "about:blank")
+    w.focusAndSelectUrlBar();
 }
 
 // Used as an onclick handler for UI elements with link-like behavior.
 // e.g. onclick="checkForMiddleClick(this, event);"
 function checkForMiddleClick(node, event) {
   // We should be using the disabled property here instead of the attribute,
   // but some elements that this function is used with don't support it (e.g.
   // menuitem).

--- a/browser/components/places/src/PlacesUIUtils.jsm
+++ b/browser/components/places/src/PlacesUIUtils.jsm
@@ -724,17 +724,19 @@ var PlacesUIUtils = {
                        .itemHasAnnotation(aNode.itemId, this.LOAD_IN_SIDEBAR_ANNO)) {
           let browserWin = this._getTopBrowserWin();
           if (browserWin) {
             browserWin.openWebPanel(aNode.title, aNode.uri);
             return;
           }
         }
       }
-      aWindow.openUILinkIn(aNode.uri, aWhere);
+      aWindow.openUILinkIn(aNode.uri, aWhere, {
+        inBackground: Services.prefs.getBoolPref("browser.tabs.loadBookmarksInBackground")
+      });
     }
   },
 
   /**
    * Helper for guessing scheme from an url string.
    * Used to avoid nsIURI overhead in frequently called UI functions.
    *
    * @param aUrlString the url to guess the scheme from.

--- a/browser/components/preferences/advanced.js
+++ b/browser/components/preferences/advanced.js
@@ -63,17 +63,18 @@ var gAdvancedPane = {
 
 #ifdef MOZ_UPDATER
     this.updateReadPrefs();
 #endif
     this.updateOfflineApps();
 #ifdef MOZ_CRASHREPORTER
     this.initSubmitCrashes();
 #endif
-    this.updateActualCacheSize();
+    this.updateActualCacheSize("disk");
+    this.updateActualCacheSize("offline");
   },
 
   /**
    * Stores the identity of the current tab in preferences so that the selected
    * tab can be persisted between openings of the preferences window.
    */
   tabSelectionChanged: function ()
   {
@@ -197,40 +198,45 @@ var gAdvancedPane = {
    * Displays a dialog in which proxy settings may be changed.
    */
   showConnections: function ()
   {
     document.documentElement.openSubDialog("chrome://browser/content/preferences/connection.xul",
                                            "", null);
   },
  
-  // Retrieves the amount of space currently used by disk cache
-  updateActualCacheSize: function ()
+  // Retrieves the amount of space currently used by disk or offline cache
+  updateActualCacheSize: function (device)
   {
     var visitor = {
       visitDevice: function (deviceID, deviceInfo)
       {
-        if (deviceID == "disk") {
-          var actualSizeLabel = document.getElementById("actualCacheSize");
+        if (deviceID == device) {
+          var actualSizeLabel = document.getElementById(device == "disk" ?
+                                                        "actualDiskCacheSize" :
+                                                        "actualAppCacheSize");
           var sizeStrings = DownloadUtils.convertByteUnits(deviceInfo.totalSize);
           var prefStrBundle = document.getElementById("bundlePreferences");
-          var sizeStr = prefStrBundle.getFormattedString("actualCacheSize",
-                                                          sizeStrings);
+          var sizeStr = prefStrBundle.getFormattedString(device == "disk" ?
+                                                         "actualDiskCacheSize" :
+                                                         "actualAppCacheSize",
+                                                         sizeStrings);
           actualSizeLabel.value = sizeStr;
         }
         // Do not enumerate entries
         return false;
       },
 
       visitEntry: function (deviceID, entryInfo)
       {
         // Do not enumerate entries.
         return false;
       }
     };
+
     var cacheService =
       Components.classes["@mozilla.org/network/cache-service;1"]
                 .getService(Components.interfaces.nsICacheService);
     cacheService.visitEntries(visitor);
   },
 
   updateCacheSizeUI: function (smartSizeEnabled)
   {
@@ -269,21 +275,33 @@ var gAdvancedPane = {
   },
 
   /**
    * Clears the cache.
    */
   clearCache: function ()
   {
     var cacheService = Components.classes["@mozilla.org/network/cache-service;1"]
-                         	       .getService(Components.interfaces.nsICacheService);
+                                 .getService(Components.interfaces.nsICacheService);
     try {
       cacheService.evictEntries(Components.interfaces.nsICache.STORE_ANYWHERE);
     } catch(ex) {}
-    this.updateActualCacheSize();
+    this.updateActualCacheSize("disk");
+  },
+
+  /**
+   * Clears the application cache.
+   */
+  clearOfflineAppCache: function ()
+  {
+    Components.utils.import("resource:///modules/offlineAppCache.jsm");
+    OfflineAppCacheHelper.clear();
+
+    this.updateActualCacheSize("offline");
+    this.updateOfflineApps();
   },
 
   readOfflineNotify: function()
   {
     var pref = document.getElementById("browser.offline-apps.notify");
     var button = document.getElementById("offlineNotifyExceptions");
     button.disabled = !pref.value;
     return pref.value;
@@ -427,16 +445,17 @@ var gAdvancedPane = {
                        .getService(Components.interfaces.nsIPermissionManager);
     pm.remove(host, "offline-app",
               Components.interfaces.nsIPermissionManager.ALLOW_ACTION);
     pm.remove(host, "offline-app",
               Components.interfaces.nsIOfflineCacheUpdateService.ALLOW_NO_WARN);
 
     list.removeChild(item);
     gAdvancedPane.offlineAppSelected();
+    this.updateActualCacheSize("offline");
   },
 
   // UPDATE TAB
 
   /*
    * Preferences:
    *
    * app.update.enabled

--- a/browser/components/preferences/advanced.xul
+++ b/browser/components/preferences/advanced.xul
@@ -229,22 +229,22 @@
             <hbox align="center">
               <description flex="1" control="connectionSettings">&connectionDesc.label;</description>
               <button id="connectionSettings" icon="network" label="&connectionSettings.label;"
                       accesskey="&connectionSettings.accesskey;"
                       oncommand="gAdvancedPane.showConnections();"/>
             </hbox>
           </groupbox>
 
-          <!-- Cache/Offline apps -->
-          <groupbox id="offlineGroup">
-            <caption label="&offlineStorage.label;"/>
- 
+          <!-- Cache -->
+          <groupbox id="cacheGroup">
+            <caption label="&httpCache.label;"/>
+
             <hbox align="center">
-              <label id="actualCacheSize" flex="1"/>
+              <label id="actualDiskCacheSize" flex="1"/>
               <button id="clearCacheButton" icon="clear"
                       label="&clearCacheNow.label;" accesskey="&clearCacheNow.accesskey;"
                       oncommand="gAdvancedPane.clearCache();"/>
             </hbox>
             <checkbox preference="browser.cache.disk.smart_size.enabled"
                       id="allowSmartSize" flex="1"
                       onsyncfrompreference="return gAdvancedPane.readSmartSizeEnabled();"
                       label="&overrideSmartCacheSize.label;" 
@@ -255,29 +255,41 @@
                      value="&limitCacheSizeBefore.label;"/>
               <textbox id="cacheSize" type="number" size="4" max="1024"
                        preference="browser.cache.disk.capacity"
                        onsyncfrompreference="return gAdvancedPane.readCacheSize();"
                        onsynctopreference="return gAdvancedPane.writeCacheSize();"
                        aria-labelledby="useCacheBefore cacheSize useCacheAfter"/>
               <label id="useCacheAfter" flex="1">&limitCacheSizeAfter.label;</label>
             </hbox>
+          </groupbox>
+
+          <!-- Offline apps -->
+          <groupbox id="offlineGroup">
+            <caption label="&offlineStorage2.label;"/>
+
+            <hbox align="center">
+              <label id="actualAppCacheSize" flex="1"/>
+              <button id="clearOfflineAppCacheButton" icon="clear"
+                      label="&clearOfflineAppCacheNow.label;" accesskey="&clearOfflineAppCacheNow.accesskey;"
+                      oncommand="gAdvancedPane.clearOfflineAppCache();"/>
+            </hbox>
             <hbox align="center">
               <checkbox id="offlineNotify" flex="1"
                         label="&offlineNotify.label;" accesskey="&offlineNotify.accesskey;"
                         preference="browser.offline-apps.notify"
                         onsyncfrompreference="return gAdvancedPane.readOfflineNotify();"/>
               <button id="offlineNotifyExceptions"
                       label="&offlineNotifyExceptions.label;"
                       accesskey="&offlineNotifyExceptions.accesskey;"
                       oncommand="gAdvancedPane.showOfflineExceptions();"/>
             </hbox>
             <hbox>
               <vbox flex="1">
-                <label id="offlineAppsListLabel">&offlineAppsList.label;</label>
+                <label id="offlineAppsListLabel">&offlineAppsList2.label;</label>
                 <listbox id="offlineAppsList"
                          style="height: &offlineAppsList.height;;"
                          flex="1"
                          aria-labelledby="offlineAppsListLabel"
                          onselect="gAdvancedPane.offlineAppSelected(event);">
                 </listbox>
               </vbox>
               <vbox pack="end">

--- a/browser/components/preferences/applications.js
+++ b/browser/components/preferences/applications.js
@@ -474,20 +474,16 @@ HandlerInfoWrapper.prototype = {
 
   //**************************************************************************//
   // Icons
 
   get smallIcon() {
     return this._getIcon(16);
   },
 
-  get largeIcon() {
-    return this._getIcon(32);
-  },
-
   _getIcon: function(aSize) {
     if (this.primaryExtension)
       return "moz-icon://goat." + this.primaryExtension + "?size=" + aSize;
 
     if (this.wrappedHandlerInfo instanceof Ci.nsIMIMEInfo)
       return "moz-icon://goat?size=" + aSize + "&contentType=" + this.type;
 
     // FIXME: consider returning some generic icon when we can't get a URL for
@@ -816,54 +812,47 @@ FeedHandlerInfo.prototype = {
   },
 
 
   //**************************************************************************//
   // Icons
 
   get smallIcon() {
     return this._smallIcon;
-  },
-
-  get largeIcon() {
-    return this._largeIcon;
   }
 
 };
 
 var feedHandlerInfo = {
   __proto__: new FeedHandlerInfo(TYPE_MAYBE_FEED),
   _prefSelectedApp: PREF_FEED_SELECTED_APP, 
   _prefSelectedWeb: PREF_FEED_SELECTED_WEB, 
   _prefSelectedAction: PREF_FEED_SELECTED_ACTION, 
   _prefSelectedReader: PREF_FEED_SELECTED_READER,
   _smallIcon: "chrome://browser/skin/feeds/feedIcon16.png",
-  _largeIcon: "chrome://browser/skin/feeds/feedIcon.png",
   _appPrefLabel: "webFeed"
 }
 
 var videoFeedHandlerInfo = {
   __proto__: new FeedHandlerInfo(TYPE_MAYBE_VIDEO_FEED),
   _prefSelectedApp: PREF_VIDEO_FEED_SELECTED_APP, 
   _prefSelectedWeb: PREF_VIDEO_FEED_SELECTED_WEB, 
   _prefSelectedAction: PREF_VIDEO_FEED_SELECTED_ACTION, 
   _prefSelectedReader: PREF_VIDEO_FEED_SELECTED_READER,
   _smallIcon: "chrome://browser/skin/feeds/videoFeedIcon16.png",
-  _largeIcon: "chrome://browser/skin/feeds/videoFeedIcon.png",
   _appPrefLabel: "videoPodcastFeed"
 }
 
 var audioFeedHandlerInfo = {
   __proto__: new FeedHandlerInfo(TYPE_MAYBE_AUDIO_FEED),
   _prefSelectedApp: PREF_AUDIO_FEED_SELECTED_APP, 
   _prefSelectedWeb: PREF_AUDIO_FEED_SELECTED_WEB, 
   _prefSelectedAction: PREF_AUDIO_FEED_SELECTED_ACTION, 
   _prefSelectedReader: PREF_AUDIO_FEED_SELECTED_READER,
   _smallIcon: "chrome://browser/skin/feeds/audioFeedIcon16.png",
-  _largeIcon: "chrome://browser/skin/feeds/audioFeedIcon.png",
   _appPrefLabel: "audioPodcastFeed"
 }
 
 
 //****************************************************************************//
 // Prefpane Controller
 
 var gApplicationsPane = {