--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -231,17 +231,16 @@ module.exports = {
       "dom/tests/mochitest/**",
       "dom/u2f/**",
       "dom/vr/**",
       "dom/webauthn/**",
       "dom/webgpu/**",
       "dom/websocket/**",
       "dom/workers/**",
       "dom/worklet/**",
-      "dom/xbl/**",
       "dom/xml/**",
       "dom/xslt/**",
       "dom/xul/**",
     ],
     "rules": {
       "consistent-return": "off",
       "mozilla/avoid-removeChild": "off",
       "mozilla/consistent-if-bracing": "off",

--- a/dom/base/moz.build
+++ b/dom/base/moz.build
@@ -520,19 +520,16 @@ LOCAL_INCLUDES += [
     '/layout/xul',
     '/netwerk/base',
     '/netwerk/url-classifier',
     '/security/manager/ssl',
     '/widget',
     '/xpcom/ds',
 ]
 
-if CONFIG['MOZ_XBL']:
-    LOCAL_INCLUDES += ['/dom/xbl']
-
 if CONFIG['MOZ_WEBRTC']:
     LOCAL_INCLUDES += [
         '/netwerk/sctp/datachannel',
     ]
 
 include('/ipc/chromium/chromium-config.mozbuild')
 
 FINAL_LIBRARY = 'xul'

--- a/dom/bindings/moz.build
+++ b/dom/bindings/moz.build
@@ -88,19 +88,16 @@ LOCAL_INCLUDES += [
     '/layout/xul/tree',
     '/media/mtransport',
     '/media/webrtc/',
     '/media/webrtc/signaling/src/common/time_profiling',
     '/media/webrtc/signaling/src/peerconnection',
     '/media/webrtc/trunk/',
 ]
 
-if CONFIG['MOZ_XBL']:
-    LOCAL_INCLUDES += ['/dom/xbl']
-
 LOCAL_INCLUDES += ['/third_party/msgpack/include']
 
 DEFINES['GOOGLE_PROTOBUF_NO_RTTI'] = True
 DEFINES['GOOGLE_PROTOBUF_NO_STATIC_INITIALIZER'] = True
 
 UNIFIED_SOURCES += [
     'BindingUtils.cpp',
     'CallbackInterface.cpp',

--- a/dom/html/moz.build
+++ b/dom/html/moz.build
@@ -248,18 +248,15 @@ LOCAL_INCLUDES += [
     '/layout/forms',
     '/layout/generic',
     '/layout/style',
     '/layout/tables',
     '/layout/xul',
     '/netwerk/base',
 ]
 
-if CONFIG['MOZ_XBL']:
-    LOCAL_INCLUDES += ['/dom/xbl']
-
 FINAL_LIBRARY = 'xul'
 
 if CONFIG['MOZ_ANDROID_HLS_SUPPORT']:
     DEFINES['MOZ_ANDROID_HLS_SUPPORT'] = True
 
 if CONFIG['CC_TYPE'] in ('clang', 'gcc'):
     CXXFLAGS += ['-Wno-error=shadow']

--- a/dom/moz.build
+++ b/dom/moz.build
@@ -103,21 +103,16 @@ DIRS += [
     'serviceworkers',
     'simpledb',
     'reporting',
     'localstorage',
     'prio',
     'l10n',
 ]
 
-if CONFIG['MOZ_XBL']:
-    DIRS += ['xbl']
-else:
-    EXPORTS += ['xbl/stub/nsXBLBinding.h']
-
 if CONFIG['OS_ARCH'] == 'WINNT':
     DIRS += ['plugins/ipc/hangui']
 
 DIRS += ['presentation']
 
 TEST_DIRS += [
     'tests',
     'imptests',

--- a/dom/prototype/moz.build
+++ b/dom/prototype/moz.build
@@ -15,14 +15,11 @@ SOURCES += [
     'PrototypeDocumentContentSink.cpp',
 ]
 
 LOCAL_INCLUDES += [
     '/dom/base',
     '/dom/xul',
 ]
 
-if CONFIG['MOZ_XBL']:
-    LOCAL_INCLUDES += ['/dom/xbl']
-
 MOCHITEST_CHROME_MANIFESTS += ['tests/chrome/chrome.ini']
 
 FINAL_LIBRARY = 'xul'

--- a/dom/svg/moz.build
+++ b/dom/svg/moz.build
@@ -254,13 +254,10 @@ LOCAL_INCLUDES += [
     '/dom/xml',
     '/layout/base',
     '/layout/generic',
     '/layout/style',
     '/layout/svg',
     '/layout/xul',
 ]
 
-if CONFIG['MOZ_XBL']:
-    LOCAL_INCLUDES += ['/dom/xbl']
-
 if CONFIG['CC_TYPE'] in ('clang', 'gcc'):
     CXXFLAGS += ['-Wno-error=shadow']

deleted file mode 100644
--- a/dom/xbl/XBLChildrenElement.cpp
+++ /dev/null
@@ -1,177 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "mozilla/dom/XBLChildrenElement.h"
-
-#include "mozilla/PresShell.h"
-#include "mozilla/dom/NodeListBinding.h"
-#include "nsAttrValueOrString.h"
-#include "nsCharSeparatedTokenizer.h"
-
-namespace mozilla {
-namespace dom {
-
-XBLChildrenElement::~XBLChildrenElement() {}
-
-NS_IMPL_ELEMENT_CLONE(XBLChildrenElement)
-
-nsresult XBLChildrenElement::BeforeSetAttr(int32_t aNamespaceID, nsAtom* aName,
-                                           const nsAttrValueOrString* aValue,
-                                           bool aNotify) {
-  if (aNamespaceID == kNameSpaceID_None) {
-    if (aName == nsGkAtoms::includes) {
-      mIncludes.Clear();
-      if (aValue) {
-        nsCharSeparatedTokenizer tok(
-            aValue->String(), '|',
-            nsCharSeparatedTokenizer::SEPARATOR_OPTIONAL);
-        while (tok.hasMoreTokens()) {
-          mIncludes.AppendElement(NS_Atomize(tok.nextToken()));
-        }
-      }
-    }
-  }
-
-  return nsXMLElement::BeforeSetAttr(aNamespaceID, aName, aValue, aNotify);
-}
-
-void XBLChildrenElement::DoRemoveDefaultContent(bool aNotify) {
-  // Default content is going away, need to tell layout about it first.
-  MOZ_ASSERT(HasChildren(), "Why bothering?");
-  MOZ_ASSERT(GetParentElement());
-
-  // We don't want to do this from frame construction while setting up the
-  // binding initially.
-  if (aNotify) {
-    Element* parent = GetParentElement();
-    if (Document* doc = parent->GetComposedDoc()) {
-      if (PresShell* presShell = doc->GetPresShell()) {
-        presShell->DestroyFramesForAndRestyle(parent);
-      }
-    }
-  }
-
-  for (nsIContent* child = static_cast<nsINode*>(this)->GetFirstChild(); child;
-       child = child->GetNextSibling()) {
-    MOZ_ASSERT(!child->GetPrimaryFrame());
-    MOZ_ASSERT(!child->IsElement() || !child->AsElement()->HasServoData());
-    child->SetXBLInsertionPoint(nullptr);
-  }
-}
-
-}  // namespace dom
-}  // namespace mozilla
-
-using namespace mozilla::dom;
-
-NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(nsAnonymousContentList, mParent)
-
-NS_IMPL_CYCLE_COLLECTING_ADDREF(nsAnonymousContentList)
-NS_IMPL_CYCLE_COLLECTING_RELEASE(nsAnonymousContentList)
-
-NS_INTERFACE_TABLE_HEAD(nsAnonymousContentList)
-  NS_WRAPPERCACHE_INTERFACE_TABLE_ENTRY
-  NS_INTERFACE_TABLE(nsAnonymousContentList, nsINodeList)
-  NS_INTERFACE_TABLE_TO_MAP_SEGUE_CYCLE_COLLECTION(nsAnonymousContentList)
-NS_INTERFACE_MAP_END
-
-uint32_t nsAnonymousContentList::Length() {
-  if (!mParent) {
-    return 0;
-  }
-
-  uint32_t count = 0;
-  for (nsIContent* child = mParent->GetFirstChild(); child;
-       child = child->GetNextSibling()) {
-    if (child->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL)) {
-      XBLChildrenElement* point = static_cast<XBLChildrenElement*>(child);
-      if (point->HasInsertedChildren()) {
-        count += point->InsertedChildrenLength();
-      } else {
-        count += point->GetChildCount();
-      }
-    } else {
-      ++count;
-    }
-  }
-
-  return count;
-}
-
-nsIContent* nsAnonymousContentList::Item(uint32_t aIndex) {
-  if (!mParent) {
-    return nullptr;
-  }
-
-  uint32_t remIndex = aIndex;
-  for (nsIContent* child = mParent->GetFirstChild(); child;
-       child = child->GetNextSibling()) {
-    if (child->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL)) {
-      XBLChildrenElement* point = static_cast<XBLChildrenElement*>(child);
-      if (point->HasInsertedChildren()) {
-        if (remIndex < point->InsertedChildrenLength()) {
-          return point->InsertedChild(remIndex);
-        }
-        remIndex -= point->InsertedChildrenLength();
-      } else {
-        if (remIndex < point->GetChildCount()) {
-          return point->GetChildAt_Deprecated(remIndex);
-        }
-        remIndex -= point->GetChildCount();
-      }
-    } else {
-      if (remIndex == 0) {
-        return child;
-      }
-      --remIndex;
-    }
-  }
-
-  return nullptr;
-}
-
-int32_t nsAnonymousContentList::IndexOf(nsIContent* aContent) {
-  NS_ASSERTION(
-      !aContent->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL),
-      "Looking for insertion point");
-
-  if (!mParent) {
-    return -1;
-  }
-
-  int32_t index = 0;
-  for (nsIContent* child = mParent->GetFirstChild(); child;
-       child = child->GetNextSibling()) {
-    if (child->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL)) {
-      XBLChildrenElement* point = static_cast<XBLChildrenElement*>(child);
-      if (point->HasInsertedChildren()) {
-        int32_t insIndex = point->IndexOfInsertedChild(aContent);
-        if (insIndex != -1) {
-          return index + insIndex;
-        }
-        index += point->InsertedChildrenLength();
-      } else {
-        int32_t insIndex = point->ComputeIndexOf(aContent);
-        if (insIndex != -1) {
-          return index + insIndex;
-        }
-        index += point->GetChildCount();
-      }
-    } else {
-      if (child == aContent) {
-        return index;
-      }
-      ++index;
-    }
-  }
-
-  return -1;
-}
-
-JSObject* nsAnonymousContentList::WrapObject(
-    JSContext* cx, JS::Handle<JSObject*> aGivenProto) {
-  return mozilla::dom::NodeList_Binding::Wrap(cx, this, aGivenProto);
-}

deleted file mode 100644
--- a/dom/xbl/XBLChildrenElement.h
+++ /dev/null
@@ -1,155 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef nsXBLChildrenElement_h___
-#define nsXBLChildrenElement_h___
-
-#include "nsINodeList.h"
-#include "nsBindingManager.h"
-#include "mozilla/dom/nsXMLElement.h"
-
-class nsAnonymousContentList;
-
-namespace mozilla {
-namespace dom {
-
-class XBLChildrenElement : public nsXMLElement {
- public:
-  explicit XBLChildrenElement(
-      already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo)
-      : nsXMLElement(std::move(aNodeInfo)) {}
-
-  // nsISupports
-  NS_INLINE_DECL_REFCOUNTING_INHERITED(XBLChildrenElement, nsXMLElement)
-
-  // nsINode interface methods
-  virtual nsresult Clone(dom::NodeInfo*, nsINode** aResult) const override;
-
-  void AppendInsertedChild(nsIContent* aChild, bool aNotify) {
-    // Appending an inserted child causes the inserted
-    // children to be projected instead of default content.
-    MaybeRemoveDefaultContent(aNotify);
-
-    mInsertedChildren.AppendElement(aChild);
-    aChild->SetXBLInsertionPoint(this);
-  }
-
-  void InsertInsertedChildAt(nsIContent* aChild, uint32_t aIndex) {
-    // Inserting an inserted child causes the inserted
-    // children to be projected instead of default content.
-    MaybeRemoveDefaultContent(true);
-
-    mInsertedChildren.InsertElementAt(aIndex, aChild);
-    aChild->SetXBLInsertionPoint(this);
-  }
-
-  void RemoveInsertedChild(nsIContent* aChild) {
-    // Can't use this assertion as we cheat for dynamic insertions and
-    // only insert in the innermost insertion point.
-    // NS_ASSERTION(mInsertedChildren.Contains(aChild),
-    //             "Removing child that's not there");
-    mInsertedChildren.RemoveElement(aChild);
-
-    // After removing the inserted child, default content
-    // may be projected into this insertion point.
-    //
-    // FIXME: Layout should be told about this before clearing
-    // mInsertedChildren, this leaves stale styles and frames in the frame tree.
-    MaybeSetupDefaultContent();
-  }
-
-  void ClearInsertedChildren() {
-    for (auto* child : mInsertedChildren) {
-      if (child->GetXBLInsertionPoint() == this) {
-        child->SetXBLInsertionPoint(nullptr);
-      }
-    }
-    mInsertedChildren.Clear();
-
-    // After clearing inserted children, default content
-    // will be projected into this insertion point.
-    //
-    // FIXME: Layout should be told about this before clearing
-    // mInsertedChildren, this leaves stale styles and frames in the frame tree.
-    MaybeSetupDefaultContent();
-  }
-
-  void MaybeSetupDefaultContent() {
-    if (!HasInsertedChildren()) {
-      for (nsIContent* child = static_cast<nsINode*>(this)->GetFirstChild();
-           child; child = child->GetNextSibling()) {
-        child->SetXBLInsertionPoint(this);
-      }
-    }
-  }
-
-  void MaybeRemoveDefaultContent(bool aNotify) {
-    if (!HasInsertedChildren() && HasChildren()) {
-      DoRemoveDefaultContent(aNotify);
-    }
-  }
-
-  uint32_t InsertedChildrenLength() { return mInsertedChildren.Length(); }
-
-  bool HasInsertedChildren() { return !mInsertedChildren.IsEmpty(); }
-
-  int32_t IndexOfInsertedChild(nsIContent* aChild) {
-    return mInsertedChildren.IndexOf(aChild);
-  }
-
-  bool Includes(nsIContent* aChild) {
-    NS_ASSERTION(!mIncludes.IsEmpty(),
-                 "Shouldn't check for includes on default insertion point");
-    return mIncludes.Contains(aChild->NodeInfo()->NameAtom());
-  }
-
-  bool IsDefaultInsertion() { return mIncludes.IsEmpty(); }
-
-  nsIContent* InsertedChild(uint32_t aIndex) {
-    return mInsertedChildren[aIndex];
-  }
-
- protected:
-  ~XBLChildrenElement();
-  virtual nsresult BeforeSetAttr(int32_t aNamespaceID, nsAtom* aName,
-                                 const nsAttrValueOrString* aValue,
-                                 bool aNotify) override;
-
-  void DoRemoveDefaultContent(bool aNotify);
-
- private:
-  nsTArray<nsIContent*> mInsertedChildren;  // WEAK
-  nsTArray<RefPtr<nsAtom> > mIncludes;
-};
-
-}  // namespace dom
-}  // namespace mozilla
-
-class nsAnonymousContentList final : public nsINodeList {
- public:
-  explicit nsAnonymousContentList(nsIContent* aParent) : mParent(aParent) {}
-
-  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
-  NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(nsAnonymousContentList)
-
-  // nsINodeList interface
-  virtual int32_t IndexOf(nsIContent* aContent) override;
-  virtual nsINode* GetParentObject() override { return mParent; }
-  virtual nsIContent* Item(uint32_t aIndex) override;
-  uint32_t Length() override;
-
-  virtual JSObject* WrapObject(JSContext* cx,
-                               JS::Handle<JSObject*> aGivenProto) override;
-
-  bool IsListFor(nsIContent* aContent) { return mParent == aContent; }
-
- private:
-  virtual ~nsAnonymousContentList() {}
-
-  nsCOMPtr<nsIContent> mParent;
-};
-
-#endif  // nsXBLChildrenElement_h___

deleted file mode 100644
--- a/dom/xbl/moz.build
+++ /dev/null
@@ -1,54 +0,0 @@
-# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
-# vim: set filetype=python:
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-with Files("**"):
-    BUG_COMPONENT = ("Core", "XBL")
-
-EXPORTS += [
-    'nsBindingManager.h',
-    'nsXBLBinding.h',
-    'nsXBLPrototypeHandler.h',
-    'nsXBLService.h',
-]
-
-EXPORTS.mozilla.dom += [
-    'XBLChildrenElement.h',
-]
-
-UNIFIED_SOURCES += [
-    'nsBindingManager.cpp',
-    'nsXBLBinding.cpp',
-    'nsXBLContentSink.cpp',
-    'nsXBLDocumentInfo.cpp',
-    'nsXBLEventHandler.cpp',
-    'nsXBLProtoImpl.cpp',
-    'nsXBLProtoImplField.cpp',
-    'nsXBLProtoImplMethod.cpp',
-    'nsXBLProtoImplProperty.cpp',
-    'nsXBLPrototypeBinding.cpp',
-    'nsXBLPrototypeHandler.cpp',
-    'nsXBLSerialize.cpp',
-    'nsXBLService.cpp',
-    'XBLChildrenElement.cpp',
-]
-
-LOCAL_INCLUDES += [
-    '/dom/base',
-    '/dom/html',
-    '/dom/xml',
-    '/dom/xul',
-    '/layout/style',
-]
-
-include('/ipc/chromium/chromium-config.mozbuild')
-
-FINAL_LIBRARY = 'xul'
-
-MOCHITEST_MANIFESTS += ['test/mochitest.ini']
-MOCHITEST_CHROME_MANIFESTS += ['test/chrome.ini']
-
-if CONFIG['CC_TYPE'] in ('clang', 'gcc'):
-    CXXFLAGS += ['-Wno-error=shadow']

deleted file mode 100644
--- a/dom/xbl/nsBindingManager.cpp
+++ /dev/null
@@ -1,876 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsBindingManager.h"
-
-#include "nsAutoPtr.h"
-#include "nsCOMPtr.h"
-#include "nsXBLService.h"
-#include "nsIInputStream.h"
-#include "nsIURI.h"
-#include "nsIURL.h"
-#include "nsIChannel.h"
-#include "nsString.h"
-#include "plstr.h"
-#include "nsIContent.h"
-#include "nsIContentInlines.h"
-#include "mozilla/dom/Document.h"
-#include "nsContentUtils.h"
-#include "nsIXMLContentSink.h"
-#include "nsContentCID.h"
-#include "mozilla/dom/XMLDocument.h"
-#include "nsIStreamListener.h"
-#include "ChildIterator.h"
-#include "nsITimer.h"
-
-#include "nsXBLBinding.h"
-#include "nsXBLPrototypeBinding.h"
-#include "nsXBLDocumentInfo.h"
-#include "mozilla/dom/XBLChildrenElement.h"
-#ifdef MOZ_XUL
-#  include "nsXULPrototypeCache.h"
-#endif
-
-#include "nsIWeakReference.h"
-
-#include "nsWrapperCacheInlines.h"
-#include "nsIXPConnect.h"
-#include "nsDOMCID.h"
-#include "nsIScriptGlobalObject.h"
-#include "nsTHashtable.h"
-
-#include "nsIScriptContext.h"
-#include "xpcpublic.h"
-#include "js/Wrapper.h"
-
-#include "nsThreadUtils.h"
-#include "mozilla/dom/NodeListBinding.h"
-#include "mozilla/dom/ScriptSettings.h"
-#include "mozilla/PresShell.h"
-#include "mozilla/PresShellInlines.h"
-#include "mozilla/Unused.h"
-
-using namespace mozilla;
-using namespace mozilla::dom;
-
-// Implement our nsISupports methods
-
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsBindingManager)
-
-NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsBindingManager)
-  tmp->mDestroyed = true;
-
-  if (tmp->mBoundContentSet) tmp->mBoundContentSet->Clear();
-
-  if (tmp->mDocumentTable) tmp->mDocumentTable->Clear();
-
-  if (tmp->mLoadingDocTable) tmp->mLoadingDocTable->Clear();
-
-  if (tmp->mWrapperTable) {
-    tmp->mWrapperTable->Clear();
-    tmp->mWrapperTable = nullptr;
-  }
-
-  NS_IMPL_CYCLE_COLLECTION_UNLINK(mAttachedStack)
-
-  if (tmp->mProcessAttachedQueueEvent) {
-    tmp->mProcessAttachedQueueEvent->Revoke();
-  }
-NS_IMPL_CYCLE_COLLECTION_UNLINK_END
-
-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsBindingManager)
-  // The hashes keyed on nsIContent are traversed from the nsIContent itself.
-  if (tmp->mDocumentTable) {
-    for (auto iter = tmp->mDocumentTable->Iter(); !iter.Done(); iter.Next()) {
-      NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mDocumentTable value");
-      cb.NoteXPCOMChild(iter.UserData());
-    }
-  }
-  if (tmp->mLoadingDocTable) {
-    for (auto iter = tmp->mLoadingDocTable->Iter(); !iter.Done(); iter.Next()) {
-      NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mLoadingDocTable value");
-      cb.NoteXPCOMChild(iter.UserData());
-    }
-  }
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mAttachedStack)
-  // No need to traverse mProcessAttachedQueueEvent, since it'll just
-  // fire at some point or become revoke and drop its ref to us.
-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
-
-NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsBindingManager)
-  NS_INTERFACE_MAP_ENTRY(nsIMutationObserver)
-  NS_INTERFACE_MAP_ENTRY(nsISupports)
-NS_INTERFACE_MAP_END
-
-NS_IMPL_CYCLE_COLLECTING_ADDREF(nsBindingManager)
-NS_IMPL_CYCLE_COLLECTING_RELEASE(nsBindingManager)
-
-// Constructors/Destructors
-nsBindingManager::nsBindingManager(Document* aDocument)
-    : mProcessingAttachedStack(false),
-      mDestroyed(false),
-      mAttachedStackSizeOnOutermost(0),
-      mDocument(aDocument) {}
-
-nsBindingManager::~nsBindingManager(void) { mDestroyed = true; }
-
-nsXBLBinding* nsBindingManager::GetBindingWithContent(
-    const nsIContent* aContent) {
-  nsXBLBinding* binding = aContent ? aContent->GetXBLBinding() : nullptr;
-  return binding ? binding->GetBindingWithContent() : nullptr;
-}
-
-void nsBindingManager::AddBoundContent(nsIContent* aContent) {
-  if (!mBoundContentSet) {
-    mBoundContentSet = new nsTHashtable<nsRefPtrHashKey<nsIContent>>;
-  }
-  mBoundContentSet->PutEntry(aContent);
-}
-
-void nsBindingManager::RemoveBoundContent(nsIContent* aContent) {
-  if (mBoundContentSet) {
-    mBoundContentSet->RemoveEntry(aContent);
-  }
-
-  // The death of the bindings means the death of the JS wrapper.
-  SetWrappedJS(aContent, nullptr);
-}
-
-nsIXPConnectWrappedJS* nsBindingManager::GetWrappedJS(nsIContent* aContent) {
-  if (!mWrapperTable) {
-    return nullptr;
-  }
-
-  if (!aContent || !aContent->HasFlag(NODE_MAY_BE_IN_BINDING_MNGR)) {
-    return nullptr;
-  }
-
-  return mWrapperTable->GetWeak(aContent);
-}
-
-nsresult nsBindingManager::SetWrappedJS(nsIContent* aContent,
-                                        nsIXPConnectWrappedJS* aWrappedJS) {
-  if (mDestroyed) {
-    return NS_OK;
-  }
-
-  if (aWrappedJS) {
-    // lazily create the table, but only when adding elements
-    if (!mWrapperTable) {
-      mWrapperTable = new WrapperHashtable();
-    }
-    aContent->SetFlags(NODE_MAY_BE_IN_BINDING_MNGR);
-
-    NS_ASSERTION(aContent, "key must be non-null");
-    if (!aContent) return NS_ERROR_INVALID_ARG;
-
-    mWrapperTable->Put(aContent, aWrappedJS);
-
-    return NS_OK;
-  }
-
-  // no value, so remove the key from the table
-  if (mWrapperTable) {
-    mWrapperTable->Remove(aContent);
-  }
-
-  return NS_OK;
-}
-
-void nsBindingManager::RemovedFromDocumentInternal(
-    nsIContent* aContent, Document* aOldDocument,
-    DestructorHandling aDestructorHandling) {
-  MOZ_ASSERT(aOldDocument != nullptr, "no old document");
-
-  RefPtr<nsXBLBinding> binding = aContent->GetXBLBinding();
-  if (binding) {
-    // The binding manager may have been destroyed before a runnable
-    // has had a chance to reach this point. If so, we bail out on calling
-    // BindingDetached (which may invoke a XBL destructor) and
-    // ChangeDocument, but we still want to clear out the binding
-    // and insertion parent that may hold references.
-    if (!mDestroyed && aDestructorHandling == eRunDtor) {
-      binding->PrototypeBinding()->BindingDetached(binding->GetBoundElement());
-      binding->ChangeDocument(aOldDocument, nullptr);
-    }
-
-    aContent->AsElement()->SetXBLBinding(nullptr, this);
-  }
-
-  // Clear out insertion point and content lists.
-  aContent->SetXBLInsertionPoint(nullptr);
-}
-
-nsINodeList* nsBindingManager::GetAnonymousNodesFor(nsIContent* aContent) {
-  nsXBLBinding* binding = GetBindingWithContent(aContent);
-  return binding ? binding->GetAnonymousNodeList() : nullptr;
-}
-
-nsresult nsBindingManager::ClearBinding(Element* aElement) {
-  // Hold a ref to the binding so it won't die when we remove it from our table
-  RefPtr<nsXBLBinding> binding = aElement ? aElement->GetXBLBinding() : nullptr;
-
-  if (!binding) {
-    return NS_OK;
-  }
-
-  // For now we can only handle removing a binding if it's the only one
-  NS_ENSURE_FALSE(binding->GetBaseBinding(), NS_ERROR_FAILURE);
-
-  // Hold strong ref in case removing the binding tries to close the
-  // window or something.
-  // XXXbz should that be ownerdoc?  Wouldn't we need a ref to the
-  // currentdoc too?  What's the one that should be passed to
-  // ChangeDocument?
-  nsCOMPtr<Document> doc = aElement->OwnerDoc();
-
-  // Destroy the frames here before the UnbindFromTree happens.
-  if (PresShell* presShell = doc->GetPresShell()) {
-    presShell->DestroyFramesForAndRestyle(aElement);
-  }
-
-  // Finally remove the binding...
-  // XXXbz this doesn't remove the implementation!  Should fix!  Until
-  // then we need the explicit UnhookEventHandlers here.
-  binding->UnhookEventHandlers();
-  binding->ChangeDocument(doc, nullptr);
-  aElement->SetXBLBinding(nullptr, this);
-  binding->MarkForDeath();
-
-  // ...and recreate its frames. We need to do this since the frames may have
-  // been removed and style may have changed due to the removal of the
-  // anonymous children.
-  // XXXbz this should be using the current doc (if any), not the owner doc.
-  // get the shell again, just in case it changed
-  PresShell* presShell = doc->GetPresShell();
-  NS_ENSURE_TRUE(presShell, NS_ERROR_FAILURE);
-  presShell->PostRecreateFramesFor(aElement);
-  return NS_OK;
-}
-
-void nsBindingManager::RemoveFromAttachedQueue(nsXBLBinding* aBinding) {
-  // Don't remove items here as that could mess up an executing
-  // ProcessAttachedQueue. Instead, null the entry in the queue.
-  size_t index = mAttachedStack.IndexOf(aBinding);
-  if (index != nsBindingList::NoIndex) {
-    mAttachedStack[index] = nullptr;
-  }
-}
-
-nsresult nsBindingManager::AddToAttachedQueue(nsXBLBinding* aBinding) {
-  mAttachedStack.AppendElement(aBinding);
-
-  // If we're in the middle of processing our queue already, don't
-  // bother posting the event.
-  if (!mProcessingAttachedStack && !mProcessAttachedQueueEvent) {
-    PostProcessAttachedQueueEvent();
-  }
-
-  // Make sure that flushes will flush out the new items as needed.
-  if (PresShell* presShell = mDocument->GetPresShell()) {
-    presShell->SetNeedStyleFlush();
-  }
-
-  return NS_OK;
-}
-
-void nsBindingManager::PostProcessAttachedQueueEvent() {
-  MOZ_ASSERT(NS_IsMainThread());
-  if (!mDocument) {
-    return;
-  }
-  mProcessAttachedQueueEvent =
-      NewRunnableMethod("nsBindingManager::DoProcessAttachedQueue", this,
-                        &nsBindingManager::DoProcessAttachedQueue);
-  nsresult rv = mDocument->EventTargetFor(TaskCategory::Other)
-                    ->Dispatch(do_AddRef(mProcessAttachedQueueEvent));
-  if (NS_SUCCEEDED(rv)) {
-    mDocument->BlockOnload();
-  }
-}
-
-// static
-void nsBindingManager::PostPAQEventCallback(nsITimer* aTimer, void* aClosure) {
-  RefPtr<nsBindingManager> mgr = already_AddRefed<nsBindingManager>(
-      static_cast<nsBindingManager*>(aClosure));
-  mgr->PostProcessAttachedQueueEvent();
-  NS_RELEASE(aTimer);
-}
-
-void nsBindingManager::DoProcessAttachedQueue() {
-  if (!mProcessingAttachedStack) {
-    ProcessAttachedQueue();
-
-    NS_ASSERTION(mAttachedStack.Length() == 0,
-                 "Shouldn't have pending bindings!");
-
-    mProcessAttachedQueueEvent = nullptr;
-  } else {
-    // Someone's doing event processing from inside a constructor.
-    // They're evil, but we'll fight back!  Just poll on them being
-    // done and repost the attached queue event.
-    //
-    // But don't poll in a tight loop -- otherwise we keep the Gecko
-    // event loop non-empty and trigger bug 1021240 on OS X.
-    nsresult rv = NS_ERROR_FAILURE;
-    nsCOMPtr<nsITimer> timer;
-    rv = NS_NewTimerWithFuncCallback(
-        getter_AddRefs(timer), PostPAQEventCallback, this, 100,
-        nsITimer::TYPE_ONE_SHOT, "nsBindingManager::DoProcessAttachedQueue");
-    if (NS_SUCCEEDED(rv)) {
-      NS_ADDREF_THIS();
-      // We drop our reference to the timer here, since the timer callback is
-      // responsible for releasing the object.
-      Unused << timer.forget().take();
-    }
-  }
-
-  // No matter what, unblock onload for the event that's fired.
-  if (mDocument) {
-    // Hold a strong reference while calling UnblockOnload since that might
-    // run script.
-    nsCOMPtr<Document> doc = mDocument;
-    doc->UnblockOnload(true);
-  }
-}
-
-void nsBindingManager::ProcessAttachedQueueInternal(uint32_t aSkipSize) {
-  mProcessingAttachedStack = true;
-
-  // Excute constructors. Do this from high index to low
-  while (mAttachedStack.Length() > aSkipSize) {
-    uint32_t lastItem = mAttachedStack.Length() - 1;
-    RefPtr<nsXBLBinding> binding = mAttachedStack.ElementAt(lastItem);
-    mAttachedStack.RemoveElementAt(lastItem);
-    if (binding) {
-      binding->ExecuteAttachedHandler();
-    }
-  }
-
-  // If NodeWillBeDestroyed has run we don't want to clobber
-  // mProcessingAttachedStack set there.
-  if (mDocument) {
-    mProcessingAttachedStack = false;
-  }
-
-  NS_ASSERTION(mAttachedStack.Length() == aSkipSize, "How did we get here?");
-
-  mAttachedStack.Compact();
-}
-
-// Keep bindings and bound elements alive while executing detached handlers.
-void nsBindingManager::ExecuteDetachedHandlers() {
-  // Walk our hashtable of bindings.
-  if (!mBoundContentSet) {
-    return;
-  }
-
-  nsCOMArray<nsIContent> boundElements;
-  nsBindingList bindings;
-
-  for (auto iter = mBoundContentSet->Iter(); !iter.Done(); iter.Next()) {
-    nsXBLBinding* binding = iter.Get()->GetKey()->GetXBLBinding();
-    if (binding && bindings.AppendElement(binding)) {
-      if (!boundElements.AppendObject(binding->GetBoundElement())) {
-        bindings.RemoveLastElement();
-      }
-    }
-  }
-
-  uint32_t i, count = bindings.Length();
-  for (i = 0; i < count; ++i) {
-    bindings[i]->ExecuteDetachedHandler();
-  }
-}
-
-nsresult nsBindingManager::PutXBLDocumentInfo(
-    nsXBLDocumentInfo* aDocumentInfo) {
-  MOZ_ASSERT(aDocumentInfo, "Must have a non-null documentinfo!");
-
-  if (!mDocumentTable) {
-    mDocumentTable = new nsRefPtrHashtable<nsURIHashKey, nsXBLDocumentInfo>();
-  }
-
-  mDocumentTable->Put(aDocumentInfo->DocumentURI(), aDocumentInfo);
-
-  return NS_OK;
-}
-
-void nsBindingManager::RemoveXBLDocumentInfo(nsXBLDocumentInfo* aDocumentInfo) {
-  if (mDocumentTable) {
-    mDocumentTable->Remove(aDocumentInfo->DocumentURI());
-  }
-}
-
-nsXBLDocumentInfo* nsBindingManager::GetXBLDocumentInfo(nsIURI* aURL) {
-  if (!mDocumentTable) return nullptr;
-
-  return mDocumentTable->GetWeak(aURL);
-}
-
-nsresult nsBindingManager::PutLoadingDocListener(nsIURI* aURL,
-                                                 nsIStreamListener* aListener) {
-  MOZ_ASSERT(aListener, "Must have a non-null listener!");
-
-  if (!mLoadingDocTable) {
-    mLoadingDocTable =
-        new nsInterfaceHashtable<nsURIHashKey, nsIStreamListener>();
-  }
-  mLoadingDocTable->Put(aURL, aListener);
-
-  return NS_OK;
-}
-
-nsIStreamListener* nsBindingManager::GetLoadingDocListener(nsIURI* aURL) {
-  if (!mLoadingDocTable) return nullptr;
-
-  return mLoadingDocTable->GetWeak(aURL);
-}
-
-void nsBindingManager::RemoveLoadingDocListener(nsIURI* aURL) {
-  if (mLoadingDocTable) {
-    mLoadingDocTable->Remove(aURL);
-  }
-}
-
-// Used below to protect from recurring in QI calls through XPConnect.
-struct AntiRecursionData {
-  nsIContent* element;
-  REFNSIID iid;
-  AntiRecursionData* next;
-
-  AntiRecursionData(nsIContent* aElement, REFNSIID aIID,
-                    AntiRecursionData* aNext)
-      : element(aElement), iid(aIID), next(aNext) {}
-};
-
-nsresult nsBindingManager::GetBindingImplementation(nsIContent* aContent,
-                                                    REFNSIID aIID,
-                                                    void** aResult) {
-  *aResult = nullptr;
-  nsXBLBinding* binding = aContent ? aContent->GetXBLBinding() : nullptr;
-  if (binding) {
-    // The binding should not be asked for nsISupports
-    NS_ASSERTION(!aIID.Equals(NS_GET_IID(nsISupports)),
-                 "Asking a binding for nsISupports");
-    if (binding->ImplementsInterface(aIID)) {
-      nsCOMPtr<nsIXPConnectWrappedJS> wrappedJS = GetWrappedJS(aContent);
-
-      if (wrappedJS) {
-        // Protect from recurring in QI calls through XPConnect.
-        // This can happen when a second binding is being resolved.
-        // At that point a wrappedJS exists, but it doesn't yet know about
-        // the iid we are asking for. So, without this protection,
-        // AggregatedQueryInterface would end up recurring back into itself
-        // through this code.
-        //
-        // With this protection, when we detect the recursion we return
-        // NS_NOINTERFACE in the inner call. The outer call will then fall
-        // through (see below) and build a new chained wrappedJS for the iid.
-        //
-        // We're careful to not assume that only one direct nesting can occur
-        // because there is a call into JS in the middle and we can't assume
-        // that this code won't be reached by some more complex nesting path.
-        //
-        // NOTE: We *assume* this is single threaded, so we can use a
-        // static linked list to do the check.
-
-        static AntiRecursionData* list = nullptr;
-
-        for (AntiRecursionData* p = list; p; p = p->next) {
-          if (p->element == aContent && p->iid.Equals(aIID)) {
-            *aResult = nullptr;
-            return NS_NOINTERFACE;
-          }
-        }
-
-        AntiRecursionData item(aContent, aIID, list);
-        list = &item;
-
-        nsresult rv = wrappedJS->AggregatedQueryInterface(aIID, aResult);
-
-        list = item.next;
-
-        if (*aResult) return rv;
-
-        // No result was found, so this must be another XBL interface.
-        // Fall through to create a new wrapper.
-      }
-
-      // We have never made a wrapper for this implementation.
-      // Create an XPC wrapper for the script object and hand it back.
-      AutoJSAPI jsapi;
-      jsapi.Init();
-      JSContext* cx = jsapi.cx();
-
-      nsIXPConnect* xpConnect = nsContentUtils::XPConnect();
-
-      JS::Rooted<JSObject*> jsobj(cx, aContent->GetWrapper());
-      NS_ENSURE_TRUE(jsobj, NS_NOINTERFACE);
-
-      // If we're using an XBL scope, we need to use the Xray view to the bound
-      // content in order to view the full array of methods defined in the
-      // binding, some of which may not be exposed on the prototype of
-      // untrusted content. We don't need to consider add-on scopes here
-      // because they're chrome-only and no Xrays are involved.
-      //
-      // If there's no separate XBL scope, or if the reflector itself lives in
-      // the XBL scope, we'll end up with the global of the reflector.
-      JS::Rooted<JSObject*> xblScope(cx, xpc::GetXBLScopeOrGlobal(cx, jsobj));
-      NS_ENSURE_TRUE(xblScope, NS_ERROR_UNEXPECTED);
-      JSAutoRealm ar(cx, xblScope);
-      bool ok = JS_WrapObject(cx, &jsobj);
-      NS_ENSURE_TRUE(ok, NS_ERROR_OUT_OF_MEMORY);
-      MOZ_ASSERT_IF(js::IsWrapper(jsobj), xpc::IsXrayWrapper(jsobj));
-
-      nsresult rv = xpConnect->WrapJSAggregatedToNative(aContent, cx, jsobj,
-                                                        aIID, aResult);
-      if (NS_FAILED(rv)) return rv;
-
-      // We successfully created a wrapper.  We will own this wrapper for as
-      // long as the binding remains alive.  At the time the binding is cleared
-      // out of the bindingManager, we will remove the wrapper from the
-      // bindingManager as well.
-      nsISupports* supp = static_cast<nsISupports*>(*aResult);
-      wrappedJS = do_QueryInterface(supp);
-      SetWrappedJS(aContent, wrappedJS);
-
-      return rv;
-    }
-  }
-
-  *aResult = nullptr;
-  return NS_NOINTERFACE;
-}
-
-static void InsertAppendedContent(XBLChildrenElement* aPoint,
-                                  nsIContent* aFirstNewContent) {
-  int32_t insertionIndex;
-  if (nsIContent* prevSibling = aFirstNewContent->GetPreviousSibling()) {
-    // If we have a previous sibling, then it must already be in aPoint. Find
-    // it and insert after it.
-    insertionIndex = aPoint->IndexOfInsertedChild(prevSibling);
-    MOZ_ASSERT(insertionIndex != -1);
-
-    // Our insertion index is one after our previous sibling's index.
-    ++insertionIndex;
-  } else {
-    // Otherwise, we append.
-    // TODO This is wrong for nested insertion points. In that case, we need to
-    // keep track of the right index to insert into.
-    insertionIndex = aPoint->InsertedChildrenLength();
-  }
-
-  // Do the inserting.
-  for (nsIContent* currentChild = aFirstNewContent; currentChild;
-       currentChild = currentChild->GetNextSibling()) {
-    aPoint->InsertInsertedChildAt(currentChild, insertionIndex++);
-  }
-}
-
-void nsBindingManager::ContentAppended(nsIContent* aFirstNewContent) {
-  // Try to find insertion points for all the new kids.
-  XBLChildrenElement* point = nullptr;
-  nsIContent* container = aFirstNewContent->GetParent();
-  nsIContent* parent = container;
-
-  // Handle appending of default content.
-  if (parent && parent->IsActiveChildrenElement()) {
-    XBLChildrenElement* childrenEl = static_cast<XBLChildrenElement*>(parent);
-    if (childrenEl->HasInsertedChildren()) {
-      // Appending default content that isn't being used. Ignore.
-      return;
-    }
-
-    childrenEl->MaybeSetupDefaultContent();
-    parent = childrenEl->GetParent();
-  }
-
-  bool first = true;
-  do {
-    nsXBLBinding* binding = GetBindingWithContent(parent);
-    if (!binding) {
-      break;
-    }
-
-    if (binding->HasFilteredInsertionPoints()) {
-      // There are filtered insertion points involved, handle each child
-      // separately.
-      // We could optimize this in the case when we've nested a few levels
-      // deep already, without hitting bindings that have filtered insertion
-      // points.
-      for (nsIContent* currentChild = aFirstNewContent; currentChild;
-           currentChild = currentChild->GetNextSibling()) {
-        HandleChildInsertion(container, currentChild, true);
-      }
-
-      return;
-    }
-
-    point = binding->GetDefaultInsertionPoint();
-    if (!point) {
-      break;
-    }
-
-    // Even though we're in ContentAppended, nested insertion points force us
-    // to deal with this append as an insertion except in the outermost
-    // binding.
-    if (first) {
-      first = false;
-      for (nsIContent* child = aFirstNewContent; child;
-           child = child->GetNextSibling()) {
-        point->AppendInsertedChild(child, true);
-      }
-    } else {
-      InsertAppendedContent(point, aFirstNewContent);
-    }
-
-    nsIContent* newParent = point->GetParent();
-    if (newParent == parent) {
-      break;
-    }
-    parent = newParent;
-  } while (parent);
-}
-
-void nsBindingManager::ContentInserted(nsIContent* aChild) {
-  HandleChildInsertion(aChild->GetParent(), aChild, false);
-}
-
-void nsBindingManager::ContentRemoved(nsIContent* aChild,
-                                      nsIContent* aPreviousSibling) {
-  aChild->SetXBLInsertionPoint(nullptr);
-
-  XBLChildrenElement* point = nullptr;
-  nsIContent* parent = aChild->GetParent();
-
-  // Handle appending of default content.
-  if (parent && parent->IsActiveChildrenElement()) {
-    XBLChildrenElement* childrenEl = static_cast<XBLChildrenElement*>(parent);
-    if (childrenEl->HasInsertedChildren()) {
-      // Removing default content that isn't being used. Ignore.
-      return;
-    }
-
-    parent = childrenEl->GetParent();
-  }
-
-  do {
-    nsXBLBinding* binding = GetBindingWithContent(parent);
-    if (!binding) {
-      // If aChild is XBL content, it might have <xbl:children> elements
-      // somewhere under it. We need to inform those elements that they're no
-      // longer in the tree so they can tell their distributed children that
-      // they're no longer distributed under them.
-      // XXX This is wrong. We need to do far more work to update the parent
-      // binding's list of insertion points and to get the new insertion parent
-      // for the newly-distributed children correct.
-      if (aChild->GetBindingParent()) {
-        ClearInsertionPointsRecursively(aChild);
-      }
-      return;
-    }
-
-    point = binding->FindInsertionPointFor(aChild);
-    if (!point) {
-      break;
-    }
-
-    point->RemoveInsertedChild(aChild);
-
-    nsIContent* newParent = point->GetParent();
-    if (newParent == parent) {
-      break;
-    }
-    parent = newParent;
-  } while (parent);
-}
-
-void nsBindingManager::ClearInsertionPointsRecursively(nsIContent* aContent) {
-  if (aContent->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL)) {
-    static_cast<XBLChildrenElement*>(aContent)->ClearInsertedChildren();
-  }
-
-  for (nsIContent* child = aContent->GetFirstChild(); child;
-       child = child->GetNextSibling()) {
-    ClearInsertionPointsRecursively(child);
-  }
-}
-
-void nsBindingManager::DropDocumentReference() {
-  mDestroyed = true;
-
-  // Make sure to not run any more XBL constructors
-  mProcessingAttachedStack = true;
-  if (mProcessAttachedQueueEvent) {
-    mProcessAttachedQueueEvent->Revoke();
-  }
-
-  if (mBoundContentSet) {
-    mBoundContentSet->Clear();
-  }
-
-  mDocument = nullptr;
-}
-
-void nsBindingManager::Traverse(nsIContent* aContent,
-                                nsCycleCollectionTraversalCallback& cb) {
-  if (!aContent->HasFlag(NODE_MAY_BE_IN_BINDING_MNGR) ||
-      !aContent->IsElement()) {
-    // Don't traverse if content is not in this binding manager.
-    // We also don't traverse non-elements because there should not
-    // be bindings (checking the flag alone is not sufficient because
-    // the flag is also set on children of insertion points that may be
-    // non-elements).
-    return;
-  }
-
-  if (mBoundContentSet && mBoundContentSet->Contains(aContent)) {
-    NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(
-        cb, "[via binding manager] mBoundContentSet entry");
-    cb.NoteXPCOMChild(aContent);
-  }
-
-  nsIXPConnectWrappedJS* value = GetWrappedJS(aContent);
-  if (value) {
-    NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(
-        cb, "[via binding manager] mWrapperTable key");
-    cb.NoteXPCOMChild(aContent);
-    NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(
-        cb, "[via binding manager] mWrapperTable value");
-    cb.NoteXPCOMChild(value);
-  }
-}
-
-void nsBindingManager::HandleChildInsertion(nsIContent* aContainer,
-                                            nsIContent* aChild, bool aAppend) {
-  MOZ_ASSERT(aChild, "Must have child");
-
-  XBLChildrenElement* point = nullptr;
-  nsIContent* parent = aContainer;
-
-  // Handle insertion of default content.
-  if (parent && parent->IsActiveChildrenElement()) {
-    XBLChildrenElement* childrenEl = static_cast<XBLChildrenElement*>(parent);
-    if (childrenEl->HasInsertedChildren()) {
-      // Inserting default content that isn't being used. Ignore.
-      return;
-    }
-
-    childrenEl->MaybeSetupDefaultContent();
-    parent = childrenEl->GetParent();
-  }
-
-  while (parent) {
-    nsXBLBinding* binding = GetBindingWithContent(parent);
-    if (!binding) {
-      break;
-    }
-
-    point = binding->FindInsertionPointFor(aChild);
-    if (!point) {
-      break;
-    }
-
-    // Insert the child into the proper insertion point.
-    // TODO If there were multiple insertion points, this approximation can be
-    // wrong. We need to re-run the distribution algorithm. In the meantime,
-    // this should work well enough.
-    uint32_t index = aAppend ? point->InsertedChildrenLength() : 0;
-    for (nsIContent* currentSibling = aChild->GetPreviousSibling();
-         currentSibling;
-         currentSibling = currentSibling->GetPreviousSibling()) {
-      // If we find one of our previous siblings in the insertion point, the
-      // index following it is the correct insertion point. Otherwise, we guess
-      // based on whether we're appending or inserting.
-      int32_t pointIndex = point->IndexOfInsertedChild(currentSibling);
-      if (pointIndex != -1) {
-        index = pointIndex + 1;
-        break;
-      }
-    }
-
-    point->InsertInsertedChildAt(aChild, index);
-
-    nsIContent* newParent = point->GetParent();
-    if (newParent == parent) {
-      break;
-    }
-
-    parent = newParent;
-  }
-}
-
-nsIContent* nsBindingManager::FindNestedSingleInsertionPoint(
-    nsIContent* aContainer, bool* aMulti) {
-  *aMulti = false;
-
-  nsIContent* parent = aContainer;
-  if (aContainer->IsActiveChildrenElement()) {
-    if (static_cast<XBLChildrenElement*>(aContainer)->HasInsertedChildren()) {
-      return nullptr;
-    }
-    parent = aContainer->GetParent();
-  }
-
-  while (parent) {
-    nsXBLBinding* binding = GetBindingWithContent(parent);
-    if (!binding) {
-      break;
-    }
-
-    if (binding->HasFilteredInsertionPoints()) {
-      *aMulti = true;
-      return nullptr;
-    }
-
-    XBLChildrenElement* point = binding->GetDefaultInsertionPoint();
-    if (!point) {
-      return nullptr;
-    }
-
-    nsIContent* newParent = point->GetParent();
-    if (newParent == parent) {
-      break;
-    }
-    parent = newParent;
-  }
-
-  return parent;
-}
-
-size_t nsBindingManager::SizeOfIncludingThis(MallocSizeOf aMallocSizeOf) const {
-  size_t n = aMallocSizeOf(this);
-
-#define SHALLOW_SIZE_INCLUDING(field_) \
-  n += field_ ? field_->ShallowSizeOfIncludingThis(aMallocSizeOf) : 0;
-  SHALLOW_SIZE_INCLUDING(mBoundContentSet);
-  SHALLOW_SIZE_INCLUDING(mWrapperTable);
-  SHALLOW_SIZE_INCLUDING(mLoadingDocTable);
-#undef SHALLOW_SIZE_INCLUDING
-  n += mAttachedStack.ShallowSizeOfExcludingThis(aMallocSizeOf);
-
-  if (mDocumentTable) {
-    n += mDocumentTable->ShallowSizeOfIncludingThis(aMallocSizeOf);
-#ifdef MOZ_XUL
-    nsXULPrototypeCache* cache = nsXULPrototypeCache::GetInstance();
-#endif
-    for (auto iter = mDocumentTable->Iter(); !iter.Done(); iter.Next()) {
-      nsXBLDocumentInfo* docInfo = iter.UserData();
-#ifdef MOZ_XUL
-      nsXBLDocumentInfo* cachedInfo = cache->GetXBLDocumentInfo(iter.Key());
-      if (cachedInfo == docInfo) {
-        // If this binding has been cached, skip it since it can be
-        // reused by other documents.
-        continue;
-      }
-#endif
-      n += docInfo->SizeOfIncludingThis(aMallocSizeOf);
-    }
-  }
-
-  return n;
-}

deleted file mode 100644
--- a/dom/xbl/nsBindingManager.h
+++ /dev/null
@@ -1,204 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef nsBindingManager_h_
-#define nsBindingManager_h_
-
-#include "nsAutoPtr.h"
-#include "nsIContent.h"
-#include "nsStubMutationObserver.h"
-#include "nsHashKeys.h"
-#include "nsInterfaceHashtable.h"
-#include "nsRefPtrHashtable.h"
-#include "nsURIHashKey.h"
-#include "nsCycleCollectionParticipant.h"
-#include "nsXBLBinding.h"
-#include "nsTArray.h"
-#include "nsThreadUtils.h"
-#include "mozilla/MediaFeatureChange.h"
-#include "mozilla/MemoryReporting.h"
-#include "mozilla/EventStates.h"
-
-struct ElementDependentRuleProcessorData;
-class nsIXPConnectWrappedJS;
-class nsAtom;
-class nsIURI;
-class nsXBLDocumentInfo;
-class nsIStreamListener;
-class nsXBLBinding;
-typedef nsTArray<RefPtr<nsXBLBinding> > nsBindingList;
-class nsIPrincipal;
-class nsITimer;
-
-class nsBindingManager final : public nsStubMutationObserver {
-  ~nsBindingManager();
-
- public:
-  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
-
-  NS_DECL_NSIMUTATIONOBSERVER_CONTENTAPPENDED
-  NS_DECL_NSIMUTATIONOBSERVER_CONTENTINSERTED
-  NS_DECL_NSIMUTATIONOBSERVER_CONTENTREMOVED
-
-  explicit nsBindingManager(mozilla::dom::Document* aDocument);
-
-  nsXBLBinding* GetBindingWithContent(const nsIContent* aContent);
-
-  void AddBoundContent(nsIContent* aContent);
-  void RemoveBoundContent(nsIContent* aContent);
-
-  /**
-   * Notify the binding manager that an element
-   * has been removed from its document,
-   * so that it can update any bindings or
-   * nsIAnonymousContentCreator-created anonymous
-   * content that may depend on the document.
-   * @param aContent the element that's being moved
-   * @param aOldDocument the old document in which the
-   *   content resided.
-   * @param aDestructorHandling whether or not to run the possible XBL
-   *        destructor.
-   */
-
-  enum DestructorHandling { eRunDtor, eDoNotRunDtor };
-  void RemovedFromDocument(nsIContent* aContent,
-                           mozilla::dom::Document* aOldDocument,
-                           DestructorHandling aDestructorHandling) {
-    if (aContent->HasFlag(NODE_MAY_BE_IN_BINDING_MNGR)) {
-      RemovedFromDocumentInternal(aContent, aOldDocument, aDestructorHandling);
-    }
-  }
-  void RemovedFromDocumentInternal(nsIContent* aContent,
-                                   mozilla::dom::Document* aOldDocument,
-                                   DestructorHandling aDestructorHandling);
-
-  /**
-   * Return the nodelist of "anonymous" kids for this node.  This might
-   * actually include some of the nodes actual DOM kids, if there are
-   * <children> tags directly as kids of <content>.  This will only end up
-   * returning a non-null list for nodes which have a binding attached.
-   */
-  nsINodeList* GetAnonymousNodesFor(nsIContent* aContent);
-
-  nsresult ClearBinding(mozilla::dom::Element* aElement);
-
-  nsresult AddToAttachedQueue(nsXBLBinding* aBinding);
-  void RemoveFromAttachedQueue(nsXBLBinding* aBinding);
-  void ProcessAttachedQueue(uint32_t aSkipSize = 0) {
-    if (mProcessingAttachedStack || mAttachedStack.Length() <= aSkipSize) {
-      return;
-    }
-
-    ProcessAttachedQueueInternal(aSkipSize);
-  }
-
- private:
-  void ProcessAttachedQueueInternal(uint32_t aSkipSize);
-
- public:
-  void ExecuteDetachedHandlers();
-
-  nsresult PutXBLDocumentInfo(nsXBLDocumentInfo* aDocumentInfo);
-  nsXBLDocumentInfo* GetXBLDocumentInfo(nsIURI* aURI);
-  void RemoveXBLDocumentInfo(nsXBLDocumentInfo* aDocumentInfo);
-
-  nsresult PutLoadingDocListener(nsIURI* aURL, nsIStreamListener* aListener);
-  nsIStreamListener* GetLoadingDocListener(nsIURI* aURL);
-  void RemoveLoadingDocListener(nsIURI* aURL);
-
-  nsresult GetBindingImplementation(nsIContent* aContent, REFNSIID aIID,
-                                    void** aResult);
-
-  void Traverse(nsIContent* aContent, nsCycleCollectionTraversalCallback& cb);
-
-  NS_DECL_CYCLE_COLLECTION_CLASS(nsBindingManager)
-
-  // Notify the binding manager when an outermost update begins and
-  // ends.  The end method can execute script.
-  void BeginOutermostUpdate() {
-    mAttachedStackSizeOnOutermost = mAttachedStack.Length();
-  }
-
-  void EndOutermostUpdate() {
-    if (!mProcessingAttachedStack) {
-      ProcessAttachedQueue(mAttachedStackSizeOnOutermost);
-      mAttachedStackSizeOnOutermost = 0;
-    }
-  }
-
-  // When removing an insertion point or a parent of one, clear the insertion
-  // points and their insertion parents.
-  void ClearInsertionPointsRecursively(nsIContent* aContent);
-
-  // Called when the document is going away
-  void DropDocumentReference();
-
-  nsIContent* FindNestedSingleInsertionPoint(nsIContent* aContainer,
-                                             bool* aMulti);
-
-  size_t SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf) const;
-
- protected:
-  nsIXPConnectWrappedJS* GetWrappedJS(nsIContent* aContent);
-  nsresult SetWrappedJS(nsIContent* aContent, nsIXPConnectWrappedJS* aResult);
-
-  // Called by ContentAppended and ContentInserted to handle a single child
-  // insertion.  aChild must not be null.  aContainer may be null.
-  // aAppend is true if this child is being appended, not inserted.
-  void HandleChildInsertion(nsIContent* aContainer, nsIContent* aChild,
-                            bool aAppend);
-
-  // Same as ProcessAttachedQueue, but also nulls out
-  // mProcessAttachedQueueEvent
-  void DoProcessAttachedQueue();
-
-  // Post an event to process the attached queue.
-  void PostProcessAttachedQueueEvent();
-
-  // Call PostProcessAttachedQueueEvent() on a timer.
-  static void PostPAQEventCallback(nsITimer* aTimer, void* aClosure);
-
-  // MEMBER VARIABLES
-  // A set of nsIContent that currently have a binding installed.
-  nsAutoPtr<nsTHashtable<nsRefPtrHashKey<nsIContent> > > mBoundContentSet;
-
-  // A mapping from nsIContent* to nsIXPWrappedJS* (an XPConnect
-  // wrapper for JS objects).  For XBL bindings that implement XPIDL
-  // interfaces, and that get referred to from C++, this table caches
-  // the XPConnect wrapper for the binding.  By caching it, I control
-  // its lifetime, and I prevent a re-wrap of the same script object
-  // (in the case where multiple bindings in an XBL inheritance chain
-  // both implement an XPIDL interface).
-  typedef nsInterfaceHashtable<nsISupportsHashKey, nsIXPConnectWrappedJS>
-      WrapperHashtable;
-  nsAutoPtr<WrapperHashtable> mWrapperTable;
-
-  // A mapping from a URL (a string) to nsXBLDocumentInfo*.  This table
-  // is the cache of all binding documents that have been loaded by a
-  // given bound document.
-  nsAutoPtr<nsRefPtrHashtable<nsURIHashKey, nsXBLDocumentInfo> > mDocumentTable;
-
-  // A mapping from a URL (a string) to a nsIStreamListener. This
-  // table is the currently loading binding docs.  If they're in this
-  // table, they have not yet finished loading.
-  nsAutoPtr<nsInterfaceHashtable<nsURIHashKey, nsIStreamListener> >
-      mLoadingDocTable;
-
-  // A queue of binding attached event handlers that are awaiting execution.
-  nsBindingList mAttachedStack;
-  bool mProcessingAttachedStack;
-  bool mDestroyed;
-  uint32_t mAttachedStackSizeOnOutermost;
-
-  // Our posted event to process the attached queue, if any
-  friend class nsRunnableMethod<nsBindingManager>;
-  RefPtr<nsRunnableMethod<nsBindingManager> > mProcessAttachedQueueEvent;
-
-  // Our document.  This is a weak ref; the document owns us
-  mozilla::dom::Document* mDocument;
-};
-
-#endif

deleted file mode 100644
--- a/dom/xbl/nsXBLBinding.cpp
+++ /dev/null
@@ -1,1028 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsCOMPtr.h"
-#include "nsAtom.h"
-#include "nsXBLDocumentInfo.h"
-#include "nsIInputStream.h"
-#include "nsNameSpaceManager.h"
-#include "nsIURI.h"
-#include "nsIURL.h"
-#include "nsIChannel.h"
-#include "nsString.h"
-#include "nsReadableUtils.h"
-#include "plstr.h"
-#include "nsIContent.h"
-#include "mozilla/dom/BindContext.h"
-#include "mozilla/dom/Document.h"
-#include "nsContentUtils.h"
-#include "ChildIterator.h"
-#include "nsIXMLContentSink.h"
-#include "nsContentCID.h"
-#include "mozilla/dom/XMLDocument.h"
-#include "jsapi.h"
-#include "nsXBLService.h"
-#include "nsIXPConnect.h"
-#include "nsIScriptContext.h"
-#include "nsCRT.h"
-
-// Event listeners
-#include "mozilla/EventListenerManager.h"
-#include "nsIDOMEventListener.h"
-#include "nsAttrName.h"
-
-#include "nsGkAtoms.h"
-
-#include "nsXBLPrototypeHandler.h"
-
-#include "nsXBLPrototypeBinding.h"
-#include "nsXBLBinding.h"
-#include "nsIPrincipal.h"
-#include "nsIScriptSecurityManager.h"
-#include "mozilla/dom/XBLChildrenElement.h"
-
-#include "nsJSUtils.h"
-
-#include "mozilla/DeferredFinalize.h"
-#include "mozilla/dom/Element.h"
-#include "mozilla/dom/ScriptSettings.h"
-
-using namespace mozilla;
-using namespace mozilla::dom;
-
-// Helper classes
-
-/***********************************************************************/
-//
-// The JS class for XBLBinding
-//
-static void XBLFinalize(JSFreeOp* fop, JSObject* obj) {
-  nsXBLDocumentInfo* docInfo =
-      static_cast<nsXBLDocumentInfo*>(::JS_GetPrivate(obj));
-  DeferredFinalize(docInfo);
-}
-
-static bool XBLEnumerate(JSContext* cx, JS::Handle<JSObject*> obj) {
-  nsXBLPrototypeBinding* protoBinding = static_cast<nsXBLPrototypeBinding*>(
-      ::JS_GetReservedSlot(obj, 0).toPrivate());
-  MOZ_ASSERT(protoBinding);
-
-  return protoBinding->ResolveAllFields(cx, obj);
-}
-
-static const JSClassOps gPrototypeJSClassOps = {
-    nullptr,     nullptr, XBLEnumerate, nullptr, nullptr, nullptr,
-    XBLFinalize, nullptr, nullptr,      nullptr, nullptr};
-
-static const JSClass gPrototypeJSClass = {
-    "XBL prototype JSClass",
-    JSCLASS_HAS_PRIVATE | JSCLASS_PRIVATE_IS_NSISUPPORTS |
-        JSCLASS_FOREGROUND_FINALIZE |
-        // Our one reserved slot holds the relevant nsXBLPrototypeBinding
-        JSCLASS_HAS_RESERVED_SLOTS(1),
-    &gPrototypeJSClassOps};
-
-// Implementation //////////////////////////////////////////////////////////////
-
-// Constructors/Destructors
-nsXBLBinding::nsXBLBinding(nsXBLPrototypeBinding* aBinding)
-    : mMarkedForDeath(false),
-      mPrototypeBinding(aBinding),
-      mBoundElement(nullptr) {
-  NS_ASSERTION(mPrototypeBinding, "Must have a prototype binding!");
-  // Grab a ref to the document info so the prototype binding won't die
-  NS_ADDREF(mPrototypeBinding->XBLDocumentInfo());
-}
-
-nsXBLBinding::~nsXBLBinding() {
-  if (mContent) {
-    nsXBLBinding::UnbindAnonymousContent(mContent->OwnerDoc(), mContent);
-  }
-  nsXBLDocumentInfo* info = mPrototypeBinding->XBLDocumentInfo();
-  NS_RELEASE(info);
-}
-
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsXBLBinding)
-
-NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsXBLBinding)
-  // XXX Probably can't unlink mPrototypeBinding->XBLDocumentInfo(), because
-  //     mPrototypeBinding is weak.
-  if (tmp->mContent) {
-    nsXBLBinding::UnbindAnonymousContent(tmp->mContent->OwnerDoc(),
-                                         tmp->mContent);
-  }
-  NS_IMPL_CYCLE_COLLECTION_UNLINK(mContent)
-  NS_IMPL_CYCLE_COLLECTION_UNLINK(mNextBinding)
-  NS_IMPL_CYCLE_COLLECTION_UNLINK(mDefaultInsertionPoint)
-  NS_IMPL_CYCLE_COLLECTION_UNLINK(mInsertionPoints)
-  NS_IMPL_CYCLE_COLLECTION_UNLINK(mAnonymousContentList)
-NS_IMPL_CYCLE_COLLECTION_UNLINK_END
-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsXBLBinding)
-  NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb,
-                                     "mPrototypeBinding->XBLDocumentInfo()");
-  cb.NoteXPCOMChild(tmp->mPrototypeBinding->XBLDocumentInfo());
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mContent)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mNextBinding)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mDefaultInsertionPoint)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mInsertionPoints)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mAnonymousContentList)
-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
-NS_IMPL_CYCLE_COLLECTION_ROOT_NATIVE(nsXBLBinding, AddRef)
-NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(nsXBLBinding, Release)
-
-void nsXBLBinding::SetBaseBinding(nsXBLBinding* aBinding) {
-  if (mNextBinding) {
-    NS_ERROR("Base XBL binding is already defined!");
-    return;
-  }
-
-  mNextBinding = aBinding;  // Comptr handles rel/add
-}
-
-nsXBLBinding* nsXBLBinding::GetBindingWithContent() {
-  if (mContent) {
-    return this;
-  }
-
-  return mNextBinding ? mNextBinding->GetBindingWithContent() : nullptr;
-}
-
-void nsXBLBinding::BindAnonymousContent(nsIContent* aAnonParent,
-                                        nsIContent* aElement) {
-  // We need to ensure two things.
-  // (1) The anonymous content should be fooled into thinking it's in the bound
-  // element's document, assuming that the bound element is in a document
-  // Note that we don't change the current doc of aAnonParent here, since that
-  // quite simply does not matter.  aAnonParent is just a way of keeping refs
-  // to all its kids, which are anonymous content from the point of view of
-  // aElement.
-  // (2) The children's parent back pointer should not be to this synthetic root
-  // but should instead point to the enclosing parent element.
-  Element* element = aElement->AsElement();
-
-  nsAutoScriptBlocker scriptBlocker;
-  BindContext context(*this, *element);
-  for (nsIContent* child = aAnonParent->GetFirstChild(); child;
-       child = child->GetNextSibling()) {
-    child->UnbindFromTree();
-    child->SetFlags(NODE_IS_ANONYMOUS_ROOT);
-    nsresult rv = child->BindToTree(context, *element);
-    if (NS_FAILED(rv)) {
-      // Oh, well... Just give up.
-      // XXXbz This really shouldn't be a void method!
-      child->UnbindFromTree();
-      return;
-    }
-  }
-}
-
-void nsXBLBinding::UnbindAnonymousContent(Document* aDocument,
-                                          nsIContent* aAnonParent,
-                                          bool aNullParent) {
-  nsAutoScriptBlocker scriptBlocker;
-  // Hold a strong ref while doing this, just in case.
-  nsCOMPtr<nsIContent> anonParent = aAnonParent;
-  for (nsIContent* child = aAnonParent->GetFirstChild(); child;
-       child = child->GetNextSibling()) {
-    child->UnbindFromTree(aNullParent);
-  }
-}
-
-void nsXBLBinding::SetBoundElement(Element* aElement) {
-  mBoundElement = aElement;
-  if (mNextBinding) mNextBinding->SetBoundElement(aElement);
-}
-
-void nsXBLBinding::GenerateAnonymousContent() {
-  NS_ASSERTION(!nsContentUtils::IsSafeToRunScript(),
-               "Someone forgot a script blocker");
-
-  // Fetch the content element for this binding.
-  Element* content = mPrototypeBinding->GetImmediateChild(nsGkAtoms::content);
-
-  if (!content) {
-    // We have no anonymous content.
-    if (mNextBinding) mNextBinding->GenerateAnonymousContent();
-
-    return;
-  }
-
-  // Find out if we're really building kids or if we're just
-  // using the attribute-setting shorthand hack.
-  uint32_t contentCount = content->GetChildCount();
-
-  // Plan to build the content by default.
-  bool hasContent = (contentCount > 0);
-  if (hasContent) {
-    Document* doc = mBoundElement->OwnerDoc();
-
-    nsCOMPtr<nsINode> clonedNode =
-        content->Clone(true, doc->NodeInfoManager(), nullptr, IgnoreErrors());
-    // FIXME: Bug 1399558, Why is this code OK assuming that nsINode::Clone
-    // never fails?
-    mContent = clonedNode->AsElement();
-
-    // Search for <xbl:children> elements in the XBL content. In the presence
-    // of multiple default insertion points, we use the last one in document
-    // order.
-    for (nsIContent* child = mContent; child;
-         child = child->GetNextNode(mContent)) {
-      if (child->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL)) {
-        XBLChildrenElement* point = static_cast<XBLChildrenElement*>(child);
-        if (point->IsDefaultInsertion()) {
-          mDefaultInsertionPoint = point;
-        } else {
-          mInsertionPoints.AppendElement(point);
-        }
-      }
-    }
-
-    // Do this after looking for <children> as this messes up the parent
-    // pointer which would make the GetNextNode call above fail
-    BindAnonymousContent(mContent, mBoundElement);
-
-    // Insert explicit children into insertion points
-    if (mDefaultInsertionPoint && mInsertionPoints.IsEmpty()) {
-      ExplicitChildIterator iter(mBoundElement);
-      for (nsIContent* child = iter.GetNextChild(); child;
-           child = iter.GetNextChild()) {
-        // Pass aNotify = false because we're just setting up the whole thing.
-        // Furthermore we do it from frame construction, so passing true here
-        // would reenter into it which is... not great.
-        mDefaultInsertionPoint->AppendInsertedChild(child, false);
-      }
-    } else {
-      // It is odd to come into this code if mInsertionPoints is not empty, but
-      // we need to make sure to do the compatibility hack below if the bound
-      // node has any non <xul:template> or <xul:observes> children.
-      ExplicitChildIterator iter(mBoundElement);
-      for (nsIContent* child = iter.GetNextChild(); child;
-           child = iter.GetNextChild()) {
-        XBLChildrenElement* point = FindInsertionPointForInternal(child);
-        if (point) {
-          // Pass aNotify = false because we're just setting up the whole thing.
-          // (see the similar call above for more details).
-          point->AppendInsertedChild(child, false);
-        } else {
-          NodeInfo* ni = child->NodeInfo();
-          if (!child->TextIsOnlyWhitespace() &&
-              (ni->NamespaceID() != kNameSpaceID_XUL ||
-               (!ni->Equals(nsGkAtoms::_template) &&
-                !ni->Equals(nsGkAtoms::observes)))) {
-            // Compatibility hack. For some reason the original XBL
-            // implementation dropped the content of a binding if any child of
-            // the bound element didn't match any of the <children> in the
-            // binding. This became a pseudo-API that we have to maintain.
-
-            // Undo BindAnonymousContent
-            UnbindAnonymousContent(doc, mContent);
-
-            // Clear out our children elements to avoid dangling references.
-            ClearInsertionPoints();
-
-            // Pretend as though there was no content in the binding.
-            mContent = nullptr;
-            return;
-          }
-        }
-      }
-    }
-
-    // Set binding parent on default content if need
-    if (mDefaultInsertionPoint) {
-      mDefaultInsertionPoint->MaybeSetupDefaultContent();
-    }
-    for (uint32_t i = 0; i < mInsertionPoints.Length(); ++i) {
-      mInsertionPoints[i]->MaybeSetupDefaultContent();
-    }
-
-    mPrototypeBinding->SetInitialAttributes(mBoundElement, mContent);
-  }
-
-  // Always check the content element for potential attributes.
-  // This shorthand hack always happens, even when we didn't
-  // build anonymous content.
-  BorrowedAttrInfo attrInfo;
-  for (uint32_t i = 0; (attrInfo = content->GetAttrInfoAt(i)); ++i) {
-    int32_t namespaceID = attrInfo.mName->NamespaceID();
-    // Hold a strong reference here so that the atom doesn't go away during
-    // UnsetAttr.
-    RefPtr<nsAtom> name = attrInfo.mName->LocalName();
-
-    if (name != nsGkAtoms::includes) {
-      if (!nsContentUtils::HasNonEmptyAttr(mBoundElement, namespaceID, name)) {
-        nsAutoString value2;
-        attrInfo.mValue->ToString(value2);
-        mBoundElement->SetAttr(namespaceID, name, attrInfo.mName->GetPrefix(),
-                               value2, false);
-      }
-    }
-
-    // Conserve space by wiping the attributes off the clone.
-    //
-    // FIXME(emilio): It'd be nice to make `mContent` a `RefPtr<Element>`.
-    if (mContent) mContent->AsElement()->UnsetAttr(namespaceID, name, false);
-  }
-}
-
-nsIURI* nsXBLBinding::GetSourceDocURI() {
-  nsIContent* targetContent =
-      mPrototypeBinding->GetImmediateChild(nsGkAtoms::content);
-  if (!targetContent) {
-    return nullptr;
-  }
-
-  return targetContent->OwnerDoc()->GetDocumentURI();
-}
-
-XBLChildrenElement* nsXBLBinding::FindInsertionPointFor(nsIContent* aChild) {
-  // XXX We should get rid of this function as it causes us to traverse the
-  // binding chain multiple times
-  if (mContent) {
-    return FindInsertionPointForInternal(aChild);
-  }
-
-  return mNextBinding ? mNextBinding->FindInsertionPointFor(aChild) : nullptr;
-}
-
-XBLChildrenElement* nsXBLBinding::FindInsertionPointForInternal(
-    nsIContent* aChild) {
-  for (uint32_t i = 0; i < mInsertionPoints.Length(); ++i) {
-    XBLChildrenElement* point = mInsertionPoints[i];
-    if (point->Includes(aChild)) {
-      return point;
-    }
-  }
-
-  return mDefaultInsertionPoint;
-}
-
-void nsXBLBinding::ClearInsertionPoints() {
-  if (mDefaultInsertionPoint) {
-    mDefaultInsertionPoint->ClearInsertedChildren();
-  }
-
-  for (const auto& insertionPoint : mInsertionPoints) {
-    insertionPoint->ClearInsertedChildren();
-  }
-}
-
-nsAnonymousContentList* nsXBLBinding::GetAnonymousNodeList() {
-  if (!mContent) {
-    return mNextBinding ? mNextBinding->GetAnonymousNodeList() : nullptr;
-  }
-
-  if (!mAnonymousContentList) {
-    mAnonymousContentList = new nsAnonymousContentList(mContent);
-  }
-
-  return mAnonymousContentList;
-}
-
-void nsXBLBinding::InstallEventHandlers() {
-  // Don't install handlers if scripts aren't allowed.
-  if (AllowScripts()) {
-    // Fetch the handlers prototypes for this binding.
-    nsXBLPrototypeHandler* handlerChain =
-        mPrototypeBinding->GetPrototypeHandlers();
-
-    if (handlerChain) {
-      EventListenerManager* manager =
-          mBoundElement->GetOrCreateListenerManager();
-      if (!manager) return;
-
-      bool isChromeDoc = nsContentUtils::IsChromeDoc(mBoundElement->OwnerDoc());
-      bool isChromeBinding = mPrototypeBinding->IsChrome();
-      nsXBLPrototypeHandler* curr;
-      for (curr = handlerChain; curr; curr = curr->GetNextHandler()) {
-        // Fetch the event type.
-        RefPtr<nsAtom> eventAtom = curr->GetEventName();
-        if (!eventAtom || eventAtom == nsGkAtoms::keyup ||
-            eventAtom == nsGkAtoms::keydown || eventAtom == nsGkAtoms::keypress)
-          continue;
-
-        nsXBLEventHandler* handler = curr->GetEventHandler();
-        if (handler) {
-          // Figure out if we're using capturing or not.
-          EventListenerFlags flags;
-          flags.mCapture = (curr->GetPhase() == NS_PHASE_CAPTURING);
-
-          // If this is a command, add it in the system event group
-          if ((curr->GetType() &
-               (NS_HANDLER_TYPE_XBL_COMMAND | NS_HANDLER_TYPE_SYSTEM)) &&
-              (isChromeBinding ||
-               mBoundElement->IsInNativeAnonymousSubtree())) {
-            flags.mInSystemGroup = true;
-          }
-
-          bool hasAllowUntrustedAttr = curr->HasAllowUntrustedAttr();
-          if ((hasAllowUntrustedAttr && curr->AllowUntrustedEvents()) ||
-              (!hasAllowUntrustedAttr && !isChromeDoc)) {
-            flags.mAllowUntrustedEvents = true;
-          }
-
-          manager->AddEventListenerByType(
-              handler, nsDependentAtomString(eventAtom), flags);
-        }
-      }
-
-      const nsCOMArray<nsXBLKeyEventHandler>* keyHandlers =
-          mPrototypeBinding->GetKeyEventHandlers();
-      int32_t i;
-      for (i = 0; i < keyHandlers->Count(); ++i) {
-        nsXBLKeyEventHandler* handler = keyHandlers->ObjectAt(i);
-        handler->SetIsBoundToChrome(isChromeDoc);
-
-        nsAutoString type;
-        handler->GetEventName(type);
-
-        // If this is a command, add it in the system event group, otherwise
-        // add it to the standard event group.
-
-        // Figure out if we're using capturing or not.
-        EventListenerFlags flags;
-        flags.mCapture = (handler->GetPhase() == NS_PHASE_CAPTURING);
-
-        if ((handler->GetType() &
-             (NS_HANDLER_TYPE_XBL_COMMAND | NS_HANDLER_TYPE_SYSTEM)) &&
-            (isChromeBinding || mBoundElement->IsInNativeAnonymousSubtree())) {
-          flags.mInSystemGroup = true;
-        }
-
-        // For key handlers we have to set mAllowUntrustedEvents flag.
-        // Whether the handling of the event is allowed or not is handled in
-        // nsXBLKeyEventHandler::HandleEvent
-        flags.mAllowUntrustedEvents = true;
-
-        manager->AddEventListenerByType(handler, type, flags);
-      }
-    }
-  }
-
-  if (mNextBinding) mNextBinding->InstallEventHandlers();
-}
-
-nsresult nsXBLBinding::InstallImplementation() {
-  // Always install the base class properties first, so that
-  // derived classes can reference the base class properties.
-
-  if (mNextBinding) {
-    nsresult rv = mNextBinding->InstallImplementation();
-    NS_ENSURE_SUCCESS(rv, rv);
-  }
-
-  // iterate through each property in the prototype's list and install the
-  // property.
-  if (AllowScripts()) return mPrototypeBinding->InstallImplementation(this);
-
-  return NS_OK;
-}
-
-void nsXBLBinding::AttributeChanged(nsAtom* aAttribute, int32_t aNameSpaceID,
-                                    bool aRemoveFlag, bool aNotify) {
-  // XXX Change if we ever allow multiple bindings in a chain to contribute
-  // anonymous content
-  if (!mContent) {
-    if (mNextBinding)
-      mNextBinding->AttributeChanged(aAttribute, aNameSpaceID, aRemoveFlag,
-                                     aNotify);
-  } else {
-    mPrototypeBinding->AttributeChanged(aAttribute, aNameSpaceID, aRemoveFlag,
-                                        mBoundElement, mContent, aNotify);
-  }
-}
-
-void nsXBLBinding::ExecuteAttachedHandler() {
-  if (mNextBinding) mNextBinding->ExecuteAttachedHandler();
-
-  if (AllowScripts()) mPrototypeBinding->BindingAttached(mBoundElement);
-}
-
-void nsXBLBinding::ExecuteDetachedHandler() {
-  if (AllowScripts()) mPrototypeBinding->BindingDetached(mBoundElement);
-
-  if (mNextBinding) mNextBinding->ExecuteDetachedHandler();
-}
-
-void nsXBLBinding::UnhookEventHandlers() {
-  nsXBLPrototypeHandler* handlerChain =
-      mPrototypeBinding->GetPrototypeHandlers();
-
-  if (handlerChain) {
-    EventListenerManager* manager = mBoundElement->GetExistingListenerManager();
-    if (!manager) {
-      return;
-    }
-
-    bool isChromeBinding = mPrototypeBinding->IsChrome();
-    nsXBLPrototypeHandler* curr;
-    for (curr = handlerChain; curr; curr = curr->GetNextHandler()) {
-      nsXBLEventHandler* handler = curr->GetCachedEventHandler();
-      if (!handler) {
-        continue;
-      }
-
-      RefPtr<nsAtom> eventAtom = curr->GetEventName();
-      if (!eventAtom || eventAtom == nsGkAtoms::keyup ||
-          eventAtom == nsGkAtoms::keydown || eventAtom == nsGkAtoms::keypress)
-        continue;
-
-      // Figure out if we're using capturing or not.
-      EventListenerFlags flags;
-      flags.mCapture = (curr->GetPhase() == NS_PHASE_CAPTURING);
-
-      // If this is a command, remove it from the system event group,
-      // otherwise remove it from the standard event group.
-
-      if ((curr->GetType() &
-           (NS_HANDLER_TYPE_XBL_COMMAND | NS_HANDLER_TYPE_SYSTEM)) &&
-          (isChromeBinding || mBoundElement->IsInNativeAnonymousSubtree())) {
-        flags.mInSystemGroup = true;
-      }
-
-      manager->RemoveEventListenerByType(
-          handler, nsDependentAtomString(eventAtom), flags);
-    }
-
-    const nsCOMArray<nsXBLKeyEventHandler>* keyHandlers =
-        mPrototypeBinding->GetKeyEventHandlers();
-    int32_t i;
-    for (i = 0; i < keyHandlers->Count(); ++i) {
-      nsXBLKeyEventHandler* handler = keyHandlers->ObjectAt(i);
-
-      nsAutoString type;
-      handler->GetEventName(type);
-
-      // Figure out if we're using capturing or not.
-      EventListenerFlags flags;
-      flags.mCapture = (handler->GetPhase() == NS_PHASE_CAPTURING);
-
-      // If this is a command, remove it from the system event group, otherwise
-      // remove it from the standard event group.
-
-      if ((handler->GetType() &
-           (NS_HANDLER_TYPE_XBL_COMMAND | NS_HANDLER_TYPE_SYSTEM)) &&
-          (isChromeBinding || mBoundElement->IsInNativeAnonymousSubtree())) {
-        flags.mInSystemGroup = true;
-      }
-
-      manager->RemoveEventListenerByType(handler, type, flags);
-    }
-  }
-}
-
-void nsXBLBinding::ChangeDocument(Document* aOldDocument,
-                                  Document* aNewDocument) {
-  if (aOldDocument == aNewDocument) return;
-
-  // Now the binding dies.  Unhook our prototypes.
-  if (mPrototypeBinding->HasImplementation()) {
-    AutoJSAPI jsapi;
-    // Init might fail here if we've cycle-collected the global object, since
-    // the Unlink phase of cycle collection happens after JS GC finalization.
-    // But in that case, we don't care about fixing the prototype chain, since
-    // everything's going away immediately.
-    if (jsapi.Init(aOldDocument->GetScopeObject())) {
-      JSContext* cx = jsapi.cx();
-
-      JS::Rooted<JSObject*> scriptObject(cx, mBoundElement->GetWrapper());
-      if (scriptObject) {
-        // XXX Stay in sync! What if a layered binding has an
-        // <interface>?!
-        // XXXbz what does that comment mean, really?  It seems to date
-        // back to when there was such a thing as an <interface>, whever
-        // that was...
-
-        // Find the right prototype.
-        JSAutoRealm ar(cx, scriptObject);
-
-        JS::Rooted<JSObject*> base(cx, scriptObject);
-        JS::Rooted<JSObject*> proto(cx);
-        for (; true; base = proto) {  // Will break out on null proto
-          if (!JS_GetPrototype(cx, base, &proto)) {
-            return;
-          }
-          if (!proto) {
-            break;
-          }
-
-          if (JS_GetClass(proto) != &gPrototypeJSClass) {
-            // Clearly not the right class
-            continue;
-          }
-
-          RefPtr<nsXBLDocumentInfo> docInfo =
-              static_cast<nsXBLDocumentInfo*>(::JS_GetPrivate(proto));
-          if (!docInfo) {
-            // Not the proto we seek
-            continue;
-          }
-
-          JS::Value protoBinding = ::JS_GetReservedSlot(proto, 0);
-
-          if (protoBinding.toPrivate() != mPrototypeBinding) {
-            // Not the right binding
-            continue;
-          }
-
-          // Alright!  This is the right prototype.  Pull it out of the
-          // proto chain.
-          JS::Rooted<JSObject*> grandProto(cx);
-          if (!JS_GetPrototype(cx, proto, &grandProto)) {
-            return;
-          }
-          ::JS_SetPrototype(cx, base, grandProto);
-          break;
-        }
-
-        mPrototypeBinding->UndefineFields(cx, scriptObject);
-
-        // Don't remove the reference from the document to the
-        // wrapper here since it'll be removed by the element
-        // itself when that's taken out of the document.
-      }
-    }
-  }
-
-  // Remove our event handlers
-  UnhookEventHandlers();
-
-  {
-    nsAutoScriptBlocker scriptBlocker;
-
-    // Then do our ancestors.  This reverses the construction order, so that at
-    // all times things are consistent as far as everyone is concerned.
-    if (mNextBinding) {
-      mNextBinding->ChangeDocument(aOldDocument, aNewDocument);
-    }
-
-    // Update the anonymous content.
-    // XXXbz why not only for style bindings?
-    if (mContent) {
-      nsXBLBinding::UnbindAnonymousContent(aOldDocument, mContent);
-    }
-
-    ClearInsertionPoints();
-  }
-}
-
-// Internal helper methods /////////////////////////////////////////////////////
-
-// Get or create a WeakMap object on a given XBL-hosting global.
-//
-// The scheme is as follows. XBL-hosting globals (either privileged content
-// Windows or XBL scopes) get two lazily-defined WeakMap properties. Each
-// WeakMap is keyed by the grand-proto - i.e. the original prototype of the
-// content before it was bound, and the prototype of the class object that we
-// splice in. The values in the WeakMap are simple dictionary-style objects,
-// mapping from XBL class names to class objects.
-static JSObject* GetOrCreateClassObjectMap(JSContext* cx,
-                                           JS::Handle<JSObject*> scope,
-                                           const char* mapName) {
-  AssertSameCompartment(cx, scope);
-  MOZ_ASSERT(JS_IsGlobalObject(scope));
-  MOZ_ASSERT(scope == xpc::GetXBLScopeOrGlobal(cx, scope));
-
-  // First, see if the map is already defined.
-  JS::Rooted<JS::PropertyDescriptor> desc(cx);
-  if (!JS_GetOwnPropertyDescriptor(cx, scope, mapName, &desc)) {
-    return nullptr;
-  }
-  if (desc.object() && desc.value().isObject() &&
-      JS::IsWeakMapObject(&desc.value().toObject())) {
-    return &desc.value().toObject();
-  }
-
-  // It's not there. Create and define it.
-  JS::Rooted<JSObject*> map(cx, JS::NewWeakMapObject(cx));
-  if (!map || !JS_DefineProperty(cx, scope, mapName, map,
-                                 JSPROP_PERMANENT | JSPROP_READONLY)) {
-    return nullptr;
-  }
-  return map;
-}
-
-static JSObject* GetOrCreateMapEntryForPrototype(JSContext* cx,
-                                                 JS::Handle<JSObject*> proto) {
-  AssertSameCompartment(cx, proto);
-  // We want to hang our class objects off the XBL scope. But since we also
-  // hoist anonymous content into the XBL scope, this creates the potential for
-  // tricky collisions, since we can simultaneously  have a bound in-content
-  // node with grand-proto HTMLDivElement and a bound anonymous node whose
-  // grand-proto is the XBL scope's cross-compartment wrapper to HTMLDivElement.
-  // Since we have to wrap the WeakMap keys into its scope, this distinction
-  // would be lost if we don't do something about it.
-  //
-  // So we define two maps - one class objects that live in content (prototyped
-  // to content prototypes), and the other for class objects that live in the
-  // XBL scope (prototyped to cross-compartment-wrapped content prototypes).
-  const char* name = xpc::IsInContentXBLScope(proto)
-                         ? "__ContentClassObjectMap__"
-                         : "__XBLClassObjectMap__";
-
-  // Now, enter the XBL scope, since that's where we need to operate, and wrap
-  // the proto accordingly. We hang the map off of the content XBL scope for
-  // content, and the Window for chrome (whether add-ons are involved or not).
-  JS::Rooted<JSObject*> scope(
-      cx, xpc::GetXBLScopeOrGlobal(cx, JS::CurrentGlobalOrNull(cx)));
-  NS_ENSURE_TRUE(scope, nullptr);
-  MOZ_ASSERT(JS_IsGlobalObject(scope));
-
-  JS::Rooted<JSObject*> wrappedProto(cx, proto);
-  JSAutoRealm ar(cx, scope);
-  if (!JS_WrapObject(cx, &wrappedProto)) {
-    return nullptr;
-  }
-
-  // Grab the appropriate WeakMap.
-  JS::Rooted<JSObject*> map(cx, GetOrCreateClassObjectMap(cx, scope, name));
-  if (!map) {
-    return nullptr;
-  }
-
-  // See if we already have a map entry for that prototype.
-  JS::Rooted<JS::Value> val(cx);
-  if (!JS::GetWeakMapEntry(cx, map, wrappedProto, &val)) {
-    return nullptr;
-  }
-  if (val.isObject()) {
-    return &val.toObject();
-  }
-
-  // We don't have an entry. Create one and stick it in the map.
-  JS::Rooted<JSObject*> entry(cx);
-  entry = JS_NewObjectWithGivenProto(cx, nullptr, nullptr);
-  if (!entry) {
-    return nullptr;
-  }
-  JS::Rooted<JS::Value> entryVal(cx, JS::ObjectValue(*entry));
-  if (!JS::SetWeakMapEntry(cx, map, wrappedProto, entryVal)) {
-    NS_WARNING(
-        "SetWeakMapEntry failed, probably due to non-preservable WeakMap "
-        "key. XBL binding will fail for this element.");
-    return nullptr;
-  }
-  return entry;
-}
-
-static nsXBLPrototypeBinding* GetProtoBindingFromClassObject(JSObject* obj) {
-  MOZ_ASSERT(JS_GetClass(obj) == &gPrototypeJSClass);
-  return static_cast<nsXBLPrototypeBinding*>(
-      ::JS_GetReservedSlot(obj, 0).toPrivate());
-}
-
-// static
-nsresult nsXBLBinding::DoInitJSClass(JSContext* cx, JS::Handle<JSObject*> obj,
-                                     const nsString& aClassName,
-                                     nsXBLPrototypeBinding* aProtoBinding,
-                                     JS::MutableHandle<JSObject*> aClassObject,
-                                     bool* aNew) {
-  MOZ_ASSERT(obj);
-
-  // Note that, now that NAC reflectors are created in the XBL scope, the
-  // reflector is not necessarily same-compartment with the document. So we'll
-  // end up creating a separate instance of the oddly-named XBL class object
-  // and defining it as a property on the XBL scope's global. This works fine,
-  // but we need to make sure never to assume that the the reflector and
-  // prototype are same-compartment with the bound document.
-  JS::Rooted<JSObject*> global(cx, JS::GetNonCCWObjectGlobal(obj));
-
-  // We must be in obj's realm.
-  MOZ_ASSERT(JS::CurrentGlobalOrNull(cx) == global);
-
-  // We never store class objects in add-on scopes.
-  JS::Rooted<JSObject*> xblScope(cx, xpc::GetXBLScopeOrGlobal(cx, global));
-  NS_ENSURE_TRUE(xblScope, NS_ERROR_UNEXPECTED);
-
-  JS::Rooted<JSObject*> parent_proto(cx);
-  {
-    JS::RootedObject wrapped(cx, obj);
-    JSAutoRealm ar(cx, xblScope);
-    if (!JS_WrapObject(cx, &wrapped)) {
-      return NS_ERROR_FAILURE;
-    }
-    if (!JS_GetPrototype(cx, wrapped, &parent_proto)) {
-      return NS_ERROR_FAILURE;
-    }
-  }
-  if (!JS_WrapObject(cx, &parent_proto)) {
-    return NS_ERROR_FAILURE;
-  }
-
-  // Get the map entry for the parent prototype. In the one-off case that the
-  // parent prototype is null, we somewhat hackily just use the WeakMap itself
-  // as a property holder.
-  JS::Rooted<JSObject*> holder(cx);
-  if (parent_proto) {
-    holder = GetOrCreateMapEntryForPrototype(cx, parent_proto);
-  } else {
-    JSAutoRealm innerAR(cx, xblScope);
-    holder =
-        GetOrCreateClassObjectMap(cx, xblScope, "__ContentClassObjectMap__");
-  }
-  if (NS_WARN_IF(!holder)) {
-    return NS_ERROR_FAILURE;
-  }
-  js::AssertSameCompartment(holder, xblScope);
-  JSAutoRealm ar(cx, holder);
-
-  // Look up the class on the property holder. The only properties on the
-  // holder should be class objects. If we don't find the class object, we need
-  // to create and define it.
-  JS::Rooted<JSObject*> proto(cx);
-  JS::Rooted<JS::PropertyDescriptor> desc(cx);
-  if (!JS_GetOwnUCPropertyDescriptor(cx, holder, aClassName.get(),
-                                     aClassName.Length(), &desc)) {
-    return NS_ERROR_OUT_OF_MEMORY;
-  }
-  *aNew = !desc.object();
-  if (desc.object()) {
-    proto = &desc.value().toObject();
-    DebugOnly<nsXBLPrototypeBinding*> cachedBinding =
-        GetProtoBindingFromClassObject(js::UncheckedUnwrap(proto));
-    MOZ_ASSERT(cachedBinding == aProtoBinding);
-  } else {
-    // We need to create the prototype. First, enter the realm where it's
-    // going to live, and create it.
-    JSAutoRealm ar2(cx, global);
-    proto = JS_NewObjectWithGivenProto(cx, &gPrototypeJSClass, parent_proto);
-    if (!proto) {
-      return NS_ERROR_OUT_OF_MEMORY;
-    }
-
-    // Keep this proto binding alive while we're alive.  Do this first so that
-    // we can guarantee that in XBLFinalize this will be non-null.
-    // Note that we can't just store aProtoBinding in the private and
-    // addref/release the nsXBLDocumentInfo through it, because cycle
-    // collection doesn't seem to work right if the private is not an
-    // nsISupports.
-    nsXBLDocumentInfo* docInfo = aProtoBinding->XBLDocumentInfo();
-    ::JS_SetPrivate(proto, docInfo);
-    NS_ADDREF(docInfo);
-    JS_SetReservedSlot(proto, 0, JS::PrivateValue(aProtoBinding));
-
-    // Don't collect the proto while recording/replaying, to avoid
-    // non-deterministically releasing the docInfo reference.
-    recordreplay::HoldJSObject(proto);
-
-    // Next, enter the realm of the property holder, wrap the proto, and
-    // stick it on.
-    JSAutoRealm ar3(cx, holder);
-    if (!JS_WrapObject(cx, &proto) ||
-        !JS_DefineUCProperty(cx, holder, aClassName.get(), -1, proto,
-                             JSPROP_READONLY | JSPROP_PERMANENT)) {
-      return NS_ERROR_OUT_OF_MEMORY;
-    }
-  }
-
-  // Whew. We have the proto. Wrap it back into the realm of |obj|,
-  // splice it in, and return it.
-  JSAutoRealm ar4(cx, obj);
-  if (!JS_WrapObject(cx, &proto) || !JS_SetPrototype(cx, obj, proto)) {
-    return NS_ERROR_FAILURE;
-  }
-  aClassObject.set(proto);
-  return NS_OK;
-}
-
-bool nsXBLBinding::AllowScripts() {
-  return mBoundElement && mPrototypeBinding->GetAllowScripts();
-}
-
-nsXBLBinding* nsXBLBinding::RootBinding() {
-  if (mNextBinding) return mNextBinding->RootBinding();
-
-  return this;
-}
-
-bool nsXBLBinding::ResolveAllFields(JSContext* cx,
-                                    JS::Handle<JSObject*> obj) const {
-  if (!mPrototypeBinding->ResolveAllFields(cx, obj)) {
-    return false;
-  }
-
-  if (mNextBinding) {
-    return mNextBinding->ResolveAllFields(cx, obj);
-  }
-
-  return true;
-}
-
-bool nsXBLBinding::LookupMember(
-    JSContext* aCx, JS::Handle<jsid> aId,
-    JS::MutableHandle<JS::PropertyDescriptor> aDesc) {
-  // We should never enter this function with a pre-filled property descriptor.
-  MOZ_ASSERT(!aDesc.object());
-
-  // Get the string as an nsString before doing anything, so we can make
-  // convenient comparisons during our search.
-  if (!JSID_IS_STRING(aId)) {
-    return true;
-  }
-  nsAutoJSString name;
-  if (!name.init(aCx, JSID_TO_STRING(aId))) {
-    return false;
-  }
-
-  // We have a weak reference to our bound element, so make sure it's alive.
-  if (!mBoundElement || !mBoundElement->GetWrapper()) {
-    return false;
-  }
-
-  // Get the scope of mBoundElement and the associated XBL scope. We should only
-  // be calling into this machinery if we're running in a separate XBL scope.
-  //
-  // Note that we only end up in LookupMember for XrayWrappers from XBL scopes
-  // into content. So for NAC reflectors that live in the XBL scope, we should
-  // never get here. But on the off-chance that someone adds new callsites to
-  // LookupMember, we do a release-mode assertion as belt-and-braces.
-  // We do a release-mode assertion here to be extra safe.
-  //
-  // This code is only called for content XBL, so we don't have to worry about
-  // add-on scopes here.
-  JS::Rooted<JSObject*> boundScope(
-      aCx, JS::GetNonCCWObjectGlobal(mBoundElement->GetWrapper()));
-  MOZ_RELEASE_ASSERT(!xpc::IsInContentXBLScope(boundScope));
-  JS::Rooted<JSObject*> xblScope(aCx, xpc::GetXBLScope(aCx, boundScope));
-  NS_ENSURE_TRUE(xblScope, false);
-  MOZ_ASSERT(boundScope != xblScope);
-
-  // Enter the xbl scope and invoke the internal version.
-  {
-    JSAutoRealm ar(aCx, xblScope);
-    JS::Rooted<jsid> id(aCx, aId);
-    if (!LookupMemberInternal(aCx, name, id, aDesc, xblScope)) {
-      return false;
-    }
-  }
-
-  // Wrap into the caller's scope.
-  return JS_WrapPropertyDescriptor(aCx, aDesc);
-}
-
-bool nsXBLBinding::LookupMemberInternal(
-    JSContext* aCx, nsString& aName, JS::Handle<jsid> aNameAsId,
-    JS::MutableHandle<JS::PropertyDescriptor> aDesc,
-    JS::Handle<JSObject*> aXBLScope) {
-  // First, see if we have an implementation. If we don't, it means that this
-  // binding doesn't have a class object, and thus doesn't have any members.
-  // Skip it.
-  if (!PrototypeBinding()->HasImplementation()) {
-    if (!mNextBinding) {
-      return true;
-    }
-    return mNextBinding->LookupMemberInternal(aCx, aName, aNameAsId, aDesc,
-                                              aXBLScope);
-  }
-
-  // Find our class object. It's in a protected scope and permanent just in
-  // case, so should be there no matter what.
-  JS::Rooted<JS::Value> classObject(aCx);
-  if (!JS_GetUCProperty(aCx, aXBLScope, PrototypeBinding()->ClassName().get(),
-                        -1, &classObject)) {
-    return false;
-  }
-
-  // The bound element may have been adoped by a document and have a different
-  // wrapper (and different xbl scope) than when the binding was applied, in
-  // this case getting the class object will fail. Behave as if the class
-  // object did not exist.
-  if (classObject.isUndefined()) {
-    return true;
-  }
-
-  MOZ_ASSERT(classObject.isObject());
-
-  // Look for the property on this binding. If it's not there, try the next
-  // binding on the chain.
-  nsXBLProtoImpl* impl = mPrototypeBinding->GetImplementation();
-  JS::Rooted<JSObject*> object(aCx, &classObject.toObject());
-  if (impl && !impl->LookupMember(aCx, aName, aNameAsId, aDesc, object)) {
-    return false;
-  }
-  if (aDesc.object() || !mNextBinding) {
-    return true;
-  }
-
-  return mNextBinding->LookupMemberInternal(aCx, aName, aNameAsId, aDesc,
-                                            aXBLScope);
-}
-
-bool nsXBLBinding::HasField(nsString& aName) {
-  // See if this binding has such a field.
-  return mPrototypeBinding->FindField(aName) ||
-         (mNextBinding && mNextBinding->HasField(aName));
-}
-
-void nsXBLBinding::MarkForDeath() {
-  mMarkedForDeath = true;
-  ExecuteDetachedHandler();
-}
-
-bool nsXBLBinding::ImplementsInterface(REFNSIID aIID) const {
-  return mPrototypeBinding->ImplementsInterface(aIID) ||
-         (mNextBinding && mNextBinding->ImplementsInterface(aIID));
-}

deleted file mode 100644
--- a/dom/xbl/nsXBLBinding.h
+++ /dev/null
@@ -1,176 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef nsXBLBinding_h_
-#define nsXBLBinding_h_
-
-#include "nsXBLService.h"
-#include "nsCOMPtr.h"
-#include "nsINodeList.h"
-#include "nsClassHashtable.h"
-#include "nsTArray.h"
-#include "nsCycleCollectionParticipant.h"
-#include "nsISupportsImpl.h"
-#include "js/TypeDecls.h"
-
-class nsXBLPrototypeBinding;
-class nsIContent;
-class nsAtom;
-struct RawServoAuthorStyles;
-
-namespace mozilla {
-namespace dom {
-class Document;
-class XBLChildrenElement;
-}  // namespace dom
-}  // namespace mozilla
-
-class nsAnonymousContentList;
-
-// *********************************************************************/
-// The XBLBinding class
-
-class nsXBLBinding final {
- public:
-  explicit nsXBLBinding(nsXBLPrototypeBinding* aProtoBinding);
-
-  /**
-   * XBLBindings are refcounted.  They are held onto in 3 ways:
-   * 1. The binding manager's binding table holds onto all bindings that are
-   *    currently attached to a content node.
-   * 2. Bindings hold onto their base binding.  This is important since
-   *    the base binding itself may not be attached to anything.
-   * 3. The binding manager holds an additional reference to bindings
-   *    which are queued to fire their constructors.
-   */
-
-  NS_INLINE_DECL_CYCLE_COLLECTING_NATIVE_REFCOUNTING(nsXBLBinding)
-
-  NS_DECL_CYCLE_COLLECTION_NATIVE_CLASS(nsXBLBinding)
-
-  nsXBLPrototypeBinding* PrototypeBinding() const { return mPrototypeBinding; }
-  nsIContent* GetAnonymousContent() { return mContent.get(); }
-  nsXBLBinding* GetBindingWithContent();
-
-  nsXBLBinding* GetBaseBinding() const { return mNextBinding; }
-  void SetBaseBinding(nsXBLBinding* aBinding);
-
-  mozilla::dom::Element* GetBoundElement() { return mBoundElement; }
-  void SetBoundElement(mozilla::dom::Element* aElement);
-
-  /*
-   * Does a lookup for a method or attribute provided by one of the bindings'
-   * prototype implementation. If found, |desc| will be set up appropriately,
-   * and wrapped into cx->compartment.
-   *
-   * May only be called when XBL code is being run in a separate scope, because
-   * otherwise we don't have untainted data with which to do a proper lookup.
-   */
-  bool LookupMember(JSContext* aCx, JS::Handle<jsid> aId,
-                    JS::MutableHandle<JS::PropertyDescriptor> aDesc);
-
-  /*
-   * Determines whether the binding has a field with the given name.
-   */
-  bool HasField(nsString& aName);
-
- protected:
-  ~nsXBLBinding();
-
-  /*
-   * Internal version. Requires that aCx is in appropriate xbl scope.
-   */
-  bool LookupMemberInternal(JSContext* aCx, nsString& aName,
-                            JS::Handle<jsid> aNameAsId,
-                            JS::MutableHandle<JS::PropertyDescriptor> aDesc,
-                            JS::Handle<JSObject*> aXBLScope);
-
- public:
-  void MarkForDeath();
-  bool MarkedForDeath() const { return mMarkedForDeath; }
-
-  bool ImplementsInterface(REFNSIID aIID) const;
-
-  void GenerateAnonymousContent();
-  void BindAnonymousContent(nsIContent* aAnonParent, nsIContent* aElement);
-  static void UnbindAnonymousContent(mozilla::dom::Document* aDocument,
-                                     nsIContent* aAnonParent,
-                                     bool aNullParent = true);
-  void InstallEventHandlers();
-  nsresult InstallImplementation();
-
-  void ExecuteAttachedHandler();
-  void ExecuteDetachedHandler();
-  void UnhookEventHandlers();
-
-  nsXBLBinding* RootBinding();
-
-  // Resolve all the fields for this binding and all ancestor bindings on the
-  // object |obj|.  False return means a JS exception was set.
-  bool ResolveAllFields(JSContext* cx, JS::Handle<JSObject*> obj) const;
-
-  void AttributeChanged(nsAtom* aAttribute, int32_t aNameSpaceID,
-                        bool aRemoveFlag, bool aNotify);
-
-  void ChangeDocument(mozilla::dom::Document* aOldDocument,
-                      mozilla::dom::Document* aNewDocument);
-
-  const RawServoAuthorStyles* GetServoStyles() const;
-
-  static nsresult DoInitJSClass(JSContext* cx, JS::Handle<JSObject*> obj,
-                                const nsString& aClassName,
-                                nsXBLPrototypeBinding* aProtoBinding,
-                                JS::MutableHandle<JSObject*> aClassObject,
-                                bool* aNew);
-
-  bool AllowScripts();
-
-  mozilla::dom::XBLChildrenElement* FindInsertionPointFor(nsIContent* aChild);
-
-  bool HasFilteredInsertionPoints() { return !mInsertionPoints.IsEmpty(); }
-
-  mozilla::dom::XBLChildrenElement* GetDefaultInsertionPoint() {
-    return mDefaultInsertionPoint;
-  }
-
-  // Removes all inserted node from <xbl:children> insertion points under us.
-  void ClearInsertionPoints();
-
-  // Returns a live node list that iterates over the anonymous nodes generated
-  // by this binding.
-  nsAnonymousContentList* GetAnonymousNodeList();
-
-  nsIURI* GetSourceDocURI();
-
-  // MEMBER VARIABLES
- protected:
-  bool mMarkedForDeath;
-
-  nsXBLPrototypeBinding*
-      mPrototypeBinding;  // Weak, but we're holding a ref to the docinfo
-  nsCOMPtr<nsIContent>
-      mContent;  // Strong. Our anonymous content stays around with us.
-  RefPtr<nsXBLBinding> mNextBinding;  // Strong. The derived binding owns the
-                                      // base class bindings.
-
-  mozilla::dom::Element*
-      mBoundElement;  // [WEAK] We have a reference, but we don't own it.
-
-  // The <xbl:children> elements that we found in our <xbl:content> when we
-  // processed this binding. The default insertion point has no includes
-  // attribute and all other insertion points must have at least one includes
-  // attribute. These points must be up-to-date with respect to their parent's
-  // children, even if their parent has another binding attached to it,
-  // preventing us from rendering their contents directly.
-  RefPtr<mozilla::dom::XBLChildrenElement> mDefaultInsertionPoint;
-  nsTArray<RefPtr<mozilla::dom::XBLChildrenElement> > mInsertionPoints;
-  RefPtr<nsAnonymousContentList> mAnonymousContentList;
-
-  mozilla::dom::XBLChildrenElement* FindInsertionPointForInternal(
-      nsIContent* aChild);
-};
-
-#endif  // nsXBLBinding_h_

deleted file mode 100644
--- a/dom/xbl/nsXBLContentSink.cpp
+++ /dev/null
@@ -1,802 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "mozilla/ArrayUtils.h"
-
-#include "nsXBLContentSink.h"
-#include "mozilla/dom/Document.h"
-#include "nsBindingManager.h"
-#include "nsGkAtoms.h"
-#include "nsNameSpaceManager.h"
-#include "nsIURI.h"
-#include "nsTextFragment.h"
-#ifdef MOZ_XUL
-#  include "nsXULElement.h"
-#endif
-#include "nsXBLProtoImplProperty.h"
-#include "nsXBLProtoImplMethod.h"
-#include "nsXBLProtoImplField.h"
-#include "nsXBLPrototypeBinding.h"
-#include "nsContentUtils.h"
-#include "nsIConsoleService.h"
-#include "nsIScriptError.h"
-#include "nsNodeInfoManager.h"
-#include "nsIPrincipal.h"
-#include "mozilla/dom/Element.h"
-
-using namespace mozilla;
-using namespace mozilla::dom;
-
-nsresult NS_NewXBLContentSink(nsIXMLContentSink** aResult, Document* aDoc,
-                              nsIURI* aURI, nsISupports* aContainer) {
-  NS_ENSURE_ARG_POINTER(aResult);
-
-  RefPtr<nsXBLContentSink> it = new nsXBLContentSink();
-  nsresult rv = it->Init(aDoc, aURI, aContainer);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  it.forget(aResult);
-  return NS_OK;
-}
-
-nsXBLContentSink::nsXBLContentSink()
-    : mState(eXBL_InDocument),
-      mSecondaryState(eXBL_None),
-      mDocInfo(nullptr),
-      mIsChromeOrResource(false),
-      mFoundFirstBinding(false),
-      mBinding(nullptr),
-      mHandler(nullptr),
-      mImplementation(nullptr),
-      mImplMember(nullptr),
-      mImplField(nullptr),
-      mProperty(nullptr),
-      mMethod(nullptr),
-      mField(nullptr) {
-  mPrettyPrintXML = false;
-}
-
-nsXBLContentSink::~nsXBLContentSink() {}
-
-nsresult nsXBLContentSink::Init(Document* aDoc, nsIURI* aURI,
-                                nsISupports* aContainer) {
-  nsresult rv;
-  rv = nsXMLContentSink::Init(aDoc, aURI, aContainer, nullptr);
-  return rv;
-}
-
-void nsXBLContentSink::MaybeStartLayout(bool aIgnorePendingSheets) {}
-
-nsresult nsXBLContentSink::FlushText(bool aReleaseTextNode) {
-  if (mTextLength != 0) {
-    const nsAString& text = Substring(mText, mText + mTextLength);
-    if (mState == eXBL_InHandlers) {
-      NS_ASSERTION(mBinding, "Must have binding here");
-      // Get the text and add it to the event handler.
-      if (mSecondaryState == eXBL_InHandler) mHandler->AppendHandlerText(text);
-      mTextLength = 0;
-      return NS_OK;
-    } else if (mState == eXBL_InImplementation) {
-      NS_ASSERTION(mBinding, "Must have binding here");
-      if (mSecondaryState == eXBL_InConstructor ||
-          mSecondaryState == eXBL_InDestructor) {
-        // Construct a method for the constructor/destructor.
-        nsXBLProtoImplMethod* method;
-        if (mSecondaryState == eXBL_InConstructor)
-          method = mBinding->GetConstructor();
-        else
-          method = mBinding->GetDestructor();
-
-        // Get the text and add it to the constructor/destructor.
-        method->AppendBodyText(text);
-      } else if (mSecondaryState == eXBL_InGetter ||
-                 mSecondaryState == eXBL_InSetter) {
-        // Get the text and add it to the getter/setter
-        if (mSecondaryState == eXBL_InGetter)
-          mProperty->AppendGetterText(text);
-        else
-          mProperty->AppendSetterText(text);
-      } else if (mSecondaryState == eXBL_InBody) {
-        // Get the text and add it to the method
-        if (mMethod) mMethod->AppendBodyText(text);
-      } else if (mSecondaryState == eXBL_InField) {
-        // Get the text and add it to the method
-        if (mField) mField->AppendFieldText(text);
-      }
-      mTextLength = 0;
-      return NS_OK;
-    }
-
-    nsIContent* content = GetCurrentContent();
-    if (content && (content->NodeInfo()->NamespaceEquals(kNameSpaceID_XBL) ||
-                    (content->IsXULElement() &&
-                     !content->IsAnyOfXULElements(nsGkAtoms::label,
-                                                  nsGkAtoms::description)))) {
-      bool isWS = true;
-      if (mTextLength > 0) {
-        const char16_t* cp = mText;
-        const char16_t* end = mText + mTextLength;
-        while (cp < end) {
-          char16_t ch = *cp++;
-          if (!dom::IsSpaceCharacter(ch)) {
-            isWS = false;
-            break;
-          }
-        }
-      }
-
-      if (isWS && mTextLength > 0) {
-        mTextLength = 0;
-        // Make sure to drop the textnode, if any
-        return nsXMLContentSink::FlushText(aReleaseTextNode);
-      }
-    }
-  }
-
-  return nsXMLContentSink::FlushText(aReleaseTextNode);
-}
-
-NS_IMETHODIMP
-nsXBLContentSink::ReportError(const char16_t* aErrorText,
-                              const char16_t* aSourceText,
-                              nsIScriptError* aError, bool* _retval) {
-  MOZ_ASSERT(aError && aSourceText && aErrorText, "Check arguments!!!");
-
-  // XXX FIXME This function overrides and calls on
-  // nsXMLContentSink::ReportError, and probably should die.  See bug 347826.
-
-  // XXX We should make sure the binding has no effect, but that it also
-  // gets destroyed properly without leaking.  Perhaps we should even
-  // ensure that the content that was bound is displayed with no
-  // binding.
-
-#ifdef DEBUG
-  // Report the error to stderr.
-  fprintf(stderr, "\n%s\n%s\n\n", NS_LossyConvertUTF16toASCII(aErrorText).get(),
-          NS_LossyConvertUTF16toASCII(aSourceText).get());
-#endif
-
-  // Most of what this does won't be too useful, but whatever...
-  // nsXMLContentSink::ReportError will handle the console logging.
-  return nsXMLContentSink::ReportError(aErrorText, aSourceText, aError,
-                                       _retval);
-}
-
-nsresult nsXBLContentSink::ReportUnexpectedElement(nsAtom* aElementName,
-                                                   uint32_t aLineNumber) {
-  // XXX we should really somehow stop the parse and drop the binding
-  // instead of just letting the XML sink build the content model like
-  // we do...
-  mState = eXBL_Error;
-  AutoTArray<nsString, 1> params;
-  aElementName->ToString(*params.AppendElement());
-
-  return nsContentUtils::ReportToConsole(
-      nsIScriptError::errorFlag, NS_LITERAL_CSTRING("XBL Content Sink"),
-      mDocument, nsContentUtils::eXBL_PROPERTIES, "UnexpectedElement", params,
-      nullptr, EmptyString() /* source line */, aLineNumber);
-}
-
-void nsXBLContentSink::AddMember(nsXBLProtoImplMember* aMember) {
-  // Add this member to our chain.
-  if (mImplMember)
-    mImplMember->SetNext(
-        aMember);  // Already have a chain. Just append to the end.
-  else
-    mImplementation->SetMemberList(
-        aMember);  // We're the first member in the chain.
-
-  mImplMember = aMember;  // Adjust our pointer to point to the new last member
-                          // in the chain.
-}
-
-void nsXBLContentSink::AddField(nsXBLProtoImplField* aField) {
-  // Add this field to our chain.
-  if (mImplField)
-    mImplField->SetNext(
-        aField);  // Already have a chain. Just append to the end.
-  else
-    mImplementation->SetFieldList(
-        aField);  // We're the first member in the chain.
-
-  mImplField = aField;  // Adjust our pointer to point to the new last field in
-                        // the chain.
-}
-
-NS_IMETHODIMP
-nsXBLContentSink::HandleStartElement(const char16_t* aName,
-                                     const char16_t** aAtts,
-                                     uint32_t aAttsCount, uint32_t aLineNumber,
-                                     uint32_t aColumnNumber) {
-  nsresult rv = nsXMLContentSink::HandleStartElement(
-      aName, aAtts, aAttsCount, aLineNumber, aColumnNumber);
-  if (NS_FAILED(rv)) return rv;
-
-  if (mState == eXBL_InBinding && !mBinding) {
-    rv = ConstructBinding(aLineNumber);
-    if (NS_FAILED(rv)) return rv;
-
-    // mBinding may still be null, if the binding had no id.  If so,
-    // we'll deal with that later in the sink.
-  }
-
-  return rv;
-}
-
-NS_IMETHODIMP
-nsXBLContentSink::HandleEndElement(const char16_t* aName) {
-  FlushText();
-
-  if (mState != eXBL_InDocument) {
-    int32_t nameSpaceID;
-    RefPtr<nsAtom> prefix, localName;
-    nsContentUtils::SplitExpatName(aName, getter_AddRefs(prefix),
-                                   getter_AddRefs(localName), &nameSpaceID);
-
-    if (nameSpaceID == kNameSpaceID_XBL) {
-      if (mState == eXBL_Error) {
-        // Check whether we've opened this tag before; we may not have if
-        // it was a real XBL tag before the error occurred.
-        if (!GetCurrentContent()->NodeInfo()->Equals(localName, nameSpaceID)) {
-          // OK, this tag was never opened as far as the XML sink is
-          // concerned.  Just drop the HandleEndElement
-          return NS_OK;
-        }
-      } else if (mState == eXBL_InHandlers) {
-        if (localName == nsGkAtoms::handlers) {
-          mState = eXBL_InBinding;
-          mHandler = nullptr;
-        } else if (localName == nsGkAtoms::handler)
-          mSecondaryState = eXBL_None;
-        return NS_OK;
-      } else if (mState == eXBL_InImplementation) {
-        if (localName == nsGkAtoms::implementation)
-          mState = eXBL_InBinding;
-        else if (localName == nsGkAtoms::property) {
-          mSecondaryState = eXBL_None;
-          mProperty = nullptr;
-        } else if (localName == nsGkAtoms::method) {
-          mSecondaryState = eXBL_None;
-          mMethod = nullptr;
-        } else if (localName == nsGkAtoms::field) {
-          mSecondaryState = eXBL_None;
-          mField = nullptr;
-        } else if (localName == nsGkAtoms::constructor ||
-                   localName == nsGkAtoms::destructor)
-          mSecondaryState = eXBL_None;
-        else if (localName == nsGkAtoms::getter ||
-                 localName == nsGkAtoms::setter)
-          mSecondaryState = eXBL_InProperty;
-        else if (localName == nsGkAtoms::parameter ||
-                 localName == nsGkAtoms::body)
-          mSecondaryState = eXBL_InMethod;
-        return NS_OK;
-      } else if (mState == eXBL_InBindings &&
-                 localName == nsGkAtoms::bindings) {
-        mState = eXBL_InDocument;
-      }
-
-      nsresult rv = nsXMLContentSink::HandleEndElement(aName);
-      if (NS_FAILED(rv)) return rv;
-
-      if (mState == eXBL_InBinding && localName == nsGkAtoms::binding) {
-        mState = eXBL_InBindings;
-        if (mBinding) {  // See comment in HandleStartElement()
-          mBinding->Initialize();
-          mBinding = nullptr;  // Clear our current binding ref.
-        }
-      }
-
-      return NS_OK;
-    }
-  }
-
-  return nsXMLContentSink::HandleEndElement(aName);
-}
-
-NS_IMETHODIMP
-nsXBLContentSink::HandleCDataSection(const char16_t* aData, uint32_t aLength) {
-  if (mState == eXBL_InHandlers || mState == eXBL_InImplementation)
-    return AddText(aData, aLength);
-  return nsXMLContentSink::HandleCDataSection(aData, aLength);
-}
-
-#define ENSURE_XBL_STATE(_cond)                     \
-  PR_BEGIN_MACRO                                    \
-  if (!(_cond)) {                                   \
-    ReportUnexpectedElement(aTagName, aLineNumber); \
-    return true;                                    \
-  }                                                 \
-  PR_END_MACRO
-
-bool nsXBLContentSink::OnOpenContainer(const char16_t** aAtts,
-                                       uint32_t aAttsCount,
-                                       int32_t aNameSpaceID, nsAtom* aTagName,
-                                       uint32_t aLineNumber) {
-  if (mState == eXBL_Error) {
-    return true;
-  }
-
-  if (aNameSpaceID != kNameSpaceID_XBL) {
-    // Construct non-XBL nodes
-    return true;
-  }
-
-  bool ret = true;
-  if (aTagName == nsGkAtoms::bindings) {
-    ENSURE_XBL_STATE(mState == eXBL_InDocument);
-
-    NS_ASSERTION(mDocument, "Must have a document!");
-    RefPtr<nsXBLDocumentInfo> info = new nsXBLDocumentInfo(mDocument);
-
-    // We keep a weak ref. We're creating a cycle between doc/binding
-    // manager/doc info.
-    mDocInfo = info;
-
-    if (!mDocInfo) {
-      mState = eXBL_Error;
-      return true;
-    }
-
-    mDocument->BindingManager()->PutXBLDocumentInfo(mDocInfo);
-
-    nsIURI* uri = mDocument->GetDocumentURI();
-
-    mIsChromeOrResource = uri->SchemeIs("chrome") || uri->SchemeIs("resource");
-
-    mState = eXBL_InBindings;
-  } else if (aTagName == nsGkAtoms::binding) {
-    ENSURE_XBL_STATE(mState == eXBL_InBindings);
-    mState = eXBL_InBinding;
-  } else if (aTagName == nsGkAtoms::handlers) {
-    ENSURE_XBL_STATE(mState == eXBL_InBinding && mBinding);
-    mState = eXBL_InHandlers;
-    ret = false;
-  } else if (aTagName == nsGkAtoms::handler) {
-    ENSURE_XBL_STATE(mState == eXBL_InHandlers);
-    mSecondaryState = eXBL_InHandler;
-    ConstructHandler(aAtts, aLineNumber);
-    ret = false;
-  } else if (aTagName == nsGkAtoms::implementation) {
-    ENSURE_XBL_STATE(mState == eXBL_InBinding && mBinding);
-    mState = eXBL_InImplementation;
-    ConstructImplementation(aAtts);
-    // Note that this mState will cause us to return false, so no need
-    // to set ret to false.
-  } else if (aTagName == nsGkAtoms::constructor) {
-    ENSURE_XBL_STATE(mState == eXBL_InImplementation &&
-                     mSecondaryState == eXBL_None);
-    NS_ASSERTION(mBinding, "Must have binding here");
-
-    mSecondaryState = eXBL_InConstructor;
-    nsAutoString name;
-    if (!mCurrentBindingID.IsEmpty()) {
-      name.Assign(mCurrentBindingID);
-      name.AppendLiteral("_XBL_Constructor");
-    } else {
-      name.AppendLiteral("XBL_Constructor");
-    }
-    nsXBLProtoImplAnonymousMethod* newMethod =
-        new nsXBLProtoImplAnonymousMethod(name.get());
-    newMethod->SetLineNumber(aLineNumber);
-    mBinding->SetConstructor(newMethod);
-    AddMember(newMethod);
-  } else if (aTagName == nsGkAtoms::destructor) {
-    ENSURE_XBL_STATE(mState == eXBL_InImplementation &&
-                     mSecondaryState == eXBL_None);
-    NS_ASSERTION(mBinding, "Must have binding here");
-    mSecondaryState = eXBL_InDestructor;
-    nsAutoString name;
-    if (!mCurrentBindingID.IsEmpty()) {
-      name.Assign(mCurrentBindingID);
-      name.AppendLiteral("_XBL_Destructor");
-    } else {
-      name.AppendLiteral("XBL_Destructor");
-    }
-    nsXBLProtoImplAnonymousMethod* newMethod =
-        new nsXBLProtoImplAnonymousMethod(name.get());
-    newMethod->SetLineNumber(aLineNumber);
-    mBinding->SetDestructor(newMethod);
-    AddMember(newMethod);
-  } else if (aTagName == nsGkAtoms::field) {
-    ENSURE_XBL_STATE(mState == eXBL_InImplementation &&
-                     mSecondaryState == eXBL_None);
-    NS_ASSERTION(mBinding, "Must have binding here");
-    mSecondaryState = eXBL_InField;
-    ConstructField(aAtts, aLineNumber);
-  } else if (aTagName == nsGkAtoms::property) {
-    ENSURE_XBL_STATE(mState == eXBL_InImplementation &&
-                     mSecondaryState == eXBL_None);
-    NS_ASSERTION(mBinding, "Must have binding here");
-    mSecondaryState = eXBL_InProperty;
-    ConstructProperty(aAtts, aLineNumber);
-  } else if (aTagName == nsGkAtoms::getter) {
-    ENSURE_XBL_STATE(mSecondaryState == eXBL_InProperty && mProperty);
-    NS_ASSERTION(mState == eXBL_InImplementation, "Unexpected state");
-    mProperty->SetGetterLineNumber(aLineNumber);
-    mSecondaryState = eXBL_InGetter;
-  } else if (aTagName == nsGkAtoms::setter) {
-    ENSURE_XBL_STATE(mSecondaryState == eXBL_InProperty && mProperty);
-    NS_ASSERTION(mState == eXBL_InImplementation, "Unexpected state");
-    mProperty->SetSetterLineNumber(aLineNumber);
-    mSecondaryState = eXBL_InSetter;
-  } else if (aTagName == nsGkAtoms::method) {
-    ENSURE_XBL_STATE(mState == eXBL_InImplementation &&
-                     mSecondaryState == eXBL_None);
-    NS_ASSERTION(mBinding, "Must have binding here");
-    mSecondaryState = eXBL_InMethod;
-    ConstructMethod(aAtts);
-  } else if (aTagName == nsGkAtoms::parameter) {
-    ENSURE_XBL_STATE(mSecondaryState == eXBL_InMethod && mMethod);
-    NS_ASSERTION(mState == eXBL_InImplementation, "Unexpected state");
-    ConstructParameter(aAtts);
-  } else if (aTagName == nsGkAtoms::body) {
-    ENSURE_XBL_STATE(mSecondaryState == eXBL_InMethod && mMethod);
-    NS_ASSERTION(mState == eXBL_InImplementation, "Unexpected state");
-    // stash away the line number
-    mMethod->SetLineNumber(aLineNumber);
-    mSecondaryState = eXBL_InBody;
-  }
-
-  return ret && mState != eXBL_InImplementation;
-}
-
-#undef ENSURE_XBL_STATE
-
-nsresult nsXBLContentSink::ConstructBinding(uint32_t aLineNumber) {
-  // This is only called from HandleStartElement, so it'd better be an element.
-  RefPtr<Element> binding = GetCurrentContent()->AsElement();
-  binding->GetAttr(kNameSpaceID_None, nsGkAtoms::id, mCurrentBindingID);
-  NS_ConvertUTF16toUTF8 cid(mCurrentBindingID);
-
-  nsresult rv = NS_OK;
-
-  // Don't create a binding with no id. nsXBLPrototypeBinding::Read also
-  // performs this check.
-  if (!cid.IsEmpty()) {
-    mBinding = new nsXBLPrototypeBinding();
-
-    rv = mBinding->Init(cid, mDocInfo, binding, !mFoundFirstBinding);
-    if (NS_SUCCEEDED(rv) &&
-        NS_SUCCEEDED(mDocInfo->SetPrototypeBinding(cid, mBinding))) {
-      if (!mFoundFirstBinding) {
-        mFoundFirstBinding = true;
-        mDocInfo->SetFirstPrototypeBinding(mBinding);
-      }
-      binding->UnsetAttr(kNameSpaceID_None, nsGkAtoms::id, false);
-    } else {
-      delete mBinding;
-      mBinding = nullptr;
-    }
-  } else {
-    nsContentUtils::ReportToConsole(
-        nsIScriptError::errorFlag, NS_LITERAL_CSTRING("XBL Content Sink"),
-        nullptr, nsContentUtils::eXBL_PROPERTIES, "MissingIdAttr",
-        nsTArray<nsString>(), mDocumentURI, EmptyString(), aLineNumber);
-  }
-
-  return rv;
-}
-
-static bool FindValue(const char16_t** aAtts, nsAtom* aAtom,
-                      const char16_t** aResult) {
-  RefPtr<nsAtom> prefix, localName;
-  for (; *aAtts; aAtts += 2) {
-    int32_t nameSpaceID;
-    nsContentUtils::SplitExpatName(aAtts[0], getter_AddRefs(prefix),
-                                   getter_AddRefs(localName), &nameSpaceID);
-
-    // Is this attribute one of the ones we care about?
-    if (nameSpaceID == kNameSpaceID_None && localName == aAtom) {
-      *aResult = aAtts[1];
-
-      return true;
-    }
-  }
-
-  return false;
-}
-
-void nsXBLContentSink::ConstructHandler(const char16_t** aAtts,
-                                        uint32_t aLineNumber) {
-  const char16_t* event = nullptr;
-  const char16_t* modifiers = nullptr;
-  const char16_t* button = nullptr;
-  const char16_t* clickcount = nullptr;
-  const char16_t* keycode = nullptr;
-  const char16_t* charcode = nullptr;
-  const char16_t* phase = nullptr;
-  const char16_t* command = nullptr;
-  const char16_t* action = nullptr;
-  const char16_t* group = nullptr;
-  const char16_t* preventdefault = nullptr;
-  const char16_t* allowuntrusted = nullptr;
-
-  RefPtr<nsAtom> prefix, localName;
-  for (; *aAtts; aAtts += 2) {
-    int32_t nameSpaceID;
-    nsContentUtils::SplitExpatName(aAtts[0], getter_AddRefs(prefix),
-                                   getter_AddRefs(localName), &nameSpaceID);
-
-    if (nameSpaceID != kNameSpaceID_None) {
-      continue;
-    }
-
-    // Is this attribute one of the ones we care about?
-    if (localName == nsGkAtoms::event)
-      event = aAtts[1];
-    else if (localName == nsGkAtoms::modifiers)
-      modifiers = aAtts[1];
-    else if (localName == nsGkAtoms::button)
-      button = aAtts[1];
-    else if (localName == nsGkAtoms::clickcount)
-      clickcount = aAtts[1];
-    else if (localName == nsGkAtoms::keycode)
-      keycode = aAtts[1];
-    else if (localName == nsGkAtoms::key || localName == nsGkAtoms::charcode)
-      charcode = aAtts[1];
-    else if (localName == nsGkAtoms::phase)
-      phase = aAtts[1];
-    else if (localName == nsGkAtoms::command)
-      command = aAtts[1];
-    else if (localName == nsGkAtoms::action)
-      action = aAtts[1];
-    else if (localName == nsGkAtoms::group)
-      group = aAtts[1];
-    else if (localName == nsGkAtoms::preventdefault)
-      preventdefault = aAtts[1];
-    else if (localName == nsGkAtoms::allowuntrusted)
-      allowuntrusted = aAtts[1];
-  }
-
-  if (command && !mIsChromeOrResource) {
-    // Make sure the XBL doc is chrome or resource if we have a command
-    // shorthand syntax.
-    mState = eXBL_Error;
-    nsContentUtils::ReportToConsole(
-        nsIScriptError::errorFlag, NS_LITERAL_CSTRING("XBL Content Sink"),
-        mDocument, nsContentUtils::eXBL_PROPERTIES, "CommandNotInChrome",
-        nsTArray<nsString>(), nullptr, EmptyString() /* source line */,
-        aLineNumber);
-    return;  // Don't even make this handler.
-  }
-
-  // All of our pointers are now filled in. Construct our handler with all of
-  // these parameters.
-  nsXBLPrototypeHandler* newHandler;
-  newHandler = new nsXBLPrototypeHandler(
-      event, phase, action, command, keycode, charcode, modifiers, button,
-      clickcount, group, preventdefault, allowuntrusted, mBinding, aLineNumber);
-
-  // Add this handler to our chain of handlers.
-  if (mHandler) {
-    // Already have a chain. Just append to the end.
-    mHandler->SetNextHandler(newHandler);
-  } else {
-    // We're the first handler in the chain.
-    mBinding->SetPrototypeHandlers(newHandler);
-  }
-  // Adjust our mHandler pointer to point to the new last handler in the
-  // chain.
-  mHandler = newHandler;
-}
-
-void nsXBLContentSink::ConstructImplementation(const char16_t** aAtts) {
-  mImplementation = nullptr;
-  mImplMember = nullptr;
-  mImplField = nullptr;
-
-  if (!mBinding) return;
-
-  const char16_t* name = nullptr;
-
-  RefPtr<nsAtom> prefix, localName;
-  for (; *aAtts; aAtts += 2) {
-    int32_t nameSpaceID;
-    nsContentUtils::SplitExpatName(aAtts[0], getter_AddRefs(prefix),
-                                   getter_AddRefs(localName), &nameSpaceID);
-
-    if (nameSpaceID != kNameSpaceID_None) {
-      continue;
-    }
-
-    // Is this attribute one of the ones we care about?
-    if (localName == nsGkAtoms::name) {
-      name = aAtts[1];
-    } else if (localName == nsGkAtoms::implements) {
-      // Only allow implementation of interfaces via XBL if the principal of
-      // our XBL document is the system principal.
-      if (nsContentUtils::IsSystemPrincipal(mDocument->NodePrincipal())) {
-        mBinding->ConstructInterfaceTable(nsDependentString(aAtts[1]));
-      }
-    }
-  }
-
-  NS_NewXBLProtoImpl(mBinding, name, &mImplementation);
-}
-
-void nsXBLContentSink::ConstructField(const char16_t** aAtts,
-                                      uint32_t aLineNumber) {
-  const char16_t* name = nullptr;
-  const char16_t* readonly = nullptr;
-
-  RefPtr<nsAtom> prefix, localName;
-  for (; *aAtts; aAtts += 2) {
-    int32_t nameSpaceID;
-    nsContentUtils::SplitExpatName(aAtts[0], getter_AddRefs(prefix),
-                                   getter_AddRefs(localName), &nameSpaceID);
-
-    if (nameSpaceID != kNameSpaceID_None) {
-      continue;
-    }
-
-    // Is this attribute one of the ones we care about?
-    if (localName == nsGkAtoms::name) {
-      name = aAtts[1];
-    } else if (localName == nsGkAtoms::readonly) {
-      readonly = aAtts[1];
-    }
-  }
-
-  if (name) {
-    // All of our pointers are now filled in. Construct our field with all of
-    // these parameters.
-    mField = new nsXBLProtoImplField(name, readonly);
-    mField->SetLineNumber(aLineNumber);
-    AddField(mField);
-  }
-}
-
-void nsXBLContentSink::ConstructProperty(const char16_t** aAtts,
-                                         uint32_t aLineNumber) {
-  const char16_t* name = nullptr;
-  const char16_t* readonly = nullptr;
-  const char16_t* onget = nullptr;
-  const char16_t* onset = nullptr;
-  bool exposeToUntrustedContent = false;
-
-  RefPtr<nsAtom> prefix, localName;
-  for (; *aAtts; aAtts += 2) {
-    int32_t nameSpaceID;
-    nsContentUtils::SplitExpatName(aAtts[0], getter_AddRefs(prefix),
-                                   getter_AddRefs(localName), &nameSpaceID);
-
-    if (nameSpaceID != kNameSpaceID_None) {
-      continue;
-    }
-
-    // Is this attribute one of the ones we care about?
-    if (localName == nsGkAtoms::name) {
-      name = aAtts[1];
-    } else if (localName == nsGkAtoms::readonly) {
-      readonly = aAtts[1];
-    } else if (localName == nsGkAtoms::onget) {
-      onget = aAtts[1];
-    } else if (localName == nsGkAtoms::onset) {
-      onset = aAtts[1];
-    } else if (localName == nsGkAtoms::exposeToUntrustedContent &&
-               nsDependentString(aAtts[1]).EqualsLiteral("true")) {
-      exposeToUntrustedContent = true;
-    }
-  }
-
-  if (name) {
-    // All of our pointers are now filled in. Construct our property with all of
-    // these parameters.
-    mProperty =
-        new nsXBLProtoImplProperty(name, onget, onset, readonly, aLineNumber);
-    if (exposeToUntrustedContent) {
-      mProperty->SetExposeToUntrustedContent(true);
-    }
-    AddMember(mProperty);
-  }
-}
-
-void nsXBLContentSink::ConstructMethod(const char16_t** aAtts) {
-  mMethod = nullptr;
-
-  const char16_t* name = nullptr;
-  const char16_t* expose = nullptr;
-  if (FindValue(aAtts, nsGkAtoms::name, &name)) {
-    mMethod = new nsXBLProtoImplMethod(name);
-    if (FindValue(aAtts, nsGkAtoms::exposeToUntrustedContent, &expose) &&
-        nsDependentString(expose).EqualsLiteral("true")) {
-      mMethod->SetExposeToUntrustedContent(true);
-    }
-  }
-
-  if (mMethod) {
-    AddMember(mMethod);
-  }
-}
-
-void nsXBLContentSink::ConstructParameter(const char16_t** aAtts) {
-  if (!mMethod) return;
-
-  const char16_t* name = nullptr;
-  if (FindValue(aAtts, nsGkAtoms::name, &name)) {
-    mMethod->AddParameter(nsDependentString(name));
-  }
-}
-
-nsresult nsXBLContentSink::CreateElement(
-    const char16_t** aAtts, uint32_t aAttsCount,
-    mozilla::dom::NodeInfo* aNodeInfo, uint32_t aLineNumber,
-    uint32_t aColumnNumber, nsIContent** aResult, bool* aAppendContent,
-    FromParser aFromParser) {
-#ifdef MOZ_XUL
-  if (!aNodeInfo->NamespaceEquals(kNameSpaceID_XUL)) {
-#endif
-    return nsXMLContentSink::CreateElement(aAtts, aAttsCount, aNodeInfo,
-                                           aLineNumber, aColumnNumber, aResult,
-                                           aAppendContent, aFromParser);
-#ifdef MOZ_XUL
-  }
-
-  // Note that this needs to match the code in
-  // nsXBLPrototypeBinding::ReadContentNode.
-
-  *aAppendContent = true;
-  RefPtr<nsXULPrototypeElement> prototype =
-      new nsXULPrototypeElement(aNodeInfo);
-
-  AddAttributesToXULPrototype(aAtts, aAttsCount, prototype);
-
-  Element* result;
-  nsresult rv = nsXULElement::CreateFromPrototype(prototype, mDocument, false,
-                                                  false, &result);
-  *aResult = result;
-  return rv;
-#endif
-}
-
-nsresult nsXBLContentSink::AddAttributes(const char16_t** aAtts,
-                                         Element* aElement) {
-  if (aElement->IsXULElement())
-    return NS_OK;  // Nothing to do, since the proto already has the attrs.
-
-  return nsXMLContentSink::AddAttributes(aAtts, aElement);
-}
-
-#ifdef MOZ_XUL
-nsresult nsXBLContentSink::AddAttributesToXULPrototype(
-    const char16_t** aAtts, uint32_t aAttsCount,
-    nsXULPrototypeElement* aElement) {
-  // Add tag attributes to the element
-  nsresult rv;
-
-  // Create storage for the attributes
-  nsXULPrototypeAttribute* attrs = nullptr;
-  if (aAttsCount > 0) {
-    attrs = aElement->mAttributes.AppendElements(aAttsCount);
-  }
-
-  // Copy the attributes into the prototype
-  RefPtr<nsAtom> prefix, localName;
-
-  uint32_t i;
-  for (i = 0; i < aAttsCount; ++i) {
-    int32_t nameSpaceID;
-    nsContentUtils::SplitExpatName(aAtts[i * 2], getter_AddRefs(prefix),
-                                   getter_AddRefs(localName), &nameSpaceID);
-
-    if (nameSpaceID == kNameSpaceID_None) {
-      attrs[i].mName.SetTo(localName);
-    } else {
-      RefPtr<NodeInfo> ni;
-      ni = mNodeInfoManager->GetNodeInfo(localName, prefix, nameSpaceID,
-                                         nsINode::ATTRIBUTE_NODE);
-      attrs[i].mName.SetTo(ni);
-    }
-
-    rv = aElement->SetAttrAt(i, nsDependentString(aAtts[i * 2 + 1]),
-                             mDocumentURI);
-    NS_ENSURE_SUCCESS(rv, rv);
-  }
-
-  return NS_OK;
-}
-#endif