Merge m-c to fx-team.
authorRyan VanderMeulen <ryanvm@gmail.com>
Wed, 18 Dec 2013 21:29:09 -0500
changeset 161208 e382a654c7638783c3e02b23f438a9cd6d408896
parent 161207 cd24da528bf3f6405314fc5a7127415acdd406b2 (current diff)
parent 161147 27228e525e085db95ae83e4268819b29fdfe1b7c (diff)
child 161209 0e84f8ba1333e284be097902ae9308ad3e82f597
push id25871
push usercbook@mozilla.com
push dateThu, 19 Dec 2013 09:34:02 +0000
treeherdermozilla-central@5c7fa2bfea8b [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone29.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Merge m-c to fx-team.
dom/interfaces/offline/nsIDOMLoadStatus.idl
js/src/jit-test/tests/basic/bug691299-regexp.js
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "444fa63091ea8641d08681f921631f8b7ddc0d88", 
+    "revision": "c6aeaa41977d9410b9baac23ccea6909f796fd1f", 
     "repo_path": "/integration/gaia-central"
 }
--- a/browser/components/tabview/test/browser.ini
+++ b/browser/components/tabview/test/browser.ini
@@ -32,47 +32,52 @@ support-files =
 [browser_tabview_bug595601.js]
 [browser_tabview_bug595804.js]
 [browser_tabview_bug595930.js]
 [browser_tabview_bug595943.js]
 [browser_tabview_bug595965.js]
 [browser_tabview_bug596781.js]
 [browser_tabview_bug597360.js]
 [browser_tabview_bug597399.js]
+[browser_tabview_bug597980.js]
+skip-if = true # Bug 711907
 [browser_tabview_bug598375.js]
 [browser_tabview_bug598600.js]
 [browser_tabview_bug599048.js]
 [browser_tabview_bug599626.js]
-skip-if = os == 'linux' # Bug 939620, much fail, so amaze
+skip-if = os == 'linux' # Bug 939620
 [browser_tabview_bug600645.js]
 [browser_tabview_bug600812.js]
+[browser_tabview_bug602432.js]
+skip-if = true # Bug 704417
 [browser_tabview_bug604098.js]
 [browser_tabview_bug606657.js]
 [browser_tabview_bug606905.js]
 [browser_tabview_bug607108.js]
+skip-if = os == 'linux' # Bug 947521
 [browser_tabview_bug608037.js]
 [browser_tabview_bug608153.js]
 [browser_tabview_bug608158.js]
 [browser_tabview_bug608184.js]
 [browser_tabview_bug608405.js]
 [browser_tabview_bug610208.js]
 [browser_tabview_bug610242.js]
+skip-if = true # Bug 736036
 [browser_tabview_bug612470.js]
 [browser_tabview_bug613541.js]
+skip-if = os == "win" # Bug 951477
 [browser_tabview_bug616729.js]
 [browser_tabview_bug616967.js]
 [browser_tabview_bug618816.js]
 [browser_tabview_bug618828.js]
 [browser_tabview_bug619937.js]
 [browser_tabview_bug622835.js]
 [browser_tabview_bug623768.js]
 [browser_tabview_bug624265_perwindowpb.js]
-# Disabled for too many intermittent failures (bug 921984).
-# Will hopefully be fixed by bug 930202.
-skip-if = true
+skip-if = true # Bug 921984, hopefully fixed by bug 930202
 [browser_tabview_bug624692.js]
 [browser_tabview_bug624727_perwindowpb.js]
 [browser_tabview_bug624847.js]
 [browser_tabview_bug624931.js]
 [browser_tabview_bug624953.js]
 [browser_tabview_bug625195.js]
 [browser_tabview_bug625269.js]
 [browser_tabview_bug625424.js]
@@ -85,50 +90,64 @@ skip-if = true
 [browser_tabview_bug628061.js]
 [browser_tabview_bug628165.js]
 [browser_tabview_bug628270.js]
 [browser_tabview_bug628887.js]
 [browser_tabview_bug629189.js]
 [browser_tabview_bug629195.js]
 [browser_tabview_bug630102.js]
 [browser_tabview_bug630157.js]
+skip-if = true # Bug 922422
 [browser_tabview_bug631662.js]
+skip-if = true # Bug 922422
 [browser_tabview_bug631752.js]
 [browser_tabview_bug633788.js]
 [browser_tabview_bug634077.js]
 [browser_tabview_bug634085.js]
 [browser_tabview_bug634672.js]
 [browser_tabview_bug635696.js]
 [browser_tabview_bug637840.js]
 [browser_tabview_bug640765.js]
 [browser_tabview_bug641802.js]
 [browser_tabview_bug642793.js]
 [browser_tabview_bug643392.js]
 [browser_tabview_bug644097.js]
+[browser_tabview_bug648882.js]
+skip-if = true # Bug 752862
 [browser_tabview_bug649006.js]
 [browser_tabview_bug649307.js]
 [browser_tabview_bug649319.js]
 [browser_tabview_bug650280_perwindowpb.js]
 [browser_tabview_bug650573.js]
 [browser_tabview_bug651311.js]
 [browser_tabview_bug654295.js]
 [browser_tabview_bug654721.js]
+[browser_tabview_bug654941.js]
+skip-if = true # Bug 754222
 [browser_tabview_bug655269.js]
 [browser_tabview_bug656778.js]
+skip-if = os == "mac" # Bug 946918
 [browser_tabview_bug656913.js]
 [browser_tabview_bug659594.js]
+skip-if = os == "mac" # Bug 939617
 [browser_tabview_bug662266.js]
 [browser_tabview_bug663421.js]
 [browser_tabview_bug665502.js]
 [browser_tabview_bug669694.js]
 [browser_tabview_bug673196.js]
+[browser_tabview_bug673729.js]
+skip-if = true # Bug 749980
+[browser_tabview_bug678374.js]
+skip-if = true # Bug 795265
 [browser_tabview_bug681599.js]
 [browser_tabview_bug685476.js]
 [browser_tabview_bug685692.js]
 [browser_tabview_bug686654.js]
+[browser_tabview_bug696602.js]
+skip-if = true # Bug 736425
 [browser_tabview_bug697390.js]
 [browser_tabview_bug705621.js]
 [browser_tabview_bug706430.js]
 [browser_tabview_bug706736.js]
 [browser_tabview_bug707466.js]
 [browser_tabview_bug712203.js]
 [browser_tabview_bug715454.js]
 [browser_tabview_bug716880.js]
@@ -137,24 +156,18 @@ skip-if = true
 [browser_tabview_bug749658.js]
 [browser_tabview_bug766597.js]
 [browser_tabview_click_group.js]
 [browser_tabview_dragdrop.js]
 [browser_tabview_exit_button.js]
 [browser_tabview_expander.js]
 [browser_tabview_firstrun_pref.js]
 [browser_tabview_group.js]
+skip-if = os == "mac" || os == "win" # Bug 945687
 [browser_tabview_launch.js]
 [browser_tabview_multiwindow_search.js]
 [browser_tabview_privatebrowsing_perwindowpb.js]
+skip-if = os == 'linux' # Bug 944300
 [browser_tabview_rtl.js]
 [browser_tabview_search.js]
 [browser_tabview_snapping.js]
 [browser_tabview_startup_transitions.js]
 [browser_tabview_undo_group.js]
-# browser_tabview_bug597980.js is disabled for leaking, see bug 711907
-# browser_tabview_bug678374.js disabled for intermittent failures (bug 795265)
-# browser_tabview_bug602432.js disabled for intermittent failures (bug 704417)
-# browser_tabview_bug610242.js disabled for intermittent failures (bug 736036)
-# browser_tabview_bug648882.js disabled for intermittent failures (bug 752862)
-# browser_tabview_bug654941.js disabled for intermittent failures (bug 754222)
-# browser_tabview_bug673729.js disabled for intermittent failures (bug 749980)
-# browser_tabview_bug696602.js disabled for intermittent failures (bug 736425)
--- a/build/moz.build
+++ b/build/moz.build
@@ -1,15 +1,16 @@
 # -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-SPHINX_TREES['build'] = 'docs'
+# This cannot be named "build" because of bug 922191.
+SPHINX_TREES['buildsystem'] = 'docs'
 
 if CONFIG['OS_ARCH'] not in ('WINNT', 'OS2'):
     DIRS += ['unix']
 elif CONFIG['OS_ARCH'] == 'WINNT':
     DIRS += ['win32']
 
 if CONFIG['OS_TARGET'] == 'Android' and not CONFIG['MOZ_ANDROID_LIBSTDCXX']:
     DIRS += ['stlport']
--- a/content/html/content/test/browser_bug649778.js
+++ b/content/html/content/test/browser_bug649778.js
@@ -1,60 +1,65 @@
 // Test for bug 649778 - document.write may cause a document to be written to disk cache even when the page has Cache-Control: no-store
 
 // Globals
 var testPath = "http://mochi.test:8888/browser/content/html/content/test/";
 var popup;
 
-function checkCache(url, policy, shouldExist, cb)
+let {LoadContextInfo} = Cu.import("resource://gre/modules/LoadContextInfo.jsm", null);
+let {Services} = Cu.import("resource://gre/modules/Services.jsm", null);
+
+function checkCache(url, inMemory, shouldExist, cb)
 {
-  var cache = Components.classes["@mozilla.org/network/cache-service;1"].
-              getService(Components.interfaces.nsICacheService);
-  var session = cache.createSession(
-                  "wyciwyg", policy,
-                  Components.interfaces.nsICache.STREAM_BASED);
+  var cache = Services.cache2;
+  var storage = cache.diskCacheStorage(LoadContextInfo.default, false);
 
-  var checkCacheListener = {
-    onCacheEntryAvailable: function oCEA(entry, access, status) {
+  function CheckCacheListener(inMemory, shouldExist)
+  {
+    this.inMemory = inMemory;
+    this.shouldExist = shouldExist;
+    this.onCacheEntryCheck = function() {
+      return Components.interfaces.nsICacheEntryOpenCallback.ENTRY_WANTED;
+    };
+
+    this.onCacheEntryAvailable = function oCEA(entry, isNew, appCache, status) {
       if (shouldExist) {
         ok(entry, "Entry not found");
+        is(this.inMemory, !entry.persistToDisk, "Entry is " + (inMemory ? "" : " not ") + " in memory as expected");
         is(status, Components.results.NS_OK, "Entry not found");
       } else {
         ok(!entry, "Entry found");
         is(status, Components.results.NS_ERROR_CACHE_KEY_NOT_FOUND,
            "Invalid error code");
       }
 
       setTimeout(cb, 0);
-    }
+    };
   };
 
-  session.asyncOpenCacheEntry(url,
-                              Components.interfaces.nsICache.ACCESS_READ,
-                              checkCacheListener);
+  storage.asyncOpenURI(Services.io.newURI(url, null, null), "",
+                       Components.interfaces.nsICacheStorage.OPEN_READONLY,
+                       new CheckCacheListener(inMemory, shouldExist));
 }
 function getPopupURL() {
   var sh = popup.QueryInterface(Components.interfaces.nsIInterfaceRequestor)
                 .getInterface(Components.interfaces.nsIWebNavigation)
                 .sessionHistory;
 
   return sh.getEntryAtIndex(sh.index, false).URI.spec;
 }
 
 var wyciwygURL;
 function testContinue() {
   wyciwygURL = getPopupURL();
   is(wyciwygURL.substring(0, 10), "wyciwyg://", "Unexpected URL.");
   popup.close()
 
-  checkCache(wyciwygURL, Components.interfaces.nsICache.STORE_ON_DISK, false,
-    function() {
-      checkCache(wyciwygURL, Components.interfaces.nsICache.STORE_IN_MEMORY,
-                 true, finish);
-    });
+  // We have to find the entry and it must not be persisted to disk
+  checkCache(wyciwygURL, true, true, finish);
 }
 
 function waitForWyciwygDocument() {
   try {
     var url = getPopupURL();
     if (url.substring(0, 10) == "wyciwyg://") {
       setTimeout(testContinue, 0);
       return;
--- a/content/media/DOMMediaStream.cpp
+++ b/content/media/DOMMediaStream.cpp
@@ -319,16 +319,19 @@ DOMMediaStream::OnTracksAvailable(OnTrac
   }
   mRunOnTracksAvailable.AppendElement(aRunnable);
   CheckTracksAvailable();
 }
 
 void
 DOMMediaStream::CheckTracksAvailable()
 {
+  if (mTrackTypesAvailable == 0) {
+    return;
+  }
   nsTArray<nsAutoPtr<OnTracksAvailableCallback> > callbacks;
   callbacks.SwapElements(mRunOnTracksAvailable);
 
   for (uint32_t i = 0; i < callbacks.Length(); ++i) {
     OnTracksAvailableCallback* cb = callbacks[i];
     if (~mTrackTypesAvailable & cb->GetExpectedTracks()) {
       // Some expected tracks not available yet. Try this callback again later.
       *mRunOnTracksAvailable.AppendElement() = callbacks[i].forget();
--- a/content/media/DOMMediaStream.h
+++ b/content/media/DOMMediaStream.h
@@ -159,16 +159,17 @@ public:
   // When one track of the appropriate type has been added for each bit set
   // in aCallback->GetExpectedTracks(), run aCallback->NotifyTracksAvailable.
   // It is allowed to do anything, including run script.
   // aCallback may run immediately during this call if tracks are already
   // available!
   // We only care about track additions, we'll fire the notification even if
   // some of the tracks have been removed.
   // Takes ownership of aCallback.
+  // If GetExpectedTracks() returns 0, the callback will be fired as soon as there are any tracks.
   void OnTracksAvailable(OnTracksAvailableCallback* aCallback);
 
   /**
    * Add an nsISupports object that this stream will keep alive as long as
    * the stream is not finished.
    */
   void AddConsumerToKeepAlive(nsISupports* aConsumer)
   {
@@ -177,16 +178,17 @@ public:
     }
   }
 
 protected:
   void Destroy();
   void InitSourceStream(nsIDOMWindow* aWindow, TrackTypeHints aHintContents);
   void InitTrackUnionStream(nsIDOMWindow* aWindow, TrackTypeHints aHintContents);
   void InitStreamCommon(MediaStream* aStream);
+
   void CheckTracksAvailable();
 
   class StreamListener;
   friend class StreamListener;
 
   // StreamTime at which the currentTime attribute would return 0.
   StreamTime mLogicalStreamStartTime;
 
--- a/content/media/MediaRecorder.cpp
+++ b/content/media/MediaRecorder.cpp
@@ -12,22 +12,26 @@
 #include "nsIDocument.h"
 #include "nsIDOMRecordErrorEvent.h"
 #include "nsTArray.h"
 #include "DOMMediaStream.h"
 #include "EncodedBufferCache.h"
 #include "nsIDOMFile.h"
 #include "mozilla/dom/BlobEvent.h"
 
+
+#include "mozilla/dom/AudioStreamTrack.h"
+#include "mozilla/dom/VideoStreamTrack.h"
+
 namespace mozilla {
 
 namespace dom {
 
-NS_IMPL_CYCLE_COLLECTION_INHERITED_1(MediaRecorder, nsDOMEventTargetHelper,
-                                     mStream)
+NS_IMPL_CYCLE_COLLECTION_INHERITED_2(MediaRecorder, nsDOMEventTargetHelper,
+                                     mStream, mSession)
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(MediaRecorder)
 NS_INTERFACE_MAP_END_INHERITING(nsDOMEventTargetHelper)
 
 NS_IMPL_ADDREF_INHERITED(MediaRecorder, nsDOMEventTargetHelper)
 NS_IMPL_RELEASE_INHERITED(MediaRecorder, nsDOMEventTargetHelper)
 
 /**
@@ -40,17 +44,17 @@ NS_IMPL_RELEASE_INHERITED(MediaRecorder,
  * the same recording context in MediaRecoder might be access by two Reading Threads,
  * which cause a  problem.
  * In the new design, we put recording context into Session object, including Read
  * Thread.  Each Session has its own recording context and Read Thread, problem is been
  * resolved.
  *
  * Life cycle of a Session object.
  * 1) Initialization Stage (in main thread)
- *    Setup media streams in MSG, and bind MediaEncoder with Source Stream.
+ *    Setup media streams in MSG, and bind MediaEncoder with Source Stream when mStream is available.
  *    Resource allocation, such as encoded data cache buffer and MediaEncoder.
  *    Create read thread.
  *    Automatically switch to Extract stage in the end of this stage.
  * 2) Extract Stage (in Read Thread)
  *    Pull encoded A/V frames from MediaEncoder, dispatch to OnDataAvailable handler.
  *    Unless a client calls Session::Stop, Session object keeps stay in this stage.
  * 3) Destroy Stage (in main thread)
  *    Switch from Extract stage to Destroy stage by calling Session::Stop.
@@ -85,17 +89,17 @@ class MediaRecorder::Session: public nsI
       nsresult rv = recorder->CreateAndDispatchBlobEvent(mSession);
       if (NS_FAILED(rv)) {
         recorder->NotifyError(rv);
       }
       return NS_OK;
     }
 
   private:
-    Session *mSession;
+    nsRefPtr<Session> mSession;
   };
 
   // Record thread task.
   // Fetch encoded Audio/Video data from MediaEncoder.
   class ExtractRunnable : public nsRunnable
   {
   public:
     ExtractRunnable(Session *aSession)
@@ -105,17 +109,46 @@ class MediaRecorder::Session: public nsI
     {
       MOZ_ASSERT(NS_GetCurrentThread() == mSession->mReadThread);
 
       mSession->Extract();
       return NS_OK;
     }
 
   private:
-    Session *mSession;
+    nsRefPtr<Session> mSession;
+  };
+
+  // For Ensure recorder has tracks to record.
+  class TracksAvailableCallback : public DOMMediaStream::OnTracksAvailableCallback
+  {
+  public:
+    TracksAvailableCallback(Session *aSession)
+     : mSession(aSession) {}
+    virtual void NotifyTracksAvailable(DOMMediaStream* aStream)
+    {
+      uint8_t trackType = aStream->GetHintContents();
+      // ToDo: GetHintContents return 0 when recording media tags.
+      if (trackType == 0) {
+        nsTArray<nsRefPtr<mozilla::dom::AudioStreamTrack> > audioTracks;
+        aStream->GetAudioTracks(audioTracks);
+        nsTArray<nsRefPtr<mozilla::dom::VideoStreamTrack> > videoTracks;
+        aStream->GetVideoTracks(videoTracks);
+        // What is inside the track
+        if (videoTracks.Length() > 0) {
+          trackType |= DOMMediaStream::HINT_CONTENTS_VIDEO;
+        }
+        if (audioTracks.Length() > 0) {
+          trackType |= DOMMediaStream::HINT_CONTENTS_AUDIO;
+        }
+      }
+      mSession->AfterTracksAdded(trackType);
+    }
+  private:
+    nsRefPtr<Session> mSession;
   };
 
   // Main thread task.
   // To delete RecordingSession object.
   class DestroyRunnable : public nsRunnable
   {
   public:
     DestroyRunnable(const already_AddRefed<Session> &aSession)
@@ -149,57 +182,40 @@ class MediaRecorder::Session: public nsI
   private:
     // Call mSession::Release automatically while DestroyRunnable be destroy.
     nsRefPtr<Session> mSession;
   };
 
   friend class PushBlobRunnable;
   friend class ExtractRunnable;
   friend class DestroyRunnable;
+  friend class TracksAvailableCallback;
 
 public:
   Session(MediaRecorder* aRecorder, int32_t aTimeSlice)
     : mRecorder(aRecorder),
       mTimeSlice(aTimeSlice)
   {
     MOZ_ASSERT(NS_IsMainThread());
 
     AddRef();
     mEncodedBufferCache = new EncodedBufferCache(MAX_ALLOW_MEMORY_BUFFER);
   }
 
   // Only DestroyRunnable is allowed to delete Session object.
   virtual ~Session()
   {
-    MOZ_ASSERT(NS_IsMainThread());
-
     CleanupStreams();
   }
 
   void Start()
   {
     MOZ_ASSERT(NS_IsMainThread());
 
     SetupStreams();
-
-    // Create a thread to read encode media data from MediaEncoder.
-    if (!mReadThread) {
-      nsresult rv = NS_NewNamedThread("Media Encoder", getter_AddRefs(mReadThread));
-      if (NS_FAILED(rv)) {
-        CleanupStreams();
-        mRecorder->NotifyError(rv);
-        return;
-      }
-    }
-
-    // In case source media stream does not notify track end, recieve
-    // shutdown notification and stop Read Thread.
-    nsContentUtils::RegisterShutdownObserver(this);
-
-    mReadThread->Dispatch(new ExtractRunnable(this), NS_DISPATCH_NORMAL);
   }
 
   void Stop()
   {
     MOZ_ASSERT(NS_IsMainThread());
 
     CleanupStreams();
     nsContentUtils::UnregisterShutdownObserver(this);
@@ -285,24 +301,67 @@ private:
     MOZ_ASSERT(mTrackUnionStream, "CreateTrackUnionStream failed");
 
     mTrackUnionStream->SetAutofinish(true);
 
     // Bind this Track Union Stream with Source Media
     mInputPort = mTrackUnionStream->AllocateInputPort(mRecorder->mStream->GetStream(), MediaInputPort::FLAG_BLOCK_OUTPUT);
 
     // Allocate encoder and bind with the Track Union Stream.
-    mEncoder = MediaEncoder::CreateEncoder(NS_LITERAL_STRING(""));
-    MOZ_ASSERT(mEncoder, "CreateEncoder failed");
-
-    if (mEncoder) {
-      mTrackUnionStream->AddListener(mEncoder);
-    }
+    TracksAvailableCallback* tracksAvailableCallback = new TracksAvailableCallback(mRecorder->mSession);
+    mRecorder->mStream->OnTracksAvailable(tracksAvailableCallback);
   }
 
+  void AfterTracksAdded(uint8_t aTrackTypes)
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+
+    // Allocate encoder and bind with union stream.
+    // At this stage, the API doesn't allow UA to choose the output mimeType format.
+    mEncoder = MediaEncoder::CreateEncoder(NS_LITERAL_STRING(""), aTrackTypes);
+
+    if (!mEncoder) {
+      DoSessionEndTask(NS_ERROR_ABORT);
+      return;
+    }
+
+    // media stream is ready but has been issued stop command
+    if (mRecorder->mState == RecordingState::Inactive) {
+      DoSessionEndTask(NS_OK);
+      return;
+    }
+    mTrackUnionStream->AddListener(mEncoder);
+    // Create a thread to read encode media data from MediaEncoder.
+    if (!mReadThread) {
+      nsresult rv = NS_NewNamedThread("Media Encoder", getter_AddRefs(mReadThread));
+      if (NS_FAILED(rv)) {
+        DoSessionEndTask(rv);
+        return;
+      }
+    }
+
+    // In case source media stream does not notify track end, recieve
+    // shutdown notification and stop Read Thread.
+    nsContentUtils::RegisterShutdownObserver(this);
+
+    mReadThread->Dispatch(new ExtractRunnable(this), NS_DISPATCH_NORMAL);
+  }
+  // application should get blob and onstop event
+  void DoSessionEndTask(nsresult rv)
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+
+    if (NS_FAILED(rv)) {
+      mRecorder->NotifyError(rv);
+    }
+    CleanupStreams();
+    // Destroy this session object in main thread.
+    NS_DispatchToMainThread(new PushBlobRunnable(this));
+    NS_DispatchToMainThread(new DestroyRunnable(already_AddRefed<Session>(this)));
+  }
   void CleanupStreams()
   {
     if (mInputPort.get()) {
       mInputPort->Destroy();
       mInputPort = nullptr;
     }
 
     if (mTrackUnionStream.get()) {
@@ -425,21 +484,20 @@ MediaRecorder::Start(const Optional<int3
 
 void
 MediaRecorder::Stop(ErrorResult& aResult)
 {
   if (mState == RecordingState::Inactive) {
     aResult.Throw(NS_ERROR_DOM_INVALID_STATE_ERR);
     return;
   }
+  mState = RecordingState::Inactive;
 
   mSession->Stop();
   mSession = nullptr;
-
-  mState = RecordingState::Inactive;
 }
 
 void
 MediaRecorder::Pause(ErrorResult& aResult)
 {
   if (mState != RecordingState::Recording) {
     aResult.Throw(NS_ERROR_DOM_INVALID_STATE_ERR);
     return;
--- a/content/media/MediaRecorder.h
+++ b/content/media/MediaRecorder.h
@@ -99,17 +99,17 @@ protected:
 
   MediaRecorder(const MediaRecorder& x) MOZ_DELETE; // prevent bad usage
 
   // MediaStream passed from js context
   nsRefPtr<DOMMediaStream> mStream;
   // The current state of the MediaRecorder object.
   RecordingState mState;
   // Current recording session.
-  Session *mSession;
+  nsRefPtr<Session> mSession;
   // Thread safe for mMimeType.
   Mutex mMutex;
   // It specifies the container format as well as the audio and video capture formats.
   nsString mMimeType;
 };
 
 }
 }
--- a/content/media/encoder/ContainerWriter.h
+++ b/content/media/encoder/ContainerWriter.h
@@ -14,19 +14,24 @@
 namespace mozilla {
 /**
  * ContainerWriter packs encoded track data into a specific media container.
  */
 class ContainerWriter {
 public:
   ContainerWriter()
     : mInitialized(false)
+    , mIsWritingComplete(false)
   {}
   virtual ~ContainerWriter() {}
-
+  // Mapping to DOMLocalMediaStream::TrackTypeHints
+  enum {
+    HAS_AUDIO = 1 << 0,
+    HAS_VIDEO = 1 << 1,
+  };
   enum {
     END_OF_STREAM = 1 << 0
   };
 
   /**
    * Writes encoded track data from aBuffer to a packet, and insert this packet
    * into the internal stream of container writer. aDuration is the playback
    * duration of this packet in number of samples. aFlags is true with
@@ -39,29 +44,34 @@ public:
   /**
    * Set the meta data pointer into muxer
    * This function will check the integrity of aMetadata.
    * If the meta data isn't well format, this function will return NS_ERROR_FAILURE to caller,
    * else save the pointer to mMetadata and return NS_OK.
    */
   virtual nsresult SetMetadata(TrackMetadataBase* aMetadata) = 0;
 
+  /**
+   * Indicate if the writer has finished to output data
+   */
+  virtual bool IsWritingComplete() { return mIsWritingComplete; }
+
   enum {
     FLUSH_NEEDED = 1 << 0,
     GET_HEADER = 1 << 1
   };
 
   /**
    * Copies the final container data to a buffer if it has accumulated enough
    * packets from WriteEncodedTrack. This buffer of data is appended to
    * aOutputBufs, and existing elements of aOutputBufs should not be modified.
    * aFlags is true with FLUSH_NEEDED will force OggWriter to flush an ogg page
    * even it is not full, and copy these container data to a buffer for
    * aOutputBufs to append.
    */
   virtual nsresult GetContainerData(nsTArray<nsTArray<uint8_t> >* aOutputBufs,
                                     uint32_t aFlags = 0) = 0;
-
 protected:
   bool mInitialized;
+  bool mIsWritingComplete;
 };
 }
 #endif
--- a/content/media/encoder/EncodedFrameContainer.h
+++ b/content/media/encoder/EncodedFrameContainer.h
@@ -47,16 +47,18 @@ public:
     mDuration(0),
     mFrameType(UNKNOW)
   {}
   enum FrameType {
     I_FRAME,      // intraframe
     P_FRAME,      // predicted frame
     B_FRAME,      // bidirectionally predicted frame
     AUDIO_FRAME,  // audio frame
+    AAC_CSD,      // AAC codec specific data
+    AVC_CSD,      // AVC codec specific data
     UNKNOW        // FrameType not set
   };
   const nsTArray<uint8_t>& GetFrameData() const
   {
     return mFrameData;
   }
   void SetFrameData(nsTArray<uint8_t> *aData)
   {
--- a/content/media/encoder/MediaEncoder.cpp
+++ b/content/media/encoder/MediaEncoder.cpp
@@ -1,134 +1,157 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-*/
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 #include "MediaEncoder.h"
 #include "MediaDecoder.h"
 #include "nsIPrincipal.h"
+#include "nsMimeTypes.h"
+#include "prlog.h"
 
 #ifdef MOZ_OGG
 #include "OggWriter.h"
 #endif
 #ifdef MOZ_OPUS
 #include "OpusTrackEncoder.h"
 #endif
+#ifdef MOZ_WEBM_ENCODER
+#include "VorbisTrackEncoder.h"
+#include "VP8TrackEncoder.h"
+#include "WebMWriter.h"
+#endif
+#ifdef MOZ_OMX_ENCODER
+#include "OmxTrackEncoder.h"
+#include "ISOMediaWriter.h"
+#endif
 
-#ifdef MOZ_WIDGET_GONK
-#include <android/log.h>
-#define LOG(args...) __android_log_print(ANDROID_LOG_INFO, "MediaEncoder", ## args);
+#ifdef LOG
+#undef LOG
+#endif
+
+#ifdef PR_LOGGING
+PRLogModuleInfo* gMediaEncoderLog;
+#define LOG(type, msg) PR_LOG(gMediaEncoderLog, type, msg)
 #else
-#define LOG(args,...)
+#define LOG(type, msg)
 #endif
 
 namespace mozilla {
 
-#define TRACK_BUFFER_LEN 8192
-
-namespace {
-
-template <class String>
-static bool
-TypeListContains(char const *const * aTypes, const String& aType)
-{
-  for (int32_t i = 0; aTypes[i]; ++i) {
-    if (aType.EqualsASCII(aTypes[i]))
-      return true;
-  }
-  return false;
-}
-
-#ifdef MOZ_OGG
-// The recommended mime-type for Ogg Opus files is audio/ogg.
-// See http://wiki.xiph.org/OggOpus for more details.
-static const char* const gOggTypes[2] = {
-  "audio/ogg",
-  nullptr
-};
-
-static bool
-IsOggType(const nsAString& aType)
-{
-  if (!MediaDecoder::IsOggEnabled()) {
-    return false;
-  }
-
-  return TypeListContains(gOggTypes, aType);
-}
-#endif
-} //anonymous namespace
+static nsIThread* sEncoderThread = nullptr;
 
 void
 MediaEncoder::NotifyQueuedTrackChanges(MediaStreamGraph* aGraph,
                                        TrackID aID,
                                        TrackRate aTrackRate,
                                        TrackTicks aTrackOffset,
                                        uint32_t aTrackEvents,
                                        const MediaSegment& aQueuedMedia)
 {
   // Process the incoming raw track data from MediaStreamGraph, called on the
   // thread of MediaStreamGraph.
-  if (aQueuedMedia.GetType() == MediaSegment::AUDIO) {
+  if (mAudioEncoder && aQueuedMedia.GetType() == MediaSegment::AUDIO) {
     mAudioEncoder->NotifyQueuedTrackChanges(aGraph, aID, aTrackRate,
                                             aTrackOffset, aTrackEvents,
                                             aQueuedMedia);
 
-  } else {
-    // Type video is not supported for now.
+  } else if (mVideoEncoder && aQueuedMedia.GetType() == MediaSegment::VIDEO) {
+      mVideoEncoder->NotifyQueuedTrackChanges(aGraph, aID, aTrackRate,
+                                              aTrackOffset, aTrackEvents,
+                                              aQueuedMedia);
   }
 }
 
 void
 MediaEncoder::NotifyRemoved(MediaStreamGraph* aGraph)
 {
   // In case that MediaEncoder does not receive a TRACK_EVENT_ENDED event.
-  LOG("NotifyRemoved in [MediaEncoder].");
-  mAudioEncoder->NotifyRemoved(aGraph);
+  LOG(PR_LOG_DEBUG, ("NotifyRemoved in [MediaEncoder]."));
+  if (mAudioEncoder) {
+    mAudioEncoder->NotifyRemoved(aGraph);
+  }
+  if (mVideoEncoder) {
+    mVideoEncoder->NotifyRemoved(aGraph);
+  }
+
 }
 
+bool
+MediaEncoder::OnEncoderThread()
+{
+  return NS_GetCurrentThread() == sEncoderThread;
+}
 /* static */
 already_AddRefed<MediaEncoder>
-MediaEncoder::CreateEncoder(const nsAString& aMIMEType)
+MediaEncoder::CreateEncoder(const nsAString& aMIMEType, uint8_t aTrackTypes)
 {
+#ifdef PR_LOGGING
+  if (!gMediaEncoderLog) {
+    gMediaEncoderLog = PR_NewLogModule("MediaEncoder");
+  }
+#endif
   nsAutoPtr<ContainerWriter> writer;
   nsAutoPtr<AudioTrackEncoder> audioEncoder;
   nsAutoPtr<VideoTrackEncoder> videoEncoder;
   nsRefPtr<MediaEncoder> encoder;
-
-  if (aMIMEType.IsEmpty()) {
-    // TODO: Should pick out a default container+codec base on the track
-    //       coming from MediaStreamGraph. For now, just default to Ogg+Opus.
-    const_cast<nsAString&>(aMIMEType) = NS_LITERAL_STRING("audio/ogg");
+  nsString mimeType;
+  if (!aTrackTypes) {
+    LOG(PR_LOG_ERROR, ("NO TrackTypes!!!"));
+    return nullptr;
+  }
+#ifdef MOZ_WEBM_ENCODER
+  else if (MediaDecoder::IsWebMEnabled() &&
+          (aMIMEType.EqualsLiteral(VIDEO_WEBM) ||
+          (aTrackTypes & ContainerWriter::HAS_VIDEO))) {
+    if (aTrackTypes & ContainerWriter::HAS_AUDIO) {
+      audioEncoder = new VorbisTrackEncoder();
+      NS_ENSURE_TRUE(audioEncoder, nullptr);
+    }
+    videoEncoder = new VP8TrackEncoder();
+    writer = new WebMWriter(aTrackTypes);
+    NS_ENSURE_TRUE(writer, nullptr);
+    NS_ENSURE_TRUE(videoEncoder, nullptr);
+    mimeType = NS_LITERAL_STRING(VIDEO_WEBM);
   }
-
-  bool isAudioOnly = FindInReadable(NS_LITERAL_STRING("audio/"), aMIMEType);
+#endif //MOZ_WEBM_ENCODER
+#ifdef MOZ_OMX_ENCODER
+  else if (aMIMEType.EqualsLiteral(VIDEO_MP4) ||
+          (aTrackTypes & ContainerWriter::HAS_VIDEO)) {
+    if (aTrackTypes & ContainerWriter::HAS_AUDIO) {
+      audioEncoder = new OmxAudioTrackEncoder();
+      NS_ENSURE_TRUE(audioEncoder, nullptr);
+    }
+    videoEncoder = new OmxVideoTrackEncoder();
+    writer = new ISOMediaWriter(aTrackTypes);
+    NS_ENSURE_TRUE(writer, nullptr);
+    NS_ENSURE_TRUE(videoEncoder, nullptr);
+    mimeType = NS_LITERAL_STRING(VIDEO_MP4);
+  }
+#endif // MOZ_OMX_ENCODER
 #ifdef MOZ_OGG
-  if (IsOggType(aMIMEType)) {
+  else if (MediaDecoder::IsOggEnabled() && MediaDecoder::IsOpusEnabled() &&
+           (aMIMEType.EqualsLiteral(AUDIO_OGG) ||
+           (aTrackTypes & ContainerWriter::HAS_AUDIO))) {
     writer = new OggWriter();
-    if (!isAudioOnly) {
-      // Initialize the videoEncoder.
-    }
-#ifdef MOZ_OPUS
     audioEncoder = new OpusTrackEncoder();
-#endif
-  }
-#endif
-  // If the given mime-type is video but fail to create the video encoder.
-  if (!isAudioOnly) {
-    NS_ENSURE_TRUE(videoEncoder, nullptr);
+    NS_ENSURE_TRUE(writer, nullptr);
+    NS_ENSURE_TRUE(audioEncoder, nullptr);
+    mimeType = NS_LITERAL_STRING(AUDIO_OGG);
   }
-
-  // Return null if we fail to create the audio encoder.
-  NS_ENSURE_TRUE(audioEncoder, nullptr);
-
+#endif  // MOZ_OGG
+  else {
+    LOG(PR_LOG_ERROR, ("Can not find any encoder to record this media stream"));
+    return nullptr;
+  }
+  LOG(PR_LOG_DEBUG, ("Create encoder result:a[%d] v[%d] w[%d] mimeType = %s.",
+                      audioEncoder != nullptr, videoEncoder != nullptr,
+                      writer != nullptr, mimeType.get()));
   encoder = new MediaEncoder(writer.forget(), audioEncoder.forget(),
-                             videoEncoder.forget(), aMIMEType);
-
-
+                             videoEncoder.forget(), mimeType);
   return encoder.forget();
 }
 
 /**
  * GetEncodedData() runs as a state machine, starting with mState set to
  * GET_METADDATA, the procedure should be as follow:
  *
  * While non-stop
@@ -151,87 +174,135 @@ MediaEncoder::CreateEncoder(const nsAStr
  *   If mState is ENCODE_DONE or ENCODE_ERROR
  *     Stop the loop
  */
 void
 MediaEncoder::GetEncodedData(nsTArray<nsTArray<uint8_t> >* aOutputBufs,
                              nsAString& aMIMEType)
 {
   MOZ_ASSERT(!NS_IsMainThread());
-
+  if (!sEncoderThread) {
+    sEncoderThread = NS_GetCurrentThread();
+  }
   aMIMEType = mMIMEType;
 
   bool reloop = true;
   while (reloop) {
     switch (mState) {
     case ENCODE_METADDATA: {
-      nsRefPtr<TrackMetadataBase> meta = mAudioEncoder->GetMetadata();
-      if (meta == nullptr) {
-        LOG("ERROR! AudioEncoder get null Metadata!");
-        mState = ENCODE_ERROR;
+      LOG(PR_LOG_DEBUG, ("ENCODE_METADDATA TimeStamp = %f", GetEncodeTimeStamp()));
+      nsresult rv = CopyMetadataToMuxer(mAudioEncoder.get());
+      if (NS_FAILED(rv)) {
+        LOG(PR_LOG_ERROR, ("Error! Fail to Set Audio Metadata"));
         break;
       }
-      nsresult rv = mWriter->SetMetadata(meta);
+      rv = CopyMetadataToMuxer(mVideoEncoder.get());
       if (NS_FAILED(rv)) {
-       LOG("ERROR! writer can't accept audio metadata!");
-       mState = ENCODE_ERROR;
-       break;
+        LOG(PR_LOG_ERROR, ("Error! Fail to Set Video Metadata"));
+        break;
       }
 
       rv = mWriter->GetContainerData(aOutputBufs,
                                      ContainerWriter::GET_HEADER);
       if (NS_FAILED(rv)) {
-       LOG("ERROR! writer fail to generate header!");
+       LOG(PR_LOG_ERROR,("Error! writer fail to generate header!"));
        mState = ENCODE_ERROR;
        break;
       }
-
+      LOG(PR_LOG_DEBUG, ("Finish ENCODE_METADDATA TimeStamp = %f", GetEncodeTimeStamp()));
       mState = ENCODE_TRACK;
       break;
     }
 
     case ENCODE_TRACK: {
+      LOG(PR_LOG_DEBUG, ("ENCODE_TRACK TimeStamp = %f", GetEncodeTimeStamp()));
       EncodedFrameContainer encodedData;
-      nsresult rv = mAudioEncoder->GetEncodedTrack(encodedData);
+      nsresult rv = NS_OK;
+      rv = WriteEncodedDataToMuxer(mAudioEncoder.get());
       if (NS_FAILED(rv)) {
-        // Encoding might be canceled.
-        LOG("ERROR! Fail to get encoded data from encoder.");
-        mState = ENCODE_ERROR;
+        LOG(PR_LOG_ERROR, ("Error! Fail to write audio encoder data to muxer"));
         break;
       }
-      rv = mWriter->WriteEncodedTrack(encodedData,
-                                      mAudioEncoder->IsEncodingComplete() ?
-                                      ContainerWriter::END_OF_STREAM : 0);
+      LOG(PR_LOG_DEBUG, ("Audio encoded TimeStamp = %f", GetEncodeTimeStamp()));
+      rv = WriteEncodedDataToMuxer(mVideoEncoder.get());
       if (NS_FAILED(rv)) {
-        LOG("ERROR! Fail to write encoded track to the media container.");
-        mState = ENCODE_ERROR;
+        LOG(PR_LOG_ERROR, ("Fail to write video encoder data to muxer"));
         break;
       }
-
+      LOG(PR_LOG_DEBUG, ("Video encoded TimeStamp = %f", GetEncodeTimeStamp()));
+      // In audio only or video only case, let unavailable track's flag to be true.
+      bool isAudioCompleted = (mAudioEncoder && mAudioEncoder->IsEncodingComplete()) || !mAudioEncoder;
+      bool isVideoCompleted = (mVideoEncoder && mVideoEncoder->IsEncodingComplete()) || !mVideoEncoder;
       rv = mWriter->GetContainerData(aOutputBufs,
-                                     mAudioEncoder->IsEncodingComplete() ?
+                                     isAudioCompleted && isVideoCompleted ?
                                      ContainerWriter::FLUSH_NEEDED : 0);
       if (NS_SUCCEEDED(rv)) {
         // Successfully get the copy of final container data from writer.
         reloop = false;
       }
-
-      mState = (mAudioEncoder->IsEncodingComplete()) ? ENCODE_DONE : ENCODE_TRACK;
+      mState = (mWriter->IsWritingComplete()) ? ENCODE_DONE : ENCODE_TRACK;
+      LOG(PR_LOG_DEBUG, ("END ENCODE_TRACK TimeStamp = %f "
+          "mState = %d aComplete %d vComplete %d",
+          GetEncodeTimeStamp(), mState, isAudioCompleted, isVideoCompleted));
       break;
     }
 
     case ENCODE_DONE:
-      LOG("MediaEncoder has been shutdown.");
-      mShutdown = true;
-      reloop = false;
-      break;
     case ENCODE_ERROR:
-      LOG("ERROR! MediaEncoder got error!");
+      LOG(PR_LOG_DEBUG, ("MediaEncoder has been shutdown."));
       mShutdown = true;
       reloop = false;
       break;
     default:
       MOZ_CRASH("Invalid encode state");
     }
   }
 }
 
+nsresult
+MediaEncoder::WriteEncodedDataToMuxer(TrackEncoder *aTrackEncoder)
+{
+  if (aTrackEncoder == nullptr) {
+    return NS_OK;
+  }
+  if (aTrackEncoder->IsEncodingComplete()) {
+    return NS_OK;
+  }
+  EncodedFrameContainer encodedVideoData;
+  nsresult rv = aTrackEncoder->GetEncodedTrack(encodedVideoData);
+  if (NS_FAILED(rv)) {
+    // Encoding might be canceled.
+    LOG(PR_LOG_ERROR, ("Error! Fail to get encoded data from video encoder."));
+    mState = ENCODE_ERROR;
+    return rv;
+  }
+  rv = mWriter->WriteEncodedTrack(encodedVideoData,
+                                  aTrackEncoder->IsEncodingComplete() ?
+                                  ContainerWriter::END_OF_STREAM : 0);
+  if (NS_FAILED(rv)) {
+    LOG(PR_LOG_ERROR, ("Error! Fail to write encoded video track to the media container."));
+    mState = ENCODE_ERROR;
+  }
+  return rv;
 }
+
+nsresult
+MediaEncoder::CopyMetadataToMuxer(TrackEncoder *aTrackEncoder)
+{
+  if (aTrackEncoder == nullptr) {
+    return NS_OK;
+  }
+  nsRefPtr<TrackMetadataBase> meta = aTrackEncoder->GetMetadata();
+  if (meta == nullptr) {
+    LOG(PR_LOG_ERROR, ("Error! metadata = null"));
+    mState = ENCODE_ERROR;
+    return NS_ERROR_ABORT;
+  }
+
+  nsresult rv = mWriter->SetMetadata(meta);
+  if (NS_FAILED(rv)) {
+   LOG(PR_LOG_ERROR, ("Error! SetMetadata fail"));
+   mState = ENCODE_ERROR;
+  }
+  return rv;
+}
+
+}
--- a/content/media/encoder/MediaEncoder.h
+++ b/content/media/encoder/MediaEncoder.h
@@ -59,16 +59,17 @@ public :
 
   MediaEncoder(ContainerWriter* aWriter,
                AudioTrackEncoder* aAudioEncoder,
                VideoTrackEncoder* aVideoEncoder,
                const nsAString& aMIMEType)
     : mWriter(aWriter)
     , mAudioEncoder(aAudioEncoder)
     , mVideoEncoder(aVideoEncoder)
+    , mStartTime(TimeStamp::Now())
     , mMIMEType(aMIMEType)
     , mState(MediaEncoder::ENCODE_METADDATA)
     , mShutdown(false)
   {}
 
   ~MediaEncoder() {};
 
   /**
@@ -86,18 +87,22 @@ public :
    */
   virtual void NotifyRemoved(MediaStreamGraph* aGraph);
 
   /**
    * Creates an encoder with a given MIME type. Returns null if we are unable
    * to create the encoder. For now, default aMIMEType to "audio/ogg" and use
    * Ogg+Opus if it is empty.
    */
-  static already_AddRefed<MediaEncoder> CreateEncoder(const nsAString& aMIMEType);
-
+  static already_AddRefed<MediaEncoder> CreateEncoder(const nsAString& aMIMEType,
+                                                      uint8_t aTrackTypes = ContainerWriter::HAS_AUDIO);
+  /**
+   * Check if run on Encoder thread
+   */
+  static bool OnEncoderThread();
   /**
    * Encodes the raw track data and returns the final container data. Assuming
    * it is called on a single worker thread. The buffer of container data is
    * allocated in ContainerWriter::GetContainerData(), and is appended to
    * aOutputBufs. aMIMEType is the valid mime-type of this returned container
    * data.
    */
   void GetEncodedData(nsTArray<nsTArray<uint8_t> >* aOutputBufs,
@@ -123,18 +128,30 @@ public :
   }
 
   bool HasError()
   {
     return mState == ENCODE_ERROR;
   }
 
 private:
+  // Get encoded data from trackEncoder and write to muxer
+  nsresult WriteEncodedDataToMuxer(TrackEncoder *aTrackEncoder);
+  // Get metadata from trackEncoder and copy to muxer
+  nsresult CopyMetadataToMuxer(TrackEncoder* aTrackEncoder);
   nsAutoPtr<ContainerWriter> mWriter;
   nsAutoPtr<AudioTrackEncoder> mAudioEncoder;
   nsAutoPtr<VideoTrackEncoder> mVideoEncoder;
+  TimeStamp mStartTime;
   nsString mMIMEType;
   int mState;
   bool mShutdown;
+  // Get duration from create encoder, for logging purpose
+  double GetEncodeTimeStamp()
+  {
+    TimeDuration decodeTime;
+    decodeTime = TimeStamp::Now() - mStartTime;
+    return decodeTime.ToMilliseconds();
+  }
 };
 
 }
 #endif
--- a/content/media/ogg/OggWriter.cpp
+++ b/content/media/ogg/OggWriter.cpp
@@ -157,17 +157,19 @@ OggWriter::GetContainerData(nsTArray<nsT
     // rc = 0 means insufficient data has accumulated to fill a page, or an
     // internal error has occurred.
     rc = ogg_stream_pageout(&mOggStreamState, &mOggPage);
   }
 
   if (rc) {
     ProduceOggPage(aOutputBufs);
   }
-
+  if (aFlags & ContainerWriter::FLUSH_NEEDED) {
+    mIsWritingComplete = true;
+  }
   return (rc > 0) ? NS_OK : NS_ERROR_FAILURE;
 }
 
 nsresult
 OggWriter::SetMetadata(TrackMetadataBase* aMetadata)
 {
   MOZ_ASSERT(aMetadata);
   if (aMetadata->GetKind() != TrackMetadataBase::METADATA_OPUS) {
--- a/content/media/ogg/OggWriter.h
+++ b/content/media/ogg/OggWriter.h
@@ -26,17 +26,16 @@ public:
   nsresult WriteEncodedTrack(const EncodedFrameContainer &aData,
                              uint32_t aFlags = 0) MOZ_OVERRIDE;
 
   nsresult GetContainerData(nsTArray<nsTArray<uint8_t> >* aOutputBufs,
                             uint32_t aFlags = 0) MOZ_OVERRIDE;
 
   // Check metadata type integrity and reject unacceptable track encoder.
   nsresult SetMetadata(TrackMetadataBase* aMetadata) MOZ_OVERRIDE;
-
 private:
   nsresult Init();
 
   nsresult WriteEncodedData(const nsTArray<uint8_t>& aBuffer, int aDuration,
                             uint32_t aFlags = 0);
 
   void ProduceOggPage(nsTArray<nsTArray<uint8_t> >* aOutputBufs);
   // Store the Medatata from track encoder
--- a/content/media/test/test_mediarecorder_record_immediate_stop.html
+++ b/content/media/test/test_mediarecorder_record_immediate_stop.html
@@ -64,23 +64,33 @@ function startTest(test, token) {
         ok(false, 'ondataavailable unexpectedly fired more than once');
     } else {
       onDataAvailableFired = true;
 
       ok(evt instanceof BlobEvent,
          'Events fired from ondataavailable should be BlobEvent');
       is(evt.type, 'dataavailable',
          'Event type should dataavailable');
-      ok(evt.data.size > 0,
-         'Blob data received should be greater than zero');
-      is(evt.data.type, expectedMimeType,
-         'Blob data received should have type = ' + expectedMimeType);
 
-      is(mediaRecorder.mimeType, expectedMimeType,
-         'Mime type in ondataavailable = ' + expectedMimeType);
+      // The initialization of encoder can be cancelled.
+      // On some platforms, the stop method may run after media stream track
+      // available, so the blob can contain the header data.
+      if (evt.data.size > 0) {
+        is(evt.data.type, expectedMimeType,
+           'Blob data received and should have mime type');
+        is(mediaRecorder.mimeType, expectedMimeType,
+           'Media Recorder mime type in ondataavailable = ' + expectedMimeType);
+      } else if (evt.data.size === 0) {
+        is(mediaRecorder.mimeType, '',
+           'Blob data mime type is empty');
+        is(mediaRecorder.mimeType, '',
+           'Media Recorder mime type in ondataavailable is empty');
+      } else {
+        ok(false, 'Blob size can not be negative');
+      }
 
       // onstop should not have fired before ondataavailable
       if (onStopFired) {
         ok(false, 'ondataavailable unexpectedly fired later than onstop');
         manager.finished(token);
       }
     }
   };
--- a/content/media/webaudio/AudioContext.cpp
+++ b/content/media/webaudio/AudioContext.cpp
@@ -539,17 +539,22 @@ AudioContext::CurrentTime() const
   return MediaTimeToSeconds(Destination()->Stream()->GetCurrentTime());
 }
 
 void
 AudioContext::Shutdown()
 {
   mIsShutDown = true;
 
-  Suspend();
+  // We mute rather than suspending, because the delay between the ::Shutdown
+  // call and the CC would make us overbuffer in the MediaStreamGraph.
+  // See bug 936784 for details.
+  if (!mIsOffline) {
+    Mute();
+  }
 
   mDecoder.Shutdown();
 
   // Release references to active nodes.
   // Active AudioNodes don't unregister in destructors, at which point the
   // Node is already unregistered.
   mActiveNodes.Clear();
 
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -3094,17 +3094,19 @@ for (uint32_t i = 0; i < length; ++i) {
 
     if type.isUnion():
         nullable = type.nullable();
         if nullable:
             type = type.inner
 
         unionArgumentObj = "${declName}" if isMember else "${holderName}"
         if nullable:
-            unionArgumentObj += ".ref()"
+            # If we're a member, we're a Nullable, which hasn't been told it has
+            # a value.  Otherwise we're an already-constructed Maybe.
+            unionArgumentObj += ".SetValue()" if isMember else ".ref()"
 
         memberTypes = type.flatMemberTypes
         names = []
 
         interfaceMemberTypes = filter(lambda t: t.isNonCallbackInterface(), memberTypes)
         if len(interfaceMemberTypes) > 0:
             interfaceObject = []
             for memberType in interfaceMemberTypes:
@@ -3284,34 +3286,41 @@ for (uint32_t i = 0; i < length; ++i) {
                 assert defaultValue.type == type
                 extraConditionForNull = "!(${haveValue}) || "
             else:
                 extraConditionForNull = ""
             templateBody = handleNull(templateBody, unionArgumentObj,
                                       extraConditionForNull=extraConditionForNull)
 
         declType = CGGeneric(typeName)
-        holderType = CGGeneric(argumentTypeName) if not isMember else None
+        if isMember:
+            holderType = None
+        else:
+            holderType = CGGeneric(argumentTypeName)
+            if nullable:
+                holderType = CGTemplatedType("Maybe", holderType)
 
         # If we're isOptional and not nullable the normal optional handling will
         # handle lazy construction of our holder.  If we're nullable we do it
         # all by hand because we do not want our holder constructed if we're
         # null.
         declLoc = "${declName}"
         constructDecl = None
         if nullable:
             if isOptional:
                 holderArgs = "${declName}.Value().SetValue()"
                 declType = CGTemplatedType("Optional", declType)
                 constructDecl = CGGeneric("${declName}.Construct();")
                 declLoc = "${declName}.Value()"
             else:
                 holderArgs = "${declName}.SetValue()"
-            holderType = CGTemplatedType("Maybe", holderType)
-            constructHolder = CGGeneric("${holderName}.construct(%s);" % holderArgs)
+            if holderType is not None:
+                constructHolder = CGGeneric("${holderName}.construct(%s);" % holderArgs)
+            else:
+                constructHolder = None
             # Don't need to pass those args when the holder is being constructed
             holderArgs = None
         else:
             holderArgs = "${declName}"
             constructHolder = None
 
         if defaultValue and not isinstance(defaultValue, IDLNullValue):
             tag = defaultValue.type.tag()
@@ -4928,16 +4937,19 @@ def wrapTypeIntoCurrentCompartment(type,
                     "%s.%s" % (value, CGDictionary.makeMemberName(member.identifier.name)))
                 if memberWrap:
                     memberWraps.append(memberWrap)
             myDict = myDict.parent
         return CGList(memberWraps, "\n") if len(memberWraps) != 0 else None
 
     if type.isUnion():
         memberWraps = []
+        if type.nullable():
+            type = type.inner
+            value = "%s.Value()" % value
         for member in type.flatMemberTypes:
             memberName = getUnionMemberName(member)
             memberWrap = wrapTypeIntoCurrentCompartment(
                member, "%s.GetAs%s()" % (value, memberName))
             if memberWrap:
                 memberWrap = CGIfWrapper(
                     memberWrap, "%s.Is%s()" % (value, memberName))
                 memberWraps.append(memberWrap)
--- a/dom/bindings/test/TestBindingHeader.h
+++ b/dom/bindings/test/TestBindingHeader.h
@@ -563,16 +563,19 @@ public:
   void PassNullableUnionWithDefaultValue9(const Nullable<UnrestrictedDoubleOrString>& arg);
   void PassNullableUnionWithDefaultValue10(const Nullable<UnrestrictedFloatOrString>& arg);
   void PassNullableUnionWithDefaultValue11(const Nullable<UnrestrictedFloatOrString>& arg);
   void PassNullableUnionWithDefaultValue12(const Nullable<UnrestrictedFloatOrString>& arg);
 
   void PassSequenceOfUnions(const Sequence<OwningCanvasPatternOrCanvasGradient>&);
   void PassVariadicUnion(const Sequence<OwningCanvasPatternOrCanvasGradient>&);
 
+  void PassSequenceOfNullableUnions(const Sequence<Nullable<OwningCanvasPatternOrCanvasGradient>>&);
+  void PassVariadicNullableUnion(const Sequence<Nullable<OwningCanvasPatternOrCanvasGradient>>&);
+
   void ReceiveUnion(OwningCanvasPatternOrCanvasGradient&);
   void ReceiveUnion2(JSContext*, OwningObjectOrLong&);
   void ReceiveUnionContainingNull(OwningCanvasPatternOrNullOrCanvasGradient&);
   void ReceiveNullableUnion(Nullable<OwningCanvasPatternOrCanvasGradient>&);
   void ReceiveNullableUnion2(JSContext*, Nullable<OwningObjectOrLong>&);
   void GetWritableUnion(OwningCanvasPatternOrCanvasGradient&);
   void SetWritableUnion(const CanvasPatternOrCanvasGradient&);
   void GetWritableUnionContainingNull(OwningCanvasPatternOrNullOrCanvasGradient&);
--- a/dom/bindings/test/TestCodeGen.webidl
+++ b/dom/bindings/test/TestCodeGen.webidl
@@ -513,16 +513,19 @@ interface TestInterface {
   void passNullableUnionWithDefaultValue9(optional (unrestricted double or DOMString)? arg = null);
   void passNullableUnionWithDefaultValue10(optional (unrestricted float or DOMString)? arg = "");
   void passNullableUnionWithDefaultValue11(optional (unrestricted float or DOMString)? arg = 1);
   void passNullableUnionWithDefaultValue12(optional (unrestricted float or DOMString)? arg = null);
 
   void passSequenceOfUnions(sequence<(CanvasPattern or CanvasGradient)> arg);
   void passVariadicUnion((CanvasPattern or CanvasGradient)... arg);
 
+  void passSequenceOfNullableUnions(sequence<(CanvasPattern or CanvasGradient)?> arg);
+  void passVariadicNullableUnion((CanvasPattern or CanvasGradient)?... arg);
+
   (CanvasPattern or CanvasGradient) receiveUnion();
   (object or long) receiveUnion2();
   (CanvasPattern? or CanvasGradient) receiveUnionContainingNull();
   (CanvasPattern or CanvasGradient)? receiveNullableUnion();
   (object or long)? receiveNullableUnion2();
 
   attribute (CanvasPattern or CanvasGradient) writableUnion;
   attribute (CanvasPattern? or CanvasGradient) writableUnionContainingNull;
@@ -782,18 +785,20 @@ dictionary Dict : ParentDict {
   unrestricted double  infUrDouble = Infinity;
   unrestricted double  negativeInfUrDouble = -Infinity;
   unrestricted double  nanUrDouble = NaN;
 
   (float or DOMString) floatOrString = "str";
   (object or long) objectOrLong;
 #ifdef DEBUG
   (EventInit or long) eventInitOrLong;
+  (EventInit or long)? nullableEventInitOrLong;
   // CustomEventInit is useful to test because it needs rooting.
   (CustomEventInit or long) eventInitOrLong2;
+  (CustomEventInit or long)? nullableEventInitOrLong2;
   (EventInit or long) eventInitOrLongWithDefaultValue = null;
   (CustomEventInit or long) eventInitOrLongWithDefaultValue2 = null;
   (EventInit or long) eventInitOrLongWithDefaultValue3 = 5;
   (CustomEventInit or long) eventInitOrLongWithDefaultValue4 = 5;
 #endif
 
   ArrayBuffer arrayBuffer;
   ArrayBuffer? nullableArrayBuffer;
--- a/dom/bindings/test/TestExampleGen.webidl
+++ b/dom/bindings/test/TestExampleGen.webidl
@@ -409,16 +409,19 @@ interface TestExampleInterface {
   void passNullableUnionWithDefaultValue9(optional (unrestricted double or DOMString)? arg = null);
   void passNullableUnionWithDefaultValue10(optional (unrestricted float or DOMString)? arg = "");
   void passNullableUnionWithDefaultValue11(optional (unrestricted float or DOMString)? arg = 1);
   void passNullableUnionWithDefaultValue12(optional (unrestricted float or DOMString)? arg = null);
 
   void passSequenceOfUnions(sequence<(CanvasPattern or CanvasGradient)> arg);
   void passVariadicUnion((CanvasPattern or CanvasGradient)... arg);
 
+  void passSequenceOfNullableUnions(sequence<(CanvasPattern or CanvasGradient)?> arg);
+  void passVariadicNullableUnion((CanvasPattern or CanvasGradient)?... arg);
+
   //(CanvasPattern or CanvasGradient) receiveUnion();
   //(object or long) receiveUnion2();
   //(CanvasPattern? or CanvasGradient) receiveUnionContainingNull();
   //(CanvasPattern or CanvasGradient)? receiveNullableUnion();
   //(object or long)? receiveNullableUnion2();
 
   //attribute (CanvasPattern or CanvasGradient) writableUnion;
   //attribute (CanvasPattern? or CanvasGradient) writableUnionContainingNull;
--- a/dom/bindings/test/TestJSImplGen.webidl
+++ b/dom/bindings/test/TestJSImplGen.webidl
@@ -431,16 +431,19 @@ interface TestJSImplInterface {
   void passNullableUnionWithDefaultValue9(optional (unrestricted double or DOMString)? arg = null);
   void passNullableUnionWithDefaultValue10(optional (unrestricted float or DOMString)? arg = "");
   void passNullableUnionWithDefaultValue11(optional (unrestricted float or DOMString)? arg = 1);
   void passNullableUnionWithDefaultValue12(optional (unrestricted float or DOMString)? arg = null);
 
   void passSequenceOfUnions(sequence<(CanvasPattern or CanvasGradient)> arg);
   void passVariadicUnion((CanvasPattern or CanvasGradient)... arg);
 
+  void passSequenceOfNullableUnions(sequence<(CanvasPattern or CanvasGradient)?> arg);
+  void passVariadicNullableUnion((CanvasPattern or CanvasGradient)?... arg);
+
   //(CanvasPattern or CanvasGradient) receiveUnion();
   //(object or long) receiveUnion2();
   //(CanvasPattern? or CanvasGradient) receiveUnionContainingNull();
   //(CanvasPattern or CanvasGradient)? receiveNullableUnion();
   //(object or long)? receiveNullableUnion2();
 
   //attribute (CanvasPattern or CanvasGradient) writableUnion;
   //attribute (CanvasPattern? or CanvasGradient) writableUnionContainingNull;
--- a/dom/fmradio/FMRadioService.cpp
+++ b/dom/fmradio/FMRadioService.cpp
@@ -118,17 +118,16 @@ public:
   NS_IMETHOD Run()
   {
     FMRadioSettings info;
     info.upperLimit() = mUpperLimit;
     info.lowerLimit() = mLowerLimit;
     info.spaceType() = mSpaceType;
 
     EnableFMRadio(info);
-    IFMRadioService::Singleton()->EnableAudio(true);
 
     return NS_OK;
   }
 
 private:
   int32_t mUpperLimit;
   int32_t mLowerLimit;
   int32_t mSpaceType;
@@ -297,19 +296,19 @@ FMRadioService::EnableAudio(bool aAudioE
   MOZ_ASSERT(NS_IsMainThread(), "Wrong thread!");
 
   nsCOMPtr<nsIAudioManager> audioManager =
     do_GetService("@mozilla.org/telephony/audiomanager;1");
   if (!audioManager) {
     return;
   }
 
-  bool AudioEnabled;
-  audioManager->GetFmRadioAudioEnabled(&AudioEnabled);
-  if (AudioEnabled != aAudioEnabled) {
+  bool audioEnabled;
+  audioManager->GetFmRadioAudioEnabled(&audioEnabled);
+  if (audioEnabled != aAudioEnabled) {
     audioManager->SetFmRadioAudioEnabled(aAudioEnabled);
   }
 }
 
 /**
  * Round the frequency to match the range of frequency and the channel width. If
  * the given frequency is out of range, return 0. For example:
  *  - lower: 87500KHz, upper: 108000KHz, channel width: 200KHz
@@ -731,16 +730,22 @@ FMRadioService::Notify(const FMRadioOper
 
       // Fire success callback on the enable request.
       TransitionState(SuccessResponse(), Enabled);
 
       // To make sure the FM app will get the right frequency after the FM
       // radio is enabled, we have to set the frequency first.
       SetFMRadioFrequency(mPendingFrequencyInKHz);
 
+      // Bug 949855: enable audio after the FM radio HW is enabled, to make sure
+      // 'hw.fm.isAnalog' could be detected as |true| during first time launch.
+      // This case is for audio output on analog path, i.e. 'ro.moz.fm.noAnalog'
+      // is not |true|.
+      EnableAudio(true);
+
       // Update the current frequency without sending the`FrequencyChanged`
       // event, to make sure the FM app will get the right frequency when the
       // `EnabledChange` event is sent.
       mPendingFrequencyInKHz = GetFMRadioFrequency();
       UpdatePowerState();
 
       // The frequency was changed from '0' to some meaningful number, so we
       // should send the `FrequencyChanged` event manually.
--- a/dom/interfaces/offline/moz.build
+++ b/dom/interfaces/offline/moz.build
@@ -1,13 +1,12 @@
 # -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 XPIDL_SOURCES += [
-    'nsIDOMLoadStatus.idl',
     'nsIDOMOfflineResourceList.idl',
 ]
 
 XPIDL_MODULE = 'dom_offline'
 
deleted file mode 100644
--- a/dom/interfaces/offline/nsIDOMLoadStatus.idl
+++ /dev/null
@@ -1,22 +0,0 @@
-/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "domstubs.idl"
-
-[uuid(2cb53a8a-d2f4-4ddf-874f-3bc2d595c41a)]
-interface nsIDOMLoadStatus : nsISupports
-{
-  readonly attribute nsIDOMNode source;
-  readonly attribute DOMString uri;
-  readonly attribute long totalSize;
-  readonly attribute long loadedSize;
-  readonly attribute unsigned short readyState;
-  readonly attribute unsigned short status;
-
-  const unsigned short UNINITIALIZED = 0;
-  const unsigned short REQUESTED     = 1;
-  const unsigned short RECEIVING     = 2;
-  const unsigned short LOADED        = 3;
-};
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -1764,17 +1764,18 @@ TabChild::UpdateTapState(const WidgetTou
   if (aEvent.message == NS_TOUCH_START) {
     if (currentlyTrackingTouch || aEvent.touches.Length() > 1) {
       // We're tracking a possible tap for another point, or we saw a
       // touchstart for a later pointer after we canceled tracking of
       // the first point.  Ignore this one.
       return;
     }
     if (aStatus == nsEventStatus_eConsumeNoDefault ||
-        nsIPresShell::gPreventMouseEvents) {
+        nsIPresShell::gPreventMouseEvents ||
+        aEvent.mFlags.mMultipleActionsPrevented) {
       return;
     }
 
     Touch* touch = static_cast<Touch*>(aEvent.touches[0].get());
     mGestureDownPoint = LayoutDevicePoint(touch->mRefPoint.x, touch->mRefPoint.y);
     mActivePointerId = touch->mIdentifier;
     if (sClickHoldContextMenusEnabled) {
       MOZ_ASSERT(!mTapHoldTimer);
@@ -1867,20 +1868,21 @@ TabChild::RecvRealTouchEvent(const Widge
   WidgetTouchEvent localEvent(aEvent);
   nsEventStatus status = DispatchWidgetEvent(localEvent);
 
   if (IsAsyncPanZoomEnabled()) {
     nsCOMPtr<nsPIDOMWindow> outerWindow = do_GetInterface(mWebNav);
     nsCOMPtr<nsPIDOMWindow> innerWindow = outerWindow->GetCurrentInnerWindow();
 
     if (innerWindow && innerWindow->HasTouchEventListeners()) {
-      SendContentReceivedTouch(aGuid, nsIPresShell::gPreventMouseEvents);
+      SendContentReceivedTouch(aGuid, nsIPresShell::gPreventMouseEvents ||
+                               localEvent.mFlags.mMultipleActionsPrevented);
     }
   } else {
-    UpdateTapState(aEvent, status);
+    UpdateTapState(localEvent, status);
   }
 
   return true;
 }
 
 bool
 TabChild::RecvRealTouchMoveEvent(const WidgetTouchEvent& aEvent,
                                  const ScrollableLayerGuid& aGuid)
--- a/dom/src/offline/nsDOMOfflineResourceList.cpp
+++ b/dom/src/offline/nsDOMOfflineResourceList.cpp
@@ -9,17 +9,16 @@
 #include "nsDOMLists.h"
 #include "nsIPrefetchService.h"
 #include "nsCPrefetchService.h"
 #include "nsNetUtil.h"
 #include "nsNetCID.h"
 #include "nsICacheSession.h"
 #include "nsICacheService.h"
 #include "nsIOfflineCacheUpdate.h"
-#include "nsIDOMLoadStatus.h"
 #include "nsAutoPtr.h"
 #include "nsContentUtils.h"
 #include "nsEventDispatcher.h"
 #include "nsIObserverService.h"
 #include "nsIScriptGlobalObject.h"
 #include "nsIWebNavigation.h"
 #include "mozilla/dom/OfflineResourceListBinding.h"
 #include "mozilla/Preferences.h"
--- a/dom/system/gonk/tests/test_ril_worker_icc.js
+++ b/dom/system/gonk/tests/test_ril_worker_icc.js
@@ -2435,16 +2435,19 @@ add_test(function test_fetch_icc_recodes
 
   RIL.appType = CARD_APPTYPE_USIM;
   iccRecord.fetchICCRecords();
   do_check_eq(fetchTag, 0x01);
 
   run_next_test();
 });
 
+/**
+ * Verify SimRecordHelper.readMWIS
+ */
 add_test(function test_read_mwis() {
   let worker = newUint8Worker();
   let helper = worker.GsmPDUHelper;
   let recordHelper = worker.SimRecordHelper;
   let buf    = worker.Buf;
   let io     = worker.ICCIOHelper;
   let mwisData;
   let postedMessage;
@@ -2501,16 +2504,19 @@ add_test(function test_read_mwis() {
   do_test(true, 255);
 
   do_test(false, 0);
   do_test(false, 255); // Test the corner case when mwi is disable with incorrect msgCount.
 
   run_next_test();
 });
 
+/**
+ * Verify SimRecordHelper.updateMWIS
+ */
 add_test(function test_update_mwis() {
   let worker = newUint8Worker();
   let pduHelper = worker.GsmPDUHelper;
   let ril = worker.RIL;
   ril.appType = CARD_APPTYPE_USIM;
   ril.iccInfoPrivate.mwis = [0x00, 0x00, 0x00, 0x00, 0x00];
   let recordHelper = worker.SimRecordHelper;
   let buf = worker.Buf;
@@ -2605,8 +2611,115 @@ add_test(function test_update_mwis() {
 
   // Test if loadLinearFixedEF() is not invoked in updateMWIS() when
   // EF_MWIS is not loaded/available.
   delete ril.iccInfoPrivate.mwis;
   do_test(false, 0);
 
   run_next_test();
 });
+
+/**
+ * Verify the call flow of receiving Class 2 SMS stored in SIM:
+ * 1. UNSOLICITED_RESPONSE_NEW_SMS_ON_SIM.
+ * 2. SimRecordHelper.readSMS().
+ * 3. sendChromeMessage() with rilMessageType == "sms-received".
+ */
+add_test(function test_read_new_sms_on_sim() {
+  // Instead of reusing newUint8Worker defined in this file,
+  // we define our own worker to fake the methods in WorkerBuffer dynamically.
+  function newSmsOnSimWorkerHelper() {
+    let _postedMessage;
+    let _worker = newWorker({
+      postRILMessage: function fakePostRILMessage(data) {
+      },
+      postMessage: function fakePostMessage(message) {
+        _postedMessage = message;
+      }
+    });
+
+    _worker.debug = do_print;
+
+    return {
+      get postedMessage() {
+        return _postedMessage;
+      },
+      get worker() {
+        return _worker;
+      },
+      fakeWokerBuffer: function fakeWokerBuffer() {
+        let index = 0; // index for read
+        let buf = [];
+        _worker.Buf.writeUint8 = function (value) {
+          buf.push(value);
+        };
+        _worker.Buf.readUint8 = function () {
+          return buf[index++];
+        };
+        _worker.Buf.seekIncoming = function (offset) {
+          index += offset;
+        };
+        _worker.Buf.getReadAvailable = function () {
+          return buf.length - index;
+        };
+      }
+    };
+  }
+
+  let workerHelper = newSmsOnSimWorkerHelper();
+  let worker = workerHelper.worker;
+
+  worker.ICCIOHelper.loadLinearFixedEF = function fakeLoadLinearFixedEF(options) {
+      // SimStatus: Unread, SMSC:+0123456789, Sender: +9876543210, Text: How are you?
+      let SimSmsPduHex = "0306911032547698040A9189674523010000208062917314080CC8F71D14969741F977FD07"
+                       // In 4.2.25 EF_SMS Short Messages of 3GPP TS 31.102:
+                       // 1. Record length == 176 bytes.
+                       // 2. Any bytes in the record following the TPDU shall be filled with 'FF'.
+                       + "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+                       + "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+                       + "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+                       + "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF";
+
+      workerHelper.fakeWokerBuffer();
+
+      worker.Buf.writeString(SimSmsPduHex);
+
+      options.recordSize = 176; // Record length is fixed to 176 bytes.
+      if (options.callback) {
+        options.callback(options);
+      }
+  };
+
+  function newSmsOnSimParcel() {
+    let data = new Uint8Array(4 + 4); // Int32List with 1 element.
+    let offset = 0;
+
+    function writeInt(value) {
+      data[offset++] = value & 0xFF;
+      data[offset++] = (value >>  8) & 0xFF;
+      data[offset++] = (value >> 16) & 0xFF;
+      data[offset++] = (value >> 24) & 0xFF;
+    }
+
+    writeInt(1); // Length of Int32List
+    writeInt(1); // RecordNum = 1.
+
+    return newIncomingParcel(-1,
+                             RESPONSE_TYPE_UNSOLICITED,
+                             UNSOLICITED_RESPONSE_NEW_SMS_ON_SIM,
+                             data);
+  }
+
+  function do_test() {
+    worker.onRILMessage(newSmsOnSimParcel());
+
+    let postedMessage = workerHelper.postedMessage;
+
+    do_check_eq("sms-received", postedMessage.rilMessageType);
+    do_check_eq("+0123456789", postedMessage.SMSC);
+    do_check_eq("+9876543210", postedMessage.sender);
+    do_check_eq("How are you?", postedMessage.fullBody);
+  }
+
+  do_test();
+
+  run_next_test();
+});
--- a/gfx/2d/PathCG.cpp
+++ b/gfx/2d/PathCG.cpp
@@ -292,20 +292,18 @@ PathCG::StrokeContainsPoint(const Stroke
 
 //XXX: what should these functions return for an empty path?
 // currently they return CGRectNull {inf,inf, 0, 0}
 Rect
 PathCG::GetBounds(const Matrix &aTransform) const
 {
   //XXX: are these bounds tight enough
   Rect bounds = CGRectToRect(CGPathGetBoundingBox(mPath));
-  if (!bounds.IsFinite()) {
-    return Rect();
-  }
-  //XXX: curretnly this returns the bounds of the transformed bounds
+
+  //XXX: currently this returns the bounds of the transformed bounds
   // this is strictly looser than the bounds of the transformed path
   return aTransform.TransformBounds(bounds);
 }
 
 Rect
 PathCG::GetStrokedBounds(const StrokeOptions &aStrokeOptions,
                          const Matrix &aTransform) const
 {
--- a/gfx/gl/GLContext.cpp
+++ b/gfx/gl/GLContext.cpp
@@ -457,16 +457,22 @@ GLContext::InitWithPrefix(const char *pr
 
     mInitialized = LoadSymbols(&symbols[0], trygl, prefix);
     MakeCurrent();
     if (mInitialized) {
         unsigned int version = 0;
 
         bool parseSuccess = ParseGLVersion(this, &version);
 
+#ifdef DEBUG
+        printf_stderr("OpenGL version detected: %u\n", version);
+        printf_stderr("OpenGL vendor: %s\n", fGetString(LOCAL_GL_VENDOR));
+        printf_stderr("OpenGL renderer: %s\n", fGetString(LOCAL_GL_RENDERER));
+#endif
+
         if (version >= mVersion) {
             mVersion = version;
         } else if (parseSuccess) {
             NS_WARNING("Parsed version less than expected.");
             mInitialized = false;
         }
     }
 
--- a/gfx/gl/GLContextProviderWGL.cpp
+++ b/gfx/gl/GLContextProviderWGL.cpp
@@ -106,21 +106,26 @@ HasExtension(const char* aExtensions, co
 bool
 WGLLibrary::EnsureInitialized(bool aUseMesaLlvmPipe)
 {
     if (mInitialized)
         return true;
     
     mozilla::ScopedGfxFeatureReporter reporter("WGL", aUseMesaLlvmPipe);
 
-    const char* libGLFilename = aUseMesaLlvmPipe 
+    std::string libGLFilename = aUseMesaLlvmPipe
                                 ? "mesallvmpipe.dll" 
                                 : "Opengl32.dll";
+    // SU_SPIES_DIRECTORY is for AMD CodeXL/gDEBugger
+    if (PR_GetEnv("SU_SPIES_DIRECTORY") && !aUseMesaLlvmPipe) {
+        libGLFilename = std::string(PR_GetEnv("SU_SPIES_DIRECTORY")) + "\\opengl32.dll";
+    }
+
     if (!mOGLLibrary) {
-        mOGLLibrary = PR_LoadLibrary(libGLFilename);
+        mOGLLibrary = PR_LoadLibrary(&libGLFilename[0]);
         if (!mOGLLibrary) {
             NS_WARNING("Couldn't load OpenGL library.");
             return false;
         }
     }
 
     GLLibraryLoader::SymLoadStruct earlySymbols[] = {
         { (PRFuncPtr*) &fCreateContext, { "wglCreateContext", nullptr } },
@@ -310,16 +315,20 @@ public:
         return ContextTypeWGL;
     }
 
     bool Init()
     {
         if (!mDC || !mContext)
             return false;
 
+        // see bug 929506 comment 29. wglGetProcAddress requires a current context.
+        if (!sWGLLib[mLibType].fMakeCurrent(mDC, mContext))
+            return false;
+
         SetupLookupFunction();
         if (!InitWithPrefix("gl", true))
             return false;
 
         return true;
     }
 
     bool MakeCurrentImpl(bool aForce = false)
@@ -358,16 +367,22 @@ public:
     virtual bool SwapBuffers() {
         if (!mIsDoubleBuffered)
             return false;
         return ::SwapBuffers(mDC);
     }
 
     bool SetupLookupFunction()
     {
+        // Make sure that we have a ref to the OGL library;
+        // when run under CodeXL, wglGetProcAddress won't return
+        // the right thing for some core functions.
+        MOZ_ASSERT(mLibrary == nullptr);
+
+        mLibrary = sWGLLib[mLibType].GetOGLLibrary();
         mLookupFunc = (PlatformLookupFunction)sWGLLib[mLibType].fGetProcAddress;
         return true;
     }
 
     void *GetNativeData(NativeDataType aType)
     {
         switch (aType) {
         case NativeGLContext:
@@ -464,36 +479,27 @@ GLContextProviderWGL::CreateForWindow(ns
     if (sWGLLib[libToUse].HasRobustness()) {
         int attribs[] = {
             LOCAL_WGL_CONTEXT_FLAGS_ARB, LOCAL_WGL_CONTEXT_ROBUST_ACCESS_BIT_ARB,
             LOCAL_WGL_CONTEXT_RESET_NOTIFICATION_STRATEGY_ARB, LOCAL_WGL_LOSE_CONTEXT_ON_RESET_ARB,
             0
         };
 
         context = sWGLLib[libToUse].fCreateContextAttribs(dc,
-                                                    shareContext ? shareContext->Context() : nullptr,
-                                                    attribs);
-        if (!context && shareContext) {
-            context = sWGLLib[libToUse].fCreateContextAttribs(dc, nullptr, attribs);
-            if (context) {
-                shareContext = nullptr;
-            }
-        } else {
-            context = sWGLLib[libToUse].fCreateContext(dc);
-            if (context && shareContext && !sWGLLib[libToUse].fShareLists(shareContext->Context(), context)) {
-                shareContext = nullptr;
-            }
-        }
+                                                          shareContext ? shareContext->Context() : nullptr,
+                                                          attribs);
     } else {
         context = sWGLLib[libToUse].fCreateContext(dc);
         if (context &&
             shareContext &&
             !sWGLLib[libToUse].fShareLists(shareContext->Context(), context))
         {
-            shareContext = nullptr;
+            printf_stderr("WGL context creation failed for window: wglShareLists returned false!");
+            sWGLLib[libToUse].fDeleteContext(context);
+            context = nullptr;
         }
     }
 
     if (!context) {
         return nullptr;
     }
 
     SurfaceCaps caps = SurfaceCaps::ForRGBA();
@@ -509,17 +515,18 @@ GLContextProviderWGL::CreateForWindow(ns
 
     glContext->SetIsDoubleBuffered(true);
 
     return glContext.forget();
 }
 
 static already_AddRefed<GLContextWGL>
 CreatePBufferOffscreenContext(const gfxIntSize& aSize,
-                              LibType aLibToUse)
+                              LibType aLibToUse,
+                              GLContextWGL *aShareContext)
 {
     WGLLibrary& wgl = sWGLLib[aLibToUse];
 
 #define A1(_a,_x)  do { _a.AppendElement(_x); } while(0)
 #define A2(_a,_x,_y)  do { _a.AppendElement(_x); _a.AppendElement(_y); } while(0)
 
     nsTArray<int> attrs;
 
@@ -570,29 +577,37 @@ CreatePBufferOffscreenContext(const gfxI
     HGLRC context;
     if (wgl.HasRobustness()) {
         int attribs[] = {
             LOCAL_WGL_CONTEXT_FLAGS_ARB, LOCAL_WGL_CONTEXT_ROBUST_ACCESS_BIT_ARB,
             LOCAL_WGL_CONTEXT_RESET_NOTIFICATION_STRATEGY_ARB, LOCAL_WGL_LOSE_CONTEXT_ON_RESET_ARB,
             0
         };
 
-        context = wgl.fCreateContextAttribs(pbdc, nullptr, attribs);
+        context = wgl.fCreateContextAttribs(pbdc, aShareContext->Context(), attribs);
     } else {
         context = wgl.fCreateContext(pbdc);
+        if (context && aShareContext) {
+            if (!wgl.fShareLists(aShareContext->Context(), context)) {
+                wgl.fDeleteContext(context);
+                context = nullptr;
+                printf_stderr("ERROR - creating pbuffer context failed because wglShareLists returned FALSE");
+            }
+        }
     }
 
     if (!context) {
         wgl.fDestroyPbuffer(pbuffer);
         return nullptr;
     }
 
     SurfaceCaps dummyCaps = SurfaceCaps::Any();
     nsRefPtr<GLContextWGL> glContext = new GLContextWGL(dummyCaps,
-                                                        nullptr, true,
+                                                        aShareContext,
+                                                        true,
                                                         pbuffer,
                                                         pbdc,
                                                         context,
                                                         chosenFormat,
                                                         aLibToUse);
 
     return glContext.forget();
 }
@@ -662,17 +677,17 @@ GLContextProviderWGL::CreateOffscreen(co
     nsRefPtr<GLContextWGL> glContext;
 
     // Always try to create a pbuffer context first, because we
     // want the context isolation.
     if (sWGLLib[libToUse].fCreatePbuffer &&
         sWGLLib[libToUse].fChoosePixelFormat)
     {
         gfxIntSize dummySize = gfxIntSize(16, 16);
-        glContext = CreatePBufferOffscreenContext(dummySize, libToUse);
+        glContext = CreatePBufferOffscreenContext(dummySize, libToUse, GetGlobalContextWGL());
     }
 
     // If it failed, then create a window context and use a FBO.
     if (!glContext) {
         glContext = CreateWindowOffscreenContext(flags);
     }
 
     if (!glContext ||
--- a/gfx/gl/WGLLibrary.h
+++ b/gfx/gl/WGLLibrary.h
@@ -75,16 +75,18 @@ public:
     bool IsInitialized() const { return mInitialized; }
     HWND GetWindow() const { return mWindow; }
     HDC GetWindowDC() const {return mWindowDC; }
     HGLRC GetWindowGLContext() const {return mWindowGLContext; }
     int GetWindowPixelFormat() const { return mWindowPixelFormat; }
     LibraryType GetLibraryType() const { return mLibType; }
     static LibraryType SelectLibrary(const ContextFlags& aFlags);
     
+    PRLibrary *GetOGLLibrary() { return mOGLLibrary; }
+
 private:
     bool mInitialized;
     PRLibrary *mOGLLibrary;
     bool mHasRobustness;
 
     HWND mWindow;
     HDC mWindowDC;
     HGLRC mWindowGLContext;
--- a/gfx/layers/FrameMetrics.h
+++ b/gfx/layers/FrameMetrics.h
@@ -119,26 +119,27 @@ public:
   // because the scrollableRect can be smaller if the content is not large
   // and the scrollableRect hasn't been updated yet.
   // We move the scrollableRect up because we don't know if we can move it
   // down. i.e. we know that scrollableRect can go back as far as zero.
   // but we don't know how much further ahead it can go.
   CSSRect GetExpandedScrollableRect() const
   {
     CSSRect scrollableRect = mScrollableRect;
-    if (scrollableRect.width < mCompositionBounds.width) {
+    CSSRect compBounds = CalculateCompositedRectInCssPixels();
+    if (scrollableRect.width < compBounds.width) {
       scrollableRect.x = std::max(0.f,
-                                  scrollableRect.x - (mCompositionBounds.width - scrollableRect.width));
-      scrollableRect.width = mCompositionBounds.width;
+                                  scrollableRect.x - (compBounds.width - scrollableRect.width));
+      scrollableRect.width = compBounds.width;
     }
 
-    if (scrollableRect.height < mCompositionBounds.height) {
+    if (scrollableRect.height < compBounds.height) {
       scrollableRect.y = std::max(0.f,
-                                  scrollableRect.y - (mCompositionBounds.height - scrollableRect.height));
-      scrollableRect.height = mCompositionBounds.height;
+                                  scrollableRect.y - (compBounds.height - scrollableRect.height));
+      scrollableRect.height = compBounds.height;
     }
 
     return scrollableRect;
   }
 
   /**
    * Return the scale factor needed to fit the viewport
    * into its composition bounds.
--- a/gfx/layers/basic/BasicCompositor.cpp
+++ b/gfx/layers/basic/BasicCompositor.cpp
@@ -297,23 +297,26 @@ DrawSurfaceWithTextureCoords(DrawTarget 
   // Compute a transform that maps sourceRect to aDestRect.
   gfxMatrix transform =
     gfxUtils::TransformRectToRect(sourceRect,
                                   gfxPoint(aDestRect.x, aDestRect.y),
                                   gfxPoint(aDestRect.XMost(), aDestRect.y),
                                   gfxPoint(aDestRect.XMost(), aDestRect.YMost()));
   Matrix matrix = ToMatrix(transform);
   if (aMask) {
-    NS_ASSERTION(matrix._11 == 1.0f && matrix._12 == 0.0f &&
-                 matrix._21 == 0.0f && matrix._22 == 1.0f,
-                 "Can only handle translations for mask transform");
-    aDest->MaskSurface(SurfacePattern(aSource, EXTEND_CLAMP, matrix),
-                       aMask,
-                       Point(matrix._31, matrix._32),
-                       DrawOptions(aOpacity));
+    aDest->PushClipRect(aDestRect);
+    Matrix maskTransformInverse = aMaskTransform;
+    maskTransformInverse.Invert();
+    Matrix dtTransform = aDest->GetTransform();
+    aDest->SetTransform(aMaskTransform);
+    Matrix patternMatrix = maskTransformInverse * dtTransform * matrix;
+    aDest->MaskSurface(SurfacePattern(aSource, EXTEND_REPEAT, patternMatrix),
+                       aMask, Point(), DrawOptions(aOpacity));
+    aDest->SetTransform(dtTransform);
+    aDest->PopClip();
   } else {
     aDest->FillRect(aDestRect,
                     SurfacePattern(aSource, EXTEND_REPEAT, matrix),
                     DrawOptions(aOpacity));
   }
 }
 
 static pixman_transform
--- a/gfx/layers/ipc/AsyncPanZoomController.cpp
+++ b/gfx/layers/ipc/AsyncPanZoomController.cpp
@@ -773,17 +773,20 @@ nsEventStatus AsyncPanZoomController::On
   // When a pinch ends, it might either turn into a pan (if only one finger
   // was lifted) or not (if both fingers were lifted). GestureEventListener
   // sets mCurrentSpan to a negative value in the latter case, and sets
   // mFocusPoint to the remaining touch point in the former case.
   if (aEvent.mCurrentSpan >= 0) {
     SetState(PANNING);
     mX.StartTouch(aEvent.mFocusPoint.x);
     mY.StartTouch(aEvent.mFocusPoint.y);
+  } else {
+    SetState(NOTHING);
   }
+
   {
     ReentrantMonitorAutoEnter lock(mMonitor);
     ScheduleComposite();
     RequestContentRepaint();
   }
 
   return nsEventStatus_eConsumeNoDefault;
 }
--- a/gfx/layers/ipc/GestureEventListener.cpp
+++ b/gfx/layers/ipc/GestureEventListener.cpp
@@ -282,16 +282,18 @@ nsEventStatus GestureEventListener::Hand
       pinchEvent.mCurrentSpan = pinchEvent.mPreviousSpan = -1.0f;
     }
 
     mAsyncPanZoomController->HandleInputEvent(pinchEvent);
 
     mState = GESTURE_NONE;
 
     rv = nsEventStatus_eConsumeNoDefault;
+  } else if (mState == GESTURE_WAITING_PINCH) {
+    mState = GESTURE_NONE;
   }
 
   if (aClearTouches) {
     mTouches.Clear();
   }
 
   return rv;
 }
new file mode 100644
--- /dev/null
+++ b/gfx/tests/crashtests/893572-1.html
@@ -0,0 +1,11 @@
+<script>
+o0 = document.createElement('canvas');
+(document.body || document.documentElement).appendChild(o0);
+o1 = o0.getContext('2d');
+
+o1.strokeRect(1.7976931348623157e+308, 0.651, 8, 34.323262543409996);
+o1.strokeRect(34.323262543409996, 1.7976931348623157e+308, 0.651, 8);
+o1.strokeRect(8, 34.323262543409996, 1.7976931348623157e+308, 0.651);
+o1.strokeRect(0.651, 8, 34.323262543409996, 1.7976931348623157e+308);
+
+</script>
new file mode 100644
--- /dev/null
+++ b/gfx/tests/crashtests/893572-2.html
@@ -0,0 +1,30 @@
+<script>
+o0 = document.createElement('canvas');
+(document.body || document.documentElement).appendChild(o0);
+o1 = o0.getContext('2d');
+
+o1.rect(1.7976931348623157e+308, 0.651, 8, 34.323262543409996);
+o1.stroke()
+
+o1.rect(-1.7976931348623157e+308, 0.651, 8, 34.323262543409996);
+o1.stroke()
+
+o1.rect(34.323262543409996, 1.7976931348623157e+308, 0.651, 8);
+o1.stroke()
+
+o1.rect(34.323262543409996, -1.7976931348623157e+308, 0.651, 8);
+o1.stroke()
+
+o1.rect(8, 34.323262543409996, 1.7976931348623157e+308, 0.651);
+o1.stroke()
+
+o1.rect(8, 34.323262543409996, -1.7976931348623157e+308, 0.651);
+o1.stroke()
+
+o1.rect(0.651, 8, 34.323262543409996, 1.7976931348623157e+308);
+o1.stroke()
+
+o1.rect(0.651, 8, 34.323262543409996, -1.7976931348623157e+308);
+o1.stroke()
+
+</script>
new file mode 100644
--- /dev/null
+++ b/gfx/tests/crashtests/893572-3.html
@@ -0,0 +1,44 @@
+<script>
+o0 = document.createElement('canvas');
+(document.body || document.documentElement).appendChild(o0);
+o1 = o0.getContext('2d');
+
+o1.beginPath();
+o1.moveTo(8,34.323262543409996);
+o1.lineTo(1.7976931348623157e+308,34.323262543409996);
+o1.arcTo(1.7976931348623157e+308, 150, 20, 150, 70);
+o1.stroke();
+
+o1.beginPath();
+o1.moveTo(8,34.323262543409996);
+o1.lineTo(-1.7976931348623157e+308,34.323262543409996);
+o1.arcTo(70, 1.7976931348623157e+308, 150, 20, 150);
+o1.stroke();
+
+o1.beginPath();
+o1.moveTo(34.323262543409996, 8);
+o1.lineTo(34.323262543409996, 1.7976931348623157e+308);
+o1.arcTo(150, 70, 1.7976931348623157e+308, 150, 20); 
+o1.stroke();
+
+o1.beginPath();
+o1.moveTo(34.323262543409996, 8);
+o1.lineTo(34.323262543409996, -1.7976931348623157e+308);
+o1.arcTo(20, 150, 70,1.7976931348623157e+308, 150); 
+o1.stroke();
+
+o1.beginPath();
+o1.moveTo(20, 20);
+o1.lineTo(100, 20);
+o1.arcTo(150, 20, 150, 70, 1.7976931348623157e+308);
+o1.lineTo(150, 120);
+o1.stroke();
+
+o1.beginPath();
+o1.moveTo(20, 20);
+o1.lineTo(100, 20);
+o1.arcTo(150, 20, 150, 70, -1.7976931348623157e+308);
+o1.lineTo(150, 120);
+o1.stroke();
+
+</script>
new file mode 100644
--- /dev/null
+++ b/gfx/tests/crashtests/893572-4.html
@@ -0,0 +1,38 @@
+<script>
+o0 = document.createElement('canvas');
+(document.body || document.documentElement).appendChild(o0);
+o1 = o0.getContext('2d');
+
+o1.beginPath();
+o1.moveTo(8,34.323262543409996);
+o1.lineTo(1.7976931348623157e+308,34.323262543409996);
+o1.lineTo(1.7976931348623157e+308,44.323262543409996);
+o1.lineTo(10.0,44.323262543409996);
+o1.lineTo(8,34.323262543409996);
+o1.stroke();
+
+o1.beginPath();
+o1.moveTo(34.323262543409996, 8);
+o1.lineTo(34.323262543409996, 1.7976931348623157e+308);
+o1.lineTo(44.323262543409996, 1.7976931348623157e+308);
+o1.lineTo(44.323262543409996, 10.0);
+o1.lineTo(34.323262543409996, 8);
+o1.stroke();
+
+o1.beginPath();
+o1.moveTo(8,34.323262543409996);
+o1.lineTo(-1.7976931348623157e+308,34.323262543409996);
+o1.lineTo(-1.7976931348623157e+308,44.323262543409996);
+o1.lineTo(10.0,44.323262543409996);
+o1.lineTo(8,34.323262543409996);
+o1.stroke();
+
+o1.beginPath();
+o1.moveTo(34.323262543409996, 8);
+o1.lineTo(34.323262543409996, -1.7976931348623157e+308);
+o1.lineTo(44.323262543409996, -1.7976931348623157e+308);
+o1.lineTo(44.323262543409996, 10.0);
+o1.lineTo(34.323262543409996, 8);
+o1.stroke();
+
+</script>
--- a/gfx/tests/crashtests/crashtests.list
+++ b/gfx/tests/crashtests/crashtests.list
@@ -96,8 +96,12 @@ load 783041-1.html
 load 783041-2.html
 load 783041-3.html
 load 783041-4.html
 asserts-if(gtk2Widget,1) load 798853.html # bug 868792
 asserts-if(winWidget,0-1) skip-if(B2G) load 815489.html
 load 836225-1.html
 load 839745-1.html
 load 856784-1.html
+load 893572-1.html
+load 893572-2.html
+load 893572-3.html
+load 893572-4.html
--- a/gfx/thebes/gfxWindowsPlatform.cpp
+++ b/gfx/thebes/gfxWindowsPlatform.cpp
@@ -1480,16 +1480,36 @@ gfxWindowsPlatform::GetD3D11Device()
 }
 
 bool
 gfxWindowsPlatform::IsOptimus()
 {
   return GetModuleHandleA("nvumdshim.dll");
 }
 
+int
+gfxWindowsPlatform::GetScreenDepth() const
+{
+    // if the system doesn't have all displays with the same
+    // pixel format, just return 24 and move on with life.
+    if (!GetSystemMetrics(SM_SAMEDISPLAYFORMAT))
+        return 24;
+
+    HDC hdc = GetDC(nullptr);
+    if (!hdc)
+        return 24;
+
+    int depth = GetDeviceCaps(hdc, BITSPIXEL) *
+                GetDeviceCaps(hdc, PLANES);
+
+    ReleaseDC(nullptr, hdc);
+
+    return depth;
+}
+
 IDXGIAdapter1*
 gfxWindowsPlatform::GetDXGIAdapter()
 {
   if (mAdapter) {
     return mAdapter;
   }
 
   nsModuleHandle dxgiModule(LoadLibrarySystem32(L"dxgi.dll"));
--- a/gfx/thebes/gfxWindowsPlatform.h
+++ b/gfx/thebes/gfxWindowsPlatform.h
@@ -148,16 +148,18 @@ public:
 
         /* Use Direct2D rendering */
         RENDER_DIRECT2D,
 
         /* max */
         RENDER_MODE_MAX
     };
 
+    int GetScreenDepth() const;
+
     RenderMode GetRenderMode() { return mRenderMode; }
     void SetRenderMode(RenderMode rmode) { mRenderMode = rmode; }
 
     /**
      * Updates render mode with relation to the current preferences and
      * available devices.
      */
     void UpdateRenderMode();
--- a/js/src/builtin/TypedObject.cpp
+++ b/js/src/builtin/TypedObject.cpp
@@ -2331,17 +2331,17 @@ TypedDatum::obj_deleteProperty(JSContext
     return JSObject::deleteProperty(cx, proto, name, succeeded);
 }
 
 bool
 TypedDatum::obj_deleteElement(JSContext *cx, HandleObject obj, uint32_t index,
                                bool *succeeded)
 {
     RootedId id(cx);
-    if (!IndexToId(cx, index, id.address()))
+    if (!IndexToId(cx, index, &id))
         return false;
 
     if (IsOwnId(cx, obj, id))
         return ReportPropertyError(cx, JSMSG_CANT_DELETE, id);
 
     RootedObject proto(cx, obj->getProto());
     if (!proto) {
         *succeeded = false;
--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -4309,20 +4309,22 @@ if test -n "$ENABLE_INTL_API" -a -z "$MO
         if test -n "$MOZ_DEBUG"; then
             HOST_ICU_BUILD_OPTS="$HOST_ICU_BUILD_OPTS --enable-debug"
         fi
 
         abs_srcdir=`(cd $srcdir; pwd)`
         mkdir -p $_objdir/intl/icu/host
         (cd $_objdir/intl/icu/host
          MOZ_SUBCONFIGURE_WRAP([.],[
+         AR="$HOST_AR" RANLIB="$HOST_RANLIB" \
          CC="$HOST_CC" CXX="$HOST_CXX" LD="$HOST_LD" \
          CFLAGS="$HOST_ICU_CFLAGS $HOST_OPTIMIZE_FLAGS" \
          CPPFLAGS="$ICU_CPPFLAGS" \
          CXXFLAGS="$HOST_ICU_CXXFLAGS $HOST_OPTIMZIE_FLAGS" \
+         LDFLAGS="$HOST_LDFLAGS" \
                 $SHELL $abs_srcdir/../../intl/icu/source/runConfigureICU \
                 $HOST_ICU_BUILD_OPTS \
                 $ICU_TARGET \
         dnl Shell quoting is fun.
                 ${ICU_SRCDIR+"$ICU_SRCDIR"} \
                 --enable-static --disable-shared \
                 --enable-extras=no --enable-icuio=no --enable-layout=no \
                 --enable-tests=no --enable-samples=no || exit 1
@@ -4351,16 +4353,23 @@ if test -n "$ENABLE_INTL_API" -a -z "$MO
     # Force the ICU static libraries to be position independent code
     ICU_CFLAGS="$DSO_PIC_CFLAGS $CFLAGS"
     ICU_CXXFLAGS="$DSO_PIC_CFLAGS $CXXFLAGS"
 
     ICU_BUILD_OPTS=""
     if test -n "$MOZ_DEBUG" -o "MOZ_DEBUG_SYMBOLS"; then
         ICU_CFLAGS="$ICU_CFLAGS $MOZ_DEBUG_FLAGS"
         ICU_CXXFLAGS="$ICU_CXXFLAGS $MOZ_DEBUG_FLAGS"
+        if test -n "$CROSS_COMPILE" -a "$OS_TARGET" = "Darwin"; then
+		# Bug 951758: Cross-OSX builds have issues with -g because it
+		# tries to run dsymutil
+                ICU_CFLAGS=`echo $ICU_CFLAGS | sed 's|-g||g'`
+                ICU_CXXFLAGS=`echo $ICU_CXXFLAGS | sed 's|-g||g'`
+        fi
+
         ICU_LDFLAGS="$MOZ_DEBUG_LDFLAGS"
         if test -z "$MOZ_DEBUG"; then
             # To generate debug symbols, it requires MOZ_DEBUG_FLAGS.
             # But, not debug build.
             ICU_CFLAGS="$ICU_CFLAGS -UDEBUG -DNDEBUG"
             ICU_CXXFLAGS="$ICU_CXXFLAGS -UDEBUG -DNDEBUG"
         else
             ICU_BUILD_OPTS="$ICU_BUILD_OPTS --enable-debug"
--- a/js/src/jit-test/tests/baseline/bug857580.js
+++ b/js/src/jit-test/tests/baseline/bug857580.js
@@ -1,13 +1,9 @@
-
-if (getBuildConfiguration()['generational-gc'])
-    quit();
-
-gczeal(2);
+gczeal(2,10);
 var g = newGlobal();
 var dbg = new Debugger(g);
 dbg.onNewScript = function(script) {
     fscript = script.getChildScripts()[0];
 }
 g.eval("function f(x) { arguments[0] = 3; return x }");
 fscript.setBreakpoint(0, {hit:function(frame) {
     assertEq(frame.eval('x').return, 1);
deleted file mode 100644
--- a/js/src/jit-test/tests/basic/bug691299-regexp.js
+++ /dev/null
@@ -1,3 +0,0 @@
-// |jit-test| error: SyntaxError: invalid quantifier
-
-String.fromCharCode(256).replace(/[^a$]{4294967295}/,"aaaa");
--- a/js/src/jit-test/tests/basic/expression-autopsy.js
+++ b/js/src/jit-test/tests/basic/expression-autopsy.js
@@ -41,25 +41,39 @@ function check(expr, expected=expr) {
             // Let block
             Function("let (o, undef) { " + statement + " }"),
             // Let block with some other variables
             Function("var v1, v2; let (o, undef) { " + statement + " }"),
             // Shadowed let block
             Function("o", "undef", "let (o, undef) { " + statement + " }"),
             // Let in a switch
             Function("var x = 4; switch (x) { case 4: let o, undef;" + statement + "\ncase 6: break;}"),
-            // Let in for-in
-            Function("var undef, o; for (let z in [1, 2]) { " + statement + " }"),
             // The more lets the merrier
             Function("let (x=4, y=5) { x + y; }\nlet (a, b, c) { a + b - c; }\nlet (o, undef) {" + statement + " }"),
             // Let destructuring
             Function("o", "undef", "let ([] = 4) {} let (o, undef) { " + statement + " }"),
             // Try-catch blocks
             Function("o", "undef", "try { let q = 4; try { let p = 4; } catch (e) {} } catch (e) {} let (o, undef) { " + statement + " }")
         ];
+
+        try {
+            // Let in for-in
+            check_one(expected,
+                      Function("var undef, o; for (let z in [1, 2]) { " + statement + " }"),
+                      err);
+        } catch (ex) {
+            // Bug 831120.  See bug 942804 comment 5.
+            if (expected == 'undef' && err == ' is undefined')
+                check_one(expected + end,
+                          Function("var undef, o; for (let z in [1, 2]) { " + statement + " }"),
+                          err);
+            else
+                throw ex;
+        }
+
         for (var f of cases) {
             check_one(expected, f, err);
         }
     }
 }
 
 check("undef");
 check("o.b");
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -1763,16 +1763,19 @@ IonBuilder::inspectOpcode(JSOp op)
       case JSOP_SETRVAL:
         JS_ASSERT(!script()->noScriptRval());
         current->setSlot(info().returnValueSlot(), current->pop());
         return true;
 
       case JSOP_INSTANCEOF:
         return jsop_instanceof();
 
+      case JSOP_DEBUGLEAVEBLOCK:
+        return true;
+
       default:
 #ifdef DEBUG
         return abort("Unsupported opcode: %s (line %d)", js_CodeName[op], info().lineno(pc));
 #else
         return abort("Unsupported opcode: %d (line %d)", op, info().lineno(pc));
 #endif
     }
 }
--- a/js/src/jit/MoveResolver.cpp
+++ b/js/src/jit/MoveResolver.cpp
@@ -108,18 +108,18 @@ MoveResolver::resolve()
             PendingMove *blocking = findBlockingMove(stack.peekBack());
 
             if (blocking) {
                 if (blocking->to() == pm->from()) {
                     // We annotate cycles at each move in the cycle, and
                     // assert that we do not find two cycles in one move chain
                     // traversal (which would indicate two moves to the same
                     // destination).
-                    pm->setInCycle();
-                    blocking->setInCycle();
+                    pm->setCycleEnd();
+                    blocking->setCycleBegin(pm->type());
                     hasCycles_ = true;
                     pending_.remove(blocking);
                     stack.pushBack(blocking);
                 } else {
                     // This is a new link in the move chain, so keep
                     // searching for a cycle.
                     pending_.remove(blocking);
                     stack.pushBack(blocking);
--- a/js/src/jit/MoveResolver.h
+++ b/js/src/jit/MoveResolver.h
@@ -105,70 +105,92 @@ class MoveOperand
 };
 
 // This represents a move operation.
 class MoveOp
 {
   protected:
     MoveOperand from_;
     MoveOperand to_;
-    bool cycle_;
+    bool cycleBegin_;
+    bool cycleEnd_;
 
   public:
     enum Type {
         GENERAL,
         INT32,
         FLOAT32,
         DOUBLE
     };
 
   protected:
     Type type_;
 
+    // If cycleBegin_ is true, endCycleType_ is the type of the move at the end
+    // of the cycle. For example, given these moves:
+    //       INT32 move a -> b
+    //     GENERAL move b -> a
+    // the move resolver starts by copying b into a temporary location, so that
+    // the last move can read it. This copy needs to use use type GENERAL.
+    Type endCycleType_;
+
   public:
     MoveOp()
     { }
     MoveOp(const MoveOperand &from, const MoveOperand &to, Type type)
       : from_(from),
         to_(to),
-        cycle_(false),
+        cycleBegin_(false),
+        cycleEnd_(false),
         type_(type)
     { }
 
-    bool inCycle() const {
-        return cycle_;
+    bool isCycleBegin() const {
+        return cycleBegin_;
+    }
+    bool isCycleEnd() const {
+        return cycleEnd_;
     }
     const MoveOperand &from() const {
         return from_;
     }
     const MoveOperand &to() const {
         return to_;
     }
     Type type() const {
         return type_;
     }
+    Type endCycleType() const {
+        JS_ASSERT(isCycleBegin());
+        return endCycleType_;
+    }
 };
 
 class MoveResolver
 {
   private:
     struct PendingMove
       : public MoveOp,
         public TempObject,
         public InlineListNode<PendingMove>
     {
         PendingMove()
         { }
         PendingMove(const MoveOperand &from, const MoveOperand &to, Type type)
           : MoveOp(from, to, type)
         { }
 
-        void setInCycle() {
-            JS_ASSERT(!inCycle());
-            cycle_ = true;
+        void setCycleBegin(Type endCycleType) {
+            JS_ASSERT(!isCycleBegin() && !isCycleEnd());
+            cycleBegin_ = true;
+            endCycleType_ = endCycleType;
+        }
+        void setCycleEnd() {
+            JS_ASSERT(!isCycleBegin() && !isCycleEnd());
+            cycleEnd_ = true;
         }
     };
 
     typedef InlineList<MoveResolver::PendingMove>::iterator PendingMoveIterator;
 
   private:
     // Moves that are definitely unblocked (constants to registers). These are
     // emitted last.
--- a/js/src/jit/arm/MoveEmitter-arm.cpp
+++ b/js/src/jit/arm/MoveEmitter-arm.cpp
@@ -269,24 +269,26 @@ MoveEmitterARM::emitDoubleMove(const Mov
 }
 
 void
 MoveEmitterARM::emit(const MoveOp &move)
 {
     const MoveOperand &from = move.from();
     const MoveOperand &to = move.to();
 
-    if (move.inCycle()) {
-        if (inCycle_) {
-            completeCycle(from, to, move.type());
-            inCycle_ = false;
-            return;
-        }
+    if (move.isCycleEnd()) {
+        JS_ASSERT(inCycle_);
+        completeCycle(from, to, move.type());
+        inCycle_ = false;
+        return;
+    }
 
-        breakCycle(from, to, move.type());
+    if (move.isCycleBegin()) {
+        JS_ASSERT(!inCycle_);
+        breakCycle(from, to, move.endCycleType());
         inCycle_ = true;
     }
 
     switch (move.type()) {
       case MoveOp::FLOAT32:
         emitFloat32Move(from, to);
         break;
       case MoveOp::DOUBLE:
--- a/js/src/jit/shared/MoveEmitter-x86-shared.cpp
+++ b/js/src/jit/shared/MoveEmitter-x86-shared.cpp
@@ -33,19 +33,18 @@ MoveEmitterX86::characterizeCycle(const 
         // to optimize it.
         if (!move.to().isGeneralReg())
             *allGeneralRegs = false;
         if (!move.to().isFloatReg())
             *allFloatRegs = false;
         if (!*allGeneralRegs && !*allFloatRegs)
             return -1;
 
-        // The first and last move of the cycle are marked with inCycle(). Stop
-        // iterating when we see the last one.
-        if (j != i && move.inCycle())
+        // Stop iterating when we see the last one.
+        if (j != i && move.isCycleEnd())
             break;
 
         // Check that this move is actually part of the cycle. This is
         // over-conservative when there are multiple reads from the same source,
         // but that's expected to be rare.
         if (move.from() != moves.getMove(j + 1).to()) {
             *allGeneralRegs = false;
             *allFloatRegs = false;
@@ -98,37 +97,38 @@ MoveEmitterX86::maybeEmitOptimizedCycle(
 void
 MoveEmitterX86::emit(const MoveResolver &moves)
 {
     for (size_t i = 0; i < moves.numMoves(); i++) {
         const MoveOp &move = moves.getMove(i);
         const MoveOperand &from = move.from();
         const MoveOperand &to = move.to();
 
-        if (move.inCycle()) {
-            // If this is the end of a cycle for which we're using the stack,
-            // handle the end.
-            if (inCycle_) {
-                completeCycle(to, move.type());
-                inCycle_ = false;
-                continue;
-            }
+        if (move.isCycleEnd()) {
+            JS_ASSERT(inCycle_);
+            completeCycle(to, move.type());
+            inCycle_ = false;
+            continue;
+        }
+
+        if (move.isCycleBegin()) {
+            JS_ASSERT(!inCycle_);
 
             // Characterize the cycle.
             bool allGeneralRegs = true, allFloatRegs = true;
             size_t swapCount = characterizeCycle(moves, i, &allGeneralRegs, &allFloatRegs);
 
             // Attempt to optimize it to avoid using the stack.
             if (maybeEmitOptimizedCycle(moves, i, allGeneralRegs, allFloatRegs, swapCount)) {
                 i += swapCount;
                 continue;
             }
 
             // Otherwise use the stack.
-            breakCycle(to, move.type());
+            breakCycle(to, move.endCycleType());
             inCycle_ = true;
         }
 
         // A normal move which is not part of a cycle.
         switch (move.type()) {
           case MoveOp::FLOAT32:
             emitFloat32Move(from, to);
             break;
@@ -251,69 +251,78 @@ MoveEmitterX86::breakCycle(const MoveOpe
             masm.store32(to.reg(), cycleSlot());
         }
         break;
 #endif
 #ifndef JS_CPU_X64
       case MoveOp::INT32:
 #endif
       case MoveOp::GENERAL:
+        JS_ASSERT(pushedAtCycle_ == -1);
         masm.Push(toOperand(to));
+        pushedAtCycle_ = masm.framePushed();
         break;
       default:
         MOZ_ASSUME_UNREACHABLE("Unexpected move type");
     }
 }
 
 void
 MoveEmitterX86::completeCycle(const MoveOperand &to, MoveOp::Type type)
 {
+    JS_ASSERT(pushedAtCycle_ != -1);
+
     // There is some pattern:
     //   (A -> B)
     //   (B -> A)
     //
     // This case handles (B -> A), which we reach last. We emit a move from the
     // saved value of B, to A.
     switch (type) {
       case MoveOp::FLOAT32:
+        JS_ASSERT(pushedAtCycle_ - pushedAtStart_ >= sizeof(float));
         if (to.isMemory()) {
             masm.loadFloat32(cycleSlot(), ScratchFloatReg);
             masm.storeFloat32(ScratchFloatReg, toAddress(to));
         } else {
             masm.loadFloat32(cycleSlot(), to.floatReg());
         }
         break;
       case MoveOp::DOUBLE:
+        JS_ASSERT(pushedAtCycle_ - pushedAtStart_ >= sizeof(double));
         if (to.isMemory()) {
             masm.loadDouble(cycleSlot(), ScratchFloatReg);
             masm.storeDouble(ScratchFloatReg, toAddress(to));
         } else {
             masm.loadDouble(cycleSlot(), to.floatReg());
         }
         break;
 #ifdef JS_CPU_X64
       case MoveOp::INT32:
+        JS_ASSERT(pushedAtCycle_ - pushedAtStart_ >= sizeof(int32_t));
         // x64 can't pop to a 32-bit destination.
         if (to.isMemory()) {
             masm.load32(cycleSlot(), ScratchReg);
             masm.store32(ScratchReg, toAddress(to));
         } else {
             masm.load32(cycleSlot(), to.reg());
         }
         break;
 #endif
 #ifndef JS_CPU_X64
       case MoveOp::INT32:
 #endif
       case MoveOp::GENERAL:
+        JS_ASSERT(pushedAtCycle_ - pushedAtStart_ >= sizeof(intptr_t));
         if (to.isMemory()) {
             masm.Pop(toPopOperand(to));
         } else {
             masm.Pop(to.reg());
         }
+        pushedAtCycle_ = -1;
         break;
       default:
         MOZ_ASSUME_UNREACHABLE("Unexpected move type");
     }
 }
 
 void
 MoveEmitterX86::emitInt32Move(const MoveOperand &from, const MoveOperand &to)
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -2675,21 +2675,17 @@ JS_NewObjectForConstructor(JSContext *cx
 
     RootedObject obj(cx, JSVAL_TO_OBJECT(*vp));
     return CreateThis(cx, Valueify(clasp), obj);
 }
 
 JS_PUBLIC_API(bool)
 JS_IsExtensible(JSContext *cx, HandleObject obj, bool *extensible)
 {
-    bool isExtensible;
-    if (!JSObject::isExtensible(cx, obj, &isExtensible))
-        return false;
-    *extensible = isExtensible;
-    return true;
+    return JSObject::isExtensible(cx, obj, extensible);
 }
 
 JS_PUBLIC_API(bool)
 JS_IsNative(JSObject *obj)
 {
     return obj->isNative();
 }
 
@@ -2804,17 +2800,17 @@ JS_LookupPropertyById(JSContext *cx, JSO
 }
 
 JS_PUBLIC_API(bool)
 JS_LookupElement(JSContext *cx, JSObject *objArg, uint32_t index, MutableHandleValue vp)
 {
     RootedObject obj(cx, objArg);
     CHECK_REQUEST(cx);
     RootedId id(cx);
-    if (!IndexToId(cx, index, id.address()))
+    if (!IndexToId(cx, index, &id))
         return false;
     return JS_LookupPropertyById(cx, obj, id, vp);
 }
 
 JS_PUBLIC_API(bool)
 JS_LookupProperty(JSContext *cx, JSObject *objArg, const char *name, MutableHandleValue vp)
 {
     RootedObject obj(cx, objArg);
@@ -2879,17 +2875,17 @@ JS_HasPropertyById(JSContext *cx, JSObje
 
 JS_PUBLIC_API(bool)
 JS_HasElement(JSContext *cx, JSObject *objArg, uint32_t index, bool *foundp)
 {
     RootedObject obj(cx, objArg);
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
     RootedId id(cx);
-    if (!IndexToId(cx, index, id.address()))
+    if (!IndexToId(cx, index, &id))
         return false;
     return JS_HasPropertyById(cx, obj, id, foundp);
 }
 
 JS_PUBLIC_API(bool)
 JS_HasProperty(JSContext *cx, JSObject *objArg, const char *name, bool *foundp)
 {
     RootedObject obj(cx, objArg);
@@ -2935,17 +2931,17 @@ JS_AlreadyHasOwnPropertyById(JSContext *
 
 JS_PUBLIC_API(bool)
 JS_AlreadyHasOwnElement(JSContext *cx, JSObject *objArg, uint32_t index, bool *foundp)
 {
     RootedObject obj(cx, objArg);
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
     RootedId id(cx);
-    if (!IndexToId(cx, index, id.address()))
+    if (!IndexToId(cx, index, &id))
         return false;
     return JS_AlreadyHasOwnPropertyById(cx, obj, id, foundp);
 }
 
 JS_PUBLIC_API(bool)
 JS_AlreadyHasOwnProperty(JSContext *cx, JSObject *objArg, const char *name, bool *foundp)
 {
     RootedObject obj(cx, objArg);
@@ -3077,17 +3073,17 @@ JS_DefineElement(JSContext *cx, JSObject
                  JSPropertyOp getter, JSStrictPropertyOp setter, unsigned attrs)
 {
     RootedObject obj(cx, objArg);
     RootedValue value(cx, valueArg);
     AutoRooterGetterSetter gsRoot(cx, attrs, &getter, &setter);
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
     RootedId id(cx);
-    if (!IndexToId(cx, index, id.address()))
+    if (!IndexToId(cx, index, &id))
         return false;
     return DefinePropertyById(cx, obj, id, value, GetterWrapper(getter),
                               SetterWrapper(setter), attrs, 0, 0);
 }
 
 static bool
 DefineProperty(JSContext *cx, HandleObject obj, const char *name, const Value &value_,
                const JSPropertyOpWrapper &getter, const JSStrictPropertyOpWrapper &setter,
@@ -3509,88 +3505,62 @@ JS_PUBLIC_API(bool)
 JS_DeletePropertyById2(JSContext *cx, JSObject *objArg, jsid id, bool *result)
 {
     RootedObject obj(cx, objArg);
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, obj, id);
     JSAutoResolveFlags rf(cx, 0);
 
-    RootedValue value(cx);
-
-    bool succeeded;
     if (JSID_IS_SPECIAL(id)) {
         Rooted<SpecialId> sid(cx, JSID_TO_SPECIALID(id));
-        if (!JSObject::deleteSpecial(cx, obj, sid, &succeeded))
-            return false;
-    } else {
-        if (!JSObject::deleteByValue(cx, obj, IdToValue(id), &succeeded))
-            return false;
+        return JSObject::deleteSpecial(cx, obj, sid, result);
     }
-
-    *result = !!succeeded;
-    return true;
+    return JSObject::deleteByValue(cx, obj, IdToValue(id), result);
 }
 
 JS_PUBLIC_API(bool)
 JS_DeleteElement2(JSContext *cx, JSObject *objArg, uint32_t index, bool *result)
 {
     RootedObject obj(cx, objArg);
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, obj);
     JSAutoResolveFlags rf(cx, 0);
 
-    bool succeeded;
-    if (!JSObject::deleteElement(cx, obj, index, &succeeded))
-        return false;
-
-    *result = !!succeeded;
-    return true;
+    return JSObject::deleteElement(cx, obj, index, result);
 }
 
 JS_PUBLIC_API(bool)
 JS_DeleteProperty2(JSContext *cx, JSObject *objArg, const char *name, bool *result)
 {
     RootedObject obj(cx, objArg);
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, obj);
     JSAutoResolveFlags rf(cx, 0);
 
     JSAtom *atom = Atomize(cx, name, strlen(name));
     if (!atom)
         return false;
-
-    bool succeeded;
-    if (!JSObject::deleteByValue(cx, obj, StringValue(atom), &succeeded))
-        return false;
-
-    *result = !!succeeded;
-    return true;
+    return JSObject::deleteByValue(cx, obj, StringValue(atom), result);
 }
 
 JS_PUBLIC_API(bool)
 JS_DeleteUCProperty2(JSContext *cx, JSObject *objArg, const jschar *name, size_t namelen,
                      bool *result)
 {
     RootedObject obj(cx, objArg);
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, obj);
     JSAutoResolveFlags rf(cx, 0);
 
     JSAtom *atom = AtomizeChars(cx, name, AUTO_NAMELEN(name, namelen));
     if (!atom)
         return false;
-
-    bool succeeded;
-    if (!JSObject::deleteByValue(cx, obj, StringValue(atom), &succeeded))
-        return false;
-
-    *result = !!succeeded;
-    return true;
+    return JSObject::deleteByValue(cx, obj, StringValue(atom), result);
 }
 
 JS_PUBLIC_API(bool)
 JS_DeletePropertyById(JSContext *cx, JSObject *objArg, jsid idArg)
 {
     bool junk;
     return JS_DeletePropertyById2(cx, objArg, idArg, &junk);
 }
@@ -6074,17 +6044,17 @@ BOOL WINAPI DllMain (HINSTANCE hDLL, DWO
     return TRUE;
 }
 
 #endif
 
 JS_PUBLIC_API(bool)
 JS_IndexToId(JSContext *cx, uint32_t index, MutableHandleId id)
 {
-    return IndexToId(cx, index, id.address());
+    return IndexToId(cx, index, id);
 }
 
 JS_PUBLIC_API(bool)
 JS_CharsToId(JSContext* cx, JS::TwoByteChars chars, MutableHandleId idp)
 {
     RootedAtom atom(cx, AtomizeChars(cx, chars.start().get(), chars.length()));
     if (!atom)
         return false;
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -132,41 +132,40 @@ js::StringIsArrayIndex(JSLinearString *s
 
     return false;
 }
 
 static bool
 ToId(JSContext *cx, double index, MutableHandleId id)
 {
     if (index == uint32_t(index))
-        return IndexToId(cx, uint32_t(index), id.address());
+        return IndexToId(cx, uint32_t(index), id);
 
     Value tmp = DoubleValue(index);
     return ValueToId<CanGC>(cx, HandleValue::fromMarkedLocation(&tmp), id);
 }
 
 static bool
 ToId(JSContext *cx, uint32_t index, MutableHandleId id)
 {
-    return IndexToId(cx, index, id.address());
+    return IndexToId(cx, index, id);
 }
 
 /*
  * If the property at the given index exists, get its value into location
  * pointed by vp and set *hole to false. Otherwise set *hole to true and *vp
  * to JSVAL_VOID. This function assumes that the location pointed by vp is
  * properly rooted and can be used as GC-protected storage for temporaries.
  */
 template<typename IndexType>
 static inline bool
 DoGetElement(JSContext *cx, HandleObject obj, HandleObject receiver,
              IndexType index, bool *hole, MutableHandleValue vp)
 {
     RootedId id(cx);
-
     if (!ToId(cx, index, &id))
         return false;
 
     RootedObject obj2(cx);
     RootedShape prop(cx);
     if (!JSObject::lookupGeneric(cx, obj, id, &obj2, &prop))
         return false;
 
@@ -713,17 +712,17 @@ js::ArraySetLength(typename ExecutionMod
         }
     }
 
     if (setterIsStrict && !succeeded) {
         // We can't have arrived here under ParallelExecution, as we have
         // returned from the function before step 15 above.
         JSContext *cx = cxArg->asJSContext();
         RootedId elementId(cx);
-        if (!IndexToId(cx, newLen - 1, elementId.address()))
+        if (!IndexToId(cx, newLen - 1, &elementId))
             return false;
         return arr->reportNotConfigurable(cx, elementId);
     }
 
     return true;
 }
 
 template bool
--- a/js/src/jsatom.cpp
+++ b/js/src/jsatom.cpp
@@ -386,29 +386,29 @@ js::AtomizeChars(ExclusiveContext *cx, c
 
     if (!JSString::validateLength(cx, length))
         return nullptr;
 
     return AtomizeAndCopyChars(cx, chars, length, ib);
 }
 
 bool
-js::IndexToIdSlow(ExclusiveContext *cx, uint32_t index, jsid *idp)
+js::IndexToIdSlow(ExclusiveContext *cx, uint32_t index, MutableHandleId idp)
 {
     JS_ASSERT(index > JSID_INT_MAX);
 
     jschar buf[UINT32_CHAR_BUFFER_LENGTH];
     RangedPtr<jschar> end(ArrayEnd(buf), buf, ArrayEnd(buf));
     RangedPtr<jschar> start = BackfillIndexInCharBuffer(index, end);
 
     JSAtom *atom = AtomizeChars(cx, start.get(), end - start);
     if (!atom)
         return false;
 
-    *idp = JSID_FROM_BITS((size_t)atom);
+    idp.set(JSID_FROM_BITS((size_t)atom));
     return true;
 }
 
 template <AllowGC allowGC>
 static JSAtom *
 ToAtomSlow(ExclusiveContext *cx, typename MaybeRooted<Value, allowGC>::HandleType arg)
 {
     JS_ASSERT(!arg.isString());
--- a/js/src/jsatominlines.h
+++ b/js/src/jsatominlines.h
@@ -100,40 +100,29 @@ BackfillIndexInCharBuffer(uint32_t index
         *--end = '0' + digit;
         index = next;
     } while (index > 0);
 
     return end;
 }
 
 bool
-IndexToIdSlow(ExclusiveContext *cx, uint32_t index, jsid *idp);
+IndexToIdSlow(ExclusiveContext *cx, uint32_t index, MutableHandleId idp);
 
 inline bool
-IndexToId(ExclusiveContext *cx, uint32_t index, jsid *idp)
+IndexToId(ExclusiveContext *cx, uint32_t index, MutableHandleId idp)
 {
     if (index <= JSID_INT_MAX) {
-        *idp = INT_TO_JSID(index);
+        idp.set(INT_TO_JSID(index));
         return true;
     }
 
     return IndexToIdSlow(cx, index, idp);
 }
 
-inline bool
-IndexToIdPure(uint32_t index, jsid *idp)
-{
-    if (index <= JSID_INT_MAX) {
-        *idp = INT_TO_JSID(index);
-        return true;
-    }
-
-    return false;
-}
-
 static JS_ALWAYS_INLINE JSFlatString *
 IdToString(JSContext *cx, jsid id)
 {
     if (JSID_IS_STRING(id))
         return JSID_TO_ATOM(id);
 
     if (JS_LIKELY(JSID_IS_INT(id)))
         return Int32ToString<CanGC>(cx, JSID_TO_INT(id));
--- a/js/src/jshashutil.h
+++ b/js/src/jshashutil.h
@@ -21,43 +21,41 @@ struct DependentAddPtr
 {
     typedef typename T::AddPtr AddPtr;
     typedef typename T::Entry Entry;
 
     template <class Lookup>
     DependentAddPtr(const ExclusiveContext *cx, const T &table, const Lookup &lookup)
       : addPtr(table.lookupForAdd(lookup))
 #ifdef JSGC_GENERATIONAL
-      , cx(cx)
       , originalGcNumber(cx->zone()->gcNumber())
 #endif
         {}
 
     template <class KeyInput, class ValueInput>
-    bool add(T &table, const KeyInput &key, const ValueInput &value) {
+    bool add(const ExclusiveContext *cx, T &table, const KeyInput &key, const ValueInput &value) {
 #ifdef JSGC_GENERATIONAL
         bool gcHappened = originalGcNumber != cx->zone()->gcNumber();
         if (gcHappened)
-            return table.putNew(key, value);
+            addPtr = table.lookupForAdd(key);
 #endif
         return table.relookupOrAdd(addPtr, key, value);
     }
 
     typedef void (DependentAddPtr::* ConvertibleToBool)();
     void nonNull() {}
 
     bool found() const                 { return addPtr.found(); }
     operator ConvertibleToBool() const { return found() ? &DependentAddPtr::nonNull : 0; }
     const Entry &operator*() const     { return *addPtr; }
     const Entry *operator->() const    { return &*addPtr; }
 
   private:
     AddPtr addPtr ;
 #ifdef JSGC_GENERATIONAL
-    const ExclusiveContext *cx;
     const uint64_t originalGcNumber;
 #endif
 
     DependentAddPtr() MOZ_DELETE;
     DependentAddPtr(const DependentAddPtr&) MOZ_DELETE;
     DependentAddPtr& operator=(const DependentAddPtr&) MOZ_DELETE;
 };
 
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -2362,17 +2362,17 @@ TypeCompartment::setTypeToHomogenousArra
             return;
         }
         obj->setType(objType);
 
         if (!objType->unknownProperties())
             objType->addPropertyType(cx, JSID_VOID, elementType);
 
         key.proto = objProto;
-        if (!p.add(*arrayTypeTable, key, objType)) {
+        if (!p.add(cx, *arrayTypeTable, key, objType)) {
             cx->compartment()->types.setPendingNukeTypes(cx);
             return;
         }
     }
 }
 
 void
 TypeCompartment::fixArrayType(ExclusiveContext *cx, JSObject *obj)
--- a/js/src/jsiter.cpp
+++ b/js/src/jsiter.cpp
@@ -1119,17 +1119,17 @@ js_SuppressDeletedProperty(JSContext *cx
         return false;
     return SuppressDeletedPropertyHelper(cx, obj, SingleStringPredicate(str));
 }
 
 bool
 js_SuppressDeletedElement(JSContext *cx, HandleObject obj, uint32_t index)
 {
     RootedId id(cx);
-    if (!IndexToId(cx, index, id.address()))
+    if (!IndexToId(cx, index, &id))
         return false;
     return js_SuppressDeletedProperty(cx, obj, id);
 }
 
 namespace {
 
 class IndexRangePredicate {
     uint32_t begin, end;
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -1680,17 +1680,17 @@ JSObject::nonNativeSetProperty(JSContext
 }
 
 /* static */ bool
 JSObject::nonNativeSetElement(JSContext *cx, HandleObject obj,
                               uint32_t index, MutableHandleValue vp, bool strict)
 {
     if (JS_UNLIKELY(obj->watched())) {
         RootedId id(cx);
-        if (!IndexToId(cx, index, id.address()))
+        if (!IndexToId(cx, index, &id))
             return false;
 
         WatchpointMap *wpmap = cx->compartment()->watchpointMap;
         if (wpmap && !wpmap->triggerWatchpoint(cx, obj, id, vp))
             return false;
     }
     return obj->getOps()->setElement(cx, obj, index, vp, strict);
 }
@@ -3264,25 +3264,25 @@ JSObject::defineSpecial(ExclusiveContext
     RootedId id(cx, SPECIALID_TO_JSID(sid));
     return defineGeneric(cx, obj, id, value, getter, setter, attrs);
 }
 
 bool
 baseops::DefineElement(ExclusiveContext *cx, HandleObject obj, uint32_t index, HandleValue value,
                        PropertyOp getter, StrictPropertyOp setter, unsigned attrs)
 {
-    Rooted<jsid> id(cx);
+    RootedId id(cx);
     if (index <= JSID_INT_MAX) {
         id = INT_TO_JSID(index);
         return DefineNativeProperty(cx, obj, id, value, getter, setter, attrs, 0, 0);
     }
 
     AutoRooterGetterSetter gsRoot(cx, attrs, &getter, &setter);
 
-    if (!IndexToId(cx, index, id.address()))
+    if (!IndexToId(cx, index, &id))
         return false;
 
     return DefineNativeProperty(cx, obj, id, value, getter, setter, attrs, 0, 0);
 }
 
 /* static */ bool
 JSObject::defineElement(ExclusiveContext *cx, HandleObject obj,
                         uint32_t index, HandleValue value,
@@ -3862,17 +3862,17 @@ JSObject::lookupGeneric(JSContext *cx, H
     return baseops::LookupProperty<js::CanGC>(cx, obj, id, objp, propp);
 }
 
 bool
 baseops::LookupElement(JSContext *cx, HandleObject obj, uint32_t index,
                        MutableHandleObject objp, MutableHandleShape propp)
 {
     RootedId id(cx);
-    if (!IndexToId(cx, index, id.address()))
+    if (!IndexToId(cx, index, &id))
         return false;
 
     return LookupPropertyWithFlagsInline<CanGC>(cx, obj, id, cx->resolveFlags, objp, propp);
 }
 
 bool
 js::LookupPropertyWithFlags(ExclusiveContext *cx, HandleObject obj, HandleId id, unsigned flags,
                             MutableHandleObject objp, MutableHandleShape propp)
@@ -4401,21 +4401,19 @@ js::GetPropertyPure(ThreadSafeContext *c
 
     return NativeGetPureInline(obj2, shape, vp);
 }
 
 static bool
 JS_ALWAYS_INLINE
 GetElementPure(ThreadSafeContext *cx, JSObject *obj, uint32_t index, Value *vp)
 {
-    jsid id;
-    if (!IndexToIdPure(index, &id))
-        return false;
-
-    return GetPropertyPure(cx, obj, id, vp);
+    if (index <= JSID_INT_MAX)
+        return GetPropertyPure(cx, obj, INT_TO_JSID(index), vp);
+    return false;
 }
 
 /*
  * A pure version of GetObjectElementOperation that can be called from
  * parallel code without locking. This variant returns false whenever a
  * side-effect might have occurred.
  */
 bool
@@ -4437,17 +4435,17 @@ js::GetObjectElementOperationPure(Thread
     return GetPropertyPure(cx, obj, NameToId(name->asPropertyName()), vp);
 }
 
 bool
 baseops::GetElement(JSContext *cx, HandleObject obj, HandleObject receiver, uint32_t index,
                     MutableHandleValue vp)
 {
     RootedId id(cx);
-    if (!IndexToId(cx, index, id.address()))
+    if (!IndexToId(cx, index, &id))
         return false;
 
     /* This call site is hot -- use the always-inlined variant of js_GetPropertyHelper(). */
     return GetPropertyHelperInline<CanGC>(cx, obj, receiver, id, vp);
 }
 
 static bool
 MaybeReportUndeclaredVarAssignment(JSContext *cx, JSString *propname)
@@ -4818,17 +4816,17 @@ baseops::SetPropertyHelper<ParallelExecu
                                               HandleId id, unsigned defineHow,
                                               MutableHandleValue vp, bool strict);
 
 bool
 baseops::SetElementHelper(JSContext *cx, HandleObject obj, HandleObject receiver, uint32_t index,
                           unsigned defineHow, MutableHandleValue vp, bool strict)
 {
     RootedId id(cx);
-    if (!IndexToId(cx, index, id.address()))
+    if (!IndexToId(cx, index, &id))
         return false;
     return baseops::SetPropertyHelper<SequentialExecution>(cx, obj, receiver, id, defineHow, vp,
                                                            strict);
 }
 
 bool
 baseops::GetAttributes(JSContext *cx, HandleObject obj, HandleId id, unsigned *attrsp)
 {
@@ -4923,17 +4921,17 @@ baseops::DeleteProperty(JSContext *cx, H
     Rooted<jsid> id(cx, NameToId(name));
     return baseops::DeleteGeneric(cx, obj, id, succeeded);
 }
 
 bool
 baseops::DeleteElement(JSContext *cx, HandleObject obj, uint32_t index, bool *succeeded)
 {
     RootedId id(cx);
-    if (!IndexToId(cx, index, id.address()))
+    if (!IndexToId(cx, index, &id))
         return false;
     return baseops::DeleteGeneric(cx, obj, id, succeeded);
 }
 
 bool
 baseops::DeleteSpecial(JSContext *cx, HandleObject obj, HandleSpecialId sid, bool *succeeded)
 {
     Rooted<jsid> id(cx, SPECIALID_TO_JSID(sid));
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -48,17 +48,17 @@ JSObject::deleteProperty(JSContext *cx, 
     js::types::MarkTypePropertyConfigured(cx, obj, id);
     js::DeletePropertyOp op = obj->getOps()->deleteProperty;
     return (op ? op : js::baseops::DeleteProperty)(cx, obj, name, succeeded);
 }
 
 /* static */ inline bool
 JSObject::deleteElement(JSContext *cx, js::HandleObject obj, uint32_t index, bool *succeeded)
 {
-    jsid id;
+    JS::RootedId id(cx);
     if (!js::IndexToId(cx, index, &id))
         return false;
     js::types::MarkTypePropertyConfigured(cx, obj, id);
     js::DeleteElementOp op = obj->getOps()->deleteElement;
     return (op ? op : js::baseops::DeleteElement)(cx, obj, index, succeeded);
 }
 
 /* static */ inline bool
@@ -616,33 +616,32 @@ JSObject::nativeSetSlotWithType(js::Excl
 JSObject::getElement(JSContext *cx, js::HandleObject obj, js::HandleObject receiver,
                      uint32_t index, js::MutableHandleValue vp)
 {
     js::ElementIdOp op = obj->getOps()->getElement;
     if (op)
         return op(cx, obj, receiver, index, vp);
 
     JS::RootedId id(cx);
-    if (!js::IndexToId(cx, index, id.address()))
+    if (!js::IndexToId(cx, index, &id))
         return false;
     return getGeneric(cx, obj, receiver, id, vp);
 }
 
 /* static */ inline bool
 JSObject::getElementNoGC(JSContext *cx, JSObject *obj, JSObject *receiver,
                          uint32_t index, js::Value *vp)
 {
     js::ElementIdOp op = obj->getOps()->getElement;
     if (op)
         return false;
 
-    jsid id;
-    if (!js::IndexToId(cx, index, &id))
+    if (index > JSID_INT_MAX)
         return false;
-    return getGenericNoGC(cx, obj, receiver, id, vp);
+    return getGenericNoGC(cx, obj, receiver, INT_TO_JSID(index), vp);
 }
 
 inline js::GlobalObject &
 JSObject::global() const
 {
 #ifdef DEBUG
     JSObject *obj = const_cast<JSObject *>(this);
     while (JSObject *parent = obj->getParent())
--- a/js/src/json.cpp
+++ b/js/src/json.cpp
@@ -683,17 +683,17 @@ Walk(JSContext *cx, HandleObject holder,
             uint32_t length;
             if (!GetLengthProperty(cx, obj, &length))
                 return false;
 
             /* Step 2a(i), 2a(iii-iv). */
             RootedId id(cx);
             RootedValue newElement(cx);
             for (uint32_t i = 0; i < length; i++) {
-                if (!IndexToId(cx, i, id.address()))
+                if (!IndexToId(cx, i, &id))
                     return false;
 
                 /* Step 2a(iii)(1). */
                 if (!Walk(cx, obj, id, reviver, &newElement))
                     return false;
 
                 if (newElement.isUndefined()) {
                     /* Step 2a(iii)(2). */
--- a/js/src/jsproxy.cpp
+++ b/js/src/jsproxy.cpp
@@ -376,17 +376,17 @@ bool
 BaseProxyHandler::slice(JSContext *cx, HandleObject proxy, uint32_t begin, uint32_t end,
                         HandleObject result)
 {
     assertEnteredPolicy(cx, proxy, JSID_VOID);
 
     RootedId id(cx);
     RootedValue value(cx);
     for (uint32_t index = begin; index < end; index++) {
-        if (!IndexToId(cx, index, id.address()))
+        if (!IndexToId(cx, index, &id))
             return false;
 
         bool present;
         if (!Proxy::has(cx, proxy, id, &present))
             return false;
 
         if (present) {
             if (!Proxy::get(cx, proxy, proxy, id, &value))
@@ -2815,35 +2815,35 @@ proxy_LookupGeneric(JSContext *cx, Handl
     }
     return true;
 }
 
 static bool
 proxy_LookupProperty(JSContext *cx, HandleObject obj, HandlePropertyName name,
                      MutableHandleObject objp, MutableHandleShape propp)
 {
-    Rooted<jsid> id(cx, NameToId(name));
+    RootedId id(cx, NameToId(name));
     return proxy_LookupGeneric(cx, obj, id, objp, propp);
 }
 
 static bool
 proxy_LookupElement(JSContext *cx, HandleObject obj, uint32_t index,
                     MutableHandleObject objp, MutableHandleShape propp)
 {
     RootedId id(cx);
-    if (!IndexToId(cx, index, id.address()))
+    if (!IndexToId(cx, index, &id))
         return false;
     return proxy_LookupGeneric(cx, obj, id, objp, propp);
 }
 
 static bool
 proxy_LookupSpecial(JSContext *cx, HandleObject obj, HandleSpecialId sid,
                     MutableHandleObject objp, MutableHandleShape propp)
 {
-    Rooted<jsid> id(cx, SPECIALID_TO_JSID(sid));
+    RootedId id(cx, SPECIALID_TO_JSID(sid));
     return proxy_LookupGeneric(cx, obj, id, objp, propp);
 }
 
 static bool
 proxy_DefineGeneric(JSContext *cx, HandleObject obj, HandleId id, HandleValue value,
                     PropertyOp getter, StrictPropertyOp setter, unsigned attrs)
 {
     Rooted<PropertyDescriptor> desc(cx);
@@ -2864,17 +2864,17 @@ proxy_DefineProperty(JSContext *cx, Hand
     return proxy_DefineGeneric(cx, obj, id, value, getter, setter, attrs);
 }
 
 static bool
 proxy_DefineElement(JSContext *cx, HandleObject obj, uint32_t index, HandleValue value,
                     PropertyOp getter, StrictPropertyOp setter, unsigned attrs)
 {
     RootedId id(cx);
-    if (!IndexToId(cx, index, id.address()))
+    if (!IndexToId(cx, index, &id))
         return false;
     return proxy_DefineGeneric(cx, obj, id, value, getter, setter, attrs);
 }
 
 static bool
 proxy_DefineSpecial(JSContext *cx, HandleObject obj, HandleSpecialId sid, HandleValue value,
                     PropertyOp getter, StrictPropertyOp setter, unsigned attrs)
 {
@@ -2897,17 +2897,17 @@ proxy_GetProperty(JSContext *cx, HandleO
     return proxy_GetGeneric(cx, obj, receiver, id, vp);
 }
 
 static bool
 proxy_GetElement(JSContext *cx, HandleObject obj, HandleObject receiver, uint32_t index,
                  MutableHandleValue vp)
 {
     RootedId id(cx);
-    if (!IndexToId(cx, index, id.address()))
+    if (!IndexToId(cx, index, &id))
         return false;
     return proxy_GetGeneric(cx, obj, receiver, id, vp);
 }
 
 static bool
 proxy_GetSpecial(JSContext *cx, HandleObject obj, HandleObject receiver, HandleSpecialId sid,
                  MutableHandleValue vp)
 {
@@ -2930,17 +2930,17 @@ proxy_SetProperty(JSContext *cx, HandleO
     return proxy_SetGeneric(cx, obj, id, vp, strict);
 }
 
 static bool
 proxy_SetElement(JSContext *cx, HandleObject obj, uint32_t index,
                  MutableHandleValue vp, bool strict)
 {
     RootedId id(cx);
-    if (!IndexToId(cx, index, id.address()))
+    if (!IndexToId(cx, index, &id))
         return false;
     return proxy_SetGeneric(cx, obj, id, vp, strict);
 }
 
 static bool
 proxy_SetSpecial(JSContext *cx, HandleObject obj, HandleSpecialId sid,
                  MutableHandleValue vp, bool strict)
 {
@@ -2977,33 +2977,33 @@ proxy_DeleteGeneric(JSContext *cx, Handl
         return false;
     *succeeded = deleted;
     return js_SuppressDeletedProperty(cx, obj, id);
 }
 
 static bool
 proxy_DeleteProperty(JSContext *cx, HandleObject obj, HandlePropertyName name, bool *succeeded)
 {
-    Rooted<jsid> id(cx, NameToId(name));
+    RootedId id(cx, NameToId(name));
     return proxy_DeleteGeneric(cx, obj, id, succeeded);
 }
 
 static bool
 proxy_DeleteElement(JSContext *cx, HandleObject obj, uint32_t index, bool *succeeded)
 {
     RootedId id(cx);
-    if (!IndexToId(cx, index, id.address()))
+    if (!IndexToId(cx, index, &id))
         return false;
     return proxy_DeleteGeneric(cx, obj, id, succeeded);
 }
 
 static bool
 proxy_DeleteSpecial(JSContext *cx, HandleObject obj, HandleSpecialId sid, bool *succeeded)
 {
-    Rooted<jsid> id(cx, SPECIALID_TO_JSID(sid));
+    RootedId id(cx, SPECIALID_TO_JSID(sid));
     return proxy_DeleteGeneric(cx, obj, id, succeeded);
 }
 
 /* static */ void
 ProxyObject::trace(JSTracer *trc, JSObject *obj)
 {
     ProxyObject *proxy = &obj->as<ProxyObject>();
 
--- a/js/src/tests/js1_8_5/regress/regress-yarr-regexp.js
+++ b/js/src/tests/js1_8_5/regress/regress-yarr-regexp.js
@@ -5,8 +5,13 @@ reportCompare(["a", "a", ""].toSource(),
 reportCompare(["ab", "ab", ""].toSource(), gcgcz.exec("ab").toSource());
 reportCompare(["abc", "abc", ""].toSource(), gcgcz.exec("abc").toSource());
 
 reportCompare(["a", ""].toSource(), toSource(/((?:)*?)a/.exec("a")));
 reportCompare(["a", ""].toSource(), toSource(/((?:.)*?)a/.exec("a")));
 reportCompare(["a", ""].toSource(), toSource(/a((?:.)*)/.exec("a")));
 
 reportCompare(["B", "B"].toSource(), toSource(/([A-Z])/.exec("fooBar")));
+
+// These just mustn't crash. See bug 872971
+reportCompare(/x{2147483648}x/.test('1'), false);
+reportCompare(/x{2147483648,}x/.test('1'), false);
+reportCompare(/x{2147483647,2147483648}x/.test('1'), false);
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -678,17 +678,17 @@ Debugger::wrapEnvironment(JSContext *cx,
     } else {
         /* Create a new Debugger.Environment for env. */
         JSObject *proto = &object->getReservedSlot(JSSLOT_DEBUG_ENV_PROTO).toObject();
         envobj = NewObjectWithGivenProto(cx, &DebuggerEnv_class, proto, nullptr, TenuredObject);
         if (!envobj)
             return false;
         envobj->setPrivateGCThing(env);
         envobj->setReservedSlot(JSSLOT_DEBUGENV_OWNER, ObjectValue(*object));
-        if (!p.add(environments, env, envobj)) {
+        if (!p.add(cx, environments, env, envobj)) {
             js_ReportOutOfMemory(cx);
             return false;
         }
 
         CrossCompartmentKey key(CrossCompartmentKey::DebuggerEnvironment, object, env);
         if (!object->compartment()->putWrapper(key, ObjectValue(*envobj))) {
             environments.remove(env);
             js_ReportOutOfMemory(cx);
@@ -721,17 +721,17 @@ Debugger::wrapDebuggeeValue(JSContext *c
             JSObject *proto = &object->getReservedSlot(JSSLOT_DEBUG_OBJECT_PROTO).toObject();
             JSObject *dobj =
                 NewObjectWithGivenProto(cx, &DebuggerObject_class, proto, nullptr, TenuredObject);
             if (!dobj)
                 return false;
             dobj->setPrivateGCThing(obj);
             dobj->setReservedSlot(JSSLOT_DEBUGOBJECT_OWNER, ObjectValue(*object));
 
-            if (!p.add(objects, obj, dobj)) {
+            if (!p.add(cx, objects, obj, dobj)) {
                 js_ReportOutOfMemory(cx);
                 return false;
             }
 
             if (obj->compartment() != object->compartment()) {
                 CrossCompartmentKey key(CrossCompartmentKey::DebuggerObject, object, obj);
                 if (!object->compartment()->putWrapper(key, ObjectValue(*dobj))) {
                     objects.remove(obj);
@@ -2807,17 +2807,17 @@ Debugger::wrapScript(JSContext *cx, Hand
     assertSameCompartment(cx, object.get());
     JS_ASSERT(cx->compartment() != script->compartment());
     DependentAddPtr<ScriptWeakMap> p(cx, scripts, script);
     if (!p) {
         JSObject *scriptobj = newDebuggerScript(cx, script);
         if (!scriptobj)
             return nullptr;
 
-        if (!p.add(scripts, script, scriptobj)) {
+        if (!p.add(cx, scripts, script, scriptobj)) {
             js_ReportOutOfMemory(cx);
             return nullptr;
         }
 
         CrossCompartmentKey key(CrossCompartmentKey::DebuggerScript, object, script);
         if (!object->compartment()->putWrapper(key, ObjectValue(*scriptobj))) {
             scripts.remove(script);
             js_ReportOutOfMemory(cx);
@@ -3700,17 +3700,17 @@ Debugger::wrapSource(JSContext *cx, Hand
     assertSameCompartment(cx, object.get());
     JS_ASSERT(cx->compartment() != source->compartment());
     DependentAddPtr<SourceWeakMap> p(cx, sources, source);
     if (!p) {
         JSObject *sourceobj = newDebuggerSource(cx, source);
         if (!sourceobj)
             return nullptr;
 
-        if (!p.add(sources, source, sourceobj)) {
+        if (!p.add(cx, sources, source, sourceobj)) {
             js_ReportOutOfMemory(cx);
             return nullptr;
         }
 
         CrossCompartmentKey key(CrossCompartmentKey::DebuggerSource, object, source);
         if (!object->compartment()->putWrapper(key, ObjectValue(*sourceobj))) {
             sources.remove(source);
             js_ReportOutOfMemory(cx);
--- a/js/src/vm/Debugger.h
+++ b/js/src/vm/Debugger.h
@@ -71,32 +71,20 @@ class DebuggerWeakMap : private WeakMap<
     using Base::all;
     using Base::trace;
 
     bool init(uint32_t len = 16) {
         return Base::init(len) && zoneCounts.init();
     }
 
     template<typename KeyInput, typename ValueInput>
-    bool putNew(const KeyInput &k, const ValueInput &v) {
-        JS_ASSERT(v->compartment() == Base::compartment);
-        JS_ASSERT(!k->compartment()->options_.invisibleToDebugger());
-        if (!incZoneCount(k->zone()))
-            return false;
-        bool ok = Base::putNew(k, v);
-        if (!ok)
-            decZoneCount(k->zone());
-        return ok;
-    }
-
-    template<typename KeyInput, typename ValueInput>
     bool relookupOrAdd(AddPtr &p, const KeyInput &k, const ValueInput &v) {
         JS_ASSERT(v->compartment() == Base::compartment);
         JS_ASSERT(!k->compartment()->options_.invisibleToDebugger());
-        JS_ASSERT(!p.found());
+        JS_ASSERT(!Base::has(k));
         if (!incZoneCount(k->zone()))
             return false;
         bool ok = Base::relookupOrAdd(p, k, v);
         if (!ok)
             decZoneCount(k->zone());
         return ok;
     }
 
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -391,60 +391,60 @@ with_LookupProperty(JSContext *cx, Handl
     return with_LookupGeneric(cx, obj, id, objp, propp);
 }
 
 static bool
 with_LookupElement(JSContext *cx, HandleObject obj, uint32_t index,
                    MutableHandleObject objp, MutableHandleShape propp)
 {
     RootedId id(cx);
-    if (!IndexToId(cx, index, id.address()))
+    if (!IndexToId(cx, index, &id))
         return false;
     return with_LookupGeneric(cx, obj, id, objp, propp);
 }
 
 static bool
 with_LookupSpecial(JSContext *cx, HandleObject obj, HandleSpecialId sid,
                    MutableHandleObject objp, MutableHandleShape propp)
 {
-    Rooted<jsid> id(cx, SPECIALID_TO_JSID(sid));
+    RootedId id(cx, SPECIALID_TO_JSID(sid));
     return with_LookupGeneric(cx, obj, id, objp, propp);
 }
 
 static bool
 with_GetGeneric(JSContext *cx, HandleObject obj, HandleObject receiver, HandleId id,
                 MutableHandleValue vp)
 {
     RootedObject actual(cx, &obj->as<WithObject>().object());
     return JSObject::getGeneric(cx, actual, actual, id, vp);
 }
 
 static bool
 with_GetProperty(JSContext *cx, HandleObject obj, HandleObject receiver, HandlePropertyName name,
                  MutableHandleValue vp)
 {
-    Rooted<jsid> id(cx, NameToId(name));
+    RootedId id(cx, NameToId(name));
     return with_GetGeneric(cx, obj, receiver, id, vp);
 }
 
 static bool
 with_GetElement(JSContext *cx, HandleObject obj, HandleObject receiver, uint32_t index,
                 MutableHandleValue vp)
 {
     RootedId id(cx);
-    if (!IndexToId(cx, index, id.address()))
+    if (!IndexToId(cx, index, &id))
         return false;
     return with_GetGeneric(cx, obj, receiver, id, vp);
 }
 
 static bool
 with_GetSpecial(JSContext *cx, HandleObject obj, HandleObject receiver, HandleSpecialId sid,
                 MutableHandleValue vp)
 {
-    Rooted<jsid> id(cx, SPECIALID_TO_JSID(sid));
+    RootedId id(cx, SPECIALID_TO_JSID(sid));
     return with_GetGeneric(cx, obj, receiver, id, vp);
 }
 
 static bool
 with_SetGeneric(JSContext *cx, HandleObject obj, HandleId id,
                 MutableHandleValue vp, bool strict)
 {
     RootedObject actual(cx, &obj->as<WithObject>().object());
--- a/js/src/vm/SelfHosting.cpp
+++ b/js/src/vm/SelfHosting.cpp
@@ -903,17 +903,17 @@ CloneObject(JSContext *cx, HandleObject 
     } else {
         JS_ASSERT(srcObj->isNative());
         clone = NewObjectWithGivenProto(cx, srcObj->getClass(), nullptr, cx->global(),
                                         GetObjectAllocKindForClone(cx->runtime(), srcObj),
                                         SingletonObject);
     }
     if (!clone)
         return nullptr;
-    if (!p.add(clonedObjects, srcObj, clone))
+    if (!p.add(cx, clonedObjects, srcObj, clone))
         return nullptr;
     if (!CloneProperties(cx, srcObj, clone, clonedObjects)) {
         clonedObjects.remove(srcObj);
         return nullptr;
     }
     return clone;
 }
 
--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@@ -1478,17 +1478,17 @@ BaseShape::getUnowned(ExclusiveContext *
     BaseShape *nbase_ = js_NewGCBaseShape<CanGC>(cx);
     if (!nbase_)
         return nullptr;
 
     new (nbase_) BaseShape(base);
 
     UnownedBaseShape *nbase = static_cast<UnownedBaseShape *>(nbase_);
 
-    if (!p.add(table, &base, nbase))
+    if (!p.add(cx, table, &base, nbase))
         return nullptr;
 
     return nbase;
 }
 
 /* static */ UnownedBaseShape *
 BaseShape::lookupUnowned(ThreadSafeContext *cx, const StackBaseShape &base)
 {
@@ -1614,17 +1614,17 @@ EmptyShape::getInitialShape(ExclusiveCon
         return nullptr;
 
     Shape *shape = cx->compartment()->propertyTree.newShape(cx);
     if (!shape)
         return nullptr;
     new (shape) EmptyShape(nbase, nfixed);
 
     Lookup lookup(clasp, protoRoot, parentRoot, metadataRoot, nfixed, objectFlags);
-    if (!p.add(table, lookup, InitialShapeEntry(shape, protoRoot)))
+    if (!p.add(cx, table, lookup, InitialShapeEntry(shape, protoRoot)))
         return nullptr;
 
     return shape;
 }
 
 /* static */ Shape *
 EmptyShape::getInitialShape(ExclusiveContext *cx, const Class *clasp, TaggedProto proto,
                             JSObject *parent, JSObject *metadata,
--- a/js/src/yarr/YarrParser.h
+++ b/js/src/yarr/YarrParser.h
@@ -607,22 +607,33 @@ private:
             case '{': {
                 ParseState state = saveState();
 
                 consume();
                 if (peekIsDigit()) {
                     unsigned min;
                     if (!consumeNumber(min))
                         break;
+                    // Clamping to INT_MAX is technically a spec deviation. In practice, it's
+                    // undetectable, because we can't even allocate strings large enough for
+                    // quantifiers this large to ever create different results than smaller ones.
+                    if (min > INT_MAX)
+                        min = INT_MAX;
 
                     unsigned max = min;
                     if (tryConsume(',')) {
                         if (peekIsDigit()) {
                             if (!consumeNumber(max))
                                 break;
+                            // Clamping to INT_MAX is technically a spec deviation. In practice,
+                            // it's undetectable, because we can't even allocate strings large
+                            // enough for quantifiers this large to ever create different results
+                            // than smaller ones.
+                            if (max > INT_MAX)
+                                max = INT_MAX;
                         } else {
                             max = quantifyInfinite;
                         }
                     }
 
                     if (tryConsume('}')) {
                         if (min <= max)
                             parseQuantifier(lastTokenWasAnAtom, min, max);
--- a/layout/base/nsDocumentViewer.cpp
+++ b/layout/base/nsDocumentViewer.cpp
@@ -116,22 +116,17 @@ static const char sPrintOptionsContractI
 //paint forcing
 #include <stdio.h>
 
 #include "mozilla/dom/Element.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
 
-#ifdef DEBUG
-
-#undef NOISY_VIEWER
-#else
-#undef NOISY_VIEWER
-#endif
+#define BEFOREUNLOAD_DISABLED_PREFNAME "dom.disable_beforeunload"
 
 //-----------------------------------------------------
 // PR LOGGING
 #ifdef MOZ_LOGGING
 #define FORCE_PR_LOG /* Allow logging in the release build */
 #endif
 
 #include "prlog.h"
@@ -554,20 +549,16 @@ nsDocumentViewer::~nsDocumentViewer()
  * must cache this document for later use when Init(...) is called.
  *
  * This method is also called when an out of band document.write() happens.
  * In that case, the document passed in is the same as the previous document.
  */
 NS_IMETHODIMP
 nsDocumentViewer::LoadStart(nsISupports *aDoc)
 {
-#ifdef NOISY_VIEWER
-  printf("nsDocumentViewer::LoadStart\n");
-#endif
-
   nsresult rv = NS_OK;
   if (!mDocument) {
     mDocument = do_QueryInterface(aDoc, &rv);
   }
   else if (mDocument == aDoc) {
     // Reset the document viewer's state back to what it was
     // when the document load started.
     PrepareToStartLoad();
@@ -1069,16 +1060,30 @@ nsDocumentViewer::PermitUnload(bool aCal
 
   if (!mDocument
    || mInPermitUnload
    || mCallerIsClosingWindow
    || mInPermitUnloadPrompt) {
     return NS_OK;
   }
 
+  static bool sIsBeforeUnloadDisabled;
+  static bool sBeforeUnloadPrefCached = false;
+
+  if (!sBeforeUnloadPrefCached ) {
+    sBeforeUnloadPrefCached = true;
+    Preferences::AddBoolVarCache(&sIsBeforeUnloadDisabled,
+                                 BEFOREUNLOAD_DISABLED_PREFNAME);
+  }
+
+  // If the user has turned off onbeforeunload warnings, no need to check.
+  if (sIsBeforeUnloadDisabled) {
+    return NS_OK;
+  }
+
   // First, get the script global object from the document...
   nsPIDOMWindow *window = mDocument->GetWindow();
 
   if (!window) {
     // This is odd, but not fatal
     NS_WARNING("window not set for document!");
     return NS_OK;
   }
--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@@ -5113,43 +5113,50 @@ nsLayoutUtils::AssertTreeOnlyEmptyNextIn
     nsFrameList::Enumerator childFrames(lists.CurrentList());
     for (; !childFrames.AtEnd(); childFrames.Next()) {
       nsLayoutUtils::AssertTreeOnlyEmptyNextInFlows(childFrames.get());
     }
   }
 }
 #endif
 
+static void
+GetFontFacesForFramesInner(nsIFrame* aFrame, nsFontFaceList* aFontFaceList)
+{
+  NS_PRECONDITION(aFrame, "NULL frame pointer");
+
+  if (aFrame->GetType() == nsGkAtoms::textFrame) {
+    if (!aFrame->GetPrevContinuation()) {
+      nsLayoutUtils::GetFontFacesForText(aFrame, 0, INT32_MAX, true,
+                                         aFontFaceList);
+    }
+    return;
+  }
+
+  nsIFrame::ChildListID childLists[] = { nsIFrame::kPrincipalList,
+                                         nsIFrame::kPopupList };
+  for (size_t i = 0; i < ArrayLength(childLists); ++i) {
+    nsFrameList children(aFrame->GetChildList(childLists[i]));
+    for (nsFrameList::Enumerator e(children); !e.AtEnd(); e.Next()) {
+      nsIFrame* child = e.get();
+      child = nsPlaceholderFrame::GetRealFrameFor(child);
+      GetFontFacesForFramesInner(child, aFontFaceList);
+    }
+  }
+}
+
 /* static */
 nsresult
 nsLayoutUtils::GetFontFacesForFrames(nsIFrame* aFrame,
                                      nsFontFaceList* aFontFaceList)
 {
   NS_PRECONDITION(aFrame, "NULL frame pointer");
 
-  if (aFrame->GetType() == nsGkAtoms::textFrame) {
-    return GetFontFacesForText(aFrame, 0, INT32_MAX, false,
-                               aFontFaceList);
-  }
-
   while (aFrame) {
-    nsIFrame::ChildListID childLists[] = { nsIFrame::kPrincipalList,
-                                           nsIFrame::kPopupList };
-    for (size_t i = 0; i < ArrayLength(childLists); ++i) {
-      nsFrameList children(aFrame->GetChildList(childLists[i]));
-      for (nsFrameList::Enumerator e(children); !e.AtEnd(); e.Next()) {
-        nsIFrame* child = e.get();
-        if (child->GetPrevContinuation()) {
-          continue;
-        }
-        child = nsPlaceholderFrame::GetRealFrameFor(child);
-        nsresult rv = GetFontFacesForFrames(child, aFontFaceList);
-        NS_ENSURE_SUCCESS(rv, rv);
-      }
-    }
+    GetFontFacesForFramesInner(aFrame, aFontFaceList);
     aFrame = GetNextContinuationOrSpecialSibling(aFrame);
   }
 
   return NS_OK;
 }
 
 /* static */
 nsresult
@@ -5164,32 +5171,41 @@ nsLayoutUtils::GetFontFacesForText(nsIFr
     return NS_OK;
   }
 
   nsTextFrame* curr = static_cast<nsTextFrame*>(aFrame);
   do {
     int32_t fstart = std::max(curr->GetContentOffset(), aStartOffset);
     int32_t fend = std::min(curr->GetContentEnd(), aEndOffset);
     if (fstart >= fend) {
+      curr = static_cast<nsTextFrame*>(curr->GetNextContinuation());
       continue;
     }
 
-    // overlapping with the offset we want
+    // curr is overlapping with the offset we want
     gfxSkipCharsIterator iter = curr->EnsureTextRun(nsTextFrame::eInflated);
     gfxTextRun* textRun = curr->GetTextRun(nsTextFrame::eInflated);
     NS_ENSURE_TRUE(textRun, NS_ERROR_OUT_OF_MEMORY);
 
+    // include continuations in the range that share the same textrun
+    nsTextFrame* next = nullptr;
+    if (aFollowContinuations && fend < aEndOffset) {
+      next = static_cast<nsTextFrame*>(curr->GetNextContinuation());
+      while (next && next->GetTextRun(nsTextFrame::eInflated) == textRun) {
+        fend = std::min(next->GetContentEnd(), aEndOffset);
+        next = fend < aEndOffset ?
+          static_cast<nsTextFrame*>(next->GetNextContinuation()) : nullptr;
+      }
+    }
+
     uint32_t skipStart = iter.ConvertOriginalToSkipped(fstart);
     uint32_t skipEnd = iter.ConvertOriginalToSkipped(fend);
-    aFontFaceList->AddFontsFromTextRun(textRun,
-                                       skipStart,
-                                       skipEnd - skipStart,
-                                       curr);
-  } while (aFollowContinuations &&
-           (curr = static_cast<nsTextFrame*>(curr->GetNextContinuation())));
+    aFontFaceList->AddFontsFromTextRun(textRun, skipStart, skipEnd - skipStart);
+    curr = next;
+  } while (aFollowContinuations && curr);
 
   return NS_OK;
 }
 
 /* static */
 size_t
 nsLayoutUtils::SizeOfTextRunsForFrames(nsIFrame* aFrame,
                                        MallocSizeOf aMallocSizeOf,
--- a/layout/generic/nsFlexContainerFrame.cpp
+++ b/layout/generic/nsFlexContainerFrame.cpp
@@ -925,29 +925,29 @@ nsFlexContainerFrame::
   // will always turn on mHResize on when it sees that the computed width
   // is different from current width, and that's all we need.)
   if (!aFlexItem.IsFrozen()) {  // Are we flexible?
     childRSForMeasuringHeight.mFlags.mVResize = true;
   }
 
   nsHTMLReflowMetrics childDesiredSize;
   nsReflowStatus childReflowStatus;
+  const uint32_t flags = NS_FRAME_NO_MOVE_FRAME;
   nsresult rv = ReflowChild(aFlexItem.Frame(), aPresContext,
                             childDesiredSize, childRSForMeasuringHeight,
-                            0, 0, NS_FRAME_NO_MOVE_FRAME,
-                            childReflowStatus);
+                            0, 0, flags, childReflowStatus);
   NS_ENSURE_SUCCESS(rv, rv);
 
   MOZ_ASSERT(NS_FRAME_IS_COMPLETE(childReflowStatus),
              "We gave flex item unconstrained available height, so it "
              "should be complete");
 
   rv = FinishReflowChild(aFlexItem.Frame(), aPresContext,
                          &childRSForMeasuringHeight, childDesiredSize,
-                         0, 0, 0);
+                         0, 0, flags);
   NS_ENSURE_SUCCESS(rv, rv);
 
   // Subtract border/padding in vertical axis, to get _just_
   // the effective computed value of the "height" property.
   nscoord childDesiredHeight = childDesiredSize.height -
     childRSForMeasuringHeight.mComputedBorderPadding.TopBottom();
   childDesiredHeight = std::max(0, childDesiredHeight);
 
@@ -2481,34 +2481,34 @@ nsFlexContainerFrame::SizeItemInCrossAxi
     // stretched computed height on it during its previous reflow. We're
     // not imposing that height for *this* measuring reflow, so we need to
     // tell it to treat this reflow as a vertical resize (regardless of
     // whether any of its ancestors are being resized).
     aChildReflowState.mFlags.mVResize = true;
   }
   nsHTMLReflowMetrics childDesiredSize;
   nsReflowStatus childReflowStatus;
+  const uint32_t flags = NS_FRAME_NO_MOVE_FRAME;
   nsresult rv = ReflowChild(aItem.Frame(), aPresContext,
                             childDesiredSize, aChildReflowState,
-                            0, 0, NS_FRAME_NO_MOVE_FRAME,
-                            childReflowStatus);
+                            0, 0, flags, childReflowStatus);
   aItem.SetHadMeasuringReflow();
   NS_ENSURE_SUCCESS(rv, rv);
 
   // XXXdholbert Once we do pagination / splitting, we'll need to actually
   // handle incomplete childReflowStatuses. But for now, we give our kids
   // unconstrained available height, which means they should always complete.
   MOZ_ASSERT(NS_FRAME_IS_COMPLETE(childReflowStatus),
              "We gave flex item unconstrained available height, so it "
              "should be complete");
 
   // Tell the child we're done with its initial reflow.
   // (Necessary for e.g. GetBaseline() to work below w/out asserting)
   rv = FinishReflowChild(aItem.Frame(), aPresContext,
-                         &aChildReflowState, childDesiredSize, 0, 0, 0);
+                         &aChildReflowState, childDesiredSize, 0, 0, flags);
   NS_ENSURE_SUCCESS(rv, rv);
 
   // Save the sizing info that we learned from this reflow
   // -----------------------------------------------------
 
   // Tentatively store the child's desired content-box cross-size.
   // Note that childDesiredSize is the border-box size, so we have to
   // subtract border & padding to get the content-box size.
--- a/layout/inspector/nsFontFaceList.cpp
+++ b/layout/inspector/nsFontFaceList.cpp
@@ -66,18 +66,17 @@ nsFontFaceList::GetLength(uint32_t *aLen
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////
 // nsFontFaceList
 
 nsresult
 nsFontFaceList::AddFontsFromTextRun(gfxTextRun* aTextRun,
-                                    uint32_t aOffset, uint32_t aLength,
-                                    nsIFrame* aFrame)
+                                    uint32_t aOffset, uint32_t aLength)
 {
   gfxTextRun::GlyphRunIterator iter(aTextRun, aOffset, aLength);
   while (iter.NextRun()) {
     gfxFontEntry *fe = iter.GetGlyphRun()->mFont->GetFontEntry();
     // if we have already listed this face, just make sure the match type is
     // recorded
     nsFontFace* existingFace =
       static_cast<nsFontFace*>(mFontFaces.GetWeak(fe));
--- a/layout/inspector/nsFontFaceList.h
+++ b/layout/inspector/nsFontFaceList.h
@@ -8,28 +8,26 @@
 #include "nsIDOMFontFaceList.h"
 #include "nsIDOMFontFace.h"
 #include "nsCOMPtr.h"
 #include "nsInterfaceHashtable.h"
 #include "nsHashKeys.h"
 
 class gfxFontEntry;
 class gfxTextRun;
-class nsIFrame;
 
 class nsFontFaceList : public nsIDOMFontFaceList
 {
 public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSIDOMFONTFACELIST
 
   nsFontFaceList();
   virtual ~nsFontFaceList();
 
   nsresult AddFontsFromTextRun(gfxTextRun* aTextRun,
-                               uint32_t aOffset, uint32_t aLength,
-                               nsIFrame* aFrame);
+                               uint32_t aOffset, uint32_t aLength);
 
 protected:
   nsInterfaceHashtable<nsPtrHashKey<gfxFontEntry>,nsIDOMFontFace> mFontFaces;
 };
 
 #endif // __nsFontFaceList_h__
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-stretch-vert-1.html
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-stretch-vert-1.html
@@ -2,17 +2,17 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <html>
 <head>
   <title>CSS Test: Testing the sizing of a stretched horizontal flex container in a vertical flex container</title>
   <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
-  <link rel="help" href="http://dev.w3.org/csswg/css-flexbox/#layout-algorithm">
+  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#layout-algorithm">
   <link rel="match" href="flexbox-align-self-stretch-vert-1-ref.html">
   <meta name="assert" content="If a stretched flex item's main size is influenced by its cross size, and the flex container has a definite cross size, then the item's cross size should be resolved early so that it can be used when determining the item's main size">
   <meta name="assert" content="http://dev.w3.org/csswg/css-flexbox/issues-cr-2012#issue-23">
   <meta charset="utf-8">
   <style>
     div.fixedWidthWrapper {
       width: 200px;
       /* Small enough that 3 characters can _easily_ fit in our width */
new file mode 100644
--- /dev/null
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-baseline-multi-line-horiz-3-ref.html
@@ -0,0 +1,86 @@
+<!DOCTYPE html>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+<head>
+  <title>CSS Reftest Reference</title>
+  <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
+  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#flex-baselines">
+  <meta charset="utf-8">
+  <style>
+    /* We use an outer vertical flex container, wrapping two single-line
+       flex containers, to match the testcase's multi-line flex container. */
+    .outerFlexContainer {
+      height: 100px;
+      background: lightgray;
+      display: inline-flex;
+      flex-direction: column;
+      justify-content: center; /* to mimic testcase's "align-content:center" */
+    }
+    .flexContainer {
+      display: flex;
+      width: 40px;
+    }
+    .flexContainer > * {
+      width: 18px;
+    }
+
+    .smallFont {
+      font-size: 8px;
+      line-height: 8px;
+    }
+    .medFont {
+      font-size: 12px;
+      line-height: 12px;
+    }
+    .bigFont {
+      font-size: 16px;
+      line-height: 16px;
+    }
+  </style>
+</head>
+<body>
+  a
+  <!-- Flex container with second item in first line baseline-aligned
+       (should set the container's baseline) -->
+  <div class="outerFlexContainer">
+    <div class="flexContainer">
+      <div class="medFont">b</div>
+      <div class="bigFont" style="align-self: baseline">c</div>
+    </div>
+    <div class="flexContainer">
+      <div class="medFont">d</div>
+      <div class="smallFont">e</div>
+    </div>
+  </div>
+
+  <!-- Flex container with both items in first line baseline-aligned
+       (should set the container's baseline) -->
+  <div class="outerFlexContainer">
+    <div class="flexContainer">
+      <div class="smallFont" style="align-self: baseline">f</div>
+      <div class="medFont" style="align-self: baseline">g</div>
+    </div>
+    <div class="flexContainer">
+      <div class="bigFont">h</div>
+      <div class="smallFont">i</div>
+    </div>
+  </div>
+
+  <!-- Flex container with all items baseline-aligned
+       (only those on first line should set the container's baseline) -->
+  <div class="outerFlexContainer">
+    <div class="flexContainer" style="align-items: baseline">
+      <div class="bigFont">j</div>
+      <div class="smallFont" style="padding-bottom: 20px">k</div>
+    </div>
+    <div class="flexContainer" style="align-items: baseline">
+      <div class="smallFont">l</div>
+      <div class="medFont">m</div>
+    </div>
+  </div>
+  n
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-baseline-multi-line-horiz-3.html
@@ -0,0 +1,73 @@
+<!DOCTYPE html>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+<head>
+  <title>CSS Test: Testing the baseline of a horizontal multi-line (wrap) flex container with baseline-aligned items on first line</title>
+  <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
+  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#flex-baselines">
+  <link rel="match" href="flexbox-baseline-multi-line-horiz-3-ref.html">
+  <meta charset="utf-8">
+  <style>
+    .flexContainer {
+      display: inline-flex;
+      flex-wrap: wrap;
+      width: 40px;
+      height: 100px;
+      background: lightgray;
+
+      /* Use "align-content", to test that packing space is considered when
+         getting container's baseline from its first FlexLine:*/
+      align-content: center;
+    }
+    .flexContainer > * {
+      width: 18px;
+    }
+
+    .smallFont {
+      font-size: 8px;
+      line-height: 8px;
+    }
+    .medFont {
+      font-size: 12px;
+      line-height: 12px;
+    }
+    .bigFont {
+      font-size: 16px;
+      line-height: 16px;
+    }
+  </style>
+</head>
+<body>
+  a
+  <!-- Flex container with second item in first line baseline-aligned
+       (should set the container's baseline) -->
+  <div class="flexContainer">
+    <div class="medFont">b</div>
+    <div class="bigFont" style="align-self: baseline">c</div>
+    <div class="medFont">d</div>
+    <div class="smallFont">e</div>
+  </div>
+
+  <!-- Flex container with both items in first line baseline-aligned
+       (should set the container's baseline) -->
+  <div class="flexContainer">
+    <div class="smallFont" style="align-self: baseline">f</div>
+    <div class="medFont" style="align-self: baseline">g</div>
+    <div class="bigFont">h</div>
+    <div class="smallFont">i</div>
+  </div>
+
+  <!-- Flex container with all items baseline-aligned, and with some padding
+       (only those on first line should set the container's baseline) -->
+  <div class="flexContainer" style="align-items: baseline">
+    <div class="bigFont">j</div>
+    <div class="smallFont" style="padding-bottom: 20px">k</div>
+    <div class="smallFont">l</div>
+    <div class="medFont">m</div>
+  </div>
+  n
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-baseline-multi-line-horiz-4-ref.html
@@ -0,0 +1,86 @@
+<!DOCTYPE html>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+<head>
+  <title>CSS Reftest Reference</title>
+  <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
+  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#flex-baselines">
+  <meta charset="utf-8">
+  <style>
+    /* We use an outer vertical flex container, wrapping two single-line
+       flex containers, to match the testcase's multi-line flex container. */
+    .outerFlexContainer {
+      height: 100px;
+      background: lightgray;
+      display: inline-flex;
+      flex-direction: column-reverse;
+      justify-content: center; /* to mimic testcase's "align-content:center" */
+    }
+    .flexContainer {
+      display: flex;
+      width: 40px;
+    }
+    .flexContainer > * {
+      width: 18px;
+    }
+
+    .smallFont {
+      font-size: 8px;
+      line-height: 8px;
+    }
+    .medFont {
+      font-size: 12px;
+      line-height: 12px;
+    }
+    .bigFont {
+      font-size: 16px;
+      line-height: 16px;
+    }
+  </style>
+</head>
+<body>
+  a
+  <!-- Flex container with second item in first line baseline-aligned
+       (should set the container's baseline) -->
+  <div class="outerFlexContainer">
+    <div class="flexContainer">
+      <div class="medFont">b</div>
+      <div class="bigFont" style="align-self: baseline">c</div>
+    </div>
+    <div class="flexContainer">
+      <div class="medFont">d</div>
+      <div class="smallFont">e</div>
+    </div>
+  </div>
+
+  <!-- Flex container with both items in first line baseline-aligned
+       (should set the container's baseline) -->
+  <div class="outerFlexContainer">
+    <div class="flexContainer">
+      <div class="smallFont" style="align-self: baseline">f</div>
+      <div class="medFont" style="align-self: baseline">g</div>
+    </div>
+    <div class="flexContainer">
+      <div class="bigFont">h</div>
+      <div class="smallFont">i</div>
+    </div>
+  </div>
+
+  <!-- Flex container with all items baseline-aligned
+       (only those on first line should set the container's baseline) -->
+  <div class="outerFlexContainer">
+    <div class="flexContainer" style="align-items: baseline">
+      <div class="bigFont">j</div>
+      <div class="smallFont" style="padding-bottom: 20px">k</div>
+    </div>
+    <div class="flexContainer" style="align-items: baseline">
+      <div class="smallFont">l</div>
+      <div class="medFont">m</div>
+    </div>
+  </div>
+  n
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-baseline-multi-line-horiz-4.html
@@ -0,0 +1,73 @@
+<!DOCTYPE html>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+<head>
+  <title>CSS Test: Testing the baseline of a horizontal multi-line (wrap-reverse) flex container with baseline-aligned items on first line</title>
+  <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
+  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#flex-baselines">
+  <link rel="match" href="flexbox-baseline-multi-line-horiz-4-ref.html">
+  <meta charset="utf-8">
+  <style>
+    .flexContainer {
+      display: inline-flex;
+      flex-wrap: wrap-reverse;
+      width: 40px;
+      height: 100px;
+      background: lightgray;
+
+      /* Use "align-content", to test that packing space is considered when
+         getting container's baseline from its first FlexLine:*/
+      align-content: center;
+    }
+    .flexContainer > * {
+      width: 18px;
+    }
+
+    .smallFont {
+      font-size: 8px;
+      line-height: 8px;
+    }
+    .medFont {
+      font-size: 12px;
+      line-height: 12px;
+    }
+    .bigFont {
+      font-size: 16px;
+      line-height: 16px;
+    }
+  </style>
+</head>
+<body>
+  a
+  <!-- Flex container with second item in first line baseline-aligned
+       (should set the container's baseline) -->
+  <div class="flexContainer">
+    <div class="medFont">b</div>
+    <div class="bigFont" style="align-self: baseline">c</div>
+    <div class="medFont">d</div>
+    <div class="smallFont">e</div>
+  </div>
+
+  <!-- Flex container with both items in first line baseline-aligned
+       (should set the container's baseline) -->
+  <div class="flexContainer">
+    <div class="smallFont" style="align-self: baseline">f</div>
+    <div class="medFont" style="align-self: baseline">g</div>
+    <div class="bigFont">h</div>
+    <div class="smallFont">i</div>
+  </div>
+
+  <!-- Flex container with all items baseline-aligned, and with some padding
+       (only those on first line should set the container's baseline) -->
+  <div class="flexContainer" style="align-items: baseline">
+    <div class="bigFont">j</div>
+    <div class="smallFont" style="padding-bottom: 20px">k</div>
+    <div class="smallFont">l</div>
+    <div class="medFont">m</div>
+  </div>
+  n
+</body>
+</html>
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-break-request-horiz-1a.html
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-break-request-horiz-1a.html
@@ -2,17 +2,17 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <html>
 <head>
   <title>CSS Test: Testing page-break-before in horizontal multi-line flex containers</title>
   <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
-  <link rel="help" href="http://dev.w3.org/csswg/css-flexbox/#algo-line-break">
+  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#algo-line-break">
   <link rel="match" href="flexbox-break-request-horiz-1-ref.html">
   <meta charset="utf-8">
   <style>
     div.flexbox {
       display: flex;
       flex-wrap: wrap;
       border: 1px dashed black;
       width: 60px;
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-break-request-horiz-1b.html
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-break-request-horiz-1b.html
@@ -2,17 +2,17 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <html>
 <head>
   <title>CSS Test: Testing page-break-after in horizontal multi-line flex containers</title>
   <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
-  <link rel="help" href="http://dev.w3.org/csswg/css-flexbox/#algo-line-break">
+  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#algo-line-break">
   <link rel="match" href="flexbox-break-request-horiz-1-ref.html">
   <meta charset="utf-8">
   <style>
     div.flexbox {
       display: flex;
       flex-wrap: wrap;
       border: 1px dashed black;
       width: 60px;
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-break-request-horiz-2a.html
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-break-request-horiz-2a.html
@@ -2,17 +2,17 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <html>
 <head>
   <title>CSS Test: Testing page-break-before in horizontal single-line flex containers (should have no effect)</title>
   <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
-  <link rel="help" href="http://dev.w3.org/csswg/css-flexbox/#algo-line-break">
+  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#algo-line-break">
   <link rel="match" href="flexbox-break-request-horiz-2-ref.html">
   <meta charset="utf-8">
   <style>
     div.flexbox {
       display: flex;
       border: 1px dashed black;
       width: 60px;
       height: 20px;
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-break-request-horiz-2b.html
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-break-request-horiz-2b.html
@@ -2,17 +2,17 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <html>
 <head>
   <title>CSS Test: Testing page-break-after in horizontal single-line flex containers (should have no effect)</title>
   <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
-  <link rel="help" href="http://dev.w3.org/csswg/css-flexbox/#algo-line-break">
+  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#algo-line-break">
   <link rel="match" href="flexbox-break-request-horiz-2-ref.html">
   <meta charset="utf-8">
   <style>
     div.flexbox {
       display: flex;
       border: 1px dashed black;
       width: 60px;
       height: 20px;
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-break-request-vert-1a.html
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-break-request-vert-1a.html
@@ -2,17 +2,17 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <html>
 <head>
   <title>CSS Test: Testing page-break-before in vertical multi-line flex containers</title>
   <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
-  <link rel="help" href="http://dev.w3.org/csswg/css-flexbox/#algo-line-break">
+  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#algo-line-break">
   <link rel="match" href="flexbox-break-request-vert-1-ref.html">
   <meta charset="utf-8">
   <style>
     div.flexbox {
       display: flex;
       flex-direction: column;
       flex-wrap: wrap;
       border: 1px dashed black;
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-break-request-vert-1b.html
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-break-request-vert-1b.html
@@ -2,17 +2,17 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <html>
 <head>
   <title>CSS Test: Testing page-break-after in vertical multi-line flex containers</title>
   <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
-  <link rel="help" href="http://dev.w3.org/csswg/css-flexbox/#algo-line-break">
+  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#algo-line-break">
   <link rel="match" href="flexbox-break-request-vert-1-ref.html">
   <meta charset="utf-8">
   <style>
     div.flexbox {
       display: flex;
       flex-direction: column;
       flex-wrap: wrap;
       border: 1px dashed black;
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-break-request-vert-2a.html
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-break-request-vert-2a.html
@@ -2,17 +2,17 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <html>
 <head>
   <title>CSS Test: Testing page-break-before in vertical single-line flex containers (should have no effect)</title>
   <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
-  <link rel="help" href="http://dev.w3.org/csswg/css-flexbox/#algo-line-break">
+  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#algo-line-break">
   <link rel="match" href="flexbox-break-request-vert-2-ref.html">
   <meta charset="utf-8">
   <style>
     div.flexbox {
       display: flex;
       flex-direction: column;
       border: 1px dashed black;
       width: 20px;
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-break-request-vert-2b.html
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-break-request-vert-2b.html
@@ -2,17 +2,17 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <html>
 <head>
   <title>CSS Test: Testing page-break-after in vertical single-line flex containers (should have no effect)</title>
   <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
-  <link rel="help" href="http://dev.w3.org/csswg/css-flexbox/#algo-line-break">
+  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#algo-line-break">
   <link rel="match" href="flexbox-break-request-vert-2-ref.html">
   <meta charset="utf-8">
   <style>
     div.flexbox {
       display: flex;
       flex-direction: column;
       border: 1px dashed black;
       width: 20px;
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-flex-wrap-horiz-1.html
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-flex-wrap-horiz-1.html
@@ -2,17 +2,17 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <html>
 <head>
   <title>CSS Test: Testing flex-wrap in horizontal flex containers</title>
   <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
-  <link rel="help" href="http://dev.w3.org/csswg/css-flexbox/#flex-wrap-property">
+  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#flex-wrap-property">
   <link rel="match" href="flexbox-flex-wrap-horiz-1-ref.html">
   <meta charset="utf-8">
   <style>
     div.flexbox {
       display: flex;
       flex-wrap: wrap;
       border: 1px dashed black;
       width: 100px;
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-flex-wrap-horiz-2.html
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-flex-wrap-horiz-2.html
@@ -2,17 +2,17 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <html>
 <head>
   <title>CSS Test: Ensure that min-width is honored for horizontal multi-line flex containers</title>
   <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
-  <link rel="help" href="http://dev.w3.org/csswg/css-flexbox/#flex-wrap-property">
+  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#flex-wrap-property">
   <link rel="match" href="flexbox-flex-wrap-horiz-2-ref.html">
   <meta charset="utf-8">
   <style>
     div.flexbox {
       display: flex;
       flex-wrap: wrap;
       border: 1px dashed black;
       min-width: 100px;
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-flex-wrap-vert-1.html
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-flex-wrap-vert-1.html
@@ -2,17 +2,17 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <html>
 <head>
   <title>CSS Test: Testing flex-wrap in vertical flex containers</title>
   <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
-  <link rel="help" href="http://dev.w3.org/csswg/css-flexbox/#flex-wrap-property">
+  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#flex-wrap-property">
   <link rel="match" href="flexbox-flex-wrap-vert-1-ref.html">
   <meta charset="utf-8">
   <style>
     div.flexbox {
       display: flex;
       flex-direction: column;
       flex-wrap: wrap;
       border: 1px dashed black;
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-flex-wrap-vert-2.html
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-flex-wrap-vert-2.html
@@ -2,17 +2,17 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <html>
 <head>
   <title>CSS Test: Ensure that min-height is honored for vertical multi-line flex containers</title>
   <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
-  <link rel="help" href="http://dev.w3.org/csswg/css-flexbox/#flex-wrap-property">
+  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#flex-wrap-property">
   <link rel="match" href="flexbox-flex-wrap-vert-2-ref.html">
   <meta charset="utf-8">
   <style>
     div.flexbox {
       display: flex;
       flex-direction: column;
       flex-wrap: wrap;
       border: 1px dashed black;
--- a/layout/reftests/w3c-css/submitted/flexbox/reftest.list
+++ b/layout/reftests/w3c-css/submitted/flexbox/reftest.list
@@ -30,16 +30,18 @@ fuzzy-if(Android,158,32) == flexbox-alig
 == flexbox-baseline-align-self-baseline-horiz-1.html flexbox-baseline-align-self-baseline-horiz-1-ref.html
 == flexbox-baseline-align-self-baseline-vert-1.html flexbox-baseline-align-self-baseline-vert-1-ref.html
 == flexbox-baseline-empty-1a.html flexbox-baseline-empty-1-ref.html
 == flexbox-baseline-empty-1b.html flexbox-baseline-empty-1-ref.html
 == flexbox-baseline-multi-item-horiz-1.html flexbox-baseline-multi-item-horiz-1-ref.html
 == flexbox-baseline-multi-item-vert-1.html flexbox-baseline-multi-item-vert-1-ref.html
 == flexbox-baseline-multi-line-horiz-1.html flexbox-baseline-multi-line-horiz-1-ref.html
 == flexbox-baseline-multi-line-horiz-2.html flexbox-baseline-multi-line-horiz-2-ref.html
+== flexbox-baseline-multi-line-horiz-3.html flexbox-baseline-multi-line-horiz-3-ref.html
+== flexbox-baseline-multi-line-horiz-4.html flexbox-baseline-multi-line-horiz-4-ref.html
 == flexbox-baseline-single-item-1a.html flexbox-baseline-single-item-1-ref.html
 == flexbox-baseline-single-item-1b.html flexbox-baseline-single-item-1-ref.html
 
 # Basic tests with with blocks as flex items
 == flexbox-basic-block-horiz-1.xhtml flexbox-basic-block-horiz-1-ref.xhtml
 == flexbox-basic-block-vert-1.xhtml flexbox-basic-block-vert-1-ref.xhtml
 
 # Tests for basic handling of <canvas>/<img>/etc as a flex item
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-01.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-01.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable consisting of a single token preceded by white space.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
   var-a: green;
   color: var(a);
 }
 </style>
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-02.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-02.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable consisting of a single token with no preceding white space.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
   var-a:green;
   color: var(a);
 }
 </style>
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-03.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-03.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable that references another variable.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
   var-a: var(b);
   var-b: green;
   color: var(a);
 }
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-04.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-04.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable consisting of a variable reference followed by white space.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
   var-a: var(b) ;
   var-b: green;
   color: var(a);
 }
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-05.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-05.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable consisting of a variable reference that includes white space around the variable name.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
   var-a: var( b ) ;
   var-b: green;
   color: var(a);
 }
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-06.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-06.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test overriding an existing variable declaration.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
   var-a: orange;
   var-a: green;
   color: var(a);
 }
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-07.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-07.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable with invalid syntax due to a variable reference having no tokens in its fallback.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
   var-a: green;
   var-b: crimson;
   var-a: var(b,);
   color: var(a);
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-08.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-08.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable that consists of a variable reference whose fallback is white space.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
   var-a: orange;
   var-b: green;
   var-a: var(b, );
   color: var(a);
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-09.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-09.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable with invalid syntax due to a variable reference having only a comment in its fallback.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
   var-a: green;
   var-b: crimson;
   var-a: var(b,/**/);
   color: var(a);
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-10.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-10.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable that consists of a variable reference with a fallback that includes a comment and an identifier.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
   var-a: orange;
   var-b: green;
   var-a: var(b,/**/a);
   color: var(a);
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-11.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-11.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable with invalid syntax due to a variable reference having a '!' token at the top level of its fallback.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
   var-a: green;
   var-b: crimson;
   var-a: var(b,!);
   color: var(a);
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-12.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-12.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable with invalid syntax due to a variable reference having a ';' token at the top level of its fallback.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
   var-a: green;
   var-b: crimson;
   var-a: var(b,;);
   color: var(a);
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-13.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-13.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable with invalid syntax due to a variable reference having "!important" the top level of its fallback.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
   var-a: green;
   var-b: crimson;
   var-a: var(b,!important);
   color: var(a);
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-14.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-14.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable that consists of a variable reference and a following identifier with no intervening white space.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: green;
 }
 span {
   color: red;
   var-a:var(b)red;
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-15.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-15.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable that consists of a comma-separated font family list.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="variable-declaration-15-ref.html">
 <meta name="flags" content="ahem">
 <link rel="stylesheet" href="support/ahem.css" type="text/css">
 <style>
 body {
   font-family: serif;
 }
 p {
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-16.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-16.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable that consists of a comma-separated font family list with the first item being a variable reference.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="variable-declaration-16-ref.html">
 <meta name="flags" content="ahem">
 <link rel="stylesheet" href="support/ahem.css" type="text/css">
 <style>
 body {
   font-family: serif;
 }
 p {
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-17.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-17.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable that consists of a comma-separated font family list with the last item being a variable reference.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="variable-declaration-17-ref.html">
 <meta name="flags" content="ahem">
 <link rel="stylesheet" href="support/ahem.css" type="text/css">
 <style>
 body {
   font-family: serif;
 }
 p {
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-18.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-18.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable that consists of a comma-separated font family list with the comma coming from a variable reference.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="variable-declaration-18-ref.html">
 <meta name="flags" content="ahem">
 <link rel="stylesheet" href="support/ahem.css" type="text/css">
 <style>
 body {
   font-family: serif;
 }
 p {
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-19.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-19.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable that consists of a function where one of the arguments is a variable reference.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
 }
 p {
   color: orange;
   var-a: rgb(0, var(b), 0);
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-20.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-20.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable with "!important".</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
 }
 p {
   color: orange;
   var-a: var(b) !important;
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-21.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-21.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable that consists of a function where all of the arguments and commas are made up of variable references.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
 }
 p {
   color: orange;
   var-a: rgb(var(b)var(c)var(d));
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-22.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-22.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable that consists of a variable reference with a number of levels of variable reference fallbacks.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
 }
 p {
   color: orange;
   var-a: var(b, var(c, var(d, green)));
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-23.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-23.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable with invalid syntax due to having two "!important" priorities.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
 }
 p {
   color: orange;
   var-a: green;
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-24.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-24.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable that contains a CDO token.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   color: green;
 }
 p {
   color: red;
 }
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-25.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-25.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable that contains a CDC token.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   color: green;
 }
 p {
   color: red;
 }
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-26.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-26.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable that contains only a white space token.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
 }
 p {
   color: orange;
   var-a: ;
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-28.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-28.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable with invalid syntax due to having no tokens.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
 }
 p {
   color: orange;
   var-a: green;
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-29.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-29.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable with an invalid custom property name "var-".</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
 }
 p {
   color: orange;
   var-: crimson;
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-30.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-30.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable that contains a variable reference to itself.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#cycles">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#cycles">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
 }
 p {
   color: orange;
   var-a: crimson;
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-31.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-31.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable where the variable name begins with a digit.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
 }
 p {
   color: orange;
   var-0: green;
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-32.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-32.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable where the variable name begins with an escaped digit.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
 }
 p {
   color: orange;
   var-\30: green;
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-33.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-33.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable where the variable name begins with an escaped letter.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
 }
 p {
   color: orange;
   var-\61: green;
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-34.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-34.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable where the variable name begins with a lone surrogate.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
 }
 p {
   color: orange;
   var-\d800: green;
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-35.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-35.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable where the variable name begins with U+FFFD.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
 }
 p {
   color: orange;
   var-\fffd: green;
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-36.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-36.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable where the variable name begins with an out-of-range Unicode character escape.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
 }
 p {
   color: orange;
   var-\ffffff: green;
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-37.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-37.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable consisting of a variable reference where white space surrounds the comma separating the variable name and fallback.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
 }
 p {
   color: orange;
   var-a: var(b , );
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-38.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-38.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring two variables in the same declaration block that differ only in case, with lowercase first.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
 }
 p {
   color: orange;
   var-a: green;
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-39.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-39.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring two variables in the same declaration block that differ only in case, with uppercase first.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
 }
 p {
   color: orange;
   var-A: green;
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-40.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-40.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable with an invalid custom property name due to it beginning with "VAR-".</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
 }
 p {
   color: orange;
   var-a: green;
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-41.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-41.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable where the 'a' in the "var-" prefix of the custom property name is escaped.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
 }
 p {
   color: orange;
   v\61r-a: green;
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-42.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-42.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable where the custom property name includes an unescaped Chinese character and an escape that is terminated by a space character.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <meta charset=utf-8>
 <style>
 p {
   color: red;
 }
 p {
   color: orange;
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-43.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-43.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable whose value is "initial".</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
 }
 p {
   color: orange;
   var-a: initial;
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-44.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-44.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable whose value is "inherit" where there is no variable to inherit from.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
 }
 p {
   color: orange;
   var-a: inherit;
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-45.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-45.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable whose value is "inherit" where there is a variable to inherit from.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   var-a: green;
   color: crimson;
 }
 p {
   color: red;
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-46.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-46.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable whose value is "initial" where there is a variable to inherit from.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   var-a: crimson;
 }
 p {
   color: red;
 }
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-47.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-47.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable whose value consists of a reference to a variable whose value is "inherit".</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   var-b: green;
   color: crimson;
 }
 p {
   color: red;
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-48.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-48.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a number of variables in a cycle.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#cycles">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#cycles">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   color: green;
 }
 p {
   color: crimson;
   var-a: red var(b);
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-49.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-49.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable that is a dependent of a variable involved in a cycle but which itself is not involved in a cycle.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#cycles">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#cycles">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   color: orange;
 }
 p {
   color: crimson;
   var-a: red var(b) var(g);
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-50.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-50.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a number of variables in a chain, where the final element of the chain uses its fallback.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#cycles">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#cycles">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   color: green;
 }
 p {
   color: crimson;
   var-a: var(b,red);
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-51.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-51.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable that consists of a reference to an invalid inherited variable.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#invalid-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#invalid-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   color: orange;
   var-c: var(a);
 }
 p {
   var-a: var(b);
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-52.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-52.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable that consists of a reference to an inherited variable whose value was a variable reference that used its fallback.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   color: orange;
   var-c: var(a,green);
 }
 p {
   var-a: var(b);
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-53.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-53.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable that consists of two variable references without fallback and with no intervening white space.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: green;
 }
 span {
   color: red;
   var-a:var(b)var(c);
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-54.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-54.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable that consists of two variable references with the first variable reference using fallback and with no intervening white space.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: green;
 }
 span {
   color: red;
   var-a:var(b,orange)var(c);
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-55.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-55.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable that consists of two variable references with the second variable reference using fallback and with no intervening white space.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: green;
 }
 span {
   color: red;
   var-a:var(b)var(c,red);
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-56.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-56.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable whose value is "unset" where there is no variable to inherit from.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
 }
 p {
   color: orange;
   var-a: unset;
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-57.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-57.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable whose value is "unset" where there is a variable to inherit from.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   var-a: green;
   color: crimson;
 }
 p {
   color: red;
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-58.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-58.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable whose value consists of a reference to a variable whose value is "unset".</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   var-b: green;
   color: crimson;
 }
 p {
   color: red;
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-59.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-59.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable with a trailing invalid token.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: var(a);
   var-a: green;
   var-a: red);
 }
 </style>
--- a/layout/reftests/w3c-css/submitted/variables/variable-declaration-60.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-declaration-60.html
@@ -1,17 +1,17 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <meta charset=utf-8>
 <title>CSS Test: Test declaring a variable with a value whose name is "initial" but using Turkish dotted/dotless 'i's.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 div {
   color: orange;
   var-a: green;
   color: var(a);
 }
 p {
--- a/layout/reftests/w3c-css/submitted/variables/variable-font-face-01.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-font-face-01.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test the invalid declaration and use of a variable in an @font-face rule.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="variable-font-face-01-ref.html">
 <meta name="flags" content="ahem">
 <style>
 @font-face {
   var-a: MyTestFontName;
   font-family: var(a);
   src: url(../../../fonts/Ahem.ttf);
 }
--- a/layout/reftests/w3c-css/submitted/variables/variable-font-face-02.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-font-face-02.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test the invalid use of a variable in an @font-face rule where the variable is defined on the root element.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="variable-font-face-02-ref.html">
 <meta name="flags" content="ahem">
 <style>
 :root {
   var-a: MyTestFontName;
 }
 @font-face {
   font-family: var(a);
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-01.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-01.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test the use of a variable in a non-custom property where the variable value is inherited.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 :root {
   var-a: green;
 }
 p {
   color: var(a);
 }
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-02.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-02.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test the use of a variable in a non-custom property where the value is invalid at computed-value time due to referencing a non-existent variable.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#invalid-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#invalid-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 :root {
   var-a: crimson;
   color: red;
 }
 body {
   color: green;
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-03.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-03.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test the use of two variables in a non-custom property where the variable values are inherited and one of the variable values consists only of white space.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 :root {
   var-a: green;
   var-b: ;
   color: red;
 }
 p {
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-04.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-04.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test the use of two variables in a non-custom property where one variable is inherited and the other references a non-existing variable with fallback that consists only of white space.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 :root {
   var-a: green;
   color: red;
 }
 p {
   color: crimson;
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-05.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-05.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test the use of a variable in a non-custom property where the values contains no tokens other than the variable reference.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   var-a: green;
   color: red;
 }
 p {
   color: crimson;
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-06.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-06.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property with invalid syntax due to having a variable reference whose fallback contains no tokens.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   var-a: crimson;
   color: red;
 }
 p {
   color: green;
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-07.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-07.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property with invalid syntax due to having a variable reference whose fallback contains a top level ';' token.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   var-a: crimson;
   color: red;
 }
 p {
   color: green;
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-08.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-08.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property with invalid syntax due to having a variable reference whose fallback contains a top level '!' token.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   var-a: crimson;
   color: red;
 }
 p {
   color: green;
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-09.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-09.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property with a variable reference that has a non-top level ';' token.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   var-a: green;
   color: crimson;
 }
 p {
   color: red;
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-10.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-10.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property with a variable reference that has a non-top level '!' token.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   var-a: green;
   color: crimson;
 }
 p {
   color: red;
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-11.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-11.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property with invalid syntax due to having a variable reference whose fallback contains nothing but a comment.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   var-a: crimson;
   color: red;
 }
 p {
   color: green;
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-12.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-12.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test the use of variable references in the 'content' property.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="variable-reference-12-ref.html">
 <style>
 :root {
   var-a: "hello";
   var-b: "there";
 }
 #a:before {
   content: var(a) " " var(b);
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-13.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-13.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test that important variable declarations are not overwritten by subsequent non-important variable declarations in the one declaration block.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
   var-a: green !important;
   var-a: crimson;
   color: var(a);
 }
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-14.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-14.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test that important variable declarations cascade correctly.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 #a {
   var-a: green !important;
 }
 p {
   color: red;
   var-a: crimson;
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-15.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-15.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property with two variable references with no intervening white space.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   color: green;
 }
 p {
   color: crimson;
   var-a: orange;
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-16.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-16.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property that consists of a variable reference with a number of levels of variable reference fallbacks.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   color: red;
 }
 p {
   color: crimson;
   color: var(a, var(b, var(c, green)));
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-17.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-17.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property that consists of a variable reference whose fallback contains a CDO token.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   color: red;
 }
 p {
   color: crimson;
   var-a: green;
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-18.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-18.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property that contains a variable reference and balanced braces and square brackets.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   color: green;
 }
 p {
   color: red;
   color: { [ var(a) ] };
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-19.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-19.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property that contains a variable reference and a non-top level ';' token.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   color: green;
 }
 p {
   color: red;
   color: [;] var(a);
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-20.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-20.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property that contains a variable reference whose function token is in uppercase.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
   var-a: green;
   color: VAR(a);
 }
 </style>
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-21.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-21.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property that contains a reference to a variable whose name must be escaped.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
   var-0: green;
   color: var(\30);
 }
 </style>
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-22.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-22.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property that contains a reference to a variable whose name is U+FFFD but which was declared and referenced using a lone surrogate.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
   var-\d800: green;
   color: var(\d800);
 }
 </style>
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-23.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-23.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property that contains a reference to a variable whose name is U+FFFD but which was declared using a lone surrogate.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
   var-\d800: green;
   color: var(\fffd);
 }
 </style>
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-24.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-24.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property that contains a reference to a variable whose name is U+FFFD but which was declared using an out-of-range Unicode character escape.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
   var-\ffffff: green;
   color: var(\fffd);
 }
 </style>
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-25.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-25.html
@@ -1,15 +1,15 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property that contains a variable reference with no fallback and which is implicitly closed due to EOF.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
   var-a: green;
   color: var(a</style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-26.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-26.html
@@ -1,15 +1,15 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property that contains a variable reference with white space before its comma and fallback consisting only of white space and which is implicitly closed due to EOF.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
   var-a: green;
   color: var(a , </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-27.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-27.html
@@ -1,15 +1,15 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property that contains a variable reference with fallback consisting only of white space and which is implicitly closed due to EOF.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
   var-a: green;
   color: var(a, </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-28.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-28.html
@@ -1,15 +1,15 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property that contains a variable reference whose fallback is a variable reference, both of which are implicitly closed due to EOF.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
   var-a: green;
   color: var(a, var(b</style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-29.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-29.html
@@ -1,15 +1,15 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property that contains a variable reference with no fallback, and whose variable name is followed by a comment, and where the comment and the variable reference are implicitly closed due to EOF.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
   var-a: green;
   color: var(a /* unclosed comment</style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-30.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-30.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property with invalid syntax due to containing two "!important" priorities.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: green;
   var-a: red;
   color: var(a) !important !important;
 }
 </style>
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-31.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-31.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property with invalid syntax due to containing a variable reference with a non-identifier variable name.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   color: orange;
 }
 p {
   color: green;
   var-0: red;
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-32.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-32.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property with invalid syntax due to containing a variable reference with fallback that contains a bad string.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   color: orange;
 }
 p {
   color: green;
   var-a: red;
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-33.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-33.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property containing a variable reference with fallback is an implicitly closed string due to EOF.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   color: orange;
 }
 p {
   color: red;
   var-a: green;
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-34.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-34.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property with invalid syntax due to containing a variable reference with fallback that contains a bad URL.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   color: orange;
 }
 p {
   color: green;
   var-a: red;
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-35.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-35.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom property containing a variable reference with fallback is an implicitly closed URL due to EOF.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body {
   color: orange;
 }
 p {
   color: red;
   var-a: green;
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-36.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-36.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom shorthand property containing a variable reference.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#variables-in-shorthands">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#variables-in-shorthands">
 <link rel="match" href="variable-reference-36-ref.html">
 <style>
 p {
   background-color: red;
   var-a: url(nothing) green;
   background: var(a);
   color: white;
 }
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-37.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-37.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a non-custom shorthand property containing a variable reference, with a subsequent property in the declaration block that overrides one of the shorthand's components.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#variables-in-shorthands">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#variables-in-shorthands">
 <link rel="match" href="variable-reference-37-ref.html">
 <style>
 p {
   var-a: url(nothing) red;
   background: var(a);
   background-color: green;
   color: white;
 }
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-38.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-38.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test using variables in overlapping shorthands.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#variables-in-shorthands">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#variables-in-shorthands">
 <link rel="match" href="variable-declaration-59-ref.html">
 <style>
 p { padding-left: 1em; }
 #a { var-style: solid; var-left: black dotted; border-style: var(style); border-left: var(left); border-top: none; border-right: none; border-bottom: none; }
 #b { var-style: solid; var-left: black dotted; border-left: var(left); border-style: var(style); border-top: none; border-right: none; border-bottom: none; }
 </style>
 <p id=a>The left border must be dotted.</p>
 <p id=b>The left border must be solid.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-reference-39.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-reference-39.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test declaring a variable that references itself but uses fallback.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#cycles">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#cycles">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 p {
   color: red;
   var-a: var(a, red);
   color: var(a, green);
 }
 </style>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-01.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-01.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing non-custom property declaration in an @supports rule where the property value contains a variable reference and no white space tokens.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color:var(a)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-02.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-02.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing non-custom property declaration in an @supports rule where the property value contains a white space token followed by a variable reference.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: var(a)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-03.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-03.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing non-custom property declaration in an @supports rule where the property value contains a variable reference surrounded by white space tokens.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: var(a) ) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-04.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-04.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing non-custom property declaration in an @supports rule where the property value contains a variable reference surrounded by white space tokens and with white space surrounding the variable name.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: var( a ) ) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-05.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-05.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a failing non-custom property declaration in an @supports rule where the property value contains a syntactically invalid variable reference due to having no fallback tokens.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: var(a)) and (not (color: var(a,))) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-06.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-06.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing non-custom property declaration in an @supports rule where the property value contains a variable reference with fallback that is only white space.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: var(a, )) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-07.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-07.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a failing non-custom property declaration in an @supports rule where the property value contains a syntactically invalid variable reference due to having no fallback tokens, just a comment.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: var(a)) and (not (color: var(a,/**/))) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-08.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-08.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing non-custom property declaration in an @supports rule where the property value contains a comment and an identifier.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: var(a,/**/a)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-09.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-09.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a failing non-custom property declaration in an @supports rule where the property value contains a syntactically invalid variable reference due to having a '!' token at the top level of its fallback.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: var(a)) and (not (color: var(a,!))) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-10.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-10.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a failing non-custom property declaration in an @supports rule where the property value contains a syntactically invalid variable reference due to having "!important" at the top level of its fallback.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: var(a)) and (not (color: var(a,!important))) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-11.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-11.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing 'color' property declaration in an @supports rule with a variable reference that comes after a non-color value.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: 1px var(a)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-12.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-12.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing 'color' property declaration in an @supports rule with a variable reference that comes before a non-color value.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: var(a) 1px) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-13.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-13.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing 'color' property declaration in an @supports rule with a range of different tokens and a variable reference not at the top level.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: something 3px url(whereever) calc(var(a) + 1px)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-14.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-14.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing non-custom property declaration in an @supports rule with a variable reference and an "!important" priority.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: var(a) !important) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-15.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-15.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing non-custom property declaration in an @supports rule with two adjacent variable references with no intervening white space.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: var(a)var(b)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-16.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-16.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing non-custom property declaration in an @supports rule with a variable reference that has a number of levels of variable reference fallbacks.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: var(a, var(b, var(c, black)))) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-17.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-17.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a failing non-custom property declaration in an @supports rule with two "!important" priorities.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: var(a)) and (not (color: var(a) !important !important)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-18.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-18.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing non-custom property declaration in an @supports rule whose value contains a variable reference and a CDO token.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: var(a) <!--) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-19.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-19.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing non-custom property declaration in an @supports rule whose value contains a variable reference and a CDC token.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: --> var(a)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-20.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-20.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing non-custom property declaration in an @supports rule whose value contains a variable reference and balanced braces and square brackets.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: { [ var(a) ] }) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-21.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-21.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a failing non-custom property declaration in an @supports rule where the property value contains a syntactically invalid variable reference due to having a ';' token at the top level of its fallback.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: var(a)) and (not (color: var(a,;))) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-22.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-22.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing non-custom property declaration in an @supports rule whose value contains a variable reference and a non-top level ';' token.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: [;] var(a)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-23.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-23.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a failing non-custom property declaration in an @supports rule whose value contains a variable reference with a top level ';' token.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: var(a)) and (not (color: var(a);)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-24.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-24.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing non-custom property declaration in an @supports rule whose value contains a variable reference with a non-top level ';' token in its fallback.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: var(a,(;))) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-25.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-25.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing non-custom property declaration in an @supports rule whose value contains a variable reference whose function token is in uppercase.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: VAR(a)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-26.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-26.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a failing non-custom property declaration in an @supports rule whose value contains a variable reference with a number token as the variable name.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: var(a)) and (not (color: var(0))) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-27.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-27.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing non-custom property declaration in an @supports rule whose value contains a variable reference with a variable name beginning with an escaped digit.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: var(\30)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-28.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-28.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing non-custom property declaration in an @supports rule whose value contains a variable reference with a U+FFFD variable name specified by an escaped lone surrogate.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: var(\d800)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-29.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-29.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing non-custom property declaration in an @supports rule whose value contains a variable reference with a U+FFFD variable name specified by an out-of-range Unicode character escape.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: var(\ffffff)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-30.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-30.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing non-custom property declaration in an @supports rule whose value contains a variable reference with a dimension token as the variable name.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: var(a)) and (not (color: var(1px))) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-31.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-31.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing non-custom property declaration in an @supports rule whose value contains a variable reference with white space surrounding the fallback comma.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (color: var(a , )) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-32.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-32.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing non-custom shorthand property declaration in an @supports rule whose value contains a variable reference.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (background: var(a)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-33.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-33.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing custom property declaration in an @supports rule whose value contains a variable reference.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a:var(b)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-34.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-34.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing custom property declaration in an @supports rule whose value contains white space and a variable reference.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: var(b)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-35.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-35.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing custom property declaration in an @supports rule whose value contains a variable reference surrounded by white space.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: var(b) ) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-36.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-36.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing custom property declaration in an @supports rule whose value contains a variable reference surrounded by white space with the variable name also surrounded by white space.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: var( b ) ) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-37.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-37.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a failing custom property declaration in an @supports rule whose value contains a variable reference with no fallback tokens.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: a) and (not (var-a: var(b,))) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-38.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-38.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing custom property declaration in an @supports rule whose value contains a variable reference with fallback consisting only of white space.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: var(b, )) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-39.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-39.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a failing custom property declaration in an @supports rule whose value contains a variable reference with no fallback tokens, just a comment.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: a) and (not (var-a: var(b,/**/))) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-40.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-40.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing custom property declaration in an @supports rule whose value contains a variable reference with fallback consisting of a comment and an identifier.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: var(b,/**/a)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-41.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-41.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a failing custom property declaration in an @supports rule whose value contains a variable reference with fallback containing a top level '!' token.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: a) and (not (var-a: var(b,!))) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-42.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-42.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a failing custom property declaration in an @supports rule whose value contains a variable reference with fallback containing a top level "!important".</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: a) and (not (var-a: var(b,!important))) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-43.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-43.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing custom property declaration in an @supports rule whose value contains a dimension followed by a variable reference.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: 1px var(b)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-44.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-44.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing custom property declaration in an @supports rule whose value contains a variable reference followed bya dimension.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: var(b) 1px) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-45.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-45.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing custom property declaration in an @supports rule whose value contains a selection of tokens and a non-top level variable reference.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: something 3px url(whereever) calc(var(b) + 1px)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-46.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-46.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing custom property declaration in an @supports rule whose value contains a variable reference and an "!important" priority.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: var(b) !important) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-47.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-47.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing custom property declaration in an @supports rule whose value contains two adjacent variable references with no intervening white space.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: var(b)var(b)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-48.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-48.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing custom property declaration in an @supports rule whose value contains a variable reference with a number of levels of variable reference fallbacks.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: var(b, var(c, var(d, black)))) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-49.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-49.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a failing custom property declaration in an @supports rule whose value contains two "!important" priorities.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: a) and (not (var-a: var(b) !important !important)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-50.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-50.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing custom property declaration in an @supports rule whose value contains a variable reference and a CDO token.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: var(b) <!--) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-51.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-51.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing custom property declaration in an @supports rule whose value contains a variable reference and a CDC token.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: --> var(b)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-52.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-52.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing custom property declaration in an @supports rule whose value contains a variable reference and balanced braces and square brackets.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: { [ var(b) ] }) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-53.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-53.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a failing custom property declaration in an @supports rule whose value contains a variable reference with a top level ';' token in its fallback.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: a) and (not (var-a: var(b,;))) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-54.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-54.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing custom property declaration in an @supports rule whose value contains a variable reference and a non-top level ';' token.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: [;] var(b)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-55.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-55.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a failing custom property declaration in an @supports rule whose value contains a variable reference and a top level ';' token in its fallback.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: a) and (not (var-a: var(b);)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-56.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-56.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing custom property declaration in an @supports rule whose value contains only a white space token.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: ) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-57.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-57.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a failing custom property declaration in an @supports rule whose value contains no tokens.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: a) and (not (var-a:)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-58.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-58.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a failing property declaration in an @supports rule with property name "var-".</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: a) and (not (var-: a)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-59.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-59.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing custom property declaration in an @supports rule whose value contains a variable reference to itself.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#cycles">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#cycles">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a:var(a)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-60.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-60.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing custom property declaration in an @supports rule for a variable whose name is a digit.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-0: a) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-61.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-61.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing custom property declaration in an @supports rule for a variable whose name is a digit which is specified with an escape.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-\61: a) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-62.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-62.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing custom property declaration in an @supports rule for a variable whose name is U+FFFD which is specified with an escaped lone surrogate.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-\d800: a) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-63.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-63.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing custom property declaration in an @supports rule for a variable whose name is U+FFFD which is specified with an out-of-range Unicode character escape.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-\ffffff: a) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-64.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-64.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a failing custom property declaration in an @supports rule whose value is a variable reference with a dimension token as the variable name.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#using-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#using-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: a) and (not (var-a: var(1px))) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-65.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-65.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a passing custom property declaration in an @supports rule whose value is a variable reference with white space surrounding the fallback comma.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#syntax">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#syntax">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: var(b , )) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-66.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-66.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a failing custom property declaration in an @supports rule where the property name begins with "VAR-".</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: a) and (not (VAR-a: a)) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/layout/reftests/w3c-css/submitted/variables/variable-supports-67.html
+++ b/layout/reftests/w3c-css/submitted/variables/variable-supports-67.html
@@ -1,16 +1,16 @@
 <!--
      Any copyright is dedicated to the Public Domain.
      http://creativecommons.org/publicdomain/zero/1.0/
 -->
 <!DOCTYPE html>
 <title>CSS Test: Test a declaration for a custom property has an invalid value does not cause the @supports rule to fail to parse.</title>
 <link rel="author" title="Cameron McCormack" href="mailto:cam@mcc.id.au">
-<link rel="help" href="http://dev.w3.org/csswg/css-variables/#defining-variables">
+<link rel="help" href="http://www.w3.org/TR/css-variables-1/#defining-variables">
 <link rel="match" href="support/color-green-ref.html">
 <style>
 body { color: red; }
 @supports (var-a: !) or (var-a: a) {
   p { color: green; }
 }
 </style>
 <p>This text must be green.</p>
--- a/modules/libjar/nsJARFactory.cpp
+++ b/modules/libjar/nsJARFactory.cpp
@@ -40,17 +40,20 @@ static const mozilla::Module::ContractID
     { "@mozilla.org/libjar/zip-reader-cache;1", &kNS_ZIPREADERCACHE_CID },
     { NS_NETWORK_PROTOCOL_CONTRACTID_PREFIX "jar", &kNS_JARPROTOCOLHANDLER_CID },
     { nullptr }
 };
 
 // Jar module shutdown hook
 static void nsJarShutdown()
 {
-    NS_IF_RELEASE(gJarHandler);
+    // Make sure to not null out gJarHandler here, because we may have
+    // still-live nsJARChannels that will want to release it.
+    nsJARProtocolHandler *handler = gJarHandler;
+    NS_IF_RELEASE(handler);
 }
 
 static const mozilla::Module kJARModule = {
     mozilla::Module::kVersion,
     kJARCIDs,
     kJARContracts,
     nullptr,
     nullptr,
--- a/modules/libjar/nsJARProtocolHandler.cpp
+++ b/modules/libjar/nsJARProtocolHandler.cpp
@@ -34,16 +34,18 @@ nsJARProtocolHandler *gJarHandler = null
 nsJARProtocolHandler::nsJARProtocolHandler()
 : mIsMainProcess(XRE_GetProcessType() == GeckoProcessType_Default)
 {
     MOZ_ASSERT(NS_IsMainThread());
 }
 
 nsJARProtocolHandler::~nsJARProtocolHandler()
 {
+    MOZ_ASSERT(gJarHandler == this);
+    gJarHandler = nullptr;
 }
 
 nsresult
 nsJARProtocolHandler::Init()
 {
     nsresult rv;
 
     mJARCache = do_CreateInstance(kZipReaderCacheCID, &rv);
--- a/modules/libpref/src/init/all.js
+++ b/modules/libpref/src/init/all.js
@@ -658,16 +658,17 @@ pref("extensions.spellcheck.inline.max-m
 pref("editor.use_custom_colors", false);
 pref("editor.singleLine.pasteNewlines",      2);
 pref("editor.use_css",                       false);
 pref("editor.css.default_length_unit",       "px");
 pref("editor.resizing.preserve_ratio",       true);
 pref("editor.positioning.offset",            0);
 
 // Scripts & Windows prefs
+pref("dom.disable_beforeunload",            false);
 pref("dom.disable_image_src_set",           false);
 pref("dom.disable_window_flip",             false);
 pref("dom.disable_window_move_resize",      false);
 pref("dom.disable_window_status_change",    false);
 
 pref("dom.disable_window_open_feature.titlebar",    false);
 pref("dom.disable_window_open_feature.close",       false);
 pref("dom.disable_window_open_feature.toolbar",     false);
--- a/netwerk/protocol/wyciwyg/nsWyciwygChannel.cpp
+++ b/netwerk/protocol/wyciwyg/nsWyciwygChannel.cpp
@@ -3,29 +3,33 @@
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsWyciwyg.h"
 #include "nsWyciwygChannel.h"
 #include "nsILoadGroup.h"
 #include "nsNetUtil.h"
-#include "nsICacheService.h"
-#include "nsICacheSession.h"
+#include "LoadContextInfo.h"
+#include "nsICacheService.h" // only to initialize
+#include "nsICacheStorageService.h"
+#include "nsICacheStorage.h"
+#include "nsICacheEntry.h"
+#include "CacheObserver.h"
 #include "nsCharsetSource.h"
 #include "nsProxyRelease.h"
 #include "nsThreadUtils.h"
-#include "nsICacheEntryDescriptor.h"
 #include "nsIEventTarget.h"
 #include "nsIInputStream.h"
 #include "nsIInputStreamPump.h"
 #include "nsIOutputStream.h"
 #include "nsIProgressEventSink.h"
 #include "nsIURI.h"
-#include "nsWyciwygProtocolHandler.h"
+
+typedef mozilla::net::LoadContextInfo LoadContextInfo;
 
 // Must release mChannel on the main thread
 class nsWyciwygAsyncEvent : public nsRunnable {
 public:
   nsWyciwygAsyncEvent(nsWyciwygChannel *aChannel) : mChannel(aChannel) {}
 
   ~nsWyciwygAsyncEvent()
   {
@@ -50,28 +54,26 @@ public:
   {
     mChannel->SetCharsetAndSourceInternal();
     return NS_OK;
   }
 };
 
 class nsWyciwygWriteEvent : public nsWyciwygAsyncEvent {
 public:
-  nsWyciwygWriteEvent(nsWyciwygChannel *aChannel, const nsAString &aData, 
-                      const nsACString &spec)
-    : nsWyciwygAsyncEvent(aChannel), mData(aData), mSpec(spec) {}
+  nsWyciwygWriteEvent(nsWyciwygChannel *aChannel, const nsAString &aData)
+    : nsWyciwygAsyncEvent(aChannel), mData(aData) {}
 
   NS_IMETHOD Run()
   {
-    mChannel->WriteToCacheEntryInternal(mData, mSpec);
+    mChannel->WriteToCacheEntryInternal(mData);
     return NS_OK;
   }
 private:
   nsString mData;
-  nsCString mSpec;
 };
 
 class nsWyciwygCloseEvent : public nsWyciwygAsyncEvent {
 public:
   nsWyciwygCloseEvent(nsWyciwygChannel *aChannel, nsresult aReason)
     : nsWyciwygAsyncEvent(aChannel), mReason(aReason) {}
 
   NS_IMETHOD Run()
@@ -81,17 +83,18 @@ public:
   }
 private:
   nsresult mReason;
 };
 
 
 // nsWyciwygChannel methods 
 nsWyciwygChannel::nsWyciwygChannel()
-  : mStatus(NS_OK),
+  : mMode(NONE),
+    mStatus(NS_OK),
     mIsPending(false),
     mCharsetAndSourceSet(false),
     mNeedToWriteCharset(false),
     mCharsetSource(kCharsetUninitialized),
     mContentLength(-1),
     mLoadFlags(LOAD_NORMAL),
     mAppId(NECKO_NO_APP_ID),
     mInBrowser(false)
@@ -102,35 +105,45 @@ nsWyciwygChannel::~nsWyciwygChannel()
 {
 }
 
 NS_IMPL_ISUPPORTS7(nsWyciwygChannel,
                    nsIChannel,
                    nsIRequest,
                    nsIStreamListener,
                    nsIRequestObserver,
-                   nsICacheListener,
+                   nsICacheEntryOpenCallback,
                    nsIWyciwygChannel,
                    nsIPrivateBrowsingChannel)
 
 nsresult
 nsWyciwygChannel::Init(nsIURI* uri)
 {
   NS_ENSURE_ARG_POINTER(uri);
 
   nsresult rv;
 
+  if (!mozilla::net::CacheObserver::UseNewCache()) {
+    // Since nsWyciwygChannel can use the new cache API off the main thread
+    // and that API normally does this initiation, we need to take care
+    // of initiating the old cache service here manually.  Will be removed
+    // with bug 913828.
+    MOZ_ASSERT(NS_IsMainThread());
+    nsCOMPtr<nsICacheService> service =
+      do_GetService(NS_CACHESERVICE_CONTRACTID, &rv);
+  }
+
   mURI = uri;
   mOriginalURI = uri;
 
-  nsCOMPtr<nsICacheService> serv =
-    do_GetService(NS_CACHESERVICE_CONTRACTID, &rv);
+  nsCOMPtr<nsICacheStorageService> serv =
+    do_GetService("@mozilla.org/netwerk/cache-storage-service;1", &rv);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  rv = serv->GetCacheIOTarget(getter_AddRefs(mCacheIOTarget));
+  rv = serv->GetIoTarget(getter_AddRefs(mCacheIOTarget));
   NS_ENSURE_SUCCESS(rv, rv);
 
   return NS_OK;
 }
 
 ///////////////////////////////////////////////////////////////////////////////
 // nsIRequest methods:
 ///////////////////////////////////////////////////////////////////////////////
@@ -381,90 +394,100 @@ nsWyciwygChannel::Open(nsIInputStream **
 {
   return NS_ERROR_NOT_IMPLEMENTED;
 }
 
 NS_IMETHODIMP
 nsWyciwygChannel::AsyncOpen(nsIStreamListener *listener, nsISupports *ctx)
 {
   LOG(("nsWyciwygChannel::AsyncOpen [this=%p]\n", this));
+  MOZ_ASSERT(mMode == NONE, "nsWyciwygChannel already open");
 
   NS_ENSURE_TRUE(!mIsPending, NS_ERROR_IN_PROGRESS);
+  NS_ENSURE_TRUE(mMode == NONE, NS_ERROR_IN_PROGRESS);
   NS_ENSURE_ARG_POINTER(listener);
 
-  nsAutoCString spec;
-  mURI->GetSpec(spec);
+  mMode = READING;
 
   // open a cache entry for this channel...
-  nsresult rv = OpenCacheEntry(spec, nsICache::ACCESS_READ);
-  if (rv == NS_ERROR_CACHE_KEY_NOT_FOUND) {
-    // Overwrite rv on purpose; if event dispatch fails we'll bail, and
-    // otherwise we'll wait until the event fires before calling back.
-    rv = NS_DispatchToCurrentThread(
-            NS_NewRunnableMethod(this, &nsWyciwygChannel::NotifyListener));
-  }
-
+  // mIsPending set to true since OnCacheEntryAvailable may be called
+  // synchronously and fails when mIsPending found false.
+  mIsPending = true;
+  nsresult rv = OpenCacheEntry(mURI, nsICacheStorage::OPEN_READONLY |
+                                     nsICacheStorage::CHECK_MULTITHREADED);
   if (NS_FAILED(rv)) {
     LOG(("nsWyciwygChannel::OpenCacheEntry failed [rv=%x]\n", rv));
+    mIsPending = false;
     return rv;
   }
 
-  mIsPending = true;
+  // There is no code path that would invoke the listener sooner than
+  // we get to this line in case OnCacheEntryAvailable is invoked
+  // synchronously.
   mListener = listener;
   mListenerContext = ctx;
 
   if (mLoadGroup)
     mLoadGroup->AddRequest(this, nullptr);
 
   return NS_OK;
 }
 
 //////////////////////////////////////////////////////////////////////////////
 // nsIWyciwygChannel
 //////////////////////////////////////////////////////////////////////////////
 
 NS_IMETHODIMP
 nsWyciwygChannel::WriteToCacheEntry(const nsAString &aData)
 {
-  // URIs not thread-safe, so get spec now in case we need it
-  nsAutoCString spec;
-  nsresult rv = mURI->GetAsciiSpec(spec);
-  if (NS_FAILED(rv)) 
-    return rv;
+  if (mMode == READING) {
+    LOG(("nsWyciwygChannel::WriteToCacheEntry already open for reading"));
+    MOZ_ASSERT(false);
+    return NS_ERROR_UNEXPECTED;
+  }
 
-  return mCacheIOTarget->Dispatch(new nsWyciwygWriteEvent(this, aData, spec),
+  mMode = WRITING;
+
+  return mCacheIOTarget->Dispatch(new nsWyciwygWriteEvent(this, aData),
                                   NS_DISPATCH_NORMAL);
 }
 
 nsresult
-nsWyciwygChannel::WriteToCacheEntryInternal(const nsAString &aData, const nsACString& spec)
+nsWyciwygChannel::WriteToCacheEntryInternal(const nsAString &aData)
 {
+  LOG(("nsWyciwygChannel::WriteToCacheEntryInternal [this=%p]", this));
   NS_ASSERTION(IsOnCacheIOThread(), "wrong thread");
 
   nsresult rv;
 
+  MOZ_ASSERT(mMode == WRITING, "nsWyciwygChannel not open for writing");
+
   if (!mCacheEntry) {
-    rv = OpenCacheEntry(spec, nsICache::ACCESS_WRITE);
-    if (NS_FAILED(rv)) return rv;
+    // OPEN_TRUNCATE will give us the entry instantly
+    rv = OpenCacheEntry(mURI, nsICacheStorage::OPEN_TRUNCATE);
+    if (NS_FAILED(rv) || !mCacheEntry) {
+      LOG(("  could not synchronously open cache entry for write!"));
+      return NS_ERROR_FAILURE;
+    }
   }
 
   if (mLoadFlags & INHIBIT_PERSISTENT_CACHING) {
     rv = mCacheEntry->SetMetaDataElement("inhibit-persistent-caching", "1");
     if (NS_FAILED(rv)) return rv;
   }
 
   if (mSecurityInfo) {
     mCacheEntry->SetSecurityInfo(mSecurityInfo);
   }
 
   if (mNeedToWriteCharset) {
     WriteCharsetAndSourceToCache(mCharsetSource, mCharset);
     mNeedToWriteCharset = false;
   }
-  
+
   uint32_t out;
   if (!mCacheOutputStream) {
     // Get the outputstream from the cache entry.
     rv = mCacheEntry->OpenOutputStream(0, getter_AddRefs(mCacheOutputStream));    
     if (NS_FAILED(rv)) return rv;
 
     // Write out a Byte Order Mark, so that we'll know if the data is
     // BE or LE when we go to read it.
@@ -491,17 +514,17 @@ nsWyciwygChannel::CloseCacheEntryInterna
   NS_ASSERTION(IsOnCacheIOThread(), "wrong thread");
 
   if (mCacheEntry) {
     LOG(("nsWyciwygChannel::CloseCacheEntryInternal [this=%p ]", this));
     mCacheOutputStream = 0;
     mCacheInputStream = 0;
 
     if (NS_FAILED(reason))
-      mCacheEntry->Doom();
+      mCacheEntry->AsyncDoom(nullptr); // here we were calling Doom() ...
 
     mCacheEntry = 0;
   }
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsWyciwygChannel::SetSecurityInfo(nsISupports *aSecurityInfo)
@@ -568,60 +591,71 @@ nsWyciwygChannel::GetCharsetAndSource(in
   }
 
   *aSource = source;
   aCharset = data;
   return NS_OK;
 }
 
 //////////////////////////////////////////////////////////////////////////////
-// nsICachelistener
+// nsICacheEntryOpenCallback
 //////////////////////////////////////////////////////////////////////////////
+
 NS_IMETHODIMP
-nsWyciwygChannel::OnCacheEntryAvailable(nsICacheEntryDescriptor * aCacheEntry, nsCacheAccessMode aMode, nsresult aStatus)
+nsWyciwygChannel::OnCacheEntryCheck(nsICacheEntry* entry, nsIApplicationCache* appCache,
+                                    uint32_t* aResult)
 {
-  LOG(("nsWyciwygChannel::OnCacheEntryAvailable [this=%p entry=%x "
-       "access=%x status=%x]\n", this, aCacheEntry, aMode, aStatus));
+  *aResult = ENTRY_WANTED;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsWyciwygChannel::OnCacheEntryAvailable(nsICacheEntry *aCacheEntry,
+                                        bool aNew,
+                                        nsIApplicationCache* aAppCache,
+                                        nsresult aStatus)
+{
+  LOG(("nsWyciwygChannel::OnCacheEntryAvailable [this=%p entry=%p "
+       "new=%d status=%x]\n", this, aCacheEntry, aNew, aStatus));
 
   // if the channel's already fired onStopRequest, 
   // then we should ignore this event.
-  if (!mIsPending)
+  if (!mIsPending && !aNew)
     return NS_OK;
 
   // otherwise, we have to handle this event.
   if (NS_SUCCEEDED(aStatus))
     mCacheEntry = aCacheEntry;
   else if (NS_SUCCEEDED(mStatus))
     mStatus = aStatus;
 
-  nsresult rv;
+  nsresult rv = NS_OK;
   if (NS_FAILED(mStatus)) {
     LOG(("channel was canceled [this=%p status=%x]\n", this, mStatus));
     rv = mStatus;
   }
-  else { // advance to the next state...
+  else if (!aNew) { // advance to the next state...
     rv = ReadFromCache();
   }
 
   // a failure from Connect means that we have to abort the channel.
   if (NS_FAILED(rv)) {
     CloseCacheEntry(rv);
 
-    NotifyListener();
+    if (!aNew) {
+      // Since OnCacheEntryAvailable can be called directly from AsyncOpen
+      // we must dispatch.
+      NS_DispatchToCurrentThread(NS_NewRunnableMethod(
+        this, &nsWyciwygChannel::NotifyListener));
+    }
   }
 
   return NS_OK;
 }
 
-NS_IMETHODIMP
-nsWyciwygChannel::OnCacheEntryDoomed(nsresult status)
-{
-    return NS_ERROR_NOT_IMPLEMENTED;
-}
-
 //-----------------------------------------------------------------------------
 // nsWyciwygChannel::nsIStreamListener
 //-----------------------------------------------------------------------------
 
 NS_IMETHODIMP
 nsWyciwygChannel::OnDataAvailable(nsIRequest *request, nsISupports *ctx,
                                   nsIInputStream *input,
                                   uint64_t offset, uint32_t count)
@@ -682,53 +716,40 @@ nsWyciwygChannel::OnStopRequest(nsIReque
   return NS_OK;
 }
 
 //////////////////////////////////////////////////////////////////////////////
 // Helper functions
 //////////////////////////////////////////////////////////////////////////////
 
 nsresult
-nsWyciwygChannel::OpenCacheEntry(const nsACString & aCacheKey,
-                                 nsCacheAccessMode aAccessMode)
+nsWyciwygChannel::OpenCacheEntry(nsIURI *aURI,
+                                 uint32_t aOpenFlags)
 {
-  nsresult rv = NS_ERROR_FAILURE;
-  // Get cache service
-  nsCOMPtr<nsICacheService> cacheService =
-    do_GetService(NS_CACHESERVICE_CONTRACTID, &rv);
+  nsresult rv;
+
+  nsCOMPtr<nsICacheStorageService> cacheService =
+    do_GetService("@mozilla.org/netwerk/cache-storage-service;1", &rv);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  // honor security settings
-  nsCacheStoragePolicy storagePolicy;
-  if (mPrivateBrowsing || mLoadFlags & INHIBIT_PERSISTENT_CACHING)
-    storagePolicy = nsICache::STORE_IN_MEMORY;
-  else
-    storagePolicy = nsICache::STORE_ANYWHERE;
-
-  nsCOMPtr<nsICacheSession> cacheSession;
-  nsAutoCString sessionName;
-  nsWyciwygProtocolHandler::GetCacheSessionName(mAppId, mInBrowser,
-                                                mPrivateBrowsing,
-                                                sessionName);
+  bool anonymous = mLoadFlags & LOAD_ANONYMOUS;
+  nsRefPtr<LoadContextInfo> loadInfo = mozilla::net::GetLoadContextInfo(
+    mPrivateBrowsing, mAppId, mInBrowser, anonymous);
 
-  // Open a stream based cache session.
-  rv = cacheService->CreateSession(sessionName.get(), storagePolicy, true,
-                                   getter_AddRefs(cacheSession));
-  if (!cacheSession) 
-    return NS_ERROR_FAILURE;
-
-  cacheSession->SetIsPrivate(mPrivateBrowsing);
+  nsCOMPtr<nsICacheStorage> cacheStorage;
+  if (mLoadFlags & INHIBIT_PERSISTENT_CACHING)
+    rv = cacheService->MemoryCacheStorage(loadInfo, getter_AddRefs(cacheStorage));
+  else
+    rv = cacheService->DiskCacheStorage(loadInfo, false, getter_AddRefs(cacheStorage));
+  NS_ENSURE_SUCCESS(rv, rv);
 
-  if (aAccessMode == nsICache::ACCESS_WRITE)
-    rv = cacheSession->OpenCacheEntry(aCacheKey, aAccessMode, false,
-                                      getter_AddRefs(mCacheEntry));
-  else
-    rv = cacheSession->AsyncOpenCacheEntry(aCacheKey, aAccessMode, this, false);
+  rv = cacheStorage->AsyncOpenURI(aURI, EmptyCString(), aOpenFlags, this);
+  NS_ENSURE_SUCCESS(rv, rv);
 
-  return rv;
+  return NS_OK;
 }
 
 nsresult
 nsWyciwygChannel::ReadFromCache()
 {
   LOG(("nsWyciwygChannel::ReadFromCache [this=%p] ", this));
 
   NS_ENSURE_TRUE(mCacheEntry, NS_ERROR_FAILURE);
--- a/netwerk/protocol/wyciwyg/nsWyciwygChannel.h
+++ b/netwerk/protocol/wyciwyg/nsWyciwygChannel.h
@@ -7,72 +7,79 @@
 #ifndef nsWyciwygChannel_h___
 #define nsWyciwygChannel_h___
 
 #include "nsString.h"
 #include "nsCOMPtr.h"
 
 #include "nsIWyciwygChannel.h"
 #include "nsIStreamListener.h"
-#include "nsICacheListener.h"
+#include "nsICacheEntryOpenCallback.h"
 #include "PrivateBrowsingChannel.h"
 
-class nsICacheEntryDescriptor;
+class nsICacheEntry;
 class nsIEventTarget;
 class nsIInputStream;
 class nsIInputStreamPump;
 class nsILoadGroup;
 class nsIOutputStream;
 class nsIProgressEventSink;
 class nsIURI;
 
 extern PRLogModuleInfo * gWyciwygLog;
 
 //-----------------------------------------------------------------------------
 
 class nsWyciwygChannel: public nsIWyciwygChannel,
                         public nsIStreamListener,
-                        public nsICacheListener,
+                        public nsICacheEntryOpenCallback,
                         public mozilla::net::PrivateBrowsingChannel<nsWyciwygChannel>
 {
 public:
     NS_DECL_THREADSAFE_ISUPPORTS
     NS_DECL_NSIREQUEST
     NS_DECL_NSICHANNEL
     NS_DECL_NSIWYCIWYGCHANNEL
     NS_DECL_NSIREQUESTOBSERVER
     NS_DECL_NSISTREAMLISTENER
-    NS_DECL_NSICACHELISTENER
+    NS_DECL_NSICACHEENTRYOPENCALLBACK
 
     friend class nsWyciwygSetCharsetandSourceEvent;
     friend class nsWyciwygWriteEvent;
     friend class nsWyciwygCloseEvent;
 
     // nsWyciwygChannel methods:
     nsWyciwygChannel();
     virtual ~nsWyciwygChannel();
 
     nsresult Init(nsIURI *uri);
 
 protected:
-    nsresult WriteToCacheEntryInternal(const nsAString& aData, const nsACString& spec);
+    nsresult WriteToCacheEntryInternal(const nsAString& aData);
     void SetCharsetAndSourceInternal();
     nsresult CloseCacheEntryInternal(nsresult reason);
 
     nsresult ReadFromCache();
-    nsresult OpenCacheEntry(const nsACString & aCacheKey, nsCacheAccessMode aWriteAccess);
+    nsresult OpenCacheEntry(nsIURI *aURI, uint32_t aOpenFlags);
 
     void WriteCharsetAndSourceToCache(int32_t aSource,
                                       const nsCString& aCharset);
 
     void NotifyListener();
     bool IsOnCacheIOThread();
 
     friend class mozilla::net::PrivateBrowsingChannel<nsWyciwygChannel>;
 
+    enum EMode {
+      NONE,
+      WRITING,
+      READING
+    };
+
+    EMode                               mMode;
     nsresult                            mStatus;
     bool                                mIsPending;
     bool                                mCharsetAndSourceSet;
     bool                                mNeedToWriteCharset;
     int32_t                             mCharsetSource;
     nsCString                           mCharset;
     int64_t                             mContentLength;
     uint32_t                            mLoadFlags;
@@ -86,17 +93,17 @@ protected:
     nsCOMPtr<nsILoadGroup>              mLoadGroup;
     nsCOMPtr<nsIStreamListener>         mListener;
     nsCOMPtr<nsISupports>               mListenerContext;
 
     // reuse as much of this channel implementation as we can
     nsCOMPtr<nsIInputStreamPump>        mPump;
     
     // Cache related stuff    
-    nsCOMPtr<nsICacheEntryDescriptor>   mCacheEntry;
+    nsCOMPtr<nsICacheEntry>             mCacheEntry;
     nsCOMPtr<nsIOutputStream>           mCacheOutputStream;
     nsCOMPtr<nsIInputStream>            mCacheInputStream;
     nsCOMPtr<nsIEventTarget>            mCacheIOTarget;
 
     nsCOMPtr<nsISupports>               mSecurityInfo;
 };
 
 #endif /* nsWyciwygChannel_h___ */
--- a/netwerk/protocol/wyciwyg/nsWyciwygProtocolHandler.cpp
+++ b/netwerk/protocol/wyciwyg/nsWyciwygProtocolHandler.cpp
@@ -8,18 +8,16 @@
 #include "nsWyciwygChannel.h"
 #include "nsWyciwygProtocolHandler.h"
 #include "nsNetCID.h"
 #include "nsServiceManagerUtils.h"
 #include "plstr.h"
 #include "nsNetUtil.h"
 #include "nsIObserverService.h"
 #include "mozIApplicationClearPrivateDataParams.h"
-#include "nsICacheService.h"
-#include "nsICacheSession.h"
 
 #include "mozilla/net/NeckoChild.h"
 
 using namespace mozilla::net;
 #include "mozilla/net/WyciwygChannelChild.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -33,37 +31,16 @@ nsWyciwygProtocolHandler::nsWyciwygProto
   LOG(("Creating nsWyciwygProtocolHandler [this=%p].\n", this));
 }
 
 nsWyciwygProtocolHandler::~nsWyciwygProtocolHandler() 
 {
   LOG(("Deleting nsWyciwygProtocolHandler [this=%p]\n", this));
 }
 
-void
-nsWyciwygProtocolHandler::GetCacheSessionName(uint32_t aAppId,
-                                              bool aInBrowser,
-                                              bool aPrivateBrowsing,
-                                              nsACString& aSessionName)
-{
-  if (aPrivateBrowsing) {
-    aSessionName.AssignLiteral("wyciwyg-private");
-  } else {
-    aSessionName.AssignLiteral("wyciwyg");
-  }
-  if (aAppId == NECKO_NO_APP_ID && !aInBrowser) {
-    return;
-  }
-
-  aSessionName.Append('~');
-  aSessionName.AppendInt(aAppId);
-  aSessionName.Append('~');
-  aSessionName.AppendInt(aInBrowser);
-}
-
 NS_IMPL_ISUPPORTS1(nsWyciwygProtocolHandler,
                    nsIProtocolHandler)
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsIProtocolHandler methods:
 ////////////////////////////////////////////////////////////////////////////////
 
 NS_IMETHODIMP
--- a/netwerk/protocol/wyciwyg/nsWyciwygProtocolHandler.h
+++ b/netwerk/protocol/wyciwyg/nsWyciwygProtocolHandler.h
@@ -12,18 +12,11 @@
 class nsWyciwygProtocolHandler : public nsIProtocolHandler
 {
 public:
     NS_DECL_ISUPPORTS
     NS_DECL_NSIPROTOCOLHANDLER
 
     nsWyciwygProtocolHandler();
     virtual ~nsWyciwygProtocolHandler();
-
-    nsresult Init();
-
-    static void GetCacheSessionName(uint32_t aAppId,
-                                    bool aInBrowser,
-                                    bool aPrivateBrowsing,
-                                    nsACString& aSessionName);
 };
 
 #endif /* nsWyciwygProtocolHandler_h___ */
--- a/testing/marionette/client/marionette/runner/mixins/reporting.py
+++ b/testing/marionette/client/marionette/runner/mixins/reporting.py
@@ -5,18 +5,18 @@
 import base64
 import cgi
 import datetime
 import json
 import os
 import pkg_resources
 import sys
 
-from py.xml import html
-from py.xml import raw
+from xmlgen import html
+from xmlgen import raw
 
 
 class HTMLReportingTestRunnerMixin(object):
 
     def __init__(self, name=None, version=None, html_output=None, **kwargs):
         """
         Name should be the name of the name of the testrunner, version should correspond
         to the testrunner version.
@@ -36,42 +36,43 @@ class HTMLReportingTestRunnerMixin(objec
             sys.setdefaultencoding('utf-8')
             html_dir = os.path.dirname(os.path.abspath(self.html_output))
             if not os.path.exists(html_dir):
                 os.makedirs(html_dir)
             with open(self.html_output, 'w') as f:
                 f.write(self.generate_html(self.results))
 
     def generate_html(self, results_list):
-
         tests = sum([results.testsRun for results in results_list])
         failures = sum([len(results.failures) for results in results_list])
         expected_failures = sum([len(results.expectedFailures) for results in results_list])
         skips = sum([len(results.skipped) for results in results_list])
         errors = sum([len(results.errors) for results in results_list])
         passes = sum([results.passed for results in results_list])
         unexpected_passes = sum([len(results.unexpectedSuccesses) for results in results_list])
         test_time = self.elapsedtime.total_seconds()
         test_logs = []
 
-        def _extract_html(test, class_name, duration=0, text='', result='passed', debug=None):
-            cls_name = class_name
-            tc_name = unicode(test)
-            tc_time = duration
+        def _extract_html(test):
             additional_html = []
-            debug = debug or {}
             links_html = []
 
-            if result in ['skipped', 'failure', 'expected failure', 'error']:
-                if debug.get('screenshot'):
-                    screenshot = 'data:image/png;base64,%s' % debug['screenshot']
+            result_map = {
+                'KNOWN-FAIL': 'expected failure',
+                'PASS': 'passed',
+                'UNEXPECTED-FAIL': 'failure',
+                'UNEXPECTED-PASS': 'unexpected pass'}
+
+            if test.result in ['SKIPPED', 'UNEXPECTED-FAIL', 'KNOWN-FAIL', 'ERROR']:
+                if test.debug.get('screenshot'):
+                    screenshot = 'data:image/png;base64,%s' % test.debug['screenshot']
                     additional_html.append(html.div(
                         html.a(html.img(src=screenshot), href="#"),
                         class_='screenshot'))
-                for name, content in debug.items():
+                for name, content in test.debug.items():
                     try:
                         if 'screenshot' in name:
                             href = '#'
                         else:
                             # use base64 to avoid that some browser (such as Firefox, Opera)
                             # treats '#' as the start of another link if the data URL contains.
                             # use 'charset=utf-8' to show special characters like Chinese.
                             href = 'data:text/plain;charset=utf-8;base64,%s' % base64.b64encode(content)
@@ -80,50 +81,39 @@ class HTMLReportingTestRunnerMixin(objec
                             class_=name,
                             href=href,
                             target='_blank'))
                         links_html.append(' ')
                     except:
                         pass
 
                 log = html.div(class_='log')
-                for line in text.splitlines():
+                for line in '\n'.join(test.output).splitlines():
                     separator = line.startswith(' ' * 10)
                     if separator:
                         log.append(line[:80])
                     else:
                         if line.lower().find("error") != -1 or line.lower().find("exception") != -1:
                             log.append(html.span(raw(cgi.escape(line)), class_='error'))
                         else:
                             log.append(raw(cgi.escape(line)))
                     log.append(html.br())
                 additional_html.append(log)
 
             test_logs.append(html.tr([
-                html.td(result.title(), class_='col-result'),
-                html.td(cls_name, class_='col-class'),
-                html.td(tc_name, class_='col-name'),
-                html.td(tc_time, class_='col-duration'),
+                html.td(result_map.get(test.result, test.result).title(), class_='col-result'),
+                html.td(test.test_class, class_='col-class'),
+                html.td(unicode(test.name), class_='col-name'),
+                html.td(int(test.duration), class_='col-duration'),
                 html.td(links_html, class_='col-links'),
                 html.td(additional_html, class_='debug')],
-                class_=result.lower() + ' results-table-row'))
+                class_=result_map.get(test.result, test.result).lower() + ' results-table-row'))
 
         for results in results_list:
-            for test in results.tests_passed:
-                _extract_html(test.name, test.test_class)
-            for result in results.skipped:
-                _extract_html(result.name, result.test_class, text='\n'.join(result.output), result='skipped')
-            for result in results.failures:
-                _extract_html(result.name, result.test_class, text='\n'.join(result.output), result='failure', debug=result.debug)
-            for result in results.expectedFailures:
-                _extract_html(result.name, result.test_class, text='\n'.join(result.output), result='expected failure', debug=result.debug)
-            for test in results.unexpectedSuccesses:
-                _extract_html(test.name, test.test_class, result='unexpected pass')
-            for result in results.errors:
-                _extract_html(result.name, result.test_class, text='\n'.join(result.output), result='error', debug=result.debug)
+            [_extract_html(test) for test in results.tests]
 
         generated = datetime.datetime.now()
         doc = html.html(
             html.head(
                 html.meta(charset='utf-8'),
                 html.title('Test Report'),
                 #TODO: must redisgn this to use marionette's resourcs, instead of the caller folder's
                 html.style(raw(pkg_resources.resource_string(
new file mode 100644
--- /dev/null
+++ b/testing/marionette/client/marionette/runner/mixins/xmlgen.py
@@ -0,0 +1,267 @@
+"""
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+ 
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+This file is originally from: https://bitbucket.org/hpk42/py, specifically:
+https://bitbucket.org/hpk42/py/src/980c8d526463958ee7cae678a7e4e9b054f36b94/py/_xmlgen.py?at=default
+by holger krekel, holger at merlinux eu. 2009
+"""
+import sys, re
+
+if sys.version_info >= (3,0):
+    def u(s):
+        return s
+    def unicode(x):
+        if hasattr(x, '__unicode__'):
+            return x.__unicode__()
+        return str(x)
+else:
+    def u(s):
+        return unicode(s)
+    unicode = unicode
+
+
+class NamespaceMetaclass(type):
+    def __getattr__(self, name):
+        if name[:1] == '_':
+            raise AttributeError(name)
+        if self == Namespace:
+            raise ValueError("Namespace class is abstract")
+        tagspec = self.__tagspec__
+        if tagspec is not None and name not in tagspec:
+            raise AttributeError(name)
+        classattr = {}
+        if self.__stickyname__:
+            classattr['xmlname'] = name
+        cls = type(name, (self.__tagclass__,), classattr)
+        setattr(self, name, cls)
+        return cls
+
+class Tag(list):
+    class Attr(object):
+        def __init__(self, **kwargs):
+            self.__dict__.update(kwargs)
+
+    def __init__(self, *args, **kwargs):
+        super(Tag, self).__init__(args)
+        self.attr = self.Attr(**kwargs)
+
+    def __unicode__(self):
+        return self.unicode(indent=0)
+    __str__ = __unicode__
+
+    def unicode(self, indent=2):
+        l = []
+        SimpleUnicodeVisitor(l.append, indent).visit(self)
+        return u("").join(l)
+
+    def __repr__(self):
+        name = self.__class__.__name__
+        return "<%r tag object %d>" % (name, id(self))
+
+Namespace = NamespaceMetaclass('Namespace', (object, ), {
+    '__tagspec__': None,
+    '__tagclass__': Tag,
+    '__stickyname__': False,
+})
+
+class HtmlTag(Tag):
+    def unicode(self, indent=2):
+        l = []
+        HtmlVisitor(l.append, indent, shortempty=False).visit(self)
+        return u("").join(l)
+
+# exported plain html namespace
+class html(Namespace):
+    __tagclass__ = HtmlTag
+    __stickyname__ = True
+    __tagspec__ = dict([(x,1) for x in (
+        'a,abbr,acronym,address,applet,area,b,bdo,big,blink,'
+        'blockquote,body,br,button,caption,center,cite,code,col,'
+        'colgroup,comment,dd,del,dfn,dir,div,dl,dt,em,embed,'
+        'fieldset,font,form,frameset,h1,h2,h3,h4,h5,h6,head,html,'
+        'i,iframe,img,input,ins,kbd,label,legend,li,link,listing,'
+        'map,marquee,menu,meta,multicol,nobr,noembed,noframes,'
+        'noscript,object,ol,optgroup,option,p,pre,q,s,script,'
+        'select,small,span,strike,strong,style,sub,sup,table,'
+        'tbody,td,textarea,tfoot,th,thead,title,tr,tt,u,ul,xmp,'
+        'base,basefont,frame,hr,isindex,param,samp,var'
+    ).split(',') if x])
+
+    class Style(object):
+        def __init__(self, **kw):
+            for x, y in kw.items():
+                x = x.replace('_', '-')
+                setattr(self, x, y)
+
+
+class raw(object):
+    """just a box that can contain a unicode string that will be
+    included directly in the output"""
+    def __init__(self, uniobj):
+        self.uniobj = uniobj
+
+class SimpleUnicodeVisitor(object):
+    """ recursive visitor to write unicode. """
+    def __init__(self, write, indent=0, curindent=0, shortempty=True):
+        self.write = write
+        self.cache = {}
+        self.visited = {} # for detection of recursion
+        self.indent = indent
+        self.curindent = curindent
+        self.parents = []
+        self.shortempty = shortempty  # short empty tags or not
+
+    def visit(self, node):
+        """ dispatcher on node's class/bases name. """
+        cls = node.__class__
+        try:
+            visitmethod = self.cache[cls]
+        except KeyError:
+            for subclass in cls.__mro__:
+                visitmethod = getattr(self, subclass.__name__, None)
+                if visitmethod is not None:
+                    break
+            else:
+                visitmethod = self.__object
+            self.cache[cls] = visitmethod
+        visitmethod(node)
+
+    # the default fallback handler is marked private
+    # to avoid clashes with the tag name object
+    def __object(self, obj):
+        #self.write(obj)
+        self.write(escape(unicode(obj)))
+
+    def raw(self, obj):
+        self.write(obj.uniobj)
+
+    def list(self, obj):
+        assert id(obj) not in self.visited
+        self.visited[id(obj)] = 1
+        for elem in obj:
+            self.visit(elem)
+
+    def Tag(self, tag):
+        assert id(tag) not in self.visited
+        try:
+            tag.parent = self.parents[-1]
+        except IndexError:
+            tag.parent = None
+        self.visited[id(tag)] = 1
+        tagname = getattr(tag, 'xmlname', tag.__class__.__name__)
+        if self.curindent and not self._isinline(tagname):
+            self.write("\n" + u(' ') * self.curindent)
+        if tag:
+            self.curindent += self.indent
+            self.write(u('<%s%s>') % (tagname, self.attributes(tag)))
+            self.parents.append(tag)
+            for x in tag:
+                self.visit(x)
+            self.parents.pop()
+            self.write(u('</%s>') % tagname)
+            self.curindent -= self.indent
+        else:
+            nameattr = tagname+self.attributes(tag)
+            if self._issingleton(tagname):
+                self.write(u('<%s/>') % (nameattr,))
+            else:
+                self.write(u('<%s></%s>') % (nameattr, tagname))
+
+    def attributes(self, tag):
+        # serialize attributes
+        attrlist = dir(tag.attr)
+        attrlist.sort()
+        l = []
+        for name in attrlist:
+            res = self.repr_attribute(tag.attr, name)
+            if res is not None:
+                l.append(res)
+        l.extend(self.getstyle(tag))
+        return u("").join(l)
+
+    def repr_attribute(self, attrs, name):
+        if name[:2] != '__':
+            value = getattr(attrs, name)
+            if name.endswith('_'):
+                name = name[:-1]
+            if isinstance(value, raw):
+                insert = value.uniobj
+            else:
+                insert = escape(unicode(value))
+            return ' %s="%s"' % (name, insert)
+
+    def getstyle(self, tag):
+        """ return attribute list suitable for styling. """
+        try:
+            styledict = tag.style.__dict__
+        except AttributeError:
+            return []
+        else:
+            stylelist = [x+': ' + y for x,y in styledict.items()]
+            return [u(' style="%s"') % u('; ').join(stylelist)]
+
+    def _issingleton(self, tagname):
+        """can (and will) be overridden in subclasses"""
+        return self.shortempty
+
+    def _isinline(self, tagname):
+        """can (and will) be overridden in subclasses"""
+        return False
+
+class HtmlVisitor(SimpleUnicodeVisitor):
+
+    single = dict([(x, 1) for x in
+                ('br,img,area,param,col,hr,meta,link,base,'
+                    'input,frame').split(',')])
+    inline = dict([(x, 1) for x in
+                ('a abbr acronym b basefont bdo big br cite code dfn em font '
+                 'i img input kbd label q s samp select small span strike '
+                 'strong sub sup textarea tt u var'.split(' '))])
+
+    def repr_attribute(self, attrs, name):
+        if name == 'class_':
+            value = getattr(attrs, name)
+            if value is None:
+                return
+        return super(HtmlVisitor, self).repr_attribute(attrs, name)
+
+    def _issingleton(self, tagname):
+        return tagname in self.single
+
+    def _isinline(self, tagname):
+        return tagname in self.inline
+
+
+class _escape:
+    def __init__(self):
+        self.escape = {
+            u('"') : u('&quot;'), u('<') : u('&lt;'), u('>') : u('&gt;'),
+            u('&') : u('&amp;'), u("'") : u('&apos;'),
+            }
+        self.charef_rex = re.compile(u("|").join(self.escape.keys()))
+
+    def _replacer(self, match):
+        return self.escape[match.group(0)]
+
+    def __call__(self, ustring):
+        """ xml-escape the given unicode string. """
+        ustring = unicode(ustring)
+        return self.charef_rex.sub(self._replacer, ustring)
+
+escape = _escape()
--- a/testing/marionette/client/marionette/tests/unit/test_click.py
+++ b/testing/marionette/client/marionette/tests/unit/test_click.py
@@ -1,29 +1,25 @@
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-import time
+from by import By
+from errors import NoSuchElementException
 from marionette_test import MarionetteTestCase
-from by import By
+from wait import Wait
 
 
 class TestClick(MarionetteTestCase):
     def test_click(self):
         test_html = self.marionette.absolute_url("test.html")
         self.marionette.navigate(test_html)
         link = self.marionette.find_element(By.ID, "mozLink")
         link.click()
         self.assertEqual("Clicked", self.marionette.execute_script("return document.getElementById('mozLink').innerHTML;"))
 
     def testClickingALinkMadeUpOfNumbersIsHandledCorrectly(self):
         test_html = self.marionette.absolute_url("clicks.html")
         self.marionette.navigate(test_html)
         self.marionette.find_element(By.LINK_TEXT, "333333").click()
-        count = 0
-        while len(self.marionette.find_elements(By.ID, "username")) == 0:
-            count += 1
-            time.sleep(1)
-            if count == 30:
-                self.fail("Element id=username not found after 30 seconds")
-
+        Wait(self.marionette, timeout=30, ignored_exceptions=NoSuchElementException).until(
+            lambda m: m.find_element(By.ID, 'username'))
         self.assertEqual(self.marionette.title, "XHTML Test Page")
--- a/testing/marionette/client/marionette/tests/unit/test_submit.py
+++ b/testing/marionette/client/marionette/tests/unit/test_submit.py
@@ -1,38 +1,33 @@
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-import time
+from by import By
+from errors import NoSuchElementException
 from marionette_test import MarionetteTestCase
-from errors import NoSuchElementException
+from wait import Wait
 
 
 class TestSubmit(MarionetteTestCase):
 
     def test_should_be_able_to_submit_forms(self):
         test_html = self.marionette.absolute_url("formPage.html")
         self.marionette.navigate(test_html)
-        self.marionette.find_element("name", "login").submit()
+        self.marionette.find_element(By.NAME, "login").submit()
         self.assertEqual(self.marionette.title, "We Arrive Here")
 
     def test_should_submit_a_form_when_any_input_element_within_that_form_is_submitted(self):
         test_html = self.marionette.absolute_url("formPage.html")
         self.marionette.navigate(test_html)
-        self.marionette.find_element("id", "checky").submit()
-        for i in range(5):
-            try:
-                self.marionette.find_element('id', 'email')
-            except NoSuchElementException:
-                time.sleep(1)
+        self.marionette.find_element(By.ID, "checky").submit()
+        Wait(self.marionette, ignored_exceptions=NoSuchElementException).until(
+            lambda m: m.find_element(By.ID, 'email'))
         self.assertEqual(self.marionette.title, "We Arrive Here")
 
     def test_should_submit_a_form_when_any_element_wihin_that_form_is_submitted(self):
         test_html = self.marionette.absolute_url("formPage.html")
         self.marionette.navigate(test_html)
-        self.marionette.find_element("xpath", "//form/p").submit()
-        for i in range(5):
-            try:
-                self.marionette.find_element('id', 'email')
-            except NoSuchElementException:
-                time.sleep(1)
+        self.marionette.find_element(By.XPATH, "//form/p").submit()
+        Wait(self.marionette, ignored_exceptions=NoSuchElementException).until(
+            lambda m: m.find_element(By.ID, 'email'))
         self.assertEqual(self.marionette.title, "We Arrive Here")
--- a/testing/marionette/client/marionette/tests/unit/test_window_switching.py
+++ b/testing/marionette/client/marionette/tests/unit/test_window_switching.py
@@ -1,15 +1,17 @@
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this file,
 # You can obtain one at http://mozilla.org/MPL/2.0/.
 
-import os
-import time
+from by import By
+from errors import NoSuchElementException
 from marionette_test import MarionetteTestCase
+from wait import Wait
+
 
 class TestWindowSwitching(MarionetteTestCase):
     def testJSWindowCreationAndSwitching(self):
         test_html = self.marionette.absolute_url("test_windows.html")
         self.marionette.navigate(test_html)
 
         self.current_window = self.marionette.current_window_handle
         link = self.marionette.find_element("link text", "Open new window")
@@ -26,23 +28,18 @@ class TestWindowSwitching(MarionetteTest
 
         #ensure navigate works in our current window
         other_page = self.marionette.absolute_url("test.html")
         self.marionette.navigate(other_page)
         other_window = self.marionette.current_window_handle
 
         #try to access its dom
         #since Bug 720714 stops us from checking DOMContentLoaded, we wait a bit
-        for i in range(30):
-            try:
-                self.marionette.find_element("id", "mozLink")
-                break
-            except:
-                pass
-            time.sleep(1)
+        Wait(self.marionette, timeout=30, ignored_exceptions=NoSuchElementException).until(
+            lambda m: m.find_element(By.ID, 'mozLink'))
 
         self.assertEqual(other_window, self.marionette.current_window_handle)
         self.marionette.switch_to_window(self.current_window)
         self.assertEqual(self.current_window, self.marionette.current_window_handle)
 
     def tearDown(self):
         window_handles = self.marionette.window_handles
         window_handles.remove(self.current_window)
--- a/testing/marionette/client/setup.py
+++ b/testing/marionette/client/setup.py
@@ -1,26 +1,26 @@
 import os
 from setuptools import setup, find_packages
 
-version = '0.7.1'
+version = '0.7.2'
 
 # get documentation from the README
 try:
     here = os.path.dirname(os.path.abspath(__file__))
     description = file(os.path.join(here, 'README.md')).read()
 except (OSError, IOError):
     description = ''
 
 # dependencies
 deps = ['manifestdestiny', 'mozhttpd >= 0.5',
         'mozprocess >= 0.9', 'mozrunner >= 5.15',
         'mozdevice >= 0.22', 'moznetwork >= 0.21',
         'mozcrash >= 0.5', 'mozprofile >= 0.7',
-        'moztest >= 0.1', 'py==1.4.14']
+        'moztest >= 0.1']
 
 setup(name='marionette_client',
       version=version,
       description="Marionette test automation client",
       long_description=description,
       classifiers=[], # Get strings from http://pypi.python.org/pypi?%3Aaction=list_classifiers
       keywords='mozilla',
       author='Jonathan Griffin',
--- a/toolkit/components/aboutmemory/tests/test_memoryReporters.xul
+++ b/toolkit/components/aboutmemory/tests/test_memoryReporters.xul
@@ -197,12 +197,146 @@
   ok(present.images,                      "images is present");
   ok(present.xptiWorkingSet,              "xpti-working-set is present");
   ok(present.atomTable,                   "atom-table is present");
   ok(present.sandboxLocation,             "sandbox locations are present");
   ok(present.bigString,                   "large string is present");
   ok(present.smallString1,                "small string 1 is present");
   ok(present.smallString2,                "small string 2 is present");
 
+
+  // Reporter registration tests
+
+  // collectReports() calls to the test reporter.
+  let called = 0;
+
+  // The test memory reporter, testing the various report units.
+  // Also acts as a report collector, verifying the reported values match the
+  // expected ones after passing through XPConnect / nsMemoryReporterManager
+  // and back.
+  function MemoryReporterAndCallback() {
+    this.seen = 0;
+  }
+  MemoryReporterAndCallback.prototype = {
+    // The test reports.
+    // Each test key corresponds to the path of the report.  |amount| is a
+    // function called when generating the report.  |expected| is a function
+    // to be tested when receiving a report during collection.  If |expected| is
+    // omitted the |amount| will be checked instead.
+    tests: {
+      "test-memory-reporter-bytes1": {
+        units: BYTES,
+        amount: () => 0
+      },
+      "test-memory-reporter-bytes2": {
+        units: BYTES,
+        amount: () => (1<<30) * 8 // awkward way to say 8G in JS
+      },
+      "test-memory-reporter-counter": {
+        units: COUNT,
+        amount: () => 2
+      },
+      "test-memory-reporter-ccounter": {
+        units: COUNT_CUMULATIVE,
+        amount: () => ++called,
+        expected: () => called
+      },
+      "test-memory-reporter-percentage": {
+        units: PERCENTAGE,
+        amount: () => 9999
+      }
+    },
+    // nsIMemoryReporter
+    collectReports: function(callback, data) {
+      for (let path of Object.keys(this.tests)) {
+        try {
+          let test = this.tests[path];
+          callback.callback(
+            "", // Process. Should be "" initially.
+            path,
+            OTHER,
+            test.units,
+            test.amount(),
+            "Test " + path + ".",
+            data);
+        }
+        catch (ex) {
+          ok(false, ex);
+        }
+      }
+    },
+    // nsIMemoryReporterCallback
+    callback: function(process, path, kind, units, amount, data) {
+      if (path in this.tests) {
+        this.seen++;
+        let test = this.tests[path];
+        ok(units === test.units, "Test reporter units match");
+        ok(amount === (test.expected || test.amount)(),
+           "Test reporter values match: " + amount);
+      }
+    },
+    // Checks that the callback has seen the expected number of reports, and
+    // resets the callback counter.
+    // @param expected  Optional.  Expected number of reports the callback
+    //                  should have processed.
+    finish: function(expected) {
+      if (expected === undefined) {
+        expected = Object.keys(this.tests).length;
+      }
+      is(expected, this.seen,
+         "Test reporter called the correct number of times: " + expected);
+      this.seen = 0;
+    }
+  };
+
+  // General memory reporter + registerStrongReporter tests.
+  function test_register_strong() {
+    let reporterAndCallback = new MemoryReporterAndCallback();
+    // Registration works.
+    mgr.registerStrongReporter(reporterAndCallback);
+
+    // Check the generated reports.
+    mgr.getReportsForThisProcess(reporterAndCallback, null);
+    reporterAndCallback.finish();
+
+    // Unregistration works.
+    mgr.unregisterStrongReporter(reporterAndCallback);
+
+    // The reporter was unregistered, hence there shouldn't be any reports from
+    // the test reporter.
+    mgr.getReportsForThisProcess(reporterAndCallback, null);
+    reporterAndCallback.finish(0);
+  }
+
+  test_register_strong();
+
+  // Check strong reporters a second time, to make sure a reporter can be
+  // re-registered.
+  test_register_strong();
+
+
+  // Check that you cannot register JS components as weak reporters.
+  function test_register_weak() {
+    let reporterAndCallback = new MemoryReporterAndCallback();
+    try {
+      // Should fail! nsMemoryReporterManager will only hold a raw pointer to
+      // "weak" reporters.  When registering a weak reporter, XPConnect will
+      // create a WrappedJS for JS components.  This WrappedJS would be
+      // successfully registered with the manager, only to be destroyed
+      // immediately after, which would eventually lead to a crash when
+      // collecting the reports.  Therefore nsMemoryReporterManager should
+      // reject WrappedJS reporters, which is what is tested here.
+      // See bug 950391 comment #0.
+      mgr.registerWeakReporter(reporterAndCallback);
+      ok(false, "Shouldn't be allowed to register a JS component (WrappedJS)");
+    }
+    catch (ex) {
+      ok(ex.message.indexOf("NS_ERROR_") >= 0,
+         "WrappedJS reporter got rejected: " + ex);
+    }
+  }
+
+  test_register_weak();
+
   ]]>
   </script>
 </window>
 
--- a/uriloader/prefetch/nsIOfflineCacheUpdate.idl
+++ b/uriloader/prefetch/nsIOfflineCacheUpdate.idl
@@ -4,17 +4,16 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsISupports.idl"
 
 interface nsIURI;
 interface nsIDOMWindow;
 interface nsIDOMNode;
 interface nsIDOMDocument;
-interface nsIDOMLoadStatus;
 interface nsIOfflineCacheUpdate;
 interface nsIPrincipal;
 interface nsIPrefBranch;
 interface nsIApplicationCache;
 interface nsIFile;
 interface nsIObserver;
 
 [scriptable, uuid(47360d57-8ef4-4a5d-8865-1a27a739ad1a)]
@@ -50,20 +49,16 @@ interface nsIOfflineCacheUpdateObserver 
 };
 
 /**
  * An nsIOfflineCacheUpdate is used to update an application's offline
  * resources.
  *
  * It can be used to perform partial or complete updates.
  *
- * Each update object maintains a list of nsIDOMLoadStatus items for the
- * resources it is updating.  The list of these items will be available
- * after the object is scheduled.
- *
  * One update object will be updating at a time.  The active object will
  * load its items one by one, sending itemCompleted() to any registered
  * observers.
  */
 [scriptable, uuid(a4503a53-6ab8-4b50-b01e-1c4f393fc980)]
 interface nsIOfflineCacheUpdate : nsISupports {
   /**
    * Fetch the status of the running update.  This will return a value
--- a/uriloader/prefetch/nsIPrefetchService.idl
+++ b/uriloader/prefetch/nsIPrefetchService.idl
@@ -21,15 +21,14 @@ interface nsIPrefetchService : nsISuppor
      * @param aExplicit the link element has an explicit prefetch link type
      */
     void prefetchURI(in nsIURI aURI,
                      in nsIURI aReferrerURI,
                      in nsIDOMNode aSource,
                      in boolean aExplicit);
 
     /**
-     * Enumerate the items in the prefetch queue.  Each element in the
-     * enumeration is an nsIDOMLoadStatus.
+     * Enumerate the items in the prefetch queue.
      */
     nsISimpleEnumerator enumerateQueue();
 
     // XXX do we need a way to cancel prefetch requests?
 };
--- a/uriloader/prefetch/nsOfflineCacheUpdate.cpp
+++ b/uriloader/prefetch/nsOfflineCacheUpdate.cpp
@@ -304,18 +304,17 @@ nsManifestCheck::AsyncOnChannelRedirect(
     aOldChannel->Cancel(NS_ERROR_ABORT);
     return NS_ERROR_ABORT;
 }
 
 //-----------------------------------------------------------------------------
 // nsOfflineCacheUpdateItem::nsISupports
 //-----------------------------------------------------------------------------
 
-NS_IMPL_ISUPPORTS6(nsOfflineCacheUpdateItem,
-                   nsIDOMLoadStatus,
+NS_IMPL_ISUPPORTS5(nsOfflineCacheUpdateItem,
                    nsIRequestObserver,
                    nsIStreamListener,
                    nsIRunnable,
                    nsIInterfaceRequestor,
                    nsIChannelEventSink)
 
 //-----------------------------------------------------------------------------
 // nsOfflineCacheUpdateItem <public>
@@ -327,17 +326,17 @@ nsOfflineCacheUpdateItem::nsOfflineCache
                                                    nsIApplicationCache *aPreviousApplicationCache,
                                                    uint32_t type)
     : mURI(aURI)
     , mReferrerURI(aReferrerURI)
     , mApplicationCache(aApplicationCache)
     , mPreviousApplicationCache(aPreviousApplicationCache)
     , mItemType(type)
     , mChannel(nullptr)
-    , mState(nsIDOMLoadStatus::UNINITIALIZED)
+    , mState(LoadStatus::UNINITIALIZED)
     , mBytesRead(0)
 {
 }
 
 nsOfflineCacheUpdateItem::~nsOfflineCacheUpdateItem()
 {
 }
 
@@ -404,43 +403,43 @@ nsOfflineCacheUpdateItem::OpenChannel(ns
                                       false);
     }
 
     rv = mChannel->AsyncOpen(this, nullptr);
     NS_ENSURE_SUCCESS(rv, rv);
 
     mUpdate = aUpdate;
 
-    mState = nsIDOMLoadStatus::REQUESTED;
+    mState = LoadStatus::REQUESTED;
 
     return NS_OK;
 }
 
 nsresult
 nsOfflineCacheUpdateItem::Cancel()
 {
     if (mChannel) {
         mChannel->Cancel(NS_ERROR_ABORT);
         mChannel = nullptr;
     }
 
-    mState = nsIDOMLoadStatus::UNINITIALIZED;
+    mState = LoadStatus::UNINITIALIZED;
 
     return NS_OK;
 }
 
 //-----------------------------------------------------------------------------
 // nsOfflineCacheUpdateItem::nsIStreamListener
 //-----------------------------------------------------------------------------
 
 NS_IMETHODIMP
 nsOfflineCacheUpdateItem::OnStartRequest(nsIRequest *aRequest,
                                          nsISupports *aContext)
 {
-    mState = nsIDOMLoadStatus::RECEIVING;
+    mState = LoadStatus::RECEIVING;
 
     return NS_OK;
 }
 
 NS_IMETHODIMP
 nsOfflineCacheUpdateItem::OnDataAvailable(nsIRequest *aRequest,
                                           nsISupports *aContext,
                                           nsIInputStream *aStream,
@@ -507,17 +506,17 @@ NS_IMETHODIMP
 nsOfflineCacheUpdateItem::Run()
 {
     // Set mState to LOADED here rather than in OnStopRequest to prevent
     // race condition when checking state of all mItems in ProcessNextURI().
     // If state would have been set in OnStopRequest we could mistakenly
     // take this item as already finished and finish the update process too
     // early when ProcessNextURI() would get called between OnStopRequest()
     // and Run() of this item.  Finish() would then have been called twice.
-    mState = nsIDOMLoadStatus::LOADED;
+    mState = LoadStatus::LOADED;
 
     nsRefPtr<nsOfflineCacheUpdate> update;
     update.swap(mUpdate);
     update->LoadCompleted(this);
 
     return NS_OK;
 }
 
@@ -586,67 +585,16 @@ nsOfflineCacheUpdateItem::AsyncOnChannel
                                   false);
 
     mChannel = aNewChannel;
 
     cb->OnRedirectVerifyCallback(NS_OK);
     return NS_OK;
 }
 
-//-----------------------------------------------------------------------------
-// nsOfflineCacheUpdateItem::nsIDOMLoadStatus
-//-----------------------------------------------------------------------------
-
-NS_IMETHODIMP
-nsOfflineCacheUpdateItem::GetSource(nsIDOMNode **aSource)
-{
-    *aSource = nullptr;
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-nsOfflineCacheUpdateItem::GetUri(nsAString &aURI)
-{
-    nsAutoCString spec;
-    nsresult rv = mURI->GetSpec(spec);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    CopyUTF8toUTF16(spec, aURI);
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-nsOfflineCacheUpdateItem::GetTotalSize(int32_t *aTotalSize)
-{
-    if (mChannel) {
-      int64_t size64;
-      nsresult rv = mChannel->GetContentLength(&size64);
-      NS_ENSURE_SUCCESS(rv, rv);
-      *aTotalSize = int32_t(size64); // XXX - loses precision
-      return NS_OK;
-    }
-
-    *aTotalSize = -1;
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-nsOfflineCacheUpdateItem::GetLoadedSize(int32_t *aLoadedSize)
-{
-    *aLoadedSize = int32_t(mBytesRead); // XXX - loses precision
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-nsOfflineCacheUpdateItem::GetReadyState(uint16_t *aReadyState)
-{
-    *aReadyState = mState;
-    return NS_OK;
-}
-
 nsresult
 nsOfflineCacheUpdateItem::GetRequestSucceeded(bool * succeeded)
 {
     *succeeded = false;
 
     if (!mChannel)
         return NS_OK;
 
@@ -676,33 +624,33 @@ nsOfflineCacheUpdateItem::GetRequestSucc
 
     *succeeded = true;
     return NS_OK;
 }
 
 bool
 nsOfflineCacheUpdateItem::IsScheduled()
 {
-    return mState == nsIDOMLoadStatus::UNINITIALIZED;
+    return mState == LoadStatus::UNINITIALIZED;
 }
 
 bool
 nsOfflineCacheUpdateItem::IsInProgress()
 {
-    return mState == nsIDOMLoadStatus::REQUESTED ||
-           mState == nsIDOMLoadStatus::RECEIVING;
+    return mState == LoadStatus::REQUESTED ||
+           mState == LoadStatus::RECEIVING;
 }
 
 bool
 nsOfflineCacheUpdateItem::IsCompleted()
 {
-    return mState == nsIDOMLoadStatus::LOADED;
+    return mState == LoadStatus::LOADED;
 }
 
-NS_IMETHODIMP
+nsresult
 nsOfflineCacheUpdateItem::GetStatus(uint16_t *aStatus)
 {
     if (!mChannel) {
         *aStatus = 0;
         return NS_OK;
     }
 
     nsresult rv;
--- a/uriloader/prefetch/nsOfflineCacheUpdate.h
+++ b/uriloader/prefetch/nsOfflineCacheUpdate.h
@@ -10,17 +10,16 @@
 
 #include "nsAutoPtr.h"
 #include "nsCOMArray.h"
 #include "nsCOMPtr.h"
 #include "nsICacheService.h"
 #include "nsIChannelEventSink.h"
 #include "nsIDOMDocument.h"
 #include "nsIDOMNode.h"
-#include "nsIDOMLoadStatus.h"
 #include "nsIInterfaceRequestor.h"
 #include "nsIMutableArray.h"
 #include "nsIObserver.h"
 #include "nsIObserverService.h"
 #include "nsIApplicationCache.h"
 #include "nsIRequestObserver.h"
 #include "nsIRunnable.h"
 #include "nsIStreamListener.h"
@@ -34,25 +33,23 @@
 #include "mozilla/Attributes.h"
 
 class nsOfflineCacheUpdate;
 
 class nsICacheEntryDescriptor;
 class nsIUTF8StringEnumerator;
 class nsILoadContext;
 
-class nsOfflineCacheUpdateItem : public nsIDOMLoadStatus
-                               , public nsIStreamListener
+class nsOfflineCacheUpdateItem : public nsIStreamListener
                                , public nsIRunnable
                                , public nsIInterfaceRequestor
                                , public nsIChannelEventSink
 {
 public:
     NS_DECL_ISUPPORTS
-    NS_DECL_NSIDOMLOADSTATUS
     NS_DECL_NSIREQUESTOBSERVER
     NS_DECL_NSISTREAMLISTENER
     NS_DECL_NSIRUNNABLE
     NS_DECL_NSIINTERFACEREQUESTOR
     NS_DECL_NSICHANNELEVENTSINK
 
     nsOfflineCacheUpdateItem(nsIURI *aURI,
                              nsIURI *aReferrerURI,
@@ -71,17 +68,26 @@ public:
     nsresult OpenChannel(nsOfflineCacheUpdate *aUpdate);
     nsresult Cancel();
     nsresult GetRequestSucceeded(bool * succeeded);
 
     bool IsInProgress();
     bool IsScheduled();
     bool IsCompleted();
 
+    nsresult GetStatus(uint16_t *aStatus);
+
 private:
+    enum LoadStatus MOZ_ENUM_TYPE(uint16_t) {
+      UNINITIALIZED = 0U,
+      REQUESTED = 1U,
+      RECEIVING = 2U,
+      LOADED = 3U
+    };
+
     nsRefPtr<nsOfflineCacheUpdate> mUpdate;
     nsCOMPtr<nsIChannel>           mChannel;
     uint16_t                       mState;
 
 protected:
     int64_t                        mBytesRead;
 };
 
--- a/uriloader/prefetch/nsPrefetchService.cpp
+++ b/uriloader/prefetch/nsPrefetchService.cpp
@@ -109,17 +109,17 @@ nsPrefetchQueueEnumerator::HasMoreElemen
     return NS_OK;
 }
 
 NS_IMETHODIMP
 nsPrefetchQueueEnumerator::GetNext(nsISupports **aItem)
 {
     if (!mCurrent) return NS_ERROR_FAILURE;
 
-    NS_ADDREF(*aItem = static_cast<nsIDOMLoadStatus*>(mCurrent.get()));
+    NS_ADDREF(*aItem = static_cast<nsIStreamListener*>(mCurrent.get()));
 
     Increment();
 
     return NS_OK;
 }
 
 //-----------------------------------------------------------------------------
 // nsPrefetchQueueEnumerator <private>
@@ -166,17 +166,16 @@ nsPrefetchNode::nsPrefetchNode(nsPrefetc
                                nsIURI *aURI,
                                nsIURI *aReferrerURI,
                                nsIDOMNode *aSource)
     : mNext(nullptr)
     , mURI(aURI)
     , mReferrerURI(aReferrerURI)
     , mService(aService)
     , mChannel(nullptr)
-    , mState(nsIDOMLoadStatus::UNINITIALIZED)
     , mBytesRead(0)
 {
     mSource = do_GetWeakReference(aSource);
 }
 
 nsresult
 nsPrefetchNode::OpenChannel()
 {
@@ -203,38 +202,33 @@ nsPrefetchNode::OpenChannel()
             NS_LITERAL_CSTRING("X-Moz"),
             NS_LITERAL_CSTRING("prefetch"),
             false);
     }
 
     rv = mChannel->AsyncOpen(this, nullptr);
     NS_ENSURE_SUCCESS(rv, rv);
 
-    mState = nsIDOMLoadStatus::REQUESTED;
-
     return NS_OK;
 }
 
 nsresult
 nsPrefetchNode::CancelChannel(nsresult error)
 {
     mChannel->Cancel(error);
     mChannel = nullptr;
 
-    mState = nsIDOMLoadStatus::UNINITIALIZED;
-
     return NS_OK;
 }
 
 //-----------------------------------------------------------------------------
 // nsPrefetchNode::nsISupports
 //-----------------------------------------------------------------------------
 
-NS_IMPL_ISUPPORTS6(nsPrefetchNode,
-                   nsIDOMLoadStatus,
+NS_IMPL_ISUPPORTS5(nsPrefetchNode,
                    nsIRequestObserver,
                    nsIStreamListener,
                    nsIInterfaceRequestor,
                    nsIChannelEventSink,
                    nsIRedirectResultListener)
 
 //-----------------------------------------------------------------------------
 // nsPrefetchNode::nsIStreamListener
@@ -275,18 +269,16 @@ nsPrefetchNode::OnStartRequest(nsIReques
     if (NS_SUCCEEDED(entryInfo->GetExpirationTime(&expTime))) {
         if (NowInSeconds() >= expTime) {
             LOG(("document cannot be reused from cache; "
                  "canceling prefetch\n"));
             return NS_BINDING_ABORTED;
         }
     }
 
-    mState = nsIDOMLoadStatus::RECEIVING;
-
     return NS_OK;
 }
 
 NS_IMETHODIMP
 nsPrefetchNode::OnDataAvailable(nsIRequest *aRequest,
                                 nsISupports *aContext,
                                 nsIInputStream *aStream,
                                 uint64_t aOffset,
@@ -302,18 +294,16 @@ nsPrefetchNode::OnDataAvailable(nsIReque
 
 NS_IMETHODIMP
 nsPrefetchNode::OnStopRequest(nsIRequest *aRequest,
                               nsISupports *aContext,
                               nsresult aStatus)
 {
     LOG(("done prefetching [status=%x]\n", aStatus));
 
-    mState = nsIDOMLoadStatus::LOADED;
-
     if (mBytesRead == 0 && aStatus == NS_OK) {
         // we didn't need to read (because LOAD_ONLY_IF_MODIFIED was
         // specified), but the object should report loadedSize as if it
         // did.
         mChannel->GetContentLength(&mBytesRead);
     }
 
     mService->NotifyLoadCompleted(this);
@@ -482,29 +472,29 @@ nsPrefetchService::ProcessNextURI()
 void
 nsPrefetchService::NotifyLoadRequested(nsPrefetchNode *node)
 {
     nsCOMPtr<nsIObserverService> observerService =
       mozilla::services::GetObserverService();
     if (!observerService)
       return;
 
-    observerService->NotifyObservers(static_cast<nsIDOMLoadStatus*>(node),
+    observerService->NotifyObservers(static_cast<nsIStreamListener*>(node),
                                      "prefetch-load-requested", nullptr);
 }
 
 void
 nsPrefetchService::NotifyLoadCompleted(nsPrefetchNode *node)
 {
     nsCOMPtr<nsIObserverService> observerService =
       mozilla::services::GetObserverService();
     if (!observerService)
       return;
 
-    observerService->NotifyObservers(static_cast<nsIDOMLoadStatus*>(node),
+    observerService->NotifyObservers(static_cast<nsIStreamListener*>(node),
                                      "prefetch-load-completed", nullptr);
 }
 
 //-----------------------------------------------------------------------------
 // nsPrefetchService <private>
 //-----------------------------------------------------------------------------
 
 void
@@ -761,94 +751,16 @@ nsPrefetchService::EnumerateQueue(nsISim
     if (!*aEnumerator) return NS_ERROR_OUT_OF_MEMORY;
 
     NS_ADDREF(*aEnumerator);
 
     return NS_OK;
 }
 
 //-----------------------------------------------------------------------------
-// nsPrefetchNode::nsIDOMLoadStatus
-//-----------------------------------------------------------------------------
-NS_IMETHODIMP
-nsPrefetchNode::GetSource(nsIDOMNode **aSource)
-{
-    *aSource = nullptr;
-    nsCOMPtr<nsIDOMNode> source = do_QueryReferent(mSource);
-    if (source)
-        source.swap(*aSource);
-
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-nsPrefetchNode::GetUri(nsAString &aURI)
-{
-    nsAutoCString spec;
-    nsresult rv = mURI->GetSpec(spec);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    CopyUTF8toUTF16(spec, aURI);
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-nsPrefetchNode::GetTotalSize(int32_t *aTotalSize)
-{
-    if (mChannel) {
-        int64_t size64;
-        nsresult rv = mChannel->GetContentLength(&size64);
-        NS_ENSURE_SUCCESS(rv, rv);
-        *aTotalSize = int32_t(size64); // XXX - loses precision
-        return NS_OK;
-    }
-
-    *aTotalSize = -1;
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-nsPrefetchNode::GetLoadedSize(int32_t *aLoadedSize)
-{
-    *aLoadedSize = int32_t(mBytesRead); // XXX - loses precision
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-nsPrefetchNode::GetReadyState(uint16_t *aReadyState)
-{
-    *aReadyState = mState;
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-nsPrefetchNode::GetStatus(uint16_t *aStatus)
-{
-    if (!mChannel) {
-        *aStatus = 0;
-        return NS_OK;
-    }
-
-    nsresult rv;
-    nsCOMPtr<nsIHttpChannel> httpChannel = do_QueryInterface(mChannel, &rv);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    uint32_t httpStatus;
-    rv = httpChannel->GetResponseStatus(&httpStatus);
-    if (rv == NS_ERROR_NOT_AVAILABLE) {
-        *aStatus = 0;
-        return NS_OK;
-    }
-
-    NS_ENSURE_SUCCESS(rv, rv);
-    *aStatus = uint16_t(httpStatus);
-    return NS_OK;
-}
-
-//-----------------------------------------------------------------------------
 // nsPrefetchService::nsIWebProgressListener
 //-----------------------------------------------------------------------------
 
 NS_IMETHODIMP
 nsPrefetchService::OnProgressChange(nsIWebProgress *aProgress,
                                   nsIRequest *aRequest, 
                                   int32_t curSelfProgress, 
                                   int32_t maxSelfProgress, 
--- a/uriloader/prefetch/nsPrefetchService.h
+++ b/uriloader/prefetch/nsPrefetchService.h
@@ -9,17 +9,16 @@
 #include "nsIObserver.h"
 #include "nsIInterfaceRequestor.h"
 #include "nsIChannelEventSink.h"
 #include "nsIRedirectResultListener.h"
 #include "nsIWebProgressListener.h"
 #include "nsIStreamListener.h"
 #include "nsIChannel.h"
 #include "nsIURI.h"
-#include "nsIDOMLoadStatus.h"
 #include "nsWeakReference.h"
 #include "nsCOMPtr.h"
 #include "nsAutoPtr.h"
 #include "mozilla/Attributes.h"
 
 class nsPrefetchService;
 class nsPrefetchListener;
 class nsPrefetchNode;
@@ -77,25 +76,23 @@ private:
     int32_t                           mHaveProcessed;
     bool                              mDisabled;
 };
 
 //-----------------------------------------------------------------------------
 // nsPrefetchNode
 //-----------------------------------------------------------------------------
 
-class nsPrefetchNode MOZ_FINAL : public nsIDOMLoadStatus
-                               , public nsIStreamListener
+class nsPrefetchNode MOZ_FINAL : public nsIStreamListener
                                , public nsIInterfaceRequestor
                                , public nsIChannelEventSink
                                , public nsIRedirectResultListener
 {
 public:
     NS_DECL_ISUPPORTS
-    NS_DECL_NSIDOMLOADSTATUS
     NS_DECL_NSIREQUESTOBSERVER
     NS_DECL_NSISTREAMLISTENER
     NS_DECL_NSIINTERFACEREQUESTOR
     NS_DECL_NSICHANNELEVENTSINK
     NS_DECL_NSIREDIRECTRESULTLISTENER
 
     nsPrefetchNode(nsPrefetchService *aPrefetchService,
                    nsIURI *aURI,
@@ -111,13 +108,12 @@ public:
     nsCOMPtr<nsIURI>            mURI;
     nsCOMPtr<nsIURI>            mReferrerURI;
     nsCOMPtr<nsIWeakReference>  mSource;
 
 private:
     nsRefPtr<nsPrefetchService> mService;
     nsCOMPtr<nsIChannel>        mChannel;
     nsCOMPtr<nsIChannel>        mRedirectChannel;
-    uint16_t                    mState;
     int64_t                     mBytesRead;
 };
 
 #endif // !nsPrefetchService_h__
--- a/xpcom/base/nsCycleCollector.cpp
+++ b/xpcom/base/nsCycleCollector.cpp
@@ -2967,16 +2967,17 @@ nsCycleCollector::ShutdownCollect()
 {
     SliceBudget unlimitedBudget;
     uint32_t i;
     for (i = 0; i < DEFAULT_SHUTDOWN_COLLECTIONS; ++i) {
         if (!Collect(ShutdownCC, unlimitedBudget, nullptr)) {
             break;
         }
     }
+    NS_ASSERTION(i < NORMAL_SHUTDOWN_COLLECTIONS, "Extra shutdown CC");
 }
 
 static void
 PrintPhase(const char *aPhase)
 {
 #ifdef DEBUG_PHASES
     printf("cc: begin %s on %s\n", aPhase,
            NS_IsMainThread() ? "mainthread" : "worker");
--- a/xpcom/base/nsIMemoryReporter.idl
+++ b/xpcom/base/nsIMemoryReporter.idl
@@ -174,37 +174,48 @@ interface nsIMemoryReporter : nsISupport
 };
 
 [scriptable, function, uuid(548b3909-c04d-4ca6-8466-b8bee3837457)]
 interface nsIFinishReportingCallback : nsISupports
 {
   void callback(in nsISupports data);
 };
 
-[scriptable, builtinclass, uuid(2b61d644-1520-420a-8f52-d06e615c1ff6)]
+[scriptable, builtinclass, uuid(e4e4ca56-13e0-46f1-b3c5-62d2c09fc98e)]
 interface nsIMemoryReporterManager : nsISupports
 {
   /*
    * Initialize.
    */
   void init();
 
   /*
    * Register the given nsIMemoryReporter.  The Manager service will hold a
    * strong reference to the given reporter, and will be responsible for freeing
-   * the reporter at shutdown.
+   * the reporter at shutdown.  You may manually unregister the reporter with
+   * unregisterStrongReporter() at any point.
    */
   void registerStrongReporter(in nsIMemoryReporter reporter);
 
   /*
    * Like registerReporter, but the Manager service will hold a weak reference
-   * to the given reporter.  The reporter should be unregistered before
+   * via a raw pointer to the given reporter.  The reporter should be
+   * unregistered before shutdown.
+   * You cannot register JavaScript components with this function!  Always
+   * register your JavaScript components with registerStrongReporter().
+   */
+  void registerWeakReporter(in nsIMemoryReporter reporter);
+
+  /*
+   * Unregister the given memory reporter, which must have been registered with
+   * registerStrongReporter().  You normally don't need to unregister your
+   * strong reporters, as nsIMemoryReporterManager will take care of that at
    * shutdown.
    */
-  void registerWeakReporter(in nsIMemoryReporter reporter);
+  void unregisterStrongReporter(in nsIMemoryReporter reporter);
 
   /*
    * Unregister the given memory reporter, which must have been registered with
    * registerWeakReporter().
    */
   void unregisterWeakReporter(in nsIMemoryReporter reporter);
 
   /*
--- a/xpcom/base/nsMemoryReporterManager.cpp
+++ b/xpcom/base/nsMemoryReporterManager.cpp
@@ -12,16 +12,17 @@
 #include "nsMemoryReporterManager.h"
 #include "nsISimpleEnumerator.h"
 #include "nsITimer.h"
 #include "nsThreadUtils.h"
 #include "nsIDOMWindow.h"
 #include "nsPIDOMWindow.h"
 #include "nsIObserverService.h"
 #include "nsIGlobalObject.h"
+#include "nsIXPConnect.h"
 #if defined(XP_LINUX) || defined(__FreeBSD__)
 #include "nsMemoryInfoDumper.h"
 #endif
 #include "mozilla/Attributes.h"
 #include "mozilla/PodOperations.h"
 #include "mozilla/Services.h"
 #include "mozilla/Telemetry.h"
 #include "mozilla/dom/PMemoryReportRequestParent.h" // for dom::MemoryReport
@@ -1276,16 +1277,26 @@ nsMemoryReporterManager::RegisterReporte
     // refcnt.
     //
     if (aStrong) {
         nsCOMPtr<nsIMemoryReporter> kungFuDeathGrip = aReporter;
         mStrongReporters->PutEntry(aReporter);
         CrashIfRefcountIsZero(aReporter);
     } else {
         CrashIfRefcountIsZero(aReporter);
+        nsCOMPtr<nsIXPConnectWrappedJS> jsComponent =
+            do_QueryInterface(aReporter);
+        if (jsComponent) {
+            // We cannot allow non-native reporters (WrappedJS), since we'll be
+            // holding onto a raw pointer, which would point to the wrapper,
+            // and that wrapper is likely to go away as soon as this register
+            // call finishes.  This would then lead to subsequent crashes in
+            // CollectReports().
+            return NS_ERROR_XPC_BAD_CONVERT_JS;
+        }
         mWeakReporters->PutEntry(aReporter);
     }
 
     return NS_OK;
 }
 
 NS_IMETHODIMP
 nsMemoryReporterManager::RegisterStrongReporter(nsIMemoryReporter* aReporter)
@@ -1305,16 +1316,32 @@ NS_IMETHODIMP
 nsMemoryReporterManager::RegisterStrongReporterEvenIfBlocked(
     nsIMemoryReporter* aReporter)
 {
     return RegisterReporterHelper(aReporter, /* force = */ true,
                                   /* strong = */ true);
 }
 
 NS_IMETHODIMP
+nsMemoryReporterManager::UnregisterStrongReporter(nsIMemoryReporter* aReporter)
+{
+    // This method is thread-safe.
+    mozilla::MutexAutoLock autoLock(mMutex);
+
+    MOZ_ASSERT(!mWeakReporters->Contains(aReporter));
+
+    if (mStrongReporters->Contains(aReporter)) {
+        mStrongReporters->RemoveEntry(aReporter);
+        return NS_OK;