Merge autoland to mozilla-central. a=merge
authorOana Pop Rus <opoprus@mozilla.com>
Tue, 07 May 2019 00:43:07 +0300
changeset 472727 e9f5f01d8b8ef297493a94e84186de210a4afccd
parent 472662 d5a6ca2d0e9d4b68fc1d316ab07d9f4e38a8f11e (current diff)
parent 472726 70b7703b8c13dc87f02693338eef29ea36bb3689 (diff)
child 472742 3c70f36ad62c9c714db3199fc00e60800ee82bde
push id35976
push useropoprus@mozilla.com
push dateMon, 06 May 2019 21:44:12 +0000
treeherdermozilla-central@e9f5f01d8b8e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmerge
milestone68.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Merge autoland to mozilla-central. a=merge
js/src/jit-test/tests/gc/bug-1215678.js
--- a/browser/app/blocklist.xml
+++ b/browser/app/blocklist.xml
@@ -1,10 +1,10 @@
 <?xml version='1.0' encoding='UTF-8'?>
-<blocklist lastupdate="1556794746654" xmlns="http://www.mozilla.org/2006/addons-blocklist">
+<blocklist lastupdate="1557087541924" xmlns="http://www.mozilla.org/2006/addons-blocklist">
   <emItems>
     <emItem blockID="i334" id="{0F827075-B026-42F3-885D-98981EE7B1AE}">
       <prefs/>
       <versionRange minVersion="0" maxVersion="*" severity="3"/>
     </emItem>
     <emItem blockID="i1211" id="flvto@hotger.com">
       <prefs/>
       <versionRange minVersion="0" maxVersion="*" severity="1"/>
@@ -2875,16 +2875,28 @@
     <emItem blockID="b0ff609b-c98e-4d29-8323-61c3e064ec9c" id="{a38141d9-ef67-4d4b-a9da-e3e4d0b7ba6a}">
       <prefs/>
       <versionRange minVersion="0" maxVersion="*" severity="3"/>
     </emItem>
     <emItem blockID="9efe3274-2bd2-44a3-aa7f-92934581470b" id="/^((premium-enhancer@ext\.com)|(notif-rm-unlisted@ext\.com)|(search-updater@ext\.com)|(updt-lite-unlisted@ext\.com)|(coldsearch@ext\.com)|(reader@ext\.com)|(local@ext\.com)|(fptool@ext\.com)|(gflash@ext\.com)|(advplayer@ext\.com)|(yfp@ext\.com)|(ytbenhancer@ext\.com)|(yoump@ext\.com)|(floating@ext\.com)|(ytbhelper@ext\.com))$/">
       <prefs/>
       <versionRange minVersion="0" maxVersion="*" severity="3"/>
     </emItem>
+    <emItem blockID="3f6acc8a-f46c-42cb-8220-48c2e5885bd3" id="{fc4c96b2-4eaa-4221-86a6-392dc1eb919a}">
+      <prefs/>
+      <versionRange minVersion="0" maxVersion="*" severity="3"/>
+    </emItem>
+    <emItem blockID="95cfb43b-72c3-4fb3-a0f2-fc975aff398d" id="{93d460ee-879f-4d8f-8599-a1c69ed59ec2}">
+      <prefs/>
+      <versionRange minVersion="0" maxVersion="*" severity="3"/>
+    </emItem>
+    <emItem blockID="654077f4-a8b3-4822-8962-0bb1cac1d70d" id="/^((\{7e4a75c1-dddc-4496-9963-1c6ac99cf226\})|(\{35af257d-14dd-4cd0-8ebd-2d30c2b30561\})|(\{d6362448-1e8f-47bf-9d2f-491648d18e3d\})|(\{80a42dcf-193e-43a2-b662-d6b14882403f\})|(\{044e39fc-333b-423c-8291-26078a780b02\})|(\{68b3c6ce-162f-4ece-9ffa-8279855a4228\})|(\{057b93a7-84e6-43ff-9686-d452435ed3c5\})|(\{1223cfa2-7aad-4a16-b98a-6bf63b346835\})|(\{9815ca8b-a77c-4e4d-beac-aad1c7021dcb\})|(\{e3f2795a-cefc-4f7f-9435-5f091b988d2f\})|(\{98fd0bd5-f486-4d81-9eb1-e89e9d56bfa2\})|(\{f96fafd2-5860-4bfa-9537-3f2ca9dd496e\})|(\{da93cdd9-6aca-410e-b2f2-e927da726559\})|(\{d97e0506-d330-4547-8a5c-093b8aa08d7a\})|(\{425ad6b3-72b8-43c0-be7c-2f6585fa0ec1\})|(\{0375f007-f5ba-46ec-86d2-c5da84576562\})|(\{e8915f55-6566-4872-97eb-d77fbdbf2fb3\})|(\{ebd3a0c4-bf9e-4dfa-b487-f77722055edb\})|(\{7cc62e47-ed20-45bc-8c92-bb57128e78d6\})|(\{b5a15631-6429-49bd-a670-e83ac41f93a9\})|(\{f263d545-3234-460f-b546-a8406a0a729d\})|(\{6468c148-9888-4243-8de5-cb6291cac82a\})|(\{da2281db-0036-46f6-8878-ff26e1cf6a2b\})|(\{63f579ba-eaf5-4e1a-a7c2-c5e889beaf9f\})|(\{84569fbb-d367-40ce-b24b-fd3b611283b8\})|(\{da2bc16f-b499-401b-8771-9d9f32d88f86\})|(\{1a275ad6-5dd3-47e9-a563-41a0bebdfd90\})|(\{e07ebf1e-5917-46a2-95d9-61d9b51f3797\})|(\{0d6791d2-ce0b-4f78-90e4-8e773703bd35\})|(\{502c7ef7-745c-4ea0-8066-a17cf1b74957\})|(\{c93f0aeb-ae9b-49d9-835b-c58a6b03aa46\})|(\{1f0bf2a4-aff5-42d3-8633-71e65f289250\})|(\{28766320-358e-42e3-a2c7-67ec77552424\})|(\{74d4fcda-c103-4fb7-810a-4596530c00a4\})|(\{7b3fd37a-a127-41a0-9e4d-59ccfa165e41\})|(\{787fa0b0-d5f1-4454-8b0c-72d191d6775f\})|(\{e2bae2ed-0368-48e7-8671-3bdcc5d7713f\})|(\{fee16fb4-830f-438a-a3d5-f7e911d23e02\})|(\{72113405-b4a5-46c3-a7c6-5353568b87bd\})|(\{5ede50a4-4151-4635-804f-a6f56115a0c6\})|(\{c11487a0-d104-4bc3-814b-474f8c29049c\})|(\{35690b6e-1979-4ea3-89aa-44a94dda2afa\})|(\{e9d698ef-bad4-4960-9df3-8c41605a6d7b\})|(\{1472b3c1-cae8-42c4-bbdf-e71134dccf08\})|(\{7a40b654-1232-4e76-81e7-d95260db25cd\})|(\{f54699c8-c82f-4d6e-a161-919bbe8410de\})|(\{dca6a5cd-0d24-442a-afd4-80572bb20c34\})|(\{b8d5d169-f076-4098-b671-a3cb8b410f56\})|(\{903e6561-0646-4c38-8039-d372d8e7c90a\})|(\{b39977b9-bcb2-448b-9d7b-9aec7f62bc26\})|(\{059b5c30-b96a-48df-8083-5fff97a8f9bf\})|(\{1d0351bb-1d96-4779-b639-44eeceb2ebfb\})|(\{80c0bdb4-ba98-472d-ae56-afd8b3021115\})|(\{4dfc5596-9655-4b0c-819d-e2ff48fb8556\})|(\{d7d3ed3c-6f73-42cb-b724-c33fccc1b465\})|(\{b378a858-89bb-492e-8b4d-eb83e910a14b\})|(\{ec1fa94c-8700-49d0-ba5d-df99a912519e\})|(\{4db5d249-881f-4442-8c01-28536c45ebfd\})|(\{7a411d82-fc50-4f20-bd2c-b2b065f18097\})|(\{675e002b-e144-4694-a725-9e8cc6a3fa67\})|(\{1902a069-c039-421e-b502-1e367c237196\})|(\{866bb3a8-82bb-4c9a-bca5-26fd5f37c4ec\})|(\{6a4e7017-43cd-4646-bb48-003620bb60fe\})|(\{bc5c676e-a75f-475b-a27c-79687b1de3ec\})|(\{6b544e1a-932d-4da9-aafe-c4b4bbfe1958\})|(\{99631434-ff1e-49d3-88d3-9ac40d0dd1bd\})|(\{623b31e0-f289-47cf-995e-5a195e261758\})|(\{1b4d88a5-4b5d-44c8-849c-82f129a7dacd\})|(\{48ba880a-b7c2-4e4e-af55-9134ac926c61\})|(\{4b498e2a-8b17-47c0-a449-89a76b6e737f\})|(\{d9cbd45f-cdbc-4be1-bb16-8e60764630ff\})|(\{bfaaa94a-1a93-4a1c-9b54-9dbe98f3ef07\})|(\{87b93e6e-70a6-4538-9848-e9d0f060e372\})|(\{fea4fd50-ed6a-4b8e-b00d-3b2276df6e34\})|(\{c15450f8-8da2-4add-a8f6-603d90e8d344\})|(\{ec972135-8e5c-49d4-bff8-b6006b21f2d2\})|(\{b039f24d-8b51-40d3-abf7-55e1dc502112\})|(\{b308870f-ae9a-4972-af28-0218717a47f4\})|(\{9349a202-8b8e-4777-ba93-c723810da51e\})|(\{798750dc-0057-47e0-a1af-73dec73544fa\})|(\{186e4b6a-e3f0-4970-8f7b-05ab6bc50320\})|(\{dec8de3e-d3a4-4946-bcbd-c3523fee11c5\})|(\{06539c62-00d3-4513-9aa4-048dd273107a\})|(\{b200a289-900a-4953-b2c6-b7a323d6fb66\})|(\{4080defb-6c6b-4012-bcac-71379e9c430f\})|(\{b110855c-90dd-427a-894c-54b93c6572b7\})|(\{dd599e99-3a48-4e36-9d83-56f8c0019d4d\})|(\{4f43f2c7-c1e6-4091-88fe-c829b3bfe553\})|(\{b7a022bc-6b89-4ac1-a1fa-bf02251336b0\})|(\{1aa370ca-9865-4c52-89a8-79e95abc82f7\})|(\{fb727d0f-7c3d-4bf6-8be4-284e7e8b8f83\})|(\{1579b5dd-ef3d-4754-bc59-8a7707fe1219\})|(\{66f0cb42-bb3e-4a16-90c1-bed1e3be4aad\})|(\{f13a1f79-f63a-4332-a9c9-11fc50328fc2\})|(\{29962f4d-bf74-4775-9d02-31fe546d6fa6\})|(\{aa539764-9ec3-41a6-af0e-6c2dc46ecbf5\})|(\{9412adf1-2714-4cb2-ad5b-13d41096234a\})|(\{86f2f4cc-97c5-4cc5-8151-c327ab379fba\})|(\{ed4c3ce2-5372-429c-ae20-fa5b1f540fd7\})|(\{cd11da28-330d-4f09-a21f-fae7509f1b60\})|(\{74bc7a66-d4e6-4f1c-a0ef-1b65baa41cbf\})|(\{8069effc-45bb-4caf-8b27-a135431cd6b9\})|(\{577fc233-25bf-4e43-a164-aa75eb9d053a\})|(\{f5626996-f5cd-4d00-bcea-20dda6d9edd6\})|(\{9bb810ef-716e-4dc5-9f03-491a2c59384e\})|(\{02634a24-04d0-439f-9faf-a323ab4a1bac\})|(\{b73f7a43-a43a-47f5-8b1f-1ef7caa7857d\})|(\{3b5bf07b-5964-408a-8e43-e0239219c524\})|(\{73d3a404-150f-4594-ac2c-24f9beec78b1\})|(\{ef6a2133-5ed9-4dbc-a735-6ffe8490062e\})|(\{76b61321-01a1-4a17-850f-b064a0366b57\})|(\{bc41ca18-9209-4500-a847-4e514fea2536\})|(\{32c4c845-9bd7-4b20-97fa-a7616e7802ef\})|(\{410d9002-b517-471f-956e-30129e307af3\})|(\{43366e90-e4be-4ba6-bec0-3fb149128480\})|(\{8ebc90a4-f7a1-420a-8380-f85545403f80\})|(\{6d3fa41f-e896-4f85-ba59-321f4b26f380\})|(\{05c811f2-f828-4d3e-ad02-7386373e9a28\})|(\{e10a0ee6-8083-42a7-bed1-35400b029bf2\})|(\{c925be5a-ae0e-4958-be36-44dc2e64d4f7\})|(\{3803ed37-c101-4b21-a678-762f51b7eabf\})|(\{08a15cc0-d6cb-43c5-9a40-27443554b455\})|(\{d0953283-5970-4ebe-b270-940c6befdbb7\})|(\{7c983689-80c7-46dd-b9d2-4d2db1cf94a6\})|(\{8f320a17-868c-43dc-94fb-9d1ab7f4fe73\})|(\{843b406a-9593-49bf-9365-684fe8cb2f5a\})|(\{42cd0cbd-248d-4a44-88b6-1a3680d159ac\})|(\{23efa05d-99b1-49e0-a67d-5378f2afc20d\})|(\{f91c606c-dd33-42a4-9219-824187730f59\})|(\{9e233d16-18ae-4519-a83c-2806f4fee321\})|(\{a93cdf30-75da-463b-865b-f49cc7fd2697\})|(\{dcacb62c-9096-482d-845d-10413199a89b\})|(\{9d5da26f-c366-46b2-b3e7-5c8e3e0b9788\})|(\{dd176d1f-8cd5-4b5b-8b06-839449e87b5e\})|(\{9ada3b66-4412-427d-8696-ac0fe0ac891e\})|(\{9695495e-cb65-4cd6-8a93-52c9e2b8d767\})|(\{e9d1a027-a84c-4e90-b602-66ffe22a0ad6\})|(\{f71bda5e-c591-44aa-8f84-2f04989f7e7a\})|(\{e6e67c6f-c010-406d-8575-1835341ec4cf\})|(\{22fbf524-38be-4ead-b6ce-e55cb23ed74b\})|(\{866dafe9-1c49-47d7-a46c-1cb50ca52461\})|(\{3479fadc-41b1-492e-bb16-d8f9e514d488\})|(\{8c02daf2-79ed-4650-89ca-1e099d28c5e7\})|(\{65e6b805-7f0c-455f-b1b4-c34621056b46\})|(\{78de7006-944c-4c18-a33a-d6931619f2b0\})|(\{16c8051b-2c16-4641-bf29-2daee7883fd0\})|(\{19263ccc-a97f-49f4-867a-b49351c42c0c\})|(\{bfe416d8-e8c3-469c-908e-6926770152f0\})|(\{a29a4a96-2fcd-48f8-bfe1-a1d1df46e73d\})|(\{2d651636-a0fa-45b7-a97e-ebc85959ff23\})|(\{ac8a3af8-e264-4a0b-b813-d7fab03ae3fe\})|(\{4719ad8b-354b-443d-b1e6-4d60b851c465\})|(\{7679a9f9-29d8-4979-86e7-a5b5cf0e2fd3\})|(\{099e1648-58e7-492e-8019-3418263b9265\})|(\{9a83d154-4ea3-45f9-ae21-28f3c1f86773\})|(\{475b88fd-574c-4881-98e0-0184a03593cb\})|(\{d7b586f8-a22d-4986-9dfb-67d49ba46a68\})|(\{50b79e30-a649-4477-8612-7085c0ee3ad4\})|(\{e9b2d453-9a98-41e4-9837-c0d68ff1aeac\})|(\{b1814ce5-0d9f-495f-b260-a7e1e5538263\})|(\{9b06d35e-2eb0-4653-886f-a3f4cdcbb754\})|(\{e7d6a360-69d4-4f8c-a96f-fd63388995b2\})|(\{68a50af6-ddad-4750-a9a7-a71c55e019b7\})|(\{8286a0e0-ba89-48b3-871b-8c9acff32023\})|(\{b3c79903-9bc5-4ddf-aeeb-7d91989ae819\})|(\{7c5cc4ec-9637-428c-bcf7-28bba279cf84\})|(\{93d460ee-879f-4d8f-8599-a1c69ed59ec2\})|(\{207c95d5-2bb9-4760-b3a4-8c58ea173bff\})|(\{b3482681-1abf-4dfa-bace-dc7b51e6a150\})|(\{d3516cf6-d531-434a-b80a-df72c7166744\})|(\{da01a2aa-0cbb-4f57-a395-2256d142c519\}))$/">
+      <prefs/>
+      <versionRange minVersion="0" maxVersion="*" severity="3"/>
+    </emItem>
   </emItems>
   <pluginItems>
     <pluginItem blockID="p332">
       <match exp="libflashplayer\.so" name="filename"/>
       <match exp="^Shockwave Flash 11.(0|1) r[0-9]{1,3}$" name="description"/>
       <infoURL>https://get.adobe.com/flashplayer/</infoURL>
       <versionRange severity="0" vulnerabilitystatus="1">
         <targetApplication id="{ec8030f7-c20a-464f-9b0e-13a3a9e97384}">
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -148,17 +148,17 @@
                 event.detail == 0 ||
                 !this.hasAttribute("overflow")) {
               return;
             }
 
             this.removeAttribute("overflow");
 
             if (this._lastTabClosedByMouse) {
-              this._expandSpacerBy(this.arrowScrollbox._scrollButtonDown.clientWidth);
+              this._expandSpacerBy(this._scrollButtonWidth);
             }
 
             for (let tab of Array.from(gBrowser._removingTabs)) {
               gBrowser.removeTab(tab);
             }
 
             this._positionPinnedTabs();
           }, true);
@@ -406,16 +406,17 @@
 
       <field name="_closingTabsSpacer">
         document.getAnonymousElementByAttribute(this, "anonid", "closing-tabs-spacer");
       </field>
 
       <field name="_tabDefaultMaxWidth">NaN</field>
       <field name="_lastTabClosedByMouse">false</field>
       <field name="_hasTabTempMaxWidth">false</field>
+      <field name="_scrollButtonWidth">0</field>
 
       <!-- Try to keep the active tab's close button under the mouse cursor -->
       <method name="_lockTabSizing">
         <parameter name="aTab"/>
         <parameter name="aTabWidth"/>
         <body><![CDATA[
           let tabs = this._getVisibleTabs();
           if (!tabs.length) {
@@ -424,16 +425,17 @@
 
           var isEndTab = (aTab._tPos > tabs[tabs.length - 1]._tPos);
 
           if (!this._tabDefaultMaxWidth) {
             this._tabDefaultMaxWidth =
               parseFloat(window.getComputedStyle(aTab).maxWidth);
           }
           this._lastTabClosedByMouse = true;
+          this._scrollButtonWidth = window.windowUtils.getBoundsWithoutFlushing(this.arrowScrollbox._scrollButtonDown).width;
 
           if (this.getAttribute("overflow") == "true") {
             // Don't need to do anything if we're in overflow mode and aren't scrolled
             // all the way to the right, or if we're closing the last tab.
             if (isEndTab || !this.arrowScrollbox._scrollButtonDown.disabled) {
               return;
             }
             // If the tab has an owner that will become the active tab, the owner will
--- a/browser/base/content/test/tabs/browser.ini
+++ b/browser/base/content/test/tabs/browser.ini
@@ -66,16 +66,17 @@ support-files = file_anchor_elements.htm
 [browser_pinnedTabs_clickOpen.js]
 [browser_pinnedTabs_closeByKeyboard.js]
 [browser_pinnedTabs.js]
 [browser_positional_attributes.js]
 skip-if = (verify && (os == 'win' || os == 'mac'))
 [browser_preloadedBrowser_zoom.js]
 [browser_reload_deleted_file.js]
 skip-if = (debug && os == 'mac') || (debug && os == 'linux' && bits == 64) #Bug 1421183, disabled on Linux/OSX for leaked windows
+[browser_tabCloseSpacer.js]
 [browser_tab_label_during_reload.js]
 [browser_tabCloseProbes.js]
 [browser_tabContextMenu_keyboard.js]
 [browser_tabReorder_overflow.js]
 [browser_tabReorder.js]
 [browser_tabSpinnerProbe.js]
 skip-if = !e10s # Tab spinner is e10s only.
 [browser_tabSuccessors.js]
new file mode 100644
--- /dev/null
+++ b/browser/base/content/test/tabs/browser_tabCloseSpacer.js
@@ -0,0 +1,73 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+/**
+ * Tests that while clicking to close tabs, the close button remains under the mouse
+ * even when an underflow happens.
+ */
+add_task(async function() {
+  await SpecialPowers.pushPrefEnv({
+    "set": [
+      ["toolkit.cosmeticAnimations.enabled", false],
+    ],
+  });
+
+  let downButton = gBrowser.tabContainer.arrowScrollbox._scrollButtonDown;
+  let closingTabsSpacer = gBrowser.tabContainer._closingTabsSpacer;
+
+  await overflowTabs();
+  ok(gBrowser.tabContainer.hasAttribute("overflow"), "Tab strip should be overflowing");
+  isnot(downButton.clientWidth, 0, "down button has some width");
+  is(closingTabsSpacer.clientWidth, 0, "spacer has no width");
+
+  let originalCloseButtonLocation = getLastCloseButtonLocation();
+
+  info("Removing half the tabs and making sure the last close button doesn't move");
+  let numTabs = gBrowser.tabs.length / 2;
+  while (gBrowser.tabs.length > numTabs) {
+    let lastCloseButtonLocation = getLastCloseButtonLocation();
+    Assert.deepEqual(lastCloseButtonLocation, originalCloseButtonLocation, "Close button hasn't moved");
+
+    EventUtils.synthesizeMouseAtCenter(getLastCloseButton(), {});
+    await new Promise(r => requestAnimationFrame(r));
+  }
+
+  ok(!gBrowser.tabContainer.hasAttribute("overflow"), "not overflowing");
+  ok(gBrowser.tabContainer.hasAttribute("using-closing-tabs-spacer"), "using spacer");
+  is(downButton.clientWidth, 0, "down button has no width");
+  isnot(closingTabsSpacer.clientWidth, 0, "spacer has some width");
+});
+
+async function overflowTabs() {
+  let arrowScrollbox = gBrowser.tabContainer.arrowScrollbox;
+  let width = ele => ele.getBoundingClientRect().width;
+  let tabMinWidth = parseInt(getComputedStyle(gBrowser.selectedTab, null).minWidth);
+  let tabCountForOverflow = Math.ceil(width(arrowScrollbox) / tabMinWidth * 1.1);
+  while (gBrowser.tabs.length < tabCountForOverflow) {
+    BrowserTestUtils.addTab(gBrowser, "about:blank", { skipAnimation: true, index: 0 });
+  }
+  await window.promiseDocumentFlushed(() => {});
+}
+
+function getLastCloseButton() {
+  let lastTab = gBrowser.tabs[gBrowser.tabs.length - 1];
+  return document.getAnonymousElementByAttribute(lastTab, "anonid", "close-button");
+}
+
+function getLastCloseButtonLocation() {
+  let rect = getLastCloseButton().getBoundingClientRect();
+  return {
+    left: Math.round(rect.left),
+    top: Math.round(rect.top),
+    width: Math.round(rect.width),
+    height: Math.round(rect.height),
+  };
+}
+
+registerCleanupFunction(() => {
+  while (gBrowser.tabs.length > 1) {
+    BrowserTestUtils.removeTab(gBrowser.tabs[0]);
+  }
+});
--- a/browser/components/urlbar/UrlbarInput.jsm
+++ b/browser/components/urlbar/UrlbarInput.jsm
@@ -1550,30 +1550,30 @@ class UrlbarInput {
   _on_dragover(event) {
     if (!getDroppableData(event)) {
       event.dataTransfer.dropEffect = "none";
     }
   }
 
   _on_drop(event) {
     let droppedItem = getDroppableData(event);
-    if (!droppedItem) {
-      return;
+    let droppedURL = droppedItem instanceof URL ? droppedItem.href : droppedItem;
+    if (droppedURL && (droppedURL !== this.window.gBrowser.currentURI.spec)) {
+      let principal = Services.droppedLinkHandler.getTriggeringPrincipal(event);
+      this.value = droppedURL;
+      this.window.SetPageProxyState("invalid");
+      this.focus();
+      this.handleCommand(null, undefined, undefined, principal);
+      // For safety reasons, in the drop case we don't want to immediately show
+      // the the dropped value, instead we want to keep showing the current page
+      // url until an onLocationChange happens.
+      // See the handling in URLBarSetURI for further details.
+      this.window.gBrowser.userTypedValue = null;
+      this.window.URLBarSetURI(null, true);
     }
-    let principal = Services.droppedLinkHandler.getTriggeringPrincipal(event);
-    this.value = droppedItem instanceof URL ? droppedItem.href : droppedItem;
-    this.window.SetPageProxyState("invalid");
-    this.focus();
-    this.handleCommand(null, undefined, undefined, principal);
-    // For safety reasons, in the drop case we don't want to immediately show
-    // the the dropped value, instead we want to keep showing the current page
-    // url until an onLocationChange happens.
-    // See the handling in URLBarSetURI for further details.
-    this.window.gBrowser.userTypedValue = null;
-    this.window.URLBarSetURI(null, true);
   }
 }
 
 /**
  * Tries to extract droppable data from a DND event.
  * @param {Event} event The DND event to examine.
  * @returns {URL|string|null}
  *          null if there's a security reason for which we should do nothing.
--- a/devtools/client/aboutdebugging-new/src/constants.js
+++ b/devtools/client/aboutdebugging-new/src/constants.js
@@ -104,16 +104,18 @@ const PAGE_TYPES = {
 
 const PREFERENCES = {
   // Preference that drives the display of the "Tabs" category on This Firefox.
   LOCAL_TAB_DEBUGGING_ENABLED: "devtools.aboutdebugging.local-tab-debugging",
   // Preference that drives the display of the "Processes" debug target category.
   PROCESS_DEBUGGING_ENABLED: "devtools.aboutdebugging.process-debugging",
   // Preference that drives the display of hidden & system addons in about:debugging.
   SHOW_HIDDEN_ADDONS: "devtools.aboutdebugging.showHiddenAddons",
+  // Preference that disables installing extensions when set to false.
+  XPINSTALL_ENABLED: "xpinstall.enabled",
 };
 
 const RUNTIME_PREFERENCE = {
   CHROME_DEBUG_ENABLED: "devtools.chrome.enabled",
   CONNECTION_PROMPT: "devtools.debugger.prompt-connection",
   PERMANENT_PRIVATE_BROWSING: "browser.privatebrowsing.autostart",
   REMOTE_DEBUG_ENABLED: "devtools.debugger.remote-enabled",
   SERVICE_WORKERS_ENABLED: "dom.serviceWorkers.enabled",
--- a/devtools/client/aboutdebugging-new/src/modules/debug-target-support.js
+++ b/devtools/client/aboutdebugging-new/src/modules/debug-target-support.js
@@ -13,24 +13,32 @@ function isProcessDebuggingSupported() {
   return Services.prefs.getBoolPref(PREFERENCES.PROCESS_DEBUGGING_ENABLED, false);
 }
 
 // Process target debugging is disabled by default.
 function isLocalTabDebuggingSupported() {
   return Services.prefs.getBoolPref(PREFERENCES.LOCAL_TAB_DEBUGGING_ENABLED, false);
 }
 
+// Installing extensions can be disabled in enterprise policy.
+// Note: Temporary Extensions are only supported when debugging This Firefox, so checking
+// the local preference is acceptable here. If we enable Temporary extensions for remote
+// runtimes, we should retrieve the preference from the target runtime instead.
+function isTemporaryExtensionSupported() {
+  return Services.prefs.getBoolPref(PREFERENCES.XPINSTALL_ENABLED, true);
+}
+
 const ALL_DEBUG_TARGET_PANES = [
   DEBUG_TARGET_PANE.INSTALLED_EXTENSION,
   ...(isProcessDebuggingSupported() ? [DEBUG_TARGET_PANE.PROCESSES] : []),
   DEBUG_TARGET_PANE.OTHER_WORKER,
   DEBUG_TARGET_PANE.SERVICE_WORKER,
   DEBUG_TARGET_PANE.SHARED_WORKER,
   DEBUG_TARGET_PANE.TAB,
-  DEBUG_TARGET_PANE.TEMPORARY_EXTENSION,
+  ...(isTemporaryExtensionSupported() ? [DEBUG_TARGET_PANE.TEMPORARY_EXTENSION] : []),
 ];
 
 // All debug target panes except temporary extensions
 const REMOTE_DEBUG_TARGET_PANES = ALL_DEBUG_TARGET_PANES.filter(p =>
   p !== DEBUG_TARGET_PANE.TEMPORARY_EXTENSION);
 
 const THIS_FIREFOX_DEBUG_TARGET_PANES = ALL_DEBUG_TARGET_PANES
   // Main process debugging is not available for This Firefox.
--- a/devtools/client/aboutdebugging-new/test/browser/browser_aboutdebugging_serviceworker_timeout.js
+++ b/devtools/client/aboutdebugging-new/test/browser/browser_aboutdebugging_serviceworker_timeout.js
@@ -1,23 +1,23 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 "use strict";
 
 // This test will be idle for a long period to give a chance to the service worker to
 // timeout.
-requestLongerTimeout(2);
+requestLongerTimeout(3);
 
 /* import-globals-from helper-serviceworker.js */
 Services.scriptloader.loadSubScript(CHROME_URL_ROOT + "helper-serviceworker.js", this);
 
 const SW_TAB_URL = URL_ROOT + "resources/service-workers/empty-sw.html";
 const SW_URL = URL_ROOT + "resources/service-workers/empty-sw.js";
-const SW_TIMEOUT = 1000;
+const SW_TIMEOUT = 4000;
 
 // This is a migration from:
 // https://searchfox.org/mozilla-central/source/devtools/client/aboutdebugging/test/browser_service_workers_timeout.js
 
 /**
  * Test that service workers will _not_ timeout and be stopped when a toolbox is attached
  * to them. Feature implemented in Bug 1228382.
  */
@@ -54,21 +54,21 @@ add_task(async function() {
   const inspectButton = getInspectButton(SW_URL, document);
   ok(!!inspectButton, "Service worker target has an inspect button");
 
   info("Click on inspect and wait for the toolbox to open");
   const onToolboxReady = gDevTools.once("toolbox-ready");
   inspectButton.click();
   await onToolboxReady;
 
-  // Wait for more 10 times the service worker timeout to check that the toolbox prevents
+  // Wait for more 5 times the service worker timeout to check that the toolbox prevents
   // the worker from being destroyed.
-  await wait(SW_TIMEOUT * 10);
+  await wait(SW_TIMEOUT * 5);
 
-  // Check that the service worker is still running, even after waiting 10 times the
+  // Check that the service worker is still running, even after waiting 5 times the
   // service worker timeout.
   const hasInspectButton = !!getInspectButton(SW_URL, document);
   ok(hasInspectButton, "Service worker target still has an inspect button");
 
   info("Destroy the toolbox");
   const devtoolsTab = gBrowser.selectedTab;
   await closeAboutDevtoolsToolbox(document, devtoolsTab, window);
 
--- a/devtools/client/aboutdebugging-new/test/browser/browser_aboutdebugging_thisfirefox.js
+++ b/devtools/client/aboutdebugging-new/test/browser/browser_aboutdebugging_thisfirefox.js
@@ -36,16 +36,33 @@ add_task(async function testThisFirefoxW
 
   // Expect all target panes but tabs to be displayed.
   const expectedTargetPanesWithoutTabs = EXPECTED_TARGET_PANES.filter(p => p !== "Tabs");
   await checkThisFirefoxTargetPanes(document, expectedTargetPanesWithoutTabs);
 
   await removeTab(tab);
 });
 
+/**
+ * Check that the Temporary Extensions is hidden if "xpinstall.enabled" is set to false.
+ */
+add_task(async function testThisFirefoxWithXpinstallDisabled() {
+  await pushPref("xpinstall.enabled", false);
+
+  const { document, tab, window } = await openAboutDebugging();
+  await selectThisFirefoxPage(document, window.AboutDebugging.store);
+
+  // Expect all target panes but temporary extensions to be displayed.
+  const expectedTargetPanesWithXpinstallDisabled =
+    EXPECTED_TARGET_PANES.filter(p => p !== "Temporary Extensions");
+  await checkThisFirefoxTargetPanes(document, expectedTargetPanesWithXpinstallDisabled);
+
+  await removeTab(tab);
+});
+
 async function checkThisFirefoxTargetPanes(doc, expectedTargetPanes) {
   const win = doc.ownerGlobal;
   // Check that the selected sidebar item is "This Firefox"/"This Nightly"/...
   const selectedSidebarItem = doc.querySelector(".qa-sidebar-item-selected");
   ok(selectedSidebarItem, "An item is selected in the sidebar");
 
   const thisFirefoxString = getThisFirefoxString(win);
   is(selectedSidebarItem.textContent, thisFirefoxString,
--- a/devtools/client/aboutdebugging/components/addons/Controls.js
+++ b/devtools/client/aboutdebugging/components/addons/Controls.js
@@ -68,16 +68,17 @@ class AddonsControls extends Component {
       .catch(e => {
         console.error(e);
         this.setState({ installError: e, lastInstallErrorFile: file });
       });
   }
 
   render() {
     const { debugDisabled } = this.props;
+    const isXpinstallEnabled = Services.prefs.getBoolPref("xpinstall.enabled", true);
 
     return dom.div({ className: "addons-top" },
       dom.div({ className: "addons-controls" },
         dom.div({ className: "addons-options toggle-container-with-text" },
           dom.input({
             id: "enable-addon-debugging",
             type: "checkbox",
             checked: !debugDisabled,
@@ -88,20 +89,20 @@ class AddonsControls extends Component {
             className: "addons-debugging-label",
             htmlFor: "enable-addon-debugging",
             title: Strings.GetStringFromName("addonDebugging.tooltip"),
           }, Strings.GetStringFromName("addonDebugging.label")),
           dom.a({ href: MORE_INFO_URL, target: "_blank" },
             Strings.GetStringFromName("addonDebugging.learnMore")
           ),
         ),
-        dom.button({
+        isXpinstallEnabled ? dom.button({
           id: "load-addon-from-file",
           onClick: this.loadAddonFromFile,
-        }, Strings.GetStringFromName("loadTemporaryAddon2"))
+        }, Strings.GetStringFromName("loadTemporaryAddon2")) : null,
       ),
       AddonsInstallError({
         error: this.state.installError,
         retryInstall: this.retryInstall,
       }));
   }
 }
 
--- a/devtools/client/aboutdebugging/components/addons/Panel.js
+++ b/devtools/client/aboutdebugging/components/addons/Panel.js
@@ -161,28 +161,31 @@ class AddonsPanel extends Component {
     const systemName = Strings.GetStringFromName("systemExtensions");
     const targetClass = AddonTarget;
 
     const installedTargets = targets.filter(
       (target) => !target.isSystem && !target.temporarilyInstalled);
     const temporaryTargets = targets.filter((target) => target.temporarilyInstalled);
     const systemTargets = showSystemAddons && targets.filter((target) => target.isSystem);
 
+    // Don't show the temporary addons category if users can't install addons.
+    const isXpinstallEnabled = Services.prefs.getBoolPref("xpinstall.enabled", true);
+
     return dom.div({
       id: id + "-panel",
       className: "panel",
       role: "tabpanel",
       "aria-labelledby": id + "-header",
     },
     PanelHeader({
       id: id + "-header",
       name: Strings.GetStringFromName("addons"),
     }),
     AddonsControls({ debugDisabled }),
-    dom.div({ id: "temporary-addons" },
+    isXpinstallEnabled ? dom.div({ id: "temporary-addons" },
       TargetList({
         id: "temporary-extensions",
         name: temporaryName,
         targets: temporaryTargets,
         client,
         connect,
         debugDisabled,
         targetClass,
@@ -192,17 +195,17 @@ class AddonsPanel extends Component {
         dom.div({ className: "addons-tip-icon"}),
         dom.span({
           className: "addons-web-ext-tip",
         }, Strings.GetStringFromName("webExtTip")),
         dom.a({ href: WEB_EXT_URL, target: "_blank" },
           Strings.GetStringFromName("webExtTip.learnMore")
         )
       )
-    ),
+    ) : null,
     dom.div({ id: "addons" },
       TargetList({
         id: "extensions",
         name: installedName,
         targets: installedTargets,
         client,
         connect,
         debugDisabled,
--- a/devtools/client/debugger/dist/parser-worker.js
+++ b/devtools/client/debugger/dist/parser-worker.js
@@ -6468,17 +6468,17 @@ function networkRequest(url, opts) {
 }
 
 module.exports = networkRequest;
 
 /***/ }),
 /* 14 */
 /***/ (function(module, exports) {
 
-function _asyncToGenerator(fn) { return function () { var gen = fn.apply(this, arguments); return new Promise(function (resolve, reject) { function step(key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { return Promise.resolve(value).then(function (value) { step("next", value); }, function (err) { step("throw", err); }); } } return step("next"); }); }; }
+
 
 function WorkerDispatcher() {
   this.msgId = 1;
   this.worker = null;
 } /* This Source Code Form is subject to the terms of the Mozilla Public
    * License, v. 2.0. If a copy of the MPL was not distributed with this
    * file, You can obtain one at <http://mozilla.org/MPL/2.0/>. */
 
@@ -6583,72 +6583,19 @@ function workerHandler(publicInterface) 
         return { error: error.toString() };
       }
     })).then(results => {
       self.postMessage({ id, results });
     });
   };
 }
 
-function streamingWorkerHandler(publicInterface, { timeout = 100 } = {}, worker = self) {
-  let streamingWorker = (() => {
-    var _ref = _asyncToGenerator(function* (id, tasks) {
-      let isWorking = true;
-
-      const timeoutId = setTimeout(function () {
-        isWorking = false;
-      }, timeout);
-
-      const results = [];
-      while (tasks.length !== 0 && isWorking) {
-        const { callback, context, args } = tasks.shift();
-        const result = yield callback.call(context, args);
-        results.push(result);
-      }
-      worker.postMessage({ id, status: "pending", data: results });
-      clearTimeout(timeoutId);
-
-      if (tasks.length !== 0) {
-        yield streamingWorker(id, tasks);
-      }
-    });
-
-    return function streamingWorker(_x, _x2) {
-      return _ref.apply(this, arguments);
-    };
-  })();
-
-  return (() => {
-    var _ref2 = _asyncToGenerator(function* (msg) {
-      const { id, method, args } = msg.data;
-      const workerMethod = publicInterface[method];
-      if (!workerMethod) {
-        console.error(`Could not find ${method} defined in worker.`);
-      }
-      worker.postMessage({ id, status: "start" });
-
-      try {
-        const tasks = workerMethod(args);
-        yield streamingWorker(id, tasks);
-        worker.postMessage({ id, status: "done" });
-      } catch (error) {
-        worker.postMessage({ id, status: "error", error });
-      }
-    });
-
-    return function (_x3) {
-      return _ref2.apply(this, arguments);
-    };
-  })();
-}
-
 module.exports = {
   WorkerDispatcher,
-  workerHandler,
-  streamingWorkerHandler
+  workerHandler
 };
 
 /***/ }),
 /* 15 */
 /***/ (function(module, exports) {
 
 var g;
 
--- a/devtools/client/debugger/dist/pretty-print-worker.js
+++ b/devtools/client/debugger/dist/pretty-print-worker.js
@@ -525,17 +525,17 @@ function networkRequest(url, opts) {
 
 module.exports = networkRequest;
 
 /***/ }),
 
 /***/ 14:
 /***/ (function(module, exports) {
 
-function _asyncToGenerator(fn) { return function () { var gen = fn.apply(this, arguments); return new Promise(function (resolve, reject) { function step(key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { return Promise.resolve(value).then(function (value) { step("next", value); }, function (err) { step("throw", err); }); } } return step("next"); }); }; }
+
 
 function WorkerDispatcher() {
   this.msgId = 1;
   this.worker = null;
 } /* This Source Code Form is subject to the terms of the Mozilla Public
    * License, v. 2.0. If a copy of the MPL was not distributed with this
    * file, You can obtain one at <http://mozilla.org/MPL/2.0/>. */
 
@@ -640,72 +640,19 @@ function workerHandler(publicInterface) 
         return { error: error.toString() };
       }
     })).then(results => {
       self.postMessage({ id, results });
     });
   };
 }
 
-function streamingWorkerHandler(publicInterface, { timeout = 100 } = {}, worker = self) {
-  let streamingWorker = (() => {
-    var _ref = _asyncToGenerator(function* (id, tasks) {
-      let isWorking = true;
-
-      const timeoutId = setTimeout(function () {
-        isWorking = false;
-      }, timeout);
-
-      const results = [];
-      while (tasks.length !== 0 && isWorking) {
-        const { callback, context, args } = tasks.shift();
-        const result = yield callback.call(context, args);
-        results.push(result);
-      }
-      worker.postMessage({ id, status: "pending", data: results });
-      clearTimeout(timeoutId);
-
-      if (tasks.length !== 0) {
-        yield streamingWorker(id, tasks);
-      }
-    });
-
-    return function streamingWorker(_x, _x2) {
-      return _ref.apply(this, arguments);
-    };
-  })();
-
-  return (() => {
-    var _ref2 = _asyncToGenerator(function* (msg) {
-      const { id, method, args } = msg.data;
-      const workerMethod = publicInterface[method];
-      if (!workerMethod) {
-        console.error(`Could not find ${method} defined in worker.`);
-      }
-      worker.postMessage({ id, status: "start" });
-
-      try {
-        const tasks = workerMethod(args);
-        yield streamingWorker(id, tasks);
-        worker.postMessage({ id, status: "done" });
-      } catch (error) {
-        worker.postMessage({ id, status: "error", error });
-      }
-    });
-
-    return function (_x3) {
-      return _ref2.apply(this, arguments);
-    };
-  })();
-}
-
 module.exports = {
   WorkerDispatcher,
-  workerHandler,
-  streamingWorkerHandler
+  workerHandler
 };
 
 /***/ }),
 
 /***/ 32:
 /***/ (function(module, exports, __webpack_require__) {
 
 /* -*- Mode: js; js-indent-level: 2; -*- */
--- a/devtools/client/debugger/dist/search-worker.js
+++ b/devtools/client/debugger/dist/search-worker.js
@@ -196,17 +196,17 @@ function networkRequest(url, opts) {
 
 module.exports = networkRequest;
 
 /***/ }),
 
 /***/ 14:
 /***/ (function(module, exports) {
 
-function _asyncToGenerator(fn) { return function () { var gen = fn.apply(this, arguments); return new Promise(function (resolve, reject) { function step(key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { return Promise.resolve(value).then(function (value) { step("next", value); }, function (err) { step("throw", err); }); } } return step("next"); }); }; }
+
 
 function WorkerDispatcher() {
   this.msgId = 1;
   this.worker = null;
 } /* This Source Code Form is subject to the terms of the Mozilla Public
    * License, v. 2.0. If a copy of the MPL was not distributed with this
    * file, You can obtain one at <http://mozilla.org/MPL/2.0/>. */
 
@@ -311,72 +311,19 @@ function workerHandler(publicInterface) 
         return { error: error.toString() };
       }
     })).then(results => {
       self.postMessage({ id, results });
     });
   };
 }
 
-function streamingWorkerHandler(publicInterface, { timeout = 100 } = {}, worker = self) {
-  let streamingWorker = (() => {
-    var _ref = _asyncToGenerator(function* (id, tasks) {
-      let isWorking = true;
-
-      const timeoutId = setTimeout(function () {
-        isWorking = false;
-      }, timeout);
-
-      const results = [];
-      while (tasks.length !== 0 && isWorking) {
-        const { callback, context, args } = tasks.shift();
-        const result = yield callback.call(context, args);
-        results.push(result);
-      }
-      worker.postMessage({ id, status: "pending", data: results });
-      clearTimeout(timeoutId);
-
-      if (tasks.length !== 0) {
-        yield streamingWorker(id, tasks);
-      }
-    });
-
-    return function streamingWorker(_x, _x2) {
-      return _ref.apply(this, arguments);
-    };
-  })();
-
-  return (() => {
-    var _ref2 = _asyncToGenerator(function* (msg) {
-      const { id, method, args } = msg.data;
-      const workerMethod = publicInterface[method];
-      if (!workerMethod) {
-        console.error(`Could not find ${method} defined in worker.`);
-      }
-      worker.postMessage({ id, status: "start" });
-
-      try {
-        const tasks = workerMethod(args);
-        yield streamingWorker(id, tasks);
-        worker.postMessage({ id, status: "done" });
-      } catch (error) {
-        worker.postMessage({ id, status: "error", error });
-      }
-    });
-
-    return function (_x3) {
-      return _ref2.apply(this, arguments);
-    };
-  })();
-}
-
 module.exports = {
   WorkerDispatcher,
-  workerHandler,
-  streamingWorkerHandler
+  workerHandler
 };
 
 /***/ }),
 
 /***/ 15:
 /***/ (function(module, exports) {
 
 var g;
--- a/devtools/client/debugger/dist/vendors.js
+++ b/devtools/client/debugger/dist/vendors.js
@@ -1304,17 +1304,17 @@ function networkRequest(url, opts) {
 
 module.exports = networkRequest;
 
 /***/ }),
 
 /***/ 14:
 /***/ (function(module, exports) {
 
-function _asyncToGenerator(fn) { return function () { var gen = fn.apply(this, arguments); return new Promise(function (resolve, reject) { function step(key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { return Promise.resolve(value).then(function (value) { step("next", value); }, function (err) { step("throw", err); }); } } return step("next"); }); }; }
+
 
 function WorkerDispatcher() {
   this.msgId = 1;
   this.worker = null;
 } /* This Source Code Form is subject to the terms of the Mozilla Public
    * License, v. 2.0. If a copy of the MPL was not distributed with this
    * file, You can obtain one at <http://mozilla.org/MPL/2.0/>. */
 
@@ -1419,72 +1419,19 @@ function workerHandler(publicInterface) 
         return { error: error.toString() };
       }
     })).then(results => {
       self.postMessage({ id, results });
     });
   };
 }
 
-function streamingWorkerHandler(publicInterface, { timeout = 100 } = {}, worker = self) {
-  let streamingWorker = (() => {
-    var _ref = _asyncToGenerator(function* (id, tasks) {
-      let isWorking = true;
-
-      const timeoutId = setTimeout(function () {
-        isWorking = false;
-      }, timeout);
-
-      const results = [];
-      while (tasks.length !== 0 && isWorking) {
-        const { callback, context, args } = tasks.shift();
-        const result = yield callback.call(context, args);
-        results.push(result);
-      }
-      worker.postMessage({ id, status: "pending", data: results });
-      clearTimeout(timeoutId);
-
-      if (tasks.length !== 0) {
-        yield streamingWorker(id, tasks);
-      }
-    });
-
-    return function streamingWorker(_x, _x2) {
-      return _ref.apply(this, arguments);
-    };
-  })();
-
-  return (() => {
-    var _ref2 = _asyncToGenerator(function* (msg) {
-      const { id, method, args } = msg.data;
-      const workerMethod = publicInterface[method];
-      if (!workerMethod) {
-        console.error(`Could not find ${method} defined in worker.`);
-      }
-      worker.postMessage({ id, status: "start" });
-
-      try {
-        const tasks = workerMethod(args);
-        yield streamingWorker(id, tasks);
-        worker.postMessage({ id, status: "done" });
-      } catch (error) {
-        worker.postMessage({ id, status: "error", error });
-      }
-    });
-
-    return function (_x3) {
-      return _ref2.apply(this, arguments);
-    };
-  })();
-}
-
 module.exports = {
   WorkerDispatcher,
-  workerHandler,
-  streamingWorkerHandler
+  workerHandler
 };
 
 /***/ }),
 
 /***/ 15:
 /***/ (function(module, exports) {
 
 var g;
--- a/devtools/client/debugger/packages/devtools-utils/src/tests/worker-utils.js
+++ b/devtools/client/debugger/packages/devtools-utils/src/tests/worker-utils.js
@@ -1,17 +1,13 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at <http://mozilla.org/MPL/2.0/>. */
 
-const {
-  WorkerDispatcher,
-  workerHandler,
-  streamingWorkerHandler
-} = require("../worker-utils");
+const { WorkerDispatcher, workerHandler } = require("../worker-utils");
 
 describe("worker utils", () => {
   it("starts a worker", () => {
     const dispatcher = new WorkerDispatcher();
     global.Worker = jest.fn();
     dispatcher.start("foo");
     expect(dispatcher.worker).toEqual(global.Worker.mock.instances[0]);
   });
@@ -143,61 +139,8 @@ describe("worker utils", () => {
     const resp = task("bar");
     resp.catch(e => expect(e).toEqual("Oops, The worker has shutdown!"));
 
     const listener = addEventListenerMock.mock.calls[0][1];
     dispatcher.stop();
     listener({ data: { id: 1 } });
   });
 });
-
-it("streams a task", async () => {
-  jest.useRealTimers();
-
-  const postMessageMock = jest.fn();
-
-  const worker = {
-    postMessage: postMessageMock
-  };
-
-  function makeTasks() {
-    return [
-      {
-        callback: () => new Promise(resolve => setTimeout(() => resolve(1), 50))
-      },
-      {
-        callback: () => new Promise(resolve => setTimeout(() => resolve(2), 50))
-      }
-    ];
-  }
-
-  const _workerHandler = streamingWorkerHandler(
-    { makeTasks },
-    { timeout: 25 },
-    worker
-  );
-
-  const id = 1;
-  const task = _workerHandler({
-    data: { id, method: "makeTasks", calls: [[]] }
-  });
-  await task;
-
-  expect(postMessageMock.mock.calls).toHaveLength(4);
-  expect(postMessageMock.mock.calls[0][0]).toEqual({
-    id,
-    status: "start"
-  });
-  expect(postMessageMock.mock.calls[1][0]).toEqual({
-    id,
-    status: "pending",
-    data: [1]
-  });
-  expect(postMessageMock.mock.calls[2][0]).toEqual({
-    id,
-    status: "pending",
-    data: [2]
-  });
-  expect(postMessageMock.mock.calls[3][0]).toEqual({
-    id,
-    status: "done"
-  });
-});
--- a/devtools/client/debugger/packages/devtools-utils/src/worker-utils.js
+++ b/devtools/client/debugger/packages/devtools-utils/src/worker-utils.js
@@ -125,57 +125,12 @@ function workerHandler(publicInterface: 
         }
       })
     ).then(results => {
       self.postMessage({ id, results });
     });
   };
 }
 
-function streamingWorkerHandler(
-  publicInterface: Object,
-  { timeout = 100 }: Object = {},
-  worker: Object = self
-) {
-  async function streamingWorker(id, tasks) {
-    let isWorking = true;
-
-    const timeoutId = setTimeout(() => {
-      isWorking = false;
-    }, timeout);
-
-    const results = [];
-    while (tasks.length !== 0 && isWorking) {
-      const { callback, context, args } = tasks.shift();
-      const result = await callback.call(context, args);
-      results.push(result);
-    }
-    worker.postMessage({ id, status: "pending", data: results });
-    clearTimeout(timeoutId);
-
-    if (tasks.length !== 0) {
-      await streamingWorker(id, tasks);
-    }
-  }
-
-  return async function(msg: Message) {
-    const { id, method, args } = msg.data;
-    const workerMethod = publicInterface[method];
-    if (!workerMethod) {
-      console.error(`Could not find ${method} defined in worker.`);
-    }
-    worker.postMessage({ id, status: "start" });
-
-    try {
-      const tasks = workerMethod(args);
-      await streamingWorker(id, tasks);
-      worker.postMessage({ id, status: "done" });
-    } catch (error) {
-      worker.postMessage({ id, status: "error", error });
-    }
-  };
-}
-
 module.exports = {
   WorkerDispatcher,
-  workerHandler,
-  streamingWorkerHandler
+  workerHandler
 };
--- a/devtools/client/debugger/src/actions/navigation.js
+++ b/devtools/client/debugger/src/actions/navigation.js
@@ -29,36 +29,30 @@ import type { Action, ThunkArgs } from "
  */
 
 /**
  * @memberof actions/navigation
  * @static
  */
 export function willNavigate(event: Object) {
   return function({ dispatch, getState, client, sourceMaps }: ThunkArgs) {
+    sourceQueue.clear();
     sourceMaps.clearSourceMaps();
     clearWasmStates();
     clearDocuments();
     clearSymbols();
     clearASTs();
     clearScopes();
     clearSources();
     client.detachWorkers();
-    dispatch(navigate(event.url));
-  };
-}
-
-export function navigate(url: string) {
-  return async function({ dispatch, getState }: ThunkArgs) {
-    sourceQueue.clear();
     const thread = getMainThread(getState());
 
     dispatch({
       type: "NAVIGATE",
-      mainThread: { ...thread, url }
+      mainThread: { ...thread, url: event.url }
     });
   };
 }
 
 export function connect(url: string, actor: string, canRewind: boolean) {
   return async function({ dispatch }: ThunkArgs) {
     await dispatch(updateWorkers());
     dispatch(
--- a/devtools/client/debugger/src/actions/sources/newSources.js
+++ b/devtools/client/debugger/src/actions/sources/newSources.js
@@ -38,56 +38,62 @@ import {
   getPendingSelectedLocation,
   getPendingBreakpointsForSource,
   getContext,
   isSourceLoadingOrLoaded
 } from "../../selectors";
 
 import { prefs } from "../../utils/prefs";
 import sourceQueue from "../../utils/source-queue";
-import { ContextError } from "../../utils/context";
+import { validateNavigateContext, ContextError } from "../../utils/context";
 
 import type {
   Source,
   SourceId,
   Context,
   OriginalSourceData,
   GeneratedSourceData,
   QueuedSourceData
 } from "../../types";
 import type { Action, ThunkArgs } from "../types";
 
 function loadSourceMaps(cx: Context, sources: Source[]) {
   return async function({
     dispatch,
     sourceMaps
-  }: ThunkArgs): Promise<Promise<Source>[]> {
-    const sourceList = await Promise.all(
-      sources.map(async ({ id }) => {
-        const originalSources = await dispatch(loadSourceMap(cx, id));
-        sourceQueue.queueSources(
-          originalSources.map(data => ({
-            type: "original",
-            data
-          }))
-        );
-        return originalSources;
-      })
-    );
+  }: ThunkArgs): Promise<?(Promise<Source>[])> {
+    try {
+      const sourceList = await Promise.all(
+        sources.map(async ({ id }) => {
+          const originalSources = await dispatch(loadSourceMap(cx, id));
+          sourceQueue.queueSources(
+            originalSources.map(data => ({
+              type: "original",
+              data
+            }))
+          );
+          return originalSources;
+        })
+      );
 
-    await sourceQueue.flush();
+      await sourceQueue.flush();
 
-    // We would like to sync breakpoints after we are done
-    // loading source maps as sometimes generated and original
-    // files share the same paths.
-    for (const source of sources) {
-      dispatch(checkPendingBreakpoints(cx, source.id));
+      // We would like to sync breakpoints after we are done
+      // loading source maps as sometimes generated and original
+      // files share the same paths.
+      for (const source of sources) {
+        dispatch(checkPendingBreakpoints(cx, source.id));
+      }
+
+      return flatten(sourceList);
+    } catch (error) {
+      if (!(error instanceof ContextError)) {
+        throw error;
+      }
     }
-
-    return flatten(sourceList);
   };
 }
 
 /**
  * @memberof actions/sources
  * @static
  */
 function loadSourceMap(cx: Context, sourceId: SourceId) {
@@ -132,16 +138,17 @@ function loadSourceMap(cx: Context, sour
           type: "CLEAR_SOURCE_MAP_URL",
           cx,
           sourceId
         }: Action)
       );
       return [];
     }
 
+    validateNavigateContext(getState(), cx);
     return urls.map(url => ({
       id: generatedToOriginalId(source.id, url),
       url
     }));
   };
 }
 
 // If a request has been made to show this source, go ahead and
--- a/devtools/client/debugger/src/components/Editor/ConditionalPanel.js
+++ b/devtools/client/debugger/src/components/Editor/ConditionalPanel.js
@@ -164,16 +164,23 @@ export class ConditionalPanel extends Pu
       mode: "javascript",
       theme: "mozilla",
       placeholder: L10N.getStr(
         log
           ? "editor.conditionalPanel.logPoint.placeholder2"
           : "editor.conditionalPanel.placeholder2"
       )
     });
+
+    codeMirror.on("keydown", (cm, e) => {
+      if (e.key === "Enter") {
+        e.codemirrorIgnore = true;
+      }
+    });
+
     const codeMirrorWrapper = codeMirror.getWrapperElement();
 
     codeMirrorWrapper.addEventListener("keydown", e => {
       codeMirror.save();
       this.onKey(e);
     });
 
     this.input = input;
--- a/devtools/client/debugger/src/utils/source-queue.js
+++ b/devtools/client/debugger/src/utils/source-queue.js
@@ -31,10 +31,13 @@ export default {
   queueSources: (sources: QueuedSourceData[]) => {
     if (sources.length > 0) {
       queuedSources = queuedSources.concat(sources);
       queue();
     }
   },
 
   flush: () => Promise.all([queue.flush(), currentWork]),
-  clear: () => queue.cancel()
+  clear: () => {
+    queuedSources = [];
+    queue.cancel();
+  }
 };
--- a/devtools/client/debugger/test/mochitest/browser.ini
+++ b/devtools/client/debugger/test/mochitest/browser.ini
@@ -762,16 +762,17 @@ skip-if = os == "win"
 [browser_dbg-search-project.js]
 [browser_dbg-blackbox-original.js]
 [browser_dbg-sourcemaps.js]
 [browser_dbg-sourcemaps-breakpoints.js]
 [browser_dbg-sourcemaps-disabled.js]
 [browser_dbg-sourcemaps-reload.js]
 skip-if = os == "win" || (verify) # Bug 1434792
 [browser_dbg-sourcemaps-reloading.js]
+[browser_dbg-sourcemaps-reloading-quickly.js]
 [browser_dbg-sourcemaps2.js]
 [browser_dbg-sourcemaps3.js]
 [browser_dbg-sourcemaps-bogus.js]
 skip-if = os == 'linux' && !asan # bug 1447118
 [browser_dbg-sources.js]
 [browser_dbg-sources-arrow-keys.js]
 [browser_dbg-sources-named-eval.js]
 [browser_dbg-sources-querystring.js]
--- a/devtools/client/debugger/test/mochitest/browser_dbg-breakpoints-cond.js
+++ b/devtools/client/debugger/test/mochitest/browser_dbg-breakpoints-cond.js
@@ -51,16 +51,20 @@ async function setLogPoint(dbg, index, v
   rightClickElement(dbg, "gutter", index);
   selectContextMenuItem(
     dbg,
     `${selectors.addLogItem},${selectors.editLogItem}`
   );
   await typeInPanel(dbg, value);
 }
 
+async function waitForConditionalPanelFocus(dbg) {
+  await waitFor(() => dbg.win.document.activeElement.tagName === "TEXTAREA");
+}
+
 add_task(async function() {
   const dbg = await initDebugger("doc-scripts.html", "simple2");
   await pushPref("devtools.debugger.features.column-breakpoints", true);
   await pushPref("devtools.debugger.features.log-points", true);
 
   await selectSource(dbg, "simple2");
   await waitForSelectedSource(dbg, "simple2");
 
@@ -75,16 +79,39 @@ add_task(async function() {
   info("Edit the conditional breakpoint set above");
   await setConditionalBreakpoint(dbg, 5, "2");
   await waitForCondition(dbg, 12);
 
   bp = findBreakpoint(dbg, "simple2", 5);
   is(bp.options.condition, "12", "breakpoint is created with the condition");
   await assertEditorBreakpoint(dbg, 5, { hasCondition: true });
 
+  info("Hit 'Enter' when the cursor is in the conditional statement");
+  rightClickElement(dbg, "gutter", 5);
+  selectContextMenuItem(dbg, `${selectors.editConditionItem}`);
+  await waitForConditionalPanelFocus(dbg);
+  pressKey(dbg, "Left");
+  pressKey(dbg, "Enter");
+  await waitForCondition(dbg, 12);
+
+  bp = findBreakpoint(dbg, "simple2", 5);
+  is(bp.options.condition, "12", "Hit 'Enter' doesn't add a new line");
+
+  info("Hit 'Alt+Enter' when the cursor is in the conditional statement");
+  rightClickElement(dbg, "gutter", 5);
+  selectContextMenuItem(dbg, `${selectors.editConditionItem}`);
+  await waitForConditionalPanelFocus(dbg);
+  pressKey(dbg, "Left");
+  pressKey(dbg, "AltEnter");
+  pressKey(dbg, "Enter");
+  await waitForCondition(dbg, "1\n2");
+
+  bp = findBreakpoint(dbg, "simple2", 5);
+  is(bp.options.condition, "1\n2", "Hit 'Alt+Enter' adds a new line");
+
   clickElement(dbg, "gutter", 5);
   await waitForDispatch(dbg, "REMOVE_BREAKPOINT");
   bp = findBreakpoint(dbg, "simple2", 5);
   is(bp, null, "breakpoint was removed");
   await assertEditorBreakpoint(dbg, 5);
 
   info("Adding a condition to a breakpoint");
   clickElement(dbg, "gutter", 5);
new file mode 100644
--- /dev/null
+++ b/devtools/client/debugger/test/mochitest/browser_dbg-sourcemaps-reloading-quickly.js
@@ -0,0 +1,27 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at <http://mozilla.org/MPL/2.0/>. */
+
+/*
+ * Test reloading an original file while the sourcemap is loading.
+ * The test passes when the selected source is visible after two reloads.
+ */
+add_task(async function() {
+  const dbg = await initDebugger("doc-sourcemaps.html");
+
+  await waitForSources(dbg, "entry.js");
+  await selectSource(dbg, "entry.js");
+
+  await reload(dbg);
+  await waitForSources(dbg, "bundle.js");
+
+  await reload(dbg);
+  await waitForLoadedSource(dbg, "entry.js");
+
+  ok(
+    getCM(dbg)
+      .getValue()
+      .includes("window.keepMeAlive"),
+    "Original source text loaded correctly"
+  );
+});
--- a/devtools/client/debugger/test/mochitest/helpers.js
+++ b/devtools/client/debugger/test/mochitest/helpers.js
@@ -1055,16 +1055,20 @@ const keyMappings = {
   quickOpen: { code: "p", modifiers: cmdOrCtrl },
   quickOpenFunc: { code: "o", modifiers: cmdShift },
   quickOpenLine: { code: ":", modifiers: cmdOrCtrl },
   fileSearch: { code: "f", modifiers: cmdOrCtrl },
   fileSearchNext: { code: "g", modifiers: cmdOrCtrl },
   fileSearchPrev: { code: "g", modifiers: cmdShift },
   Enter: { code: "VK_RETURN" },
   ShiftEnter: { code: "VK_RETURN", modifiers: shiftOrAlt },
+  AltEnter: { 
+    code: "VK_RETURN", 
+    modifiers: { altKey: true }
+  },
   Up: { code: "VK_UP" },
   Down: { code: "VK_DOWN" },
   Right: { code: "VK_RIGHT" },
   Left: { code: "VK_LEFT" },
   End: endKey,
   Start: startKey,
   Tab: { code: "VK_TAB" },
   Escape: { code: "VK_ESCAPE" },
--- a/devtools/client/jar.mn
+++ b/devtools/client/jar.mn
@@ -112,16 +112,17 @@ devtools.jar:
     skin/images/command-noautohide.svg (themes/images/command-noautohide.svg)
     skin/images/command-chevron.svg (themes/images/command-chevron.svg)
     skin/images/rules-view-print-simulation.svg (themes/images/rules-view-print-simulation.svg)
     skin/markup.css (themes/markup.css)
     skin/webconsole.css (themes/webconsole.css)
     skin/images/webconsole/error.svg (themes/images/webconsole/error.svg)
     skin/images/webconsole/info.svg (themes/images/webconsole/info.svg)
     skin/images/webconsole/input.svg (themes/images/webconsole/input.svg)
+    skin/images/webconsole/navigation.svg (themes/images/webconsole/navigation.svg)
     skin/images/webconsole/return.svg (themes/images/webconsole/return.svg)
     skin/images/breadcrumbs-scrollbutton.svg (themes/images/breadcrumbs-scrollbutton.svg)
     skin/animation.css (themes/animation.css)
     skin/perf.css (themes/perf.css)
     skin/performance.css (themes/performance.css)
     skin/memory.css (themes/memory.css)
     skin/scratchpad.css (themes/scratchpad.css)
     skin/storage.css (themes/storage.css)
--- a/devtools/client/netmonitor/src/assets/styles/NetworkDetailsPanel.css
+++ b/devtools/client/netmonitor/src/assets/styles/NetworkDetailsPanel.css
@@ -327,34 +327,35 @@
   margin-inline-end: 2px;
 }
 
 .network-monitor .headers-summary .status-text {
     width: auto!important;
     margin-left: 4px;
 }
 
-/* Params tabpanel */
+/* Params and Response error messages */
 
-.network-monitor .request-error-header {
+.network-monitor .request-error-header,
+.network-monitor .response-error-header {
   margin: 0;
-  padding: 3px 8px;
-  background-color: var(--theme-highlight-red);
-  color: var(--theme-selection-color);
+  padding: 4px 8px;
+  border-bottom: 1px solid var(--theme-splitter-color);
+  background-color: var(--red-60);
+  color: white;
+  line-height: 16px;
+}
+
+.theme-dark .network-monitor .request-error-header,
+.theme-dark .network-monitor .response-error-header {
+  background-color: var(--red-70);
 }
 
 /* Response tabpanel */
 
-.network-monitor .response-error-header {
-  margin: 0;
-  padding: 3px 8px;
-  background-color: var(--theme-highlight-red);
-  color: var(--theme-selection-color);
-}
-
 .network-monitor .response-image-box {
   display: flex;
   flex-direction: column;
   justify-content: center;
   align-items: center;
   overflow-y: auto;
   padding: 10px;
 }
--- a/devtools/client/shared/components/reps/reps.css
+++ b/devtools/client/shared/components/reps/reps.css
@@ -350,30 +350,27 @@ button.open-inspector {
 .open-inspector:hover {
   background-color: var(--theme-icon-checked-color);
 }
 
 /******************************************************************************/
 /* Jump to definition button */
 
 button.jump-definition {
+  mask: url("resource://devtools/client/shared/components/reps/images/jump-definition.svg")
+    no-repeat;
   display: inline-block;
+  background-color: var(--theme-icon-color);
   height: 16px;
   margin-left: 0.25em;
   vertical-align: middle;
-  background: 0% 50% url("resource://devtools/client/shared/components/reps/images/jump-definition.svg")
-    no-repeat;
-  border-color: transparent;
-  stroke: var(--theme-icon-color);
-  -moz-context-properties: stroke;
-  cursor: pointer;
 }
 
 .jump-definition:hover {
-  stroke: var(--theme-icon-checked-color);
+  background-color: var(--theme-icon-checked-color);
 }
 
 /******************************************************************************/
 /* Invoke getter button */
 
 button.invoke-getter {
   mask: url("resource://devtools/client/shared/components/reps/images/input.svg")
     no-repeat;
@@ -441,16 +438,13 @@ button.invoke-getter {
   margin-inline-start: -1px;
 }
 
 /* Focused styles */
 .tree.object-inspector .tree-node.focused * {
   color: inherit;
 }
 
+.tree-node.focused button.jump-definition,
 .tree-node.focused button.open-inspector,
 .tree-node.focused button.invoke-getter {
   background-color: currentColor;
 }
-
-.tree-node.focused .jump-definition.focused {
-  stroke: var(--theme-selection-background);
-}
--- a/devtools/client/shared/source-map/index.js
+++ b/devtools/client/shared/source-map/index.js
@@ -399,17 +399,17 @@ function networkRequest(url, opts) {
 
 module.exports = networkRequest;
 
 /***/ }),
 
 /***/ 14:
 /***/ (function(module, exports) {
 
-function _asyncToGenerator(fn) { return function () { var gen = fn.apply(this, arguments); return new Promise(function (resolve, reject) { function step(key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { return Promise.resolve(value).then(function (value) { step("next", value); }, function (err) { step("throw", err); }); } } return step("next"); }); }; }
+
 
 function WorkerDispatcher() {
   this.msgId = 1;
   this.worker = null;
 } /* This Source Code Form is subject to the terms of the Mozilla Public
    * License, v. 2.0. If a copy of the MPL was not distributed with this
    * file, You can obtain one at <http://mozilla.org/MPL/2.0/>. */
 
@@ -514,72 +514,19 @@ function workerHandler(publicInterface) 
         return { error: error.toString() };
       }
     })).then(results => {
       self.postMessage({ id, results });
     });
   };
 }
 
-function streamingWorkerHandler(publicInterface, { timeout = 100 } = {}, worker = self) {
-  let streamingWorker = (() => {
-    var _ref = _asyncToGenerator(function* (id, tasks) {
-      let isWorking = true;
-
-      const timeoutId = setTimeout(function () {
-        isWorking = false;
-      }, timeout);
-
-      const results = [];
-      while (tasks.length !== 0 && isWorking) {
-        const { callback, context, args } = tasks.shift();
-        const result = yield callback.call(context, args);
-        results.push(result);
-      }
-      worker.postMessage({ id, status: "pending", data: results });
-      clearTimeout(timeoutId);
-
-      if (tasks.length !== 0) {
-        yield streamingWorker(id, tasks);
-      }
-    });
-
-    return function streamingWorker(_x, _x2) {
-      return _ref.apply(this, arguments);
-    };
-  })();
-
-  return (() => {
-    var _ref2 = _asyncToGenerator(function* (msg) {
-      const { id, method, args } = msg.data;
-      const workerMethod = publicInterface[method];
-      if (!workerMethod) {
-        console.error(`Could not find ${method} defined in worker.`);
-      }
-      worker.postMessage({ id, status: "start" });
-
-      try {
-        const tasks = workerMethod(args);
-        yield streamingWorker(id, tasks);
-        worker.postMessage({ id, status: "done" });
-      } catch (error) {
-        worker.postMessage({ id, status: "error", error });
-      }
-    });
-
-    return function (_x3) {
-      return _ref2.apply(this, arguments);
-    };
-  })();
-}
-
 module.exports = {
   WorkerDispatcher,
-  workerHandler,
-  streamingWorkerHandler
+  workerHandler
 };
 
 /***/ }),
 
 /***/ 182:
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
--- a/devtools/client/shared/source-map/worker.js
+++ b/devtools/client/shared/source-map/worker.js
@@ -443,17 +443,17 @@ function networkRequest(url, opts) {
 
 module.exports = networkRequest;
 
 /***/ }),
 
 /***/ 14:
 /***/ (function(module, exports) {
 
-function _asyncToGenerator(fn) { return function () { var gen = fn.apply(this, arguments); return new Promise(function (resolve, reject) { function step(key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { return Promise.resolve(value).then(function (value) { step("next", value); }, function (err) { step("throw", err); }); } } return step("next"); }); }; }
+
 
 function WorkerDispatcher() {
   this.msgId = 1;
   this.worker = null;
 } /* This Source Code Form is subject to the terms of the Mozilla Public
    * License, v. 2.0. If a copy of the MPL was not distributed with this
    * file, You can obtain one at <http://mozilla.org/MPL/2.0/>. */
 
@@ -558,72 +558,19 @@ function workerHandler(publicInterface) 
         return { error: error.toString() };
       }
     })).then(results => {
       self.postMessage({ id, results });
     });
   };
 }
 
-function streamingWorkerHandler(publicInterface, { timeout = 100 } = {}, worker = self) {
-  let streamingWorker = (() => {
-    var _ref = _asyncToGenerator(function* (id, tasks) {
-      let isWorking = true;
-
-      const timeoutId = setTimeout(function () {
-        isWorking = false;
-      }, timeout);
-
-      const results = [];
-      while (tasks.length !== 0 && isWorking) {
-        const { callback, context, args } = tasks.shift();
-        const result = yield callback.call(context, args);
-        results.push(result);
-      }
-      worker.postMessage({ id, status: "pending", data: results });
-      clearTimeout(timeoutId);
-
-      if (tasks.length !== 0) {
-        yield streamingWorker(id, tasks);
-      }
-    });
-
-    return function streamingWorker(_x, _x2) {
-      return _ref.apply(this, arguments);
-    };
-  })();
-
-  return (() => {
-    var _ref2 = _asyncToGenerator(function* (msg) {
-      const { id, method, args } = msg.data;
-      const workerMethod = publicInterface[method];
-      if (!workerMethod) {
-        console.error(`Could not find ${method} defined in worker.`);
-      }
-      worker.postMessage({ id, status: "start" });
-
-      try {
-        const tasks = workerMethod(args);
-        yield streamingWorker(id, tasks);
-        worker.postMessage({ id, status: "done" });
-      } catch (error) {
-        worker.postMessage({ id, status: "error", error });
-      }
-    });
-
-    return function (_x3) {
-      return _ref2.apply(this, arguments);
-    };
-  })();
-}
-
 module.exports = {
   WorkerDispatcher,
-  workerHandler,
-  streamingWorkerHandler
+  workerHandler
 };
 
 /***/ }),
 
 /***/ 15:
 /***/ (function(module, exports) {
 
 var g;
--- a/devtools/client/themes/images/alert.svg
+++ b/devtools/client/themes/images/alert.svg
@@ -1,6 +1,6 @@
 <!-- This Source Code Form is subject to the terms of the Mozilla Public
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 12 12">
-  <path fill="context-fill #0b0b0b" fill-rule="evenodd" d="M6 0a1 1 0 0 1 .89.54l5 9.6A1 1 0 0 1 11 11.6H1a1 1 0 0 1-.89-1.46l5-9.6A1 1 0 0 1 6 0zm-.25 8a.75.75 0 0 0-.75.75v.5c0 .41.34.75.75.75h.5c.41 0 .75-.34.75-.75v-.5A.75.75 0 0 0 6.25 8h-.5zM7 3.7a1 1 0 1 0-2 0v2.6a1 1 0 1 0 2 0V3.7z" />
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 12 12" width="12" height="12">
+  <path fill="context-fill" d="M6 0a1 1 0 0 1 .89.54l5 9.6A1 1 0 0 1 11 11.6H1a1 1 0 0 1-.89-1.46l5-9.6A1 1 0 0 1 6 0zm-.25 8a.75.75 0 0 0-.75.75v.5c0 .41.34.75.75.75h.5c.41 0 .75-.34.75-.75v-.5A.75.75 0 0 0 6.25 8h-.5zM7 3.7a1 1 0 1 0-2 0v2.6a1 1 0 1 0 2 0V3.7z" />
 </svg>
--- a/devtools/client/themes/images/globe.svg
+++ b/devtools/client/themes/images/globe.svg
@@ -1,6 +1,6 @@
 <!-- This Source Code Form is subject to the terms of the Mozilla Public
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" fill="context-fill #0b0b0b">
-  <path d="M8 0a8 8 0 1 0 8 8 8 8 0 0 0-8-8zm5.16 4.96h-1.55a7.7 7.7 0 0 0-1.05-2.38 6.03 6.03 0 0 1 2.6 2.38zM14 8a5.96 5.96 0 0 1-.34 1.96h-1.82A12.33 12.33 0 0 0 12 8a12.33 12.33 0 0 0-.16-1.96h1.82A5.96 5.96 0 0 1 14 8zm-6 6c-1.07 0-2.04-1.2-2.57-2.96h5.14C10.04 12.8 9.07 14 8 14zM5.17 9.96a11.08 11.08 0 0 1 0-3.92h5.66A11.11 11.11 0 0 1 11 8a11.11 11.11 0 0 1-.17 1.96zM2 8a5.96 5.96 0 0 1 .34-1.96h1.82a12.36 12.36 0 0 0 0 3.92H2.33A5.96 5.96 0 0 1 2 8zm6-6c1.07 0 2.04 1.2 2.57 2.96H5.43C5.96 3.2 6.93 2 8 2zm-2.56.58a7.7 7.7 0 0 0-1.05 2.38H2.84a6.03 6.03 0 0 1 2.6-2.38zm-2.6 8.46h1.55a7.7 7.7 0 0 0 1.05 2.38 6.03 6.03 0 0 1-2.6-2.38zm7.72 2.38a7.7 7.7 0 0 0 1.05-2.38h1.56a6.03 6.03 0 0 1-2.61 2.38z"/>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" width="16" height="16">
+  <path fill="context-fill" d="M8 0a8 8 0 1 0 8 8 8 8 0 0 0-8-8zm5.16 4.96h-1.55a7.7 7.7 0 0 0-1.05-2.38 6.03 6.03 0 0 1 2.6 2.38zM14 8a5.96 5.96 0 0 1-.34 1.96h-1.82A12.33 12.33 0 0 0 12 8a12.33 12.33 0 0 0-.16-1.96h1.82A5.96 5.96 0 0 1 14 8zm-6 6c-1.07 0-2.04-1.2-2.57-2.96h5.14C10.04 12.8 9.07 14 8 14zM5.17 9.96a11.08 11.08 0 0 1 0-3.92h5.66A11.11 11.11 0 0 1 11 8a11.11 11.11 0 0 1-.17 1.96zM2 8a5.96 5.96 0 0 1 .34-1.96h1.82a12.36 12.36 0 0 0 0 3.92H2.33A5.96 5.96 0 0 1 2 8zm6-6c1.07 0 2.04 1.2 2.57 2.96H5.43C5.96 3.2 6.93 2 8 2zm-2.56.58a7.7 7.7 0 0 0-1.05 2.38H2.84a6.03 6.03 0 0 1 2.6-2.38zm-2.6 8.46h1.55a7.7 7.7 0 0 0 1.05 2.38 6.03 6.03 0 0 1-2.6-2.38zm7.72 2.38a7.7 7.7 0 0 0 1.05-2.38h1.56a6.03 6.03 0 0 1-2.61 2.38z"/>
 </svg>
--- a/devtools/client/themes/images/webconsole/error.svg
+++ b/devtools/client/themes/images/webconsole/error.svg
@@ -1,6 +1,6 @@
 <!-- This Source Code Form is subject to the terms of the Mozilla Public
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 12 12" fill="context-fill #0b0b0b">
-  <path fill-rule="evenodd" d="M12 6A6 6 0 1 1 0 6a6 6 0 0 1 12 0zM5.75 8a.75.75 0 0 0-.75.75v.5c0 .41.34.75.75.75h.5c.41 0 .75-.34.75-.75v-.5A.75.75 0 0 0 6.25 8h-.5zM5 6c0 .54.46 1 1 1s1-.46 1-1V3.15c0-.54-.46-1-1-1s-1 .46-1 1V6z"/>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 12 12" width="12" height="12">
+  <path fill="context-fill" d="M12 6A6 6 0 1 1 0 6a6 6 0 0 1 12 0zM5.75 8a.75.75 0 0 0-.75.75v.5c0 .41.34.75.75.75h.5c.41 0 .75-.34.75-.75v-.5A.75.75 0 0 0 6.25 8h-.5zM5 6c0 .54.46 1 1 1s1-.46 1-1V3.15c0-.54-.46-1-1-1s-1 .46-1 1V6z"/>
 </svg>
--- a/devtools/client/themes/images/webconsole/info.svg
+++ b/devtools/client/themes/images/webconsole/info.svg
@@ -1,7 +1,7 @@
 <!-- This Source Code Form is subject to the terms of the Mozilla Public
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 12 12">
-  <circle cx="6" cy="6" r="5.5" fill="none" opacity="0.8" stroke="context-fill"/>
-  <path d="M7 8a1 1 0 0 1-2 0V6.25a1 1 0 0 1 2 0V8zM7 3.5c0 .45-.45.8-1 .8s-1-.35-1-.8c0-.45.45-.8 1-.8s1 .35 1 .8z" fill="context-fill #0b0b0b"/>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 12 12" width="12" height="12">
+  <path fill="context-fill" fill-opacity=".8" d="M6 1a5 5 0 1 0 0 10A5 5 0 0 0 6 1zM0 6a6 6 0 1 1 12 0A6 6 0 0 1 0 6z"/>
+  <path fill="context-fill" d="M7 3.5a1 1 0 1 1-2 0 1 1 0 0 1 2 0zM5 6.5a1 1 0 0 1 2 0v1.75a1 1 0 0 1-2 0V6.5z"/>
 </svg>
--- a/devtools/client/themes/images/webconsole/input.svg
+++ b/devtools/client/themes/images/webconsole/input.svg
@@ -1,6 +1,6 @@
 <!-- This Source Code Form is subject to the terms of the Mozilla Public
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 12 12">
-  <path fill="none" stroke="context-fill" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" d="M1.7 1.85L5.85 6L1.7 10.15 M6.7 1.85L10.85 6L6.7 10.15"/>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 12 12" width="12" height="12">
+  <path fill="context-fill" d="M1.07 1.32c.3-.3.77-.3 1.06 0l4.15 4.15a.75.75 0 0 1 0 1.06l-4.15 4.15a.75.75 0 1 1-1.06-1.06L4.69 6 1.07 2.38a.75.75 0 0 1 0-1.06zm5 0c.3-.3.77-.3 1.06 0l4.15 4.15a.75.75 0 0 1 0 1.06l-4.15 4.15a.75.75 0 1 1-1.06-1.06L9.69 6 6.07 2.38a.75.75 0 0 1 0-1.06z"/>
 </svg>
new file mode 100644
--- /dev/null
+++ b/devtools/client/themes/images/webconsole/navigation.svg
@@ -0,0 +1,7 @@
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 12 12" width="12" height="12">
+  <path fill="context-fill" d="M6 1a5 5 0 1 0 0 10A5 5 0 0 0 6 1zM0 6a6 6 0 1 1 12 0A6 6 0 0 1 0 6zM1 4h10v1H1V4zM1 7h10v1H1V7z"/>
+  <path fill="context-fill" fill-rule="evenodd" d="M7.23 9.8C7.69 8.88 8 7.54 8 6s-.31-2.88-.77-3.8C6.73 1.23 6.25 1 6 1s-.74.23-1.23 1.2A8.74 8.74 0 0 0 4 6c0 1.54.31 2.88.77 3.8.5.97.98 1.2 1.23 1.2s.74-.23 1.23-1.2zM6 12c1.66 0 3-2.69 3-6S7.66 0 6 0 3 2.69 3 6s1.34 6 3 6z"/>
+</svg>
--- a/devtools/client/themes/images/webconsole/return.svg
+++ b/devtools/client/themes/images/webconsole/return.svg
@@ -1,6 +1,6 @@
 <!-- This Source Code Form is subject to the terms of the Mozilla Public
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 12 12">
-  <path fill="none" stroke="context-fill" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M6.15 10.15L2 6L6.15 1.85 M3 6H10"/>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 12 12" width="12" height="12">
+  <path fill="context-fill" d="M6.68 1.32c.3.3.3.77 0 1.06L3.81 5.25h6.44a.75.75 0 0 1 0 1.5H3.81l2.87 2.87a.75.75 0 1 1-1.06 1.06L1.47 6.53a.75.75 0 0 1 0-1.06l4.15-4.15c.3-.3.77-.3 1.06 0z"/>
 </svg>
--- a/devtools/client/themes/webconsole.css
+++ b/devtools/client/themes/webconsole.css
@@ -178,19 +178,19 @@ a {
   flex: none;
   align-self: flex-start;
   /* Width and height must be a multiples of 2px to avoid blurry images.
    * Height should match the text's line-height for optimal vertical alignment */
   width: 14px;
   height: 14px;
   margin: var(--console-output-vertical-padding) 4px;
   background-image: none;
-  background-position: 50% 50%;
+  background-position: center;
   background-repeat: no-repeat;
-  background-size: 12px 12px;
+  background-size: 12px;
   -moz-context-properties: fill;
   fill: currentColor;
 }
 
 /* Icon on unindented row should be centered within the left gutter */
 .message > .indent[data-indent="0"] + .icon {
   width: 24px;
   margin-inline-start: var(--console-icon-horizontal-offset);
@@ -219,17 +219,17 @@ a {
 
 .message.warn > .icon {
   color: var(--console-output-icon-warning-color);
   background-image: url(chrome://devtools/skin/images/alert.svg);
 }
 
 .message.navigationMarker > .icon {
   color: var(--object-color);
-  background-image: url(chrome://devtools/skin/images/globe.svg);
+  background-image: url(chrome://devtools/skin/images/webconsole/navigation.svg);
 }
 
 .message:hover > .icon.rewindable {
   background-image: url(chrome://devtools/skin/images/next-circle.svg);
   cursor: pointer;
   transform: rotate(180deg);
 }
 
--- a/dom/base/Element.cpp
+++ b/dom/base/Element.cpp
@@ -3151,17 +3151,17 @@ nsresult Element::PostHandleEventForLink
         aVisitor.mEventStatus = nsEventStatus_eConsumeNoDefault;
       }
     } break;
 
     case eKeyPress: {
       WidgetKeyboardEvent* keyEvent = aVisitor.mEvent->AsKeyboardEvent();
       if (keyEvent && keyEvent->mKeyCode == NS_VK_RETURN) {
         nsEventStatus status = nsEventStatus_eIgnore;
-        rv = DispatchClickEvent(aVisitor.mPresContext, keyEvent, this, false,
+        rv = DispatchClickEvent(MOZ_KnownLive(aVisitor.mPresContext), keyEvent, this, false,
                                 nullptr, &status);
         if (NS_SUCCEEDED(rv)) {
           aVisitor.mEventStatus = nsEventStatus_eConsumeNoDefault;
         }
       }
     } break;
 
     default:
--- a/dom/base/Element.h
+++ b/dom/base/Element.h
@@ -1363,30 +1363,32 @@ class Element : public FragmentOrElement
    * aSourceEvent. If aFullDispatch is true, the event will be dispatched
    * through the full dispatching of the presshell of the aPresContext; if it's
    * false the event will be dispatched only as a DOM event.
    * If aPresContext is nullptr, this does nothing.
    *
    * @param aFlags      Extra flags for the dispatching event.  The true flags
    *                    will be respected.
    */
+  MOZ_CAN_RUN_SCRIPT
   static nsresult DispatchClickEvent(nsPresContext* aPresContext,
                                      WidgetInputEvent* aSourceEvent,
                                      nsIContent* aTarget, bool aFullDispatch,
                                      const EventFlags* aFlags,
                                      nsEventStatus* aStatus);
 
   /**
    * Method to dispatch aEvent to aTarget. If aFullDispatch is true, the event
    * will be dispatched through the full dispatching of the presshell of the
    * aPresContext; if it's false the event will be dispatched only as a DOM
    * event.
    * If aPresContext is nullptr, this does nothing.
    */
   using nsIContent::DispatchEvent;
+  MOZ_CAN_RUN_SCRIPT
   static nsresult DispatchEvent(nsPresContext* aPresContext,
                                 WidgetEvent* aEvent, nsIContent* aTarget,
                                 bool aFullDispatch, nsEventStatus* aStatus);
 
   bool IsDisplayContents() const {
     return HasServoData() && Servo_Element_IsDisplayContents(this);
   }
 
--- a/dom/base/Selection.cpp
+++ b/dom/base/Selection.cpp
@@ -193,17 +193,17 @@ class nsAutoScrollTimer final : public n
     return NS_OK;
   }
 
   nsresult SetDelay(uint32_t aDelay) {
     mDelay = aDelay;
     return NS_OK;
   }
 
-  NS_IMETHOD Notify(nsITimer* timer) override {
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHOD Notify(nsITimer* timer) override {
     if (mSelection && mPresContext) {
       AutoWeakFrame frame =
           mContent ? mPresContext->GetPrimaryFrameFor(mContent) : nullptr;
       if (!frame) {
         return NS_OK;
       }
       mContent = nullptr;
 
@@ -211,17 +211,18 @@ class nsAutoScrollTimer final : public n
                                 mPresContext->PresShell()->GetRootFrame());
       RefPtr<nsFrameSelection> frameSelection = mFrameSelection;
       frameSelection->HandleDrag(frame, pt);
       if (!frame.IsAlive()) {
         return NS_OK;
       }
 
       NS_ASSERTION(frame->PresContext() == mPresContext, "document mismatch?");
-      mSelection->DoAutoScroll(frame, pt);
+      RefPtr<Selection> selection = mSelection;
+      selection->DoAutoScroll(frame, pt);
     }
     return NS_OK;
   }
 
   NS_IMETHOD GetName(nsACString& aName) override {
     aName.AssignLiteral("nsAutoScrollTimer");
     return NS_OK;
   }
@@ -3039,17 +3040,17 @@ void Selection::ScrollIntoView(int16_t a
 
 nsresult Selection::ScrollIntoView(SelectionRegion aRegion,
                                    ScrollAxis aVertical, ScrollAxis aHorizontal,
                                    int32_t aFlags) {
   if (!mFrameSelection) {
     return NS_OK;
   }
 
-  PresShell* presShell = mFrameSelection->GetPresShell();
+  RefPtr<PresShell> presShell = mFrameSelection->GetPresShell();
   if (!presShell || !presShell->GetDocument()) {
     return NS_OK;
   }
 
   if (mFrameSelection->GetBatching()) return NS_OK;
 
   if (!(aFlags & Selection::SCROLL_SYNCHRONOUS))
     return PostScrollSelectionIntoViewEvent(aRegion, aFlags, aVertical,
--- a/dom/base/Selection.h
+++ b/dom/base/Selection.h
@@ -148,16 +148,17 @@ class Selection final : public nsSupport
     SCROLL_OVERFLOW_HIDDEN = 1 << 5,
     SCROLL_FOR_CARET_MOVE = 1 << 6
   };
   // If aFlags doesn't contain SCROLL_SYNCHRONOUS, then we'll flush when
   // the scroll event fires so we make sure to scroll to the right place.
   // Otherwise, if SCROLL_DO_FLUSH is also in aFlags, then this method will
   // flush layout and you MUST hold a strong ref on 'this' for the duration
   // of this call.  This might destroy arbitrary layout objects.
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY
   nsresult ScrollIntoView(SelectionRegion aRegion,
                           ScrollAxis aVertical = ScrollAxis(),
                           ScrollAxis aHorizontal = ScrollAxis(),
                           int32_t aFlags = 0);
   nsresult SubtractRange(RangeData* aRange, nsRange* aSubtract,
                          nsTArray<RangeData>* aOutput);
   /**
    * AddItem adds aRange to this Selection.  If mUserInitiated is true,
@@ -204,17 +205,17 @@ class Selection final : public nsSupport
 
   UniquePtr<SelectionDetails> LookUpSelection(
       nsIContent* aContent, int32_t aContentOffset, int32_t aContentLength,
       UniquePtr<SelectionDetails> aDetailsHead, SelectionType aSelectionType,
       bool aSlowCheck);
 
   NS_IMETHOD Repaint(nsPresContext* aPresContext);
 
-  // Note: StartAutoScrollTimer might destroy arbitrary frames etc.
+  MOZ_CAN_RUN_SCRIPT
   nsresult StartAutoScrollTimer(nsIFrame* aFrame, const nsPoint& aPoint,
                                 uint32_t aDelay);
 
   nsresult StopAutoScrollTimer();
 
   JSObject* WrapObject(JSContext* aCx,
                        JS::Handle<JSObject*> aGivenProto) override;
 
@@ -372,17 +373,17 @@ class Selection final : public nsSupport
   }
   SelectionType Type() const { return mSelectionType; }
 
   void GetRangesForInterval(nsINode& aBeginNode, int32_t aBeginOffset,
                             nsINode& aEndNode, int32_t aEndOffset,
                             bool aAllowAdjacent,
                             nsTArray<RefPtr<nsRange>>& aReturn,
                             mozilla::ErrorResult& aRv);
-
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY
   void ScrollIntoView(int16_t aRegion, bool aIsSynchronous,
                       WhereToScroll aVPercent, WhereToScroll aHPercent,
                       mozilla::ErrorResult& aRv);
 
   void SetColors(const nsAString& aForeColor, const nsAString& aBackColor,
                  const nsAString& aAltForeColor, const nsAString& aAltBackColor,
                  mozilla::ErrorResult& aRv);
 
@@ -582,18 +583,17 @@ class Selection final : public nsSupport
    * @param langRTL is true if the new language is right-to-left or
    *                false if the new language is left-to-right.
    */
   nsresult SelectionLanguageChange(bool aLangRTL);
 
  private:
   friend class ::nsAutoScrollTimer;
 
-  // Note: DoAutoScroll might destroy arbitrary frames etc.
-  nsresult DoAutoScroll(nsIFrame* aFrame, nsPoint aPoint);
+  MOZ_CAN_RUN_SCRIPT nsresult DoAutoScroll(nsIFrame* aFrame, nsPoint aPoint);
 
   // We are not allowed to be in nodes whose root is not our document
   bool HasSameRoot(nsINode& aNode);
 
   // XXX Please don't add additional uses of this method, it's only for
   // XXX supporting broken code (bug 1245883) in the following classes:
   friend class ::nsCopySupport;
   friend class ::nsHTMLCopyEncoder;
--- a/dom/base/nsDOMWindowUtils.cpp
+++ b/dom/base/nsDOMWindowUtils.cpp
@@ -373,18 +373,17 @@ NS_IMETHODIMP
 nsDOMWindowUtils::UpdateLayerTree() {
   if (RefPtr<PresShell> presShell = GetPresShell()) {
     // Don't flush throttled animations since it might fire MozAfterPaint event
     // (in WebRender it constantly does), thus the reftest harness can't take
     // any snapshot until the throttled animations finished.
     presShell->FlushPendingNotifications(
         ChangesToFlush(FlushType::Display, false /* flush animations */));
     RefPtr<nsViewManager> vm = presShell->GetViewManager();
-    nsView* view = vm->GetRootView();
-    if (view) {
+    if (nsView* view = vm->GetRootView()) {
       nsAutoScriptBlocker scriptBlocker;
       presShell->Paint(
           view, view->GetBounds(),
           PaintFlags::PaintLayers | PaintFlags::PaintSyncDecodeImages);
       presShell->GetLayerManager()->WaitOnTransactionProcessed();
     }
   }
   return NS_OK;
--- a/dom/base/nsISelectionListener.idl
+++ b/dom/base/nsISelectionListener.idl
@@ -16,13 +16,14 @@ interface nsISelectionListener : nsISupp
   const short MOUSEDOWN_REASON=2;/*bitflags*/
   const short MOUSEUP_REASON=4;/*bitflags*/
   const short KEYPRESS_REASON=8;/*bitflags*/
   const short SELECTALL_REASON=16;
   const short COLLAPSETOSTART_REASON=32;
   const short COLLAPSETOEND_REASON=64;
   const short IME_REASON=128;
 
+  [can_run_script]
   void notifySelectionChanged(in Document doc, in Selection sel,
                               in short reason);
 };
 
 
--- a/dom/base/test/mochitest.ini
+++ b/dom/base/test/mochitest.ini
@@ -358,16 +358,17 @@ support-files = test_bug380418.html^head
 [test_bug395915.html]
 [test_bug397234.html]
 [test_bug398243.html]
 [test_bug401662.html]
 [test_bug402150.html]
 support-files = test_bug402150.html^headers^
 [test_bug403841.html]
 [test_bug403852.html]
+skip-if = os == 'android' && !debug # Bug 1519063
 [test_bug403868.xml]
 [test_bug405182.html]
 [test_bug409380.html]
 [test_bug410229.html]
 [test_bug413974.html]
 [test_bug414190.html]
 [test_bug415860.html]
 [test_bug416317-1.html]
--- a/dom/chrome-webidl/ChannelWrapper.webidl
+++ b/dom/chrome-webidl/ChannelWrapper.webidl
@@ -412,16 +412,28 @@ dictionary MozProxyInfo {
    */
   ByteString? username = null;
 
   /**
    * The timeout, in seconds, before the network stack will failover to the
    * next candidate proxy server if it has not received a response.
    */
   unsigned long failoverTimeout;
+
+  /**
+   * Any non-empty value will be passed directly as Proxy-Authorization header
+   * value for the CONNECT request attempt.  However, this header set on the
+   * resource request itself takes precedence.
+   */
+  ByteString? proxyAuthorizationHeader = null;
+
+  /**
+   * An optional key used for additional isolation of this proxy connection.
+   */
+  ByteString? connectionIsolationKey = null;
 };
 
 /**
  * MozFrameAncestorInfo combines loadInfo::AncestorPrincipals with
  * loadInfo::AncestorOuterWindowIDs for easier access in the WebRequest API.
  *
  * url represents the parent of the loading window.
  * frameId is the outerWindowID for the parent of the loading window.
new file mode 100644
--- /dev/null
+++ b/dom/docs/Fission-IPC-Diagram.svg
@@ -0,0 +1,2 @@
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg xmlns="http://www.w3.org/2000/svg" style="background-color: rgb(255, 255, 255);" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" width="841px" height="861px" viewBox="-0.5 -0.5 841 861" content="&lt;mxfile modified=&quot;2019-04-26T17:33:16.547Z&quot; host=&quot;www.draw.io&quot; agent=&quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:68.0) Gecko/20100101 Firefox/68.0&quot; etag=&quot;ryQDoUVJ1oS_b3fguxas&quot; version=&quot;10.6.5&quot; type=&quot;google&quot;&gt;&lt;diagram id=&quot;GcJpJ4Eku4OUxVByAJcz&quot; name=&quot;Page-1&quot;&gt;7Vxbc9o6EP41PDZjyzd4DCSkZ6ZnJnNyZto+dYQtQImxOLZISH/9kWzJNxlsKAY1pQ+ptbp6d7/VrrRmYE1W24cYrpd/kwCFA2AE24F1NwBgZA7ZX054zwiO7WWERYyDjGQWhCf8EwmiIagbHKCk0pASElK8rhJ9EkXIpxUajGPyVm02J2F11jVcIIXw5MNQpX7FAV1m1KFjFPTPCC+WcmbTEDUrKBsLQrKEAXkrkaz7gTWJCaHZ02o7QSHnneRL1m+6ozZfWIwi2qXDN289dbav0x8Pw89T4IHk2f7nkxjlFYYb8cJisfRdciAmmyhAfBBzYI3flpiipzX0ee0bEzmjLekqFNXqouQMKKZoWyKJRT4gskI0fmdNRK0t+CUUxrSNGyejvBUC8FzRalliPpC8h0Loi3zwgi/sQbDmADYB7dlkgyY22cMGNtm9scnSj02O24VPOTfPwydb4dOYWyoUM+JjTHyUJArj2PvSKncSGpMXNCEhiRklIhFrOZ7jMKyRYIgXESv6jItsCmvMuYeZibsVFSscBHyaRnEUAjP48CSiT2JRDRboYPEM62C3G6RjNkkH9CUcp0GJ3ZDzPsCv7HHBHyeMD/ytS/LK2rApS83+TCl6I/PCMnSvMjxUhq6pmxCBo7AeBcw5E0US0yVZkAiG9wW1xqSizRdC1kJaz4jSd+Fpwg0lVVmiLabfeHdmiLLS91LN3VaMnBbeZSFi71vqxIvfy3VFt7Qk+zXqTUJhTG+568o1JYRJgn1JnuKwdW9MyCb20R6+CgecjbdAdE874blznu9VoBiFkOLXqsN8em3w2p2LM6jHVTr7Vr3f4LL/4YpbsrRiu2Ez3M5yxyeJ/bSn+9+Gh0RjeOOTVVHk65P95WiN1lqZNkqmMVyhLwQGfKKsfhbXe7RY/arm9O+4jmqekdfkt5qgwSC7vRnk0U4p892owi8pNl7xKUnRdMsamGC9Lcs0Y/Zj7v7mosgG3CELfXB+rOU/3j4MO9qH0antg+j6SHAqaqnETi2+MnM9lYNkSxX9aiqYL+R4rRwqSim06THjrmZAZvC8OJAt48/YS0cdsSJdX002U9XMCo2eLHEY6KbQduMB3ZkV2lS48uFChZ6xIjHQDhZTK7CYqi2Lkq9olrsUeqHFsTRAy0Ws/cdCi7yLakUL0AstTRc+LYEanvPwqSFCm/Uaoekdj7nyYvNiKLatS6LYLGG4QHQbiisYvvGci8MYdIVxP+EUezf4Xmqw5kFSUhq5Fm05Ru2Q1hqJ3WTasQcL2Ko92EO2ipMGZbZ6ICSD/HGMORPruqueqscowT/hLG3AtUEwh7V2xgPnbnDIeXoIZygcQ/9lkSJAHrkOgDVP/zVq0V7YKZYjz0EQSx6Ur/mbLIpxYw09cVNxbBQupJorsuxC5vME9RJuy5nU6CQTrJYximeMLu91Nd2Ol7bCYw/PznQE12lTvrqRB+4/dtf9x9HLjdyZwaDJoZvlaHjqZv8ueOlf752Oeg/0Opkz1eQQrY7m6mqvxdnc7oSaD3drpCfY3K6bjKcX2NQsHr02GRdouMl4V72vqXP7JqPZibYaO2u1ydTVXodNxv5tLoD6V/uuGQLSiddF7Xde5GcHC5oY/bqLpUNijuX+LtqvbyTeOVfA1Qs1O5MFtEJNfc/QATVA85vjuqXR4up4dLU0v2hp8s8YW91SoJWlyRVYU7jUTYwOcJHfS1zhcjxcQFe4WHrBBShwOT7Tot9ceM0yLepA1iDV4jIn9xKSZgWQN+BEaRO5mSgZibZUjufNai1fG3Il/RVkW11d7pN/69KcK1FXPA8ouezZSym57AfncdS/mGzP46h/KTs8Tx6HGl7onscR4Bj5FBPej4mLW4zOuR3yWvMEuR3G0AEVicnfWjhWSftP7QBqhoKGqR0KSjXI7ZCibtjsl6bcWB+Q/0JYo78e2STGnCkuMKaYGWemqvu+SitGaNjQ77fMDeCiuO3sA1zoM7y8WzRL1mnZOHeeqbqEtnLXJXblUvtnh02LPu6LxeO/U08YfnG0YASnKP2bui381KQZ5YRBeB6mPseSmWsUKT7QCcBf/3EYQwH+0GgAfm4NDkA+KxY/zpOZ2OIXjqz7/wE=&lt;/diagram&gt;&lt;/mxfile&gt;"><defs/><g><rect x="20" y="160.5" width="760" height="200" rx="30" ry="30" fill="#ffffff" stroke="#000000" pointer-events="none"/><rect x="20" y="440.5" width="480" height="400" rx="60" ry="60" fill="#ffffff" stroke="#000000" pointer-events="none"/><rect x="540" y="440.5" width="240" height="400" rx="36" ry="36" fill="#ffffff" stroke="#000000" pointer-events="none"/><g transform="translate(80.5,168.5)"><switch><foreignObject style="overflow:visible;" pointer-events="all" width="98" height="12" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; vertical-align: top; width: 99px; white-space: nowrap; overflow-wrap: normal; font-weight: bold; text-align: center;"><div xmlns="http://www.w3.org/1999/xhtml" style="display:inline-block;text-align:inherit;text-decoration:inherit;">Browser Process</div></div></foreignObject><text x="49" y="12" fill="#000000" text-anchor="middle" font-size="12px" font-family="Helvetica" font-weight="bold">Browser Process</text></switch></g><g transform="translate(82.5,814.5)"><switch><foreignObject style="overflow:visible;" pointer-events="all" width="95" height="12" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; vertical-align: top; width: 96px; white-space: nowrap; overflow-wrap: normal; font-weight: bold; text-align: center;"><div xmlns="http://www.w3.org/1999/xhtml" style="display:inline-block;text-align:inherit;text-decoration:inherit;"><div>Content Process</div></div></div></foreignObject><text x="48" y="12" fill="#000000" text-anchor="middle" font-size="12px" font-family="Helvetica" font-weight="bold">&lt;div&gt;Content Process&lt;/div&gt;</text></switch></g><g transform="translate(612.5,814.5)"><switch><foreignObject style="overflow:visible;" pointer-events="all" width="95" height="12" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; vertical-align: top; width: 96px; white-space: nowrap; overflow-wrap: normal; font-weight: bold; text-align: center;"><div xmlns="http://www.w3.org/1999/xhtml" style="display:inline-block;text-align:inherit;text-decoration:inherit;"><div>Content Process</div></div></div></foreignObject><text x="48" y="12" fill="#000000" text-anchor="middle" font-size="12px" font-family="Helvetica" font-weight="bold">&lt;div&gt;Content Process&lt;/div&gt;</text></switch></g><path d="M 130 256.87 L 130 271 L 130 261 L 130 274.13" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 130 251.62 L 133.5 258.62 L 130 256.87 L 126.5 258.62 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 130 279.38 L 126.5 272.38 L 130 274.13 L 133.5 272.38 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><rect x="70" y="190.5" width="120" height="60" fill="#ffffff" stroke="#000000" pointer-events="none"/><g transform="translate(71.5,199.5)"><switch><foreignObject style="overflow:visible;" pointer-events="all" width="116" height="41" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; vertical-align: top; width: 116px; white-space: normal; overflow-wrap: normal; text-align: center;"><div xmlns="http://www.w3.org/1999/xhtml" style="display:inline-block;text-align:inherit;text-decoration:inherit;"><div>&lt;xul:browser src="a.com"/&gt;</div><div>nsFrameLoader<br /></div></div></div></foreignObject><text x="58" y="27" fill="#000000" text-anchor="middle" font-size="12px" font-family="Helvetica">[Not supported by viewer]</text></switch></g><path d="M 130 346.87 L 130 454.63" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 130 341.62 L 133.5 348.62 L 130 346.87 L 126.5 348.62 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 130 459.88 L 126.5 452.88 L 130 454.63 L 133.5 452.88 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><g transform="translate(103.5,394.5)"><switch><foreignObject style="overflow:visible;" pointer-events="all" width="52" height="12" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; font-size: 11px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; vertical-align: top; white-space: nowrap; text-align: center;"><div xmlns="http://www.w3.org/1999/xhtml" style="display:inline-block;text-align:inherit;text-decoration:inherit;background-color:#ffffff;"><font style="font-size: 12px">PBrowser</font></div></div></foreignObject><text x="26" y="12" fill="#000000" text-anchor="middle" font-size="11px" font-family="Helvetica">[Not supported by viewer]</text></switch></g><rect x="70" y="280.5" width="120" height="60" fill="#ffffff" stroke="#000000" pointer-events="none"/><g transform="translate(90.5,304.5)"><switch><foreignObject style="overflow:visible;" pointer-events="all" width="79" height="12" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; vertical-align: top; width: 80px; white-space: nowrap; overflow-wrap: normal; text-align: center;"><div xmlns="http://www.w3.org/1999/xhtml" style="display:inline-block;text-align:inherit;text-decoration:inherit;">BrowserParent</div></div></foreignObject><text x="40" y="12" fill="#000000" text-anchor="middle" font-size="12px" font-family="Helvetica">BrowserParent</text></switch></g><path d="M 130 526.87 L 130 541 L 130 531 L 130 544.13" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 130 521.62 L 133.5 528.62 L 130 526.87 L 126.5 528.62 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 130 549.38 L 126.5 542.38 L 130 544.13 L 133.5 542.38 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><rect x="70" y="460.5" width="120" height="60" fill="#ffffff" stroke="#000000" pointer-events="none"/><g transform="translate(94.5,484.5)"><switch><foreignObject style="overflow:visible;" pointer-events="all" width="71" height="12" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; vertical-align: top; width: 72px; white-space: nowrap; overflow-wrap: normal; text-align: center;"><div xmlns="http://www.w3.org/1999/xhtml" style="display:inline-block;text-align:inherit;text-decoration:inherit;">BrowserChild</div></div></foreignObject><text x="36" y="12" fill="#000000" text-anchor="middle" font-size="12px" font-family="Helvetica">BrowserChild</text></switch></g><path d="M 130 617.37 L 130 631.63" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 130 612.12 L 133.5 619.12 L 130 617.37 L 126.5 619.12 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 130 636.88 L 126.5 629.88 L 130 631.63 L 133.5 629.88 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><rect x="70" y="550.5" width="120" height="60" fill="#ffffff" stroke="#000000" pointer-events="none"/><g transform="translate(89.5,574.5)"><switch><foreignObject style="overflow:visible;" pointer-events="all" width="81" height="12" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; vertical-align: top; width: 82px; white-space: nowrap; overflow-wrap: normal; text-align: center;"><div xmlns="http://www.w3.org/1999/xhtml" style="display:inline-block;text-align:inherit;text-decoration:inherit;">nsWebBrowser</div></div></foreignObject><text x="41" y="12" fill="#000000" text-anchor="middle" font-size="12px" font-family="Helvetica">nsWebBrowser</text></switch></g><path d="M 130 704.37 L 130 723.63" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 130 699.12 L 133.5 706.12 L 130 704.37 L 126.5 706.12 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 130 728.88 L 126.5 721.88 L 130 723.63 L 133.5 721.88 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><rect x="70" y="638" width="120" height="60" fill="#ffffff" stroke="#000000" pointer-events="none"/><g transform="translate(71.5,647.5)"><switch><foreignObject style="overflow:visible;" pointer-events="all" width="116" height="41" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; vertical-align: top; width: 116px; white-space: normal; overflow-wrap: normal; text-align: center;"><div xmlns="http://www.w3.org/1999/xhtml" style="display:inline-block;text-align:inherit;text-decoration:inherit;"><div>&lt;iframe src="b.com"/&gt;</div><div>nsFrameLoader</div></div></div></foreignObject><text x="58" y="27" fill="#000000" text-anchor="middle" font-size="12px" font-family="Helvetica">[Not supported by viewer]</text></switch></g><path d="M 196.37 760 L 480 760 L 480 236 L 593.63 236" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 191.12 760 L 198.12 756.5 L 196.37 760 L 198.12 763.5 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 598.88 236 L 591.88 239.5 L 593.63 236 L 591.88 232.5 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><g transform="translate(436.5,384.5)"><switch><foreignObject style="overflow:visible;" pointer-events="all" width="87" height="12" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; vertical-align: top; white-space: nowrap; text-align: center;"><div xmlns="http://www.w3.org/1999/xhtml" style="display:inline-block;text-align:inherit;text-decoration:inherit;background-color:#ffffff;">PBrowserBridge</div></div></foreignObject><text x="44" y="12" fill="#000000" text-anchor="middle" font-size="12px" font-family="Helvetica">PBrowserBridge</text></switch></g><rect x="70" y="729.5" width="120" height="60" fill="#ffffff" stroke="#000000" pointer-events="none"/><g transform="translate(76.5,753.5)"><switch><foreignObject style="overflow:visible;" pointer-events="all" width="106" height="12" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; vertical-align: top; width: 107px; white-space: nowrap; overflow-wrap: normal; text-align: center;"><div xmlns="http://www.w3.org/1999/xhtml" style="display:inline-block;text-align:inherit;text-decoration:inherit;">BrowserBridgeChild</div></div></foreignObject><text x="53" y="12" fill="#000000" text-anchor="middle" font-size="12px" font-family="Helvetica">BrowserBridgeChild</text></switch></g><path d="M 390 347.37 L 390 454.63" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 390 342.12 L 393.5 349.12 L 390 347.37 L 386.5 349.12 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 390 459.88 L 386.5 452.88 L 390 454.63 L 393.5 452.88 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><g transform="translate(363.5,394.5)"><switch><foreignObject style="overflow:visible;" pointer-events="all" width="52" height="12" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; font-size: 11px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; vertical-align: top; white-space: nowrap; text-align: center;"><div xmlns="http://www.w3.org/1999/xhtml" style="display:inline-block;text-align:inherit;text-decoration:inherit;background-color:#ffffff;"><div style="font-size: 12px"><font style="font-size: 12px">PBrowser</font></div></div></div></foreignObject><text x="26" y="12" fill="#000000" text-anchor="middle" font-size="11px" font-family="Helvetica">[Not supported by viewer]</text></switch></g><rect x="330" y="280.5" width="120" height="60" fill="#ffffff" stroke="#000000" pointer-events="none"/><g transform="translate(350.5,304.5)"><switch><foreignObject style="overflow:visible;" pointer-events="all" width="79" height="12" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; vertical-align: top; width: 80px; white-space: nowrap; overflow-wrap: normal; text-align: center;"><div xmlns="http://www.w3.org/1999/xhtml" style="display:inline-block;text-align:inherit;text-decoration:inherit;">BrowserParent</div></div></foreignObject><text x="40" y="12" fill="#000000" text-anchor="middle" font-size="12px" font-family="Helvetica">BrowserParent</text></switch></g><path d="M 390 527.37 L 390 541 L 390 531 L 390 544.13" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 390 522.12 L 393.5 529.12 L 390 527.37 L 386.5 529.12 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 390 549.38 L 386.5 542.38 L 390 544.13 L 393.5 542.38 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><rect x="330" y="460.5" width="120" height="60" fill="#ffffff" stroke="#000000" pointer-events="none"/><g transform="translate(354.5,484.5)"><switch><foreignObject style="overflow:visible;" pointer-events="all" width="71" height="12" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; vertical-align: top; width: 72px; white-space: nowrap; overflow-wrap: normal; text-align: center;"><div xmlns="http://www.w3.org/1999/xhtml" style="display:inline-block;text-align:inherit;text-decoration:inherit;">BrowserChild</div></div></foreignObject><text x="36" y="12" fill="#000000" text-anchor="middle" font-size="12px" font-family="Helvetica">BrowserChild</text></switch></g><path d="M 660 347.37 L 660 454.13" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 660 342.12 L 663.5 349.12 L 660 347.37 L 656.5 349.12 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 660 459.38 L 656.5 452.38 L 660 454.13 L 663.5 452.38 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><g transform="translate(633.5,394.5)"><switch><foreignObject style="overflow:visible;" pointer-events="all" width="52" height="12" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; font-size: 11px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; vertical-align: top; white-space: nowrap; text-align: center;"><div xmlns="http://www.w3.org/1999/xhtml" style="display:inline-block;text-align:inherit;text-decoration:inherit;background-color:#ffffff;"><font style="font-size: 12px">PBrowser</font></div></div></foreignObject><text x="26" y="12" fill="#000000" text-anchor="middle" font-size="11px" font-family="Helvetica">[Not supported by viewer]</text></switch></g><rect x="600" y="280.5" width="120" height="60" fill="#ffffff" stroke="#000000" pointer-events="none"/><g transform="translate(620.5,304.5)"><switch><foreignObject style="overflow:visible;" pointer-events="all" width="79" height="12" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; vertical-align: top; width: 80px; white-space: nowrap; overflow-wrap: normal; text-align: center;"><div xmlns="http://www.w3.org/1999/xhtml" style="display:inline-block;text-align:inherit;text-decoration:inherit;">BrowserParent</div></div></foreignObject><text x="40" y="12" fill="#000000" text-anchor="middle" font-size="12px" font-family="Helvetica">BrowserParent</text></switch></g><path d="M 660 527.37 L 660 541 L 660 531 L 660 544.13" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 660 522.12 L 663.5 529.12 L 660 527.37 L 656.5 529.12 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 660 549.38 L 656.5 542.38 L 660 544.13 L 663.5 542.38 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><rect x="600" y="460.5" width="120" height="60" fill="#ffffff" stroke="#000000" pointer-events="none"/><g transform="translate(624.5,484.5)"><switch><foreignObject style="overflow:visible;" pointer-events="all" width="71" height="12" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; vertical-align: top; width: 72px; white-space: nowrap; overflow-wrap: normal; text-align: center;"><div xmlns="http://www.w3.org/1999/xhtml" style="display:inline-block;text-align:inherit;text-decoration:inherit;">BrowserChild</div></div></foreignObject><text x="36" y="12" fill="#000000" text-anchor="middle" font-size="12px" font-family="Helvetica">BrowserChild</text></switch></g><path d="M 390 257.37 L 390 271 L 390 261 L 390 274.13" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 390 252.12 L 393.5 259.12 L 390 257.37 L 386.5 259.12 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 390 279.38 L 386.5 272.38 L 390 274.13 L 393.5 272.38 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><rect x="330" y="190.5" width="120" height="60" fill="#ffffff" stroke="#000000" pointer-events="none"/><g transform="translate(332.5,214.5)"><switch><foreignObject style="overflow:visible;" pointer-events="all" width="114" height="12" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; vertical-align: top; width: 115px; white-space: nowrap; overflow-wrap: normal; text-align: center;"><div xmlns="http://www.w3.org/1999/xhtml" style="display:inline-block;text-align:inherit;text-decoration:inherit;">BrowserBridgeParent</div></div></foreignObject><text x="57" y="12" fill="#000000" text-anchor="middle" font-size="12px" font-family="Helvetica">BrowserBridgeParent</text></switch></g><path d="M 660 257.37 L 660 274.63" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 660 252.12 L 663.5 259.12 L 660 257.37 L 656.5 259.12 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 660 279.88 L 656.5 272.88 L 660 274.63 L 663.5 272.88 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><rect x="600" y="190.5" width="120" height="60" fill="#ffffff" stroke="#000000" pointer-events="none"/><g transform="translate(602.5,214.5)"><switch><foreignObject style="overflow:visible;" pointer-events="all" width="114" height="12" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; vertical-align: top; width: 115px; white-space: nowrap; overflow-wrap: normal; text-align: center;"><div xmlns="http://www.w3.org/1999/xhtml" style="display:inline-block;text-align:inherit;text-decoration:inherit;">BrowserBridgeParent</div></div></foreignObject><text x="57" y="12" fill="#000000" text-anchor="middle" font-size="12px" font-family="Helvetica">BrowserBridgeParent</text></switch></g><rect x="330" y="550.5" width="120" height="60" fill="#ffffff" stroke="#000000" pointer-events="none"/><g transform="translate(349.5,574.5)"><switch><foreignObject style="overflow:visible;" pointer-events="all" width="81" height="12" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; vertical-align: top; width: 82px; white-space: nowrap; overflow-wrap: normal; text-align: center;"><div xmlns="http://www.w3.org/1999/xhtml" style="display:inline-block;text-align:inherit;text-decoration:inherit;">nsWebBrowser</div></div></foreignObject><text x="41" y="12" fill="#000000" text-anchor="middle" font-size="12px" font-family="Helvetica">nsWebBrowser</text></switch></g><path d="M 660 617.37 L 660 631.63" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 660 612.12 L 663.5 619.12 L 660 617.37 L 656.5 619.12 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 660 636.88 L 656.5 629.88 L 660 631.63 L 663.5 629.88 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><rect x="600" y="550.5" width="120" height="60" fill="#ffffff" stroke="#000000" pointer-events="none"/><g transform="translate(619.5,574.5)"><switch><foreignObject style="overflow:visible;" pointer-events="all" width="81" height="12" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; vertical-align: top; width: 82px; white-space: nowrap; overflow-wrap: normal; text-align: center;"><div xmlns="http://www.w3.org/1999/xhtml" style="display:inline-block;text-align:inherit;text-decoration:inherit;">nsWebBrowser</div></div></foreignObject><text x="41" y="12" fill="#000000" text-anchor="middle" font-size="12px" font-family="Helvetica">nsWebBrowser</text></switch></g><path d="M 660 704.37 L 660 723.63" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 660 699.12 L 663.5 706.12 L 660 704.37 L 656.5 706.12 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 660 728.88 L 656.5 721.88 L 660 723.63 L 663.5 721.88 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><rect x="600" y="638" width="120" height="60" fill="#ffffff" stroke="#000000" pointer-events="none"/><g transform="translate(601.5,647.5)"><switch><foreignObject style="overflow:visible;" pointer-events="all" width="116" height="41" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; vertical-align: top; width: 116px; white-space: normal; overflow-wrap: normal; text-align: center;"><div xmlns="http://www.w3.org/1999/xhtml" style="display:inline-block;text-align:inherit;text-decoration:inherit;"><div>&lt;iframe src="a.com"/&gt;</div><div>nsFrameLoader</div></div></div></foreignObject><text x="58" y="27" fill="#000000" text-anchor="middle" font-size="12px" font-family="Helvetica">[Not supported by viewer]</text></switch></g><path d="M 593.63 760 L 560 760 L 560 239 C 563.9 239 563.9 233 560 233 L 560 233 L 560 206 L 456.37 206" fill="none" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 598.88 760 L 591.88 763.5 L 593.63 760 L 591.88 756.5 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><path d="M 451.12 206 L 458.12 202.5 L 456.37 206 L 458.12 209.5 Z" fill="#000000" stroke="#000000" stroke-miterlimit="10" pointer-events="none"/><g transform="translate(517.5,412.5)"><switch><foreignObject style="overflow:visible;" pointer-events="all" width="87" height="12" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; vertical-align: top; white-space: nowrap; text-align: center;"><div xmlns="http://www.w3.org/1999/xhtml" style="display:inline-block;text-align:inherit;text-decoration:inherit;background-color:#ffffff;">PBrowserBridge</div></div></foreignObject><text x="44" y="12" fill="#000000" text-anchor="middle" font-size="12px" font-family="Helvetica">PBrowserBridge</text></switch></g><rect x="600" y="729.5" width="120" height="60" fill="#ffffff" stroke="#000000" pointer-events="none"/><g transform="translate(606.5,753.5)"><switch><foreignObject style="overflow:visible;" pointer-events="all" width="106" height="12" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; vertical-align: top; width: 107px; white-space: nowrap; overflow-wrap: normal; text-align: center;"><div xmlns="http://www.w3.org/1999/xhtml" style="display:inline-block;text-align:inherit;text-decoration:inherit;">BrowserBridgeChild</div></div></foreignObject><text x="53" y="12" fill="#000000" text-anchor="middle" font-size="12px" font-family="Helvetica">BrowserBridgeChild</text></switch></g><g transform="translate(24.5,19.5)"><switch><foreignObject style="overflow:visible;" pointer-events="all" width="249" height="130" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; vertical-align: top; overflow: hidden; max-height: 130px; max-width: 790px; width: 250px; white-space: normal; overflow-wrap: normal;"><div xmlns="http://www.w3.org/1999/xhtml" style="display:inline-block;text-align:inherit;text-decoration:inherit;"><h1>Gecko IPC for Fission<br /></h1><div>Example:</div><div>&lt;xul:browser src="a.com"/&gt;</div><div>  &lt;iframe src="b.com"/&gt;</div><div>    &lt;iframe src="a.com"/&gt;<br /></div><div><br /></div></div></div></foreignObject><text x="125" y="71" fill="#000000" text-anchor="middle" font-size="12px" font-family="Helvetica">[Not supported by viewer]</text></switch></g></g></svg>
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/dom/docs/Fission.rst
@@ -0,0 +1,13 @@
+Fission
+=======
+
+Fission is a cross-functional project for revamping and strengthening the architecture of the Firefox browser.
+
+The work is tracked under this bug (https://bugzilla.mozilla.org/show_bug.cgi?id=fission). See this Wiki page for more details (https://wiki.mozilla.org/Project_Fission).
+
+We don't have an all-encompassing design document at this time. This may change in the future.
+
+IPC Diagram
+-----------
+
+.. image:: Fission-IPC-Diagram.svg
new file mode 100644
--- /dev/null
+++ b/dom/docs/index.rst
@@ -0,0 +1,9 @@
+DOM
+===
+
+These linked pages contain design documents for the DOM implementation in Gecko. They live in-tree under the 'dom/docs' directory.
+
+.. toctree::
+   :maxdepth: 1
+
+   Fission
--- a/dom/events/EventDispatcher.cpp
+++ b/dom/events/EventDispatcher.cpp
@@ -888,18 +888,19 @@ nsresult EventDispatcher::Dispatch(nsISu
   nsCOMPtr<nsIContent> content = do_QueryInterface(aEvent->mOriginalTarget);
   bool isInAnon = content && content->IsInAnonymousSubtree();
 
   aEvent->mFlags.mIsBeingDispatched = true;
 
   // Create visitor object and start event dispatching.
   // GetEventTargetParent for the original target.
   nsEventStatus status = aEventStatus ? *aEventStatus : nsEventStatus_eIgnore;
+  nsCOMPtr<EventTarget> targetForPreVisitor = aEvent->mTarget;
   EventChainPreVisitor preVisitor(aPresContext, aEvent, aDOMEvent, status,
-                                  isInAnon, aEvent->mTarget);
+                                  isInAnon, targetForPreVisitor);
   targetEtci->GetEventTargetParent(preVisitor);
 
   if (!preVisitor.mCanHandle) {
     targetEtci = MayRetargetToChromeIfCanNotHandleEvent(
         chain, preVisitor, targetEtci, nullptr, content);
   }
   if (!preVisitor.mCanHandle) {
     // The original target and chrome target (mAutomaticChromeDispatch=true)
--- a/dom/events/EventDispatcher.h
+++ b/dom/events/EventDispatcher.h
@@ -45,29 +45,35 @@ class EventTarget;
  *
  * The capture, target and bubble phases of the event dispatch are handled
  * by iterating through the event target chain. Iteration happens twice,
  * first for the default event group and then for the system event group.
  * While dispatching the event for the system event group PostHandleEvent
  * is called right after calling event listener for the current event target.
  */
 
-class EventChainVisitor {
+class MOZ_STACK_CLASS EventChainVisitor {
  public:
+  // For making creators of this class instances guarantee the lifetime of
+  // aPresContext, this needs to be marked as MOZ_CAN_RUN_SCRIPT.
+  MOZ_CAN_RUN_SCRIPT
   EventChainVisitor(nsPresContext* aPresContext, WidgetEvent* aEvent,
                     dom::Event* aDOMEvent,
                     nsEventStatus aEventStatus = nsEventStatus_eIgnore)
       : mPresContext(aPresContext),
         mEvent(aEvent),
         mDOMEvent(aDOMEvent),
         mEventStatus(aEventStatus),
         mItemFlags(0) {}
 
   /**
    * The prescontext, possibly nullptr.
+   * Note that the lifetime of mPresContext is guaranteed by the creators so
+   * that you can use this with MOZ_KnownLive() when you set argument
+   * of can-run-script methods to this.
    */
   nsPresContext* const mPresContext;
 
   /**
    * The WidgetEvent which is being dispatched. Never nullptr.
    */
   WidgetEvent* const mEvent;
 
@@ -101,18 +107,19 @@ class EventChainVisitor {
    *
    * @note This data is different for each item in the event target chain.
    *       It is up to the Pre/PostHandleEvent implementation to decide how to
    *       use this.
    */
   nsCOMPtr<nsISupports> mItemData;
 };
 
-class EventChainPreVisitor : public EventChainVisitor {
+class MOZ_STACK_CLASS EventChainPreVisitor final : public EventChainVisitor {
  public:
+  MOZ_CAN_RUN_SCRIPT
   EventChainPreVisitor(nsPresContext* aPresContext, WidgetEvent* aEvent,
                        dom::Event* aDOMEvent, nsEventStatus aEventStatus,
                        bool aIsInAnon,
                        dom::EventTarget* aTargetInKnownToBeHandledScope)
       : EventChainVisitor(aPresContext, aEvent, aDOMEvent, aEventStatus),
         mCanHandle(true),
         mAutomaticChromeDispatch(true),
         mForceContentDispatch(false),
@@ -287,20 +294,26 @@ class EventChainPreVisitor : public Even
   /**
    * Set to the value of mEvent->mTarget of the previous scope in case of
    * Shadow DOM or such, and if there is no anonymous content this just points
    * to the initial target.
    */
   dom::EventTarget* mTargetInKnownToBeHandledScope;
 };
 
-class EventChainPostVisitor : public mozilla::EventChainVisitor {
+class MOZ_STACK_CLASS EventChainPostVisitor final
+    : public mozilla::EventChainVisitor {
  public:
+  // Note that for making guarantee the lifetime of mPresContext and mDOMEvent,
+  // creators should guarantee that aOther won't be deleted while the instance
+  // of this class is alive.
+  MOZ_CAN_RUN_SCRIPT
   explicit EventChainPostVisitor(EventChainVisitor& aOther)
-      : EventChainVisitor(aOther.mPresContext, aOther.mEvent, aOther.mDOMEvent,
+      : EventChainVisitor(MOZ_KnownLive(aOther.mPresContext), aOther.mEvent,
+                          MOZ_KnownLive(aOther.mDOMEvent),
                           aOther.mEventStatus) {}
 };
 
 /**
  * If an EventDispatchingCallback object is passed to Dispatch,
  * its HandleEvent method is called after handling the default event group,
  * before handling the system event group.
  * This is used in PresShell.
--- a/dom/events/EventStateManager.cpp
+++ b/dom/events/EventStateManager.cpp
@@ -4028,17 +4028,18 @@ class MOZ_STACK_CLASS ESMEventCB : publi
  public:
   explicit ESMEventCB(nsIContent* aTarget) : mTarget(aTarget) {}
 
   MOZ_CAN_RUN_SCRIPT
   void HandleEvent(EventChainPostVisitor& aVisitor) override {
     if (aVisitor.mPresContext) {
       nsIFrame* frame = aVisitor.mPresContext->GetPrimaryFrameFor(mTarget);
       if (frame) {
-        frame->HandleEvent(aVisitor.mPresContext, aVisitor.mEvent->AsGUIEvent(),
+        frame->HandleEvent(MOZ_KnownLive(aVisitor.mPresContext),
+                           aVisitor.mEvent->AsGUIEvent(),
                            &aVisitor.mEventStatus);
       }
     }
   }
 
   nsCOMPtr<nsIContent> mTarget;
 };
 
@@ -4729,17 +4730,19 @@ void EventStateManager::FireDragEnterOrE
     }
 
     // collect any changes to moz cursor settings stored in the event's
     // data transfer.
     UpdateDragDataTransfer(&event);
   }
 
   // Finally dispatch the event to the frame
-  if (aTargetFrame) aTargetFrame->HandleEvent(aPresContext, &event, &status);
+  if (aTargetFrame) {
+    aTargetFrame->HandleEvent(aPresContext, &event, &status);
+  }
 }
 
 void EventStateManager::UpdateDragDataTransfer(WidgetDragEvent* dragEvent) {
   NS_ASSERTION(dragEvent, "drag event is null in UpdateDragDataTransfer!");
   if (!dragEvent->mDataTransfer) {
     return;
   }
 
@@ -4883,18 +4886,18 @@ nsresult EventStateManager::InitAndDispa
   if (!target->IsInComposedDoc()) {
     return NS_OK;
   }
 
   // Use local event status for each click event dispatching since it'll be
   // cleared by EventStateManager::PreHandleEvent().  Therefore, dispatching
   // an event means that previous event status will be ignored.
   nsEventStatus status = nsEventStatus_eIgnore;
-  nsresult rv =
-      aPresShell->HandleEventWithTarget(&event, targetFrame, target, &status);
+  nsresult rv = aPresShell->HandleEventWithTarget(
+      &event, targetFrame, MOZ_KnownLive(target), &status);
   // Copy mMultipleActionsPrevented flag from a click event to the mouseup
   // event only when it's set to true.  It may be set to true if an editor has
   // already handled it.  This is important to avoid two or more default
   // actions handled here.
   aMouseUpEvent->mFlags.mMultipleActionsPrevented |=
       event.mFlags.mMultipleActionsPrevented;
   // If current status is nsEventStatus_eConsumeNoDefault, we don't need to
   // overwrite it.
--- a/dom/events/EventStateManager.h
+++ b/dom/events/EventStateManager.h
@@ -1041,23 +1041,25 @@ class EventStateManager : public nsSuppo
 
   void SetGestureDownPoint(WidgetGUIEvent* aEvent);
 
   LayoutDeviceIntPoint GetEventRefPoint(WidgetEvent* aEvent) const;
 
   friend class mozilla::dom::BrowserParent;
   void BeginTrackingRemoteDragGesture(nsIContent* aContent);
   void StopTrackingDragGesture();
+  MOZ_CAN_RUN_SCRIPT
   void GenerateDragGesture(nsPresContext* aPresContext,
                            WidgetInputEvent* aEvent);
 
   /**
    * When starting a dnd session, UA must fire a pointercancel event and stop
    * firing the subsequent pointer events.
    */
+  MOZ_CAN_RUN_SCRIPT
   void MaybeFirePointerCancel(WidgetInputEvent* aEvent);
 
   /**
    * Determine which node the drag should be targeted at.
    * This is either the node clicked when there is a selection, or, for HTML,
    * the element with a draggable property set to true.
    *
    * aSelectionTarget - target to check for selection
--- a/dom/events/PointerEventHandler.cpp
+++ b/dom/events/PointerEventHandler.cpp
@@ -283,27 +283,28 @@ void PointerEventHandler::CheckPointerCa
   }
 
   if (!captureInfo ||
       captureInfo->mPendingContent == captureInfo->mOverrideContent) {
     return;
   }
   // cache captureInfo->mPendingContent since it may be changed in the pointer
   // event listener
-  nsIContent* pendingContent = captureInfo->mPendingContent.get();
+  nsCOMPtr<nsIContent> pendingContent = captureInfo->mPendingContent.get();
   if (captureInfo->mOverrideContent) {
+    nsCOMPtr<nsIContent> overrideContent = captureInfo->mOverrideContent;
     DispatchGotOrLostPointerCaptureEvent(/* aIsGotCapture */ false, aEvent,
-                                         captureInfo->mOverrideContent);
+                                         overrideContent);
   }
   if (pendingContent) {
     DispatchGotOrLostPointerCaptureEvent(/* aIsGotCapture */ true, aEvent,
                                          pendingContent);
   }
 
-  captureInfo->mOverrideContent = pendingContent;
+  captureInfo->mOverrideContent = std::move(pendingContent);
   if (captureInfo->Empty()) {
     sPointerCaptureList->Remove(aEvent->pointerId);
   }
 }
 
 /* static */
 void PointerEventHandler::ImplicitlyCapturePointer(nsIFrame* aFrame,
                                                    WidgetEvent* aEvent) {
--- a/dom/events/PointerEventHandler.h
+++ b/dom/events/PointerEventHandler.h
@@ -65,23 +65,28 @@ class PointerEventHandler final {
   // GetPointerInfo returns true if pointer with aPointerId is situated in
   // device, false otherwise.
   // aActiveState is additional information, which shows state of pointer like
   // button state for mouse.
   static bool GetPointerInfo(uint32_t aPointerId, bool& aActiveState);
 
   // CheckPointerCaptureState checks cases, when got/lostpointercapture events
   // should be fired.
+  MOZ_CAN_RUN_SCRIPT
   static void MaybeProcessPointerCapture(WidgetGUIEvent* aEvent);
+  MOZ_CAN_RUN_SCRIPT
   static void ProcessPointerCaptureForMouse(WidgetMouseEvent* aEvent);
+  MOZ_CAN_RUN_SCRIPT
   static void ProcessPointerCaptureForTouch(WidgetTouchEvent* aEvent);
+  MOZ_CAN_RUN_SCRIPT
   static void CheckPointerCaptureState(WidgetPointerEvent* aEvent);
 
   // Implicitly get and release capture of current pointer for touch.
   static void ImplicitlyCapturePointer(nsIFrame* aFrame, WidgetEvent* aEvent);
+  MOZ_CAN_RUN_SCRIPT
   static void ImplicitlyReleasePointerCapture(WidgetEvent* aEvent);
 
   /**
    * GetPointerCapturingContent returns a target content which captures the
    * pointer. It's applied to mouse or pointer event (except mousedown and
    * pointerdown). When capturing, return the content. Otherwise, nullptr.
    *
    * @param aEvent               A mouse event or pointer event which may be
@@ -162,16 +167,17 @@ class PointerEventHandler final {
   // event with pointerId. The return value must be one of
   // MouseEvent_Binding::MOZ_SOURCE_*
   static uint16_t GetPointerType(uint32_t aPointerId);
 
   // GetPointerPrimaryState returns state of attribute isPrimary for pointer
   // event with pointerId
   static bool GetPointerPrimaryState(uint32_t aPointerId);
 
+  MOZ_CAN_RUN_SCRIPT
   static void DispatchGotOrLostPointerCaptureEvent(
       bool aIsGotCapture, const WidgetPointerEvent* aPointerEvent,
       nsIContent* aCaptureTarget);
 
   // The cached spoofed pointer ID for fingerprinting resistance. We will use a
   // mouse pointer id for desktop. For mobile, we should use the touch pointer
   // id as the spoofed one, and this work will be addressed in Bug 1492775.
   static Maybe<int32_t> sSpoofedPointerId;
--- a/dom/html/HTMLLabelElement.cpp
+++ b/dom/html/HTMLLabelElement.cpp
@@ -155,18 +155,18 @@ nsresult HTMLLabelElement::PostHandleEve
           //    would do nothing.  If we wanted to do something
           //    sensible, we might send more events through like
           //    this.)  See bug 7554, bug 49897, and bug 96813.
           nsEventStatus status = aVisitor.mEventStatus;
           // Ok to use aVisitor.mEvent as parameter because DispatchClickEvent
           // will actually create a new event.
           EventFlags eventFlags;
           eventFlags.mMultipleActionsPrevented = true;
-          DispatchClickEvent(aVisitor.mPresContext, mouseEvent, content, false,
-                             &eventFlags, &status);
+          DispatchClickEvent(MOZ_KnownLive(aVisitor.mPresContext), mouseEvent,
+                             content, false, &eventFlags, &status);
           // Do we care about the status this returned?  I don't think we do...
           // Don't run another <label> off of this click
           mouseEvent->mFlags.mMultipleActionsPrevented = true;
         }
         break;
 
       default:
         break;
--- a/dom/html/HTMLLabelElement.h
+++ b/dom/html/HTMLLabelElement.h
@@ -42,16 +42,17 @@ class HTMLLabelElement final : public ns
   }
   nsGenericHTMLElement* GetControl() const { return GetLabeledElement(); }
 
   using nsGenericHTMLElement::Focus;
   virtual void Focus(const FocusOptions& aOptions,
                      ErrorResult& aError) override;
 
   // nsIContent
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY
   virtual nsresult PostHandleEvent(EventChainPostVisitor& aVisitor) override;
   virtual bool PerformAccesskey(bool aKeyCausesActivation,
                                 bool aIsTrustedEvent) override;
   virtual nsresult Clone(dom::NodeInfo*, nsINode** aResult) const override;
 
   nsGenericHTMLElement* GetLabeledElement() const;
 
  protected:
--- a/dom/html/TextInputListener.h
+++ b/dom/html/TextInputListener.h
@@ -42,16 +42,17 @@ class TextInputListener final : public n
   /**
    * OnEditActionHandled() is called when the editor handles each edit action.
    */
   void OnEditActionHandled();
 
   /**
    * OnSelectionChange() is called when selection is changed in the editor.
    */
+  MOZ_CAN_RUN_SCRIPT
   void OnSelectionChange(dom::Selection& aSelection, int16_t aReason);
 
   /**
    * Start to listen or end listening to selection change in the editor.
    */
   void StartToListenToSelectionChange() { mListeningToSelectionChange = true; }
   void EndListeningToSelectionChange() { mListeningToSelectionChange = false; }
 
--- a/dom/html/nsTextEditorState.cpp
+++ b/dom/html/nsTextEditorState.cpp
@@ -799,22 +799,19 @@ void TextInputListener::OnSelectionChang
   //          create the event each time select all is called, even if
   //          everything was previously selected, becase technically select all
   //          will first collapse and then extend. Mozilla will never create an
   //          event if the selection collapses to nothing.
   bool collapsed = aSelection.IsCollapsed();
   if (!collapsed && (aReason & (nsISelectionListener::MOUSEUP_REASON |
                                 nsISelectionListener::KEYPRESS_REASON |
                                 nsISelectionListener::SELECTALL_REASON))) {
-    nsIContent* content = mFrame->GetContent();
-    if (content) {
-      nsCOMPtr<Document> doc = content->GetComposedDoc();
-      if (doc) {
-        RefPtr<PresShell> presShell = doc->GetPresShell();
-        if (presShell) {
+    if (nsCOMPtr<nsIContent> content = mFrame->GetContent()) {
+      if (nsCOMPtr<Document> doc = content->GetComposedDoc()) {
+        if (RefPtr<PresShell> presShell = doc->GetPresShell()) {
           nsEventStatus status = nsEventStatus_eIgnore;
           WidgetEvent event(true, eFormSelect);
 
           presShell->HandleEventWithTarget(&event, mFrame, content, &status);
         }
       }
     }
   }
--- a/dom/ipc/BrowserBridgeChild.h
+++ b/dom/ipc/BrowserBridgeChild.h
@@ -10,17 +10,18 @@
 #include "mozilla/dom/PBrowserBridgeChild.h"
 #include "mozilla/dom/BrowserChild.h"
 
 namespace mozilla {
 namespace dom {
 class BrowsingContext;
 
 /**
- * Child side for a remote frame.
+ * BrowserBridgeChild implements the child actor part of the PBrowserBridge
+ * protocol. See PBrowserBridge for more information.
  */
 class BrowserBridgeChild : public PBrowserBridgeChild {
  public:
   NS_INLINE_DECL_REFCOUNTING(BrowserBridgeChild);
 
   BrowserChild* Manager() {
     MOZ_ASSERT(mIPCOpen);
     return static_cast<BrowserChild*>(PBrowserBridgeChild::Manager());
--- a/dom/ipc/BrowserBridgeParent.cpp
+++ b/dom/ipc/BrowserBridgeParent.cpp
@@ -4,16 +4,17 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "mozilla/dom/BrowserBridgeParent.h"
 #include "mozilla/dom/ContentParent.h"
 #include "mozilla/dom/ContentProcessManager.h"
 #include "mozilla/dom/CanonicalBrowsingContext.h"
 #include "mozilla/dom/BrowsingContextGroup.h"
+#include "mozilla/layers/InputAPZContext.h"
 
 using namespace mozilla::ipc;
 using namespace mozilla::layout;
 using namespace mozilla::hal;
 
 namespace mozilla {
 namespace dom {
 
@@ -142,16 +143,40 @@ IPCResult BrowserBridgeParent::RecvRende
 }
 
 IPCResult BrowserBridgeParent::RecvNavigateByKey(
     const bool& aForward, const bool& aForDocumentNavigation) {
   Unused << mBrowserParent->SendNavigateByKey(aForward, aForDocumentNavigation);
   return IPC_OK();
 }
 
+IPCResult BrowserBridgeParent::RecvDispatchSynthesizedMouseEvent(
+    const WidgetMouseEvent& aEvent) {
+  if (aEvent.mMessage != eMouseMove ||
+      aEvent.mReason != WidgetMouseEvent::eSynthesized) {
+    return IPC_FAIL(this, "Unexpected event type");
+  }
+
+  WidgetMouseEvent event = aEvent;
+  // Convert mRefPoint from the dispatching child process coordinate space
+  // to the parent coordinate space. The SendRealMouseEvent call will convert
+  // it into the dispatchee child process coordinate space
+  event.mRefPoint = Manager()->TransformChildToParent(event.mRefPoint);
+  // We need to set up an InputAPZContext on the stack because
+  // BrowserParent::SendRealMouseEvent requires one. But the only thing in
+  // that context that is actually used in this scenario is the layers id,
+  // and we already have that on the mouse event.
+  layers::InputAPZContext context(
+      layers::ScrollableLayerGuid(event.mLayersId, 0,
+                                  layers::ScrollableLayerGuid::NULL_SCROLL_ID),
+      0, nsEventStatus_eIgnore);
+  mBrowserParent->SendRealMouseEvent(event);
+  return IPC_OK();
+}
+
 IPCResult BrowserBridgeParent::RecvActivate() {
   mBrowserParent->Activate();
   return IPC_OK();
 }
 
 IPCResult BrowserBridgeParent::RecvDeactivate() {
   mBrowserParent->Deactivate();
   return IPC_OK();
--- a/dom/ipc/BrowserBridgeParent.h
+++ b/dom/ipc/BrowserBridgeParent.h
@@ -8,16 +8,20 @@
 #define mozilla_dom_BrowserBridgeParent_h
 
 #include "mozilla/dom/PBrowserBridgeParent.h"
 #include "mozilla/dom/BrowserParent.h"
 
 namespace mozilla {
 namespace dom {
 
+/**
+ * BrowserBridgeParent implements the parent actor part of the PBrowserBridge
+ * protocol. See PBrowserBridge for more information.
+ */
 class BrowserBridgeParent : public PBrowserBridgeParent {
  public:
   NS_INLINE_DECL_REFCOUNTING(BrowserBridgeParent);
 
   BrowserBridgeParent();
 
   // Initialize this actor after performing startup.
   nsresult Init(const nsString& aPresentationURL, const nsString& aRemoteType,
@@ -51,16 +55,19 @@ class BrowserBridgeParent : public PBrow
       const DimensionInfo& aDimensions);
   mozilla::ipc::IPCResult RecvRenderLayers(const bool& aEnabled,
                                            const bool& aForceRepaint,
                                            const LayersObserverEpoch& aEpoch);
 
   mozilla::ipc::IPCResult RecvNavigateByKey(const bool& aForward,
                                             const bool& aForDocumentNavigation);
 
+  mozilla::ipc::IPCResult RecvDispatchSynthesizedMouseEvent(
+      const WidgetMouseEvent& aEvent);
+
   mozilla::ipc::IPCResult RecvActivate();
 
   mozilla::ipc::IPCResult RecvDeactivate();
 
   void ActorDestroy(ActorDestroyReason aWhy) override;
 
  private:
   ~BrowserBridgeParent();
--- a/dom/ipc/BrowserChild.h
+++ b/dom/ipc/BrowserChild.h
@@ -191,16 +191,20 @@ class BrowserChildBase : public nsISuppo
 
   bool UpdateFrameHandler(const mozilla::layers::RepaintRequest& aRequest);
 
  protected:
   RefPtr<BrowserChildMessageManager> mBrowserChildMessageManager;
   nsCOMPtr<nsIWebBrowserChrome3> mWebBrowserChrome;
 };
 
+/**
+ * BrowserChild implements the child actor part of the PBrowser protocol. See
+ * PBrowser for more information.
+ */
 class BrowserChild final : public BrowserChildBase,
                            public PBrowserChild,
                            public nsIWebBrowserChrome2,
                            public nsIEmbeddingSiteWindow,
                            public nsIWebBrowserChromeFocus,
                            public nsIInterfaceRequestor,
                            public nsIWindowProvider,
                            public nsSupportsWeakReference,
@@ -696,16 +700,17 @@ class BrowserChild final : public Browse
 
   virtual bool DeallocPBrowserBridgeChild(PBrowserBridgeChild* aActor) override;
 
   virtual mozilla::ipc::IPCResult RecvDestroy() override;
 
   virtual mozilla::ipc::IPCResult RecvSetDocShellIsActive(
       const bool& aIsActive) override;
 
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY
   virtual mozilla::ipc::IPCResult RecvRenderLayers(
       const bool& aEnabled, const bool& aForce,
       const layers::LayersObserverEpoch& aEpoch) override;
 
   virtual mozilla::ipc::IPCResult RecvRequestRootPaint(
       const IntRect& aRect, const float& aScale,
       const nscolor& aBackgroundColor,
       RequestRootPaintResolver&& aResolve) override;
--- a/dom/ipc/BrowserParent.h
+++ b/dom/ipc/BrowserParent.h
@@ -73,16 +73,20 @@ class ContentParent;
 class Element;
 class DataTransfer;
 class BrowserBridgeParent;
 
 namespace ipc {
 class StructuredCloneData;
 }  // namespace ipc
 
+/**
+ * BrowserParent implements the parent actor part of the PBrowser protocol. See
+ * PBrowser for more information.
+ */
 class BrowserParent final : public PBrowserParent,
                             public nsIDOMEventListener,
                             public nsIRemoteTab,
                             public nsIAuthPromptProvider,
                             public nsIKeyEventInPluginCallback,
                             public nsSupportsWeakReference,
                             public TabContext,
                             public LiveResizeListener {
--- a/dom/ipc/PBrowser.ipdl
+++ b/dom/ipc/PBrowser.ipdl
@@ -113,16 +113,23 @@ struct WebProgressData
 
 struct RequestData
 {
   nsIURI requestURI;
   nsIURI originalRequestURI;
   nsCString matchedList;
 };
 
+/**
+ * A PBrowser manages a maximal locally connected subtree of BrowsingContexts
+ * in a content process.
+ *
+ * See `dom/docs/Fission-IPC-Diagram.svg` for an overview of the DOM IPC
+ * actors.
+ */
 nested(upto inside_cpow) sync protocol PBrowser
 {
     manager PContent;
 
     manages PColorPicker;
     manages PDocAccessible;
     manages PFilePicker;
     manages PPluginWidget;
--- a/dom/ipc/PBrowserBridge.ipdl
+++ b/dom/ipc/PBrowserBridge.ipdl
@@ -7,22 +7,27 @@
 include protocol PBrowser;
 
 include DOMTypes;
 
 using ScreenIntSize from "Units.h";
 using nsSizeMode from "nsIWidgetListener.h";
 using mozilla::layers::LayersObserverEpoch from "mozilla/layers/LayersTypes.h";
 using mozilla::layers::LayersId from "mozilla/layers/LayersTypes.h";
+using mozilla::WidgetMouseEvent from "ipc/nsGUIEventIPC.h";
 
 namespace mozilla {
 namespace dom {
 
 /**
- * PBrowserBridge corresponds to a remote iframe.
+ * A PBrowserBridge connects an iframe/browser in a content process to the
+ * PBrowser that manages the embedded content.
+ *
+ * See `dom/docs/Fission-IPC-Diagram.svg` for an overview of the DOM IPC
+ * actors.
  */
 async protocol PBrowserBridge {
   manager PBrowser;
 
 child:
   async SetLayersId(LayersId layersId);
 
   /**
@@ -52,16 +57,21 @@ parent:
   async RenderLayers(bool aEnabled, bool aForceRepaint, LayersObserverEpoch aEpoch);
 
   /**
    * Navigate by key (Tab/Shift+Tab/F6/Shift+f6).
    */
   async NavigateByKey(bool aForward, bool aForDocumentNavigation);
 
   /**
+   * Dispatch the given synthesized mousemove event to the child.
+   */
+  async DispatchSynthesizedMouseEvent(WidgetMouseEvent event);
+
+  /**
    * Sending an activate message moves focus to the iframe.
    */
   async Activate();
 
   async Deactivate();
 
 };
 
--- a/dom/media/MediaManager.cpp
+++ b/dom/media/MediaManager.cpp
@@ -4591,32 +4591,36 @@ void GetUserMediaWindowListener::StopSha
   for (auto& source : mActiveListeners) {
     source->StopSharing();
   }
 }
 
 void GetUserMediaWindowListener::StopRawID(const nsString& removedDeviceID) {
   MOZ_ASSERT(NS_IsMainThread(), "Only call on main thread");
 
+  nsTArray<Pair<RefPtr<SourceListener>, TrackID>> matches;
   for (auto& source : mActiveListeners) {
     if (source->GetAudioDevice()) {
       nsString id;
       source->GetAudioDevice()->GetRawId(id);
       if (removedDeviceID.Equals(id)) {
-        source->StopTrack(kAudioTrack);
+        matches.AppendElement(MakePair(source, TrackID(kAudioTrack)));
       }
     }
     if (source->GetVideoDevice()) {
       nsString id;
       source->GetVideoDevice()->GetRawId(id);
       if (removedDeviceID.Equals(id)) {
-        source->StopTrack(kVideoTrack);
+        matches.AppendElement(MakePair(source, TrackID(kVideoTrack)));
       }
     }
   }
+  for (auto& pair : matches) {
+    pair.first()->StopTrack(pair.second());
+  }
 }
 
 void GetUserMediaWindowListener::ChromeAffectingStateChanged() {
   MOZ_ASSERT(NS_IsMainThread());
 
   // We wait until stable state before notifying chrome so chrome only does one
   // update if more updates happen in this event loop.
 
--- a/dom/moz.build
+++ b/dom/moz.build
@@ -116,8 +116,9 @@ DIRS += ['presentation']
 TEST_DIRS += [
     'tests',
     'imptests',
 ]
 
 if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('gtk3', 'cocoa', 'windows'):
     TEST_DIRS += ['plugins/test']
 
+SPHINX_TREES['dom'] = 'docs'
--- a/dom/tests/mochitest/bugs/mochitest.ini
+++ b/dom/tests/mochitest/bugs/mochitest.ini
@@ -134,17 +134,17 @@ skip-if = toolkit == 'android'
 [test_devicemotion_multiple_listeners.html]
 skip-if = toolkit == 'android' #bug 775227
 [test_domparser_after_blank.html]
 [test_errorReporting.html]
 [test_navigator_buildID.html]
 [test_onerror_message.html]
 [test_protochains.html]
 [test_resize_move_windows.html]
-skip-if = toolkit == 'android' || os == 'linux' #Windows can't change size and position on Android
+skip-if = toolkit == 'android' || os == 'linux' || (devedition && os == 'win' && bits == 32) #Windows can't change size and position on Android; Windows: bug 1540554
 [test_sizetocontent_clamp.html]
 skip-if = toolkit == 'android' #Windows can't change size on Android
 [test_toJSON.html]
 [test_window_bar.html]
 skip-if = toolkit == 'android'
 [test_bug1022869.html]
 [test_bug1112040.html]
 [test_bug1160342_marquee.html]
--- a/dom/tests/mochitest/general/mochitest.ini
+++ b/dom/tests/mochitest/general/mochitest.ini
@@ -142,9 +142,9 @@ skip-if = toolkit == 'android' # bug 123
 [test_storagePermissionsRejectForeign.html]
 [test_stylesheetPI.html]
 [test_vibrator.html]
 [test_WebKitCSSMatrix.html]
 [test_windowedhistoryframes.html]
 [test_windowProperties.html]
 [test_resource_timing_nocors.html]
 [test_resizeby.html]
-skip-if = toolkit == 'android' # Window sizes cannot be controled on android.
+skip-if = toolkit == 'android' || (devedition && os == 'win' && bits == 32) # Window sizes cannot be controled on android; Windows: bug 1540554
--- a/gfx/layers/apz/src/APZCTreeManager.cpp
+++ b/gfx/layers/apz/src/APZCTreeManager.cpp
@@ -3234,22 +3234,16 @@ bool APZCTreeManager::GetAPZTestData(Lay
 
 void APZCTreeManager::CollectTransformsForChromeMainThread(
     LayersId aRootLayerTreeId) {
   RefPtr<GeckoContentController> controller =
       GetContentController(aRootLayerTreeId);
   if (!controller) {
     return;
   }
-  if (controller->IsRemote() && !gfxPrefs::FissionApzMatricesWithGpuProcess()) {
-    // Avoid IPC errors in the GPU process case until
-    // https://bugzilla.mozilla.org/show_bug.cgi?id=1533673
-    // is resolved.
-    return;
-  }
   nsTArray<MatrixMessage> messages;
   {
     RecursiveMutexAutoLock lock(mTreeLock);
     // This formulation duplicates matrix multiplications closer
     // to the root of the tree. For now, aiming for separation
     // of concerns rather than minimum number of multiplications.
     ForEachNode<ReverseIterator>(
         mRootNode.get(), [&messages](HitTestingTreeNode* aNode) {
--- a/gfx/layers/ipc/CompositorBridgeChild.cpp
+++ b/gfx/layers/ipc/CompositorBridgeChild.cpp
@@ -170,26 +170,35 @@ void CompositorBridgeChild::Destroy() {
   AutoTArray<PWebRenderBridgeChild*, 16> wrBridges;
   ManagedPWebRenderBridgeChild(wrBridges);
   for (int i = wrBridges.Length() - 1; i >= 0; --i) {
     RefPtr<WebRenderBridgeChild> wrBridge =
         static_cast<WebRenderBridgeChild*>(wrBridges[i]);
     wrBridge->Destroy(/* aIsSync */ false);
   }
 
+  AutoTArray<PAPZChild*, 16> apzChildren;
+  ManagedPAPZChild(apzChildren);
+  for (PAPZChild* child : apzChildren) {
+    Unused << child->SendDestroy();
+  }
+
   const ManagedContainer<PTextureChild>& textures = ManagedPTextureChild();
   for (auto iter = textures.ConstIter(); !iter.Done(); iter.Next()) {
     RefPtr<TextureClient> texture =
         TextureClient::AsTextureClient(iter.Get()->GetKey());
 
     if (texture) {
       texture->Destroy();
     }
   }
 
+  // The WillClose message is synchronous, so we know that after it returns
+  // any messages sent by the above code will have been processed on the
+  // other side.
   SendWillClose();
   mCanSend = false;
 
   // We no longer care about unexpected shutdowns, in the remote process case.
   mProcessToken = 0;
 
   // The call just made to SendWillClose can result in IPC from the
   // CompositorBridgeParent to the CompositorBridgeChild (e.g. caused by the
--- a/gfx/layers/ipc/PAPZ.ipdl
+++ b/gfx/layers/ipc/PAPZ.ipdl
@@ -42,17 +42,16 @@ namespace layers {
  * are implemented. If a new method is needed then PAPZ, APZChild, and RemoteContentController
  * must be updated to handle it.
  */
 sync protocol PAPZ
 {
   manager PCompositorBridge;
 
 parent:
-
   async __delete__();
 
 child:
   async LayerTransforms(MatrixMessage[] aTransforms);
 
   async RequestContentRepaint(RepaintRequest request);
 
   async UpdateOverscrollVelocity(float aX, float aY, bool aIsRootContent);
@@ -66,13 +65,14 @@ child:
   async NotifyFlushComplete();
 
   async NotifyAsyncScrollbarDragInitiated(uint64_t aDragBlockId, ViewID aScrollId, ScrollDirection aDirection);
 
   async NotifyAsyncScrollbarDragRejected(ViewID aScrollId);
 
   async NotifyAsyncAutoscrollRejected(ViewID aScrollId);
 
+both:
   async Destroy();
 };
 
 } // layers
 } // mozilla
--- a/gfx/layers/ipc/RemoteContentController.cpp
+++ b/gfx/layers/ipc/RemoteContentController.cpp
@@ -365,12 +365,19 @@ void RemoteContentController::ActorDestr
 
 void RemoteContentController::Destroy() {
   if (mCanSend) {
     mCanSend = false;
     Unused << SendDestroy();
   }
 }
 
+mozilla::ipc::IPCResult RemoteContentController::RecvDestroy() {
+  // The actor on the other side is about to get destroyed, so let's not send
+  // it any more messages.
+  mCanSend = false;
+  return IPC_OK();
+}
+
 bool RemoteContentController::IsRemote() { return true; }
 
 }  // namespace layers
 }  // namespace mozilla
--- a/gfx/layers/ipc/RemoteContentController.h
+++ b/gfx/layers/ipc/RemoteContentController.h
@@ -80,16 +80,17 @@ class RemoteContentController : public G
   void NotifyAsyncAutoscrollRejected(
       const ScrollableLayerGuid::ViewID& aScrollId) override;
 
   void CancelAutoscroll(const ScrollableLayerGuid& aScrollId) override;
 
   void ActorDestroy(ActorDestroyReason aWhy) override;
 
   void Destroy() override;
+  mozilla::ipc::IPCResult RecvDestroy();
 
   bool IsRemote() override;
 
  private:
   MessageLoop* mCompositorThread;
   bool mCanSend;
 
   void HandleTapOnMainThread(TapType aType, LayoutDevicePoint aPoint,
--- a/gfx/thebes/gfxPrefs.h
+++ b/gfx/thebes/gfxPrefs.h
@@ -401,21 +401,16 @@ class gfxPrefs final {
   DECL_GFX_PREF(Live, "dom.vr.puppet.enabled",                 VRPuppetEnabled, bool, false);
   DECL_GFX_PREF(Live, "dom.vr.puppet.submitframe",             VRPuppetSubmitFrame, uint32_t, 0);
   DECL_GFX_PREF(Live, "dom.vr.display.rafMaxDuration",         VRDisplayRafMaxDuration, uint32_t, 50);
   DECL_GFX_PREF(Once, "dom.vr.process.enabled",                VRProcessEnabled, bool, false);
   DECL_GFX_PREF(Once, "dom.vr.process.startup_timeout_ms",     VRProcessTimeoutMs, int32_t, 5000);
   DECL_GFX_PREF(Once, "dom.vr.service.enabled",                VRServiceEnabled, bool, true);
   DECL_GFX_PREF(Live, "dom.w3c_pointer_events.enabled",        PointerEventsEnabled, bool, false);
 
-  // Make APZ send child-to-screen layer matrices to the chrome process
-  // even when the GPU process is in use (behind pref due to IPC errors
-  // in reftests) https://bugzilla.mozilla.org/show_bug.cgi?id=1533673
-  DECL_GFX_PREF(Live, "fission.apz-matrices-with-gpu-process", FissionApzMatricesWithGpuProcess, bool, false);
-
   DECL_GFX_PREF(Live, "general.smoothScroll",                  SmoothScrollEnabled, bool, true);
   DECL_GFX_PREF(Live, "general.smoothScroll.currentVelocityWeighting",
                 SmoothScrollCurrentVelocityWeighting, float, 0.25);
   DECL_GFX_PREF(Live, "general.smoothScroll.durationToIntervalRatio",
                 SmoothScrollDurationToIntervalRatio, int32_t, 200);
   DECL_GFX_PREF(Live, "general.smoothScroll.lines.durationMaxMS",
                 LineSmoothScrollMaxDurationMs, int32_t, 150);
   DECL_GFX_PREF(Live, "general.smoothScroll.lines.durationMinMS",
--- a/gfx/wr/webrender/src/gpu_cache.rs
+++ b/gfx/wr/webrender/src/gpu_cache.rs
@@ -24,17 +24,17 @@
 //! address in the GPU cache of a given resource slot
 //! for this frame.
 
 use api::{DebugFlags, DocumentId, PremultipliedColorF};
 #[cfg(test)]
 use api::IdNamespace;
 use api::units::TexelRect;
 use euclid::{HomogeneousVector, TypedRect};
-use internal_types::{FastHashMap};
+use internal_types::{FastHashMap, FastHashSet};
 use profiler::GpuCacheProfileCounters;
 use render_backend::{FrameStamp, FrameId};
 use renderer::MAX_VERTEX_TEXTURE_WIDTH;
 use std::{mem, u16, u32};
 use std::num::NonZeroU32;
 use std::ops::Add;
 use std::time::{Duration, Instant};
 
@@ -689,56 +689,93 @@ pub struct GpuCache {
     /// Number of blocks requested this frame that don't
     /// need to be re-uploaded.
     saved_block_count: usize,
     /// The current debug flags for the system.
     debug_flags: DebugFlags,
     /// Whether there is a pending clear to send with the
     /// next update.
     pending_clear: bool,
+    /// Indicates that prepare_for_frames has been called for this group of frames.
+    /// Used for sanity checks.
+    prepared_for_frames: bool,
+    /// This indicates that we performed a cleanup operation which requires all
+    /// documents to build a frame.
+    requires_frame_build: bool,
+    /// The set of documents which have had frames built in this update. Used for
+    /// sanity checks.
+    document_frames_to_build: FastHashSet<DocumentId>,
 }
 
 impl GpuCache {
     pub fn new() -> Self {
         let debug_flags = DebugFlags::empty();
         GpuCache {
             now: FrameStamp::INVALID,
             texture: Texture::new(Epoch(0), debug_flags),
             saved_block_count: 0,
             debug_flags,
             pending_clear: false,
+            prepared_for_frames: false,
+            requires_frame_build: false,
+            document_frames_to_build: FastHashSet::default(),
         }
     }
 
     /// Creates a GpuCache and sets it up with a valid `FrameStamp`, which
     /// is useful for avoiding panics when instantiating the `GpuCache`
     /// directly from unit test code.
     #[cfg(test)]
     pub fn new_for_testing() -> Self {
         let mut cache = Self::new();
         let mut now = FrameStamp::first(DocumentId::new(IdNamespace(1), 1));
         now.advance();
+        cache.prepared_for_frames = true;
         cache.begin_frame(now);
         cache
     }
 
     /// Drops everything in the GPU cache. Must not be called once gpu cache entries
     /// for the next frame have already been requested.
     pub fn clear(&mut self) {
         assert!(self.texture.updates.is_empty(), "Clearing with pending updates");
         let mut next_base_epoch = self.texture.max_epoch;
         next_base_epoch.next();
         self.texture = Texture::new(next_base_epoch, self.debug_flags);
         self.saved_block_count = 0;
         self.pending_clear = true;
+        self.requires_frame_build = true;
+    }
+
+    pub fn requires_frame_build(&self) -> bool {
+        self.requires_frame_build
+    }
+
+    pub fn prepare_for_frames(&mut self) {
+        self.prepared_for_frames = true;
+        if self.should_reclaim_memory() {
+            self.clear();
+            debug_assert!(self.document_frames_to_build.is_empty());
+            for &document_id in self.texture.occupied_list_heads.keys() {
+                self.document_frames_to_build.insert(document_id);
+            }
+        }
+    }
+
+    pub fn bookkeep_after_frames(&mut self) {
+        assert!(self.document_frames_to_build.is_empty());
+        assert!(self.prepared_for_frames);
+        self.requires_frame_build = false;
+        self.prepared_for_frames = false;
     }
 
     /// Begin a new frame.
     pub fn begin_frame(&mut self, stamp: FrameStamp) {
         debug_assert!(self.texture.pending_blocks.is_empty());
+        assert!(self.prepared_for_frames);
         self.now = stamp;
         self.texture.evict_old_blocks(self.now);
         self.saved_block_count = 0;
     }
 
     // Invalidate a (possibly) existing block in the cache.
     // This means the next call to request() for this location
     // will rebuild the data and upload it to the GPU.
@@ -828,16 +865,17 @@ impl GpuCache {
             self.texture.rows.len() > (GPU_CACHE_INITIAL_HEIGHT as usize) &&
             self.texture.utilization() < RECLAIM_THRESHOLD;
         if reached_threshold {
             self.texture.reached_reclaim_threshold.get_or_insert_with(Instant::now);
         } else {
             self.texture.reached_reclaim_threshold = None;
         }
 
+        self.document_frames_to_build.remove(&self.now.document_id());
         self.now
     }
 
     /// Returns true if utilization has been low enough for long enough that we
     /// should blow the cache away and rebuild it.
     pub fn should_reclaim_memory(&self) -> bool {
         self.texture.reached_reclaim_threshold
             .map_or(false, |t| t.elapsed() > Duration::from_secs(RECLAIM_DELAY_S))
--- a/gfx/wr/webrender/src/render_backend.rs
+++ b/gfx/wr/webrender/src/render_backend.rs
@@ -858,17 +858,17 @@ impl RenderBackend {
         }
 
         while keep_going {
             profile_scope!("handle_msg");
 
             while let Ok(msg) = self.scene_rx.try_recv() {
                 match msg {
                     SceneBuilderResult::Transactions(mut txns, result_tx) => {
-                        self.resource_cache.before_frames(SystemTime::now());
+                        self.prepare_for_frames();
                         self.maybe_force_nop_documents(
                             &mut frame_counter,
                             &mut profile_counters,
                             |document_id| txns.iter().any(|txn| txn.document_id == document_id));
 
                         for mut txn in txns.drain(..) {
                             let has_built_scene = txn.built_scene.is_some();
                             if let Some(doc) = self.documents.get_mut(&txn.document_id) {
@@ -916,17 +916,17 @@ impl RenderBackend {
                                 txn.notifications.take(),
                                 txn.render_frame,
                                 txn.invalidate_rendered_frame,
                                 &mut frame_counter,
                                 &mut profile_counters,
                                 has_built_scene,
                             );
                         }
-                        self.resource_cache.after_frames();
+                        self.bookkeep_after_frames();
                     },
                     SceneBuilderResult::FlushComplete(tx) => {
                         tx.send(()).ok();
                     }
                     SceneBuilderResult::ExternalEvent(evt) => {
                         self.notifier.external_event(evt);
                     }
                     SceneBuilderResult::ClearNamespace(id) => {
@@ -1194,16 +1194,30 @@ impl RenderBackend {
                     profile_counters,
                 );
             }
         }
 
         true
     }
 
+    fn prepare_for_frames(&mut self) {
+        self.resource_cache.prepare_for_frames(SystemTime::now());
+        self.gpu_cache.prepare_for_frames();
+    }
+
+    fn bookkeep_after_frames(&mut self) {
+        self.resource_cache.bookkeep_after_frames();
+        self.gpu_cache.bookkeep_after_frames();   
+    }
+
+    fn requires_frame_build(&mut self) -> bool {
+        self.resource_cache.requires_frame_build() || self.gpu_cache.requires_frame_build()
+    }
+
     fn prepare_transactions(
         &mut self,
         document_ids: Vec<DocumentId>,
         mut transaction_msgs: Vec<TransactionMsg>,
         frame_counter: &mut u32,
         profile_counters: &mut BackendProfileCounters,
     ) {
         let mut use_scene_builder = transaction_msgs.iter()
@@ -1230,23 +1244,16 @@ impl RenderBackend {
                     invalidate_rendered_frame: transaction_msg.invalidate_rendered_frame,
                 });
 
                 self.resource_cache.pre_scene_building_update(
                     &mut txn.resource_updates,
                     &mut profile_counters.resources,
                 );
 
-                // If we've been above the threshold for reclaiming GPU cache memory for
-                // long enough, drop it and rebuild it. This needs to be done before any
-                // updates for this frame are made.
-                if self.gpu_cache.should_reclaim_memory() {
-                    self.gpu_cache.clear();
-                }
-
                 for scene_msg in transaction_msg.scene_ops.drain(..) {
                     let _timer = profile_counters.total_time.timer();
                     self.process_scene_msg(
                         document_id,
                         scene_msg,
                         *frame_counter,
                         &mut txn,
                         &mut profile_counters.ipc,
@@ -1276,17 +1283,17 @@ impl RenderBackend {
                     txn.request_scene_build = Some(SceneRequest {
                         view: doc.view.clone(),
                         font_instances: self.resource_cache.get_font_instances(),
                         output_pipelines: doc.output_pipelines.clone(),
                     });
                 }
             }
         } else {
-            self.resource_cache.before_frames(SystemTime::now());
+            self.prepare_for_frames();
             self.maybe_force_nop_documents(
                 frame_counter,
                 profile_counters,
                 |document_id| txns.iter().any(|txn| txn.document_id == document_id));
 
             for mut txn in txns {
                 self.update_document(
                     txn.document_id,
@@ -1297,17 +1304,17 @@ impl RenderBackend {
                     txn.render_frame,
                     txn.invalidate_rendered_frame,
                     frame_counter,
                     profile_counters,
                     false
                 );
             }
 
-            self.resource_cache.after_frames();
+            self.bookkeep_after_frames();
             return;
         }
 
         let tx = if use_high_priority {
             &self.scene_tx
         } else {
             &self.low_priority_scene_tx
         };
@@ -1321,17 +1328,17 @@ impl RenderBackend {
     /// may not have a transaction ready for every document - this method
     /// calls update_document with the details of a fake, nop transaction just
     /// to force a frame build.
     fn maybe_force_nop_documents<F>(&mut self,
                                     frame_counter: &mut u32,
                                     profile_counters: &mut BackendProfileCounters,
                                     document_already_present: F) where
         F: Fn(DocumentId) -> bool {
-        if self.resource_cache.requires_frame_build() {
+        if self.requires_frame_build() {
             let nop_documents : Vec<DocumentId> = self.documents.keys()
                 .cloned()
                 .filter(|key| !document_already_present(*key))
                 .collect();
             for &document_id in &nop_documents {
                 self.update_document(
                     document_id,
                     Vec::default(),
@@ -1368,16 +1375,17 @@ impl RenderBackend {
         // before rendering. This is useful for rendering with the latest
         // async transforms.
         if requested_frame || has_built_scene {
             if let Some(ref sampler) = self.sampler {
                 frame_ops.append(&mut sampler.sample(document_id));
             }
         }
 
+        let requires_frame_build = self.requires_frame_build();
         let doc = self.documents.get_mut(&document_id).unwrap();
         doc.has_built_scene |= has_built_scene;
 
         // If there are any additions or removals of clip modes
         // during the scene build, apply them to the data store now.
         if let Some(updates) = interner_updates {
             doc.data_stores.apply_updates(updates, profile_counters);
         }
@@ -1415,17 +1423,17 @@ impl RenderBackend {
         }
 
         // Avoid re-building the frame if the current built frame is still valid.
         // However, if the resource_cache requires a frame build, _always_ do that, unless
         // doc.can_render() is false, as in that case a frame build can't happen anyway.
         // We want to ensure we do this because even if the doc doesn't have pixels it
         // can still try to access stale texture cache items.
         let build_frame = (render_frame && !doc.frame_is_valid && doc.has_pixels()) ||
-            (self.resource_cache.requires_frame_build() && doc.can_render());
+            (requires_frame_build && doc.can_render());
 
         // Request composite is true when we want to composite frame even when
         // there is no frame update. This happens when video frame is updated under
         // external image with NativeTexture or when platform requested to composite frame.
         if invalidate_rendered_frame {
             doc.rendered_frame_is_valid = false;
         }
 
@@ -1652,16 +1660,20 @@ impl RenderBackend {
         debug!("capture: saving {:?}", root);
         if !root.is_dir() {
             if let Err(e) = fs::create_dir_all(&root) {
                 panic!("Unable to create capture dir: {:?}", e);
             }
         }
         let config = CaptureConfig::new(root, bits);
 
+        if config.bits.contains(CaptureBits::FRAME) {
+            self.prepare_for_frames();
+        }
+
         for (&id, doc) in &mut self.documents {
             debug!("\tdocument {:?}", id);
             if config.bits.contains(CaptureBits::SCENE) {
                 let file_name = format!("scene-{}-{}", id.namespace_id.0, id.id);
                 config.serialize(&doc.scene, file_name);
             }
             if config.bits.contains(CaptureBits::FRAME) {
                 let rendered_document = doc.build_frame(
@@ -1693,16 +1705,24 @@ impl RenderBackend {
                     &mut svg_file
                 ).unwrap();
             }
 
             let data_stores_name = format!("data-stores-{}-{}", id.namespace_id.0, id.id);
             config.serialize(&doc.data_stores, data_stores_name);
         }
 
+        if config.bits.contains(CaptureBits::FRAME) {
+            // TODO: there is no guarantee that we won't hit this case, but we want to
+            // report it here if we do. If we don't, it will simply crash in
+            // Renderer::render_impl and give us less information about the source.
+            assert!(!self.requires_frame_build(), "Caches were cleared during a capture.");
+            self.bookkeep_after_frames();
+        }
+
         debug!("\tscene builder");
         self.scene_tx.send(SceneBuilderRequest::SaveScene(config.clone())).unwrap();
 
         debug!("\tresource cache");
         let (resources, deferred) = self.resource_cache.save_capture(&config.root);
 
         info!("\tbackend");
         let backend = PlainRenderBackend {
--- a/gfx/wr/webrender/src/render_task.rs
+++ b/gfx/wr/webrender/src/render_task.rs
@@ -148,17 +148,17 @@ impl RenderTaskTree {
     ) {
         let parent = &mut self[parent_id];
         parent.children.push(child_id);
     }
 
     /// Assign this frame's render tasks to render passes ordered so that passes appear
     /// earlier than the ones that depend on them.
     pub fn generate_passes(
-        &self,
+        &mut self,
         main_render_task: Option<RenderTaskId>,
         screen_size: DeviceIntSize,
         gpu_supports_fast_clears: bool,
     ) -> Vec<RenderPass> {
         let mut passes = Vec::new();
 
         if !self.cacheable_render_tasks.is_empty() {
             self.generate_passes_impl(
@@ -175,16 +175,19 @@ impl RenderTaskTree {
                 &[main_task],
                 screen_size,
                 gpu_supports_fast_clears,
                 true,
                 &mut passes,
             );
         }
 
+
+        self.resolve_target_conflicts(&mut passes);
+
         passes
     }
 
     /// Assign the render tasks from the tree rooted at root_task to render passes and
     /// append them to the `passes` vector so that the passes that we depend on end up
     /// _earlier_ in the pass list.
     fn generate_passes_impl(
         &self,
@@ -273,16 +276,123 @@ impl RenderTaskTree {
                 task_id,
                 task.get_dynamic_size(),
                 task.target_kind(),
                 &task.location,
             );
         }
     }
 
+    /// Resolve conflicts between the generated passes and the limitiations of our target
+    /// allocation scheme.
+    ///
+    /// The render task graph operates with a ping-pong target allocation scheme where
+    /// a set of targets is written to by even passes and a different set of targets is
+    /// written to by odd passes.
+    /// Since tasks cannot read and write the same target, we can run into issues if a
+    /// task pass in N + 2 reads the result of a task in pass N.
+    /// To avoid such cases have to insert blit tasks to copy the content of the task
+    /// into pass N + 1 which is readable by pass N + 2.
+    ///
+    /// In addition, allocated rects of pass N are currently not tracked and can be
+    /// overwritten by allocations in later passes on the same target, unless the task
+    /// has been marked for saving, which perserves the allocated rect until the end of
+    /// the frame. This is a big hammer, hopefully we won't need to mark many passes
+    /// for saving. A better solution would be to track allocations through the entire
+    /// graph, there is a prototype of that in https://github.com/nical/toy-render-graph/
+    fn resolve_target_conflicts(&mut self, passes: &mut [RenderPass]) {
+        // Keep track of blit tasks we inserted to avoid adding several blits for the same
+        // task.
+        let mut task_redirects = vec![None; self.tasks.len()];
+
+        let mut task_passes = vec![-1; self.tasks.len()];
+        for pass_index in 0..passes.len() {
+            for task in &passes[pass_index].tasks {
+                task_passes[task.index as usize] = pass_index as i32;
+            }
+        }
+
+        for task_index in 0..self.tasks.len() {
+            if task_passes[task_index] < 0 {
+                // The task doesn't contribute to this frame.
+                continue;
+            }
+
+            let pass_index = task_passes[task_index];
+
+            // Go through each dependency and check whether they belong
+            // to a pass that uses the same targets and/or are more than
+            // one pass behind.
+            for nth_child in 0..self.tasks[task_index].children.len() {
+                let child_task_index = self.tasks[task_index].children[nth_child].index as usize;
+                let child_pass_index = task_passes[child_task_index];
+
+                if child_pass_index == pass_index - 1 {
+                    // This should be the most common case.
+                    continue;
+                }
+
+                if child_pass_index % 2 != pass_index % 2 {
+                    // The tasks and its dependency aren't on the same targets,
+                    // but the dependency needs to be kept alive.
+                    self.tasks[child_task_index].mark_for_saving();
+                    continue;
+                }
+
+                if let Some(blit_id) = task_redirects[child_task_index] {
+                    // We already resolved a similar conflict with a blit task,
+                    // reuse the same blit instead of creating a new one.
+                    self.tasks[task_index].children[nth_child] = blit_id;
+
+                    // Mark for saving if the blit is more than pass appart from
+                    // our task.
+                    if child_pass_index < pass_index - 2 {
+                        self.tasks[blit_id.index as usize].mark_for_saving();
+                    }
+
+                    continue;
+                }
+
+                // Our dependency is an even number of passes behind, need
+                // to insert a blit to ensure we don't read and write from
+                // the same target.
+
+                let task_id = RenderTaskId {
+                    index: child_task_index as u32,
+                    #[cfg(debug_assertions)]
+                    frame_id: self.frame_id,
+                };
+
+                let mut blit = RenderTask::new_blit(
+                    self.tasks[task_index].location.size(),
+                    BlitSource::RenderTask { task_id },
+                );
+
+                // Mark for saving if the blit is more than pass appart from
+                // our task.
+                if child_pass_index < pass_index - 2 {
+                    blit.mark_for_saving();
+                }
+
+                let blit_id = RenderTaskId {
+                    index: self.tasks.len() as u32,
+                    #[cfg(debug_assertions)]
+                    frame_id: self.frame_id,
+                };
+
+                self.tasks.push(blit);
+
+                passes[child_pass_index as usize + 1].tasks.push(blit_id);
+
+                self.tasks[task_index].children[nth_child] = blit_id;
+                task_redirects[task_index] = Some(blit_id);
+            }
+        }
+    }
+
     pub fn get_task_address(&self, id: RenderTaskId) -> RenderTaskAddress {
         #[cfg(debug_assertions)]
         debug_assert_eq!(self.frame_id, id.frame_id);
         RenderTaskAddress(id.index)
     }
 
     pub fn write_task_data(&mut self) {
         for task in &self.tasks {
--- a/gfx/wr/webrender/src/resource_cache.rs
+++ b/gfx/wr/webrender/src/resource_cache.rs
@@ -1560,22 +1560,22 @@ impl ResourceCache {
             ImageProperties {
                 descriptor: image_template.descriptor,
                 external_image,
                 tiling: image_template.tiling,
             }
         })
     }
 
-    pub fn before_frames(&mut self, time: SystemTime) {
-        self.texture_cache.before_frames(time);
+    pub fn prepare_for_frames(&mut self, time: SystemTime) {
+        self.texture_cache.prepare_for_frames(time);
     }
 
-    pub fn after_frames(&mut self) {
-        self.texture_cache.after_frames();
+    pub fn bookkeep_after_frames(&mut self) {
+        self.texture_cache.bookkeep_after_frames();
     }
 
     pub fn requires_frame_build(&self) -> bool {
         self.texture_cache.requires_frame_build()
     }
 
     pub fn begin_frame(&mut self, stamp: FrameStamp) {
         debug_assert_eq!(self.state, State::Idle);
--- a/gfx/wr/webrender/src/texture_cache.rs
+++ b/gfx/wr/webrender/src/texture_cache.rs
@@ -666,21 +666,21 @@ impl TextureCache {
                             .unwrap_or_else(|| PerDocumentData::new());
     }
 
     fn unset_doc_data(&mut self) {
         self.per_doc_data.insert(self.now.document_id(),
                                  mem::replace(&mut self.doc_data, PerDocumentData::new()));
     }
 
-    pub fn before_frames(&mut self, time: SystemTime) {
+    pub fn prepare_for_frames(&mut self, time: SystemTime) {
         self.maybe_reclaim_shared_memory(time);
     }
 
-    pub fn after_frames(&mut self) {
+    pub fn bookkeep_after_frames(&mut self) {
         self.require_frame_build = false;
     }
 
     pub fn requires_frame_build(&self) -> bool {
         return self.require_frame_build;
     }
 
     /// Called at the beginning of each frame.
--- a/gfx/wr/webrender/src/tiling.rs
+++ b/gfx/wr/webrender/src/tiling.rs
@@ -559,18 +559,22 @@ impl RenderTarget for ColorRenderTarget 
                             source: BlitJobSource::Texture(
                                 cache_item.texture_id,
                                 cache_item.texture_layer,
                                 source_rect,
                             ),
                             target_rect: target_rect.inner_rect(task_info.padding)
                         });
                     }
-                    BlitSource::RenderTask { .. } => {
-                        panic!("BUG: render task blit jobs to render tasks not supported");
+                    BlitSource::RenderTask { task_id } => {
+                        let (target_rect, _) = task.get_target_rect();
+                        self.blits.push(BlitJob {
+                            source: BlitJobSource::RenderTask(task_id),
+                            target_rect: target_rect.inner_rect(task_info.padding)
+                        });
                     }
                 }
             }
         }
     }
 
     fn must_be_drawn(&self) -> bool {
         self.alpha_batch_containers.iter().any(|ab| {
--- a/js/src/frontend/TokenStream.cpp
+++ b/js/src/frontend/TokenStream.cpp
@@ -161,16 +161,23 @@ static uint32_t GetSingleCodePoint(const
   }
 
   codePoint = **p;
   (*p)++;
   return codePoint;
 }
 
 template <typename CharT>
+static constexpr bool IsAsciiBinary(CharT c) {
+  using UnsignedCharT = std::make_unsigned_t<CharT>;
+  auto uc = static_cast<UnsignedCharT>(c);
+  return uc == '0' || uc == '1';
+}
+
+template <typename CharT>
 static constexpr bool IsAsciiOctal(CharT c) {
   using UnsignedCharT = std::make_unsigned_t<CharT>;
   auto uc = static_cast<UnsignedCharT>(c);
   return '0' <= uc && uc <= '7';
 }
 
 template <typename CharT>
 static constexpr uint8_t AsciiOctalToNumber(CharT c) {
@@ -2160,26 +2167,56 @@ void SourceUnits<Utf8Unit>::consumeRestO
       return;
     }
 
     consumeKnownCodePoint(peeked);
   }
 }
 
 template <typename Unit, class AnyCharsAccess>
+MOZ_MUST_USE MOZ_ALWAYS_INLINE bool
+TokenStreamSpecific<Unit, AnyCharsAccess>::matchInteger(
+    IsIntegerUnit isIntegerUnit, int32_t* nextUnit) {
+  int32_t unit;
+  while (true) {
+    unit = getCodeUnit();
+    if (isIntegerUnit(unit)) {
+      continue;
+    }
+#ifdef NIGHTLY_BUILD
+    if (unit != '_') {
+      break;
+    }
+    unit = getCodeUnit();
+    if (!isIntegerUnit(unit)) {
+      error(JSMSG_MISSING_DIGIT_AFTER_SEPARATOR);
+      return false;
+    }
+#else
+    break;
+#endif /* NIGHTLY_BUILD */
+  }
+
+  *nextUnit = unit;
+  return true;
+}
+
+template <typename Unit, class AnyCharsAccess>
 MOZ_MUST_USE bool TokenStreamSpecific<Unit, AnyCharsAccess>::decimalNumber(
     int32_t unit, TokenStart start, const Unit* numStart, Modifier modifier,
     TokenKind* out) {
   // Run the bad-token code for every path out of this function except the
   // one success-case.
   auto noteBadToken = MakeScopeExit([this]() { this->badToken(); });
 
   // Consume integral component digits.
-  while (IsAsciiDigit(unit)) {
-    unit = getCodeUnit();
+  if (IsAsciiDigit(unit)) {
+    if (!matchInteger(IsAsciiDigit, &unit)) {
+      return false;
+    }
   }
 
   // Numbers contain no escapes, so we can read directly from |sourceUnits|.
   double dval;
   bool isBigInt = false;
   DecimalPoint decimalPoint = NoDecimal;
   if (unit != '.' && unit != 'e' && unit != 'E' && unit != 'n') {
     // NOTE: |unit| may be EOF here.
@@ -2193,19 +2230,19 @@ MOZ_MUST_USE bool TokenStreamSpecific<Un
     }
   } else if (unit == 'n' && anyCharsAccess().options().bigIntEnabledOption) {
     isBigInt = true;
     unit = peekCodeUnit();
   } else {
     // Consume any decimal dot and fractional component.
     if (unit == '.') {
       decimalPoint = HasDecimal;
-      do {
-        unit = getCodeUnit();
-      } while (IsAsciiDigit(unit));
+      if (!matchInteger(IsAsciiDigit, &unit)) {
+        return false;
+      }
     }
 
     // Consume any exponential notation.
     if (unit == 'e' || unit == 'E') {
       unit = getCodeUnit();
       if (unit == '+' || unit == '-') {
         unit = getCodeUnit();
       }
@@ -2213,28 +2250,29 @@ MOZ_MUST_USE bool TokenStreamSpecific<Un
       // Exponential notation must contain at least one digit.
       if (!IsAsciiDigit(unit)) {
         ungetCodeUnit(unit);
         error(JSMSG_MISSING_EXPONENT);
         return false;
       }
 
       // Consume exponential digits.
-      do {
-        unit = getCodeUnit();
-      } while (IsAsciiDigit(unit));
+      if (!matchInteger(IsAsciiDigit, &unit)) {
+        return false;
+      }
     }
 
     ungetCodeUnit(unit);
 
     // "0." and "0e..." numbers parse "." or "e..." here.  Neither range
     // contains a number, so we can't use |FullStringToDouble|.  (Parse
     // failures return 0.0, so we'll still get the right result.)
-    if (!StringToDouble(anyCharsAccess().cx, numStart,
-                        this->sourceUnits.addressOfNextCodeUnit(), &dval)) {
+    if (!GetDecimalNonInteger(anyCharsAccess().cx, numStart,
+                              this->sourceUnits.addressOfNextCodeUnit(),
+                              &dval)) {
       return false;
     }
   }
 
   // Number followed by IdentifierStart is an error.  (This is the only place
   // in ECMAScript where token boundary is inadequate to properly separate
   // two tokens, necessitating this unaesthetic lookahead.)
   if (unit != EOF) {
@@ -2401,16 +2439,22 @@ MOZ_MUST_USE bool TokenStreamSpecific<Un
   mozilla::Range<const Unit> chars(
       this->sourceUnits.codeUnitPtrAt(start.offset()), length);
   for (uint32_t idx = 0; idx < length - 1; idx++) {
     int32_t unit = CodeUnitValue(chars[idx]);
     // Char buffer may start with a 0[bBoOxX] prefix, then follows with
     // binary, octal, decimal, or hex digits.  Already checked by caller, as
     // the "n" indicating bigint comes at the end.
     MOZ_ASSERT(isAsciiCodePoint(unit));
+#ifdef NIGHTLY_BUILD
+    // Skip over any separators.
+    if (unit == '_') {
+      continue;
+    }
+#endif
     if (!this->appendCodePointToCharBuffer(unit)) {
       return false;
     }
   }
   newBigIntToken(start, modifier, out);
   return true;
 }
 
@@ -2612,81 +2656,89 @@ MOZ_MUST_USE bool TokenStreamSpecific<Un
           ungetCodeUnit(unit);
           error(JSMSG_MISSING_HEXDIGITS);
           return badToken();
         }
 
         // one past the '0x'
         numStart = this->sourceUnits.addressOfNextCodeUnit() - 1;
 
-        while (IsAsciiHexDigit(unit)) {
-          unit = getCodeUnit();
+        if (!matchInteger(IsAsciiHexDigit, &unit)) {
+          return badToken();
         }
       } else if (unit == 'b' || unit == 'B') {
         radix = 2;
         unit = getCodeUnit();
-        if (unit != '0' && unit != '1') {
+        if (!IsAsciiBinary(unit)) {
           // NOTE: |unit| may be EOF here.
           ungetCodeUnit(unit);
           error(JSMSG_MISSING_BINARY_DIGITS);
           return badToken();
         }
 
         // one past the '0b'
         numStart = this->sourceUnits.addressOfNextCodeUnit() - 1;
 
-        while (unit == '0' || unit == '1') {
-          unit = getCodeUnit();
+        if (!matchInteger(IsAsciiBinary, &unit)) {
+          return badToken();
         }
       } else if (unit == 'o' || unit == 'O') {
         radix = 8;
         unit = getCodeUnit();
         if (!IsAsciiOctal(unit)) {
           // NOTE: |unit| may be EOF here.
           ungetCodeUnit(unit);
           error(JSMSG_MISSING_OCTAL_DIGITS);
           return badToken();
         }
 
         // one past the '0o'
         numStart = this->sourceUnits.addressOfNextCodeUnit() - 1;
 
-        while (IsAsciiOctal(unit)) {
-          unit = getCodeUnit();
+        if (!matchInteger(IsAsciiOctal, &unit)) {
+          return badToken();
         }
       } else if (IsAsciiDigit(unit)) {
+        // Octal integer literals are not permitted in strict mode code.
+        if (!strictModeError(JSMSG_DEPRECATED_OCTAL)) {
+          return badToken();
+        }
+
         radix = 8;
         isLegacyOctalOrNoctal = true;
         // one past the '0'
         numStart = this->sourceUnits.addressOfNextCodeUnit() - 1;
 
+        bool nonOctalDecimalIntegerLiteral = false;
         do {
-          // Octal integer literals are not permitted in strict mode
-          // code.
-          if (!strictModeError(JSMSG_DEPRECATED_OCTAL)) {
-            return badToken();
+          if (unit >= '8') {
+            nonOctalDecimalIntegerLiteral = true;
           }
-
-          // Outside strict mode, we permit 08 and 09 as decimal
-          // numbers, which makes our behaviour a superset of the
-          // ECMA numeric grammar. We might not always be so
-          // permissive, so we warn about it.
-          if (unit >= '8') {
-            if (!warning(JSMSG_BAD_OCTAL, unit == '8' ? "08" : "09")) {
-              return badToken();
-            }
-
-            // Use the decimal scanner for the rest of the number.
-            return decimalNumber(unit, start, numStart, modifier, ttp);
-          }
-
           unit = getCodeUnit();
         } while (IsAsciiDigit(unit));
+
+#ifdef NIGHTLY_BUILD
+        if (unit == '_') {
+          error(JSMSG_SEPARATOR_IN_ZERO_PREFIXED_NUMBER);
+          return badToken();
+        }
+#endif /* NIGHTLY_BUILD */
+
+        if (nonOctalDecimalIntegerLiteral) {
+          // Use the decimal scanner for the rest of the number.
+          return decimalNumber(unit, start, numStart, modifier, ttp);
+        }
+#ifdef NIGHTLY_BUILD
+      } else if (unit == '_') {
+        // Give a more explicit error message when '_' is used after '0'.
+        error(JSMSG_SEPARATOR_IN_ZERO_PREFIXED_NUMBER);
+        return badToken();
+#endif /* NIGHTLY_BUILD */
       } else {
-        // '0' not followed by [XxBbOo0-9];  scan as a decimal number.
+        // '0' not followed by [XxBbOo0-9_];  scan as a decimal number.
         numStart = this->sourceUnits.addressOfNextCodeUnit() - 1;
 
         // NOTE: |unit| may be EOF here.  (This is permitted by case #3
         //       in TokenStream.h docs for this function.)
         return decimalNumber(unit, start, numStart, modifier, ttp);
       }
 
       if (unit == 'n' && anyCharsAccess().options().bigIntEnabledOption) {
@@ -2721,17 +2773,17 @@ MOZ_MUST_USE bool TokenStreamSpecific<Un
 
       if (isBigInt) {
         return bigIntLiteral(start, modifier, ttp);
       }
 
       double dval;
       if (!GetFullInteger(anyCharsAccess().cx, numStart,
                           this->sourceUnits.addressOfNextCodeUnit(), radix,
-                          &dval)) {
+                          IntegerSeparatorHandling::SkipUnderscore, &dval)) {
         return badToken();
       }
       newNumberToken(dval, NoDecimal, start, modifier, ttp);
       return true;
     }
 
     MOZ_ASSERT(c1kind == Other);
 
--- a/js/src/frontend/TokenStream.h
+++ b/js/src/frontend/TokenStream.h
@@ -2505,16 +2505,20 @@ class MOZ_STACK_CLASS TokenStreamSpecifi
       case InvalidEscapeType::Octal:
         errorAt(offset, JSMSG_DEPRECATED_OCTAL);
         return;
     }
   }
 
   MOZ_MUST_USE bool putIdentInCharBuffer(const Unit* identStart);
 
+  using IsIntegerUnit = bool (*)(int32_t);
+  MOZ_MUST_USE MOZ_ALWAYS_INLINE bool matchInteger(IsIntegerUnit isIntegerUnit,
+                                                   int32_t* nextUnit);
+
   /**
    * Tokenize a decimal number that begins at |numStart| into the provided
    * token.
    *
    * |unit| must be one of these values:
    *
    *   1. The first decimal digit in the integral part of a decimal number
    *      not starting with '0' or '.', e.g. '1' for "17", '3' for "3.14", or
deleted file mode 100644
--- a/js/src/jit-test/tests/gc/bug-1215678.js
+++ /dev/null
@@ -1,10 +0,0 @@
-// |jit-test| error: ReferenceError
-if (!('oomTest' in this))
-    a;
-
-enableShellAllocationMetadataBuilder()
-oomTest(() => {
-  newGlobal()
-})
-gczeal(9, 1);
-a;
--- a/js/src/js.msg
+++ b/js/src/js.msg
@@ -200,17 +200,16 @@ MSG_DEF(JSMSG_BAD_DESTRUCT_PARENS,     0
 MSG_DEF(JSMSG_BAD_DESTRUCT_DECL,       0, JSEXN_SYNTAXERR, "missing = in destructuring declaration")
 MSG_DEF(JSMSG_BAD_DUP_ARGS,            0, JSEXN_SYNTAXERR, "duplicate argument names not allowed in this context")
 MSG_DEF(JSMSG_BAD_FOR_EACH_LOOP,       0, JSEXN_SYNTAXERR, "invalid for each loop")
 MSG_DEF(JSMSG_BAD_FOR_LEFTSIDE,        0, JSEXN_SYNTAXERR, "invalid for-in/of left-hand side")
 MSG_DEF(JSMSG_LEXICAL_DECL_DEFINES_LET,0, JSEXN_SYNTAXERR, "a lexical declaration can't define a 'let' binding")
 MSG_DEF(JSMSG_LET_STARTING_FOROF_LHS,  0, JSEXN_SYNTAXERR, "an expression X in 'for (X of Y)' must not start with 'let'")
 MSG_DEF(JSMSG_BAD_INCOP_OPERAND,       0, JSEXN_SYNTAXERR, "invalid increment/decrement operand")
 MSG_DEF(JSMSG_BAD_METHOD_DEF,          0, JSEXN_SYNTAXERR, "bad method definition")
-MSG_DEF(JSMSG_BAD_OCTAL,               1, JSEXN_SYNTAXERR, "{0} is not a legal ECMA-262 octal constant")
 MSG_DEF(JSMSG_BAD_POW_LEFTSIDE,        0, JSEXN_SYNTAXERR, "unparenthesized unary expression can't appear on the left-hand side of '**'")
 MSG_DEF(JSMSG_BAD_PROP_ID,             0, JSEXN_SYNTAXERR, "invalid property id")
 MSG_DEF(JSMSG_BAD_RETURN_OR_YIELD,     1, JSEXN_SYNTAXERR, "{0} not in function")
 MSG_DEF(JSMSG_BAD_STRICT_ASSIGN,       1, JSEXN_SYNTAXERR, "'{0}' can't be defined or assigned to in strict mode code")
 MSG_DEF(JSMSG_BAD_STRICT_ASSIGN_ARGUMENTS, 0, JSEXN_SYNTAXERR, "'arguments' can't be defined or assigned to in strict mode code")
 MSG_DEF(JSMSG_BAD_STRICT_ASSIGN_EVAL,  0, JSEXN_SYNTAXERR, "'eval' can't be defined or assigned to in strict mode code")
 MSG_DEF(JSMSG_BAD_SWITCH,              0, JSEXN_SYNTAXERR, "invalid switch statement")
 MSG_DEF(JSMSG_BAD_SUPER,               0, JSEXN_SYNTAXERR, "invalid use of keyword 'super'")
@@ -266,31 +265,33 @@ MSG_DEF(JSMSG_BAD_ESCAPE,              0
 MSG_DEF(JSMSG_MISSING_PRIVATE_NAME,    0, JSEXN_SYNTAXERR, "'#' not followed by identifier")
 MSG_DEF(JSMSG_ILLEGAL_CHARACTER,       0, JSEXN_SYNTAXERR, "illegal character")
 MSG_DEF(JSMSG_IMPORT_META_OUTSIDE_MODULE, 0, JSEXN_SYNTAXERR, "import.meta may only appear in a module")
 MSG_DEF(JSMSG_IMPORT_DECL_AT_TOP_LEVEL, 0, JSEXN_SYNTAXERR, "import declarations may only appear at top level of a module")
 MSG_DEF(JSMSG_OF_AFTER_FOR_LOOP_DECL,  0, JSEXN_SYNTAXERR, "a declaration in the head of a for-of loop can't have an initializer")
 MSG_DEF(JSMSG_IN_AFTER_LEXICAL_FOR_DECL,0,JSEXN_SYNTAXERR, "a lexical declaration in the head of a for-in loop can't have an initializer")
 MSG_DEF(JSMSG_INVALID_FOR_IN_DECL_WITH_INIT,0,JSEXN_SYNTAXERR,"for-in loop head declarations may not have initializers")
 MSG_DEF(JSMSG_INVALID_ID,              1, JSEXN_SYNTAXERR, "{0} is an invalid identifier")
+MSG_DEF(JSMSG_SEPARATOR_IN_ZERO_PREFIXED_NUMBER, 0, JSEXN_SYNTAXERR, "numeric separators '_' are not allowed in numbers that start with '0'")
 MSG_DEF(JSMSG_LABEL_NOT_FOUND,         0, JSEXN_SYNTAXERR, "label not found")
 MSG_DEF(JSMSG_LEXICAL_DECL_NOT_IN_BLOCK,   1, JSEXN_SYNTAXERR, "{0} declaration not directly within block")
 MSG_DEF(JSMSG_LEXICAL_DECL_LABEL,      1, JSEXN_SYNTAXERR, "{0} declarations cannot be labelled")
 MSG_DEF(JSMSG_GENERATOR_LABEL,         0, JSEXN_SYNTAXERR, "generator functions cannot be labelled")
 MSG_DEF(JSMSG_FUNCTION_LABEL,          0, JSEXN_SYNTAXERR, "functions cannot be labelled")
 MSG_DEF(JSMSG_SLOPPY_FUNCTION_LABEL,   0, JSEXN_SYNTAXERR, "functions can only be labelled inside blocks")
 MSG_DEF(JSMSG_LINE_BREAK_AFTER_THROW,  0, JSEXN_SYNTAXERR, "no line break is allowed between 'throw' and its expression")
 MSG_DEF(JSMSG_LINE_BREAK_BEFORE_ARROW, 0, JSEXN_SYNTAXERR, "no line break is allowed before '=>'")
 MSG_DEF(JSMSG_MALFORMED_ESCAPE,        1, JSEXN_SYNTAXERR, "malformed {0} character escape sequence")
 MSG_DEF(JSMSG_MISSING_BINARY_DIGITS,   0, JSEXN_SYNTAXERR, "missing binary digits after '0b'")
 MSG_DEF(JSMSG_MISSING_EXPONENT,        0, JSEXN_SYNTAXERR, "missing exponent")
 MSG_DEF(JSMSG_MISSING_EXPR_AFTER_THROW,0, JSEXN_SYNTAXERR, "throw statement is missing an expression")
 MSG_DEF(JSMSG_MISSING_FORMAL,          0, JSEXN_SYNTAXERR, "missing formal parameter")
 MSG_DEF(JSMSG_MISSING_HEXDIGITS,       0, JSEXN_SYNTAXERR, "missing hexadecimal digits after '0x'")
 MSG_DEF(JSMSG_MISSING_OCTAL_DIGITS,    0, JSEXN_SYNTAXERR, "missing octal digits after '0o'")
+MSG_DEF(JSMSG_MISSING_DIGIT_AFTER_SEPARATOR, 0, JSEXN_SYNTAXERR, "missing digit after '_' numeric separator")
 MSG_DEF(JSMSG_MODULE_SPEC_AFTER_FROM,  0, JSEXN_SYNTAXERR, "missing module specifier after 'from' keyword")
 MSG_DEF(JSMSG_NAME_AFTER_DOT,          0, JSEXN_SYNTAXERR, "missing name after . operator")
 MSG_DEF(JSMSG_NAMED_IMPORTS_OR_NAMESPACE_IMPORT, 0, JSEXN_SYNTAXERR, "expected named imports or namespace import after comma")
 MSG_DEF(JSMSG_NO_BINDING_NAME,        0, JSEXN_SYNTAXERR, "missing binding name")
 MSG_DEF(JSMSG_NO_EXPORT_NAME,          0, JSEXN_SYNTAXERR, "missing export name")
 MSG_DEF(JSMSG_NO_IMPORT_NAME,          0, JSEXN_SYNTAXERR, "missing import name")
 MSG_DEF(JSMSG_NO_VARIABLE_NAME,        0, JSEXN_SYNTAXERR, "missing variable name")
 MSG_DEF(JSMSG_OF_AFTER_FOR_NAME,       0, JSEXN_SYNTAXERR, "missing 'of' after for")
--- a/js/src/jsapi-tests/binast/jit-test.ignore
+++ b/js/src/jsapi-tests/binast/jit-test.ignore
@@ -1206,17 +1206,16 @@ gc/bug-1109913.js
 gc/bug-1144738.js
 gc/bug-1191576.js
 gc/bug-1206677.js
 gc/bug-1208994.js
 gc/bug-1209001.js
 gc/bug-1215363-1.js
 gc/bug-1215363-2.js
 gc/bug-1215363-3.js
-gc/bug-1215678.js
 gc/bug-1221359.js
 gc/bug-1226896.js
 gc/bug-1234410.js
 gc/bug-1236473.js
 gc/bug-1238575-2.js
 gc/bug-1238582.js
 gc/bug-1240503.js
 gc/bug-1240527.js
--- a/js/src/jsnum.cpp
+++ b/js/src/jsnum.cpp
@@ -76,36 +76,55 @@ static bool EnsureDtoaState(JSContext* c
     cx->dtoaState = NewDtoaState();
     if (!cx->dtoaState) {
       return false;
     }
   }
   return true;
 }
 
+template <typename CharT>
+static inline void AssertWellPlacedNumericSeparator(const CharT* s,
+                                                    const CharT* start,
+                                                    const CharT* end) {
+  MOZ_ASSERT(start < end, "string is non-empty");
+  MOZ_ASSERT(s > start, "number can't start with a separator");
+  MOZ_ASSERT(s + 1 < end,
+             "final character in a numeric literal can't be a separator");
+  MOZ_ASSERT(*(s + 1) != '_',
+             "separator can't be followed by another separator");
+  MOZ_ASSERT(*(s - 1) != '_',
+             "separator can't be preceded by another separator");
+}
+
 /*
  * If we're accumulating a decimal number and the number is >= 2^53, then the
  * fast result from the loop in Get{Prefix,Decimal}Integer may be inaccurate.
  * Call js_strtod_harder to get the correct answer.
  */
 template <typename CharT>
 static bool ComputeAccurateDecimalInteger(JSContext* cx, const CharT* start,
                                           const CharT* end, double* dp) {
   size_t length = end - start;
   auto cstr = cx->make_pod_array<char>(length + 1);
   if (!cstr) {
     return false;
   }
 
+  size_t j = 0;
   for (size_t i = 0; i < length; i++) {
     char c = char(start[i]);
+    if (c == '_') {
+      AssertWellPlacedNumericSeparator(start + i, start, end);
+      continue;
+    }
     MOZ_ASSERT(IsAsciiAlphanumeric(c));
-    cstr[i] = c;
+    cstr[j++] = c;
   }
-  cstr[length] = 0;
+  cstr[j] = 0;
 
   if (!EnsureDtoaState(cx)) {
     return false;
   }
 
   char* estr;
   *dp = js_strtod_harder(cx->dtoaState, cstr.get(), &estr);
 
@@ -114,31 +133,42 @@ static bool ComputeAccurateDecimalIntege
 
 namespace {
 
 template <typename CharT>
 class BinaryDigitReader {
   const int base;     /* Base of number; must be a power of 2 */
   int digit;          /* Current digit value in radix given by base */
   int digitMask;      /* Mask to extract the next bit from digit */
-  const CharT* start; /* Pointer to the remaining digits */
+  const CharT* cur;   /* Pointer to the remaining digits */
+  const CharT* start; /* Pointer to the start of the string */
   const CharT* end;   /* Pointer to first non-digit */
 
  public:
   BinaryDigitReader(int base, const CharT* start, const CharT* end)
-      : base(base), digit(0), digitMask(0), start(start), end(end) {}
+      : base(base),
+        digit(0),
+        digitMask(0),
+        cur(start),
+        start(start),
+        end(end) {}
 
   /* Return the next binary digit from the number, or -1 if done. */
   int nextDigit() {
     if (digitMask == 0) {
-      if (start == end) {
+      if (cur == end) {
         return -1;
       }
 
-      int c = *start++;
+      int c = *cur++;
+      if (c == '_') {
+        AssertWellPlacedNumericSeparator(cur - 1, start, end);
+        c = *cur++;
+      }
+
       MOZ_ASSERT(IsAsciiAlphanumeric(c));
       digit = AsciiAlphanumericToNumber(c);
       digitMask = base >> 1;
     }
 
     int bit = (digit & digitMask) != 0;
     digitMask >>= 1;
     return bit;
@@ -217,25 +247,31 @@ double js::ParseDecimalNumber(const mozi
 template double js::ParseDecimalNumber(
     const mozilla::Range<const Latin1Char> chars);
 
 template double js::ParseDecimalNumber(
     const mozilla::Range<const char16_t> chars);
 
 template <typename CharT>
 bool js::GetPrefixInteger(JSContext* cx, const CharT* start, const CharT* end,
-                          int base, const CharT** endp, double* dp) {
+                          int base, IntegerSeparatorHandling separatorHandling,
+                          const CharT** endp, double* dp) {
   MOZ_ASSERT(start <= end);
   MOZ_ASSERT(2 <= base && base <= 36);
 
   const CharT* s = start;
   double d = 0.0;
   for (; s < end; s++) {
     CharT c = *s;
     if (!IsAsciiAlphanumeric(c)) {
+      if (c == '_' &&
+          separatorHandling == IntegerSeparatorHandling::SkipUnderscore) {
+        AssertWellPlacedNumericSeparator(s, start, end);
+        continue;
+      }
       break;
     }
 
     uint8_t digit = AsciiAlphanumericToNumber(c);
     if (digit >= base) {
       break;
     }
 
@@ -248,50 +284,56 @@ bool js::GetPrefixInteger(JSContext* cx,
   /* If we haven't reached the limit of integer precision, we're done. */
   if (d < DOUBLE_INTEGRAL_PRECISION_LIMIT) {
     return true;
   }
 
   /*
    * Otherwise compute the correct integer from the prefix of valid digits
    * if we're computing for base ten or a power of two.  Don't worry about
-   * other bases; see 15.1.2.2 step 13.
+   * other bases; see ES2018, 18.2.5 `parseInt(string, radix)`, step 13.
    */
   if (base == 10) {
     return ComputeAccurateDecimalInteger(cx, start, s, dp);
   }
 
   if ((base & (base - 1)) == 0) {
     *dp = ComputeAccurateBinaryBaseInteger(start, s, base);
   }
 
   return true;
 }
 
 namespace js {
 
 template bool GetPrefixInteger(JSContext* cx, const char16_t* start,
                                const char16_t* end, int base,
+                               IntegerSeparatorHandling separatorHandling,
                                const char16_t** endp, double* dp);
 
 template bool GetPrefixInteger(JSContext* cx, const Latin1Char* start,
                                const Latin1Char* end, int base,
+                               IntegerSeparatorHandling separatorHandling,
                                const Latin1Char** endp, double* dp);
 
 }  // namespace js
 
 template <typename CharT>
 bool js::GetDecimalInteger(JSContext* cx, const CharT* start, const CharT* end,
                            double* dp) {
   MOZ_ASSERT(start <= end);
 
   const CharT* s = start;
   double d = 0.0;
   for (; s < end; s++) {
     CharT c = *s;
+    if (c == '_') {
+      AssertWellPlacedNumericSeparator(s, start, end);
+      continue;
+    }
     MOZ_ASSERT(IsAsciiDigit(c));
     int digit = c - '0';
     d = d * 10 + digit;
   }
 
   *dp = d;
 
   // If we haven't reached the limit of integer precision, we're done.
@@ -315,16 +357,69 @@ template <>
 bool GetDecimalInteger<Utf8Unit>(JSContext* cx, const Utf8Unit* start,
                                  const Utf8Unit* end, double* dp) {
   return GetDecimalInteger(cx, Utf8AsUnsignedChars(start),
                            Utf8AsUnsignedChars(end), dp);
 }
 
 }  // namespace js
 
+template <typename CharT>
+bool js::GetDecimalNonInteger(JSContext* cx, const CharT* start,
+                              const CharT* end, double* dp) {
+  MOZ_ASSERT(start <= end);
+
+  size_t length = end - start;
+  Vector<char, 32> chars(cx);
+  if (!chars.growByUninitialized(length + 1)) {
+    return false;
+  }
+
+  const CharT* s = start;
+  size_t i = 0;
+  for (; s < end; s++) {
+    CharT c = *s;
+    if (c == '_') {
+      AssertWellPlacedNumericSeparator(s, start, end);
+      continue;
+    }
+    MOZ_ASSERT(IsAsciiDigit(c) || c == '.' || c == 'e' || c == 'E' ||
+               c == '+' || c == '-');
+    chars[i++] = char(c);
+  }
+  chars[i] = 0;
+
+  if (!EnsureDtoaState(cx)) {
+    return false;
+  }
+
+  char* ep;
+  *dp = js_strtod_harder(cx->dtoaState, chars.begin(), &ep);
+  MOZ_ASSERT(ep >= chars.begin());
+
+  return true;
+}
+
+namespace js {
+
+template bool GetDecimalNonInteger(JSContext* cx, const char16_t* start,
+                                   const char16_t* end, double* dp);
+
+template bool GetDecimalNonInteger(JSContext* cx, const Latin1Char* start,
+                                   const Latin1Char* end, double* dp);
+
+template <>
+bool GetDecimalNonInteger<Utf8Unit>(JSContext* cx, const Utf8Unit* start,
+                                    const Utf8Unit* end, double* dp) {
+  return GetDecimalNonInteger(cx, Utf8AsUnsignedChars(start),
+                              Utf8AsUnsignedChars(end), dp);
+}
+
+}  // namespace js
+
 static bool num_parseFloat(JSContext* cx, unsigned argc, Value* vp) {
   CallArgs args = CallArgsFromVp(argc, vp);
 
   if (args.length() == 0) {
     args.rval().setNaN();
     return true;
   }
 
@@ -403,17 +498,18 @@ static bool ParseIntImpl(JSContext* cx, 
       s += 2;
       radix = 16;
     }
   }
 
   /* Steps 11-15. */
   const CharT* actualEnd;
   double d;
-  if (!GetPrefixInteger(cx, s, end, radix, &actualEnd, &d)) {
+  if (!GetPrefixInteger(cx, s, end, radix, IntegerSeparatorHandling::None,
+                        &actualEnd, &d)) {
     return false;
   }
 
   if (s == actualEnd) {
     *res = GenericNaN();
   } else {
     *res = negative ? -d : d;
   }
@@ -1573,17 +1669,18 @@ static bool CharsToNumber(JSContext* cx,
     if (radix != 0) {
       /*
        * It's probably a non-decimal number. Accept if there's at least one
        * digit after the 0b|0o|0x, and if no non-whitespace characters follow
        * all the digits.
        */
       const CharT* endptr;
       double d;
-      if (!GetPrefixInteger(cx, bp + 2, end, radix, &endptr, &d) ||
+      if (!GetPrefixInteger(cx, bp + 2, end, radix,
+                            IntegerSeparatorHandling::None, &endptr, &d) ||
           endptr == bp + 2 || SkipSpace(endptr, end) != end) {
         *result = GenericNaN();
       } else {
         *result = d;
       }
       return true;
     }
   }
--- a/js/src/jsnum.h
+++ b/js/src/jsnum.h
@@ -116,69 +116,86 @@ const double DOUBLE_INTEGRAL_PRECISION_L
  * Parse a decimal number encoded in |chars|.  The decimal number must be
  * sufficiently small that it will not overflow the integrally-precise range of
  * the double type -- that is, the number will be smaller than
  * DOUBLE_INTEGRAL_PRECISION_LIMIT
  */
 template <typename CharT>
 extern double ParseDecimalNumber(const mozilla::Range<const CharT> chars);
 
+enum class IntegerSeparatorHandling : bool { None, SkipUnderscore };
+
 /*
  * Compute the positive integer of the given base described immediately at the
  * start of the range [start, end) -- no whitespace-skipping, no magical
  * leading-"0" octal or leading-"0x" hex behavior, no "+"/"-" parsing, just
  * reading the digits of the integer.  Return the index one past the end of the
  * digits of the integer in *endp, and return the integer itself in *dp.  If
  * base is 10 or a power of two the returned integer is the closest possible
  * double; otherwise extremely large integers may be slightly inaccurate.
  *
+ * The |separatorHandling| controls whether or not numeric separators can be
+ * part of integer string. If the option is enabled, all '_' characters in the
+ * string are ignored. Underscore characters must not appear directly next to
+ * each other, e.g. '1__2' will lead to an assertion.
+ *
  * If [start, end) does not begin with a number with the specified base,
  * *dp == 0 and *endp == start upon return.
  */
 template <typename CharT>
-extern MOZ_MUST_USE bool GetPrefixInteger(JSContext* cx, const CharT* start,
-                                          const CharT* end, int base,
-                                          const CharT** endp, double* dp);
+extern MOZ_MUST_USE bool GetPrefixInteger(
+    JSContext* cx, const CharT* start, const CharT* end, int base,
+    IntegerSeparatorHandling separatorHandling, const CharT** endp, double* dp);
 
 inline const char16_t* ToRawChars(const char16_t* units) { return units; }
 
 inline const unsigned char* ToRawChars(const unsigned char* units) {
   return units;
 }
 
 inline const unsigned char* ToRawChars(const mozilla::Utf8Unit* units) {
   return mozilla::Utf8AsUnsignedChars(units);
 }
 
 /**
- * Like the prior function, but [start, end) must all be digits in the given
+ * Like GetPrefixInteger, but [start, end) must all be digits in the given
  * base (and so this function doesn't take a useless outparam).
  */
 template <typename CharT>
-extern MOZ_MUST_USE bool GetFullInteger(JSContext* cx, const CharT* start,
-                                        const CharT* end, int base,
-                                        double* dp) {
+extern MOZ_MUST_USE bool GetFullInteger(
+    JSContext* cx, const CharT* start, const CharT* end, int base,
+    IntegerSeparatorHandling separatorHandling, double* dp) {
   decltype(ToRawChars(start)) realEnd;
-  if (GetPrefixInteger(cx, ToRawChars(start), ToRawChars(end), base, &realEnd,
-                       dp)) {
+  if (GetPrefixInteger(cx, ToRawChars(start), ToRawChars(end), base,
+                       separatorHandling, &realEnd, dp)) {
     MOZ_ASSERT(end == static_cast<const void*>(realEnd));
     return true;
   }
   return false;
 }
 
 /*
- * This is like GetPrefixInteger, but it only deals with base 10 and doesn't
- * have an |endp| outparam.  It should only be used when the characters are
- * known to only contain digits.
+ * This is like GetPrefixInteger, but only deals with base 10, always ignores
+ * '_', and doesn't have an |endp| outparam. It should only be used when the
+ * characters are known to match |DecimalIntegerLiteral|, cf. ES2020, 11.8.3
+ * Numeric Literals.
  */
 template <typename CharT>
 extern MOZ_MUST_USE bool GetDecimalInteger(JSContext* cx, const CharT* start,
                                            const CharT* end, double* dp);
 
+/*
+ * This is like GetDecimalInteger, but also allows non-integer numbers. It
+ * should only be used when the characters are known to match |DecimalLiteral|,
+ * cf. ES2020, 11.8.3 Numeric Literals.
+ */
+template <typename CharT>
+extern MOZ_MUST_USE bool GetDecimalNonInteger(JSContext* cx, const CharT* start,
+                                              const CharT* end, double* dp);
+
 extern MOZ_MUST_USE bool StringToNumber(JSContext* cx, JSString* str,
                                         double* result);
 
 extern MOZ_MUST_USE bool StringToNumberPure(JSContext* cx, JSString* str,
                                             double* result);
 
 /* ES5 9.3 ToNumber, overwriting *vp with the appropriate number value. */
 MOZ_ALWAYS_INLINE MOZ_MUST_USE bool ToNumber(JSContext* cx,
@@ -240,28 +257,16 @@ MOZ_MUST_USE bool num_parseInt(JSContext
 template <typename CharT>
 extern MOZ_MUST_USE bool js_strtod(JSContext* cx, const CharT* begin,
                                    const CharT* end, const CharT** dEnd,
                                    double* d);
 
 namespace js {
 
 /**
- * Like js_strtod, but for when you don't require a |dEnd| argument *and* it's
- * possible that the number in the string will not occupy the full [begin, end)
- * range.
- */
-template <typename CharT>
-extern MOZ_MUST_USE bool StringToDouble(JSContext* cx, const CharT* begin,
-                                        const CharT* end, double* d) {
-  decltype(ToRawChars(begin)) dummy;
-  return js_strtod(cx, ToRawChars(begin), ToRawChars(end), &dummy, d);
-}
-
-/**
  * Like js_strtod, but for when the number always constitutes the entire range
  * (and so |dEnd| would be a value already known).
  */
 template <typename CharT>
 extern MOZ_MUST_USE bool FullStringToDouble(JSContext* cx, const CharT* begin,
                                             const CharT* end, double* d) {
   decltype(ToRawChars(begin)) realEnd;
   if (js_strtod(cx, ToRawChars(begin), ToRawChars(end), &realEnd, d)) {
--- a/js/src/tests/test262-update.py
+++ b/js/src/tests/test262-update.py
@@ -25,34 +25,35 @@ UNSUPPORTED_FEATURES = set([
     "class-fields-private",
     "class-static-fields-private",
     "class-methods-private",
     "class-static-methods-private",
     "regexp-dotall",
     "regexp-lookbehind",
     "regexp-named-groups",
     "regexp-unicode-property-escapes",
-    "numeric-separator-literal",
     "Intl.Locale",
     "global",
     "export-star-as-namespace-from-module",
     "Intl.ListFormat",
     "Intl.Segmenter",
     "Intl.NumberFormat-unified",
 ])
 FEATURE_CHECK_NEEDED = {
     "Atomics": "!this.hasOwnProperty('Atomics')",
     "BigInt": "!this.hasOwnProperty('BigInt')",
     "SharedArrayBuffer": "!this.hasOwnProperty('SharedArrayBuffer')",
     # Syntax is a bit weird, because this string cannot have spaces in it
     "class-fields-public":
         "(function(){try{eval('c=class{x;}');return(false);}catch{return(true);}})()",
     "dynamic-import": "!xulRuntime.shell",
 }
-RELEASE_OR_BETA = set()
+RELEASE_OR_BETA = set([
+    "numeric-separator-literal",
+])
 
 
 @contextlib.contextmanager
 def TemporaryDirectory():
     tmpDir = tempfile.mkdtemp()
     try:
         yield tmpDir
     finally:
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-bil-bd-nsl-bd.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-bil-bd-nsl-bd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   `0b` | `0B` BinaryDigit NumericLiteralSeparator BinaryDigit
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-bil-bd-nsl-bds.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-bil-bd-nsl-bds.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   `0b` | `0B` BinaryDigit NumericLiteralSeparator BinaryDigit
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-bil-bds-nsl-bd.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-bil-bds-nsl-bd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   `0b` | `0B` BinaryDigits NumericLiteralSeparator BinaryDigit
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-bil-bds-nsl-bds.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-bil-bds-nsl-bds.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   `0b` | `0B` BinaryDigits NumericLiteralSeparator BinaryDigit
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-dd-dot-dd-ep-sign-minus-dd-nsl-dd.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-dd-dot-dd-ep-sign-minus-dd-nsl-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   DecimalDigits `.` DecimalDigits ExponentPart_opt `-` DecimalDigits
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-dd-dot-dd-ep-sign-minus-dds-nsl-dd.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-dd-dot-dd-ep-sign-minus-dds-nsl-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   DecimalDigits `.` DecimalDigits ExponentPart_opt `-` DecimalDigits
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-dd-dot-dd-ep-sign-plus-dd-nsl-dd.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-dd-dot-dd-ep-sign-plus-dd-nsl-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   DecimalDigits `.` DecimalDigits ExponentPart_opt `+` DecimalDigits
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-dd-dot-dd-ep-sign-plus-dds-nsl-dd.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-dd-dot-dd-ep-sign-plus-dds-nsl-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   DecimalDigits `.` DecimalDigits ExponentPart_opt `+` DecimalDigits
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-dd-nsl-dd-one-of.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-dd-nsl-dd-one-of.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   NonZeroDigit NumericLiteralSeparator DecimalDigits
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-dds-dot-dd-nsl-dd-ep-dd.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-dds-dot-dd-nsl-dd-ep-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   DecimalDigits `.` DecimalDigits NumericLiteralSeparator DecimalDigits
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-dds-nsl-dd.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-dds-nsl-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: DecimalDigits NumericLiteralSeparator DecimalDigit
 info: |
   NumericLiteralSeparator :: _
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-dot-dd-nsl-dd-ep.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-dot-dd-nsl-dd-ep.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   `.` DecimalDigit NumericLiteralSeparator DecimalDigit ExponentPart
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-dot-dd-nsl-dds-ep.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-dot-dd-nsl-dds-ep.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   `.` DecimalDigit NumericLiteralSeparator DecimalDigits ExponentPart
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-dot-dds-nsl-dd-ep.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-dot-dds-nsl-dd-ep.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   `.` DecimalDigits NumericLiteralSeparator DecimalDigit ExponentPart
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-dot-dds-nsl-dds-ep.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-dot-dds-nsl-dds-ep.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   `.` DecimalDigits NumericLiteralSeparator DecimalDigits ExponentPart
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-hil-hd-nsl-hd.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-hil-hd-nsl-hd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   `0x` | `0X` HexDigit NumericLiteralSeparator HexDigit
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-hil-hd-nsl-hds.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-hil-hd-nsl-hds.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   `0x` | `0X` HexDigit NumericLiteralSeparator HexDigit
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-hil-hds-nsl-hd.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-hil-hds-nsl-hd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   `0x` | `0X` HexDigits NumericLiteralSeparator HexDigit
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-hil-hds-nsl-hds.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-hil-hds-nsl-hds.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   `0x` | `0X` HexDigits NumericLiteralSeparator HexDigit
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-hil-od-nsl-od-one-of.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-hil-od-nsl-od-one-of.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   `0x` | `0X` HexDigit NumericLiteralSeparator HexDigit
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-nzd-nsl-dd-one-of.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-nzd-nsl-dd-one-of.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   NonZeroDigit NumericLiteralSeparator DecimalDigits
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-nzd-nsl-dd.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-nzd-nsl-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   NonZeroDigit NumericLiteralSeparator DecimalDigits
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-nzd-nsl-dds.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-nzd-nsl-dds.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   NonZeroDigit NumericLiteralSeparator DecimalDigits
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-oil-od-nsl-od-one-of.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-oil-od-nsl-od-one-of.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   `0o` | `0O` OctalDigit NumericLiteralSeparator OctalDigit
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-oil-od-nsl-od.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-oil-od-nsl-od.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   `0o` | `0O` OctalDigit NumericLiteralSeparator OctalDigit
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-oil-od-nsl-ods.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-oil-od-nsl-ods.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   `0o` | `0O` OctalDigit NumericLiteralSeparator OctalDigit
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-oil-ods-nsl-od.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-oil-ods-nsl-od.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   `0o` | `0O` OctalDigits NumericLiteralSeparator OctalDigit
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-oil-ods-nsl-ods.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-oil-ods-nsl-ods.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   `0o` | `0O` OctalDigits NumericLiteralSeparator OctalDigit
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-sign-minus-dds-nsl-dd.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-sign-minus-dds-nsl-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   DecimalDigits NumericLiteralSeparator DecimalDigit
--- a/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-sign-plus-dds-nsl-dd.js
+++ b/js/src/tests/test262/built-ins/Number/string-numeric-separator-literal-sign-plus-dds-nsl-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator is not valid on string conversions for ToNumber operations
 info: |
   DecimalDigits NumericLiteralSeparator DecimalDigit
--- a/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-dd-dot-dd-ep-sign-minus-dd-nsl-dd.js
+++ b/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-dd-dot-dd-ep-sign-minus-dd-nsl-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: sec-tonumber-applied-to-the-string-type
 description: >
   The NSL does not affect strings parsed by parseFloat - StrDecimalDigits . StrDecimalDigits StrExponentPart
 info: |
--- a/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-dd-dot-dd-ep-sign-minus-dds-nsl-dd.js
+++ b/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-dd-dot-dd-ep-sign-minus-dds-nsl-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: sec-tonumber-applied-to-the-string-type
 description: >
   The NSL does not affect strings parsed by parseFloat - StrDecimalDigits . StrDecimalDigits StrExponentPart
 info: |
--- a/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-dd-dot-dd-ep-sign-plus-dd-nsl-dd.js
+++ b/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-dd-dot-dd-ep-sign-plus-dd-nsl-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: sec-tonumber-applied-to-the-string-type
 description: >
   The NSL does not affect strings parsed by parseFloat - StrDecimalDigits . StrDecimalDigits StrExponentPart
 info: |
--- a/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-dd-dot-dd-ep-sign-plus-dds-nsl-dd.js
+++ b/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-dd-dot-dd-ep-sign-plus-dds-nsl-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: sec-tonumber-applied-to-the-string-type
 description: >
   The NSL does not affect strings parsed by parseFloat - StrDecimalDigits . StrDecimalDigits StrExponentPart
 info: |
--- a/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-dd-nsl-dd-one-of.js
+++ b/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-dd-nsl-dd-one-of.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: sec-tonumber-applied-to-the-string-type
 description: >
   The NSL does not affect strings parsed by parseFloat - StrUnsignedDecimalLiteral
 info: |
--- a/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-dds-dot-dd-nsl-dd-ep-dd.js
+++ b/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-dds-dot-dd-nsl-dd-ep-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: sec-tonumber-applied-to-the-string-type
 description: >
   The NSL does not affect strings parsed by parseFloat - StrDecimalDigits . StrDecimalDigits StrExponentPart
 info: |
--- a/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-dds-nsl-dd.js
+++ b/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-dds-nsl-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: sec-tonumber-applied-to-the-string-type
 description: >
   The NSL does not affect strings parsed by parseFloat - StrDecimalDigits
 info: |
--- a/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-dot-dd-nsl-dd-ep.js
+++ b/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-dot-dd-nsl-dd-ep.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: sec-tonumber-applied-to-the-string-type
 description: >
   The NSL does not affect strings parsed by parseFloat - . StrDecimalDigits StrExponentPart
 info: |
--- a/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-dot-dd-nsl-dds-ep.js
+++ b/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-dot-dd-nsl-dds-ep.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: sec-tonumber-applied-to-the-string-type
 description: >
   The NSL does not affect strings parsed by parseFloat - . StrDecimalDigits StrExponentPart
 info: |
--- a/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-dot-dds-nsl-dd-ep.js
+++ b/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-dot-dds-nsl-dd-ep.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: sec-tonumber-applied-to-the-string-type
 description: >
   The NSL does not affect strings parsed by parseFloat - . StrDecimalDigits StrExponentPart
 info: |
--- a/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-dot-dds-nsl-dds-ep.js
+++ b/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-dot-dds-nsl-dds-ep.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: sec-tonumber-applied-to-the-string-type
 description: >
   The NSL does not affect strings parsed by parseFloat - . StrDecimalDigits StrExponentPart
 info: |
--- a/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-nzd-nsl-dd-one-of.js
+++ b/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-nzd-nsl-dd-one-of.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: sec-tonumber-applied-to-the-string-type
 description: >
   The NSL does not affect strings parsed by parseFloat - NonZeroDigit NumericLiteralSeparator DecimalDigit
 info: |
--- a/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-nzd-nsl-dd.js
+++ b/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-nzd-nsl-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: sec-tonumber-applied-to-the-string-type
 description: >
   The NSL does not affect strings parsed by parseFloat - StrDecimalDigits
 info: |
--- a/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-nzd-nsl-dds.js
+++ b/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-nzd-nsl-dds.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: sec-tonumber-applied-to-the-string-type
 description: >
   The NSL does not affect strings parsed by parseFloat - DecimalDigit
 info: |
--- a/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-sign-plus-dds-nsl-dd.js
+++ b/js/src/tests/test262/built-ins/parseFloat/tonumber-numeric-separator-literal-sign-plus-dds-nsl-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: sec-tonumber-applied-to-the-string-type
 description: >
   The NSL does not affect strings parsed by parseFloat (StrUnsignedDecimalLiteral)
 info: |
--- a/js/src/tests/test262/language/expressions/template-literal/unicode-escape-nls-err.js
+++ b/js/src/tests/test262/language/expressions/template-literal/unicode-escape-nls-err.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 Valerie Young. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-Template
 description: NumericLiteralSeperator disallowed in unicode CodePoint sequence
 info: |
  Template ::
--- a/js/src/tests/test262/language/identifiers/unicode-escape-nls-err.js
+++ b/js/src/tests/test262/language/identifiers/unicode-escape-nls-err.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2014 Valerie Young. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 /*---
 esid: prod-Identifier
 description: NumericLiteralSeperator disallowed in unicode CodePoint escape sequence
 info: |
  Identifier:
    IdentifierName but not ReservedWord
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-bil-bd-nsl-bd-err.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-bil-bd-nsl-bd-err.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   NumericLiteralSeparator may not be the appear adjacent to `0b` | `0B` in a
   BinaryIntegerLiteral
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-bil-bd-nsl-bd.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-bil-bd-nsl-bd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   `0b` | `0B` BinaryDigit NumericLiteralSeparator BinaryDigit
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-bil-bd-nsl-bds.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-bil-bd-nsl-bds.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   `0b` | `0B` BinaryDigit NumericLiteralSeparator BinaryDigit
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-bil-bds-nsl-bd.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-bil-bds-nsl-bd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   `0b` | `0B` BinaryDigits NumericLiteralSeparator BinaryDigit
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-bil-bds-nsl-bds.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-bil-bds-nsl-bds.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   `0b` | `0B` BinaryDigits NumericLiteralSeparator BinaryDigit
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-bil-nsl-bd-dunder-err.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-bil-nsl-bd-dunder-err.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   NumericLiteralSeparator may not appear adjacent to another
   NumericLiteralSeparator in a BinaryIntegerLiteral
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-bil-nsl-bd-err.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-bil-nsl-bd-err.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   NumericLiteralSeparator may not be the last digit character of a
   BinaryIntegerLiteral
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dd-dot-dd-ep-sign-minus-dd-nsl-dd.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dd-dot-dd-ep-sign-minus-dd-nsl-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   DecimalDigits `.` DecimalDigits ExponentPart_opt `-` DecimalDigits
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dd-dot-dd-ep-sign-minus-dds-nsl-dd.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dd-dot-dd-ep-sign-minus-dds-nsl-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   DecimalDigits `.` DecimalDigits ExponentPart_opt `-` DecimalDigits
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dd-dot-dd-ep-sign-plus-dd-nsl-dd.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dd-dot-dd-ep-sign-plus-dd-nsl-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   DecimalDigits `.` DecimalDigits ExponentPart_opt `+` DecimalDigits
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dd-dot-dd-ep-sign-plus-dds-nsl-dd.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dd-dot-dd-ep-sign-plus-dds-nsl-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   DecimalDigits `.` DecimalDigits ExponentPart_opt `+` DecimalDigits
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dd-nsl-dd-one-of.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dd-nsl-dd-one-of.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NonZeroDigit NumericLiteralSeparator DecimalDigit
 info: |
   NumericLiteralSeparator ::
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dd-nsl-dds-dunder-err.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dd-nsl-dds-dunder-err.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   NumericLiteralSeparator may not appear adjacent to another
   NumericLiteralSeparator in a DecimalIntegerLiteral
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dd-nsl-err.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dd-nsl-err.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   NumericLiteralSeparator may not be the last digit character
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dds-dot-dd-nsl-dd-ep-dd.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dds-dot-dd-nsl-dd-ep-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   DecimalDigits `.` DecimalDigits NumericLiteralSeparator DecimalDigits
   ExponentPart SignedInteger
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dds-nsl-dd.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dds-nsl-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: DecimalDigits NumericLiteralSeparator DecimalDigit
 info: |
   NumericLiteralSeparator ::
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dds-nsl-dds-dunder-err.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dds-nsl-dds-dunder-err.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   NumericLiteralSeparator may not appear adjacent to another
   NumericLiteralSeparator in DecimalIntegerLiteral
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dds-nsl-err.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dds-nsl-err.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   NumericLiteralSeparator may not be the last digit character of a
   DecimalLiteral
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dil-dot-dds-nsl-ep-dd-err.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dil-dot-dds-nsl-ep-dd-err.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   NumericLiteralSeparator may not appear adjacent to ExponentPart
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dil-dot-nsl-ep-err.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dil-dot-nsl-ep-err.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   NumericLiteralSeparator may not appear between `.` and ExponentPart
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dil-dot-nsl-err.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dil-dot-nsl-err.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   NumericLiteralSeparator may not be the last digit character of a
   DecimalLiteral
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dot-dd-nsl-dd-ep.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dot-dd-nsl-dd-ep.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   `.` DecimalDigit NumericLiteralSeparator DecimalDigit ExponentPart
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dot-dd-nsl-dds-ep.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dot-dd-nsl-dds-ep.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   `.` DecimalDigit NumericLiteralSeparator DecimalDigits ExponentPart
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dot-dds-nsl-dd-ep.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dot-dds-nsl-dd-ep.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   `.` DecimalDigits NumericLiteralSeparator DecimalDigit ExponentPart
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dot-dds-nsl-dds-ep.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dot-dds-nsl-dds-ep.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   `.` DecimalDigits NumericLiteralSeparator DecimalDigits ExponentPart
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dot-dds-nsl-ep-err.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dot-dds-nsl-ep-err.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NumericLiteralSeparator may not appear adjacent to ExponentPart
 info: |
   NumericLiteralSeparator ::
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dot-nsl-ep-err.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dot-nsl-ep-err.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   NumericLiteralSeparator may not appear between `.` and ExponentPart
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dot-nsl-err.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-dot-nsl-err.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   NumericLiteralSeparator may not be the last digit character of a
   DecimalLiteral, nor adjacent to `.`
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-hil-hd-nsl-hd-err.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-hil-hd-nsl-hd-err.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   NumericLiteralSeparator may not be the appear adjacent to `0x` | `0X` in a
   HexIntegerLiteral
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-hil-hd-nsl-hd.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-hil-hd-nsl-hd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   `0x` | `0X` HexDigit NumericLiteralSeparator HexDigit
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-hil-hd-nsl-hds.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-hil-hd-nsl-hds.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   `0x` | `0X` HexDigit NumericLiteralSeparator HexDigit
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-hil-hds-nsl-hd.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-hil-hds-nsl-hd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   `0x` | `0X` HexDigits NumericLiteralSeparator HexDigit
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-hil-hds-nsl-hds.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-hil-hds-nsl-hds.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   `0x` | `0X` HexDigits NumericLiteralSeparator HexDigit
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-hil-nsl-hd-dunder-err.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-hil-nsl-hd-dunder-err.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   NumericLiteralSeparator may not appear adjacent to another
   NumericLiteralSeparator in a HexIntegerLiteral
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-hil-nsl-hd-err.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-hil-nsl-hd-err.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   NumericLiteralSeparator may not be the last digit character of a
   HexIntegerLiteral
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-hil-od-nsl-od-one-of.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-hil-od-nsl-od-one-of.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   `0x` | `0X` HexDigit NumericLiteralSeparator HexDigit
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-nzd-nsl-dd-one-of.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-nzd-nsl-dd-one-of.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NonZeroDigit NumericLiteralSeparator DecimalDigit
 info: |
   NumericLiteralSeparator ::
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-nzd-nsl-dd.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-nzd-nsl-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NonZeroDigit NumericLiteralSeparator DecimalDigit
 info: |
   NumericLiteralSeparator ::
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-nzd-nsl-dds-dunder-err.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-nzd-nsl-dds-dunder-err.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   NumericLiteralSeparator may not appear adjacent to another
   NumericLiteralSeparator in DecimalIntegerLiteral
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-nzd-nsl-dds-leading-zero-err.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-nzd-nsl-dds-leading-zero-err.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NonZeroDigit NumericLiteralSeparator DecimalDigits
 info: |
   NumericLiteralSeparator ::
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-nzd-nsl-dds.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-nzd-nsl-dds.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: NonZeroDigit NumericLiteralSeparator DecimalDigits
 info: |
   NumericLiteralSeparator ::
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-oil-nsl-od-dunder-err.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-oil-nsl-od-dunder-err.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   NumericLiteralSeparator may not appear adjacent to another
   NumericLiteralSeparator in a OctalIntegerLiteral
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-oil-nsl-od-err.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-oil-nsl-od-err.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   NumericLiteralSeparator may not be the last digit character of an
   OctalIntegerLiteral
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-oil-od-nsl-od-err.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-oil-od-nsl-od-err.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   NumericLiteralSeparator may not be the appear adjacent to `0o` | `0O` in a
   OctalIntegerLiteral
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-oil-od-nsl-od-one-of.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-oil-od-nsl-od-one-of.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   `0o` | `0O` OctalDigit NumericLiteralSeparator OctalDigit
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-oil-od-nsl-od.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-oil-od-nsl-od.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   `0o` | `0O` OctalDigit NumericLiteralSeparator OctalDigit
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-oil-od-nsl-ods.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-oil-od-nsl-ods.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   `0o` | `0O` OctalDigit NumericLiteralSeparator OctalDigit
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-oil-ods-nsl-od.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-oil-ods-nsl-od.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   `0o` | `0O` OctalDigits NumericLiteralSeparator OctalDigit
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-oil-ods-nsl-ods.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-oil-ods-nsl-ods.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   `0o` | `0O` OctalDigits NumericLiteralSeparator OctalDigit
 info: |
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-sign-minus-dds-nsl-dd.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-sign-minus-dds-nsl-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: DecimalDigits NumericLiteralSeparator DecimalDigit
 info: |
   NumericLiteralSeparator ::
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-sign-plus-dds-nsl-dd.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-sign-plus-dds-nsl-dd.js
@@ -1,9 +1,9 @@
-// |reftest| skip -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: DecimalDigits NumericLiteralSeparator DecimalDigit
 info: |
   NumericLiteralSeparator ::
--- a/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-unicode-err.js
+++ b/js/src/tests/test262/language/literals/numeric/numeric-separator-literal-unicode-err.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 the V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-NumericLiteralSeparator
 description: >
   NonZeroDigit NumericLiteralSeparator DecimalDigits sequence expressed with
   unicode escape sequence
--- a/js/src/tests/test262/language/literals/regexp/unicode-escape-nls-err.js
+++ b/js/src/tests/test262/language/literals/regexp/unicode-escape-nls-err.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 Valerie Young. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-Pattern
 description: NumericLiteralSeperator disallowed in unicode CodePoint sequence
 info: |
  Pattern[U, N]::
--- a/js/src/tests/test262/language/literals/string/unicode-escape-nls-err-double.js
+++ b/js/src/tests/test262/language/literals/string/unicode-escape-nls-err-double.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 Valerie Young. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-StringLiteral
 description: NumericLiteralSeperator disallowed in unicode CodePoint sequence (DoubleStringCharacters)
 info: |
  StringLiteral::
--- a/js/src/tests/test262/language/literals/string/unicode-escape-nls-err-single.js
+++ b/js/src/tests/test262/language/literals/string/unicode-escape-nls-err-single.js
@@ -1,9 +1,9 @@
-// |reftest| skip error:SyntaxError -- numeric-separator-literal is not supported
+// |reftest| skip-if(release_or_beta) error:SyntaxError -- numeric-separator-literal is not released yet
 // Copyright (C) 2017 Valerie Young. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
 /*---
 esid: prod-StringLiteral
 description: NumericLiteralSeperator disallowed in unicode CodePoint sequence (DoubleStringCharacters)
 info: |
  StringLiteral::
--- a/js/src/vm/GeckoProfiler.cpp
+++ b/js/src/vm/GeckoProfiler.cpp
@@ -3,16 +3,17 @@
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "vm/GeckoProfiler-inl.h"
 
 #include "mozilla/ArrayUtils.h"
 #include "mozilla/DebugOnly.h"
+#include "mozilla/Sprintf.h"
 
 #include "jsnum.h"
 
 #include "gc/GC.h"
 #include "gc/PublicIterators.h"
 #include "jit/BaselineFrame.h"
 #include "jit/BaselineJIT.h"
 #include "jit/JitcodeMap.h"
--- a/js/src/vm/JSONParser.cpp
+++ b/js/src/vm/JSONParser.cpp
@@ -292,17 +292,18 @@ JSONParserBase::Token JSONParser<CharT>:
       // largest number a double can represent with integral precision),
       // parse it using a decimal-only parser.  This comparison is
       // conservative but faster than a fully-precise check.
       double d = ParseDecimalNumber(chars);
       return numberToken(negative ? -d : d);
     }
 
     double d;
-    if (!GetFullInteger(cx, digitStart.get(), current.get(), 10, &d)) {
+    if (!GetFullInteger(cx, digitStart.get(), current.get(), 10,
+                        IntegerSeparatorHandling::None, &d)) {
       return token(OOM);
     }
     return numberToken(negative ? -d : d);
   }
 
   /* (\.[0-9]+)? */
   if (current < end && *current == '.') {
     if (++current == end) {
--- a/layout/base/AccessibleCaretManager.h
+++ b/layout/base/AccessibleCaretManager.h
@@ -207,16 +207,17 @@ class AccessibleCaretManager {
       nsIContent** aOutContent = nullptr,
       int32_t* aOutContentOffset = nullptr) const;
 
   nsresult DragCaretInternal(const nsPoint& aPoint);
   nsPoint AdjustDragBoundary(const nsPoint& aPoint) const;
 
   // Start the selection scroll timer if the caret is being dragged out of
   // the scroll port.
+  MOZ_CAN_RUN_SCRIPT
   void StartSelectionAutoScrollTimer(const nsPoint& aPoint) const;
   void StopSelectionAutoScrollTimer() const;
 
   void ClearMaintainedSelection() const;
 
   // This method could kill the shell, so callers to methods that call
   // FlushLayout should ensure the event hub that owns us is still alive.
   //
--- a/layout/base/PresShell.cpp
+++ b/layout/base/PresShell.cpp
@@ -39,16 +39,17 @@
 #endif
 
 #include "gfxContext.h"
 #include "gfxPrefs.h"
 #include "gfxUserFontSet.h"
 #include "nsContentList.h"
 #include "nsPresContext.h"
 #include "nsIContent.h"
+#include "mozilla/dom/BrowserBridgeChild.h"
 #include "mozilla/dom/Element.h"
 #include "mozilla/dom/PointerEventHandler.h"
 #include "mozilla/dom/PopupBlocker.h"
 #include "mozilla/dom/Document.h"
 #include "mozilla/dom/DocumentInlines.h"
 #include "nsAnimationManager.h"
 #include "nsNameSpaceManager.h"  // for Pref-related rule management (bugs 22963,20760,31816)
 #include "nsFrame.h"
@@ -495,17 +496,18 @@ class MOZ_STACK_CLASS nsPresShellEventCB
       nsIFrame* frame = mPresShell->GetCurrentEventFrame();
       if (!frame && (aVisitor.mEvent->mMessage == eMouseUp ||
                      aVisitor.mEvent->mMessage == eTouchEnd)) {
         // Redirect BUTTON_UP and TOUCH_END events to the root frame to ensure
         // that capturing is released.
         frame = mPresShell->GetRootFrame();
       }
       if (frame) {
-        frame->HandleEvent(aVisitor.mPresContext, aVisitor.mEvent->AsGUIEvent(),
+        frame->HandleEvent(MOZ_KnownLive(aVisitor.mPresContext),
+                           aVisitor.mEvent->AsGUIEvent(),
                            &aVisitor.mEventStatus);
       }
     }
   }
 
   RefPtr<PresShell> mPresShell;
 };
 
@@ -5368,16 +5370,32 @@ static nsView* FindViewContaining(nsView
   for (nsView* v = aView->GetFirstChild(); v; v = v->GetNextSibling()) {
     nsView* r = FindViewContaining(v, v->ConvertFromParentCoords(aPt));
     if (r) return r;
   }
 
   return aView;
 }
 
+static BrowserBridgeChild* GetChildBrowser(nsView* aView) {
+  if (!aView) {
+    return nullptr;
+  }
+  nsIFrame* frame = aView->GetFrame();
+  if (!frame && aView->GetParent()) {
+    // If frame is null then view is an anonymous inner view, and we want
+    // the frame from the corresponding outer view.
+    frame = aView->GetParent()->GetFrame();
+  }
+  if (!frame || !frame->GetContent()) {
+    return nullptr;
+  }
+  return BrowserBridgeChild::GetFrom(frame->GetContent());
+}
+
 void PresShell::ProcessSynthMouseMoveEvent(bool aFromScroll) {
   // If drag session has started, we shouldn't synthesize mousemove event.
   nsCOMPtr<nsIDragSession> dragSession = nsContentUtils::GetDragSession();
   if (dragSession) {
     mSynthMouseMoveEvent.Forget();
     return;
   }
 
@@ -5422,19 +5440,20 @@ void PresShell::ProcessSynthMouseMoveEve
 
   // We always dispatch the event to the pres shell that contains the view that
   // the mouse is over. pointVM is the VM of that pres shell.
   nsViewManager* pointVM = nullptr;
 
   // This could be a bit slow (traverses entire view hierarchy)
   // but it's OK to do it once per synthetic mouse event
   view = FindFloatingViewContaining(rootView, mMouseLocation);
+  nsView* pointView = view;
   if (!view) {
     view = rootView;
-    nsView* pointView = FindViewContaining(rootView, mMouseLocation);
+    pointView = FindViewContaining(rootView, mMouseLocation);
     // pointView can be null in situations related to mouse capture
     pointVM = (pointView ? pointView : view)->GetViewManager();
     refpoint = mMouseLocation + rootView->ViewToWidgetOffset();
     viewAPD = APD;
   } else {
     pointVM = view->GetViewManager();
     nsIFrame* frame = view->GetFrame();
     NS_ASSERTION(frame, "floating views can't be anonymous");
@@ -5447,17 +5466,27 @@ void PresShell::ProcessSynthMouseMoveEve
   WidgetMouseEvent event(true, eMouseMove, view->GetWidget(),
                          WidgetMouseEvent::eSynthesized);
   event.mRefPoint =
       LayoutDeviceIntPoint::FromAppUnitsToNearest(refpoint, viewAPD);
   event.mTime = PR_IntervalNow();
   // XXX set event.mModifiers ?
   // XXX mnakano I think that we should get the latest information from widget.
 
-  if (RefPtr<PresShell> presShell = pointVM->GetPresShell()) {
+  if (BrowserBridgeChild* bbc = GetChildBrowser(pointView)) {
+    // If we have a BrowserBridgeChild, we're going to be dispatching this
+    // mouse event into an OOP iframe of the current document.
+    event.mLayersId = bbc->GetLayersId();
+    bbc->SendDispatchSynthesizedMouseEvent(event);
+  } else if (RefPtr<PresShell> presShell = pointVM->GetPresShell()) {
+    // Otherwise we're targetting regular (non-OOP iframe) content in the
+    // current process. This field probably won't even be read, but we
+    // can fill it in with a sane value.
+    event.mLayersId = mMouseEventTargetGuid.mLayersId;
+
     // Since this gets run in a refresh tick there isn't an InputAPZContext on
     // the stack from the nsBaseWidget. We need to simulate one with at least
     // the correct target guid, so that the correct callback transform gets
     // applied if this event goes to a child process. The input block id is set
     // to 0 because this is a synthetic event which doesn't really belong to any
     // input block. Same for the APZ response field.
     InputAPZContext apzContext(mMouseEventTargetGuid, 0, nsEventStatus_eIgnore);
     presShell->DispatchSynthMouseMove(&event);
--- a/layout/base/PresShell.h
+++ b/layout/base/PresShell.h
@@ -554,16 +554,17 @@ class PresShell final : public nsStubDoc
    * nodes in this document, not in any parent documents which
    * contain this document in a iframe or the like.
    * If SCROLL_IGNORE_SCROLL_MARGIN_AND_PADDING is set we ignore scroll-margin
    * value specified for |aFrame| and scroll-padding value for the scroll
    * container. This option is typically used to locate poped-up frames into
    * view.
    * @return true if any scrolling happened, false if no scrolling happened
    */
+  MOZ_CAN_RUN_SCRIPT
   bool ScrollFrameRectIntoView(nsIFrame* aFrame, const nsRect& aRect,
                                ScrollAxis aVertical, ScrollAxis aHorizontal,
                                ScrollFlags aScrollFlags);
 
   /**
    * Determine if a rectangle specified in the frame's coordinate system
    * intersects "enough" with the viewport to be considered visible. This
    * is not a strict test against the viewport -- it's a test against
@@ -632,17 +633,17 @@ class PresShell final : public nsStubDoc
   already_AddRefed<nsISelectionController>
   GetSelectionControllerForFocusedContent(
       nsIContent** aFocusedContent = nullptr);
 
   /**
    * Interface to dispatch events via the presshell
    * @note The caller must have a strong reference to the PresShell.
    */
-  MOZ_CAN_RUN_SCRIPT_BOUNDARY
+  MOZ_CAN_RUN_SCRIPT
   nsresult HandleEventWithTarget(WidgetEvent* aEvent, nsIFrame* aFrame,
                                  nsIContent* aContent,
                                  nsEventStatus* aEventStatus,
                                  bool aIsHandlingNativeEvent = false,
                                  nsIContent** aTargetContent = nullptr,
                                  nsIContent* aOverrideClickTarget = nullptr) {
     MOZ_ASSERT(aEvent);
     EventHandler eventHandler(*this);
@@ -1029,23 +1030,23 @@ class PresShell final : public nsStubDoc
   nsresult HandleEvent(nsIFrame* aFrame, WidgetGUIEvent* aEvent,
                        bool aDontRetargetEvents, nsEventStatus* aEventStatus);
   bool ShouldIgnoreInvalidation();
   /**
    * Notify that we're going to call Paint with PaintFlags::PaintComposite.
    * Fires on the presshell for the painted widget.
    * This is issued at a time when it's safe to modify widget geometry.
    */
-  void WillPaintWindow();
+  MOZ_CAN_RUN_SCRIPT void WillPaintWindow();
   /**
    * Notify that we called Paint with PaintFlags::PaintComposite.
    * Fires on the presshell for the painted widget.
    * This is issued at a time when it's safe to modify widget geometry.
    */
-  void DidPaintWindow();
+  MOZ_CAN_RUN_SCRIPT void DidPaintWindow();
 
   bool IsVisible();
   MOZ_CAN_RUN_SCRIPT
   void DispatchSynthMouseMove(WidgetGUIEvent* aEvent);
 
   /* Temporarily ignore the Displayport for better paint performance. We
    * trigger a repaint once suppression is disabled. Without that
    * the displayport may get left at the suppressed size for an extended
@@ -1277,18 +1278,17 @@ class PresShell final : public nsStubDoc
                                    ResolutionChangeOrigin aOrigin);
 
   // Widget notificiations
   void WindowSizeMoveDone();
   void SysColorChanged() { mPresContext->SysColorChanged(); }
   void ThemeChanged() { mPresContext->ThemeChanged(); }
   void BackingScaleFactorChanged() { mPresContext->UIResolutionChangedSync(); }
 
-  // nsIViewObserver interface
-
+  MOZ_CAN_RUN_SCRIPT
   void Paint(nsView* aViewToPaint, const nsRegion& aDirtyRegion,
              PaintFlags aFlags);
 
   /**
    * Notify that we're going to call Paint with PaintFlags::PaintLayers
    * on the pres shell for a widget (which might not be this one, since
    * WillPaint is called on all presshells in the same toplevel window as the
    * painted widget). This is issued at a time when it's safe to modify
--- a/layout/forms/nsButtonFrameRenderer.cpp
+++ b/layout/forms/nsButtonFrameRenderer.cpp
@@ -58,18 +58,18 @@ void nsButtonFrameRenderer::SetDisabled(
 bool nsButtonFrameRenderer::isDisabled() {
   return mFrame->GetContent()->AsElement()->State().HasState(
       NS_EVENT_STATE_DISABLED);
 }
 
 class nsDisplayButtonBoxShadowOuter : public nsDisplayItem {
  public:
   nsDisplayButtonBoxShadowOuter(nsDisplayListBuilder* aBuilder,
-                                nsButtonFrameRenderer* aRenderer)
-      : nsDisplayItem(aBuilder, aRenderer->GetFrame()) {
+                                nsIFrame* aFrame)
+      : nsDisplayItem(aBuilder, aFrame) {
     MOZ_COUNT_CTOR(nsDisplayButtonBoxShadowOuter);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
   virtual ~nsDisplayButtonBoxShadowOuter() {
     MOZ_COUNT_DTOR(nsDisplayButtonBoxShadowOuter);
   }
 #endif
 
@@ -181,19 +181,19 @@ bool nsDisplayButtonBoxShadowOuter::Crea
                            wr::ToColorF(shadowColor), blurRadius, spreadRadius,
                            borderRadius, wr::BoxShadowClipMode::Outset);
   }
   return true;
 }
 
 class nsDisplayButtonBorder final : public nsDisplayItem {
  public:
-  nsDisplayButtonBorder(nsDisplayListBuilder* aBuilder,
+  nsDisplayButtonBorder(nsDisplayListBuilder* aBuilder, nsIFrame* aFrame,
                         nsButtonFrameRenderer* aRenderer)
-      : nsDisplayItem(aBuilder, aRenderer->GetFrame()), mBFR(aRenderer) {
+      : nsDisplayItem(aBuilder, aFrame), mBFR(aRenderer) {
     MOZ_COUNT_CTOR(nsDisplayButtonBorder);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
   virtual ~nsDisplayButtonBorder() { MOZ_COUNT_DTOR(nsDisplayButtonBorder); }
 #endif
   virtual bool MustPaintOnContentSide() const override { return true; }
 
   virtual void HitTest(nsDisplayListBuilder* aBuilder, const nsRect& aRect,
@@ -287,19 +287,19 @@ nsRect nsDisplayButtonBorder::GetBounds(
   return aBuilder->IsForEventDelivery()
              ? nsRect(ToReferenceFrame(), mFrame->GetSize())
              : mFrame->GetVisualOverflowRectRelativeToSelf() +
                    ToReferenceFrame();
 }
 
 class nsDisplayButtonForeground final : public nsDisplayItem {
  public:
-  nsDisplayButtonForeground(nsDisplayListBuilder* aBuilder,
+  nsDisplayButtonForeground(nsDisplayListBuilder* aBuilder, nsIFrame* aFrame,
                             nsButtonFrameRenderer* aRenderer)
-      : nsDisplayItem(aBuilder, aRenderer->GetFrame()), mBFR(aRenderer) {
+      : nsDisplayItem(aBuilder, aFrame), mBFR(aRenderer) {
     MOZ_COUNT_CTOR(nsDisplayButtonForeground);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
   virtual ~nsDisplayButtonForeground() {
     MOZ_COUNT_DTOR(nsDisplayButtonForeground);
   }
 #endif
 
@@ -381,30 +381,33 @@ bool nsDisplayButtonForeground::CreateWe
   br->CreateWebRenderCommands(this, aBuilder, aResources, aSc);
   return true;
 }
 
 nsresult nsButtonFrameRenderer::DisplayButton(nsDisplayListBuilder* aBuilder,
                                               nsDisplayList* aBackground,
                                               nsDisplayList* aForeground) {
   if (mFrame->StyleEffects()->mBoxShadow) {
-    aBackground->AppendNewToTop<nsDisplayButtonBoxShadowOuter>(aBuilder, this);
+    aBackground->AppendNewToTop<nsDisplayButtonBoxShadowOuter>(aBuilder,
+                                                               GetFrame());
   }
 
   nsRect buttonRect = mFrame->GetRectRelativeToSelf();
 
   nsDisplayBackgroundImage::AppendBackgroundItemsToTop(aBuilder, mFrame,
                                                        buttonRect, aBackground);
 
-  aBackground->AppendNewToTop<nsDisplayButtonBorder>(aBuilder, this);
+  aBackground->AppendNewToTop<nsDisplayButtonBorder>(aBuilder, GetFrame(),
+                                                     this);
 
   // Only display focus rings if we actually have them. Since at most one
   // button would normally display a focus ring, most buttons won't have them.
   if (mInnerFocusStyle && mInnerFocusStyle->StyleBorder()->HasBorder()) {
-    aForeground->AppendNewToTop<nsDisplayButtonForeground>(aBuilder, this);
+    aForeground->AppendNewToTop<nsDisplayButtonForeground>(aBuilder, GetFrame(),
+                                                           this);
   }
   return NS_OK;
 }
 
 void nsButtonFrameRenderer::GetButtonInnerFocusRect(const nsRect& aRect,
                                                     nsRect& aResult) {
   aResult = aRect;
   aResult.Deflate(mFrame->GetUsedBorderAndPadding());
--- a/layout/forms/nsComboboxControlFrame.cpp
+++ b/layout/forms/nsComboboxControlFrame.cpp
@@ -1383,17 +1383,18 @@ bool nsComboboxControlFrame::Rollup(uint
   ShowDropDown(false);  // might destroy us
   if (weakFrame.IsAlive()) {
     mListControlFrame->CaptureMouseEvents(false);
   }
 
   if (aFlush && weakFrame.IsAlive()) {
     // The popup's visibility doesn't update until the minimize animation has
     // finished, so call UpdateWidgetGeometry to update it right away.
-    nsViewManager* viewManager = mDropdownFrame->GetView()->GetViewManager();
+    RefPtr<nsViewManager> viewManager =
+        mDropdownFrame->GetView()->GetViewManager();
     viewManager->UpdateWidgetGeometry();  // might destroy us
   }
 
   if (!weakFrame.IsAlive()) {
     return consume;
   }
 
   if (aLastRolledUp) {
--- a/layout/forms/nsComboboxControlFrame.h
+++ b/layout/forms/nsComboboxControlFrame.h
@@ -179,16 +179,17 @@ class nsComboboxControlFrame final : pub
   NS_IMETHOD_(void)
   OnSetSelectedIndex(int32_t aOldIndex, int32_t aNewIndex) override;
 
   // nsIRollupListener
   /**
    * Hide the dropdown menu and stop capturing mouse events.
    * @note This method might destroy |this|.
    */
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY
   virtual bool Rollup(uint32_t aCount, bool aFlush, const nsIntPoint* pos,
                       nsIContent** aLastRolledUp) override;
   virtual void NotifyGeometryChange() override;
 
   /**
    * A combobox should roll up if a mousewheel event happens outside of
    * the popup area.
    */
--- a/layout/forms/nsListControlFrame.cpp
+++ b/layout/forms/nsListControlFrame.cpp
@@ -1807,17 +1807,18 @@ void nsListControlFrame::ScrollToIndex(i
     }
   }
 }
 
 void nsListControlFrame::ScrollToFrame(dom::HTMLOptionElement& aOptElement) {
   // otherwise we find the content's frame and scroll to it
   nsIFrame* childFrame = aOptElement.GetPrimaryFrame();
   if (childFrame) {
-    PresShell()->ScrollFrameRectIntoView(
+    RefPtr<mozilla::PresShell> presShell = PresShell();
+    presShell->ScrollFrameRectIntoView(
         childFrame, nsRect(nsPoint(0, 0), childFrame->GetSize()), ScrollAxis(),
         ScrollAxis(),
         ScrollFlags::ScrollOverflowHidden |
             ScrollFlags::ScrollFirstAncestorOnly |
             ScrollFlags::IgnoreMarginAndPadding);
   }
 }
 
--- a/layout/forms/nsListControlFrame.h
+++ b/layout/forms/nsListControlFrame.h
@@ -71,16 +71,17 @@ class nsListControlFrame final : public 
 
   virtual void Reflow(nsPresContext* aCX, ReflowOutput& aDesiredSize,
                       const ReflowInput& aReflowInput,
                       nsReflowStatus& aStatus) override;
 
   virtual void Init(nsIContent* aContent, nsContainerFrame* aParent,
                     nsIFrame* aPrevInFlow) override;
 
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY
   virtual void DidReflow(nsPresContext* aPresContext,
                          const ReflowInput* aReflowInput) override;
   virtual void DestroyFrom(nsIFrame* aDestructRoot,
                            PostDestroyData& aPostDestroyData) override;
 
   virtual void BuildDisplayList(nsDisplayListBuilder* aBuilder,
                                 const nsDisplayListSet& aLists) override;
 
@@ -93,16 +94,17 @@ class nsListControlFrame final : public 
 
 #ifdef DEBUG_FRAME_DUMP
   virtual nsresult GetFrameName(nsAString& aResult) const override;
 #endif
 
   // nsIFormControlFrame
   virtual nsresult SetFormProperty(nsAtom* aName,
                                    const nsAString& aValue) override;
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY
   virtual void SetFocus(bool aOn = true, bool aRepaint = false) override;
 
   virtual mozilla::ScrollStyles GetScrollStyles() const override;
   virtual bool ShouldPropagateComputedBSizeToScrolledContent() const override;
 
   // for accessibility purposes
 #ifdef ACCESSIBILITY
   virtual mozilla::a11y::AccType AccessibleType() override;
@@ -117,17 +119,17 @@ class nsListControlFrame final : public 
    * If the there are zero items then an empty string is returned
    * If there is nothing selected, then the 0th item's text is returned.
    */
   void GetOptionText(uint32_t aIndex, nsAString& aStr);
 
   void CaptureMouseEvents(bool aGrabMouseEvents);
   nscoord GetBSizeOfARow();
   uint32_t GetNumberOfOptions();
-  void AboutToDropDown();
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY void AboutToDropDown();
 
   /**
    * @note This method might destroy the frame, pres shell and other objects.
    */
   void AboutToRollup();
 
   /**
    * Dispatch a DOM oninput and onchange event synchroniously.
@@ -135,40 +137,46 @@ class nsListControlFrame final : public 
    */
   MOZ_CAN_RUN_SCRIPT
   void FireOnInputAndOnChange();
 
   /**
    * Makes aIndex the selected option of a combobox list.
    * @note This method might destroy the frame, pres shell and other objects.
    */
-  void ComboboxFinish(int32_t aIndex);
-  void OnContentReset();
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY void ComboboxFinish(int32_t aIndex);
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY void OnContentReset();
 
   // nsISelectControlFrame
   NS_IMETHOD AddOption(int32_t index) override;
   NS_IMETHOD RemoveOption(int32_t index) override;
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY
   NS_IMETHOD DoneAddingChildren(bool aIsDone) override;
 
   /**
    * Gets the content (an option) by index and then set it as
    * being selected or not selected.
    */
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY
   NS_IMETHOD OnOptionSelected(int32_t aIndex, bool aSelected) override;
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY
   NS_IMETHOD_(void)
   OnSetSelectedIndex(int32_t aOldIndex, int32_t aNewIndex) override;
 
   /**
    * Mouse event listeners.
    * @note These methods might destroy the frame, pres shell and other objects.
    */
+  MOZ_CAN_RUN_SCRIPT
   nsresult MouseDown(mozilla::dom::Event* aMouseEvent);
   MOZ_CAN_RUN_SCRIPT
   nsresult MouseUp(mozilla::dom::Event* aMouseEvent);
+  MOZ_CAN_RUN_SCRIPT
   nsresult MouseMove(mozilla::dom::Event* aMouseEvent);
+  MOZ_CAN_RUN_SCRIPT
   nsresult DragMove(mozilla::dom::Event* aMouseEvent);
   MOZ_CAN_RUN_SCRIPT
   nsresult KeyDown(mozilla::dom::Event* aKeyEvent);
   MOZ_CAN_RUN_SCRIPT
   nsresult KeyPress(mozilla::dom::Event* aKeyEvent);
 
   /**
    * Returns the options collection for mContent, if any.
@@ -283,24 +291,19 @@ class nsListControlFrame final : public 
   bool IsOptionInteractivelySelectable(int32_t aIndex) const;
   /**
    * @return true if aOption in aSelect is selectable by the user.
    */
   static bool IsOptionInteractivelySelectable(
       mozilla::dom::HTMLSelectElement* aSelect,
       mozilla::dom::HTMLOptionElement* aOption);
 
-  /**
-   * @note This method might destroy the frame, pres shell and other objects.
-   */
-  void ScrollToFrame(HTMLOptionElement& aOptElement);
-  /**
-   * @note This method might destroy the frame, pres shell and other objects.
-   */
-  void ScrollToIndex(int32_t anIndex);
+  MOZ_CAN_RUN_SCRIPT void ScrollToFrame(HTMLOptionElement& aOptElement);
+
+  MOZ_CAN_RUN_SCRIPT void ScrollToIndex(int32_t anIndex);
 
   /**
    * When the user clicks on the comboboxframe to show the dropdown
    * listbox, they then have to move the mouse into the list. We don't
    * want to process those mouse events as selection events (i.e., to
    * scroll list items into view). So we ignore the events until
    * the mouse moves below our border-inner-edge, when
    * mItemSelectionStarted is set.
@@ -317,17 +320,17 @@ class nsListControlFrame final : public 
   void AdjustIndexForDisabledOpt(int32_t aStartIndex, int32_t& anNewIndex,
                                  int32_t aNumOptions, int32_t aDoAdjustInc,
                                  int32_t aDoAdjustIncNext);
 
   /**
    * Resets the select back to it's original default values;
    * those values as determined by the original HTML
    */
-  virtual void ResetList(bool aAllowScrolling);
+  MOZ_CAN_RUN_SCRIPT void ResetList(bool aAllowScrolling);
 
   explicit nsListControlFrame(ComputedStyle* aStyle,
                               nsPresContext* aPresContext);
   virtual ~nsListControlFrame();
 
   /**
    * Sets the mSelectedIndex and mOldSelectedIndex from figuring out what
    * item was selected using content
@@ -359,29 +362,24 @@ class nsListControlFrame final : public 
   void ReflowAsDropdown(nsPresContext* aPresContext, ReflowOutput& aDesiredSize,
                         const ReflowInput& aReflowInput,
                         nsReflowStatus& aStatus);
 
   // Selection
   bool SetOptionsSelectedFromFrame(int32_t aStartIndex, int32_t aEndIndex,
                                    bool aValue, bool aClearAll);
   bool ToggleOptionSelectedFromFrame(int32_t aIndex);
-  /**
-   * @note This method might destroy the frame, pres shell and other objects.
-   */
+
+  MOZ_CAN_RUN_SCRIPT
   bool SingleSelection(int32_t aClickedIndex, bool aDoToggle);
   bool ExtendedSelection(int32_t aStartIndex, int32_t aEndIndex,
                          bool aClearAll);
-  /**
-   * @note This method might destroy the frame, pres shell and other objects.
-   */
+  MOZ_CAN_RUN_SCRIPT
   bool PerformSelection(int32_t aClickedIndex, bool aIsShift, bool aIsControl);
-  /**
-   * @note This method might destroy the frame, pres shell and other objects.
-   */
+  MOZ_CAN_RUN_SCRIPT
   bool HandleListSelection(mozilla::dom::Event* aDOMEvent,
                            int32_t selectedIndex);
   void InitSelectionRange(int32_t aClickedIndex);
   MOZ_CAN_RUN_SCRIPT
   void PostHandleKeyEvent(int32_t aNewIndex, uint32_t aCharCode, bool aIsShift,
                           bool aIsControlOrMeta);
 
  public:
--- a/layout/generic/nsCanvasFrame.cpp
+++ b/layout/generic/nsCanvasFrame.cpp
@@ -543,31 +543,32 @@ void nsCanvasFrame::BuildDisplayList(nsD
           asrSetter.SetCurrentActiveScrolledRoot(
               displayData->mContainingBlockActiveScrolledRoot);
           thisItemASR = displayData->mContainingBlockActiveScrolledRoot;
         }
         nsDisplayCanvasBackgroundImage* bgItem = nullptr;
         {
           DisplayListClipState::AutoSaveRestore bgImageClip(aBuilder);
           bgImageClip.Clear();
-          bgItem =
-              MakeDisplayItem<nsDisplayCanvasBackgroundImage>(aBuilder, bgData);
+          bgItem = MakeDisplayItem<nsDisplayCanvasBackgroundImage>(
+              aBuilder, this, bgData);
           if (bgItem) {
             bgItem->SetDependentFrame(aBuilder, dependentFrame);
           }
         }
         if (bgItem) {
           thisItemList.AppendToTop(
               nsDisplayFixedPosition::CreateForFixedBackground(aBuilder, this,
                                                                bgItem, i));
         }
 
       } else {
         nsDisplayCanvasBackgroundImage* bgItem =
-            MakeDisplayItem<nsDisplayCanvasBackgroundImage>(aBuilder, bgData);
+            MakeDisplayItem<nsDisplayCanvasBackgroundImage>(aBuilder, this,
+                                                            bgData);
         if (bgItem) {
           bgItem->SetDependentFrame(aBuilder, dependentFrame);
           thisItemList.AppendToTop(bgItem);
         }
       }
 
       if (layers.mLayers[i].mBlendMode != NS_STYLE_BLEND_NORMAL) {
         DisplayListClipState::AutoSaveRestore blendClip(aBuilder);
--- a/layout/generic/nsCanvasFrame.h
+++ b/layout/generic/nsCanvasFrame.h
@@ -187,18 +187,19 @@ class nsDisplayCanvasBackgroundColor fin
 #ifdef MOZ_DUMP_PAINTING
   virtual void WriteDebugInfo(std::stringstream& aStream) override;
 #endif
 };
 
 class nsDisplayCanvasBackgroundImage : public nsDisplayBackgroundImage {
  public:
   explicit nsDisplayCanvasBackgroundImage(nsDisplayListBuilder* aBuilder,
+                                          nsIFrame* aFrame,
                                           const InitData& aInitData)
-      : nsDisplayBackgroundImage(aBuilder, aInitData) {}
+      : nsDisplayBackgroundImage(aBuilder, aFrame, aInitData) {}
 
   virtual void Paint(nsDisplayListBuilder* aBuilder, gfxContext* aCtx) override;
 
   // We still need to paint a background color as well as an image for this
   // item, so we can't support this yet.
   virtual bool SupportsOptimizingToImage() const override { return false; }
 
   bool IsSingleFixedPositionImage(nsDisplayListBuilder* aBuilder,
--- a/layout/generic/nsFrame.h
+++ b/layout/generic/nsFrame.h
@@ -167,16 +167,17 @@ class nsFrame : public nsBox {
                    PostDestroyData& aPostDestroyData) override;
   ComputedStyle* GetAdditionalComputedStyle(int32_t aIndex) const override;
   void SetAdditionalComputedStyle(int32_t aIndex,
                                   ComputedStyle* aComputedStyle) override;
   nscoord GetLogicalBaseline(mozilla::WritingMode aWritingMode) const override;
   const nsFrameList& GetChildList(ChildListID aListID) const override;
   void GetChildLists(nsTArray<ChildList>* aLists) const override;
 
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY
   nsresult HandleEvent(nsPresContext* aPresContext,
                        mozilla::WidgetGUIEvent* aEvent,
                        nsEventStatus* aEventStatus) override;
   nsresult GetContentForEvent(mozilla::WidgetEvent* aEvent,
                               nsIContent** aContent) override;
 
   nsresult GetPointFromOffset(int32_t inOffset, nsPoint* outPoint) override;
   nsresult GetCharacterRectsInRange(int32_t aInOffset, int32_t aLength,
@@ -394,16 +395,17 @@ class nsFrame : public nsBox {
                          mozilla::WidgetGUIEvent* aEvent,
                          nsEventStatus* aEventStatus);
 
   NS_IMETHOD HandleMultiplePress(nsPresContext* aPresContext,
                                  mozilla::WidgetGUIEvent* aEvent,
                                  nsEventStatus* aEventStatus,
                                  bool aControlHeld);
 
+  MOZ_CAN_RUN_SCRIPT
   NS_IMETHOD HandleDrag(nsPresContext* aPresContext,
                         mozilla::WidgetGUIEvent* aEvent,
                         nsEventStatus* aEventStatus);
 
   NS_IMETHOD HandleRelease(nsPresContext* aPresContext,
                            mozilla::WidgetGUIEvent* aEvent,
                            nsEventStatus* aEventStatus);
 
--- a/layout/generic/nsFrameSelection.cpp
+++ b/layout/generic/nsFrameSelection.cpp
@@ -1184,17 +1184,18 @@ void nsFrameSelection::HandleDrag(nsIFra
 nsresult nsFrameSelection::StartAutoScrollTimer(nsIFrame* aFrame,
                                                 const nsPoint& aPoint,
                                                 uint32_t aDelay) {
   int8_t index = GetIndexFromSelectionType(SelectionType::eNormal);
   if (!mDomSelections[index]) {
     return NS_ERROR_NULL_POINTER;
   }
 
-  return mDomSelections[index]->StartAutoScrollTimer(aFrame, aPoint, aDelay);
+  RefPtr<Selection> selection = mDomSelections[index];
+  return selection->StartAutoScrollTimer(aFrame, aPoint, aDelay);
 }
 
 void nsFrameSelection::StopAutoScrollTimer() {
   int8_t index = GetIndexFromSelectionType(SelectionType::eNormal);
   if (!mDomSelections[index]) {
     return;
   }
 
--- a/layout/generic/nsFrameSelection.h
+++ b/layout/generic/nsFrameSelection.h
@@ -362,17 +362,17 @@ class nsFrameSelection final {
    * @param aFrame is the outermost frame to use when searching for
    * the closest frame for the point, i.e. the frame that is capturing
    * the mouse
    *
    * @param aPoint is relative to aFrame.
    *
    * @param aDelay is the timer's interval.
    */
-  /*unsafe*/
+  MOZ_CAN_RUN_SCRIPT
   nsresult StartAutoScrollTimer(nsIFrame* aFrame, const nsPoint& aPoint,
                                 uint32_t aDelay);
 
   /**
    * Stops any active auto scroll timer.
    */
   void StopAutoScrollTimer();
 
--- a/layout/painting/nsDisplayList.cpp
+++ b/layout/painting/nsDisplayList.cpp
@@ -3571,27 +3571,25 @@ nsDisplayBackgroundImage::GetInitData(ns
       !isTransformedFixed;
 
   bool shouldFixToViewport = shouldTreatAsFixed && !layer.mImage.IsEmpty();
   bool isRasterImage = state.mImageRenderer.IsRasterImage();
   nsCOMPtr<imgIContainer> image;
   if (isRasterImage) {
     image = state.mImageRenderer.GetImage();
   }
-  return InitData{aBuilder,         aFrame,
-                  aBackgroundStyle, image,
-                  aBackgroundRect,  state.mFillArea,
-                  state.mDestArea,  aLayer,
-                  isRasterImage,    shouldFixToViewport};
+  return InitData{aBuilder,        aBackgroundStyle, image,
+                  aBackgroundRect, state.mFillArea,  state.mDestArea,
+                  aLayer,          isRasterImage,    shouldFixToViewport};
 }
 
 nsDisplayBackgroundImage::nsDisplayBackgroundImage(
-    nsDisplayListBuilder* aBuilder, const InitData& aInitData,
+    nsDisplayListBuilder* aBuilder, nsIFrame* aFrame, const InitData& aInitData,
     nsIFrame* aFrameForBounds)
-    : nsDisplayImageContainer(aBuilder, aInitData.frame),
+    : nsDisplayImageContainer(aBuilder, aFrame),
       mBackgroundStyle(aInitData.backgroundStyle),
       mImage(aInitData.image),
       mDependentFrame(nullptr),
       mBackgroundRect(aInitData.backgroundRect),
       mFillRect(aInitData.fillArea),
       mDestRect(aInitData.destArea),
       mLayer(aInitData.layer),
       mIsRasterImage(aInitData.isRasterImage),
@@ -3892,23 +3890,21 @@ bool nsDisplayBackgroundImage::AppendBac
       }
       nsDisplayBackgroundImage* bgItem = nullptr;
       {
         // The clip is captured by the nsDisplayFixedPosition, so clear the
         // clip for the nsDisplayBackgroundImage inside.
         DisplayListClipState::AutoSaveRestore bgImageClip(aBuilder);
         bgImageClip.Clear();
         if (aSecondaryReferenceFrame) {
-          nsDisplayBackgroundImage::InitData tableData = bgData;
-          nsIFrame* styleFrame = tableData.frame;
-          tableData.frame = aSecondaryReferenceFrame;
           bgItem = MakeDisplayItem<nsDisplayTableBackgroundImage>(
-              aBuilder, tableData, styleFrame);
+              aBuilder, aSecondaryReferenceFrame, bgData, aFrame);
         } else {
-          bgItem = MakeDisplayItem<nsDisplayBackgroundImage>(aBuilder, bgData);
+          bgItem = MakeDisplayItem<nsDisplayBackgroundImage>(aBuilder, aFrame,
+                                                             bgData);
         }
       }
       if (bgItem) {
         bgItem->SetDependentFrame(aBuilder, dependentFrame);
         if (aSecondaryReferenceFrame) {
           thisItemList.AppendToTop(
               nsDisplayTableFixedPosition::CreateForFixedBackground(
                   aBuilder, aSecondaryReferenceFrame, bgItem, i, aFrame));
@@ -3917,24 +3913,21 @@ bool nsDisplayBackgroundImage::AppendBac
               nsDisplayFixedPosition::CreateForFixedBackground(aBuilder, aFrame,
                                                                bgItem, i));
         }
       }
 
     } else {
       nsDisplayBackgroundImage* bgItem;
       if (aSecondaryReferenceFrame) {
-        nsDisplayBackgroundImage::InitData tableData = bgData;
-        nsIFrame* styleFrame = tableData.frame;
-        tableData.frame = aSecondaryReferenceFrame;
-
         bgItem = MakeDisplayItem<nsDisplayTableBackgroundImage>(
-            aBuilder, tableData, styleFrame);
+            aBuilder, aSecondaryReferenceFrame, bgData, aFrame);
       } else {
-        bgItem = MakeDisplayItem<nsDisplayBackgroundImage>(aBuilder, bgData);
+        bgItem =
+            MakeDisplayItem<nsDisplayBackgroundImage>(aBuilder, aFrame, bgData);
       }
       if (bgItem) {
         bgItem->SetDependentFrame(aBuilder, dependentFrame);
         thisItemList.AppendToTop(bgItem);
       }
     }
 
     if (bg->mImage.mLayers[i].mBlendMode != NS_STYLE_BLEND_NORMAL) {
@@ -4406,18 +4399,19 @@ nsRect nsDisplayBackgroundImage::GetBoun
   const nsStyleImageLayers::Layer& layer =
       mBackgroundStyle->StyleBackground()->mImage.mLayers[mLayer];
   return nsCSSRendering::GetBackgroundLayerRect(
       presContext, frame, mBackgroundRect, clipRect, layer,
       aBuilder->GetBackgroundPaintFlags());
 }
 
 nsDisplayTableBackgroundImage::nsDisplayTableBackgroundImage(
-    nsDisplayListBuilder* aBuilder, const InitData& aData, nsIFrame* aCellFrame)
-    : nsDisplayBackgroundImage(aBuilder, aData, aCellFrame),
+    nsDisplayListBuilder* aBuilder, nsIFrame* aFrame, const InitData& aData,
+    nsIFrame* aCellFrame)
+    : nsDisplayBackgroundImage(aBuilder, aFrame, aData, aCellFrame),
       mStyleFrame(aCellFrame),
       mTableType(GetTableTypeFromFrame(mStyleFrame)) {
   if (aBuilder->IsRetainingDisplayList()) {
     mStyleFrame->AddDisplayItem(this);
   }
 }
 
 nsDisplayTableBackgroundImage::~nsDisplayTableBackgroundImage() {
@@ -5738,17 +5732,17 @@ nsDisplayWrapList::~nsDisplayWrapList() 
 void nsDisplayWrapList::MergeDisplayListFromItem(nsDisplayListBuilder* aBuilder,
                                                  const nsDisplayItem* aItem) {
   const nsDisplayWrapList* wrappedItem = aItem->AsDisplayWrapList();
   MOZ_ASSERT(wrappedItem);
 
   // Create a new nsDisplayWrapList using a copy-constructor. This is done
   // to preserve the information about bounds.
   nsDisplayWrapList* wrapper =
-      MakeDisplayItem<nsDisplayWrapList>(aBuilder, *wrappedItem);
+      MakeClone<nsDisplayWrapList>(aBuilder, wrappedItem);
   MOZ_ASSERT(wrapper);
 
   // Set the display list pointer of the new wrapper item to the display list
   // of the wrapped item.
   wrapper->mListPtr = wrappedItem->mListPtr;
 
   mListPtr->AppendToBottom(wrapper);
 }
--- a/layout/painting/nsDisplayList.h
+++ b/layout/painting/nsDisplayList.h
@@ -2003,30 +2003,49 @@ class RetainedDisplayList;
   const char* Name() const override { return n; }                            \
   constexpr static DisplayItemType ItemType() { return DisplayItemType::e; } \
                                                                              \
  private:                                                                    \
   void* operator new(size_t aSize, nsDisplayListBuilder* aBuilder) {         \
     return aBuilder->Allocate(aSize, DisplayItemType::e);                    \
   }                                                                          \
                                                                              \
-  template <typename T, typename... Args>                                    \
-  friend T* ::MakeDisplayItem(nsDisplayListBuilder* aBuilder,                \
+  template <typename T, typename F, typename... Args>                        \
+  friend T* ::MakeDisplayItem(nsDisplayListBuilder* aBuilder, F* aFrame,     \
                               Args&&... aArgs);                              \
                                                                              \
  public:
 
+#define NS_DISPLAY_ALLOW_CLONING()                                          \
+  template <typename T>                                                     \
+  friend T* MakeClone(nsDisplayListBuilder* aBuilder, const T* aItem);      \
+                                                                            \
+  nsDisplayWrapList* Clone(nsDisplayListBuilder* aBuilder) const override { \
+    return MakeClone(aBuilder, this);                                       \
+  }
+
+template <typename T>
+MOZ_ALWAYS_INLINE T* MakeClone(nsDisplayListBuilder* aBuilder, const T* aItem) {
+  T* item = new (aBuilder) T(aBuilder, *aItem);
+  item->SetType(T::ItemType());
+  item->SetPerFrameKey(item->CalculatePerFrameKey());
+  return item;
+}
+
 #ifdef MOZ_DIAGNOSTIC_ASSERT_ENABLED
 void AssertUniqueItem(nsDisplayItem* aItem);
 #endif
 
-template <typename T, typename... Args>
-MOZ_ALWAYS_INLINE T* MakeDisplayItem(nsDisplayListBuilder* aBuilder,
+template <typename T, typename F, typename... Args>
+MOZ_ALWAYS_INLINE T* MakeDisplayItem(nsDisplayListBuilder* aBuilder, F* aFrame,
                                      Args&&... aArgs) {
-  T* item = new (aBuilder) T(aBuilder, std::forward<Args>(aArgs)...);
+  static_assert(std::is_base_of<nsIFrame, F>::value,
+                "Frame type is not derived from nsIFrame");
+
+  T* item = new (aBuilder) T(aBuilder, aFrame, std::forward<Args>(aArgs)...);
 
   if (T::ItemType() != DisplayItemType::TYPE_GENERIC) {
     item->SetType(T::ItemType());
   }
 
   item->SetPerFrameKey(item->CalculatePerFrameKey());
 
   // TODO: Ideally we'd determine this before constructing the item,
@@ -2157,18 +2176,21 @@ class nsDisplayItemBase : public nsDispl
    */
   virtual const char* Name() const = 0;
 
   /**
    * Some consecutive items should be rendered together as a unit, e.g.,
    * outlines for the same element. For this, we need a way for items to
    * identify their type. We use the type for other purposes too.
    */
-  DisplayItemType GetType() const { return mType; }
-  void SetType(const DisplayItemType aType) { mType = aType; }
+  DisplayItemType GetType() const {
+    MOZ_ASSERT(mType != DisplayItemType::TYPE_ZERO,
+               "Display item should have a valid type!");
+    return mType;
+  }
 
   /**
    * Pairing this with the Frame() pointer gives a key that
    * uniquely identifies this display item in the display item tree.
    */
   uint32_t GetPerFrameKey() const {
     // The top 8 bits are currently unused.
     // The middle 16 bits of the per frame key uniquely identify the display
@@ -2262,17 +2284,17 @@ class nsDisplayItemBase : public nsDispl
    * display list iterator to descend into the child display list.
    */
   virtual bool ShouldFlattenAway(nsDisplayListBuilder* aBuilder) {
     return false;
   }
 
  protected:
   nsDisplayItemBase(nsDisplayListBuilder* aBuilder, nsIFrame* aFrame)
-      : mFrame(aFrame) {
+      : mFrame(aFrame), mType(DisplayItemType::TYPE_ZERO) {
     MOZ_COUNT_CTOR(nsDisplayItemBase);
     MOZ_ASSERT(mFrame);
 
     if (aBuilder->IsRetainingDisplayList()) {
       mFrame->AddDisplayItem(this);
     }
   }
 
@@ -2287,16 +2309,17 @@ class nsDisplayItemBase : public nsDispl
 
   virtual ~nsDisplayItemBase() {
     MOZ_COUNT_DTOR(nsDisplayItemBase);
     if (mFrame) {
       mFrame->RemoveDisplayItem(this);
     }
   }
 
+  void SetType(const DisplayItemType aType) { mType = aType; }
   void SetPerFrameKey(const uint16_t aKey) { mKey = aKey; }
 
   void SetDeletedFrame();
 
   nsIFrame* mFrame;  // 8
 
  private:
   enum class ItemBaseFlag : uint8_t {
@@ -2396,16 +2419,17 @@ class nsDisplayItem : public nsDisplayIt
    */
   virtual const nsDisplayWrapList* AsDisplayWrapList() const { return nullptr; }
   virtual nsDisplayWrapList* AsDisplayWrapList() { return nullptr; }
 
   /**
    * Create a clone of this item.
    */
   virtual nsDisplayItem* Clone(nsDisplayListBuilder* aBuilder) const {
+    MOZ_ASSERT_UNREACHABLE("Clone() called on an incorrect item type!");
     return nullptr;
   }
 
   nsDisplayItem(const nsDisplayItem&) = delete;
   /**
    * The custom copy-constructor is implemented to prevent copying the saved
    * state of the item.
    * This is currently only used when creating temporary items for merging.
@@ -3210,20 +3234,21 @@ class nsDisplayList {
       return;
     }
     MOZ_ASSERT(!aItem->mAbove, "Already in a list!");
     mTop->mAbove = aItem;
     mTop = aItem;
     mLength++;
   }
 
-  template <typename T, typename... Args>
-  void AppendNewToTop(nsDisplayListBuilder* aBuilder, Args&&... aArgs) {
+  template <typename T, typename F, typename... Args>
+  void AppendNewToTop(nsDisplayListBuilder* aBuilder, F* aFrame,
+                      Args&&... aArgs) {
     nsDisplayItem* item =
-        MakeDisplayItem<T>(aBuilder, std::forward<Args>(aArgs)...);
+        MakeDisplayItem<T>(aBuilder, aFrame, std::forward<Args>(aArgs)...);
     if (item) {
       AppendToTop(item);
     }
   }
 
   /**
    * Append a new item to the bottom of the list. The item must be non-null
    * and not already in a list.
@@ -3236,20 +3261,21 @@ class nsDisplayList {
     aItem->mAbove = mSentinel.mAbove;
     mSentinel.mAbove = aItem;
     if (mTop == &mSentinel) {
       mTop = aItem;
     }
     mLength++;
   }
 
-  template <typename T, typename... Args>
-  void AppendNewToBottom(nsDisplayListBuilder* aBuilder, Args&&... aArgs) {
+  template <typename T, typename F, typename... Args>
+  void AppendNewToBottom(nsDisplayListBuilder* aBuilder, F* aFrame,
+                         Args&&... aArgs) {
     nsDisplayItem* item =
-        MakeDisplayItem<T>(aBuilder, std::forward<Args>(aArgs)...);
+        MakeDisplayItem<T>(aBuilder, aFrame, std::forward<Args>(aArgs)...);
     if (item) {
       AppendToBottom(item);
     }
   }
 
   /**
    * Removes all items from aList and appends them to the top of this list
    */
@@ -3992,18 +4018,19 @@ class nsDisplayGeneric : public nsDispla
     this->~nsDisplayGeneric();
     aBuilder->Destroy(DisplayItemType::TYPE_GENERIC, this);
   }
 
  protected:
   void* operator new(size_t aSize, nsDisplayListBuilder* aBuilder) {
     return aBuilder->Allocate(aSize, DisplayItemType::TYPE_GENERIC);
   }
-  template <typename T, typename... Args>
-  friend T* MakeDisplayItem(nsDisplayListBuilder* aBuilder, Args&&... aArgs);
+  template <typename T, typename F, typename... Args>
+  friend T* MakeDisplayItem(nsDisplayListBuilder* aBuilder, F* aFrame,
+                            Args&&... aArgs);
 
   PaintCallback mPaint;
   OldPaintCallback mOldPaint;  // XXX: should be removed eventually
   const char* mName;
 };
 
 #if defined(MOZ_REFLOW_PERF_DSP) && defined(MOZ_REFLOW_PERF)
 /**
@@ -4380,17 +4407,16 @@ class nsDisplaySolidColorRegion : public
  * image layer gets its own nsDisplayBackgroundImage.
  */
 class nsDisplayBackgroundImage : public nsDisplayImageContainer {
  public:
   typedef mozilla::StyleGeometryBox StyleGeometryBox;
 
   struct InitData {
     nsDisplayListBuilder* builder;
-    nsIFrame* frame;
     mozilla::ComputedStyle* backgroundStyle;
     nsCOMPtr<imgIContainer> image;
     nsRect backgroundRect;
     nsRect fillArea;
     nsRect destArea;
     uint32_t layer;
     bool isRasterImage;
     bool shouldFixToViewport;
@@ -4403,17 +4429,17 @@ class nsDisplayBackgroundImage : public 
    * nsCSSRendering::FindBackground, or null if FindBackground returned false.
    * aBackgroundRect is relative to aFrame.
    */
   static InitData GetInitData(nsDisplayListBuilder* aBuilder, nsIFrame* aFrame,
                               uint16_t aLayer, const nsRect& aBackgroundRect,
                               mozilla::ComputedStyle* aBackgroundStyle);
 
   explicit nsDisplayBackgroundImage(nsDisplayListBuilder* aBuilder,
-                                    const InitData& aInitData,
+                                    nsIFrame* aFrame, const InitData& aInitData,
                                     nsIFrame* aFrameForBounds = nullptr);
   ~nsDisplayBackgroundImage() override;
 
   NS_DISPLAY_DECL_NAME("Background", TYPE_BACKGROUND)
 
   // This will create and append new items for all the layers of the
   // background. Returns whether we appended a themed background.
   // aAllowWillPaintBorderOptimization should usually be left at true, unless
@@ -4594,17 +4620,17 @@ static uint16_t CalculateTablePerFrameKe
  * frame. And use mFrame and table type as key to generate DisplayItemData to
  * avoid sharing DisplayItemData.
  *
  * Also store ancestor frame as mStyleFrame for all rendering informations.
  */
 class nsDisplayTableBackgroundImage : public nsDisplayBackgroundImage {
  public:
   nsDisplayTableBackgroundImage(nsDisplayListBuilder* aBuilder,
-                                const InitData& aInitData,
+                                nsIFrame* aFrame, const InitData& aInitData,
                                 nsIFrame* aCellFrame);
   ~nsDisplayTableBackgroundImage() override;
 
   NS_DISPLAY_DECL_NAME("TableBackgroundImage", TYPE_TABLE_BACKGROUND_IMAGE)
 
   uint16_t CalculatePerFrameKey() const override {
     return CalculateTablePerFrameKey(mLayer, mTableType);
   }
@@ -5458,16 +5484,19 @@ class nsDisplayWrapList : public nsDispl
   nsRect mBounds;
   // Displaylist building rect contributed by this display item itself.
   // Our mBuildingRect may include the visible areas of children.
   nsRect mBaseBuildingRect;
   int32_t mOverrideZIndex;
   uint16_t mIndex;
   bool mHasZIndexOverride;
   bool mClearingClipChain = false;
+
+ private:
+  NS_DISPLAY_ALLOW_CLONING()
 };
 
 /**
  * We call WrapDisplayList on the in-flow lists: BorderBackground(),
  * BlockBorderBackgrounds() and Content().
  * We call WrapDisplayItem on each item of Outlines(), PositionedDescendants(),
  * and Floats(). This is done to support special wrapping processing for frames
  * that may not be in-flow descendants of the current frame.
@@ -5505,36 +5534,32 @@ class nsDisplayOpacity : public nsDispla
 
   nsDisplayOpacity(nsDisplayListBuilder* aBuilder,
                    const nsDisplayOpacity& aOther)
       : nsDisplayWrapList(aBuilder, aOther),
         mOpacity(aOther.mOpacity),
         mForEventsAndPluginsOnly(aOther.mForEventsAndPluginsOnly),
         mNeedsActiveLayer(aOther.mNeedsActiveLayer),
         mChildOpacityState(ChildOpacityState::Unknown) {
+    MOZ_COUNT_CTOR(nsDisplayOpacity);
     // We should not try to merge flattened opacities.
     MOZ_ASSERT(aOther.mChildOpacityState != ChildOpacityState::Applied);
   }
 
 #ifdef NS_BUILD_REFCNT_LOGGING
   ~nsDisplayOpacity() override { MOZ_COUNT_DTOR(nsDisplayOpacity); }
 #endif
 
   NS_DISPLAY_DECL_NAME("Opacity", TYPE_OPACITY)
 
   void RestoreState() override {
     nsDisplayItem::RestoreState();
     mOpacity = mState.mOpacity;
   }
 
-  nsDisplayWrapList* Clone(nsDisplayListBuilder* aBuilder) const override {
-    MOZ_COUNT_CTOR(nsDisplayOpacity);
-    return MakeDisplayItem<nsDisplayOpacity>(aBuilder, *this);
-  }
-
   void InvalidateCachedChildInfo(nsDisplayListBuilder* aBuilder) override {
     mChildOpacityState = ChildOpacityState::Unknown;
   }
 
   nsRegion GetOpaqueRegion(nsDisplayListBuilder* aBuilder,
                            bool* aSnap) const override;
   already_AddRefed<Layer> BuildLayer(
       nsDisplayListBuilder* aBuilder, LayerManager* aManager,
@@ -5599,16 +5624,18 @@ class nsDisplayOpacity : public nsDispla
       mozilla::wr::IpcResourceUpdateQueue& aResources,
       const StackingContextHelper& aSc,
       mozilla::layers::RenderRootStateManager* aManager,
       nsDisplayListBuilder* aDisplayListBuilder) override;
 
   float GetOpacity() const { return mOpacity; }
 
  private:
+  NS_DISPLAY_ALLOW_CLONING()
+
   bool ApplyOpacityToChildren(nsDisplayListBuilder* aBuilder);
   bool IsEffectsWrapper() const;
 
   float mOpacity;
   bool mForEventsAndPluginsOnly : 1;
   enum class ChildOpacityState : uint8_t {
     // Our child list has changed since the last time ApplyOpacityToChildren was
     // called.
@@ -5635,29 +5662,26 @@ class nsDisplayBlendMode : public nsDisp
   nsDisplayBlendMode(nsDisplayListBuilder* aBuilder, nsIFrame* aFrame,
                      nsDisplayList* aList, uint8_t aBlendMode,
                      const ActiveScrolledRoot* aActiveScrolledRoot,
                      uint16_t aIndex = 0);
   nsDisplayBlendMode(nsDisplayListBuilder* aBuilder,
                      const nsDisplayBlendMode& aOther)
       : nsDisplayWrapList(aBuilder, aOther),
         mBlendMode(aOther.mBlendMode),
-        mIndex(aOther.mIndex) {}
+        mIndex(aOther.mIndex) {
+    MOZ_COUNT_CTOR(nsDisplayBlendMode);
+  }
 
 #ifdef NS_BUILD_REFCNT_LOGGING
   ~nsDisplayBlendMode() override { MOZ_COUNT_DTOR(nsDisplayBlendMode); }
 #endif
 
   NS_DISPLAY_DECL_NAME("BlendMode", TYPE_BLEND_MODE)
 
-  nsDisplayWrapList* Clone(nsDisplayListBuilder* aBuilder) const override {
-    MOZ_COUNT_CTOR(nsDisplayBlendMode);
-    return MakeDisplayItem<nsDisplayBlendMode>(aBuilder, *this);
-  }
-
   nsRegion GetOpaqueRegion(nsDisplayListBuilder* aBuilder,
                            bool* aSnap) const override;
   already_AddRefed<Layer> BuildLayer(
       nsDisplayListBuilder* aBuilder, LayerManager* aManager,
       const ContainerLayerParameters& aContainerParameters) override;
   void ComputeInvalidationRegion(nsDisplayListBuilder* aBuilder,
                                  const nsDisplayItemGeometry* aGeometry,
                                  nsRegion* aInvalidRegion) const override {
@@ -5685,16 +5709,19 @@ class nsDisplayBlendMode : public nsDisp
     return false;
   }
 
   mozilla::gfx::CompositionOp BlendMode();
 
  protected:
   uint8_t mBlendMode;
   uint16_t mIndex;
+
+ private:
+  NS_DISPLAY_ALLOW_CLONING()
 };
 
 class nsDisplayTableBlendMode : public nsDisplayBlendMode {
  public:
   nsDisplayTableBlendMode(nsDisplayListBuilder* aBuilder, nsIFrame* aFrame,
                           nsDisplayList* aList, uint8_t aBlendMode,
                           const ActiveScrolledRoot* aActiveScrolledRoot,
                           uint16_t aIndex, nsIFrame* aAncestorFrame)
@@ -5720,20 +5747,16 @@ class nsDisplayTableBlendMode : public n
   ~nsDisplayTableBlendMode() override {
     if (mAncestorFrame) {
       mAncestorFrame->RemoveDisplayItem(this);
     }
   }
 
   NS_DISPLAY_DECL_NAME("TableBlendMode", TYPE_TABLE_BLEND_MODE)
 
-  nsDisplayWrapList* Clone(nsDisplayListBuilder* aBuilder) const override {
-    return MakeDisplayItem<nsDisplayTableBlendMode>(aBuilder, *this);
-  }
-
   nsIFrame* FrameForInvalidation() const override { return mAncestorFrame; }
 
   void RemoveFrame(nsIFrame* aFrame) override {
     if (aFrame == mAncestorFrame) {
       mAncestorFrame = nullptr;
       SetDeletedFrame();
     }
     nsDisplayBlendMode::RemoveFrame(aFrame);
@@ -5741,16 +5764,19 @@ class nsDisplayTableBlendMode : public n
 
   uint16_t CalculatePerFrameKey() const override {
     return CalculateTablePerFrameKey(mIndex, mTableType);
   }
 
  protected:
   nsIFrame* mAncestorFrame;
   TableType mTableType;
+
+ private:
+  NS_DISPLAY_ALLOW_CLONING()
 };
 
 class nsDisplayBlendContainer : public nsDisplayWrapList {
  public:
   static nsDisplayBlendContainer* CreateForMixBlendMode(
       nsDisplayListBuilder* aBuilder, nsIFrame* aFrame, nsDisplayList* aList,
       const ActiveScrolledRoot* aActiveScrolledRoot);
 
@@ -5761,21 +5787,16 @@ class nsDisplayBlendContainer : public n
 #ifdef NS_BUILD_REFCNT_LOGGING
   ~nsDisplayBlendContainer() override {
     MOZ_COUNT_DTOR(nsDisplayBlendContainer);
   }
 #endif
 
   NS_DISPLAY_DECL_NAME("BlendContainer", TYPE_BLEND_CONTAINER)
 
-  nsDisplayWrapList* Clone(nsDisplayListBuilder* aBuilder) const override {
-    MOZ_COUNT_CTOR(nsDisplayBlendContainer);
-    return MakeDisplayItem<nsDisplayBlendContainer>(aBuilder, *this);
-  }
-
   already_AddRefed<Layer> BuildLayer(
       nsDisplayListBuilder* aBuilder, LayerManager* aManager,
       const ContainerLayerParameters& aContainerParameters) override;
   LayerState GetLayerState(
       nsDisplayListBuilder* aBuilder, LayerManager* aManager,
       const ContainerLayerParameters& aParameters) override;
   bool CreateWebRenderCommands(
       mozilla::wr::DisplayListBuilder& aBuilder,
@@ -5805,35 +5826,36 @@ class nsDisplayBlendContainer : public n
  protected:
   nsDisplayBlendContainer(nsDisplayListBuilder* aBuilder, nsIFrame* aFrame,
                           nsDisplayList* aList,
                           const ActiveScrolledRoot* aActiveScrolledRoot,
                           bool aIsForBackground);
   nsDisplayBlendContainer(nsDisplayListBuilder* aBuilder,
                           const nsDisplayBlendContainer& aOther)
       : nsDisplayWrapList(aBuilder, aOther),
-        mIsForBackground(aOther.mIsForBackground) {}
+        mIsForBackground(aOther.mIsForBackground) {
+    MOZ_COUNT_CTOR(nsDisplayBlendContainer);
+  }
 
   // Used to distinguish containers created at building stacking
   // context or appending background.
   bool mIsForBackground;
+
+ private:
+  NS_DISPLAY_ALLOW_CLONING()
 };
 
 class nsDisplayTableBlendContainer : public nsDisplayBlendContainer {
  public:
   static nsDisplayTableBlendContainer* CreateForBackgroundBlendMode(
       nsDisplayListBuilder* aBuilder, nsIFrame* aFrame, nsDisplayList* aList,
       const ActiveScrolledRoot* aActiveScrolledRoot, nsIFrame* aAncestorFrame);
 
   NS_DISPLAY_DECL_NAME("TableBlendContainer", TYPE_TABLE_BLEND_CONTAINER)
 
-  nsDisplayWrapList* Clone(nsDisplayListBuilder* aBuilder) const override {
-    return MakeDisplayItem<nsDisplayTableBlendContainer>(aBuilder, *this);
-  }
-
   nsIFrame* FrameForInvalidation() const override { return mAncestorFrame; }
 
   void RemoveFrame(nsIFrame* aFrame) override {
     if (aFrame == mAncestorFrame) {
       mAncestorFrame = nullptr;
       SetDeletedFrame();
     }
     nsDisplayBlendContainer::RemoveFrame(aFrame);
@@ -5856,30 +5878,29 @@ class nsDisplayTableBlendContainer : pub
       mAncestorFrame->AddDisplayItem(this);
     }
   }
 
   nsDisplayTableBlendContainer(nsDisplayListBuilder* aBuilder,
                                const nsDisplayTableBlendContainer& aOther)
       : nsDisplayBlendContainer(aBuilder, aOther),
         mAncestorFrame(aOther.mAncestorFrame),
-        mTableType(aOther.mTableType) {
-    if (aBuilder->IsRetainingDisplayList()) {
-      mAncestorFrame->AddDisplayItem(this);
-    }
-  }
+        mTableType(aOther.mTableType) {}
 
   ~nsDisplayTableBlendContainer() override {
     if (mAncestorFrame) {
       mAncestorFrame->RemoveDisplayItem(this);
     }
   }
 
   nsIFrame* mAncestorFrame;
   TableType mTableType;
+
+ private:
+  NS_DISPLAY_ALLOW_CLONING()
 };
 
 /**
  * nsDisplayOwnLayer constructor flags. If we nest this class inside
  * nsDisplayOwnLayer then we can't forward-declare it up at the top of this
  * file and that makes it hard to use in all the places that we need to use it.
  */
 enum class nsDisplayOwnLayerFlags {
@@ -6103,30 +6124,28 @@ class nsDisplayStickyPosition : public n
  public:
   nsDisplayStickyPosition(nsDisplayListBuilder* aBuilder, nsIFrame* aFrame,
                           nsDisplayList* aList,
                           const ActiveScrolledRoot* aActiveScrolledRoot,
                           const ActiveScrolledRoot* aContainerASR);
   nsDisplayStickyPosition(nsDisplayListBuilder* aBuilder,
                           const nsDisplayStickyPosition& aOther)
       : nsDisplayOwnLayer(aBuilder, aOther),
-        mContainerASR(aOther.mContainerASR) {}
+        mContainerASR(aOther.mContainerASR) {
+    MOZ_COUNT_CTOR(nsDisplayStickyPosition);
+  }
 
 #ifdef NS_BUILD_REFCNT_LOGGING
   ~nsDisplayStickyPosition() override {
     MOZ_COUNT_DTOR(nsDisplayStickyPosition);
   }
 #endif
 
   void SetClipChain(const DisplayItemClipChain* aClipChain,
                     bool aStore) override;
-  nsDisplayWrapList* Clone(nsDisplayListBuilder* aBuilder) const override {
-    MOZ_COUNT_CTOR(nsDisplayStickyPosition);
-    return MakeDisplayItem<nsDisplayStickyPosition>(aBuilder, *this);
-  }
 
   already_AddRefed<Layer> BuildLayer(
       nsDisplayListBuilder* aBuilder, LayerManager* aManager,
       const ContainerLayerParameters& aContainerParameters) override;
   NS_DISPLAY_DECL_NAME("StickyPosition", TYPE_STICKY_POSITION)
   LayerState GetLayerState(
       nsDisplayListBuilder* aBuilder, LayerManager* aManager,
       const ContainerLayerParameters& aParameters) override {
@@ -6138,16 +6157,18 @@ class nsDisplayStickyPosition : public n
       mozilla::wr::IpcResourceUpdateQueue& aResources,
       const StackingContextHelper& aSc,
       mozilla::layers::RenderRootStateManager* aManager,
       nsDisplayListBuilder* aDisplayListBuilder) override;
 
   const ActiveScrolledRoot* GetContainerASR() const { return mContainerASR; }
 
  private:
+  NS_DISPLAY_ALLOW_CLONING()
+
   // This stores the ASR that this sticky container item would have assuming it
   // has no fixed descendants. This may be the same as the ASR returned by
   // GetActiveScrolledRoot(), or it may be a descendant of that.
   RefPtr<const ActiveScrolledRoot> mContainerASR;
 };
 
 class nsDisplayFixedPosition : public nsDisplayOwnLayer {
  public:
@@ -6171,20 +6192,16 @@ class nsDisplayFixedPosition : public ns
       nsDisplayBackgroundImage* aImage, uint16_t aIndex);
 
 #ifdef NS_BUILD_REFCNT_LOGGING
   ~nsDisplayFixedPosition() override { MOZ_COUNT_DTOR(nsDisplayFixedPosition); }
 #endif
 
   NS_DISPLAY_DECL_NAME("FixedPosition", TYPE_FIXED_POSITION)
 
-  nsDisplayWrapList* Clone(nsDisplayListBuilder* aBuilder) const override {
-    return MakeDisplayItem<nsDisplayFixedPosition>(aBuilder, *this);
-  }
-
   already_AddRefed<Layer> BuildLayer(
       nsDisplayListBuilder* aBuilder, LayerManager* aManager,
       const ContainerLayerParameters& aContainerParameters) override;
 
   LayerState GetLayerState(
       nsDisplayListBuilder* aBuilder, LayerManager* aManager,
       const ContainerLayerParameters& aParameters) override {
     return mozilla::LAYER_ACTIVE_FORCE;
@@ -6217,31 +6234,30 @@ class nsDisplayFixedPosition : public ns
                          nsDisplayList* aList, uint16_t aIndex);
   void Init(nsDisplayListBuilder* aBuilder);
   ViewID GetScrollTargetId();
 
   RefPtr<AnimatedGeometryRoot> mAnimatedGeometryRootForScrollMetadata;
   RefPtr<const ActiveScrolledRoot> mContainerASR;
   uint16_t mIndex;
   bool mIsFixedBackground;
+
+ private:
+  NS_DISPLAY_ALLOW_CLONING()
 };
 
 class nsDisplayTableFixedPosition : public nsDisplayFixedPosition {
  public:
   static nsDisplayTableFixedPosition* CreateForFixedBackground(
       nsDisplayListBuilder* aBuilder, nsIFrame* aFrame,
       nsDisplayBackgroundImage* aImage, uint16_t aIndex,
       nsIFrame* aAncestorFrame);
 
   NS_DISPLAY_DECL_NAME("TableFixedPosition", TYPE_TABLE_FIXED_POSITION)
 
-  nsDisplayWrapList* Clone(nsDisplayListBuilder* aBuilder) const override {
-    return MakeDisplayItem<nsDisplayTableFixedPosition>(aBuilder, *this);
-  }
-
   nsIFrame* FrameForInvalidation() const override { return mAncestorFrame; }
 
   void RemoveFrame(nsIFrame* aFrame) override {
     if (aFrame == mAncestorFrame) {
       mAncestorFrame = nullptr;
       SetDeletedFrame();
     }
     nsDisplayFixedPosition::RemoveFrame(aFrame);
@@ -6255,30 +6271,29 @@ class nsDisplayTableFixedPosition : publ
   nsDisplayTableFixedPosition(nsDisplayListBuilder* aBuilder, nsIFrame* aFrame,
                               nsDisplayList* aList, uint16_t aIndex,
                               nsIFrame* aAncestorFrame);
 
   nsDisplayTableFixedPosition(nsDisplayListBuilder* aBuilder,
                               const nsDisplayTableFixedPosition& aOther)
       : nsDisplayFixedPosition(aBuilder, aOther),
         mAncestorFrame(aOther.mAncestorFrame),
-        mTableType(aOther.mTableType) {
-    if (aBuilder->IsRetainingDisplayList()) {
-      mAncestorFrame->AddDisplayItem(this);
-    }
-  }
+        mTableType(aOther.mTableType) {}
 
   ~nsDisplayTableFixedPosition() override {
     if (mAncestorFrame) {
       mAncestorFrame->RemoveDisplayItem(this);
     }
   }
 
   nsIFrame* mAncestorFrame;
   TableType mTableType;
+
+ private:
+  NS_DISPLAY_ALLOW_CLONING()
 };
 
 /**
  * This creates an empty scrollable layer. It has no child layers.
  * It is used to record the existence of a scrollable frame in the layer
  * tree.
  */
 class nsDisplayScrollInfoLayer : public nsDisplayWrapList {
@@ -6479,31 +6494,28 @@ class nsDisplayMasksAndClipPaths : publi
  public:
   typedef mozilla::layers::ImageLayer ImageLayer;
 
   nsDisplayMasksAndClipPaths(nsDisplayListBuilder* aBuilder, nsIFrame* aFrame,
                              nsDisplayList* aList,
                              const ActiveScrolledRoot* aActiveScrolledRoot);
   nsDisplayMasksAndClipPaths(nsDisplayListBuilder* aBuilder,
                              const nsDisplayMasksAndClipPaths& aOther)
-      : nsDisplayEffectsBase(aBuilder, aOther), mDestRects(aOther.mDestRects) {}
+      : nsDisplayEffectsBase(aBuilder, aOther), mDestRects(aOther.mDestRects) {
+    MOZ_COUNT_CTOR(nsDisplayMasksAndClipPaths);
+  }
 
 #ifdef NS_BUILD_REFCNT_LOGGING
   ~nsDisplayMasksAndClipPaths() override {
     MOZ_COUNT_DTOR(nsDisplayMasksAndClipPaths);
   }
 #endif
 
   NS_DISPLAY_DECL_NAME("Mask", TYPE_MASK)
 
-  nsDisplayWrapList* Clone(nsDisplayListBuilder* aBuilder) const override {
-    MOZ_COUNT_CTOR(nsDisplayMasksAndClipPaths);
-    return MakeDisplayItem<nsDisplayMasksAndClipPaths>(aBuilder, *this);
-  }
-
   bool CanMerge(const nsDisplayItem* aItem) const override;
 
   void Merge(const nsDisplayItem* aItem) override {
     nsDisplayWrapList::Merge(aItem);
 
     const nsDisplayMasksAndClipPaths* other =
         static_cast<const nsDisplayMasksAndClipPaths*>(aItem);
     mEffectsBounds.UnionRect(
@@ -6557,16 +6569,18 @@ class nsDisplayMasksAndClipPaths : publi
       mozilla::layers::RenderRootStateManager* aManager,
       nsDisplayListBuilder* aDisplayListBuilder) override;
 
   mozilla::Maybe<nsRect> GetClipWithRespectToASR(
       nsDisplayListBuilder* aBuilder,
       const ActiveScrolledRoot* aASR) const override;
 
  private:
+  NS_DISPLAY_ALLOW_CLONING()
+
   // According to mask property and the capability of aManager, determine
   // whether we can paint the mask onto a dedicate mask layer.
   bool CanPaintOnMaskLayer(LayerManager* aManager);
 
   nsTArray<nsRect> mDestRects;
 };
 
 /**
@@ -6579,29 +6593,26 @@ class nsDisplayMasksAndClipPaths : publi
 class nsDisplayFilters : public nsDisplayEffectsBase {
  public:
   nsDisplayFilters(nsDisplayListBuilder* aBuilder, nsIFrame* aFrame,
                    nsDisplayList* aList);
 
   nsDisplayFilters(nsDisplayListBuilder* aBuilder,
                    const nsDisplayFilters& aOther)
       : nsDisplayEffectsBase(aBuilder, aOther),
-        mEffectsBounds(aOther.mEffectsBounds) {}
+        mEffectsBounds(aOther.mEffectsBounds) {
+    MOZ_COUNT_CTOR(nsDisplayFilters);
+  }
 
 #ifdef NS_BUILD_REFCNT_LOGGING
   ~nsDisplayFilters() override { MOZ_COUNT_DTOR(nsDisplayFilters); }
 #endif
 
   NS_DISPLAY_DECL_NAME("Filter", TYPE_FILTER)
 
-  nsDisplayWrapList* Clone(nsDisplayListBuilder* aBuilder) const override {
-    MOZ_COUNT_CTOR(nsDisplayFilters);
-    return MakeDisplayItem<nsDisplayFilters>(aBuilder, *this);
-  }
-
   bool CanMerge(const nsDisplayItem* aItem) const override {
     // Items for the same content element should be merged into a single
     // compositing group.
     return HasDifferentFrame(aItem) && HasSameTypeAndClip(aItem) &&
            HasSameContent(aItem);
   }
 
   void Merge(const nsDisplayItem* aItem) override {
@@ -6649,16 +6660,18 @@ class nsDisplayFilters : public nsDispla
       const StackingContextHelper& aSc,
       mozilla::layers::RenderRootStateManager* aManager,
       nsDisplayListBuilder* aDisplayListBuilder) override;
   bool CanCreateWebRenderCommands(nsDisplayListBuilder* aBuilder);
 
   bool CreateWebRenderCSSFilters(WrFiltersHolder& wrFilters);
 
  private:
+  NS_DISPLAY_ALLOW_CLONING()
+
   // relative to mFrame
   nsRect mEffectsBounds;
 };
 
 /* A display item that applies a transformation to all of its descendant
  * elements.  This wrapper should only be used if there is a transform applied
  * to the root element.
  *
--- a/layout/xul/nsMenuPopupFrame.cpp
+++ b/layout/xul/nsMenuPopupFrame.cpp
@@ -1807,17 +1807,18 @@ nsIScrollableFrame* nsMenuPopupFrame::Ge
     currFrame = currFrame->GetNextSibling();
   } while (currFrame);
 
   return nullptr;
 }
 
 void nsMenuPopupFrame::EnsureMenuItemIsVisible(nsMenuFrame* aMenuItem) {
   if (aMenuItem) {
-    aMenuItem->PresShell()->ScrollFrameRectIntoView(
+    RefPtr<mozilla::PresShell> presShell = aMenuItem->PresShell();
+    presShell->ScrollFrameRectIntoView(
         aMenuItem, nsRect(nsPoint(0, 0), aMenuItem->GetRect().Size()),
         ScrollAxis(), ScrollAxis(),
         ScrollFlags::ScrollOverflowHidden |
             ScrollFlags::ScrollFirstAncestorOnly |
             ScrollFlags::IgnoreMarginAndPadding);
   }
 }
 
--- a/layout/xul/nsMenuPopupFrame.h
+++ b/layout/xul/nsMenuPopupFrame.h
@@ -173,16 +173,17 @@ class nsMenuPopupFrame final : public ns
  public:
   NS_DECL_QUERYFRAME
   NS_DECL_FRAMEARENA_HELPERS(nsMenuPopupFrame)
 
   explicit nsMenuPopupFrame(ComputedStyle* aStyle, nsPresContext* aPresContext);
 
   // nsMenuParent interface
   virtual nsMenuFrame* GetCurrentMenuItem() override;
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY
   NS_IMETHOD SetCurrentMenuItem(nsMenuFrame* aMenuItem) override;
   virtual void CurrentMenuIsBeingDestroyed() override;
   MOZ_CAN_RUN_SCRIPT_BOUNDARY
   NS_IMETHOD ChangeMenuItem(nsMenuFrame* aMenuItem, bool aSelectFirstItem,
                             bool aFromKey) override;
 
   // as popups are opened asynchronously, the popup pending state is used to
   // prevent multiple requests from attempting to open the same popup twice
@@ -249,16 +250,17 @@ class nsMenuPopupFrame final : public ns
   nsresult CreateWidgetForView(nsView* aView);
   uint8_t GetShadowStyle();
 
   virtual bool IsLeafDynamic() const override;
 
   virtual void UpdateWidgetProperties() override;
 
   // layout, position and display the popup as needed
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY
   void LayoutPopup(nsBoxLayoutState& aState, nsIFrame* aParentMenu,
                    nsIFrame* aAnchor, bool aSizedToPopup);
 
   nsView* GetRootViewForPopup(nsIFrame* aStartFrame);
 
   // Set the position of the popup either relative to the anchor aAnchorFrame
   // (or the frame for mAnchorContent if aAnchorFrame is null), anchored at a
   // rectangle, or at a specific point if a screen position is set. The popup
@@ -342,17 +344,17 @@ class nsMenuPopupFrame final : public ns
   }
 
 #ifdef DEBUG_FRAME_DUMP
   virtual nsresult GetFrameName(nsAString& aResult) const override {
     return MakeFrameName(NS_LITERAL_STRING("MenuPopup"), aResult);
   }
 #endif
 
-  void EnsureMenuItemIsVisible(nsMenuFrame* aMenuFrame);
+  MOZ_CAN_RUN_SCRIPT void EnsureMenuItemIsVisible(nsMenuFrame* aMenuFrame);
 
   void ChangeByPage(bool aIsUp);
 
   // Move the popup to the screen coordinate |aPos| in CSS pixels.
   // If aUpdateAttrs is true, and the popup already has left or top attributes,
   // then those attributes are updated to the new location.
   // The frame may be destroyed by this method.
   void MoveTo(const mozilla::CSSIntPoint& aPos, bool aUpdateAttrs);
--- a/layout/xul/nsScrollbarButtonFrame.h
+++ b/layout/xul/nsScrollbarButtonFrame.h
@@ -54,16 +54,17 @@ class nsScrollbarButtonFrame final : pub
 
   NS_IMETHOD HandleMultiplePress(nsPresContext* aPresContext,
                                  mozilla::WidgetGUIEvent* aEvent,
                                  nsEventStatus* aEventStatus,
                                  bool aControlHeld) override {
     return NS_OK;
   }
 
+  MOZ_CAN_RUN_SCRIPT
   NS_IMETHOD HandleDrag(nsPresContext* aPresContext,
                         mozilla::WidgetGUIEvent* aEvent,
                         nsEventStatus* aEventStatus) override {
     return NS_OK;
   }
 
   NS_IMETHOD HandleRelease(nsPresContext* aPresContext,
                            mozilla::WidgetGUIEvent* aEvent,
--- a/layout/xul/nsScrollbarFrame.h
+++ b/layout/xul/nsScrollbarFrame.h
@@ -56,16 +56,17 @@ class nsScrollbarFrame final : public ns
                          mozilla::WidgetGUIEvent* aEvent,
                          nsEventStatus* aEventStatus) override;
 
   NS_IMETHOD HandleMultiplePress(nsPresContext* aPresContext,
                                  mozilla::WidgetGUIEvent* aEvent,
                                  nsEventStatus* aEventStatus,
                                  bool aControlHeld) override;
 
+  MOZ_CAN_RUN_SCRIPT
   NS_IMETHOD HandleDrag(nsPresContext* aPresContext,
                         mozilla::WidgetGUIEvent* aEvent,
                         nsEventStatus* aEventStatus) override;
 
   NS_IMETHOD HandleRelease(nsPresContext* aPresContext,
                            mozilla::WidgetGUIEvent* aEvent,
                            nsEventStatus* aEventStatus) override;
 
--- a/layout/xul/nsSliderFrame.h
+++ b/layout/xul/nsSliderFrame.h
@@ -111,16 +111,17 @@ class nsSliderFrame final : public nsBox
 
   NS_IMETHOD HandleMultiplePress(nsPresContext* aPresContext,
                                  mozilla::WidgetGUIEvent* aEvent,
                                  nsEventStatus* aEventStatus,
                                  bool aControlHeld) override {
     return NS_OK;
   }
 
+  MOZ_CAN_RUN_SCRIPT
   NS_IMETHOD HandleDrag(nsPresContext* aPresContext,
                         mozilla::WidgetGUIEvent* aEvent,
                         nsEventStatus* aEventStatus) override {
     return NS_OK;
   }
 
   NS_IMETHOD HandleRelease(nsPresContext* aPresContext,
                            mozilla::WidgetGUIEvent* aEvent,
--- a/layout/xul/nsSplitterFrame.h
+++ b/layout/xul/nsSplitterFrame.h
@@ -50,16 +50,17 @@ class nsSplitterFrame final : public nsB
                          mozilla::WidgetGUIEvent* aEvent,
                          nsEventStatus* aEventStatus) override;
 
   NS_IMETHOD HandleMultiplePress(nsPresContext* aPresContext,
                                  mozilla::WidgetGUIEvent* aEvent,
                                  nsEventStatus* aEventStatus,
                                  bool aControlHeld) override;
 
+  MOZ_CAN_RUN_SCRIPT
   NS_IMETHOD HandleDrag(nsPresContext* aPresContext,
                         mozilla::WidgetGUIEvent* aEvent,
                         nsEventStatus* aEventStatus) override;
 
   NS_IMETHOD HandleRelease(nsPresContext* aPresContext,
                            mozilla::WidgetGUIEvent* aEvent,
                            nsEventStatus* aEventStatus) override;
 
--- a/layout/xul/nsXULPopupManager.h
+++ b/layout/xul/nsXULPopupManager.h
@@ -328,16 +328,17 @@ class nsXULPopupManager final : public n
   friend class nsXULMenuCommandEvent;
   friend class TransitionEnder;
 
   NS_DECL_ISUPPORTS
   NS_DECL_NSIOBSERVER
   NS_DECL_NSIDOMEVENTLISTENER
 
   // nsIRollupListener
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY
   virtual bool Rollup(uint32_t aCount, bool aFlush, const nsIntPoint* pos,
                       nsIContent** aLastRolledUp) override;
   virtual bool ShouldRollupOnMouseWheelEvent() override;
   virtual bool ShouldConsumeOnMouseWheelEvent() override;
   virtual bool ShouldRollupOnMouseActivate() override;
   virtual uint32_t GetSubmenuWidgetChain(
       nsTArray<nsIWidget*>* aWidgetChain) override;
   virtual void NotifyGeometryChange() override {}
--- a/mobile/android/geckoview/src/androidTest/java/org/mozilla/geckoview/test/NavigationDelegateTest.kt
+++ b/mobile/android/geckoview/src/androidTest/java/org/mozilla/geckoview/test/NavigationDelegateTest.kt
@@ -1135,16 +1135,29 @@ class NavigationDelegateTest : BaseSessi
             @AssertCalled(count = 0)
             override fun onNewSession(session: GeckoSession, uri: String): GeckoResult<GeckoSession>? {
                 return null
             }
         })
     }
 
     @WithDevToolsAPI
+    @Test fun loadUriReferrer() {
+        val uri = "https://example.com"
+        val referrer = "https://foo.org/"
+
+        sessionRule.session.loadUri(uri, referrer, GeckoSession.LOAD_FLAGS_NONE)
+        sessionRule.session.waitForPageStop()
+
+        assertThat("Referrer should match",
+                   sessionRule.session.evaluateJS("document.referrer") as String,
+                   equalTo(referrer))
+    }
+
+    @WithDevToolsAPI
     @Test(expected = GeckoResult.UncaughtException::class)
     fun onNewSession_doesNotAllowOpened() {
         // Disable popup blocker.
         sessionRule.setPrefsUntilTestEnd(mapOf("dom.disable_open_during_load" to false))
 
         sessionRule.session.loadTestPath(NEW_SESSION_HTML_PATH)
         sessionRule.session.waitForPageStop()
 
--- a/mobile/android/geckoview/src/main/java/org/mozilla/geckoview/GeckoView.java
+++ b/mobile/android/geckoview/src/main/java/org/mozilla/geckoview/GeckoView.java
@@ -452,26 +452,25 @@ public class GeckoView extends FrameLayo
 
     public @NonNull DynamicToolbarAnimator getDynamicToolbarAnimator() {
         ThreadUtils.assertOnUiThread();
         return mSession.getDynamicToolbarAnimator();
     }
 
     @Override
     public void onAttachedToWindow() {
-        if (mSession == null) {
+        if (mSession != null && mRuntime != null) {
+            if (!mSession.isOpen()) {
+                mSession.open(mRuntime);
+            }
+            mRuntime.orientationChanged();
+        } else {
             Log.w(LOGTAG, "No GeckoSession attached to this GeckoView instance. Call setSession to attach a GeckoSession to this instance.");
-            return;
         }
 
-        if (!mSession.isOpen()) {
-            mSession.open(mRuntime);
-        }
-        mRuntime.orientationChanged();
-
         super.onAttachedToWindow();
     }
 
     @Override
     public void onDetachedFromWindow() {
         super.onDetachedFromWindow();
 
         if (mSession == null) {
--- a/mobile/android/modules/geckoview/GeckoViewNavigation.jsm
+++ b/mobile/android/modules/geckoview/GeckoViewNavigation.jsm
@@ -10,16 +10,38 @@ const {GeckoViewModule} = ChromeUtils.im
 const {XPCOMUtils} = ChromeUtils.import("resource://gre/modules/XPCOMUtils.jsm");
 
 XPCOMUtils.defineLazyModuleGetters(this, {
   E10SUtils: "resource://gre/modules/sessionstore/Utils.jsm",
   LoadURIDelegate: "resource://gre/modules/LoadURIDelegate.jsm",
   Services: "resource://gre/modules/Services.jsm",
 });
 
+XPCOMUtils.defineLazyGetter(this, "ReferrerInfo", () =>
+  Components.Constructor(
+    "@mozilla.org/referrer-info;1",
+    "nsIReferrerInfo",
+    "init"));
+
+// Create default ReferrerInfo instance for the given referrer URI string.
+const createReferrerInfo = aReferrer => {
+  let referrerUri;
+  try {
+    referrerUri = Services.io.newURI(aReferrer);
+  } catch (ignored) {
+  }
+
+  return new ReferrerInfo(
+    Ci.nsIHttpChannel.REFERRER_POLICY_UNSET,
+    true,
+    referrerUri
+  );
+};
+
+
 // Handles navigation requests between Gecko and a GeckoView.
 // Handles GeckoView:GoBack and :GoForward requests dispatched by
 // GeckoView.goBack and .goForward.
 // Dispatches GeckoView:LocationChange to the GeckoView on location change when
 // active.
 // Implements nsIBrowserDOMWindow.
 class GeckoViewNavigation extends GeckoViewModule {
   onInitBrowser() {
@@ -100,17 +122,17 @@ class GeckoViewNavigation extends GeckoV
         } catch (ignored) {
         }
         if (!triggeringPrincipal) {
           triggeringPrincipal = Services.scriptSecurityManager.createNullPrincipal({});
         }
 
         this.browser.loadURI(parsedUri ? parsedUri.spec : uri, {
           flags: navFlags,
-          referrerURI: referrer,
+          referrerInfo: createReferrerInfo(referrer),
           triggeringPrincipal,
         });
         break;
       case "GeckoView:Reload":
         this.browser.reload();
         break;
       case "GeckoView:Stop":
         this.browser.stop();
@@ -128,17 +150,17 @@ class GeckoViewNavigation extends GeckoV
         // we may need to change the remoteness of our browser and
         // load the URI.
         const { uri, flags, referrer, triggeringPrincipal } = aMsg.data.loadOptions;
 
         this.moduleManager.updateRemoteTypeForURI(uri);
 
         this.browser.loadURI(uri, {
           flags,
-          referrerURI: referrer,
+          referrerInfo: createReferrerInfo(referrer),
           triggeringPrincipal: E10SUtils.deserializePrincipal(triggeringPrincipal),
         });
         break;
     }
   }
 
   waitAndSetupWindow(aSessionId, { opener, nextRemoteTabId }) {
     if (!aSessionId) {
@@ -267,17 +289,21 @@ class GeckoViewNavigation extends GeckoV
       browser = this.handleNewSession(aUri, aOpener, aWhere, aFlags,
                                       aTriggeringPrincipal);
     }
 
     if (!browser) {
       // Should we throw?
       return null;
     }
-    browser.loadURI(aUri.spec, null, null, null, null, aTriggeringPrincipal, aCsp);
+
+    browser.loadURI(aUri.spec, {
+      triggeringPrincipal: aTriggeringPrincipal,
+      csp: aCsp,
+    });
     return browser;
   }
 
   // nsIBrowserDOMWindow.
   openURI(aUri, aOpener, aWhere, aFlags, aTriggeringPrincipal, aCsp) {
     const browser = this.handleOpenUri(aUri, aOpener, aWhere, aFlags,
                                        aTriggeringPrincipal, aCsp, null);
     return browser && browser.contentWindow;
--- a/netwerk/base/nsIProtocolProxyService.idl
+++ b/netwerk/base/nsIProtocolProxyService.idl
@@ -94,17 +94,17 @@ interface nsIProtocolProxyService : nsIS
      * nsIProxiedProtocolHandler, then the nsIProxyInfo instance returned from
      * resolve may be passed to the newProxiedChannel method to create a
      * nsIChannel to the given URI that uses the specified proxy.
      *
      * NOTE: However, if the nsIProxyInfo type is "http", then it means that
      * the given URI should be loaded using the HTTP protocol handler, which
      * also supports nsIProxiedProtocolHandler.
      *
-     * @see nsIProxiedProtocolHandler::newProxiedChannel 
+     * @see nsIProxiedProtocolHandler::newProxiedChannel
      */
     nsICancelable asyncResolve(in nsISupports aChannelOrURI, in unsigned long aFlags,
                                in nsIProtocolProxyCallback aCallback,
                                [optional] in nsIEventTarget aMainThreadTarget);
 
     /**
      * This method may be called to construct a nsIProxyInfo instance from
      * the given parameters.  This method may be useful in conjunction with
@@ -134,17 +134,20 @@ interface nsIProtocolProxyService : nsIS
      *        this proxy fails.  Pass UINT32_MAX to specify the default
      *        timeout value, causing nsIProxyInfo::failoverTimeout to be
      *        assigned the default value.
      * @param aFailoverProxy
      *        Specifies the next proxy to try if this proxy fails.  This
      *        parameter may be null.
      */
     nsIProxyInfo newProxyInfo(in ACString aType, in AUTF8String aHost,
-                              in long aPort, in unsigned long aFlags,
+                              in long aPort,
+                              in ACString aProxyAuthorizationHeader,
+                              in ACString aConnectionIsolationKey,
+                              in unsigned long aFlags,
                               in unsigned long aFailoverTimeout,
                               in nsIProxyInfo aFailoverProxy);
 
     /**
      * This method may be called to construct a nsIProxyInfo instance for
      * with the specified username and password.
      * Currently implemented for SOCKS proxies only.
      * @param aType
@@ -173,16 +176,18 @@ interface nsIProtocolProxyService : nsIS
      *        assigned the default value.
      * @param aFailoverProxy
      *        Specifies the next proxy to try if this proxy fails.  This
      *        parameter may be null.
      */
     nsIProxyInfo newProxyInfoWithAuth(in ACString aType, in AUTF8String aHost,
                                       in long aPort,
                                       in ACString aUsername, in ACString aPassword,
+                                      in ACString aProxyAuthorizationHeader,
+                                      in ACString aConnectionIsolationKey,
                                       in unsigned long aFlags,
                                       in unsigned long aFailoverTimeout,
                                       in nsIProxyInfo aFailoverProxy);
 
     /**
      * If the proxy identified by aProxyInfo is unavailable for some reason,
      * this method may be called to access an alternate proxy that may be used
      * instead.  As a side-effect, this method may affect future result values
@@ -266,17 +271,17 @@ interface nsIProtocolProxyService : nsIS
      * @param aFilter
      *        The nsIProtocolProxyChannelFilter instance to be unregistered.
      */
     void unregisterChannelFilter(in nsIProtocolProxyChannelFilter aFilter);
 
      /**
       * These values correspond to the possible integer values for the
       * network.proxy.type preference.
-      */ 
+      */
      const unsigned long PROXYCONFIG_DIRECT   = 0;
      const unsigned long PROXYCONFIG_MANUAL   = 1;
      const unsigned long PROXYCONFIG_PAC      = 2;
      const unsigned long PROXYCONFIG_WPAD     = 4;
      const unsigned long PROXYCONFIG_SYSTEM   = 5;
 
      /**
       * This attribute specifies the current type of proxy configuration.
--- a/netwerk/base/nsIProxyInfo.idl
+++ b/netwerk/base/nsIProxyInfo.idl
@@ -30,28 +30,28 @@ interface nsIProxyInfo : nsISupports
    *   "https"    HTTP proxying over TLS connection to proxy
    *   "socks"    SOCKS v5 proxy
    *   "socks4"   SOCKS v4 proxy
    *   "direct"   no proxy
    *   "unknown"  unknown proxy (see nsIProtocolProxyService::resolve)
    *
    * A future version of this interface may define additional types.
    */
-  readonly attribute ACString type; 
+  readonly attribute ACString type;
 
   /**
    * This attribute specifies flags that modify the proxy type.  The value of
    * this attribute is the bit-wise combination of the Proxy Flags defined
    * below.  Any undefined bits are reserved for future use.
    */
   readonly attribute unsigned long flags;
 
   /**
    * This attribute specifies flags that were used by nsIProxyProtocolService when
-   * creating this ProxyInfo element. 
+   * creating this ProxyInfo element.
    */
   readonly attribute unsigned long resolveFlags;
 
   /**
    * Specifies a proxy username.
    */
   readonly attribute ACString username;
 
@@ -68,16 +68,27 @@ interface nsIProxyInfo : nsISupports
    */
   readonly attribute unsigned long failoverTimeout;
 
   /**
    * This attribute specifies the proxy to failover to when this proxy fails.
    */
   attribute nsIProxyInfo failoverProxy;
 
+  /**
+   * Any non-empty value will be passed directly as Proxy-Authorization header
+   * value for the CONNECT request attempt.  However, this header set on the
+   * resource request itself takes precedence.
+   */
+  readonly attribute ACString proxyAuthorizationHeader;
+
+  /**
+   * An optional key used for additional isolation of this proxy connection.
+   */
+  readonly attribute ACString connectionIsolationKey;
 
   /****************************************************************************
    * The following "Proxy Flags" may be bit-wise combined to construct the
    * flags attribute defined on this interface.  All unspecified bits are
    * reserved for future use.
    */
 
   /**
--- a/netwerk/base/nsNetUtil.cpp
+++ b/netwerk/base/nsNetUtil.cpp
@@ -1048,18 +1048,18 @@ nsresult NS_CheckPortSafety(nsIURI* uri)
 }
 
 nsresult NS_NewProxyInfo(const nsACString& type, const nsACString& host,
                          int32_t port, uint32_t flags, nsIProxyInfo** result) {
   nsresult rv;
   nsCOMPtr<nsIProtocolProxyService> pps =
       do_GetService(NS_PROTOCOLPROXYSERVICE_CONTRACTID, &rv);
   if (NS_SUCCEEDED(rv))
-    rv =
-        pps->NewProxyInfo(type, host, port, flags, UINT32_MAX, nullptr, result);
+    rv = pps->NewProxyInfo(type, host, port, EmptyCString(), EmptyCString(),
+                           flags, UINT32_MAX, nullptr, result);
   return rv;
 }
 
 nsresult NS_GetFileProtocolHandler(nsIFileProtocolHandler** result,
                                    nsIIOService* ioService /* = nullptr */) {
   nsresult rv;
   nsCOMPtr<nsIIOService> grip;
   rv = net_EnsureIOService(&ioService, grip);
@@ -2935,30 +2935,30 @@ nsresult NS_CompareLoadInfoAndLoadContex
   MOZ_ASSERT(originAttrsLoadInfo.mPrivateBrowsingId ==
                  originAttrsLoadContext.mPrivateBrowsingId,
              "The value of mPrivateBrowsingId in the loadContext and in the "
              "loadInfo are not the same!");
 
   return NS_OK;
 }
 
-nsresult NS_SetRequestBlockingReason(nsIChannel *channel, uint32_t reason) {
+nsresult NS_SetRequestBlockingReason(nsIChannel* channel, uint32_t reason) {
   NS_ENSURE_ARG(channel);
 
   nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
   return NS_SetRequestBlockingReason(loadInfo, reason);
 }
 
-nsresult NS_SetRequestBlockingReason(nsILoadInfo *loadInfo, uint32_t reason) {
+nsresult NS_SetRequestBlockingReason(nsILoadInfo* loadInfo, uint32_t reason) {
   NS_ENSURE_ARG(loadInfo);
 
   return loadInfo->SetRequestBlockingReason(reason);
 }
 
-nsresult NS_SetRequestBlockingReasonIfNull(nsILoadInfo *loadInfo,
+nsresult NS_SetRequestBlockingReasonIfNull(nsILoadInfo* loadInfo,
                                            uint32_t reason) {
   NS_ENSURE_ARG(loadInfo);
 
   uint32_t existingReason;
   if (NS_SUCCEEDED(loadInfo->GetRequestBlockingReason(&existingReason)) &&
       existingReason != nsILoadInfo::BLOCKING_REASON_NONE) {
     return NS_OK;
   }
--- a/netwerk/base/nsProtocolProxyService.cpp
+++ b/netwerk/base/nsProtocolProxyService.cpp
@@ -1596,30 +1596,34 @@ nsProtocolProxyService::AsyncResolve(nsI
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
   return AsyncResolveInternal(channel, flags, callback, result, false,
                               mainThreadEventTarget);
 }
 
 NS_IMETHODIMP
-nsProtocolProxyService::NewProxyInfo(const nsACString& aType,
-                                     const nsACString& aHost, int32_t aPort,
-                                     uint32_t aFlags, uint32_t aFailoverTimeout,
-                                     nsIProxyInfo* aFailoverProxy,
-                                     nsIProxyInfo** aResult) {
+nsProtocolProxyService::NewProxyInfo(
+    const nsACString& aType, const nsACString& aHost, int32_t aPort,
+    const nsACString& aProxyAuthorizationHeader,
+    const nsACString& aConnectionIsolationKey, uint32_t aFlags,
+    uint32_t aFailoverTimeout, nsIProxyInfo* aFailoverProxy,
+    nsIProxyInfo** aResult) {
   return NewProxyInfoWithAuth(aType, aHost, aPort, EmptyCString(),
-                              EmptyCString(), aFlags, aFailoverTimeout,
+                              EmptyCString(), aProxyAuthorizationHeader,
+                              aConnectionIsolationKey, aFlags, aFailoverTimeout,
                               aFailoverProxy, aResult);
 }
 
 NS_IMETHODIMP
 nsProtocolProxyService::NewProxyInfoWithAuth(
     const nsACString& aType, const nsACString& aHost, int32_t aPort,
-    const nsACString& aUsername, const nsACString& aPassword, uint32_t aFlags,
+    const nsACString& aUsername, const nsACString& aPassword,
+    const nsACString& aProxyAuthorizationHeader,
+    const nsACString& aConnectionIsolationKey, uint32_t aFlags,
     uint32_t aFailoverTimeout, nsIProxyInfo* aFailoverProxy,
     nsIProxyInfo** aResult) {
   static const char* types[] = {kProxyType_HTTP, kProxyType_HTTPS,
                                 kProxyType_SOCKS, kProxyType_SOCKS4,
                                 kProxyType_DIRECT};
 
   // resolve type; this allows us to avoid copying the type string into each
   // proxy info instance.  we just reference the string literals directly :)
@@ -1634,17 +1638,19 @@ nsProtocolProxyService::NewProxyInfoWith
 
   // We have only implemented username/password for SOCKS proxies.
   if ((!aUsername.IsEmpty() || !aPassword.IsEmpty()) &&
       !aType.LowerCaseEqualsASCII(kProxyType_SOCKS) &&
       !aType.LowerCaseEqualsASCII(kProxyType_SOCKS4)) {
     return NS_ERROR_NOT_IMPLEMENTED;
   }
 
-  return NewProxyInfo_Internal(type, aHost, aPort, aUsername, aPassword, aFlags,
+  return NewProxyInfo_Internal(type, aHost, aPort, aUsername, aPassword,
+                               aProxyAuthorizationHeader,
+                               aConnectionIsolationKey, aFlags,
                                aFailoverTimeout, aFailoverProxy, 0, aResult);
 }
 
 NS_IMETHODIMP
 nsProtocolProxyService::GetFailoverForProxy(nsIProxyInfo* aProxy, nsIURI* aURI,
                                             nsresult aStatus,
                                             nsIProxyInfo** aResult) {
   // We only support failover when a PAC file is configured, either
@@ -1981,17 +1987,19 @@ nsresult nsProtocolProxyService::GetProt
   if (NS_FAILED(rv)) return rv;
 
   rv = handler->GetDefaultPort(&info->defaultPort);
   return rv;
 }
 
 nsresult nsProtocolProxyService::NewProxyInfo_Internal(
     const char* aType, const nsACString& aHost, int32_t aPort,
-    const nsACString& aUsername, const nsACString& aPassword, uint32_t aFlags,
+    const nsACString& aUsername, const nsACString& aPassword,
+    const nsACString& aProxyAuthorizationHeader,
+    const nsACString& aConnectionIsolationKey, uint32_t aFlags,
     uint32_t aFailoverTimeout, nsIProxyInfo* aFailoverProxy,
     uint32_t aResolveFlags, nsIProxyInfo** aResult) {
   if (aPort <= 0) aPort = -1;
 
   nsCOMPtr<nsProxyInfo> failover;
   if (aFailoverProxy) {
     failover = do_QueryInterface(aFailoverProxy);
     NS_ENSURE_ARG(failover);
@@ -2004,16 +2012,18 @@ nsresult nsProtocolProxyService::NewProx
   proxyInfo->mHost = aHost;
   proxyInfo->mPort = aPort;
   proxyInfo->mUsername = aUsername;
   proxyInfo->mPassword = aPassword;
   proxyInfo->mFlags = aFlags;
   proxyInfo->mResolveFlags = aResolveFlags;
   proxyInfo->mTimeout =
       aFailoverTimeout == UINT32_MAX ? mFailedProxyTimeout : aFailoverTimeout;
+  proxyInfo->mProxyAuthorizationHeader = aProxyAuthorizationHeader;
+  proxyInfo->mConnectionIsolationKey = aConnectionIsolationKey;
   failover.swap(proxyInfo->mNext);
 
   NS_ADDREF(*aResult = proxyInfo);
   return NS_OK;
 }
 
 nsresult nsProtocolProxyService::Resolve_Internal(nsIChannel* channel,
                                                   const nsProtocolInfo& info,
@@ -2170,19 +2180,19 @@ nsresult nsProtocolProxyService::Resolve
     else
       type = kProxyType_SOCKS;
     port = mSOCKSProxyPort;
     if (mSOCKSProxyRemoteDNS)
       proxyFlags |= nsIProxyInfo::TRANSPARENT_PROXY_RESOLVES_HOST;
   }
 
   if (type) {
-    rv =
-        NewProxyInfo_Internal(type, *host, port, EmptyCString(), EmptyCString(),
-                              proxyFlags, UINT32_MAX, nullptr, flags, result);
+    rv = NewProxyInfo_Internal(type, *host, port, EmptyCString(),
+                               EmptyCString(), EmptyCString(), EmptyCString(),
+                               proxyFlags, UINT32_MAX, nullptr, flags, result);
     if (NS_FAILED(rv)) return rv;
   }
 
   return NS_OK;
 }
 
 void nsProtocolProxyService::MaybeDisableDNSPrefetch(nsIProxyInfo* aProxy) {
   // Disable Prefetch in the DNS service if a proxy is in use.
--- a/netwerk/base/nsProtocolProxyService.h
+++ b/netwerk/base/nsProtocolProxyService.h
@@ -210,19 +210,22 @@ class nsProtocolProxyService final : pub
    *        The next proxy to try if this one fails.
    * @param aResolveFlags
    *        The flags passed to resolve (from nsIProtocolProxyService).
    * @param result
    *        The resulting nsIProxyInfo object.
    */
   nsresult NewProxyInfo_Internal(const char* type, const nsACString& host,
                                  int32_t port, const nsACString& username,
-                                 const nsACString& password, uint32_t flags,
-                                 uint32_t timeout, nsIProxyInfo* next,
-                                 uint32_t aResolveFlags, nsIProxyInfo** result);
+                                 const nsACString& password,
+                                 const nsACString& aProxyAuthorizationHeader,
+                                 const nsACString& aConnectionIsolationKey,
+                                 uint32_t flags, uint32_t timeout,
+                                 nsIProxyInfo* next, uint32_t aResolveFlags,
+                                 nsIProxyInfo** result);
 
   /**
    * This method is an internal version of Resolve that does not query PAC.
    * It performs all of the built-in processing, and reports back to the
    * caller with either the proxy info result or a flag to instruct the
    * caller to use PAC instead.
    *
    * @param channel
--- a/netwerk/base/nsProxyInfo.cpp
+++ b/netwerk/base/nsProxyInfo.cpp
@@ -51,16 +51,28 @@ nsProxyInfo::GetUsername(nsACString& res
 
 NS_IMETHODIMP
 nsProxyInfo::GetPassword(nsACString& result) {
   result = mPassword;
   return NS_OK;
 }
 
 NS_IMETHODIMP
+nsProxyInfo::GetProxyAuthorizationHeader(nsACString& result) {
+  result = mProxyAuthorizationHeader;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProxyInfo::GetConnectionIsolationKey(nsACString& result) {
+  result = mConnectionIsolationKey;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
 nsProxyInfo::GetFailoverTimeout(uint32_t* result) {
   *result = mTimeout;
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsProxyInfo::GetFailoverProxy(nsIProxyInfo** result) {
   NS_IF_ADDREF(*result = mNext);
--- a/netwerk/base/nsProxyInfo.h
+++ b/netwerk/base/nsProxyInfo.h
@@ -27,22 +27,28 @@ namespace net {
 class nsProxyInfo final : public nsIProxyInfo {
  public:
   NS_DECLARE_STATIC_IID_ACCESSOR(NS_PROXYINFO_IID)
 
   NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSIPROXYINFO
 
   // Cheap accessors for use within Necko
-  const nsCString& Host() { return mHost; }
-  int32_t Port() { return mPort; }
-  const char* Type() { return mType; }
-  uint32_t Flags() { return mFlags; }
-  const nsCString& Username() { return mUsername; }
-  const nsCString& Password() { return mPassword; }
+  const nsCString& Host() const { return mHost; }
+  int32_t Port() const { return mPort; }
+  const char* Type() const { return mType; }
+  uint32_t Flags() const { return mFlags; }
+  const nsCString& Username() const { return mUsername; }
+  const nsCString& Password() const { return mPassword; }
+  const nsCString& ProxyAuthorizationHeader() const {
+    return mProxyAuthorizationHeader;
+  }
+  const nsCString& ConnectionIsolationKey() const {
+    return mConnectionIsolationKey;
+  }
 
   bool IsDirect();
   bool IsHTTP();
   bool IsHTTPS();
   bool IsSOCKS();
 
  private:
   friend class nsProtocolProxyService;
@@ -56,16 +62,18 @@ class nsProxyInfo final : public nsIProx
         mNext(nullptr) {}
 
   ~nsProxyInfo() { NS_IF_RELEASE(mNext); }
 
   const char* mType;  // pointer to statically allocated value
   nsCString mHost;
   nsCString mUsername;
   nsCString mPassword;
+  nsCString mProxyAuthorizationHeader;
+  nsCString mConnectionIsolationKey;
   int32_t mPort;
   uint32_t mFlags;
   uint32_t mResolveFlags;
   uint32_t mTimeout;
   nsProxyInfo* mNext;
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsProxyInfo, NS_PROXYINFO_IID)
--- a/netwerk/protocol/http/nsHttpChannelAuthProvider.cpp
+++ b/netwerk/protocol/http/nsHttpChannelAuthProvider.cpp
@@ -1542,16 +1542,25 @@ void nsHttpChannelAuthProvider::SetAutho
   // set informations that depend on whether
   // we're authenticating against a proxy
   // or a webserver
   nsISupports** continuationState;
 
   nsAutoCString suffix;
   if (header == nsHttp::Proxy_Authorization) {
     continuationState = &mProxyAuthContinuationState;
+
+    if (mProxyInfo) {
+      // Let this be overriden by anything from the cache.
+      auto const& pa = mProxyInfo->ProxyAuthorizationHeader();
+      if (!pa.IsEmpty()) {
+        rv = mAuthChannel->SetProxyCredentials(pa);
+        MOZ_ASSERT(NS_SUCCEEDED(rv));
+      }
+    }
   } else {
     continuationState = &mAuthContinuationState;
 
     nsCOMPtr<nsIChannel> chan = do_QueryInterface(mAuthChannel);
     GetOriginAttributesSuffix(chan, suffix);
   }
 
   rv = authCache->GetAuthEntryForPath(scheme, host, port, path, suffix, &entry);
--- a/netwerk/protocol/http/nsHttpConnectionInfo.cpp
+++ b/netwerk/protocol/http/nsHttpConnectionInfo.cpp
@@ -247,16 +247,26 @@ void nsHttpConnectionInfo::BuildHashKey(
   if (mIsolated && !mTopWindowOrigin.IsEmpty()) {
     mHashKey.Append('{');
     mHashKey.Append('{');
     mHashKey.Append(mTopWindowOrigin);
     mHashKey.Append('}');
     mHashKey.Append('}');
   }
 
+  if (mProxyInfo) {
+    const nsCString& connectionIsolationKey =
+        mProxyInfo->ConnectionIsolationKey();
+    if (!connectionIsolationKey.IsEmpty()) {
+      mHashKey.AppendLiteral("{CIK ");
+      mHashKey.Append(connectionIsolationKey);
+      mHashKey.AppendLiteral("}");
+    }
+  }
+
   nsAutoCString originAttributes;
   mOriginAttributes.CreateSuffix(originAttributes);
   mHashKey.Append(originAttributes);
 }
 
 void nsHttpConnectionInfo::SetOriginServer(const nsACString& host,
                                            int32_t port) {
   mOrigin = host;
--- a/netwerk/protocol/http/nsHttpConnectionInfo.h
+++ b/netwerk/protocol/http/nsHttpConnectionInfo.h
@@ -86,16 +86,23 @@ class nsHttpConnectionInfo final : publi
   }
   const char* ProxyUsername() const {
     return mProxyInfo ? mProxyInfo->Username().get() : nullptr;
   }
   const char* ProxyPassword() const {
     return mProxyInfo ? mProxyInfo->Password().get() : nullptr;
   }
 
+  const nsCString& ProxyAuthorizationHeader() const {
+    return mProxyInfo ? mProxyInfo->ProxyAuthorizationHeader() : EmptyCString();
+  }
+  const nsCString& ConnectionIsolationKey() const {
+    return mProxyInfo ? mProxyInfo->ConnectionIsolationKey() : EmptyCString();
+  }
+
   // Compare this connection info to another...
   // Two connections are 'equal' if they end up talking the same
   // protocol to the same server. This is needed to properly manage
   // persistent connections to proxies
   // Note that we don't care about transparent proxies -
   // it doesn't matter if we're talking via socks or not, since
   // a request will end up at the same host.
   bool Equals(const nsHttpConnectionInfo* info) {
--- a/netwerk/test/httpserver/httpd.js
+++ b/netwerk/test/httpserver/httpd.js
@@ -1596,18 +1596,25 @@ RequestReader.prototype =
         throw new Error("unsupported HTTP version");
     } catch (e) {
       // we support HTTP/1.0 and HTTP/1.1 only
       throw HTTP_501;
     }
 
 
     var fullPath = request[1];
+
+    if (metadata._method == "CONNECT") {
+      metadata._path = "CONNECT";
+      metadata._scheme = "https";
+      [metadata._host, metadata._port] = fullPath.split(":");
+      return;
+    }
+
     var serverIdentity = this._connection.server.identity;
-
     var scheme, host, port;
 
     if (fullPath.charAt(0) != "/") {
       // No absolute paths in the request line in HTTP prior to 1.1
       if (!metadata._httpVersion.atLeast(nsHttpVersion.HTTP_1_1)) {
         dumpn("*** Metadata version too low");
         throw HTTP_400;
       }
@@ -2263,17 +2270,17 @@ ServerHandler.prototype =
       };
   },
 
   //
   // see nsIHttpServer.registerPathHandler
   //
   registerPathHandler(path, handler) {
     // XXX true path validation!
-    if (path.charAt(0) != "/")
+    if (path.charAt(0) != "/" && path != "CONNECT")
       throw Components.Exception("", Cr.NS_ERROR_INVALID_ARG);
 
     this._handlerToField(handler, this._overridePaths, path);
   },
 
   //
   // see nsIHttpServer.registerPrefixHandler
   //
--- a/netwerk/test/unit/socks_client_subprocess.js
+++ b/netwerk/test/unit/socks_client_subprocess.js
@@ -10,17 +10,17 @@ var sts = Cc["@mozilla.org/network/socke
 
 function launchConnection(socks_vers, socks_port, dest_host, dest_port, dns)
 {
   var pi_flags = 0;
   if (dns == 'remote')
     pi_flags = Ci.nsIProxyInfo.TRANSPARENT_PROXY_RESOLVES_HOST;
   
   var pps = new ProtocolProxyService();
-  var pi = pps.newProxyInfo(socks_vers, 'localhost', socks_port,
+  var pi = pps.newProxyInfo(socks_vers, 'localhost', socks_port, '', '',
           pi_flags, -1, null);
   var trans = sts.createTransport(null, 0, dest_host, dest_port, pi);
   var input = trans.openInputStream(Ci.nsITransport.OPEN_BLOCKING,0,0);
   var output = trans.openOutputStream(Ci.nsITransport.OPEN_BLOCKING,0,0);
   var bin = new BinaryInputStream(input);
   var data = bin.readBytes(5);
   if (data == 'PING!') {
     print('client: got ping, sending pong.');
--- a/netwerk/test/unit/test_protocolproxyservice-async-filters.js
+++ b/netwerk/test/unit/test_protocolproxyservice-async-filters.js
@@ -102,17 +102,17 @@ TestFilter.prototype = {
 
   QueryInterface: ChromeUtils.generateQI([Ci.nsIProtocolProxyFilter]),
 
   applyFilter: function(pps, uri, pi, cb) {
     if (this._result == THROW) {
       throw Cr.NS_ERROR_FAILURE;
     }
 
-    var pi_tail = pps.newProxyInfo(this._type, this._host, this._port,
+    var pi_tail = pps.newProxyInfo(this._type, this._host, this._port, "", "",
                                    this._flags, this._timeout, null);
     if (pi)
       pi.failoverProxy = pi_tail;
     else
       pi = pi_tail;
 
     if (this._result == ASYNC) {
       executeSoon(() => { cb.onProxyFilterResult(pi) });
--- a/netwerk/test/unit/test_protocolproxyservice.js
+++ b/netwerk/test/unit/test_protocolproxyservice.js
@@ -100,44 +100,44 @@ function TestFilter(type, host, port, fl
 TestFilter.prototype = {
   _type: "",
   _host: "",
   _port: -1,
   _flags: 0,
   _timeout: 0,
   QueryInterface: ChromeUtils.generateQI([Ci.nsIProtocolProxyFilter]),
   applyFilter: function(pps, uri, pi, cb) {
-    var pi_tail = pps.newProxyInfo(this._type, this._host, this._port,
+    var pi_tail = pps.newProxyInfo(this._type, this._host, this._port, "", "",
                                    this._flags, this._timeout, null);
     if (pi)
       pi.failoverProxy = pi_tail;
     else
       pi = pi_tail;
     cb.onProxyFilterResult(pi);
   }
 };
 
 function BasicFilter() {}
 BasicFilter.prototype = {
   QueryInterface: ChromeUtils.generateQI([Ci.nsIProtocolProxyFilter]),
   applyFilter: function(pps, uri, pi, cb) {
     cb.onProxyFilterResult(
-      pps.newProxyInfo("http", "localhost", 8080, 0, 10,
-      pps.newProxyInfo("direct", "", -1, 0, 0, null))
+      pps.newProxyInfo("http", "localhost", 8080, "", "", 0, 10,
+      pps.newProxyInfo("direct", "", -1, "", "", 0, 0, null))
     );
   }
 };
 
 function BasicChannelFilter() {}
 BasicChannelFilter.prototype = {
   QueryInterface: ChromeUtils.generateQI([Ci.nsIProtocolProxyChannelFilter]),
   applyFilter: function(pps, channel, pi, cb) {
     cb.onProxyFilterResult(
-      pps.newProxyInfo("http", channel.URI.host, 7777, 0, 10,
-      pps.newProxyInfo("direct", "", -1, 0, 0, null))
+      pps.newProxyInfo("http", channel.URI.host, 7777, "", "", 0, 10,
+      pps.newProxyInfo("direct", "", -1, "", "", 0, 0, null))
     );
   }
 };
 
 function resolveCallback() { }
 resolveCallback.prototype = {
   nextFunction: null,
 
new file mode 100644
--- /dev/null
+++ b/netwerk/test/unit/test_proxy-authorization-via-proxyinfo.js
@@ -0,0 +1,72 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+// This test checks that the proxy-auth header is propagated to the CONNECT request when
+// set on a proxy-info object via a proxy filter
+
+const { HttpServer } = ChromeUtils.import("resource://testing-common/httpd.js");
+const pps = Cc["@mozilla.org/network/protocol-proxy-service;1"].getService();
+
+class TestFilter {
+  constructor(type, host, port, flags, auth) {
+    this._type = type;
+    this._host = host;
+    this._port = port;
+    this._flags = flags;
+    this._auth = auth;
+    this.QueryInterface = ChromeUtils.generateQI([Ci.nsIProtocolProxyFilter]);
+  }
+
+  applyFilter(pps, uri, pi, cb) {
+    cb.onProxyFilterResult(pps.newProxyInfo(
+      this._type, this._host, this._port,
+      this._auth, "", this._flags, 1000, null));
+  }
+};
+
+let httpServer = null;
+let port;
+let connectProcessesed = false;
+const proxyAuthHeader = 'proxy-auth-header-value';
+
+function make_channel(url) {
+  return NetUtil.newChannel({
+    uri: url,
+    loadUsingSystemPrincipal: true
+  });
+}
+
+function connect_handler(request, response)
+{
+  Assert.equal(request.method, "CONNECT");
+  Assert.ok(request.hasHeader("Proxy-Authorization"));
+  Assert.equal(request.getHeader("Proxy-Authorization"), proxyAuthHeader);
+
+  // Just refuse to connect, we have what we need now.
+  response.setStatusLine(request.httpVersion, 500, "STOP");
+  connectProcessesed = true;
+}
+
+function finish_test()
+{
+  Assert.ok(connectProcessesed);
+  httpServer.stop(do_test_finished);
+}
+
+function run_test()
+{
+  httpServer = new HttpServer();
+  httpServer.identity.add("https", "mozilla.org", 443);
+  httpServer.registerPathHandler("CONNECT", connect_handler);
+  httpServer.start(-1);
+  port = httpServer.identity.primaryPort;
+
+  pps.registerFilter(new TestFilter("http", "localhost", port, 0, proxyAuthHeader), 10);
+
+  let chan = make_channel("https://mozilla.org/");
+  chan.asyncOpen(new ChannelListener(finish_test, null, CL_EXPECT_FAILURE));
+  do_test_pending();
+}
--- a/netwerk/test/unit/test_speculative_connect.js
+++ b/netwerk/test/unit/test_speculative_connect.js
@@ -240,17 +240,17 @@ function test_proxies(proxyHost, next) {
     info("Proxy: " + proxyHost);
     var sts = Cc["@mozilla.org/network/socket-transport-service;1"]
               .getService(Ci.nsISocketTransportService);
     Assert.notEqual(typeof(sts), undefined);
     var pps = Cc["@mozilla.org/network/protocol-proxy-service;1"]
               .getService();
     Assert.notEqual(typeof(pps), undefined);
 
-    var proxyInfo = pps.newProxyInfo("http", proxyHost, 8080, 0, 1, null);
+    var proxyInfo = pps.newProxyInfo("http", proxyHost, 8080, "", "", 0, 1, null);
     Assert.notEqual(typeof(proxyInfo), undefined);
 
     var transport = sts.createTransport(null, 0, "dummyHost", 80, proxyInfo);
     Assert.notEqual(typeof(transport), undefined);
 
     transport.connectionFlags = Ci.nsISocketTransport.DISABLE_RFC1918;
 
     transport.setTimeout(Ci.nsISocketTransport.TIMEOUT_CONNECT, 1);
--- a/netwerk/test/unit/xpcshell.ini
+++ b/netwerk/test/unit/xpcshell.ini
@@ -446,8 +446,9 @@ skip-if = os == "android"
 [test_network_connectivity_service.js]
 skip-if = os == "android" # DNSv6 issues on android
 [test_suspend_channel_on_authRetry.js]
 [test_suspend_channel_on_examine_merged_response.js]
 [test_bug1527293.js]
 [test_stale-while-revalidate_negative.js]
 [test_stale-while-revalidate_positive.js]
 [test_stale-while-revalidate_max-age-0.js]
+[test_proxy-authorization-via-proxyinfo.js]
--- a/netwerk/url-classifier/UrlClassifierFeatureCryptominingAnnotation.cpp
+++ b/netwerk/url-classifier/UrlClassifierFeatureCryptominingAnnotation.cpp
@@ -142,16 +142,18 @@ UrlClassifierFeatureCryptominingAnnotati
            nsIHttpChannel::ClassificationFlags::
                CLASSIFIED_CRYPTOMINING_CONTENT},
       };
 
   uint32_t flags = UrlClassifierCommon::TablesToClassificationFlags(
       aList, sClassificationData,
       nsIHttpChannel::ClassificationFlags::CLASSIFIED_CRYPTOMINING);
 
+  UrlClassifierCommon::SetTrackingInfo(aChannel, aList, aHashes);
+
   UrlClassifierCommon::AnnotateChannel(
       aChannel, AntiTrackingCommon::eCryptomining, flags,
       nsIWebProgressListener::STATE_LOADED_CRYPTOMINING_CONTENT);
   return NS_OK;
 }
 
 NS_IMETHODIMP
 UrlClassifierFeatureCryptominingAnnotation::GetURIByListType(
--- a/netwerk/url-classifier/UrlClassifierFeatureFingerprintingAnnotation.cpp
+++ b/netwerk/url-classifier/UrlClassifierFeatureFingerprintingAnnotation.cpp
@@ -144,16 +144,18 @@ UrlClassifierFeatureFingerprintingAnnota
            nsIHttpChannel::ClassificationFlags::
                CLASSIFIED_FINGERPRINTING_CONTENT},
       };
 
   uint32_t flags = UrlClassifierCommon::TablesToClassificationFlags(
       aList, sClassificationData,
       nsIHttpChannel::ClassificationFlags::CLASSIFIED_FINGERPRINTING);
 
+  UrlClassifierCommon::SetTrackingInfo(aChannel, aList, aHashes);
+
   UrlClassifierCommon::AnnotateChannel(
       aChannel, AntiTrackingCommon::eFingerprinting, flags,
       nsIWebProgressListener::STATE_LOADED_FINGERPRINTING_CONTENT);
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
--- a/security/manager/ssl/StaticHPKPins.h
+++ b/security/manager/ssl/StaticHPKPins.h
@@ -999,16 +999,17 @@ static const TransportSecurityPreload kP
   { "goto.google.com", true, false, false, -1, &kPinset_google_root_pems },
   { "gr.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
   { "groups.google.com", true, false, false, -1, &kPinset_google_root_pems },
   { "gstatic.cn", true, false, false, -1, &kPinset_google_root_pems },
   { "gstatic.com", true, false, false, -1, &kPinset_google_root_pems },
   { "gvt1.com", true, false, false, -1, &kPinset_google_root_pems },
   { "gvt2.com", true, false, false, -1, &kPinset_google_root_pems },
   { "gvt3.com", true, false, false, -1, &kPinset_google_root_pems },
+  { "hangout", true, false, false, -1, &kPinset_google_root_pems },
   { "hangouts.google.com", true, false, false, -1, &kPinset_google_root_pems },
   { "history.google.com", true, false, false, -1, &kPinset_google_root_pems },
   { "hk.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
   { "hn.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
   { "hostedtalkgadget.google.com", true, false, false, -1, &kPinset_google_root_pems },
   { "hu.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
   { "id.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
   { "ie.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
@@ -1143,13 +1144,13 @@ static const TransportSecurityPreload kP
   { "youtu.be", true, false, false, -1, &kPinset_google_root_pems },
   { "youtube-nocookie.com", true, false, false, -1, &kPinset_google_root_pems },
   { "youtube.com", true, false, false, -1, &kPinset_google_root_pems },
   { "ytimg.com", true, false, false, -1, &kPinset_google_root_pems },
   { "za.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
   { "zh.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
 };
 
-// Pinning Preload List Length = 485;
+// Pinning Preload List Length = 486;
 
 static const int32_t kUnknownId = -1;
 
-static const PRTime kPreloadPKPinsExpirationTime = INT64_C(1565267271924000);
+static const PRTime kPreloadPKPinsExpirationTime = INT64_C(1565612900901000);
--- a/security/manager/ssl/nsSTSPreloadList.inc
+++ b/security/manager/ssl/nsSTSPreloadList.inc
@@ -3,17 +3,17 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 /*****************************************************************************/
 /* This is an automatically generated file. If you're not                    */
 /* nsSiteSecurityService.cpp, you shouldn't be #including it.                */
 /*****************************************************************************/
 
 #include <stdint.h>
-const PRTime gPreloadListExpirationTime = INT64_C(1567686452072000);
+const PRTime gPreloadListExpirationTime = INT64_C(1568032095032000);
 %%
 0-1.party, 1
 00100010.net, 1
 0010100.net, 1
 00120012.net, 1
 00130013.net, 1
 00140014.net, 1
 00150015.net, 1
@@ -31,16 +31,17 @@ 00550055.net, 1
 005555.xyz, 1
 00660066.net, 1
 00770077.net, 1
 007kf.com, 1
 008207.com, 1
 008251.com, 1
 008253.com, 1
 008271.com, 1
+0086286.com, 1
 00880088.net, 1
 00990099.net, 1
 009p.com, 1
 00d88.com, 1
 00dani.me, 1
 00f.net, 1
 00wbf.com, 1
 01-edu.org, 1
@@ -352,16 +353,17 @@ 127663.com, 1
 127665.com, 1
 1288366.com, 1
 1288fc.com, 1
 12autoankauf-berlin.de, 1
 12gotovo.com, 1
 12thmanrising.com, 1
 12train.com, 1
 12vpn.net, 1
+130.ua, 1
 130032.com, 1
 130212.com, 1
 130232.com, 1
 130497.xyz, 1
 131934.com, 1
 131954.com, 1
 131ks.net, 1
 13214.cc, 1
@@ -999,23 +1001,21 @@ 4baby.com.br, 1
 4c-haircare.com, 1
 4d2.xyz, 1
 4dbygg.se, 1
 4eyes.ch, 1
 4fit.ro, 1
 4flex.info, 1
 4freepress.com, 1
 4g-server.eu, 0
-4garage.com.br, 1
 4gnews.pt, 1
 4hmediaproductions.com, 1
 4host.ch, 1
 4kprojektory.cz, 1
 4loc.us, 1
-4lock.com.br, 1
 4mm.org, 1
 4monar.com, 1
 4o5.xyz, 1
 4plebs.moe, 1
 4project.co.il, 1
 4share.tv, 1
 4sics.se, 1
 4smart.house, 1
@@ -1507,16 +1507,17 @@ 8035d88.com, 1
 8036d88.com, 1
 8037d88.com, 1
 804322.com, 1
 80780780.com, 1
 8078d.com, 1
 8080883.com, 1
 8080889.com, 1
 8081d.com, 1
+8086.cf, 1
 80883.cc, 1
 80887.cc, 1
 808phone.net, 1
 809088.cc, 1
 8092d88.com, 1
 809422.com, 1
 80993.net, 1
 80bin.com, 1
@@ -1563,17 +1564,16 @@ 8522club.com, 1
 8522hk.com, 1
 8522ph.com, 1
 8522top.com, 1
 8522tw.com, 1
 8522usa.com, 1
 85383838.com, 0
 8560.be, 1
 85kb88.com, 1
-86286286.com, 1
 8649955.com, 1
 8649966.com, 1
 8649977.com, 1
 8688fc.com, 1
 86kb88.com, 1
 86metro.ru, 1
 8722.am, 1
 8722am.com, 1
@@ -1878,47 +1878,44 @@ a7m2.me, 1
 a8q.org, 1
 aa-tour.ru, 1
 aa43d.cn, 1
 aa6688.net, 1
 aaa-racing.com, 1
 aaa-racing.net, 1
 aaa-racing.uk, 1
 aaapl.com, 1
-aabanet.com.br, 1
 aaben-bank.dk, 1
 aabenbank.dk, 1
 aacfree.com, 1
 aacs-design.com, 1
 aadw.de, 1
 aaex.cloud, 1
 aagetransport.no, 1
 aalalbayt.com, 1
 aalalbayt.net, 1
 aalstmotors-usedcars.be, 1
 aaltocapital.com, 1
 aamwa.com, 1
-aanbieders.ga, 1
 aandeautobody.com, 1
 aandkevents.co.uk, 1
 aanmpc.com, 1
 aaomidi.com, 1
 aapar.nl, 1
 aapas.org.ar, 1
 aarailfan.com, 1
 aariefhaafiz.com, 1
 aarklendoia.com, 1
 aarkue.eu, 1
 aaron.xin, 1
 aaronfurtado.com, 1
 aaronhorler.com, 1
 aaronhorler.com.au, 1
 aaronkimmig.de, 1
 aaronroyle.com, 1
-aaronsilber.me, 1
 aarvinproperties.com, 1
 aatf.us, 1
 aati.be, 1
 aati.info, 1
 aattrans.com, 1
 aavienna.com, 1
 ab-photography.nl, 1
 ab288.com, 1
@@ -2034,17 +2031,16 @@ aboutyou.at, 1
 aboutyou.be, 1
 aboutyou.ch, 1
 aboutyou.de, 1
 aboutyou.nl, 1
 aboveaverageplumbing.com, 1
 abox-kb.com, 1
 abpis.hr, 1
 abracadabra.co.jp, 0
-abrakidabra.com.br, 1
 abraxan.pro, 1
 abrilect.com, 1
 abristolgeek.co.uk, 1
 abseits.org, 1
 absolem.cc, 0
 absolutcruceros.com, 1
 absoluteautobody.com, 1
 absolutedouble.co.uk, 1
@@ -2080,18 +2076,18 @@ ac0g.dyndns.org, 1
 aca-creative.co.uk, 1
 academiadebomberosonline.com, 1
 academicexperts.us, 1
 academichealthscience.net, 1
 academie-de-police.ch, 1
 academkin.com, 1
 academus.io, 1
 academytv.com.au, 1
+acadianapatios.com, 1
 acaeum.com, 1
-acampar.com.br, 1
 acandroid.top, 1
 acaonegocios.com.br, 1
 acaptureservices.com, 1
 acara-yoga.de, 1
 acareer.in, 1
 acat.io, 1
 acbrussels-used.be, 1
 accbay.com, 1
@@ -2138,17 +2134,16 @@ acecolleges.edu.au, 1
 acefreightco.com, 1
 aceinflatables.com, 1
 aceinstituteonline.com, 1
 acelpb.com, 1
 acem.org.au, 1
 acemobileforce.com, 1
 acemypaper.com, 1
 acen.eu, 1
-acendealuz.com.br, 1
 acerentalandsales.com, 1
 acerislaw.com, 1
 acessoeducacao.com, 1
 acfun.eu.org, 1
 acg.mn, 1
 acg.social, 1
 acgaudio.com, 1
 acgmoon.com, 1
@@ -2571,17 +2566,16 @@ aerobotz.com, 1
 aeronautix.com, 1
 aeronote.net, 1
 aeropole.de, 1
 aeropole.eu, 1
 aerosimexperience.com, 1
 aerospace-schools.com, 1
 aerotechcoatings.com, 1
 aertel.ie, 1
-aessencia.com.br, 1
 aestheticdr.org, 1
 aestheticsplus.xyz, 1
 aesthetx.com, 1
 aestore.by, 1
 aesym.de, 1
 aeternus.tech, 1
 aetherc0r3.eu, 1
 aethonan.pro, 1
@@ -2610,17 +2604,16 @@ affissioni.roma.it, 1
 affittacamere.roma.it, 1
 affittialmare.it, 1
 affittisalento.it, 1
 affloc.com, 1
 affordableazdivorce.com, 1
 affordableblindsexpress.com, 1
 affordableenvironmental.net, 1
 affordablehealthquotesforyou.com, 1
-affordablekilimanjaro.com, 1
 affordablemudjacking.com, 1
 affordablepapers.com, 1
 affordableracingparts.com.au, 1
 affpass.com, 1
 affping.com, 1
 affvps.net, 1
 afghan.dating, 1
 afgn.com.ua, 1
@@ -2703,16 +2696,17 @@ aging.gov, 1
 agingstats.gov, 1
 agingstop.net, 1
 aginion.net, 1
 agiserv.fr, 1
 agks5.com, 1
 agks998.com, 1
 agliamici.it, 1
 agnesk.blog, 1
+agoodmind.com, 1
 agoravm.tk, 1
 agoravox.fr, 1
 agoravox.it, 1
 agoravox.tv, 1
 agotnes.com, 1
 agouraelectrical.com, 1
 agouraelectrician.com, 1
 agouraexteriorlighting.com, 1
@@ -2721,17 +2715,16 @@ agourahillselectrical.com, 1
 agourahillselectrician.com, 1
 agourahillsexteriorlighting.com, 1
 agourahillslandscapelighting.com, 1
 agourahillslighting.com, 1
 agourahillsoutdoorlighting.com, 1
 agouralandscapelighting.com, 1
 agouralighting.com, 1
 agouraoutdoorlighting.com, 1
-agowa338.de, 1
 agpideas.com, 1
 agr.asia, 1
 agrajag.nl, 1
 agrarking.com, 1
 agrarking.de, 1
 agrarshop4u.de, 1
 agrekov.ru, 1
 agreor.com, 1
@@ -2750,16 +2743,17 @@ agscinemas.com, 1
 agscinemasapp.com, 1
 aguijara.com, 1
 agung-furniture.com, 1
 agwa.name, 1
 agy.cl, 1
 ahawkesrealtors.com, 1
 ahcpr.gov, 0
 ahd.com, 0
+ahegao.ca, 1
 aheng.me, 1
 ahero4all.org, 1
 ahkubiak.ovh, 0
 ahlaejaba.com, 1
 ahlz.sk, 1
 ahmad.works, 1
 ahmadly.com, 1
 ahmd.io, 1
@@ -3078,17 +3072,16 @@ alainfrancois.nl, 1
 alainmargot.ch, 1
 alainodea.com, 1
 alainwolf.ch, 1
 alainwolf.net, 1
 alair.cn, 0
 alamancetv.com, 1
 alamgir.works, 1
 alanberger.me.uk, 1
-alandoyle.com, 1
 alanhua.ng, 1
 alanhuang.name, 1
 alaninkenya.org, 1
 alaricfavier.eu, 0
 alarmat.pl, 1
 alarmcomplete.co.uk, 1
 alarna.de, 1
 alasdelalma.com.co, 1
@@ -3119,17 +3112,16 @@ alcatelonetouch.us, 1
 alchimic.ch, 1
 alcnutrition.com, 1
 alco-united.com, 1
 alcoholapi.com, 1
 alcolecapital.com, 1
 alcorao.org, 1
 alcouponest.com, 1
 aldiabcs.com, 1
-aldien.com.br, 1
 aldo-vandini.de, 1
 aldomedia.com, 1
 aldorr.net, 0
 aldous-huxley.com, 1
 aleax.me, 1
 alecel.de, 1
 alecpap.com, 1
 alecpapierniak.com, 1
@@ -3141,17 +3133,16 @@ alela.fr, 1
 aleph.land, 1
 alerbon.net, 1
 alertboxx.com, 1
 alertonline.nl, 1
 alerts.sg, 1
 alertwire.com, 1
 alesia-formation.fr, 1
 alessandro.pw, 1
-alessandroonline.com.br, 1
 alessandrotravel.com, 1
 aletm.it, 1
 alex-ross.co.uk, 1
 alex4386.us, 1
 alex97000.de, 1
 alexander-beck.eu, 1
 alexanderb.info, 1
 alexanderneng.de, 1
@@ -3244,17 +3235,16 @@ alicestudio.it, 1
 alicetone.net, 1
 alicialab.org, 1
 alieke.design, 1
 alien6.com, 1
 alienation.biz, 1
 alienflight.com, 1
 alienslab.net, 1
 alienstat.com, 1
-alienvision.com.br, 1
 alighierirescaldina.it, 1
 alignrs.com, 1
 aliim.gdn, 1
 alijammusic.com, 0
 alikulov.me, 1
 alilialili.ga, 1
 alinasmusicstudio.com, 1
 alinbu.net, 1
@@ -3521,17 +3511,16 @@ alvicom.hu, 1
 alvin.cool, 1
 alvn.ga, 1
 alvosec.com, 1
 alwaysdry.com.au, 1
 alwayslookingyourbest.com, 1
 alwaysmine.fi, 1
 alwaysonssl.com, 1
 alxlegal.com, 1
-alxpresentes.com.br, 1
 alxu.ca, 1
 alyoung.com, 1
 alza.at, 1
 alza.co.uk, 1
 alza.cz, 1
 alza.de, 1
 alza.hu, 1
 alza.sk, 1
@@ -3869,16 +3858,17 @@ andronika.net, 0
 androticsdirect.com, 1
 andruvision.cz, 1
 andsat.org, 1
 andschwa.com, 1
 anduril.de, 1
 anduril.eu, 1
 andybrett.com, 1
 andyc.cc, 1
+andycraftz.eu, 1
 andycrockett.io, 1
 andys-place.co.uk, 1
 andyt.eu, 1
 andzia.art.pl, 1
 anecuni-club.com, 1
 anecuni-rec.com, 1
 anedot-sandbox.com, 1
 anedot.com, 1
@@ -3978,17 +3968,16 @@ ankiweb.net, 1
 ankwanoma.com, 1
 ankya9.com, 1
 anleitung-deutsch-lernen.de, 1
 anleitung-zum-flechten.de, 1
 anleitung-zum-haekeln.de, 1
 anleitung-zum-schreiben.de, 1
 anleitung-zum-schweissen.de, 1
 anleitung-zum-toepfern.de, 1
-anlovegeek.net, 1
 anlp.top, 1
 anna.info, 1
 annaenemma.nl, 1
 annafiore.com.br, 1
 annalitvinova.pro, 1
 annangela.moe, 1
 annarokina.com, 1
 annawagner.pl, 1
@@ -4113,17 +4102,16 @@ antonchen.com, 1
 antonellabb.eu, 1
 antonin.one, 1
 antonio-gartenbau.de, 1
 antonjuulnaber.dk, 1
 antonok.com, 1
 antota.lt, 1
 antragsgruen.de, 1
 antraxx.ee, 1
-antroposofica.com.br, 1
 anttitenhunen.com, 1
 antvklik.com, 1
 antyblokada.pl, 1
 anulowano.pl, 1
 anvartay.com, 0
 anvorte.com, 0
 anwalt.us, 1
 anwaltsindex.com, 1
@@ -4220,17 +4208,16 @@ apio.systems, 1
 apiplus.fr, 1
 apis.blue, 1
 apis.google.com, 1
 apis.moe, 1
 apisyouwonthate.com, 1
 apiu.me, 1
 apk.li, 1
 apk4fun.com, 1
-apkmod.id, 1
 apkoyunlar.club, 1
 aplikaceproandroid.cz, 1
 aplis-online.de, 0
 aplpackaging.co.uk, 1
 aplu.fr, 1
 aplus-usa.net, 1
 aplusdownload.com, 1
 apluswaterservices.com, 1
@@ -4321,17 +4308,16 @@ appuals.com, 1
 appui-de-fenetre.fr, 1
 appveyor.com, 1
 appzoojoo.be, 1
 apratimsaha.com, 1
 aprefix.com, 1
 aprendiendoforexhoy.com, 1
 apretatuercas.es, 1
 aprikaner.de, 1
-aprogend.com.br, 1
 aproposcomputing.com, 1
 aprovpn.com, 1
 aprr.org, 1
 aprsdroid.org, 1
 aprz.de, 1
 apsa.paris, 1
 apstudynotes.org, 1
 aptitudetests.org, 1
@@ -4382,17 +4368,16 @@ arados.de, 1
 aragon.fun, 1
 arai21.net, 1
 araleeniken.com, 1
 aramido.de, 1
 aramloebmd.com, 1
 aranchhomes.com, 1
 aranel.me, 1
 aranycsillag.net, 1
-araraexpress.com.br, 1
 araratour.com, 1
 araro.ch, 1
 araseifudousan.com, 1
 arawaza.com, 0
 arawaza.info, 1
 araxis.com, 1
 arbeitsch.eu, 1
 arbeitskreis-asyl-eningen.de, 1
@@ -4519,17 +4504,16 @@ arlingtonelectric.com, 1
 arlingtonwine.net, 1
 arm-host.com, 1
 arm.gov, 1
 armadaquadrat.com, 1
 armandsdiscount.com, 1
 armanozak.com, 1
 armansfinejewellery.com, 1
 armansfinejewellery.com.au, 1
-armarinhovirtual.com.br, 1
 armazemdaminiatura.com.br, 1
 armbrust.me, 1
 armedpoet.com, 1
 armenians.online, 1
 armeo.top, 1
 armil.it, 1
 armin-cme.de, 1
 armin-cpe.de, 1
@@ -4613,23 +4597,21 @@ artdeco-photo.com, 1
 arte-soft.co, 1
 artea.ga, 1
 arteaga.co.uk, 1
 arteaga.eu, 1
 arteaga.me, 1
 arteaga.tech, 1
 arteaga.uk, 1
 arteaga.xyz, 1
-artebel.com.br, 1
 artecat.ch, 1
 artedellavetrina.it, 1
 artedona.com, 1
 arteequipamientos.com.uy, 1
 artefakt.es, 1
-artefeita.com.br, 1
 arteinstudio.it, 1
 artelt.com, 1
 arterienundvenen.ch, 1
 arteseideias.com.pt, 1
 arteshow.ch, 1
 artfabrics.com, 1
 artforum.sk, 1
 artfullyelegant.com, 1
@@ -4706,17 +4688,16 @@ aryalaroca.de, 1
 aryan-nation.com, 1
 aryasenna.net, 1
 arzid.com, 1
 arzinfo.pw, 1
 as200753.com, 1
 as200753.net, 1
 as44222.net, 1
 asadatec.de, 1
-asadzulfahri.com, 1
 asafaweb.com, 1
 asafilm.co, 1
 asafomba.com, 1
 asandu.eu, 1
 asanger.biz, 1
 asato-jewelry.com, 1
 asbestosthedarkarts.com, 1
 asbito.de, 1
@@ -4823,16 +4804,17 @@ asseenfromthesidecar.org, 1
 assemble-together.org, 1
 assempsaibiza.com, 1
 assertion.de, 1
 assessoriati.com.br, 1
 assetbacked.capital, 1
 assetsec.io, 1
 assetvault.co.za, 1
 assguidesporrentruy.ch, 1
+assign-it.co.uk, 0
 assistance-personnes-agees.ch, 1
 assistcart.com, 1
 assistel.com, 1
 assistenzaferrodastiro.org, 1
 assistenzafrigorifero.org, 1
 assistenzalavatrice.org, 1
 assistenzamicroonde.org, 1
 associatedwomenshealthcare.com, 1
@@ -4880,18 +4862,16 @@ asws.nl, 1
 asylbarn.no, 1
 asystent-dzierzawy.pl, 1
 at.search.yahoo.com, 0
 at1.co, 1
 at5.nl, 1
 at7s.me, 1
 ataber.pw, 1
 atac.no, 1
-atacadocervejeiro.com.br, 1
-atacadodesandalias.com.br, 1
 atacadooptico.com.br, 1
 atahualpa.com, 1
 atallo.com, 1
 atallo.es, 1
 ataton.ch, 1
 atc.cuneo.it, 1
 atc.io, 1
 atchleyjazz.com, 1
@@ -4984,17 +4964,16 @@ atolm.net, 1
 atom-china.org, 1
 atom.solutions, 1
 atom86.net, 1
 atombase.org, 1
 atomic-bounce.com, 1
 atomic.red, 1
 atomicbounce.co.uk, 1
 atomism.com, 1
-atorcidabrasileira.com.br, 1
 atplonline.co, 1
 atpnutrition.com, 1
 atracaosexshop.com.br, 1
 atraining.ru, 1
 atraverscugy.ch, 1
 atrevillot.com, 1
 atrinik.org, 1
 atsoftware.de, 1
@@ -5395,16 +5374,17 @@ axispara-bg.com, 1
 axolotlfarm.org, 0
 axon-toumpa.gr, 1
 axonholdingse.eu, 1
 axre.de, 1
 axrec.de, 1
 axtux.tk, 1
 axxial.tk, 1
 ay-net.jp, 1
+ayahya.me, 0
 ayamchikchik.com, 1
 ayanomimi.com, 1
 aycomba.de, 1
 ayesh.me, 1
 ayesh.win, 1
 aying.love, 1
 ayj.solutions, 1
 aykutcevik.com, 1
@@ -5703,17 +5683,16 @@ bahnbonus-praemienwelt.de, 1
 bahnenimbild.de, 1
 bahnenimbild.eu, 1
 bahnhelden.de, 1
 bahninrotweissrot.at, 1
 bahnmagazine.de, 1
 baiduo.com, 1
 baifubao.com, 1
 baiker.info, 1
-bailakomigo.com.br, 1
 baildonbouncycastles.co.uk, 1
 baildonhottubs.co.uk, 1
 baileebee.com, 1
 baileybae.com, 1
 bailonga.com, 1
 bairdzhang.com, 1
 baitap.net, 1
 baitcon.com, 1
@@ -5734,17 +5713,16 @@ bakeup.be, 1
 bakhansen.com, 1
 bakibal.com, 1
 bakim.li, 1
 bakingstone.com, 1
 bakkerinjebuurt.be, 1
 bakongcondo.com, 1
 balade-commune.ch, 1
 baladecommune.ch, 1
-balancascia.com.br, 1
 balance7.jp, 1
 balancedbrawl.net, 1
 balancenaturalhealthclinic.ca, 1
 balboa.io, 1
 balcaonet.com.br, 1
 balcarek.pl, 1
 balconnr.com, 1
 balconsverdun.com, 1
@@ -5755,16 +5733,17 @@ balia.de, 1
 balicekzdravi.cz, 1
 balikonos.cz, 1
 balinese.dating, 1
 balist.es, 1
 balivillassanur.com, 1
 baliyano.com, 1
 balkonien.org, 1
 ball-bizarr.de, 1
+ball3d.es, 1
 ballarin.cc, 1
 ballbusting-cbt.com, 1
 ballejaune.com, 1
 balletcenterofhouston.com, 1
 ballinarsl.com.au, 1
 ballitolocksmith.com, 1
 ballmerpeak.org, 1
 ballonsportclub-erlangen.de, 1
@@ -5793,17 +5772,16 @@ bananium.fr, 1
 bancacrs.it, 1
 bancobai.ao, 1
 bancoctt.pt, 1
 bancomap.ch, 1
 bancor.network, 1
 bandagastrica.es, 1
 bandally.net, 1
 bandarifamily.com, 1
-bandeira1.com.br, 1
 banderasdelmundo.xyz, 1
 bandgap.io, 1
 bandiga.it, 1
 bandito.re, 1
 banes.ch, 1
 bangdream.ga, 1
 bangkok-dark-night.com, 1
 bangkok.dating, 1
@@ -5906,17 +5884,16 @@ barpodsosnami.pl, 1
 barprive.com, 1
 barqo.co, 0
 barracuda.blog, 1
 barracuda.com.tr, 1
 barrera.io, 1
 barriofut.com, 1
 barrydenicola.com, 1
 bars.kh.ua, 1
-barsashop.com.br, 1
 barsgroup.com, 1
 barslecht.com, 1
 barslecht.nl, 1
 barss.io, 1
 bart-f.com, 1
 bartbania.com, 1
 bartel.ws, 1
 bartelt.name, 1
@@ -5979,17 +5956,16 @@ bat9vip.net, 1
 batcave.tech, 1
 batch.com, 1
 baterioverolety.cz, 1
 batfoundry.com, 1
 bati-alu.fr, 1
 batiburrillo.net, 1
 batipresta.ch, 1
 batiskaf.ua, 1
-batistareisfloresonline.com.br, 1
 batlab.ch, 1
 batolis.com, 1
 batook.org, 1
 batschu.de, 1
 batten.eu.org, 1
 batteryboys.ca, 1
 batteryboys.com, 1
 batterystaple.pw, 1
@@ -6039,17 +6015,16 @@ baystreet.com.mt, 1
 baytalebaa.com, 1
 baywatch.io, 1
 bayz.de, 1
 baza-gai.com.ua, 1
 bazaarbhaav.com, 1
 bazaarcompass.com, 1
 bazari.com.pl, 1
 bazdell.com, 1
-bazinga-events.nl, 1
 bazos.at, 1
 bazos.cz, 1
 bazos.pl, 1
 bazos.sk, 1
 bazziergraphik.com, 1
 bb37roma.it, 1
 bbalposticino.it, 1
 bbb1991.me, 0
@@ -6146,17 +6121,16 @@ beamitapp.com, 1
 beamstat.com, 1
 beanbagaa.com, 1
 beanbot.party, 1
 beanilla.com, 1
 beanjuice.me, 1
 beans-one.com, 0
 beansgalore.com.au, 1
 bearcms.com, 1
-bearcosports.com.br, 1
 bearded.sexy, 1
 beardic.cn, 1
 bearingworks.com, 1
 bearlakelife.com, 1
 beasel.biz, 1
 beastiejob.com, 1
 beastowner.li, 1
 beatfeld.de, 1
@@ -6173,17 +6147,16 @@ beautybh.com, 1
 beautyby.tv, 1
 beautycarepack.com.ng, 1
 beautyevent.fr, 1
 beautykat.ru, 1
 beaverdamautos.com, 1
 beavertales.ca, 1
 bebeautiful.business, 1
 bebef.de, 1
-bebefofuxo.com.br, 1
 bebes.uno, 1
 bebest.gov, 1
 bebetrotteur.com, 1
 beboldpr.com, 1
 bebout.domains, 1
 bebout.pw, 1
 beccajoshwedding.com, 1
 beckenhamcastles.co.uk, 1
@@ -6251,23 +6224,25 @@ beeswax-orgone.com, 1
 beetgroup.id, 1
 beethoveninlove.com, 1
 beetman.net, 1
 beeutifulparties.co.uk, 1
 beexfit.com, 1
 beezkneezcastles.co.uk, 1
 beeznest.com, 1
 befoodsafe.gov, 1
+beforesunrise.de, 1
 beforeyoueatoc.com, 1
 beframed.ch, 1
 befreewifi.info, 1
 befundonline.de, 1
 begabungsfoerderung.info, 1
 begbie.com, 1
 beginner.nl, 1
+beginwp.top, 1
 behamepresrdce.sk, 1
 behamzdarma.cz, 1
 behead.de, 1
 beherit.pl, 1
 behindertenagentur.de, 1
 behna24hodin.cz, 1
 behoreal.cz, 1
 bei18.com, 1
@@ -6289,17 +6264,16 @@ belarto.fr, 1
 belarto.it, 1
 belarto.nl, 1
 belarto.pl, 1
 belastingdienst-in-beeld.nl, 1
 belastingmiddeling.nl, 1
 belavis.com, 1
 beleggingspanden-financiering.nl, 1
 belegit.org, 1
-belezashopping.com.br, 1
 belfastbounce.co.uk, 1
 belfastlocks.com, 1
 belfasttechservices.co.uk, 1
 belfor-probleme.de, 1
 belfordroxo.net.br, 1
 belge.rs, 1
 belgers.com, 1
 belgicaservices.be, 1
@@ -6356,17 +6330,16 @@ bendix.co, 1
 bendyworks.com, 1
 beneathvt.com, 1
 benedict-balzer.de, 1
 benediktgeissler.de, 1
 benefits.gov, 1
 benefitsbookcase.com, 1
 benefitshub.io, 1
 benefitshub.xyz, 1
-benepiscinas.com.br, 1
 beneri.se, 1
 benevisim.com, 1
 benevita.bio, 1
 benevita.life, 1
 benevita.live, 1
 benevita.organic, 1
 benewpro.com, 1
 benfairclough.com, 1
@@ -6470,17 +6443,16 @@ bernhard-seidenspinner.de, 1
 bernhardkau.de, 1
 bernhardluginbuehl.ch, 1
 bernhardluginbuehl.com, 1
 bernieware.de, 1
 bernyweb.net, 1
 berodes.be, 1
 berr.yt, 1
 berra.se, 1
-berruezoabogados.com, 1
 berrus.com, 1
 berry.cat, 1
 berrypay.com, 1
 bersierservices.ch, 1
 bersotavocats.fr, 1
 berst.cz, 1
 berthabailey.com, 1
 berthelier.me, 1
@@ -6538,20 +6510,18 @@ best66.me, 1
 bestattungen-kammerer.de, 1
 bestattungshaus-kammerer.de, 1
 bestautoinsurance.com, 1
 bestbatteriesonline.com, 1
 bestbefore.com, 1
 bestbestbitcoin.com, 1
 bestbrakes.com, 1
 bestbrokerindia.com, 1
-bestbyte.com.br, 1
 bestcellular.com, 0
 bestdating.today, 1
-bestdoc.com.br, 1
 bestdownloadscenter.com, 1
 bestelectricnd.com, 1
 bestellipticalmachinereview.info, 1
 bestemailmarketingsoftware.org, 1
 bestesb.com, 1
 bestesb.net, 1
 bestessaycheap.com, 1
 bestessayhelp.com, 1
@@ -6564,16 +6534,17 @@ besti.it, 1
 bestiahosting.com, 1
 bestinductioncooktop.us, 1
 bestinshowing.com, 1
 bestinver.es, 0
 bestjumptrampolines.be, 1
 bestkenmoredentists.com, 1
 bestladyshaver.co.uk, 1
 bestleftwild.com, 1
+bestlooperpedalsguide.com, 1
 bestmotherfucking.website, 1
 bestoffert.club, 1
 bestoliveoils.com, 1
 bestpal.eu, 1
 bestparking.xyz, 1
 bestpartyhire.com, 1
 bestperfumebrands.com, 1
 bestpig.fr, 1
@@ -6582,17 +6553,16 @@ bestpractice.domains, 1
 bestschools.io, 1
 bestseries.tv, 1
 bestshoesmix.com, 1
 bestwarezone.com, 1
 bestwebsite.gallery, 1
 bet-99.cc, 1
 bet-99.com, 1
 bet-99.net, 1
-bet.eu, 1
 bet168wy.com, 1
 bet168wy.net, 1
 bet909.com, 1
 bet990.com, 1
 bet9bet9.net, 1
 betaal.my, 1
 betacavi.com, 1
 betaclouds.net, 1
@@ -6679,17 +6649,16 @@ beyerautomation.com, 1
 beyerm.de, 1
 beylikduzuvaillant.com, 1
 beyond-infinity.org, 0
 beyond-rational.com, 1
 beyondalderaan.net, 1
 beyondbounce.co.uk, 1
 beyondordinarylife.com, 1
 beyondpricing.com, 1
-beyondthecode.io, 1
 beyondtodaymediagroup.com, 1
 beyondweb.net, 1
 beyonic.com, 1
 beyours.be, 1
 bez-energie.de, 1
 bezahlbare-praemien.ch, 1
 bezemkast.nl, 1
 bezlampowe.pl, 1
@@ -6815,17 +6784,16 @@ bigbrotherawards.nl, 1
 bigcakes.dk, 1
 bigclassaction.com, 1
 bigdinosaur.org, 1
 bigerbio.com, 1
 biggreenexchange.com, 1
 bighouse-events.co.uk, 1
 bight.ca, 1
 bigideasnetwork.com, 1
-bigio.com.br, 1
 biglou.com, 0
 bigorbitgallery.org, 1
 bigpicture-learning.com, 1
 bigserp.com, 1
 bigshopper.com, 1
 bigshopper.nl, 1
 bigshort.org, 1
 bigsisterchannel.com, 1
@@ -7009,17 +6977,16 @@ biometrics.es, 1
 biomin.co.uk, 0
 biomodra.cz, 1
 bionima.com, 1
 biopreferred.gov, 1
 biopronut.com, 1
 biopsychiatry.com, 1
 bioresonanz-ibiza.com, 1
 biosafe.ch, 1
-biosalts.it, 1
 biosbits.org, 1
 bioshine.com.sg, 1
 bioshome.de, 1
 biosignalanalytics.com, 1
 biospeak.solutions, 1
 biosphere.cc, 1
 biospw.com, 1
 biotechware.com, 1
@@ -7032,30 +6999,29 @@ birbaumer.li, 1
 birchbarkfurniture.ch, 1
 birchbarkfurniture.com, 1
 birchbarkfurniture.fr, 1
 birdbrowser.com, 1
 birdfeeder.online, 1
 birdiehosting.nl, 1
 birdslabel.com, 1
 birdymanbestreviews.com, 1
-birgerschwarz.de, 1
+birgerschwarz.de, 0
 birgit-rydlewski.de, 1
 birgitandmerlin.com, 1
 birkengarten.ch, 1
 birkenstab.de, 1
 birminghamcastlehire.co.uk, 1
 birminghamsunset.com, 1
 birthdaytip.com, 1
 birthmatters.us, 1
 birthright.website, 1
 birzan.org, 1
 bisa-sis.net, 1
 bischoff-mathey.family, 1
-biscoint.io, 1
 biscuitcute.com.br, 1
 biscuits-rec.com, 1
 biscuits-shop.com, 1
 biser-borisov.eu, 1
 biser.online, 1
 bishopscourt-hawarden.co.uk, 1
 bismarck-tb.de, 1
 biso.ga, 1
@@ -7440,16 +7406,17 @@ bloglogistics.com, 1
 bloglyric.com, 1
 blognr.com, 1
 blogom.at, 1
 blogpentrusuflet.ro, 1
 blogreen.org, 1
 blogsdna.com, 1
 blogthedayaway.com, 1
 blogtroterzy.pl, 1
+blok56.nl, 1
 blokmy.com, 1
 blood4pets.tk, 1
 bloodhunt.pl, 1
 bloodsports.org, 1
 bloody.pw, 1
 bloom-avenue.com, 1
 bloom.sh, 0
 bloombrown.com, 1
@@ -7932,17 +7899,16 @@ bourasse.fr, 1
 bourdon.fr.eu.org, 1
 bourgeoisdoorco.com, 1
 bournefun.co.uk, 1
 bourqu.in, 1
 bourse-aux-jouets.org, 0
 bourse-aux-vetements.org, 0
 bourse-puericulture.org, 0
 bourseauxservices.com, 1
-boutiquedecanetas.com.br, 1
 boutiqueguenaelleverdin.com, 1
 boutoncoupdepoing.fr, 1
 bouw.live, 1
 bouzouada.com, 1
 bouzouks.net, 1
 bovenwebdesign.nl, 1
 bovworkplacepensions.com, 1
 bowdens.me, 1
@@ -7978,17 +7944,16 @@ boz.nl, 0
 bozdoz.com, 1
 bozit.com.au, 1
 bozosbouncycastles.co.uk, 1
 bpa.gov, 1
 bpadvisors.eu, 1
 bpastudies.org, 1
 bpo.ovh, 1
 bpol-forum.de, 1
-bpreguica.com.br, 1
 bps.vc, 1
 bpvboekje.nl, 1
 bqcp.net, 1
 bqp.io, 1
 bqr.ch, 1
 bqtoolbox.com, 1
 br-miyamoto.spdns.org, 1
 br.search.yahoo.com, 0
@@ -8068,17 +8033,16 @@ brandweerfraneker.nl, 1
 brandweertrainingen.nl, 1
 brandweeruitgeest.nl, 1
 brank.as, 1
 branno.org, 1
 branw.xyz, 0
 brasal.ma, 1
 brasalcosmetics.com, 1
 brashear.me, 1
-brasilbombas.com.br, 1
 brasildxn.com.br, 1
 brasileiro.ca, 1
 brasserie-mino.fr, 1
 brasspipedreams.org, 1
 bratislava-airport-taxi.com, 1
 bratteng.me, 1
 bratteng.xyz, 1
 bratvanov.com, 1
@@ -8093,17 +8057,16 @@ brave-foods.com, 1
 brave.com, 1
 bravebaby.com.au, 1
 bravehearts.org.au, 1
 braviskindenjeugd.nl, 1
 bravisziekenhuis.nl, 0
 bravor.pe, 1
 brazilian.dating, 1
 braziliex.com, 1
-brazillens.com, 1
 brazoriabar.org, 1
 brb.city, 1
 brck.nl, 1
 brd.ro, 1
 breadandlife.org, 1
 breadofgod.org, 1
 breakingtech.it, 0
 breakingvap.fr, 1
@@ -8250,17 +8213,16 @@ brody.digital, 1
 brody.ninja, 1
 broersma.com, 1
 broerweb.nl, 1
 broeselei.at, 1
 brokenhands.io, 1
 brokernet.ie, 0
 brokervalues.com, 1
 brompton-cocktail.com, 1
-bronetb2b.com.br, 1
 bronevichok.ru, 1
 bronwynlewis.com, 1
 broodbesteld.nl, 1
 brookframework.org, 1
 brooklyncosmetics.net, 1
 brooklynrealestateblog.com, 1
 brookworth.com, 1
 brossman.it, 1
@@ -8366,17 +8328,16 @@ btc2secure.com, 1
 btcarmory.com, 1
 btcbolsa.com, 1
 btcontract.com, 1
 btcp.space, 1
 btcpop.co, 1
 btine.tk, 1
 btio.pw, 0
 btku.org, 1
-btmstore.com.br, 1
 btnissanparts.com, 1
 btorrent.xyz, 1
 btrb.ml, 1
 btsapem.com, 1
 btshe.net, 1
 btsoft.eu, 1
 btsow.com, 0
 bttc.co.uk, 1
@@ -8797,17 +8758,16 @@ cabinetfurnituree.com, 1
 cablehighspeed.net, 1
 cablemod.com, 1
 cablesandkits.com, 1
 cabotfinancial.co.uk, 1
 cabuna.hr, 1
 cacao-chocolate.com, 1
 cacao.supply, 1
 cacaolalina.com, 1
-cacaumidade.com.br, 1
 cacd.eu, 1
 caceis.bank, 1
 cachacacha.com, 1
 cachedview.nl, 1
 cachetagalong.com, 0
 cachethome.com, 1
 cachetur.no, 1
 cackette.com, 1
@@ -8838,20 +8798,18 @@ cafedupont.be, 1
 cafedupont.co.uk, 1
 cafedupont.de, 1
 cafedupont.nl, 1
 cafeimsueden.de, 1
 cafejulian.com, 1
 cafelandia.net, 1
 cafeobscura.nl, 1
 caferagazzi.de, 1
-caferestor.com, 1
 cafericoy.com, 1
 cafermin.com, 1
-cafesdomundo.pt, 1
 cafeterasbaratas.net, 1
 caffeinatedcode.com, 1
 caffeinefiend.org, 1
 cafled.org, 1
 cagalogluyayinevi.com, 0
 caglarcakici.com, 1
 caibi.io, 1
 caijunyi.net, 0
@@ -8968,17 +8926,16 @@ cambuslangharriers.org, 1
 camcapital.com, 1
 camconn.cc, 1
 camdenboneandjoint.com, 1
 camdesign.pl, 1
 camel2243.com, 1
 camelforensics.com, 1
 camelservers.com, 1
 cameo-membership.uk, 1
-cameraviva.com.br, 1
 cameronthomson.racing, 1
 camerweb.es, 1
 camilomodzz.net, 1
 camisetasmalwee.com.br, 1
 camolist.com, 1
 camp-pleinsoleil.ch, 1
 camp.co.uk, 1
 campaign-ad.com, 1
@@ -9048,17 +9005,16 @@ cancerdata.nhs.uk, 1
 candaceplayforth.com, 1
 candelec.com, 1
 candeo-books.nl, 1
 candex.com, 1
 candguchocolat.com, 1
 candicecity.com, 1
 candidasa.com, 1
 candidaturedunprix.com, 1
-candinya.com, 1
 candlcastles.co.uk, 1
 cando.eu, 1
 candylion.rocks, 1
 canfield.gov, 1
 cangku.in, 1
 cangku.moe, 1
 canglong.net, 1
 canhazip.com, 1
@@ -9162,16 +9118,17 @@ carbon12.software, 1
 carboneselectricosnettosl.info, 0
 carbonmonoxidelawyer.net, 1
 carbono.uy, 1
 carbontv.com, 1
 carburetorcycleoi.com, 1
 carck.co.uk, 1
 carck.uk, 1
 carcloud.ch, 1
+card-cashing.com, 1
 cardano.eco, 1
 cardboard.cx, 1
 cardcaptorsakura.jp, 1
 carddreams.be, 1
 carddreams.de, 1
 carddreams.es, 1
 carddreams.nl, 1
 cardelmar.com, 1
@@ -9273,17 +9230,16 @@ carmelglenane.com, 1
 carmelrise.co.uk, 1
 carnaticalifornia.com, 1
 carnet-du-voyageur.com, 1
 carnildo.com, 1
 caroes.be, 1
 caroffer.ch, 1
 carol-lambert.com, 1
 carolcappelletti.com, 1
-carolcestas.com, 1
 caroli.biz, 1
 caroli.com, 1
 caroli.info, 1
 caroli.name, 1
 caroli.net, 1
 carolina.cz, 1
 carolinaclimatecontrolsc.com, 1
 carolineeball.com, 1
@@ -9300,21 +9256,19 @@ carriedin.com, 1
 carrierplatform.com, 1
 carringtonrealtygroup.com, 1
 carroattrezzimilanodaluiso.it, 1
 carroceriascarluis.com, 1
 carrouselcompany.fr, 1
 cars4salecy.com, 1
 carseatchecks.ca, 1
 carshippingcarriers.com, 1
-carson-aviation-adventures.com, 1
 carson-matthews.co.uk, 1
 carsoug.com, 1
 carspneu.cz, 1
-carteirasedistintivos.com.br, 1
 cartelloni.roma.it, 1
 carterdan.net, 1
 carterorland.com, 1
 carterstad.se, 1
 cartertonscouts.org.nz, 1
 cartesentreprises-unicef.fr, 1
 carthedral.com, 1
 cartierplan.ga, 0
@@ -9338,27 +9292,22 @@ casa-lunch-break.de, 1
 casa-lunchbreak.de, 1
 casa-mea-inteligenta.ro, 1
 casaamor.ph, 1
 casaanastasia.ro, 1
 casabouquet.com, 1
 casacameo.com, 0
 casacazoleiro.com, 1
 casacochecurro.com, 1
-casacomcharme.com.br, 1
 casadasportasejanelas.com, 1
-casadoarbitro.com.br, 1
 casadopulpo.com, 1
-casadowifi.com.br, 1
-casaessencias.com.br, 1
 casalborgo.it, 1
 casalindamex.com, 1
 casalunchbreak.de, 1
 casamariposaspi.com, 1
-casapalla.com.br, 1
 casasuara.com, 1
 casasuleletrodomesticos.com.br, 1
 casbia.info, 1
 casbuijs.nl, 1
 casburggraaf.com, 0
 casc.cz, 1
 cascadesjobcorpscca.com, 1
 cascavelle.fr, 1
@@ -9388,17 +9337,16 @@ casino-cash-flow.su, 1
 casino-cashflow.ru, 1
 casino-online.info, 1
 casino-trio.com, 1
 casinobonuscodes.online, 1
 casinocashflow.ru, 1
 casinochecking.com, 1
 casinolegal.pt, 1
 casinolistings.com, 1
-casinomegaslotos.com, 1
 casinomucho.com, 1
 casinomucho.org, 1
 casinomucho.se, 1
 casinoonlinesicuri.com, 1
 casinoportugal.pt, 1
 casinoreal.com, 1
 casinorewards.info, 1
 casinovergleich.com, 1
@@ -9639,17 +9587,16 @@ centa-am.com, 1
 centaur.de, 1
 centennialradon.com, 1
 centennialseptic.com, 1
 centermk.ru, 1
 centerpereezd.ru, 0
 centerperson.org, 1
 centerpoint.ovh, 1
 centio.bg, 1
-centision.com, 1
 centos.cz, 1
 centos.pub, 1
 centos.tips, 1
 central4.me, 1
 centralbank.ae, 1
 centralebigmat.eu, 1
 centralegedimat.eu, 1
 centralfor.me, 1
@@ -9727,17 +9674,16 @@ ces-ltd.co.uk, 1
 cesantias.co, 1
 cesboard.com, 1
 cesdb.com, 1
 cesipagano.com, 1
 ceskepivnesety.sk, 1
 ceskepivnisety.cz, 1
 ceso-saco.com, 1
 cesobaly.cz, 1
-cestasedelicias.com.br, 1
 cestunmetier.ch, 1
 cetamol.com, 1
 ceu.edu, 0
 cevin.at, 1
 cevo.com.hr, 1
 cf-ide.de, 1
 cf-tm.net, 1
 cfan.space, 1
@@ -9798,20 +9744,18 @@ chaisystems.net, 1
 chaizhikang.com, 1
 chaletdemontagne.org, 1
 chaletmanager.com, 1
 chaletpierrot.ch, 1
 chaleur.com, 1
 chalker.io, 1
 chalkfestival.org, 0
 challengeblog.org, 1
-challengeclothing.com.br, 1
 challengeskins.com, 1
 challstrom.com, 1
-chamathellawala.com, 1
 chambion.ch, 1
 chameleon-ents.co.uk, 1
 chameth.com, 0
 chamicro.com, 1
 champdogs.co.uk, 1
 champdogs.com, 1
 champicreuse.fr, 1
 championcastles.ie, 1
@@ -10158,17 +10102,16 @@ chloehorler.com, 1
 chloescastles.co.uk, 1
 chlth.com, 1
 chmielarz.it, 1
 chmsoft.com.ua, 1
 chmsoft.ru, 1
 chmurakotori.ml, 1
 choc-o-lush.co.uk, 1
 chocgu.com, 1
-chocodecor.com.br, 1
 chocolah.com.au, 0
 chocolat-suisse.ch, 1
 chocolat.work, 1
 chocolatesandhealth.com, 1
 chocolatier-tristan.ch, 1
 chocolytech.info, 1
 chocotough.nl, 1
 chocoweb.net, 1
@@ -10304,17 +10247,16 @@ chrpaul.de, 1
 chrstn.eu, 1
 chrysanthos.net, 1
 chrystajewelry.com, 1
 chs.us, 0
 chsh.moe, 0
 chshealthcare.co.uk, 1
 chshouyu.com, 1
 chsterz.de, 1
-chtsi.uk, 1
 chuchote-moi.fr, 1
 chuill.com, 1
 chun.pro, 1
 chunche.net, 1
 chundelac.com, 1
 chunk.science, 1
 chupadelfrasco.com, 1
 chuppa.com.au, 1
@@ -10413,22 +10355,18 @@ circlebox.rocks, 1
 circu.ml, 1
 circuitcityelectricaladelaide.com.au, 1
 circulatedigital.com, 1
 circule.cc, 1
 cirfi.com, 1
 ciri.com.co, 1
 cirrus0.de, 1
 cirujanooral.com, 1
-cirurgicagervasio.com.br, 1
-cirurgicalucena.com.br, 1
-cirurgicasalutar.com.br, 1
-cirurgicavirtual.com.br, 1
 cisa.gov, 1
-ciscodude.net, 0
+ciscodude.net, 1
 cisoaid.com, 1
 cisofy.com, 1
 cispeo.org, 1
 ciss.ltd, 1
 cistitguru.ru, 1
 cisum-cycling.com, 1
 cisy.me, 1
 citadelnet.works, 1
@@ -10442,17 +10380,16 @@ citizensbankal.com, 1
 citizenscience.gov, 0
 citizenscience.org, 1
 citizensgbr.org, 1
 citizenslasvegas.com, 1
 citizensleague.org, 1
 citizing.org, 1
 citrusui.me, 1
 cittadesign.com, 0
-citton.com.br, 1
 city-adm.lviv.ua, 1
 city-walks.info, 1
 citya.com, 1
 citybeat.de, 1
 citycreek.studio, 1
 citydance.ee, 1
 cityextra.com.au, 1
 cityfloorsupply.com, 1
@@ -10752,17 +10689,16 @@ club-jose.com, 1
 club-premiere.com, 1
 club-reduc.com, 1
 club-slow.jp, 1
 club-yy.com, 1
 club103.ch, 1
 clubcorsavenezuela.com, 1
 clubdelzapato.com, 1
 clubdeslecteurs.net, 1
-clubedalutashop.com, 1
 clubefiel.com.br, 1
 clubegolfpt.com, 1
 clubempleos.com, 1
 clubeohara.com, 1
 clubfamily.de, 1
 clubgalaxy.futbol, 0
 clubiconkenosha.com, 1
 clubmarina.store, 1
@@ -10778,17 +10714,16 @@ clusteranalyse.net, 1
 clusterfuck.nz, 1
 clustermaze.net, 1
 clycat.ru, 1
 cm.center, 1
 cmacacias.ch, 1
 cmadeangelis.it, 1
 cmc.pt, 1
 cmcc.network, 1
-cmcelectrical.com, 1
 cmcressy.ch, 1
 cmdline.org, 1
 cme-colleg.de, 1
 cmf.qc.ca, 1
 cmfaccounting.com, 1
 cmftech.com, 1
 cmgacheatcontrol.com, 1
 cmitao.com, 1
@@ -10830,17 +10765,17 @@ cnet-hosting.com, 1
 cnetw.xyz, 1
 cni-certing.it, 1
 cnitdog.com, 0
 cnlic.com, 1
 cnnet.in, 1
 cnre.eu, 1
 cnvt.fr, 1
 cnwage.com, 1
-co-founder-stuttgart.de, 0
+co-founder-stuttgart.de, 1
 co-yutaka.com, 1
 co.search.yahoo.com, 0
 co2eco.cn, 0
 co50.com, 1
 coa.one, 1
 coachezmoi.ch, 1
 coachfederation.ro, 1
 coaching-harmonique.fr, 1
@@ -10999,42 +10934,41 @@ cognitivecomputingconsortium.com, 1
 cognitohq.com, 1
 cogsquad.house, 1
 cogumelosmagicos.org, 1
 coiffeurschnittstelle.ch, 1
 coigach-assynt.org, 1
 coimmvest.com, 1
 coin-exchange.cz, 1
 coin-quest.net, 1
+coin.dance, 1
 coinapult.com, 1
 coinbase.com, 1
 coinbit.trade, 1
 coincealed.com, 1
 coinchat.im, 1
 coincircle.com, 1
 coincoele.com.br, 1
 coincoin.eu.org, 1
-coincolors.co, 1
 coindatabase.net, 1
 coindeal.com, 1
 coinessa.com, 1
 coinf.it, 1
 coinflux.com, 1
 coingate.com, 1
 coinjar-sandbox.com, 1
 coinlist.co, 0
 coinloan.io, 1
 coinmewallet.com, 1
 coinpit.io, 1
 coinroom.com, 1
 coins2001.ru, 1
 coinsmat.com, 1
 coinsz.co, 1
 coinx.pro, 1
-coisabakana.com.br, 1
 coisasdemulher.org, 1
 cojam.ru, 1
 cojo.eu, 1
 cokebar.info, 1
 coker.com.au, 1
 col.la, 1
 colaborativa.tv, 1
 coladv.com, 1
@@ -11123,16 +11057,17 @@ coloringnotebook.com, 0
 coloristcafe.com, 1
 colors3d.com, 1
 colorsbycarin.com, 1
 colossal-events.co.uk, 1
 colotimes.com, 1
 colourfulcastles.co.uk, 1
 colourmanagementpro.com, 1
 colpacpackaging.com, 1
+colpatriaws.azurewebsites.net, 1
 colson-occasions.be, 1
 coltellisurvival.com, 1
 coltonrb.com, 1
 columbuswines.com, 1
 colyakoomusic.com, 1
 colyakootees.com, 1
 com-in.de, 1
 com-news.io, 1
@@ -11163,17 +11098,16 @@ comestoarra.com, 1
 cometbot.cf, 1
 cometcache.com, 1
 cometonovascotia.ca, 1
 comevius.com, 1
 comevius.org, 1
 comevius.xyz, 1
 comff.net, 1
 comfintouch.com, 1
-comflores.com.br, 1
 comfortmastersinsulation.com, 1
 comfun.net, 1
 comfy.cafe, 0
 comfypc.com, 1
 comhack.com, 1
 comicspornos.com, 1
 comicspornow.com, 1
 comicspornoxxx.com, 1
@@ -11268,17 +11202,16 @@ componentshop.co.uk, 1
 compostatebien.com.ar, 1
 compostelle-bouddha.fr, 1
 compoundingrxusa.com, 1
 compraneta.com, 0
 compraporinternet.online, 1
 comprarefiereygana.com, 1
 comprarimpresoras-3d.com, 1
 compreair.com, 1
-compreautomacao.com.br, 1
 compree.com, 1
 comprefitasadere.com.br, 1
 comprehensiveihc.com, 1
 compromised.com, 1
 compservice.in.ua, 1
 comptablevilledequebec.com, 1
 comptrollerofthecurrency.gov, 1
 comptu.com, 1
@@ -11329,17 +11262,16 @@ concordsoftwareleasing.com, 1
 concretehermit.com, 0
 concretelevelingsystems.com, 1
 concreterepairatlanta.com, 1
 concreterepairconcreteraising.com, 1
 concursopublico.com.br, 1
 concursos.com.br, 1
 concursosabertos.com.br, 1
 concursuri.biz, 1
-condecom.com.br, 1
 condepenalba.com, 0
 condesaelectronics.com, 1
 condolencemessages.net, 1
 condominiosi.it, 1
 condominioweb.com, 1
 condosforcash.com, 1
 condroz-motors.be, 1
 conectadev.com, 1
@@ -11352,17 +11284,16 @@ conejovalleylighting.com, 1
 conejovalleyoutdoorlighting.com, 1
 conexiontransporte.com, 1
 conference-expert.eu, 1
 conference.dnsfor.me, 1
 confiancefoundation.org, 1
 confidential.network, 1
 config.schokokeks.org, 0
 confiwall.de, 1
-conformax.com.br, 1
 conformist.jp, 1
 confucio.cl