--- a/dom/base/test/chrome/cpows_parent.xul
+++ b/dom/base/test/chrome/cpows_parent.xul
@@ -53,19 +53,24 @@
         ok(Components.utils.isCrossProcessWrapper(data), "got a CPOW");
         ok(Components.utils.isCrossProcessWrapper(document), "got a CPOW");
       }
       ok(data.i === 5, "integer property");
       ok(data.b === true, "boolean property");
       ok(data.s === "hello", "string property");
       ok(data.x.i === 10, "nested property");
       ok(data.f() === 99, "function call");
+      is(Object.getOwnPropertyDescriptor(data, "doesn't exist"), undefined,
+         "getOwnPropertyDescriptor returns undefined for non-existant properties");
+      ok(Object.getOwnPropertyDescriptor(data, "i").value, 5,
+         "getOwnPropertyDescriptor.value works");
       let obj = new data.ctor();
       ok(obj.a === 3, "constructor call");
       ok(document.title === "Hello, Kitty", "document node");
+      is(typeof document.cookie, "string", "can get document.cookie");
 
       data.i = 6;
       data.b = false;
       data.s = "bye";
       data.x = null;
       ok(data.i === 6, "integer property");
       ok(data.b === false, "boolean property");
       ok(data.s === "bye", "string property");

--- a/dom/ipc/PBrowser.ipdl
+++ b/dom/ipc/PBrowser.ipdl
@@ -64,17 +64,17 @@ struct NativeKeyBinding
 };
 
 union MaybeNativeKeyBinding
 {
   NativeKeyBinding;
   void_t;
 };
 
-prio(normal upto high) intr protocol PBrowser
+prio(normal upto urgent) intr protocol PBrowser
 {
     manager PContent or PContentBridge;
 
     manages PColorPicker;
     manages PDocumentRenderer;
     manages PContentPermissionRequest;
     manages PFilePicker;
     manages PIndexedDBPermissionRequest;
@@ -136,102 +136,106 @@ parent:
      * Notifies chrome that there is a focus change involving an editable
      * object (input, textarea, document, contentEditable. etc.)
      *
      *  focus        PR_TRUE if editable object is receiving focus
      *               PR_FALSE if losing focus
      *  preference   Native widget preference for IME updates
      *  seqno        Current seqno value on the chrome side
      */
-    sync NotifyIMEFocus(bool focus)
+    prio(urgent) sync NotifyIMEFocus(bool focus)
       returns (nsIMEUpdatePreference preference, uint32_t seqno);
 
     /**
      * Notifies chrome that there has been a change in text content
      * One call can encompass both a delete and an insert operation
      * Only called when NotifyIMEFocus returns PR_TRUE for mWantUpdates
      *
      *  offset       Starting offset of the change
      *  end          Ending offset of the range deleted
      *  newEnd       New ending offset after insertion
      *  causedByComposition true if the change is caused by composition
      *
      *  for insertion, offset == end
      *  for deletion, offset == newEnd
      */
-    NotifyIMETextChange(uint32_t offset, uint32_t end, uint32_t newEnd,
-                        bool causedByComposition);
+    prio(urgent) async NotifyIMETextChange(uint32_t offset, uint32_t end,
+                                           uint32_t newEnd,
+                                           bool causedByComposition);
 
     /**
      * Notifies chrome that there is a IME compostion rect updated
      *
      *  offset       The starting offset of this rect
      *  rect         The rect of first character of selected IME composition
      *  caretOffset  The offset of caret position
      *  caretRect    The rect of IME caret
      */
-    NotifyIMESelectedCompositionRect(uint32_t offset, nsIntRect[] rect,
-                                     uint32_t caretOffset, nsIntRect caretRect);
+    prio(urgent) async NotifyIMESelectedCompositionRect(uint32_t offset,
+                                                        nsIntRect[] rect,
+                                                        uint32_t caretOffset,
+                                                        nsIntRect caretRect);
 
     /**
      * Notifies chrome that there has been a change in selection
      * Only called when NotifyIMEFocus returns PR_TRUE for mWantUpdates
      *
      *  seqno        Current seqno value on the content side
      *  anchor       Offset where the selection started
      *  focus        Offset where the caret is
      *  causedByComposition true if the change is caused by composition
      */
-    NotifyIMESelection(uint32_t seqno, uint32_t anchor, uint32_t focus,
-                       bool causedByComposition);
+    prio(urgent) async NotifyIMESelection(uint32_t seqno, uint32_t anchor,
+                                          uint32_t focus, bool causedByComposition);
 
     /**
      * Notifies chrome to refresh its text cache 
      *
      *  text         The entire content of the text field
      */
-    NotifyIMETextHint(nsString text);
+    prio(urgent) async NotifyIMETextHint(nsString text);
 
     /**
      * Notifies IME of mouse button event on a character in focused editor.
      *
      * Returns true if the mouse button event is consumd by IME.
      */
-    sync NotifyIMEMouseButtonEvent(IMENotification notification)
+    prio(urgent) sync NotifyIMEMouseButtonEvent(IMENotification notification)
       returns (bool consumedByIME);
 
     /**
      * Instructs chrome to end any pending composition
      *
      *  cancel       PR_TRUE if composition should be cancelled
      *  composition  Text to commit before ending the composition
      *
      *  if cancel is PR_TRUE,
      *    widget should return empty string for composition
      *  if cancel is PR_FALSE,
      *    widget should return the current composition text
      */
-    sync EndIMEComposition(bool cancel) returns (nsString composition);
+    prio(urgent) sync EndIMEComposition(bool cancel) returns (nsString composition);
 
     /**
      * Request that the parent process move focus to the browser's frame. If
      * canRaise is true, the window can be raised if it is inactive.
      */
     RequestFocus(bool canRaise);
 
-    sync GetInputContext() returns (int32_t IMEEnabled, int32_t IMEOpen,
-                                    intptr_t NativeIMEContext);
+    prio(urgent) sync GetInputContext() returns (int32_t IMEEnabled,
+                                                 int32_t IMEOpen,
+                                                 intptr_t NativeIMEContext);
 
-    SetInputContext(int32_t IMEEnabled,
-                    int32_t IMEOpen,
-                    nsString type,
-                    nsString inputmode,
-                    nsString actionHint,
-                    int32_t cause,
-                    int32_t focusChange);
+    prio(urgent) async SetInputContext(int32_t IMEEnabled,
+                                       int32_t IMEOpen,
+                                       nsString type,
+                                       nsString inputmode,
+                                       nsString actionHint,
+                                       int32_t cause,
+                                       int32_t focusChange);
 
     sync IsParentWindowMainWidgetVisible() returns (bool visible);
 
     /**
      * Gets the DPI of the screen corresponding to this browser.
      */
     sync GetDPI() returns (float value);
 

--- a/dom/ipc/PContent.ipdl
+++ b/dom/ipc/PContent.ipdl
@@ -325,17 +325,17 @@ struct ClipboardCapabilities {
   bool supportsFindClipboard;
 };
 
 union MaybeFileDesc {
     FileDescriptor;
     void_t;
 };
 
-prio(normal upto high) intr protocol PContent
+prio(normal upto urgent) intr protocol PContent
 {
     parent spawns PPluginModule;
 
     parent opens PCompositor;
     parent opens PSharedBufferManager;
     parent opens PImageBridge;
     child opens PBackground;
 

--- a/dom/ipc/PContentBridge.ipdl
+++ b/dom/ipc/PContentBridge.ipdl
@@ -23,17 +23,17 @@ namespace dom {
 /*
  * PContentBridge allows us to represent a parent/child relationship between two
  * child processes.  When a child process wants to open its own child, it asks
  * the root process to create a new process and then bridge them.  The first
  * child will allocate the PContentBridgeParent, and the newly opened child will
  * allocate the PContentBridgeChild.  This protocol allows these processes to
  * share PBrowsers and send messages to each other.
  */
-prio(normal upto high) intr protocol PContentBridge
+prio(normal upto urgent) intr protocol PContentBridge
 {
     bridges PContent, PContent;
 
     manages PBlob;
     manages PBrowser;
     manages PJavaScript;
 
 parent:

--- a/netwerk/cookie/PCookieService.ipdl
+++ b/netwerk/cookie/PCookieService.ipdl
@@ -22,17 +22,17 @@ namespace net {
  * all cookie operations. Lower-level programmatic operations (i.e. those
  * provided by the nsICookieManager and nsICookieManager2 interfaces) are not
  * currently implemented and requesting these interfaces in the child will fail.
  *
  * @see nsICookieService
  * @see nsICookiePermission
  */
 
-sync protocol PCookieService
+prio(normal upto urgent) sync protocol PCookieService
 {
   manager PNecko;
 
 parent:
 
   /*
    * Get the complete cookie string associated with the URI. This is a sync
    * call in order to avoid race conditions -- for instance, an HTTP response
@@ -55,20 +55,20 @@ parent:
    *        being set on.
    *
    * @see nsICookieService.getCookieString
    * @see nsICookieService.getCookieStringFromHttp
    * @see mozIThirdPartyUtil.isThirdPartyChannel
    *
    * @return the resulting cookie string.
    */
-  sync GetCookieString(URIParams host,
-                       bool isForeign,
-                       bool fromHttp,
-                       SerializedLoadContext loadContext)
+  prio(urgent) sync GetCookieString(URIParams host,
+                                    bool isForeign,
+                                    bool fromHttp,
+                                    SerializedLoadContext loadContext)
        returns (nsCString result);
 
   /*
    * Set a cookie string.
    *
    * @param host
    *        Same as the 'aURI' argument to nsICookieService.setCookieString.
    * @param isForeign
@@ -90,21 +90,21 @@ parent:
    * @param loadContext
    *        The loadContext from the HTTP channel or document that the cookie is
    *        being set on.
    *
    * @see nsICookieService.setCookieString
    * @see nsICookieService.setCookieStringFromHttp
    * @see mozIThirdPartyUtil.isThirdPartyChannel
    */
-  SetCookieString(URIParams host,
-                  bool isForeign,
-                  nsCString cookieString,
-                  nsCString serverTime,
-                  bool fromHttp,
-                  SerializedLoadContext loadContext);
+  prio(urgent) async SetCookieString(URIParams host,
+                                     bool isForeign,
+                                     nsCString cookieString,
+                                     nsCString serverTime,
+                                     bool fromHttp,
+                                     SerializedLoadContext loadContext);
 
   __delete__();
 };
 
 }
 }
 

--- a/netwerk/ipc/PNecko.ipdl
+++ b/netwerk/ipc/PNecko.ipdl
@@ -30,17 +30,17 @@ include PBrowserOrId;
 
 using class IPC::SerializedLoadContext from "SerializedLoadContext.h";
 using mozilla::dom::TabId from "mozilla/dom/ipc/IdType.h";
 
 namespace mozilla {
 namespace net {
 
 //-------------------------------------------------------------------
-sync protocol PNecko
+prio(normal upto urgent) sync protocol PNecko
 {
   manager PContent;
   manages PHttpChannel;
   manages PCookieService;
   manages PWyciwygChannel;
   manages PFTPChannel;
   manages PWebSocket;
   manages PTCPSocket;
@@ -50,17 +50,17 @@ sync protocol PNecko
   manages PRemoteOpenFile;
   manages PRtspController;
   manages PRtspChannel;
   manages PChannelDiverter;
 
 parent:
   __delete__();
 
-  PCookieService();
+  prio(urgent) async PCookieService();
   PHttpChannel(PBrowserOrId browser,
                SerializedLoadContext loadContext,
                HttpChannelCreationArgs args);
   PWyciwygChannel();
   PFTPChannel(PBrowserOrId browser, SerializedLoadContext loadContext,
               FTPChannelCreationArgs args);
 
   PWebSocket(PBrowserOrId browser, SerializedLoadContext loadContext);

--- a/toolkit/components/addoncompat/RemoteAddonsParent.jsm
+++ b/toolkit/components/addoncompat/RemoteAddonsParent.jsm
@@ -704,17 +704,18 @@ RemoteBrowserElementInterposition.getter
   // and immediately set contentWindow.location.
   if (!target.contentWindowAsCPOW) {
     return makeDummyContentWindow(target);
   }
   return target.contentWindowAsCPOW;
 };
 
 let DummyContentDocument = {
-  readyState: "loading"
+  readyState: "loading",
+  location: { href: "about:blank" }
 };
 
 RemoteBrowserElementInterposition.getters.contentDocument = function(addon, target) {
   // If we don't have a CPOW yet, just return something we can use to
   // examine readyState. This is useful for tests that create a new
   // tab and then immediately start polling readyState.
   if (!target.contentDocumentAsCPOW) {
     return DummyContentDocument;