--- a/accessible/windows/msaa/EnumVariant.cpp
+++ b/accessible/windows/msaa/EnumVariant.cpp
@@ -9,20 +9,18 @@
 using namespace mozilla;
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // ChildrenEnumVariant
 ////////////////////////////////////////////////////////////////////////////////
 
 IMPL_IUNKNOWN_QUERY_HEAD(ChildrenEnumVariant)
-IMPL_IUNKNOWN_QUERY_IFACE(IEnumVARIANT);
-IMPL_IUNKNOWN_QUERY_IFACE(IUnknown);
-IMPL_IUNKNOWN_QUERY_AGGR_COND(mAnchorAcc, !mAnchorAcc->IsDefunct());
-IMPL_IUNKNOWN_QUERY_TAIL
+IMPL_IUNKNOWN_QUERY_IFACE(IEnumVARIANT)
+IMPL_IUNKNOWN_QUERY_TAIL_AGGREGATED(mAnchorAcc)
 
 STDMETHODIMP
 ChildrenEnumVariant::Next(ULONG aCount, VARIANT FAR* aItems,
                           ULONG FAR* aCountFetched)
 {
   A11Y_TRYBLOCK_BEGIN
 
   if (!aItems || !aCountFetched)

--- a/caps/BasePrincipal.cpp
+++ b/caps/BasePrincipal.cpp
@@ -61,16 +61,23 @@ PrincipalOriginAttributes::InheritFromNe
   mUserContextId = aAttrs.mUserContextId;
   mSignedPkg = aAttrs.mSignedPkg;
 
   mPrivateBrowsingId = aAttrs.mPrivateBrowsingId;
   mFirstPartyDomain = aAttrs.mFirstPartyDomain;
 }
 
 void
+PrincipalOriginAttributes::StripUserContextIdAndFirstPartyDomain()
+{
+  mUserContextId = nsIScriptSecurityManager::DEFAULT_USER_CONTEXT_ID;
+  mFirstPartyDomain.Truncate();
+}
+
+void
 DocShellOriginAttributes::InheritFromDocToChildDocShell(const PrincipalOriginAttributes& aAttrs)
 {
   mAppId = aAttrs.mAppId;
   mInIsolatedMozBrowser = aAttrs.mInIsolatedMozBrowser;
 
   // addonId is computed from the principal URI and never propagated
   mUserContextId = aAttrs.mUserContextId;
 
@@ -712,16 +719,33 @@ BasePrincipal::CreateCodebasePrincipal(c
 
   nsCOMPtr<nsIURI> uri;
   nsresult rv = NS_NewURI(getter_AddRefs(uri), originNoSuffix);
   NS_ENSURE_SUCCESS(rv, nullptr);
 
   return BasePrincipal::CreateCodebasePrincipal(uri, attrs);
 }
 
+already_AddRefed<BasePrincipal>
+BasePrincipal::CloneStrippingUserContextIdAndFirstPartyDomain()
+{
+  PrincipalOriginAttributes attrs = OriginAttributesRef();
+  attrs.StripUserContextIdAndFirstPartyDomain();
+
+  nsAutoCString originNoSuffix;
+  nsresult rv = GetOriginNoSuffix(originNoSuffix);
+  NS_ENSURE_SUCCESS(rv, nullptr);
+
+  nsCOMPtr<nsIURI> uri;
+  rv = NS_NewURI(getter_AddRefs(uri), originNoSuffix);
+  NS_ENSURE_SUCCESS(rv, nullptr);
+
+  return BasePrincipal::CreateCodebasePrincipal(uri, attrs);
+}
+
 bool
 BasePrincipal::AddonAllowsLoad(nsIURI* aURI)
 {
   if (mOriginAttributes.mAddonId.IsEmpty()) {
     return false;
   }
 
   nsCOMPtr<nsIAddonPolicyService> aps = do_GetService("@mozilla.org/addons/policy-service;1");

--- a/caps/BasePrincipal.h
+++ b/caps/BasePrincipal.h
@@ -99,16 +99,18 @@ public:
   //
   // @param aAttrs  Origin Attributes of the docshell.
   // @param aURI    The URI of the document.
   void InheritFromDocShellToDoc(const DocShellOriginAttributes& aAttrs,
                                 const nsIURI* aURI);
 
   // Inherit OriginAttributes from Necko.
   void InheritFromNecko(const NeckoOriginAttributes& aAttrs);
+
+  void StripUserContextIdAndFirstPartyDomain();
 };
 
 // For OriginAttributes stored on docshells / loadcontexts / browsing contexts.
 class DocShellOriginAttributes : public OriginAttributes
 {
 public:
   DocShellOriginAttributes() {}
   DocShellOriginAttributes(uint32_t aAppId, bool aInIsolatedMozBrowser)
@@ -309,16 +311,18 @@ public:
     eNullPrincipal,
     eCodebasePrincipal,
     eExpandedPrincipal,
     eSystemPrincipal
   };
 
   virtual PrincipalKind Kind() = 0;
 
+  already_AddRefed<BasePrincipal> CloneStrippingUserContextIdAndFirstPartyDomain();
+
 protected:
   virtual ~BasePrincipal();
 
   virtual nsresult GetOriginInternal(nsACString& aOrigin) = 0;
   virtual bool SubsumesInternal(nsIPrincipal* aOther, DocumentDomainConsideration aConsider) = 0;
 
   // Internal, side-effect-free check to determine whether the concrete
   // principal would allow the load ignoring any common behavior implemented in

--- a/caps/nsScriptSecurityManager.cpp
+++ b/caps/nsScriptSecurityManager.cpp
@@ -142,24 +142,25 @@ GetPrincipalDomainOrigin(nsIPrincipal* a
   if (!uri) {
     aPrincipal->GetURI(getter_AddRefs(uri));
   }
   NS_ENSURE_TRUE(uri, NS_ERROR_UNEXPECTED);
 
   return GetOriginFromURI(uri, aOrigin);
 }
 
-inline void SetPendingException(JSContext *cx, const char *aMsg)
+inline void SetPendingExceptionASCII(JSContext *cx, const char *aMsg)
 {
-    JS_ReportError(cx, "%s", aMsg);
+    JS_ReportErrorASCII(cx, "%s", aMsg);
 }
 
 inline void SetPendingException(JSContext *cx, const char16_t *aMsg)
 {
-    JS_ReportError(cx, "%hs", aMsg);
+    // FIXME: Need to convert to UTF-8 (bug XXX).
+    JS_ReportErrorLatin1(cx, "%hs", aMsg);
 }
 
 // Helper class to get stuff from the ClassInfo and not waste extra time with
 // virtual method calls for things it has already gotten
 class ClassInfoData
 {
 public:
     ClassInfoData(nsIClassInfo *aClassInfo, const char *aName)
@@ -591,17 +592,17 @@ nsScriptSecurityManager::CheckLoadURIFro
 
     // Report error.
     nsAutoCString spec;
     if (NS_FAILED(aURI->GetAsciiSpec(spec)))
         return NS_ERROR_FAILURE;
     nsAutoCString msg("Access to '");
     msg.Append(spec);
     msg.AppendLiteral("' from script denied");
-    SetPendingException(cx, msg.get());
+    SetPendingExceptionASCII(cx, msg.get());
     return NS_ERROR_DOM_BAD_URI;
 }
 
 /**
  * Helper method to handle cases where a flag passed to
  * CheckLoadURIWithPrincipal means denying loading if the given URI has certain
  * nsIProtocolHandler flags set.
  * @return if success, access is allowed. Otherwise, deny access
@@ -1300,34 +1301,34 @@ nsScriptSecurityManager::CanCreateInstan
         return NS_OK;
     }
 
     //-- Access denied, report an error
     nsAutoCString errorMsg("Permission denied to create instance of class. CID=");
     char cidStr[NSID_LENGTH];
     aCID.ToProvidedString(cidStr);
     errorMsg.Append(cidStr);
-    SetPendingException(cx, errorMsg.get());
+    SetPendingExceptionASCII(cx, errorMsg.get());
     return NS_ERROR_DOM_XPCONNECT_ACCESS_DENIED;
 }
 
 NS_IMETHODIMP
 nsScriptSecurityManager::CanGetService(JSContext *cx,
                                        const nsCID &aCID)
 {
     if (nsContentUtils::IsCallerChrome()) {
         return NS_OK;
     }
 
     //-- Access denied, report an error
     nsAutoCString errorMsg("Permission denied to get service. CID=");
     char cidStr[NSID_LENGTH];
     aCID.ToProvidedString(cidStr);
     errorMsg.Append(cidStr);
-    SetPendingException(cx, errorMsg.get());
+    SetPendingExceptionASCII(cx, errorMsg.get());
     return NS_ERROR_DOM_XPCONNECT_ACCESS_DENIED;
 }
 
 /////////////////////////////////////
 // Method implementing nsIObserver //
 /////////////////////////////////////
 const char sJSEnabledPrefName[] = "javascript.enabled";
 const char sFileOriginPolicyPrefName[] =

deleted file mode 100644
--- a/config/external/sqlite/Makefile.in
+++ /dev/null
@@ -1,5 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-LIB_IS_C_ONLY    = 1

--- a/devtools/client/webconsole/test/browser_webconsole_inspect-parsed-documents.js
+++ b/devtools/client/webconsole/test/browser_webconsole_inspect-parsed-documents.js
@@ -16,17 +16,17 @@ const TEST_CASES = [
   },
   {
     input: '(new DOMParser()).parseFromString("<a />", "application/xml")',
     output: "XMLDocument",
     inspectable: true,
   },
   {
     input: '(new DOMParser()).parseFromString("<svg></svg>", "image/svg+xml")',
-    output: "SVGDocument",
+    output: "XMLDocument",
     inspectable: true,
   },
 ];
 
 const TEST_URI = "data:text/html;charset=utf8," +
   "browser_webconsole_inspect-parsed-documents.js";
 add_task(function* () {
   let {tab} = yield loadTab(TEST_URI);

--- a/dom/animation/test/css-transitions/file_animation-cancel.html
+++ b/dom/animation/test/css-transitions/file_animation-cancel.html
@@ -113,25 +113,53 @@ test(function(t) {
   assert_equals(getComputedStyle(div).marginLeft, '1000px',
                 'margin-left style is still not animated after updating'
                 + ' transition-duration');
   assert_equals(animation.playState, 'idle',
                 'Transition is still idle after updating transition-duration');
 }, 'After cancelling a transition, updating transition properties doesn\'t make'
    + ' it live again');
 
-test(function(t) {
+promise_test(function(t) {
   var div = addDiv(t, { style: 'margin-left: 0px' });
   flushComputedStyle(div);
 
   div.style.transition = 'margin-left 100s';
   div.style.marginLeft = '1000px';
   flushComputedStyle(div);
 
   var animation = div.getAnimations()[0];
-  div.style.display = 'none';
-  assert_equals(animation.playState, 'idle');
-  assert_equals(getComputedStyle(div).marginLeft, '1000px');
+  return animation.ready.then(function() {
+    assert_equals(animation.playState, 'running');
+    div.style.display = 'none';
+    return waitForFrame();
+  }).then(function() {
+    assert_equals(animation.playState, 'idle');
+    assert_equals(getComputedStyle(div).marginLeft, '1000px');
+  });
 }, 'Setting display:none on an element cancels its transitions');
 
+promise_test(function(t) {
+  var parentDiv = addDiv(t);
+  var childDiv = document.createElement('div');
+  parentDiv.appendChild(childDiv);
+  childDiv.setAttribute('style', 'margin-left: 0px');
+
+  flushComputedStyle(childDiv);
+
+  childDiv.style.transition = 'margin-left 100s';
+  childDiv.style.marginLeft = '1000px';
+  flushComputedStyle(childDiv);
+
+  var animation = childDiv.getAnimations()[0];
+  return animation.ready.then(function() {
+    assert_equals(animation.playState, 'running');
+    parentDiv.style.display = 'none';
+    return waitForFrame();
+  }).then(function() {
+    assert_equals(animation.playState, 'idle');
+    assert_equals(getComputedStyle(childDiv).marginLeft, '1000px');
+  });
+}, 'Setting display:none cancels transitions on a child element');
+
 done();
 </script>
 </body>

--- a/dom/base/BlobSet.cpp
+++ b/dom/base/BlobSet.cpp
@@ -7,49 +7,34 @@
 #include "mozilla/dom/BlobSet.h"
 #include "mozilla/CheckedInt.h"
 #include "mozilla/dom/File.h"
 #include "MultipartBlobImpl.h"
 
 namespace mozilla {
 namespace dom {
 
-already_AddRefed<Blob>
-BlobSet::GetBlobInternal(nsISupports* aParent,
-                         const nsACString& aContentType,
-                         ErrorResult& aRv)
-{
-  nsTArray<RefPtr<BlobImpl>> subImpls(GetBlobImpls());
-  RefPtr<BlobImpl> blobImpl =
-    MultipartBlobImpl::Create(Move(subImpls),
-                              NS_ConvertASCIItoUTF16(aContentType),
-                              aRv);
-  if (NS_WARN_IF(aRv.Failed())) {
-    return nullptr;
-  }
-
-  RefPtr<Blob> blob = Blob::Create(aParent, blobImpl);
-  return blob.forget();
-}
-
 nsresult
 BlobSet::AppendVoidPtr(const void* aData, uint32_t aLength)
 {
   NS_ENSURE_ARG_POINTER(aData);
   if (!aLength) {
     return NS_OK;
   }
 
-  uint64_t offset = mDataLen;
-
-  if (!ExpandBufferSize(aLength)) {
+  void* data = malloc(aLength);
+  if (!data) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
-  memcpy((char*)mData + offset, aData, aLength);
+  memcpy((char*)data, aData, aLength);
+
+  RefPtr<BlobImpl> blobImpl = new BlobImplMemory(data, aLength, EmptyString());
+  mBlobImpls.AppendElement(blobImpl);
+
   return NS_OK;
 }
 
 nsresult
 BlobSet::AppendString(const nsAString& aString, bool nativeEOL, JSContext* aCx)
 {
   nsCString utf8Str = NS_ConvertUTF16toUTF8(aString);
 
@@ -66,74 +51,14 @@ BlobSet::AppendString(const nsAString& a
   return AppendVoidPtr((void*)utf8Str.Data(),
                        utf8Str.Length());
 }
 
 nsresult
 BlobSet::AppendBlobImpl(BlobImpl* aBlobImpl)
 {
   NS_ENSURE_ARG_POINTER(aBlobImpl);
-
-  Flush();
   mBlobImpls.AppendElement(aBlobImpl);
-
-  return NS_OK;
-}
-
-nsresult
-BlobSet::AppendBlobImpls(const nsTArray<RefPtr<BlobImpl>>& aBlobImpls)
-{
-  Flush();
-  mBlobImpls.AppendElements(aBlobImpls);
-
   return NS_OK;
 }
 
-bool
-BlobSet::ExpandBufferSize(uint64_t aSize)
-{
-  if (mDataBufferLen >= mDataLen + aSize) {
-    mDataLen += aSize;
-    return true;
-  }
-
-  // Start at 1 or we'll loop forever.
-  CheckedUint32 bufferLen =
-    std::max<uint32_t>(static_cast<uint32_t>(mDataBufferLen), 1);
-  while (bufferLen.isValid() && bufferLen.value() < mDataLen + aSize) {
-    bufferLen *= 2;
-  }
-
-  if (!bufferLen.isValid()) {
-    return false;
-  }
-
-  void* data = realloc(mData, bufferLen.value());
-  if (!data) {
-    return false;
-  }
-
-  mData = data;
-  mDataBufferLen = bufferLen.value();
-  mDataLen += aSize;
-  return true;
-}
-
-void
-BlobSet::Flush()
-{
-  if (mData) {
-    // If we have some data, create a blob for it
-    // and put it on the stack
-
-    RefPtr<BlobImpl> blobImpl =
-      new BlobImplMemory(mData, mDataLen, EmptyString());
-    mBlobImpls.AppendElement(blobImpl);
-
-    mData = nullptr; // The nsDOMMemoryFile takes ownership of the buffer
-    mDataLen = 0;
-    mDataBufferLen = 0;
-    return;
-  }
-}
-
 } // dom namespace
 } // mozilla namespace

--- a/dom/base/BlobSet.h
+++ b/dom/base/BlobSet.h
@@ -7,55 +7,30 @@
 #ifndef mozilla_dom_BlobSet_h
 #define mozilla_dom_BlobSet_h
 
 #include "mozilla/RefPtr.h"
 
 namespace mozilla {
 namespace dom {
 
-class Blob;
 class BlobImpl;
 
 class BlobSet final
 {
 public:
-  BlobSet()
-    : mData(nullptr)
-    , mDataLen(0)
-    , mDataBufferLen(0)
-  {}
-
-  ~BlobSet()
-  {
-    free(mData);
-  }
-
   nsresult AppendVoidPtr(const void* aData, uint32_t aLength);
 
   nsresult AppendString(const nsAString& aString, bool nativeEOL,
                         JSContext* aCx);
 
   nsresult AppendBlobImpl(BlobImpl* aBlobImpl);
 
-  nsresult AppendBlobImpls(const nsTArray<RefPtr<BlobImpl>>& aBlobImpls);
-
-  nsTArray<RefPtr<BlobImpl>>& GetBlobImpls() { Flush(); return mBlobImpls; }
-
-  already_AddRefed<Blob> GetBlobInternal(nsISupports* aParent,
-                                         const nsACString& aContentType,
-                                         ErrorResult& aRv);
+  nsTArray<RefPtr<BlobImpl>>& GetBlobImpls() { return mBlobImpls; }
 
 private:
-  bool ExpandBufferSize(uint64_t aSize);
-
-  void Flush();
-
   nsTArray<RefPtr<BlobImpl>> mBlobImpls;
-  void* mData;
-  uint64_t mDataLen;
-  uint64_t mDataBufferLen;
 };
 
 } // namespace dom
 } // namespace mozilla
 
 #endif // mozilla_dom_BlobSet_h

--- a/dom/base/Location.cpp
+++ b/dom/base/Location.cpp
@@ -905,30 +905,33 @@ Location::GetSourceBaseURL(JSContext* cx
     }
   }
   NS_ENSURE_TRUE(doc, NS_OK);
   *sourceURL = doc->GetBaseURI().take();
   return NS_OK;
 }
 
 bool
-Location::CallerSubsumes()
+Location::CallerSubsumes(nsIPrincipal* aSubjectPrincipal)
 {
+  MOZ_ASSERT(aSubjectPrincipal);
+
   // Get the principal associated with the location object.  Note that this is
   // the principal of the page which will actually be navigated, not the
   // principal of the Location object itself.  This is why we need this check
   // even though we only allow limited cross-origin access to Location objects
   // in general.
   nsCOMPtr<nsPIDOMWindowOuter> outer = mInnerWindow->GetOuterWindow();
   if (MOZ_UNLIKELY(!outer))
     return false;
   nsCOMPtr<nsIScriptObjectPrincipal> sop = do_QueryInterface(outer);
   bool subsumes = false;
   nsresult rv =
-    nsContentUtils::SubjectPrincipal()->SubsumesConsideringDomain(sop->GetPrincipal(), &subsumes);
+    aSubjectPrincipal->SubsumesConsideringDomain(sop->GetPrincipal(),
+                                                 &subsumes);
   NS_ENSURE_SUCCESS(rv, false);
   return subsumes;
 }
 
 JSObject*
 Location::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto)
 {
   return LocationBinding::Wrap(aCx, this, aGivenProto);

--- a/dom/base/Location.h
+++ b/dom/base/Location.h
@@ -39,129 +39,190 @@ public:
 
   void SetDocShell(nsIDocShell *aDocShell);
   nsIDocShell *GetDocShell();
 
   // nsIDOMLocation
   NS_DECL_NSIDOMLOCATION
 
   #define THROW_AND_RETURN_IF_CALLER_DOESNT_SUBSUME() { \
-    if (!CallerSubsumes()) { \
+    MOZ_ASSERT(aSubjectPrincipal.isSome()); \
+    if (!CallerSubsumes(aSubjectPrincipal.value())) { \
       aError.Throw(NS_ERROR_DOM_SECURITY_ERR); \
       return; \
     } \
   }
 
   // WebIDL API:
-  void Assign(const nsAString& aUrl, ErrorResult& aError)
+  void Assign(const nsAString& aUrl,
+              const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+              ErrorResult& aError)
   {
     THROW_AND_RETURN_IF_CALLER_DOESNT_SUBSUME();
     aError = Assign(aUrl);
   }
 
-  void Replace(const nsAString& aUrl, ErrorResult& aError)
+  void Replace(const nsAString& aUrl,
+               const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+               ErrorResult& aError)
   {
     aError = Replace(aUrl);
   }
 
-  void Reload(bool aForceget, ErrorResult& aError)
+  void Reload(bool aForceget,
+              const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+              ErrorResult& aError)
   {
     THROW_AND_RETURN_IF_CALLER_DOESNT_SUBSUME();
     aError = Reload(aForceget);
   }
-  void GetHref(nsAString& aHref, ErrorResult& aError)
+
+  void GetHref(nsAString& aHref,
+               const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+               ErrorResult& aError)
   {
     THROW_AND_RETURN_IF_CALLER_DOESNT_SUBSUME();
     aError = GetHref(aHref);
   }
-  void SetHref(const nsAString& aHref, ErrorResult& aError)
+
+  void SetHref(const nsAString& aHref,
+               const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+               ErrorResult& aError)
   {
     aError = SetHref(aHref);
   }
-  void GetOrigin(nsAString& aOrigin, ErrorResult& aError)
+
+  void GetOrigin(nsAString& aOrigin,
+                 const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+                 ErrorResult& aError)
   {
     THROW_AND_RETURN_IF_CALLER_DOESNT_SUBSUME();
     aError = GetOrigin(aOrigin);
   }
-  void GetProtocol(nsAString& aProtocol, ErrorResult& aError)
+
+  void GetProtocol(nsAString& aProtocol,
+                   const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+                   ErrorResult& aError)
   {
     THROW_AND_RETURN_IF_CALLER_DOESNT_SUBSUME();
     aError = GetProtocol(aProtocol);
   }
-  void SetProtocol(const nsAString& aProtocol, ErrorResult& aError)
+
+  void SetProtocol(const nsAString& aProtocol,
+                   const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+                   ErrorResult& aError)
   {
     THROW_AND_RETURN_IF_CALLER_DOESNT_SUBSUME();
     aError = SetProtocol(aProtocol);
   }
-  void GetHost(nsAString& aHost, ErrorResult& aError)
+
+  void GetHost(nsAString& aHost,
+               const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+               ErrorResult& aError)
   {
     THROW_AND_RETURN_IF_CALLER_DOESNT_SUBSUME();
     aError = GetHost(aHost);
   }
-  void SetHost(const nsAString& aHost, ErrorResult& aError)
+
+  void SetHost(const nsAString& aHost,
+               const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+               ErrorResult& aError)
   {
     THROW_AND_RETURN_IF_CALLER_DOESNT_SUBSUME();
     aError = SetHost(aHost);
   }
-  void GetHostname(nsAString& aHostname, ErrorResult& aError)
+
+  void GetHostname(nsAString& aHostname,
+                   const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+                   ErrorResult& aError)
   {
     THROW_AND_RETURN_IF_CALLER_DOESNT_SUBSUME();
     aError = GetHostname(aHostname);
   }
-  void SetHostname(const nsAString& aHostname, ErrorResult& aError)
+
+  void SetHostname(const nsAString& aHostname,
+                   const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+                   ErrorResult& aError)
   {
     THROW_AND_RETURN_IF_CALLER_DOESNT_SUBSUME();
     aError = SetHostname(aHostname);
   }
-  void GetPort(nsAString& aPort, ErrorResult& aError)
+
+  void GetPort(nsAString& aPort,
+               const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+               ErrorResult& aError)
   {
     THROW_AND_RETURN_IF_CALLER_DOESNT_SUBSUME();
     aError = GetPort(aPort);
   }
-  void SetPort(const nsAString& aPort, ErrorResult& aError)
+
+  void SetPort(const nsAString& aPort,
+               const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+               ErrorResult& aError)
   {
     THROW_AND_RETURN_IF_CALLER_DOESNT_SUBSUME();
     aError = SetPort(aPort);
   }
-  void GetPathname(nsAString& aPathname, ErrorResult& aError)
+
+  void GetPathname(nsAString& aPathname,
+                   const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+                   ErrorResult& aError)
   {
     THROW_AND_RETURN_IF_CALLER_DOESNT_SUBSUME();
     aError = GetPathname(aPathname);
   }
-  void SetPathname(const nsAString& aPathname, ErrorResult& aError)
+
+  void SetPathname(const nsAString& aPathname,
+                   const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+                   ErrorResult& aError)
   {
     THROW_AND_RETURN_IF_CALLER_DOESNT_SUBSUME();
     aError = SetPathname(aPathname);
   }
-  void GetSearch(nsAString& aSeach, ErrorResult& aError)
+
+  void GetSearch(nsAString& aSeach,
+                 const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+                 ErrorResult& aError)
   {
     THROW_AND_RETURN_IF_CALLER_DOESNT_SUBSUME();
     aError = GetSearch(aSeach);
   }
-  void SetSearch(const nsAString& aSeach, ErrorResult& aError)
+
+  void SetSearch(const nsAString& aSeach,
+                 const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+                 ErrorResult& aError)
   {
     THROW_AND_RETURN_IF_CALLER_DOESNT_SUBSUME();
     aError = SetSearch(aSeach);
   }
 
-  void GetHash(nsAString& aHash, ErrorResult& aError)
+  void GetHash(nsAString& aHash,
+               const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+               ErrorResult& aError)
   {
     THROW_AND_RETURN_IF_CALLER_DOESNT_SUBSUME();
     aError = GetHash(aHash);
   }
-  void SetHash(const nsAString& aHash, ErrorResult& aError)
+
+  void SetHash(const nsAString& aHash,
+               const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+               ErrorResult& aError)
   {
     THROW_AND_RETURN_IF_CALLER_DOESNT_SUBSUME();
     aError = SetHash(aHash);
   }
-  void Stringify(nsAString& aRetval, ErrorResult& aError)
+
+  void Stringify(nsAString& aRetval,
+                 const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+                 ErrorResult& aError)
   {
     // GetHref checks CallerSubsumes.
-    GetHref(aRetval, aError);
+    GetHref(aRetval, aSubjectPrincipal, aError);
   }
+
   nsPIDOMWindowInner* GetParentObject() const
   {
     return mInnerWindow;
   }
 
   virtual JSObject* WrapObject(JSContext* aCx,
                                JS::Handle<JSObject*> aGivenProto) override;
 
@@ -180,17 +241,17 @@ protected:
   nsresult SetURI(nsIURI* aURL, bool aReplace = false);
   nsresult SetHrefWithBase(const nsAString& aHref, nsIURI* aBase,
                            bool aReplace);
   nsresult SetHrefWithContext(JSContext* cx, const nsAString& aHref,
                               bool aReplace);
 
   nsresult GetSourceBaseURL(JSContext* cx, nsIURI** sourceURL);
   nsresult CheckURL(nsIURI *url, nsIDocShellLoadInfo** aLoadInfo);
-  bool CallerSubsumes();
+  bool CallerSubsumes(nsIPrincipal* aSubjectPrincipal);
 
   nsString mCachedHash;
   nsCOMPtr<nsPIDOMWindowInner> mInnerWindow;
   nsWeakPtr mDocShell;
 };
 
 } // dom namespace
 } // mozilla namespace

copy from dom/base/BlobSet.cpp
copy to dom/base/MutableBlobStorage.cpp
--- a/dom/base/BlobSet.cpp
+++ b/dom/base/MutableBlobStorage.cpp
@@ -1,100 +1,497 @@
 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "mozilla/dom/BlobSet.h"
+#include "mozilla/dom/MutableBlobStorage.h"
 #include "mozilla/CheckedInt.h"
 #include "mozilla/dom/File.h"
-#include "MultipartBlobImpl.h"
+#include "nsAnonymousTemporaryFile.h"
+#include "nsNetCID.h"
+#include "WorkerPrivate.h"
+
+#define BLOB_MEMORY_TEMPORARY_FILE 1048576
 
 namespace mozilla {
 namespace dom {
 
-already_AddRefed<Blob>
-BlobSet::GetBlobInternal(nsISupports* aParent,
-                         const nsACString& aContentType,
-                         ErrorResult& aRv)
+namespace {
+
+// This class uses the callback to inform when the Blob is created or when the
+// error must be propagated.
+class BlobCreationDoneRunnable final : public Runnable
+{
+public:
+  BlobCreationDoneRunnable(MutableBlobStorage* aBlobStorage,
+                           MutableBlobStorageCallback* aCallback,
+                           Blob* aBlob,
+                           nsresult aRv)
+    : mBlobStorage(aBlobStorage)
+    , mCallback(aCallback)
+    , mBlob(aBlob)
+    , mRv(aRv)
+  {
+    MOZ_ASSERT(aBlobStorage);
+    MOZ_ASSERT(aCallback);
+    MOZ_ASSERT((NS_FAILED(aRv) && !aBlob) ||
+               (NS_SUCCEEDED(aRv) && aBlob));
+  }
+
+  NS_IMETHOD
+  Run() override
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+    mCallback->BlobStoreCompleted(mBlobStorage, mBlob, mRv);
+    mCallback = nullptr;
+    mBlob = nullptr;
+    return NS_OK;
+  }
+
+private:
+  ~BlobCreationDoneRunnable()
+  {
+    // If something when wrong, we still have to release these objects in the
+    // correct thread.
+    NS_ReleaseOnMainThread(mCallback.forget());
+    NS_ReleaseOnMainThread(mBlob.forget());
+  }
+
+  RefPtr<MutableBlobStorage> mBlobStorage;
+  RefPtr<MutableBlobStorageCallback> mCallback;
+  RefPtr<Blob> mBlob;
+  nsresult mRv;
+};
+
+// This runnable goes back to the main-thread and informs the BlobStorage about
+// the temporary file.
+class FileCreatedRunnable final : public Runnable
+{
+public:
+  FileCreatedRunnable(MutableBlobStorage* aBlobStorage, PRFileDesc* aFD)
+    : mBlobStorage(aBlobStorage)
+    , mFD(aFD)
+  {
+    MOZ_ASSERT(!NS_IsMainThread());
+    MOZ_ASSERT(aBlobStorage);
+    MOZ_ASSERT(aFD);
+  }
+
+  NS_IMETHOD
+  Run() override
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+    mBlobStorage->TemporaryFileCreated(mFD);
+    mFD = nullptr;
+    return NS_OK;
+  }
+
+private:
+  ~FileCreatedRunnable()
+  {
+    // If something when wrong, we still have to close the FileDescriptor.
+    if (mFD) {
+      PR_Close(mFD);
+    }
+  }
+
+  RefPtr<MutableBlobStorage> mBlobStorage;
+  PRFileDesc* mFD;
+};
+
+// This runnable creates the temporary file. When done, FileCreatedRunnable is
+// dispatched back to the main-thread.
+class CreateTemporaryFileRunnable final : public Runnable
+{
+public:
+  explicit CreateTemporaryFileRunnable(MutableBlobStorage* aBlobStorage)
+    : mBlobStorage(aBlobStorage)
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+    MOZ_ASSERT(aBlobStorage);
+  }
+
+  NS_IMETHOD
+  Run() override
+  {
+    MOZ_ASSERT(!NS_IsMainThread());
+
+    PRFileDesc* tempFD = nullptr;
+    nsresult rv = NS_OpenAnonymousTemporaryFile(&tempFD);
+    if (NS_WARN_IF(NS_FAILED(rv))) {
+      // In sandboxed context we are not allowed to create temporary files, but
+      // this doesn't mean that BlobStorage should fail. We can continue to
+      // store data in memory.  We don't change the storageType so that we don't
+      // try to create a temporary file again.
+      return NS_OK;
+    }
+
+    // The ownership of the tempFD is moved to the FileCreatedRunnable.
+    return NS_DispatchToMainThread(new FileCreatedRunnable(mBlobStorage, tempFD));
+  }
+
+private:
+  RefPtr<MutableBlobStorage> mBlobStorage;
+};
+
+// Simple runnable to propagate the error to the BlobStorage.
+class ErrorPropagationRunnable final : public Runnable
+{
+public:
+  ErrorPropagationRunnable(MutableBlobStorage* aBlobStorage, nsresult aRv)
+    : mBlobStorage(aBlobStorage)
+    , mRv(aRv)
+  {}
+
+  NS_IMETHOD
+  Run() override
+  {
+    mBlobStorage->ErrorPropagated(mRv);
+    return NS_OK;
+  }
+
+private:
+  RefPtr<MutableBlobStorage> mBlobStorage;
+  nsresult mRv;
+};
+
+// This runnable moves a buffer to the IO thread and there, it writes it into
+// the temporary file.
+class WriteRunnable final : public Runnable
 {
-  nsTArray<RefPtr<BlobImpl>> subImpls(GetBlobImpls());
-  RefPtr<BlobImpl> blobImpl =
-    MultipartBlobImpl::Create(Move(subImpls),
-                              NS_ConvertASCIItoUTF16(aContentType),
-                              aRv);
-  if (NS_WARN_IF(aRv.Failed())) {
-    return nullptr;
+public:
+  static WriteRunnable*
+  CopyBuffer(MutableBlobStorage* aBlobStorage, PRFileDesc* aFD,
+             const void* aData, uint32_t aLength)
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+    MOZ_ASSERT(aBlobStorage);
+    MOZ_ASSERT(aFD);
+    MOZ_ASSERT(aData);
+
+    // We have to take a copy of this buffer.
+    void* data = malloc(aLength);
+    if (!data) {
+      return nullptr;
+    }
+
+    memcpy((char*)data, aData, aLength);
+    return new WriteRunnable(aBlobStorage, aFD, data, aLength);
+  }
+
+  static WriteRunnable*
+  AdoptBuffer(MutableBlobStorage* aBlobStorage, PRFileDesc* aFD,
+              void* aData, uint32_t aLength)
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+    MOZ_ASSERT(aBlobStorage);
+    MOZ_ASSERT(aFD);
+    MOZ_ASSERT(aData);
+
+    return new WriteRunnable(aBlobStorage, aFD, aData, aLength);
+  }
+
+  NS_IMETHOD
+  Run() override
+  {
+    MOZ_ASSERT(!NS_IsMainThread());
+
+    int32_t written = PR_Write(mFD, mData, mLength);
+    if (NS_WARN_IF(written < 0 || uint32_t(written) != mLength)) {
+      return NS_DispatchToMainThread(
+        new ErrorPropagationRunnable(mBlobStorage, NS_ERROR_FAILURE));
+    }
+
+    return NS_OK;
+  }
+
+private:
+  WriteRunnable(MutableBlobStorage* aBlobStorage, PRFileDesc* aFD,
+                void* aData, uint32_t aLength)
+    : mBlobStorage(aBlobStorage)
+    , mFD(aFD)
+    , mData(aData)
+    , mLength(aLength)
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+    MOZ_ASSERT(mBlobStorage);
+    MOZ_ASSERT(aFD);
+    MOZ_ASSERT(aData);
+  }
+
+  ~WriteRunnable()
+  {
+    free(mData);
+  }
+
+  RefPtr<MutableBlobStorage> mBlobStorage;
+  PRFileDesc* mFD;
+  void* mData;
+  uint32_t mLength;
+};
+
+// This runnable closes the FD in case something goes wrong or the temporary
+// file is not needed anymore.
+class CloseFileRunnable final : public Runnable
+{
+public:
+  explicit CloseFileRunnable(PRFileDesc* aFD)
+    : mFD(aFD)
+  {}
+
+  NS_IMETHOD
+  Run() override
+  {
+    MOZ_ASSERT(!NS_IsMainThread());
+    PR_Close(mFD);
+    mFD = nullptr;
+    return NS_OK;
+  }
+
+private:
+  ~CloseFileRunnable()
+  {
+    if (mFD) {
+      PR_Close(mFD);
+    }
+  }
+
+  PRFileDesc* mFD;
+};
+
+// This runnable is dispatched to the main-thread from the IO thread and its
+// task is to create the blob and inform the callback.
+class CreateBlobRunnable final : public Runnable
+{
+public:
+  CreateBlobRunnable(MutableBlobStorage* aBlobStorage,
+                     already_AddRefed<nsISupports> aParent,
+                     const nsACString& aContentType,
+                     already_AddRefed<MutableBlobStorageCallback> aCallback)
+    : mBlobStorage(aBlobStorage)
+    , mParent(aParent)
+    , mContentType(aContentType)
+    , mCallback(aCallback)
+  {
+    MOZ_ASSERT(!NS_IsMainThread());
+  }
+
+  NS_IMETHOD
+  Run() override
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+    mBlobStorage->CreateBlobAndRespond(mParent.forget(), mContentType,
+                                       mCallback.forget());
+    return NS_OK;
+  }
+
+private:
+  ~CreateBlobRunnable()
+  {
+    // If something when wrong, we still have to release data in the correct
+    // thread.
+    NS_ReleaseOnMainThread(mParent.forget());
+    NS_ReleaseOnMainThread(mCallback.forget());
+  }
+
+  RefPtr<MutableBlobStorage> mBlobStorage;
+  nsCOMPtr<nsISupports> mParent;
+  nsCString mContentType;
+  RefPtr<MutableBlobStorageCallback> mCallback;
+};
+
+// This task is used to know when the writing is completed. From the IO thread
+// it dispatches a CreateBlobRunnable to the main-thread.
+class LastRunnable final : public Runnable
+{
+public:
+  LastRunnable(MutableBlobStorage* aBlobStorage,
+               nsISupports* aParent,
+               const nsACString& aContentType,
+               MutableBlobStorageCallback* aCallback)
+    : mBlobStorage(aBlobStorage)
+    , mParent(aParent)
+    , mContentType(aContentType)
+    , mCallback(aCallback)
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+    MOZ_ASSERT(mBlobStorage);
+    MOZ_ASSERT(aParent);
+    MOZ_ASSERT(aCallback);
+  }
+
+  NS_IMETHOD
+  Run() override
+  {
+    MOZ_ASSERT(!NS_IsMainThread());
+    RefPtr<Runnable> runnable =
+      new CreateBlobRunnable(mBlobStorage, mParent.forget(),
+                             mContentType, mCallback.forget());
+    return NS_DispatchToMainThread(runnable);
+  }
+
+private:
+  ~LastRunnable()
+  {
+    // If something when wrong, we still have to release data in the correct
+    // thread.
+    NS_ReleaseOnMainThread(mParent.forget());
+    NS_ReleaseOnMainThread(mCallback.forget());
+  }
+
+  RefPtr<MutableBlobStorage> mBlobStorage;
+  nsCOMPtr<nsISupports> mParent;
+  nsCString mContentType;
+  RefPtr<MutableBlobStorageCallback> mCallback;
+};
+
+} // anonymous namespace
+
+MutableBlobStorage::MutableBlobStorage(MutableBlobStorageType aType)
+  : mData(nullptr)
+  , mDataLen(0)
+  , mDataBufferLen(0)
+  , mStorageState(aType == eOnlyInMemory ? eKeepInMemory : eInMemory)
+  , mFD(nullptr)
+  , mErrorResult(NS_OK)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+}
+
+MutableBlobStorage::~MutableBlobStorage()
+{
+  free(mData);
+
+  if (mFD) {
+    DispatchToIOThread(new CloseFileRunnable(mFD));
+  }
+}
+
+uint64_t
+MutableBlobStorage::GetBlobWhenReady(nsISupports* aParent,
+                                     const nsACString& aContentType,
+                                     MutableBlobStorageCallback* aCallback)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(aParent);
+  MOZ_ASSERT(aCallback);
+
+  // GetBlob can be called just once.
+  MOZ_ASSERT(mStorageState != eClosed);
+  StorageState previousState = mStorageState;
+  mStorageState = eClosed;
+
+  if (previousState == eInTemporaryFile) {
+    MOZ_ASSERT(mFD);
+
+    if (NS_FAILED(mErrorResult)) {
+      NS_DispatchToMainThread(
+        new BlobCreationDoneRunnable(this, aCallback, nullptr, mErrorResult));
+      return 0;
+    }
+
+    // We want to wait until all the WriteRunnable are completed. The way we do
+    // this is to go to the I/O thread and then we come back: the runnables are
+    // executed in order and this LastRunnable will be... the last one.
+    nsresult rv = DispatchToIOThread(new LastRunnable(this, aParent,
+                                                      aContentType, aCallback));
+    if (NS_WARN_IF(NS_FAILED(rv))) {
+      NS_DispatchToMainThread(
+        new BlobCreationDoneRunnable(this, aCallback, nullptr, rv));
+      return 0;
+    }
+
+    return mDataLen;
+  }
+
+  RefPtr<BlobImpl> blobImpl;
+
+  if (mData) {
+    blobImpl = new BlobImplMemory(mData, mDataLen,
+                                  NS_ConvertUTF8toUTF16(aContentType));
+
+    mData = nullptr; // The BlobImplMemory takes ownership of the buffer
+    mDataLen = 0;
+    mDataBufferLen = 0;
+  } else {
+    blobImpl = new EmptyBlobImpl(NS_ConvertUTF8toUTF16(aContentType));
   }
 
   RefPtr<Blob> blob = Blob::Create(aParent, blobImpl);
-  return blob.forget();
+  RefPtr<BlobCreationDoneRunnable> runnable =
+    new BlobCreationDoneRunnable(this, aCallback, blob, NS_OK);
+
+  nsresult error = NS_DispatchToMainThread(runnable);
+  if (NS_WARN_IF(NS_FAILED(error))) {
+    return 0;
+  }
+
+  return mDataLen;
 }
 
 nsresult
-BlobSet::AppendVoidPtr(const void* aData, uint32_t aLength)
+MutableBlobStorage::Append(const void* aData, uint32_t aLength)
 {
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(mStorageState != eClosed);
   NS_ENSURE_ARG_POINTER(aData);
+
   if (!aLength) {
     return NS_OK;
   }
 
+  // If eInMemory is the current Storage state, we could maybe migrate to
+  // a temporary file.
+  if (mStorageState == eInMemory && ShouldBeTemporaryStorage(aLength)) {
+    nsresult rv = MaybeCreateTemporaryFile();
+    if (NS_WARN_IF(NS_FAILED(rv))) {
+      return rv;
+    }
+  }
+
+  // If we are already in the temporaryFile mode, we have to dispatch a
+  // runnable.
+  if (mStorageState == eInTemporaryFile) {
+    MOZ_ASSERT(mFD);
+
+    RefPtr<WriteRunnable> runnable =
+      WriteRunnable::CopyBuffer(this, mFD, aData, aLength);
+    if (NS_WARN_IF(!runnable)) {
+      return NS_ERROR_OUT_OF_MEMORY;
+    }
+
+    nsresult rv = DispatchToIOThread(runnable);
+    if (NS_WARN_IF(NS_FAILED(rv))) {
+      return rv;
+    }
+
+    mDataLen += aLength;
+    return NS_OK;
+  }
+
+  // By default, we store in memory.
+
   uint64_t offset = mDataLen;
 
   if (!ExpandBufferSize(aLength)) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
   memcpy((char*)mData + offset, aData, aLength);
   return NS_OK;
 }
 
-nsresult
-BlobSet::AppendString(const nsAString& aString, bool nativeEOL, JSContext* aCx)
+bool
+MutableBlobStorage::ExpandBufferSize(uint64_t aSize)
 {
-  nsCString utf8Str = NS_ConvertUTF16toUTF8(aString);
-
-  if (nativeEOL) {
-    if (utf8Str.Contains('\r')) {
-      utf8Str.ReplaceSubstring("\r\n", "\n");
-      utf8Str.ReplaceSubstring("\r", "\n");
-    }
-#ifdef XP_WIN
-    utf8Str.ReplaceSubstring("\n", "\r\n");
-#endif
-  }
-
-  return AppendVoidPtr((void*)utf8Str.Data(),
-                       utf8Str.Length());
-}
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(mStorageState < eInTemporaryFile);
 
-nsresult
-BlobSet::AppendBlobImpl(BlobImpl* aBlobImpl)
-{
-  NS_ENSURE_ARG_POINTER(aBlobImpl);
-
-  Flush();
-  mBlobImpls.AppendElement(aBlobImpl);
-
-  return NS_OK;
-}
-
-nsresult
-BlobSet::AppendBlobImpls(const nsTArray<RefPtr<BlobImpl>>& aBlobImpls)
-{
-  Flush();
-  mBlobImpls.AppendElements(aBlobImpls);
-
-  return NS_OK;
-}
-
-bool
-BlobSet::ExpandBufferSize(uint64_t aSize)
-{
   if (mDataBufferLen >= mDataLen + aSize) {
     mDataLen += aSize;
     return true;
   }
 
   // Start at 1 or we'll loop forever.
   CheckedUint32 bufferLen =
     std::max<uint32_t>(static_cast<uint32_t>(mDataBufferLen), 1);
@@ -112,28 +509,109 @@ BlobSet::ExpandBufferSize(uint64_t aSize
   }
 
   mData = data;
   mDataBufferLen = bufferLen.value();
   mDataLen += aSize;
   return true;
 }
 
-void
-BlobSet::Flush()
+bool
+MutableBlobStorage::ShouldBeTemporaryStorage(uint64_t aSize) const
 {
-  if (mData) {
-    // If we have some data, create a blob for it
-    // and put it on the stack
+  MOZ_ASSERT(mStorageState == eInMemory);
+
+  CheckedUint32 bufferSize = mDataLen;
+  bufferSize += aSize;
+
+  if (!bufferSize.isValid()) {
+    return false;
+  }
+
+  return bufferSize.value() >= Preferences::GetUint("dom.blob.memoryToTemporaryFile",
+                                                    BLOB_MEMORY_TEMPORARY_FILE);
+}
+
+nsresult
+MutableBlobStorage::MaybeCreateTemporaryFile()
+{
+  nsresult rv = DispatchToIOThread(new CreateTemporaryFileRunnable(this));
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
 
-    RefPtr<BlobImpl> blobImpl =
-      new BlobImplMemory(mData, mDataLen, EmptyString());
-    mBlobImpls.AppendElement(blobImpl);
+  mStorageState = eWaitingForTemporaryFile;
+  return NS_OK;
+}
+
+void
+MutableBlobStorage::TemporaryFileCreated(PRFileDesc* aFD)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(mStorageState == eWaitingForTemporaryFile ||
+             mStorageState == eClosed);
 
-    mData = nullptr; // The nsDOMMemoryFile takes ownership of the buffer
-    mDataLen = 0;
-    mDataBufferLen = 0;
+  if (mStorageState == eClosed) {
+    DispatchToIOThread(new CloseFileRunnable(aFD));
+    return;
+  }
+
+  mStorageState = eInTemporaryFile;
+  mFD = aFD;
+
+  RefPtr<WriteRunnable> runnable =
+    WriteRunnable::AdoptBuffer(this, mFD, mData, mDataLen);
+  MOZ_ASSERT(runnable);
+
+  mData = nullptr;
+
+  nsresult rv = DispatchToIOThread(runnable);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    mErrorResult = rv;
     return;
   }
 }
 
+void
+MutableBlobStorage::CreateBlobAndRespond(already_AddRefed<nsISupports> aParent,
+                                         const nsACString& aContentType,
+                                         already_AddRefed<MutableBlobStorageCallback> aCallback)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(mStorageState == eClosed);
+  MOZ_ASSERT(mFD);
+
+  nsCOMPtr<nsISupports> parent(aParent);
+  RefPtr<MutableBlobStorageCallback> callback(aCallback);
+
+  RefPtr<Blob> blob =
+    File::CreateTemporaryBlob(parent, mFD, 0, mDataLen,
+                              NS_ConvertUTF8toUTF16(aContentType));
+  callback->BlobStoreCompleted(this, blob, NS_OK);
+
+  // ownership of this FD is moved to the BlobImpl.
+  mFD = nullptr;
+}
+
+void
+MutableBlobStorage::ErrorPropagated(nsresult aRv)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  mErrorResult = aRv;
+}
+
+/* static */ nsresult
+MutableBlobStorage::DispatchToIOThread(Runnable* aRunnable)
+{
+  nsCOMPtr<nsIEventTarget> target
+    = do_GetService(NS_STREAMTRANSPORTSERVICE_CONTRACTID);
+  MOZ_ASSERT(target);
+
+  nsresult rv = target->Dispatch(aRunnable, NS_DISPATCH_NORMAL);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+
+  return NS_OK;
+}
+
 } // dom namespace
 } // mozilla namespace

copy from dom/base/BlobSet.h
copy to dom/base/MutableBlobStorage.h
--- a/dom/base/BlobSet.h
+++ b/dom/base/MutableBlobStorage.h
@@ -1,61 +1,98 @@
 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifndef mozilla_dom_BlobSet_h
-#define mozilla_dom_BlobSet_h
+#ifndef mozilla_dom_MutableBlobStorage_h
+#define mozilla_dom_MutableBlobStorage_h
 
 #include "mozilla/RefPtr.h"
+#include "prio.h"
 
 namespace mozilla {
 namespace dom {
 
 class Blob;
 class BlobImpl;
+class MutableBlobStorage;
 
-class BlobSet final
+class MutableBlobStorageCallback
+{
+public:
+  NS_IMETHOD_(MozExternalRefCountType) AddRef(void) = 0;
+
+  NS_IMETHOD_(MozExternalRefCountType) Release(void) = 0;
+
+  virtual void BlobStoreCompleted(MutableBlobStorage* aBlobStorage,
+                                  Blob* aBlob,
+                                  nsresult aRv) = 0;
+};
+
+// This class is main-thread only.
+class MutableBlobStorage final
 {
 public:
-  BlobSet()
-    : mData(nullptr)
-    , mDataLen(0)
-    , mDataBufferLen(0)
-  {}
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(MutableBlobStorage);
 
-  ~BlobSet()
+  enum MutableBlobStorageType
   {
-    free(mData);
-  }
+    eOnlyInMemory,
+    eCouldBeInTemporaryFile,
+  };
 
-  nsresult AppendVoidPtr(const void* aData, uint32_t aLength);
+  explicit MutableBlobStorage(MutableBlobStorageType aType);
+
+  nsresult Append(const void* aData, uint32_t aLength);
 
-  nsresult AppendString(const nsAString& aString, bool nativeEOL,
-                        JSContext* aCx);
-
-  nsresult AppendBlobImpl(BlobImpl* aBlobImpl);
+  // This method can be called just once.
+  // The callback will be called when the Blob is ready.
+  // The return value is the total size of the blob, when created.
+  uint64_t GetBlobWhenReady(nsISupports* aParent,
+                            const nsACString& aContentType,
+                            MutableBlobStorageCallback* aCallback);
 
-  nsresult AppendBlobImpls(const nsTArray<RefPtr<BlobImpl>>& aBlobImpls);
-
-  nsTArray<RefPtr<BlobImpl>>& GetBlobImpls() { Flush(); return mBlobImpls; }
+  void TemporaryFileCreated(PRFileDesc* aFD);
 
-  already_AddRefed<Blob> GetBlobInternal(nsISupports* aParent,
-                                         const nsACString& aContentType,
-                                         ErrorResult& aRv);
+  void  CreateBlobAndRespond(already_AddRefed<nsISupports> aParent,
+                             const nsACString& aContentType,
+                             already_AddRefed<MutableBlobStorageCallback> aCallback);
+
+  void ErrorPropagated(nsresult aRv);
 
 private:
+  ~MutableBlobStorage();
+
   bool ExpandBufferSize(uint64_t aSize);
 
-  void Flush();
+  bool ShouldBeTemporaryStorage(uint64_t aSize) const;
+
+  nsresult MaybeCreateTemporaryFile();
 
-  nsTArray<RefPtr<BlobImpl>> mBlobImpls;
+  static nsresult DispatchToIOThread(Runnable* aRunnable);
+
+  // All these variables are touched on the main thread only.
+
   void* mData;
   uint64_t mDataLen;
   uint64_t mDataBufferLen;
+
+  enum StorageState {
+    eKeepInMemory,
+    eInMemory,
+    eWaitingForTemporaryFile,
+    eInTemporaryFile,
+    eClosed
+  };
+
+  StorageState mStorageState;
+
+  PRFileDesc* mFD;
+
+  nsresult mErrorResult;
 };
 
 } // namespace dom
 } // namespace mozilla
 
-#endif // mozilla_dom_BlobSet_h
+#endif // mozilla_dom_MutableBlobStorage_h

--- a/dom/base/domerr.msg
+++ b/dom/base/domerr.msg
@@ -161,8 +161,21 @@ DOM4_MSG_DEF(InvalidStateError, "A subsc
 
 DOM_MSG_DEF(NS_ERROR_DOM_JS_EXCEPTION, "A callback threw an exception")
 DOM_MSG_DEF(NS_ERROR_DOM_DOMEXCEPTION, "A DOMException was thrown")
 
 /* Media errors */
 DOM4_MSG_DEF(AbortError,        "The fetching process for the media resource was aborted by the user agent at the user's request.", NS_ERROR_DOM_MEDIA_ABORT_ERR)
 DOM4_MSG_DEF(NotAllowedError,   "The play method is not allowed by the user agent or the platform in the current context, possibly because the user denied permission.", NS_ERROR_DOM_MEDIA_NOT_ALLOWED_ERR)
 DOM4_MSG_DEF(NotSupportedError, "The media resource indicated by the src attribute or assigned media provider object was not suitable.", NS_ERROR_DOM_MEDIA_NOT_SUPPORTED_ERR)
+
+DOM4_MSG_DEF(SyntaxError, "The URI is malformed.", NS_ERROR_DOM_MALFORMED_URI)
+DOM4_MSG_DEF(SyntaxError, "Invalid header name.", NS_ERROR_DOM_INVALID_HEADER_NAME)
+
+/* XMLHttpRequest errors. */
+DOM4_MSG_DEF(InvalidStateError, "XMLHttpRequest has an invalid context.", NS_ERROR_DOM_INVALID_STATE_XHR_HAS_INVALID_CONTEXT)
+DOM4_MSG_DEF(InvalidStateError, "XMLHttpRequest state must be OPENED.", NS_ERROR_DOM_INVALID_STATE_XHR_MUST_BE_OPENED)
+DOM4_MSG_DEF(InvalidStateError, "XMLHttpRequest must not be sending.", NS_ERROR_DOM_INVALID_STATE_XHR_MUST_NOT_BE_SENDING)
+DOM4_MSG_DEF(InvalidStateError, "XMLHttpRequest state must not be LOADING or DONE.", NS_ERROR_DOM_INVALID_STATE_XHR_MUST_NOT_BE_LOADING_OR_DONE)
+DOM4_MSG_DEF(InvalidStateError, "responseXML is only available if responseType is '' or 'document'.", NS_ERROR_DOM_INVALID_STATE_XHR_HAS_WRONG_RESPONSETYPE_FOR_RESPONSEXML)
+DOM4_MSG_DEF(InvalidStateError, "responseText is only available if responseType is '', 'document', or 'moz-chunked-text'.", NS_ERROR_DOM_INVALID_STATE_XHR_HAS_WRONG_RESPONSETYPE_FOR_RESPONSETEXT)
+DOM4_MSG_DEF(InvalidStateError, "synchronous XMLHttpRequests do not support 'moz-chunked-text' or 'moz-chunked-arraybuffer' responseType.", NS_ERROR_DOM_INVALID_STATE_XHR_CHUNKED_RESPONSETYPES_UNSUPPORTED_FOR_SYNC)
+DOM4_MSG_DEF(InvalidAccessError, "synchronous XMLHttpRequests do not support timeout and responseType.", NS_ERROR_DOM_INVALID_ACCESS_XHR_TIMEOUT_AND_RESPONSETYPE_UNSUPPORTED_FOR_SYNC)

--- a/dom/base/moz.build
+++ b/dom/base/moz.build
@@ -181,16 +181,17 @@ EXPORTS.mozilla.dom += [
     'FileReader.h',
     'FormData.h',
     'FragmentOrElement.h',
     'FromParser.h',
     'ImageEncoder.h',
     'ImportManager.h',
     'Link.h',
     'Location.h',
+    'MutableBlobStorage.h',
     'NameSpaceConstants.h',
     'Navigator.h',
     'NodeInfo.h',
     'NodeInfoInlines.h',
     'NodeIterator.h',
     'ProcessGlobal.h',
     'ResponsiveImageSelector.h',
     'SameProcessMessageQueue.h',
@@ -242,16 +243,17 @@ UNIFIED_SOURCES += [
     'FileReader.cpp',
     'FormData.cpp',
     'FragmentOrElement.cpp',
     'ImageEncoder.cpp',
     'ImportManager.cpp',
     'Link.cpp',
     'Location.cpp',
     'MultipartBlobImpl.cpp',
+    'MutableBlobStorage.cpp',
     'Navigator.cpp',
     'NodeInfo.cpp',
     'NodeIterator.cpp',
     'nsAtomListUtils.cpp',
     'nsAttrAndChildArray.cpp',
     'nsAttrValue.cpp',
     'nsAttrValueOrString.cpp',
     'nsCCUncollectableMarker.cpp',

--- a/dom/base/nsCCUncollectableMarker.cpp
+++ b/dom/base/nsCCUncollectableMarker.cpp
@@ -23,16 +23,17 @@
 #include "nsIXULWindow.h"
 #include "nsIAppShellService.h"
 #include "nsAppShellCID.h"
 #include "nsContentUtils.h"
 #include "nsGlobalWindow.h"
 #include "nsJSEnvironment.h"
 #include "nsInProcessTabChildGlobal.h"
 #include "nsFrameLoader.h"
+#include "mozilla/CycleCollectedJSContext.h"
 #include "mozilla/EventListenerManager.h"
 #include "mozilla/dom/Element.h"
 #include "mozilla/dom/ProcessGlobal.h"
 #include "xpcpublic.h"
 #include "nsObserverService.h"
 #include "nsFocusManager.h"
 #include "nsIInterfaceRequestorUtils.h"
 
@@ -308,16 +309,18 @@ MarkWindowList(nsISimpleEnumerator* aWin
       MarkDocShell(rootDocShell, aCleanupJS, aPrepareForCC);
 
       nsCOMPtr<nsITabChild> tabChild =
         rootDocShell ? rootDocShell->GetTabChild() : nullptr;
       if (tabChild) {
         nsCOMPtr<nsIContentFrameMessageManager> mm;
         tabChild->GetMessageManager(getter_AddRefs(mm));
         if (mm) {
+          // MarkForCC ends up calling UnmarkGray on message listeners, which
+          // TraceBlackJS can't do yet.
           mm->MarkForCC();
         }
       }
     }
   }
 }
 
 nsresult
@@ -484,29 +487,61 @@ mozilla::dom::TraceBlackJS(JSTracer* aTr
     }
   }
 #endif
 
   if (!nsCCUncollectableMarker::sGeneration) {
     return;
   }
 
+  if (nsFrameMessageManager::GetChildProcessManager()) {
+    nsIContentProcessMessageManager* pg = ProcessGlobal::Get();
+    if (pg) {
+      mozilla::TraceScriptHolder(pg, aTrc);
+    }
+  }
+
   // Mark globals of active windows black.
   nsGlobalWindow::WindowByIdTable* windowsById =
     nsGlobalWindow::GetWindowsTable();
   if (windowsById) {
     for (auto iter = windowsById->Iter(); !iter.Done(); iter.Next()) {
       nsGlobalWindow* window = iter.Data();
       if (window->GetDocShell() && window->IsOuterWindow()) {
         window->TraceGlobalJSObject(aTrc);
         EventListenerManager* elm = window->GetExistingListenerManager();
         if (elm) {
           elm->TraceListeners(aTrc);
         }
 
+        if (window->IsRootOuterWindow()) {
+          // In child process trace all the TabChildGlobals.
+          // Since there is one root outer window per TabChildGlobal, we need
+          // to look for only those windows, not all.
+          nsIDocShell* ds = window->GetDocShell();
+          if (ds) {
+            nsCOMPtr<nsITabChild> tabChild = ds->GetTabChild();
+            if (tabChild) {
+              nsCOMPtr<nsIContentFrameMessageManager> mm;
+              tabChild->GetMessageManager(getter_AddRefs(mm));
+              nsCOMPtr<EventTarget> et = do_QueryInterface(mm);
+              if (et) {
+                nsCOMPtr<nsISupports> tabChildAsSupports =
+                  do_QueryInterface(tabChild);
+                mozilla::TraceScriptHolder(tabChildAsSupports, aTrc);
+                EventListenerManager* elm = et->GetExistingListenerManager();
+                if (elm) {
+                  elm->TraceListeners(aTrc);
+                }
+                // As of now there isn't an easy way to trace message listeners.
+              }
+            }
+          }
+        }
+
 #ifdef MOZ_XUL
         nsIDocument* doc = window->GetExtantDoc();
         if (doc && doc->IsXULDocument()) {
           XULDocument* xulDoc = static_cast<XULDocument*>(doc);
           xulDoc->TraceProtos(aTrc, aGCNumber);
         }
 #endif
       }

--- a/dom/base/nsDeprecatedOperationList.h
+++ b/dom/base/nsDeprecatedOperationList.h
@@ -28,16 +28,17 @@ DEPRECATED_OPERATION(PrefixedVisibilityA
 DEPRECATED_OPERATION(NodeIteratorDetach)
 DEPRECATED_OPERATION(LenientThis)
 DEPRECATED_OPERATION(GetPreventDefault)
 DEPRECATED_OPERATION(GetSetUserData)
 DEPRECATED_OPERATION(MozGetAsFile)
 DEPRECATED_OPERATION(UseOfCaptureEvents)
 DEPRECATED_OPERATION(UseOfReleaseEvents)
 DEPRECATED_OPERATION(UseOfDOM3LoadMethod)
+DEPRECATED_OPERATION(ChromeUseOfDOM3LoadMethod)
 DEPRECATED_OPERATION(ShowModalDialog)
 DEPRECATED_OPERATION(Window_Content)
 DEPRECATED_OPERATION(SyncXMLHttpRequest)
 DEPRECATED_OPERATION(DataContainerEvent)
 DEPRECATED_OPERATION(Window_Controllers)
 DEPRECATED_OPERATION(ImportXULIntoContent)
 DEPRECATED_OPERATION(PannerNodeDoppler)
 DEPRECATED_OPERATION(NavigatorGetUserMedia)

--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -247,17 +247,17 @@
 #include "mozilla/dom/FontFaceSet.h"
 #include "mozilla/dom/BoxObject.h"
 #include "gfxPrefs.h"
 #include "nsISupportsPrimitives.h"
 #include "mozilla/StyleSetHandle.h"
 #include "mozilla/StyleSetHandleInlines.h"
 #include "mozilla/StyleSheet.h"
 #include "mozilla/StyleSheetInlines.h"
-
+#include "mozilla/dom/SVGSVGElement.h"
 #include "mozilla/DocLoadingTimelineMarker.h"
 
 #include "nsISpeculativeConnect.h"
 
 #include "mozilla/MediaManager.h"
 #ifdef MOZ_WEBRTC
 #include "IPeerConnection.h"
 #endif // MOZ_WEBRTC
@@ -3033,16 +3033,26 @@ nsDocument::GetAnimations(nsTArray<RefPt
   if (!root) {
     return;
   }
   AnimationFilter filter;
   filter.mSubtree = true;
   root->GetAnimations(filter, aAnimations);
 }
 
+SVGSVGElement*
+nsIDocument::GetSVGRootElement() const
+{
+  Element* root = GetRootElement();
+  if (!root || !root->IsSVGElement(nsGkAtoms::svg)) {
+    return nullptr;
+  }
+  return static_cast<SVGSVGElement*>(root);
+}
+
 /* Return true if the document is in the focused top-level window, and is an
  * ancestor of the focused DOMWindow. */
 NS_IMETHODIMP
 nsDocument::HasFocus(bool* aResult)
 {
   ErrorResult rv;
   *aResult = nsIDocument::HasFocus(rv);
   return rv.StealNSResult();
@@ -5967,40 +5977,16 @@ nsDocument::GetElementsByTagNameNS(const
   }
 
   // transfer ref to aReturn
   list.forget(aReturn);
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsDocument::GetAsync(bool *aAsync)
-{
-  NS_ERROR("nsDocument::GetAsync() should be overriden by subclass!");
-
-  return NS_ERROR_NOT_IMPLEMENTED;
-}
-
-NS_IMETHODIMP
-nsDocument::SetAsync(bool aAsync)
-{
-  NS_ERROR("nsDocument::SetAsync() should be overriden by subclass!");
-
-  return NS_ERROR_NOT_IMPLEMENTED;
-}
-
-NS_IMETHODIMP
-nsDocument::Load(const nsAString& aUrl, bool *aReturn)
-{
-  NS_ERROR("nsDocument::Load() should be overriden by subclass!");
-
-  return NS_ERROR_NOT_IMPLEMENTED;
-}
-
-NS_IMETHODIMP
 nsDocument::GetStyleSheets(nsIDOMStyleSheetList** aStyleSheets)
 {
   NS_ADDREF(*aStyleSheets = StyleSheets());
   return NS_OK;
 }
 
 StyleSheetList*
 nsDocument::StyleSheets()

--- a/dom/base/nsDocument.h
+++ b/dom/base/nsDocument.h
@@ -14,17 +14,17 @@
 #include "nsIDocument.h"
 
 #include "nsCOMPtr.h"
 #include "nsAutoPtr.h"
 #include "nsCRT.h"
 #include "nsWeakReference.h"
 #include "nsWeakPtr.h"
 #include "nsTArray.h"
-#include "nsIDOMXMLDocument.h"
+#include "nsIDOMDocument.h"
 #include "nsIDOMDocumentXBL.h"
 #include "nsStubDocumentObserver.h"
 #include "nsIScriptGlobalObject.h"
 #include "nsIContent.h"
 #include "nsIPrincipal.h"
 #include "nsIParser.h"
 #include "nsBindingManager.h"
 #include "nsInterfaceHashtable.h"
@@ -480,26 +480,18 @@ protected:
                                nsIDocument* aDisplayDocument);
 
   nsClassHashtable<nsURIHashKey, ExternalResource> mMap;
   nsRefPtrHashtable<nsURIHashKey, PendingLoad> mPendingLoads;
   bool mHaveShutDown;
 };
 
 // Base class for our document implementations.
-//
-// Note that this class *implements* nsIDOMXMLDocument, but it's not
-// really an nsIDOMXMLDocument. The reason for implementing
-// nsIDOMXMLDocument on this class is to avoid having to duplicate all
-// its inherited methods on document classes that *are*
-// nsIDOMXMLDocument's. nsDocument's QI should *not* claim to support
-// nsIDOMXMLDocument unless someone writes a real implementation of
-// the interface.
 class nsDocument : public nsIDocument,
-                   public nsIDOMXMLDocument, // inherits nsIDOMDocument
+                   public nsIDOMDocument,
                    public nsIDOMDocumentXBL,
                    public nsSupportsWeakReference,
                    public nsIScriptObjectPrincipal,
                    public nsIRadioGroupContainer,
                    public nsIApplicationCacheContainer,
                    public nsStubMutationObserver,
                    public nsIObserver,
                    public nsIDOMXPathEvaluator
@@ -793,19 +785,16 @@ private:
 
 public:
   // nsIDOMNode
   NS_FORWARD_NSIDOMNODE_TO_NSINODE_OVERRIDABLE
 
   // nsIDOMDocument
   NS_DECL_NSIDOMDOCUMENT
 
-  // nsIDOMXMLDocument
-  NS_DECL_NSIDOMXMLDOCUMENT
-
   // nsIDOMDocumentXBL
   NS_DECL_NSIDOMDOCUMENTXBL
 
   // nsIDOMEventTarget
   virtual nsresult PreHandleEvent(
                      mozilla::EventChainPreVisitor& aVisitor) override;
   virtual mozilla::EventListenerManager*
     GetOrCreateListenerManager() override;

--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -617,17 +617,17 @@ nsPIDOMWindow<T>::nsPIDOMWindow(nsPIDOMW
   mMayHaveMouseEnterLeaveEventListener(false),
   mMayHavePointerEnterLeaveEventListener(false),
   mInnerObjectsFreed(false),
   mIsModalContentWindow(false),
   mIsActive(false), mIsBackground(false),
   mMediaSuspend(Preferences::GetBool("media.block-autoplay-until-in-foreground", true) ?
     nsISuspendedTypes::SUSPENDED_BLOCK : nsISuspendedTypes::NONE_SUSPENDED),
   mAudioMuted(false), mAudioVolume(1.0), mAudioCaptured(false),
-  mDesktopModeViewport(false), mInnerWindow(nullptr),
+  mDesktopModeViewport(false), mIsRootOuterWindow(false), mInnerWindow(nullptr),
   mOuterWindow(aOuterWindow),
   // Make sure no actual window ends up with mWindowID == 0
   mWindowID(NextWindowID()), mHasNotifiedGlobalCreated(false),
   mMarkedCCGeneration(0), mServiceWorkersTestingEnabled(false)
  {}
 
 template<class T>
 nsPIDOMWindow<T>::~nsPIDOMWindow() {}
@@ -3062,16 +3062,17 @@ nsGlobalWindow::SetDocShell(nsIDocShell*
     // handler and receive all events that occur anywhere inside
     // our window.
     nsCOMPtr<nsPIDOMWindowOuter> parentWindow = GetParent();
     if (parentWindow.get() != AsOuter()) {
       mChromeEventHandler = parentWindow->GetChromeEventHandler();
     }
     else {
       mChromeEventHandler = NS_NewWindowRoot(AsOuter());
+      mIsRootOuterWindow = true;
     }
   }
 
   bool docShellActive;
   mDocShell->GetIsActive(&docShellActive);
   mIsBackground = !docShellActive;
 }
 

--- a/dom/base/nsIDocument.h
+++ b/dom/base/nsIDocument.h
@@ -143,16 +143,17 @@ class MediaQueryList;
 class GlobalObject;
 class NodeFilter;
 class NodeIterator;
 enum class OrientationType : uint32_t;
 class ProcessingInstruction;
 class Promise;
 class StyleSheetList;
 class SVGDocument;
+class SVGSVGElement;
 class Touch;
 class TouchList;
 class TreeWalker;
 class UndoManager;
 class XPathEvaluator;
 class XPathExpression;
 class XPathNSResolver;
 class XPathResult;
@@ -2323,16 +2324,18 @@ public:
 
   virtual already_AddRefed<mozilla::dom::UndoManager> GetUndoManager() = 0;
 
   virtual mozilla::dom::DocumentTimeline* Timeline() = 0;
 
   virtual void GetAnimations(
       nsTArray<RefPtr<mozilla::dom::Animation>>& aAnimations) = 0;
 
+  mozilla::dom::SVGSVGElement* GetSVGRootElement() const;
+
   nsresult ScheduleFrameRequestCallback(mozilla::dom::FrameRequestCallback& aCallback,
                                         int32_t *aHandle);
   void CancelFrameRequestCallback(int32_t aHandle);
 
   typedef nsTArray<RefPtr<mozilla::dom::FrameRequestCallback>> FrameRequestCallbackList;
   /**
    * Put this document's frame request callbacks into the provided
    * list, and forget about them.

--- a/dom/base/nsPIDOMWindow.h
+++ b/dom/base/nsPIDOMWindow.h
@@ -113,16 +113,22 @@ public:
    */
 
   virtual already_AddRefed<nsPIDOMWindowOuter> GetTop() = 0; // Outer only
   virtual already_AddRefed<nsPIDOMWindowOuter> GetParent() = 0;
   virtual nsPIDOMWindowOuter* GetScriptableTop() = 0;
   virtual nsPIDOMWindowOuter* GetScriptableParent() = 0;
   virtual already_AddRefed<nsPIWindowRoot> GetTopWindowRoot() = 0;
 
+  bool IsRootOuterWindow()
+  {
+    MOZ_ASSERT(IsOuterWindow());
+    return mIsRootOuterWindow;
+  }
+
   /**
    * Behavies identically to GetScriptableParent extept that it returns null
    * if GetScriptableParent would return this window.
    */
   virtual nsPIDOMWindowOuter* GetScriptableParentOrNull() = 0;
 
   // Inner windows only.
   virtual nsresult RegisterIdleObserver(nsIIdleObserver* aIdleObserver) = 0;
@@ -661,16 +667,18 @@ protected:
   bool                   mAudioMuted;
   float                  mAudioVolume;
 
   bool                   mAudioCaptured;
 
   // current desktop mode flag.
   bool                   mDesktopModeViewport;
 
+  bool                   mIsRootOuterWindow;
+
   // And these are the references between inner and outer windows.
   nsPIDOMWindowInner* MOZ_NON_OWNING_REF mInnerWindow;
   nsCOMPtr<nsPIDOMWindowOuter> mOuterWindow;
 
   // the element within the document that is currently focused when this
   // window is active
   nsCOMPtr<nsIContent> mFocusedNode;
 

--- a/dom/base/test/test_bug435425.html
+++ b/dom/base/test/test_bug435425.html
@@ -212,17 +212,17 @@ var tests =
   [
     { method: "GET", withUpload: none, testAbort: false, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
                        {target: XHR, type: "progress", optional: false},
                        {target: XHR, type: "load", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: none, testAbort: true, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
-                       {target: XHR, type: "progress", optional: false},
+                       {target: XHR, type: "progress", optional: true},
                        {target: XHR, type: "abort", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: none, testAbort: false, testRedirectError: true, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
                        {target: XHR, type: "error", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: none, testAbort: false, testRedirectError: false, testNetworkError: true,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
@@ -231,17 +231,17 @@ var tests =
 
     { method: "GET", withUpload: small, testAbort: false, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
                        {target: XHR, type: "progress", optional: false},
                        {target: XHR, type: "load", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: small, testAbort: true, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
-                       {target: XHR, type: "progress", optional: false},
+                       {target: XHR, type: "progress", optional: true},
                        {target: XHR, type: "abort", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: small, testAbort: false, testRedirectError: true, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
                        {target: XHR, type: "error", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: small, testAbort: false, testRedirectError: false, testNetworkError: true,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
@@ -250,17 +250,17 @@ var tests =
 
     { method: "GET", withUpload: mid, testAbort: false, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
                        {target: XHR, type: "progress", optional: false},
                        {target: XHR, type: "load", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: mid, testAbort: true, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
-                       {target: XHR, type: "progress", optional: false},
+                       {target: XHR, type: "progress", optional: true},
                        {target: XHR, type: "abort", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: mid, testAbort: false, testRedirectError: true, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
                        {target: XHR, type: "error", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: mid, testAbort: false, testRedirectError: false, testNetworkError: true,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
@@ -269,17 +269,17 @@ var tests =
 
     { method: "GET", withUpload: large, testAbort: false, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
                        {target: XHR, type: "progress", optional: false},
                        {target: XHR, type: "load", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: large, testAbort: true, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
-                       {target: XHR, type: "progress", optional: false},
+                       {target: XHR, type: "progress", optional: true},
                        {target: XHR, type: "abort", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: large, testAbort: false, testRedirectError: true, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
                        {target: XHR, type: "error", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "GET", withUpload: large, testAbort: false, testRedirectError: false, testNetworkError: true,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
@@ -288,17 +288,17 @@ var tests =
 
     { method: "POST", withUpload: none, testAbort: false, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
                        {target: XHR, type: "progress", optional: false},
                        {target: XHR, type: "load", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "POST", withUpload: none, testAbort: true, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
-                       {target: XHR, type: "progress", optional: false},
+                       {target: XHR, type: "progress", optional: true},
                        {target: XHR, type: "abort", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "POST", withUpload: none, testAbort: false, testRedirectError: true, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
                        {target: XHR, type: "error", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "POST", withUpload: none, testAbort: false, testRedirectError: false, testNetworkError: true,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
@@ -312,20 +312,20 @@ var tests =
                        {target: UPLOAD, type: "load", optional: false},
                        {target: UPLOAD, type: "loadend", optional: false},
                        {target: XHR, type: "progress", optional: false},
                        {target: XHR, type: "load", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "POST", withUpload: small, testAbort: true, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
                        {target: UPLOAD, type: "loadstart", optional: false},
-                       {target: UPLOAD, type: "progress", optional: false},
+                       {target: UPLOAD, type: "progress", optional: true},
                        {target: UPLOAD, type: "abort", optional: false},
                        {target: UPLOAD, type: "loadend", optional: false},
-                       {target: XHR, type: "progress", optional: false},
+                       {target: XHR, type: "progress", optional: true},
                        {target: XHR, type: "abort", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "POST", withUpload: small, testAbort: false, testRedirectError: true, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
                        {target: UPLOAD, type: "loadstart", optional: false},
                        {target: UPLOAD, type: "progress", optional: true},
                        {target: UPLOAD, type: "error", optional: false},
                        {target: UPLOAD, type: "loadend", optional: false},
@@ -346,20 +346,20 @@ var tests =
                        {target: UPLOAD, type: "load", optional: false},
                        {target: UPLOAD, type: "loadend", optional: false},
                        {target: XHR, type: "progress", optional: false},
                        {target: XHR, type: "load", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "POST", withUpload: mid, testAbort: true, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
                        {target: UPLOAD, type: "loadstart", optional: false},
-                       {target: UPLOAD, type: "progress", optional: false},
+                       {target: UPLOAD, type: "progress", optional: true},
                        {target: UPLOAD, type: "abort", optional: false},
                        {target: UPLOAD, type: "loadend", optional: false},
-                       {target: XHR, type: "progress", optional: false},
+                       {target: XHR, type: "progress", optional: true},
                        {target: XHR, type: "abort", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "POST", withUpload: mid, testAbort: false, testRedirectError: true, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
                        {target: UPLOAD, type: "loadstart", optional: false},
                        {target: UPLOAD, type: "progress", optional: true},
                        {target: UPLOAD, type: "error", optional: false},
                        {target: UPLOAD, type: "loadend", optional: false},
@@ -380,20 +380,20 @@ var tests =
                        {target: UPLOAD, type: "load", optional: false},
                        {target: UPLOAD, type: "loadend", optional: false},
                        {target: XHR, type: "progress", optional: false},
                        {target: XHR, type: "load", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "POST", withUpload: large, testAbort: true, testRedirectError: false, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
                        {target: UPLOAD, type: "loadstart", optional: false},
-                       {target: UPLOAD, type: "progress", optional: false},
+                       {target: UPLOAD, type: "progress", optional: true},
                        {target: UPLOAD, type: "abort", optional: false},
                        {target: UPLOAD, type: "loadend", optional: false},
-                       {target: XHR, type: "progress", optional: false},
+                       {target: XHR, type: "progress", optional: true},
                        {target: XHR, type: "abort", optional: false},
                        {target: XHR, type: "loadend", optional: false}]},
     { method: "POST", withUpload: large, testAbort: false, testRedirectError: true, testNetworkError: false,
       expectedEvents: [{target: XHR, type: "loadstart", optional: false},
                        {target: UPLOAD, type: "loadstart", optional: false},
                        {target: UPLOAD, type: "progress", optional: true},
                        {target: UPLOAD, type: "error", optional: false},
                        {target: UPLOAD, type: "loadend", optional: false},

--- a/dom/base/test/test_bug450160.html
+++ b/dom/base/test/test_bug450160.html
@@ -29,18 +29,16 @@ function testHTMLDocuments(ids, isXHTML)
     ok(docType1, "No doctype?");
     ok(docType1.ownerDocument, "docType should have ownerDocument!");
     var doc1 = document.implementation.createDocument(null, null, docType1);
     is(docType1.ownerDocument, doc1, "docType should have ownerDocument!");
     ok(!doc1.documentElement, "Document shouldn't have document element!");
     is(doc1.body, null, "Shouldn't have .body!");
     ok(doc1 instanceof HTMLDocument,
        "Document should be an HTML document!");
-    ok(!(doc1 instanceof SVGDocument),
-       "Document shouldn't be an SVG document!");
 
     var docType2 =
       document.implementation.createDocumentType(isXHTML ? "html" : "HTML",
                                                  ids[i],
                                                  null);
     var doc2 = document.implementation.createDocument(
       "http://www.w3.org/1999/xhtml", "html", docType2);
     is(docType2.ownerDocument, doc2, "docType should have ownerDocument!");
@@ -65,62 +63,57 @@ function testSVGDocument() {
                                                  null);
   ok(docType1, "No doctype?");
   ok(docType1.ownerDocument, "docType should have ownerDocument!");
   var doc1 = document.implementation.createDocument(null, null, docType1);
   is(docType1.ownerDocument, doc1, "docType should have ownerDocument!");
   ok(!doc1.documentElement, "Document shouldn't have document element!");
   ok(!(doc1 instanceof HTMLDocument),
      "Document shouldn't be an HTML document!");
-  ok(doc1 instanceof SVGDocument,
-     "Document should be an SVG document!");
+  ok(doc1 instanceof XMLDocument,
+     "Document should be an XML document!");
 
-  // SVG documents have .rootElement.
-  ok("rootElement" in doc1, "No .rootElement in document");
+  // SVG documents have .documentElement.
+  ok("documentElement" in doc1, "No .documentElement in document");
 
   var docType2 =
       document.implementation.createDocumentType("svg",
                                                  "-//W3C//DTD SVG 1.1//EN",
                                                  null);
   var doc2 = document.implementation.createDocument("http://www.w3.org/2000/svg",
                                                     "svg", docType2);
   ok(doc2.documentElement, "Document should have document element!");
-  ok(doc2.rootElement, "Should have .rootElement in document");
-  is(doc2.rootElement.localName, "svg", "Wrong .rootElement!");
+  is(doc2.documentElement.localName, "svg", "Wrong .documentElement!");
 }
 
 function testFooBarDocument() {
   var docType1 =
       document.implementation.createDocumentType("FooBar", "FooBar", null);
   ok(docType1, "No doctype?");
   ok(docType1.ownerDocument, "docType should have ownerDocument!");
   var doc1 = document.implementation.createDocument(null, null, docType1);
   is(docType1.ownerDocument, doc1, "docType should have ownerDocument!");
   ok(!doc1.documentElement, "Document shouldn't have document element!");
   ok(!(doc1 instanceof HTMLDocument),
      "Document shouldn't be an HTML document!");
-  ok(!(doc1 instanceof SVGDocument),
-     "Document shouldn't be an SVG document!");
 
   var docType2 =
       document.implementation.createDocumentType("FooBar", "FooBar", null);
   var doc2 = document.implementation.createDocument("FooBarNS",
                                                     "FooBar", docType2);
   ok(doc2.documentElement, "Document should have document element!");
   is(doc2.documentElement.namespaceURI, "FooBarNS", "Wrong namespaceURI!");
   is(doc2.documentElement.localName, "FooBar", "Wrong localName!");
 }
 
 function testNullDocTypeDocument() {
   var doc1 = document.implementation.createDocument(null, null, null);
   ok(!doc1.documentElement, "Document shouldn't have document element!");
   ok(!(doc1 instanceof HTMLDocument),
      "Document shouldn't be an HTML document!");
-  ok(!(doc1 instanceof SVGDocument),
-     "Document shouldn't be an SVG document!");
 
   var doc2 = document.implementation.createDocument("FooBarNS",
                                                     "FooBar", null);
   ok(doc2.documentElement, "Document should have document element!");
   is(doc2.documentElement.namespaceURI, "FooBarNS", "Wrong namespaceURI!");
   is(doc2.documentElement.localName, "FooBar", "Wrong localName!");
 }
 

--- a/dom/base/test/test_bug693875.html
+++ b/dom/base/test/test_bug693875.html
@@ -18,22 +18,17 @@ https://bugzilla.mozilla.org/show_bug.cg
 <script type="application/javascript">
 
 /** Test for Bug 693875 **/
 
 var dp = new DOMParser();
 var d = dp.parseFromString("<?xml version='1.0'?><svg xmlns='http://www.w3.org/2000/svg'></svg>",
                            "image/svg+xml");
 
-ok(d instanceof SVGDocument, "Should have created an SVG document.");
-ok("rootElement" in d, "Should have created an SVG document, which has .rootElement.");
+ok(d instanceof XMLDocument, "Should have created an XML document.");
+ok("documentElement" in d, "Should have created an XML document, which has .documentElement.");
 is(d.documentElement.localName, "svg", "Root element should be svg.");
 is(d.documentElement.namespaceURI, "http://www.w3.org/2000/svg",
    "Root element should be in svg namespace.");
-
-dp = new DOMParser();
-d = dp.parseFromString("<?xml version='1.0'?><svg xmlns='http://www.w3.org/2000/svg'></svg>",
-                       "text/xml");
-ok(!(d instanceof SVGDocument), "Should not have created an SVG document!");
 </script>
 </pre>
 </body>
 </html>

--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@@ -1112,17 +1112,17 @@ QueryInterface(JSContext* cx, unsigned a
     return false;
 
   // Get the object. It might be a security wrapper, in which case we do a checked
   // unwrap.
   JS::Rooted<JSObject*> origObj(cx, &thisv.toObject());
   JS::Rooted<JSObject*> obj(cx, js::CheckedUnwrap(origObj,
                                                   /* stopAtWindowProxy = */ false));
   if (!obj) {
-      JS_ReportError(cx, "Permission denied to access object");
+      JS_ReportErrorASCII(cx, "Permission denied to access object");
       return false;
   }
 
   // Switch this to UnwrapDOMObjectToISupports once our global objects are
   // using new bindings.
   nsCOMPtr<nsISupports> native;
   UnwrapArg<nsISupports>(obj, getter_AddRefs(native));
   if (!native) {

--- a/dom/bindings/Bindings.conf
+++ b/dom/bindings/Bindings.conf
@@ -1850,18 +1850,16 @@ addExternalIface('MozTreeView', nativeTy
                   headerFile='nsITreeView.h', notflattened=True)
 addExternalIface('MozWakeLockListener', headerFile='nsIDOMWakeLockListener.h')
 addExternalIface('MozXULTemplateBuilder', nativeType='nsIXULTemplateBuilder')
 addExternalIface('nsIBrowserDOMWindow', nativeType='nsIBrowserDOMWindow',
                  notflattened=True)
 addExternalIface('nsIControllers', nativeType='nsIControllers')
 addExternalIface('nsIDOMCrypto', nativeType='nsIDOMCrypto',
                  headerFile='Crypto.h')
-addExternalIface('nsIInputStreamCallback', nativeType='nsIInputStreamCallback',
-                 headerFile='nsIAsyncInputStream.h')
 addExternalIface('nsIFile', nativeType='nsIFile', notflattened=True)
 addExternalIface('nsILoadGroup', nativeType='nsILoadGroup',
                  headerFile='nsILoadGroup.h', notflattened=True)
 addExternalIface('nsIMessageBroadcaster', nativeType='nsIMessageBroadcaster',
                  headerFile='nsIMessageManager.h', notflattened=True)
 addExternalIface('nsISelectionListener', nativeType='nsISelectionListener')
 addExternalIface('nsIStreamListener', nativeType='nsIStreamListener', notflattened=True)
 addExternalIface('nsITransportProvider', nativeType='nsITransportProvider')

--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -6831,26 +6831,30 @@ def needScopeObject(returnType, argument
              any(typeNeedsScopeObject(a.type) for a in arguments)))
 
 
 class CGCallGenerator(CGThing):
     """
     A class to generate an actual call to a C++ object.  Assumes that the C++
     object is stored in a variable whose name is given by the |object| argument.
 
+    needsSubjectPrincipal is a boolean indicating whether the call should
+    receive the subject nsIPrincipal as argument.
+
     isFallible is a boolean indicating whether the call should be fallible.
 
     resultVar: If the returnType is not void, then the result of the call is
     stored in a C++ variable named by resultVar. The caller is responsible for
     declaring the result variable. If the caller doesn't care about the result
     value, resultVar can be omitted.
     """
-    def __init__(self, isFallible, arguments, argsPre, returnType,
-                 extendedAttributes, descriptorProvider, nativeMethodName,
-                 static, object="self", argsPost=[], resultVar=None):
+    def __init__(self, isFallible, needsSubjectPrincipal, arguments, argsPre,
+                 returnType, extendedAttributes, descriptorProvider,
+                 nativeMethodName, static, object="self", argsPost=[],
+                 resultVar=None):
         CGThing.__init__(self)
 
         result, resultOutParam, resultRooter, resultArgs, resultConversion = \
             getRetvalDeclarationForType(returnType, descriptorProvider)
 
         args = CGList([CGGeneric(arg) for arg in argsPre], ", ")
         for a, name in arguments:
             arg = CGGeneric(name)
@@ -6897,16 +6901,19 @@ class CGCallGenerator(CGThing):
                 needResultDecl = True
                 resultVar = "result"
             if resultOutParam == "ref":
                 args.append(CGGeneric(resultVar))
             else:
                 assert resultOutParam == "ptr"
                 args.append(CGGeneric("&" + resultVar))
 
+        if needsSubjectPrincipal:
+            args.append(CGGeneric("subjectPrincipal"))
+
         if isFallible:
             args.append(CGGeneric("rv"))
         args.extend(CGGeneric(arg) for arg in argsPost)
 
         # Build up our actual call
         self.cgRoot = CGList([])
 
         call = CGGeneric(nativeMethodName)
@@ -6935,16 +6942,28 @@ class CGCallGenerator(CGThing):
                     call = CGWrapper(call, pre=resultVar + " = ")
         elif result is not None:
             assert resultOutParam is None
             call = CGWrapper(call, pre=resultVar + " = ")
 
         call = CGWrapper(call, post=";\n")
         self.cgRoot.append(call)
 
+        if needsSubjectPrincipal:
+            self.cgRoot.prepend(CGGeneric(dedent(
+               """
+               Maybe<nsIPrincipal*> subjectPrincipal;
+               if (NS_IsMainThread()) {
+                 JSCompartment* compartment = js::GetContextCompartment(cx);
+                 MOZ_ASSERT(compartment);
+                 JSPrincipals* principals = JS_GetCompartmentPrincipals(compartment);
+                 subjectPrincipal.emplace(nsJSPrincipals::get(principals));
+               }
+               """)))
+
         if isFallible:
             self.cgRoot.prepend(CGGeneric("binding_detail::FastErrorResult rv;\n"))
             self.cgRoot.append(CGGeneric(dedent(
                 """
                 if (MOZ_UNLIKELY(rv.MaybeSetPendingException(cx))) {
                   return false;
                 }
                 """)))
@@ -7401,16 +7420,17 @@ class CGPerSignatureCall(CGThing):
                                                                   idlNode.identifier.name))
             else:
                 cgThings.append(CGIterableMethodGenerator(descriptor,
                                                           idlNode.maplikeOrSetlikeOrIterable,
                                                           idlNode.identifier.name))
         else:
             cgThings.append(CGCallGenerator(
                 self.isFallible(),
+                idlNode.getExtendedAttribute('NeedsSubjectPrincipal'),
                 self.getArguments(), argsPre, returnType,
                 self.extendedAttributes, descriptor,
                 nativeMethodName,
                 static, argsPost=argsPost, resultVar=resultVar))
 
         if useCounterName:
             # Generate a telemetry call for when [UseCounter] is used.
             code = "SetDocumentAndPageUseCounter(cx, obj, eUseCounter_%s);\n" % useCounterName
@@ -13807,16 +13827,19 @@ class CGNativeMember(ClassMethod):
             args.append(Argument("%s&" %
                                  CGUnionStruct.unionTypeDecl(returnType, True),
                                  "aRetVal"))
         elif returnType.isAny():
             args.append(Argument("JS::MutableHandle<JS::Value>", "aRetVal"))
         elif returnType.isObject() or returnType.isSpiderMonkeyInterface():
             args.append(Argument("JS::MutableHandle<JSObject*>", "aRetVal"))
 
+        # And the nsIPrincipal
+        if self.member.getExtendedAttribute('NeedsSubjectPrincipal'):
+            args.append(Argument("const Maybe<nsIPrincipal*>&", "aPrincipal"))
         # And the ErrorResult
         if 'infallible' not in self.extendedAttrs:
             # Use aRv so it won't conflict with local vars named "rv"
             args.append(Argument("ErrorResult&", "aRv"))
         # The legacycaller thisval
         if self.member.isMethod() and self.member.isLegacycaller():
             # If it has an identifier, we can't deal with it yet
             assert self.member.isIdentifierLess()
@@ -15752,17 +15775,17 @@ class CGMaplikeOrSetlikeMethodGenerator(
         something that would return an iterator is called via Xray, fail early.
         """
         # TODO: Bug 1173651 - Remove check once bug 1023984 is fixed.
         code = CGGeneric(dedent(
             """
             // TODO (Bug 1173651): Xrays currently cannot wrap iterators. Change
             // after bug 1023984 is fixed.
             if (xpc::WrapperFactory::IsXrayWrapper(obj)) {
-              JS_ReportError(cx, "Xray wrapping of iterators not supported.");
+              JS_ReportErrorASCII(cx, "Xray wrapping of iterators not supported.");
               return false;
             }
             JS::Rooted<JSObject*> result(cx);
             JS::Rooted<JS::Value> v(cx);
             """))
         arguments = "&v"
         setResult = CGGeneric(dedent(
             """

--- a/dom/bindings/parser/WebIDL.py
+++ b/dom/bindings/parser/WebIDL.py
@@ -4199,16 +4199,17 @@ class IDLAttribute(IDLInterfaceMember):
               identifier == "Throws" or
               identifier == "GetterThrows" or
               identifier == "ChromeOnly" or
               identifier == "Func" or
               identifier == "SecureContext" or
               identifier == "Frozen" or
               identifier == "NewObject" or
               identifier == "UnsafeInPrerendering" or
+              identifier == "NeedsSubjectPrincipal" or
               identifier == "BinaryName"):
             # Known attributes that we don't need to do anything with here
             pass
         else:
             raise WebIDLError("Unknown extended attribute %s on attribute" % identifier,
                               [attr.location])
         IDLInterfaceMember.handleExtendedAttribute(self, attr)
 
@@ -4915,16 +4916,17 @@ class IDLMethod(IDLInterfaceMember, IDLS
               identifier == "NewObject" or
               identifier == "ChromeOnly" or
               identifier == "UnsafeInPrerendering" or
               identifier == "Pref" or
               identifier == "Deprecated" or
               identifier == "Func" or
               identifier == "SecureContext" or
               identifier == "BinaryName" or
+              identifier == "NeedsSubjectPrincipal" or
               identifier == "StaticClassOverride"):
             # Known attributes that we don't need to do anything with here
             pass
         else:
             raise WebIDLError("Unknown extended attribute %s on method" % identifier,
                               [attr.location])
         IDLInterfaceMember.handleExtendedAttribute(self, attr)
 

--- a/dom/bindings/test/TestExampleGen.webidl
+++ b/dom/bindings/test/TestExampleGen.webidl
@@ -768,16 +768,18 @@ interface TestExampleInterface {
   void passRenamedInterface(TestRenamedInterface arg);
   [PutForwards=writableByte] readonly attribute TestExampleInterface putForwardsAttr;
   [PutForwards=writableByte, LenientThis] readonly attribute TestExampleInterface putForwardsAttr2;
   [PutForwards=writableByte, ChromeOnly] readonly attribute TestExampleInterface putForwardsAttr3;
   [Throws] void throwingMethod();
   [Throws] attribute boolean throwingAttr;
   [GetterThrows] attribute boolean throwingGetterAttr;
   [SetterThrows] attribute boolean throwingSetterAttr;
+  [NeedsSubjectPrincipal] void needsSubjectPrincipalMethod();
+  [NeedsSubjectPrincipal] attribute boolean needsSubjectPrincipalAttr;
   legacycaller short(unsigned long arg1, TestInterface arg2);
   void passArgsWithDefaults(optional long arg1,
                             optional TestInterface? arg2 = null,
                             optional Dict arg3, optional double arg4 = 5.0,
                             optional float arg5);
   attribute any jsonifierShouldSkipThis;
   attribute TestParentInterface jsonifierShouldSkipThis2;
   attribute TestCallbackInterface jsonifierShouldSkipThis3;

--- a/dom/canvas/TexUnpackBlob.cpp
+++ b/dom/canvas/TexUnpackBlob.cpp
@@ -390,25 +390,26 @@ TexUnpackBytes::TexOrSubImage(bool isSub
     }
 
     //////
 
     MOZ_ASSERT(webgl->mBoundPixelUnpackBuffer);
 
     if (!isSubImage) {
         // Alloc first to catch OOMs.
-        gl->fBindBuffer(LOCAL_GL_PIXEL_UNPACK_BUFFER, 0);
+        AssertUintParamCorrect(gl, LOCAL_GL_PIXEL_UNPACK_BUFFER, 0);
         *out_error = DoTexOrSubImage(false, gl, target, level, dui, xOffset, yOffset,
                                      zOffset, mWidth, mHeight, mDepth, nullptr);
-        gl->fBindBuffer(LOCAL_GL_PIXEL_UNPACK_BUFFER,
-                        webgl->mBoundPixelUnpackBuffer->mGLName);
         if (*out_error)
             return false;
     }
 
+    const ScopedLazyBind bindPBO(gl, LOCAL_GL_PIXEL_UNPACK_BUFFER,
+                                 webgl->mBoundPixelUnpackBuffer);
+
     //////
 
     // Make our sometimes-implicit values explicit. Also this keeps them constant when we
     // ask for height=mHeight-1 and such.
     gl->fPixelStorei(LOCAL_GL_UNPACK_ROW_LENGTH, mRowLength);
     gl->fPixelStorei(LOCAL_GL_UNPACK_IMAGE_HEIGHT, mImageHeight);
 
     if (mDepth > 1) {

--- a/dom/canvas/WebGL2ContextBuffers.cpp
+++ b/dom/canvas/WebGL2ContextBuffers.cpp
@@ -80,16 +80,18 @@ WebGL2Context::CopyBufferSubData(GLenum 
                               (readType == WebGLBuffer::Kind::OtherData) ? "other"
                                                                          : "element",
                               (writeType == WebGLBuffer::Kind::OtherData) ? "other"
                                                                           : "element");
         return;
     }
 
     gl->MakeCurrent();
+    const ScopedLazyBind readBind(gl, readTarget, readBuffer);
+    const ScopedLazyBind writeBind(gl, writeTarget, writeBuffer);
     gl->fCopyBufferSubData(readTarget, writeTarget, readOffset, writeOffset, size);
 }
 
 void
 WebGL2Context::GetBufferSubData(GLenum target, GLintptr offset,
                                 const dom::ArrayBufferView& data)
 {
     const char funcName[] = "getBufferSubData";
@@ -138,16 +140,17 @@ WebGL2Context::GetBufferSubData(GLenum t
         ErrorInvalidOperation("%s: Currently bound transform feedback is active.",
                               funcName);
         return;
     }
 
     ////
 
     gl->MakeCurrent();
+    const ScopedLazyBind readBind(gl, target, buffer);
 
     const auto ptr = gl->fMapBufferRange(target, offset, data.LengthAllowShared(),
                                          LOCAL_GL_MAP_READ_BIT);
     // Warning: Possibly shared memory.  See bug 1225033.
     memcpy(data.DataAllowShared(), ptr, data.LengthAllowShared());
     gl->fUnmapBuffer(target);
 }
 

--- a/dom/canvas/WebGLBuffer.cpp
+++ b/dom/canvas/WebGLBuffer.cpp
@@ -11,16 +11,17 @@
 #include "WebGLElementArrayCache.h"
 
 namespace mozilla {
 
 WebGLBuffer::WebGLBuffer(WebGLContext* webgl, GLuint buf)
     : WebGLContextBoundObject(webgl)
     , mGLName(buf)
     , mContent(Kind::Undefined)
+    , mUsage(LOCAL_GL_STATIC_DRAW)
     , mByteLength(0)
     , mNumActiveTFOs(0)
     , mBoundForTF(false)
 {
     mContext->mBuffers.insertBack(this);
 }
 
 WebGLBuffer::~WebGLBuffer()
@@ -109,16 +110,17 @@ WebGLBuffer::BufferData(GLenum target, s
         mContext->ErrorInvalidOperation("%s: Buffer is bound to an active transform"
                                         " feedback object.",
                                         funcName);
         return;
     }
 
     const auto& gl = mContext->gl;
     gl->MakeCurrent();
+    const ScopedLazyBind lazyBind(gl, target, this);
     mContext->InvalidateBufferFetching();
 
 #ifdef XP_MACOSX
     // bug 790879
     if (gl->WorkAroundDriverBugs() &&
         size > INT32_MAX)
     {
         mContext->ErrorOutOfMemory("%s: Allocation size too large.", funcName);
@@ -136,16 +138,17 @@ WebGLBuffer::BufferData(GLenum target, s
             MOZ_ASSERT(error == LOCAL_GL_OUT_OF_MEMORY);
             mContext->ErrorOutOfMemory("%s: Error from driver: 0x%04x", funcName, error);
             return;
         }
     } else {
         gl->fBufferData(target, size, data, usage);
     }
 
+    mUsage = usage;
     mByteLength = size;
 
     // Warning: Possibly shared memory.  See bug 1225033.
     if (!ElementArrayCacheBufferData(data, size)) {
         mByteLength = 0;
         mContext->ErrorOutOfMemory("%s: Failed update index buffer cache.", funcName);
     }
 }

--- a/dom/canvas/WebGLBuffer.h
+++ b/dom/canvas/WebGLBuffer.h
@@ -40,16 +40,17 @@ public:
 
     void SetContentAfterBind(GLenum target);
     Kind Content() const { return mContent; }
 
     void Delete();
 
     size_t SizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const;
 
+    GLenum Usage() const { return mUsage; }
     size_t ByteLength() const { return mByteLength; }
 
     bool ElementArrayCacheBufferData(const void* ptr, size_t bufferSizeInBytes);
 
     void ElementArrayCacheBufferSubData(size_t pos, const void* ptr,
                                         size_t updateSizeInBytes);
 
     bool Validate(GLenum type, uint32_t max_allowed, size_t first, size_t count) const;
@@ -69,16 +70,17 @@ public:
 
     NS_INLINE_DECL_CYCLE_COLLECTING_NATIVE_REFCOUNTING(WebGLBuffer)
     NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_NATIVE_CLASS(WebGLBuffer)
 
 protected:
     ~WebGLBuffer();
 
     Kind mContent;
+    GLenum mUsage;
     size_t mByteLength;
     UniquePtr<WebGLElementArrayCache> mCache;
     size_t mNumActiveTFOs;
     bool mBoundForTF;
 };
 
 } // namespace mozilla
 

--- a/dom/canvas/WebGLContext.cpp
+++ b/dom/canvas/WebGLContext.cpp
@@ -2154,16 +2154,49 @@ ScopedFBRebinder::UnwrapImpl()
         mGL->fBindFramebuffer(LOCAL_GL_DRAW_FRAMEBUFFER, fnName(mWebGL->mBoundDrawFramebuffer));
         mGL->fBindFramebuffer(LOCAL_GL_READ_FRAMEBUFFER, fnName(mWebGL->mBoundReadFramebuffer));
     } else {
         MOZ_ASSERT(mWebGL->mBoundDrawFramebuffer == mWebGL->mBoundReadFramebuffer);
         mGL->fBindFramebuffer(LOCAL_GL_FRAMEBUFFER, fnName(mWebGL->mBoundDrawFramebuffer));
     }
 }
 
+////////////////////
+
+static GLenum
+TargetIfLazy(GLenum target)
+{
+    switch (target) {
+    case LOCAL_GL_PIXEL_PACK_BUFFER:
+    case LOCAL_GL_PIXEL_UNPACK_BUFFER:
+        return target;
+
+    default:
+        return 0;
+    }
+}
+
+ScopedLazyBind::ScopedLazyBind(gl::GLContext* gl, GLenum target, const WebGLBuffer* buf)
+    : ScopedGLWrapper<ScopedLazyBind>(gl)
+    , mTarget(buf ? TargetIfLazy(target) : 0)
+    , mBuf(buf)
+{
+    if (mTarget) {
+        mGL->fBindBuffer(mTarget, mBuf->mGLName);
+    }
+}
+
+void
+ScopedLazyBind::UnwrapImpl()
+{
+    if (mTarget) {
+        mGL->fBindBuffer(mTarget, 0);
+    }
+}
+
 ////////////////////////////////////////
 
 void
 Intersect(uint32_t srcSize, int32_t dstStartInSrc, uint32_t dstSize,
           uint32_t* const out_intStartInSrc, uint32_t* const out_intStartInDst,
           uint32_t* const out_intSize)
 {
     // Only >0 if dstStartInSrc is >0:

--- a/dom/canvas/WebGLContext.h
+++ b/dom/canvas/WebGLContext.h
@@ -1829,16 +1829,31 @@ public:
         : ScopedGLWrapper<ScopedFBRebinder>(webgl->gl)
         , mWebGL(webgl)
     { }
 
 private:
     void UnwrapImpl();
 };
 
+class ScopedLazyBind final
+    : public gl::ScopedGLWrapper<ScopedLazyBind>
+{
+    friend struct gl::ScopedGLWrapper<ScopedLazyBind>;
+
+    const GLenum mTarget;
+    const WebGLBuffer* const mBuf;
+
+public:
+    ScopedLazyBind(gl::GLContext* gl, GLenum target, const WebGLBuffer* buf);
+
+private:
+    void UnwrapImpl();
+};
+
 void
 ComputeLengthAndData(const dom::ArrayBufferViewOrSharedArrayBufferView& view,
                      void** const out_data, size_t* const out_length,
                      js::Scalar::Type* const out_type);
 
 void
 Intersect(uint32_t srcSize, int32_t dstStartInSrc, uint32_t dstSize,
           uint32_t* const out_intStartInSrc, uint32_t* const out_intStartInDst,

--- a/dom/canvas/WebGLContextBuffers.cpp
+++ b/dom/canvas/WebGLContextBuffers.cpp
@@ -132,16 +132,23 @@ WebGLContext::BindBuffer(GLenum target, 
 
     gl->MakeCurrent();
     gl->fBindBuffer(target, buffer ? buffer->mGLName : 0);
 
     *slot = buffer;
     if (buffer) {
         buffer->SetContentAfterBind(target);
     }
+
+    switch (target) {
+    case LOCAL_GL_PIXEL_PACK_BUFFER:
+    case LOCAL_GL_PIXEL_UNPACK_BUFFER:
+        gl->fBindBuffer(target, 0);
+        break;
+    }
 }
 
 ////////////////////////////////////////
 
 bool
 WebGLContext::ValidateIndexedBufferBinding(const char* funcName, GLenum target,
                                            GLuint index,
                                            WebGLRefPtr<WebGLBuffer>** const out_genericBinding,
@@ -424,16 +431,18 @@ WebGLContext::BufferSubDataT(GLenum targ
         ErrorInvalidValue("bufferSubData: Not enough data. Operation requires"
                           " %d bytes, but buffer only has %d bytes.",
                           checked_neededByteLength.value(),
                           buffer->ByteLength());
         return;
     }
 
     MakeContextCurrent();
+    const ScopedLazyBind lazyBind(gl, target, buffer);
+
     // Warning: Possibly shared memory.  See bug 1225033.
     gl->fBufferSubData(target, byteOffset, data.LengthAllowShared(),
                        data.DataAllowShared());
 
     // Warning: Possibly shared memory.  See bug 1225033.
     buffer->ElementArrayCacheBufferSubData(byteOffset, data.DataAllowShared(),
                                            data.LengthAllowShared());
 }

--- a/dom/canvas/WebGLContextGL.cpp
+++ b/dom/canvas/WebGLContextGL.cpp
@@ -625,38 +625,27 @@ WebGLContext::GetBufferParameter(GLenum 
 {
     if (IsContextLost())
         return JS::NullValue();
 
     const auto& buffer = ValidateBufferSelection("getBufferParameter", target);
     if (!buffer)
         return JS::NullValue();
 
-    MakeContextCurrent();
-
     switch (pname) {
-        case LOCAL_GL_BUFFER_SIZE:
-        case LOCAL_GL_BUFFER_USAGE:
-        {
-            GLint i = 0;
-            gl->fGetBufferParameteriv(target, pname, &i);
-            if (pname == LOCAL_GL_BUFFER_SIZE) {
-                return JS::Int32Value(i);
-            }
-
-            MOZ_ASSERT(pname == LOCAL_GL_BUFFER_USAGE);
-            return JS::NumberValue(uint32_t(i));
-        }
-            break;
-
-        default:
-            ErrorInvalidEnumInfo("getBufferParameter: parameter", pname);
+    case LOCAL_GL_BUFFER_SIZE:
+        return JS::NumberValue(buffer->ByteLength());
+
+    case LOCAL_GL_BUFFER_USAGE:
+        return JS::NumberValue(buffer->Usage());
+
+    default:
+        ErrorInvalidEnumInfo("getBufferParameter: parameter", pname);
+        return JS::NullValue();
     }
-
-    return JS::NullValue();
 }
 
 JS::Value
 WebGLContext::GetFramebufferAttachmentParameter(JSContext* cx,
                                                 GLenum target,
                                                 GLenum attachment,
                                                 GLenum pname,
                                                 ErrorResult& rv)
@@ -1523,16 +1512,19 @@ WebGL2Context::ReadPixels(GLint x, GLint
     const auto bytesAvailable = mBoundPixelPackBuffer->ByteLength();
     const auto checkedBytesAfterOffset = CheckedUint32(bytesAvailable) - offset;
 
     uint32_t bytesAfterOffset = 0;
     if (checkedBytesAfterOffset.isValid()) {
         bytesAfterOffset = checkedBytesAfterOffset.value();
     }
 
+    gl->MakeCurrent();
+    const ScopedLazyBind lazyBind(gl, LOCAL_GL_PIXEL_PACK_BUFFER, mBoundPixelPackBuffer);
+
     ReadPixelsImpl(x, y, width, height, format, type, (void*)offset, bytesAfterOffset);
 }
 
 static bool
 ValidateReadPixelsFormatAndType(const webgl::FormatInfo* srcFormat,
                                 const webgl::PackingInfo& pi, gl::GLContext* gl,
                                 WebGLContext* webgl)
 {

--- a/dom/canvas/WebGLTransformFeedback.h
+++ b/dom/canvas/WebGLTransformFeedback.h
@@ -28,19 +28,19 @@ public:
 private:
     // GLES 3.0.4 p267, Table 6.24 "Transform Feedback State"
     WebGLRefPtr<WebGLBuffer> mGenericBufferBinding;
     std::vector<IndexedBufferBinding> mIndexedBindings;
     bool mIsPaused;
     bool mIsActive;
     // Not in state tables:
     WebGLRefPtr<WebGLProgram> mActive_Program;
-    GLenum mActive_PrimMode;
-    size_t mActive_VertPosition;
-    size_t mActive_VertCapacity;
+    MOZ_INIT_OUTSIDE_CTOR GLenum mActive_PrimMode;
+    MOZ_INIT_OUTSIDE_CTOR size_t mActive_VertPosition;
+    MOZ_INIT_OUTSIDE_CTOR size_t mActive_VertCapacity;
 
 public:
     WebGLTransformFeedback(WebGLContext* webgl, GLuint tf);
 private:
     ~WebGLTransformFeedback();
 
 public:
     NS_INLINE_DECL_CYCLE_COLLECTING_NATIVE_REFCOUNTING(WebGLTransformFeedback)

--- a/dom/events/DataTransfer.cpp
+++ b/dom/events/DataTransfer.cpp
@@ -444,41 +444,45 @@ DataTransfer::SetData(const nsAString& a
   RefPtr<nsVariantCC> variant = new nsVariantCC();
   variant->SetAsAString(aData);
 
   aRv = SetDataAtInternal(aFormat, variant, 0,
                           nsContentUtils::SubjectPrincipal());
 }
 
 void
-DataTransfer::ClearData(const Optional<nsAString>& aFormat, ErrorResult& aRv)
+DataTransfer::ClearData(const Optional<nsAString>& aFormat,
+                        const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+                        ErrorResult& aRv)
 {
+  MOZ_ASSERT(aSubjectPrincipal.isSome());
+
   if (mReadOnly) {
     aRv.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
     return;
   }
 
   if (MozItemCount() == 0) {
     return;
   }
 
   if (aFormat.WasPassed()) {
-    MozClearDataAtHelper(aFormat.Value(), 0, aRv);
+    MozClearDataAtHelper(aFormat.Value(), 0, aSubjectPrincipal, aRv);
   } else {
-    MozClearDataAtHelper(EmptyString(), 0, aRv);
+    MozClearDataAtHelper(EmptyString(), 0, aSubjectPrincipal, aRv);
   }
 }
 
 NS_IMETHODIMP
 DataTransfer::ClearData(const nsAString& aFormat)
 {
   Optional<nsAString> format;
   format = &aFormat;
   ErrorResult rv;
-  ClearData(format, rv);
+  ClearData(format, Some(nsContentUtils::SubjectPrincipal()), rv);
   return rv.StealNSResult();
 }
 
 NS_IMETHODIMP
 DataTransfer::GetMozItemCount(uint32_t* aCount)
 {
   *aCount = MozItemCount();
   return NS_OK;
@@ -738,18 +742,21 @@ DataTransfer::MozSetDataAt(JSContext* aC
   if (!aRv.Failed()) {
     aRv = SetDataAtInternal(aFormat, data, aIndex,
                             nsContentUtils::SubjectPrincipal());
   }
 }
 
 void
 DataTransfer::MozClearDataAt(const nsAString& aFormat, uint32_t aIndex,
+                             const Maybe<nsIPrincipal*>& aSubjectPrincipal,
                              ErrorResult& aRv)
 {
+  MOZ_ASSERT(aSubjectPrincipal.isSome());
+
   if (mReadOnly) {
     aRv.Throw(NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR);
     return;
   }
 
   if (aIndex >= MozItemCount()) {
     aRv.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
     return;
@@ -758,51 +765,53 @@ DataTransfer::MozClearDataAt(const nsASt
   // Only the first item is valid for clipboard events
   if (aIndex > 0 &&
       (mEventMessage == eCut || mEventMessage == eCopy ||
        mEventMessage == ePaste)) {
     aRv.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
     return;
   }
 
-  MozClearDataAtHelper(aFormat, aIndex, aRv);
+  MozClearDataAtHelper(aFormat, aIndex, aSubjectPrincipal, aRv);
 
   // If we just cleared the 0-th index, and there are still more than 1 indexes
   // remaining, MozClearDataAt should cause the 1st index to become the 0th
   // index. This should _only_ happen when the MozClearDataAt function is
   // explicitly called by script, as this behavior is inconsistent with spec.
   // (however, so is the MozClearDataAt API)
 
   if (aIndex == 0 && mItems->MozItemCount() > 1 &&
       mItems->MozItemsAt(0)->Length() == 0) {
     mItems->PopIndexZero();
   }
 }
 
 void
 DataTransfer::MozClearDataAtHelper(const nsAString& aFormat, uint32_t aIndex,
+                                   const Maybe<nsIPrincipal*>& aSubjectPrincipal,
                                    ErrorResult& aRv)
 {
   MOZ_ASSERT(!mReadOnly);
   MOZ_ASSERT(aIndex < MozItemCount());
   MOZ_ASSERT(aIndex == 0 ||
              (mEventMessage != eCut && mEventMessage != eCopy &&
               mEventMessage != ePaste));
+  MOZ_ASSERT(aSubjectPrincipal.isSome());
 
   nsAutoString format;
   GetRealFormat(aFormat, format);
 
-  mItems->MozRemoveByTypeAt(format, aIndex, aRv);
+  mItems->MozRemoveByTypeAt(format, aIndex, aSubjectPrincipal, aRv);
 }
 
 NS_IMETHODIMP
 DataTransfer::MozClearDataAt(const nsAString& aFormat, uint32_t aIndex)
 {
   ErrorResult rv;
-  MozClearDataAt(aFormat, aIndex, rv);
+  MozClearDataAt(aFormat, aIndex, Some(nsContentUtils::SubjectPrincipal()), rv);
   return rv.StealNSResult();
 }
 
 void
 DataTransfer::SetDragImage(Element& aImage, int32_t aX, int32_t aY,
                            ErrorResult& aRv)
 {
   if (mReadOnly) {

--- a/dom/events/DataTransfer.h
+++ b/dom/events/DataTransfer.h
@@ -139,16 +139,17 @@ public:
   already_AddRefed<DOMStringList> GetTypes(ErrorResult& rv) const;
 
   void GetData(const nsAString& aFormat, nsAString& aData, ErrorResult& aRv);
 
   void SetData(const nsAString& aFormat, const nsAString& aData,
                ErrorResult& aRv);
 
   void ClearData(const mozilla::dom::Optional<nsAString>& aFormat,
+                 const Maybe<nsIPrincipal*>& aSubjectPrincipal,
                  mozilla::ErrorResult& aRv);
 
   already_AddRefed<FileList> GetFiles(mozilla::ErrorResult& aRv);
 
   already_AddRefed<Promise> GetFilesAndDirectories(ErrorResult& aRv);
 
   already_AddRefed<Promise> GetFiles(bool aRecursiveFlag, ErrorResult& aRv);
 
@@ -165,16 +166,17 @@ public:
       aCursor.AssignLiteral("auto");
     }
   }
 
   already_AddRefed<DOMStringList> MozTypesAt(uint32_t aIndex,
                                              mozilla::ErrorResult& aRv) const;
 
   void MozClearDataAt(const nsAString& aFormat, uint32_t aIndex,
+                      const Maybe<nsIPrincipal*>& aSubjectPrincipal,
                       mozilla::ErrorResult& aRv);
 
   void MozSetDataAt(JSContext* aCx, const nsAString& aFormat,
                     JS::Handle<JS::Value> aData, uint32_t aIndex,
                     mozilla::ErrorResult& aRv);
 
   void MozGetDataAt(JSContext* aCx, const nsAString& aFormat,
                     uint32_t aIndex, JS::MutableHandle<JS::Value> aRetval,
@@ -302,16 +304,17 @@ protected:
   void FillAllExternalData();
 
   void FillInExternalCustomTypes(uint32_t aIndex, nsIPrincipal* aPrincipal);
 
   void FillInExternalCustomTypes(nsIVariant* aData, uint32_t aIndex,
                                  nsIPrincipal* aPrincipal);
 
   void MozClearDataAtHelper(const nsAString& aFormat, uint32_t aIndex,
+                            const Maybe<nsIPrincipal*>& aSubjectPrincipal,
                             mozilla::ErrorResult& aRv);
 
   nsCOMPtr<nsISupports> mParent;
 
   // the drop effect and effect allowed
   uint32_t mDropEffect;
   uint32_t mEffectAllowed;
 

--- a/dom/events/DataTransferItem.cpp
+++ b/dom/events/DataTransferItem.cpp
@@ -233,31 +233,28 @@ DataTransferItem::FillInExternalData()
 #ifdef DEBUG
   if (oldKind != Kind()) {
     NS_WARNING("Clipboard data provided by the OS does not match predicted kind");
   }
 #endif
 }
 
 already_AddRefed<File>
-DataTransferItem::GetAsFile(ErrorResult& aRv)
+DataTransferItem::GetAsFile(const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+                            ErrorResult& aRv)
 {
-  return GetAsFileWithPrincipal(nsContentUtils::SubjectPrincipal(), aRv);
-}
+  MOZ_ASSERT(aSubjectPrincipal.isSome());
 
-already_AddRefed<File>
-DataTransferItem::GetAsFileWithPrincipal(nsIPrincipal* aPrincipal, ErrorResult& aRv)
-{
   if (mKind != KIND_FILE) {
     return nullptr;
   }
 
   // This is done even if we have an mCachedFile, as it performs the necessary
   // permissions checks to ensure that we are allowed to access this type.
-  nsCOMPtr<nsIVariant> data = Data(aPrincipal, aRv);
+  nsCOMPtr<nsIVariant> data = Data(aSubjectPrincipal.value(), aRv);
   if (NS_WARN_IF(!data || aRv.Failed())) {
     return nullptr;
   }
 
   // Generate the dom::File from the stored data, caching it so that the
   // same object is returned in the future.
   if (!mCachedFile) {
     nsCOMPtr<nsISupports> supports;
@@ -281,26 +278,22 @@ DataTransferItem::GetAsFileWithPrincipal
     }
   }
 
   RefPtr<File> file = mCachedFile;
   return file.forget();
 }
 
 already_AddRefed<FileSystemEntry>
-DataTransferItem::GetAsEntry(ErrorResult& aRv)
+DataTransferItem::GetAsEntry(const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+                             ErrorResult& aRv)
 {
-  return GetAsEntryWithPrincipal(nsContentUtils::SubjectPrincipal(), aRv);
-}
+  MOZ_ASSERT(aSubjectPrincipal.isSome());
 
-already_AddRefed<FileSystemEntry>
-DataTransferItem::GetAsEntryWithPrincipal(nsIPrincipal* aPrincipal,
-                                          ErrorResult& aRv)
-{
-  RefPtr<File> file = GetAsFileWithPrincipal(aPrincipal, aRv);
+  RefPtr<File> file = GetAsFile(aSubjectPrincipal, aRv);
   if (NS_WARN_IF(aRv.Failed()) || !file) {
     return nullptr;
   }
 
   nsCOMPtr<nsIGlobalObject> global;
   // This is annoying, but DataTransfer may have various things as parent.
   nsCOMPtr<EventTarget> target =
     do_QueryInterface(mDataTransfer->GetParentObject());
@@ -388,26 +381,29 @@ DataTransferItem::CreateFileFromInputStr
   }
 
   return File::CreateMemoryFile(mDataTransfer, data, available, fileName,
                                 mType, PR_Now());
 }
 
 void
 DataTransferItem::GetAsString(FunctionStringCallback* aCallback,
+                              const Maybe<nsIPrincipal*>& aSubjectPrincipal,
                               ErrorResult& aRv)
 {
+  MOZ_ASSERT(aSubjectPrincipal.isSome());
+
   if (!aCallback || mKind != KIND_STRING) {
     return;
   }
 
   // Theoretically this should be done inside of the runnable, as it might be an
   // expensive operation on some systems, however we wouldn't get access to the
   // NS_ERROR_DOM_SECURITY_ERROR messages which may be raised by this method.
-  nsCOMPtr<nsIVariant> data = Data(nsContentUtils::SubjectPrincipal(), aRv);
+  nsCOMPtr<nsIVariant> data = Data(aSubjectPrincipal.value(), aRv);
   if (NS_WARN_IF(!data || aRv.Failed())) {
     return;
   }
 
   nsAutoString stringData;
   nsresult rv = data->GetAsAString(stringData);
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return;

--- a/dom/events/DataTransferItem.h
+++ b/dom/events/DataTransferItem.h
@@ -45,17 +45,19 @@ public:
     MOZ_ASSERT(mDataTransfer, "Must be associated with a DataTransfer");
   }
 
   already_AddRefed<DataTransferItem> Clone(DataTransfer* aDataTransfer) const;
 
   virtual JSObject* WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto) override;
 
   // NOTE: This accesses the subject principal, and should not be called from C++
-  void GetAsString(FunctionStringCallback* aCallback, ErrorResult& aRv);
+  void GetAsString(FunctionStringCallback* aCallback,
+                   const Maybe<nsIPrincipal*>& aPrincipal,
+                   ErrorResult& aRv);
 
   void GetKind(nsAString& aKind) const
   {
     switch (mKind) {
     case KIND_FILE:
       aKind = NS_LITERAL_STRING("file");
       return;
     case KIND_STRING:
@@ -77,25 +79,21 @@ public:
   {
     return mKind;
   }
   void SetKind(eKind aKind)
   {
     mKind = aKind;
   }
 
-  // NOTE: This accesses the subject principal, and should not be called from C++
-  already_AddRefed<File> GetAsFile(ErrorResult& aRv);
-  already_AddRefed<File> GetAsFileWithPrincipal(nsIPrincipal* aPrincipal,
-                                                ErrorResult& aRv);
+  already_AddRefed<File>
+  GetAsFile(const Maybe<nsIPrincipal*>& aSubjectPrincipal, ErrorResult& aRv);
 
-  // NOTE: This accesses the subject principal, and should not be called from C++
-  already_AddRefed<FileSystemEntry> GetAsEntry(ErrorResult& aRv);
-  already_AddRefed<FileSystemEntry> GetAsEntryWithPrincipal(nsIPrincipal* aPrincipal,
-                                                            ErrorResult& aRv);
+  already_AddRefed<FileSystemEntry>
+  GetAsEntry(const Maybe<nsIPrincipal*>& aSubjectPrincipal, ErrorResult& aRv);
 
   DataTransfer* GetParentObject() const
   {
     return mDataTransfer;
   }
 
   nsIPrincipal* Principal() const
   {

--- a/dom/events/DataTransferItemList.cpp
+++ b/dom/events/DataTransferItemList.cpp
@@ -76,29 +76,33 @@ DataTransferItemList::Clone(DataTransfer
     // Copy over the reference
     list->mItems[i] = list->mIndexedItems[index][subIndex];
   }
 
   return list.forget();
 }
 
 void
-DataTransferItemList::Remove(uint32_t aIndex, ErrorResult& aRv)
+DataTransferItemList::Remove(uint32_t aIndex,
+                             const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+                             ErrorResult& aRv)
 {
+  MOZ_ASSERT(aSubjectPrincipal.isSome());
+
   if (mDataTransfer->IsReadOnly()) {
     aRv.Throw(NS_ERROR_DOM_INVALID_STATE_ERR);
     return;
   }
 
   if (aIndex >= Length()) {
     aRv.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
     return;
   }
 
-  ClearDataHelper(mItems[aIndex], aIndex, -1, aRv);
+  ClearDataHelper(mItems[aIndex], aIndex, -1, aSubjectPrincipal, aRv);
 }
 
 DataTransferItem*
 DataTransferItemList::IndexedGetter(uint32_t aIndex, bool& aFound, ErrorResult& aRv) const
 {
   if (aIndex >= mItems.Length()) {
     aFound = false;
     return nullptr;
@@ -117,96 +121,104 @@ DataTransferItemList::MozItemCount() con
   // if it is empty, scripts using the moz* APIs should see it as not existing.
   if (length == 1 && mIndexedItems[0].IsEmpty()) {
     return 0;
   }
   return length;
 }
 
 void
-DataTransferItemList::Clear(ErrorResult& aRv)
+DataTransferItemList::Clear(const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+                            ErrorResult& aRv)
 {
+  MOZ_ASSERT(aSubjectPrincipal.isSome());
+
   if (NS_WARN_IF(mDataTransfer->IsReadOnly())) {
     return;
   }
 
   uint32_t count = Length();
   for (uint32_t i = 0; i < count; i++) {
     // We always remove the last item first, to avoid moving items around in
     // memory as much
-    Remove(Length() - 1, aRv);
+    Remove(Length() - 1, aSubjectPrincipal, aRv);
     ENSURE_SUCCESS_VOID(aRv);
   }
 
   MOZ_ASSERT(Length() == 0);
 }
 
 DataTransferItem*
 DataTransferItemList::Add(const nsAString& aData,
                           const nsAString& aType,
+                          const Maybe<nsIPrincipal*>& aSubjectPrincipal,
                           ErrorResult& aRv)
 {
+  MOZ_ASSERT(aSubjectPrincipal.isSome());
+
   if (NS_WARN_IF(mDataTransfer->IsReadOnly())) {
     return nullptr;
   }
 
   nsCOMPtr<nsIVariant> data(new storage::TextVariant(aData));
 
   nsAutoString format;
   mDataTransfer->GetRealFormat(aType, format);
 
-  nsIPrincipal* subjectPrincipal = nsContentUtils::SubjectPrincipal();
-
-  if (!DataTransfer::PrincipalMaySetData(format, data, subjectPrincipal)) {
+  if (!DataTransfer::PrincipalMaySetData(format, data,
+                                         aSubjectPrincipal.value())) {
     aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
     return nullptr;
   }
 
   // We add the textual data to index 0. We set aInsertOnly to true, as we don't
   // want to update an existing entry if it is already present, as per the spec.
   RefPtr<DataTransferItem> item =
-    SetDataWithPrincipal(format, data, 0, subjectPrincipal,
+    SetDataWithPrincipal(format, data, 0, aSubjectPrincipal.value(),
                          /* aInsertOnly = */ true,
                          /* aHidden = */ false,
                          aRv);
   if (NS_WARN_IF(aRv.Failed())) {
     return nullptr;
   }
   MOZ_ASSERT(item->Kind() != DataTransferItem::KIND_FILE);
 
   return item;
 }
 
 DataTransferItem*
-DataTransferItemList::Add(File& aData, ErrorResult& aRv)
+DataTransferItemList::Add(File& aData,
+                          const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+                          ErrorResult& aRv)
 {
+  MOZ_ASSERT(aSubjectPrincipal.isSome());
+
   if (mDataTransfer->IsReadOnly()) {
     return nullptr;
   }
 
   nsCOMPtr<nsISupports> supports = do_QueryObject(&aData);
   nsCOMPtr<nsIWritableVariant> data = new nsVariant();
   data->SetAsISupports(supports);
 
   nsAutoString type;
   aData.GetType(type);
 
-  nsIPrincipal* subjectPrincipal = nsContentUtils::SubjectPrincipal();
-
-  if (!DataTransfer::PrincipalMaySetData(type, data, subjectPrincipal)) {
+  if (!DataTransfer::PrincipalMaySetData(type, data,
+                                         aSubjectPrincipal.value())) {
     aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
     return nullptr;
   }
 
   // We need to add this as a new item, as multiple files can't exist in the
   // same item in the Moz DataTransfer layout. It will be appended at the end of
   // the internal specced layout.
   uint32_t index = mIndexedItems.Length();
   RefPtr<DataTransferItem> item =
-    SetDataWithPrincipal(type, data, index, subjectPrincipal,
+    SetDataWithPrincipal(type, data, index, aSubjectPrincipal.value(),
                          /* aInsertOnly = */ true,
                          /* aHidden = */ false,
                          aRv);
   if (NS_WARN_IF(aRv.Failed())) {
     return nullptr;
   }
   MOZ_ASSERT(item->Kind() == DataTransferItem::KIND_FILE);
 
@@ -255,51 +267,54 @@ DataTransferItemList::Files(nsIPrincipal
 
   files = mFiles;
   return files.forget();
 }
 
 void
 DataTransferItemList::MozRemoveByTypeAt(const nsAString& aType,
                                         uint32_t aIndex,
+                                        const Maybe<nsIPrincipal*>& aSubjectPrincipal,
                                         ErrorResult& aRv)
 {
+  MOZ_ASSERT(aSubjectPrincipal.isSome());
+
   if (NS_WARN_IF(mDataTransfer->IsReadOnly() ||
                  aIndex >= mIndexedItems.Length())) {
     return;
   }
 
   bool removeAll = aType.IsEmpty();
 
   nsTArray<RefPtr<DataTransferItem>>& items = mIndexedItems[aIndex];
   uint32_t count = items.Length();
   // We remove the last item of the list repeatedly - that way we don't
   // have to worry about modifying the loop iterator
   if (removeAll) {
     for (uint32_t i = 0; i < count; ++i) {
       uint32_t index = items.Length() - 1;
       MOZ_ASSERT(index == count - i - 1);
 
-      ClearDataHelper(items[index], -1, index, aRv);
+      ClearDataHelper(items[index], -1, index, aSubjectPrincipal, aRv);
       if (NS_WARN_IF(aRv.Failed())) {
         return;
       }
     }
 
     // items is no longer a valid reference, as removing the last element from
     // it via ClearDataHelper invalidated it. so we can't MOZ_ASSERT that the
     // length is now 0.
     return;
   }
 
   for (uint32_t i = 0; i < count; ++i) {
     nsAutoString type;
     items[i]->GetType(type);
     if (type == aType) {
-      ClearDataHelper(items[i], -1, i, aRv);
+      ClearDataHelper(items[i], -1, i, aSubjectPrincipal, aRv);
       return;
     }
   }
 }
 
 DataTransferItem*
 DataTransferItemList::MozItemByTypeAt(const nsAString& aType, uint32_t aIndex)
 {
@@ -464,26 +479,26 @@ DataTransferItemList::ClearAllItems()
   // Re-generate files (into an empty list)
   RegenerateFiles();
 }
 
 void
 DataTransferItemList::ClearDataHelper(DataTransferItem* aItem,
                                       uint32_t aIndexHint,
                                       uint32_t aMozOffsetHint,
+                                      const Maybe<nsIPrincipal*>& aSubjectPrincipal,
                                       ErrorResult& aRv)
 {
   MOZ_ASSERT(aItem);
   if (NS_WARN_IF(mDataTransfer->IsReadOnly())) {
     return;
   }
 
-  nsIPrincipal* principal = nsContentUtils::SubjectPrincipal();
-  if (aItem->Principal() && principal &&
-      !principal->Subsumes(aItem->Principal())) {
+  if (aItem->Principal() && aSubjectPrincipal.isSome() &&
+      !aSubjectPrincipal.value()->Subsumes(aItem->Principal())) {
     aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
     return;
   }
 
   // Check if the aIndexHint is actually the index, and then remove the item
   // from aItems
   ErrorResult rv;
   bool found;
@@ -552,17 +567,17 @@ DataTransferItemList::GenerateFiles(File
     ErrorResult rv;
     bool found;
     RefPtr<DataTransferItem> item = IndexedGetter(i, found, rv);
     if (NS_WARN_IF(!found || rv.Failed())) {
       continue;
     }
 
     if (item->Kind() == DataTransferItem::KIND_FILE) {
-      RefPtr<File> file = item->GetAsFileWithPrincipal(aFilesPrincipal, rv);
+      RefPtr<File> file = item->GetAsFile(Some(aFilesPrincipal), rv);
       if (NS_WARN_IF(rv.Failed() || !file)) {
         continue;
       }
       aFiles->Append(file);
     }
   }
 }
 

--- a/dom/events/DataTransferItemList.h
+++ b/dom/events/DataTransferItemList.h
@@ -46,55 +46,63 @@ public:
                                JS::Handle<JSObject*> aGivenProto) override;
 
   uint32_t Length() const
   {
     return mItems.Length();
   };
 
   DataTransferItem* Add(const nsAString& aData, const nsAString& aType,
+                        const Maybe<nsIPrincipal*>& aSubjectPrincipal,
                         ErrorResult& rv);
-  DataTransferItem* Add(File& aData, ErrorResult& aRv);
+  DataTransferItem* Add(File& aData,
+                        const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+                        ErrorResult& aRv);
 
-  void Remove(uint32_t aIndex, ErrorResult& aRv);
+  void Remove(uint32_t aIndex,
+              const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+              ErrorResult& aRv);
 
   DataTransferItem* IndexedGetter(uint32_t aIndex, bool& aFound,
                                   ErrorResult& aRv) const;
 
   DataTransfer* GetParentObject() const
   {
     return mDataTransfer;
   }
 
-  void Clear(ErrorResult& aRv);
+  void Clear(const Maybe<nsIPrincipal*>& aSubjectPrincipal, ErrorResult& aRv);
 
   already_AddRefed<DataTransferItem>
   SetDataWithPrincipal(const nsAString& aType, nsIVariant* aData,
                        uint32_t aIndex, nsIPrincipal* aPrincipal,
                        bool aInsertOnly, bool aHidden, ErrorResult& aRv);
 
   already_AddRefed<FileList> Files(nsIPrincipal* aPrincipal);
 
   // Moz-style helper methods for interacting with the stored data
   void MozRemoveByTypeAt(const nsAString& aType, uint32_t aIndex,
+                         const Maybe<nsIPrincipal*>& aSubjectPrincipal,
                          ErrorResult& aRv);
   DataTransferItem* MozItemByTypeAt(const nsAString& aType, uint32_t aIndex);
   const nsTArray<RefPtr<DataTransferItem>>* MozItemsAt(uint32_t aIndex);
   uint32_t MozItemCount() const;
 
   // Causes everything in indexes above 0 to shift down one index.
   void PopIndexZero();
 
   // Delete every item in the DataTransferItemList, without checking for
   // permissions or read-only status (for internal use only).
   void ClearAllItems();
 
 private:
   void ClearDataHelper(DataTransferItem* aItem, uint32_t aIndexHint,
-                       uint32_t aMozOffsetHint, ErrorResult& aRv);
+                       uint32_t aMozOffsetHint,
+                       const Maybe<nsIPrincipal*>& aSubjectPrincipal,
+                       ErrorResult& aRv);
   DataTransferItem* AppendNewItem(uint32_t aIndex, const nsAString& aType,
                                   nsIVariant* aData, nsIPrincipal* aPrincipal,
                                   bool aHidden);
   void RegenerateFiles();
   void GenerateFiles(FileList* aFiles, nsIPrincipal* aFilesPrincipal);
 
   ~DataTransferItemList() {}
 

--- a/dom/geolocation/nsGeolocation.cpp
+++ b/dom/geolocation/nsGeolocation.cpp
@@ -5,17 +5,16 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsXULAppAPI.h"
 
 #include "mozilla/dom/ContentChild.h"
 #include "mozilla/Telemetry.h"
 
 #include "nsAutoPtr.h"
-#include "nsISettingsService.h"
 
 #include "nsGeolocation.h"
 #include "nsDOMClassInfoID.h"
 #include "nsComponentManagerUtils.h"
 #include "nsServiceManagerUtils.h"
 #include "nsContentUtils.h"
 #include "nsContentPermissionHelper.h"
 #include "nsIDocument.h"
@@ -27,17 +26,16 @@
 #include "mozilla/Hal.h"
 #include "mozilla/Services.h"
 #include "mozilla/Unused.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/ClearOnShutdown.h"
 #include "mozilla/dom/Event.h"
 #include "mozilla/WeakPtr.h"
 #include "mozilla/dom/PermissionMessageUtils.h"
-#include "mozilla/dom/SettingChangeNotificationBinding.h"
 #include "mozilla/dom/WakeLock.h"
 
 class nsIPrincipal;
 
 #ifdef MOZ_WIDGET_ANDROID
 #include "AndroidLocationProvider.h"
 #endif
 
@@ -57,19 +55,16 @@ class nsIPrincipal;
 #include "WindowsLocationProvider.h"
 #include "mozilla/WindowsVersion.h"
 #endif
 
 // Some limit to the number of get or watch geolocation requests
 // that a window can make.
 #define MAX_GEO_REQUESTS_PER_WINDOW  1500
 
-// The settings key.
-#define GEO_SETTINGS_ENABLED          "geolocation.enabled"
-
 using mozilla::Unused;          // <snicker>
 using namespace mozilla;
 using namespace mozilla::dom;
 using namespace mozilla::hal;
 
 class nsGeolocationRequest final
  : public nsIContentPermissionRequest
  , public nsIGeolocationUpdate
@@ -145,63 +140,16 @@ CreatePositionOptionsCopy(const Position
 
   geoOptions->mEnableHighAccuracy = aOptions.mEnableHighAccuracy;
   geoOptions->mMaximumAge = aOptions.mMaximumAge;
   geoOptions->mTimeout = aOptions.mTimeout;
 
   return geoOptions;
 }
 
-class GeolocationSettingsCallback : public nsISettingsServiceCallback
-{
-  virtual ~GeolocationSettingsCallback() {
-    MOZ_COUNT_DTOR(GeolocationSettingsCallback);
-  }
-
-public:
-  NS_DECL_ISUPPORTS
-
-  GeolocationSettingsCallback() {
-    MOZ_COUNT_CTOR(GeolocationSettingsCallback);
-  }
-
-  NS_IMETHOD Handle(const nsAString& aName, JS::Handle<JS::Value> aResult) override
-  {
-    MOZ_ASSERT(NS_IsMainThread());
-
-    // The geolocation is enabled by default:
-    bool value = true;
-    if (aResult.isBoolean()) {
-        value = aResult.toBoolean();
-    }
-
-    MozSettingValue(value);
-    return NS_OK;
-  }
-
-  NS_IMETHOD HandleError(const nsAString& aName) override
-  {
-    NS_WARNING("Unable to get value for '" GEO_SETTINGS_ENABLED "'");
-
-    // Default it's enabled:
-    MozSettingValue(true);
-    return NS_OK;
-  }
-
-  void MozSettingValue(const bool aValue)
-  {
-    RefPtr<nsGeolocationService> gs = nsGeolocationService::GetGeolocationService();
-    if (gs) {
-      gs->HandleMozsettingValue(aValue);
-    }
-  }
-};
-
-NS_IMPL_ISUPPORTS(GeolocationSettingsCallback, nsISettingsServiceCallback)
-
 class RequestPromptEvent : public Runnable
 {
 public:
   RequestPromptEvent(nsGeolocationRequest* aRequest, nsWeakPtr aWindow)
     : mRequest(aRequest)
     , mWindow(aWindow)
   {
   }
@@ -377,22 +325,24 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIContentPermissionRequest)
   NS_INTERFACE_MAP_ENTRY(nsIContentPermissionRequest)
   NS_INTERFACE_MAP_ENTRY(nsIGeolocationUpdate)
 NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsGeolocationRequest)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsGeolocationRequest)
 NS_IMPL_CYCLE_COLLECTION(nsGeolocationRequest, mCallback, mErrorCallback, mLocator)
+
 void
 nsGeolocationRequest::Notify()
 {
   SetTimeoutTimer();
   NotifyErrorAndShutdown(nsIDOMGeoPositionError::TIMEOUT);
 }
+
 void
 nsGeolocationRequest::NotifyErrorAndShutdown(uint16_t aErrorCode)
 {
   MOZ_ASSERT(!mShutdown, "timeout after shutdown");
   if (!mIsWatchPositionRequest) {
     Shutdown();
     mLocator->RemoveRequest(this);
   }
@@ -554,16 +504,17 @@ nsGeolocationRequest::Allow(JS::HandleVa
 
 NS_IMETHODIMP
 nsGeolocationRequest::GetRequester(nsIContentPermissionRequester** aRequester)
 {
   NS_ENSURE_ARG_POINTER(aRequester);
 
   nsCOMPtr<nsIContentPermissionRequester> requester = mRequester;
   requester.forget(aRequester);
+
   return NS_OK;
 }
 
 void
 nsGeolocationRequest::SetTimeoutTimer()
 {
   StopTimeoutTimer();
 
@@ -633,32 +584,34 @@ nsGeolocationRequest::SendLocation(nsIDO
     nsIDOMGeoPositionCallback* callback = mCallback.GetXPCOMCallback();
     MOZ_ASSERT(callback);
     callback->HandleEvent(aPosition);
   }
   SetTimeoutTimer();
   MOZ_ASSERT(mShutdown || mIsWatchPositionRequest,
              "non-shutdown getCurrentPosition request after callback!");
 }
+
 nsIPrincipal*
 nsGeolocationRequest::GetPrincipal()
 {
   if (!mLocator) {
     return nullptr;
   }
   return mLocator->GetPrincipal();
 }
 
 NS_IMETHODIMP
 nsGeolocationRequest::Update(nsIDOMGeoPosition* aPosition)
 {
   nsCOMPtr<nsIRunnable> ev = new RequestSendLocationEvent(aPosition, this);
   NS_DispatchToMainThread(ev);
   return NS_OK;
 }
+
 NS_IMETHODIMP
 nsGeolocationRequest::NotifyError(uint16_t aErrorCode)
 {
   MOZ_ASSERT(NS_IsMainThread());
   RefPtr<PositionError> positionError = new PositionError(mLocator, aErrorCode);
   positionError->NotifyCallback(mErrorCallback);
   return NS_OK;
 }
@@ -690,16 +643,17 @@ NS_IMPL_ISUPPORTS(nsGeolocationRequest::
 
 NS_IMETHODIMP
 nsGeolocationRequest::TimerCallbackHolder::Notify(nsITimer*)
 {
   if (mRequest && mRequest->mLocator) {
     RefPtr<nsGeolocationRequest> request(mRequest);
     request->Notify();
   }
+
   return NS_OK;
 }
 
 
 ////////////////////////////////////////////////////
 // nsGeolocationService
 ////////////////////////////////////////////////////
 NS_INTERFACE_MAP_BEGIN(nsGeolocationService)
@@ -708,59 +662,38 @@ NS_INTERFACE_MAP_BEGIN(nsGeolocationServ
   NS_INTERFACE_MAP_ENTRY(nsIObserver)
 NS_INTERFACE_MAP_END
 
 NS_IMPL_ADDREF(nsGeolocationService)
 NS_IMPL_RELEASE(nsGeolocationService)
 
 
 static bool sGeoEnabled = true;
-static bool sGeoInitPending = true;
 static int32_t sProviderTimeout = 6000; // Time, in milliseconds, to wait for the location provider to spin up.
 
 nsresult nsGeolocationService::Init()
 {
   Preferences::AddIntVarCache(&sProviderTimeout, "geo.timeout", sProviderTimeout);
   Preferences::AddBoolVarCache(&sGeoEnabled, "geo.enabled", sGeoEnabled);
 
   if (!sGeoEnabled) {
     return NS_ERROR_FAILURE;
   }
 
   if (XRE_IsContentProcess()) {
-    sGeoInitPending = false;
     return NS_OK;
   }
 
-  // check if the geolocation service is enable from settings
-  nsCOMPtr<nsISettingsService> settings =
-    do_GetService("@mozilla.org/settingsService;1");
-
-  if (settings) {
-    nsCOMPtr<nsISettingsServiceLock> settingsLock;
-    nsresult rv = settings->CreateLock(nullptr, getter_AddRefs(settingsLock));
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    RefPtr<GeolocationSettingsCallback> callback = new GeolocationSettingsCallback();
-    rv = settingsLock->Get(GEO_SETTINGS_ENABLED, callback);
-    NS_ENSURE_SUCCESS(rv, rv);
-  } else {
-    // If we cannot obtain the settings service, we continue
-    // assuming that the geolocation is enabled:
-    sGeoInitPending = false;
-  }
-
   // geolocation service can be enabled -> now register observer
   nsCOMPtr<nsIObserverService> obs = services::GetObserverService();
   if (!obs) {
     return NS_ERROR_FAILURE;
   }
 
   obs->AddObserver(this, "xpcom-shutdown", false);
-  obs->AddObserver(this, "mozsettings-changed", false);
 
 #ifdef MOZ_WIDGET_ANDROID
   mProvider = new AndroidLocationProvider();
 #endif
 
 #ifdef MOZ_WIDGET_GONK
   // GonkGPSGeolocationProvider can be started at boot up time for initialization reasons.
   // do_getService gets hold of the already initialized component and starts
@@ -811,82 +744,35 @@ nsresult nsGeolocationService::Init()
 
   return NS_OK;
 }
 
 nsGeolocationService::~nsGeolocationService()
 {
 }
 
-void
-nsGeolocationService::HandleMozsettingChanged(nsISupports* aSubject)
-{
-    // The string that we're interested in will be a JSON string that looks like:
-    //  {"key":"gelocation.enabled","value":true}
-
-    RootedDictionary<SettingChangeNotification> setting(RootingCx());
-    if (!WrappedJSToDictionary(aSubject, setting)) {
-      return;
-    }
-    if (!setting.mKey.EqualsASCII(GEO_SETTINGS_ENABLED)) {
-      return;
-    }
-    if (!setting.mValue.isBoolean()) {
-      return;
-    }
-
-    HandleMozsettingValue(setting.mValue.toBoolean());
-}
-
-void
-nsGeolocationService::HandleMozsettingValue(const bool aValue)
-{
-    if (!aValue) {
-      // turn things off
-      StopDevice();
-      Update(nullptr);
-      mLastPosition.position = nullptr;
-      sGeoEnabled = false;
-    } else {
-      sGeoEnabled = true;
-    }
-
-    if (sGeoInitPending) {
-      sGeoInitPending = false;
-      for (uint32_t i = 0, length = mGeolocators.Length(); i < length; ++i) {
-        mGeolocators[i]->ServiceReady();
-      }
-    }
-}
-
 NS_IMETHODIMP
 nsGeolocationService::Observe(nsISupports* aSubject,
                               const char* aTopic,
                               const char16_t* aData)
 {
   if (!strcmp("xpcom-shutdown", aTopic)) {
     nsCOMPtr<nsIObserverService> obs = services::GetObserverService();
     if (obs) {
       obs->RemoveObserver(this, "xpcom-shutdown");
-      obs->RemoveObserver(this, "mozsettings-changed");
     }
 
     for (uint32_t i = 0; i< mGeolocators.Length(); i++) {
       mGeolocators[i]->Shutdown();
     }
     StopDevice();
 
     return NS_OK;
   }
 
-  if (!strcmp("mozsettings-changed", aTopic)) {
-    HandleMozsettingChanged(aSubject);
-    return NS_OK;
-  }
-
   if (!strcmp("timer-callback", aTopic)) {
     // decide if we can close down the service.
     for (uint32_t i = 0; i< mGeolocators.Length(); i++)
       if (mGeolocators[i]->HasActiveCallbacks()) {
         SetDisconnectTimer();
         return NS_OK;
       }
 
@@ -900,21 +786,24 @@ nsGeolocationService::Observe(nsISupport
 }
 
 NS_IMETHODIMP
 nsGeolocationService::Update(nsIDOMGeoPosition *aSomewhere)
 {
   if (aSomewhere) {
     SetCachedPosition(aSomewhere);
   }
+
   for (uint32_t i = 0; i< mGeolocators.Length(); i++) {
     mGeolocators[i]->Update(aSomewhere);
   }
+
   return NS_OK;
 }
+
 NS_IMETHODIMP
 nsGeolocationService::NotifyError(uint16_t aErrorCode)
 {
   for (uint32_t i = 0; i < mGeolocators.Length(); i++) {
     mGeolocators[i]->NotifyError(aErrorCode);
   }
   return NS_OK;
 }
@@ -930,17 +819,17 @@ CachedPositionAndAccuracy
 nsGeolocationService::GetCachedPosition()
 {
   return mLastPosition;
 }
 
 nsresult
 nsGeolocationService::StartDevice(nsIPrincipal *aPrincipal)
 {
-  if (!sGeoEnabled || sGeoInitPending) {
+  if (!sGeoEnabled) {
     return NS_ERROR_NOT_AVAILABLE;
   }
 
   // we do not want to keep the geolocation devices online
   // indefinitely.  Close them down after a reasonable period of
   // inactivivity
   SetDisconnectTimer();
 
@@ -981,17 +870,16 @@ void
 nsGeolocationService::StopDisconnectTimer()
 {
   if (mDisconnectTimer) {
     mDisconnectTimer->Cancel();
     mDisconnectTimer = nullptr;
   }
 }
 
-
 void
 nsGeolocationService::SetDisconnectTimer()
 {
   if (!mDisconnectTimer) {
     mDisconnectTimer = do_CreateInstance("@mozilla.org/timer;1");
   } else {
     mDisconnectTimer->Cancel();
   }
@@ -1004,51 +892,47 @@ nsGeolocationService::SetDisconnectTimer
 bool
 nsGeolocationService::HighAccuracyRequested()
 {
   for (uint32_t i = 0; i < mGeolocators.Length(); i++) {
     if (mGeolocators[i]->HighAccuracyRequested()) {
       return true;
     }
   }
+
   return false;
 }
 
 void
 nsGeolocationService::UpdateAccuracy(bool aForceHigh)
 {
   bool highRequired = aForceHigh || HighAccuracyRequested();
 
   if (XRE_IsContentProcess()) {
     ContentChild* cpc = ContentChild::GetSingleton();
     if (cpc->IsAlive()) {
       cpc->SendSetGeolocationHigherAccuracy(highRequired);
     }
+
     return;
   }
 
-  if (!mHigherAccuracy && highRequired) {
-      mProvider->SetHighAccuracy(true);
-  }
-
-  if (mHigherAccuracy && !highRequired) {
-      mProvider->SetHighAccuracy(false);
-  }
-
+  mProvider->SetHighAccuracy(!mHigherAccuracy && highRequired);
   mHigherAccuracy = highRequired;
 }
 
 void
 nsGeolocationService::StopDevice()
 {
   StopDisconnectTimer();
 
   if (XRE_IsContentProcess()) {
     ContentChild* cpc = ContentChild::GetSingleton();
     cpc->SendRemoveGeolocationListener();
+
     return; // bail early
   }
 
   nsCOMPtr<nsIObserverService> obs = services::GetObserverService();
   if (!obs) {
     return;
   }
 
@@ -1067,23 +951,25 @@ nsGeolocationService::StopDevice()
 StaticRefPtr<nsGeolocationService> nsGeolocationService::sService;
 
 already_AddRefed<nsGeolocationService>
 nsGeolocationService::GetGeolocationService()
 {
   RefPtr<nsGeolocationService> result;
   if (nsGeolocationService::sService) {
     result = nsGeolocationService::sService;
+
     return result.forget();
   }
 
   result = new nsGeolocationService();
   if (NS_FAILED(result->Init())) {
     return nullptr;
   }
+
   ClearOnShutdown(&nsGeolocationService::sService);
   nsGeolocationService::sService = result;
   return result.forget();
 }
 
 void
 nsGeolocationService::AddLocator(Geolocation* aLocator)
 {
@@ -1178,31 +1064,31 @@ Geolocation::Init(nsPIDOMWindowInner* aC
 
   // If no aContentDom was passed into us, we are being used
   // by chrome/c++ and have no mOwner, no mPrincipal, and no need
   // to prompt.
   mService = nsGeolocationService::GetGeolocationService();
   if (mService) {
     mService->AddLocator(this);
   }
+
   return NS_OK;
 }
 
 bool
 Geolocation::ContainsRequest(nsGeolocationRequest* aRequest)
 {
-  if (aRequest->IsWatch()) {
-    if (mWatchingCallbacks.Contains(aRequest)) {
+  if (aRequest->IsWatch() && mWatchingCallbacks.Contains(aRequest)) {
 	return true;
-    }
-  } else {
-    if (mPendingCallbacks.Contains(aRequest)) {
-        return true;
-    }
   }
+
+  if (mPendingCallbacks.Contains(aRequest)) {
+      return true;
+  }
+
   return false;
 }
 
 
 NS_IMETHODIMP
 Geolocation::HandleEvent(nsIDOMEvent* aEvent)
 {
 
@@ -1216,33 +1102,37 @@ Geolocation::HandleEvent(nsIDOMEvent* aE
   MOZ_ASSERT(doc);
 
   if (doc->Hidden()) {
     WakeLockInformation info;
     GetWakeLockInfo(NS_LITERAL_STRING("gps"), &info);
 
     MOZ_ASSERT(XRE_IsContentProcess());
     ContentChild* cpc = ContentChild::GetSingleton();
+
     if (!info.lockingProcesses().Contains(cpc->GetID())) {
       cpc->SendRemoveGeolocationListener();
       mService->StopDisconnectTimer();
     }
-  } else {
-    mService->SetDisconnectTimer();
+
+    return NS_OK;
+  }
+
+  mService->SetDisconnectTimer();
 
-    // We will unconditionally allow all the requests in the callbacks
-    // because if a request is put into either of these two callbacks,
-    // it means that it has been allowed before.
-    // That's why when we resume them, we unconditionally allow them again.
-    for (uint32_t i = 0, length = mWatchingCallbacks.Length(); i < length; ++i) {
-      mWatchingCallbacks[i]->Allow(JS::UndefinedHandleValue);
-    }
-    for (uint32_t i = 0, length = mPendingCallbacks.Length(); i < length; ++i) {
-      mPendingCallbacks[i]->Allow(JS::UndefinedHandleValue);
-    }
+  // We will unconditionally allow all the requests in the callbacks
+  // because if a request is put into either of these two callbacks,
+  // it means that it has been allowed before.
+  // That's why when we resume them, we unconditionally allow them again.
+  for (uint32_t i = 0, length = mWatchingCallbacks.Length(); i < length; ++i) {
+    mWatchingCallbacks[i]->Allow(JS::UndefinedHandleValue);
+  }
+
+  for (uint32_t i = 0, length = mPendingCallbacks.Length(); i < length; ++i) {
+    mPendingCallbacks[i]->Allow(JS::UndefinedHandleValue);
   }
 
   return NS_OK;
 }
 
 void
 Geolocation::Shutdown()
 {
@@ -1333,25 +1223,28 @@ Geolocation::Update(nsIDOMGeoPosition *a
     mPendingCallbacks[i-1]->Update(aSomewhere);
     RemoveRequest(mPendingCallbacks[i-1]);
   }
 
   // notify everyone that is watching
   for (uint32_t i = 0; i < mWatchingCallbacks.Length(); i++) {
     mWatchingCallbacks[i]->Update(aSomewhere);
   }
+
   return NS_OK;
 }
+
 NS_IMETHODIMP
 Geolocation::NotifyError(uint16_t aErrorCode)
 {
   if (!WindowOwnerStillExists()) {
     Shutdown();
     return NS_OK;
   }
+
   mozilla::Telemetry::Accumulate(mozilla::Telemetry::GEOLOCATION_ERROR, true);
 
   for (uint32_t i = mPendingCallbacks.Length(); i > 0; i--) {
     mPendingCallbacks[i-1]->NotifyErrorAndShutdown(aErrorCode);
     //NotifyErrorAndShutdown() removes the request from the array
   }
 
   // notify everyone that is watching
@@ -1365,27 +1258,29 @@ Geolocation::NotifyError(uint16_t aError
 bool
 Geolocation::IsAlreadyCleared(nsGeolocationRequest* aRequest)
 {
   for (uint32_t i = 0, length = mClearedWatchIDs.Length(); i < length; ++i) {
     if (mClearedWatchIDs[i] == aRequest->WatchId()) {
       return true;
     }
   }
+
   return false;
 }
 
 bool
 Geolocation::ClearPendingRequest(nsGeolocationRequest* aRequest)
 {
   if (aRequest->IsWatch() && this->IsAlreadyCleared(aRequest)) {
     this->NotifyAllowedRequest(aRequest);
     this->ClearWatch(aRequest->WatchId());
     return true;
   }
+
   return false;
 }
 
 void
 Geolocation::GetCurrentPosition(PositionCallback& aCallback,
                                 PositionErrorCallback* aErrorCallback,
                                 const PositionOptions& aOptions,
                                 ErrorResult& aRv)
@@ -1438,21 +1333,16 @@ Geolocation::GetCurrentPosition(GeoPosit
     NS_DispatchToMainThread(ev);
     return NS_OK;
   }
 
   if (!mOwner && !nsContentUtils::LegacyIsCallerChromeOrNativeCode()) {
     return NS_ERROR_FAILURE;
   }
 
-  if (sGeoInitPending) {
-    mPendingRequests.AppendElement(request);
-    return NS_OK;
-  }
-
   return GetCurrentPositionReady(request);
 }
 
 nsresult
 Geolocation::GetCurrentPositionReady(nsGeolocationRequest* aRequest)
 {
   if (mOwner) {
     if (!RegisterRequestWithPrompt(aRequest)) {
@@ -1530,21 +1420,16 @@ Geolocation::WatchPosition(GeoPositionCa
     NS_DispatchToMainThread(ev);
     return NS_OK;
   }
 
   if (!mOwner && !nsContentUtils::LegacyIsCallerChromeOrNativeCode()) {
     return NS_ERROR_FAILURE;
   }
 
-  if (sGeoInitPending) {
-    mPendingRequests.AppendElement(request);
-    return NS_OK;
-  }
-
   return WatchPositionReady(request);
 }
 
 nsresult
 Geolocation::WatchPositionReady(nsGeolocationRequest* aRequest)
 {
   if (mOwner) {
     if (!RegisterRequestWithPrompt(aRequest))