Merge m-c to fx-team. a=merge
authorRyan VanderMeulen <ryanvm@gmail.com>
Tue, 07 Oct 2014 16:14:26 -0400
changeset 209206 d15aba695f0c051ff7a6bb2584087259347fd403
parent 209205 fda842d4d3729a1d40eb6fa02c4307fd321c938a (current diff)
parent 209198 0c8ae792f1c09bdef53d620c39a3a47beea9917e (diff)
child 209207 1198bd62f42a8b2a2d0fcf584bb4b273d2cf8d3e
push id1
push userroot
push dateMon, 20 Oct 2014 17:29:22 +0000
reviewersmerge
milestone35.0a1
Merge m-c to fx-team. a=merge
dom/ipc/ContentChild.cpp
js/src/jit-test/tests/debug/Script-sourceMapURL-deprecated.js
js/src/jit-test/tests/debug/Script-sourceMapURL.js
js/src/jsonparser.cpp
js/src/jsonparser.h
--- a/accessible/jsat/EventManager.jsm
+++ b/accessible/jsat/EventManager.jsm
@@ -261,17 +261,18 @@ this.EventManager.prototype = {
        if (this.inTest) {
         this.sendMsgFunc("AccessFu:Focused");
        }
        break;
       }
       case Events.DOCUMENT_LOAD_COMPLETE:
       {
         let position = this.contentControl.vc.position;
-        if (position && Utils.isInSubtree(position, aEvent.accessible)) {
+        if (aEvent.accessible === aEvent.accessibleDocument ||
+            (position && Utils.isInSubtree(position, aEvent.accessible))) {
           // Do not automove into the document if the virtual cursor is already
           // positioned inside it.
           break;
         }
         this.contentControl.autoMove(
           aEvent.accessible, { delay: 500 });
         break;
       }
--- a/b2g/config/dolphin/sources.xml
+++ b/b2g/config/dolphin/sources.xml
@@ -10,17 +10,17 @@
   <!--original fetch url was git://codeaurora.org/-->
   <remote fetch="https://git.mozilla.org/external/caf" name="caf"/>
   <!--original fetch url was https://git.mozilla.org/releases-->
   <remote fetch="https://git.mozilla.org/releases" name="mozillaorg"/>
   <!-- B2G specific things. -->
   <project name="platform_build" path="build" remote="b2g" revision="3a2947df41a480de1457a6dcdbf46ad0af70d8e0">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="9306e431d5b559035d9656902e413816b6ca3c26"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="9050edcda308b65d86577c8ed0eedc5c568d8e44"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="5883a99b6528ced9dafaed8d3ca2405fb285537e"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="9f9bc14c28aed7b2571e641bfeeca81876ec48ec"/>
--- a/b2g/config/emulator-ics/sources.xml
+++ b/b2g/config/emulator-ics/sources.xml
@@ -14,17 +14,17 @@
   <!--original fetch url was git://github.com/apitrace/-->
   <remote fetch="https://git.mozilla.org/external/apitrace" name="apitrace"/>
   <default remote="caf" revision="refs/tags/android-4.0.4_r2.1" sync-j="4"/>
   <!-- Gonk specific things and forks -->
   <project name="platform_build" path="build" remote="b2g" revision="84923f1940625c47ff4c1fdf01b10fde3b7d909e">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="9306e431d5b559035d9656902e413816b6ca3c26"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="9050edcda308b65d86577c8ed0eedc5c568d8e44"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="5883a99b6528ced9dafaed8d3ca2405fb285537e"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="cd88d860656c31c7da7bb310d6a160d0011b0961"/>
   <project name="platform_external_qemu" path="external/qemu" remote="b2g" revision="c058843242068d0df7c107e09da31b53d2e08fa6"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="9f9bc14c28aed7b2571e641bfeeca81876ec48ec"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="dd924f92906085b831bf1cbbc7484d3c043d613c"/>
--- a/b2g/config/emulator-jb/sources.xml
+++ b/b2g/config/emulator-jb/sources.xml
@@ -12,17 +12,17 @@
   <!--original fetch url was https://git.mozilla.org/releases-->
   <remote fetch="https://git.mozilla.org/releases" name="mozillaorg"/>
   <!-- B2G specific things. -->
   <project name="platform_build" path="build" remote="b2g" revision="8986df0f82e15ac2798df0b6c2ee3435400677ac">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="9306e431d5b559035d9656902e413816b6ca3c26"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="9050edcda308b65d86577c8ed0eedc5c568d8e44"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="5883a99b6528ced9dafaed8d3ca2405fb285537e"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="9f9bc14c28aed7b2571e641bfeeca81876ec48ec"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <!-- Stock Android things -->
   <project groups="linux" name="platform/prebuilts/clang/linux-x86/3.1" path="prebuilts/clang/linux-x86/3.1" revision="5c45f43419d5582949284eee9cef0c43d866e03b"/>
   <project groups="linux" name="platform/prebuilts/clang/linux-x86/3.2" path="prebuilts/clang/linux-x86/3.2" revision="3748b4168e7bd8d46457d4b6786003bc6a5223ce"/>
--- a/b2g/config/emulator-kk/sources.xml
+++ b/b2g/config/emulator-kk/sources.xml
@@ -10,17 +10,17 @@
   <!--original fetch url was git://codeaurora.org/-->
   <remote fetch="https://git.mozilla.org/external/caf" name="caf"/>
   <!--original fetch url was https://git.mozilla.org/releases-->
   <remote fetch="https://git.mozilla.org/releases" name="mozillaorg"/>
   <!-- B2G specific things. -->
   <project name="platform_build" path="build" remote="b2g" revision="3a2947df41a480de1457a6dcdbf46ad0af70d8e0">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="9306e431d5b559035d9656902e413816b6ca3c26"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="9050edcda308b65d86577c8ed0eedc5c568d8e44"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="5883a99b6528ced9dafaed8d3ca2405fb285537e"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="9f9bc14c28aed7b2571e641bfeeca81876ec48ec"/>
--- a/b2g/config/emulator/sources.xml
+++ b/b2g/config/emulator/sources.xml
@@ -14,17 +14,17 @@
   <!--original fetch url was git://github.com/apitrace/-->
   <remote fetch="https://git.mozilla.org/external/apitrace" name="apitrace"/>
   <default remote="caf" revision="refs/tags/android-4.0.4_r2.1" sync-j="4"/>
   <!-- Gonk specific things and forks -->
   <project name="platform_build" path="build" remote="b2g" revision="84923f1940625c47ff4c1fdf01b10fde3b7d909e">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="9306e431d5b559035d9656902e413816b6ca3c26"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="9050edcda308b65d86577c8ed0eedc5c568d8e44"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="5883a99b6528ced9dafaed8d3ca2405fb285537e"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="cd88d860656c31c7da7bb310d6a160d0011b0961"/>
   <project name="platform_external_qemu" path="external/qemu" remote="b2g" revision="c058843242068d0df7c107e09da31b53d2e08fa6"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="9f9bc14c28aed7b2571e641bfeeca81876ec48ec"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="dd924f92906085b831bf1cbbc7484d3c043d613c"/>
--- a/b2g/config/flame-kk/sources.xml
+++ b/b2g/config/flame-kk/sources.xml
@@ -10,17 +10,17 @@
   <!--original fetch url was git://codeaurora.org/-->
   <remote fetch="https://git.mozilla.org/external/caf" name="caf"/>
   <!--original fetch url was https://git.mozilla.org/releases-->
   <remote fetch="https://git.mozilla.org/releases" name="mozillaorg"/>
   <!-- B2G specific things. -->
   <project name="platform_build" path="build" remote="b2g" revision="3a2947df41a480de1457a6dcdbf46ad0af70d8e0">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="9306e431d5b559035d9656902e413816b6ca3c26"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="9050edcda308b65d86577c8ed0eedc5c568d8e44"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="5883a99b6528ced9dafaed8d3ca2405fb285537e"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="9f9bc14c28aed7b2571e641bfeeca81876ec48ec"/>
--- a/b2g/config/flame/sources.xml
+++ b/b2g/config/flame/sources.xml
@@ -12,17 +12,17 @@
   <!--original fetch url was https://git.mozilla.org/releases-->
   <remote fetch="https://git.mozilla.org/releases" name="mozillaorg"/>
   <!-- B2G specific things. -->
   <project name="platform_build" path="build" remote="b2g" revision="8986df0f82e15ac2798df0b6c2ee3435400677ac">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="9306e431d5b559035d9656902e413816b6ca3c26"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="9050edcda308b65d86577c8ed0eedc5c568d8e44"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="5883a99b6528ced9dafaed8d3ca2405fb285537e"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="9f9bc14c28aed7b2571e641bfeeca81876ec48ec"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <!-- Stock Android things -->
   <project groups="linux" name="platform/prebuilts/clang/linux-x86/3.1" path="prebuilts/clang/linux-x86/3.1" revision="e95b4ce22c825da44d14299e1190ea39a5260bde"/>
   <project groups="linux" name="platform/prebuilts/clang/linux-x86/3.2" path="prebuilts/clang/linux-x86/3.2" revision="471afab478649078ad7c75ec6b252481a59e19b8"/>
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,9 +1,9 @@
 {
     "git": {
         "git_revision": "", 
         "remote": "", 
         "branch": ""
     }, 
-    "revision": "25a5d3c030a5ece82a1114882575560b58fe185f", 
+    "revision": "c98710d8aeb492eef503879c8542e90818a3839c", 
     "repo_path": "/integration/gaia-central"
 }
--- a/b2g/config/hamachi/sources.xml
+++ b/b2g/config/hamachi/sources.xml
@@ -12,17 +12,17 @@
   <!--original fetch url was git://github.com/apitrace/-->
   <remote fetch="https://git.mozilla.org/external/apitrace" name="apitrace"/>
   <default remote="caf" revision="b2g/ics_strawberry" sync-j="4"/>
   <!-- Gonk specific things and forks -->
   <project name="platform_build" path="build" remote="b2g" revision="84923f1940625c47ff4c1fdf01b10fde3b7d909e">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="9306e431d5b559035d9656902e413816b6ca3c26"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="9050edcda308b65d86577c8ed0eedc5c568d8e44"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="5883a99b6528ced9dafaed8d3ca2405fb285537e"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="9f9bc14c28aed7b2571e641bfeeca81876ec48ec"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="6426040f1be4a844082c9769171ce7f5341a5528"/>
   <project name="platform/bionic" path="bionic" revision="d2eb6c7b6e1bc7643c17df2d9d9bcb1704d0b9ab"/>
--- a/b2g/config/helix/sources.xml
+++ b/b2g/config/helix/sources.xml
@@ -10,17 +10,17 @@
   <!--original fetch url was https://git.mozilla.org/releases-->
   <remote fetch="https://git.mozilla.org/releases" name="mozillaorg"/>
   <default remote="caf" revision="b2g/ics_strawberry" sync-j="4"/>
   <!-- Gonk specific things and forks -->
   <project name="platform_build" path="build" remote="b2g" revision="84923f1940625c47ff4c1fdf01b10fde3b7d909e">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="9306e431d5b559035d9656902e413816b6ca3c26"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="9050edcda308b65d86577c8ed0eedc5c568d8e44"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="5883a99b6528ced9dafaed8d3ca2405fb285537e"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
   <project name="gonk-patches" path="patches" remote="b2g" revision="223a2421006e8f5da33f516f6891c87cae86b0f6"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="6426040f1be4a844082c9769171ce7f5341a5528"/>
   <project name="platform/bionic" path="bionic" revision="d2eb6c7b6e1bc7643c17df2d9d9bcb1704d0b9ab"/>
--- a/b2g/config/nexus-4/sources.xml
+++ b/b2g/config/nexus-4/sources.xml
@@ -12,17 +12,17 @@
   <!--original fetch url was https://git.mozilla.org/releases-->
   <remote fetch="https://git.mozilla.org/releases" name="mozillaorg"/>
   <!-- B2G specific things. -->
   <project name="platform_build" path="build" remote="b2g" revision="8986df0f82e15ac2798df0b6c2ee3435400677ac">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="9306e431d5b559035d9656902e413816b6ca3c26"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="9050edcda308b65d86577c8ed0eedc5c568d8e44"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="5883a99b6528ced9dafaed8d3ca2405fb285537e"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="9f9bc14c28aed7b2571e641bfeeca81876ec48ec"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <!-- Stock Android things -->
   <project groups="linux" name="platform/prebuilts/clang/linux-x86/3.1" path="prebuilts/clang/linux-x86/3.1" revision="5c45f43419d5582949284eee9cef0c43d866e03b"/>
   <project groups="linux" name="platform/prebuilts/clang/linux-x86/3.2" path="prebuilts/clang/linux-x86/3.2" revision="3748b4168e7bd8d46457d4b6786003bc6a5223ce"/>
--- a/b2g/config/wasabi/sources.xml
+++ b/b2g/config/wasabi/sources.xml
@@ -12,17 +12,17 @@
   <!--original fetch url was git://github.com/apitrace/-->
   <remote fetch="https://git.mozilla.org/external/apitrace" name="apitrace"/>
   <default remote="caf" revision="ics_chocolate_rb4.2" sync-j="4"/>
   <!-- Gonk specific things and forks -->
   <project name="platform_build" path="build" remote="b2g" revision="84923f1940625c47ff4c1fdf01b10fde3b7d909e">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="9306e431d5b559035d9656902e413816b6ca3c26"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="9050edcda308b65d86577c8ed0eedc5c568d8e44"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="5883a99b6528ced9dafaed8d3ca2405fb285537e"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="9f9bc14c28aed7b2571e641bfeeca81876ec48ec"/>
   <project name="gonk-patches" path="patches" remote="b2g" revision="223a2421006e8f5da33f516f6891c87cae86b0f6"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="6426040f1be4a844082c9769171ce7f5341a5528"/>
--- a/browser/devtools/debugger/test/browser.ini
+++ b/browser/devtools/debugger/test/browser.ini
@@ -134,16 +134,17 @@ skip-if = os == "mac" || e10s # Bug 8954
 [browser_dbg_breakpoints-contextmenu.js]
 [browser_dbg_breakpoints-disabled-reload.js]
 [browser_dbg_breakpoints-editor.js]
 [browser_dbg_breakpoints-highlight.js]
 [browser_dbg_breakpoints-new-script.js]
 [browser_dbg_breakpoints-other-tabs.js]
 [browser_dbg_breakpoints-pane.js]
 [browser_dbg_breakpoints-reload.js]
+skip-if = (os == "linux") && debug # Bug 1076830
 [browser_dbg_chrome-create.js]
 [browser_dbg_chrome-debugging.js]
 [browser_dbg_clean-exit-window.js]
 skip-if = true # Bug 933950 (leaky test)
 [browser_dbg_clean-exit.js]
 [browser_dbg_closure-inspection.js]
 [browser_dbg_cmd-blackbox.js]
 [browser_dbg_cmd-break.js]
--- a/content/base/public/FragmentOrElement.h
+++ b/content/base/public/FragmentOrElement.h
@@ -46,17 +46,16 @@ class Element;
  * @see nsIDOMNodeList
  */
 class nsChildContentList MOZ_FINAL : public nsINodeList
 {
 public:
   explicit nsChildContentList(nsINode* aNode)
     : mNode(aNode)
   {
-    SetIsDOMBinding();
   }
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SKIPPABLE_SCRIPT_HOLDER_CLASS(nsChildContentList)
 
   // nsWrapperCache
   virtual JSObject* WrapObject(JSContext *cx) MOZ_OVERRIDE;
 
--- a/content/base/public/nsDOMFile.h
+++ b/content/base/public/nsDOMFile.h
@@ -749,17 +749,16 @@ private:
 class nsDOMFileList MOZ_FINAL : public nsIDOMFileList,
                                 public nsWrapperCache
 {
   ~nsDOMFileList() {}
 
 public:
   explicit nsDOMFileList(nsISupports *aParent) : mParent(aParent)
   {
-    SetIsDOMBinding();
   }
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(nsDOMFileList)
 
   NS_DECL_NSIDOMFILELIST
 
   virtual JSObject* WrapObject(JSContext *cx) MOZ_OVERRIDE;
--- a/content/base/public/nsINode.h
+++ b/content/base/public/nsINode.h
@@ -315,17 +315,16 @@ public:
     mParent(nullptr),
     mBoolFlags(0),
     mNextSibling(nullptr),
     mPreviousSibling(nullptr),
     mFirstChild(nullptr),
     mSubtreeRoot(MOZ_THIS_IN_INITIALIZER_LIST()),
     mSlots(nullptr)
   {
-    SetIsDOMBinding();
   }
 #endif
 
   virtual ~nsINode();
 
   /**
    * Bit-flags to pass (or'ed together) to IsNodeOfType()
    */
@@ -376,21 +375,17 @@ public:
   static bool HasBoxQuadsSupport(JSContext* aCx, JSObject* /* unused */);
 
 protected:
   /**
    * WrapNode is called from WrapObject to actually wrap this node, WrapObject
    * does some additional checks and fix-up that's common to all nodes. WrapNode
    * should just call the DOM binding's Wrap function.
    */
-  virtual JSObject* WrapNode(JSContext *aCx)
-  {
-    MOZ_ASSERT(!IsDOMBinding(), "Someone forgot to override WrapNode");
-    return nullptr;
-  }
+  virtual JSObject* WrapNode(JSContext *aCx) = 0;
 
   // Subclasses that wish to override the parent behavior should return the
   // result of GetParentObjectIntenral, which handles the XBL scope stuff.
   //
   mozilla::dom::ParentObject GetParentObjectInternal(nsINode* aNativeParent) const {
     mozilla::dom::ParentObject p(aNativeParent);
     // Note that mUseXBLScope is a no-op for chrome, and other places where we
     // don't use XBL scopes.
--- a/content/base/src/Attr.cpp
+++ b/content/base/src/Attr.cpp
@@ -49,18 +49,16 @@ Attr::Attr(nsDOMAttributeMap *aAttrMap,
   : nsIAttribute(aAttrMap, aNodeInfo, aNsAware), mValue(aValue)
 {
   NS_ABORT_IF_FALSE(mNodeInfo, "We must get a nodeinfo here!");
   NS_ABORT_IF_FALSE(mNodeInfo->NodeType() == nsIDOMNode::ATTRIBUTE_NODE,
                     "Wrong nodeType");
 
   // We don't add a reference to our content. It will tell us
   // to drop our reference when it goes away.
-
-  SetIsDOMBinding();
 }
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(Attr)
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(Attr)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_SCRIPT_OBJECTS
 
   if (!nsINode::Traverse(tmp, cb)) {
@@ -383,15 +381,15 @@ Attr::Initialize()
 
 void
 Attr::Shutdown()
 {
   sInitialized = false;
 }
 
 JSObject*
-Attr::WrapObject(JSContext* aCx)
+Attr::WrapNode(JSContext* aCx)
 {
   return AttrBinding::Wrap(aCx, this);
 }
 
 } // namespace dom
 } // namespace mozilla
--- a/content/base/src/Attr.h
+++ b/content/base/src/Attr.h
@@ -77,17 +77,17 @@ public:
   static void Shutdown();
 
   NS_DECL_CYCLE_COLLECTION_SKIPPABLE_SCRIPT_HOLDER_CLASS_AMBIGUOUS(Attr,
                                                                    nsIAttribute)
 
   virtual nsIDOMNode* AsDOMNode() { return this; }
 
   // WebIDL
-  virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
+  virtual JSObject* WrapNode(JSContext* aCx) MOZ_OVERRIDE;
 
   // XPCOM GetName() is OK
   // XPCOM GetValue() is OK
 
   void SetValue(const nsAString& aValue, ErrorResult& aRv);
 
   bool Specified() const;
 
--- a/content/base/src/DOMImplementation.h
+++ b/content/base/src/DOMImplementation.h
@@ -37,17 +37,16 @@ public:
                     nsIURI* aDocumentURI,
                     nsIURI* aBaseURI)
     : mOwner(aOwner)
     , mScriptObject(do_GetWeakReference(aScriptObject))
     , mDocumentURI(aDocumentURI)
     , mBaseURI(aBaseURI)
   {
     MOZ_ASSERT(aOwner);
-    SetIsDOMBinding();
   }
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(DOMImplementation)
 
   nsIDocument* GetParentObject() const
   {
     return mOwner;
--- a/content/base/src/DOMMatrix.h
+++ b/content/base/src/DOMMatrix.h
@@ -23,29 +23,26 @@ class GlobalObject;
 class DOMMatrix;
 
 class DOMMatrixReadOnly : public nsWrapperCache
 {
 public:
   explicit DOMMatrixReadOnly(nsISupports* aParent)
     : mParent(aParent), mMatrix2D(new gfx::Matrix())
   {
-    SetIsDOMBinding();
   }
 
   DOMMatrixReadOnly(nsISupports* aParent, const DOMMatrixReadOnly& other)
     : mParent(aParent)
   {
     if (other.mMatrix2D) {
       mMatrix2D = new gfx::Matrix(*other.mMatrix2D);
     } else {
       mMatrix3D = new gfx::Matrix4x4(*other.mMatrix3D);
     }
-
-    SetIsDOMBinding();
   }
 
 #define GetMatrixMember(entry2D, entry3D, default) \
 { \
   if (mMatrix3D) { \
     return mMatrix3D->entry3D; \
   } \
   return mMatrix2D->entry2D; \
--- a/content/base/src/DOMParser.cpp
+++ b/content/base/src/DOMParser.cpp
@@ -20,17 +20,16 @@
 #include "mozilla/dom/ScriptSettings.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
 
 DOMParser::DOMParser()
   : mAttemptedInit(false)
 {
-  SetIsDOMBinding();
 }
 
 DOMParser::~DOMParser()
 {
 }
 
 // QueryInterface implementation for DOMParser
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(DOMParser)
--- a/content/base/src/DOMParser.h
+++ b/content/base/src/DOMParser.h
@@ -79,17 +79,16 @@ public:
   {
     return mozilla::dom::DOMParserBinding::Wrap(aCx, this);
   }
 
 private:
   explicit DOMParser(nsISupports* aOwner) : mOwner(aOwner), mAttemptedInit(false)
   {
     MOZ_ASSERT(aOwner);
-    SetIsDOMBinding();
   }
 
   nsresult InitInternal(nsISupports* aOwner, nsIPrincipal* prin,
                         nsIURI* documentURI, nsIURI* baseURI);
 
   nsresult SetUpDocument(DocumentFlavor aFlavor, nsIDOMDocument** aResult);
 
   // Helper for ParseFromString
--- a/content/base/src/DOMPoint.h
+++ b/content/base/src/DOMPoint.h
@@ -26,17 +26,16 @@ public:
   DOMPointReadOnly(nsISupports* aParent, double aX, double aY,
                    double aZ, double aW)
     : mParent(aParent)
     , mX(aX)
     , mY(aY)
     , mZ(aZ)
     , mW(aW)
   {
-    SetIsDOMBinding();
   }
 
   double X() const { return mX; }
   double Y() const { return mY; }
   double Z() const { return mZ; }
   double W() const { return mW; }
 
 protected:
--- a/content/base/src/DOMQuad.cpp
+++ b/content/base/src/DOMQuad.cpp
@@ -18,26 +18,24 @@ NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(DO
                                       mPoints[1], mPoints[2], mPoints[3])
 
 NS_IMPL_CYCLE_COLLECTION_ROOT_NATIVE(DOMQuad, AddRef)
 NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(DOMQuad, Release)
 
 DOMQuad::DOMQuad(nsISupports* aParent, CSSPoint aPoints[4])
   : mParent(aParent)
 {
-  SetIsDOMBinding();
   for (uint32_t i = 0; i < 4; ++i) {
     mPoints[i] = new DOMPoint(aParent, aPoints[i].x, aPoints[i].y);
   }
 }
 
 DOMQuad::DOMQuad(nsISupports* aParent)
   : mParent(aParent)
 {
-  SetIsDOMBinding();
 }
 
 DOMQuad::~DOMQuad()
 {
 }
 
 JSObject*
 DOMQuad::WrapObject(JSContext* aCx)
--- a/content/base/src/DOMRect.h
+++ b/content/base/src/DOMRect.h
@@ -31,17 +31,16 @@ protected:
 
 public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(DOMRectReadOnly)
 
   explicit DOMRectReadOnly(nsISupports* aParent)
     : mParent(aParent)
   {
-    SetIsDOMBinding();
   }
 
   nsISupports* GetParentObject() const
   {
     MOZ_ASSERT(mParent);
     return mParent;
   }
   virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
@@ -150,17 +149,16 @@ private:
 class DOMRectList MOZ_FINAL : public nsIDOMClientRectList,
                               public nsWrapperCache
 {
   ~DOMRectList() {}
 
 public:
   explicit DOMRectList(nsISupports *aParent) : mParent(aParent)
   {
-    SetIsDOMBinding();
   }
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(DOMRectList)
 
   NS_DECL_NSIDOMCLIENTRECTLIST
   
   virtual JSObject* WrapObject(JSContext *cx) MOZ_OVERRIDE;
--- a/content/base/src/DOMStringList.h
+++ b/content/base/src/DOMStringList.h
@@ -16,21 +16,16 @@ namespace dom {
 
 class DOMStringList : public nsISupports,
                       public nsWrapperCache
 {
 protected:
   virtual ~DOMStringList();
 
 public:
-  DOMStringList()
-  {
-    SetIsDOMBinding();
-  }
-
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(DOMStringList)
 
   virtual JSObject* WrapObject(JSContext* aCx);
   nsISupports* GetParentObject()
   {
     return nullptr;
   }
--- a/content/base/src/Element.cpp
+++ b/content/base/src/Element.cpp
@@ -871,18 +871,16 @@ NS_INTERFACE_TABLE_HEAD(DestinationInser
 NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(DestinationInsertionPointList)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(DestinationInsertionPointList)
 
 DestinationInsertionPointList::DestinationInsertionPointList(Element* aElement)
   : mParent(aElement)
 {
-  SetIsDOMBinding();
-
   nsTArray<nsIContent*>* destPoints = aElement->GetExistingDestInsertionPoints();
   if (destPoints) {
     for (uint32_t i = 0; i < destPoints->Length(); i++) {
       mDestinationPoints.AppendElement(destPoints->ElementAt(i));
     }
   }
 }
 
--- a/content/base/src/StyleSheetList.h
+++ b/content/base/src/StyleSheetList.h
@@ -15,21 +15,16 @@ namespace mozilla {
 class CSSStyleSheet;
 
 namespace dom {
 
 class StyleSheetList : public nsIDOMStyleSheetList
                      , public nsWrapperCache
 {
 public:
-  StyleSheetList()
-  {
-    SetIsDOMBinding();
-  }
-
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(StyleSheetList)
   NS_DECL_NSIDOMSTYLESHEETLIST
 
   virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE MOZ_FINAL;
 
   virtual nsINode* GetParentObject() const = 0;
 
--- a/content/base/src/nsContentList.h
+++ b/content/base/src/nsContentList.h
@@ -34,21 +34,16 @@ namespace dom {
 class Element;
 }
 }
 
 
 class nsBaseContentList : public nsINodeList
 {
 public:
-  nsBaseContentList()
-  {
-    SetIsDOMBinding();
-  }
-
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
 
   // nsIDOMNodeList
   NS_DECL_NSIDOMNODELIST
 
   // nsINodeList
   virtual int32_t IndexOf(nsIContent* aContent) MOZ_OVERRIDE;
   virtual nsIContent* Item(uint32_t aIndex) MOZ_OVERRIDE;
--- a/content/base/src/nsDOMAttributeMap.cpp
+++ b/content/base/src/nsDOMAttributeMap.cpp
@@ -29,17 +29,16 @@ using namespace mozilla::dom;
 
 //----------------------------------------------------------------------
 
 nsDOMAttributeMap::nsDOMAttributeMap(Element* aContent)
   : mContent(aContent)
 {
   // We don't add a reference to our content. If it goes away,
   // we'll be told to drop our reference
-  SetIsDOMBinding();
 }
 
 /**
  * Clear map pointer for attributes.
  */
 PLDHashOperator
 RemoveMapRef(nsAttrHashKey::KeyType aKey, nsRefPtr<Attr>& aData,
              void* aUserArg)
--- a/content/base/src/nsDOMCaretPosition.cpp
+++ b/content/base/src/nsDOMCaretPosition.cpp
@@ -8,17 +8,16 @@
 #include "mozilla/dom/DOMRect.h"
 #include "nsRange.h"
 
 using namespace mozilla::dom;
 
 nsDOMCaretPosition::nsDOMCaretPosition(nsINode* aNode, uint32_t aOffset)
   : mOffset(aOffset), mOffsetNode(aNode), mAnonymousContentNode(nullptr)
 {
-  SetIsDOMBinding();
 }
 
 nsDOMCaretPosition::~nsDOMCaretPosition()
 {
 }
 
 nsINode* nsDOMCaretPosition::GetOffsetNode() const
 {
--- a/content/base/src/nsDOMFileReader.cpp
+++ b/content/base/src/nsDOMFileReader.cpp
@@ -82,17 +82,16 @@ nsDOMFileReader::RootResultArrayBuffer()
 //nsDOMFileReader constructors/initializers
 
 nsDOMFileReader::nsDOMFileReader()
   : mFileData(nullptr),
     mDataLen(0), mDataFormat(FILE_AS_BINARY),
     mResultArrayBuffer(nullptr)
 {
   SetDOMStringToNull(mResult);
-  SetIsDOMBinding();
 }
 
 nsDOMFileReader::~nsDOMFileReader()
 {
   FreeFileData();
   mResultArrayBuffer = nullptr;
   mozilla::DropJSObjects(this);
 }
--- a/content/base/src/nsDOMMutationObserver.h
+++ b/content/base/src/nsDOMMutationObserver.h
@@ -32,17 +32,16 @@ class nsDOMMutationRecord : public nsISu
                             public nsWrapperCache
 {
   virtual ~nsDOMMutationRecord() {}
 
 public:
   nsDOMMutationRecord(nsIAtom* aType, nsISupports* aOwner)
   : mType(aType), mAttrNamespace(NullString()), mPrevValue(NullString()), mOwner(aOwner)
   {
-    SetIsDOMBinding();
   }
 
   nsISupports* GetParentObject() const
   {
     return mOwner;
   }
 
   virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE
@@ -342,17 +341,16 @@ class nsDOMMutationObserver : public nsI
                               public nsWrapperCache
 {
 public:
   nsDOMMutationObserver(already_AddRefed<nsPIDOMWindow>&& aOwner,
                         mozilla::dom::MutationCallback& aCb)
   : mOwner(aOwner), mLastPendingMutation(nullptr), mPendingMutationCount(0),
     mCallback(&aCb), mWaitingForRun(false), mId(++sCount)
   {
-    SetIsDOMBinding();
   }
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(nsDOMMutationObserver)
   NS_DECLARE_STATIC_IID_ACCESSOR(NS_DOM_MUTATION_OBSERVER_IID)
 
   static already_AddRefed<nsDOMMutationObserver>
   Constructor(const mozilla::dom::GlobalObject& aGlobal,
               mozilla::dom::MutationCallback& aCb,
--- a/content/base/src/nsDOMSerializer.cpp
+++ b/content/base/src/nsDOMSerializer.cpp
@@ -13,17 +13,16 @@
 #include "nsContentUtils.h"
 #include "nsError.h"
 #include "nsINode.h"
 
 using namespace mozilla;
 
 nsDOMSerializer::nsDOMSerializer()
 {
-  SetIsDOMBinding();
 }
 
 nsDOMSerializer::~nsDOMSerializer()
 {
 }
 
 // QueryInterface implementation for nsDOMSerializer
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsDOMSerializer)
--- a/content/base/src/nsDOMSerializer.h
+++ b/content/base/src/nsDOMSerializer.h
@@ -54,17 +54,16 @@ public:
   }
 
 private:
   virtual ~nsDOMSerializer();
 
   explicit nsDOMSerializer(nsISupports* aOwner) : mOwner(aOwner)
   {
     MOZ_ASSERT(aOwner);
-    SetIsDOMBinding();
   }
 
   nsCOMPtr<nsISupports> mOwner;
 };
 
 
 #endif
 
--- a/content/base/src/nsDOMTokenList.cpp
+++ b/content/base/src/nsDOMTokenList.cpp
@@ -19,17 +19,16 @@ using namespace mozilla;
 using namespace mozilla::dom;
 
 nsDOMTokenList::nsDOMTokenList(Element* aElement, nsIAtom* aAttrAtom)
   : mElement(aElement),
     mAttrAtom(aAttrAtom)
 {
   // We don't add a reference to our element. If it goes away,
   // we'll be told to drop our reference
-  SetIsDOMBinding();
 }
 
 nsDOMTokenList::~nsDOMTokenList() { }
 
 NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(nsDOMTokenList, mElement)
 
 NS_INTERFACE_MAP_BEGIN(nsDOMTokenList)
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
--- a/content/base/src/nsFormData.cpp
+++ b/content/base/src/nsFormData.cpp
@@ -11,17 +11,16 @@
 
 using namespace mozilla;
 using namespace mozilla::dom;
 
 nsFormData::nsFormData(nsISupports* aOwner)
   : nsFormSubmission(NS_LITERAL_CSTRING("UTF-8"), nullptr)
   , mOwner(aOwner)
 {
-  SetIsDOMBinding();
 }
 
 // -------------------------------------------------------------------------
 // nsISupports
 
 NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(nsFormData, mOwner)
 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsFormData)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsFormData)
--- a/content/base/src/nsINode.cpp
+++ b/content/base/src/nsINode.cpp
@@ -2669,18 +2669,16 @@ nsINode::GetElementById(const nsAString&
     }
   }
   return nullptr;
 }
 
 JSObject*
 nsINode::WrapObject(JSContext *aCx)
 {
-  MOZ_ASSERT(IsDOMBinding());
-
   // Make sure one of these is true
   // (1) our owner document has a script handling object,
   // (2) Our owner document has had a script handling object, or has been marked
   //     to have had one,
   // (3) we are running a privileged script.
   // Event handling is possible only if (1). If (2) event handling is
   // prevented.
   // If the document has never had a script handling object, untrusted
--- a/content/base/src/nsInProcessTabChildGlobal.cpp
+++ b/content/base/src/nsInProcessTabChildGlobal.cpp
@@ -98,16 +98,17 @@ nsInProcessTabChildGlobal::DoSendAsyncMe
 }
 
 nsInProcessTabChildGlobal::nsInProcessTabChildGlobal(nsIDocShell* aShell,
                                                      nsIContent* aOwner,
                                                      nsFrameMessageManager* aChrome)
 : mDocShell(aShell), mInitialized(false), mLoadingScript(false),
   mOwner(aOwner), mChromeMessageManager(aChrome)
 {
+  SetIsNotDOMBinding();
   mozilla::HoldJSObjects(this);
 
   // If owner corresponds to an <iframe mozbrowser> or <iframe mozapp>, we'll
   // have to tweak our PreHandleEvent implementation.
   nsCOMPtr<nsIMozBrowserFrame> browserFrame = do_QueryInterface(mOwner);
   if (browserFrame) {
     mIsBrowserOrAppFrame = browserFrame->GetReallyIsBrowserOrApp();
   }
--- a/content/base/src/nsInProcessTabChildGlobal.h
+++ b/content/base/src/nsInProcessTabChildGlobal.h
@@ -149,16 +149,20 @@ public:
 
   virtual JSObject* GetGlobalJSObject() MOZ_OVERRIDE {
     if (!mGlobal) {
       return nullptr;
     }
 
     return mGlobal->GetJSObject();
   }
+  virtual JSObject* WrapObject(JSContext* cx) MOZ_OVERRIDE
+  {
+    MOZ_CRASH("nsInProcessTabChildGlobal doesn't use DOM bindings!");
+  }
 protected:
   virtual ~nsInProcessTabChildGlobal();
 
   nsresult Init();
   nsresult InitTabChildGlobal();
   nsCOMPtr<nsIContentFrameMessageManager> mMessageManager;
   nsCOMPtr<nsIDocShell> mDocShell;
   bool mInitialized;
--- a/content/base/src/nsObjectLoadingContent.cpp
+++ b/content/base/src/nsObjectLoadingContent.cpp
@@ -3446,19 +3446,16 @@ nsObjectLoadingContent::LegacyCall(JSCon
 
   Telemetry::Accumulate(Telemetry::PLUGIN_CALLED_DIRECTLY, true);
 }
 
 void
 nsObjectLoadingContent::SetupProtoChain(JSContext* aCx,
                                         JS::Handle<JSObject*> aObject)
 {
-  MOZ_ASSERT(nsCOMPtr<nsIContent>(do_QueryInterface(
-    static_cast<nsIObjectLoadingContent*>(this)))->IsDOMBinding());
-
   if (mType != eType_Plugin) {
     return;
   }
 
   if (!nsContentUtils::IsSafeToRunScript()) {
     nsRefPtr<SetupProtoChainRunner> runner = new SetupProtoChainRunner(this);
     nsContentUtils::AddScriptRunner(runner);
     return;
--- a/content/base/src/nsRange.h
+++ b/content/base/src/nsRange.h
@@ -52,17 +52,16 @@ public:
     , mStartOffsetWasIncremented(false)
     , mEndOffsetWasIncremented(false)
     , mEnableGravitationOnElementRemoval(true)
 #ifdef DEBUG
     , mAssertNextInsertOrAppendIndex(-1)
     , mAssertNextInsertOrAppendNode(nullptr)
 #endif
   {
-    SetIsDOMBinding();
     MOZ_ASSERT(aNode, "range isn't in a document!");
     mOwner = aNode->OwnerDoc();
   }
 
   static nsresult CreateRange(nsIDOMNode* aStartParent, int32_t aStartOffset,
                               nsIDOMNode* aEndParent, int32_t aEndOffset,
                               nsRange** aRange);
   static nsresult CreateRange(nsIDOMNode* aStartParent, int32_t aStartOffset,
--- a/content/base/src/nsXMLHttpRequest.cpp
+++ b/content/base/src/nsXMLHttpRequest.cpp
@@ -302,17 +302,16 @@ nsXMLHttpRequest::nsXMLHttpRequest()
     mIsAnon(false),
     mFirstStartRequestSeen(false),
     mInLoadProgressEvent(false),
     mResultJSON(JSVAL_VOID),
     mResultArrayBuffer(nullptr),
     mIsMappedArrayBuffer(false),
     mXPCOMifier(nullptr)
 {
-  SetIsDOMBinding();
 #ifdef DEBUG
   StaticAssertions();
 #endif
 }
 
 nsXMLHttpRequest::~nsXMLHttpRequest()
 {
   mState |= XML_HTTP_REQUEST_DELETED;
--- a/content/base/test/chrome/cpows_child.js
+++ b/content/base/test/chrome/cpows_child.js
@@ -110,16 +110,31 @@ function dom_test()
 function xray_test()
 {
   let element = content.document.createElement("div");
   element.wrappedJSObject.foo = "hello";
 
   sendSyncMessage("cpows:xray_test", {}, {element: element});
 }
 
+function symbol_test()
+{
+  let iterator = Symbol.iterator;
+  let named = Symbol.for("cpow-test");
+  // let unique = Symbol();
+
+  let object = {
+    [iterator]: iterator,
+    [named]: named,
+    // [unique]: unique,
+    // "unique": unique
+  };
+  sendSyncMessage("cpows:symbol_test", {}, object);
+}
+
 // Parent->Child references should go X->parent.privilegedJunkScope->child.privilegedJunkScope->Y
 // Child->Parent references should go X->child.privilegedJunkScope->parent.unprivilegedJunkScope->Y
 function compartment_test()
 {
   // This test primarily checks various compartment invariants for CPOWs, and
   // doesn't make sense to run in-process.
   if (!is_remote) {
     return;
--- a/content/base/test/chrome/cpows_parent.xul
+++ b/content/base/test/chrome/cpows_parent.xul
@@ -200,16 +200,23 @@
       is(id, "it_works", "DOM element has expected ID");
     }
 
     function recvXrayTest(message) {
       let element = message.objects.element;
       is(element.foo, undefined, "DOM element does not expose content properties");
     }
 
+    function recvSymbolTest(message) {
+      let object = message.objects;
+      is(object[Symbol.iterator], Symbol.iterator, "Should use Symbol.iterator");
+      is(Symbol.keyFor(object[Symbol.for("cpow-test")]), "cpow-test", "Symbols aren't registered correctly");
+      // is(object.unique, object[object.unique], "Unique symbols as ids and values don't seem to work");
+    }
+
     let systemGlobal = this;
     function recvCompartmentTest(message) {
       let getUnprivilegedObject = message.objects.getUnprivilegedObject;
       let testParentObject = message.objects.testParentObject;
 
       // Make sure that parent->child CPOWs live in the parent's privileged junk scope.
       let unprivilegedObject = getUnprivilegedObject();
       is(Cu.getGlobalForObject(getUnprivilegedObject),
@@ -295,16 +302,17 @@
       mm.addMessageListener("cpows:reenter_sync", recvReenterSyncMessage);
       mm.addMessageListener("cpows:done", recvDoneMessage);
       mm.addMessageListener("cpows:fail", recvFailMessage);
       mm.addMessageListener("cpows:parent_test", recvParentTest);
       mm.addMessageListener("cpows:error_reporting_test", recvErrorReportingTest);
       mm.addMessageListener("cpows:dom_test", recvDomTest);
       mm.addMessageListener("cpows:dom_test_after_gc", recvDomTestAfterGC);
       mm.addMessageListener("cpows:xray_test", recvXrayTest);
+      mm.addMessageListener("cpows:symbol_test", recvSymbolTest);
       mm.addMessageListener("cpows:compartment_test", recvCompartmentTest);
       mm.addMessageListener("cpows:regexp_test", recvRegExpTest);
       mm.addMessageListener("cpows:lifetime_test_1", recvLifetimeTest1);
       mm.addMessageListener("cpows:lifetime_test_2", recvLifetimeTest2);
       mm.loadFrameScript("chrome://mochitests/content/chrome/content/base/test/chrome/cpows_child.js", true);
     }
 
     function start() {
--- a/content/base/test/chrome/test_bug765993.html
+++ b/content/base/test/chrome/test_bug765993.html
@@ -41,17 +41,17 @@ window.onload = function () {
             var dbg = new Debugger(iframe.contentWindow);
             ok(dbg, "Should be able to create debugger");
 
             var scripts = dbg.findScripts({
                 url: "http://mochi.test:8888/tests/content/base/test/chrome/nochrome_bug765993.js"
             });
             ok(scripts.length > 0, "Should be able to find script");
 
-            is(scripts[0].sourceMapURL, "foo.js.map");
+            is(scripts[0].source.sourceMapURL, "foo.js.map");
             SimpleTest.finish();
         }
 
         iframe.contentWindow.document.body.appendChild(script);
     };
 
     document.body.appendChild(iframe);
 };
--- a/content/html/content/src/HTMLCanvasElement.cpp
+++ b/content/html/content/src/HTMLCanvasElement.cpp
@@ -59,17 +59,16 @@ NS_IMPL_CYCLE_COLLECTION_ROOT_NATIVE(HTM
 NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(HTMLCanvasPrintState, Release)
 
 HTMLCanvasPrintState::HTMLCanvasPrintState(HTMLCanvasElement* aCanvas,
                                            nsICanvasRenderingContextInternal* aContext,
                                            nsITimerCallback* aCallback)
   : mIsDone(false), mPendingNotify(false), mCanvas(aCanvas),
     mContext(aContext), mCallback(aCallback)
 {
-  SetIsDOMBinding();
 }
 
 HTMLCanvasPrintState::~HTMLCanvasPrintState()
 {
 }
 
 /* virtual */ JSObject*
 HTMLCanvasPrintState::WrapObject(JSContext* aCx)
--- a/content/html/content/src/HTMLContentElement.cpp
+++ b/content/html/content/src/HTMLContentElement.cpp
@@ -19,17 +19,16 @@
 
 NS_IMPL_NS_NEW_HTML_ELEMENT(Content)
 
 using namespace mozilla::dom;
 
 HTMLContentElement::HTMLContentElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
   : nsGenericHTMLElement(aNodeInfo), mValidSelector(true), mIsInsertionPoint(false)
 {
-  SetIsDOMBinding();
 }
 
 HTMLContentElement::~HTMLContentElement()
 {
 }
 
 NS_IMPL_CYCLE_COLLECTION_INHERITED(HTMLContentElement,
                                    nsGenericHTMLElement,
@@ -307,17 +306,16 @@ NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(DistributedContentList)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(DistributedContentList)
 
 DistributedContentList::DistributedContentList(HTMLContentElement* aHostElement)
   : mParent(aHostElement)
 {
   MOZ_COUNT_CTOR(DistributedContentList);
-  SetIsDOMBinding();
 
   if (aHostElement->IsInsertionPoint()) {
     if (aHostElement->MatchedNodes().IsEmpty()) {
       // Fallback content.
       nsINode* contentNode = aHostElement;
       for (nsIContent* content = contentNode->GetFirstChild();
            content;
            content = content->GetNextSibling()) {
--- a/content/html/content/src/HTMLFormControlsCollection.cpp
+++ b/content/html/content/src/HTMLFormControlsCollection.cpp
@@ -71,17 +71,16 @@ HTMLFormControlsCollection::ShouldBeInEl
 
 HTMLFormControlsCollection::HTMLFormControlsCollection(HTMLFormElement* aForm)
   : mForm(aForm)
   // Initialize the elements list to have an initial capacity
   // of 8 to reduce allocations on small forms.
   , mElements(8)
   , mNameLookupTable(HTMLFormElement::FORM_CONTROL_LIST_HASHTABLE_LENGTH)
 {
-  SetIsDOMBinding();
 }
 
 HTMLFormControlsCollection::~HTMLFormControlsCollection()
 {
   mForm = nullptr;
   Clear();
 }
 
--- a/content/html/content/src/HTMLFormElement.cpp
+++ b/content/html/content/src/HTMLFormElement.cpp
@@ -2062,24 +2062,25 @@ HTMLFormElement::GetNextRadioButton(cons
       if (--index < 0) {
         index = numRadios -1;
       }
     }
     else if (++index >= (int32_t)numRadios) {
       index = 0;
     }
     radio = HTMLInputElement::FromContentOrNull(radioGroup->Item(index));
-    if (!radio)
+    isRadio = radio && radio->GetType() == NS_FORM_INPUT_RADIO;
+    if (!isRadio) {
       continue;
+    }
 
-    isRadio = radio->GetType() == NS_FORM_INPUT_RADIO;
-    if (!isRadio)
-      continue;
-
-  } while ((radio->Disabled() && radio != currentRadio) || !isRadio);
+    nsAutoString name;
+    radio->GetName(name);
+    isRadio = aName.Equals(name);
+  } while (!isRadio || (radio->Disabled() && radio != currentRadio));
 
   NS_IF_ADDREF(*aRadioOut = radio);
   return NS_OK;
 }
 
 NS_IMETHODIMP
 HTMLFormElement::WalkRadioGroup(const nsAString& aName,
                                 nsIRadioVisitor* aVisitor,
--- a/content/html/content/src/HTMLOptionsCollection.cpp
+++ b/content/html/content/src/HTMLOptionsCollection.cpp
@@ -30,18 +30,16 @@
 #include "nsStyleConsts.h"
 #include "jsfriendapi.h"
 
 namespace mozilla {
 namespace dom {
 
 HTMLOptionsCollection::HTMLOptionsCollection(HTMLSelectElement* aSelect)
 {
-  SetIsDOMBinding();
-
   // Do not maintain a reference counted reference. When
   // the select goes away, it will let us know.
   mSelect = aSelect;
 }
 
 HTMLOptionsCollection::~HTMLOptionsCollection()
 {
   DropReference();
--- a/content/html/content/src/HTMLPropertiesCollection.cpp
+++ b/content/html/content/src/HTMLPropertiesCollection.cpp
@@ -41,17 +41,16 @@ NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(HTM
   NS_IMPL_CYCLE_COLLECTION_TRACE_PRESERVED_WRAPPER
 NS_IMPL_CYCLE_COLLECTION_TRACE_END
 
 HTMLPropertiesCollection::HTMLPropertiesCollection(nsGenericHTMLElement* aRoot)
   : mRoot(aRoot)
   , mDoc(aRoot->GetUncomposedDoc())
   , mIsDirty(true)
 {
-  SetIsDOMBinding();
   mNames = new PropertyStringList(this);
   if (mDoc) {
     mDoc->AddMutationObserver(this);
   }
 }
 
 HTMLPropertiesCollection::~HTMLPropertiesCollection()
 {
@@ -306,17 +305,16 @@ HTMLPropertiesCollection::GetSupportedNa
 PropertyNodeList::PropertyNodeList(HTMLPropertiesCollection* aCollection,
                                    nsIContent* aParent, const nsAString& aName)
   : mName(aName),
     mDoc(aParent->GetUncomposedDoc()),
     mCollection(aCollection),
     mParent(aParent),
     mIsDirty(true)
 {
-  SetIsDOMBinding();
   if (mDoc) {
     mDoc->AddMutationObserver(this);
   }
 }
 
 PropertyNodeList::~PropertyNodeList()
 {
   if (mDoc) {
--- a/content/html/content/src/HTMLShadowElement.cpp
+++ b/content/html/content/src/HTMLShadowElement.cpp
@@ -12,17 +12,16 @@
 
 NS_IMPL_NS_NEW_HTML_ELEMENT(Shadow)
 
 using namespace mozilla::dom;
 
 HTMLShadowElement::HTMLShadowElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
   : nsGenericHTMLElement(aNodeInfo), mIsInsertionPoint(false)
 {
-  SetIsDOMBinding();
 }
 
 HTMLShadowElement::~HTMLShadowElement()
 {
   if (mProjectedShadow) {
     mProjectedShadow->RemoveMutationObserver(this);
   }
 }
--- a/content/html/content/src/HTMLTableElement.cpp
+++ b/content/html/content/src/HTMLTableElement.cpp
@@ -68,17 +68,16 @@ protected:
 TableRowsCollection::TableRowsCollection(HTMLTableElement *aParent)
   : mParent(aParent)
   , mOrphanRows(new nsContentList(mParent,
                                   kNameSpaceID_XHTML,
                                   nsGkAtoms::tr,
                                   nsGkAtoms::tr,
                                   false))
 {
-  SetIsDOMBinding();
 }
 
 TableRowsCollection::~TableRowsCollection()
 {
   // we do NOT have a ref-counted reference to mParent, so do NOT
   // release it!  this is to avoid circular references.  The
   // instantiator who provided mParent is responsible for managing our
   // reference for us.
--- a/content/html/content/src/MediaError.cpp
+++ b/content/html/content/src/MediaError.cpp
@@ -20,17 +20,16 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
   NS_INTERFACE_MAP_ENTRY(nsIDOMMediaError)
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIDOMMediaError)
 NS_INTERFACE_MAP_END
 
 MediaError::MediaError(HTMLMediaElement* aParent, uint16_t aCode)
   : mParent(aParent)
   , mCode(aCode)
 {
-  SetIsDOMBinding();
 }
 
 NS_IMETHODIMP MediaError::GetCode(uint16_t* aCode)
 {
   if (aCode)
     *aCode = Code();
 
   return NS_OK;
--- a/content/html/content/src/UndoManager.cpp
+++ b/content/html/content/src/UndoManager.cpp
@@ -836,17 +836,16 @@ NS_IMPL_CYCLE_COLLECTING_RELEASE(UndoMan
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(UndoManager)
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 UndoManager::UndoManager(nsIContent* aNode)
   : mHostNode(aNode), mInTransaction(false), mIsDisconnected(false)
 {
-  SetIsDOMBinding();
   mTxnManager = new nsTransactionManager();
 }
 
 UndoManager::~UndoManager() {}
 
 void
 UndoManager::Transact(JSContext* aCx, DOMTransaction& aTransaction,
                       bool aMerge, ErrorResult& aRv)
--- a/content/html/content/src/ValidityState.cpp
+++ b/content/html/content/src/ValidityState.cpp
@@ -19,17 +19,16 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRY(nsIDOMValidityState)
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 ValidityState::ValidityState(nsIConstraintValidation* aConstraintValidation)
   : mConstraintValidation(aConstraintValidation)
 {
-  SetIsDOMBinding();
 }
 
 NS_IMETHODIMP
 ValidityState::GetValueMissing(bool* aValueMissing)
 {
   *aValueMissing = ValueMissing();
   return NS_OK;
 }
--- a/content/html/content/src/nsDOMStringMap.cpp
+++ b/content/html/content/src/nsDOMStringMap.cpp
@@ -50,18 +50,16 @@ NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsDOMStringMap)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsDOMStringMap)
 
 nsDOMStringMap::nsDOMStringMap(nsGenericHTMLElement* aElement)
   : mElement(aElement),
     mRemovingProp(false)
 {
-  SetIsDOMBinding();
-
   mElement->AddMutationObserver(this);
 }
 
 nsDOMStringMap::~nsDOMStringMap()
 {
   // Check if element still exists, may have been unlinked by cycle collector.
   if (mElement) {
     // Call back to element to null out weak reference to this object.
--- a/content/html/content/src/nsHTMLDNSPrefetch.cpp
+++ b/content/html/content/src/nsHTMLDNSPrefetch.cpp
@@ -89,16 +89,20 @@ nsHTMLDNSPrefetch::Shutdown()
   NS_IF_RELEASE(sDNSListener);
   
   return NS_OK;
 }
 
 bool
 nsHTMLDNSPrefetch::IsAllowed (nsIDocument *aDocument)
 {
+  if (NS_IsAppOffline(aDocument->NodePrincipal())) {
+    return false;
+  }
+
   // There is no need to do prefetch on non UI scenarios such as XMLHttpRequest.
   return aDocument->IsDNSPrefetchAllowed() && aDocument->GetWindow();
 }
 
 nsresult
 nsHTMLDNSPrefetch::Prefetch(Link *aElement, uint16_t flags)
 {
   if (!(sInitialized && sPrefetches && sDNSService && sDNSListener))
--- a/content/html/content/test/forms/test_input_radio_radiogroup.html
+++ b/content/html/content/test/forms/test_input_radio_radiogroup.html
@@ -9,35 +9,62 @@ https://bugzilla.mozilla.org/show_bug.cg
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 </head>
 <body>
 <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=343444">Mozilla Bug 343444</a>
 <p id="display"></p>
 <form>
-  <input type="radio" name="testradio" id="start"></input>
-  <input type="text"  name="testradio"></input>
-  <input type="text"  name="testradio"></input>
-  <input type="radio" name="testradio"></input>
-  <input type="text"  name="testradio"></input>
-  <input type="radio" name="testradio"></input>
-  <input type="text"  name="testradio"></input>
-  <input type="radio" name="testradio"></input>
-  <input type="radio" name="testradio"></input>
-  <input type="text"  name="testradio"></input>
+  <fieldset id="testradio">
+    <input type="radio" name="testradio" id="start"></input>
+    <input type="text"  name="testradio"></input>
+    <input type="text"  name="testradio"></input>
+    <input type="radio" name="testradio"></input>
+    <input type="text"  name="testradio"></input>
+    <input type="radio" name="testradio"></input>
+    <input type="text"  name="testradio"></input>
+    <input type="radio" name="testradio"></input>
+    <input type="radio" name="testradio"></input>
+    <input type="text"  name="testradio"></input>
+  </fieldset>
+
+  <fieldset>
+    <input type="radio" name="testtwo" id="start2"></input>
+    <input type="radio" name="testtwo"></input>
+    <input type="radio" name="error" id="testtwo"></input>
+    <input type="radio" name="testtwo" id="end"></input>
+  </fieldset>
+
+  <fieldset>
+    <input type="radio" name="testthree" id="start3"></input>
+    <input type="radio" name="errorthree" id="testthree"></input>
+  </fieldset>
 </form>
 <script class="testbody" type="text/javascript">
 /** Test for Bug 343444 **/
 document.getElementById("start").focus();
 var count=0;
 while (count < 2) {
   sendKey("DOWN");
-  ok(document.activeElement.type == "radio", "radioGroup should ignore non-radio input fields");
+  is(document.activeElement.type, "radio", "radioGroup should ignore non-radio input fields");
   if (document.activeElement.id == "start") {
     count++;
   }
 }
+
+document.getElementById("start2").focus();
+count = 0;
+while (count < 3) {
+  is(document.activeElement.name, "testtwo",
+     "radioGroup should only contain elements with the same @name")
+  sendKey("DOWN");
+  count++;
+}
+
+document.getElementById("start3").focus();
+sendKey("DOWN");
+is(document.activeElement.name, "testthree", "we don't have an infinite-loop");
 </script>
 </pre>
 </body>
 </html>
 
--- a/content/html/document/src/HTMLAllCollection.cpp
+++ b/content/html/document/src/HTMLAllCollection.cpp
@@ -13,17 +13,16 @@
 
 namespace mozilla {
 namespace dom {
 
 HTMLAllCollection::HTMLAllCollection(nsHTMLDocument* aDocument)
   : mDocument(aDocument)
 {
   MOZ_ASSERT(mDocument);
-  SetIsDOMBinding();
 }
 
 HTMLAllCollection::~HTMLAllCollection()
 {
 }
 
 NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(HTMLAllCollection,
                                       mDocument,
--- a/content/media/DOMMediaStream.cpp
+++ b/content/media/DOMMediaStream.cpp
@@ -122,17 +122,16 @@ private:
   DOMMediaStream* mStream;
 };
 
 DOMMediaStream::DOMMediaStream()
   : mLogicalStreamStartTime(0),
     mStream(nullptr), mHintContents(0), mTrackTypesAvailable(0),
     mNotifiedOfMediaStreamGraphShutdown(false)
 {
-  SetIsDOMBinding();
 }
 
 DOMMediaStream::~DOMMediaStream()
 {
   Destroy();
 }
 
 void
--- a/content/media/MediaStreamTrack.cpp
+++ b/content/media/MediaStreamTrack.cpp
@@ -10,18 +10,16 @@
 #include "nsServiceManagerUtils.h"
 
 namespace mozilla {
 namespace dom {
 
 MediaStreamTrack::MediaStreamTrack(DOMMediaStream* aStream, TrackID aTrackID)
   : mStream(aStream), mTrackID(aTrackID), mEnded(false), mEnabled(true)
 {
-  SetIsDOMBinding();
-
   memset(&mID, 0, sizeof(mID));
 
   nsresult rv;
   nsCOMPtr<nsIUUIDGenerator> uuidgen =
     do_GetService("@mozilla.org/uuid-generator;1", &rv);
   if (uuidgen) {
     uuidgen->GenerateUUIDInPlace(&mID);
   }
--- a/content/media/MediaTrack.cpp
+++ b/content/media/MediaTrack.cpp
@@ -38,13 +38,12 @@ MediaTrack::SetTrackList(MediaTrackList*
 {
   mList = aList;
 }
 
 void
 MediaTrack::Init(nsPIDOMWindow* aOwnerWindow)
 {
   BindToOwner(aOwnerWindow);
-  SetIsDOMBinding();
 }
 
 } // namespace dom
 } // namespace mozilla
--- a/content/media/TextTrackCueList.cpp
+++ b/content/media/TextTrackCueList.cpp
@@ -30,17 +30,16 @@ NS_IMPL_CYCLE_COLLECTING_ADDREF(TextTrac
 NS_IMPL_CYCLE_COLLECTING_RELEASE(TextTrackCueList)
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(TextTrackCueList)
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 TextTrackCueList::TextTrackCueList(nsISupports* aParent) : mParent(aParent)
 {
-  SetIsDOMBinding();
 }
 
 TextTrackCueList::~TextTrackCueList()
 {}
 
 JSObject*
 TextTrackCueList::WrapObject(JSContext* aCx)
 {
--- a/content/media/TextTrackRegion.cpp
+++ b/content/media/TextTrackRegion.cpp
@@ -41,17 +41,16 @@ TextTrackRegion::TextTrackRegion(nsISupp
   : mParent(aGlobal)
   , mWidth(100)
   , mLines(3)
   , mRegionAnchorX(0)
   , mRegionAnchorY(100)
   , mViewportAnchorX(0)
   , mViewportAnchorY(100)
 {
-  SetIsDOMBinding();
 }
 
 void
 TextTrackRegion::CopyValues(TextTrackRegion& aRegion)
 {
   mWidth = aRegion.Width();
   mLines = aRegion.Lines();
   mRegionAnchorX = aRegion.RegionAnchorX();
--- a/content/media/VideoPlaybackQuality.cpp
+++ b/content/media/VideoPlaybackQuality.cpp
@@ -20,17 +20,16 @@ VideoPlaybackQuality::VideoPlaybackQuali
                                            uint64_t aDroppedFrames,
                                            uint64_t aCorruptedFrames)
   : mElement(aElement)
   , mCreationTime(aCreationTime)
   , mTotalFrames(aTotalFrames)
   , mDroppedFrames(aDroppedFrames)
   , mCorruptedFrames(aCorruptedFrames)
 {
-  SetIsDOMBinding();
 }
 
 HTMLMediaElement*
 VideoPlaybackQuality::GetParentObject() const
 {
   return mElement;
 }
 
--- a/content/media/eme/MediaKeyError.cpp
+++ b/content/media/eme/MediaKeyError.cpp
@@ -10,17 +10,16 @@
 
 namespace mozilla {
 namespace dom {
 
 MediaKeyError::MediaKeyError(EventTarget* aOwner, uint32_t aSystemCode)
   : Event(aOwner, nullptr, nullptr)
   , mSystemCode(aSystemCode)
 {
-  SetIsDOMBinding();
   InitEvent(NS_LITERAL_STRING("error"), false, false);
 }
 
 MediaKeyError::~MediaKeyError()
 {
 }
 
 uint32_t
--- a/content/media/eme/MediaKeys.cpp
+++ b/content/media/eme/MediaKeys.cpp
@@ -36,17 +36,16 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 MediaKeys::MediaKeys(nsPIDOMWindow* aParent, const nsAString& aKeySystem)
   : mParent(aParent)
   , mKeySystem(aKeySystem)
   , mCreatePromiseId(0)
 {
-  SetIsDOMBinding();
 }
 
 static PLDHashOperator
 RejectPromises(const uint32_t& aKey,
                nsRefPtr<dom::Promise>& aPromise,
                void* aClosure)
 {
   aPromise->MaybeReject(NS_ERROR_DOM_INVALID_STATE_ERR);
--- a/content/media/webaudio/AudioBuffer.cpp
+++ b/content/media/webaudio/AudioBuffer.cpp
@@ -43,17 +43,16 @@ NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(A
 
 AudioBuffer::AudioBuffer(AudioContext* aContext, uint32_t aNumberOfChannels,
                          uint32_t aLength, float aSampleRate)
   : mContext(aContext),
     mLength(aLength),
     mSampleRate(aSampleRate)
 {
   mJSChannels.SetCapacity(aNumberOfChannels);
-  SetIsDOMBinding();
   mozilla::HoldJSObjects(this);
 }
 
 AudioBuffer::~AudioBuffer()
 {
   ClearJSChannels();
 }
 
--- a/content/media/webaudio/AudioListener.cpp
+++ b/content/media/webaudio/AudioListener.cpp
@@ -21,17 +21,16 @@ AudioListener::AudioListener(AudioContex
   , mPosition()
   , mFrontVector(0., 0., -1.)
   , mRightVector(1., 0., 0.)
   , mVelocity()
   , mDopplerFactor(1.)
   , mSpeedOfSound(343.3) // meters/second
 {
   MOZ_ASSERT(aContext);
-  SetIsDOMBinding();
 }
 
 JSObject*
 AudioListener::WrapObject(JSContext* aCx)
 {
   return AudioListenerBinding::Wrap(aCx, this);
 }
 
--- a/content/media/webaudio/AudioNode.cpp
+++ b/content/media/webaudio/AudioNode.cpp
@@ -67,17 +67,16 @@ AudioNode::AudioNode(AudioContext* aCont
   , mId(gId++)
   , mPassThrough(false)
 #ifdef DEBUG
   , mDemiseNotified(false)
 #endif
 {
   MOZ_ASSERT(aContext);
   DOMEventTargetHelper::BindToOwner(aContext->GetParentObject());
-  SetIsDOMBinding();
   aContext->UpdateNodeCount(1);
 }
 
 AudioNode::~AudioNode()
 {
   MOZ_ASSERT(mInputNodes.IsEmpty());
   MOZ_ASSERT(mOutputNodes.IsEmpty());
   MOZ_ASSERT(mOutputParams.IsEmpty());
--- a/content/media/webaudio/AudioParam.cpp
+++ b/content/media/webaudio/AudioParam.cpp
@@ -46,17 +46,16 @@ NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(A
 AudioParam::AudioParam(AudioNode* aNode,
                        AudioParam::CallbackType aCallback,
                        float aDefaultValue)
   : AudioParamTimeline(aDefaultValue)
   , mNode(aNode)
   , mCallback(aCallback)
   , mDefaultValue(aDefaultValue)
 {
-  SetIsDOMBinding();
 }
 
 AudioParam::~AudioParam()
 {
   MOZ_ASSERT(mInputNodes.IsEmpty());
 }
 
 JSObject*
--- a/content/media/webaudio/AudioProcessingEvent.cpp
+++ b/content/media/webaudio/AudioProcessingEvent.cpp
@@ -23,17 +23,16 @@ NS_IMPL_RELEASE_INHERITED(AudioProcessin
 
 AudioProcessingEvent::AudioProcessingEvent(ScriptProcessorNode* aOwner,
                                            nsPresContext* aPresContext,
                                            WidgetEvent* aEvent)
   : Event(aOwner, aPresContext, aEvent)
   , mPlaybackTime(0.0)
   , mNode(aOwner)
 {
-  SetIsDOMBinding();
 }
 
 AudioProcessingEvent::~AudioProcessingEvent()
 {
 }
 
 JSObject*
 AudioProcessingEvent::WrapObject(JSContext* aCx)
--- a/content/media/webaudio/OfflineAudioCompletionEvent.cpp
+++ b/content/media/webaudio/OfflineAudioCompletionEvent.cpp
@@ -20,17 +20,16 @@ NS_INTERFACE_MAP_END_INHERITING(Event)
 NS_IMPL_ADDREF_INHERITED(OfflineAudioCompletionEvent, Event)
 NS_IMPL_RELEASE_INHERITED(OfflineAudioCompletionEvent, Event)
 
 OfflineAudioCompletionEvent::OfflineAudioCompletionEvent(AudioContext* aOwner,
                                                          nsPresContext* aPresContext,
                                                          WidgetEvent* aEvent)
   : Event(aOwner, aPresContext, aEvent)
 {
-  SetIsDOMBinding();
 }
 
 OfflineAudioCompletionEvent::~OfflineAudioCompletionEvent()
 {
 }
 
 JSObject*
 OfflineAudioCompletionEvent::WrapObject(JSContext* aCx)
--- a/content/media/webaudio/PeriodicWave.cpp
+++ b/content/media/webaudio/PeriodicWave.cpp
@@ -19,17 +19,16 @@ NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(P
 PeriodicWave::PeriodicWave(AudioContext* aContext,
                            const float* aRealData,
                            const float* aImagData,
                            const uint32_t aLength,
                            ErrorResult& aRv)
   : mContext(aContext)
 {
   MOZ_ASSERT(aContext);
-  SetIsDOMBinding();
 
   // Caller should have checked this and thrown.
   MOZ_ASSERT(aLength > 0);
   MOZ_ASSERT(aLength <= 4096);
   mLength = aLength;
 
   // Copy coefficient data. The two arrays share an allocation.
   mCoefficients = new ThreadSharedFloatArrayBufferList(2);
--- a/content/media/webspeech/recognition/SpeechGrammar.cpp
+++ b/content/media/webspeech/recognition/SpeechGrammar.cpp
@@ -18,17 +18,16 @@ NS_IMPL_CYCLE_COLLECTING_RELEASE(SpeechG
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(SpeechGrammar)
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 SpeechGrammar::SpeechGrammar(nsISupports* aParent)
   : mParent(aParent)
 {
-  SetIsDOMBinding();
 }
 
 SpeechGrammar::~SpeechGrammar()
 {
 }
 
 already_AddRefed<SpeechGrammar>
 SpeechGrammar::Constructor(const GlobalObject& aGlobal,
--- a/content/media/webspeech/recognition/SpeechGrammarList.cpp
+++ b/content/media/webspeech/recognition/SpeechGrammarList.cpp
@@ -22,17 +22,16 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 SpeechGrammarList::SpeechGrammarList(nsISupports* aParent, nsISpeechRecognitionService* aRecognitionService)
   : mParent(aParent)
 {
   this->mRecognitionService = aRecognitionService;
-  SetIsDOMBinding();
 }
 
 SpeechGrammarList::~SpeechGrammarList()
 {
 }
 
 already_AddRefed<SpeechGrammarList>
 SpeechGrammarList::Constructor(const GlobalObject& aGlobal,
--- a/content/media/webspeech/recognition/SpeechRecognitionAlternative.cpp
+++ b/content/media/webspeech/recognition/SpeechRecognitionAlternative.cpp
@@ -21,17 +21,16 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 SpeechRecognitionAlternative::SpeechRecognitionAlternative(SpeechRecognition* aParent)
   : mTranscript(NS_LITERAL_STRING(""))
   , mConfidence(0)
   , mParent(aParent)
 {
-  SetIsDOMBinding();
 }
 
 SpeechRecognitionAlternative::~SpeechRecognitionAlternative()
 {
 }
 
 JSObject*
 SpeechRecognitionAlternative::WrapObject(JSContext* aCx)
--- a/content/media/webspeech/recognition/SpeechRecognitionResult.cpp
+++ b/content/media/webspeech/recognition/SpeechRecognitionResult.cpp
@@ -18,17 +18,16 @@ NS_IMPL_CYCLE_COLLECTING_RELEASE(SpeechR
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(SpeechRecognitionResult)
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 SpeechRecognitionResult::SpeechRecognitionResult(SpeechRecognition* aParent)
   : mParent(aParent)
 {
-  SetIsDOMBinding();
 }
 
 SpeechRecognitionResult::~SpeechRecognitionResult()
 {
 }
 
 JSObject*
 SpeechRecognitionResult::WrapObject(JSContext* aCx)
--- a/content/media/webspeech/recognition/SpeechRecognitionResultList.cpp
+++ b/content/media/webspeech/recognition/SpeechRecognitionResultList.cpp
@@ -19,17 +19,16 @@ NS_IMPL_CYCLE_COLLECTING_RELEASE(SpeechR
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(SpeechRecognitionResultList)
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 SpeechRecognitionResultList::SpeechRecognitionResultList(SpeechRecognition* aParent)
   : mParent(aParent)
 {
-  SetIsDOMBinding();
 }
 
 SpeechRecognitionResultList::~SpeechRecognitionResultList()
 {
 }
 
 nsISupports*
 SpeechRecognitionResultList::GetParentObject() const
--- a/content/media/webspeech/synth/SpeechSynthesis.cpp
+++ b/content/media/webspeech/synth/SpeechSynthesis.cpp
@@ -72,17 +72,16 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
 NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(SpeechSynthesis)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(SpeechSynthesis)
 
 SpeechSynthesis::SpeechSynthesis(nsPIDOMWindow* aParent)
   : mParent(aParent)
 {
-  SetIsDOMBinding();
 }
 
 SpeechSynthesis::~SpeechSynthesis()
 {
 }
 
 JSObject*
 SpeechSynthesis::WrapObject(JSContext* aCx)
--- a/content/media/webspeech/synth/SpeechSynthesisUtterance.cpp
+++ b/content/media/webspeech/synth/SpeechSynthesisUtterance.cpp
@@ -30,17 +30,16 @@ SpeechSynthesisUtterance::SpeechSynthesi
   : DOMEventTargetHelper(aOwnerWindow)
   , mText(text)
   , mVolume(1)
   , mRate(1)
   , mPitch(1)
   , mState(STATE_NONE)
   , mPaused(false)
 {
-  SetIsDOMBinding();
 }
 
 SpeechSynthesisUtterance::~SpeechSynthesisUtterance() {}
 
 JSObject*
 SpeechSynthesisUtterance::WrapObject(JSContext* aCx)
 {
   return SpeechSynthesisUtteranceBinding::Wrap(aCx, this);
--- a/content/media/webspeech/synth/SpeechSynthesisVoice.cpp
+++ b/content/media/webspeech/synth/SpeechSynthesisVoice.cpp
@@ -19,17 +19,16 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 SpeechSynthesisVoice::SpeechSynthesisVoice(nsISupports* aParent,
                                            const nsAString& aUri)
   : mParent(aParent)
   , mUri(aUri)
 {
-  SetIsDOMBinding();
 }
 
 SpeechSynthesisVoice::~SpeechSynthesisVoice()
 {
 }
 
 JSObject*
 SpeechSynthesisVoice::WrapObject(JSContext* aCx)
--- a/content/svg/content/src/DOMSVGAnimatedLengthList.h
+++ b/content/svg/content/src/DOMSVGAnimatedLengthList.h
@@ -172,17 +172,16 @@ private:
    */
   DOMSVGAnimatedLengthList(nsSVGElement *aElement, uint8_t aAttrEnum, uint8_t aAxis)
     : mBaseVal(nullptr)
     , mAnimVal(nullptr)
     , mElement(aElement)
     , mAttrEnum(aAttrEnum)
     , mAxis(aAxis)
   {
-    SetIsDOMBinding();
   }
 
   ~DOMSVGAnimatedLengthList();
 
   /// Get a reference to this DOM wrapper object's internal counterpart.
   SVGAnimatedLengthList& InternalAList();
   const SVGAnimatedLengthList& InternalAList() const;
 
--- a/content/svg/content/src/DOMSVGAnimatedNumberList.h
+++ b/content/svg/content/src/DOMSVGAnimatedNumberList.h
@@ -102,17 +102,16 @@ private:
    * type.
    */
   DOMSVGAnimatedNumberList(nsSVGElement *aElement, uint8_t aAttrEnum)
     : mBaseVal(nullptr)
     , mAnimVal(nullptr)
     , mElement(aElement)
     , mAttrEnum(aAttrEnum)
   {
-    SetIsDOMBinding();
   }
 
   ~DOMSVGAnimatedNumberList();
 
   /// Get a reference to this DOM wrapper object's internal counterpart.
   SVGAnimatedNumberList& InternalAList();
   const SVGAnimatedNumberList& InternalAList() const;
 
--- a/content/svg/content/src/DOMSVGLength.cpp
+++ b/content/svg/content/src/DOMSVGLength.cpp
@@ -107,44 +107,40 @@ DOMSVGLength::DOMSVGLength(DOMSVGLengthL
   , mVal(nullptr)
 {
   // These shifts are in sync with the members in the header.
   NS_ABORT_IF_FALSE(aList &&
                     aAttrEnum < (1 << 4) &&
                     aListIndex <= MaxListIndex(), "bad arg");
 
   NS_ABORT_IF_FALSE(IndexIsValid(), "Bad index for DOMSVGNumber!");
-
-  SetIsDOMBinding();
 }
 
 DOMSVGLength::DOMSVGLength()
   : mList(nullptr)
   , mListIndex(0)
   , mAttrEnum(0)
   , mIsAnimValItem(false)
   , mUnit(nsIDOMSVGLength::SVG_LENGTHTYPE_NUMBER)
   , mValue(0.0f)
   , mVal(nullptr)
 {
-  SetIsDOMBinding();
 }
 
 DOMSVGLength::DOMSVGLength(nsSVGLength2* aVal, nsSVGElement* aSVGElement,
                            bool aAnimVal)
   : mList(nullptr)
   , mListIndex(0)
   , mAttrEnum(0)
   , mIsAnimValItem(aAnimVal)
   , mUnit(nsIDOMSVGLength::SVG_LENGTHTYPE_NUMBER)
   , mValue(0.0f)
   , mVal(aVal)
   , mSVGElement(aSVGElement)
 {
-  SetIsDOMBinding();
 }
 
 DOMSVGLength::~DOMSVGLength()
 {
   // Our mList's weak ref to us must be nulled out when we die. If GC has
   // unlinked us using the cycle collector code, then that has already
   // happened, and mList is null.
   if (mList) {
--- a/content/svg/content/src/DOMSVGLengthList.h
+++ b/content/svg/content/src/DOMSVGLengthList.h
@@ -56,18 +56,16 @@ class DOMSVGLengthList MOZ_FINAL : publi
 public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(DOMSVGLengthList)
 
   DOMSVGLengthList(DOMSVGAnimatedLengthList *aAList,
                    const SVGLengthList &aInternalList)
     : mAList(aAList)
   {
-    SetIsDOMBinding();
-
     // aInternalList must be passed in explicitly because we can't use
     // InternalList() here. (Because it depends on IsAnimValList, which depends
     // on this object having been assigned to aAList's mBaseVal or mAnimVal,
     // which hasn't happend yet.)
     
     InternalListLengthWillChange(aInternalList.Length()); // Sync mItems
   }
 
--- a/content/svg/content/src/DOMSVGNumber.cpp
+++ b/content/svg/content/src/DOMSVGNumber.cpp
@@ -93,29 +93,26 @@ DOMSVGNumber::DOMSVGNumber(DOMSVGNumberL
   , mValue(0.0f)
 {
   // These shifts are in sync with the members in the header.
   NS_ABORT_IF_FALSE(aList &&
                     aAttrEnum < (1 << 4) &&
                     aListIndex <= MaxListIndex(), "bad arg");
 
   NS_ABORT_IF_FALSE(IndexIsValid(), "Bad index for DOMSVGNumber!");
-
-  SetIsDOMBinding();
 }
 
 DOMSVGNumber::DOMSVGNumber(nsISupports* aParent)
   : mList(nullptr)
   , mParent(aParent)
   , mListIndex(0)
   , mAttrEnum(0)
   , mIsAnimValItem(false)
   , mValue(0.0f)
 {
-  SetIsDOMBinding();
 }
 
 /* static */ already_AddRefed<DOMSVGNumber>
 DOMSVGNumber::Constructor(const dom::GlobalObject& aGlobal, ErrorResult& aRv)
 {
   nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(aGlobal.GetAsSupports());
   if (!window) {
     aRv.Throw(NS_ERROR_UNEXPECTED);
--- a/content/svg/content/src/DOMSVGNumberList.h
+++ b/content/svg/content/src/DOMSVGNumberList.h
@@ -56,18 +56,16 @@ class DOMSVGNumberList MOZ_FINAL : publi
 public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(DOMSVGNumberList)
 
   DOMSVGNumberList(DOMSVGAnimatedNumberList *aAList,
                    const SVGNumberList &aInternalList)
     : mAList(aAList)
   {
-    SetIsDOMBinding();
-
     // aInternalList must be passed in explicitly because we can't use
     // InternalList() here. (Because it depends on IsAnimValList, which depends
     // on this object having been assigned to aAList's mBaseVal or mAnimVal,
     // which hasn't happend yet.)
 
     InternalListLengthWillChange(aInternalList.Length()); // Sync mItems
   }
 
--- a/content/svg/content/src/DOMSVGPathSeg.cpp
+++ b/content/svg/content/src/DOMSVGPathSeg.cpp
@@ -74,30 +74,28 @@ private:
 
 DOMSVGPathSeg::DOMSVGPathSeg(DOMSVGPathSegList *aList,
                              uint32_t aListIndex,
                              bool aIsAnimValItem)
   : mList(aList)
   , mListIndex(aListIndex)
   , mIsAnimValItem(aIsAnimValItem)
 {
-  SetIsDOMBinding();
   // These shifts are in sync with the members in the header.
   NS_ABORT_IF_FALSE(aList &&
                     aListIndex <= MaxListIndex(), "bad arg");
 
   NS_ABORT_IF_FALSE(IndexIsValid(), "Bad index for DOMSVGPathSeg!");
 }
 
 DOMSVGPathSeg::DOMSVGPathSeg()
   : mList(nullptr)
   , mListIndex(0)
   , mIsAnimValItem(false)
 {
-  SetIsDOMBinding();
 }
 
 void
 DOMSVGPathSeg::InsertingIntoList(DOMSVGPathSegList *aList,
                                  uint32_t aListIndex,
                                  bool aIsAnimValItem)
 {
   NS_ABORT_IF_FALSE(!HasOwner(), "Inserting item that is already in a list");
--- a/content/svg/content/src/DOMSVGPathSegList.h
+++ b/content/svg/content/src/DOMSVGPathSegList.h
@@ -165,18 +165,16 @@ private:
   /**
    * Only our static GetDOMWrapper() factory method may create objects of our
    * type.
    */
   DOMSVGPathSegList(nsSVGElement *aElement, bool aIsAnimValList)
     : mElement(aElement)
     , mIsAnimValList(aIsAnimValList)
   {
-    SetIsDOMBinding();
-
     InternalListWillChangeTo(InternalList()); // Sync mItems
   }
 
   ~DOMSVGPathSegList();
 
   nsSVGElement* Element() const {
     return mElement.get();
   }
--- a/content/svg/content/src/DOMSVGPointList.h
+++ b/content/svg/content/src/DOMSVGPointList.h
@@ -167,18 +167,16 @@ private:
   /**
    * Only our static GetDOMWrapper() factory method may create objects of our
    * type.
    */
   DOMSVGPointList(nsSVGElement *aElement, bool aIsAnimValList)
     : mElement(aElement)
     , mIsAnimValList(aIsAnimValList)
   {
-    SetIsDOMBinding();
-
     InternalListWillChangeTo(InternalList()); // Sync mItems
   }
 
   ~DOMSVGPointList();
 
   nsSVGElement* Element() const {
     return mElement.get();
   }
--- a/content/svg/content/src/DOMSVGStringList.h
+++ b/content/svg/content/src/DOMSVGStringList.h
@@ -95,17 +95,16 @@ private:
    * type.
    */
   DOMSVGStringList(nsSVGElement *aElement,
                    bool aIsConditionalProcessingAttribute, uint8_t aAttrEnum)
     : mElement(aElement)
     , mAttrEnum(aAttrEnum)
     , mIsConditionalProcessingAttribute(aIsConditionalProcessingAttribute)
   {
-    SetIsDOMBinding();
   }
 
   ~DOMSVGStringList();
 
   SVGStringList &InternalList() const;
 
   // Strong ref to our element to keep it alive.
   nsRefPtr<nsSVGElement> mElement;
--- a/content/svg/content/src/DOMSVGTransformList.h
+++ b/content/svg/content/src/DOMSVGTransformList.h
@@ -51,18 +51,16 @@ class DOMSVGTransformList MOZ_FINAL : pu
 public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(DOMSVGTransformList)
 
   DOMSVGTransformList(dom::SVGAnimatedTransformList *aAList,
                       const SVGTransformList &aInternalList)
     : mAList(aAList)
   {
-    SetIsDOMBinding();
-
     // aInternalList must be passed in explicitly because we can't use
     // InternalList() here. (Because it depends on IsAnimValList, which depends
     // on this object having been assigned to aAList's mBaseVal or mAnimVal,
     // which hasn't happend yet.)
 
     InternalListLengthWillChange(aInternalList.Length()); // Sync mItems
   }
 
--- a/content/svg/content/src/SVGAngle.h
+++ b/content/svg/content/src/SVGAngle.h
@@ -25,17 +25,16 @@ public:
   } AngleType;
 
   NS_INLINE_DECL_CYCLE_COLLECTING_NATIVE_REFCOUNTING(SVGAngle)
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_NATIVE_CLASS(SVGAngle)
 
   SVGAngle(nsSVGAngle* aVal, nsSVGElement *aSVGElement, AngleType aType)
     : mVal(aVal), mSVGElement(aSVGElement), mType(aType)
   {
-    SetIsDOMBinding();
   }
 
   // WebIDL
   nsSVGElement* GetParentObject() { return mSVGElement; }
   virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
   uint16_t UnitType() const;
   float Value() const;
   void GetValueAsString(nsAString& aValue);
--- a/content/svg/content/src/SVGAnimatedAngle.h
+++ b/content/svg/content/src/SVGAnimatedAngle.h
@@ -21,17 +21,16 @@ class SVGAnimatedAngle MOZ_FINAL : publi
 {
 public:
   NS_INLINE_DECL_CYCLE_COLLECTING_NATIVE_REFCOUNTING(SVGAnimatedAngle)
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_NATIVE_CLASS(SVGAnimatedAngle)
 
   SVGAnimatedAngle(nsSVGAngle* aVal, nsSVGElement *aSVGElement)
     : mVal(aVal), mSVGElement(aSVGElement)
   {
-    SetIsDOMBinding();
   }
 
   // WebIDL
   nsSVGElement* GetParentObject() { return mSVGElement; }
   virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
   already_AddRefed<SVGAngle> BaseVal();
   already_AddRefed<SVGAngle> AnimVal();
 
--- a/content/svg/content/src/SVGAnimatedBoolean.h
+++ b/content/svg/content/src/SVGAnimatedBoolean.h
@@ -17,17 +17,16 @@ namespace dom {
 class SVGAnimatedBoolean MOZ_FINAL : public nsWrapperCache
 {
   NS_INLINE_DECL_CYCLE_COLLECTING_NATIVE_REFCOUNTING(SVGAnimatedBoolean)
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_NATIVE_CLASS(SVGAnimatedBoolean)
 
   SVGAnimatedBoolean(nsSVGBoolean* aVal, nsSVGElement *aSVGElement)
     : mVal(aVal), mSVGElement(aSVGElement)
   {
-    SetIsDOMBinding();
   }
 
   // WebIDL
   nsSVGElement* GetParentObject() const { return mSVGElement; }
   virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
   bool BaseVal() const { return mVal->GetBaseValue(); }
   void SetBaseVal(bool aValue) { mVal->SetBaseValue(aValue, mSVGElement); }
   bool AnimVal() const { mSVGElement->FlushAnimations(); return mVal->GetAnimValue(); }
--- a/content/svg/content/src/SVGAnimatedEnumeration.h
+++ b/content/svg/content/src/SVGAnimatedEnumeration.h
@@ -32,17 +32,16 @@ public:
   virtual uint16_t BaseVal() = 0;
   virtual void SetBaseVal(uint16_t aBaseVal, ErrorResult& aRv) = 0;
   virtual uint16_t AnimVal() = 0;
 
 protected:
   explicit SVGAnimatedEnumeration(nsSVGElement* aSVGElement)
     : mSVGElement(aSVGElement)
   {
-    SetIsDOMBinding();
   }
   virtual ~SVGAnimatedEnumeration() {};
 
   nsRefPtr<nsSVGElement> mSVGElement;
 };
 
 } // namespace dom
 } // namespace mozilla
--- a/content/svg/content/src/SVGAnimatedInteger.h
+++ b/content/svg/content/src/SVGAnimatedInteger.h
@@ -32,17 +32,16 @@ public:
   virtual int32_t BaseVal() = 0;
   virtual void SetBaseVal(int32_t aBaseVal) = 0;
   virtual int32_t AnimVal() = 0;
 
 protected:
   explicit SVGAnimatedInteger(nsSVGElement* aSVGElement)
     : mSVGElement(aSVGElement)
   {
-    SetIsDOMBinding();
   }
   virtual ~SVGAnimatedInteger() {};
 
   nsRefPtr<nsSVGElement> mSVGElement;
 };
 
 } // namespace dom
 } // namespace mozilla
--- a/content/svg/content/src/SVGAnimatedLength.h
+++ b/content/svg/content/src/SVGAnimatedLength.h
@@ -20,17 +20,18 @@ namespace dom {
 class SVGAnimatedLength MOZ_FINAL : public nsWrapperCache
 {
 public:
   NS_INLINE_DECL_CYCLE_COLLECTING_NATIVE_REFCOUNTING(SVGAnimatedLength)
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_NATIVE_CLASS(SVGAnimatedLength)
 
   SVGAnimatedLength(nsSVGLength2* aVal, nsSVGElement *aSVGElement)
     : mVal(aVal), mSVGElement(aSVGElement)
-  { SetIsDOMBinding(); }
+  {
+  }
 
   // WebIDL
   nsSVGElement* GetParentObject() { return mSVGElement; }
   virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
   already_AddRefed<DOMSVGLength> BaseVal();
   already_AddRefed<DOMSVGLength> AnimVal();
 
 protected:
--- a/content/svg/content/src/SVGAnimatedNumber.h
+++ b/content/svg/content/src/SVGAnimatedNumber.h
@@ -33,17 +33,16 @@ public:
   virtual float BaseVal() = 0;
   virtual void SetBaseVal(float aBaseVal) = 0;
   virtual float AnimVal() = 0;
 
 protected:
   explicit SVGAnimatedNumber(nsSVGElement* aSVGElement)
     : mSVGElement(aSVGElement)
   {
-    SetIsDOMBinding();
   }
   virtual ~SVGAnimatedNumber() {};
 
   nsRefPtr<nsSVGElement> mSVGElement;
 };
 
 } // namespace dom
 } // namespace mozilla
--- a/content/svg/content/src/SVGAnimatedPreserveAspectRatio.h
+++ b/content/svg/content/src/SVGAnimatedPreserveAspectRatio.h
@@ -119,17 +119,16 @@ class DOMSVGAnimatedPreserveAspectRatio 
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(DOMSVGAnimatedPreserveAspectRatio)
 
   DOMSVGAnimatedPreserveAspectRatio(SVGAnimatedPreserveAspectRatio* aVal,
                                     nsSVGElement *aSVGElement)
     : mVal(aVal), mSVGElement(aSVGElement)
   {
-    SetIsDOMBinding();
   }
 
   // WebIDL
   nsSVGElement* GetParentObject() const { return mSVGElement; }
   virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
 
   // These aren't weak refs because new objects are returned each time
   already_AddRefed<DOMSVGPreserveAspectRatio> BaseVal();
--- a/content/svg/content/src/SVGAnimatedRect.cpp
+++ b/content/svg/content/src/SVGAnimatedRect.cpp
@@ -16,17 +16,16 @@ NS_SVG_VAL_IMPL_CYCLE_COLLECTION_WRAPPER
 
 NS_IMPL_CYCLE_COLLECTION_ROOT_NATIVE(SVGAnimatedRect, AddRef)
 NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(SVGAnimatedRect, Release)
 
 SVGAnimatedRect::SVGAnimatedRect(nsSVGViewBox* aVal, nsSVGElement* aSVGElement)
   : mVal(aVal)
   , mSVGElement(aSVGElement)
 {
-  SetIsDOMBinding();
 }
 
 SVGAnimatedRect::~SVGAnimatedRect()
 {
   nsSVGViewBox::sSVGAnimatedRectTearoffTable.RemoveTearoff(mVal);
 }
 
 already_AddRefed<SVGIRect>
--- a/content/svg/content/src/SVGAnimatedString.h
+++ b/content/svg/content/src/SVGAnimatedString.h
@@ -13,17 +13,16 @@ namespace dom {
 
 class SVGAnimatedString : public nsISupports,
                           public nsWrapperCache
 {
 public:
   explicit SVGAnimatedString(nsSVGElement* aSVGElement)
     : mSVGElement(aSVGElement)
   {
-    SetIsDOMBinding();
   }
 
   virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
 
   // WebIDL
   nsSVGElement* GetParentObject() const
   {
     return mSVGElement;
--- a/content/svg/content/src/SVGAnimatedTransformList.h
+++ b/content/svg/content/src/SVGAnimatedTransformList.h
@@ -101,17 +101,16 @@ private:
    * Only our static GetDOMWrapper() factory method may create objects of our
    * type.
    */
   explicit SVGAnimatedTransformList(nsSVGElement *aElement)
     : mBaseVal(nullptr)
     , mAnimVal(nullptr)
     , mElement(aElement)
   {
-    SetIsDOMBinding();
   }
 
   ~SVGAnimatedTransformList();
 
   /// Get a reference to this DOM wrapper object's internal counterpart.
   nsSVGAnimatedTransformList& InternalAList();
   const nsSVGAnimatedTransformList& InternalAList() const;
 
--- a/content/svg/content/src/SVGIRect.h
+++ b/content/svg/content/src/SVGIRect.h
@@ -17,21 +17,16 @@ class nsSVGElement;
 
 namespace mozilla {
 namespace dom {
 
 class SVGIRect : public nsISupports,
                  public nsWrapperCache
 {
 public:
-  SVGIRect()
-  {
-    SetIsDOMBinding();
-  }
-
   virtual ~SVGIRect()
   {
   }
 
   JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE
   {
     return SVGRectBinding::Wrap(aCx, this);
   }
--- a/content/svg/content/src/SVGMatrix.h
+++ b/content/svg/content/src/SVGMatrix.h
@@ -54,31 +54,25 @@ class SVGMatrix MOZ_FINAL : public nsWra
 {
 public:
   NS_INLINE_DECL_CYCLE_COLLECTING_NATIVE_REFCOUNTING(SVGMatrix)
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_NATIVE_CLASS(SVGMatrix)
 
   /**
    * Ctor for SVGMatrix objects that belong to a SVGTransform.
    */
-  explicit SVGMatrix(SVGTransform& aTransform) : mTransform(&aTransform) {
-    SetIsDOMBinding();
-  }
+  explicit SVGMatrix(SVGTransform& aTransform) : mTransform(&aTransform) {}
 
   /**
    * Ctors for SVGMatrix objects created independently of a SVGTransform.
    */
   // Default ctor for gfxMatrix will produce identity mx
-  SVGMatrix() {
-    SetIsDOMBinding();
-  }
+  SVGMatrix() {}
 
-  explicit SVGMatrix(const gfxMatrix &aMatrix) : mMatrix(aMatrix) {
-    SetIsDOMBinding();
-  }
+  explicit SVGMatrix(const gfxMatrix &aMatrix) : mMatrix(aMatrix) {}
 
   const gfxMatrix& GetMatrix() const {
     return mTransform ? mTransform->Matrixgfx() : mMatrix;
   }
 
   // WebIDL
   SVGTransform* GetParentObject() const;
   virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
--- a/content/svg/content/src/SVGPreserveAspectRatio.h
+++ b/content/svg/content/src/SVGPreserveAspectRatio.h
@@ -120,17 +120,16 @@ public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(DOMSVGPreserveAspectRatio)
 
   DOMSVGPreserveAspectRatio(SVGAnimatedPreserveAspectRatio* aVal,
                             nsSVGElement *aSVGElement,
                             bool aIsBaseValue)
     : mVal(aVal), mSVGElement(aSVGElement), mIsBaseValue(aIsBaseValue)
   {
-    SetIsDOMBinding();
   }
 
   // WebIDL
   nsSVGElement* GetParentObject() const { return mSVGElement; }
   virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
 
   uint16_t Align();
   void SetAlign(uint16_t aAlign, ErrorResult& rv);
--- a/content/svg/content/src/SVGTransform.cpp
+++ b/content/svg/content/src/SVGTransform.cpp
@@ -107,51 +107,47 @@ private:
 SVGTransform::SVGTransform(DOMSVGTransformList *aList,
                            uint32_t aListIndex,
                            bool aIsAnimValItem)
   : mList(aList)
   , mListIndex(aListIndex)
   , mIsAnimValItem(aIsAnimValItem)
   , mTransform(nullptr)
 {
-  SetIsDOMBinding();
   // These shifts are in sync with the members in the header.
   NS_ABORT_IF_FALSE(aList &&
                     aListIndex <= MaxListIndex(), "bad arg");
 
   NS_ABORT_IF_FALSE(IndexIsValid(), "Bad index for DOMSVGNumber!");
 }
 
 SVGTransform::SVGTransform()
   : mList(nullptr)
   , mListIndex(0)
   , mIsAnimValItem(false)
   , mTransform(new nsSVGTransform()) // Default ctor for objects not in a list
                                      // initialises to matrix type with identity
                                      // matrix
 {
-  SetIsDOMBinding();
 }
 
 SVGTransform::SVGTransform(const gfxMatrix &aMatrix)
   : mList(nullptr)
   , mListIndex(0)
   , mIsAnimValItem(false)
   , mTransform(new nsSVGTransform(aMatrix))
 {
-  SetIsDOMBinding();
 }
 
 SVGTransform::SVGTransform(const nsSVGTransform &aTransform)
   : mList(nullptr)
   , mListIndex(0)
   , mIsAnimValItem(false)
   , mTransform(new nsSVGTransform(aTransform))
 {
-  SetIsDOMBinding();
 }
 
 SVGTransform::~SVGTransform()
 {
   SVGMatrix* matrix = SVGMatrixTearoffTable().GetTearoff(this);
   if (matrix) {
     SVGMatrixTearoffTable().RemoveTearoff(this);
     NS_RELEASE(matrix);
--- a/content/svg/content/src/nsISVGPoint.h
+++ b/content/svg/content/src/nsISVGPoint.h
@@ -45,27 +45,25 @@ public:
    */
   explicit nsISVGPoint()
     : mList(nullptr)
     , mListIndex(0)
     , mIsReadonly(false)
     , mIsAnimValItem(false)
     , mIsTranslatePoint(false)
   {
-    SetIsDOMBinding();
   }
 
   explicit nsISVGPoint(SVGPoint* aPt, bool aIsTranslatePoint)
     : mList(nullptr)
     , mListIndex(0)
     , mIsReadonly(false)
     , mIsAnimValItem(false)
     , mIsTranslatePoint(aIsTranslatePoint)
   {
-    SetIsDOMBinding();
     mPt.mX = aPt->GetX();
     mPt.mY = aPt->GetY();
   }
 
 protected:
   virtual ~nsISVGPoint()
   {
     // Our mList's weak ref to us must be nulled out when we die. If GC has
--- a/dom/activities/Activity.cpp
+++ b/dom/activities/Activity.cpp
@@ -80,11 +80,10 @@ Activity::~Activity()
   if (mProxy) {
     mProxy->Cleanup();
   }
 }
 
 Activity::Activity(nsPIDOMWindow* aWindow)
   : DOMRequest(aWindow)
 {
-  MOZ_ASSERT(IsDOMBinding());
 }
 
--- a/dom/animation/Animation.h
+++ b/dom/animation/Animation.h
@@ -138,17 +138,16 @@ public:
     , mTarget(aTarget)
     , mTiming(aTiming)
     , mName(aName)
     , mIsFinishedTransition(false)
     , mLastNotification(LAST_NOTIFICATION_NONE)
     , mPseudoType(aPseudoType)
   {
     MOZ_ASSERT(aTarget, "null animation target is not yet supported");
-    SetIsDOMBinding();
   }
 
   NS_INLINE_DECL_CYCLE_COLLECTING_NATIVE_REFCOUNTING(Animation)
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_NATIVE_CLASS(Animation)
 
   nsIDocument* GetParentObject() const { return mDocument; }
   virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
 
--- a/dom/animation/AnimationEffect.h
+++ b/dom/animation/AnimationEffect.h
@@ -16,17 +16,16 @@ namespace mozilla {
 namespace dom {
 
 class AnimationEffect MOZ_FINAL : public nsWrapperCache
 {
 public:
   explicit AnimationEffect(Animation* aAnimation)
     : mAnimation(aAnimation)
   {
-    SetIsDOMBinding();
   }
 
   NS_INLINE_DECL_CYCLE_COLLECTING_NATIVE_REFCOUNTING(AnimationEffect)
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_NATIVE_CLASS(AnimationEffect)
 
   Animation* GetParentObject() const { return mAnimation; }
   virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
 
--- a/dom/animation/AnimationPlayer.h
+++ b/dom/animation/AnimationPlayer.h
@@ -31,17 +31,16 @@ protected:
   virtual ~AnimationPlayer() { }
 
 public:
   explicit AnimationPlayer(AnimationTimeline* aTimeline)
     : mPlayState(NS_STYLE_ANIMATION_PLAY_STATE_RUNNING)
     , mIsRunningOnCompositor(false)
     , mTimeline(aTimeline)
   {
-    SetIsDOMBinding();
   }
 
   NS_INLINE_DECL_CYCLE_COLLECTING_NATIVE_REFCOUNTING(AnimationPlayer)
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_NATIVE_CLASS(AnimationPlayer)
 
   AnimationTimeline* GetParentObject() const { return mTimeline; }
   virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
 
--- a/dom/animation/AnimationTimeline.h
+++ b/dom/animation/AnimationTimeline.h
@@ -19,17 +19,16 @@ namespace mozilla {
 namespace dom {
 
 class AnimationTimeline MOZ_FINAL : public nsWrapperCache
 {
 public:
   explicit AnimationTimeline(nsIDocument* aDocument)
     : mDocument(aDocument)
   {
-    SetIsDOMBinding();
   }
 
   NS_INLINE_DECL_CYCLE_COLLECTING_NATIVE_REFCOUNTING(AnimationTimeline)
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_NATIVE_CLASS(AnimationTimeline)
 
   nsISupports* GetParentObject() const { return mDocument; }
   virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
 
--- a/dom/archivereader/ArchiveReader.cpp
+++ b/dom/archivereader/ArchiveReader.cpp
@@ -51,18 +51,16 @@ ArchiveReader::ArchiveReader(nsIDOMBlob*
                              const nsACString& aEncoding)
   : mBlob(aBlob)
   , mWindow(aWindow)
   , mStatus(NOT_STARTED)
   , mEncoding(aEncoding)
 {
   MOZ_ASSERT(aBlob);
   MOZ_ASSERT(aWindow);
-
-  SetIsDOMBinding();
 }
 
 ArchiveReader::~ArchiveReader()
 {
 }
 
 /* virtual */ JSObject*
 ArchiveReader::WrapObject(JSContext* aCx)
--- a/dom/base/BarProps.cpp
+++ b/dom/base/BarProps.cpp
@@ -16,17 +16,16 @@ namespace dom {
 
 //
 //  Basic (virtual) BarProp class implementation
 //
 BarProp::BarProp(nsGlobalWindow* aWindow)
   : mDOMWindow(aWindow)
 {
   MOZ_ASSERT(aWindow->IsInnerWindow());
-  SetIsDOMBinding();
 }
 
 BarProp::~BarProp()
 {
 }
 
 nsPIDOMWindow*
 BarProp::GetParentObject() const
--- a/dom/base/CompositionStringSynthesizer.cpp
+++ b/dom/base/CompositionStringSynthesizer.cpp
@@ -130,28 +130,28 @@ CompositionStringSynthesizer::DispatchEv
     if (mCaret.mEndOffset > mString.Length()) {
       NS_WARNING("Caret position is out of the composition string");
       ClearInternal();
       return NS_ERROR_ILLEGAL_VALUE;
     }
     mClauses->AppendElement(mCaret);
   }
 
-  WidgetTextEvent textEvent(true, NS_TEXT_TEXT, widget);
-  textEvent.time = PR_IntervalNow();
-  textEvent.theText = mString;
+  WidgetCompositionEvent compChangeEvent(true, NS_COMPOSITION_CHANGE, widget);
+  compChangeEvent.time = PR_IntervalNow();
+  compChangeEvent.mData = mString;
   if (!mClauses->IsEmpty()) {
-    textEvent.mRanges = mClauses;
+    compChangeEvent.mRanges = mClauses;
   }
 
   // XXX How should we set false for this on b2g?
-  textEvent.mFlags.mIsSynthesizedForTests = true;
+  compChangeEvent.mFlags.mIsSynthesizedForTests = true;
 
   nsEventStatus status = nsEventStatus_eIgnore;
-  nsresult rv = widget->DispatchEvent(&textEvent, status);
+  nsresult rv = widget->DispatchEvent(&compChangeEvent, status);
   *aDefaultPrevented = (status == nsEventStatus_eConsumeNoDefault);
 
   ClearInternal();
 
   NS_ENSURE_SUCCESS(rv, rv);
 
   return NS_OK;
 }
--- a/dom/base/Console.cpp
+++ b/dom/base/Console.cpp
@@ -555,17 +555,16 @@ Console::Console(nsPIDOMWindow* aWindow)
 
   if (NS_IsMainThread()) {
     nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService();
     if (obs) {
       obs->AddObserver(this, "inner-window-destroyed", false);
     }
   }
 
-  SetIsDOMBinding();
   mozilla::HoldJSObjects(this);
 }
 
 Console::~Console()
 {
   mozilla::DropJSObjects(this);
 }
 
--- a/dom/base/Crypto.cpp
+++ b/dom/base/Crypto.cpp
@@ -27,17 +27,16 @@ NS_INTERFACE_MAP_END
 NS_IMPL_CYCLE_COLLECTING_ADDREF(Crypto)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(Crypto)
 
 NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(Crypto, mWindow, mSubtle)
 
 Crypto::Crypto()
 {
   MOZ_COUNT_CTOR(Crypto);
-  SetIsDOMBinding();
 }
 
 Crypto::~Crypto()
 {
   MOZ_COUNT_DTOR(Crypto);
 }
 
 void
--- a/dom/base/DOMError.cpp
+++ b/dom/base/DOMError.cpp
@@ -19,45 +19,40 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRY(DOMError)
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 DOMError::DOMError(nsPIDOMWindow* aWindow)
   : mWindow(aWindow)
 {
-  SetIsDOMBinding();
 }
 
 DOMError::DOMError(nsPIDOMWindow* aWindow, nsresult aValue)
   : mWindow(aWindow)
 {
   nsCString name, message;
   NS_GetNameAndMessageForDOMNSResult(aValue, name, message);
 
   CopyUTF8toUTF16(name, mName);
   CopyUTF8toUTF16(message, mMessage);
-
-  SetIsDOMBinding();
 }
 
 DOMError::DOMError(nsPIDOMWindow* aWindow, const nsAString& aName)
   : mWindow(aWindow)
   , mName(aName)
 {
-  SetIsDOMBinding();
 }
 
 DOMError::DOMError(nsPIDOMWindow* aWindow, const nsAString& aName,
                    const nsAString& aMessage)
   : mWindow(aWindow)
   , mName(aName)
   , mMessage(aMessage)
 {
-  SetIsDOMBinding();
 }
 
 DOMError::~DOMError()
 {
 }
 
 JSObject*
 DOMError::WrapObject(JSContext* aCx)
--- a/dom/base/DOMException.cpp
+++ b/dom/base/DOMException.cpp
@@ -195,18 +195,16 @@ Exception::Exception(const nsACString& a
                      const nsACString& aName,
                      nsIStackFrame *aLocation,
                      nsISupports *aData)
 : mResult(NS_OK),
   mLineNumber(0),
   mInitialized(false),
   mHoldingJSVal(false)
 {
-  SetIsDOMBinding();
-
   // A little hack... The nsIGenericModule nsIClassInfo scheme relies on there
   // having been at least one instance made via the factory. Otherwise, the
   // shared factory/classinsance object never gets created and our QI getter
   // for our instance's pointer to our nsIClassInfo will always return null.
   // This is bad because it means that wrapped exceptions will never have a
   // shared prototype. So... We force one to be created via the factory
   // *once* and then go about our business.
   if (!sEverMadeOneFromFactory) {
@@ -595,17 +593,16 @@ NS_INTERFACE_MAP_END_INHERITING(Exceptio
 
 DOMException::DOMException(nsresult aRv, const nsACString& aMessage,
                            const nsACString& aName, uint16_t aCode)
   : Exception(EmptyCString(), aRv, EmptyCString(), nullptr, nullptr),
     mName(aName),
     mMessage(aMessage),
     mCode(aCode)
 {
-  SetIsDOMBinding();
 }
 
 NS_IMETHODIMP
 DOMException::GetCode(uint16_t* aCode)
 {
   NS_ENSURE_ARG_POINTER(aCode);
   *aCode = mCode;
 
--- a/dom/base/MessageChannel.cpp
+++ b/dom/base/MessageChannel.cpp
@@ -62,17 +62,16 @@ MessageChannel::Enabled(JSContext* aCx, 
 
   return isResource;
 }
 
 MessageChannel::MessageChannel(nsPIDOMWindow* aWindow)
   : mWindow(aWindow)
 {
   MOZ_COUNT_CTOR(MessageChannel);
-  SetIsDOMBinding();
 
   mPort1 = new MessagePort(mWindow);
   mPort2 = new MessagePort(mWindow);
 
   mPort1->Entangle(mPort2);
   mPort2->Entangle(mPort1);
 }
 
--- a/dom/base/MessagePort.cpp
+++ b/dom/base/MessagePort.cpp
@@ -309,22 +309,20 @@ PostMessageRunnable::Run()
   bool status;
   mPort->DispatchEvent(static_cast<dom::Event*>(event.get()), &status);
   return status ? NS_OK : NS_ERROR_FAILURE;
 }
 
 MessagePortBase::MessagePortBase(nsPIDOMWindow* aWindow)
   : DOMEventTargetHelper(aWindow)
 {
-  // SetIsDOMBinding() is called by DOMEventTargetHelper's ctor.
 }
 
 MessagePortBase::MessagePortBase()
 {
-  SetIsDOMBinding();
 }
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(MessagePort)
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(MessagePort,
                                                 DOMEventTargetHelper)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mEntangledPort)
 
--- a/dom/base/MessagePortList.h
+++ b/dom/base/MessagePortList.h
@@ -27,17 +27,16 @@ public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(MessagePortList)
 
 public:
   MessagePortList(nsISupports* aOwner, nsTArray<nsRefPtr<MessagePortBase>>& aPorts)
     : mOwner(aOwner)
     , mPorts(aPorts)
   {
-    SetIsDOMBinding();
   }
 
   nsISupports*
   GetParentObject() const
   {
     return mOwner;
   }
 
--- a/dom/base/Navigator.cpp
+++ b/dom/base/Navigator.cpp
@@ -134,17 +134,16 @@ Navigator::Init()
   Preferences::AddUintVarCache(&sMaxVibrateListLen,
                                "dom.vibrator.max_vibrate_list_len", 128);
 }
 
 Navigator::Navigator(nsPIDOMWindow* aWindow)
   : mWindow(aWindow)
 {
   MOZ_ASSERT(aWindow->IsInnerWindow(), "Navigator must get an inner window!");
-  SetIsDOMBinding();
 }
 
 Navigator::~Navigator()
 {
   Invalidate();
 }
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(Navigator)
@@ -580,16 +579,21 @@ Navigator::CookieEnabled()
   }
 
   return cookieEnabled;
 }
 
 bool
 Navigator::OnLine()
 {
+  if (mWindow && mWindow->GetDoc()) {
+    return !NS_IsOffline() &&
+      !NS_IsAppOffline(mWindow->GetDoc()->NodePrincipal());
+  }
+
   return !NS_IsOffline();
 }
 
 NS_IMETHODIMP
 Navigator::GetBuildID(nsAString& aBuildID)
 {
   if (!nsContentUtils::IsCallerChrome()) {
     const nsAdoptingString& override =
@@ -1716,18 +1720,17 @@ Navigator::GetProperties(nsINetworkPrope
 network::Connection*
 Navigator::GetConnection(ErrorResult& aRv)
 {
   if (!mConnection) {
     if (!mWindow) {
       aRv.Throw(NS_ERROR_UNEXPECTED);
       return nullptr;
     }
-    mConnection = new network::Connection();
-    mConnection->Init(mWindow);
+    mConnection = new network::Connection(mWindow);
   }
 
   return mConnection;
 }
 
 #ifdef MOZ_B2G_BT
 bluetooth::BluetoothManager*
 Navigator::GetMozBluetooth(ErrorResult& aRv)
--- a/dom/base/PerformanceEntry.cpp
+++ b/dom/base/PerformanceEntry.cpp
@@ -18,17 +18,16 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 PerformanceEntry::PerformanceEntry(nsPerformance* aPerformance)
 : mPerformance(aPerformance)
 {
   MOZ_ASSERT(aPerformance, "Parent performance object should be provided");
-  SetIsDOMBinding();
 }
 
 PerformanceEntry::~PerformanceEntry()
 {
 }
 
 JSObject*
 PerformanceEntry::WrapObject(JSContext* aCx)
--- a/dom/base/SubtleCrypto.cpp
+++ b/dom/base/SubtleCrypto.cpp
@@ -21,17 +21,16 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 
 
 SubtleCrypto::SubtleCrypto(nsPIDOMWindow* aWindow)
   : mWindow(aWindow)
 {
-  SetIsDOMBinding();
 }
 
 JSObject*
 SubtleCrypto::WrapObject(JSContext* aCx)
 {
   return SubtleCryptoBinding::Wrap(aCx, this);
 }
 
--- a/dom/base/URLSearchParams.cpp
+++ b/dom/base/URLSearchParams.cpp
@@ -16,17 +16,16 @@ NS_IMPL_CYCLE_COLLECTING_RELEASE(URLSear
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(URLSearchParams)
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 URLSearchParams::URLSearchParams()
 {
-  SetIsDOMBinding();
 }
 
 URLSearchParams::~URLSearchParams()
 {
   DeleteAll();
 }
 
 JSObject*
--- a/dom/base/nsDOMWindowUtils.cpp
+++ b/dom/base/nsDOMWindowUtils.cpp
@@ -2113,31 +2113,31 @@ nsDOMWindowUtils::SendCompositionEvent(c
 
   uint32_t msg;
   if (aType.EqualsLiteral("compositionstart")) {
     msg = NS_COMPOSITION_START;
   } else if (aType.EqualsLiteral("compositionend")) {
     msg = NS_COMPOSITION_END;
   } else if (aType.EqualsLiteral("compositionupdate")) {
     // Now we don't support manually dispatching composition update with this
-    // API.  compositionupdate is dispatched when text event modifies
+    // API.  A compositionupdate is dispatched when a DOM text event modifies
     // composition string automatically.  For backward compatibility, this
     // shouldn't return error in this case.
     NS_WARNING("Don't call nsIDOMWindowUtils.sendCompositionEvent() for "
                "compositionupdate since it's ignored and the event is "
                "fired automatically when it's necessary");
     return NS_OK;
   } else {
     return NS_ERROR_FAILURE;
   }
 
   WidgetCompositionEvent compositionEvent(true, msg, widget);
   InitEvent(compositionEvent);
   if (msg != NS_COMPOSITION_START) {
-    compositionEvent.data = aData;
+    compositionEvent.mData = aData;
   }
 
   compositionEvent.mFlags.mIsSynthesizedForTests = true;
 
   nsEventStatus status;
   nsresult rv = widget->DispatchEvent(&compositionEvent, status);
   NS_ENSURE_SUCCESS(rv, rv);
 
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -1090,17 +1090,17 @@ nsGlobalWindow::nsGlobalWindow(nsGlobalW
     mIsFrozen(false),
     mFullScreen(false),
     mIsClosed(false),
     mInClose(false),
     mHavePendingClose(false),
     mHadOriginalOpener(false),
     mIsPopupSpam(false),
     mBlockScriptedClosingFlag(false),
-    mFireOfflineStatusChangeEventOnThaw(false),
+    mWasOffline(false),
     mNotifyIdleObserversIdleOnThaw(false),
     mNotifyIdleObserversActiveOnThaw(false),
     mCreatingInnerWindow(false),
     mIsChrome(false),
     mCleanMessageManager(false),
     mNeedsFocus(true),
     mHasFocus(false),
 #if defined(XP_MACOSX)
@@ -1136,18 +1136,16 @@ nsGlobalWindow::nsGlobalWindow(nsGlobalW
     mDialogAbuseCount(0),
     mAreDialogsEnabled(true)
 {
   nsLayoutStatics::AddRef();
 
   // Initialize the PRCList (this).
   PR_INIT_CLIST(this);
 
-  SetIsDOMBinding();
-
   if (aOuterWindow) {
     // |this| is an inner window, add this inner window to the outer
     // window list of inners.
     PR_INSERT_AFTER(this, aOuterWindow);
 
     mObserver = new nsGlobalWindowObserver(this);
     if (mObserver) {
       NS_ADDREF(mObserver);
@@ -2456,21 +2454,21 @@ nsGlobalWindow::SetNewDocument(nsIDocume
     JS_SetCompartmentPrincipals(compartment,
                                 nsJSPrincipals::get(aDocument->NodePrincipal()));
   } else {
     if (aState) {
       newInnerWindow = wsh->GetInnerWindow();
       newInnerGlobal = newInnerWindow->GetWrapperPreserveColor();
     } else {
       if (thisChrome) {
-        newInnerWindow = new nsGlobalChromeWindow(this);
+        newInnerWindow = nsGlobalChromeWindow::Create(this);
       } else if (mIsModalContentWindow) {
-        newInnerWindow = new nsGlobalModalWindow(this);
+        newInnerWindow = nsGlobalModalWindow::Create(this);
       } else {
-        newInnerWindow = new nsGlobalWindow(this);
+        newInnerWindow = nsGlobalWindow::Create(this);
       }
 
       // Freeze the outer window and null out the inner window so
       // that initializing classes on the new inner doesn't end up
       // reaching into the old inner window for classes etc.
       //
       // [This happens with Object.prototype when XPConnect creates
       // a temporary global while initializing classes; the reason
@@ -10735,22 +10733,32 @@ void
 nsGlobalWindow::GetInterface(JSContext* aCx, nsIJSID* aIID,
                              JS::MutableHandle<JS::Value> aRetval,
                              ErrorResult& aError)
 {
   dom::GetInterface(aCx, this, aIID, aRetval, aError);
 }
 
 void
-nsGlobalWindow::FireOfflineStatusEvent()
+nsGlobalWindow::FireOfflineStatusEventIfChanged()
 {
   if (!IsCurrentInnerWindow())
     return;
+
+  bool isOffline = NS_IsOffline() || NS_IsAppOffline(GetPrincipal());
+
+  // Don't fire an event if the status hasn't changed
+  if (mWasOffline == isOffline) {
+    return;
+  }
+
+  mWasOffline = isOffline;
+
   nsAutoString name;
-  if (NS_IsOffline()) {
+  if (isOffline) {
     name.AssignLiteral("offline");
   } else {
     name.AssignLiteral("online");
   }
   // The event is fired at the body element, or if there is no body element,
   // at the document.
   nsCOMPtr<EventTarget> eventTarget = mDoc.get();
   nsHTMLDocument* htmlDoc = mDoc->AsHTMLDocument();
@@ -11296,23 +11304,21 @@ nsGlobalWindow::UnregisterIdleObserver(n
 
   return NS_OK;
 }
 
 nsresult
 nsGlobalWindow::Observe(nsISupports* aSubject, const char* aTopic,
                         const char16_t* aData)
 {
-  if (!nsCRT::strcmp(aTopic, NS_IOSERVICE_OFFLINE_STATUS_TOPIC)) {
-    if (IsFrozen()) {
-      // if an even number of notifications arrive while we're frozen,
-      // we don't need to fire.
-      mFireOfflineStatusChangeEventOnThaw = !mFireOfflineStatusChangeEventOnThaw;
-    } else {
-      FireOfflineStatusEvent();
+  if (!nsCRT::strcmp(aTopic, NS_IOSERVICE_OFFLINE_STATUS_TOPIC) ||
+      !nsCRT::strcmp(aTopic, NS_IOSERVICE_APP_OFFLINE_STATUS_TOPIC)) {
+    if (!IsFrozen()) {
+        // Fires an offline status event if the offline status has changed
+        FireOfflineStatusEventIfChanged();
     }
     return NS_OK;
   }
 
   if (!nsCRT::strcmp(aTopic, OBSERVER_TOPIC_IDLE)) {
     mCurrentlyIdle = true;
     if (IsFrozen()) {
       // need to fire only one idle event while the window is frozen.
@@ -11577,20 +11583,18 @@ nsGlobalWindow::FireDelayedDOMEvents()
   for (uint32_t i = 0, len = mPendingStorageEvents.Length(); i < len; ++i) {
     Observe(mPendingStorageEvents[i], "dom-storage2-changed", nullptr);
   }
 
   if (mApplicationCache) {
     static_cast<nsDOMOfflineResourceList*>(mApplicationCache.get())->FirePendingEvents();
   }
 
-  if (mFireOfflineStatusChangeEventOnThaw) {
-    mFireOfflineStatusChangeEventOnThaw = false;
-    FireOfflineStatusEvent();
-  }
+  // Fires an offline status event if the offline status has changed
+  FireOfflineStatusEventIfChanged();
 
   if (mNotifyIdleObserversIdleOnThaw) {
     mNotifyIdleObserversIdleOnThaw = false;
     HandleIdleActiveEvent();
   }
 
   if (mNotifyIdleObserversActiveOnThaw) {
     mNotifyIdleObserversActiveOnThaw = false;
@@ -13358,16 +13362,24 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 // QueryInterface implementation for nsGlobalChromeWindow
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(nsGlobalChromeWindow)
   NS_INTERFACE_MAP_ENTRY(nsIDOMChromeWindow)
 NS_INTERFACE_MAP_END_INHERITING(nsGlobalWindow)
 
 NS_IMPL_ADDREF_INHERITED(nsGlobalChromeWindow, nsGlobalWindow)
 NS_IMPL_RELEASE_INHERITED(nsGlobalChromeWindow, nsGlobalWindow)
 
+/* static */ already_AddRefed<nsGlobalChromeWindow>
+nsGlobalChromeWindow::Create(nsGlobalWindow *aOuterWindow)
+{
+  nsRefPtr<nsGlobalChromeWindow> window = new nsGlobalChromeWindow(aOuterWindow);
+  window->InitWasOffline();
+  return window.forget();
+}
+
 NS_IMETHODIMP
 nsGlobalChromeWindow::GetWindowState(uint16_t* aWindowState)
 {
   *aWindowState = WindowState();
   return NS_OK;
 }
 
 uint16_t
@@ -13782,27 +13794,49 @@ nsGlobalWindow::GetDialogArguments(JSCon
   // This does an internal origin check, and returns undefined if the subject
   // does not subsumes the origin of the arguments.
   JS::Rooted<JSObject*> wrapper(aCx, GetWrapper());
   JSAutoCompartment ac(aCx, wrapper);
   mDialogArguments->Get(aCx, wrapper, nsContentUtils::SubjectPrincipal(),
                         aRetval, aError);
 }
 
+/* static */ already_AddRefed<nsGlobalModalWindow>
+nsGlobalModalWindow::Create(nsGlobalWindow *aOuterWindow)
+{
+  nsRefPtr<nsGlobalModalWindow> window = new nsGlobalModalWindow(aOuterWindow);
+  window->InitWasOffline();
+  return window.forget();
+}
+
 NS_IMETHODIMP
 nsGlobalModalWindow::GetDialogArguments(nsIVariant **aArguments)
 {
   FORWARD_TO_OUTER_MODAL_CONTENT_WINDOW(GetDialogArguments, (aArguments),
                                         NS_ERROR_NOT_INITIALIZED);
 
   // This does an internal origin check, and returns undefined if the subject
   // does not subsumes the origin of the arguments.
   return mDialogArguments->Get(nsContentUtils::SubjectPrincipal(), aArguments);
 }
 
+/* static */ already_AddRefed<nsGlobalWindow>
+nsGlobalWindow::Create(nsGlobalWindow *aOuterWindow)
+{
+  nsRefPtr<nsGlobalWindow> window = new nsGlobalWindow(aOuterWindow);
+  window->InitWasOffline();
+  return window.forget();
+}
+
+void
+nsGlobalWindow::InitWasOffline()
+{
+  mWasOffline = NS_IsOffline() || NS_IsAppOffline(GetPrincipal());
+}
+
 void
 nsGlobalWindow::GetReturnValue(JSContext* aCx,
                                JS::MutableHandle<JS::Value> aReturnValue,
                                ErrorResult& aError)
 {
   FORWARD_TO_OUTER_OR_THROW(GetReturnValue, (aCx, aReturnValue, aError),
                             aError, );
 
@@ -13965,17 +13999,16 @@ nsGlobalWindow::GetSidebar(OwningExterna
   aRv.Throw(NS_ERROR_NOT_IMPLEMENTED);
 #endif
 }
 
 void
 nsGlobalWindow::ClearDocumentDependentSlots(JSContext* aCx)
 {
   MOZ_ASSERT(IsInnerWindow());
-  MOZ_ASSERT(IsDOMBinding());
   WindowBinding::ClearCachedDocumentValue(aCx, this);
   WindowBinding::ClearCachedPerformanceValue(aCx, this);
 }
 
 /* static */
 JSObject*
 nsGlobalWindow::CreateNamedPropertiesObject(JSContext *aCx,
                                             JS::Handle<JSObject*> aProto)
--- a/dom/base/nsGlobalWindow.h
+++ b/dom/base/nsGlobalWindow.h
@@ -485,17 +485,17 @@ public:
   bool DoNewResolve(JSContext* aCx, JS::Handle<JSObject*> aObj,
                     JS::Handle<jsid> aId,
                     JS::MutableHandle<JSPropertyDescriptor> aDesc);
 
   void GetOwnPropertyNames(JSContext* aCx, nsTArray<nsString>& aNames,
                            mozilla::ErrorResult& aRv);
 
   // Object Management
-  explicit nsGlobalWindow(nsGlobalWindow *aOuterWindow);
+  static already_AddRefed<nsGlobalWindow> Create(nsGlobalWindow *aOuterWindow);
 
   static nsGlobalWindow *FromSupports(nsISupports *supports)
   {
     // Make sure this matches the casts we do in QueryInterface().
     return (nsGlobalWindow *)(mozilla::dom::EventTarget *)supports;
   }
   static nsGlobalWindow *FromWrapper(nsIXPConnectWrappedNative *wrapper)
   {
@@ -818,17 +818,20 @@ public:
   uint32_t Length();
   already_AddRefed<nsIDOMWindow> GetTop(mozilla::ErrorResult& aError)
   {
     nsCOMPtr<nsIDOMWindow> top;
     aError = GetScriptableTop(getter_AddRefs(top));
     return top.forget();
   }
 protected:
+  explicit nsGlobalWindow(nsGlobalWindow *aOuterWindow);
   nsIDOMWindow* GetOpenerWindow(mozilla::ErrorResult& aError);
+  // Initializes the mWasOffline member variable
+  void InitWasOffline();
 public:
   void GetOpener(JSContext* aCx, JS::MutableHandle<JS::Value> aRetval,
                  mozilla::ErrorResult& aError);
   void SetOpener(JSContext* aCx, JS::Handle<JS::Value> aOpener,
                  mozilla::ErrorResult& aError);
   using nsIDOMWindow::GetParent;
   already_AddRefed<nsIDOMWindow> GetParent(mozilla::ErrorResult& aError);
   mozilla::dom::Element* GetFrameElement(mozilla::ErrorResult& aError);
@@ -1241,17 +1244,17 @@ public:
   nsresult SecurityCheckURL(const char *aURL);
 
   bool PopupWhitelisted();
   PopupControlState RevisePopupAbuseLevel(PopupControlState);
   void     FireAbuseEvents(bool aBlocked, bool aWindow,
                            const nsAString &aPopupURL,
                            const nsAString &aPopupWindowName,
                            const nsAString &aPopupWindowFeatures);
-  void FireOfflineStatusEvent();
+  void FireOfflineStatusEventIfChanged();
 
   // Inner windows only.
   nsresult ScheduleNextIdleObserverCallback();
   uint32_t GetFuzzTimeMS();
   nsresult ScheduleActiveTimerCallback();
   uint32_t FindInsertionIndex(IdleObserverHolder* aIdleObserver);
   virtual nsresult RegisterIdleObserver(nsIIdleObserver* aIdleObserverPtr);
   nsresult FindIndexOfElementToRemove(nsIIdleObserver* aIdleObserver,
@@ -1444,18 +1447,20 @@ protected:
   // event posted.  If this is set, just ignore window.close() calls.
   bool                          mHavePendingClose : 1;
   bool                          mHadOriginalOpener : 1;
   bool                          mIsPopupSpam : 1;
 
   // Indicates whether scripts are allowed to close this window.
   bool                          mBlockScriptedClosingFlag : 1;
 
+  // Window offline status. Checked to see if we need to fire offline event
+  bool                          mWasOffline : 1;
+
   // Track what sorts of events we need to fire when thawed
-  bool                          mFireOfflineStatusChangeEventOnThaw : 1;
   bool                          mNotifyIdleObserversIdleOnThaw : 1;
   bool                          mNotifyIdleObserversActiveOnThaw : 1;
 
   // Indicates whether we're in the middle of creating an initializing
   // a new inner window object.
   bool                          mCreatingInnerWindow : 1;
 
   // Fast way to tell if this is a chrome window (without having to QI).
@@ -1652,36 +1657,38 @@ class nsGlobalChromeWindow : public nsGl
 {
 public:
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIDOMChromeWindow interface
   NS_DECL_NSIDOMCHROMEWINDOW
 
-  explicit nsGlobalChromeWindow(nsGlobalWindow *aOuterWindow)
-    : nsGlobalWindow(aOuterWindow),
-      mGroupMessageManagers(1)
-  {
-    mIsChrome = true;
-    mCleanMessageManager = true;
-  }
+  static already_AddRefed<nsGlobalChromeWindow> Create(nsGlobalWindow *aOuterWindow);
 
   static PLDHashOperator
   DisconnectGroupMessageManager(const nsAString& aKey,
                                 nsIMessageBroadcaster* aMM,
                                 void* aUserArg)
   {
     if (aMM) {
       static_cast<nsFrameMessageManager*>(aMM)->Disconnect();
     }
     return PL_DHASH_NEXT;
   }
 
 protected:
+  explicit nsGlobalChromeWindow(nsGlobalWindow *aOuterWindow)
+    : nsGlobalWindow(aOuterWindow),
+      mGroupMessageManagers(1)
+  {
+    mIsChrome = true;
+    mCleanMessageManager = true;
+  }
+
   ~nsGlobalChromeWindow()
   {
     NS_ABORT_IF_FALSE(mCleanMessageManager,
                       "chrome windows may always disconnect the msg manager");
 
     mGroupMessageManagers.EnumerateRead(DisconnectGroupMessageManager, nullptr);
     mGroupMessageManagers.Clear();
 
@@ -1719,39 +1726,41 @@ public:
  * nsGlobalModalWindow inherits from nsGlobalWindow. It is the global
  * object created for a modal content windows only (i.e. not modal
  * chrome dialogs).
  */
 class nsGlobalModalWindow : public nsGlobalWindow,
                             public nsIDOMModalContentWindow
 {
 public:
+  NS_DECL_ISUPPORTS_INHERITED
+  NS_DECL_NSIDOMMODALCONTENTWINDOW
+
+  static already_AddRefed<nsGlobalModalWindow> Create(nsGlobalWindow *aOuterWindow);
+
+protected:
   explicit nsGlobalModalWindow(nsGlobalWindow *aOuterWindow)
     : nsGlobalWindow(aOuterWindow)
   {
     mIsModalContentWindow = true;
   }
 
-  NS_DECL_ISUPPORTS_INHERITED
-  NS_DECL_NSIDOMMODALCONTENTWINDOW
-
-protected:
   ~nsGlobalModalWindow() {}
 };
 
 /* factory function */
 inline already_AddRefed<nsGlobalWindow>
 NS_NewScriptGlobalObject(bool aIsChrome, bool aIsModalContentWindow)
 {
   nsRefPtr<nsGlobalWindow> global;
 
   if (aIsChrome) {
-    global = new nsGlobalChromeWindow(nullptr);
+    global = nsGlobalChromeWindow::Create(nullptr);
   } else if (aIsModalContentWindow) {
-    global = new nsGlobalModalWindow(nullptr);
+    global = nsGlobalModalWindow::Create(nullptr);
   } else {
-    global = new nsGlobalWindow(nullptr);
+    global = nsGlobalWindow::Create(nullptr);
   }
 
   return global.forget();
 }
 
 #endif /* nsGlobalWindow_h___ */
--- a/dom/base/nsHistory.cpp
+++ b/dom/base/nsHistory.cpp
@@ -41,17 +41,16 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRY(nsISupports)
   NS_INTERFACE_MAP_ENTRY(nsIDOMHistory) // Empty, needed for extension compat
 NS_INTERFACE_MAP_END
 
 nsHistory::nsHistory(nsPIDOMWindow* aInnerWindow)
   : mInnerWindow(do_GetWeakReference(aInnerWindow))
 {
-  SetIsDOMBinding();
 }
 
 nsHistory::~nsHistory()
 {
 }
 
 nsPIDOMWindow*
 nsHistory::GetParentObject() const
--- a/dom/base/nsLocation.cpp
+++ b/dom/base/nsLocation.cpp
@@ -50,17 +50,16 @@ GetDocumentCharacterSetForURI(const nsAS
   return NS_OK;
 }
 
 nsLocation::nsLocation(nsPIDOMWindow* aWindow, nsIDocShell *aDocShell)
   : mInnerWindow(aWindow)
 {
   MOZ_ASSERT(aDocShell);
   MOZ_ASSERT(mInnerWindow->IsInnerWindow());
-  SetIsDOMBinding();
 
   mDocShell = do_GetWeakReference(aDocShell);
 }
 
 nsLocation::~nsLocation()
 {
   RemoveURLSearchParams();
 }
--- a/dom/base/nsMimeTypeArray.cpp
+++ b/dom/base/nsMimeTypeArray.cpp
@@ -28,17 +28,16 @@ NS_INTERFACE_MAP_END
 NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(nsMimeTypeArray,
                                       mWindow,
                                       mMimeTypes,
                                       mHiddenMimeTypes)
 
 nsMimeTypeArray::nsMimeTypeArray(nsPIDOMWindow* aWindow)
   : mWindow(aWindow)
 {
-  SetIsDOMBinding();
 }
 
 nsMimeTypeArray::~nsMimeTypeArray()
 {
 }
 
 JSObject*
 nsMimeTypeArray::WrapObject(JSContext* aCx)
@@ -228,26 +227,24 @@ NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(ns
 
 nsMimeType::nsMimeType(nsPIDOMWindow* aWindow, nsPluginElement* aPluginElement,
                        uint32_t aPluginTagMimeIndex, const nsAString& aType)
   : mWindow(aWindow),
     mPluginElement(aPluginElement),
     mPluginTagMimeIndex(aPluginTagMimeIndex),
     mType(aType)
 {
-  SetIsDOMBinding();
 }
 
 nsMimeType::nsMimeType(nsPIDOMWindow* aWindow, const nsAString& aType)
   : mWindow(aWindow),
     mPluginElement(nullptr),
     mPluginTagMimeIndex(0),
     mType(aType)
 {
-  SetIsDOMBinding();
 }
 
 nsMimeType::~nsMimeType()
 {
 }
 
 nsPIDOMWindow*
 nsMimeType::GetParentObject() const
--- a/dom/base/nsPerformance.cpp
+++ b/dom/base/nsPerformance.cpp
@@ -35,17 +35,16 @@ nsPerformanceTiming::nsPerformanceTiming
   : mPerformance(aPerformance),
     mChannel(aChannel),
     mFetchStart(0.0),
     mZeroTime(aZeroTime),
     mTimingAllowed(true),
     mReportCrossOriginRedirect(true)
 {
   MOZ_ASSERT(aPerformance, "Parent performance object should be provided");
-  SetIsDOMBinding();
 
   if (!nsContentUtils::IsPerformanceTimingEnabled()) {
     mZeroTime = 0;
   }
 
   // The aHttpChannel argument is null if this nsPerformanceTiming object
   // is being used for the navigation timing (document) and has a non-null
   // value for the resource timing (any resources within the page).
@@ -363,17 +362,16 @@ NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(ns
 
 NS_IMPL_CYCLE_COLLECTION_ROOT_NATIVE(nsPerformanceNavigation, AddRef)
 NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(nsPerformanceNavigation, Release)
 
 nsPerformanceNavigation::nsPerformanceNavigation(nsPerformance* aPerformance)
   : mPerformance(aPerformance)
 {
   MOZ_ASSERT(aPerformance, "Parent performance object should be provided");
-  SetIsDOMBinding();
 }
 
 nsPerformanceNavigation::~nsPerformanceNavigation()
 {
 }
 
 JSObject*
 nsPerformanceNavigation::WrapObject(JSContext *cx)
@@ -396,17 +394,16 @@ nsPerformance::nsPerformance(nsPIDOMWind
   : DOMEventTargetHelper(aWindow),
     mWindow(aWindow),
     mDOMTiming(aDOMTiming),
     mChannel(aChannel),
     mParentPerformance(aParentPerformance),
     mPrimaryBufferSize(kDefaultBufferSize)
 {
   MOZ_ASSERT(aWindow, "Parent window object should be provided");
-  SetIsDOMBinding();
 }
 
 nsPerformance::~nsPerformance()
 {
 }
 
 // QueryInterface implementation for nsPerformance
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsPerformance)
--- a/dom/base/nsPluginArray.cpp
+++ b/dom/base/nsPluginArray.cpp
@@ -22,17 +22,16 @@
 #include "nsIInterfaceRequestorUtils.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
 
 nsPluginArray::nsPluginArray(nsPIDOMWindow* aWindow)
   : mWindow(aWindow)
 {
-  SetIsDOMBinding();
 }
 
 void
 nsPluginArray::Init()
 {
   nsCOMPtr<nsIObserverService> obsService =
     mozilla::services::GetObserverService();
   if (obsService) {
@@ -381,17 +380,16 @@ NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(nsPluginElement, mWindow, mMimeTypes)
 
 nsPluginElement::nsPluginElement(nsPIDOMWindow* aWindow,
                                  nsPluginTag* aPluginTag)
   : mWindow(aWindow),
     mPluginTag(aPluginTag)
 {
-  SetIsDOMBinding();
 }
 
 nsPluginElement::~nsPluginElement()
 {
 }
 
 nsPIDOMWindow*
 nsPluginElement::GetParentObject() const
--- a/dom/base/nsWindowRoot.cpp
+++ b/dom/base/nsWindowRoot.cpp
@@ -28,16 +28,17 @@
 #endif
 
 using namespace mozilla;
 using namespace mozilla::dom;
 
 nsWindowRoot::nsWindowRoot(nsPIDOMWindow* aWindow)
 {
   mWindow = aWindow;
+  SetIsNotDOMBinding();
 }
 
 nsWindowRoot::~nsWindowRoot()
 {
   if (mListenerManager) {
     mListenerManager->Disconnect();
   }
 }
--- a/dom/base/nsWindowRoot.h
+++ b/dom/base/nsWindowRoot.h
@@ -56,16 +56,21 @@ public:
 
   virtual void SetParentTarget(mozilla::dom::EventTarget* aTarget) MOZ_OVERRIDE
   {
     mParent = aTarget;
   }
   virtual mozilla::dom::EventTarget* GetParentTarget() MOZ_OVERRIDE { return mParent; }
   virtual nsIDOMWindow* GetOwnerGlobal() MOZ_OVERRIDE;
 
+  virtual JSObject* WrapObject(JSContext* cx) MOZ_OVERRIDE
+  {
+    MOZ_CRASH("nsWindowRoot doesn't use DOM bindings!");
+  }
+
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_AMBIGUOUS(nsWindowRoot,
                                                          nsIDOMEventTarget)
 
 protected:
   virtual ~nsWindowRoot();
 
   // Members
   nsCOMPtr<nsPIDOMWindow> mWindow;
--- a/dom/base/nsWrapperCache.h
+++ b/dom/base/nsWrapperCache.h
@@ -9,16 +9,24 @@
 #include "nsCycleCollectionParticipant.h"
 #include "mozilla/Assertions.h"
 #include "js/Class.h"
 #include "js/Id.h"          // must come before js/RootingAPI.h
 #include "js/Value.h"       // must come before js/RootingAPI.h
 #include "js/RootingAPI.h"
 #include "js/TracingAPI.h"
 
+namespace mozilla {
+namespace dom {
+class TabChildGlobal;
+} // namespace dom
+} // namespace mozilla
+class SandboxPrivate;
+class nsInProcessTabChildGlobal;
+class nsWindowRoot;
 class XPCWrappedNativeScope;
 
 #define NS_WRAPPERCACHE_IID \
 { 0x6f3179a1, 0x36f7, 0x4a5c, \
   { 0x8c, 0xf1, 0xad, 0xc8, 0x7c, 0xde, 0x3e, 0x87 } }
 
 /**
  * Class to store the wrapper for an object. This can only be used with objects
@@ -32,20 +40,20 @@ class XPCWrappedNativeScope;
  *
  * The cache can store objects other than wrappers. We allow wrappers to use a
  * separate JSObject to store their state (mostly expandos). If the wrapper is
  * collected and we want to preserve this state we actually store the state
  * object in the cache.
  *
  * The cache can store 2 types of objects:
  *
- *  If WRAPPER_IS_DOM_BINDING is not set (IsDOMBinding() returns false):
- *    - a slim wrapper or the JSObject of an XPCWrappedNative wrapper
+ *  If WRAPPER_IS_NOT_DOM_BINDING is set (IsDOMBinding() returns false):
+ *    - the JSObject of an XPCWrappedNative wrapper
  *
- *  If WRAPPER_IS_DOM_BINDING is set (IsDOMBinding() returns true):
+ *  If WRAPPER_IS_NOT_DOM_BINDING is not set (IsDOMBinding() returns true):
  *    - a DOM binding object (regular JS object or proxy)
  *
  * The finalizer for the wrapper clears the cache.
  *
  * A compacting GC can move the wrapper object. Pointers to moved objects are
  * usually found and updated by tracing the heap, however non-preserved wrappers
  * are weak references and are not traced, so another approach is
  * necessary. Instead a class hook (objectMovedOp) is provided that is called
@@ -129,37 +137,26 @@ public:
     }
   }
 
   bool PreservingWrapper()
   {
     return HasWrapperFlag(WRAPPER_BIT_PRESERVED);
   }
 
-  void SetIsDOMBinding()
-  {
-    MOZ_ASSERT(!mWrapper && !(GetWrapperFlags() & ~WRAPPER_IS_DOM_BINDING),
-               "This flag should be set before creating any wrappers.");
-    SetWrapperFlags(WRAPPER_IS_DOM_BINDING);
-  }
-
   bool IsDOMBinding() const
   {
-    return HasWrapperFlag(WRAPPER_IS_DOM_BINDING);
+    return !HasWrapperFlag(WRAPPER_IS_NOT_DOM_BINDING);
   }
 
   /**
    * Wrap the object corresponding to this wrapper cache. If non-null is
    * returned, the object has already been stored in the wrapper cache.
    */
-  virtual JSObject* WrapObject(JSContext* cx)
-  {
-    MOZ_ASSERT(!IsDOMBinding(), "Someone forgot to override WrapObject");
-    return nullptr;
-  }
+  virtual JSObject* WrapObject(JSContext* cx) = 0;
 
   /**
    * Returns true if the object has a non-gray wrapper.
    */
   bool IsBlack();
 
   /**
    * Returns true if the object has a black wrapper,
@@ -260,25 +257,36 @@ protected:
   void PoisonWrapper()
   {
     if (mWrapper) {
       mWrapper.setToCrashOnTouch();
     }
   }
 
 private:
+  friend class mozilla::dom::TabChildGlobal;
+  friend class SandboxPrivate;
+  friend class nsInProcessTabChildGlobal;
+  friend class nsWindowRoot;
+  void SetIsNotDOMBinding()
+  {
+    MOZ_ASSERT(!mWrapper && !(GetWrapperFlags() & ~WRAPPER_IS_NOT_DOM_BINDING),
+               "This flag should be set before creating any wrappers.");
+    SetWrapperFlags(WRAPPER_IS_NOT_DOM_BINDING);
+  }
+
   JSObject *GetWrapperJSObject() const
   {
     return mWrapper;
   }
 
   void SetWrapperJSObject(JSObject* aWrapper)
   {
     mWrapper = aWrapper;
-    UnsetWrapperFlags(kWrapperFlagsMask & ~WRAPPER_IS_DOM_BINDING);
+    UnsetWrapperFlags(kWrapperFlagsMask & ~WRAPPER_IS_NOT_DOM_BINDING);
   }
 
   void TraceWrapperJSObject(JSTracer* aTrc, const char* aName);
 
   FlagsType GetWrapperFlags() const
   {
     return mFlags & kWrapperFlagsMask;
   }
@@ -318,22 +326,22 @@ private:
    * traces/traverses/unlinks the cached JS object (see
    * NS_IMPL_CYCLE_COLLECTION_TRACE_PRESERVED_WRAPPER,
    * NS_IMPL_CYCLE_COLLECTION_TRAVERSE_SCRIPT_OBJECTS and
    * NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER).
    */
   enum { WRAPPER_BIT_PRESERVED = 1 << 0 };
 
   /**
-   * If this bit is set then the wrapper for the native object is a DOM binding
-   * (regular JS object or proxy).
+   * If this bit is set then the wrapper for the native object is not a DOM
+   * binding.
    */
-  enum { WRAPPER_IS_DOM_BINDING = 1 << 1 };
+  enum { WRAPPER_IS_NOT_DOM_BINDING = 1 << 1 };
 
-  enum { kWrapperFlagsMask = (WRAPPER_BIT_PRESERVED | WRAPPER_IS_DOM_BINDING) };
+  enum { kWrapperFlagsMask = (WRAPPER_BIT_PRESERVED | WRAPPER_IS_NOT_DOM_BINDING) };
 
   JS::Heap<JSObject*> mWrapper;
   FlagsType           mFlags;
 };
 
 enum { WRAPPER_CACHE_FLAGS_BITS_USED = 2 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsWrapperCache, NS_WRAPPERCACHE_IID)
--- a/dom/bindings/BindingUtils.h
+++ b/dom/bindings/BindingUtils.h
@@ -2863,17 +2863,16 @@ CreateGlobal(JSContext* aCx, T* aNative,
   }
 
   JSAutoCompartment ac(aCx, aGlobal);
 
   {
     js::SetReservedSlot(aGlobal, DOM_OBJECT_SLOT, PRIVATE_TO_JSVAL(aNative));
     NS_ADDREF(aNative);
 
-    aCache->SetIsDOMBinding();
     aCache->SetWrapper(aGlobal);
 
     dom::AllocateProtoAndIfaceCache(aGlobal,
                                     CreateGlobalOptions<T>::ProtoAndIfaceCacheKind);
 
     if (!CreateGlobalOptions<T>::PostCreateGlobal(aCx, aGlobal)) {
       return false;
     }
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -13018,30 +13018,26 @@ class CGExampleClass(CGBindingImplClass)
                                                         visibility="public")],
                          destructor=ClassDestructor(visibility=destructorVisibility),
                          methods=self.methodDecls,
                          decorators=decorators,
                          extradeclarations=extradeclarations)
 
     def define(self):
         # Just override CGClass and do our own thing
-        if self.descriptor.wrapperCache:
-            setDOMBinding = "  SetIsDOMBinding();\n"
-        else:
-            setDOMBinding = ""
         if self.refcounted:
             ctordtor = dedent("""
                 ${nativeType}::${nativeType}()
                 {
-                %s}
+                }
 
                 ${nativeType}::~${nativeType}()
                 {
                 }
-                """) % setDOMBinding
+                """)
         else:
             ctordtor = dedent("""
                 ${nativeType}::${nativeType}()
                 {
                   MOZ_COUNT_CTOR(${nativeType});
                 }
 
                 ${nativeType}::~${nativeType}()
@@ -13336,17 +13332,17 @@ class CGJSImplClass(CGBindingImplClass):
                 descriptor.interface.parent.identifier.name).jsImplParent
             baseClasses = [ClassBase(parentClass)]
             isupportsDecl = "NS_DECL_ISUPPORTS_INHERITED\n"
             ccDecl = ("NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(%s, %s)\n" %
                       (descriptor.name, parentClass))
             constructorBody = dedent("""
                 // Make sure we're an nsWrapperCache already
                 MOZ_ASSERT(static_cast<nsWrapperCache*>(this));
-                // And that our ancestor has called SetIsDOMBinding()
+                // And that our ancestor has not called SetIsNotDOMBinding()
                 MOZ_ASSERT(IsDOMBinding());
                 """)
             extradefinitions = fill(
                 """
                 NS_IMPL_CYCLE_COLLECTION_INHERITED(${ifaceName}, ${parentClass}, mImpl, mParent)
                 NS_IMPL_ADDREF_INHERITED(${ifaceName}, ${parentClass})
                 NS_IMPL_RELEASE_INHERITED(${ifaceName}, ${parentClass})
                 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(${ifaceName})
@@ -13355,17 +13351,16 @@ class CGJSImplClass(CGBindingImplClass):
                 ifaceName=self.descriptor.name,
                 parentClass=parentClass)
         else:
             baseClasses = [ClassBase("nsSupportsWeakReference"),
                            ClassBase("nsWrapperCache")]
             isupportsDecl = "NS_DECL_CYCLE_COLLECTING_ISUPPORTS\n"
             ccDecl = ("NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(%s)\n" %
                       descriptor.name)
-            constructorBody = "SetIsDOMBinding();\n"
             extradefinitions = fill(
                 """
                 NS_IMPL_CYCLE_COLLECTION_CLASS(${ifaceName})
                 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(${ifaceName})
                   NS_IMPL_CYCLE_COLLECTION_UNLINK(mImpl)
                   NS_IMPL_CYCLE_COLLECTION_UNLINK(mParent)
                   NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER
                   tmp->ClearWeakReferences();
@@ -13424,18 +13419,17 @@ class CGJSImplClass(CGBindingImplClass):
             # We only have C++ ancestors, so only pass along the window
             baseConstructors.insert(0,
                                     "%s(aParent)" % parentClass)
 
         constructor = ClassConstructor(
             [Argument("JS::Handle<JSObject*>", "aJSImplObject"),
              Argument("nsPIDOMWindow*", "aParent")],
             visibility="public",
-            baseConstructors=baseConstructors,
-            body=constructorBody)
+            baseConstructors=baseConstructors)
 
         self.methodDecls.append(
             ClassMethod("_Create",
                         "bool",
                         JSNativeArguments(),
                         static=True,
                         body=self.getCreateFromExistingBody()))
 
--- a/dom/bluetooth/BluetoothAdapter.cpp
+++ b/dom/bluetooth/BluetoothAdapter.cpp
@@ -164,17 +164,16 @@ BluetoothAdapter::BluetoothAdapter(nsPID
   , mJsDeviceAddresses(nullptr)
   , mDiscoverable(false)
   , mDiscovering(false)
   , mPairable(false)
   , mPowered(false)
   , mIsRooted(false)
 {
   MOZ_ASSERT(aWindow);
-  MOZ_ASSERT(IsDOMBinding());
 
   const InfallibleTArray<BluetoothNamedValue>& values =
     aValue.get_ArrayOfBluetoothNamedValue();
   for (uint32_t i = 0; i < values.Length(); ++i) {
     SetPropertyByValue(values[i]);
   }
 
   BluetoothService* bs = BluetoothService::Get();
--- a/dom/bluetooth/BluetoothCommon.h
+++ b/dom/bluetooth/BluetoothCommon.h
@@ -154,16 +154,17 @@ enum BluetoothBondState {
 
 enum BluetoothDeviceType {
   DEVICE_TYPE_BREDR,
   DEVICE_TYPE_BLE,
   DEVICE_TYPE_DUAL
 };
 
 enum BluetoothPropertyType {
+  PROPERTY_UNKNOWN,
   PROPERTY_BDNAME,
   PROPERTY_BDADDR,
   PROPERTY_UUIDS,
   PROPERTY_CLASS_OF_DEVICE,
   PROPERTY_TYPE_OF_DEVICE,
   PROPERTY_SERVICE_RECORD,
   PROPERTY_ADAPTER_SCAN_MODE,
   PROPERTY_ADAPTER_BONDED_DEVICES,
--- a/dom/bluetooth/BluetoothDevice.cpp
+++ b/dom/bluetooth/BluetoothDevice.cpp
@@ -51,17 +51,16 @@ BluetoothDevice::BluetoothDevice(nsPIDOM
   : DOMEventTargetHelper(aWindow)
   , BluetoothPropertyContainer(BluetoothObjectType::TYPE_DEVICE)
   , mJsUuids(nullptr)
   , mJsServices(nullptr)
   , mAdapterPath(aAdapterPath)
   , mIsRooted(false)
 {
   MOZ_ASSERT(aWindow);
-  MOZ_ASSERT(IsDOMBinding());
 
   const InfallibleTArray<BluetoothNamedValue>& values =
     aValue.get_ArrayOfBluetoothNamedValue();
   for (uint32_t i = 0; i < values.Length(); ++i) {
     SetPropertyByValue(values[i]);
   }
 
   BluetoothService* bs = BluetoothService::Get();
--- a/dom/bluetooth/BluetoothManager.cpp
+++ b/dom/bluetooth/BluetoothManager.cpp
@@ -95,17 +95,16 @@ private:
   nsRefPtr<BluetoothManager> mManagerPtr;
 };
 
 BluetoothManager::BluetoothManager(nsPIDOMWindow *aWindow)
   : DOMEventTargetHelper(aWindow)
   , BluetoothPropertyContainer(BluetoothObjectType::TYPE_MANAGER)
 {
   MOZ_ASSERT(aWindow);
-  MOZ_ASSERT(IsDOMBinding());
 
   mPath.Assign('/');
 
   BluetoothService* bs = BluetoothService::Get();
   NS_ENSURE_TRUE_VOID(bs);
   bs->RegisterBluetoothSignalHandler(NS_LITERAL_STRING(KEY_MANAGER), this);
 }
 
--- a/dom/bluetooth/bluedroid/BluetoothHALHelpers.cpp
+++ b/dom/bluetooth/bluedroid/BluetoothHALHelpers.cpp
@@ -219,16 +219,19 @@ Convert(const bt_property_t& aIn, Blueto
   nsresult rv = Convert(aIn.type, aOut.mType);
   if (NS_FAILED(rv)) {
     return rv;
   }
 
   /* value conversion */
 
   switch (aOut.mType) {
+    case PROPERTY_UNKNOWN:
+      /* Bug 1065999: working around unknown properties */
+      break;
     case PROPERTY_BDNAME:
       /* fall through */
     case PROPERTY_REMOTE_FRIENDLY_NAME:
       {
         // We construct an nsCString here because bdname
         // returned from Bluedroid is not 0-terminated.
         aOut.mString = NS_ConvertUTF8toUTF16(
           nsCString(static_cast<char*>(aIn.val), aIn.len));
--- a/dom/bluetooth/bluedroid/BluetoothHALHelpers.h
+++ b/dom/bluetooth/bluedroid/BluetoothHALHelpers.h
@@ -202,17 +202,19 @@ Convert(bt_property_type_t aIn, Bluetoot
   };
   if (aIn == BT_PROPERTY_REMOTE_DEVICE_TIMESTAMP) {
     /* This case is handled separately to not populate
      * |sPropertyType| with empty entries. */
     aOut = PROPERTY_REMOTE_DEVICE_TIMESTAMP;
     return NS_OK;
   }
   if (!aIn || aIn >= MOZ_ARRAY_LENGTH(sPropertyType)) {
-    return NS_ERROR_ILLEGAL_VALUE;
+    /* Bug 1065999: working around unknown properties */
+    aOut = PROPERTY_UNKNOWN;
+    return NS_OK;
   }
   aOut = sPropertyType[aIn];
   return NS_OK;
 }
 
 inline nsresult
 Convert(bt_discovery_state_t aIn, bool& aOut)
 {
--- a/dom/bluetooth/bluedroid/BluetoothServiceBluedroid.cpp
+++ b/dom/bluetooth/bluedroid/BluetoothServiceBluedroid.cpp
@@ -804,17 +804,17 @@ public:
 
   void OnError(BluetoothStatus aStatus) MOZ_OVERRIDE
   {
     sBondingRunnableArray.RemoveElement(mRunnable);
     ReplyStatusError(mRunnable, aStatus, NS_LITERAL_STRING("CreatedPairedDevice"));
   }
 
 private:
-  BluetoothReplyRunnable* mRunnable;
+  nsRefPtr<BluetoothReplyRunnable> mRunnable;
 };
 
 nsresult
 BluetoothServiceBluedroid::CreatePairedDeviceInternal(
   const nsAString& aDeviceAddress, int aTimeout,
   BluetoothReplyRunnable* aRunnable)
 {
   MOZ_ASSERT(NS_IsMainThread());
@@ -838,17 +838,17 @@ public:
 
   void OnError(BluetoothStatus aStatus) MOZ_OVERRIDE
   {
     sUnbondingRunnableArray.RemoveElement(mRunnable);
     ReplyStatusError(mRunnable, aStatus, NS_LITERAL_STRING("RemoveDevice"));
   }
 
 private:
-  BluetoothReplyRunnable* mRunnable;
+  nsRefPtr<BluetoothReplyRunnable> mRunnable;
 };
 
 nsresult
 BluetoothServiceBluedroid::RemoveDeviceInternal(
   const nsAString& aDeviceAddress, BluetoothReplyRunnable* aRunnable)
 {
   MOZ_ASSERT(NS_IsMainThread());
 
@@ -1318,16 +1318,19 @@ BluetoothServiceBluedroid::AdapterProper
       }
 
       propertyValue = sAdapterBondedAddressArray;
       BT_APPEND_NAMED_VALUE(props, "Devices", propertyValue);
 
     } else if (p.mType == PROPERTY_UUIDS) {
       //FIXME: This will be implemented in the later patchset
       continue;
+    } else if (p.mType == PROPERTY_UNKNOWN) {
+      /* Bug 1065999: working around unknown properties */
+      continue;
     } else {
       BT_LOGD("Unhandled adapter property type: %d", p.mType);
       continue;
     }
   }
 
   NS_ENSURE_TRUE_VOID(props.Length() > 0);
 
@@ -1410,16 +1413,18 @@ BluetoothServiceBluedroid::RemoteDeviceP
       }
 
       if (isCodInvalid) {
         BT_APPEND_NAMED_VALUE(props, "Class", cod);
         // 'audio-card' refers to 'Audio' device
         BT_APPEND_NAMED_VALUE(props, "Icon", NS_LITERAL_STRING("audio-card"));
       }
       BT_APPEND_NAMED_VALUE(props, "UUIDS", uuidsArray);
+    } else if (p.mType == PROPERTY_UNKNOWN) {
+      /* Bug 1065999: working around unknown properties */
     } else {
       BT_LOGD("Other non-handled device properties. Type: %d", p.mType);
     }
   }
 
   if (sRequestedDeviceCountArray.IsEmpty()) {
     // This is possible because the callback would be called after turning
     // Bluetooth on.
@@ -1470,16 +1475,18 @@ BluetoothServiceBluedroid::DeviceFoundNo
       uint32_t cod = p.mUint32;
       propertyValue = cod;
       BT_APPEND_NAMED_VALUE(propertiesArray, "Class", propertyValue);
 
       nsString icon;
       ClassToIcon(cod, icon);
       propertyValue = icon;
       BT_APPEND_NAMED_VALUE(propertiesArray, "Icon", propertyValue);
+    } else if (p.mType == PROPERTY_UNKNOWN) {
+      /* Bug 1065999: working around unknown properties */
     } else {
       BT_LOGD("Not handled remote device property: %d", p.mType);
     }
   }
 
   DistributeSignal(BluetoothSignal(NS_LITERAL_STRING("DeviceFound"),
                                    NS_LITERAL_STRING(KEY_ADAPTER),
                                    BluetoothValue(propertiesArray)));
--- a/dom/bluetooth2/BluetoothAdapter.cpp
+++ b/dom/bluetooth2/BluetoothAdapter.cpp
@@ -190,17 +190,16 @@ BluetoothAdapter::BluetoothAdapter(nsPID
                                    const BluetoothValue& aValue)
   : DOMEventTargetHelper(aWindow)
   , mState(BluetoothAdapterState::Disabled)
   , mDiscoverable(false)
   , mDiscovering(false)
   , mDiscoveryHandleInUse(nullptr)
 {
   MOZ_ASSERT(aWindow);
-  MOZ_ASSERT(IsDOMBinding());
 
   mPairingReqs = BluetoothPairingListener::Create(aWindow);
 
   const InfallibleTArray<BluetoothNamedValue>& values =
     aValue.get_ArrayOfBluetoothNamedValue();
   for (uint32_t i = 0; i < values.Length(); ++i) {
     SetPropertyByValue(values[i]);
   }
--- a/dom/bluetooth2/BluetoothClassOfDevice.cpp
+++ b/dom/bluetooth2/BluetoothClassOfDevice.cpp
@@ -39,17 +39,16 @@ NS_INTERFACE_MAP_END
 
 // Bit 7 ~ Bit 2: Minor device class
 #define GET_MINOR_DEVICE_CLASS(cod)  (((cod) & 0xfc) >> 2)
 
 BluetoothClassOfDevice::BluetoothClassOfDevice(nsPIDOMWindow* aOwner)
   : mOwnerWindow(aOwner)
 {
   MOZ_ASSERT(aOwner);
-  SetIsDOMBinding();
 
   Reset();
 }
 
 BluetoothClassOfDevice::~BluetoothClassOfDevice()
 {}
 
 void
--- a/dom/bluetooth2/BluetoothCommon.h
+++ b/dom/bluetooth2/BluetoothCommon.h
@@ -218,16 +218,17 @@ enum BluetoothBondState {
 
 enum BluetoothTypeOfDevice {
   TYPE_OF_DEVICE_BREDR,
   TYPE_OF_DEVICE_BLE,
   TYPE_OF_DEVICE_DUAL
 };
 
 enum BluetoothPropertyType {
+  PROPERTY_UNKNOWN,
   PROPERTY_BDNAME,
   PROPERTY_BDADDR,
   PROPERTY_UUIDS,
   PROPERTY_CLASS_OF_DEVICE,
   PROPERTY_TYPE_OF_DEVICE,
   PROPERTY_SERVICE_RECORD,
   PROPERTY_ADAPTER_SCAN_MODE,
   PROPERTY_ADAPTER_BONDED_DEVICES,
--- a/dom/bluetooth2/BluetoothDevice.cpp
+++ b/dom/bluetooth2/BluetoothDevice.cpp
@@ -73,17 +73,16 @@ private:
 
 BluetoothDevice::BluetoothDevice(nsPIDOMWindow* aWindow,
                                  const BluetoothValue& aValue)
   : DOMEventTargetHelper(aWindow)
   , mPaired(false)
   , mType(BluetoothDeviceType::Unknown)
 {
   MOZ_ASSERT(aWindow);
-  MOZ_ASSERT(IsDOMBinding());
 
   mCod = BluetoothClassOfDevice::Create(aWindow);
 
   const InfallibleTArray<BluetoothNamedValue>& values =
     aValue.get_ArrayOfBluetoothNamedValue();
   for (uint32_t i = 0; i < values.Length(); ++i) {
     SetPropertyByValue(values[i]);
   }
--- a/dom/bluetooth2/BluetoothDiscoveryHandle.cpp
+++ b/dom/bluetooth2/BluetoothDiscoveryHandle.cpp
@@ -19,17 +19,16 @@ NS_INTERFACE_MAP_END_INHERITING(DOMEvent
 
 NS_IMPL_ADDREF_INHERITED(BluetoothDiscoveryHandle, DOMEventTargetHelper)
 NS_IMPL_RELEASE_INHERITED(BluetoothDiscoveryHandle, DOMEventTargetHelper)
 
 BluetoothDiscoveryHandle::BluetoothDiscoveryHandle(nsPIDOMWindow* aWindow)
   : DOMEventTargetHelper(aWindow)
 {
   MOZ_ASSERT(aWindow);
-  MOZ_ASSERT(IsDOMBinding());
 }
 
 BluetoothDiscoveryHandle::~BluetoothDiscoveryHandle()
 {
 }
 
 // static
 already_AddRefed<BluetoothDiscoveryHandle>
--- a/dom/bluetooth2/BluetoothManager.cpp
+++ b/dom/bluetooth2/BluetoothManager.cpp
@@ -86,17 +86,16 @@ private:
   nsRefPtr<BluetoothManager> mManager;
 };
 
 BluetoothManager::BluetoothManager(nsPIDOMWindow *aWindow)
   : DOMEventTargetHelper(aWindow)
   , mDefaultAdapterIndex(-1)
 {
   MOZ_ASSERT(aWindow);
-  MOZ_ASSERT(IsDOMBinding());
 
   ListenToBluetoothSignal(true);
   BT_API2_LOGR("aWindow %p", aWindow);
 
   // Query adapters list from bluetooth backend
   BluetoothService* bs = BluetoothService::Get();
   NS_ENSURE_TRUE_VOID(bs);
 
--- a/dom/bluetooth2/BluetoothPairingHandle.cpp
+++ b/dom/bluetooth2/BluetoothPairingHandle.cpp
@@ -38,18 +38,16 @@ BluetoothPairingHandle::BluetoothPairing
   MOZ_ASSERT(aOwner && !aDeviceAddress.IsEmpty() && !aType.IsEmpty());
 
   if (aType.EqualsLiteral(PAIRING_REQ_TYPE_DISPLAYPASSKEY) ||
       aType.EqualsLiteral(PAIRING_REQ_TYPE_CONFIRMATION)) {
     MOZ_ASSERT(!aPasskey.IsEmpty());
   } else {
     MOZ_ASSERT(aPasskey.IsEmpty());
   }
-
-  SetIsDOMBinding();
 }
 
 BluetoothPairingHandle::~BluetoothPairingHandle()
 {
 }
 
 already_AddRefed<BluetoothPairingHandle>
 BluetoothPairingHandle::Create(nsPIDOMWindow* aOwner,
--- a/dom/bluetooth2/BluetoothPairingListener.cpp
+++ b/dom/bluetooth2/BluetoothPairingListener.cpp
@@ -16,17 +16,16 @@ NS_INTERFACE_MAP_END_INHERITING(DOMEvent
 
 NS_IMPL_ADDREF_INHERITED(BluetoothPairingListener, DOMEventTargetHelper)
 NS_IMPL_RELEASE_INHERITED(BluetoothPairingListener, DOMEventTargetHelper)
 
 BluetoothPairingListener::BluetoothPairingListener(nsPIDOMWindow* aWindow)
   : DOMEventTargetHelper(aWindow)
 {
   MOZ_ASSERT(aWindow);
-  MOZ_ASSERT(IsDOMBinding());
 }
 
 already_AddRefed<BluetoothPairingListener>
 BluetoothPairingListener::Create(nsPIDOMWindow* aWindow)
 {
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(aWindow);
 
--- a/dom/bluetooth2/bluedroid/BluetoothHALHelpers.cpp
+++ b/dom/bluetooth2/bluedroid/BluetoothHALHelpers.cpp
@@ -337,16 +337,19 @@ Convert(const bt_property_t& aIn, Blueto
   nsresult rv = Convert(aIn.type, aOut.mType);
   if (NS_FAILED(rv)) {
     return rv;
   }
 
   /* value conversion */
 
   switch (aOut.mType) {
+    case PROPERTY_UNKNOWN:
+      /* Bug 1065999: working around unknown properties */
+      break;
     case PROPERTY_BDNAME:
       /* fall through */
     case PROPERTY_REMOTE_FRIENDLY_NAME:
       {
         // We construct an nsCString here because bdname
         // returned from Bluedroid is not 0-terminated.
         aOut.mString = NS_ConvertUTF8toUTF16(
           nsCString(static_cast<char*>(aIn.val), aIn.len));
--- a/dom/bluetooth2/bluedroid/BluetoothHALHelpers.h
+++ b/dom/bluetooth2/bluedroid/BluetoothHALHelpers.h
@@ -200,17 +200,19 @@ Convert(bt_property_type_t aIn, Bluetoot
   };
   if (aIn == BT_PROPERTY_REMOTE_DEVICE_TIMESTAMP) {
     /* This case is handled separately to not populate
      * |sPropertyType| with empty entries. */
     aOut = PROPERTY_REMOTE_DEVICE_TIMESTAMP;
     return NS_OK;
   }
   if (!aIn || aIn >= MOZ_ARRAY_LENGTH(sPropertyType)) {
-    return NS_ERROR_ILLEGAL_VALUE;
+    /* Bug 1065999: working around unknown properties */
+    aOut = PROPERTY_UNKNOWN;
+    return NS_OK;
   }
   aOut = sPropertyType[aIn];
   return NS_OK;
 }
 
 inline nsresult
 Convert(bt_discovery_state_t aIn, bool& aOut)
 {
--- a/dom/bluetooth2/bluedroid/BluetoothServiceBluedroid.cpp
+++ b/dom/bluetooth2/bluedroid/BluetoothServiceBluedroid.cpp
@@ -1298,16 +1298,18 @@ BluetoothServiceBluedroid::AdapterProper
 
       nsTArray<nsString> pairedDeviceAddresses;
       for (size_t index = 0; index < p.mStringArray.Length(); index++) {
         pairedDeviceAddresses.AppendElement(p.mStringArray[index]);
       }
 
       BT_APPEND_NAMED_VALUE(propertiesArray, "PairedDevices", pairedDeviceAddresses);
 
+    } else if (p.mType == PROPERTY_UNKNOWN) {
+      /* Bug 1065999: working around unknown properties */
     } else {
       BT_LOGD("Unhandled adapter property type: %d", p.mType);
       continue;
     }
   }
 
   NS_ENSURE_TRUE_VOID(propertiesArray.Length() > 0);
 
@@ -1365,16 +1367,18 @@ BluetoothServiceBluedroid::RemoteDeviceP
         }
       }
       BT_APPEND_NAMED_VALUE(propertiesArray, "UUIDs", uuids);
 
     } else if (p.mType == PROPERTY_TYPE_OF_DEVICE) {
       BT_APPEND_NAMED_VALUE(propertiesArray, "Type",
                             static_cast<uint32_t>(p.mTypeOfDevice));
 
+    } else if (p.mType == PROPERTY_UNKNOWN) {
+      /* Bug 1065999: working around unknown properties */
     } else {
       BT_LOGD("Other non-handled device properties. Type: %d", p.mType);
     }
   }
 
   // The order of operations below is
   //
   //  (1) modify global state (i.e., the variables starting with 's'),
@@ -1462,16 +1466,18 @@ BluetoothServiceBluedroid::DeviceFoundNo
         }
       }
       BT_APPEND_NAMED_VALUE(propertiesArray, "UUIDs", uuids);
 
     } else if (p.mType == PROPERTY_TYPE_OF_DEVICE) {
       BT_APPEND_NAMED_VALUE(propertiesArray, "Type",
                             static_cast<uint32_t>(p.mTypeOfDevice));
 
+    } else if (p.mType == PROPERTY_UNKNOWN) {
+      /* Bug 1065999: working around unknown properties */
     } else {
       BT_LOGD("Not handled remote device property: %d", p.mType);
     }
   }
 
   DistributeSignal(BluetoothSignal(NS_LITERAL_STRING("DeviceFound"),
                                    NS_LITERAL_STRING(KEY_ADAPTER),
                                    BluetoothValue(propertiesArray)));
--- a/dom/camera/DOMCameraCapabilities.cpp
+++ b/dom/camera/DOMCameraCapabilities.cpp
@@ -52,17 +52,16 @@ CameraCapabilities::HasSupport(JSContext
 
 CameraCapabilities::CameraCapabilities(nsPIDOMWindow* aWindow)
   : mRecorderProfiles(JS::UndefinedValue())
   , mWindow(aWindow)
 {
   DOM_CAMERA_LOGT("%s:%d : this=%p\n", __func__, __LINE__, this);
   MOZ_COUNT_CTOR(CameraCapabilities);
   mozilla::HoldJSObjects(this);
-  SetIsDOMBinding();
 }
 
 CameraCapabilities::~CameraCapabilities()
 {
   DOM_CAMERA_LOGT("%s:%d : this=%p\n", __func__, __LINE__, this);
   mRecorderProfiles = JS::UndefinedValue();
   mozilla::DropJSObjects(this);
   MOZ_COUNT_DTOR(CameraCapabilities);
--- a/dom/camera/DOMCameraControl.cpp
+++ b/dom/camera/DOMCameraControl.cpp
@@ -175,17 +175,16 @@ nsDOMCameraControl::nsDOMCameraControl(u
   , mOnFacesDetectedCb(nullptr)
   , mWindow(aWindow)
   , mPreviewState(CameraControlListener::kPreviewStopped)
 {
   DOM_CAMERA_LOGT("%s:%d : this=%p\n", __func__, __LINE__, this);
   mInput = new CameraPreviewMediaStream(this);
 
   BindToOwner(aWindow);
-  SetIsDOMBinding();
 
   nsRefPtr<DOMCameraConfiguration> initialConfig =
     new DOMCameraConfiguration(aInitialConfig);
 
   // Create and initialize the underlying camera.
   ICameraControl::Configuration config;
   bool haveInitialConfig = false;
   nsresult rv;
--- a/dom/camera/DOMCameraDetectedFace.cpp
+++ b/dom/camera/DOMCameraDetectedFace.cpp
@@ -47,11 +47,9 @@ DOMCameraDetectedFace::DOMCameraDetected
     mLeftEye = new DOMPoint(this, aFace.leftEye.x, aFace.leftEye.y);
   }
   if (aFace.hasRightEye) {
     mRightEye = new DOMPoint(this, aFace.rightEye.x, aFace.rightEye.y);
   }
   if (aFace.hasMouth) {
     mMouth = new DOMPoint(this, aFace.mouth.x, aFace.mouth.y);
   }
-
-  SetIsDOMBinding();
 }
--- a/dom/camera/DOMCameraManager.cpp
+++ b/dom/camera/DOMCameraManager.cpp
@@ -56,17 +56,16 @@ GetCameraLog()
 nsDOMCameraManager::nsDOMCameraManager(nsPIDOMWindow* aWindow)
   : mWindowId(aWindow->WindowID())
   , mPermission(nsIPermissionManager::DENY_ACTION)
   , mWindow(aWindow)
 {
   /* member initializers and constructor code */
   DOM_CAMERA_LOGT("%s:%d : this=%p, windowId=%llx\n", __func__, __LINE__, this, mWindowId);
   MOZ_COUNT_CTOR(nsDOMCameraManager);
-  SetIsDOMBinding();
 }
 
 nsDOMCameraManager::~nsDOMCameraManager()
 {
   /* destructor code */
   MOZ_COUNT_DTOR(nsDOMCameraManager);
   DOM_CAMERA_LOGT("%s:%d : this=%p\n", __func__, __LINE__, this);
 }
--- a/dom/canvas/CanvasGradient.h
+++ b/dom/canvas/CanvasGradient.h
@@ -61,17 +61,16 @@ public:
     return mContext;
   }
 
 protected:
   CanvasGradient(CanvasRenderingContext2D* aContext, Type aType)
     : mContext(aContext)
     , mType(aType)
   {
-    SetIsDOMBinding();
   }
 
   nsRefPtr<CanvasRenderingContext2D> mContext;
   nsTArray<mozilla::gfx::GradientStop> mRawStops;
   mozilla::RefPtr<mozilla::gfx::GradientStops> mStops;
   Type mType;
   virtual ~CanvasGradient() {}
 };
--- a/dom/canvas/CanvasPattern.h
+++ b/dom/canvas/CanvasPattern.h
@@ -45,17 +45,16 @@ public:
     : mContext(aContext)
     , mSurface(aSurface)
     , mPrincipal(principalForSecurityCheck)
     , mTransform()
     , mForceWriteOnly(forceWriteOnly)
     , mCORSUsed(CORSUsed)
     , mRepeat(aRepeat)
   {
-    SetIsDOMBinding();
   }
 
   JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE
   {
     return CanvasPatternBinding::Wrap(aCx, this);
   }
 
   CanvasRenderingContext2D* GetParentObject()
--- a/dom/canvas/CanvasRenderingContext2D.cpp
+++ b/dom/canvas/CanvasRenderingContext2D.cpp
@@ -827,17 +827,16 @@ CanvasRenderingContext2D::CanvasRenderin
   , mResetLayer(true)
   , mIPC(false)
   , mStream(nullptr)
   , mIsEntireFrameInvalid(false)
   , mPredictManyRedrawCalls(false), mPathTransformWillUpdate(false)
   , mInvalidateCount(0)
 {
   sNumLivingContexts++;
-  SetIsDOMBinding();
 
   // The default is to use OpenGL mode
   if (!gfxPlatform::GetPlatform()->UseAcceleratedSkiaCanvas()) {
     mRenderingMode = RenderingMode::SoftwareBackendMode;
   }
 
 }
 
@@ -4945,26 +4944,22 @@ CanvasRenderingContext2D::ShouldForceIna
 NS_IMPL_CYCLE_COLLECTION_ROOT_NATIVE(CanvasPath, AddRef)
 NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(CanvasPath, Release)
 
 NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(CanvasPath, mParent)
 
 CanvasPath::CanvasPath(nsISupports* aParent)
   : mParent(aParent)
 {
-  SetIsDOMBinding();
-
   mPathBuilder = gfxPlatform::GetPlatform()->ScreenReferenceDrawTarget()->CreatePathBuilder();
 }
 
 CanvasPath::CanvasPath(nsISupports* aParent, TemporaryRef<PathBuilder> aPathBuilder)
   : mParent(aParent), mPathBuilder(aPathBuilder)
 {
-  SetIsDOMBinding();
-
   if (!mPathBuilder) {
     mPathBuilder = gfxPlatform::GetPlatform()->ScreenReferenceDrawTarget()->CreatePathBuilder();
   }
 }
 
 JSObject*
 CanvasPath::WrapObject(JSContext* aCx)
 {
--- a/dom/canvas/WebGLBuffer.cpp
+++ b/dom/canvas/WebGLBuffer.cpp
@@ -12,17 +12,16 @@
 
 using namespace mozilla;
 
 WebGLBuffer::WebGLBuffer(WebGLContext *context)
     : WebGLBindableName<BufferBinding>()
     , WebGLContextBoundObject(context)
     , mByteLength(0)
 {
-    SetIsDOMBinding();
     mContext->MakeContextCurrent();
     mContext->gl->fGenBuffers(1, &mGLName);
     mContext->mBuffers.insertBack(this);
 }
 
 WebGLBuffer::~WebGLBuffer() {
     DeleteOnce();
 }
--- a/dom/canvas/WebGLContext.cpp
+++ b/dom/canvas/WebGLContext.cpp
@@ -224,18 +224,16 @@ WebGLContextOptions::WebGLContextOptions
     if (Preferences::GetBool("webgl.default-no-alpha", false))
         alpha = false;
 }
 
 WebGLContext::WebGLContext()
     : gl(nullptr)
     , mNeedsFakeNoAlpha(false)
 {
-    SetIsDOMBinding();
-
     mGeneration = 0;
     mInvalidated = false;
     mShouldPresent = true;
     mResetLayer = true;
     mOptionsFrozen = false;
 
     mActiveTexture = 0;
     mPixelStoreFlipY = false;
--- a/dom/canvas/WebGLExtensionBase.cpp
+++ b/dom/canvas/WebGLExtensionBase.cpp
@@ -7,17 +7,16 @@
 #include "WebGLExtensions.h"
 
 using namespace mozilla;
 
 WebGLExtensionBase::WebGLExtensionBase(WebGLContext* context)
     : WebGLContextBoundObject(context)
     , mIsLost(false)
 {
-    SetIsDOMBinding();
 }
 
 WebGLExtensionBase::~WebGLExtensionBase()
 {
 }
 
 void
 WebGLExtensionBase::MarkLost()
--- a/dom/canvas/WebGLFramebuffer.cpp
+++ b/dom/canvas/WebGLFramebuffer.cpp
@@ -29,17 +29,16 @@ WebGLFramebuffer::WrapObject(JSContext* 
 WebGLFramebuffer::WebGLFramebuffer(WebGLContext* context)
     : WebGLBindableName<FBTarget>()
     , WebGLContextBoundObject(context)
     , mStatus(0)
     , mDepthAttachment(LOCAL_GL_DEPTH_ATTACHMENT)
     , mStencilAttachment(LOCAL_GL_STENCIL_ATTACHMENT)
     , mDepthStencilAttachment(LOCAL_GL_DEPTH_STENCIL_ATTACHMENT)
 {
-    SetIsDOMBinding();
     mContext->MakeContextCurrent();
     mContext->gl->fGenFramebuffers(1, &mGLName);
     mContext->mFramebuffers.insertBack(this);
 
     mColorAttachments.SetLength(1);
     mColorAttachments[0].mAttachmentPoint = LOCAL_GL_COLOR_ATTACHMENT0;
 }
 
--- a/dom/canvas/WebGLProgram.cpp
+++ b/dom/canvas/WebGLProgram.cpp
@@ -55,17 +55,16 @@ WebGLProgram::WebGLProgram(WebGLContext 
     : WebGLContextBoundObject(context)
     , mLinkStatus(false)
     , mGeneration(0)
     , mIdentifierMap(new CStringMap)
     , mIdentifierReverseMap(new CStringMap)
     , mUniformInfoMap(new CStringToUniformInfoMap)
     , mAttribMaxNameLength(0)
 {
-    SetIsDOMBinding();
     mContext->MakeContextCurrent();
     mGLName = mContext->gl->fCreateProgram();
     mContext->mPrograms.insertBack(this);
 }
 
 void
 WebGLProgram::Delete() {
     DetachShaders();
--- a/dom/canvas/WebGLQuery.cpp
+++ b/dom/canvas/WebGLQuery.cpp
@@ -16,17 +16,16 @@ WebGLQuery::WrapObject(JSContext *cx) {
     return dom::WebGLQueryBinding::Wrap(cx, this);
 }
 
 WebGLQuery::WebGLQuery(WebGLContext* context)
     : WebGLContextBoundObject(context)
     , mGLName(0)
     , mType(0)
 {
-    SetIsDOMBinding();
     mContext->mQueries.insertBack(this);
 
     mContext->MakeContextCurrent();
     mContext->gl->fGenQueries(1, &mGLName);
 }
 
 void WebGLQuery::Delete() {
     mContext->MakeContextCurrent();
--- a/dom/canvas/WebGLRenderbuffer.cpp
+++ b/dom/canvas/WebGLRenderbuffer.cpp
@@ -46,17 +46,16 @@ WebGLRenderbuffer::WebGLRenderbuffer(Web
     : WebGLBindableName<RBTarget>()
     , WebGLContextBoundObject(context)
     , mPrimaryRB(0)
     , mSecondaryRB(0)
     , mInternalFormat(0)
     , mInternalFormatForGL(0)
     , mImageDataStatus(WebGLImageDataStatus::NoImageData)
 {
-    SetIsDOMBinding();
     mContext->MakeContextCurrent();
 
     mContext->gl->fGenRenderbuffers(1, &mPrimaryRB);
     if (!SupportsDepthStencil(mContext->gl))
         mContext->gl->fGenRenderbuffers(1, &mSecondaryRB);
 
     mContext->mRenderbuffers.insertBack(this);
 }
--- a/dom/canvas/WebGLSampler.cpp
+++ b/dom/canvas/WebGLSampler.cpp
@@ -10,17 +10,16 @@
 
 #include "mozilla/dom/WebGL2RenderingContextBinding.h"
 
 using namespace mozilla;
 
 WebGLSampler::WebGLSampler(WebGLContext* context)
     : WebGLContextBoundObject(context)
 {
-    SetIsDOMBinding();
     MOZ_CRASH("Not Implemented.");
 }
 
 WebGLSampler::~WebGLSampler()
 {}
 
 void
 WebGLSampler::Delete()
--- a/dom/canvas/WebGLShader.cpp
+++ b/dom/canvas/WebGLShader.cpp
@@ -19,17 +19,16 @@ WebGLShader::WrapObject(JSContext *cx) {
 
 WebGLShader::WebGLShader(WebGLContext *context, GLenum stype)
     : WebGLContextBoundObject(context)
     , mType(stype)
     , mNeedsTranslation(true)
     , mAttribMaxNameLength(0)
     , mCompileStatus(false)
 {
-    SetIsDOMBinding();
     mContext->MakeContextCurrent();
     mGLName = mContext->gl->fCreateShader(mType);
     mContext->mShaders.insertBack(this);
 }
 
 void
 WebGLShader::Delete() {
     mSource.Truncate();
--- a/dom/canvas/WebGLTexture.cpp
+++ b/dom/canvas/WebGLTexture.cpp
@@ -30,17 +30,16 @@ WebGLTexture::WebGLTexture(WebGLContext 
     , mWrapS(LOCAL_GL_REPEAT)
     , mWrapT(LOCAL_GL_REPEAT)
     , mFacesCount(0)
     , mMaxLevelWithCustomImages(0)
     , mHaveGeneratedMipmap(false)
     , mImmutable(false)
     , mFakeBlackStatus(WebGLTextureFakeBlackStatus::IncompleteTexture)
 {
-    SetIsDOMBinding();
     mContext->MakeContextCurrent();
     mContext->gl->fGenTextures(1, &mGLName);
     mContext->mTextures.insertBack(this);
 }
 
 void
 WebGLTexture::Delete() {
     mImageInfos.Clear();
--- a/dom/canvas/WebGLTransformFeedback.cpp
+++ b/dom/canvas/WebGLTransformFeedback.cpp
@@ -10,17 +10,16 @@
 
 #include "mozilla/dom/WebGL2RenderingContextBinding.h"
 
 using namespace mozilla;
 
 WebGLTransformFeedback::WebGLTransformFeedback(WebGLContext* context)
     : WebGLContextBoundObject(context)
 {
-    SetIsDOMBinding();
     MOZ_CRASH("Not Implemented.");
 }
 
 WebGLTransformFeedback::~WebGLTransformFeedback()
 {}
 
 void
 WebGLTransformFeedback::Delete()
--- a/dom/canvas/WebGLVertexArray.cpp
+++ b/dom/canvas/WebGLVertexArray.cpp
@@ -18,17 +18,16 @@ JSObject*
 WebGLVertexArray::WrapObject(JSContext *cx) {
     return dom::WebGLVertexArrayBinding::Wrap(cx, this);
 }
 
 WebGLVertexArray::WebGLVertexArray(WebGLContext* context)
     : WebGLBindableName<VAOBinding>()
     , WebGLContextBoundObject(context)
 {
-    SetIsDOMBinding();
     context->mVertexArrays.insertBack(this);
 }
 
 WebGLVertexArray*
 WebGLVertexArray::Create(WebGLContext* context)
 {
     WebGLVertexArray* array;
     if (context->gl->IsSupported(gl::GLFeature::vertex_array_object)) {
--- a/dom/cellbroadcast/CellBroadcastMessage.cpp
+++ b/dom/cellbroadcast/CellBroadcastMessage.cpp
@@ -92,18 +92,16 @@ CellBroadcastMessage::CellBroadcastMessa
     mMessageClass.SetValue(
       ToWebidlEnum<CellBroadcastMessageClass>(aMessageClass));
   }
 
   // CdmaServiceCategory represents a 16bit unsigned value.
   if (aCdmaServiceCategory <= 0xFFFFU) {
     mCdmaServiceCategory.SetValue(static_cast<uint16_t>(aCdmaServiceCategory));
   }
-
-  SetIsDOMBinding();
 }
 
 JSObject*
 CellBroadcastMessage::WrapObject(JSContext* aCx)
 {
   return MozCellBroadcastMessageBinding::Wrap(aCx, this);
 }
 
@@ -135,18 +133,16 @@ CellBroadcastEtwsInfo::CellBroadcastEtws
   : mWindow(aWindow)
   , mEmergencyUserAlert(aEmergencyUserAlert)
   , mPopup(aPopup)
 {
   if (aWarningType < nsICellBroadcastService::GSM_ETWS_WARNING_INVALID) {
     mWarningType.SetValue(
       ToWebidlEnum<CellBroadcastEtwsWarningType>(aWarningType));
   }
-
-  SetIsDOMBinding();
 }
 
 JSObject*
 CellBroadcastEtwsInfo::WrapObject(JSContext* aCx)
 {
   return MozCellBroadcastEtwsInfoBinding::Wrap(aCx, this);
 }
 
--- a/dom/crypto/CryptoKey.cpp
+++ b/dom/crypto/CryptoKey.cpp
@@ -50,17 +50,16 @@ StringToUsage(const nsString& aUsage, Cr
 
 CryptoKey::CryptoKey(nsIGlobalObject* aGlobal)
   : mGlobal(aGlobal)
   , mAttributes(0)
   , mSymKey()
   , mPrivateKey(nullptr)
   , mPublicKey(nullptr)
 {
-  SetIsDOMBinding();
 }
 
 CryptoKey::~CryptoKey()
 {
   nsNSSShutDownPreventionLock locker;
   if (isAlreadyShutDown()) {
     return;
   }
--- a/dom/events/CompositionEvent.cpp
+++ b/dom/events/CompositionEvent.cpp
@@ -27,17 +27,18 @@ CompositionEvent::CompositionEvent(Event
     mEvent->time = PR_Now();
 
     // XXX compositionstart is cancelable in draft of DOM3 Events.
     //     However, it doesn't make sence for us, we cannot cancel composition
     //     when we sends compositionstart event.
     mEvent->mFlags.mCancelable = false;
   }
 
-  mData = mEvent->AsCompositionEvent()->data;
+  // XXX Do we really need to duplicate the data value?
+  mData = mEvent->AsCompositionEvent()->mData;
   // TODO: Native event should have locale information.
 }
 
 NS_IMPL_ADDREF_INHERITED(CompositionEvent, UIEvent)
 NS_IMPL_RELEASE_INHERITED(CompositionEvent, UIEvent)
 
 NS_INTERFACE_MAP_BEGIN(CompositionEvent)
   NS_INTERFACE_MAP_ENTRY(nsIDOMCompositionEvent)
--- a/dom/events/DOMEventTargetHelper.h
+++ b/dom/events/DOMEventTargetHelper.h
@@ -37,27 +37,23 @@ public:
   {
   }
   explicit DOMEventTargetHelper(nsPIDOMWindow* aWindow)
     : mParentObject(nullptr)
     , mOwnerWindow(nullptr)
     , mHasOrHasHadOwnerWindow(false)
   {
     BindToOwner(aWindow);
-    // All objects coming through here are WebIDL objects
-    SetIsDOMBinding();
   }
   explicit DOMEventTargetHelper(DOMEventTargetHelper* aOther)
     : mParentObject(nullptr)
     , mOwnerWindow(nullptr)
     , mHasOrHasHadOwnerWindow(false)
   {
     BindToOwner(aOther);
-    // All objects coming through here are WebIDL objects
-    SetIsDOMBinding();
   }
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SKIPPABLE_SCRIPT_HOLDER_CLASS(DOMEventTargetHelper)
 
   NS_DECL_NSIDOMEVENTTARGET
 
   virtual EventListenerManager* GetExistingListenerManager() const MOZ_OVERRIDE;
--- a/dom/events/DataTransfer.cpp
+++ b/dom/events/DataTransfer.cpp
@@ -78,17 +78,16 @@ DataTransfer::DataTransfer(nsISupports* 
     mIsExternal(aIsExternal),
     mUserCancelled(false),
     mIsCrossDomainSubFrameDrop(false),
     mClipboardType(aClipboardType),
     mDragImageX(0),
     mDragImageY(0)
 {
   MOZ_ASSERT(mParent);
-  SetIsDOMBinding();
   // For these events, we want to be able to add data to the data transfer, so
   // clear the readonly state. Otherwise, the data is already present. For
   // external usage, cache the data from the native clipboard or drag.
   if (aEventType == NS_CUT ||
       aEventType == NS_COPY ||
       aEventType == NS_DRAGDROP_START ||
       aEventType == NS_DRAGDROP_GESTURE) {
     mReadOnly = false;
@@ -124,17 +123,16 @@ DataTransfer::DataTransfer(nsISupports* 
     mIsCrossDomainSubFrameDrop(aIsCrossDomainSubFrameDrop),
     mClipboardType(aClipboardType),
     mItems(aItems),
     mDragImage(aDragImage),
     mDragImageX(aDragImageX),
     mDragImageY(aDragImageY)
 {
   MOZ_ASSERT(mParent);
-  SetIsDOMBinding();
   // The items are copied from aItems into mItems. There is no need to copy
   // the actual data in the items as the data transfer will be read only. The
   // draggesture and dragstart events are the only times when items are
   // modifiable, but those events should have been using the first constructor
   // above.
   NS_ASSERTION(aEventType != NS_DRAGDROP_GESTURE &&
                aEventType != NS_DRAGDROP_START,
                "invalid event type for DataTransfer constructor");
--- a/dom/events/DeviceMotionEvent.cpp
+++ b/dom/events/DeviceMotionEvent.cpp
@@ -104,17 +104,16 @@ DeviceAcceleration::DeviceAcceleration(D
                                        Nullable<double> aX,
                                        Nullable<double> aY,
                                        Nullable<double> aZ)
   : mOwner(aOwner)
   , mX(aX)
   , mY(aY)
   , mZ(aZ)
 {
-  SetIsDOMBinding();
 }
 
 DeviceAcceleration::~DeviceAcceleration()
 {
 }
 
 /******************************************************************************
  * DeviceRotationRate
@@ -129,17 +128,16 @@ DeviceRotationRate::DeviceRotationRate(D
                                        Nullable<double> aAlpha,
                                        Nullable<double> aBeta,
                                        Nullable<double> aGamma)
   : mOwner(aOwner)
   , mAlpha(aAlpha)
   , mBeta(aBeta)
   , mGamma(aGamma)
 {
-  SetIsDOMBinding();
 }
 
 DeviceRotationRate::~DeviceRotationRate()
 {
 }
 
 } // namespace dom
 } // namespace mozilla
--- a/dom/events/Event.cpp
+++ b/dom/events/Event.cpp
@@ -57,17 +57,16 @@ Event::Event(nsPIDOMWindow* aParent)
   ConstructorInit(static_cast<nsGlobalWindow *>(aParent), nullptr, nullptr);
 }
 
 void
 Event::ConstructorInit(EventTarget* aOwner,
                        nsPresContext* aPresContext,
                        WidgetEvent* aEvent)
 {
-  SetIsDOMBinding();
   SetOwner(aOwner);
   mIsMainThreadEvent = mOwner || NS_IsMainThread();
   if (mIsMainThreadEvent) {
     nsJSContext::LikelyShortLivingObjectCreated();
   }
 
   if (mIsMainThreadEvent && !sReturnHighResTimeStampIsSet) {
     Preferences::AddBoolVarCache(&sReturnHighResTimeStamp,
--- a/dom/events/EventDispatcher.cpp
+++ b/dom/events/EventDispatcher.cpp
@@ -717,19 +717,16 @@ EventDispatcher::CreateEvent(EventTarget
       return NS_NewDOMWheelEvent(aDOMEvent, aOwner, aPresContext,
                                  aEvent->AsWheelEvent());
     case eEditorInputEventClass:
       return NS_NewDOMInputEvent(aDOMEvent, aOwner, aPresContext,
                                  aEvent->AsEditorInputEvent());
     case eDragEventClass:
       return NS_NewDOMDragEvent(aDOMEvent, aOwner, aPresContext,
                                 aEvent->AsDragEvent());
-    case eTextEventClass:
-      return NS_NewDOMUIEvent(aDOMEvent, aOwner, aPresContext,
-                              aEvent->AsTextEvent());
     case eClipboardEventClass:
       return NS_NewDOMClipboardEvent(aDOMEvent, aOwner, aPresContext,
                                      aEvent->AsClipboardEvent());
     case eSVGZoomEventClass:
       return NS_NewDOMSVGZoomEvent(aDOMEvent, aOwner, aPresContext,
                                    aEvent->AsSVGZoomEvent());
     case eSMILTimeEventClass:
       return NS_NewDOMTimeEvent(aDOMEvent, aOwner, aPresContext,
@@ -767,24 +764,24 @@ EventDispatcher::CreateEvent(EventTarget
   if (aEventType.LowerCaseEqualsLiteral("mousescrollevents"))
     return NS_NewDOMMouseScrollEvent(aDOMEvent, aOwner, aPresContext, nullptr);
   if (aEventType.LowerCaseEqualsLiteral("dragevent") ||
       aEventType.LowerCaseEqualsLiteral("dragevents"))
     return NS_NewDOMDragEvent(aDOMEvent, aOwner, aPresContext, nullptr);
   if (aEventType.LowerCaseEqualsLiteral("keyboardevent") ||
       aEventType.LowerCaseEqualsLiteral("keyevents"))
     return NS_NewDOMKeyboardEvent(aDOMEvent, aOwner, aPresContext, nullptr);
-  if (aEventType.LowerCaseEqualsLiteral("compositionevent"))
+  if (aEventType.LowerCaseEqualsLiteral("compositionevent") ||
+      aEventType.LowerCaseEqualsLiteral("textevent") ||
+      aEventType.LowerCaseEqualsLiteral("textevents")) {
     return NS_NewDOMCompositionEvent(aDOMEvent, aOwner, aPresContext, nullptr);
+  }
   if (aEventType.LowerCaseEqualsLiteral("mutationevent") ||
         aEventType.LowerCaseEqualsLiteral("mutationevents"))
     return NS_NewDOMMutationEvent(aDOMEvent, aOwner, aPresContext, nullptr);
-  if (aEventType.LowerCaseEqualsLiteral("textevent") ||
-      aEventType.LowerCaseEqualsLiteral("textevents"))
-    return NS_NewDOMUIEvent(aDOMEvent, aOwner, aPresContext, nullptr);
   if (aEventType.LowerCaseEqualsLiteral("deviceorientationevent")) {
     DeviceOrientationEventInit init;
     nsRefPtr<DeviceOrientationEvent> event =
       DeviceOrientationEvent::Constructor(aOwner, EmptyString(), init);
     event.forget(aDOMEvent);
     return NS_OK;
   }
   if (aEventType.LowerCaseEqualsLiteral("devicemotionevent"))
--- a/dom/events/EventNameList.h
+++ b/dom/events/EventNameList.h
@@ -646,20 +646,24 @@ NON_IDL_EVENT(warning,
               eBasicEventClass)
 
 NON_IDL_EVENT(speakerforcedchange,
               NS_SPEAKERMANAGER_SPEAKERFORCEDCHANGE,
               EventNameType_None,
               eBasicEventClass)
 
 // Events that only have on* attributes on XUL elements
+
+ // "text" event is legacy event for modifying composition string in nsEditor.
+ // This shouldn't be used by web/xul apps.  "compositionupdate" should be
+ // used instead.
 NON_IDL_EVENT(text,
-              NS_TEXT_TEXT,
+              NS_COMPOSITION_CHANGE,
               EventNameType_XUL,
-              eTextEventClass)
+              eCompositionEventClass)
 NON_IDL_EVENT(compositionstart,
               NS_COMPOSITION_START,
               EventNameType_XUL,
               eCompositionEventClass)
 NON_IDL_EVENT(compositionupdate,
               NS_COMPOSITION_UPDATE,
               EventNameType_XUL,
               eCompositionEventClass)
--- a/dom/events/EventStateManager.cpp
+++ b/dom/events/EventStateManager.cpp
@@ -791,41 +791,30 @@ EventStateManager::PreHandleEvent(nsPres
       DoContentCommandEvent(aEvent->AsContentCommandEvent());
     }
     break;
   case NS_CONTENT_COMMAND_SCROLL:
     {
       DoContentCommandScrollEvent(aEvent->AsContentCommandEvent());
     }
     break;
-  case NS_TEXT_TEXT:
-    {
-      WidgetTextEvent *textEvent = aEvent->AsTextEvent();
-      if (IsTargetCrossProcess(textEvent)) {
-        // Will not be handled locally, remote the event
-        if (GetCrossProcessTarget()->SendTextEvent(*textEvent)) {
-          // Cancel local dispatching
-          aEvent->mFlags.mPropagationStopped = true;
-        }
-      }
-    }
-    break;
   case NS_COMPOSITION_START:
     if (aEvent->mFlags.mIsTrusted) {
       // If the event is trusted event, set the selected text to data of
       // composition event.
       WidgetCompositionEvent* compositionEvent = aEvent->AsCompositionEvent();
       WidgetQueryContentEvent selectedText(true, NS_QUERY_SELECTED_TEXT,
                                            compositionEvent->widget);
       DoQuerySelectedText(&selectedText);
       NS_ASSERTION(selectedText.mSucceeded, "Failed to get selected text");
-      compositionEvent->data = selectedText.mReply.mString;
+      compositionEvent->mData = selectedText.mReply.mString;
     }
     // through to compositionend handling
   case NS_COMPOSITION_END:
+  case NS_COMPOSITION_CHANGE:
     {
       WidgetCompositionEvent* compositionEvent = aEvent->AsCompositionEvent();
       if (IsTargetCrossProcess(compositionEvent)) {
         // Will not be handled locally, remote the event
         if (GetCrossProcessTarget()->SendCompositionEvent(*compositionEvent)) {
           // Cancel local dispatching
           aEvent->mFlags.mPropagationStopped = true;
         }
--- a/dom/events/IMEStateManager.cpp
+++ b/dom/events/IMEStateManager.cpp
@@ -126,40 +126,27 @@ GetIMEStateSetOpenName(IMEState::Open aO
     case IMEState::CLOSED:
       return "CLOSED";
     default:
       return "illegal value";
   }
 }
 
 static const char*
-GetEventClassIDName(EventClassID aEventClassID)
-{
-  switch (aEventClassID) {
-    case eCompositionEventClass:
-      return "eCompositionEventClass";
-    case eTextEventClass:
-      return "eTextEventClass";
-    default:
-      return "unacceptable event struct type";
-  }
-}
-
-static const char*
 GetEventMessageName(uint32_t aMessage)
 {
   switch (aMessage) {
     case NS_COMPOSITION_START:
       return "NS_COMPOSITION_START";
     case NS_COMPOSITION_END:
       return "NS_COMPOSITION_END";
     case NS_COMPOSITION_UPDATE:
       return "NS_COMPOSITION_UPDATE";
-    case NS_TEXT_TEXT:
-      return "NS_TEXT_TEXT";
+    case NS_COMPOSITION_CHANGE:
+      return "NS_COMPOSITION_CHANGE";
     default:
       return "unacceptable event message";
   }
 }
 
 static const char*
 GetNotifyIMEMessageName(IMEMessage aMessage)
 {
@@ -878,130 +865,126 @@ IMEStateManager::EnsureTextCompositionAr
   if (sTextCompositions) {
     return;
   }
   sTextCompositions = new TextCompositionArray();
 }
 
 // static
 void
-IMEStateManager::DispatchCompositionEvent(nsINode* aEventTargetNode,
-                                          nsPresContext* aPresContext,
-                                          WidgetEvent* aEvent,
-                                          nsEventStatus* aStatus,
-                                          EventDispatchingCallback* aCallBack,
-                                          bool aIsSynthesized)
+IMEStateManager::DispatchCompositionEvent(
+                   nsINode* aEventTargetNode,
+                   nsPresContext* aPresContext,
+                   WidgetCompositionEvent* aCompositionEvent,
+                   nsEventStatus* aStatus,
+                   EventDispatchingCallback* aCallBack,
+                   bool aIsSynthesized)
 {
   PR_LOG(sISMLog, PR_LOG_ALWAYS,
     ("ISM: IMEStateManager::DispatchCompositionEvent(aNode=0x%p, "
-     "aPresContext=0x%p, aEvent={ mClass=%s, message=%s, "
+     "aPresContext=0x%p, aCompositionEvent={ message=%s, "
      "mFlags={ mIsTrusted=%s, mPropagationStopped=%s } }, "
      "aIsSynthesized=%s)",
      aEventTargetNode, aPresContext,
-     GetEventClassIDName(aEvent->mClass),
-     GetEventMessageName(aEvent->message),
-     GetBoolName(aEvent->mFlags.mIsTrusted),
-     GetBoolName(aEvent->mFlags.mPropagationStopped),
+     GetEventMessageName(aCompositionEvent->message),
+     GetBoolName(aCompositionEvent->mFlags.mIsTrusted),
+     GetBoolName(aCompositionEvent->mFlags.mPropagationStopped),
      GetBoolName(aIsSynthesized)));
 
-  MOZ_ASSERT(aEvent->mClass == eCompositionEventClass ||
-             aEvent->mClass == eTextEventClass);
-  if (!aEvent->mFlags.mIsTrusted || aEvent->mFlags.mPropagationStopped) {
+  if (!aCompositionEvent->mFlags.mIsTrusted ||
+      aCompositionEvent->mFlags.mPropagationStopped) {
     return;
   }
 
-  MOZ_ASSERT(aEvent->message != NS_COMPOSITION_UPDATE,
+  MOZ_ASSERT(aCompositionEvent->message != NS_COMPOSITION_UPDATE,
              "compositionupdate event shouldn't be dispatched manually");
 
   EnsureTextCompositionArray();
 
-  WidgetGUIEvent* GUIEvent = aEvent->AsGUIEvent();
-
   nsRefPtr<TextComposition> composition =
-    sTextCompositions->GetCompositionFor(GUIEvent->widget);
+    sTextCompositions->GetCompositionFor(aCompositionEvent->widget);
   if (!composition) {
     // If synthesized event comes after delayed native composition events
     // for request of commit or cancel, we should ignore it.
     if (NS_WARN_IF(aIsSynthesized)) {
       return;
     }
     PR_LOG(sISMLog, PR_LOG_DEBUG,
       ("ISM:   IMEStateManager::DispatchCompositionEvent(), "
        "adding new TextComposition to the array"));
-    MOZ_ASSERT(GUIEvent->message == NS_COMPOSITION_START);
-    composition = new TextComposition(aPresContext, aEventTargetNode, GUIEvent);
+    MOZ_ASSERT(aCompositionEvent->message == NS_COMPOSITION_START);
+    composition =
+      new TextComposition(aPresContext, aEventTargetNode, aCompositionEvent);
     sTextCompositions->AppendElement(composition);
   }
 #ifdef DEBUG
   else {
-    MOZ_ASSERT(GUIEvent->message != NS_COMPOSITION_START);
+    MOZ_ASSERT(aCompositionEvent->message != NS_COMPOSITION_START);
   }
 #endif // #ifdef DEBUG
 
   // Dispatch the event on composing target.
-  composition->DispatchEvent(GUIEvent, aStatus, aCallBack, aIsSynthesized);
+  composition->DispatchCompositionEvent(aCompositionEvent, aStatus, aCallBack,
+                                        aIsSynthesized);
 
   // WARNING: the |composition| might have been destroyed already.
 
   // Remove the ended composition from the array.
   // NOTE: When TextComposition is synthesizing compositionend event for
   //       emulating a commit, the instance shouldn't be removed from the array
   //       because IME may perform it later.  Then, we need to ignore the
   //       following commit events in TextComposition::DispatchEvent().
   //       However, if commit or cancel for a request is performed synchronously
   //       during not safe to dispatch events, PresShell must have discarded
   //       compositionend event.  Then, the synthesized compositionend event is
   //       the last event for the composition.  In this case, we need to
   //       destroy the TextComposition with synthesized compositionend event.
   if ((!aIsSynthesized ||
        composition->WasNativeCompositionEndEventDiscarded()) &&
-      aEvent->message == NS_COMPOSITION_END) {
+      aCompositionEvent->message == NS_COMPOSITION_END) {
     TextCompositionArray::index_type i =
-      sTextCompositions->IndexOf(GUIEvent->widget);
+      sTextCompositions->IndexOf(aCompositionEvent->widget);
     if (i != TextCompositionArray::NoIndex) {
       PR_LOG(sISMLog, PR_LOG_DEBUG,
         ("ISM:   IMEStateManager::DispatchCompositionEvent(), "
          "removing TextComposition from the array since NS_COMPOSTION_END "
          "was dispatched"));
       sTextCompositions->ElementAt(i)->Destroy();
       sTextCompositions->RemoveElementAt(i);
     }
   }
 }
 
 // static
 void
-IMEStateManager::OnCompositionEventDiscarded(WidgetEvent* aEvent)
+IMEStateManager::OnCompositionEventDiscarded(
+                   const WidgetCompositionEvent* aCompositionEvent)
 {
   // Note that this method is never called for synthesized events for emulating
   // commit or cancel composition.
 
   PR_LOG(sISMLog, PR_LOG_ALWAYS,
-    ("ISM: IMEStateManager::OnCompositionEventDiscarded(aEvent={ mClass=%s, "
+    ("ISM: IMEStateManager::OnCompositionEventDiscarded(aCompositionEvent={ "
      "message=%s, mFlags={ mIsTrusted=%s } })",
-     GetEventClassIDName(aEvent->mClass),
-     GetEventMessageName(aEvent->message),
-     GetBoolName(aEvent->mFlags.mIsTrusted)));
+     GetEventMessageName(aCompositionEvent->message),
+     GetBoolName(aCompositionEvent->mFlags.mIsTrusted)));
 
-  MOZ_ASSERT(aEvent->mClass == eCompositionEventClass ||
-             aEvent->mClass == eTextEventClass);
-  if (!aEvent->mFlags.mIsTrusted) {
+  if (!aCompositionEvent->mFlags.mIsTrusted) {
     return;
   }
 
   // Ignore compositionstart for now because sTextCompositions may not have
   // been created yet.
-  if (aEvent->message == NS_COMPOSITION_START) {
+  if (aCompositionEvent->message == NS_COMPOSITION_START) {
     return;
   }
 
-  WidgetGUIEvent* GUIEvent = aEvent->AsGUIEvent();
   nsRefPtr<TextComposition> composition =
-    sTextCompositions->GetCompositionFor(GUIEvent->widget);
-  composition->OnCompositionEventDiscarded(GUIEvent);
+    sTextCompositions->GetCompositionFor(aCompositionEvent->widget);
+  composition->OnCompositionEventDiscarded(aCompositionEvent);
 }
 
 // static
 nsresult
 IMEStateManager::NotifyIME(IMEMessage aMessage,
                            nsIWidget* aWidget)
 {
   nsRefPtr<TextComposition> composition;
@@ -1226,18 +1209,16 @@ IMEStateManager::GetTextCompositionFor(n
   }
   nsRefPtr<TextComposition> textComposition =
     sTextCompositions->GetCompositionFor(aWidget);
   return textComposition.forget();
 }
 
 // static
 already_AddRefed<TextComposition>
-IMEStateManager::GetTextCompositionFor(WidgetGUIEvent* aEvent)
+IMEStateManager::GetTextCompositionFor(WidgetGUIEvent* aGUIEvent)
 {
-  MOZ_ASSERT(aEvent->AsCompositionEvent() || aEvent->AsTextEvent() ||
-             aEvent->AsKeyboardEvent(),
-             "aEvent has to be WidgetCompositionEvent, WidgetTextEvent or "
-             "WidgetKeyboardEvent");
-  return GetTextCompositionFor(aEvent->widget);
+  MOZ_ASSERT(aGUIEvent->AsCompositionEvent() || aGUIEvent->AsKeyboardEvent(),
+    "aGUIEvent has to be WidgetCompositionEvent or WidgetKeyboardEvent");
+  return GetTextCompositionFor(aGUIEvent->widget);
 }
 
 } // namespace mozilla
--- a/dom/events/IMEStateManager.h
+++ b/dom/events/IMEStateManager.h
@@ -87,49 +87,49 @@ public:
   // aContent must be:
   //   If the editor is for <input> or <textarea>, the element.
   //   If the editor is for contenteditable, the active editinghost.
   //   If the editor is for designMode, nullptr.
   static void OnFocusInEditor(nsPresContext* aPresContext,
                               nsIContent* aContent);
 
   /**
-   * All DOM composition events and DOM text events must be dispatched via
-   * DispatchCompositionEvent() for storing the composition target
-   * and ensuring a set of composition events must be fired the stored target.
-   * If the stored composition event target is destroying, this removes the
-   * stored composition automatically.
+   * All composition events must be dispatched via DispatchCompositionEvent()
+   * for storing the composition target and ensuring a set of composition
+   * events must be fired the stored target.  If the stored composition event
+   * target is destroying, this removes the stored composition automatically.
    */
-  static void DispatchCompositionEvent(nsINode* aEventTargetNode,
-                                       nsPresContext* aPresContext,
-                                       WidgetEvent* aEvent,
-                                       nsEventStatus* aStatus,
-                                       EventDispatchingCallback* aCallBack,
-                                       bool aIsSynthesized = false);
+  static void DispatchCompositionEvent(
+                nsINode* aEventTargetNode,
+                nsPresContext* aPresContext,
+                WidgetCompositionEvent* aCompositionEvent,
+                nsEventStatus* aStatus,
+                EventDispatchingCallback* aCallBack,
+                bool aIsSynthesized = false);
 
   /**
-   * This is called when PresShell ignores composition event or text event due
-   * to not safe to dispatch events.
+   * This is called when PresShell ignores a composition event due to not safe
+   * to dispatch events.
    */
-  static void OnCompositionEventDiscarded(WidgetEvent* aEvent);
+  static void OnCompositionEventDiscarded(
+                const WidgetCompositionEvent* aCompositionEvent);
 
   /**
    * Get TextComposition from widget.
    */
   static already_AddRefed<TextComposition>
     GetTextCompositionFor(nsIWidget* aWidget);
 
   /**
    * Returns TextComposition instance for the event.
    *
-   * @param aEvent      Should be a composition event or a text event which is
-   *                    being dispatched.
+   * @param aGUIEvent Should be a composition event which is being dispatched.
    */
   static already_AddRefed<TextComposition>
-    GetTextCompositionFor(WidgetGUIEvent* aEvent);
+    GetTextCompositionFor(WidgetGUIEvent* aGUIEvent);
 
   /**
    * Send a notification to IME.  It depends on the IME or platform spec what
    * will occur (or not occur).
    */
   static nsresult NotifyIME(IMEMessage aMessage, nsIWidget* aWidget);
   static nsresult NotifyIME(IMEMessage aMessage, nsPresContext* aPresContext);
 
--- a/dom/events/ImageCaptureError.cpp
+++ b/dom/events/ImageCaptureError.cpp
@@ -19,17 +19,16 @@ NS_INTERFACE_MAP_END
 
 ImageCaptureError::ImageCaptureError(nsISupports* aParent,
                                      uint16_t aCode,
                                      const nsAString& aMessage)
   : mParent(aParent)
   , mMessage(aMessage)
   , mCode(aCode)
 {
-  SetIsDOMBinding();
 }
 
 ImageCaptureError::~ImageCaptureError()
 {
 }
 
 nsISupports*
 ImageCaptureError::GetParentObject() const
--- a/dom/events/PaintRequest.h
+++ b/dom/events/PaintRequest.h
@@ -20,17 +20,16 @@ class DOMRect;
 class PaintRequest MOZ_FINAL : public nsIDOMPaintRequest
                              , public nsWrapperCache
 {
 public:
   explicit PaintRequest(nsIDOMEvent* aParent)
     : mParent(aParent)
   {
     mRequest.mFlags = 0;
-    SetIsDOMBinding();
   }
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(PaintRequest)
   NS_DECL_NSIDOMPAINTREQUEST
 
   virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
 
@@ -56,17 +55,16 @@ private:
 };
 
 class PaintRequestList MOZ_FINAL : public nsISupports,
                                    public nsWrapperCache
 {
 public:
   explicit PaintRequestList(nsIDOMEvent *aParent) : mParent(aParent)
   {
-    SetIsDOMBinding();
   }
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(PaintRequestList)
   
   virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
   nsISupports* GetParentObject()
   {
--- a/dom/events/TextComposition.cpp
+++ b/dom/events/TextComposition.cpp
@@ -24,23 +24,24 @@ namespace mozilla {
 #define IDEOGRAPHIC_SPACE (NS_LITERAL_STRING("\x3000"))
 
 /******************************************************************************
  * TextComposition
  ******************************************************************************/
 
 TextComposition::TextComposition(nsPresContext* aPresContext,
                                  nsINode* aNode,
-                                 WidgetGUIEvent* aEvent)
+                                 WidgetCompositionEvent* aCompositionEvent)
   : mPresContext(aPresContext)
   , mNode(aNode)
-  , mNativeContext(aEvent->widget->GetInputContext().mNativeIMEContext)
+  , mNativeContext(
+      aCompositionEvent->widget->GetInputContext().mNativeIMEContext)
   , mCompositionStartOffset(0)
   , mCompositionTargetOffset(0)
-  , mIsSynthesizedForTests(aEvent->mFlags.mIsSynthesizedForTests)
+  , mIsSynthesizedForTests(aCompositionEvent->mFlags.mIsSynthesizedForTests)
   , mIsComposing(false)
   , mIsEditorHandlingEvent(false)
   , mIsRequestingCommit(false)
   , mIsRequestingCancel(false)
   , mRequestedToCommitOrCancel(false)
   , mWasNativeCompositionEndEventDiscarded(false)
 {
 }
@@ -56,69 +57,70 @@ TextComposition::Destroy()
 
 bool
 TextComposition::MatchesNativeContext(nsIWidget* aWidget) const
 {
   return mNativeContext == aWidget->GetInputContext().mNativeIMEContext;
 }
 
 bool
-TextComposition::MaybeDispatchCompositionUpdate(const WidgetTextEvent* aEvent)
+TextComposition::MaybeDispatchCompositionUpdate(
+                   const WidgetCompositionEvent* aCompositionEvent)
 {
   if (Destroyed()) {
     return false;
   }
 
-  if (mLastData == aEvent->theText) {
+  if (mLastData == aCompositionEvent->mData) {
     return true;
   }
 
-  WidgetCompositionEvent compositionUpdate(aEvent->mFlags.mIsTrusted,
+  WidgetCompositionEvent compositionUpdate(aCompositionEvent->mFlags.mIsTrusted,
                                            NS_COMPOSITION_UPDATE,
-                                           aEvent->widget);
-  compositionUpdate.time = aEvent->time;
-  compositionUpdate.timeStamp = aEvent->timeStamp;
-  compositionUpdate.data = aEvent->theText;
+                                           aCompositionEvent->widget);
+  compositionUpdate.time = aCompositionEvent->time;
+  compositionUpdate.timeStamp = aCompositionEvent->timeStamp;
+  compositionUpdate.mData = aCompositionEvent->mData;
   compositionUpdate.mFlags.mIsSynthesizedForTests =
-    aEvent->mFlags.mIsSynthesizedForTests;
+    aCompositionEvent->mFlags.mIsSynthesizedForTests;
 
   nsEventStatus status = nsEventStatus_eConsumeNoDefault;
-  mLastData = compositionUpdate.data;
+  mLastData = compositionUpdate.mData;
   EventDispatcher::Dispatch(mNode, mPresContext,
                             &compositionUpdate, nullptr, &status, nullptr);
   return !Destroyed();
 }
 
 void
-TextComposition::OnCompositionEventDiscarded(const WidgetGUIEvent* aEvent)
+TextComposition::OnCompositionEventDiscarded(
+                   const WidgetCompositionEvent* aCompositionEvent)
 {
   // Note that this method is never called for synthesized events for emulating
   // commit or cancel composition.
 
-  MOZ_ASSERT(aEvent->mFlags.mIsTrusted,
+  MOZ_ASSERT(aCompositionEvent->mFlags.mIsTrusted,
              "Shouldn't be called with untrusted event");
-  MOZ_ASSERT(aEvent->mClass == eCompositionEventClass ||
-             aEvent->mClass == eTextEventClass);
 
   // XXX If composition events are discarded, should we dispatch them with
   //     runnable event?  However, even if we do so, it might make native IME
   //     confused due to async modification.  Especially when native IME is
   //     TSF.
-  if (aEvent->message != NS_COMPOSITION_END) {
+  if (aCompositionEvent->message != NS_COMPOSITION_END) {
     return;
   }
 
   mWasNativeCompositionEndEventDiscarded = true;
 }
 
 void
-TextComposition::DispatchEvent(WidgetGUIEvent* aEvent,
-                               nsEventStatus* aStatus,
-                               EventDispatchingCallback* aCallBack,
-                               bool aIsSynthesized)
+TextComposition::DispatchCompositionEvent(
+                   WidgetCompositionEvent* aCompositionEvent,
+                   nsEventStatus* aStatus,
+                   EventDispatchingCallback* aCallBack,
+                   bool aIsSynthesized)
 {
   if (Destroyed()) {
     *aStatus = nsEventStatus_eConsumeNoDefault;
     return;
   }
 
   // If this instance has requested to commit or cancel composition but
   // is not synthesizing commit event, that means that the IME commits or
@@ -139,97 +141,96 @@ TextComposition::DispatchEvent(WidgetGUI
   // Note that most Chinese IMEs don't expose actual composition string to us.
   // They typically tell us an IDEOGRAPHIC SPACE or empty string as composition
   // string.  Therefore, we should hack it only when:
   // 1. committing string is empty string at requesting commit but the last
   //    data isn't IDEOGRAPHIC SPACE.
   // 2. non-empty string is committed at requesting cancel.
   if (!aIsSynthesized && (mIsRequestingCommit || mIsRequestingCancel)) {
     nsString* committingData = nullptr;
-    switch (aEvent->message) {
+    switch (aCompositionEvent->message) {
       case NS_COMPOSITION_END:
-        committingData = &aEvent->AsCompositionEvent()->data;
-        break;
-      case NS_TEXT_TEXT:
-        committingData = &aEvent->AsTextEvent()->theText;
+      case NS_COMPOSITION_CHANGE:
+        committingData = &aCompositionEvent->mData;
         break;
       default:
         NS_WARNING("Unexpected event comes during committing or "
                    "canceling composition");
         break;
     }
     if (committingData) {
       if (mIsRequestingCommit && committingData->IsEmpty() &&
           mLastData != IDEOGRAPHIC_SPACE) {
         committingData->Assign(mLastData);
       } else if (mIsRequestingCancel && !committingData->IsEmpty()) {
         committingData->Truncate();
       }
     }
   }
 
-  if (aEvent->message == NS_TEXT_TEXT) {
-    if (!MaybeDispatchCompositionUpdate(aEvent->AsTextEvent())) {
+  if (aCompositionEvent->message == NS_COMPOSITION_CHANGE) {
+    if (!MaybeDispatchCompositionUpdate(aCompositionEvent)) {
       return;
     }
   }
 
   EventDispatcher::Dispatch(mNode, mPresContext,
-                            aEvent, nullptr, aStatus, aCallBack);
+                            aCompositionEvent, nullptr, aStatus, aCallBack);
 
   if (NS_WARN_IF(Destroyed())) {
     return;
   }
 
-  // Emulate editor behavior of text event handler if no editor handles
-  // composition/text events.
-  if (aEvent->message == NS_TEXT_TEXT && !HasEditor()) {
-    EditorWillHandleTextEvent(aEvent->AsTextEvent());
-    EditorDidHandleTextEvent();
+  // Emulate editor behavior of compositionchange event (DOM text event) handler
+  // if no editor handles composition events.
+  if (aCompositionEvent->message == NS_COMPOSITION_CHANGE && !HasEditor()) {
+    EditorWillHandleCompositionChangeEvent(aCompositionEvent);
+    EditorDidHandleCompositionChangeEvent();
   }
 
 #ifdef DEBUG
-  else if (aEvent->message == NS_COMPOSITION_END) {
+  else if (aCompositionEvent->message == NS_COMPOSITION_END) {
     MOZ_ASSERT(!mIsComposing, "Why is the editor still composing?");
     MOZ_ASSERT(!HasEditor(), "Why does the editor still keep to hold this?");
   }
 #endif // #ifdef DEBUG
 
   // Notify composition update to widget if possible
-  NotityUpdateComposition(aEvent);
+  NotityUpdateComposition(aCompositionEvent);
 }
 
 void
-TextComposition::NotityUpdateComposition(WidgetGUIEvent* aEvent)
+TextComposition::NotityUpdateComposition(
+                   const WidgetCompositionEvent* aCompositionEvent)
 {
   nsEventStatus status;
 
   // When compositon start, notify the rect of first offset character.
   // When not compositon start, notify the rect of selected composition
-  // string if text event.
-  if (aEvent->message == NS_COMPOSITION_START) {
+  // string if compositionchange event.
+  if (aCompositionEvent->message == NS_COMPOSITION_START) {
     nsCOMPtr<nsIWidget> widget = mPresContext->GetRootWidget();
     // Update composition start offset
     WidgetQueryContentEvent selectedTextEvent(true,
                                               NS_QUERY_SELECTED_TEXT,
                                               widget);
     widget->DispatchEvent(&selectedTextEvent, status);
     if (selectedTextEvent.mSucceeded) {
       mCompositionStartOffset = selectedTextEvent.mReply.mOffset;
     } else {
       // Unknown offset
       NS_WARNING("Cannot get start offset of IME composition");
       mCompositionStartOffset = 0;
     }
     mCompositionTargetOffset = mCompositionStartOffset;
-  } else if (aEvent->mClass != eTextEventClass) {
-    return;
+  } else if (aCompositionEvent->message == NS_COMPOSITION_CHANGE) {
+    mCompositionTargetOffset =
+      mCompositionStartOffset + aCompositionEvent->TargetClauseOffset();
   } else {
-    mCompositionTargetOffset =
-      mCompositionStartOffset + aEvent->AsTextEvent()->TargetClauseOffset();
+    return;
   }
 
   NotifyIME(NOTIFY_IME_OF_COMPOSITION_UPDATE);
 }
 
 void
 TextComposition::DispatchCompositionEventRunnable(uint32_t aEventMessage,
                                                   const nsAString& aData,
@@ -260,19 +261,18 @@ TextComposition::RequestToCommit(nsIWidg
     if (aDiscard) {
       mIsRequestingCancel = true;
       mIsRequestingCommit = false;
     } else {
       mIsRequestingCancel = false;
       mIsRequestingCommit = true;
     }
     if (!mIsSynthesizedForTests) {
-      // FYI: CompositionEvent and TextEvent caused by a call of NotifyIME()
-      //      may be discarded by PresShell if it's not safe to dispatch the
-      //      event.
+      // FYI: CompositionEvents caused by a call of NotifyIME() may be
+      //      discarded by PresShell if it's not safe to dispatch the event.
       nsresult rv =
         aWidget->NotifyIME(IMENotification(aDiscard ?
                                              REQUEST_TO_CANCEL_COMPOSITION :
                                              REQUEST_TO_COMMIT_COMPOSITION));
       if (rv == NS_ERROR_NOT_IMPLEMENTED) {
         return rv;
       }
       if (NS_WARN_IF(NS_FAILED(rv))) {
@@ -281,83 +281,84 @@ TextComposition::RequestToCommit(nsIWidg
     } else {
       // Emulates to commit or cancel the composition
       // FYI: These events may be discarded by PresShell if it's not safe to
       //      dispatch the event.
       nsCOMPtr<nsIWidget> widget(aWidget);
       nsAutoString commitData(aDiscard ? EmptyString() : lastData);
       bool changingData = lastData != commitData;
 
-      WidgetTextEvent textEvent(true, NS_TEXT_TEXT, widget);
-      textEvent.theText = commitData;
-      textEvent.mFlags.mIsSynthesizedForTests = true;
+      WidgetCompositionEvent changeEvent(true, NS_COMPOSITION_CHANGE, widget);
+      changeEvent.mData = commitData;
+      changeEvent.mFlags.mIsSynthesizedForTests = true;
 
-      MaybeDispatchCompositionUpdate(&textEvent);
+      MaybeDispatchCompositionUpdate(&changeEvent);
 
       // If changing the data or committing string isn't empty, we need to
-      // dispatch text event for setting the composition string without
-      // IME selection.
+      // dispatch compositionchange event for setting the composition string
+      // without IME selection.
       if (!Destroyed() && !widget->Destroyed() &&
           (changingData || !commitData.IsEmpty())) {
         nsEventStatus status = nsEventStatus_eIgnore;
-        widget->DispatchEvent(&textEvent, status);
+        widget->DispatchEvent(&changeEvent, status);
       }
 
       if (!Destroyed() && !widget->Destroyed()) {
         nsEventStatus status = nsEventStatus_eIgnore;
         WidgetCompositionEvent endEvent(true, NS_COMPOSITION_END, widget);
-        endEvent.data = commitData;
+        endEvent.mData = commitData;
         endEvent.mFlags.mIsSynthesizedForTests = true;
         widget->DispatchEvent(&endEvent, status);
       }
     }
   }
 
   mRequestedToCommitOrCancel = true;
 
   // If the request is performed synchronously, this must be already destroyed.
   if (Destroyed()) {
     return NS_OK;
   }
 
   // Otherwise, synthesize the commit in content.
   nsAutoString data(aDiscard ? EmptyString() : lastData);
   // If the last composition string and new data are different, we need to
-  // dispatch text event for removing IME selection.  However, if the commit
-  // string is empty string and it's not changed from the last data, we don't
-  // need to dispatch text event.
+  // dispatch compositionchange event for removing IME selection.  However, if
+  // the commit string is empty string and it's not changed from the last data,
+  // we don't need to dispatch compositionchange event.
   if (lastData != data || !data.IsEmpty()) {
-    DispatchCompositionEventRunnable(NS_TEXT_TEXT, data, true);
+    DispatchCompositionEventRunnable(NS_COMPOSITION_CHANGE, data, true);
   }
   DispatchCompositionEventRunnable(NS_COMPOSITION_END, data, true);
 
   return NS_OK;
 }
 
 nsresult
 TextComposition::NotifyIME(IMEMessage aMessage)
 {
   NS_ENSURE_TRUE(mPresContext, NS_ERROR_NOT_AVAILABLE);
   return IMEStateManager::NotifyIME(aMessage, mPresContext);
 }
 
 void
-TextComposition::EditorWillHandleTextEvent(const WidgetTextEvent* aTextEvent)
+TextComposition::EditorWillHandleCompositionChangeEvent(
+                   const WidgetCompositionEvent* aCompositionChangeEvent)
 {
-  mIsComposing = aTextEvent->IsComposing();
-  mRanges = aTextEvent->mRanges;
+  mIsComposing = aCompositionChangeEvent->IsComposing();
+  mRanges = aCompositionChangeEvent->mRanges;
   mIsEditorHandlingEvent = true;
 
-  MOZ_ASSERT(mLastData == aTextEvent->theText,
-    "The text of a text event must be same as previous data attribute value "
-    "of the latest compositionupdate event");
+  MOZ_ASSERT(mLastData == aCompositionChangeEvent->mData,
+    "The text of a compositionchange event must be same as previous data "
+    "attribute value of the latest compositionupdate event");
 }
 
 void
-TextComposition::EditorDidHandleTextEvent()
+TextComposition::EditorDidHandleCompositionChangeEvent()
 {
   mString = mLastData;
   mIsEditorHandlingEvent = false;
 }
 
 void
 TextComposition::StartHandlingComposition(nsIEditor* aEditor)
 {
@@ -430,44 +431,35 @@ TextComposition::CompositionEventDispatc
   switch (mEventMessage) {
     case NS_COMPOSITION_START: {
       WidgetCompositionEvent compStart(true, NS_COMPOSITION_START, widget);
       WidgetQueryContentEvent selectedText(true, NS_QUERY_SELECTED_TEXT,
                                            widget);
       ContentEventHandler handler(presContext);
       handler.OnQuerySelectedText(&selectedText);
       NS_ASSERTION(selectedText.mSucceeded, "Failed to get selected text");
-      compStart.data = selectedText.mReply.mString;
+      compStart.mData = selectedText.mReply.mString;
       compStart.mFlags.mIsSynthesizedForTests =
         mTextComposition->IsSynthesizedForTests();
       IMEStateManager::DispatchCompositionEvent(mEventTarget, presContext,
                                                 &compStart, &status, nullptr,
                                                 mIsSynthesizedEvent);
       break;
     }
-    case NS_COMPOSITION_END: {
+    case NS_COMPOSITION_END:
+    case NS_COMPOSITION_CHANGE: {
       WidgetCompositionEvent compEvent(true, mEventMessage, widget);
-      compEvent.data = mData;
+      compEvent.mData = mData;
       compEvent.mFlags.mIsSynthesizedForTests =
         mTextComposition->IsSynthesizedForTests();
       IMEStateManager::DispatchCompositionEvent(mEventTarget, presContext,
                                                 &compEvent, &status, nullptr,
                                                 mIsSynthesizedEvent);
       break;
     }
-    case NS_TEXT_TEXT: {
-      WidgetTextEvent textEvent(true, NS_TEXT_TEXT, widget);
-      textEvent.theText = mData;
-      textEvent.mFlags.mIsSynthesizedForTests =
-        mTextComposition->IsSynthesizedForTests();
-      IMEStateManager::DispatchCompositionEvent(mEventTarget, presContext,
-                                                &textEvent, &status, nullptr,
-                                                mIsSynthesizedEvent);
-      break;
-    }
     default:
       MOZ_CRASH("Unsupported event");
   }
   return NS_OK;
 }
 
 /******************************************************************************
  * TextCompositionArray
--- a/dom/events/TextComposition.h
+++ b/dom/events/TextComposition.h
@@ -35,32 +35,33 @@ class TextComposition MOZ_FINAL
 {
   friend class IMEStateManager;
 
   NS_INLINE_DECL_REFCOUNTING(TextComposition)
 
 public:
   TextComposition(nsPresContext* aPresContext,
                   nsINode* aNode,
-                  WidgetGUIEvent* aEvent);
+                  WidgetCompositionEvent* aCompositionEvent);
 
   bool Destroyed() const { return !mPresContext; }
   nsPresContext* GetPresContext() const { return mPresContext; }
   nsINode* GetEventTargetNode() const { return mNode; }
   // The latest CompositionEvent.data value except compositionstart event.
   // This value is modified at dispatching compositionupdate.
   const nsString& LastData() const { return mLastData; }
   // The composition string which is already handled by the focused editor.
   // I.e., this value must be same as the composition string on the focused
-  // editor.  This value is modified at a call of EditorDidHandleTextEvent().
+  // editor.  This value is modified at a call of
+  // EditorDidHandleCompositionChangeEvent().
   // Note that mString and mLastData are different between dispatcing
-  // compositionupdate and text event handled by focused editor.
+  // compositionupdate and compositionchange event handled by focused editor.
   const nsString& String() const { return mString; }
   // Returns the clauses and/or caret range of the composition string.
-  // This is modified at a call of EditorWillHandleTextEvent().
+  // This is modified at a call of EditorWillHandleCompositionChangeEvent().
   // This may return null if there is no clauses and caret.
   // XXX We should return |const TextRangeArray*| here, but it causes compile
   //     error due to inaccessible Release() method.
   TextRangeArray* GetRanges() const { return mRanges; }
   // Returns the widget which is proper to call NotifyIME().
   nsIWidget* GetWidget() const
   {
     return mPresContext ? mPresContext->GetRootWidget() : nullptr;
@@ -119,39 +120,43 @@ public:
   /**
    * StartHandlingComposition() and EndHandlingComposition() are called by
    * editor when it holds a TextComposition instance and release it.
    */
   void StartHandlingComposition(nsIEditor* aEditor);
   void EndHandlingComposition(nsIEditor* aEditor);
 
   /**
-   * TextEventHandlingMarker class should be created at starting to handle text
-   * event in focused editor.  This calls EditorWillHandleTextEvent() and
-   * EditorDidHandleTextEvent() automatically.
+   * CompositionChangeEventHandlingMarker class should be created at starting
+   * to handle text event in focused editor.  This calls
+   * EditorWillHandleCompositionChangeEvent() and
+   * EditorDidHandleCompositionChangeEvent() automatically.
    */
-  class MOZ_STACK_CLASS TextEventHandlingMarker
+  class MOZ_STACK_CLASS CompositionChangeEventHandlingMarker
   {
   public:
-    TextEventHandlingMarker(TextComposition* aComposition,
-                            const WidgetTextEvent* aTextEvent)
+    CompositionChangeEventHandlingMarker(
+      TextComposition* aComposition,
+      const WidgetCompositionEvent* aCompositionChangeEvent)
       : mComposition(aComposition)
     {
-      mComposition->EditorWillHandleTextEvent(aTextEvent);
+      mComposition->EditorWillHandleCompositionChangeEvent(
+                      aCompositionChangeEvent);
     }
 
-    ~TextEventHandlingMarker()
+    ~CompositionChangeEventHandlingMarker()
     {
-      mComposition->EditorDidHandleTextEvent();
+      mComposition->EditorDidHandleCompositionChangeEvent();
     }
 
   private:
     nsRefPtr<TextComposition> mComposition;
-    TextEventHandlingMarker();
-    TextEventHandlingMarker(const TextEventHandlingMarker& aOther);
+    CompositionChangeEventHandlingMarker();
+    CompositionChangeEventHandlingMarker(
+      const CompositionChangeEventHandlingMarker& aOther);
   };
 
 private:
   // Private destructor, to discourage deletion outside of Release():
   ~TextComposition()
   {
     // WARNING: mPresContext may be destroying, so, be careful if you touch it.
   }
@@ -227,64 +232,67 @@ private:
 
   /**
    * HasEditor() returns true if mEditorWeak holds nsIEditor instance which is
    * alive.  Otherwise, false.
    */
   bool HasEditor() const;
 
   /**
-   * EditorWillHandleTextEvent() must be called before the focused editor
-   * handles the text event.
+   * EditorWillHandleCompositionChangeEvent() must be called before the focused
+   * editor handles the compositionchange event.
    */
-  void EditorWillHandleTextEvent(const WidgetTextEvent* aTextEvent);
+  void EditorWillHandleCompositionChangeEvent(
+         const WidgetCompositionEvent* aCompositionChangeEvent);
 
   /**
-   * EditorDidHandleTextEvent() must be called after the focused editor handles
-   * a text event.
+   * EditorDidHandleCompositionChangeEvent() must be called after the focused
+   * editor handles a compositionchange event.
    */
-  void EditorDidHandleTextEvent();
+  void EditorDidHandleCompositionChangeEvent();
 
   /**
-   * DispatchEvent() dispatches the aEvent to the mContent synchronously.
-   * The caller must ensure that it's safe to dispatch the event.
+   * DispatchCompositionEvent() dispatches the aCompositionEvent to the mContent
+   * synchronously. The caller must ensure that it's safe to dispatch the event.
    */
-  void DispatchEvent(WidgetGUIEvent* aEvent,
-                     nsEventStatus* aStatus,
-                     EventDispatchingCallback* aCallBack,
-                     bool aIsSynthesized);
+  void DispatchCompositionEvent(WidgetCompositionEvent* aCompositionEvent,
+                                nsEventStatus* aStatus,
+                                EventDispatchingCallback* aCallBack,
+                                bool aIsSynthesized);
 
   /**
    * MaybeDispatchCompositionUpdate() may dispatch a compositionupdate event
-   * if aEvent changes composition string.
+   * if aCompositionEvent changes composition string.
    * @return Returns false if dispatching the compositionupdate event caused
    *         destroying this composition.
    */
-  bool MaybeDispatchCompositionUpdate(const WidgetTextEvent* aEvent);
+  bool MaybeDispatchCompositionUpdate(
+         const WidgetCompositionEvent* aCompositionEvent);
 
   /**
    * If IME has already dispatched compositionend event but it was discarded
    * by PresShell due to not safe to dispatch, this returns true.
    */
   bool WasNativeCompositionEndEventDiscarded() const
   {
     return mWasNativeCompositionEndEventDiscarded;
   }
 
   /**
    * OnCompositionEventDiscarded() is called when PresShell discards
-   * compositionupdate, compositionend or text event due to not safe to
-   * dispatch event.
+   * compositionupdate, compositionend or compositionchange event due to not
+   * safe to dispatch event.
    */
-  void OnCompositionEventDiscarded(const WidgetGUIEvent* aEvent);
+  void OnCompositionEventDiscarded(
+         const WidgetCompositionEvent* aCompositionEvent);
 
   /**
    * Calculate composition offset then notify composition update to widget
    */
-  void NotityUpdateComposition(WidgetGUIEvent* aEvent);
+  void NotityUpdateComposition(const WidgetCompositionEvent* aCompositionEvent);
 
   /**
    * CompositionEventDispatcher dispatches the specified composition (or text)
    * event.
    */
   class CompositionEventDispatcher : public nsRunnable
   {
   public:
@@ -301,27 +309,24 @@ private:
     uint32_t mEventMessage;
     nsString mData;
     bool mIsSynthesizedEvent;
 
     CompositionEventDispatcher() {};
   };
 
   /**
-   * DispatchCompositionEventRunnable() dispatches a composition or text event
-   * to the content.  Be aware, if you use this method, nsPresShellEventCB
-   * isn't used.  That means that nsIFrame::HandleEvent() is never called.
+   * DispatchCompositionEventRunnable() dispatches a composition event to the
+   * content.  Be aware, if you use this method, nsPresShellEventCB isn't used.
+   * That means that nsIFrame::HandleEvent() is never called.
    * WARNING: The instance which is managed by IMEStateManager may be
    *          destroyed by this method call.
    *
-   * @param aEventMessage       Must be one of composition event or text event.
-   * @param aData               Used for data value if aEventMessage is
-   *                            NS_COMPOSITION_END.
-   *                            Used for theText value if aEventMessage is
-   *                            NS_TEXT_TEXT.
+   * @param aEventMessage       Must be one of composition events.
+   * @param aData               Used for mData value.
    * @param aIsSynthesizingCommit   true if this is called for synthesizing
    *                                commit or cancel composition.  Otherwise,
    *                                false.
    */
   void DispatchCompositionEventRunnable(uint32_t aEventMessage,
                                         const nsAString& aData,
                                         bool aIsSynthesizingCommit = false);
 };
--- a/dom/events/Touch.cpp
+++ b/dom/events/Touch.cpp
@@ -23,17 +23,16 @@ Touch::Touch(EventTarget* aTarget,
              int32_t aScreenY,
              int32_t aClientX,
              int32_t aClientY,
              int32_t aRadiusX,
              int32_t aRadiusY,
              float aRotationAngle,
              float aForce)
 {
-  SetIsDOMBinding();
   mTarget = aTarget;
   mIdentifier = aIdentifier;
   mPagePoint = CSSIntPoint(aPageX, aPageY);
   mScreenPoint = nsIntPoint(aScreenX, aScreenY);
   mClientPoint = CSSIntPoint(aClientX, aClientY);
   mRefPoint = nsIntPoint(0, 0);
   mPointsInitialized = true;
   mRadius.x = aRadiusX;
@@ -47,17 +46,16 @@ Touch::Touch(EventTarget* aTarget,
 }
 
 Touch::Touch(int32_t aIdentifier,
              nsIntPoint aPoint,
              nsIntPoint aRadius,
              float aRotationAngle,
              float aForce)
 {
-  SetIsDOMBinding();
   mIdentifier = aIdentifier;
   mPagePoint = CSSIntPoint(0, 0);
   mScreenPoint = nsIntPoint(0, 0);
   mClientPoint = CSSIntPoint(0, 0);
   mRefPoint = aPoint;
   mPointsInitialized = false;
   mRadius = aRadius;
   mRotationAngle = aRotationAngle;
--- a/dom/events/TouchEvent.h
+++ b/dom/events/TouchEvent.h
@@ -24,25 +24,23 @@ class TouchList MOZ_FINAL : public nsISu
 {
 public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(TouchList)
 
   explicit TouchList(nsISupports* aParent)
     : mParent(aParent)
   {
-    SetIsDOMBinding();
     nsJSContext::LikelyShortLivingObjectCreated();
   }
   TouchList(nsISupports* aParent,
             const WidgetTouchEvent::TouchArray& aTouches)
     : mParent(aParent)
     , mPoints(aTouches)
   {
-    SetIsDOMBinding();
     nsJSContext::LikelyShortLivingObjectCreated();
   }
 
   void Append(Touch* aPoint)
   {
     mPoints.AppendElement(aPoint);
   }
 
--- a/dom/events/UIEvent.cpp
+++ b/dom/events/UIEvent.cpp
@@ -339,21 +339,17 @@ UIEvent::GetIsChar(bool* aIsChar)
   *aIsChar = IsChar();
   return NS_OK;
 }
 
 bool
 UIEvent::IsChar() const
 {
   WidgetKeyboardEvent* keyEvent = mEvent->AsKeyboardEvent();
-  if (keyEvent) {
-    return keyEvent->isChar;
-  }
-  WidgetTextEvent* textEvent = mEvent->AsTextEvent();
-  return textEvent ? textEvent->isChar : false;
+  return keyEvent ? keyEvent->isChar : false;
 }
 
 NS_IMETHODIMP
 UIEvent::DuplicatePrivateData()
 {
   mClientPoint =
     Event::GetClientCoords(mPresContext, mEvent, mEvent->refPoint,
                            mClientPoint);
--- a/dom/fetch/Headers.cpp
+++ b/dom/fetch/Headers.cpp
@@ -104,17 +104,16 @@ Headers::Constructor(const GlobalObject&
 
   return headers.forget();
 }
 
 Headers::Headers(const Headers& aOther)
   : mOwner(aOther.mOwner)
   , mGuard(aOther.mGuard)
 {
-  SetIsDOMBinding();
   ErrorResult result;
   Fill(aOther, result);
   MOZ_ASSERT(!result.Failed());
 }
 
 void
 Headers::Append(const nsACString& aName, const nsACString& aValue,
                 ErrorResult& aRv)
--- a/dom/fetch/Headers.h
+++ b/dom/fetch/Headers.h
@@ -48,17 +48,16 @@ private:
   HeadersGuardEnum mGuard;
   nsTArray<Entry> mList;
 
 public:
   explicit Headers(nsISupports* aOwner, HeadersGuardEnum aGuard = HeadersGuardEnum::None)
     : mOwner(aOwner)
     , mGuard(aGuard)
   {
-    SetIsDOMBinding();
   }
 
   explicit Headers(const Headers& aOther);
 
   static bool PrefEnabled(JSContext* cx, JSObject* obj);
 
   static already_AddRefed<Headers>
   Constructor(const GlobalObject& aGlobal,
--- a/dom/fetch/Request.cpp
+++ b/dom/fetch/Request.cpp
@@ -39,17 +39,16 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 Request::Request(nsIGlobalObject* aOwner, InternalRequest* aRequest)
   : mOwner(aOwner)
   , mRequest(aRequest)
   , mBodyUsed(false)
 {
-  SetIsDOMBinding();
 }
 
 Request::~Request()
 {
 }
 
 already_AddRefed<InternalRequest>
 Request::GetInternalRequest()
--- a/dom/fetch/Response.cpp
+++ b/dom/fetch/Response.cpp
@@ -24,17 +24,16 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 Response::Response(nsISupports* aOwner)
   : mOwner(aOwner)
   , mHeaders(new Headers(aOwner))
 {
-  SetIsDOMBinding();
 }
 
 Response::~Response()
 {
 }
 
 /* static */ already_AddRefed<Response>
 Response::Error(const GlobalObject& aGlobal)
--- a/dom/filesystem/Directory.cpp
+++ b/dom/filesystem/Directory.cpp
@@ -58,18 +58,16 @@ Directory::GetRoot(FileSystemBase* aFile
 Directory::Directory(FileSystemBase* aFileSystem,
                      const nsAString& aPath)
   : mFileSystem(aFileSystem)
   , mPath(aPath)
 {
   MOZ_ASSERT(aFileSystem, "aFileSystem should not be null.");
   // Remove the trailing "/".
   mPath.Trim(FILESYSTEM_DOM_PATH_SEPARATOR, false, true);
-
-  SetIsDOMBinding();
 }
 
 Directory::~Directory()
 {
 }
 
 nsPIDOMWindow*
 Directory::GetParentObject() const
--- a/dom/fmradio/FMRadio.cpp
+++ b/dom/fmradio/FMRadio.cpp
@@ -107,18 +107,16 @@ NS_IMPL_ISUPPORTS_INHERITED0(FMRadioRequ
 FMRadio::FMRadio()
   : mHeadphoneState(SWITCH_STATE_OFF)
   , mRdsGroupMask(0)
   , mAudioChannelAgentEnabled(false)
   , mHasInternalAntenna(false)
   , mIsShutdown(false)
 {
   LOG("FMRadio is initialized.");
-
-  SetIsDOMBinding();
 }
 
 FMRadio::~FMRadio()
 {
 }
 
 void
 FMRadio::Init(nsPIDOMWindow *aWindow)
--- a/dom/gamepad/Gamepad.cpp
+++ b/dom/gamepad/Gamepad.cpp
@@ -28,17 +28,16 @@ Gamepad::Gamepad(nsISupports* aParent,
   : mParent(aParent),
     mID(aID),
     mIndex(aIndex),
     mMapping(aMapping),
     mConnected(true),
     mButtons(aNumButtons),
     mAxes(aNumAxes)
 {
-  SetIsDOMBinding();
   for (unsigned i = 0; i < aNumButtons; i++) {
     mButtons.InsertElementAt(i, new GamepadButton(mParent));
   }
   mAxes.InsertElementsAt(0, aNumAxes, 0.0f);
 }
 
 void
 Gamepad::SetIndex(uint32_t aIndex)
--- a/dom/gamepad/GamepadButton.h
+++ b/dom/gamepad/GamepadButton.h
@@ -15,17 +15,16 @@ namespace dom {
 class GamepadButton : public nsISupports,
                       public nsWrapperCache
 {
 public:
   explicit GamepadButton(nsISupports* aParent) : mParent(aParent),
                                                  mPressed(false),
                                                  mValue(0)
   {
-    SetIsDOMBinding();
   }
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(GamepadButton)
 
   nsISupports* GetParentObject() const
   {
     return mParent;
--- a/dom/geolocation/nsGeoPosition.cpp
+++ b/dom/geolocation/nsGeoPosition.cpp
@@ -153,17 +153,16 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 Position::Position(nsISupports* aParent, nsIDOMGeoPosition* aGeoPosition)
   : mParent(aParent)
   , mGeoPosition(aGeoPosition)
 {
-  SetIsDOMBinding();
 }
 
 Position::~Position()
 {
 }
 
 nsISupports*
 Position::GetParentObject() const
@@ -207,17 +206,16 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 Coordinates::Coordinates(Position* aPosition, nsIDOMGeoPositionCoords* aCoords)
   : mPosition(aPosition)
   , mCoords(aCoords)
 {
-  SetIsDOMBinding();
 }
 
 Coordinates::~Coordinates()
 {
 }
 
 Position*
 Coordinates::GetParentObject() const
--- a/dom/geolocation/nsGeolocation.cpp
+++ b/dom/geolocation/nsGeolocation.cpp
@@ -238,17 +238,16 @@ NS_INTERFACE_MAP_END
 NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(PositionError, mParent)
 NS_IMPL_CYCLE_COLLECTING_ADDREF(PositionError)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(PositionError)
 
 PositionError::PositionError(Geolocation* aParent, int16_t aCode)
   : mCode(aCode)
   , mParent(aParent)
 {
-  SetIsDOMBinding();
 }
 
 PositionError::~PositionError(){}
 
 
 NS_IMETHODIMP
 PositionError::GetCode(int16_t *aCode)
 {
@@ -1014,17 +1013,16 @@ NS_IMPL_CYCLE_COLLECTING_RELEASE(Geoloca
 NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(Geolocation,
                                       mPendingCallbacks,
                                       mWatchingCallbacks,
                                       mPendingRequests)
 
 Geolocation::Geolocation()
 : mLastWatchId(0)
 {
-  SetIsDOMBinding();
 }
 
 Geolocation::~Geolocation()
 {
   if (mService) {
     Shutdown();
   }
 }
--- a/dom/icc/Icc.cpp
+++ b/dom/icc/Icc.cpp
@@ -24,17 +24,16 @@ NS_INTERFACE_MAP_END_INHERITING(DOMEvent
 
 NS_IMPL_ADDREF_INHERITED(Icc, DOMEventTargetHelper)
 NS_IMPL_RELEASE_INHERITED(Icc, DOMEventTargetHelper)
 
 Icc::Icc(nsPIDOMWindow* aWindow, long aClientId, nsIIccInfo* aIccInfo)
   : mLive(true)
   , mClientId(aClientId)
 {
-  SetIsDOMBinding();
   BindToOwner(aWindow);
 
   mProvider = do_GetService(NS_RILCONTENTHELPER_CONTRACTID);
 
   if (aIccInfo) {
     aIccInfo->GetIccid(mIccId);
     UpdateIccInfo(aIccInfo);
   }
--- a/dom/icc/IccInfo.cpp
+++ b/dom/icc/IccInfo.cpp
@@ -30,17 +30,16 @@ NS_IMPL_CYCLE_COLLECTING_RELEASE(IccInfo
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(IccInfo)
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 IccInfo::IccInfo(nsPIDOMWindow* aWindow)
   : mWindow(aWindow)
 {
-  SetIsDOMBinding();
 }
 
 void
 IccInfo::Update(nsIIccInfo* aInfo)
 {
   mIccInfo = aInfo;
 }
 
@@ -144,17 +143,16 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_
 NS_INTERFACE_MAP_END_INHERITING(IccInfo)
 
 NS_IMPL_ADDREF_INHERITED(GsmIccInfo, IccInfo)
 NS_IMPL_RELEASE_INHERITED(GsmIccInfo, IccInfo)
 
 GsmIccInfo::GsmIccInfo(nsPIDOMWindow* aWindow)
   : IccInfo(aWindow)
 {
-  SetIsDOMBinding();
 }
 
 void
 GsmIccInfo::Update(nsIGsmIccInfo* aInfo)
 {
   IccInfo::Update(aInfo);
   mGsmIccInfo = aInfo;
 }
@@ -184,17 +182,16 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_
 NS_INTERFACE_MAP_END_INHERITING(IccInfo)
 
 NS_IMPL_ADDREF_INHERITED(CdmaIccInfo, IccInfo)
 NS_IMPL_RELEASE_INHERITED(CdmaIccInfo, IccInfo)
 
 CdmaIccInfo::CdmaIccInfo(nsPIDOMWindow* aWindow)
   : IccInfo(aWindow)
 {
-  SetIsDOMBinding();
 }
 
 void
 CdmaIccInfo::Update(nsICdmaIccInfo* aInfo)
 {
   IccInfo::Update(aInfo);
   mCdmaIccInfo = aInfo;
 }
--- a/dom/indexedDB/IDBCursor.cpp
+++ b/dom/indexedDB/IDBCursor.cpp
@@ -55,18 +55,16 @@ IDBCursor::IDBCursor(Type aType,
                 aSourceObjectStore);
   MOZ_ASSERT_IF(aType == Type_Index || aType == Type_IndexKey, aSourceIndex);
   MOZ_ASSERT(aTransaction);
   aTransaction->AssertIsOnOwningThread();
   MOZ_ASSERT(aBackgroundActor);
   MOZ_ASSERT(!aKey.IsUnset());
   MOZ_ASSERT(mScriptOwner);
 
-  SetIsDOMBinding();
-
   if (mScriptOwner) {
     mozilla::HoldJSObjects(this);
     mRooted = true;
   }
 }
 
 IDBCursor::~IDBCursor()
 {
--- a/dom/indexedDB/IDBDatabase.cpp
+++ b/dom/indexedDB/IDBDatabase.cpp
@@ -200,18 +200,16 @@ IDBDatabase::IDBDatabase(IDBWrapperCache
   , mClosed(false)
   , mInvalidated(false)
 {
   MOZ_ASSERT(aOwnerCache);
   MOZ_ASSERT(aFactory);
   aFactory->AssertIsOnOwningThread();
   MOZ_ASSERT(aActor);
   MOZ_ASSERT(aSpec);
-
-  SetIsDOMBinding();
 }
 
 IDBDatabase::~IDBDatabase()
 {
   AssertIsOnOwningThread();
   MOZ_ASSERT(!mBackgroundActor);
 }
 
--- a/dom/indexedDB/IDBEvents.h
+++ b/dom/indexedDB/IDBEvents.h
@@ -106,17 +106,16 @@ public:
   virtual JSObject*
   WrapObject(JSContext* aCx) MOZ_OVERRIDE;
 
 private:
   IDBVersionChangeEvent(EventTarget* aOwner, uint64_t aOldVersion)
     : Event(aOwner, nullptr, nullptr)
     , mOldVersion(aOldVersion)
   {
-    SetIsDOMBinding();
   }
 
   ~IDBVersionChangeEvent()
   { }
 
   static already_AddRefed<IDBVersionChangeEvent>
   CreateInternal(EventTarget* aOwner,
                  const nsAString& aName,
--- a/dom/indexedDB/IDBFactory.cpp
+++ b/dom/indexedDB/IDBFactory.cpp
@@ -113,18 +113,16 @@ IDBFactory::IDBFactory()
   , mRootedOwningObject(false)
   , mBackgroundActorFailed(false)
   , mPrivateBrowsingMode(false)
 {
 #ifdef DEBUG
   mOwningThread = PR_GetCurrentThread();
 #endif
   AssertIsOnOwningThread();
-
-  SetIsDOMBinding();
 }
 
 IDBFactory::~IDBFactory()
 {
   MOZ_ASSERT_IF(mBackgroundActorFailed, !mBackgroundActor);
 
   if (mRootedOwningObject) {
     mOwningObject = nullptr;
--- a/dom/indexedDB/IDBFileHandle.cpp
+++ b/dom/indexedDB/IDBFileHandle.cpp
@@ -27,17 +27,16 @@ NS_DEFINE_CID(kAppShellCID2, NS_APPSHELL
 } // anonymous namespace
 
 IDBFileHandle::IDBFileHandle(FileMode aMode,
                              RequestMode aRequestMode,
                              IDBMutableFile* aMutableFile)
   : FileHandleBase(aMode, aRequestMode)
   , mMutableFile(aMutableFile)
 {
-  SetIsDOMBinding();
 }
 
 IDBFileHandle::~IDBFileHandle()
 {
 }
 
 // static
 already_AddRefed<IDBFileHandle>
--- a/dom/indexedDB/IDBIndex.cpp
+++ b/dom/indexedDB/IDBIndex.cpp
@@ -51,18 +51,16 @@ IDBIndex::IDBIndex(IDBObjectStore* aObje
   , mCachedKeyPath(JSVAL_VOID)
   , mMetadata(aMetadata)
   , mId(aMetadata->id())
   , mRooted(false)
 {
   MOZ_ASSERT(aObjectStore);
   aObjectStore->AssertIsOnOwningThread();
   MOZ_ASSERT(aMetadata);
-
-  SetIsDOMBinding();
 }
 
 IDBIndex::~IDBIndex()
 {
   AssertIsOnOwningThread();
 
   if (mRooted) {
     mCachedKeyPath = JSVAL_VOID;
--- a/dom/indexedDB/IDBObjectStore.cpp
+++ b/dom/indexedDB/IDBObjectStore.cpp
@@ -864,18 +864,16 @@ IDBObjectStore::IDBObjectStore(IDBTransa
   , mCachedKeyPath(JSVAL_VOID)
   , mSpec(aSpec)
   , mId(aSpec->metadata().id())
   , mRooted(false)
 {
   MOZ_ASSERT(aTransaction);
   aTransaction->AssertIsOnOwningThread();
   MOZ_ASSERT(aSpec);
-
-  SetIsDOMBinding();
 }
 
 IDBObjectStore::~IDBObjectStore()
 {
   AssertIsOnOwningThread();
 
   if (mRooted) {
     mCachedKeyPath = JSVAL_VOID;
--- a/dom/interfaces/events/nsIDOMEvent.idl
+++ b/dom/interfaces/events/nsIDOMEvent.idl
@@ -283,21 +283,16 @@ NS_NewDOMMutationEvent(nsIDOMEvent** aRe
                        nsPresContext* aPresContext,
                        mozilla::InternalMutationEvent* aEvent);
 nsresult
 NS_NewDOMDeviceMotionEvent(nsIDOMEvent** aResult,
                            mozilla::dom::EventTarget* aOwner,
                            nsPresContext* aPresContext,
                            mozilla::WidgetEvent* aEvent);
 nsresult
-NS_NewDOMTextEvent(nsIDOMEvent** aResult,
-                   mozilla::dom::EventTarget* aOwner,
-                   nsPresContext* aPresContext,
-                   mozilla::WidgetTextEvent* aEvent);
-nsresult
 NS_NewDOMBeforeUnloadEvent(nsIDOMEvent** aResult,
                            mozilla::dom::EventTarget* aOwner,
                            nsPresContext* aPresContext,
                            mozilla::WidgetEvent* aEvent);
 nsresult
 NS_NewDOMSVGEvent(nsIDOMEvent** aResult,
                   mozilla::dom::EventTarget* aOwner,
                   nsPresContext* aPresContext,
--- a/dom/ipc/PBrowser.ipdl
+++ b/dom/ipc/PBrowser.ipdl
@@ -39,17 +39,16 @@ using struct nsIMEUpdatePreference from 
 using struct nsIntPoint from "nsPoint.h";
 using struct nsIntRect from "nsRect.h";
 using struct nsIntSize from "nsSize.h";
 using class mozilla::WidgetKeyboardEvent from "ipc/nsGUIEventIPC.h";
 using class mozilla::WidgetMouseEvent from "ipc/nsGUIEventIPC.h";
 using class mozilla::WidgetWheelEvent from "ipc/nsGUIEventIPC.h";
 using struct nsRect from "nsRect.h";
 using class mozilla::WidgetSelectionEvent from "ipc/nsGUIEventIPC.h";
-using class mozilla::WidgetTextEvent from "ipc/nsGUIEventIPC.h";
 using class mozilla::WidgetTouchEvent from "ipc/nsGUIEventIPC.h";
 using struct mozilla::dom::RemoteDOMEvent from "mozilla/dom/TabMessageUtils.h";
 using mozilla::dom::ScreenOrientation from "mozilla/dom/ScreenOrientation.h";
 using struct mozilla::layers::TextureFactoryIdentifier from "mozilla/layers/CompositorTypes.h";
 using mozilla::CSSPoint from "Units.h";
 using mozilla::CSSToScreenScale from "Units.h";
 using mozilla::CommandInt from "mozilla/EventForwards.h";
 using mozilla::layers::GeckoContentController::APZStateChange from "mozilla/layers/GeckoContentController.h";
@@ -474,18 +473,16 @@ child:
     KeyEvent(nsString aType,
              int32_t aKeyCode,
              int32_t aCharCode,
              int32_t aModifiers,
              bool aPreventDefault);
 
     CompositionEvent(WidgetCompositionEvent event);
 
-    TextEvent(WidgetTextEvent event);
-
     SelectionEvent(WidgetSelectionEvent event);
 
     /**
      * Activate event forwarding from client to parent.
      */
     ActivateFrameEvent(nsString aType, bool capture);
 
     LoadRemoteScript(nsString aURL, bool aRunInGlobalScope);
@@ -537,16 +534,21 @@ child:
     async RequestNotifyAfterRemotePaint();
 
     /**
      * Tell the child that the UI resolution changed for the containing
      * window.
      */
     UIResolutionChanged();
 
+    /**
+     * Tell the child of an app's offline status
+     */
+    AppOfflineStatus(uint32_t id, bool offline);
+
 /*
  * FIXME: write protocol!
 
 state LIVE:
     send LoadURL goto LIVE;
 //etc.
     send Destroy goto DYING;
 
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -75,16 +75,17 @@
 #include "nsViewportInfo.h"
 #include "JavaScriptChild.h"
 #include "nsILoadContext.h"
 #include "ipc/nsGUIEventIPC.h"
 #include "mozilla/gfx/Matrix.h"
 #include "UnitTransforms.h"
 #include "ClientLayerManager.h"
 #include "LayersLogging.h"
+#include "nsIOService.h"
 
 #include "nsColorPickerProxy.h"
 
 #define BROWSER_ELEMENT_CHILD_SCRIPT \
     NS_LITERAL_STRING("chrome://global/content/BrowserElementChild.js")
 
 #define TABC_LOG(...)
 // #define TABC_LOG(...) printf_stderr("TABC: " __VA_ARGS__)
@@ -2384,25 +2385,16 @@ TabChild::RecvCompositionEvent(const Wid
 {
   WidgetCompositionEvent localEvent(event);
   localEvent.widget = mWidget;
   DispatchWidgetEvent(localEvent);
   return true;
 }
 
 bool
-TabChild::RecvTextEvent(const WidgetTextEvent& event)
-{
-  WidgetTextEvent localEvent(event);
-  localEvent.widget = mWidget;
-  DispatchWidgetEvent(localEvent);
-  return true;
-}
-
-bool
 TabChild::RecvSelectionEvent(const WidgetSelectionEvent& event)
 {
   WidgetSelectionEvent localEvent(event);
   localEvent.widget = mWidget;
   DispatchWidgetEvent(localEvent);
   return true;
 }
 
@@ -2576,16 +2568,28 @@ TabChild::RecvAsyncMessage(const nsStrin
       static_cast<nsFrameMessageManager*>(mTabChildGlobal->mMessageManager.get());
     CpowIdHolder cpows(Manager(), aCpows);
     mm->ReceiveMessage(static_cast<EventTarget*>(mTabChildGlobal),
                        aMessage, false, &cloneData, &cpows, aPrincipal, nullptr);
   }
   return true;
 }
 
+bool
+TabChild::RecvAppOfflineStatus(const uint32_t& aId, const bool& aOffline)
+{
+  // Instantiate the service to make sure gIOService is initialized
+  nsCOMPtr<nsIIOService> ioService = mozilla::services::GetIOService();
+  if (gIOService && ioService) {
+    gIOService->SetAppOfflineInternal(aId, aOffline ?
+      nsIAppOfflineInfo::OFFLINE : nsIAppOfflineInfo::ONLINE);
+  }
+  return true;
+}
+
 class UnloadScriptEvent : public nsRunnable
 {
 public:
   UnloadScriptEvent(TabChild* aTabChild, TabChildGlobal* aTabChildGlobal)
     : mTabChild(aTabChild), mTabChildGlobal(aTabChildGlobal)
   { }
 
   NS_IMETHOD Run()
--- a/dom/ipc/TabChild.h
+++ b/dom/ipc/TabChild.h
@@ -133,16 +133,21 @@ public:
     aVisitor.mForceContentDispatch = true;
     return NS_OK;
   }
 
   virtual JSContext* GetJSContextForEventHandlers() MOZ_OVERRIDE;
   virtual nsIPrincipal* GetPrincipal() MOZ_OVERRIDE;
   virtual JSObject* GetGlobalJSObject() MOZ_OVERRIDE;
 
+  virtual JSObject* WrapObject(JSContext* cx) MOZ_OVERRIDE
+  {
+    MOZ_CRASH("TabChildGlobal doesn't use DOM bindings!");
+  }
+
   nsCOMPtr<nsIContentFrameMessageManager> mMessageManager;
   nsRefPtr<TabChildBase> mTabChild;
 
 protected:
   ~TabChildGlobal();
 };
 
 class ContentListener MOZ_FINAL : public nsIDOMEventListener
@@ -355,26 +360,27 @@ public:
     virtual bool RecvRealTouchMoveEvent(const WidgetTouchEvent& aEvent,
                                         const ScrollableLayerGuid& aGuid) MOZ_OVERRIDE;
     virtual bool RecvKeyEvent(const nsString& aType,
                               const int32_t&  aKeyCode,
                               const int32_t&  aCharCode,
                               const int32_t&  aModifiers,
                               const bool&     aPreventDefault) MOZ_OVERRIDE;
     virtual bool RecvCompositionEvent(const mozilla::WidgetCompositionEvent& event) MOZ_OVERRIDE;
-    virtual bool RecvTextEvent(const mozilla::WidgetTextEvent& event) MOZ_OVERRIDE;
     virtual bool RecvSelectionEvent(const mozilla::WidgetSelectionEvent& event) MOZ_OVERRIDE;
     virtual bool RecvActivateFrameEvent(const nsString& aType, const bool& capture) MOZ_OVERRIDE;
     virtual bool RecvLoadRemoteScript(const nsString& aURL,
                                       const bool& aRunInGlobalScope) MOZ_OVERRIDE;
     virtual bool RecvAsyncMessage(const nsString& aMessage,
                                   const ClonedMessageData& aData,
                                   const InfallibleTArray<CpowEntry>& aCpows,
                                   const IPC::Principal& aPrincipal) MOZ_OVERRIDE;
 
+    virtual bool RecvAppOfflineStatus(const uint32_t& aId, const bool& aOffline) MOZ_OVERRIDE;
+
     virtual PDocumentRendererChild*
     AllocPDocumentRendererChild(const nsRect& documentRect, const gfx::Matrix& transform,
                                 const nsString& bgcolor,
                                 const uint32_t& renderFlags, const bool& flushLayout,
                                 const nsIntSize& renderSize) MOZ_OVERRIDE;
     virtual bool DeallocPDocumentRendererChild(PDocumentRendererChild* actor) MOZ_OVERRIDE;
     virtual bool RecvPDocumentRendererConstructor(PDocumentRendererChild* actor,
                                                   const nsRect& documentRect,
--- a/dom/ipc/TabParent.cpp
+++ b/dom/ipc/TabParent.cpp
@@ -235,16 +235,17 @@ TabParent::TabParent(nsIContentParent* a
   , mDPI(0)
   , mDefaultScale(0)
   , mShown(false)
   , mUpdatedDimensions(false)
   , mManager(aManager)
   , mMarkedDestroying(false)
   , mIsDestroyed(false)
   , mAppPackageFileDescriptorSent(false)
+  , mSendOfflineStatus(true)
   , mChromeFlags(aChromeFlags)
 {
   MOZ_ASSERT(aManager);
 }
 
 TabParent::~TabParent()
 {
 }
@@ -494,16 +495,24 @@ TabParent::LoadURL(nsIURI* aURI)
 
     if (!mShown) {
         NS_WARNING(nsPrintfCString("TabParent::LoadURL(%s) called before "
                                    "Show(). Ignoring LoadURL.\n",
                                    spec.get()).get());
         return;
     }
 
+    uint32_t appId = OwnOrContainingAppId();
+    if (mSendOfflineStatus && NS_IsAppOffline(appId)) {
+      // If the app is offline in the parent process
+      // pass that state to the child process as well
+      unused << SendAppOfflineStatus(appId, true);
+    }
+    mSendOfflineStatus = false;
+
     unused << SendLoadURL(spec);
 
     // If this app is a packaged app then we can speed startup by sending over
     // the file descriptor for the "application.zip" file that it will
     // invariably request. Only do this once.
     if (!mAppPackageFileDescriptorSent) {
         mAppPackageFileDescriptorSent = true;
 
@@ -1560,53 +1569,55 @@ TabParent::HandleQueryContentEvent(Widge
 }
 
 bool
 TabParent::SendCompositionEvent(WidgetCompositionEvent& event)
 {
   if (mIsDestroyed) {
     return false;
   }
+
+  if (event.message == NS_COMPOSITION_CHANGE) {
+    return SendCompositionChangeEvent(event);
+  }
+
   mIMEComposing = event.message != NS_COMPOSITION_END;
   mIMECompositionStart = std::min(mIMESelectionAnchor, mIMESelectionFocus);
   if (mIMECompositionEnding)
     return true;
   event.mSeqno = ++mIMESeqno;
   return PBrowserParent::SendCompositionEvent(event);
 }
 
 /**
  * During REQUEST_TO_COMMIT_COMPOSITION or REQUEST_TO_CANCEL_COMPOSITION,
- * widget usually sends a NS_TEXT_TEXT event to finalize or clear the
- * composition, respectively
+ * widget usually sends a NS_COMPOSITION_CHANGE event to finalize or
+ * clear the composition, respectively
  *
  * Because the event will not reach content in time, we intercept it
  * here and pass the text as the EndIMEComposition return value
  */
 bool
-TabParent::SendTextEvent(WidgetTextEvent& event)
+TabParent::SendCompositionChangeEvent(WidgetCompositionEvent& event)
 {
-  if (mIsDestroyed) {
-    return false;
-  }
   if (mIMECompositionEnding) {
-    mIMECompositionText = event.theText;
+    mIMECompositionText = event.mData;
     return true;
   }
 
   // We must be able to simulate the selection because
   // we might not receive selection updates in time
   if (!mIMEComposing) {
     mIMECompositionStart = std::min(mIMESelectionAnchor, mIMESelectionFocus);
   }
   mIMESelectionAnchor = mIMESelectionFocus =
-      mIMECompositionStart + event.theText.Length();
+      mIMECompositionStart + event.mData.Length();
 
   event.mSeqno = ++mIMESeqno;
-  return PBrowserParent::SendTextEvent(event);
+  return PBrowserParent::SendCompositionEvent(event);
 }
 
 bool
 TabParent::SendSelectionEvent(WidgetSelectionEvent& event)
 {
   if (mIsDestroyed) {
     return false;
   }
--- a/dom/ipc/TabParent.h
+++ b/dom/ipc/TabParent.h
@@ -313,17 +313,16 @@ public:
 
     NS_DECL_ISUPPORTS
     NS_DECL_NSIAUTHPROMPTPROVIDER
     NS_DECL_NSISECUREBROWSERUI
 
     static TabParent *GetIMETabParent() { return mIMETabParent; }
     bool HandleQueryContentEvent(mozilla::WidgetQueryContentEvent& aEvent);
     bool SendCompositionEvent(mozilla::WidgetCompositionEvent& event);
-    bool SendTextEvent(mozilla::WidgetTextEvent& event);
     bool SendSelectionEvent(mozilla::WidgetSelectionEvent& event);
 
     static TabParent* GetFrom(nsFrameLoader* aFrameLoader);
     static TabParent* GetFrom(nsIContent* aContent);
 
     nsIContentParent* Manager() { return mManager; }
 
     /**
@@ -359,16 +358,18 @@ protected:
     virtual PRenderFrameParent* AllocPRenderFrameParent(ScrollingBehavior* aScrolling,
                                                         TextureFactoryIdentifier* aTextureFactoryIdentifier,
                                                         uint64_t* aLayersId,
                                                         bool* aSuccess) MOZ_OVERRIDE;
     virtual bool DeallocPRenderFrameParent(PRenderFrameParent* aFrame) MOZ_OVERRIDE;
 
     virtual bool RecvRemotePaintIsReady() MOZ_OVERRIDE;
 
+    bool SendCompositionChangeEvent(mozilla::WidgetCompositionEvent& event);
+
     // IME
     static TabParent *mIMETabParent;
     nsString mIMECacheText;
     uint32_t mIMESelectionAnchor;
     uint32_t mIMESelectionFocus;
     bool mIMEComposing;
     bool mIMECompositionEnding;
     // Buffer to store composition text during ResetInputState
@@ -422,16 +423,20 @@ private:
     // managing PContent.
     bool mMarkedDestroying;
     // When true, the TabParent is invalid and we should not send IPC messages
     // anymore.
     bool mIsDestroyed;
     // Whether we have already sent a FileDescriptor for the app package.
     bool mAppPackageFileDescriptorSent;
 
+    // Whether we need to send the offline status to the TabChild
+    // This is true, until the first call of LoadURL
+    bool mSendOfflineStatus;
+
     uint32_t mChromeFlags;
 
     nsCOMPtr<nsILoadContext> mLoadContext;
 };
 
 } // namespace dom
 } // namespace mozilla
 
--- a/dom/media/GetUserMediaRequest.cpp
+++ b/dom/media/GetUserMediaRequest.cpp
@@ -18,17 +18,16 @@ GetUserMediaRequest::GetUserMediaRequest
     const MediaStreamConstraints& aConstraints,
     bool aIsSecure)
   : mInnerWindowID(aInnerWindow->WindowID())
   , mOuterWindowID(aInnerWindow->GetOuterWindow()->WindowID())
   , mCallID(aCallID)
   , mConstraints(new MediaStreamConstraints(aConstraints))
   , mIsSecure(aIsSecure)
 {
-  SetIsDOMBinding();
 }
 
 NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE_0(GetUserMediaRequest)
 NS_IMPL_CYCLE_COLLECTING_ADDREF(GetUserMediaRequest)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(GetUserMediaRequest)
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(GetUserMediaRequest)
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRY(nsISupports)
--- a/dom/media/PeerConnection.js
+++ b/dom/media/PeerConnection.js
@@ -145,16 +145,25 @@ GlobalPCList.prototype = {
     }
     else if (topic == "network:offline-status-changed") {
       if (data == "offline") {
         // this._list shold be empty here
         this._networkdown = true;
       } else if (data == "online") {
         this._networkdown = false;
       }
+    } else if (topic == "network:app-offline-status-changed") {
+      // App just went offline. The subject also contains the appId,
+      // but navigator.onLine checks that for us
+      if (!this._networkdown && !this._win.navigator.onLine) {
+        for (let winId in this._list) {
+          cleanupWinId(this._list, winId);
+        }
+      }
+      this._networkdown = !this._win.navigator.onLine;
     } else if (topic == "gmp-plugin-crash") {
       // a plugin crashed; if it's associated with any of our PCs, fire an
       // event to the DOM window
       let sep = data.indexOf(' ');
       let pluginId = data.slice(0, sep);
       let rest = data.slice(sep+1);
       // This presumes no spaces in the name!
       sep = rest.indexOf(' ');
@@ -327,17 +336,17 @@ RTCPeerConnection.prototype = {
   __init: function(rtcConfig) {
     if (!rtcConfig.iceServers ||
         !Services.prefs.getBoolPref("media.peerconnection.use_document_iceservers")) {
       rtcConfig.iceServers =
         JSON.parse(Services.prefs.getCharPref("media.peerconnection.default_iceservers"));
     }
     this._mustValidateRTCConfiguration(rtcConfig,
         "RTCPeerConnection constructor passed invalid RTCConfiguration");
-    if (_globalPCList._networkdown) {
+    if (_globalPCList._networkdown || !this._win.navigator.onLine) {
       throw new this._win.DOMError("",
           "Can't create RTCPeerConnections when the network is down");
     }
 
     this.makeGetterSetterEH("onaddstream");
     this.makeGetterSetterEH("onaddtrack");
     this.makeGetterSetterEH("onicecandidate");
     this.makeGetterSetterEH("onnegotiationneeded");
--- a/dom/mobileconnection/MobileCellInfo.cpp
+++ b/dom/mobileconnection/MobileCellInfo.cpp
@@ -25,17 +25,16 @@ MobileCellInfo::MobileCellInfo(nsPIDOMWi
   , mGsmLocationAreaCode(-1)
   , mGsmCellId(-1)
   , mCdmaBaseStationId(-1)
   , mCdmaBaseStationLatitude(-1)
   , mCdmaBaseStationLongitude(-1)
   , mCdmaSystemId(-1)
   , mCdmaNetworkId(-1)
 {
-  SetIsDOMBinding();
 }
 
 MobileCellInfo::MobileCellInfo(int32_t aGsmLocationAreaCode,
                                int64_t aGsmCellId,
                                int32_t aCdmaBaseStationId,
                                int32_t aCdmaBaseStationLatitude,
                                int32_t aCdmaBaseStationLongitude,
                                int32_t aCdmaSystemId,
@@ -44,19 +43,18 @@ MobileCellInfo::MobileCellInfo(int32_t a
   , mGsmCellId(aGsmCellId)
   , mCdmaBaseStationId(aCdmaBaseStationId)
   , mCdmaBaseStationLatitude(aCdmaBaseStationLatitude)
   , mCdmaBaseStationLongitude(aCdmaBaseStationLongitude)
   , mCdmaSystemId(aCdmaSystemId)
   , mCdmaNetworkId(aCdmaNetworkId)
 {
   // The instance created by this way is only used for IPC stuff. It won't be
-  // expose to JS directly, we will clone this instance to the one that is
-  // maintained in MobileConnectionChild. So we don't need SetIsDOMBinding()
-  // here.
+  // exposed to JS directly, we will clone this instance to the one that is
+  // maintained in MobileConnectionChild.
 }
 
 void
 MobileCellInfo::Update(nsIMobileCellInfo* aInfo)
 {
   if (!aInfo) {
     return;
   }
@@ -68,17 +66,16 @@ MobileCellInfo::Update(nsIMobileCellInfo
   aInfo->GetCdmaBaseStationLongitude(&mCdmaBaseStationLongitude);
   aInfo->GetCdmaSystemId(&mCdmaSystemId);
   aInfo->GetCdmaNetworkId(&mCdmaNetworkId);
 }
 
 JSObject*
 MobileCellInfo::WrapObject(JSContext* aCx)
 {
-  MOZ_ASSERT(IsDOMBinding());
   return MozMobileCellInfoBinding::Wrap(aCx, this);
 }
 
 // nsIMobileCellInfo
 
 NS_IMETHODIMP
 MobileCellInfo::GetGsmLocationAreaCode(int32_t* aGsmLocationAreaCode)
 {
--- a/dom/mobileconnection/MobileConnection.cpp
+++ b/dom/mobileconnection/MobileConnection.cpp
@@ -102,18 +102,16 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_
 NS_INTERFACE_MAP_END_INHERITING(DOMEventTargetHelper)
 
 NS_IMPL_ADDREF_INHERITED(MobileConnection, DOMEventTargetHelper)
 NS_IMPL_RELEASE_INHERITED(MobileConnection, DOMEventTargetHelper)
 
 MobileConnection::MobileConnection(nsPIDOMWindow* aWindow, uint32_t aClientId)
   : DOMEventTargetHelper(aWindow)
 {
-  SetIsDOMBinding();
-
   nsCOMPtr<nsIMobileConnectionService> service =
     do_GetService(NS_MOBILE_CONNECTION_SERVICE_CONTRACTID);
 
   // Not being able to acquire the service isn't fatal since we check
   // for it explicitly below.
   if (!service) {
     NS_WARNING("Could not acquire nsIMobileConnectionService!");
     return;
--- a/dom/mobileconnection/MobileConnectionArray.cpp
+++ b/dom/mobileconnection/MobileConnectionArray.cpp
@@ -29,17 +29,16 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 MobileConnectionArray::MobileConnectionArray(nsPIDOMWindow* aWindow)
   : mLengthInitialized(false)
   , mWindow(aWindow)
 {
-  SetIsDOMBinding();
 }
 
 MobileConnectionArray::~MobileConnectionArray()
 {
 }
 
 nsPIDOMWindow*
 MobileConnectionArray::GetParentObject() const
--- a/dom/mobileconnection/MobileConnectionInfo.cpp
+++ b/dom/mobileconnection/MobileConnectionInfo.cpp
@@ -53,17 +53,16 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
 NS_INTERFACE_MAP_END
 
 MobileConnectionInfo::MobileConnectionInfo(nsPIDOMWindow* aWindow)
   : mConnected(false)
   , mEmergencyCallsOnly(false)
   , mRoaming(false)
   , mWindow(aWindow)
 {
-  SetIsDOMBinding();
 }
 
 MobileConnectionInfo::MobileConnectionInfo(const nsAString& aState,
                                            bool aConnected,
                                            bool aEmergencyCallsOnly,
                                            bool aRoaming,
                                            nsIMobileNetworkInfo* aNetworkInfo,
                                            const nsAString& aType,
@@ -72,19 +71,18 @@ MobileConnectionInfo::MobileConnectionIn
                                            nsIMobileCellInfo* aCellInfo)
   : mConnected(aConnected)
   , mEmergencyCallsOnly(aEmergencyCallsOnly)
   , mRoaming(aRoaming)
   , mSignalStrength(aSignalStrength)
   , mRelSignalStrength(aRelSignalStrength)
 {
   // The instance created by this way is only used for IPC stuff. It won't be
-  // expose to JS directly, we will clone this instance to the one that is
-  // maintained in MobileConnectionChild. So we don't need SetIsDOMBinding()
-  // here.
+  // exposed to JS directly, we will clone this instance to the one that is
+  // maintained in MobileConnectionChild.
 
   // Update mState and mType
   CONVERT_STRING_TO_NULLABLE_ENUM(aState, MobileConnectionState, mState);
   CONVERT_STRING_TO_NULLABLE_ENUM(aType, MobileConnectionType, mType);
 
   // Update mNetworkInfo
   if (aNetworkInfo) {
     mNetworkInfo = new MobileNetworkInfo(mWindow);
@@ -161,17 +159,16 @@ MobileConnectionInfo::Update(nsIMobileCo
   } else {
     mCellInfo = nullptr;
   }
 }
 
 JSObject*
 MobileConnectionInfo::WrapObject(JSContext* aCx)
 {
-  MOZ_ASSERT(IsDOMBinding());
   return MozMobileConnectionInfoBinding::Wrap(aCx, this);
 }
 
 // nsIMobileConnectionInfo
 
 NS_IMETHODIMP
 MobileConnectionInfo::GetState(nsAString& aState)
 {
--- a/dom/mobileconnection/MobileNetworkInfo.cpp
+++ b/dom/mobileconnection/MobileNetworkInfo.cpp
@@ -17,33 +17,31 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRY(nsISupports)
   NS_INTERFACE_MAP_ENTRY(nsIMobileNetworkInfo)
 NS_INTERFACE_MAP_END
 
 MobileNetworkInfo::MobileNetworkInfo(nsPIDOMWindow* aWindow)
   : mWindow(aWindow)
 {
-  SetIsDOMBinding();
 }
 
 MobileNetworkInfo::MobileNetworkInfo(const nsAString& aShortName,
                                      const nsAString& aLongName,
                                      const nsAString& aMcc,
                                      const nsAString& aMnc,
                                      const nsAString& aState)
   : mShortName(aShortName)
   , mLongName(aLongName)
   , mMcc(aMcc)
   , mMnc(aMnc)
   , mState(aState)
 {
   // The parent object is nullptr when MobileNetworkInfo is created by this way.
   // And it won't be exposed to web content.
-  SetIsDOMBinding();
 }
 
 void
 MobileNetworkInfo::Update(nsIMobileNetworkInfo* aInfo)
 {
   if (!aInfo) {
     return;
   }
--- a/dom/network/Connection.cpp
+++ b/dom/network/Connection.cpp
@@ -23,29 +23,22 @@ namespace network {
 NS_IMPL_QUERY_INTERFACE_INHERITED(Connection, DOMEventTargetHelper,
                                   nsINetworkProperties)
 
 // Don't use |Connection| alone, since that confuses nsTraceRefcnt since
 // we're not the only class with that name.
 NS_IMPL_ADDREF_INHERITED(dom::network::Connection, DOMEventTargetHelper)
 NS_IMPL_RELEASE_INHERITED(dom::network::Connection, DOMEventTargetHelper)
 
-Connection::Connection()
-  : mType(static_cast<ConnectionType>(kDefaultType))
+Connection::Connection(nsPIDOMWindow* aWindow)
+  : DOMEventTargetHelper(aWindow)
+  , mType(static_cast<ConnectionType>(kDefaultType))
   , mIsWifi(kDefaultIsWifi)
   , mDHCPGateway(kDefaultDHCPGateway)
 {
-  SetIsDOMBinding();
-}
-
-void
-Connection::Init(nsPIDOMWindow* aWindow)
-{
-  BindToOwner(aWindow);
-
   hal::RegisterNetworkObserver(this);
 
   hal::NetworkInformation networkInfo;
   hal::GetCurrentNetworkInformation(&networkInfo);
 
   UpdateFromNetworkInfo(networkInfo);
 }
 
--- a/dom/network/Connection.h
+++ b/dom/network/Connection.h
@@ -27,19 +27,18 @@ class Connection MOZ_FINAL : public DOME
                            , public nsINetworkProperties
 {
 public:
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_NSINETWORKPROPERTIES
 
   NS_REALLY_FORWARD_NSIDOMEVENTTARGET(DOMEventTargetHelper)
 
-  Connection();
+  Connection(nsPIDOMWindow *aWindow);
 
-  void Init(nsPIDOMWindow *aWindow);
   void Shutdown();
 
   // For IObserver
   void Notify(const hal::NetworkInformation& aNetworkInfo);
 
   // WebIDL
 
   virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
--- a/dom/network/TCPSocketParent.cpp
+++ b/dom/network/TCPSocketParent.cpp
@@ -63,24 +63,70 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
 NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(TCPSocketParentBase)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(TCPSocketParentBase)
 
 TCPSocketParentBase::TCPSocketParentBase()
 : mIPCOpen(false)
 {
+  mObserver = new mozilla::net::OfflineObserver(this);
   mozilla::HoldJSObjects(this);
 }
 
 TCPSocketParentBase::~TCPSocketParentBase()
 {
+  if (mObserver) {
+    mObserver->RemoveObserver();
+  }
   mozilla::DropJSObjects(this);
 }
 
+uint32_t
+TCPSocketParent::GetAppId()
+{
+  uint32_t appId = nsIScriptSecurityManager::UNKNOWN_APP_ID;
+  const PContentParent *content = Manager()->Manager();
+  const InfallibleTArray<PBrowserParent*>& browsers = content->ManagedPBrowserParent();
+  if (browsers.Length() > 0) {
+    TabParent *tab = static_cast<TabParent*>(browsers[0]);
+    appId = tab->OwnAppId();
+  }
+  return appId;
+};
+
+nsresult
+TCPSocketParent::OfflineNotification(nsISupports *aSubject)
+{
+  nsCOMPtr<nsIAppOfflineInfo> info(do_QueryInterface(aSubject));
+  if (!info) {
+    return NS_OK;
+  }
+
+  uint32_t targetAppId = nsIScriptSecurityManager::UNKNOWN_APP_ID;
+  info->GetAppId(&targetAppId);
+
+  // Obtain App ID
+  uint32_t appId = GetAppId();
+  if (appId != targetAppId) {
+    return NS_OK;
+  }
+
+  // If the app is offline, close the socket
+  if (mSocket && NS_IsAppOffline(appId)) {
+    mSocket->Close();
+    mSocket = nullptr;
+    mIntermediaryObj = nullptr;
+    mIntermediary = nullptr;
+  }
+
+  return NS_OK;
+}
+
+
 void
 TCPSocketParentBase::ReleaseIPDLReference()
 {
   MOZ_ASSERT(mIPCOpen);
   mIPCOpen = false;
   this->Release();
 }
 
@@ -110,22 +156,22 @@ TCPSocketParent::RecvOpen(const nsString
   // tests without this loophole.
   if (net::UsingNeckoIPCSecurity() &&
       !AssertAppProcessPermission(Manager()->Manager(), "tcp-socket")) {
     FireInteralError(this, __LINE__);
     return true;
   }
 
   // Obtain App ID
-  uint32_t appId = nsIScriptSecurityManager::NO_APP_ID;
-  const PContentParent *content = Manager()->Manager();
-  const InfallibleTArray<PBrowserParent*>& browsers = content->ManagedPBrowserParent();
-  if (browsers.Length() > 0) {
-    TabParent *tab = static_cast<TabParent*>(browsers[0]);
-    appId = tab->OwnAppId();
+  uint32_t appId = GetAppId();
+
+  if (NS_IsAppOffline(appId)) {
+    NS_ERROR("Can't open socket because app is offline");
+    FireInteralError(this, __LINE__);
+    return true;
   }
 
   nsresult rv;
   mIntermediary = do_CreateInstance("@mozilla.org/tcp-socket-intermediary;1", &rv);
   if (NS_FAILED(rv)) {
     FireInteralError(this, __LINE__);
     return true;
   }
--- a/dom/network/TCPSocketParent.h
+++ b/dom/network/TCPSocketParent.h
@@ -6,41 +6,44 @@
 #define mozilla_dom_TCPSocketParent_h
 
 #include "mozilla/net/PTCPSocketParent.h"
 #include "nsITCPSocketParent.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsCOMPtr.h"
 #include "nsIDOMTCPSocket.h"
 #include "js/TypeDecls.h"
+#include "mozilla/net/OfflineObserver.h"
 
 #define TCPSOCKETPARENT_CID \
   { 0x4e7246c6, 0xa8b3, 0x426d, { 0x9c, 0x17, 0x76, 0xda, 0xb1, 0xe1, 0xe1, 0x4a } }
 
 namespace mozilla {
 namespace dom {
 
 class PBrowserParent;
 
 class TCPSocketParentBase : public nsITCPSocketParent
+                          , public mozilla::net::DisconnectableParent
 {
 public:
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(TCPSocketParentBase)
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
 
   void AddIPDLReference();
   void ReleaseIPDLReference();
 
 protected:
   TCPSocketParentBase();
   virtual ~TCPSocketParentBase();
 
   JS::Heap<JSObject*> mIntermediaryObj;
   nsCOMPtr<nsITCPSocketIntermediary> mIntermediary;
   nsCOMPtr<nsIDOMTCPSocket> mSocket;
+  nsRefPtr<mozilla::net::OfflineObserver> mObserver;
   bool mIPCOpen;
 };
 
 class TCPSocketParent : public mozilla::net::PTCPSocketParent
                       , public TCPSocketParentBase
 {
 public:
   NS_DECL_NSITCPSOCKETPARENT
@@ -53,16 +56,18 @@ public:
 
   virtual bool RecvStartTLS() MOZ_OVERRIDE;
   virtual bool RecvSuspend() MOZ_OVERRIDE;
   virtual bool RecvResume() MOZ_OVERRIDE;
   virtual bool RecvClose() MOZ_OVERRIDE;
   virtual bool RecvData(const SendableData& aData,
                         const uint32_t& aTrackingNumber) MOZ_OVERRIDE;
   virtual bool RecvRequestDelete() MOZ_OVERRIDE;
+  virtual nsresult OfflineNotification(nsISupports *) MOZ_OVERRIDE;
+  virtual uint32_t GetAppId() MOZ_OVERRIDE;
 
 private:
   virtual void ActorDestroy(ActorDestroyReason why) MOZ_OVERRIDE;
 };
 
 } // namespace dom
 } // namespace mozilla
 
--- a/dom/network/UDPSocketParent.cpp
+++ b/dom/network/UDPSocketParent.cpp
@@ -10,24 +10,74 @@
 #include "nsIUDPSocket.h"
 #include "nsINetAddr.h"
 #include "mozilla/AppProcessChecker.h"
 #include "mozilla/unused.h"
 #include "mozilla/ipc/InputStreamUtils.h"
 #include "mozilla/net/DNS.h"
 #include "mozilla/net/NeckoCommon.h"
 #include "mozilla/net/PNeckoParent.h"
+#include "nsNetUtil.h"
+#include "mozilla/dom/ContentParent.h"
+#include "mozilla/dom/TabParent.h"
 
 namespace mozilla {
 namespace dom {
 
 NS_IMPL_ISUPPORTS(UDPSocketParent, nsIUDPSocketListener)
 
+UDPSocketParent::UDPSocketParent()
+  : mIPCOpen(true)
+{
+  mObserver = new mozilla::net::OfflineObserver(this);
+}
+
 UDPSocketParent::~UDPSocketParent()
 {
+  if (mObserver) {
+    mObserver->RemoveObserver();
+  }
+}
+
+nsresult
+UDPSocketParent::OfflineNotification(nsISupports *aSubject)
+{
+  nsCOMPtr<nsIAppOfflineInfo> info(do_QueryInterface(aSubject));
+  if (!info) {
+    return NS_OK;
+  }
+
+  uint32_t targetAppId = nsIScriptSecurityManager::UNKNOWN_APP_ID;
+  info->GetAppId(&targetAppId);
+
+  // Obtain App ID
+  uint32_t appId = GetAppId();
+  if (appId != targetAppId) {
+    return NS_OK;
+  }
+
+  // If the app is offline, close the socket
+  if (mSocket && NS_IsAppOffline(appId)) {
+    mSocket->Close();
+  }
+
+  return NS_OK;
+}
+
+uint32_t
+UDPSocketParent::GetAppId()
+{
+  uint32_t appId = nsIScriptSecurityManager::UNKNOWN_APP_ID;
+  const PContentParent *content = Manager()->Manager();
+  const InfallibleTArray<PBrowserParent*>& browsers = content->ManagedPBrowserParent();
+  if (browsers.Length() > 0) {
+    TabParent *tab = static_cast<TabParent*>(browsers[0]);
+    appId = tab->OwnAppId();
+  }
+  return appId;
 }
 
 bool
 UDPSocketParent::Init(const nsACString& aFilter)
 {
   if (!aFilter.IsEmpty()) {
     nsAutoCString contractId(NS_NETWORK_UDP_SOCKET_FILTER_HANDLER_PREFIX);
     contractId.Append(aFilter);
--- a/dom/network/UDPSocketParent.h
+++ b/dom/network/UDPSocketParent.h
@@ -6,57 +6,61 @@
 
 #ifndef mozilla_dom_UDPSocketParent_h__
 #define mozilla_dom_UDPSocketParent_h__
 
 #include "mozilla/net/PUDPSocketParent.h"
 #include "nsCOMPtr.h"
 #include "nsIUDPSocket.h"
 #include "nsIUDPSocketFilter.h"
+#include "mozilla/net/OfflineObserver.h"
 
 namespace mozilla {
 namespace dom {
 
 class UDPSocketParent : public mozilla::net::PUDPSocketParent
                       , public nsIUDPSocketListener
+                      , public mozilla::net::DisconnectableParent
 {
 public:
   NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSIUDPSOCKETLISTENER
 
-  UDPSocketParent() :
-    mIPCOpen(true) {}
+  UDPSocketParent();
 
   bool Init(const nsACString& aFilter);
 
   virtual bool RecvBind(const UDPAddressInfo& aAddressInfo,
                         const bool& aAddressReuse, const bool& aLoopback) MOZ_OVERRIDE;
 
   virtual bool RecvOutgoingData(const UDPData& aData, const UDPSocketAddr& aAddr) MOZ_OVERRIDE;
 
   virtual bool RecvClose() MOZ_OVERRIDE;
 
   virtual bool RecvRequestDelete() MOZ_OVERRIDE;
   virtual bool RecvJoinMulticast(const nsCString& aMulticastAddress,
                                  const nsCString& aInterface) MOZ_OVERRIDE;
   virtual bool RecvLeaveMulticast(const nsCString& aMulticastAddress,
                                   const nsCString& aInterface) MOZ_OVERRIDE;
+  virtual nsresult OfflineNotification(nsISupports *) MOZ_OVERRIDE;
+  virtual uint32_t GetAppId() MOZ_OVERRIDE;
 
 private:
   virtual ~UDPSocketParent();
 
   virtual void ActorDestroy(ActorDestroyReason why) MOZ_OVERRIDE;
   void Send(const InfallibleTArray<uint8_t>& aData, const UDPSocketAddr& aAddr);
   void Send(const InputStreamParams& aStream, const UDPSocketAddr& aAddr);
   nsresult BindInternal(const nsCString& aHost, const uint16_t& aPort,
                         const bool& aAddressReuse, const bool& aLoopback);
 
   void FireInternalError(uint32_t aLineNo);
 
   bool mIPCOpen;
   nsCOMPtr<nsIUDPSocket> mSocket;
   nsCOMPtr<nsIUDPSocketFilter> mFilter;
+  nsRefPtr<mozilla::net::OfflineObserver> mObserver;
 };
 
 } // namespace dom
 } // namespace mozilla
 
 #endif // !defined(mozilla_dom_UDPSocketParent_h__)
--- a/dom/nfc/MozNDEFRecord.cpp
+++ b/dom/nfc/MozNDEFRecord.cpp
@@ -145,17 +145,16 @@ MozNDEFRecord::MozNDEFRecord(JSContext* 
   }
 
   if (aOptions.mPayload.WasPassed()) {
     const Uint8Array& payload = aOptions.mPayload.Value();
     payload.ComputeLengthAndData();
     mPayload = Uint8Array::Create(aCx, this, payload.Length(), payload.Data());
   }
 
-  SetIsDOMBinding();
   HoldData();
 }
 
 MozNDEFRecord::~MozNDEFRecord()
 {
   DropData();
 }
 
--- a/dom/notification/DesktopNotification.h
+++ b/dom/notification/DesktopNotification.h
@@ -46,18 +46,16 @@ public:
     MOZ_ASSERT(aWindow);
     mOwner = aWindow;
 
     nsCOMPtr<nsIScriptObjectPrincipal> sop = do_QueryInterface(aWindow);
     MOZ_ASSERT(sop);
 
     mPrincipal = sop->GetPrincipal();
     MOZ_ASSERT(mPrincipal);
-
-    SetIsDOMBinding();
   }
 
   void Shutdown() {
     mOwner = nullptr;
   }
 
   nsPIDOMWindow* GetParentObject() const
   {
--- a/dom/power/PowerManager.h
+++ b/dom/power/PowerManager.h
@@ -24,21 +24,16 @@ namespace dom {
 class PowerManager MOZ_FINAL : public nsIDOMMozWakeLockListener
                              , public nsWrapperCache
 {
 public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(PowerManager)
   NS_DECL_NSIDOMMOZWAKELOCKLISTENER
 
-  PowerManager()
-  {
-    SetIsDOMBinding();
-  }
-
   nsresult Init(nsIDOMWindow *aWindow);
   nsresult Shutdown();
 
   static already_AddRefed<PowerManager> CreateInstance(nsPIDOMWindow*);
 
   // WebIDL
   nsIDOMWindow* GetParentObject() const
   {
--- a/dom/power/WakeLock.cpp
+++ b/dom/power/WakeLock.cpp
@@ -34,17 +34,16 @@ NS_INTERFACE_MAP_END
 NS_IMPL_CYCLE_COLLECTING_ADDREF(WakeLock)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(WakeLock)
 
 WakeLock::WakeLock()
   : mLocked(false)
   , mHidden(true)
   , mContentParentID(CONTENT_PROCESS_ID_UNKNOWN)
 {
-  SetIsDOMBinding();
 }
 
 WakeLock::~WakeLock()
 {
   DoUnlock();
   DetachEventListener();
 }
 
--- a/dom/promise/Promise.cpp
+++ b/dom/promise/Promise.cpp
@@ -302,17 +302,16 @@ Promise::Promise(nsIGlobalObject* aGloba
   , mState(Pending)
   , mTaskPending(false)
   , mHadRejectCallback(false)
   , mResolvePending(false)
 {
   MOZ_ASSERT(mGlobal);
 
   mozilla::HoldJSObjects(this);
-  SetIsDOMBinding();
 }
 
 Promise::~Promise()
 {
   MaybeReportRejectedOnce();
   mozilla::DropJSObjects(this);
 }
 
--- a/dom/smil/TimeEvent.cpp
+++ b/dom/smil/TimeEvent.cpp
@@ -14,17 +14,16 @@ namespace dom {
 
 TimeEvent::TimeEvent(EventTarget* aOwner,
                      nsPresContext* aPresContext,
                      InternalSMILTimeEvent* aEvent)
   : Event(aOwner, aPresContext,
           aEvent ? aEvent : new InternalSMILTimeEvent(false, 0))
   , mDetail(mEvent->AsSMILTimeEvent()->detail)
 {
-  SetIsDOMBinding();
   if (aEvent) {
     mEventIsInternal = false;
   } else {
     mEventIsInternal = true;
   }
 
   if (mPresContext) {
     nsCOMPtr<nsIDocShell> docShell = mPresContext->GetDocShell();
--- a/dom/speakermanager/SpeakerManager.cpp
+++ b/dom/speakermanager/SpeakerManager.cpp
@@ -20,17 +20,16 @@ NS_IMPL_QUERY_INTERFACE_INHERITED(Speake
                                   nsIDOMEventListener)
 NS_IMPL_ADDREF_INHERITED(SpeakerManager, DOMEventTargetHelper)
 NS_IMPL_RELEASE_INHERITED(SpeakerManager, DOMEventTargetHelper)
 
 SpeakerManager::SpeakerManager()
   : mForcespeaker(false)
   , mVisible(false)
 {
-  SetIsDOMBinding();
   SpeakerManagerService *service =
     SpeakerManagerService::GetOrCreateSpeakerManagerService();
   MOZ_ASSERT(service);
   service->RegisterSpeakerManager(this);
 }
 
 SpeakerManager::~SpeakerManager()
 {
--- a/dom/storage/DOMStorage.cpp
+++ b/dom/storage/DOMStorage.cpp
@@ -47,17 +47,16 @@ DOMStorage::DOMStorage(nsIDOMWindow* aWi
 , mManager(aManager)
 , mCache(aCache)
 , mDocumentURI(aDocumentURI)
 , mPrincipal(aPrincipal)
 , mIsPrivate(aIsPrivate)
 , mIsSessionOnly(false)
 {
   mCache->Preload();
-  SetIsDOMBinding();
 }
 
 DOMStorage::~DOMStorage()
 {
   mCache->KeepAlive();
 }
 
 /* virtual */ JSObject*
--- a/dom/system/gonk/AudioChannelManager.cpp
+++ b/dom/system/gonk/AudioChannelManager.cpp
@@ -25,17 +25,16 @@ NS_IMPL_ADDREF_INHERITED(AudioChannelMan
 NS_IMPL_RELEASE_INHERITED(AudioChannelManager, DOMEventTargetHelper)
 
 AudioChannelManager::AudioChannelManager()
   : mState(SWITCH_STATE_UNKNOWN)
   , mVolumeChannel(-1)
 {
   RegisterSwitchObserver(SWITCH_HEADPHONES, this);
   mState = GetCurrentSwitchState(SWITCH_HEADPHONES);
-  SetIsDOMBinding();
 }
 
 AudioChannelManager::~AudioChannelManager()
 {
   UnregisterSwitchObserver(SWITCH_HEADPHONES, this);
 
   nsCOMPtr<EventTarget> target = do_QueryInterface(GetOwner());
   NS_ENSURE_TRUE_VOID(target);
--- a/dom/telephony/CallsList.cpp
+++ b/dom/telephony/CallsList.cpp
@@ -24,18 +24,16 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
 CallsList::CallsList(Telephony* aTelephony, TelephonyCallGroup* aGroup)
 : mTelephony(aTelephony), mGroup(aGroup)
 {
   MOZ_ASSERT(mTelephony);
-
-  SetIsDOMBinding();
 }
 
 CallsList::~CallsList()
 {
 }
 
 nsPIDOMWindow*
 CallsList::GetParentObject() const
--- a/dom/telephony/TelephonyCallId.cpp
+++ b/dom/telephony/TelephonyCallId.cpp
@@ -14,17 +14,16 @@ namespace dom {
 TelephonyCallId::TelephonyCallId(nsPIDOMWindow* aWindow,
                                  const nsAString& aNumber,
                                  uint16_t aNumberPresentation,
                                  const nsAString& aName,
                                  uint16_t aNamePresentation)
 : mWindow(aWindow), mNumber(aNumber), mNumberPresentation(aNumberPresentation),
   mName(aName), mNamePresentation(aNamePresentation)
 {
-  SetIsDOMBinding();
 }
 
 TelephonyCallId::~TelephonyCallId()
 {
 }
 
 JSObject*
 TelephonyCallId::WrapObject(JSContext* aCx)
--- a/dom/time/TimeManager.h
+++ b/dom/time/TimeManager.h
@@ -31,17 +31,16 @@ public:
   }
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(TimeManager)
 
   explicit TimeManager(nsPIDOMWindow* aWindow)
     : mWindow(aWindow)
   {
-    SetIsDOMBinding();
   }
 
   nsPIDOMWindow* GetParentObject() const
   {
     return mWindow;
   }
   JSObject* WrapObject(JSContext* aCx);
 
--- a/dom/voicemail/VoicemailStatus.cpp
+++ b/dom/voicemail/VoicemailStatus.cpp
@@ -26,18 +26,16 @@ NS_INTERFACE_MAP_END
 
 VoicemailStatus::VoicemailStatus(nsISupports* aParent,
                                  nsIVoicemailProvider* aProvider)
   : mParent(aParent)
   , mProvider(aProvider)
 {
   MOZ_ASSERT(mParent);
   MOZ_ASSERT(mProvider);
-
-  SetIsDOMBinding();
 }
 
 JSObject*
 VoicemailStatus::WrapObject(JSContext* aCx)
 {
   return MozVoicemailStatusBinding::Wrap(aCx, this);
 }
 
--- a/dom/workers/Location.h
+++ b/dom/workers/Location.h
@@ -39,17 +39,16 @@ class WorkerLocation MOZ_FINAL : public 
     , mHostname(aHostname)
     , mPort(aPort)
     , mPathname(aPathname)
     , mSearch(aSearch)
     , mHash(aHash)
     , mOrigin(aOrigin)
   {
     MOZ_COUNT_CTOR(WorkerLocation);
-    SetIsDOMBinding();
   }
 
   ~WorkerLocation()
   {
     MOZ_COUNT_DTOR(WorkerLocation);
   }
 
 public:
--- a/dom/workers/MessagePort.cpp
+++ b/dom/workers/MessagePort.cpp
@@ -76,24 +76,22 @@ BEGIN_WORKERS_NAMESPACE
 
 MessagePort::MessagePort(nsPIDOMWindow* aWindow, SharedWorker* aSharedWorker,
                          uint64_t aSerial)
 : MessagePortBase(aWindow), mSharedWorker(aSharedWorker),
   mWorkerPrivate(nullptr), mSerial(aSerial), mStarted(false)
 {
   AssertIsOnMainThread();
   MOZ_ASSERT(aSharedWorker);
-  SetIsDOMBinding();
 }
 
 MessagePort::MessagePort(WorkerPrivate* aWorkerPrivate, uint64_t aSerial)
 : mWorkerPrivate(aWorkerPrivate), mSerial(aSerial), mStarted(false)
 {
   aWorkerPrivate->AssertIsOnWorkerThread();
-  SetIsDOMBinding();
 }
 
 MessagePort::~MessagePort()
 {
   Close();
 }
 
 void
--- a/dom/workers/Navigator.h
+++ b/dom/workers/Navigator.h
@@ -31,17 +31,16 @@ class WorkerNavigator MOZ_FINAL : public
   bool mOnline;
 
   WorkerNavigator(const NavigatorProperties& aProperties,
                   bool aOnline)
     : mProperties(aProperties)
     , mOnline(aOnline)
   {
     MOZ_COUNT_CTOR(WorkerNavigator);
-    SetIsDOMBinding();
   }
 
   ~WorkerNavigator()
   {
     MOZ_COUNT_DTOR(WorkerNavigator);
   }
 
 public:
--- a/dom/workers/Performance.cpp
+++ b/dom/workers/Performance.cpp
@@ -13,17 +13,16 @@ NS_IMPL_CYCLE_COLLECTION_ROOT_NATIVE(Per
 NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(Performance, Release)
 
 NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE_0(Performance)
 
 Performance::Performance(WorkerPrivate* aWorkerPrivate)
   : mWorkerPrivate(aWorkerPrivate)
 {
   mWorkerPrivate->AssertIsOnWorkerThread();
-  SetIsDOMBinding();
 }
 
 Performance::~Performance()
 {
   mWorkerPrivate->AssertIsOnWorkerThread();
 }
 
 JSObject*
--- a/dom/workers/RuntimeService.cpp
+++ b/dom/workers/RuntimeService.cpp
@@ -2595,16 +2595,22 @@ RuntimeService::Observe(nsISupports* aSu
     GarbageCollectAllWorkers(/* shrinking = */ true);
     CycleCollectAllWorkers();
     return NS_OK;
   }
   if (!strcmp(aTopic, NS_IOSERVICE_OFFLINE_STATUS_TOPIC)) {
     SendOfflineStatusChangeEventToAllWorkers(NS_IsOffline());
     return NS_OK;
   }
+  if (!strcmp(aTopic, NS_IOSERVICE_APP_OFFLINE_STATUS_TOPIC)) {
+    BROADCAST_ALL_WORKERS(OfflineStatusChangeEvent,
+                          NS_IsOffline() ||
+                          NS_IsAppOffline(workers[index]->GetPrincipal()));
+    return NS_OK;
+  }
 
   NS_NOTREACHED("Unknown observer topic!");
   return NS_OK;
 }
 
 /* static */ void
 RuntimeService::WorkerPrefChanged(const char* aPrefName, void* aClosure)
 {
--- a/dom/workers/WorkerPrivate.cpp
+++ b/dom/workers/WorkerPrivate.cpp
@@ -2130,18 +2130,16 @@ WorkerPrivateParent<Derived>::WorkerPriv
   mMemoryReportCondVar(mMutex, "WorkerPrivateParent Memory Report CondVar"),
   mParent(aParent), mScriptURL(aScriptURL),
   mSharedWorkerName(aSharedWorkerName), mBusyCount(0), mMessagePortSerial(0),
   mParentStatus(Pending), mParentSuspended(false),
   mIsChromeWorker(aIsChromeWorker), mMainThreadObjectsForgotten(false),
   mWorkerType(aWorkerType),
   mCreationTimeStamp(TimeStamp::Now())
 {
-  SetIsDOMBinding();
-
   MOZ_ASSERT_IF(!IsDedicatedWorker(),
                 !aSharedWorkerName.IsVoid() && NS_IsMainThread());
   MOZ_ASSERT_IF(IsDedicatedWorker(), aSharedWorkerName.IsEmpty());
 
   if (aLoadInfo.mWindow) {
     AssertIsOnMainThread();
     MOZ_ASSERT(aLoadInfo.mWindow->IsInnerWindow(),
                "Should have inner window here!");
@@ -3025,16 +3023,21 @@ WorkerPrivateParent<Derived>::OfflineSta
   }
 }
 
 void
 WorkerPrivate::OfflineStatusChangeEventInternal(JSContext* aCx, bool aIsOffline)
 {
   AssertIsOnWorkerThread();
 
+  // The worker is already in this state. No need to dispatch an event.
+  if (mOnLine == !aIsOffline) {
+    return;
+  }
+
   for (uint32_t index = 0; index < mChildWorkers.Length(); ++index) {
     mChildWorkers[index]->OfflineStatusChangeEvent(aCx, aIsOffline);
   }
 
   mOnLine = !aIsOffline;
   WorkerGlobalScope* globalScope = GlobalScope();
   nsRefPtr<WorkerNavigator> nav = globalScope->GetExistingNavigator();
   if (nav) {
@@ -3577,17 +3580,17 @@ WorkerPrivate::WorkerPrivate(JSContext* 
   if (aParent) {
     aParent->AssertIsOnWorkerThread();
     aParent->GetAllPreferences(mPreferences);
     mOnLine = aParent->OnLine();
   }
   else {
     AssertIsOnMainThread();
     RuntimeService::GetDefaultPreferences(mPreferences);
-    mOnLine = !NS_IsOffline();
+    mOnLine = !NS_IsOffline() && !NS_IsAppOffline(aLoadInfo.mPrincipal);
   }
 }
 
 WorkerPrivate::~WorkerPrivate()
 {
 }
 
 // static
--- a/dom/workers/WorkerScope.cpp
+++ b/dom/workers/WorkerScope.cpp
@@ -42,18 +42,16 @@ using namespace mozilla::dom;
 USING_WORKERS_NAMESPACE
 
 BEGIN_WORKERS_NAMESPACE
 
 WorkerGlobalScope::WorkerGlobalScope(WorkerPrivate* aWorkerPrivate)
 : mWorkerPrivate(aWorkerPrivate)
 {
   mWorkerPrivate->AssertIsOnWorkerThread();
-
-  SetIsDOMBinding();
 }
 
 WorkerGlobalScope::~WorkerGlobalScope()
 {
   mWorkerPrivate->AssertIsOnWorkerThread();
 }
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(WorkerGlobalScope)
--- a/dom/workers/XMLHttpRequest.cpp
+++ b/dom/workers/XMLHttpRequest.cpp
@@ -1570,18 +1570,16 @@ SendRunnable::MainThreadRun()
 XMLHttpRequest::XMLHttpRequest(WorkerPrivate* aWorkerPrivate)
 : mWorkerPrivate(aWorkerPrivate),
   mResponseType(XMLHttpRequestResponseType::Text), mTimeout(0),
   mRooted(false), mBackgroundRequest(false), mWithCredentials(false),
   mCanceled(false), mMozAnon(false), mMozSystem(false)
 {
   mWorkerPrivate->AssertIsOnWorkerThread();
 
-  SetIsDOMBinding();
-
   mozilla::HoldJSObjects(this);
 }
 
 XMLHttpRequest::~XMLHttpRequest()
 {
   mWorkerPrivate->AssertIsOnWorkerThread();
 
   ReleaseProxy(XHRIsGoingAway);
--- a/dom/workers/XMLHttpRequestUpload.cpp
+++ b/dom/workers/XMLHttpRequestUpload.cpp
@@ -9,17 +9,16 @@
 
 #include "mozilla/dom/XMLHttpRequestUploadBinding.h"
 
 USING_WORKERS_NAMESPACE
 
 XMLHttpRequestUpload::XMLHttpRequestUpload(XMLHttpRequest* aXHR)
 : mXHR(aXHR)
 {
-  SetIsDOMBinding();
 }
 
 XMLHttpRequestUpload::~XMLHttpRequestUpload()
 {
 }
 
 NS_IMPL_ADDREF_INHERITED(XMLHttpRequestUpload, nsXHREventTarget)
 NS_IMPL_RELEASE_INHERITED(XMLHttpRequestUpload, nsXHREventTarget)
--- a/dom/xbl/XBLChildrenElement.h
+++ b/dom/xbl/XBLChildrenElement.h
@@ -147,17 +147,16 @@ private:
 
 class nsAnonymousContentList : public nsINodeList
 {
 public:
   explicit nsAnonymousContentList(nsIContent* aParent)
     : mParent(aParent)
   {
     MOZ_COUNT_CTOR(nsAnonymousContentList);
-    SetIsDOMBinding();
   }
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(nsAnonymousContentList)
   // nsIDOMNodeList interface
   NS_DECL_NSIDOMNODELIST
 
   // nsINodeList interface
--- a/dom/xslt/xpath/XPathResult.cpp
+++ b/dom/xslt/xpath/XPathResult.cpp
@@ -24,30 +24,28 @@ XPathResult::XPathResult(nsINode* aParen
     : mParent(aParent),
       mDocument(nullptr),
       mCurrentPos(0),
       mResultType(ANY_TYPE),
       mInvalidIteratorState(true),
       mBooleanResult(false),
       mNumberResult(0)
 {
-    SetIsDOMBinding();
 }
 
 XPathResult::XPathResult(const XPathResult &aResult)
     : mParent(aResult.mParent),
       mResult(aResult.mResult),
       mResultNodes(aResult.mResultNodes),
       mDocument(aResult.mDocument),
       mContextNode(aResult.mContextNode),
       mCurrentPos(0),
       mResultType(aResult.mResultType),
       mInvalidIteratorState(aResult.mInvalidIteratorState)
 {
-    SetIsDOMBinding();
     if (mDocument) {
         mDocument->AddMutationObserver(this);
     }
 }
 
 XPathResult::~XPathResult()
 {
     RemoveObserver();
--- a/editor/libeditor/nsEditor.cpp
+++ b/editor/libeditor/nsEditor.cpp
@@ -968,17 +968,17 @@ nsEditor::EndPlaceHolderTransaction()
       }
       else  
       {
         // in the future we will check to make sure undo is off here,
         // since that is the only known case where the placeholdertxn would disappear on us.
         // For now just removing the assert.
       }
       // notify editor observers of action but if composing, it's done by
-      // text event handler.
+      // compositionchange event handler.
       if (!mComposition) {
         NotifyEditorObservers(eNotifyEditorObserversOfEnd);
       }
     } else {
       NotifyEditorObservers(eNotifyEditorObserversOfCancel);
     }
   }
   mPlaceHolderBatch--;
@@ -5092,37 +5092,32 @@ nsEditor::IsAcceptableInputEvent(nsIDOME
   // focus, we shouldn't handle it.
   if (widgetEvent->IsUsingCoordinates()) {
     nsCOMPtr<nsIContent> focusedContent = GetFocusedContent();
     if (!focusedContent) {
       return false;
     }
   }
 
-  // If composition event or text event isn't dispatched via widget,
-  // we need to ignore them since they cannot be managed by TextComposition.
-  // E.g., the event was created by chrome JS.
+  // If a composition event isn't dispatched via widget, we need to ignore them
+  // since they cannot be managed by TextComposition. E.g., the event was
+  // created by chrome JS.
   // Note that if we allow to handle such events, editor may be confused by
   // strange event order.
   bool needsWidget = false;
   WidgetGUIEvent* widgetGUIEvent = nullptr;
   switch (widgetEvent->message) {
     case NS_USER_DEFINED_EVENT:
       // If events are not created with proper event interface, their message
       // are initialized with NS_USER_DEFINED_EVENT.  Let's ignore such event.
       return false;
-    case NS_TEXT_TEXT:
-      // Don't allow text events whose internal event are not
-      // WidgetTextEvent.
-      widgetGUIEvent = aEvent->GetInternalNSEvent()->AsTextEvent();
-      needsWidget = true;
-      break;
     case NS_COMPOSITION_START:
     case NS_COMPOSITION_END:
     case NS_COMPOSITION_UPDATE:
+    case NS_COMPOSITION_CHANGE:
       // Don't allow composition events whose internal event are not
       // WidgetCompositionEvent.
       widgetGUIEvent = aEvent->GetInternalNSEvent()->AsCompositionEvent();
       needsWidget = true;
       break;
     default:
       break;
   }
--- a/editor/libeditor/nsEditor.h
+++ b/editor/libeditor/nsEditor.h
@@ -412,19 +412,18 @@ protected:
   bool CanEnableSpellCheck()
   {
     // Check for password/readonly/disabled, which are not spellchecked
     // regardless of DOM. Also, check to see if spell check should be skipped or not.
     return !IsPasswordEditor() && !IsReadonly() && !IsDisabled() && !ShouldSkipSpellCheck();
   }
 
   /**
-   * EnsureComposition() should be composition event handlers or text event
-   * handler.  This tries to get the composition for the event and set it to
-   * mComposition.
+   * EnsureComposition() should be called by composition event handlers.  This
+   * tries to get the composition for the event and set it to mComposition.
    */
   void EnsureComposition(mozilla::WidgetGUIEvent* aEvent);
 
 public:
 
   /** All editor operations which alter the doc should be prefaced
    *  with a call to StartOperation, naming the action and direction */
   NS_IMETHOD StartOperation(EditAction opID,
--- a/editor/libeditor/nsEditorEventListener.cpp
+++ b/editor/libeditor/nsEditorEventListener.cpp
@@ -451,17 +451,17 @@ nsEditorEventListener::HandleEvent(nsIDO
     }
     // focus
     case NS_FOCUS_CONTENT:
       return Focus(aEvent);
     // blur
     case NS_BLUR_CONTENT:
       return Blur(aEvent);
     // text
-    case NS_TEXT_TEXT:
+    case NS_COMPOSITION_CHANGE:
       return HandleText(aEvent);
     // compositionstart
     case NS_COMPOSITION_START:
       return HandleStartComposition(aEvent);
     // compositionend
     case NS_COMPOSITION_END:
       HandleEndComposition(aEvent);
       return NS_OK;
--- a/editor/libeditor/nsPlaintextEditor.cpp
+++ b/editor/libeditor/nsPlaintextEditor.cpp
@@ -841,50 +841,52 @@ nsPlaintextEditor::BeginIMEComposition(W
   return nsEditor::BeginIMEComposition(aEvent);
 }
 
 nsresult
 nsPlaintextEditor::UpdateIMEComposition(nsIDOMEvent* aDOMTextEvent)
 {
   NS_ABORT_IF_FALSE(aDOMTextEvent, "aDOMTextEvent must not be nullptr");
 
-  WidgetTextEvent* widgetTextEvent =
-    aDOMTextEvent->GetInternalNSEvent()->AsTextEvent();
-  NS_ENSURE_TRUE(widgetTextEvent, NS_ERROR_INVALID_ARG);
+  WidgetCompositionEvent* compositionChangeEvent =
+    aDOMTextEvent->GetInternalNSEvent()->AsCompositionEvent();
+  NS_ENSURE_TRUE(compositionChangeEvent, NS_ERROR_INVALID_ARG);
+  MOZ_ASSERT(compositionChangeEvent->message == NS_COMPOSITION_CHANGE,
+             "The internal event should be NS_COMPOSITION_CHANGE");
 
-  EnsureComposition(widgetTextEvent);
+  EnsureComposition(compositionChangeEvent);
 
   nsCOMPtr<nsIPresShell> ps = GetPresShell();
   NS_ENSURE_TRUE(ps, NS_ERROR_NOT_INITIALIZED);
 
   nsCOMPtr<nsISelection> selection;
   nsresult rv = GetSelection(getter_AddRefs(selection));
   NS_ENSURE_SUCCESS(rv, rv);
 
   // NOTE: TextComposition should receive selection change notification before
-  //       TextEventHandlingMarker notifies TextComposition of the end of
-  //       handling TextEvent because TextComposition may need to ignore
-  //       selection changes caused by composition.  Therefore,
-  //       TextEventHandlingMarker must be destroyed after a call of
-  //       NotifiyEditorObservers(eNotifyEditorObserversOfEnd) or
+  //       CompositionChangeEventHandlingMarker notifies TextComposition of the
+  //       end of handling compositionchange event because TextComposition may
+  //       need to ignore selection changes caused by composition.  Therefore,
+  //       CompositionChangeEventHandlingMarker must be destroyed after a call
+  //       of NotifiyEditorObservers(eNotifyEditorObserversOfEnd) or
   //       NotifiyEditorObservers(eNotifyEditorObserversOfCancel) which notifies
   //       TextComposition of a selection change.
   MOZ_ASSERT(!mPlaceHolderBatch,
     "UpdateIMEComposition() must be called without place holder batch");
-  TextComposition::TextEventHandlingMarker
-    textEventHandlingMarker(mComposition, widgetTextEvent);
+  TextComposition::CompositionChangeEventHandlingMarker
+    compositionChangeEventHandlingMarker(mComposition, compositionChangeEvent);
 
   NotifyEditorObservers(eNotifyEditorObserversOfBefore);
 
   nsRefPtr<nsCaret> caretP = ps->GetCaret();
 
   {
     nsAutoPlaceHolderBatch batch(this, nsGkAtoms::IMETxnName);
 
-    rv = InsertText(widgetTextEvent->theText);
+    rv = InsertText(compositionChangeEvent->mData);
 
     if (caretP) {
       caretP->SetSelection(selection);
     }
   }
 
   // If still composing, we should fire input event via observer.
   // Note that if committed, we don't need to notify it since it will be
--- a/editor/libeditor/tests/test_bug1026397.html
+++ b/editor/libeditor/tests/test_bug1026397.html
@@ -42,30 +42,30 @@ function runTests()
     input.selectionStart = input.selectionEnd = aCaretOffset;
     if (aAdditionalExplanation) {
       aAdditionalExplanation = " " + aAdditionalExplanation;
     } else {
       aAdditionalExplanation = "";
     }
 
     synthesizeComposition({ type: "compositionstart" });
-    synthesizeText(
+    synthesizeCompositionChange(
       { "composition":
         { "string": aInsertString,
           "clauses":
           [
             { "length": aInsertString.length, "attr": COMPOSITION_ATTR_RAWINPUT }
           ]
         },
         "caret": { "start": aInsertString.length, "length": 0 }
       });
     is(input.value, aExpectedValueDuringComposition,
        "The value of input whose maxlength is " + maxLengthStr + " should be "
          + aExpectedValueDuringComposition + " during composition" + aAdditionalExplanation);
-    synthesizeText(
+    synthesizeCompositionChange(
       { "composition":
         { "string": aInsertString,
           "clauses":
           [
             { "length": 0, "attr": 0 }
           ]
         },
         "caret": { "start": aInsertString.length, "length": 0 }
--- a/editor/libeditor/tests/test_bug697842.html
+++ b/editor/libeditor/tests/test_bug697842.html
@@ -48,55 +48,55 @@ function runTests()
     editor.addEventListener("compositionupdate", handler, true);
     editor.addEventListener("text", handler, true);
 
     // start composition
     synthesizeComposition({ type: "compositionstart" });
 
     // input first character
     composingString = "\u306B";
-    synthesizeText(
+    synthesizeCompositionChange(
       { "composition":
         { "string": composingString,
           "clauses":
           [
             { "length": 1, "attr": COMPOSITION_ATTR_RAWINPUT }
           ]
         },
         "caret": { "start": 1, "length": 0 }
       });
 
     // input second character
     composingString = "\u306B\u3085";
-    synthesizeText(
+    synthesizeCompositionChange(
       { "composition":
         { "string": composingString,
           "clauses":
           [
             { "length": 2, "attr": COMPOSITION_ATTR_RAWINPUT }
           ]
         },
         "caret": { "start": 2, "length": 0 }
       });
 
     // convert them
-    synthesizeText(
+    synthesizeCompositionChange(
       { "composition":
         { "string": composingString,
           "clauses":
           [
             { "length": 2,
               "attr": COMPOSITION_ATTR_SELECTEDCONVERTEDTEXT }
           ]
         },
         "caret": { "start": 2, "length": 0 }
       });
 
     // commit
-    synthesizeText(
+    synthesizeCompositionChange(
       { "composition":
         { "string": composingString,
           "clauses":
           [
             { "length": 0, "attr": 0 }
           ]
         },
         "caret": { "start": 2, "length": 0 }
--- a/editor/libeditor/tests/test_bug795785.html
+++ b/editor/libeditor/tests/test_bug795785.html
@@ -117,29 +117,29 @@ function doCompositionTest(aElement, aEl
     var str = "Web \u958b\u767a\u8005\u306e\u7686\u3055\u3093\u306f\u3001" +
               "Firefox \u306b\u5b9f\u88c5\u3055\u308c\u3066\u3044\u308b HTML5" +
               " \u3084 CSS \u306e\u65b0\u6a5f\u80fd\u3092\u6d3b\u7528\u3059" +
               "\u308b\u3053\u3068\u3067\u3001\u9b45\u529b\u3042\u308b Web " +
               "\u30b5\u30a4\u30c8\u3084\u9769\u65b0\u7684\u306a Web \u30a2" +
               "\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u3088\u308a" +
               "\u77ed\u6642\u9593\u3067\u7c21\u5358\u306b\u4f5c\u6210\u3067" +
               "\u304d\u307e\u3059\u3002";
-    synthesizeText({
+    synthesizeCompositionChange({
         composition: {
           string: str,
           clauses: [
             { length: str.length, attr: COMPOSITION_ATTR_RAWINPUT }
           ]
         },
         caret: { start: str.length, length: 0 }
       });
     hitEventLoop(function () {
       isnot(aElement.scrollTop, 0,
             aElementDescription + " was not scrolled by composition");
-      synthesizeText({
+      synthesizeCompositionChange({
         composition: { string: "", clauses: [ { length: 0, attr: 0 } ] },
         caret: { start: 0, length: 0 }
       });
       synthesizeComposition({ type: "compositionend", data: "" });
       hitEventLoop(function () {
         is(aElement.scrollTop, 0,
            aElementDescription + " was not scrolled back to the top by canceling composition");
         aCallback();
--- a/editor/libeditor/tests/test_contenteditable_text_input_handling.html
+++ b/editor/libeditor/tests/test_contenteditable_text_input_handling.html
@@ -217,17 +217,17 @@ function runTests()
     if (!aFocus._isEditable) {
       return;
     }
 
     // IME
     // start composition
     synthesizeComposition({ type: "compositionstart" });
     // input first character
-    synthesizeText(
+    synthesizeCompositionChange(
       { "composition":
         { "string": "\u3089",
           "clauses":
           [
             { "length": 1, "attr": COMPOSITION_ATTR_RAWINPUT }
           ]
         },
         "caret": { "start": 1, "length": 0 }
@@ -252,17 +252,17 @@ function runTests()
     if (!querySelectedText.succeeded) {
       return;
     }
     is(querySelectedText.offset, 1,
        "query selected text event returns wrong offset" + when);
     is(querySelectedText.text, "",
        "query selected text event returns wrong selected text" + when);
     // commit composition
-    synthesizeText(
+    synthesizeCompositionChange(
       { "composition":
         { "string": "\u3089",
           "clauses":
           [
             { "length": 0, "attr": 0 }
           ]
         },
         "caret": { "start": 1, "length": 0 }
--- a/gfx/2d/FilterNodeSoftware.cpp
+++ b/gfx/2d/FilterNodeSoftware.cpp
@@ -1151,41 +1151,51 @@ FilterNodeTransformSoftware::SourceRectF
 }
 
 TemporaryRef<DataSourceSurface>
 FilterNodeTransformSoftware::Render(const IntRect& aRect)
 {
   IntRect srcRect = SourceRectForOutputRect(aRect);
 
   RefPtr<DataSourceSurface> input =
-    GetInputDataSourceSurface(IN_TRANSFORM_IN, srcRect, NEED_COLOR_CHANNELS);
+    GetInputDataSourceSurface(IN_TRANSFORM_IN, srcRect);
 
   if (!input) {
     return nullptr;
   }
 
   Matrix transform = Matrix::Translation(srcRect.x, srcRect.y) * mMatrix *
                      Matrix::Translation(-aRect.x, -aRect.y);
   if (transform.IsIdentity() && srcRect.Size() == aRect.Size()) {
     return input.forget();
   }
 
+  RefPtr<DataSourceSurface> surf =
+    Factory::CreateDataSourceSurface(aRect.Size(), input->GetFormat());
+
+  DataSourceSurface::MappedSurface mapping;
+  surf->Map(DataSourceSurface::MapType::WRITE, &mapping);
+
   RefPtr<DrawTarget> dt =
-    Factory::CreateDrawTarget(BackendType::CAIRO, aRect.Size(), input->GetFormat());
+    Factory::CreateDrawTargetForData(BackendType::CAIRO,
+                                     mapping.mData,
+                                     surf->GetSize(),
+                                     mapping.mStride,
+                                     surf->GetFormat());
   if (!dt) {
     return nullptr;
   }
 
   Rect r(0, 0, srcRect.width, srcRect.height);
   dt->SetTransform(transform);
   dt->DrawSurface(input, r, r, DrawSurfaceOptions(mFilter));
 
-  RefPtr<SourceSurface> result = dt->Snapshot();
-  RefPtr<DataSourceSurface> resultData = result->GetDataSurface();
-  return resultData.forget();
+  dt->Flush();
+  surf->Unmap();
+  return surf.forget();
 }
 
 void
 FilterNodeTransformSoftware::RequestFromInputsForRect(const IntRect &aRect)
 {
   RequestInputRect(IN_TRANSFORM_IN, SourceRectForOutputRect(aRect));
 }
 
--- a/gfx/gl/GLConsts.h
+++ b/gfx/gl/GLConsts.h
@@ -5182,16 +5182,18 @@
 #define LOCAL_EGL_CONTEXT_PRIORITY_MEDIUM_IMG                0x3102
 #define LOCAL_EGL_CORE_NATIVE_ENGINE                         0x305B
 #define LOCAL_EGL_COVERAGE_BUFFERS_NV                        0x30E0
 #define LOCAL_EGL_COVERAGE_SAMPLES_NV                        0x30E1
 #define LOCAL_EGL_COVERAGE_SAMPLE_RESOLVE_DEFAULT_NV         0x3132
 #define LOCAL_EGL_COVERAGE_SAMPLE_RESOLVE_NONE_NV            0x3133
 #define LOCAL_EGL_COVERAGE_SAMPLE_RESOLVE_NV                 0x3131
 #define LOCAL_EGL_D3D_TEXTURE_2D_SHARE_HANDLE_ANGLE          0x3200
+#define LOCAL_EGL_D3D11_ELSE_D3D9_DISPLAY_ANGLE              ((EGLNativeDisplayType)-2)
+#define LOCAL_EGL_D3D11_ONLY_DISPLAY_ANGLE                   ((EGLNativeDisplayType)-3)
 #define LOCAL_EGL_DEFAULT_DISPLAY                            ((EGLNativeDisplayType)0)
 #define LOCAL_EGL_DEPTH_ENCODING_NONE_NV                     0
 #define LOCAL_EGL_DEPTH_ENCODING_NONLINEAR_NV                0x30E3
 #define LOCAL_EGL_DEPTH_ENCODING_NV                          0x30E2
 #define LOCAL_EGL_DEPTH_SIZE                                 0x3025
 #define LOCAL_EGL_DISCARD_SAMPLES_ARM                        0x3286
 #define LOCAL_EGL_DISPLAY_SCALING                            10000
 #define LOCAL_EGL_DMA_BUF_PLANE0_FD_EXT                      0x3272
--- a/gfx/gl/GLContext.cpp
+++ b/gfx/gl/GLContext.cpp
@@ -1735,20 +1735,19 @@ GLContext::UpdatePixelFormat()
 #ifdef DEBUG
     const SurfaceCaps& caps = Caps();
     MOZ_ASSERT(!caps.any, "Did you forget to DetermineCaps()?");
 
     MOZ_ASSERT(caps.color == !!format.red);
     MOZ_ASSERT(caps.color == !!format.green);
     MOZ_ASSERT(caps.color == !!format.blue);
 
-    MOZ_ASSERT(caps.alpha == !!format.alpha);
-
     // These we either must have if they're requested, or
     // we can have if they're not.
+    MOZ_ASSERT(caps.alpha == !!format.alpha || !caps.alpha);
     MOZ_ASSERT(caps.depth == !!format.depth || !caps.depth);
     MOZ_ASSERT(caps.stencil == !!format.stencil || !caps.stencil);
 
     MOZ_ASSERT(caps.antialias == (format.samples > 1));
 #endif
     mPixelFormat = new PixelBufferFormat(format);
 }
 
--- a/gfx/gl/GLLibraryEGL.cpp
+++ b/gfx/gl/GLLibraryEGL.cpp
@@ -227,17 +227,39 @@ GLLibraryEGL::EnsureInitialized()
 
     GLLibraryLoader::LoadSymbols(mEGLLibrary, &optionalSymbols[0]);
 
 #if defined(MOZ_WIDGET_GONK) && ANDROID_VERSION >= 18
     MOZ_RELEASE_ASSERT(mSymbols.fQueryStringImplementationANDROID,
                        "Couldn't find eglQueryStringImplementationANDROID");
 #endif
 
-    mEGLDisplay = fGetDisplay(EGL_DEFAULT_DISPLAY);
+    mEGLDisplay = nullptr;
+
+#ifdef XP_WIN
+    // XXX we have no way of knowing if this is ANGLE, or if we're just using
+    // a native EGL on windows.  We don't really do the latter right now, so
+    // let's assume it is ANGLE, and try our special types.
+
+    // D3D11 ANGLE only works with OMTC; there's a bug in the non-OMTC layer
+    // manager, and it's pointless to try to fix it.  We also don't try D3D11
+    // ANGLE if the layer manager is prefering D3D9 (hrm, do we care?)
+    if (gfxPrefs::LayersOffMainThreadCompositionEnabled() &&
+        !gfxPrefs::LayersPreferD3D9())
+    {
+        if (gfxPrefs::WebGLANGLEForceD3D11()) {
+            mEGLDisplay = fGetDisplay(LOCAL_EGL_D3D11_ONLY_DISPLAY_ANGLE);
+        } else if (gfxPrefs::WebGLANGLETryD3D11()) {
+            mEGLDisplay = fGetDisplay(LOCAL_EGL_D3D11_ELSE_D3D9_DISPLAY_ANGLE);
+        }
+    }
+#endif
+
+    if (!mEGLDisplay)
+        mEGLDisplay = fGetDisplay(EGL_DEFAULT_DISPLAY);
     if (!fInitialize(mEGLDisplay, nullptr, nullptr))
         return false;
 
     const char *vendor = (const char*) fQueryString(mEGLDisplay, LOCAL_EGL_VENDOR);
     if (vendor && (strstr(vendor, "TransGaming") != 0 || strstr(vendor, "Google Inc.") != 0)) {
         mIsANGLE = true;
     }
 
--- a/gfx/layers/Compositor.h
+++ b/gfx/layers/Compositor.h
@@ -118,17 +118,17 @@ class DrawTarget;
 
 namespace layers {
 
 struct Effect;
 struct EffectChain;
 class Image;
 class ISurfaceAllocator;
 class Layer;
-class NewTextureSource;
+class TextureSource;
 class DataTextureSource;
 class CompositingRenderTarget;
 class PCompositorParent;
 class LayerManagerComposite;
 
 enum SurfaceInitMode
 {
   INIT_MODE_NONE,
--- a/gfx/layers/RotatedBuffer.cpp
+++ b/gfx/layers/RotatedBuffer.cpp
@@ -722,21 +722,21 @@ RotatedContentBuffer::BorrowDrawTargetFo
     drawPtr = &aIter->mDrawRegion;
   }
   if (result->GetBackendType() == BackendType::DIRECT2D ||
       result->GetBackendType() == BackendType::DIRECT2D1_1) {
     drawPtr->SimplifyOutwardByArea(100 * 100);
   }
 
   if (aPaintState.mMode == SurfaceMode::SURFACE_COMPONENT_ALPHA) {
-    MOZ_ASSERT(mDTBuffer && mDTBufferOnWhite);
     if (!mDTBuffer || !mDTBufferOnWhite) {
       // This can happen in release builds if allocating one of the two buffers
       // failed. This is pretty bad and the reason for the failure is already
       // reported through gfxCriticalError.
+      MOZ_ASSERT(false);
       return nullptr;
     }
     nsIntRegionRectIterator iter(*drawPtr);
     const nsIntRect *iterRect;
     while ((iterRect = iter.Next())) {
       mDTBuffer->FillRect(Rect(iterRect->x, iterRect->y, iterRect->width, iterRect->height),
                           ColorPattern(Color(0.0, 0.0, 0.0, 1.0)));
       mDTBufferOnWhite->FillRect(Rect(iterRect->x, iterRect->y, iterRect->width, iterRect->height),
--- a/gfx/layers/TextureDIB.cpp
+++ b/gfx/layers/TextureDIB.cpp
@@ -123,17 +123,17 @@ DIBTextureHost::DIBTextureHost(TextureFl
     dont_AddRef(reinterpret_cast<gfxWindowsSurface*>(aDescriptor.surface()));
   MOZ_ASSERT(mSurface);
 
   mSize = ToIntSize(mSurface->GetSize());
   mFormat = ImageFormatToSurfaceFormat(
     gfxPlatform::GetPlatform()->OptimalFormatForContent(mSurface->GetContentType()));
 }
 
-NewTextureSource*
+TextureSource*
 DIBTextureHost::GetTextureSources()
 {
   if (!mTextureSource) {
     Updated();
   }
 
   return mTextureSource;
 }
--- a/gfx/layers/TextureDIB.h
+++ b/gfx/layers/TextureDIB.h
@@ -65,17 +65,17 @@ protected:
 };
 
 class DIBTextureHost : public TextureHost
 {
 public:
   DIBTextureHost(TextureFlags aFlags,
                  const SurfaceDescriptorDIB& aDescriptor);
 
-  virtual NewTextureSource* GetTextureSources() MOZ_OVERRIDE;
+  virtual TextureSource* GetTextureSources() MOZ_OVERRIDE;
 
   virtual void DeallocateDeviceData() MOZ_OVERRIDE;
 
   virtual void SetCompositor(Compositor* aCompositor) MOZ_OVERRIDE;
 
   virtual gfx::SurfaceFormat GetFormat() const MOZ_OVERRIDE { return mFormat; }
 
   virtual gfx::IntSize GetSize() const MOZ_OVERRIDE { return mSize; }
--- a/gfx/layers/basic/BasicColorLayer.cpp
+++ b/gfx/layers/basic/BasicColorLayer.cpp
@@ -57,19 +57,22 @@ public:
 
     Rect snapped(mBounds.x, mBounds.y, mBounds.width, mBounds.height);
     if (UserToDevicePixelSnapped(snapped, aDT->GetTransform())) {
       Matrix mat = aDT->GetTransform();
       mat.Invert();
       snapped = mat.TransformBounds(snapped);
     }
 
+    // Clip drawing in case we're using (unbounded) operator source.
+    aDT->PushClipRect(snapped);
     FillRectWithMask(aDT, aDeviceOffset, snapped, ToColor(mColor),
                      DrawOptions(GetEffectiveOpacity(), GetEffectiveOperator(this)),
                      aMaskLayer);
+    aDT->PopClip();
   }
 
 protected:
   BasicLayerManager* BasicManager()
   {
     return static_cast<BasicLayerManager*>(mManager);
   }
 };
--- a/gfx/layers/basic/BasicLayerManager.cpp
+++ b/gfx/layers/basic/BasicLayerManager.cpp
@@ -790,36 +790,34 @@ BasicLayerManager::PaintLayer(gfxContext
   // just throw an error.
   if (aLayer->GetEffectiveTransform().IsSingular()) {
     return;
   }
 
   RenderTraceScope trace("BasicLayerManager::PaintLayer", "707070");
 
   const nsIntRect* clipRect = aLayer->GetEffectiveClipRect();
-  // aLayer might not be a container layer, but if so we take care not to use
-  // the container variable
-  BasicContainerLayer* container = static_cast<BasicContainerLayer*>(aLayer);
-  bool needsGroup = aLayer->GetFirstChild() &&
-                    container->UseIntermediateSurface();
+  BasicContainerLayer* container =
+    static_cast<BasicContainerLayer*>(aLayer->AsContainerLayer());
+  bool needsGroup = container && container->UseIntermediateSurface();
   BasicImplData* data = ToData(aLayer);
   bool needsClipToVisibleRegion =
     data->GetClipToVisibleRegion() && !aLayer->AsPaintedLayer();
-  NS_ASSERTION(needsGroup || !aLayer->GetFirstChild() ||
+  NS_ASSERTION(needsGroup || !container ||
                container->GetOperator() == CompositionOp::OP_OVER,
                "non-OVER operator should have forced UseIntermediateSurface");
-  NS_ASSERTION(!aLayer->GetFirstChild() || !aLayer->GetMaskLayer() ||
+  NS_ASSERTION(!container || !aLayer->GetMaskLayer() ||
                container->UseIntermediateSurface(),
                "ContainerLayer with mask layer should force UseIntermediateSurface");
 
   gfxContextAutoSaveRestore contextSR;
   gfxMatrix transform;
   // Will return an identity matrix for 3d transforms, and is handled separately below.
   bool is2D = paintLayerContext.Setup2DTransform();
-  NS_ABORT_IF_FALSE(is2D || needsGroup || !aLayer->GetFirstChild(), "Must PushGroup for 3d transforms!");
+  NS_ABORT_IF_FALSE(is2D || needsGroup || !container, "Must PushGroup for 3d transforms!");
 
   bool needsSaveRestore =
     needsGroup || clipRect || needsClipToVisibleRegion || !is2D;
   if (needsSaveRestore) {
     contextSR.SetContext(aTarget);
 
     if (clipRect) {
       aTarget->NewPath();
--- a/gfx/layers/basic/MacIOSurfaceTextureHostBasic.h
+++ b/gfx/layers/basic/MacIOSurfaceTextureHostBasic.h
@@ -18,17 +18,17 @@ class BasicCompositor;
 /**
  * A texture source meant for use with BasicCompositor.
  *
  * It does not own any GL texture, and attaches its shared handle to one of
  * the compositor's temporary textures when binding.
  */
 class MacIOSurfaceTextureSourceBasic
   : public TextureSourceBasic,
-    public NewTextureSource
+    public TextureSource
 {
 public:
   MacIOSurfaceTextureSourceBasic(BasicCompositor* aCompositor,
                                  MacIOSurface* aSurface);
   virtual ~MacIOSurfaceTextureSourceBasic();
 
   virtual TextureSourceBasic* AsSourceBasic() MOZ_OVERRIDE { return this; }
 
@@ -58,17 +58,17 @@ public:
                                const SurfaceDescriptorMacIOSurface& aDescriptor);
 
   virtual void SetCompositor(Compositor* aCompositor) MOZ_OVERRIDE;
 
   virtual bool Lock() MOZ_OVERRIDE;
 
   virtual gfx::SurfaceFormat GetFormat() const MOZ_OVERRIDE;
 
-  virtual NewTextureSource* GetTextureSources() MOZ_OVERRIDE
+  virtual TextureSource* GetTextureSources() MOZ_OVERRIDE
   {
     return mTextureSource;
   }
 
   virtual TemporaryRef<gfx::DataSourceSurface> GetAsSurface() MOZ_OVERRIDE
   {
     return nullptr; // XXX - implement this (for MOZ_DUMP_PAINTING)
   }
--- a/gfx/layers/basic/X11TextureSourceBasic.h
+++ b/gfx/layers/basic/X11TextureSourceBasic.h
@@ -12,17 +12,17 @@
 namespace mozilla {
 namespace layers {
 
 class BasicCompositor;
 
 // TextureSource for Xlib-backed surfaces.
 class X11TextureSourceBasic
   : public TextureSourceBasic
-  , public NewTextureSource
+  , public TextureSource
 {
 public:
   X11TextureSourceBasic(BasicCompositor* aCompositor, gfxXlibSurface* aSurface);
 
   virtual X11TextureSourceBasic* AsSourceBasic() MOZ_OVERRIDE { return this; }
 
   virtual gfx::IntSize GetSize() const MOZ_OVERRIDE;
 
--- a/gfx/layers/composite/ContentHost.cpp
+++ b/gfx/layers/composite/ContentHost.cpp
@@ -44,18 +44,18 @@ ContentHostBase::Composite(EffectChain& 
 {
   NS_ASSERTION(aVisibleRegion, "Requires a visible region");
 
   AutoLockCompositableHost lock(this);
   if (lock.Failed()) {
     return;
   }
 
-  RefPtr<NewTextureSource> source = GetTextureSource();
-  RefPtr<NewTextureSource> sourceOnWhite = GetTextureSourceOnWhite();
+  RefPtr<TextureSource> source = GetTextureSource();
+  RefPtr<TextureSource> sourceOnWhite = GetTextureSourceOnWhite();
 
   if (!source) {
     return;
   }
 
   RefPtr<TexturedEffect> effect = GenEffect(aFilter);
   if (!effect) {
     return;
@@ -203,18 +203,18 @@ ContentHostBase::Composite(EffectChain& 
   }
   GetCompositor()->DrawDiagnostics(diagnostics, nsIntRegion(mBufferRect), aClipRect,
                                    aTransform, mFlashCounter);
 }
 
 TemporaryRef<TexturedEffect>
 ContentHostBase::GenEffect(const gfx::Filter& aFilter)
 {
-  RefPtr<NewTextureSource> source = GetTextureSource();
-  RefPtr<NewTextureSource> sourceOnWhite = GetTextureSourceOnWhite();
+  RefPtr<TextureSource> source = GetTextureSource();
+  RefPtr<TextureSource> sourceOnWhite = GetTextureSourceOnWhite();
   if (!source) {
     return nullptr;
   }
   return CreateTexturedEffect(source, sourceOnWhite, aFilter, true);
 }
 
 void
 ContentHostTexture::UseTextureHost(TextureHost* aTexture)
@@ -434,24 +434,24 @@ void
 ContentHostIncremental::ProcessTextureUpdates()
 {
   for (uint32_t i = 0; i < mUpdateList.Length(); i++) {
     mUpdateList[i]->Execute(this);
   }
   mUpdateList.Clear();
 }
 
-NewTextureSource*
+TextureSource*
 ContentHostIncremental::GetTextureSource()
 {
   MOZ_ASSERT(mLocked);
   return mSource;
 }
 
-NewTextureSource*
+TextureSource*
 ContentHostIncremental::GetTextureSourceOnWhite()
 {
   MOZ_ASSERT(mLocked);
   return mSourceOnWhite;
 }
 
 void
 ContentHostIncremental::TextureCreationRequest::Execute(ContentHostIncremental* aHost)
--- a/gfx/layers/composite/ContentHost.h
+++ b/gfx/layers/composite/ContentHost.h
@@ -98,18 +98,18 @@ public:
 
   virtual void Composite(EffectChain& aEffectChain,
                          float aOpacity,
                          const gfx::Matrix4x4& aTransform,
                          const gfx::Filter& aFilter,
                          const gfx::Rect& aClipRect,
                          const nsIntRegion* aVisibleRegion = nullptr);
 
-  virtual NewTextureSource* GetTextureSource() = 0;
-  virtual NewTextureSource* GetTextureSourceOnWhite() = 0;
+  virtual TextureSource* GetTextureSource() = 0;
+  virtual TextureSource* GetTextureSourceOnWhite() = 0;
 
   virtual TemporaryRef<TexturedEffect> GenEffect(const gfx::Filter& aFilter) MOZ_OVERRIDE;
 
 protected:
   virtual nsIntPoint GetOriginOffset()
   {
     return mBufferRect.TopLeft() - mBufferRotation;
   }
@@ -168,21 +168,21 @@ public:
     MOZ_ASSERT(mLocked);
     mTextureHost->Unlock();
     if (mTextureHostOnWhite) {
       mTextureHostOnWhite->Unlock();
     }
     mLocked = false;
   }
 
-  virtual NewTextureSource* GetTextureSource() MOZ_OVERRIDE {
+  virtual TextureSource* GetTextureSource() MOZ_OVERRIDE {
     MOZ_ASSERT(mLocked);
     return mTextureHost->GetTextureSources();
   }
-  virtual NewTextureSource* GetTextureSourceOnWhite() MOZ_OVERRIDE {
+  virtual TextureSource* GetTextureSourceOnWhite() MOZ_OVERRIDE {
     MOZ_ASSERT(mLocked);
     if (mTextureHostOnWhite) {
       return mTextureHostOnWhite->GetTextureSources();
     }
     return nullptr;
   }
 
   LayerRenderState GetRenderState();
@@ -286,18 +286,18 @@ public:
     return true;
   }
 
   virtual void Unlock() MOZ_OVERRIDE {
     MOZ_ASSERT(mLocked);
     mLocked = false;
   }
 
-  virtual NewTextureSource* GetTextureSource() MOZ_OVERRIDE;
-  virtual NewTextureSource* GetTextureSourceOnWhite() MOZ_OVERRIDE;
+  virtual TextureSource* GetTextureSource() MOZ_OVERRIDE;
+  virtual TextureSource* GetTextureSourceOnWhite() MOZ_OVERRIDE;
 
 private:
 
   void FlushUpdateQueue();
   void ProcessTextureUpdates();
 
   class Request
   {
--- a/gfx/layers/composite/ImageHost.cpp
+++ b/gfx/layers/composite/ImageHost.cpp
@@ -99,17 +99,17 @@ ImageHost::Composite(EffectChain& aEffec
   mFrontBuffer->SetCompositor(GetCompositor());
   mFrontBuffer->SetCompositableBackendSpecificData(GetCompositableBackendSpecificData());
 
   AutoLockCompositableHost autoLock(this);
   if (autoLock.Failed()) {
     NS_WARNING("failed to lock front buffer");
     return;
   }
-  RefPtr<NewTextureSource> source = GetTextureSource();
+  RefPtr<TextureSource> source = GetTextureSource();
   if (!source) {
     return;
   }
 
   RefPtr<TexturedEffect> effect = GenEffect(aFilter);
   if (!effect) {
     return;
   }
@@ -268,27 +268,27 @@ ImageHost::Lock()
 void
 ImageHost::Unlock()
 {
   MOZ_ASSERT(mLocked);
   mFrontBuffer->Unlock();
   mLocked = false;
 }
 
-TemporaryRef<NewTextureSource>
+TemporaryRef<TextureSource>
 ImageHost::GetTextureSource()
 {
   MOZ_ASSERT(mLocked);
   return mFrontBuffer->GetTextureSources();
 }
 
 TemporaryRef<TexturedEffect>
 ImageHost::GenEffect(const gfx::Filter& aFilter)
 {
-  RefPtr<NewTextureSource> source = GetTextureSource();
+  RefPtr<TextureSource> source = GetTextureSource();
   if (!source) {
     return nullptr;
   }
   bool isAlphaPremultiplied = true;
   if (mFrontBuffer->GetFlags() & TextureFlags::NON_PREMULTIPLIED)
     isAlphaPremultiplied = false;
 
   return CreateTexturedEffect(mFrontBuffer->GetFormat(),
--- a/gfx/layers/composite/ImageHost.h
+++ b/gfx/layers/composite/ImageHost.h
@@ -79,17 +79,17 @@ public:
 
   virtual TemporaryRef<gfx::DataSourceSurface> GetAsSurface() MOZ_OVERRIDE;
 #endif
 
   virtual bool Lock() MOZ_OVERRIDE;
 
   virtual void Unlock() MOZ_OVERRIDE;
 
-  virtual TemporaryRef<NewTextureSource> GetTextureSource();
+  virtual TemporaryRef<TextureSource> GetTextureSource();
 
   virtual TemporaryRef<TexturedEffect> GenEffect(const gfx::Filter& aFilter) MOZ_OVERRIDE;
 
 protected:
 
   RefPtr<TextureHost> mFrontBuffer;
   nsIntRect mPictureRect;
   bool mHasPictureRect;
--- a/gfx/layers/composite/TextureHost.cpp
+++ b/gfx/layers/composite/TextureHost.cpp
@@ -362,28 +362,28 @@ BufferTextureHost::Updated(const nsIntRe
 }
 
 void
 BufferTextureHost::SetCompositor(Compositor* aCompositor)
 {
   if (mCompositor == aCompositor) {
     return;
   }
-  RefPtr<NewTextureSource> it = mFirstSource;
+  RefPtr<TextureSource> it = mFirstSource;
   while (it) {
     it->SetCompositor(aCompositor);
     it = it->GetNextSibling();
   }
   mCompositor = aCompositor;
 }
 
 void
 BufferTextureHost::DeallocateDeviceData()
 {
-  RefPtr<NewTextureSource> it = mFirstSource;
+  RefPtr<TextureSource> it = mFirstSource;
   while (it) {
     it->DeallocateDeviceData();
     it = it->GetNextSibling();
   }
 }
 
 bool
 BufferTextureHost::Lock()
@@ -398,17 +398,17 @@ BufferTextureHost::Lock()
 
 void
 BufferTextureHost::Unlock()
 {
   MOZ_ASSERT(mLocked);
   mLocked = false;
 }
 
-NewTextureSource*
+TextureSource*
 BufferTextureHost::GetTextureSources()
 {
   MOZ_ASSERT(mLocked);
   MOZ_ASSERT(mFirstSource);
   return mFirstSource;
 }
 
 gfx::SurfaceFormat
@@ -860,17 +860,17 @@ StreamTextureHost::Lock()
         default:
           break;
       }
       break;
     default:
       break;
   }
 
-  RefPtr<NewTextureSource> newTexSource;
+  RefPtr<TextureSource> newTexSource;
   if (compositorSupportsShSurfType) {
     gfx::SurfaceFormat format = abstractSurf->mHasAlpha ? gfx::SurfaceFormat::R8G8B8A8
                                                         : gfx::SurfaceFormat::R8G8B8X8;
 
     switch (abstractSurf->mType) {
       case gl::SharedSurfaceType::Basic: {
         gl::SharedSurface_Basic* surf = gl::SharedSurface_Basic::Cast(abstractSurf);
 
--- a/gfx/layers/composite/TextureHost.h
+++ b/gfx/layers/composite/TextureHost.h
@@ -83,25 +83,29 @@ public:
  * between backends, the TextureSource interface is split into different
  * interfaces (TextureSourceOGL, etc.), and TextureSource mostly provide
  * access to these interfaces.
  *
  * This class is used on the compositor side.
  */
 class TextureSource
 {
-protected:
-  virtual ~TextureSource();
-
 public:
   NS_INLINE_DECL_REFCOUNTING(TextureSource)
 
   TextureSource();
 
   /**
+   * Should be overridden in order to deallocate the data that is associated
+   * with the rendering backend, such as GL textures.
+   */
+  virtual void DeallocateDeviceData() {}
+
+
+  /**
    * Return the size of the texture in texels.
    * If this is a tile iterator, GetSize must return the size of the current tile.
    */
   virtual gfx::IntSize GetSize() const = 0;
 
   /**
    * Return the pixel format of this texture
    */
@@ -109,92 +113,59 @@ public:
 
   /**
    * Cast to a TextureSource for for each backend..
    */
   virtual TextureSourceOGL* AsSourceOGL() { return nullptr; }
   virtual TextureSourceD3D9* AsSourceD3D9() { return nullptr; }
   virtual TextureSourceD3D11* AsSourceD3D11() { return nullptr; }
   virtual TextureSourceBasic* AsSourceBasic() { return nullptr; }
-
   /**
    * Cast to a DataTextureSurce.
    */
   virtual DataTextureSource* AsDataTextureSource() { return nullptr; }
 
   /**
-   * In some rare cases we currently need to consider a group of textures as one
-   * TextureSource, that can be split in sub-TextureSources.
-   */
-  virtual TextureSource* GetSubSource(int index) { return nullptr; }
-
-  /**
    * Overload this if the TextureSource supports big textures that don't fit in
    * one device texture and must be tiled internally.
    */
   virtual BigImageIterator* AsBigImageIterator() { return nullptr; }
-};
-
-/**
- * XXX - merge this class with TextureSource when deprecated texture classes
- * are completely removed.
- */
-class NewTextureSource : public TextureSource
-{
-public:
-  NewTextureSource()
-  {
-    MOZ_COUNT_CTOR(NewTextureSource);
-  }
-protected:
-  virtual ~NewTextureSource()
-  {
-    MOZ_COUNT_DTOR(NewTextureSource);
-  }
-
-public:
-  /**
-   * Should be overridden in order to deallocate the data that is associated
-   * with the rendering backend, such as GL textures.
-   */
-  virtual void DeallocateDeviceData() = 0;
 
   virtual void SetCompositor(Compositor* aCompositor) {}
 
-  void SetNextSibling(NewTextureSource* aTexture)
-  {
-    mNextSibling = aTexture;
-  }
+  void SetNextSibling(TextureSource* aTexture) { mNextSibling = aTexture; }
+
+  TextureSource* GetNextSibling() const { return mNextSibling; }
 
-  NewTextureSource* GetNextSibling() const
-  {
-    return mNextSibling;
-  }
-
-  // temporary adapter to use the same SubSource API as the old TextureSource
-  virtual TextureSource* GetSubSource(int index) MOZ_OVERRIDE
+  /**
+   * In some rare cases we currently need to consider a group of textures as one
+   * TextureSource, that can be split in sub-TextureSources.
+   */
+  TextureSource* GetSubSource(int index)
   {
     switch (index) {
       case 0: return this;
       case 1: return GetNextSibling();
       case 2: return GetNextSibling() ? GetNextSibling()->GetNextSibling() : nullptr;
     }
     return nullptr;
   }
 
 protected:
-  RefPtr<NewTextureSource> mNextSibling;
+  virtual ~TextureSource();
+
+  RefPtr<TextureSource> mNextSibling;
 };
 
 /**
  * Interface for TextureSources that can be updated from a DataSourceSurface.
  *
  * All backend should implement at least one DataTextureSource.
  */
-class DataTextureSource : public NewTextureSource
+class DataTextureSource : public TextureSource
 {
 public:
   DataTextureSource()
     : mUpdateSerial(0)
   {}
 
   virtual DataTextureSource* AsDataTextureSource() MOZ_OVERRIDE { return this; }
 
@@ -323,17 +294,17 @@ public:
 
   /**
    * Return a list of TextureSources for use with a Compositor.
    *
    * This can trigger texture uploads, so do not call it inside transactions
    * so as to not upload textures while the main thread is blocked.
    * Must not be called while this TextureHost is not sucessfully Locked.
    */
-  virtual NewTextureSource* GetTextureSources() = 0;
+  virtual TextureSource* GetTextureSources() = 0;
 
   /**
    * Is called before compositing if the shared data has changed since last
    * composition.
    * This method should be overload in cases like when we need to do a texture
    * upload for example.
    *
    * @param aRegion The region that has been changed, if nil, it means that the
@@ -494,17 +465,17 @@ public:
   virtual size_t GetBufferSize() = 0;
 
   virtual void Updated(const nsIntRegion* aRegion = nullptr) MOZ_OVERRIDE;
 
   virtual bool Lock() MOZ_OVERRIDE;
 
   virtual void Unlock() MOZ_OVERRIDE;
 
-  virtual NewTextureSource* GetTextureSources() MOZ_OVERRIDE;
+  virtual TextureSource* GetTextureSources() MOZ_OVERRIDE;
 
   virtual void DeallocateDeviceData() MOZ_OVERRIDE;
 
   virtual void SetCompositor(Compositor* aCompositor) MOZ_OVERRIDE;
 
   /**
    * Return the format that is exposed to the compositor when calling
    * GetTextureSources.
@@ -616,17 +587,17 @@ public:
   virtual void SetCompositor(Compositor* aCompositor) MOZ_OVERRIDE;
 
   virtual bool Lock() MOZ_OVERRIDE;
 
   virtual void Unlock() MOZ_OVERRIDE;
 
   virtual gfx::SurfaceFormat GetFormat() const MOZ_OVERRIDE;
 
-  virtual NewTextureSource* GetTextureSources() MOZ_OVERRIDE
+  virtual TextureSource* GetTextureSources() MOZ_OVERRIDE
   {
     return mTextureSource;
   }
 
   virtual TemporaryRef<gfx::DataSourceSurface> GetAsSurface() MOZ_OVERRIDE
   {
     return nullptr; // XXX - implement this (for MOZ_DUMP_PAINTING)
   }
@@ -635,17 +606,17 @@ public:
 
 #ifdef MOZ_LAYERS_HAVE_LOG
   virtual const char* Name() { return "StreamTextureHost"; }
 #endif
 
 protected:
   Compositor* mCompositor;
   gl::SurfaceStream* mStream;
-  RefPtr<NewTextureSource> mTextureSource;
+  RefPtr<TextureSource> mTextureSource;
   RefPtr<DataTextureSource> mDataTextureSource;
 };
 
 class MOZ_STACK_CLASS AutoLockTextureHost
 {
 public:
   explicit AutoLockTextureHost(TextureHost* aTexture)
     : mTexture(aTexture)
@@ -666,19 +637,20 @@ private:
   RefPtr<TextureHost> mTexture;
   bool mLocked;
 };
 
 /**
  * This can be used as an offscreen rendering target by the compositor, and
  * subsequently can be used as a source by the compositor.
  */
-class CompositingRenderTarget : public TextureSource
+class CompositingRenderTarget: public TextureSource
 {
 public:
+
   explicit CompositingRenderTarget(const gfx::IntPoint& aOrigin)
     : mOrigin(aOrigin)
   {}
   virtual ~CompositingRenderTarget() {}
 
 #ifdef MOZ_DUMP_PAINTING
   virtual TemporaryRef<gfx::DataSourceSurface> Dump(Compositor* aCompositor) { return nullptr; }
 #endif
--- a/gfx/layers/composite/TiledContentHost.cpp
+++ b/gfx/layers/composite/TiledContentHost.cpp
@@ -481,18 +481,18 @@ TiledContentHost::RenderTile(const TileH
 
   AutoLockTextureHost autoLock(aTile.mTextureHost);
   AutoLockTextureHost autoLockOnWhite(aTile.mTextureHostOnWhite);
   if (autoLock.Failed() ||
       autoLockOnWhite.Failed()) {
     NS_WARNING("Failed to lock tile");
     return;
   }
-  RefPtr<NewTextureSource> source = aTile.mTextureHost->GetTextureSources();
-  RefPtr<NewTextureSource> sourceOnWhite =
+  RefPtr<TextureSource> source = aTile.mTextureHost->GetTextureSources();
+  RefPtr<TextureSource> sourceOnWhite =
     aTile.mTextureHostOnWhite ? aTile.mTextureHostOnWhite->GetTextureSources() : nullptr;
   if (!source || (aTile.mTextureHostOnWhite && !sourceOnWhite)) {
     return;
   }
 
   RefPtr<TexturedEffect> effect = CreateTexturedEffect(source, sourceOnWhite, aFilter, true);
   if (!effect) {
     return;
--- a/gfx/layers/composite/X11TextureHost.h
+++ b/gfx/layers/composite/X11TextureHost.h
@@ -25,32 +25,32 @@ public:
   virtual void SetCompositor(Compositor* aCompositor) MOZ_OVERRIDE;
 
   virtual bool Lock() MOZ_OVERRIDE;
 
   virtual gfx::SurfaceFormat GetFormat() const MOZ_OVERRIDE;
 
   virtual gfx::IntSize GetSize() const MOZ_OVERRIDE;
 
-  virtual NewTextureSource* GetTextureSources() MOZ_OVERRIDE
+  virtual TextureSource* GetTextureSources() MOZ_OVERRIDE
   {
     return mTextureSource;
   }
 
   virtual TemporaryRef<gfx::DataSourceSurface> GetAsSurface() MOZ_OVERRIDE
   {
     return nullptr; // XXX - implement this (for MOZ_DUMP_PAINTING)
   }
 
 #ifdef MOZ_LAYERS_HAVE_LOG
   virtual const char* Name() { return "X11TextureHost"; }
 #endif
 
 protected:
   Compositor* mCompositor;
-  RefPtr<NewTextureSource> mTextureSource;
+  RefPtr<TextureSource> mTextureSource;
   RefPtr<gfxXlibSurface> mSurface;
 };
 
 } // namespace layers
 } // namespace mozilla
 
 #endif // MOZILLA_GFX_X11TEXTUREHOST__H
--- a/gfx/layers/d3d11/TextureD3D11.cpp
+++ b/gfx/layers/d3d11/TextureD3D11.cpp
@@ -480,17 +480,17 @@ DXGITextureHostD3D11::Lock()
 void
 DXGITextureHostD3D11::Unlock()
 {
   MOZ_ASSERT(mIsLocked);
   UnlockD3DTexture(mTextureSource->GetD3D11Texture());
   mIsLocked = false;
 }
 
-NewTextureSource*
+TextureSource*
 DXGITextureHostD3D11::GetTextureSources()
 {
   MOZ_ASSERT(mIsLocked);
   // If Lock was successful we must have a valid TextureSource.
   MOZ_ASSERT(mTextureSource);
   return mTextureSource.get();
 }
 
--- a/gfx/layers/d3d11/TextureD3D11.h
+++ b/gfx/layers/d3d11/TextureD3D11.h
@@ -171,17 +171,17 @@ protected:
  * A TextureHost for shared D3D11 textures.
  */
 class DXGITextureHostD3D11 : public TextureHost
 {
 public:
   DXGITextureHostD3D11(TextureFlags aFlags,
                        const SurfaceDescriptorD3D10& aDescriptor);
 
-  virtual NewTextureSource* GetTextureSources() MOZ_OVERRIDE;
+  virtual TextureSource* GetTextureSources() MOZ_OVERRIDE;
 
   virtual void DeallocateDeviceData() MOZ_OVERRIDE {}
 
   virtual void SetCompositor(Compositor* aCompositor) MOZ_OVERRIDE;
 
   virtual gfx::SurfaceFormat GetFormat() const MOZ_OVERRIDE { return mFormat; }
 
   virtual bool Lock() MOZ_OVERRIDE;
--- a/gfx/layers/d3d9/TextureD3D9.cpp
+++ b/gfx/layers/d3d9/TextureD3D9.cpp
@@ -884,17 +884,17 @@ void
 TextureHostD3D9::SetCompositor(Compositor* aCompositor)
 {
   mCompositor = static_cast<CompositorD3D9*>(aCompositor);
   if (mTextureSource) {
     mTextureSource->SetCompositor(aCompositor);
   }
 }
 
-NewTextureSource*
+TextureSource*
 TextureHostD3D9::GetTextureSources()
 {
   MOZ_ASSERT(mIsLocked);
   MOZ_ASSERT(mTextureSource);
   return mTextureSource;
 }
 
 bool
@@ -960,17 +960,17 @@ DXGITextureHostD3D9::OpenSharedHandle()
     return;
   }
 
   mTextureSource = new DataTextureSourceD3D9(mFormat, mSize, mCompositor, texture);
 
   return;
 }
 
-NewTextureSource*
+TextureSource*
 DXGITextureHostD3D9::GetTextureSources()
 {
   MOZ_ASSERT(mIsLocked);
   MOZ_ASSERT(mTextureSource);
   return mTextureSource;
 }
 
 bool
--- a/gfx/layers/d3d9/TextureD3D9.h
+++ b/gfx/layers/d3d9/TextureD3D9.h
@@ -287,17 +287,17 @@ private:
 };
 
 class TextureHostD3D9 : public TextureHost
 {
 public:
   TextureHostD3D9(TextureFlags aFlags,
                   const SurfaceDescriptorD3D9& aDescriptor);
 
-  virtual NewTextureSource* GetTextureSources() MOZ_OVERRIDE;
+  virtual TextureSource* GetTextureSources() MOZ_OVERRIDE;
 
   virtual void DeallocateDeviceData() MOZ_OVERRIDE;
 
   virtual void SetCompositor(Compositor* aCompositor) MOZ_OVERRIDE;
 
   virtual gfx::SurfaceFormat GetFormat() const MOZ_OVERRIDE { return mFormat; }
 
   virtual bool Lock() MOZ_OVERRIDE;
@@ -328,17 +328,17 @@ protected:
 };
 
 class DXGITextureHostD3D9 : public TextureHost
 {
 public:
   DXGITextureHostD3D9(TextureFlags aFlags,
     const SurfaceDescriptorD3D10& aDescriptor);
 
-  virtual NewTextureSource* GetTextureSources() MOZ_OVERRIDE;
+  virtual TextureSource* GetTextureSources() MOZ_OVERRIDE;
 
   virtual void DeallocateDeviceData() MOZ_OVERRIDE;
 
   virtual void SetCompositor(Compositor* aCompositor) MOZ_OVERRIDE;
 
   virtual gfx::SurfaceFormat GetFormat() const MOZ_OVERRIDE { return mFormat; }
 
   virtual gfx::IntSize GetSize() const MOZ_OVERRIDE { return mSize; }
--- a/gfx/layers/opengl/GrallocTextureHost.cpp
+++ b/gfx/layers/opengl/GrallocTextureHost.cpp
@@ -290,17 +290,17 @@ GrallocTextureSourceOGL::GetSize() const
   }
   return gfx::IntSize(mGraphicBuffer->getWidth(), mGraphicBuffer->getHeight());
 }
 
 void
 GrallocTextureSourceOGL::DeallocateDeviceData()
 {
   if (mEGLImage) {
-    MOZ_ASSERT(gl());
+    MOZ_ASSERT(mCompositor);
     if (!gl() || !gl()->MakeCurrent()) {
       return;
     }
     if (mTextureBackendSpecificData) {
       mTextureBackendSpecificData->ClearBoundEGLImage(mEGLImage);
     }
     EGLImageDestroy(gl(), mEGLImage);
     mEGLImage = EGL_NO_IMAGE;
--- a/gfx/layers/opengl/GrallocTextureHost.h
+++ b/gfx/layers/opengl/GrallocTextureHost.h
@@ -11,17 +11,17 @@
 #include "mozilla/layers/ShadowLayerUtilsGralloc.h"
 #include <ui/GraphicBuffer.h>
 
 namespace mozilla {
 namespace layers {
 
 class GrallocTextureHostOGL;
 
-class GrallocTextureSourceOGL : public NewTextureSource
+class GrallocTextureSourceOGL : public TextureSource
                               , public TextureSourceOGL
 {
 public:
   friend class GrallocTextureHostOGL;
 
   GrallocTextureSourceOGL(CompositorOGL* aCompositor,
                           GrallocTextureHostOGL* aTextureHost,
                           android::GraphicBuffer* aGraphicBuffer,
@@ -111,17 +111,17 @@ public:
   virtual void DeallocateDeviceData() MOZ_OVERRIDE;
 
   virtual gfx::SurfaceFormat GetFormat() const;
 
   virtual gfx::IntSize GetSize() const MOZ_OVERRIDE { return mSize; }
 
   virtual LayerRenderState GetRenderState() MOZ_OVERRIDE;
 
-  virtual NewTextureSource* GetTextureSources() MOZ_OVERRIDE
+  virtual TextureSource* GetTextureSources() MOZ_OVERRIDE
   {
     return mTextureSource;
   }
 
 #if defined(MOZ_WIDGET_GONK) && ANDROID_VERSION >= 17
   virtual TextureHostOGL* AsHostOGL() MOZ_OVERRIDE
   {
     return this;
--- a/gfx/layers/opengl/MacIOSurfaceTextureHostOGL.h
+++ b/gfx/layers/opengl/MacIOSurfaceTextureHostOGL.h
@@ -14,17 +14,17 @@ namespace mozilla {
 namespace layers {
 
 /**
  * A texture source meant for use with MacIOSurfaceTextureHostOGL.
  *
  * It does not own any GL texture, and attaches its shared handle to one of
  * the compositor's temporary textures when binding.
  */
-class MacIOSurfaceTextureSourceOGL : public NewTextureSource
+class MacIOSurfaceTextureSourceOGL : public TextureSource
                                    , public TextureSourceOGL
 {
 public:
   MacIOSurfaceTextureSourceOGL(CompositorOGL* aCompositor,
                                MacIOSurface* aSurface);
   virtual ~MacIOSurfaceTextureSourceOGL();
 
   virtual TextureSourceOGL* AsSourceOGL() { return this; }
@@ -68,17 +68,17 @@ public:
   virtual void DeallocateDeviceData() MOZ_OVERRIDE {}
 
   virtual void SetCompositor(Compositor* aCompositor) MOZ_OVERRIDE;
 
   virtual bool Lock() MOZ_OVERRIDE;
 
   virtual gfx::SurfaceFormat GetFormat() const MOZ_OVERRIDE;
 
-  virtual NewTextureSource* GetTextureSources() MOZ_OVERRIDE
+  virtual TextureSource* GetTextureSources() MOZ_OVERRIDE
   {
     return mTextureSource;
   }
 
   virtual TemporaryRef<gfx::DataSourceSurface> GetAsSurface() MOZ_OVERRIDE
   {
     return nullptr; // XXX - implement this (for MOZ_DUMP_PAINTING)
   }
--- a/gfx/layers/opengl/TextureHostOGL.h
+++ b/gfx/layers/opengl/TextureHostOGL.h
@@ -363,17 +363,17 @@ protected:
 /**
  * A texture source for GL textures.
  *
  * It does not own any GL texture, and attaches its shared handle to one of
  * the compositor's temporary textures when binding.
  *
  * The shared texture handle is owned by the TextureHost.
  */
-class GLTextureSource : public NewTextureSource
+class GLTextureSource : public TextureSource
                       , public TextureSourceOGL
 {
 public:
   GLTextureSource(CompositorOGL* aCompositor,
                   GLuint aTex,
                   gfx::SurfaceFormat aFormat,
                   GLenum aTarget,
                   gfx::IntSize aSize);
@@ -406,17 +406,17 @@ protected:
   const GLenum mTextureTarget;
 };
 
 ////////////////////////////////////////////////////////////////////////
 // SurfaceTexture
 
 #ifdef MOZ_WIDGET_ANDROID
 
-class SurfaceTextureSource : public NewTextureSource
+class SurfaceTextureSource : public TextureSource
                            , public TextureSourceOGL
 {
 public:
   SurfaceTextureSource(CompositorOGL* aCompositor,
                        nsSurfaceTexture* aSurfTex,
                        gfx::SurfaceFormat aFormat,
                        GLenum aTarget,
                        GLenum aWrapMode,
@@ -469,17 +469,17 @@ public:
   virtual void SetCompositor(Compositor* aCompositor) MOZ_OVERRIDE;
 
   virtual bool Lock() MOZ_OVERRIDE;
 
   virtual void Unlock() MOZ_OVERRIDE;
 
   virtual gfx::SurfaceFormat GetFormat() const MOZ_OVERRIDE;
 
-  virtual NewTextureSource* GetTextureSources() MOZ_OVERRIDE
+  virtual TextureSource* GetTextureSources() MOZ_OVERRIDE
   {
     return mTextureSource;
   }
 
   virtual TemporaryRef<gfx::DataSourceSurface> GetAsSurface() MOZ_OVERRIDE
   {
     return nullptr; // XXX - implement this (for MOZ_DUMP_PAINTING)
   }
@@ -497,17 +497,17 @@ protected:
   RefPtr<SurfaceTextureSource> mTextureSource;
 };
 
 #endif // MOZ_WIDGET_ANDROID
 
 ////////////////////////////////////////////////////////////////////////
 // EGLImage
 
-class EGLImageTextureSource : public NewTextureSource
+class EGLImageTextureSource : public TextureSource
                             , public TextureSourceOGL
 {
 public:
   EGLImageTextureSource(CompositorOGL* aCompositor,
                         EGLImage aImage,
                         gfx::SurfaceFormat aFormat,
                         GLenum aTarget,
                         GLenum aWrapMode,
@@ -560,17 +560,17 @@ public:
   virtual void SetCompositor(Compositor* aCompositor) MOZ_OVERRIDE;
 
   virtual bool Lock() MOZ_OVERRIDE;
 
   virtual void Unlock() MOZ_OVERRIDE;
 
   virtual gfx::SurfaceFormat GetFormat() const MOZ_OVERRIDE;
 
-  virtual NewTextureSource* GetTextureSources() MOZ_OVERRIDE
+  virtual TextureSource* GetTextureSources() MOZ_OVERRIDE
   {
     return mTextureSource;
   }
 
   virtual TemporaryRef<gfx::DataSourceSurface> GetAsSurface() MOZ_OVERRIDE
   {
     return nullptr; // XXX - implement this (for MOZ_DUMP_PAINTING)
   }
--- a/gfx/layers/opengl/X11TextureSourceOGL.h
+++ b/gfx/layers/opengl/X11TextureSourceOGL.h
@@ -12,17 +12,17 @@
 #include "mozilla/gfx/2D.h"
 
 namespace mozilla {
 namespace layers {
 
 // TextureSource for Xlib-backed surfaces.
 class X11TextureSourceOGL
   : public TextureSourceOGL
-  , public NewTextureSource
+  , public TextureSource
 {
 public:
   X11TextureSourceOGL(CompositorOGL* aCompositor, gfxXlibSurface* aSurface);
   ~X11TextureSourceOGL();
 
   virtual X11TextureSourceOGL* AsSourceOGL() MOZ_OVERRIDE { return this; }
 
   virtual bool IsValid() const MOZ_OVERRIDE { return !!gl(); } ;
--- a/gfx/thebes/gfxPrefs.h
+++ b/gfx/thebes/gfxPrefs.h
@@ -299,16 +299,18 @@ private:
   DECL_GFX_PREF(Live, "layout.event-regions.enabled",          LayoutEventRegionsEnabled, bool, false);
   DECL_GFX_PREF(Once, "layout.paint_rects_separately",         LayoutPaintRectsSeparately, bool, true);
 
   DECL_GFX_PREF(Live, "nglayout.debug.widget_update_flashing", WidgetUpdateFlashing, bool, false);
 
   DECL_GFX_PREF(Live, "ui.click_hold_context_menus.delay",     UiClickHoldContextMenusDelay, int32_t, 500);
 
   DECL_GFX_PREF(Once, "webgl.force-layers-readback",           WebGLForceLayersReadback, bool, false);
+  DECL_GFX_PREF(Once, "webgl.angle.try-d3d11",                 WebGLANGLETryD3D11, bool, false);
+  DECL_GFX_PREF(Once, "webgl.angle.force-d3d11",               WebGLANGLEForceD3D11, bool, false);
 
   DECL_GFX_PREF(Once, "layers.stereo-video.enabled",           StereoVideoEnabled, bool, false);
 public:
   // Manage the singleton:
   static gfxPrefs& GetSingleton()
   {
     MOZ_ASSERT(!sInstanceHasBeenDestroyed, "Should never recreate a gfxPrefs instance!");
     if (!sInstance) {
--- a/gfx/thebes/gfxWindowsPlatform.cpp
+++ b/gfx/thebes/gfxWindowsPlatform.cpp
@@ -472,16 +472,20 @@ gfxWindowsPlatform::CreateDevice(nsRefPt
   decltype(D3D10CreateDevice1)* createD3DDevice =
     (decltype(D3D10CreateDevice1)*) GetProcAddress(d3d10module, "D3D10CreateDevice1");
   if (!createD3DDevice)
     return E_FAIL;
 
   nsRefPtr<ID3D10Device1> device;
   HRESULT hr =
     createD3DDevice(adapter1, D3D10_DRIVER_TYPE_HARDWARE, nullptr,
+#ifdef DEBUG
+                    // This isn't set because of bug 1078411
+                    // D3D10_CREATE_DEVICE_DEBUG |
+#endif
                     D3D10_CREATE_DEVICE_BGRA_SUPPORT |
                     D3D10_CREATE_DEVICE_PREVENT_INTERNAL_THREADING_OPTIMIZATIONS,
                     static_cast<D3D10_FEATURE_LEVEL1>(kSupportedFeatureLevels[featureLevelIndex]),
                     D3D10_1_SDK_VERSION, getter_AddRefs(device));
 
   // If we fail here, the DirectX version or video card probably
   // changed.  We previously could use 10.1 but now we can't
   // anymore.  Revert back to doing a 10.0 check first before
--- a/js/ipc/JavaScriptBase.h
+++ b/js/ipc/JavaScriptBase.h
@@ -33,52 +33,52 @@ class JavaScriptBase : public WrapperOwn
         WrapperOwner::ActorDestroy(why);
     }
 
     /*** IPC handlers ***/
 
     bool AnswerPreventExtensions(const uint64_t &objId, ReturnStatus *rs) {
         return Answer::AnswerPreventExtensions(ObjectId::deserialize(objId), rs);
     }
-    bool AnswerGetPropertyDescriptor(const uint64_t &objId, const nsString &id,
+    bool AnswerGetPropertyDescriptor(const uint64_t &objId, const JSIDVariant &id,
                                      ReturnStatus *rs,
                                      PPropertyDescriptor *out) {
         return Answer::AnswerGetPropertyDescriptor(ObjectId::deserialize(objId), id, rs, out);
     }
     bool AnswerGetOwnPropertyDescriptor(const uint64_t &objId,
-                                        const nsString &id,
+                                        const JSIDVariant &id,
                                         ReturnStatus *rs,
                                         PPropertyDescriptor *out) {
         return Answer::AnswerGetOwnPropertyDescriptor(ObjectId::deserialize(objId), id, rs, out);
     }
-    bool AnswerDefineProperty(const uint64_t &objId, const nsString &id,
+    bool AnswerDefineProperty(const uint64_t &objId, const JSIDVariant &id,
                               const PPropertyDescriptor &flags,
                               ReturnStatus *rs) {
         return Answer::AnswerDefineProperty(ObjectId::deserialize(objId), id, flags, rs);
     }
-    bool AnswerDelete(const uint64_t &objId, const nsString &id,
+    bool AnswerDelete(const uint64_t &objId, const JSIDVariant &id,
                       ReturnStatus *rs, bool *success) {
         return Answer::AnswerDelete(ObjectId::deserialize(objId), id, rs, success);
     }
 
-    bool AnswerHas(const uint64_t &objId, const nsString &id,
+    bool AnswerHas(const uint64_t &objId, const JSIDVariant &id,
                    ReturnStatus *rs, bool *bp) {
         return Answer::AnswerHas(ObjectId::deserialize(objId), id, rs, bp);
     }
-    bool AnswerHasOwn(const uint64_t &objId, const nsString &id,
+    bool AnswerHasOwn(const uint64_t &objId, const JSIDVariant &id,
                       ReturnStatus *rs, bool *bp) {
         return Answer::AnswerHasOwn(ObjectId::deserialize(objId), id, rs, bp);
     }
     bool AnswerGet(const uint64_t &objId, const ObjectVariant &receiverVar,
-                   const nsString &id,
+                   const JSIDVariant &id,
                    ReturnStatus *rs, JSVariant *result) {
         return Answer::AnswerGet(ObjectId::deserialize(objId), receiverVar, id, rs, result);
     }
     bool AnswerSet(const uint64_t &objId, const ObjectVariant &receiverVar,
-                   const nsString &id, const bool &strict,
+                   const JSIDVariant &id, const bool &strict,
                    const JSVariant &value, ReturnStatus *rs, JSVariant *result) {
         return Answer::AnswerSet(ObjectId::deserialize(objId), receiverVar, id, strict, value, rs, result);
     }
 
     bool AnswerIsExtensible(const uint64_t &objId, ReturnStatus *rs,
                             bool *result) {
         return Answer::AnswerIsExtensible(ObjectId::deserialize(objId), rs, result);
     }
@@ -129,52 +129,52 @@ class JavaScriptBase : public WrapperOwn
     /*** Dummy call handlers ***/
 
     bool SendDropObject(const ObjectId &objId) {
         return Base::SendDropObject(objId.serialize());
     }
     bool CallPreventExtensions(const ObjectId &objId, ReturnStatus *rs) {
         return Base::CallPreventExtensions(objId.serialize(), rs);
     }
-    bool CallGetPropertyDescriptor(const ObjectId &objId, const nsString &id,
+    bool CallGetPropertyDescriptor(const ObjectId &objId, const JSIDVariant &id,
                                      ReturnStatus *rs,
                                      PPropertyDescriptor *out) {
         return Base::CallGetPropertyDescriptor(objId.serialize(), id, rs, out);
     }
     bool CallGetOwnPropertyDescriptor(const ObjectId &objId,
-                                      const nsString &id,
+                                      const JSIDVariant &id,
                                       ReturnStatus *rs,
                                       PPropertyDescriptor *out) {
         return Base::CallGetOwnPropertyDescriptor(objId.serialize(), id, rs, out);
     }
-    bool CallDefineProperty(const ObjectId &objId, const nsString &id,
+    bool CallDefineProperty(const ObjectId &objId, const JSIDVariant &id,
                             const PPropertyDescriptor &flags,
                               ReturnStatus *rs) {
         return Base::CallDefineProperty(objId.serialize(), id, flags, rs);
     }
-    bool CallDelete(const ObjectId &objId, const nsString &id,
+    bool CallDelete(const ObjectId &objId, const JSIDVariant &id,
                     ReturnStatus *rs, bool *success) {
         return Base::CallDelete(objId.serialize(), id, rs, success);
     }
 
-    bool CallHas(const ObjectId &objId, const nsString &id,
+    bool CallHas(const ObjectId &objId, const JSIDVariant &id,
                    ReturnStatus *rs, bool *bp) {
         return Base::CallHas(objId.serialize(), id, rs, bp);
     }
-    bool CallHasOwn(const ObjectId &objId, const nsString &id,
+    bool CallHasOwn(const ObjectId &objId, const JSIDVariant &id,
                     ReturnStatus *rs, bool *bp) {
         return Base::CallHasOwn(objId.serialize(), id, rs, bp);
     }
     bool CallGet(const ObjectId &objId, const ObjectVariant &receiverVar,
-                 const nsString &id,
+                 const JSIDVariant &id,
                  ReturnStatus *rs, JSVariant *result) {
         return Base::CallGet(objId.serialize(), receiverVar, id, rs, result);
     }
     bool CallSet(const ObjectId &objId, const ObjectVariant &receiverVar,
-                 const nsString &id, const bool &strict,
+                 const JSIDVariant &id, const bool &strict,
                  const JSVariant &value, ReturnStatus *rs, JSVariant *result) {
         return Base::CallSet(objId.serialize(), receiverVar, id, strict, value, rs, result);
     }
 
     bool CallIsExtensible(const ObjectId &objId, ReturnStatus *rs,
                           bool *result) {
         return Base::CallIsExtensible(objId.serialize(), rs, result);
     }
--- a/js/ipc/JavaScriptLogging.h
+++ b/js/ipc/JavaScriptLogging.h
@@ -44,16 +44,22 @@ struct InVariant
 };
 
 struct OutVariant
 {
     JSVariant variant;
     explicit OutVariant(const JSVariant &variant) : variant(variant) {}
 };
 
+struct Identifier
+{
+    JSIDVariant variant;
+    explicit Identifier(const JSIDVariant &variant) : variant(variant) {}
+};
+
 class Logging
 {
   public:
     Logging(JavaScriptShared *shared, JSContext *cx) : shared(shared), cx(cx) {}
 
     void print(const nsCString &str) {
         const char *side = shared->isParent() ? "from child" : "from parent";
         printf("CPOW %s: %s\n", side, str.get());
@@ -160,16 +166,20 @@ class Logging
           case JSVariant::TObjectVariant: {
               const ObjectVariant &ovar = value.get_ObjectVariant();
               if (ovar.type() == ObjectVariant::TLocalObject)
                   formatObject(incoming, true, ObjectId::deserialize(ovar.get_LocalObject().serializedId()), out);
               else
                   formatObject(incoming, false, ObjectId::deserialize(ovar.get_RemoteObject().serializedId()), out);
               break;
           }
+          case JSVariant::TSymbolVariant: {
+              out = "<Symbol>";
+              break;
+          }
           case JSVariant::Tdouble: {
               out = nsPrintfCString("%.0f", value.get_double());
               break;
           }
           case JSVariant::Tbool: {
               out = value.get_bool() ? "true" : "false";
               break;
           }
@@ -179,16 +189,39 @@ class Logging
           }
           default: {
               out = "<JSIID>";
               break;
           }
         }
     }
 
+    void format(const Identifier &id, nsCString &out) {
+        switch (id.variant.type()) {
+          case JSIDVariant::TSymbolVariant: {
+              out = "<Symbol>";
+              break;
+          }
+          case JSIDVariant::TnsString: {
+              nsAutoCString tmp;
+              format(id.variant.get_nsString(), tmp);
+              out = nsPrintfCString("\"%s\"", tmp.get());
+              break;
+          }
+          case JSIDVariant::Tint32_t: {
+              out = nsPrintfCString("%d", id.variant.get_int32_t());
+              break;
+          }
+          default: {
+              out = "Unknown";
+              break;
+          }
+      }
+    }
+
   private:
     JavaScriptShared *shared;
     JSContext *cx;
 };
 
 }
 }
 
--- a/js/ipc/JavaScriptShared.cpp
+++ b/js/ipc/JavaScriptShared.cpp
@@ -262,16 +262,27 @@ JavaScriptShared::toVariant(JSContext *c
 
         ObjectVariant objVar;
         if (!toObjectVariant(cx, obj, &objVar))
             return false;
         *to = objVar;
         return true;
       }
 
+      case JSTYPE_SYMBOL:
+      {
+        RootedSymbol sym(cx, from.toSymbol());
+
+        SymbolVariant symVar;
+        if (!toSymbolVariant(cx, sym, &symVar))
+            return false;
+        *to = symVar;
+        return true;
+      }
+
       case JSTYPE_STRING:
       {
         nsAutoJSString autoStr;
         if (!autoStr.init(cx, from))
             return false;
         *to = autoStr;
         return true;
       }
@@ -309,16 +320,25 @@ JavaScriptShared::fromVariant(JSContext 
         {
           JSObject *obj = fromObjectVariant(cx, from.get_ObjectVariant());
           if (!obj)
               return false;
           to.set(ObjectValue(*obj));
           return true;
         }
 
+        case JSVariant::TSymbolVariant:
+        {
+          Symbol *sym = fromSymbolVariant(cx, from.get_SymbolVariant());
+          if (!sym)
+              return false;
+          to.setSymbol(sym);
+          return true;
+        }
+
         case JSVariant::Tdouble:
           to.set(JS_NumberValue(from.get_double()));
           return true;
 
         case JSVariant::Tbool:
           to.set(BOOLEAN_TO_JSVAL(from.get_bool()));
           return true;
 
@@ -343,20 +363,117 @@ JavaScriptShared::fromVariant(JSContext 
           JSObject *obj = xpc_NewIDObject(cx, global, iid);
           if (!obj)
               return false;
           to.set(ObjectValue(*obj));
           return true;
         }
 
         default:
+          MOZ_CRASH("NYI");
           return false;
     }
 }
 
+bool
+JavaScriptShared::toJSIDVariant(JSContext *cx, HandleId from, JSIDVariant *to)
+{
+    if (JSID_IS_STRING(from)) {
+        nsAutoJSString autoStr;
+        if (!autoStr.init(cx, JSID_TO_STRING(from)))
+            return false;
+        *to = autoStr;
+        return true;
+    }
+    if (JSID_IS_INT(from)) {
+        *to = JSID_TO_INT(from);
+        return true;
+    }
+    if (JSID_IS_SYMBOL(from)) {
+        SymbolVariant symVar;
+        if (!toSymbolVariant(cx, JSID_TO_SYMBOL(from), &symVar))
+            return false;
+        *to = symVar;
+        return true;
+    }
+    MOZ_ASSERT(false);
+    return false;
+}
+
+bool
+JavaScriptShared::fromJSIDVariant(JSContext *cx, const JSIDVariant &from, MutableHandleId to)
+{
+    switch (from.type()) {
+      case JSIDVariant::TSymbolVariant: {
+        Symbol *sym = fromSymbolVariant(cx, from.get_SymbolVariant());
+        if (!sym)
+            return false;
+        to.set(SYMBOL_TO_JSID(sym));
+        return true;
+      }
+
+      case JSIDVariant::TnsString:
+        return convertGeckoStringToId(cx, from.get_nsString(), to);
+
+      case JSIDVariant::Tint32_t:
+        to.set(INT_TO_JSID(from.get_int32_t()));
+        return true;
+
+      default:
+        return false;
+    }
+}
+
+bool
+JavaScriptShared::toSymbolVariant(JSContext *cx, JS::Symbol *symArg, SymbolVariant *symVarp)
+{
+    RootedSymbol sym(cx, symArg);
+    MOZ_ASSERT(sym);
+
+    SymbolCode code = GetSymbolCode(sym);
+    if (static_cast<uint32_t>(code) < WellKnownSymbolLimit) {
+        *symVarp = WellKnownSymbol(static_cast<uint32_t>(code));
+        return true;
+    }
+    if (code == SymbolCode::InSymbolRegistry) {
+        nsAutoJSString autoStr;
+        if (!autoStr.init(cx, GetSymbolDescription(sym)))
+            return false;
+        *symVarp = RegisteredSymbol(autoStr);
+        return true;
+    }
+    MOZ_CRASH("unique symbols not yet implemented");
+    return false;
+}
+
+JS::Symbol *
+JavaScriptShared::fromSymbolVariant(JSContext *cx, SymbolVariant symVar)
+{
+    switch (symVar.type()) {
+      case SymbolVariant::TWellKnownSymbol: {
+        uint32_t which = symVar.get_WellKnownSymbol().which();
+        if (which < WellKnownSymbolLimit)
+            return GetWellKnownSymbol(cx, static_cast<SymbolCode>(which));
+        MOZ_ASSERT(false, "bad child data");
+        return nullptr;
+      }
+
+      case SymbolVariant::TRegisteredSymbol: {
+        nsString key = symVar.get_RegisteredSymbol().key();
+        RootedString str(cx, JS_NewUCStringCopyN(cx, key.get(), key.Length()));
+        if (!str)
+            return nullptr;
+        return GetSymbolFor(cx, str);
+      }
+
+      default:
+        return nullptr;
+    }
+}
+
 /* static */ void
 JavaScriptShared::ConvertID(const nsID &from, JSIID *to)
 {
     to->m0() = from.m0;
     to->m1() = from.m1;
     to->m2() = from.m2;
     to->m3_0() = from.m3[0];
     to->m3_1() = from.m3[1];
--- a/js/ipc/JavaScriptShared.h
+++ b/js/ipc/JavaScriptShared.h
@@ -153,16 +153,22 @@ class JavaScriptShared
 
     bool Unwrap(JSContext *cx, const InfallibleTArray<CpowEntry> &aCpows, JS::MutableHandleObject objp);
     bool Wrap(JSContext *cx, JS::HandleObject aObj, InfallibleTArray<CpowEntry> *outCpows);
 
   protected:
     bool toVariant(JSContext *cx, JS::HandleValue from, JSVariant *to);
     bool fromVariant(JSContext *cx, const JSVariant &from, JS::MutableHandleValue to);
 
+    bool toJSIDVariant(JSContext *cx, JS::HandleId from, JSIDVariant *to);
+    bool fromJSIDVariant(JSContext *cx, const JSIDVariant &from, JS::MutableHandleId to);
+
+    bool toSymbolVariant(JSContext *cx, JS::Symbol *sym, SymbolVariant *symVarp);
+    JS::Symbol *fromSymbolVariant(JSContext *cx, SymbolVariant symVar);
+
     bool fromDescriptor(JSContext *cx, JS::Handle<JSPropertyDescriptor> desc,
                         PPropertyDescriptor *out);
     bool toDescriptor(JSContext *cx, const PPropertyDescriptor &in,
                       JS::MutableHandle<JSPropertyDescriptor> out);
 
     bool convertIdToGeckoString(JSContext *cx, JS::HandleId id, nsString *to);
     bool convertGeckoStringToId(JSContext *cx, const nsString &from, JS::MutableHandleId id);
 
--- a/js/ipc/JavaScriptTypes.ipdlh
+++ b/js/ipc/JavaScriptTypes.ipdlh
@@ -38,30 +38,54 @@ struct RemoteObject
 };
 
 union ObjectVariant
 {
     LocalObject;
     RemoteObject;
 };
 
+struct WellKnownSymbol
+{
+    uint32_t which;
+};
+
+struct RegisteredSymbol
+{
+    nsString key;
+};
+
+union SymbolVariant
+{
+    WellKnownSymbol;
+    RegisteredSymbol;
+};
+
 struct UndefinedVariant {};
 struct NullVariant {};
 
 union JSVariant
 {
     UndefinedVariant;
     NullVariant;
     ObjectVariant;
+    SymbolVariant;
     nsString;   /* StringValue(x) */
     double;     /* NumberValue(x) */
     bool;       /* BooleanValue(x) */
     JSIID;      /* XPC nsIID */
 };
 
+union JSIDVariant
+{
+    SymbolVariant;
+    nsString;
+    int32_t;
+};
+
 struct ReturnSuccess
 {
 };
 
 struct ReturnStopIteration
 {
 };
 
--- a/js/ipc/PJavaScript.ipdl
+++ b/js/ipc/PJavaScript.ipdl
@@ -20,25 +20,25 @@ intr protocol PJavaScript
     manager PContent or PContentBridge;
 
 both:
     // Sent when a CPOW has been finalized and table entries can be freed up.
     async DropObject(uint64_t objId);
 
     // These roughly map to the ProxyHandler hooks that CPOWs need.
     rpc PreventExtensions(uint64_t objId) returns (ReturnStatus rs);
-    rpc GetPropertyDescriptor(uint64_t objId, nsString id) returns (ReturnStatus rs, PPropertyDescriptor result);
-    rpc GetOwnPropertyDescriptor(uint64_t objId, nsString id) returns (ReturnStatus rs, PPropertyDescriptor result);
-    rpc DefineProperty(uint64_t objId, nsString id, PPropertyDescriptor descriptor) returns (ReturnStatus rs);
-    rpc Delete(uint64_t objId, nsString id) returns (ReturnStatus rs, bool successful);
+    rpc GetPropertyDescriptor(uint64_t objId, JSIDVariant id) returns (ReturnStatus rs, PPropertyDescriptor result);
+    rpc GetOwnPropertyDescriptor(uint64_t objId, JSIDVariant id) returns (ReturnStatus rs, PPropertyDescriptor result);
+    rpc DefineProperty(uint64_t objId, JSIDVariant id, PPropertyDescriptor descriptor) returns (ReturnStatus rs);
+    rpc Delete(uint64_t objId, JSIDVariant id) returns (ReturnStatus rs, bool successful);
 
-    rpc Has(uint64_t objId, nsString id) returns (ReturnStatus rs, bool has);
-    rpc HasOwn(uint64_t objId, nsString id) returns (ReturnStatus rs, bool has);
-    rpc Get(uint64_t objId, ObjectVariant receiver, nsString id) returns (ReturnStatus rs, JSVariant result);
-    rpc Set(uint64_t objId, ObjectVariant receiver, nsString id, bool strict, JSVariant value) returns (ReturnStatus rs, JSVariant result);
+    rpc Has(uint64_t objId, JSIDVariant id) returns (ReturnStatus rs, bool has);
+    rpc HasOwn(uint64_t objId, JSIDVariant id) returns (ReturnStatus rs, bool has);
+    rpc Get(uint64_t objId, ObjectVariant receiver, JSIDVariant id) returns (ReturnStatus rs, JSVariant result);
+    rpc Set(uint64_t objId, ObjectVariant receiver, JSIDVariant id, bool strict, JSVariant value) returns (ReturnStatus rs, JSVariant result);
 
     rpc IsExtensible(uint64_t objId) returns (ReturnStatus rs, bool result);
     rpc CallOrConstruct(uint64_t objId, JSParam[] argv, bool construct) returns (ReturnStatus rs, JSVariant result, JSParam[] outparams);
     rpc HasInstance(uint64_t objId, JSVariant v) returns (ReturnStatus rs, bool has);
     rpc ObjectClassIs(uint64_t objId, uint32_t classValue) returns (bool result);
     rpc ClassName(uint64_t objId) returns (nsString name);
     rpc RegExpToShared(uint64_t objId) returns (ReturnStatus rs, nsString source, uint32_t flags);
 
--- a/js/ipc/WrapperAnswer.cpp
+++ b/js/ipc/WrapperAnswer.cpp
@@ -82,207 +82,208 @@ EmptyDesc(PPropertyDescriptor *desc)
     desc->obj() = LocalObject(0);
     desc->attrs() = 0;
     desc->value() = UndefinedVariant();
     desc->getter() = 0;
     desc->setter() = 0;
 }
 
 bool
-WrapperAnswer::AnswerGetPropertyDescriptor(const ObjectId &objId, const nsString &id,
-					   ReturnStatus *rs, PPropertyDescriptor *out)
+WrapperAnswer::AnswerGetPropertyDescriptor(const ObjectId &objId, const JSIDVariant &idVar,
+                                           ReturnStatus *rs, PPropertyDescriptor *out)
 {
     AutoSafeJSContext cx;
     JSAutoRequest request(cx);
 
     EmptyDesc(out);
 
     RootedObject obj(cx, findObjectById(cx, objId));
     if (!obj)
         return fail(cx, rs);
 
     JSAutoCompartment comp(cx, obj);
 
-    LOG("%s.getPropertyDescriptor(%s)", ReceiverObj(objId), id);
+    LOG("%s.getPropertyDescriptor(%s)", ReceiverObj(objId), Identifier(idVar));
 
-    RootedId internedId(cx);
-    if (!convertGeckoStringToId(cx, id, &internedId))
+    RootedId id(cx);
+    if (!fromJSIDVariant(cx, idVar, &id))
         return fail(cx, rs);
 
     Rooted<JSPropertyDescriptor> desc(cx);
-    if (!JS_GetPropertyDescriptorById(cx, obj, internedId, &desc))
+    if (!JS_GetPropertyDescriptorById(cx, obj, id, &desc))
         return fail(cx, rs);
 
     if (!desc.object())
         return ok(rs);
 
     if (!fromDescriptor(cx, desc, out))
         return fail(cx, rs);
 
     return ok(rs);
 }
 
 bool
-WrapperAnswer::AnswerGetOwnPropertyDescriptor(const ObjectId &objId, const nsString &id,
-					      ReturnStatus *rs, PPropertyDescriptor *out)
+WrapperAnswer::AnswerGetOwnPropertyDescriptor(const ObjectId &objId, const JSIDVariant &idVar,
+                                              ReturnStatus *rs, PPropertyDescriptor *out)
 {
     AutoSafeJSContext cx;
     JSAutoRequest request(cx);
 
     EmptyDesc(out);
 
     RootedObject obj(cx, findObjectById(cx, objId));
     if (!obj)
         return fail(cx, rs);
 
     JSAutoCompartment comp(cx, obj);
 
-    LOG("%s.getOwnPropertyDescriptor(%s)", ReceiverObj(objId), id);
+    LOG("%s.getOwnPropertyDescriptor(%s)", ReceiverObj(objId), Identifier(idVar));
 
-    RootedId internedId(cx);
-    if (!convertGeckoStringToId(cx, id, &internedId))
+    RootedId id(cx);
+    if (!fromJSIDVariant(cx, idVar, &id))
         return fail(cx, rs);
 
     Rooted<JSPropertyDescriptor> desc(cx);
-    if (!JS_GetPropertyDescriptorById(cx, obj, internedId, &desc))
+    if (!JS_GetPropertyDescriptorById(cx, obj, id, &desc))
         return fail(cx, rs);
 
     if (desc.object() != obj)
         return ok(rs);
 
     if (!fromDescriptor(cx, desc, out))
         return fail(cx, rs);
 
     return ok(rs);
 }
 
 bool
-WrapperAnswer::AnswerDefineProperty(const ObjectId &objId, const nsString &id,
-				    const PPropertyDescriptor &descriptor, ReturnStatus *rs)
+WrapperAnswer::AnswerDefineProperty(const ObjectId &objId, const JSIDVariant &idVar,
+                                    const PPropertyDescriptor &descriptor, ReturnStatus *rs)
 {
     AutoSafeJSContext cx;
     JSAutoRequest request(cx);
 
     RootedObject obj(cx, findObjectById(cx, objId));
     if (!obj)
         return fail(cx, rs);
 
     JSAutoCompartment comp(cx, obj);
 
-    LOG("define %s[%s]", ReceiverObj(objId), id);
+    LOG("define %s[%s]", ReceiverObj(objId), Identifier(idVar));
 
-    RootedId internedId(cx);
-    if (!convertGeckoStringToId(cx, id, &internedId))
+    RootedId id(cx);
+    if (!fromJSIDVariant(cx, idVar, &id))
         return fail(cx, rs);
 
     Rooted<JSPropertyDescriptor> desc(cx);
     if (!toDescriptor(cx, descriptor, &desc))
         return fail(cx, rs);
 
-    if (!js::CheckDefineProperty(cx, obj, internedId, desc.value(), desc.attributes(),
+    if (!js::CheckDefineProperty(cx, obj, id, desc.value(), desc.attributes(),
                                  desc.getter(), desc.setter()))
     {
         return fail(cx, rs);
     }
 
-    if (!JS_DefinePropertyById(cx, obj, internedId, desc.value(), desc.attributes(),
+    if (!JS_DefinePropertyById(cx, obj, id, desc.value(), desc.attributes(),
                                desc.getter(), desc.setter()))
     {
         return fail(cx, rs);
     }
 
     return ok(rs);
 }
 
 bool
-WrapperAnswer::AnswerDelete(const ObjectId &objId, const nsString &id, ReturnStatus *rs,
-			    bool *success)
+WrapperAnswer::AnswerDelete(const ObjectId &objId, const JSIDVariant &idVar, ReturnStatus *rs,
+                            bool *success)
 {
     AutoSafeJSContext cx;
     JSAutoRequest request(cx);
 
     *success = false;
 
     RootedObject obj(cx, findObjectById(cx, objId));
     if (!obj)
         return fail(cx, rs);
 
     JSAutoCompartment comp(cx, obj);
 
-    LOG("delete %s[%s]", ReceiverObj(objId), id);
+    LOG("delete %s[%s]", ReceiverObj(objId), Identifier(idVar));
 
-    RootedId internedId(cx);
-    if (!convertGeckoStringToId(cx, id, &internedId))
+    RootedId id(cx);
+    if (!fromJSIDVariant(cx, idVar, &id))
         return fail(cx, rs);
 
-    if (!JS_DeletePropertyById2(cx, obj, internedId, success))
+    if (!JS_DeletePropertyById2(cx, obj, id, success))
         return fail(cx, rs);
 
     return ok(rs);
 }
 
 bool
-WrapperAnswer::AnswerHas(const ObjectId &objId, const nsString &id, ReturnStatus *rs, bool *bp)
+WrapperAnswer::AnswerHas(const ObjectId &objId, const JSIDVariant &idVar, ReturnStatus *rs, bool *bp)
 {
     AutoSafeJSContext cx;
     JSAutoRequest request(cx);
 
     *bp = false;
 
     RootedObject obj(cx, findObjectById(cx, objId));
     if (!obj)
         return fail(cx, rs);
 
     JSAutoCompartment comp(cx, obj);
 
-    LOG("%s.has(%s)", ReceiverObj(objId), id);
+    LOG("%s.has(%s)", ReceiverObj(objId), Identifier(idVar));
 
-    RootedId internedId(cx);
-    if (!convertGeckoStringToId(cx, id, &internedId))
+    RootedId id(cx);
+    if (!fromJSIDVariant(cx, idVar, &id))
         return fail(cx, rs);
 
     bool found;
-    if (!JS_HasPropertyById(cx, obj, internedId, &found))
+    if (!JS_HasPropertyById(cx, obj, id, &found))
         return fail(cx, rs);
     *bp = !!found;
 
     return ok(rs);
 }
 
 bool
-WrapperAnswer::AnswerHasOwn(const ObjectId &objId, const nsString &id, ReturnStatus *rs, bool *bp)
+WrapperAnswer::AnswerHasOwn(const ObjectId &objId, const JSIDVariant &idVar, ReturnStatus *rs,
+                            bool *bp)
 {
     AutoSafeJSContext cx;
     JSAutoRequest request(cx);
 
     *bp = false;
 
     RootedObject obj(cx, findObjectById(cx, objId));
     if (!obj)
         return fail(cx, rs);
 
     JSAutoCompartment comp(cx, obj);
 
-    LOG("%s.hasOwn(%s)", ReceiverObj(objId), id);
+    LOG("%s.hasOwn(%s)", ReceiverObj(objId), Identifier(idVar));
 
-    RootedId internedId(cx);
-    if (!convertGeckoStringToId(cx, id, &internedId))
+    RootedId id(cx);
+    if (!fromJSIDVariant(cx, idVar, &id))
         return fail(cx, rs);
 
     Rooted<JSPropertyDescriptor> desc(cx);
-    if (!JS_GetPropertyDescriptorById(cx, obj, internedId, &desc))
+    if (!JS_GetPropertyDescriptorById(cx, obj, id, &desc))
         return fail(cx, rs);
     *bp = (desc.object() == obj);
 
     return ok(rs);
 }
 
 bool
-WrapperAnswer::AnswerGet(const ObjectId &objId, const ObjectVariant &receiverVar, const nsString &id,
-			 ReturnStatus *rs, JSVariant *result)
+WrapperAnswer::AnswerGet(const ObjectId &objId, const ObjectVariant &receiverVar,
+                         const JSIDVariant &idVar, ReturnStatus *rs, JSVariant *result)
 {
     AutoSafeJSContext cx;
     JSAutoRequest request(cx);
 
     // The outparam will be written to the buffer, so it must be set even if
     // the parent won't read it.
     *result = UndefinedVariant();
 
@@ -291,36 +292,36 @@ WrapperAnswer::AnswerGet(const ObjectId 
         return fail(cx, rs);
 
     JSAutoCompartment comp(cx, obj);
 
     RootedObject receiver(cx, fromObjectVariant(cx, receiverVar));
     if (!receiver)
         return fail(cx, rs);
 
-    RootedId internedId(cx);
-    if (!convertGeckoStringToId(cx, id, &internedId))
+    RootedId id(cx);
+    if (!fromJSIDVariant(cx, idVar, &id))
         return fail(cx, rs);
 
     JS::RootedValue val(cx);
-    if (!JS_ForwardGetPropertyTo(cx, obj, internedId, receiver, &val))
+    if (!JS_ForwardGetPropertyTo(cx, obj, id, receiver, &val))
         return fail(cx, rs);
 
     if (!toVariant(cx, val, result))
         return fail(cx, rs);
 
-    LOG("get %s.%s = %s", ReceiverObj(objId), id, OutVariant(*result));
+    LOG("get %s.%s = %s", ReceiverObj(objId), Identifier(idVar), OutVariant(*result));
 
     return ok(rs);
 }
 
 bool
-WrapperAnswer::AnswerSet(const ObjectId &objId, const ObjectVariant &receiverVar, const nsString &id,
-			 const bool &strict, const JSVariant &value, ReturnStatus *rs,
-			 JSVariant *result)
+WrapperAnswer::AnswerSet(const ObjectId &objId, const ObjectVariant &receiverVar,
+                         const JSIDVariant &idVar, const bool &strict, const JSVariant &value,
+                         ReturnStatus *rs, JSVariant *result)
 {
     AutoSafeJSContext cx;
     JSAutoRequest request(cx);
 
     // The outparam will be written to the buffer, so it must be set even if
     // the parent won't read it.
     *result = UndefinedVariant();
 
@@ -329,29 +330,29 @@ WrapperAnswer::AnswerSet(const ObjectId 
         return fail(cx, rs);
 
     JSAutoCompartment comp(cx, obj);
 
     RootedObject receiver(cx, fromObjectVariant(cx, receiverVar));
     if (!receiver)
         return fail(cx, rs);
 
-    LOG("set %s[%s] = %s", ReceiverObj(objId), id, InVariant(value));
+    LOG("set %s[%s] = %s", ReceiverObj(objId), Identifier(idVar), InVariant(value));
 
-    RootedId internedId(cx);
-    if (!convertGeckoStringToId(cx, id, &internedId))
+    RootedId id(cx);
+    if (!fromJSIDVariant(cx, idVar, &id))
         return fail(cx, rs);
 
     MOZ_ASSERT(obj == receiver);
 
     RootedValue val(cx);
     if (!fromVariant(cx, value, &val))
         return fail(cx, rs);
 
-    if (!JS_SetPropertyById(cx, obj, internedId, val))
+    if (!JS_SetPropertyById(cx, obj, id, val))
         return fail(cx, rs);
 
     if (!toVariant(cx, val, result))
         return fail(cx, rs);
 
     return ok(rs);
 }
 
@@ -507,17 +508,17 @@ WrapperAnswer::AnswerHasInstance(const O
     if (!JS_HasInstance(cx, obj, val, bp))
         return fail(cx, rs);
 
     return ok(rs);
 }
 
 bool
 WrapperAnswer::AnswerObjectClassIs(const ObjectId &objId, const uint32_t &classValue,
-				   bool *result)
+                                   bool *result)
 {
     AutoSafeJSContext cx;
     JSAutoRequest request(cx);
 
     RootedObject obj(cx, findObjectById(cx, objId));
     if (!obj) {
         // This is very unfortunate, but we have no choice.
         *result = false;
@@ -574,17 +575,17 @@ WrapperAnswer::AnswerRegExpToShared(cons
 
     *flags = JS_GetRegExpFlags(cx, obj);
 
     return ok(rs);
 }
 
 bool
 WrapperAnswer::AnswerGetPropertyNames(const ObjectId &objId, const uint32_t &flags,
-				      ReturnStatus *rs, nsTArray<nsString> *names)
+                                      ReturnStatus *rs, nsTArray<nsString> *names)
 {
     AutoSafeJSContext cx;
     JSAutoRequest request(cx);
 
     RootedObject obj(cx, findObjectById(cx, objId));
     if (!obj)
         return fail(cx, rs);
 
@@ -604,17 +605,17 @@ WrapperAnswer::AnswerGetPropertyNames(co
         names->AppendElement(name);
     }
 
     return ok(rs);
 }
 
 bool
 WrapperAnswer::AnswerInstanceOf(const ObjectId &objId, const JSIID &iid, ReturnStatus *rs,
-				bool *instanceof)
+                                bool *instanceof)
 {
     AutoSafeJSContext cx;
     JSAutoRequest request(cx);
 
     *instanceof = false;
 
     RootedObject obj(cx, findObjectById(cx, objId));
     if (!obj)
@@ -631,18 +632,17 @@ WrapperAnswer::AnswerInstanceOf(const Ob
     if (rv != NS_OK)
         return fail(cx, rs);
 
     return ok(rs);
 }
 
 bool
 WrapperAnswer::AnswerDOMInstanceOf(const ObjectId &objId, const int &prototypeID,
-				   const int &depth,
-				   ReturnStatus *rs, bool *instanceof)
+                                   const int &depth, ReturnStatus *rs, bool *instanceof)
 {
     AutoSafeJSContext cx;
     JSAutoRequest request(cx);
 
     *instanceof = false;
 
     RootedObject obj(cx, findObjectById(cx, objId));
     if (!obj)
--- a/js/ipc/WrapperAnswer.h
+++ b/js/ipc/WrapperAnswer.h
@@ -14,38 +14,38 @@ namespace mozilla {
 namespace jsipc {
 
 class WrapperAnswer : public virtual JavaScriptShared
 {
   public:
     explicit WrapperAnswer(JSRuntime *rt) : JavaScriptShared(rt) {}
 
     bool AnswerPreventExtensions(const ObjectId &objId, ReturnStatus *rs);
-    bool AnswerGetPropertyDescriptor(const ObjectId &objId, const nsString &id,
+    bool AnswerGetPropertyDescriptor(const ObjectId &objId, const JSIDVariant &id,
                                      ReturnStatus *rs,
                                      PPropertyDescriptor *out);
     bool AnswerGetOwnPropertyDescriptor(const ObjectId &objId,
-                                        const nsString &id,
+                                        const JSIDVariant &id,
                                         ReturnStatus *rs,
                                         PPropertyDescriptor *out);
-    bool AnswerDefineProperty(const ObjectId &objId, const nsString &id,
+    bool AnswerDefineProperty(const ObjectId &objId, const JSIDVariant &id,
                               const PPropertyDescriptor &flags,
                               ReturnStatus *rs);
-    bool AnswerDelete(const ObjectId &objId, const nsString &id,
+    bool AnswerDelete(const ObjectId &objId, const JSIDVariant &id,
                       ReturnStatus *rs, bool *success);
 
-    bool AnswerHas(const ObjectId &objId, const nsString &id,
+    bool AnswerHas(const ObjectId &objId, const JSIDVariant &id,
                        ReturnStatus *rs, bool *bp);
-    bool AnswerHasOwn(const ObjectId &objId, const nsString &id,
+    bool AnswerHasOwn(const ObjectId &objId, const JSIDVariant &id,
                           ReturnStatus *rs, bool *bp);
     bool AnswerGet(const ObjectId &objId, const ObjectVariant &receiverVar,
-                       const nsString &id,
+                       const JSIDVariant &id,
                        ReturnStatus *rs, JSVariant *result);
     bool AnswerSet(const ObjectId &objId, const ObjectVariant &receiverVar,
-                   const nsString &id, const bool &strict,
+                   const JSIDVariant &id, const bool &strict,
                    const JSVariant &value, ReturnStatus *rs, JSVariant *result);
 
     bool AnswerIsExtensible(const ObjectId &objId, ReturnStatus *rs,
                             bool *result);
     bool AnswerCallOrConstruct(const ObjectId &objId, const nsTArray<JSParam> &argv,
                                const bool &construct, ReturnStatus *rs, JSVariant *result,
                                nsTArray<JSParam> *outparams);
     bool AnswerHasInstance(const ObjectId &objId, const JSVariant &v, ReturnStatus *rs, bool *bp);
--- a/js/ipc/WrapperOwner.cpp
+++ b/js/ipc/WrapperOwner.cpp
@@ -140,23 +140,23 @@ CPOWProxyHandler::getPropertyDescriptor(
 }
 
 bool
 WrapperOwner::getPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id,
 				    MutableHandle<JSPropertyDescriptor> desc)
 {
     ObjectId objId = idOf(proxy);
 
-    nsString idstr;
-    if (!convertIdToGeckoString(cx, id, &idstr))
+    JSIDVariant idVar;
+    if (!toJSIDVariant(cx, id, &idVar))
         return false;
 
     ReturnStatus status;
     PPropertyDescriptor result;
-    if (!CallGetPropertyDescriptor(objId, idstr, &status, &result))
+    if (!CallGetPropertyDescriptor(objId, idVar, &status, &result))
         return ipcfail(cx);
 
     LOG_STACK();
 
     if (!ok(cx, status))
         return false;
 
     return toDescriptor(cx, result, desc);
@@ -170,23 +170,23 @@ CPOWProxyHandler::getOwnPropertyDescript
 }
 
 bool
 WrapperOwner::getOwnPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id,
 				       MutableHandle<JSPropertyDescriptor> desc)
 {
     ObjectId objId = idOf(proxy);
 
-    nsString idstr;
-    if (!convertIdToGeckoString(cx, id, &idstr))
+    JSIDVariant idVar;
+    if (!toJSIDVariant(cx, id, &idVar))
         return false;
 
     ReturnStatus status;
     PPropertyDescriptor result;
-    if (!CallGetOwnPropertyDescriptor(objId, idstr, &status, &result))
+    if (!CallGetOwnPropertyDescriptor(objId, idVar, &status, &result))
         return ipcfail(cx);
 
     LOG_STACK();
 
     if (!ok(cx, status))
         return false;
 
     return toDescriptor(cx, result, desc);
@@ -200,26 +200,26 @@ CPOWProxyHandler::defineProperty(JSConte
 }
 
 bool
 WrapperOwner::defineProperty(JSContext *cx, HandleObject proxy, HandleId id,
 			     MutableHandle<JSPropertyDescriptor> desc)
 {
     ObjectId objId = idOf(proxy);
 
-    nsString idstr;
-    if (!convertIdToGeckoString(cx, id, &idstr))
+    JSIDVariant idVar;
+    if (!toJSIDVariant(cx, id, &idVar))
         return false;
 
     PPropertyDescriptor descriptor;
     if (!fromDescriptor(cx, desc, &descriptor))
         return false;
 
     ReturnStatus status;
-    if (!CallDefineProperty(objId, idstr, descriptor, &status))
+    if (!CallDefineProperty(objId, idVar, descriptor, &status))
         return ipcfail(cx);
 
     LOG_STACK();
 
     return ok(cx, status);
 }
 
 bool
@@ -241,22 +241,22 @@ CPOWProxyHandler::delete_(JSContext *cx,
     FORWARD(delete_, (cx, proxy, id, bp));
 }
 
 bool
 WrapperOwner::delete_(JSContext *cx, HandleObject proxy, HandleId id, bool *bp)
 {
     ObjectId objId = idOf(proxy);
 
-    nsString idstr;
-    if (!convertIdToGeckoString(cx, id, &idstr))
+    JSIDVariant idVar;
+    if (!toJSIDVariant(cx, id, &idVar))
         return false;
 
     ReturnStatus status;
-    if (!CallDelete(objId, idstr, &status, bp))
+    if (!CallDelete(objId, idVar, &status, bp))
         return ipcfail(cx);
 
     LOG_STACK();
 
     return ok(cx, status);
 }
 
 bool
@@ -277,22 +277,22 @@ CPOWProxyHandler::has(JSContext *cx, Han
     FORWARD(has, (cx, proxy, id, bp));
 }
 
 bool
 WrapperOwner::has(JSContext *cx, HandleObject proxy, HandleId id, bool *bp)
 {
     ObjectId objId = idOf(proxy);
 
-    nsString idstr;
-    if (!convertIdToGeckoString(cx, id, &idstr))
+    JSIDVariant idVar;
+    if (!toJSIDVariant(cx, id, &idVar))
         return false;
 
     ReturnStatus status;
-    if (!CallHas(objId, idstr, &status, bp))
+    if (!CallHas(objId, idVar, &status, bp))
         return ipcfail(cx);
 
     LOG_STACK();
 
     return ok(cx, status);
 }
 
 bool
@@ -301,22 +301,22 @@ CPOWProxyHandler::hasOwn(JSContext *cx, 
     FORWARD(hasOwn, (cx, proxy, id, bp));
 }
 
 bool
 WrapperOwner::hasOwn(JSContext *cx, HandleObject proxy, HandleId id, bool *bp)
 {
     ObjectId objId = idOf(proxy);
 
-    nsString idstr;
-    if (!convertIdToGeckoString(cx, id, &idstr))
+    JSIDVariant idVar;
+    if (!toJSIDVariant(cx, id, &idVar))
         return false;
 
     ReturnStatus status;
-    if (!CallHasOwn(objId, idstr, &status, bp))
+    if (!CallHasOwn(objId, idVar, &status, bp))
         return ipcfail(cx);
 
     LOG_STACK();
 
     return !!ok(cx, status);
 }
 
 bool
@@ -377,42 +377,43 @@ WrapperOwner::toString(JSContext *cx, Ha
         return false;
 
     args.rval().setString(str);
     return true;
 }
 
 bool
 WrapperOwner::get(JSContext *cx, HandleObject proxy, HandleObject receiver,
-		  HandleId id, MutableHandleValue vp)
+                  HandleId id, MutableHandleValue vp)
 {
     ObjectId objId = idOf(proxy);
 
     ObjectVariant receiverVar;
     if (!toObjectVariant(cx, receiver, &receiverVar))
         return false;
 
-    nsString idstr;
-    if (!convertIdToGeckoString(cx, id, &idstr))
+    JSIDVariant idVar;
+    if (!toJSIDVariant(cx, id, &idVar))
         return false;
 
     JSVariant val;
     ReturnStatus status;
-    if (!CallGet(objId, receiverVar, idstr, &status, &val))
+    if (!CallGet(objId, receiverVar, idVar, &status, &val))
         return ipcfail(cx);
 
     LOG_STACK();
 
     if (!ok(cx, status))
         return false;
 
     if (!fromVariant(cx, val, vp))
         return false;
 
-    if (idstr.EqualsLiteral("toString")) {
+    if (idVar.type() == JSIDVariant::TnsString &&
+        idVar.get_nsString().EqualsLiteral("toString")) {
         RootedFunction toString(cx, JS_NewFunction(cx, CPOWToString, 0, 0, proxy, "toString"));
         if (!toString)
             return false;
 
         RootedObject toStringObj(cx, JS_GetFunctionObject(toString));
 
         if (!JS_DefineProperty(cx, toStringObj, "__cpow__", vp, JSPROP_PERMANENT | JSPROP_READONLY))
             return false;
@@ -427,35 +428,35 @@ bool
 CPOWProxyHandler::set(JSContext *cx, JS::HandleObject proxy, JS::HandleObject receiver,
                       JS::HandleId id, bool strict, JS::MutableHandleValue vp) const
 {
     FORWARD(set, (cx, proxy, receiver, id, strict, vp));
 }
 
 bool
 WrapperOwner::set(JSContext *cx, JS::HandleObject proxy, JS::HandleObject receiver,
-		  JS::HandleId id, bool strict, JS::MutableHandleValue vp)
+                  JS::HandleId id, bool strict, JS::MutableHandleValue vp)
 {
     ObjectId objId = idOf(proxy);
 
     ObjectVariant receiverVar;
     if (!toObjectVariant(cx, receiver, &receiverVar))
         return false;
 
-    nsString idstr;
-    if (!convertIdToGeckoString(cx, id, &idstr))
+    JSIDVariant idVar;
+    if (!toJSIDVariant(cx, id, &idVar))
         return false;
 
     JSVariant val;
     if (!toVariant(cx, vp, &val))
         return false;
 
     ReturnStatus status;
     JSVariant result;
-    if (!CallSet(objId, receiverVar, idstr, strict, val, &status, &result))
+    if (!CallSet(objId, receiverVar, idVar, strict, val, &status, &result))
         return ipcfail(cx);
 
     LOG_STACK();
 
     if (!ok(cx, status))
         return false;
 
     return fromVariant(cx, result, vp);
--- a/js/ipc/WrapperOwner.h
+++ b/js/ipc/WrapperOwner.h
@@ -103,38 +103,38 @@ class WrapperOwner : public virtual Java
     bool ok(JSContext *cx, const ReturnStatus &status);
 
     bool inactive_;
 
     /*** Dummy call handlers ***/
   public:
     virtual bool SendDropObject(const ObjectId &objId) = 0;
     virtual bool CallPreventExtensions(const ObjectId &objId, ReturnStatus *rs) = 0;
-    virtual bool CallGetPropertyDescriptor(const ObjectId &objId, const nsString &id,
+    virtual bool CallGetPropertyDescriptor(const ObjectId &objId, const JSIDVariant &id,
                                            ReturnStatus *rs,
                                            PPropertyDescriptor *out) = 0;
     virtual bool CallGetOwnPropertyDescriptor(const ObjectId &objId,
-                                              const nsString &id,
+                                              const JSIDVariant &id,
                                               ReturnStatus *rs,
                                               PPropertyDescriptor *out) = 0;
-    virtual bool CallDefineProperty(const ObjectId &objId, const nsString &id,
+    virtual bool CallDefineProperty(const ObjectId &objId, const JSIDVariant &id,
                                     const PPropertyDescriptor &flags,
                                     ReturnStatus *rs) = 0;
-    virtual bool CallDelete(const ObjectId &objId, const nsString &id,
+    virtual bool CallDelete(const ObjectId &objId, const JSIDVariant &id,
                             ReturnStatus *rs, bool *success) = 0;
 
-    virtual bool CallHas(const ObjectId &objId, const nsString &id,
+    virtual bool CallHas(const ObjectId &objId, const JSIDVariant &id,
                          ReturnStatus *rs, bool *bp) = 0;
-    virtual bool CallHasOwn(const ObjectId &objId, const nsString &id,
+    virtual bool CallHasOwn(const ObjectId &objId, const JSIDVariant &id,
                             ReturnStatus *rs, bool *bp) = 0;
     virtual bool CallGet(const ObjectId &objId, const ObjectVariant &receiverVar,
-                         const nsString &id,
+                         const JSIDVariant &id,
                          ReturnStatus *rs, JSVariant *result) = 0;
     virtual bool CallSet(const ObjectId &objId, const ObjectVariant &receiverVar,
-                         const nsString &id, const bool &strict,
+                         const JSIDVariant &id, const bool &strict,
                          const JSVariant &value, ReturnStatus *rs, JSVariant *result) = 0;
 
     virtual bool CallIsExtensible(const ObjectId &objId, ReturnStatus *rs,
                                   bool *result) = 0;
     virtual bool CallCallOrConstruct(const ObjectId &objId, const nsTArray<JSParam> &argv,
                                      const bool &construct, ReturnStatus *rs, JSVariant *result,
                                      nsTArray<JSParam> *outparams) = 0;
     virtual bool CallHasInstance(const ObjectId &objId, const JSVariant &v,
--- a/js/src/builtin/Eval.cpp
+++ b/js/src/builtin/Eval.cpp
@@ -5,20 +5,20 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "builtin/Eval.h"
 
 #include "mozilla/HashFunctions.h"
 #include "mozilla/Range.h"
 
 #include "jscntxt.h"
-#include "jsonparser.h"
 
 #include "frontend/BytecodeCompiler.h"
 #include "vm/GlobalObject.h"
+#include "vm/JSONParser.h"
 
 #include "vm/Interpreter-inl.h"
 
 using namespace js;
 
 using mozilla::AddToHash;
 using mozilla::HashString;
 using mozilla::RangedPtr;
--- a/js/src/doc/Debugger/Debugger.Script.md
+++ b/js/src/doc/Debugger/Debugger.Script.md
@@ -110,27 +110,16 @@ from its prototype:
     contains code at that line. In such a case, the most deeply nested
     script—the one with the highest static level—should receive the
     breakpoint.
 
 `strictMode`
 :   This is `true` if this script's code is ECMAScript strict mode code, and
     `false` otherwise.
 
-`sourceMapURL`
-:   If this script was produced by a minimizer or translated from some other
-    language, and we know the URL of a <b>source map</b> document relating
-    the source positions in this script to the corresponding source
-    positions in the original source, then this property's value is that
-    URL. Otherwise, this is `null`.
-
-    (On the web, the translator may provide the source map URL in a
-    specially formatted comment in the JavaScript source code, or via a
-    header in the HTTP reply that carried the generated JavaScript.)
-
 ## Function Properties of the Debugger.Script Prototype Object
 
 The functions described below may only be called with a `this` value
 referring to a `Debugger.Script` instance; they may not be used as
 methods of other kinds of objects.
 
 <code>decompile([<i>pretty</i>])</code>
 :   Return a string containing JavaScript source code equivalent to this
--- a/js/src/doc/Debugger/Debugger.Source.md
+++ b/js/src/doc/Debugger/Debugger.Source.md
@@ -69,16 +69,27 @@ from its prototype:
 
     * The URL may be the name of a XPCOM JavaScript module or subscript.
 
     (Note that code passed to `eval`, the `Function` constructor, or a
     similar function is <i>not</i> considered to be loaded from a URL; the
     `url` accessor on `Debugger.Source` instances for such sources should
     return `undefined`.)
 
+`sourceMapURL`
+:   If this source was produced by a minimizer or translated from some other
+    language, and we know the URL of a <b>source map</b> document relating
+    the source positions in this source to the corresponding source
+    positions in the original source, then this property's value is that
+    URL. Otherwise, this is `null`.
+
+    (On the web, the translator may provide the source map URL in a
+    specially formatted comment in the JavaScript source code, or via a
+    header in the HTTP reply that carried the generated JavaScript.)
+
 `element`
 :   The [`Debugger.Object`][object] instance referring to the DOM element to which
     this source code belongs, if any, or `undefined` if it belongs to no DOM
     element. Source belongs to a DOM element in the following cases:
 
     * Source belongs to a `<script>` element if it is the element's text
       content (that is, it is written out as the body of the `<script>`
       element in the markup text), or is the source document referenced by its
--- a/js/src/gc/RootMarking.cpp
+++ b/js/src/gc/RootMarking.cpp
@@ -7,29 +7,29 @@
 #include "mozilla/ArrayUtils.h"
 
 #ifdef MOZ_VALGRIND
 # include <valgrind/memcheck.h>
 #endif
 
 #include "jscntxt.h"
 #include "jsgc.h"
-#include "jsonparser.h"
 #include "jsprf.h"
 #include "jstypes.h"
 #include "jswatchpoint.h"
 
 #include "builtin/MapObject.h"
 #include "frontend/BytecodeCompiler.h"
 #include "gc/ForkJoinNursery.h"
 #include "gc/GCInternals.h"
 #include "gc/Marking.h"
 #include "jit/IonMacroAssembler.h"
 #include "js/HashTable.h"
 #include "vm/Debugger.h"
+#include "vm/JSONParser.h"
 #include "vm/PropDesc.h"
 
 #include "jsgcinlines.h"
 #include "jsobjinlines.h"
 
 using namespace js;
 using namespace js::gc;
 
deleted file mode 100644
--- a/js/src/jit-test/tests/debug/Script-sourceMapURL-deprecated.js
+++ /dev/null
@@ -1,70 +0,0 @@
-// Script.prototype.sourceMapURL can be a string or null.
-
-let g = newGlobal();
-let dbg = new Debugger;
-let gw = dbg.addDebuggee(g);
-
-function getSourceMapURL() {
-    let fw = gw.makeDebuggeeValue(g.f);
-    return fw.script.sourceMapURL;
-}
-
-// Without a source map
-g.evaluate("function f(x) { return 2*x; }");
<