--- a/Makefile
+++ b/Makefile
@@ -21,17 +21,19 @@ include $(CORE_DEPTH)/coreconf/config.mk
 #######################################################################
 
 
 
 #######################################################################
 # (4) Include "local" platform-dependent assignments (OPTIONAL).      #
 #######################################################################
 
-
+ifdef NSS_DISABLE_GTESTS
+DIRS := $(filter-out external_tests,$(DIRS))
+endif
 
 #######################################################################
 # (5) Execute "global" rules. (OPTIONAL)                              #
 #######################################################################
 
 include $(CORE_DEPTH)/coreconf/rules.mk
 
 #######################################################################

--- a/coreconf/WIN32.mk
+++ b/coreconf/WIN32.mk
@@ -187,17 +187,18 @@ endif
 	# Purify requires /FIXED:NO when linking EXEs.
 	LDFLAGS    += /FIXED:NO
     endif
 ifneq ($(_MSC_VER),$(_MSC_VER_6))
     # NSS has too many of these to fix, downgrade the warning
     # Disable C4267: conversion from 'size_t' to 'type', possible loss of data
     # Disable C4244: conversion from 'type1' to 'type2', possible loss of data
     # Disable C4018: 'expression' : signed/unsigned mismatch
-    OS_CFLAGS += -w44267 -w44244 -w44018
+    # Disable C4312: 'type cast': conversion from 'type1' to 'type2' of greater size
+    OS_CFLAGS += -w44267 -w44244 -w44018 -w44312
     ifeq ($(_MSC_VER_GE_12),1)
 	OS_CFLAGS += -FS
     endif
 endif # !MSVC6
 endif # NS_USE_GCC
 
 ifdef USE_64
 DEFINES += -DWIN64

--- a/external_tests/ssl_gtest/Makefile
+++ b/external_tests/ssl_gtest/Makefile
@@ -38,24 +38,25 @@ include $(CORE_DEPTH)/coreconf/rules.mk
 #######################################################################
 
 
 #######################################################################
 # (7) Execute "local" rules. (OPTIONAL).                              #
 #######################################################################
 
 MKPROG = $(CCC)
-CXXFLAGS += -std=c++0x
 CFLAGS += -I$(CORE_DEPTH)/lib/ssl
 
 include ../../cmd/platrules.mk
 
 ifeq (WINNT,$(OS_ARCH))
     # -MTd (not -MD) because that makes it link to the right library
     # -EHsc because gtest has exception handlers
     OS_CFLAGS := $(filterout -MD,$(OS_CFLAGS))
     OS_CFLAGS += -MTd -EHsc -nologo
     # http://www.suodenjoki.dk/us/archive/2010/min-max.htm
     OS_CFLAGS += -DNOMINMAX
 
     # Linking to winsock to get htonl
     OS_LIBS += Ws2_32.lib
+else
+    CXXFLAGS += -std=c++0x
 endif

--- a/external_tests/ssl_gtest/ssl_gtest.cc
+++ b/external_tests/ssl_gtest/ssl_gtest.cc
@@ -11,19 +11,16 @@
 
 std::string g_working_dir_path;
 
 int main(int argc, char **argv) {
   // Start the tests
   ::testing::InitGoogleTest(&argc, argv);
   g_working_dir_path = ".";
 
-  // Temporarily disable asserts for PKCS#11 slot leakage until
-  // Bug 1168425 is fixed.
-  unsetenv("NSS_STRICT_SHUTDOWN");
   char* workdir = getenv("NSS_GTEST_WORKDIR");
   if (workdir)
     g_working_dir_path = workdir;
 
   for (int i = 0; i < argc; i++) {
     if (!strcmp(argv[i], "-d")) {
       g_working_dir_path = argv[i + 1];
       ++i;

--- a/external_tests/ssl_gtest/tls_agent.cc
+++ b/external_tests/ssl_gtest/tls_agent.cc
@@ -231,34 +231,34 @@ void TlsAgent::SetSignatureAlgorithms(co
                                       size_t count) {
   EXPECT_TRUE(EnsureTlsSetup());
   EXPECT_LE(count, SSL_SignatureMaxCount());
   EXPECT_EQ(SECSuccess, SSL_SignaturePrefSet(ssl_fd_, algorithms,
                                              static_cast<unsigned int>(count)));
   EXPECT_EQ(SECFailure, SSL_SignaturePrefSet(ssl_fd_, algorithms, 0))
       << "setting no algorithms should fail and do nothing";
 
+  std::vector<SSLSignatureAndHashAlg> configuredAlgorithms(count);
   unsigned int configuredCount;
-  SSLSignatureAndHashAlg configuredAlgorithms[count];
   EXPECT_EQ(SECFailure,
             SSL_SignaturePrefGet(ssl_fd_, nullptr, &configuredCount, 1))
       << "get algorithms, algorithms is nullptr";
   EXPECT_EQ(SECFailure,
-            SSL_SignaturePrefGet(ssl_fd_, configuredAlgorithms,
+            SSL_SignaturePrefGet(ssl_fd_, &configuredAlgorithms[0],
                                  &configuredCount, 0))
       << "get algorithms, too little space";
   EXPECT_EQ(SECFailure,
-            SSL_SignaturePrefGet(ssl_fd_, configuredAlgorithms, nullptr,
-                                 PR_ARRAY_SIZE(configuredAlgorithms)))
+            SSL_SignaturePrefGet(ssl_fd_, &configuredAlgorithms[0],
+                                 nullptr, configuredAlgorithms.size()))
       << "get algorithms, algCountOut is nullptr";
 
   EXPECT_EQ(SECSuccess,
-            SSL_SignaturePrefGet(ssl_fd_, configuredAlgorithms,
+            SSL_SignaturePrefGet(ssl_fd_, &configuredAlgorithms[0],
                                  &configuredCount,
-                                 PR_ARRAY_SIZE(configuredAlgorithms)));
+                                 configuredAlgorithms.size()));
   // SignaturePrefSet drops unsupported algorithms silently, so the number that
   // are configured might be fewer.
   EXPECT_LE(configuredCount, count);
   unsigned int i = 0;
   for (unsigned int j = 0; j < count && i < configuredCount; ++j) {
     if (i < configuredCount &&
         algorithms[j].hashAlg == configuredAlgorithms[i].hashAlg &&
         algorithms[j].sigAlg == configuredAlgorithms[i].sigAlg) {
@@ -400,17 +400,17 @@ void TlsAgent::EnableExtendedMasterSecre
   SECStatus rv = SSL_OptionSet(ssl_fd_,
                                SSL_ENABLE_EXTENDED_MASTER_SECRET,
                                PR_TRUE);
 
   ASSERT_EQ(SECSuccess, rv);
 }
 
 void TlsAgent::CheckExtendedMasterSecret(bool expected) {
-  ASSERT_EQ(expected, info_.extendedMasterSecretUsed)
+  ASSERT_EQ(expected, static_cast<bool>(info_.extendedMasterSecretUsed))
       << "unexpected extended master secret state for " << name_;
 }
 
 void TlsAgent::DisableRollbackDetection() {
   ASSERT_TRUE(EnsureTlsSetup());
 
   SECStatus rv = SSL_OptionSet(ssl_fd_,
                                SSL_ROLLBACK_DETECTION,

--- a/manifest.mn
+++ b/manifest.mn
@@ -5,13 +5,9 @@
 CORE_DEPTH = .
 DEPTH      = .
 
 IMPORTS =	nspr20/v4.8 \
 		$(NULL)
 
 RELEASE = nss
 
-DIRS = coreconf lib cmd
-
-ifndef NSS_DISABLE_GTESTS
-DIRS += external_tests
-endif
+DIRS = coreconf lib cmd external_tests

--- a/tests/ssl_gtests/ssl_gtests.sh
+++ b/tests/ssl_gtests/ssl_gtests.sh
@@ -100,26 +100,36 @@ ssl_gtest_init()
 ####################################################################
 ssl_gtest_start()
 {
   if [ ! -f ${BINDIR}/ssl_gtest ]; then
     html_unknown "Skipping ssl_gtest (not built)"
     return
   fi
 
+  # Temporarily disable asserts for PKCS#11 slot leakage (Bug 1168425)
+  unset NSS_STRICT_SHUTDOWN
   SSLGTESTREPORT="${SSLGTESTDIR}/report.xml"
   ${BINDIR}/ssl_gtest -d "${SSLGTESTDIR}" --gtest_output=xml:"${SSLGTESTREPORT}"
   html_msg $? 0 "ssl_gtest run successfully"
   sed -f ${QADIR}/ssl_gtests/parsereport.sed "${SSLGTESTREPORT}" | \
   while read result name; do
     if [ "$result" = "notrun" ]; then
       echo "$name" SKIPPED
     elif [ "$result" = "run" ]; then
       html_passed "$name" > /dev/null
     else
       html_failed "$name"
     fi
   done
 }
 
+ssl_gtest_cleanup()
+{
+  cd ${QADIR}
+  . common/cleanup.sh
+}
+
 ################## main #################################################
+cd "$(dirname "$0")"
 ssl_gtest_init
 ssl_gtest_start
+ssl_gtest_cleanup