Merge from mozilla-central.
authorDavid Anderson <danderson@mozilla.com>
Mon, 26 Mar 2012 14:17:28 -0700
changeset 106047 5caeb193e6de12c5252280a0f8bd29fb32e821e7
parent 106046 cc2329cebf200e14eb320e6004903bcf95d4e42b (current diff)
parent 90298 df8ac2a1ecdd3223a110a15ee717b3ce6882effa (diff)
child 106048 349c49960e9e508d8dc538303442e2facea562d1
push idunknown
push userunknown
push dateunknown
milestone14.0a1
Merge from mozilla-central.
accessible/src/base/nsAccUtils.cpp
accessible/src/base/nsAccUtils.h
accessible/src/base/nsAccessibilityService.h
accessible/src/base/nsAccessible.cpp
accessible/src/base/nsAccessible.h
accessible/src/base/nsBaseWidgetAccessible.h
accessible/src/html/nsHTMLImageMapAccessible.cpp
accessible/src/html/nsHyperTextAccessible.cpp
accessible/src/html/nsHyperTextAccessible.h
accessible/src/mac/mozTextAccessible.mm
accessible/src/mac/nsAccessibleWrap.mm
accessible/src/xul/nsXULFormControlAccessible.cpp
accessible/src/xul/nsXULFormControlAccessible.h
accessible/src/xul/nsXULListboxAccessible.cpp
accessible/src/xul/nsXULListboxAccessible.h
accessible/src/xul/nsXULTabAccessible.cpp
accessible/src/xul/nsXULTreeAccessible.cpp
accessible/src/xul/nsXULTreeGridAccessible.cpp
accessible/tests/mochitest/actions/test_tree.xul
accessible/tests/mochitest/attributes/test_obj_group.xul
accessible/tests/mochitest/common.js
accessible/tests/mochitest/events/test_focus_tree.xul
accessible/tests/mochitest/hittest/test_general.xul
accessible/tests/mochitest/relations/test_tree.xul
b2g/chrome/content/httpd.js
b2g/chrome/jar.mn
b2g/installer/package-manifest.in
browser/base/content/browser.js
browser/base/jar.mn
browser/components/migration/src/nsBrowserProfileMigratorUtils.cpp
browser/components/migration/src/nsBrowserProfileMigratorUtils.h
browser/components/migration/src/nsIEProfileMigrator.cpp
browser/components/migration/src/nsSafariProfileMigrator.cpp
browser/components/nsBrowserGlue.js
browser/components/sessionstore/src/nsSessionStore.js
browser/devtools/webconsole/test/browser_webconsole_bug_595934_message_categories.js
browser/devtools/webconsole/test/browser_webconsole_bug_642108_pruneTest.js
browser/devtools/webconsole/test/browser_webconsole_bug_653531_highlighter_console_helper.js
browser/devtools/webconsole/test/test-console-extras.html
browser/locales/en-US/chrome/browser/browser.dtd
build/mobile/devicemanagerADB.py
build/mobile/devicemanagerSUT.py
caps/src/nsJSPrincipals.cpp
config/autoconf.mk.in
configure.in
content/base/public/nsDOMFile.h
content/base/src/nsContentList.h
content/base/src/nsContentUtils.cpp
content/base/src/nsDOMFileReader.cpp
content/base/src/nsDOMTokenList.cpp
content/base/src/nsDocument.cpp
content/base/src/nsDocument.h
content/base/src/nsGenericElement.cpp
content/base/src/nsGenericElement.h
content/base/src/nsImageLoadingContent.h
content/base/src/nsObjectLoadingContent.cpp
content/base/src/nsScriptLoader.cpp
content/base/src/nsXMLHttpRequest.cpp
content/base/test/test_XHR.html
content/canvas/public/nsICanvasRenderingContextInternal.h
content/canvas/src/WebGLContext.cpp
content/canvas/src/WebGLContext.h
content/canvas/src/nsCanvasRenderingContext2D.cpp
content/canvas/src/nsCanvasRenderingContext2DAzure.cpp
content/events/src/nsDOMTouchEvent.h
content/events/src/nsEventListenerManager.cpp
content/html/content/public/nsHTMLCanvasElement.h
content/html/content/public/nsHTMLMediaElement.h
content/html/content/src/nsGenericHTMLElement.cpp
content/html/content/src/nsGenericHTMLElement.h
content/html/content/src/nsHTMLCanvasElement.cpp
content/html/content/src/nsHTMLFormElement.cpp
content/html/content/src/nsHTMLInputElement.cpp
content/html/content/src/nsHTMLMediaElement.cpp
content/html/content/src/nsHTMLSelectElement.cpp
content/html/content/src/nsHTMLTableElement.cpp
content/html/content/src/nsHTMLTextAreaElement.cpp
content/html/content/src/nsTextEditorState.h
content/html/document/src/nsHTMLDocument.cpp
content/svg/content/src/DOMSVGLengthList.h
content/svg/content/src/DOMSVGNumberList.h
content/svg/content/src/DOMSVGPathSegList.h
content/svg/content/src/DOMSVGPointList.h
content/svg/content/src/DOMSVGTransformList.h
content/xbl/src/nsBindingManager.cpp
content/xbl/src/nsXBLDocumentInfo.cpp
content/xbl/src/nsXBLPrototypeHandler.cpp
content/xml/document/src/nsXMLDocument.cpp
content/xslt/src/xslt/txMozillaXMLOutput.cpp
content/xul/content/src/nsXULElement.cpp
content/xul/document/src/nsXULDocument.cpp
content/xul/document/src/nsXULPrototypeCache.cpp
content/xul/document/src/nsXULPrototypeDocument.cpp
db/sqlite3/src/Makefile.in
docshell/base/nsDocShell.cpp
dom/base/nsDOMClassInfo.cpp
dom/base/nsDOMClassInfoClasses.h
dom/base/nsGlobalWindow.cpp
dom/base/nsGlobalWindow.h
dom/base/nsIScriptContext.h
dom/base/nsIScriptGlobalObject.h
dom/base/nsJSEnvironment.cpp
dom/base/nsJSEnvironment.h
dom/base/nsPIDOMWindow.h
dom/base/nsWrapperCache.h
dom/interfaces/core/nsIDOMDocument.idl
dom/interfaces/core/nsIDOMXMLDocument.idl
dom/interfaces/html/nsIDOMHTMLDocument.idl
dom/interfaces/svg/nsIDOMSVGDocument.idl
dom/system/nsDeviceMotion.cpp
dom/system/nsDeviceMotion.h
dom/system/nsDeviceSensors.cpp
dom/system/nsDeviceSensors.h
dom/workers/File.cpp
editor/libeditor/base/nsEditor.cpp
editor/libeditor/base/nsEditor.h
editor/libeditor/base/nsEditorEventListener.cpp
editor/libeditor/html/nsHTMLAnonymousUtils.cpp
editor/libeditor/html/nsHTMLDataTransfer.cpp
editor/libeditor/html/nsHTMLEditRules.cpp
editor/libeditor/html/nsHTMLEditor.cpp
editor/libeditor/html/nsHTMLObjectResizer.cpp
editor/libeditor/text/nsPlaintextDataTransfer.cpp
editor/libeditor/text/nsPlaintextEditor.cpp
editor/libeditor/text/nsTextEditRules.cpp
gfx/gl/GLContext.cpp
gfx/layers/basic/BasicLayers.cpp
gfx/layers/d3d10/CanvasLayerD3D10.cpp
gfx/layers/d3d10/CanvasLayerD3D10.h
gfx/layers/d3d9/CanvasLayerD3D9.cpp
gfx/layers/d3d9/CanvasLayerD3D9.h
gfx/layers/opengl/CanvasLayerOGL.cpp
gfx/layers/opengl/CanvasLayerOGL.h
gfx/thebes/gfxDWriteFontList.cpp
gfx/thebes/gfxDWriteFontList.h
gfx/thebes/gfxDWriteFonts.cpp
gfx/thebes/gfxDWriteFonts.h
gfx/thebes/gfxFT2FontList.cpp
gfx/thebes/gfxFT2FontList.h
gfx/thebes/gfxFT2Fonts.cpp
gfx/thebes/gfxFT2Fonts.h
gfx/thebes/gfxFont.cpp
gfx/thebes/gfxFont.h
gfx/thebes/gfxFontUtils.h
gfx/thebes/gfxGDIFont.cpp
gfx/thebes/gfxGDIFont.h
gfx/thebes/gfxGDIFontList.cpp
gfx/thebes/gfxGDIFontList.h
gfx/thebes/gfxMacFont.cpp
gfx/thebes/gfxMacFont.h
gfx/thebes/gfxMacPlatformFontList.h
gfx/thebes/gfxMacPlatformFontList.mm
gfx/thebes/gfxPlatformFontList.cpp
gfx/thebes/gfxPlatformFontList.h
gfx/thebes/gfxUtils.cpp
gfx/thebes/gfxUtils.h
image/decoders/nsPNGDecoder.cpp
image/src/Decoder.cpp
image/src/Decoder.h
image/src/RasterImage.cpp
image/src/RasterImage.h
image/src/imgFrame.cpp
image/src/imgFrame.h
intl/locale/src/windows/nsWin32Locale.cpp
intl/uconv/src/nsConverterInputStream.cpp
intl/uconv/util/nsUCSupport.h
js/src/Makefile.in
js/src/configure.in
js/src/frontend/BytecodeEmitter.h
js/src/js.msg
js/src/jsapi.cpp
js/src/jsapi.h
js/src/jsatom.cpp
js/src/jsatom.h
js/src/jscompartment.cpp
js/src/jsexn.cpp
js/src/jsfriendapi.h
js/src/jsfun.cpp
js/src/jsfun.h
js/src/jsgc.cpp
js/src/jsnum.h
js/src/jsobj.cpp
js/src/jsobj.h
js/src/jsprvtd.h
js/src/jspubtd.h
js/src/jsscope.cpp
js/src/jsscript.cpp
js/src/jsscript.h
js/src/jswrapper.cpp
js/src/jswrapper.h
js/src/jsxdrapi.cpp
js/src/jsxdrapi.h
js/src/vm/ArgumentsObject.cpp
js/src/vm/RegExpObject.cpp
js/src/vm/RegExpObject.h
js/xpconnect/loader/mozJSComponentLoader.cpp
js/xpconnect/src/XPCConvert.cpp
js/xpconnect/src/XPCJSRuntime.cpp
js/xpconnect/src/XPCWrappedJSClass.cpp
js/xpconnect/src/XPCWrappedNative.cpp
js/xpconnect/src/nsXPConnect.cpp
js/xpconnect/src/xpcpublic.h
js/xpconnect/tests/chrome/test_doublewrappedcompartments.xul
js/xpconnect/tests/mochitest/file_doublewrappedcompartments.html
js/xpconnect/wrappers/AccessCheck.cpp
js/xpconnect/wrappers/AccessCheck.h
js/xpconnect/wrappers/FilteringWrapper.cpp
js/xpconnect/wrappers/WrapperFactory.cpp
js/xpconnect/wrappers/WrapperFactory.h
js/xpconnect/wrappers/XrayWrapper.cpp
js/xpconnect/wrappers/XrayWrapper.h
layout/base/nsLayoutUtils.cpp
layout/base/nsPresContext.cpp
layout/build/nsLayoutModule.cpp
layout/generic/nsFrame.cpp
layout/generic/nsFrameList.cpp
layout/generic/nsHTMLReflowState.cpp
layout/generic/nsIFrame.h
layout/generic/nsObjectFrame.cpp
layout/generic/nsObjectFrame.h
layout/generic/nsQueryFrame.h
layout/generic/nsTextRunTransformations.cpp
layout/mathml/nsMathMLForeignFrameWrapper.cpp
layout/mathml/nsMathMLForeignFrameWrapper.h
layout/svg/base/src/SVGFELeafFrame.cpp
layout/svg/base/src/nsSVGClipPathFrame.cpp
layout/svg/base/src/nsSVGContainerFrame.cpp
layout/svg/base/src/nsSVGEffects.cpp
layout/svg/base/src/nsSVGFilterFrame.cpp
layout/svg/base/src/nsSVGForeignObjectFrame.cpp
layout/svg/base/src/nsSVGGeometryFrame.cpp
layout/svg/base/src/nsSVGGlyphFrame.cpp
layout/svg/base/src/nsSVGImageFrame.cpp
layout/svg/base/src/nsSVGInnerSVGFrame.cpp
layout/svg/base/src/nsSVGIntegrationUtils.cpp
layout/svg/base/src/nsSVGLeafFrame.cpp
layout/svg/base/src/nsSVGMarkerFrame.cpp
layout/svg/base/src/nsSVGMaskFrame.cpp
layout/svg/base/src/nsSVGOuterSVGFrame.cpp
layout/svg/base/src/nsSVGPaintServerFrame.cpp
layout/svg/base/src/nsSVGPathGeometryFrame.cpp
layout/svg/base/src/nsSVGPatternFrame.cpp
layout/svg/base/src/nsSVGStopFrame.cpp
layout/svg/base/src/nsSVGSwitchFrame.cpp
layout/svg/base/src/nsSVGTSpanFrame.cpp
layout/svg/base/src/nsSVGTextContainerFrame.cpp
layout/svg/base/src/nsSVGTextFrame.cpp
layout/svg/base/src/nsSVGUseFrame.cpp
layout/svg/base/src/nsSVGUtils.cpp
mobile/android/base/GeckoApp.java
mobile/android/base/Makefile.in
mobile/android/base/resources/menu-v11/gecko_menu.xml
mobile/android/base/resources/menu/gecko_menu.xml
modules/libpref/src/init/all.js
netwerk/base/src/nsIOService.cpp
parser/html/nsHtml5StreamParser.cpp
parser/html/nsHtml5StreamParser.h
parser/html/nsHtml5TreeBuilderCppSupplement.h
parser/html/nsHtml5TreeBuilderHSupplement.h
parser/html/nsHtml5TreeOpExecutor.cpp
parser/html/nsHtml5TreeOpExecutor.h
parser/html/nsHtml5TreeOperation.cpp
parser/html/nsHtml5TreeOperation.h
parser/htmlparser/public/nsIHTMLContentSink.h
parser/htmlparser/public/nsIHTMLFragmentContentSink.h
parser/htmlparser/public/nsIParser.h
parser/htmlparser/src/nsDTDUtils.h
security/manager/ssl/src/nsCRLManager.cpp
security/manager/ssl/src/nsNSSComponent.cpp
toolkit/components/places/nsPlacesImportExportService.cpp
toolkit/components/places/nsPlacesImportExportService.h
toolkit/mozapps/installer/packager.mk
toolkit/system/gnome/nsAlertsIconListener.cpp
widget/xpwidgets/nsBaseWidget.cpp
xpcom/glue/nsBaseHashtable.h
xpcom/glue/nsTArray.h
xpcom/glue/nsTHashtable.h
xpcom/system/nsIDeviceMotion.idl
xpcom/threads/nsThread.cpp
xpcom/threads/nsThread.h
xulrunner/installer/mac/Description.plist.in
xulrunner/installer/mac/Info.plist.in
xulrunner/installer/mac/Makefile.in
xulrunner/makefiles.sh
--- a/Makefile.in
+++ b/Makefile.in
@@ -67,16 +67,21 @@ tier_base_dirs = \
 
 ifndef LIBXUL_SDK
 ifeq (android,$(MOZ_WIDGET_TOOLKIT))
 tier_base_dirs += \
   other-licenses/android \
   other-licenses/skia-npapi \
   $(NULL)
 endif
+ifeq (gonk,$(MOZ_WIDGET_TOOLKIT))
+tier_base_dirs += \
+  other-licenses/android \
+  $(NULL)
+endif
 
 ifdef MOZ_MEMORY
 tier_base_dirs += memory/jemalloc
 endif
 tier_base_dirs += \
   mozglue \
   memory/mozalloc \
   $(NULL)
--- a/accessible/public/nsIAccessibleRole.idl
+++ b/accessible/public/nsIAccessibleRole.idl
@@ -788,14 +788,19 @@ interface nsIAccessibleRole : nsISupport
   const unsigned long ROLE_NOTE = 123;
 
   /**
    * A figure. Used for things like HTML5 figure element.
    */
   const unsigned long ROLE_FIGURE = 124;
 
   /**
+   * Represents a rich item with a check box.
+   */
+  const unsigned long ROLE_CHECK_RICH_OPTION = 125;
+
+  /**
    * It's not role actually. This constant is important to help ensure
    * nsRoleMap's are synchronized.
    */
-  const unsigned long ROLE_LAST_ENTRY = 125;
+  const unsigned long ROLE_LAST_ENTRY = 126;
 };
 
--- a/accessible/src/atk/nsMaiInterfaceEditableText.cpp
+++ b/accessible/src/atk/nsMaiInterfaceEditableText.cpp
@@ -95,17 +95,17 @@ insertTextCB(AtkEditableText *aText,
         return;
 
     nsCOMPtr<nsIAccessibleEditableText> accText;
     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
                             getter_AddRefs(accText));
     if (!accText)
         return;
 
-    NS_ConvertUTF8toUTF16 strContent(aString);
+    NS_ConvertUTF8toUTF16 strContent(aString, aLength);
 
     // interface changed in nsIAccessibleEditableText.idl ???
     //
     // PRInt32 pos = *aPosition;
     // nsresult rv = accText->InsertText(strContent, aLength, &pos);
     // *aPosition = pos;
 
     accText->InsertText(strContent, *aPosition);
--- a/accessible/src/atk/nsRoleMap.h
+++ b/accessible/src/atk/nsRoleMap.h
@@ -165,11 +165,12 @@ static const PRUint32 atkRoleMap[] = {
     ATK_ROLE_LIST_ITEM,           // roles::OPTION               117
     ATK_ROLE_LIST_ITEM,           // roles::RICH_OPTION          118
     ATK_ROLE_LIST,                // roles::LISTBOX              119
     ATK_ROLE_UNKNOWN,             // roles::FLAT_EQUATION        120
     ATK_ROLE_TABLE_CELL,          // roles::GRID_CELL            121
     ATK_ROLE_PANEL,               // roles::EMBEDDED_OBJECT      122
     ATK_ROLE_SECTION,             // roles::NOTE                 123
     ATK_ROLE_PANEL,               // roles::FIGURE               124
+    ATK_ROLE_CHECK_BOX,           // roles::CHECK_RICH_OPTION    125
     kROLE_ATK_LAST_ENTRY          // roles::LAST_ENTRY
 };
 
--- a/accessible/src/base/AccGroupInfo.h
+++ b/accessible/src/base/AccGroupInfo.h
@@ -62,16 +62,18 @@ public:
     mozilla::a11y::role role = aAccessible->Role();
     if (role != mozilla::a11y::roles::ROW &&
         role != mozilla::a11y::roles::GRID_CELL &&
         role != mozilla::a11y::roles::OUTLINEITEM &&
         role != mozilla::a11y::roles::OPTION &&
         role != mozilla::a11y::roles::LISTITEM &&
         role != mozilla::a11y::roles::MENUITEM &&
         role != mozilla::a11y::roles::COMBOBOX_OPTION &&
+        role != mozilla::a11y::roles::RICH_OPTION &&
+        role != mozilla::a11y::roles::CHECK_RICH_OPTION &&
         role != mozilla::a11y::roles::PARENT_MENUITEM &&
         role != mozilla::a11y::roles::CHECK_MENU_ITEM &&
         role != mozilla::a11y::roles::RADIO_MENU_ITEM &&
         role != mozilla::a11y::roles::RADIOBUTTON &&
         role != mozilla::a11y::roles::PAGETAB)
       return nsnull;
 
     AccGroupInfo* info = new AccGroupInfo(aAccessible, BaseRole(role));
@@ -83,16 +85,20 @@ private:
   AccGroupInfo& operator =(const AccGroupInfo&);
 
   static mozilla::a11y::role BaseRole(mozilla::a11y::role aRole)
   {
     if (aRole == mozilla::a11y::roles::CHECK_MENU_ITEM ||
         aRole == mozilla::a11y::roles::PARENT_MENUITEM ||
         aRole == mozilla::a11y::roles::RADIO_MENU_ITEM)
       return mozilla::a11y::roles::MENUITEM;
+
+    if (aRole == mozilla::a11y::roles::CHECK_RICH_OPTION)
+      return mozilla::a11y::roles::RICH_OPTION;
+
     return aRole;
   }
 
   /**
    * Return true if the given parent role is conceptual parent of the given
    * role.
    */
   static bool IsConceptualParent(mozilla::a11y::role aRole,
--- a/accessible/src/base/Role.h
+++ b/accessible/src/base/Role.h
@@ -785,19 +785,24 @@ namespace roles {
   NOTE = 123,
 
   /**
    * A figure. Used for things like HTML5 figure element.
    */
   FIGURE = 124,
 
   /**
+   * Represents a rich item with a check box.
+   */
+  CHECK_RICH_OPTION = 125,
+
+  /**
    * It's not role actually. This constant is important to help ensure
    * nsRoleMap's are synchronized.
    */
-  LAST_ENTRY = 125
+  LAST_ENTRY = 126
   };
 } // namespace role
 typedef enum mozilla::a11y::roles::Role role;
 } // namespace a11y
 } // namespace mozilla
 
 #endif
--- a/accessible/src/base/nsAccUtils.cpp
+++ b/accessible/src/base/nsAccUtils.cpp
@@ -129,57 +129,16 @@ nsAccUtils::GetARIAOrDefaultLevel(nsAcce
                            nsGkAtoms::aria_level, &level);
 
   if (level != 0)
     return level;
 
   return GetDefaultLevel(aAccessible);
 }
 
-void
-nsAccUtils::GetPositionAndSizeForXULSelectControlItem(nsIContent *aContent,
-                                                      PRInt32 *aPosInSet,
-                                                      PRInt32 *aSetSize)
-{
-  nsCOMPtr<nsIDOMXULSelectControlItemElement> item(do_QueryInterface(aContent));
-  if (!item)
-    return;
-
-  nsCOMPtr<nsIDOMXULSelectControlElement> control;
-  item->GetControl(getter_AddRefs(control));
-  if (!control)
-    return;
-
-  PRUint32 itemsCount = 0;
-  control->GetItemCount(&itemsCount);
-
-  PRInt32 indexOf = 0;
-  control->GetIndexOfItem(item, &indexOf);
-
-  *aSetSize = itemsCount;
-  *aPosInSet = indexOf;
-
-  for (PRUint32 index = 0; index < itemsCount; index++) {
-    nsCOMPtr<nsIDOMXULSelectControlItemElement> currItem;
-    control->GetItemAtIndex(index, getter_AddRefs(currItem));
-    nsCOMPtr<nsINode> currNode(do_QueryInterface(currItem));
-
-    nsAccessible* itemAcc = currNode ?
-      GetAccService()->GetAccessible(currNode, nsnull) : nsnull;
-
-    if (!itemAcc || itemAcc->State() & states::INVISIBLE) {
-      (*aSetSize)--;
-      if (index < static_cast<PRUint32>(indexOf))
-        (*aPosInSet)--;
-    }
-  }
-
-  (*aPosInSet)++; // group position is 1-index based.
-}
-
 PRInt32
 nsAccUtils::GetLevelForXULContainerItem(nsIContent *aContent)
 {
   nsCOMPtr<nsIDOMXULContainerItemElement> item(do_QueryInterface(aContent));
   if (!item)
     return 0;
 
   nsCOMPtr<nsIDOMXULContainerElement> container;
--- a/accessible/src/base/nsAccUtils.h
+++ b/accessible/src/base/nsAccUtils.h
@@ -103,24 +103,16 @@ public:
 
   /**
    * Return ARIA level value or the default one if ARIA is missed for the
    * given accessible.
    */
   static PRInt32 GetARIAOrDefaultLevel(nsAccessible *aAccessible);
 
   /**
-   * Compute position in group (posinset) and group size (setsize) for
-   * nsIDOMXULSelectControlItemElement node.
-   */
-  static void GetPositionAndSizeForXULSelectControlItem(nsIContent *aContent,
-                                                        PRInt32 *aPosInSet,
-                                                        PRInt32 *aSetSize);
-
-  /**
    * Compute group level for nsIDOMXULContainerItemElement node.
    */
   static PRInt32 GetLevelForXULContainerItem(nsIContent *aContent);
 
   /**
    * Set container-foo live region attributes for the given node.
    *
    * @param aAttributes    where to store the attributes
--- a/accessible/src/base/nsAccessibilityService.h
+++ b/accessible/src/base/nsAccessibilityService.h
@@ -410,17 +410,18 @@ static const char kRoleNames[][20] = {
   "image map",           //ROLE_IMAGE_MAP
   "listbox option",      //ROLE_OPTION
   "listbox rich option", //ROLE_RICH_OPTION
   "listbox",             //ROLE_LISTBOX
   "flat equation",       //ROLE_FLAT_EQUATION
   "gridcell",            //ROLE_GRID_CELL
   "embedded object",     //ROLE_EMBEDDED_OBJECT
   "note",                //ROLE_NOTE
-  "figure"               //ROLE_FIGURE
+  "figure",              //ROLE_FIGURE
+  "check rich option"    //ROLE_CHECK_RICH_OPTION
 };
 
 /**
  * Map nsIAccessibleEvents constants to strings. Used by
  * nsIAccessibleRetrieval::getStringEventType() method.
  */
 static const char kEventTypeNames[][40] = {
   "unknown",                                 //
--- a/accessible/src/base/nsAccessible.cpp
+++ b/accessible/src/base/nsAccessible.cpp
@@ -1347,48 +1347,45 @@ nsAccessible::GetAttributes(nsIPersisten
   }
 
   return NS_OK;
 }
 
 nsresult
 nsAccessible::GetAttributesInternal(nsIPersistentProperties *aAttributes)
 {
+  // If the accessible isn't primary for its node (such as list item bullet or
+  // xul tree item then don't calculate content based attributes.
+  if (!IsPrimaryForNode())
+    return NS_OK;
+
   // Attributes set by this method will not be used to override attributes on a sub-document accessible
   // when there is a <frame>/<iframe> element that spawned the sub-document
-  nsCOMPtr<nsIDOMElement> element(do_QueryInterface(mContent));
-
-  nsAutoString tagName;
-  element->GetTagName(tagName);
-  if (!tagName.IsEmpty()) {
-    nsAutoString oldValueUnused;
-    aAttributes->SetStringProperty(NS_LITERAL_CSTRING("tag"), tagName,
-                                   oldValueUnused);
-  }
 
   nsEventShell::GetEventAttributes(GetNode(), aAttributes);
  
   // Expose class because it may have useful microformat information
   // Let the class from an iframe's document be exposed, don't override from <iframe class>
   nsAutoString _class;
   if (mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::_class, _class))
     nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::_class, _class);
 
   // Get container-foo computed live region properties based on the closest container with
   // the live region attribute. 
   // Inner nodes override outer nodes within the same document --
   //   The inner nodes can be used to override live region behavior on more general outer nodes
   // However, nodes in outer documents override nodes in inner documents:
   //   Outer doc author may want to override properties on a widget they used in an iframe
-  nsIContent *startContent = mContent;
-  while (true) {
-    NS_ENSURE_STATE(startContent);
-    nsIDocument *doc = startContent->GetDocument();
+  nsIContent* startContent = mContent;
+  while (startContent) {
+    nsIDocument* doc = startContent->GetDocument();
     nsIContent* rootContent = nsCoreUtils::GetRoleContent(doc);
-    NS_ENSURE_STATE(rootContent);
+    if (!rootContent)
+      return NS_OK;
+
     nsAccUtils::SetLiveContainerAttributes(aAttributes, startContent,
                                            rootContent);
 
     // Allow ARIA live region markup from outer documents to override
     nsCOMPtr<nsISupports> container = doc->GetContainer(); 
     nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
       do_QueryInterface(container);
     if (!docShellTreeItem)
@@ -1404,31 +1401,35 @@ nsAccessible::GetAttributesInternal(nsIP
       break;
 
     startContent = parentDoc->FindContentForSubDocument(doc);      
   }
 
   if (!mContent->IsElement())
     return NS_OK;
 
+  // Expose tag.
+  nsAutoString tagName;
+  mContent->NodeInfo()->GetName(tagName);
+  nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::tag, tagName);
+
   // Expose draggable object attribute?
   nsCOMPtr<nsIDOMHTMLElement> htmlElement = do_QueryInterface(mContent);
   if (htmlElement) {
     bool draggable = false;
     htmlElement->GetDraggable(&draggable);
     if (draggable) {
       nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::draggable,
                              NS_LITERAL_STRING("true"));
     }
   }
 
   // Don't calculate CSS-based object attributes when no frame (i.e.
-  // the accessible is not unattached form three) or when the accessible is not
-  // primary for node (like list bullet or XUL tree items).
-  if (!mContent->GetPrimaryFrame() || !IsPrimaryForNode())
+  // the accessible is unattached from the tree).
+  if (!mContent->GetPrimaryFrame())
     return NS_OK;
 
   // CSS style based object attributes.
   nsAutoString value;
   StyleInfo styleInfo(mContent->AsElement(), mDoc->PresShell());
 
   // Expose 'display' attribute.
   styleInfo.Display(value);
--- a/accessible/src/base/nsAccessible.h
+++ b/accessible/src/base/nsAccessible.h
@@ -645,17 +645,17 @@ protected:
    * Cache accessible children.
    */
   virtual void CacheChildren();
 
   /**
    * Set accessible parent and index in parent.
    */
   virtual void BindToParent(nsAccessible* aParent, PRUint32 aIndexInParent);
-  void UnbindFromParent();
+  virtual void UnbindFromParent();
 
   /**
    * Return sibling accessible at the given offset.
    */
   virtual nsAccessible* GetSiblingAtOffset(PRInt32 aOffset,
                                            nsresult *aError = nsnull) const;
 
   /**
--- a/accessible/src/base/nsBaseWidgetAccessible.cpp
+++ b/accessible/src/base/nsBaseWidgetAccessible.cpp
@@ -243,16 +243,26 @@ nsLinkableAccessible::BindToParent(nsAcc
     if (nsCoreUtils::HasClickListener(walkUpAcc->GetContent())) {
       mActionAcc = walkUpAcc;
       mIsOnclick = true;
       return;
     }
   }
 }
 
+void
+nsLinkableAccessible::UnbindFromParent()
+{
+  mActionAcc = nsnull;
+  mIsLink = false;
+  mIsOnclick = false;
+
+  nsAccessibleWrap::UnbindFromParent();
+}
+
 ////////////////////////////////////////////////////////////////////////////////
 // nsEnumRoleAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsEnumRoleAccessible::
   nsEnumRoleAccessible(nsIContent* aNode, nsDocAccessible* aDoc,
                        roles::Role aRole) :
   nsAccessibleWrap(aNode, aDoc), mRole(aRole)
--- a/accessible/src/base/nsBaseWidgetAccessible.h
+++ b/accessible/src/base/nsBaseWidgetAccessible.h
@@ -103,16 +103,17 @@ public:
   virtual KeyBinding AccessKey() const;
 
   // HyperLinkAccessible
   virtual already_AddRefed<nsIURI> AnchorURIAt(PRUint32 aAnchorIndex);
 
 protected:
   // nsAccessible
   virtual void BindToParent(nsAccessible* aParent, PRUint32 aIndexInParent);
+  virtual void UnbindFromParent();
 
   /**
    * Parent accessible that provides an action for this linkable accessible.
    */
   nsAccessible* mActionAcc;
   bool mIsLink;
   bool mIsOnclick;
 };
--- a/accessible/src/html/nsHTMLImageMapAccessible.cpp
+++ b/accessible/src/html/nsHTMLImageMapAccessible.cpp
@@ -211,63 +211,16 @@ nsHTMLAreaAccessible::Description(nsStri
   aDescription.Truncate();
 
   // Still to do - follow IE's standard here
   nsCOMPtr<nsIDOMHTMLAreaElement> area(do_QueryInterface(mContent));
   if (area) 
     area->GetShape(aDescription);
 }
 
-NS_IMETHODIMP
-nsHTMLAreaAccessible::GetBounds(PRInt32 *aX, PRInt32 *aY,
-                                PRInt32 *aWidth, PRInt32 *aHeight)
-{
-  NS_ENSURE_ARG_POINTER(aX);
-  *aX = 0;
-  NS_ENSURE_ARG_POINTER(aY);
-  *aY = 0;
-  NS_ENSURE_ARG_POINTER(aWidth);
-  *aWidth = 0;
-  NS_ENSURE_ARG_POINTER(aHeight);
-  *aHeight = 0;
-
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
-  // Essentially this uses GetRect on mAreas of nsImageMap from nsImageFrame.
-  nsPresContext *presContext = GetPresContext();
-  NS_ENSURE_TRUE(presContext, NS_ERROR_FAILURE);
-
-  nsIFrame *frame = GetFrame();
-  NS_ENSURE_TRUE(frame, NS_ERROR_FAILURE);
-  nsImageFrame *imageFrame = do_QueryFrame(frame);
-
-  nsImageMap* map = imageFrame->GetImageMap();
-  NS_ENSURE_TRUE(map, NS_ERROR_FAILURE);
-
-  nsRect rect;
-  nsresult rv = map->GetBoundsForAreaContent(mContent, rect);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  *aX = presContext->AppUnitsToDevPixels(rect.x);
-  *aY = presContext->AppUnitsToDevPixels(rect.y);
-
-  // XXX Areas are screwy; they return their rects as a pair of points, one pair
-  // stored into the width and height.
-  *aWidth  = presContext->AppUnitsToDevPixels(rect.width - rect.x);
-  *aHeight = presContext->AppUnitsToDevPixels(rect.height - rect.y);
-
-  // Put coords in absolute screen coords
-  nsIntRect orgRectPixels = frame->GetScreenRectExternal();
-  *aX += orgRectPixels.x;
-  *aY += orgRectPixels.y;
-
-  return NS_OK;
-}
-
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLAreaAccessible: nsAccessNode public
 
 bool
 nsHTMLAreaAccessible::IsPrimaryForNode() const
 {
   // Make HTML area DOM element not accessible. HTML image map accessible
   // manages its tree itself.
@@ -321,8 +274,30 @@ nsHTMLAreaAccessible::EndOffset()
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLAreaAccessible: nsAccessible protected
 
 void
 nsHTMLAreaAccessible::CacheChildren()
 {
   // No children for aria accessible.
 }
+
+void
+nsHTMLAreaAccessible::GetBoundsRect(nsRect& aBounds, nsIFrame** aBoundingFrame)
+{
+  nsIFrame* frame = GetFrame();
+  if (!frame)
+    return;
+
+  nsImageFrame* imageFrame = do_QueryFrame(frame);
+  nsImageMap* map = imageFrame->GetImageMap();
+
+  nsresult rv = map->GetBoundsForAreaContent(mContent, aBounds);
+  if (NS_FAILED(rv))
+    return;
+
+  // XXX Areas are screwy; they return their rects as a pair of points, one pair
+  // stored into the width and height.
+  aBounds.width -= aBounds.x;
+  aBounds.height -= aBounds.y;
+
+  *aBoundingFrame = frame;
+}
--- a/accessible/src/html/nsHTMLImageMapAccessible.h
+++ b/accessible/src/html/nsHTMLImageMapAccessible.h
@@ -91,20 +91,16 @@ nsAccessible::AsImageMap()
  * Accessible for image map areas - must be child of image.
  */
 class nsHTMLAreaAccessible : public nsHTMLLinkAccessible
 {
 public:
 
   nsHTMLAreaAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
-  // nsIAccessible
-
-  NS_IMETHOD GetBounds(PRInt32 *x, PRInt32 *y, PRInt32 *width, PRInt32 *height);
-
   // nsAccessNode
   virtual bool IsPrimaryForNode() const;
 
   // nsAccessible
   virtual void Description(nsString& aDescription);
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual PRUint64 NativeState();
   virtual nsAccessible* ChildAtPoint(PRInt32 aX, PRInt32 aY,
@@ -113,11 +109,12 @@ public:
   // HyperLinkAccessible
   virtual PRUint32 StartOffset();
   virtual PRUint32 EndOffset();
 
 protected:
 
   // nsAccessible
   virtual void CacheChildren();
+  virtual void GetBoundsRect(nsRect& aBounds, nsIFrame** aBoundingFrame);
 };
 
 #endif  
--- a/accessible/src/html/nsHyperTextAccessible.cpp
+++ b/accessible/src/html/nsHyperTextAccessible.cpp
@@ -1219,17 +1219,17 @@ nsHyperTextAccessible::GetAttributesInte
   nsIFrame *frame = GetFrame();
   if (frame && frame->GetType() == nsGkAtoms::blockFrame) {
     nsAutoString oldValueUnused;
     aAttributes->SetStringProperty(NS_LITERAL_CSTRING("formatting"), NS_LITERAL_STRING("block"),
                                    oldValueUnused);
   }
 
   if (FocusMgr()->IsFocused(this)) {
-    PRInt32 lineNumber = GetCaretLineNumber();
+    PRInt32 lineNumber = CaretLineNumber();
     if (lineNumber >= 1) {
       nsAutoString strLineNumber;
       strLineNumber.AppendInt(lineNumber);
       nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::lineNumber,
                              strLineNumber);
     }
   }
 
@@ -1675,17 +1675,17 @@ nsHyperTextAccessible::GetCaretOffset(PR
       return NS_OK;
   }
 
   DOMPointToHypertextOffset(focusNode, focusOffset, aCaretOffset);
   return NS_OK;
 }
 
 PRInt32
-nsHyperTextAccessible::GetCaretLineNumber()
+nsHyperTextAccessible::CaretLineNumber()
 {
   // Provide the line number for the caret, relative to the
   // currently focused node. Use a 1-based index
   nsRefPtr<nsFrameSelection> frameSelection = FrameSelection();
   if (!frameSelection)
     return -1;
 
   nsISelection* domSel =
--- a/accessible/src/html/nsHyperTextAccessible.h
+++ b/accessible/src/html/nsHyperTextAccessible.h
@@ -259,16 +259,32 @@ public:
    *
    * @param  aOffset  [in] the given text offset
    */
   nsAccessible* GetChildAtOffset(PRUint32 aOffset)
   {
     return GetChildAt(GetChildIndexAtOffset(aOffset));
   }
 
+  /**
+   * Return the bounds of the text between given start and end offset.
+   */
+  nsIntRect GetTextBounds(PRInt32 aStartOffset, PRInt32 aEndOffset)
+  {
+    nsIntRect bounds;
+    GetPosAndText(aStartOffset, aEndOffset, nsnull, nsnull, &bounds);
+    return bounds;
+  }
+
+  /**
+   * Provide the line number for the caret.
+   * @return 1-based index for the line number with the caret
+   */
+  PRInt32 CaretLineNumber();
+
   //////////////////////////////////////////////////////////////////////////////
   // EditableTextAccessible
 
   /**
    * Return the editor associated with the accessible.
    */
   virtual already_AddRefed<nsIEditor> GetEditor() const;
 
@@ -368,23 +384,16 @@ protected:
 
   /**
    * Return selection ranges within the accessible subtree.
    */
   void GetSelectionDOMRanges(PRInt16 aType, nsTArray<nsRange*>* aRanges);
 
   nsresult SetSelectionRange(PRInt32 aStartPos, PRInt32 aEndPos);
 
-  /**
-   * Provide the line number for the caret, relative to the
-   * current DOM node.
-   * @return 1-based index for the line number with the caret
-   */
-  PRInt32 GetCaretLineNumber();
-
   // Helpers
   nsresult GetDOMPointByFrameOffset(nsIFrame *aFrame, PRInt32 aOffset,
                                     nsIAccessible *aAccessible,
                                     nsIDOMNode **aNode, PRInt32 *aNodeOffset);
 
   
   /**
    * Return hyper text offset for the specified bound of the given DOM range.
--- a/accessible/src/mac/mozAccessible.h
+++ b/accessible/src/mac/mozAccessible.h
@@ -39,16 +39,28 @@
 #include "nsAccessibleWrap.h"
 
 #import <Cocoa/Cocoa.h>
 
 #import "mozAccessibleProtocol.h"
 
 @class mozRootAccessible;
 
+/**
+ * All mozAccessibles are either abstract objects (that correspond to XUL
+ * widgets, HTML frames, etc) or are attached to a certain view; for example
+ * a document view. When we hand an object off to an AT, we always want
+ * to give it the represented view, in the latter case.
+ */
+inline id <mozAccessible>
+GetObjectOrRepresentedView(id <mozAccessible> aObject)
+{
+  return [aObject hasRepresentedView] ? [aObject representedView] : aObject;
+}
+
 @interface mozAccessible : NSObject <mozAccessible>
 {
   /**
    * Weak reference; it owns us.
    */
   nsAccessibleWrap* mGeckoAccessible;
   
   /**
--- a/accessible/src/mac/mozAccessible.mm
+++ b/accessible/src/mac/mozAccessible.mm
@@ -66,31 +66,16 @@ using namespace mozilla::a11y;
 // of the screen), into a top-left screen point, that gecko can use.
 static inline void
 ConvertCocoaToGeckoPoint(NSPoint &aInPoint, nsPoint &aOutPoint)
 {
   float mainScreenHeight = [(NSView*)[[NSScreen screens] objectAtIndex:0] frame].size.height;
   aOutPoint.MoveTo ((nscoord)aInPoint.x, (nscoord)(mainScreenHeight - aInPoint.y));
 }
 
-// all mozAccessibles are either abstract objects (that correspond to XUL widgets, HTML frames, etc) or are
-// attached to a certain view; for example a document view. when we hand an object off to an AT, we always want
-// to give it the represented view, in the latter case.
-static inline id <mozAccessible>
-GetObjectOrRepresentedView(id <mozAccessible> anObject)
-{
-  NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
-
-  if ([anObject hasRepresentedView])
-    return [anObject representedView];
-  return anObject;
-
-  NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
-}
-
 // returns the passed in object if it is not ignored. if it's ignored, will return
 // the first unignored ancestor.
 static inline id
 GetClosestInterestingAccessible(id anObject)
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
 
   // this object is not ignored, so let's return it.
--- a/accessible/src/mac/mozTextAccessible.h
+++ b/accessible/src/mac/mozTextAccessible.h
@@ -5,18 +5,8 @@
 @interface mozTextAccessible : mozAccessible
 {
   // both of these are the same old mGeckoAccessible, but already
   // QI'd for us, to the right type, for convenience.
   nsHyperTextAccessible     *mGeckoTextAccessible;         // strong
   nsIAccessibleEditableText *mGeckoEditableTextAccessible; // strong
 }
 @end
-
-/* A combobox (in the mac world) is a textfield with an associated menu, for example
-   the location bar. */
-@interface mozComboboxAccessible : mozTextAccessible
-// equivalent to pressing return key in this textfield.
-- (void)confirm;
-
-// shows the menu for this combobox.
-- (void)showMenu;
-@end
--- a/accessible/src/mac/mozTextAccessible.mm
+++ b/accessible/src/mac/mozTextAccessible.mm
@@ -1,8 +1,10 @@
+/* -*- Mode: Objective-C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+
 #include "nsAccessibleWrap.h"
 
 #include "nsCocoaUtils.h"
 #include "nsObjCExceptions.h"
 
 #import "mozTextAccessible.h"
 
 using namespace mozilla::a11y;
@@ -238,112 +240,15 @@ using namespace mozilla::a11y;
 }
 
 #pragma mark -
 
 - (void)valueDidChange
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
 
-  NSAccessibilityPostNotification([self hasRepresentedView] ? [self representedView] : self, 
+  NSAccessibilityPostNotification(GetObjectOrRepresentedView(self),
                                   NSAccessibilityValueChangedNotification);
 
   NS_OBJC_END_TRY_ABORT_BLOCK;
 }
 
 @end
-
-@implementation mozComboboxAccessible
-
-- (NSArray*)accessibilityAttributeNames
-{
-  NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
-
-  static NSArray *supportedAttributes = nil;
-  if (!supportedAttributes) {
-    // standard attributes that are shared and supported by all generic elements.
-    supportedAttributes = [[NSArray alloc] initWithObjects:NSAccessibilityParentAttribute, // required
-                                                           NSAccessibilityRoleAttribute,   // required
-                                                           NSAccessibilityTitleAttribute,
-                                                           NSAccessibilityValueAttribute, // required
-                                                           NSAccessibilityHelpAttribute,
-                                                           NSAccessibilityRoleDescriptionAttribute,
-                                                           NSAccessibilityPositionAttribute, // required
-                                                           NSAccessibilitySizeAttribute, // required
-                                                           NSAccessibilityWindowAttribute, // required
-                                                           NSAccessibilityFocusedAttribute, // required
-                                                           NSAccessibilityEnabledAttribute, // required
-                                                           NSAccessibilityChildrenAttribute, // required
-                                                           NSAccessibilityHelpAttribute,
-                                                           // NSAccessibilityExpandedAttribute, // required
-                                                           NSAccessibilityTopLevelUIElementAttribute, // required
-                                                           NSAccessibilityDescriptionAttribute, // required
-                                                           /* text-specific attributes */
-                                                           NSAccessibilitySelectedTextAttribute, // required
-                                                           NSAccessibilitySelectedTextRangeAttribute, // required
-                                                           NSAccessibilityNumberOfCharactersAttribute, // required
-                                                           // TODO: NSAccessibilityVisibleCharacterRangeAttribute, // required
-                                                           // TODO: NSAccessibilityInsertionPointLineNumberAttribute
-#if DEBUG
-                                                           @"AXMozDescription",
-#endif
-                                                           nil];
-  }
-  return supportedAttributes;
-
-  NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
-}
-
-- (NSArray *)accessibilityActionNames
-{
-  NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
-
-  if ([self isEnabled]) {
-    return [NSArray arrayWithObjects:NSAccessibilityConfirmAction,
-                                     NSAccessibilityShowMenuAction,
-                                     nil];
-  }
-  return nil;
-
-  NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
-}
-
-- (NSString *)accessibilityActionDescription:(NSString *)action
-{
-  NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
-
-  if ([action isEqualToString:NSAccessibilityShowMenuAction])
-    return @"show menu";
-  if ([action isEqualToString:NSAccessibilityConfirmAction])
-    return @"confirm";
-    
-  return [super accessibilityActionDescription:action];
-
-  NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
-}
-
-- (void)accessibilityPerformAction:(NSString *)action
-{
-  NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
-
-  // both the ShowMenu and Click action do the same thing.
-  if ([self isEnabled]) {
-    if ([action isEqualToString:NSAccessibilityShowMenuAction])
-      [self showMenu];
-    if ([action isEqualToString:NSAccessibilityConfirmAction])
-      [self confirm];
-  }
-
-  NS_OBJC_END_TRY_ABORT_BLOCK;
-}
-
-- (void)showMenu
-{
-  // currently unimplemented. waiting for support in bug 363697
-}
-
-- (void)confirm
-{
-  // should be the same as pressing enter/return in this textfield.
-  // not yet implemented
-}
-
-@end
--- a/accessible/src/mac/nsAccessibleWrap.mm
+++ b/accessible/src/mac/nsAccessibleWrap.mm
@@ -105,19 +105,16 @@ nsAccessibleWrap::GetNativeType ()
     }
     
     case roles::PAGETAB:
       return [mozButtonAccessible class];
 
     case roles::CHECKBUTTON:
       return [mozCheckboxAccessible class];
       
-    case roles::AUTOCOMPLETE:
-      return [mozComboboxAccessible class];
-
     case roles::HEADING:
       return [mozHeadingAccessible class];
 
     case roles::PAGETABLIST:
       return [mozTabsAccessible class];
       
     case roles::ENTRY:
     case roles::STATICTEXT:
--- a/accessible/src/mac/nsRoleMap.h
+++ b/accessible/src/mac/nsRoleMap.h
@@ -137,17 +137,17 @@ static const NSString* AXRoles [] = {
   NSAccessibilityGroupRole,                     // ROLE_TEXT_CONTAINER
   NSAccessibilityButtonRole,                    // ROLE_TOGGLE_BUTTON
   NSAccessibilityTableRole,                     // ROLE_TREE_TABLE
   NSAccessibilityUnknownRole,                   // ROLE_VIEWPORT
   NSAccessibilityGroupRole,                     // ROLE_HEADER
   NSAccessibilityGroupRole,                     // ROLE_FOOTER
   NSAccessibilityGroupRole,                     // ROLE_PARAGRAPH
   @"AXRuler",                                   // ROLE_RULER. 10.4+ only, so we re-define the constant.
-  NSAccessibilityComboBoxRole,                  // ROLE_AUTOCOMPLETE
+  NSAccessibilityUnknownRole,                   // ROLE_AUTOCOMPLETE
   NSAccessibilityTextFieldRole,                 // ROLE_EDITBAR
   NSAccessibilityTextFieldRole,                 // ROLE_ENTRY
   NSAccessibilityStaticTextRole,                // ROLE_CAPTION
   NSAccessibilityScrollAreaRole,                // ROLE_DOCUMENT_FRAME
   @"AXHeading",                                 // ROLE_HEADING
   NSAccessibilityGroupRole,                     // ROLE_PAG
   NSAccessibilityGroupRole,                     // ROLE_SECTION
   NSAccessibilityUnknownRole,                   // ROLE_REDUNDANT_OBJECT
@@ -162,10 +162,11 @@ static const NSString* AXRoles [] = {
   NSAccessibilityRowRole,                       // ROLE_OPTION
   NSAccessibilityRowRole,                       // ROLE_RICH_OPTION
   NSAccessibilityListRole,                      // ROLE_LISTBOX
   NSAccessibilityUnknownRole,                   // ROLE_FLAT_EQUATION
   NSAccessibilityGroupRole,                     // ROLE_GRID_CELL
   NSAccessibilityGroupRole,                     // ROLE_EMBEDDED_OBJECT
   NSAccessibilityGroupRole,                     // ROLE_NOTE
   NSAccessibilityGroupRole,                     // ROLE_FIGURE
+  NSAccessibilityCheckBoxRole,                  // ROLE_CHECK_RICH_OPTION
   @"ROLE_LAST_ENTRY"                            // ROLE_LAST_ENTRY. bogus role that will never be shown (just marks the end of this array)!
 };
--- a/accessible/src/msaa/nsRoleMap.h
+++ b/accessible/src/msaa/nsRoleMap.h
@@ -444,12 +444,15 @@ static const WindowsRoleMapItem gWindows
   { USE_ROLE_STRING, IA2_ROLE_EMBEDDED_OBJECT },
 
   // roles::NOTE
   { USE_ROLE_STRING, IA2_ROLE_NOTE },
 
   // roles::FIGURE
   { ROLE_SYSTEM_GROUPING, ROLE_SYSTEM_GROUPING },
 
+  // roles::CHECK_RICH_OPTION
+  { ROLE_SYSTEM_CHECKBUTTON, ROLE_SYSTEM_CHECKBUTTON },
+
   // roles::LAST_ENTRY
   { ROLE_WINDOWS_LAST_ENTRY, ROLE_WINDOWS_LAST_ENTRY }
 };
 
--- a/accessible/src/xul/nsXULFormControlAccessible.cpp
+++ b/accessible/src/xul/nsXULFormControlAccessible.cpp
@@ -522,24 +522,16 @@ nsXULRadioButtonAccessible::NativeState(
     if (selected) {
       state |= states::CHECKED;
     }
   }
 
   return state;
 }
 
-void
-nsXULRadioButtonAccessible::GetPositionAndSizeInternal(PRInt32 *aPosInSet,
-                                                       PRInt32 *aSetSize)
-{
-  nsAccUtils::GetPositionAndSizeForXULSelectControlItem(mContent, aPosInSet,
-                                                        aSetSize);
-}
-
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULRadioButtonAccessible: Widgets
 
 nsAccessible*
 nsXULRadioButtonAccessible::ContainerWidget() const
 {
   return mParent;
 }
--- a/accessible/src/xul/nsXULFormControlAccessible.h
+++ b/accessible/src/xul/nsXULFormControlAccessible.h
@@ -157,18 +157,16 @@ public:
  */
 class nsXULRadioButtonAccessible : public nsRadioButtonAccessible
 {
 
 public:
   nsXULRadioButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsAccessible
-  virtual void GetPositionAndSizeInternal(PRInt32 *aPosInSet,
-                                          PRInt32 *aSetSize);
   virtual PRUint64 NativeState();
 
   // Widgets
   virtual nsAccessible* ContainerWidget() const;
 };
 
 /**
  * Used for XUL radiogroup element.
--- a/accessible/src/xul/nsXULListboxAccessible.cpp
+++ b/accessible/src/xul/nsXULListboxAccessible.cpp
@@ -971,17 +971,17 @@ nsXULListitemAccessible::NativeRole()
     NS_ERROR("No list accessible for listitem accessible!");
     return roles::NOTHING;
   }
 
   if (list->Role() == roles::TABLE)
     return roles::ROW;
 
   if (mIsCheckbox)
-    return roles::CHECKBUTTON;
+    return roles::CHECK_RICH_OPTION;
 
   if (mParent && mParent->Role() == roles::COMBOBOX_LIST)
     return roles::COMBOBOX_OPTION;
 
   return roles::RICH_OPTION;
 }
 
 PRUint64
@@ -1026,24 +1026,16 @@ NS_IMETHODIMP nsXULListitemAccessible::G
 
 bool
 nsXULListitemAccessible::CanHaveAnonChildren()
 {
   // That indicates we should walk anonymous children for listitems
   return true;
 }
 
-void
-nsXULListitemAccessible::GetPositionAndSizeInternal(PRInt32 *aPosInSet,
-                                                    PRInt32 *aSetSize)
-{
-  nsAccUtils::GetPositionAndSizeForXULSelectControlItem(mContent, aPosInSet,
-                                                        aSetSize);
-}
-
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULListitemAccessible: Widgets
 
 nsAccessible*
 nsXULListitemAccessible::ContainerWidget() const
 {
   return Parent();
 }
--- a/accessible/src/xul/nsXULListboxAccessible.h
+++ b/accessible/src/xul/nsXULListboxAccessible.h
@@ -134,18 +134,16 @@ public:
   NS_IMETHOD GetActionName(PRUint8 index, nsAString& aName);
   // Don't use XUL menuitems's description attribute
 
   // nsAccessible
   virtual void Description(nsString& aDesc);
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
-  virtual void GetPositionAndSizeInternal(PRInt32 *aPosInSet,
-                                          PRInt32 *aSetSize);
   virtual bool CanHaveAnonChildren();
 
   // Widgets
   virtual nsAccessible* ContainerWidget() const;
 
 protected:
   /**
    * Return listbox accessible for the listitem.
--- a/accessible/src/xul/nsXULTabAccessible.cpp
+++ b/accessible/src/xul/nsXULTabAccessible.cpp
@@ -159,24 +159,16 @@ nsXULTabAccessible::RelationByType(PRUin
   if (!tabpanelNode)
     return rel;
 
   nsCOMPtr<nsIContent> tabpanelContent(do_QueryInterface(tabpanelNode));
   rel.AppendTarget(tabpanelContent);
   return rel;
 }
 
-void
-nsXULTabAccessible::GetPositionAndSizeInternal(PRInt32 *aPosInSet,
-                                               PRInt32 *aSetSize)
-{
-  nsAccUtils::GetPositionAndSizeForXULSelectControlItem(mContent, aPosInSet,
-                                                        aSetSize);
-}
-
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTabsAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTabsAccessible::
   nsXULTabsAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
   XULSelectControlAccessible(aContent, aDoc)
--- a/accessible/src/xul/nsXULTabAccessible.h
+++ b/accessible/src/xul/nsXULTabAccessible.h
@@ -54,18 +54,16 @@ public:
 
   nsXULTabAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
   // nsAccessible
-  virtual void GetPositionAndSizeInternal(PRInt32 *aPosInSet,
-                                          PRInt32 *aSetSize);
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
   virtual Relation RelationByType(PRUint32 aType);
 
   // ActionAccessible
   virtual PRUint8 ActionCount();
 };
 
--- a/accessible/src/xul/nsXULTreeAccessible.cpp
+++ b/accessible/src/xul/nsXULTreeAccessible.cpp
@@ -87,22 +87,26 @@ nsXULTreeAccessible::
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeAccessible: nsISupports and cycle collection implementation
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsXULTreeAccessible)
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsXULTreeAccessible,
                                                   nsAccessible)
-CycleCollectorTraverseCache(tmp->mAccessibleCache, &cb);
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mTree)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mTreeView)
+  CycleCollectorTraverseCache(tmp->mAccessibleCache, &cb);
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsXULTreeAccessible,
                                                 nsAccessible)
-ClearCache(tmp->mAccessibleCache);
+  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mTree)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mTreeView)
+  ClearCache(tmp->mAccessibleCache);
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(nsXULTreeAccessible)
 NS_INTERFACE_MAP_STATIC_AMBIGUOUS(nsXULTreeAccessible)
 NS_INTERFACE_MAP_END_INHERITING(nsAccessible)
 
 NS_IMPL_ADDREF_INHERITED(nsXULTreeAccessible, nsAccessible)
 NS_IMPL_RELEASE_INHERITED(nsXULTreeAccessible, nsAccessible)
@@ -220,20 +224,20 @@ nsXULTreeAccessible::ChildAtPoint(PRInt3
     return nsnull;
 
   nsPresContext *presContext = frame->PresContext();
   nsCOMPtr<nsIPresShell> presShell = presContext->PresShell();
 
   nsIFrame *rootFrame = presShell->GetRootFrame();
   NS_ENSURE_TRUE(rootFrame, nsnull);
 
-  nsIntRect rootRect = rootFrame->GetScreenRectExternal();
+  nsIntRect rootRect = rootFrame->GetScreenRect();
 
-  PRInt32 clientX = presContext->DevPixelsToIntCSSPixels(aX - rootRect.x);
-  PRInt32 clientY = presContext->DevPixelsToIntCSSPixels(aY - rootRect.y);
+  PRInt32 clientX = presContext->DevPixelsToIntCSSPixels(aX) - rootRect.x;
+  PRInt32 clientY = presContext->DevPixelsToIntCSSPixels(aY) - rootRect.y;
 
   PRInt32 row = -1;
   nsCOMPtr<nsITreeColumn> column;
   nsCAutoString childEltUnused;
   mTree->GetCellAt(clientX, clientY, &row, getter_AddRefs(column),
                    childEltUnused);
 
   // If we failed to find tree cell for the given point then it might be
--- a/accessible/src/xul/nsXULTreeGridAccessible.cpp
+++ b/accessible/src/xul/nsXULTreeGridAccessible.cpp
@@ -701,20 +701,20 @@ nsXULTreeGridRowAccessible::ChildAtPoint
     return nsnull;
 
   nsPresContext *presContext = frame->PresContext();
   nsCOMPtr<nsIPresShell> presShell = presContext->PresShell();
 
   nsIFrame *rootFrame = presShell->GetRootFrame();
   NS_ENSURE_TRUE(rootFrame, nsnull);
 
-  nsIntRect rootRect = rootFrame->GetScreenRectExternal();
+  nsIntRect rootRect = rootFrame->GetScreenRect();
 
-  PRInt32 clientX = presContext->DevPixelsToIntCSSPixels(aX - rootRect.x);
-  PRInt32 clientY = presContext->DevPixelsToIntCSSPixels(aY - rootRect.y);
+  PRInt32 clientX = presContext->DevPixelsToIntCSSPixels(aX) - rootRect.x;
+  PRInt32 clientY = presContext->DevPixelsToIntCSSPixels(aY) - rootRect.y;
 
   PRInt32 row = -1;
   nsCOMPtr<nsITreeColumn> column;
   nsCAutoString childEltUnused;
   mTree->GetCellAt(clientX, clientY, &row, getter_AddRefs(column),
                    childEltUnused);
 
   // Return if we failed to find tree cell in the row for the given point.
--- a/accessible/tests/mochitest/actions/test_tree.xul
+++ b/accessible/tests/mochitest/actions/test_tree.xul
@@ -38,17 +38,17 @@
     }
 
     ////////////////////////////////////////////////////////////////////////////
     // Test
 
     // gA11yEventDumpID = "debug";
     //gA11yEventDumpToConsole = true; // debug
 
-    function doTestActions()
+    function doTest()
     {
       var treeNode = getNode("tree");
 
       var treeBodyNode = treeNode.boxObject.treeBody;
 
       var tree = getAccessible(treeNode);
       var expandedTreeItem = tree.getChildAt(2);
       var collapsedTreeItem = tree.getChildAt(5);
@@ -86,25 +86,18 @@
             testStates(this.ID, STATE_COLLAPSED);
           }
         }
       ];
 
       testActions(actions); // Will call SimpleTest.finish();
     }
 
-    function doTest()
-    {
-      var treeNode = getNode("tree");
-      waitForEvent(EVENT_REORDER, treeNode, doTestActions);
-      treeNode.view = new nsTreeTreeView();
-    }
-
     SimpleTest.waitForExplicitFinish();
-    addA11yLoadEvent(doTest);
+    addA11yXULTreeLoadEvent(doTest, "tree", new nsTreeTreeView());
   ]]>
   </script>
 
   <hbox flex="1" style="overflow: auto;">
     <body xmlns="http://www.w3.org/1999/xhtml">
       <a target="_blank"
          href="https://bugzilla.mozilla.org/show_bug.cgi?id=503727"
          title="Reorganize implementation of XUL tree accessibility">
--- a/accessible/tests/mochitest/attributes/test_obj.html
+++ b/accessible/tests/mochitest/attributes/test_obj.html
@@ -100,16 +100,20 @@ https://bugzilla.mozilla.org/show_bug.cg
       if (WIN) {
         var gfxInfo = Components.classes["@mozilla.org/gfx/info;1"].
           getService(Components.interfaces.nsIGfxInfo);
         var attrs = {
           "D2D": (gfxInfo.D2DEnabled ? "true" : "false")
         }
         testAttrs(getApplicationAccessible(), attrs, false);
       }
+
+      // no object attributes
+      testAbsentAttrs(getAccessible("listitem").firstChild, { "tag": "" });
+
       SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
     addA11yLoadEvent(doTest);
   </script>
 </head>
 <body>
@@ -188,10 +192,14 @@ https://bugzilla.mozilla.org/show_bug.cg
   <input id="checkbox" type="checkbox"/>
   <div id="draggable" draggable="true">Draggable div</div>
   <table>
     <tr>
       <th id="th1"><abbr title="Social Security Number">SS#</abbr></th>
       <th id="th2" abbr="SS#" axis="social">Social Security Number</th>
     </tr>
   </table>
+
+  <ul>
+    <li id="listitem">item
+  </ul>
 </body>
 </html>
--- a/accessible/tests/mochitest/attributes/test_obj_css.html
+++ b/accessible/tests/mochitest/attributes/test_obj_css.html
@@ -1,28 +1,52 @@
 <html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=439566
-https://bugzilla.mozilla.org/show_bug.cgi?id=460932
-https://bugzilla.mozilla.org/show_bug.cgi?id=689540
--->
 <head>
   <title>CSS-like attributes tests</title>
   <link rel="stylesheet" type="text/css"
         href="chrome://mochikit/content/tests/SimpleTest/test.css" />
 
   <script type="application/javascript"
           src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
 
   <script type="application/javascript"
           src="../common.js"></script>
   <script type="application/javascript"
           src="../attributes.js"></script>
+  <script type="application/javascript"
+          src="../events.js"></script>
 
   <script type="application/javascript">
+    var gQueue = null;
+
+    function removeElm(aID)
+    {
+      this.node = getNode(aID);
+      this.accessible = getAccessible(aID);
+
+      this.eventSeq = [
+        new invokerChecker(EVENT_HIDE, this.accessible)
+      ];
+
+      this.invoke = function removeElm_invoke()
+      {
+        this.node.parentNode.removeChild(this.node);
+      }
+
+      this.check = function removeElm_check()
+      {
+        testAbsentCSSAttrs(this.accessible);
+      }
+
+      this.getID = function removeElm_getID()
+      {
+        return "test CSS-based attributes on removed accessible";
+      }
+    }
+
     function doTest()
     {
       // CSS display
       testCSSAttrs("display_block");
       testCSSAttrs("display_inline");
       testCSSAttrs("display_inline-block");
       testCSSAttrs("display_list-item");
       testCSSAttrs("display_table");
@@ -80,17 +104,19 @@ https://bugzilla.mozilla.org/show_bug.cg
       testCSSAttrs("input");
       testCSSAttrs("table");
       testCSSAttrs("tr");
       testCSSAttrs("td");
 
       // no CSS-based object attributes
       testAbsentCSSAttrs(getAccessible("listitem").firstChild);
 
-      SimpleTest.finish();
+      gQueue = new eventQueue();
+      gQueue.push(new removeElm("div"));
+      gQueue.invoke(); // SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
     addA11yLoadEvent(doTest);
   </script>
 </head>
 <body>
 
--- a/accessible/tests/mochitest/attributes/test_obj_group.xul
+++ b/accessible/tests/mochitest/attributes/test_obj_group.xul
@@ -72,18 +72,20 @@
 
     //gA11yEventDumpToConsole = true; // debug stuff
 
     var gQueue = null;
     function doTest()
     {
       //////////////////////////////////////////////////////////////////////////
       // xul:listbox (bug 417317)
-      testGroupAttrs("item1", 1, 2);
-      testGroupAttrs("item2", 2, 2);
+      testGroupAttrs("listitem1", 1, 4);
+      testGroupAttrs("listitem2", 2, 4);
+      testGroupAttrs("listitem3", 3, 4);
+      testGroupAttrs("listitem4", 4, 4);
 
       //////////////////////////////////////////////////////////////////////////
       // xul:tab
       testGroupAttrs("tab1", 1, 2);
       testGroupAttrs("tab2", 2, 2);
 
       //////////////////////////////////////////////////////////////////////////
       // xul:radio
@@ -138,19 +140,22 @@
     <p id="display"></p>
     <div id="content" style="display: none">
     </div>
     <pre id="test">
     </pre>
   </body>
 
   <vbox flex="1">
+
   <listbox>
-    <listitem label="item1" id="item1"/>
-    <listitem label="item2" id="item2"/>
+    <listitem label="listitem1" id="listitem1"/>
+    <listitem label="listitem2" id="listitem2" type="checkbox"/>
+    <listitem label="listitem3" id="listitem3" type="checkbox"/>
+    <listitem label="listitem4" id="listitem4"/>
   </listbox>
 
   <menubar>
     <menu label="item1" id="menu_item1">
       <menupopup>
         <menuitem label="item1.1" id="menu_item1.1"/>
         <menuseparator/>
         <menuitem label="item1.2" id="menu_item1.2"/>
--- a/accessible/tests/mochitest/attributes/test_obj_group_tree.xul
+++ b/accessible/tests/mochitest/attributes/test_obj_group_tree.xul
@@ -19,17 +19,17 @@
   <script type="application/javascript"
           src="../events.js" />
 
   <script type="application/javascript">
   <![CDATA[
     ////////////////////////////////////////////////////////////////////////////
     // Test
 
-    function doTestAttrs()
+    function doTest()
     {
       var treeNode = getNode("tree");
 
       var tree = getAccessible(treeNode);
       var treeitem1 = tree.firstChild.nextSibling;
       testGroupAttrs(treeitem1, 1, 4, 1);
 
       var treeitem2 = treeitem1.nextSibling;
@@ -45,25 +45,18 @@
       testGroupAttrs(treeitem5, 3, 4, 1);
 
       var treeitem6 = treeitem5.nextSibling;
       testGroupAttrs(treeitem6, 4, 4, 1);
 
       SimpleTest.finish();
     }
 
-    function doTest()
-    {
-      var treeNode = getNode("tree");
-      waitForEvent(EVENT_REORDER, treeNode, doTestAttrs);
-      treeNode.view = new nsTreeTreeView();
-    }
-
     SimpleTest.waitForExplicitFinish();
-    addA11yLoadEvent(doTest);
+    addA11yXULTreeLoadEvent(doTest, "tree", new nsTreeTreeView());
   ]]>
   </script>
 
   <hbox flex="1" style="overflow: auto;">
     <body xmlns="http://www.w3.org/1999/xhtml">
       <a target="_blank"
          href="https://bugzilla.mozilla.org/show_bug.cgi?id=503727"
          title="Reorganize implementation of XUL tree accessibility">
--- a/accessible/tests/mochitest/bounds/test_zoom.html
+++ b/accessible/tests/mochitest/bounds/test_zoom.html
@@ -2,48 +2,68 @@
 <html>
 <head>
   <title>Accessible boundaries when page is zoomed</title>
   <link rel="stylesheet" type="text/css"
         href="chrome://mochikit/content/tests/SimpleTest/test.css" />
 
   <script type="application/javascript"
           src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/EventUtils.js"></script>
 
   <script type="application/javascript"
           src="../common.js"></script>
   <script type="application/javascript"
           src="../role.js"></script>
   <script type="application/javascript"
           src="../layout.js"></script>
   <script type="application/javascript"
           src="../browser.js"></script>
 
   <script type="application/javascript">
     function doTest()
     {
       var tabDocument = currentTabDocument();
-      var p1 = tabDocument.body.firstElementChild;
-      var p2 = tabDocument.body.lastElementChild;
+      var p1 = tabDocument.getElementById("p1");
+      var p2 = tabDocument.getElementById("p2");
+
+      var imgMap = tabDocument.getElementById("imgmap");
+      ensureImageMapTree(imgMap);
+      var imgMapAcc = getAccessible(imgMap);
+      var area = imgMapAcc.firstChild;
 
       testBounds(p1);
       testBounds(p2);
+      testBounds(area);
 
       zoomDocument(tabDocument, 2.0);
 
       testBounds(p1);
       testBounds(p2);
+      testBounds(area);
 
       closeBrowserWindow();
       SimpleTest.finish();
     }
 
+    var url = "data:text/html,<html><body>";
+    url += "<p id='p1'>para 1</p><p id='p2'>para 2</p>";
+    url += "<map name='atoz_map' id='map'>";
+    url += "  <area id='area1' href='http%3A%2F%2Fmozilla.org'";
+    url += "        coords=17,0,30,14' alt='mozilla.org' shape='rect'>";
+    url += "</map>";
+    url += "<img id='imgmap' width='447' height='15'";
+    url += "     usemap='%23atoz_map'";
+    url += "     src='chrome%3A%2F%2Fmochitests%2Fcontent%2Fa11y%2Faccessible%2Fletters.gif'>";
+    url += "</body></html>";
+
     SimpleTest.waitForExplicitFinish();
     openBrowserWindow(doTest,
-                      "data:text/html,<html><body><p>para 1</p><p>para 2</p></body></html>",
+                      url,
                       { left: 0, top: 0, width: 600, height: 600 });
   </script>
 </head>
 <body>
 
   <a target="_blank"
      href="https://bugzilla.mozilla.org/show_bug.cgi?id=650241"
      title="Location returned by accessibles incorrect when page zoomed">
--- a/accessible/tests/mochitest/browser.js
+++ b/accessible/tests/mochitest/browser.js
@@ -93,31 +93,16 @@ function urlbarInput()
 /**
  * Return reload button.
  */
 function reloadButton()
 {
   return browserWindow().document.getElementById("urlbar-reload-button");
 }
 
-/**
- * Zoom the given document.
- */
-function zoomDocument(aDocument, aZoom)
-{
-  var docShell = aDocument.defaultView.
-    QueryInterface(Components.interfaces.nsIInterfaceRequestor).
-    getInterface(Components.interfaces.nsIWebNavigation).
-    QueryInterface(Components.interfaces.nsIDocShell);
-  var docViewer = docShell.contentViewer.
-    QueryInterface(Components.interfaces.nsIMarkupDocumentViewer);
-
-  docViewer.fullZoom = aZoom;
-}
-
 ////////////////////////////////////////////////////////////////////////////////
 // private section
 
 Components.utils.import("resource://gre/modules/Services.jsm");
 
 var gBrowserContext =
 {
   browserWnd: null,
--- a/accessible/tests/mochitest/common.js
+++ b/accessible/tests/mochitest/common.js
@@ -110,16 +110,31 @@ function addA11yLoadEvent(aFunc, aWindow
       },
       0
     );
   }
 
   SimpleTest.waitForFocus(waitForDocLoad, aWindow);
 }
 
+/**
+ * Analogy of SimpleTest.is function used to compare objects.
+ */
+function isObject(aObj, aExpectedObj, aMsg)
+{
+  if (aObj == aExpectedObj) {
+    ok(true, aMsg);
+    return;
+  }
+
+  ok(false,
+     aMsg + " - got '" + prettyName(aObj) +
+            "', expected '" + prettyName(aExpectedObj) + "'");
+}
+
 ////////////////////////////////////////////////////////////////////////////////
 // Helpers for getting DOM node/accessible
 
 /**
  * Return the DOM node by identifier (may be accessible, DOM node or ID).
  */
 function getNode(aAccOrNodeOrID)
 {
@@ -489,17 +504,19 @@ function testDefunctAccessible(aAcc, aNo
 /**
  * Ensure that image map accessible tree is created.
  */
 function ensureImageMapTree(aID)
 {
   // XXX: We send a useless mouse move to the image to force it to setup its
   // image map, because flushing layout won't do it. Hopefully bug 135040
   // will make this not suck.
-  synthesizeMouse(getNode(aID), 10, 10, { type: "mousemove" });
+  var image = getNode(aID);
+  synthesizeMouse(image, 10, 10, { type: "mousemove" },
+                  image.ownerDocument.defaultView);
 
   // XXX This may affect a11y more than other code because imagemaps may not
   // get drawn or have an mouse event over them. Bug 570322 tracks a11y
   // dealing with this.
   todo(false, "Need to remove this image map workaround.");
 }
 
 /**
--- a/accessible/tests/mochitest/elm/test_landmarks.html
+++ b/accessible/tests/mochitest/elm/test_landmarks.html
@@ -29,22 +29,22 @@
 
       // Some AT may look for this
       testAttrs("nav", {"xml-roles" : "navigation"}, true);
       testAttrs("footer", {"xml-roles" : "contentinfo"}, true);
       testAttrs("aside", {"xml-roles" : "complementary"}, true);
       testAttrs("main", {"xml-roles" : "main"}, true); // ARIA override
 
       // And some AT may look for this
-      testAttrs("nav", {"tag" : "NAV"}, true);
-      testAttrs("header", {"tag" : "HEADER"}, true);
-      testAttrs("footer", {"tag" : "FOOTER"}, true);
-      testAttrs("article", {"tag" : "ARTICLE"}, true);
-      testAttrs("aside", {"tag" : "ASIDE"}, true);
-      testAttrs("main", {"tag" : "ARTICLE"}, true); // no override expected
+      testAttrs("nav", {"tag" : "nav"}, true);
+      testAttrs("header", {"tag" : "header"}, true);
+      testAttrs("footer", {"tag" : "footer"}, true);
+      testAttrs("article", {"tag" : "article"}, true);
+      testAttrs("aside", {"tag" : "aside"}, true);
+      testAttrs("main", {"tag" : "article"}, true); // no override expected
 
       SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
     addA11yLoadEvent(doTest);
   </script>
 </head>
--- a/accessible/tests/mochitest/events/test_focus_tree.xul
+++ b/accessible/tests/mochitest/events/test_focus_tree.xul
@@ -24,33 +24,16 @@
           src="../events.js" />
 
   <script type="application/javascript">
   <![CDATA[
 
     ////////////////////////////////////////////////////////////////////////////
     // Invokers
 
-    function setTreeView(aTreeID, aView)
-    {
-      this.DOMNode = getNode(aTreeID);
-
-      this.eventSeq = [
-        new invokerChecker(EVENT_REORDER, this.DOMNode)
-      ];
-
-      this.invoke = function setTreeView_invoke()
-      {
-        this.DOMNode.treeBoxObject.view = aView;
-      }
-
-      this.getID = function setTreeView_getID()
-        { return "set tree view for " + prettyName(aTreeID); }
-    };
-
     function focusTree(aTreeID)
     {
       var checker = new focusChecker(getFirstTreeItem, aTreeID);
       this.__proto__ = new synthFocus(aTreeID, [ checker ]);
     }
 
     function moveToNextItem(aTreeID)
     {
@@ -77,29 +60,28 @@
 
     //gA11yEventDumpID = "debug"; // debugging
     //gA11yEventDumpToConsole = true; // debugging
 
     function doTest()
     {
       gQueue = new eventQueue();
 
-      gQueue.push(new setTreeView("tree", new nsTableTreeView(5)));
       gQueue.push(new focusTree("tree"));
       gQueue.push(new moveToNextItem("tree"));
       gQueue.push(new synthFocus("emptytree"));
 
       // no focus event for changed current item for unfocused tree
       gQueue.push(new changeCurrentItem("tree", 0));
 
       gQueue.invoke();
     }
 
     SimpleTest.waitForExplicitFinish();
-    addA11yLoadEvent(doTest);
+    addA11yXULTreeLoadEvent(doTest, "tree", new nsTableTreeView(5));
   ]]>
   </script>
 
   <hbox flex="1" style="overflow: auto;">
     <body xmlns="http://www.w3.org/1999/xhtml">
       <a target="_blank"
          href="https://bugzilla.mozilla.org/show_bug.cgi?id=386821"
          title="Need better solution for firing delayed event against xul tree">
--- a/accessible/tests/mochitest/focus/test_takeFocus.xul
+++ b/accessible/tests/mochitest/focus/test_takeFocus.xul
@@ -21,33 +21,16 @@
   <script type="application/javascript"
           src="../treeview.js" />
 
   <script type="application/javascript">
   <![CDATA[
     ////////////////////////////////////////////////////////////////////////////
     // Invokers
 
-    function setTreeView(aTreeID, aView)
-    {
-      this.DOMNode = getNode(aTreeID);
-
-      this.eventSeq = [
-        new invokerChecker(EVENT_REORDER, this.DOMNode)
-      ];
-
-      this.invoke = function setTreeView_invoke()
-      {
-        this.DOMNode.treeBoxObject.view = aView;
-      }
-
-      this.getID = function setTreeView_getID()
-        { return "set tree view for " + prettyName(aTreeID); }
-    };
-
     function takeFocusInvoker(aID, aArgConverterFunc)
     {
       this.targetFunc = aArgConverterFunc ? aArgConverterFunc : getAccessible;
 
       this.eventSeq = [ new focusChecker(this.targetFunc, aID) ];
 
       this.invoke = function takeFocusInvoker_invoke()
       {
@@ -72,25 +55,24 @@
     //gA11yEventDumpToConsole = true; // debug stuff
 
     var gQueue = null;
     function doTests()
     {
       // Test focus events.
       gQueue = new eventQueue();
 
-      gQueue.push(new setTreeView("tree", new nsTableTreeView(5)));
       gQueue.push(new takeFocusInvoker("tree", getLastChild));
       gQueue.push(new takeFocusInvoker("listitem2"));
 
       gQueue.invoke(); // Will call SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
-    addA11yLoadEvent(doTests);
+    addA11yXULTreeLoadEvent(doTests, "tree", new nsTableTreeView(5));
   ]]>
   </script>
 
   <hbox flex="1" style="overflow: auto;">
     <body xmlns="http://www.w3.org/1999/xhtml">
       <a target="_blank"
          href="https://bugzilla.mozilla.org/show_bug.cgi?id=706067"
          title="Make takeFocus work on widget items">
--- a/accessible/tests/mochitest/hittest/Makefile.in
+++ b/accessible/tests/mochitest/hittest/Makefile.in
@@ -43,14 +43,15 @@ VPATH		= @srcdir@
 relativesrcdir  = accessible/hittest
 
 include $(DEPTH)/config/autoconf.mk
 include $(topsrcdir)/config/rules.mk
 
 _TEST_FILES = \
 		test_browser.html \
 		test_general.html \
-		test_general.xul \
+		test_zoom_tree.xul \
 		test_zoom.html \
+		zoom_tree.xul \
 		$(NULL)
 
 libs:: $(_TEST_FILES)
 	$(INSTALL) $(foreach f,$^,"$f") $(DEPTH)/_tests/testing/mochitest/a11y/$(relativesrcdir)
--- a/accessible/tests/mochitest/hittest/test_general.html
+++ b/accessible/tests/mochitest/hittest/test_general.html
@@ -14,53 +14,46 @@
 
   <script type="application/javascript">
     function doTest()
     {
       // Not specific case, child and deepchild testing.
       var list = getAccessible("list");
       var listitem = getAccessible("listitem");
       var image = getAccessible("image");
-      testChildAtPoint(list, 1, 1, false, listitem);
-      testChildAtPoint(list, 1, 1, true, image.firstChild);
+      testChildAtPoint(list, 1, 1, listitem, image.firstChild);
 
       // ::MustPrune case (in this case childAtPoint doesn't look inside a
       // textbox), point is inside of textbox.
       var txt = getAccessible("txt");
-      testChildAtPoint(txt, 1, 1, false, txt);
-      testChildAtPoint(txt, 1, 1, true, txt);
+      testChildAtPoint(txt, 1, 1, txt, txt);
 
       // ::MustPrune case, point is outside of textbox accessible but is in
       // document.
-      testChildAtPoint(txt, -1, 1, false, null);
-      testChildAtPoint(txt, -1, 1, true, null);
+      testChildAtPoint(txt, -1, 1, null, null);
 
       // ::MustPrune case, point is outside of root accessible.
-      testChildAtPoint(txt, -10000, 10000, false, null);
-      testChildAtPoint(txt, -10000, 10000, true, null);
+      testChildAtPoint(txt, -10000, 10000, null, null);
 
       // Not specific case, point is inside of btn accessible.
       var btn = getAccessible("btn");
       var btnText = btn.firstChild;
-      testChildAtPoint(btn, 1, 1, false, btnText);
-      testChildAtPoint(btn, 1, 1, true, btnText);
+      testChildAtPoint(btn, 1, 1, btnText, btnText);
   
       // Not specific case, point is outside of btn accessible.
-      testChildAtPoint(btn, -1, 1, false, null);
-      testChildAtPoint(btn, -1, 1, true, null);
+      testChildAtPoint(btn, -1, 1, null, null);
 
       // Out of flow accessible testing, do not return out of flow accessible
       // because it's not a child of the accessible even visually it is.
       var rectArea = getNode("area").getBoundingClientRect();
       var outOfFlow = getNode("outofflow");
       outOfFlow.style.left = rectArea.left + "px";
       outOfFlow.style.top = rectArea.top + "px";
 
-      testChildAtPoint("area", 1, 1, false, "area");
-      testChildAtPoint("area", 1, 1, true, "area");
+      testChildAtPoint("area", 1, 1, "area", "area");
 
       SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
     addA11yLoadEvent(doTest);
   </script>
 </head>
rename from accessible/tests/mochitest/hittest/test_general.xul
rename to accessible/tests/mochitest/hittest/test_zoom_tree.xul
--- a/accessible/tests/mochitest/hittest/test_general.xul
+++ b/accessible/tests/mochitest/hittest/test_zoom_tree.xul
@@ -10,62 +10,92 @@
           src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js" />
 
   <script type="application/javascript"
           src="../treeview.js" />
 
   <script type="application/javascript"
           src="../common.js" />
   <script type="application/javascript"
+          src="../events.js" />
+  <script type="application/javascript"
           src="../layout.js" />
+  <script type="application/javascript"
+          src="../browser.js" />
 
   <script type="application/javascript">
   <![CDATA[
     function doTest()
     {
-      // Initialize the tree
-      var view = new nsTableTreeView(5);
+      var tabDocument = currentTabDocument();
+      var tabWindow = currentTabWindow();
+
+      var tree = tabDocument.getElementById("tree");
+      var treecols = tabDocument.getElementById("treecols");
+      var treecol1 = tabDocument.getElementById("treecol1");
 
-      var tree = getNode("tree");
-      var treeBox = tree.treeBoxObject;
-      treeBox.view = view;
+      // tree columns
+      hitTest(tree, treecols, treecol1);
+
+      // tree rows and cells
+      var treeBoxObject = tree.treeBoxObject;
+      var treeBodyBoxObj = tree.treeBoxObject.treeBody.boxObject;
+      var xObj = {}, yObj = {}, widthObj = {}, heightObj = {};
+      treeBoxObject.getCoordsForCellItem(1, tree.columns[0], "cell",
+                                         xObj, yObj, widthObj, heightObj);
 
-      // Tests
-      var treecols = getNode("treecols");
-      var x = treecols.boxObject.x;
-      var y = treecols.boxObject.y;
+      var treeAcc = getAccessible(tree, [nsIAccessibleTable]);
+      var cellAcc = treeAcc.getCellAt(1, 0);
+      var rowAcc = cellAcc.parent;
+
+      var cssX = xObj.value + treeBodyBoxObj.x;
+      var cssY = yObj.value + treeBodyBoxObj.y;
+      var [x, y] = CSSToDevicePixels(tabWindow, cssX, cssY);
+
+      testChildAtPoint(treeAcc, x, y, rowAcc, cellAcc);
+      testChildAtPoint(rowAcc, x, y, cellAcc, cellAcc);
 
-      testChildAtPoint(tree, x, y, false, treecols);
-      testChildAtPoint(tree, x, y, true, "col1");
+      // do zoom
+      zoomDocument(tabDocument, 1.5);
+
+      // tree columns
+      hitTest(tree, treecols, treecol1);
 
+      // tree rows and cells
+      var [x, y] = CSSToDevicePixels(tabWindow, cssX, cssY);
+      testChildAtPoint(treeAcc, x, y, rowAcc, cellAcc);
+      testChildAtPoint(rowAcc, x, y, cellAcc, cellAcc);
+
+      closeBrowserWindow();
       SimpleTest.finish();
     }
 
+    function prepareTest()
+    {
+      var tabDocument = currentTabDocument();
+      var tree = tabDocument.getElementById("tree");
+      loadXULTreeAndDoTest(doTest, tree, new nsTableTreeView(5));
+    }
+
     SimpleTest.waitForExplicitFinish();
-    addA11yLoadEvent(doTest);
+    openBrowserWindow(prepareTest,
+                      "chrome://mochitests/content/a11y/accessible/hittest/zoom_tree.xul",
+                      { left: 100, top: 100 });
   ]]>
   </script>
 
   <hbox flex="1" style="overflow: auto;">
     <body xmlns="http://www.w3.org/1999/xhtml">
       <a target="_blank"
          href="https://bugzilla.mozilla.org/show_bug.cgi?id=471493"
          title=" crash [@ nsPropertyTable::GetPropertyInternal]">
         Mozilla Bug 471493
       </a><br/>
       <p id="display"></p>
       <div id="content" style="display: none">
       </div>
       <pre id="test">
       </pre>
     </body>
-
-    <tree id="tree" flex="1">
-      <treecols id="treecols">
-        <treecol id="col1" flex="1" primary="true" label="column"/>
-        <treecol id="col2" flex="1" label="column 2"/>
-      </treecols>
-      <treechildren id="treechildren"/>
-    </tree>
   </hbox>
 
 </window>
 
new file mode 100644
--- /dev/null
+++ b/accessible/tests/mochitest/hittest/zoom_tree.xul
@@ -0,0 +1,18 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        title="nsIAccessible::getChildAtPoint and getDeepestChildAtPoint for XUL trees">
+
+  <tree id="tree" flex="1">
+    <treecols id="treecols">
+      <treecol id="treecol1" flex="1" primary="true" label="column"/>
+      <treecol id="treecol2" flex="1" label="column 2"/>
+    </treecols>
+    <treechildren id="treechildren"/>
+  </tree>
+
+</window>
+
--- a/accessible/tests/mochitest/layout.js
+++ b/accessible/tests/mochitest/layout.js
@@ -1,53 +1,69 @@
 /**
- * Tests if the given accessible at the given point is expected.
+ * Tests if the given child and grand child accessibles at the given point are
+ * expected.
  *
- * @param aIdentifier        [in] accessible identifier
- * @param aX                 [in] x coordinate of the point relative accessible
- * @param aY                 [in] y coordinate of the point relative accessible
- * @param aFindDeepestChild  [in] points whether deepest or nearest child should
- *                           be returned
- * @param aChildIdentifier   [in] expected child accessible
+ * @param aID            [in] accessible identifier
+ * @param aX             [in] x coordinate of the point relative accessible
+ * @param aY             [in] y coordinate of the point relative accessible
+ * @param aChildID       [in] expected child accessible
+ * @param aGrandChildID  [in] expected child accessible
  */
-function testChildAtPoint(aIdentifier, aX, aY, aFindDeepestChild,
-                          aChildIdentifier)
+function testChildAtPoint(aID, aX, aY, aChildID, aGrandChildID)
 {
-  var childAcc = getAccessible(aChildIdentifier);
-  var actualChildAcc = getChildAtPoint(aIdentifier, aX, aY, aFindDeepestChild);
+  var child = getChildAtPoint(aID, aX, aY, false);
+  var expectedChild = getAccessible(aChildID);
 
-  var msg = "Wrong " + (aFindDeepestChild ? "deepest" : "direct");
-  msg += " child accessible [" + prettyName(actualChildAcc);
-  msg += "] at the point (" + aX + ", " + aY + ") of accessible [";
-  msg += prettyName(aIdentifier) + "]";
+  var msg = "Wrong direct child accessible at the point (" + aX + ", " + aY +
+    ") of " + prettyName(aID);
+  isObject(child, expectedChild, msg);
 
-  is(childAcc, actualChildAcc, msg);
+  var grandChild = getChildAtPoint(aID, aX, aY, true);
+  var expectedGrandChild = getAccessible(aGrandChildID);
+
+  msg = "Wrong deepest child accessible at the point (" + aX + ", " + aY +
+    ") of " + prettyName(aID);
+  isObject(grandChild, expectedGrandChild, msg);
 }
 
 /**
  * Test if getChildAtPoint returns the given child and grand child accessibles
  * at coordinates of child accessible (direct and deep hit test).
  */
 function hitTest(aContainerID, aChildID, aGrandChildID)
 {
   var container = getAccessible(aContainerID);
   var child = getAccessible(aChildID);
   var grandChild = getAccessible(aGrandChildID);
 
   var [x, y] = getBoundsForDOMElm(child);
 
   var actualChild = container.getChildAtPoint(x + 1, y + 1);
-  is(actualChild, child,
-     "Wrong child, expected: " + prettyName(child) +
-     ", got: " + prettyName(actualChild));
+  isObject(actualChild, child,
+           "Wrong direct child of " + prettyName(aContainerID));
 
   var actualGrandChild = container.getDeepestChildAtPoint(x + 1, y + 1);
-  is(actualGrandChild, grandChild,
-     "Wrong deepest child, expected: " + prettyName(grandChild) +
-     ", got: " + prettyName(actualGrandChild));
+  isObject(actualGrandChild, grandChild,
+           "Wrong deepest child of " + prettyName(aContainerID));
+}
+
+/**
+ * Zoom the given document.
+ */
+function zoomDocument(aDocument, aZoom)
+{
+  var docShell = aDocument.defaultView.
+    QueryInterface(Components.interfaces.nsIInterfaceRequestor).
+    getInterface(Components.interfaces.nsIWebNavigation).
+    QueryInterface(Components.interfaces.nsIDocShell);
+  var docViewer = docShell.contentViewer.
+    QueryInterface(Components.interfaces.nsIMarkupDocumentViewer);
+
+  docViewer.fullZoom = aZoom;
 }
 
 /**
  * Return child accessible at the given point.
  *
  * @param aIdentifier        [in] accessible identifier
  * @param aX                 [in] x coordinate of the point relative accessible
  * @param aY                 [in] y coordinate of the point relative accessible
@@ -102,21 +118,54 @@ function getBounds(aID)
 }
 
 /**
  * Return DOM node coordinates relative the screen and its size in device
  * pixels.
  */
 function getBoundsForDOMElm(aID)
 {
+  var x = 0, y = 0, width = 0, height = 0;
+
   var elm = getNode(aID);
+  if (elm.localName == "area") {
+    var mapName = elm.parentNode.getAttribute("name");
+    var selector = "[usemap='#" + mapName + "']";
+    var img = elm.ownerDocument.querySelector(selector);
+
+    var areaCoords = elm.coords.split(",");
+    var areaX = parseInt(areaCoords[0]);
+    var areaY = parseInt(areaCoords[1]);
+    var areaWidth = parseInt(areaCoords[2]) - areaX;
+    var areaHeight = parseInt(areaCoords[3]) - areaY;
+
+    var rect = img.getBoundingClientRect();
+    x = rect.left + areaX;
+    y = rect.top + areaY;
+    width = areaWidth;
+    height = areaHeight;
+  }
+  else {
+    var rect = elm.getBoundingClientRect();
+    x = rect.left;
+    y = rect.top;
+    width = rect.width;
+    height = rect.height;
+  }
+
   var elmWindow = elm.ownerDocument.defaultView;
-  var winUtil = elmWindow.
+  return CSSToDevicePixels(elmWindow,
+                           x + elmWindow.mozInnerScreenX,
+                           y + elmWindow.mozInnerScreenY,
+                           width,
+                           height);
+}
+
+function CSSToDevicePixels(aWindow, aX, aY, aWidth, aHeight)
+{
+  var winUtil = aWindow.
     QueryInterface(Components.interfaces.nsIInterfaceRequestor).
     getInterface(Components.interfaces.nsIDOMWindowUtils);
 
   var ratio = winUtil.screenPixelsPerCSSPixel;
-  var rect = elm.getBoundingClientRect();
-  return [ (rect.left + elmWindow.mozInnerScreenX) * ratio,
-           (rect.top + elmWindow.mozInnerScreenY) * ratio,
-           rect.width * ratio,
-           rect.height * ratio ];
+  return [aX * ratio, aY * ratio, aWidth * ratio, aHeight * ratio];
 }
+
--- a/accessible/tests/mochitest/relations/test_tree.xul
+++ b/accessible/tests/mochitest/relations/test_tree.xul
@@ -19,17 +19,17 @@
   <script type="application/javascript"
           src="../relations.js" />
 
   <script type="application/javascript">
   <![CDATA[
     ////////////////////////////////////////////////////////////////////////////
     // Test
 
-    function doTestRelations()
+    function doTest()
     {
       var treeNode = getNode("tree");
 
       var tree = getAccessible(treeNode);
       var treeitem1 = tree.firstChild.nextSibling;
       testRelation(treeitem1, RELATION_NODE_CHILD_OF, [tree]);
 
       var treeitem2 = treeitem1.nextSibling;
@@ -49,25 +49,18 @@
 
       // treeitems and treecells shouldn't pick up relations from tree
       testRelation(treeitem1, RELATION_LABELLED_BY, null);
       testRelation(treeitem1.firstChild, RELATION_LABELLED_BY, null);
 
       SimpleTest.finish();
     }
 
-    function doTest()
-    {
-      var treeNode = getNode("tree");
-      waitForEvent(EVENT_REORDER, treeNode, doTestRelations);
-      treeNode.view = new nsTreeTreeView();
-    }
-
     SimpleTest.waitForExplicitFinish();
-    addA11yLoadEvent(doTest);
+    addA11yXULTreeLoadEvent(doTest, "tree", new nsTreeTreeView());
   ]]>
   </script>
 
   <hbox flex="1" style="overflow: auto;">
     <body xmlns="http://www.w3.org/1999/xhtml">
       <a target="_blank"
          href="https://bugzilla.mozilla.org/show_bug.cgi?id=503727"
          title="Reorganize implementation of XUL tree accessibility">
--- a/accessible/tests/mochitest/table/test_headers_tree.xul
+++ b/accessible/tests/mochitest/table/test_headers_tree.xul
@@ -19,36 +19,21 @@
   <script type="application/javascript"
           src="../table.js" />
 
   <script type="application/javascript">
   <![CDATA[
     ////////////////////////////////////////////////////////////////////////////
     // Test
 
-    var gTree = null;
-    var gTreeBox = null;
-    var gTreeView = null;
-
     // gA11yEventDumpID = "debug";
 
     function doTest()
     {
-      // Initialize the tree
-      gTree = document.getElementById("tree");
-      gTreeBox = gTree.treeBoxObject;
-      gView = new nsTableTreeView(3);
-
-      waitForEvent(EVENT_REORDER, gTree, continueTest);
-      gTreeBox.view = gView;
-    }
-
-    function continueTest()
-    {
-      var treeAcc = getAccessible(gTree, [nsIAccessibleTable]);
+      var treeAcc = getAccessible("tree", [nsIAccessibleTable]);
 
       var headerInfoMap = [
         {
           cell: treeAcc.getCellAt(0, 0),
           rowHeaderCells: [],
           columnHeaderCells: [ "col" ]
         },
         {
@@ -79,17 +64,17 @@
       ];
 
       testHeaderCells(headerInfoMap);
 
       SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
-    addA11yLoadEvent(doTest);
+    addA11yXULTreeLoadEvent(doTest, "tree", new nsTableTreeView(3));
   ]]>
   </script>
 
   <hbox flex="1" style="overflow: auto;">
     <body xmlns="http://www.w3.org/1999/xhtml">
       <a target="_blank"
          href="https://bugzilla.mozilla.org/show_bug.cgi?id=512424"
          title="implement IAccessibleTable2">
--- a/accessible/tests/mochitest/table/test_indexes_tree.xul
+++ b/accessible/tests/mochitest/table/test_indexes_tree.xul
@@ -19,47 +19,32 @@
   <script type="application/javascript"
           src="../table.js" />
 
   <script type="application/javascript">
   <![CDATA[
     ////////////////////////////////////////////////////////////////////////////
     // Test
 
-    var gTree = null;
-    var gTreeBox = null;
-    var gTreeView = null;
-
     // gA11yEventDumpID = "debug";
 
     function doTest()
     {
-      // Initialize the tree
-      gTree = document.getElementById("tree");
-      gTreeBox = gTree.treeBoxObject;
-      gView = new nsTableTreeView(3);
-
-      waitForEvent(EVENT_REORDER, gTree, continueTest);
-      gTreeBox.view = gView;
-    }
-
-    function continueTest()
-    {
       var idxes = [
         [0, 1],
         [2, 3],
         [4, 5]
       ];
-      testTableIndexes(gTree, idxes);
+      testTableIndexes("tree", idxes);
 
       SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
-    addA11yLoadEvent(doTest);
+    addA11yXULTreeLoadEvent(doTest, "tree", new nsTableTreeView(3));
   ]]>
   </script>
 
   <hbox flex="1" style="overflow: auto;">
     <body xmlns="http://www.w3.org/1999/xhtml">
       <a target="_blank"
          href="https://bugzilla.mozilla.org/show_bug.cgi?id=503727"
          title="Reorganize implementation of XUL tree accessibility">
--- a/accessible/tests/mochitest/table/test_sels_tree.xul
+++ b/accessible/tests/mochitest/table/test_sels_tree.xul
@@ -21,51 +21,36 @@
   <script type="application/javascript"
           src="../table.js" />
 
   <script type="application/javascript">
   <![CDATA[
     ////////////////////////////////////////////////////////////////////////////
     // Test
 
-    var gTree = null;
-    var gTreeBox = null;
-    var gTreeView = null;
-
     // gA11yEventDumpID = "debug";
 
     function doTest()
     {
-      // Initialize the tree
-      gTree = document.getElementById("tree");
-      gTreeBox = gTree.treeBoxObject;
-      gView = new nsTableTreeView(3);
-
-      waitForEvent(EVENT_REORDER, gTree, continueTest);
-      gTreeBox.view = gView;
-    }
-
-    function continueTest()
-    {
       var cellsArray =
       [
         [false, false],
         [false, false],
         [false, false]
       ];
 
-      testTableSelection(gTree, cellsArray);
-      testSelectTableRow(gTree, 0, cellsArray);
-      testUnselectTableRow(gTree, 0, cellsArray);
+      testTableSelection("tree", cellsArray);
+      testSelectTableRow("tree", 0, cellsArray);
+      testUnselectTableRow("tree", 0, cellsArray);
 
       SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
-    addA11yLoadEvent(doTest);
+    addA11yXULTreeLoadEvent(doTest, "tree", new nsTableTreeView(3));
   ]]>
   </script>
 
   <hbox flex="1" style="overflow: auto;">
     <body xmlns="http://www.w3.org/1999/xhtml">
       <a target="_blank"
          href="https://bugzilla.mozilla.org/show_bug.cgi?id=503727"
          title="Reorganize implementation of XUL tree accessibility">
--- a/accessible/tests/mochitest/table/test_struct_tree.xul
+++ b/accessible/tests/mochitest/table/test_struct_tree.xul
@@ -21,48 +21,33 @@
   <script type="application/javascript"
           src="../table.js" />
 
   <script type="application/javascript">
   <![CDATA[
     ////////////////////////////////////////////////////////////////////////////
     // Test
 
-    var gTree = null;
-    var gTreeBox = null;
-    var gTreeView = null;
-
     // gA11yEventDumpID = "debug";
 
     function doTest()
     {
-      // Initialize the tree
-      gTree = document.getElementById("table");
-      gTreeBox = gTree.treeBoxObject;
-      gView = new nsTableTreeView(3);
-
-      waitForEvent(EVENT_REORDER, gTree, continueTest);
-      gTreeBox.view = gView;
-    }
-
-    function continueTest()
-    {
       var cellsArray = [
         [kDataCell, kDataCell],
         [kDataCell, kDataCell],
         [kDataCell, kDataCell]
       ];
 
-      testTableStruct(gTree, cellsArray, kTreeColumnHeader);
+      testTableStruct("table", cellsArray, kTreeColumnHeader);
 
       SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
-    addA11yLoadEvent(doTest);
+    addA11yXULTreeLoadEvent(doTest, "table", new nsTableTreeView(3));
   ]]>
   </script>
 
   <hbox flex="1" style="overflow: auto;">
     <body xmlns="http://www.w3.org/1999/xhtml">
       <a target="_blank"
          href="https://bugzilla.mozilla.org/show_bug.cgi?id=512424"
          title="implement IAccessibleTable2">
--- a/accessible/tests/mochitest/test_nsIAccessibleDocument.html
+++ b/accessible/tests/mochitest/test_nsIAccessibleDocument.html
@@ -35,17 +35,17 @@ https://bugzilla.mozilla.org/show_bug.cg
         // check if it is focusable, read-only.
         testStates(docAcc, (STATE_READONLY | STATE_FOCUSABLE));
 
         // No actions wanted on doc
         is(docAcc.numActions, 0, "Wrong number of actions for document!");
 
         // attributes should contain tag:body
         attributes = docAcc.attributes;
-        is(attributes.getStringProperty("tag"), "BODY",
+        is(attributes.getStringProperty("tag"), "body",
            "Wrong attribute on document!");
 
         // nsIAccessibleDocument
         // getRootDirectory() depends on broken chrome-harness.js include (bug
         // 736886)
         /*
         var rootDir = getRootDirectory(window.location.href);
         is(docAcc.URL, rootDir.path + "test_nsIAccessibleDocument.html",
--- a/accessible/tests/mochitest/treeview.js
+++ b/accessible/tests/mochitest/treeview.js
@@ -1,8 +1,59 @@
+/**
+ * Helper method to start a single XUL tree test.
+ */
+function loadXULTreeAndDoTest(aDoTestFunc, aTreeID, aTreeView)
+{
+  var doTestFunc = aDoTestFunc ? aDoTestFunc : gXULTreeLoadContext.doTestFunc;
+  var treeID = aTreeID ? aTreeID : gXULTreeLoadContext.treeID;
+  var treeView = aTreeView ? aTreeView : gXULTreeLoadContext.treeView;
+
+  function loadXULTree(aTreeID, aTreeView)
+  {
+    this.treeNode = getNode(aTreeID);
+
+    this.eventSeq = [
+      new invokerChecker(EVENT_REORDER, this.treeNode)
+    ];
+
+    this.invoke = function loadXULTree_invoke()
+    {
+      this.treeNode.treeBoxObject.view = aTreeView;
+    }
+
+    this.getID = function loadXULTree_getID()
+    {
+      return "Load XUL tree " + prettyName(aTreeID);
+    }
+  }
+
+  gXULTreeLoadContext.queue = new eventQueue();
+  gXULTreeLoadContext.queue.push(new loadXULTree(treeID, treeView));
+  gXULTreeLoadContext.queue.onFinish = function()
+  {
+    SimpleTest.executeSoon(doTestFunc);
+    return DO_NOT_FINISH_TEST;
+  }
+  gXULTreeLoadContext.queue.invoke();
+}
+
+/**
+ * Analogy of addA11yLoadEvent, nice helper to load XUL tree and start the test.
+ */
+function addA11yXULTreeLoadEvent(aDoTestFunc, aTreeID, aTreeView)
+{
+  gXULTreeLoadContext.doTestFunc = aDoTestFunc;
+  gXULTreeLoadContext.treeID = aTreeID;
+  gXULTreeLoadContext.treeView = aTreeView;
+
+  addA11yLoadEvent(loadXULTreeAndDoTest);
+}
+
+
 function nsTableTreeView(aRowCount)
 {
   this.__proto__ = new nsTreeView();
 
   for (var idx = 0; idx < aRowCount; idx++)
     this.mData.push(new treeItem("row" + String(idx) + "_"));
 }
 
@@ -227,8 +278,19 @@ function treeItem(aText, aOpen, aChildre
     this.children = aChildren;
 }
 
 function createAtom(aName)
 {
   return Components.classes["@mozilla.org/atom-service;1"]
     .getService(Components.interfaces.nsIAtomService).getAtom(aName);
 }
+
+/**
+ * Used in conjunction with loadXULTreeAndDoTest and addA11yXULTreeLoadEvent.
+ */
+var gXULTreeLoadContext =
+{
+  doTestFunc: null,
+  treeID: null,
+  treeView: null,
+  queue: null
+};
--- a/allmakefiles.sh
+++ b/allmakefiles.sh
@@ -69,16 +69,22 @@ config/doxygen.cfg
 config/expandlibs_config.py
 config/tests/src-simple/Makefile
 mfbt/Makefile
 probes/Makefile
 extensions/Makefile
 "
 
 if [ ! "$LIBXUL_SDK" ]; then
+  if [ "$STLPORT_SOURCES" ]; then
+    add_makefiles "
+      build/stlport/Makefile
+      build/stlport/stl/config/_android.h
+    "
+  fi
   add_makefiles "
     memory/mozalloc/Makefile
     mozglue/Makefile
     mozglue/build/Makefile
   "
   if [ "$MOZ_MEMORY" ]; then
     add_makefiles "
       memory/jemalloc/Makefile
--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@@ -35,46 +35,70 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #filter substitution
 
 pref("toolkit.defaultChromeURI", "chrome://browser/content/shell.xul");
 pref("browser.chromeURL", "chrome://browser/content/");
 #ifdef MOZ_OFFICIAL_BRANDING
-pref("browser.homescreenURL", "file:///system/home/homescreen.html");
+pref("browser.homescreenURL", "http://homescreen.gaiamobile.org/");
 #else
-pref("browser.homescreenURL", "file:///data/local/homescreen.html,file:///system/home/homescreen.html");
+pref("browser.homescreenURL", "http://homescreen.gaiamobile.org/");
 #endif
 
+// All the privileged domains
+// XXX TODO : we should read them from a file somewhere
+pref("b2g.privileged.domains", "http://browser.gaiamobile.org,
+	                            http://calculator.gaiamobile.org,
+	                            http://contacts.gaiamobile.org,
+	                            http://camera.gaiamobile.org,
+	                            http://clock.gaiamobile.org,
+	                            http://crystalskull.gaiamobile.org,
+	                            http://cubevid.gaiamobile.org,
+	                            http://dialer.gaiamobile.org,
+	                            http://gallery.gaiamobile.org,
+	                            http://homescreen.gaiamobile.org,
+	                            http://maps.gaiamobile.org,
+	                            http://market.gaiamobile.org,
+	                            http://music.gaiamobile.org,
+	                            http://penguinpop.gaiamobile.org,
+	                            http://settings.gaiamobile.org,
+	                            http://sms.gaiamobile.org,
+	                            http://towerjelly.gaiamobile.org,
+	                            http://video.gaiamobile.org");
+
 // URL for the dialer application.
-pref("dom.telephony.app.phone.url", "http://localhost:7777/data/local/apps/dialer/dialer.html,http://localhost:7777/data/local/apps/homescreen/homescreen.html,http://localhost:7777/apps/dialer/dialer.html,http://localhost:7777/apps/homescreen/homescreen.html");
+pref("dom.telephony.app.phone.url", "http://dialer.gaiamobile.org,http://homescreen.gaiamobile.org");
 
 // Device pixel to CSS px ratio, in percent. Set to -1 to calculate based on display density.
 pref("browser.viewport.scaleRatio", -1);
 
 /* disable text selection */
 pref("browser.ignoreNativeFrameTextSelection", true);
 
 /* cache prefs */
+#ifdef MOZ_WIDGET_GONK
 pref("browser.cache.disk.enable", true);
 pref("browser.cache.disk.capacity", 55000); // kilobytes
 pref("browser.cache.disk.parent_directory", "/cache");
+#endif
 pref("browser.cache.disk.smart_size.enabled", false);
 pref("browser.cache.disk.smart_size.first_run", false);
 
 pref("browser.cache.memory.enable", true);
 pref("browser.cache.memory.capacity", 1024); // kilobytes
 
 /* image cache prefs */
 pref("image.cache.size", 1048576); // bytes
 
 /* offline cache prefs */
 pref("browser.offline-apps.notify", false);
-pref("browser.cache.offline.enable", false);
+pref("browser.cache.offline.enable", true);
+pref("offline-apps.allow_by_default", true);
 
 /* protocol warning prefs */
 pref("network.protocol-handler.warn-external.tel", false);
 pref("network.protocol-handler.warn-external.mailto", false);
 pref("network.protocol-handler.warn-external.vnd.youtube", false);
 
 /* http prefs */
 pref("network.http.pipelining", true);
@@ -386,38 +410,38 @@ pref("security.fileuri.strict_origin_pol
 // Temporarily force-enable GL compositing.  This is default-disabled
 // deep within the bowels of the widgetry system.  Remove me when GL
 // compositing isn't default disabled in widget/android.
 pref("layers.acceleration.force-enabled", true);
 
 // screen.enabled and screen.brightness properties.
 pref("dom.screenEnabledProperty.enabled", true);
 pref("dom.screenBrightnessProperty.enabled", true);
-pref("dom.mozScreenWhitelist", "http://localhost:7777");
+pref("dom.mozScreenWhitelist", "http://homescreen.gaiamobile.org,http://settings.gaiamobile.org");
 
 // handle links targeting new windows
 // 1=current window/tab, 2=new window, 3=new tab in most recent window
 pref("browser.link.open_newwindow", 3);
 
 // 0: no restrictions - divert everything
 // 1: don't divert window.open at all
 // 2: don't divert window.open with features
 pref("browser.link.open_newwindow.restriction", 0);
 
 // Enable browser frame
 pref("dom.mozBrowserFramesEnabled", true);
-pref("dom.mozBrowserFramesWhitelist", "http://localhost:7777");
+pref("dom.mozBrowserFramesWhitelist", "http://homescreen.gaiamobile.org,http://browser.gaiamobile.org");
 
 // Temporary permission hack for WebSMS
 pref("dom.sms.enabled", true);
-pref("dom.sms.whitelist", "file://,http://localhost:7777");
+pref("dom.sms.whitelist", "file://,http://homescreen.gaiamobile.org,http://sms.gaiamobile.org");
 
 // Temporary permission hack for WebContacts
 pref("dom.mozContacts.enabled", true);
-pref("dom.mozContacts.whitelist", "http://localhost:7777");
+pref("dom.mozContacts.whitelist", "http://dialer.gaiamobile.org,http://sms.gaiamobile.org");
 
 // Ignore X-Frame-Options headers.
 pref("b2g.ignoreXFrameOptions", true);
 
 // controls if we want camera support
 pref("device.camera.enabled", true);
 pref("media.realtime_decoder.enabled", true);
 
@@ -435,17 +459,17 @@ pref("b2g.remote-js.enabled", true);
 pref("b2g.remote-js.port", 9999);
 
 // Handle hardware buttons in the b2g chrome package
 pref("b2g.keys.menu.enabled", true);
 pref("b2g.keys.search.enabled", false);
 
 // Screen timeout in minutes
 pref("power.screen.timeout", 60);
-pref("dom.power.whitelist", "http://localhost:7777");
+pref("dom.power.whitelist", "http://homescreen.gaiamobile.org,http://settings.gaiamobile.org");
 
 pref("full-screen-api.enabled", true);
 
 pref("media.volume.steps", 10);
 
 // Data connection settings. These will eventually live in the
 // navigator.settings API, or even in a database where we can look
 // it up automatically (bug 729440), but for this will have to do.
@@ -463,19 +487,22 @@ pref("marionette.defaultPrefs.port", 282
 pref("app.update.enabled", true);
 pref("app.update.auto", true);
 pref("app.update.silent", true);
 pref("app.update.mode", 0);
 pref("app.update.incompatible.mode", 0);
 pref("app.update.service.enabled", true);
 
 // The URL hosting the update manifest.
-//pref("app.update.url", "http://localhost/updates.xml");
+pref("app.update.url", "http://update.boot2gecko.org/m2.5/updates.xml");
 // Interval at which update manifest is fetched.  In units of seconds.
-pref("app.update.interval", 86400); // 24 hours
+pref("app.update.interval", 3600); // 1 hour
 // First interval to elapse before checking for update.  In units of
 // milliseconds.  Capped at 10 seconds.
 pref("app.update.timerFirstInterval", 30000);
+pref("app.update.timerMinimumDelay", 30); // seconds
+// Don't throttle background updates.
+pref("app.update.download.backgroundInterval", 0);
 
 // Enable update logging for now, to diagnose growing pains in the
 // field.
 pref("app.update.log", true);
 #endif
deleted file mode 100644
--- a/b2g/chrome/content/httpd.js
+++ /dev/null
@@ -1,5211 +0,0 @@
-/* -*- Mode: JavaScript; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim:set ts=2 sw=2 sts=2 et: */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is the httpd.js server.
- *
- * The Initial Developer of the Original Code is
- * Mozilla Corporation.
- * Portions created by the Initial Developer are Copyright (C) 2006
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *   Darin Fisher (v1, netwerk/test/TestServ.js)
- *   Christian Biesinger (v2, netwerk/test/unit/head_http_server.js)
- *   Jeff Walden <jwalden+code@mit.edu> (v3, netwerk/test/httpserver/httpd.js)
- *   Robert Sayre <sayrer@gmail.com>
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-/*
- * An implementation of an HTTP server both as a loadable script and as an XPCOM
- * component.  See the accompanying README file for user documentation on
- * httpd.js.
- */
-
-Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
-
-const Cc = Components.classes;
-const Ci = Components.interfaces;
-const Cr = Components.results;
-const Cu = Components.utils;
-const CC = Components.Constructor;
-
-const PR_UINT32_MAX = Math.pow(2, 32) - 1;
-
-/** True if debugging output is enabled, false otherwise. */
-var DEBUG = false; // non-const *only* so tweakable in server tests
-
-/** True if debugging output should be timestamped. */
-var DEBUG_TIMESTAMP = false; // non-const so tweakable in server tests
-
-var gGlobalObject = this;
-
-/**
- * Asserts that the given condition holds.  If it doesn't, the given message is
- * dumped, a stack trace is printed, and an exception is thrown to attempt to
- * stop execution (which unfortunately must rely upon the exception not being
- * accidentally swallowed by the code that uses it).
- */
-function NS_ASSERT(cond, msg)
-{
-  if (DEBUG && !cond)
-  {
-    dumpn("###!!!");
-    dumpn("###!!! ASSERTION" + (msg ? ": " + msg : "!"));
-    dumpn("###!!! Stack follows:");
-
-    var stack = new Error().stack.split(/\n/);
-    dumpn(stack.map(function(val) { return "###!!!   " + val; }).join("\n"));
-
-    throw Cr.NS_ERROR_ABORT;
-  }
-}
-
-/** Constructs an HTTP error object. */
-function HttpError(code, description)
-{
-  this.code = code;
-  this.description = description;
-}
-HttpError.prototype =
-{
-  toString: function()
-  {
-    return this.code + " " + this.description;
-  }
-};
-
-/**
- * Errors thrown to trigger specific HTTP server responses.
- */
-const HTTP_400 = new HttpError(400, "Bad Request");
-const HTTP_401 = new HttpError(401, "Unauthorized");
-const HTTP_402 = new HttpError(402, "Payment Required");
-const HTTP_403 = new HttpError(403, "Forbidden");
-const HTTP_404 = new HttpError(404, "Not Found");
-const HTTP_405 = new HttpError(405, "Method Not Allowed");
-const HTTP_406 = new HttpError(406, "Not Acceptable");
-const HTTP_407 = new HttpError(407, "Proxy Authentication Required");
-const HTTP_408 = new HttpError(408, "Request Timeout");
-const HTTP_409 = new HttpError(409, "Conflict");
-const HTTP_410 = new HttpError(410, "Gone");
-const HTTP_411 = new HttpError(411, "Length Required");
-const HTTP_412 = new HttpError(412, "Precondition Failed");
-const HTTP_413 = new HttpError(413, "Request Entity Too Large");
-const HTTP_414 = new HttpError(414, "Request-URI Too Long");
-const HTTP_415 = new HttpError(415, "Unsupported Media Type");
-const HTTP_417 = new HttpError(417, "Expectation Failed");
-
-const HTTP_500 = new HttpError(500, "Internal Server Error");
-const HTTP_501 = new HttpError(501, "Not Implemented");
-const HTTP_502 = new HttpError(502, "Bad Gateway");
-const HTTP_503 = new HttpError(503, "Service Unavailable");
-const HTTP_504 = new HttpError(504, "Gateway Timeout");
-const HTTP_505 = new HttpError(505, "HTTP Version Not Supported");
-
-/** Creates a hash with fields corresponding to the values in arr. */
-function array2obj(arr)
-{
-  var obj = {};
-  for (var i = 0; i < arr.length; i++)
-    obj[arr[i]] = arr[i];
-  return obj;
-}
-
-/** Returns an array of the integers x through y, inclusive. */
-function range(x, y)
-{
-  var arr = [];
-  for (var i = x; i <= y; i++)
-    arr.push(i);
-  return arr;
-}
-
-/** An object (hash) whose fields are the numbers of all HTTP error codes. */
-const HTTP_ERROR_CODES = array2obj(range(400, 417).concat(range(500, 505)));
-
-
-/**
- * The character used to distinguish hidden files from non-hidden files, a la
- * the leading dot in Apache.  Since that mechanism also hides files from
- * easy display in LXR, ls output, etc. however, we choose instead to use a
- * suffix character.  If a requested file ends with it, we append another
- * when getting the file on the server.  If it doesn't, we just look up that
- * file.  Therefore, any file whose name ends with exactly one of the character
- * is "hidden" and available for use by the server.
- */
-const HIDDEN_CHAR = "^";
-
-/**
- * The file name suffix indicating the file containing overridden headers for
- * a requested file.
- */
-const HEADERS_SUFFIX = HIDDEN_CHAR + "headers" + HIDDEN_CHAR;
-
-/** Type used to denote SJS scripts for CGI-like functionality. */
-const SJS_TYPE = "sjs";
-
-/** Base for relative timestamps produced by dumpn(). */
-var firstStamp = 0;
-
-/** dump(str) with a trailing "\n" -- only outputs if DEBUG. */
-function dumpn(str)
-{
-  if (DEBUG)
-  {
-    var prefix = "HTTPD-INFO | ";
-    if (DEBUG_TIMESTAMP)
-    {
-      if (firstStamp === 0)
-        firstStamp = Date.now();
-
-      var elapsed = Date.now() - firstStamp; // milliseconds
-      var min = Math.floor(elapsed / 60000);
-      var sec = (elapsed % 60000) / 1000;
-
-      if (sec < 10)
-        prefix += min + ":0" + sec.toFixed(3) + " | ";
-      else
-        prefix += min + ":" + sec.toFixed(3) + " | ";
-    }
-
-    dump(prefix + str + "\n");
-  }
-}
-
-/** Dumps the current JS stack if DEBUG. */
-function dumpStack()
-{
-  // peel off the frames for dumpStack() and Error()
-  var stack = new Error().stack.split(/\n/).slice(2);
-  stack.forEach(dumpn);
-}
-
-
-/** The XPCOM thread manager. */
-var gThreadManager = null;
-
-/** The XPCOM prefs service. */
-var gRootPrefBranch = null;
-function getRootPrefBranch()
-{
-  if (!gRootPrefBranch)
-  {
-    gRootPrefBranch = Cc["@mozilla.org/preferences-service;1"]
-                        .getService(Ci.nsIPrefBranch);
-  }
-  return gRootPrefBranch;
-}
-
-/**
- * JavaScript constructors for commonly-used classes; precreating these is a
- * speedup over doing the same from base principles.  See the docs at
- * http://developer.mozilla.org/en/docs/Components.Constructor for details.
- */
-const ServerSocket = CC("@mozilla.org/network/server-socket;1",
-                        "nsIServerSocket",
-                        "init");
-const ScriptableInputStream = CC("@mozilla.org/scriptableinputstream;1",
-                                 "nsIScriptableInputStream",
-                                 "init");
-const Pipe = CC("@mozilla.org/pipe;1",
-                "nsIPipe",
-                "init");
-const FileInputStream = CC("@mozilla.org/network/file-input-stream;1",
-                           "nsIFileInputStream",
-                           "init");
-const ConverterInputStream = CC("@mozilla.org/intl/converter-input-stream;1",
-                                "nsIConverterInputStream",
-                                "init");
-const WritablePropertyBag = CC("@mozilla.org/hash-property-bag;1",
-                               "nsIWritablePropertyBag2");
-const SupportsString = CC("@mozilla.org/supports-string;1",
-                          "nsISupportsString");
-
-/* These two are non-const only so a test can overwrite them. */
-var BinaryInputStream = CC("@mozilla.org/binaryinputstream;1",
-                           "nsIBinaryInputStream",
-                           "setInputStream");
-var BinaryOutputStream = CC("@mozilla.org/binaryoutputstream;1",
-                            "nsIBinaryOutputStream",
-                            "setOutputStream");
-
-/**
- * Returns the RFC 822/1123 representation of a date.
- *
- * @param date : Number
- *   the date, in milliseconds from midnight (00:00:00), January 1, 1970 GMT
- * @returns string
- *   the representation of the given date
- */
-function toDateString(date)
-{
-  //
-  // rfc1123-date = wkday "," SP date1 SP time SP "GMT"
-  // date1        = 2DIGIT SP month SP 4DIGIT
-  //                ; day month year (e.g., 02 Jun 1982)
-  // time         = 2DIGIT ":" 2DIGIT ":" 2DIGIT
-  //                ; 00:00:00 - 23:59:59
-  // wkday        = "Mon" | "Tue" | "Wed"
-  //              | "Thu" | "Fri" | "Sat" | "Sun"
-  // month        = "Jan" | "Feb" | "Mar" | "Apr"
-  //              | "May" | "Jun" | "Jul" | "Aug"
-  //              | "Sep" | "Oct" | "Nov" | "Dec"
-  //
-
-  const wkdayStrings = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
-  const monthStrings = ["Jan", "Feb", "Mar", "Apr", "May", "Jun",
-                        "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
-
-  /**
-   * Processes a date and returns the encoded UTC time as a string according to
-   * the format specified in RFC 2616.
-   *
-   * @param date : Date
-   *   the date to process
-   * @returns string
-   *   a string of the form "HH:MM:SS", ranging from "00:00:00" to "23:59:59"
-   */
-  function toTime(date)
-  {
-    var hrs = date.getUTCHours();
-    var rv  = (hrs < 10) ? "0" + hrs : hrs;
-    
-    var mins = date.getUTCMinutes();
-    rv += ":";
-    rv += (mins < 10) ? "0" + mins : mins;
-
-    var secs = date.getUTCSeconds();
-    rv += ":";
-    rv += (secs < 10) ? "0" + secs : secs;
-
-    return rv;
-  }
-
-  /**
-   * Processes a date and returns the encoded UTC date as a string according to
-   * the date1 format specified in RFC 2616.
-   *
-   * @param date : Date
-   *   the date to process
-   * @returns string
-   *   a string of the form "HH:MM:SS", ranging from "00:00:00" to "23:59:59"
-   */
-  function toDate1(date)
-  {
-    var day = date.getUTCDate();
-    var month = date.getUTCMonth();
-    var year = date.getUTCFullYear();
-
-    var rv = (day < 10) ? "0" + day : day;
-    rv += " " + monthStrings[month];
-    rv += " " + year;
-
-    return rv;
-  }
-
-  date = new Date(date);
-
-  const fmtString = "%wkday%, %date1% %time% GMT";
-  var rv = fmtString.replace("%wkday%", wkdayStrings[date.getUTCDay()]);
-  rv = rv.replace("%time%", toTime(date));
-  return rv.replace("%date1%", toDate1(date));
-}
-
-/**
- * Prints out a human-readable representation of the object o and its fields,
- * omitting those whose names begin with "_" if showMembers != true (to ignore
- * "private" properties exposed via getters/setters).
- */
-function printObj(o, showMembers)
-{
-  var s = "******************************\n";
-  s +=    "o = {\n";
-  for (var i in o)
-  {
-    if (typeof(i) != "string" ||
-        (showMembers || (i.length > 0 && i[0] != "_")))
-      s+= "      " + i + ": " + o[i] + ",\n";
-  }
-  s +=    "    };\n";
-  s +=    "******************************";
-  dumpn(s);
-}
-
-/**
- * Instantiates a new HTTP server.
- */
-function nsHttpServer()
-{
-  if (!gThreadManager)
-    gThreadManager = Cc["@mozilla.org/thread-manager;1"].getService();
-
-  /** The port on which this server listens. */
-  this._port = undefined;
-
-  /** The socket associated with this. */
-  this._socket = null;
-
-  /** The handler used to process requests to this server. */
-  this._handler = new ServerHandler(this);
-
-  /** Naming information for this server. */
-  this._identity = new ServerIdentity();
-
-  /**
-   * Indicates when the server is to be shut down at the end of the request.
-   */
-  this._doQuit = false;
-
-  /**
-   * True if the socket in this is closed (and closure notifications have been
-   * sent and processed if the socket was ever opened), false otherwise.
-   */
-  this._socketClosed = true;
-
-  /**
-   * Used for tracking existing connections and ensuring that all connections
-   * are properly cleaned up before server shutdown; increases by 1 for every
-   * new incoming connection.
-   */
-  this._connectionGen = 0;
-
-  /**
-   * Hash of all open connections, indexed by connection number at time of
-   * creation.
-   */
-  this._connections = {};
-}
-nsHttpServer.prototype =
-{
-  classID: Components.ID("{54ef6f81-30af-4b1d-ac55-8ba811293e41}"),
-
-  // NSISERVERSOCKETLISTENER
-
-  /**
-   * Processes an incoming request coming in on the given socket and contained
-   * in the given transport.
-   *
-   * @param socket : nsIServerSocket
-   *   the socket through which the request was served
-   * @param trans : nsISocketTransport
-   *   the transport for the request/response
-   * @see nsIServerSocketListener.onSocketAccepted
-   */
-  onSocketAccepted: function(socket, trans)
-  {
-    dumpn("*** onSocketAccepted(socket=" + socket + ", trans=" + trans + ")");
-
-    dumpn(">>> new connection on " + trans.host + ":" + trans.port);
-
-    const SEGMENT_SIZE = 8192;
-    const SEGMENT_COUNT = 1024;
-    try
-    {
-      var input = trans.openInputStream(0, SEGMENT_SIZE, SEGMENT_COUNT)
-                       .QueryInterface(Ci.nsIAsyncInputStream);
-      var output = trans.openOutputStream(0, 0, 0);
-    }
-    catch (e)
-    {
-      dumpn("*** error opening transport streams: " + e);
-      trans.close(Cr.NS_BINDING_ABORTED);
-      return;
-    }
-
-    var connectionNumber = ++this._connectionGen;
-
-    try
-    {
-      var conn = new Connection(input, output, this, socket.port, trans.port,
-                                connectionNumber);
-      var reader = new RequestReader(conn);
-
-      // XXX add request timeout functionality here!
-
-      // Note: must use main thread here, or we might get a GC that will cause
-      //       threadsafety assertions.  We really need to fix XPConnect so that
-      //       you can actually do things in multi-threaded JS.  :-(
-      input.asyncWait(reader, 0, 0, gThreadManager.mainThread);
-    }
-    catch (e)
-    {
-      // Assume this connection can't be salvaged and bail on it completely;
-      // don't attempt to close it so that we can assert that any connection
-      // being closed is in this._connections.
-      dumpn("*** error in initial request-processing stages: " + e);
-      trans.close(Cr.NS_BINDING_ABORTED);
-      return;
-    }
-
-    this._connections[connectionNumber] = conn;
-    dumpn("*** starting connection " + connectionNumber);
-  },
-
-  /**
-   * Called when the socket associated with this is closed.
-   *
-   * @param socket : nsIServerSocket
-   *   the socket being closed
-   * @param status : nsresult
-   *   the reason the socket stopped listening (NS_BINDING_ABORTED if the server
-   *   was stopped using nsIHttpServer.stop)
-   * @see nsIServerSocketListener.onStopListening
-   */
-  onStopListening: function(socket, status)
-  {
-    dumpn(">>> shutting down server on port " + socket.port);
-    this._socketClosed = true;
-    if (!this._hasOpenConnections())
-    {
-      dumpn("*** no open connections, notifying async from onStopListening");
-
-      // Notify asynchronously so that any pending teardown in stop() has a
-      // chance to run first.
-      var self = this;
-      var stopEvent =
-        {
-          run: function()
-          {
-            dumpn("*** _notifyStopped async callback");
-            self._notifyStopped();
-          }
-        };
-      gThreadManager.currentThread
-                    .dispatch(stopEvent, Ci.nsIThread.DISPATCH_NORMAL);
-    }
-  },
-
-  // NSIHTTPSERVER
-
-  //
-  // see nsIHttpServer.start
-  //
-  start: function(port)
-  {
-    this._start(port, "localhost")
-  },
-
-  _start: function(port, host)
-  {
-    if (this._socket)
-      throw Cr.NS_ERROR_ALREADY_INITIALIZED;
-
-    this._port = port;
-    this._doQuit = this._socketClosed = false;
-
-    this._host = host;
-
-    // The listen queue needs to be long enough to handle
-    // network.http.max-connections-per-server concurrent connections,
-    // plus a safety margin in case some other process is talking to
-    // the server as well.
-    var prefs = getRootPrefBranch();
-    var maxConnections =
-      prefs.getIntPref("network.http.max-connections-per-server") + 5;
-
-    try
-    {
-      var loopback = true;
-      if (this._host != "127.0.0.1" && this._host != "localhost") {
-        var loopback = false;
-      }
-
-      var socket = new ServerSocket(this._port,
-                                    loopback, // true = localhost, false = everybody
-                                    maxConnections);
-      dumpn(">>> listening on port " + socket.port + ", " + maxConnections +
-            " pending connections");
-      socket.asyncListen(this);
-      this._identity._initialize(port, host, true);
-      this._socket = socket;
-    }
-    catch (e)
-    {
-      dumpn("!!! could not start server on port " + port + ": " + e);
-      throw Cr.NS_ERROR_NOT_AVAILABLE;
-    }
-  },
-
-  //
-  // see nsIHttpServer.stop
-  //
-  stop: function(callback)
-  {
-    if (!callback)
-      throw Cr.NS_ERROR_NULL_POINTER;
-    if (!this._socket)
-      throw Cr.NS_ERROR_UNEXPECTED;
-
-    this._stopCallback = typeof callback === "function"
-                       ? callback
-                       : function() { callback.onStopped(); };
-
-    dumpn(">>> stopping listening on port " + this._socket.port);
-    this._socket.close();
-    this._socket = null;
-
-    // We can't have this identity any more, and the port on which we're running
-    // this server now could be meaningless the next time around.
-    this._identity._teardown();
-
-    this._doQuit = false;
-
-    // socket-close notification and pending request completion happen async
-  },
-
-  //
-  // see nsIHttpServer.registerFile
-  //
-  registerFile: function(path, file)
-  {
-    if (file && (!file.exists() || file.isDirectory()))
-      throw Cr.NS_ERROR_INVALID_ARG;
-
-    this._handler.registerFile(path, file);
-  },
-
-  //
-  // see nsIHttpServer.registerDirectory
-  //
-  registerDirectory: function(path, directory)
-  {
-    // XXX true path validation!
-    if (path.charAt(0) != "/" ||
-        path.charAt(path.length - 1) != "/" ||
-        (directory &&
-         (!directory.exists() || !directory.isDirectory())))
-      throw Cr.NS_ERROR_INVALID_ARG;
-
-    // XXX determine behavior of nonexistent /foo/bar when a /foo/bar/ mapping
-    //     exists!
-
-    this._handler.registerDirectory(path, directory);
-  },
-
-  //
-  // see nsIHttpServer.registerPathHandler
-  //
-  registerPathHandler: function(path, handler)
-  {
-    this._handler.registerPathHandler(path, handler);
-  },
-
-  //
-  // see nsIHttpServer.registerErrorHandler
-  //
-  registerErrorHandler: function(code, handler)
-  {
-    this._handler.registerErrorHandler(code, handler);
-  },
-
-  //
-  // see nsIHttpServer.setIndexHandler
-  //
-  setIndexHandler: function(handler)
-  {
-    this._handler.setIndexHandler(handler);
-  },
-
-  //
-  // see nsIHttpServer.registerContentType
-  //
-  registerContentType: function(ext, type)
-  {
-    this._handler.registerContentType(ext, type);
-  },
-
-  //
-  // see nsIHttpServer.serverIdentity
-  //
-  get identity()
-  {
-    return this._identity;
-  },
-
-  //
-  // see nsIHttpServer.getState
-  //
-  getState: function(path, k)
-  {
-    return this._handler._getState(path, k);
-  },
-
-  //
-  // see nsIHttpServer.setState
-  //
-  setState: function(path, k, v)
-  {
-    return this._handler._setState(path, k, v);
-  },
-
-  //
-  // see nsIHttpServer.getSharedState
-  //
-  getSharedState: function(k)
-  {
-    return this._handler._getSharedState(k);
-  },
-
-  //
-  // see nsIHttpServer.setSharedState
-  //
-  setSharedState: function(k, v)
-  {
-    return this._handler._setSharedState(k, v);
-  },
-
-  //
-  // see nsIHttpServer.getObjectState
-  //
-  getObjectState: function(k)
-  {
-    return this._handler._getObjectState(k);
-  },
-
-  //
-  // see nsIHttpServer.setObjectState
-  //
-  setObjectState: function(k, v)
-  {
-    return this._handler._setObjectState(k, v);
-  },
-
-
-  // NSISUPPORTS
-
-  //
-  // see nsISupports.QueryInterface
-  //
-  QueryInterface: function(iid)
-  {
-    if (iid.equals(Ci.nsIHttpServer) ||
-        iid.equals(Ci.nsIServerSocketListener) ||
-        iid.equals(Ci.nsISupports))
-      return this;
-
-    throw Cr.NS_ERROR_NO_INTERFACE;
-  },
-
-
-  // NON-XPCOM PUBLIC API
-
-  /**
-   * Returns true iff this server is not running (and is not in the process of
-   * serving any requests still to be processed when the server was last
-   * stopped after being run).
-   */
-  isStopped: function()
-  {
-    return this._socketClosed && !this._hasOpenConnections();
-  },
-
-  // PRIVATE IMPLEMENTATION
-
-  /** True if this server has any open connections to it, false otherwise. */
-  _hasOpenConnections: function()
-  {
-    //
-    // If we have any open connections, they're tracked as numeric properties on
-    // |this._connections|.  The non-standard __count__ property could be used
-    // to check whether there are any properties, but standard-wise, even
-    // looking forward to ES5, there's no less ugly yet still O(1) way to do
-    // this.
-    //
-    for (var n in this._connections)
-      return true;
-    return false;
-  },
-
-  /** Calls the server-stopped callback provided when stop() was called. */
-  _notifyStopped: function()
-  {
-    NS_ASSERT(this._stopCallback !== null, "double-notifying?");
-    NS_ASSERT(!this._hasOpenConnections(), "should be done serving by now");
-
-    //
-    // NB: We have to grab this now, null out the member, *then* call the
-    //     callback here, or otherwise the callback could (indirectly) futz with
-    //     this._stopCallback by starting and immediately stopping this, at
-    //     which point we'd be nulling out a field we no longer have a right to
-    //     modify.
-    //
-    var callback = this._stopCallback;
-    this._stopCallback = null;
-    try
-    {
-      callback();
-    }
-    catch (e)
-    {
-      // not throwing because this is specified as being usually (but not
-      // always) asynchronous
-      dump("!!! error running onStopped callback: " + e + "\n");
-    }
-  },
-
-  /**
-   * Notifies this server that the given connection has been closed.
-   *
-   * @param connection : Connection
-   *   the connection that was closed
-   */
-  _connectionClosed: function(connection)
-  {
-    NS_ASSERT(connection.number in this._connections,
-              "closing a connection " + this + " that we never added to the " +
-              "set of open connections?");
-    NS_ASSERT(this._connections[connection.number] === connection,
-              "connection number mismatch?  " +
-              this._connections[connection.number]);
-    delete this._connections[connection.number];
-
-    // Fire a pending server-stopped notification if it's our responsibility.
-    if (!this._hasOpenConnections() && this._socketClosed)
-      this._notifyStopped();
-    // Bug 508125: Add a GC here else we'll use gigabytes of memory running
-    // mochitests. We can't rely on xpcshell doing an automated GC, as that
-    // would interfere with testing GC stuff...
-    gc();
-  },
-
-  /**
-   * Requests that the server be shut down when possible.
-   */
-  _requestQuit: function()
-  {
-    dumpn(">>> requesting a quit");
-    dumpStack();
-    this._doQuit = true;
-  }
-};
-
-
-//
-// RFC 2396 section 3.2.2:
-//
-// host        = hostname | IPv4address
-// hostname    = *( domainlabel "." ) toplabel [ "." ]
-// domainlabel = alphanum | alphanum *( alphanum | "-" ) alphanum
-// toplabel    = alpha | alpha *( alphanum | "-" ) alphanum
-// IPv4address = 1*digit "." 1*digit "." 1*digit "." 1*digit
-//
-
-const HOST_REGEX =
-  new RegExp("^(?:" +
-               // *( domainlabel "." )
-               "(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\\.)*" +
-               // toplabel
-               "[a-z](?:[a-z0-9-]*[a-z0-9])?" +
-             "|" +
-               // IPv4 address 
-               "\\d+\\.\\d+\\.\\d+\\.\\d+" +
-             ")$",
-             "i");
-
-
-/**
- * Represents the identity of a server.  An identity consists of a set of
- * (scheme, host, port) tuples denoted as locations (allowing a single server to
- * serve multiple sites or to be used behind both HTTP and HTTPS proxies for any
- * host/port).  Any incoming request must be to one of these locations, or it
- * will be rejected with an HTTP 400 error.  One location, denoted as the
- * primary location, is the location assigned in contexts where a location
- * cannot otherwise be endogenously derived, such as for HTTP/1.0 requests.
- *
- * A single identity may contain at most one location per unique host/port pair;
- * other than that, no restrictions are placed upon what locations may
- * constitute an identity.
- */
-function ServerIdentity()
-{
-  /** The scheme of the primary location. */
-  this._primaryScheme = "http";
-
-  /** The hostname of the primary location. */
-  this._primaryHost = "127.0.0.1"
-
-  /** The port number of the primary location. */
-  this._primaryPort = -1;
-
-  /**
-   * The current port number for the corresponding server, stored so that a new
-   * primary location can always be set if the current one is removed.
-   */
-  this._defaultPort = -1;
-
-  /**
-   * Maps hosts to maps of ports to schemes, e.g. the following would represent
-   * https://example.com:789/ and http://example.org/:
-   *
-   *   {
-   *     "xexample.com": { 789: "https" },
-   *     "xexample.org": { 80: "http" }
-   *   }
-   *
-   * Note the "x" prefix on hostnames, which prevents collisions with special
-   * JS names like "prototype".
-   */
-  this._locations = { "xlocalhost": {} };
-}
-ServerIdentity.prototype =
-{
-  // NSIHTTPSERVERIDENTITY
-
-  //
-  // see nsIHttpServerIdentity.primaryScheme
-  //
-  get primaryScheme()
-  {
-    if (this._primaryPort === -1)
-      throw Cr.NS_ERROR_NOT_INITIALIZED;
-    return this._primaryScheme;
-  },
-
-  //
-  // see nsIHttpServerIdentity.primaryHost
-  //
-  get primaryHost()
-  {
-    if (this._primaryPort === -1)
-      throw Cr.NS_ERROR_NOT_INITIALIZED;
-    return this._primaryHost;
-  },
-
-  //
-  // see nsIHttpServerIdentity.primaryPort
-  //
-  get primaryPort()
-  {
-    if (this._primaryPort === -1)
-      throw Cr.NS_ERROR_NOT_INITIALIZED;
-    return this._primaryPort;
-  },
-
-  //
-  // see nsIHttpServerIdentity.add
-  //
-  add: function(scheme, host, port)
-  {
-    this._validate(scheme, host, port);
-
-    var entry = this._locations["x" + host];
-    if (!entry)
-      this._locations["x" + host] = entry = {};
-
-    entry[port] = scheme;
-  },
-
-  //
-  // see nsIHttpServerIdentity.remove
-  //
-  remove: function(scheme, host, port)
-  {
-    this._validate(scheme, host, port);
-
-    var entry = this._locations["x" + host];
-    if (!entry)
-      return false;
-
-    var present = port in entry;
-    delete entry[port];
-
-    if (this._primaryScheme == scheme &&
-        this._primaryHost == host &&
-        this._primaryPort == port &&
-        this._defaultPort !== -1)
-    {
-      // Always keep at least one identity in existence at any time, unless
-      // we're in the process of shutting down (the last condition above).
-      this._primaryPort = -1;
-      this._initialize(this._defaultPort, host, false);
-    }
-
-    return present;
-  },
-
-  //
-  // see nsIHttpServerIdentity.has
-  //
-  has: function(scheme, host, port)
-  {
-    this._validate(scheme, host, port);
-
-    return "x" + host in this._locations &&
-           scheme === this._locations["x" + host][port];
-  },
-
-  //
-  // see nsIHttpServerIdentity.has
-  //
-  getScheme: function(host, port)
-  {
-    this._validate("http", host, port);
-
-    var entry = this._locations["x" + host];
-    if (!entry)
-      return "";
-
-    return entry[port] || "";
-  },
-
-  //
-  // see nsIHttpServerIdentity.setPrimary
-  //
-  setPrimary: function(scheme, host, port)
-  {
-    this._validate(scheme, host, port);
-
-    this.add(scheme, host, port);
-
-    this._primaryScheme = scheme;
-    this._primaryHost = host;
-    this._primaryPort = port;
-  },
-
-
-  // NSISUPPORTS
-
-  //
-  // see nsISupports.QueryInterface
-  //
-  QueryInterface: function(iid)
-  {
-    if (iid.equals(Ci.nsIHttpServerIdentity) || iid.equals(Ci.nsISupports))
-      return this;
-
-    throw Cr.NS_ERROR_NO_INTERFACE;
-  },
-
-
-  // PRIVATE IMPLEMENTATION
-
-  /**
-   * Initializes the primary name for the corresponding server, based on the
-   * provided port number.
-   */
-  _initialize: function(port, host, addSecondaryDefault)
-  {
-    this._host = host;
-    if (this._primaryPort !== -1)
-      this.add("http", host, port);
-    else
-      this.setPrimary("http", "localhost", port);
-    this._defaultPort = port;
-
-    // Only add this if we're being called at server startup
-    if (addSecondaryDefault && host != "127.0.0.1")
-      this.add("http", "127.0.0.1", port);
-  },
-
-  /**
-   * Called at server shutdown time, unsets the primary location only if it was
-   * the default-assigned location and removes the default location from the
-   * set of locations used.
-   */
-  _teardown: function()
-  {
-    if (this._host != "127.0.0.1") {
-      // Not the default primary location, nothing special to do here
-      this.remove("http", "127.0.0.1", this._defaultPort);
-    }
-    
-    // This is a *very* tricky bit of reasoning here; make absolutely sure the
-    // tests for this code pass before you commit changes to it.
-    if (this._primaryScheme == "http" &&
-        this._primaryHost == this._host &&
-        this._primaryPort == this._defaultPort)
-    {
-      // Make sure we don't trigger the readding logic in .remove(), then remove
-      // the default location.
-      var port = this._defaultPort;
-      this._defaultPort = -1;
-      this.remove("http", this._host, port);
-
-      // Ensure a server start triggers the setPrimary() path in ._initialize()
-      this._primaryPort = -1;
-    }
-    else
-    {
-      // No reason not to remove directly as it's not our primary location
-      this.remove("http", this._host, this._defaultPort);
-    }
-  },
-
-  /**
-   * Ensures scheme, host, and port are all valid with respect to RFC 2396.
-   *
-   * @throws NS_ERROR_ILLEGAL_VALUE
-   *   if any argument doesn't match the corresponding production
-   */
-  _validate: function(scheme, host, port)
-  {
-    if (scheme !== "http" && scheme !== "https")
-    {
-      dumpn("*** server only supports http/https schemes: '" + scheme + "'");
-      dumpStack();
-      throw Cr.NS_ERROR_ILLEGAL_VALUE;
-    }
-    if (!HOST_REGEX.test(host))
-    {
-      dumpn("*** unexpected host: '" + host + "'");
-      throw Cr.NS_ERROR_ILLEGAL_VALUE;
-    }
-    if (port < 0 || port > 65535)
-    {
-      dumpn("*** unexpected port: '" + port + "'");
-      throw Cr.NS_ERROR_ILLEGAL_VALUE;
-    }
-  }
-};
-
-
-/**
- * Represents a connection to the server (and possibly in the future the thread
- * on which the connection is processed).
- *
- * @param input : nsIInputStream
- *   stream from which incoming data on the connection is read
- * @param output : nsIOutputStream
- *   stream to write data out the connection
- * @param server : nsHttpServer
- *   the server handling the connection
- * @param port : int
- *   the port on which the server is running
- * @param outgoingPort : int
- *   the outgoing port used by this connection
- * @param number : uint
- *   a serial number used to uniquely identify this connection
- */
-function Connection(input, output, server, port, outgoingPort, number)
-{
-  dumpn("*** opening new connection " + number + " on port " + outgoingPort);
-
-  /** Stream of incoming data. */
-  this.input = input;
-
-  /** Stream for outgoing data. */
-  this.output = output;
-
-  /** The server associated with this request. */
-  this.server = server;
-
-  /** The port on which the server is running. */
-  this.port = port;
-
-  /** The outgoing poort used by this connection. */
-  this._outgoingPort = outgoingPort;
-
-  /** The serial number of this connection. */
-  this.number = number;
-
-  /**
-   * The request for which a response is being generated, null if the
-   * incoming request has not been fully received or if it had errors.
-   */
-  this.request = null;
-
-  /** State variables for debugging. */
-  this._closed = this._processed = false;
-}
-Connection.prototype =
-{
-  /** Closes this connection's input/output streams. */
-  close: function()
-  {
-    dumpn("*** closing connection " + this.number +
-          " on port " + this._outgoingPort);
-
-    this.input.close();
-    this.output.close();
-    this._closed = true;
-
-    var server = this.server;
-    server._connectionClosed(this);
-
-    // If an error triggered a server shutdown, act on it now
-    if (server._doQuit)
-      server.stop(function() { /* not like we can do anything better */ });
-  },
-
-  /**
-   * Initiates processing of this connection, using the data in the given
-   * request.
-   *
-   * @param request : Request
-   *   the request which should be processed
-   */
-  process: function(request)
-  {
-    NS_ASSERT(!this._closed && !this._processed);
-
-    this._processed = true;
-
-    this.request = request;
-    this.server._handler.handleResponse(this);
-  },
-
-  /**
-   * Initiates processing of this connection, generating a response with the
-   * given HTTP error code.
-   *
-   * @param code : uint
-   *   an HTTP code, so in the range [0, 1000)
-   * @param request : Request
-   *   incomplete data about the incoming request (since there were errors
-   *   during its processing
-   */
-  processError: function(code, request)
-  {
-    NS_ASSERT(!this._closed && !this._processed);
-
-    this._processed = true;
-    this.request = request;
-    this.server._handler.handleError(code, this);
-  },
-
-  /** Converts this to a string for debugging purposes. */
-  toString: function()
-  {
-    return "<Connection(" + this.number +
-           (this.request ? ", " + this.request.path : "") +"): " +
-           (this._closed ? "closed" : "open") + ">";
-  }
-};
-
-
-
-/** Returns an array of count bytes from the given input stream. */
-function readBytes(inputStream, count)
-{
-  return new BinaryInputStream(inputStream).readByteArray(count);
-}
-
-
-
-/** Request reader processing states; see RequestReader for details. */
-const READER_IN_REQUEST_LINE = 0;
-const READER_IN_HEADERS      = 1;
-const READER_IN_BODY         = 2;
-const READER_FINISHED        = 3;
-
-
-/**
- * Reads incoming request data asynchronously, does any necessary preprocessing,
- * and forwards it to the request handler.  Processing occurs in three states:
- *
- *   READER_IN_REQUEST_LINE     Reading the request's status line
- *   READER_IN_HEADERS          Reading headers in the request
- *   READER_IN_BODY             Reading the body of the request
- *   READER_FINISHED            Entire request has been read and processed
- *
- * During the first two stages, initial metadata about the request is gathered
- * into a Request object.  Once the status line and headers have been processed,
- * we start processing the body of the request into the Request.  Finally, when
- * the entire body has been read, we create a Response and hand it off to the
- * ServerHandler to be given to the appropriate request handler.
- *
- * @param connection : Connection
- *   the connection for the request being read
- */
-function RequestReader(connection)
-{
-  /** Connection metadata for this request. */
-  this._connection = connection;
-
-  /**
-   * A container providing line-by-line access to the raw bytes that make up the
-   * data which has been read from the connection but has not yet been acted
-   * upon (by passing it to the request handler or by extracting request
-   * metadata from it).
-   */
-  this._data = new LineData();
-
-  /**
-   * The amount of data remaining to be read from the body of this request.
-   * After all headers in the request have been read this is the value in the
-   * Content-Length header, but as the body is read its value decreases to zero.
-   */
-  this._contentLength = 0;
-
-  /** The current state of parsing the incoming request. */
-  this._state = READER_IN_REQUEST_LINE;
-
-  /** Metadata constructed from the incoming request for the request handler. */
-  this._metadata = new Request(connection.port);
-
-  /**
-   * Used to preserve state if we run out of line data midway through a
-   * multi-line header.  _lastHeaderName stores the name of the header, while
-   * _lastHeaderValue stores the value we've seen so far for the header.
-   *
-   * These fields are always either both undefined or both strings.
-   */
-  this._lastHeaderName = this._lastHeaderValue = undefined;
-}
-RequestReader.prototype =
-{
-  // NSIINPUTSTREAMCALLBACK
-
-  /**
-   * Called when more data from the incoming request is available.  This method
-   * then reads the available data from input and deals with that data as
-   * necessary, depending upon the syntax of already-downloaded data.
-   *
-   * @param input : nsIAsyncInputStream
-   *   the stream of incoming data from the connection
-   */
-  onInputStreamReady: function(input)
-  {
-    dumpn("*** onInputStreamReady(input=" + input + ") on thread " +
-          gThreadManager.currentThread + " (main is " +
-          gThreadManager.mainThread + ")");
-    dumpn("*** this._state == " + this._state);
-
-    // Handle cases where we get more data after a request error has been
-    // discovered but *before* we can close the connection.
-    var data = this._data;
-    if (!data)
-      return;
-
-    try
-    {
-      data.appendBytes(readBytes(input, input.available()));
-    }
-    catch (e)
-    {
-      if (streamClosed(e))
-      {
-        dumpn("*** WARNING: unexpected error when reading from socket; will " +
-              "be treated as if the input stream had been closed");
-        dumpn("*** WARNING: actual error was: " + e);
-      }
-
-      // We've lost a race -- input has been closed, but we're still expecting
-      // to read more data.  available() will throw in this case, and since
-      // we're dead in the water now, destroy the connection.
-      dumpn("*** onInputStreamReady called on a closed input, destroying " +
-            "connection");
-      this._connection.close();
-      return;
-    }
-
-    switch (this._state)
-    {
-      default:
-        NS_ASSERT(false, "invalid state: " + this._state);
-        break;
-
-      case READER_IN_REQUEST_LINE:
-        if (!this._processRequestLine())
-          break;
-        /* fall through */
-
-      case READER_IN_HEADERS:
-        if (!this._processHeaders())
-          break;
-        /* fall through */
-
-      case READER_IN_BODY:
-        this._processBody();
-    }
-
-    if (this._state != READER_FINISHED)
-      input.asyncWait(this, 0, 0, gThreadManager.currentThread);
-  },
-
-  //
-  // see nsISupports.QueryInterface
-  //
-  QueryInterface: function(aIID)
-  {
-    if (aIID.equals(Ci.nsIInputStreamCallback) ||
-        aIID.equals(Ci.nsISupports))
-      return this;
-
-    throw Cr.NS_ERROR_NO_INTERFACE;
-  },
-
-
-  // PRIVATE API
-
-  /**
-   * Processes unprocessed, downloaded data as a request line.
-   *
-   * @returns boolean
-   *   true iff the request line has been fully processed
-   */
-  _processRequestLine: function()
-  {
-    NS_ASSERT(this._state == READER_IN_REQUEST_LINE);
-
-    // Servers SHOULD ignore any empty line(s) received where a Request-Line
-    // is expected (section 4.1).
-    var data = this._data;
-    var line = {};
-    var readSuccess;
-    while ((readSuccess = data.readLine(line)) && line.value == "")
-      dumpn("*** ignoring beginning blank line...");
-
-    // if we don't have a full line, wait until we do
-    if (!readSuccess)
-      return false;
-
-    // we have the first non-blank line
-    try
-    {
-      this._parseRequestLine(line.value);
-      this._state = READER_IN_HEADERS;
-      return true;
-    }
-    catch (e)
-    {
-      this._handleError(e);
-      return false;
-    }
-  },
-
-  /**
-   * Processes stored data, assuming it is either at the beginning or in
-   * the middle of processing request headers.
-   *
-   * @returns boolean
-   *   true iff header data in the request has been fully processed
-   */
-  _processHeaders: function()
-  {
-    NS_ASSERT(this._state == READER_IN_HEADERS);
-
-    // XXX things to fix here:
-    //
-    // - need to support RFC 2047-encoded non-US-ASCII characters
-
-    try
-    {
-      var done = this._parseHeaders();
-      if (done)
-      {
-        var request = this._metadata;
-
-        // XXX this is wrong for requests with transfer-encodings applied to
-        //     them, particularly chunked (which by its nature can have no
-        //     meaningful Content-Length header)!
-        this._contentLength = request.hasHeader("Content-Length")
-                            ? parseInt(request.getHeader("Content-Length"), 10)
-                            : 0;
-        dumpn("_processHeaders, Content-length=" + this._contentLength);
-
-        this._state = READER_IN_BODY;
-      }
-      return done;
-    }
-    catch (e)
-    {
-      this._handleError(e);
-      return false;
-    }
-  },
-
-  /**
-   * Processes stored data, assuming it is either at the beginning or in
-   * the middle of processing the request body.
-   *
-   * @returns boolean
-   *   true iff the request body has been fully processed
-   */
-  _processBody: function()
-  {
-    NS_ASSERT(this._state == READER_IN_BODY);
-
-    // XXX handle chunked transfer-coding request bodies!
-
-    try
-    {
-      if (this._contentLength > 0)
-      {
-        var data = this._data.purge();
-        var count = Math.min(data.length, this._contentLength);
-        dumpn("*** loading data=" + data + " len=" + data.length +
-              " excess=" + (data.length - count));
-
-        var bos = new BinaryOutputStream(this._metadata._bodyOutputStream);
-        bos.writeByteArray(data, count);
-        this._contentLength -= count;
-      }
-
-      dumpn("*** remaining body data len=" + this._contentLength);
-      if (this._contentLength == 0)
-      {
-        this._validateRequest();
-        this._state = READER_FINISHED;
-        this._handleResponse();
-        return true;
-      }
-      
-      return false;
-    }
-    catch (e)
-    {
-      this._handleError(e);
-      return false;
-    }
-  },
-
-  /**
-   * Does various post-header checks on the data in this request.
-   *
-   * @throws : HttpError
-   *   if the request was malformed in some way
-   */
-  _validateRequest: function()
-  {
-    NS_ASSERT(this._state == READER_IN_BODY);
-
-    dumpn("*** _validateRequest");
-
-    var metadata = this._metadata;
-    var headers = metadata._headers;
-
-    // 19.6.1.1 -- servers MUST report 400 to HTTP/1.1 requests w/o Host header
-    var identity = this._connection.server.identity;
-    if (metadata._httpVersion.atLeast(nsHttpVersion.HTTP_1_1))
-    {
-      if (!headers.hasHeader("Host"))
-      {
-        dumpn("*** malformed HTTP/1.1 or greater request with no Host header!");
-        throw HTTP_400;
-      }
-
-      // If the Request-URI wasn't absolute, then we need to determine our host.
-      // We have to determine what scheme was used to access us based on the
-      // server identity data at this point, because the request just doesn't
-      // contain enough data on its own to do this, sadly.
-      if (!metadata._host)
-      {
-        var host, port;
-        var hostPort = headers.getHeader("Host");
-        var colon = hostPort.indexOf(":");
-        if (colon < 0)
-        {
-          host = hostPort;
-          port = "";
-        }
-        else
-        {
-          host = hostPort.substring(0, colon);
-          port = hostPort.substring(colon + 1);
-        }
-
-        // NB: We allow an empty port here because, oddly, a colon may be
-        //     present even without a port number, e.g. "example.com:"; in this
-        //     case the default port applies.
-        if (!HOST_REGEX.test(host) || !/^\d*$/.test(port))
-        {
-          dumpn("*** malformed hostname (" + hostPort + ") in Host " +
-                "header, 400 time");
-          throw HTTP_400;
-        }
-
-        // If we're not given a port, we're stuck, because we don't know what
-        // scheme to use to look up the correct port here, in general.  Since
-        // the HTTPS case requires a tunnel/proxy and thus requires that the
-        // requested URI be absolute (and thus contain the necessary
-        // information), let's assume HTTP will prevail and use that.
-        port = +port || 80;
-
-        var scheme = identity.getScheme(host, port);
-        if (!scheme)
-        {
-          dumpn("*** unrecognized hostname (" + hostPort + ") in Host " +
-                "header, 400 time");
-          throw HTTP_400;
-        }
-
-        metadata._scheme = scheme;
-        metadata._host = host;
-        metadata._port = port;
-      }
-    }
-    else
-    {
-      NS_ASSERT(metadata._host === undefined,
-                "HTTP/1.0 doesn't allow absolute paths in the request line!");
-
-      metadata._scheme = identity.primaryScheme;
-      metadata._host = identity.primaryHost;
-      metadata._port = identity.primaryPort;
-    }
-
-    NS_ASSERT(identity.has(metadata._scheme, metadata._host, metadata._port),
-              "must have a location we recognize by now!");
-  },
-
-  /**
-   * Handles responses in case of error, either in the server or in the request.
-   *
-   * @param e
-   *   the specific error encountered, which is an HttpError in the case where
-   *   the request is in some way invalid or cannot be fulfilled; if this isn't
-   *   an HttpError we're going to be paranoid and shut down, because that
-   *   shouldn't happen, ever
-   */
-  _handleError: function(e)
-  {
-    // Don't fall back into normal processing!
-    this._state = READER_FINISHED;
-
-    var server = this._connection.server;
-    if (e instanceof HttpError)
-    {
-      var code = e.code;
-    }
-    else
-    {
-      dumpn("!!! UNEXPECTED ERROR: " + e +
-            (e.lineNumber ? ", line " + e.lineNumber : ""));
-
-      // no idea what happened -- be paranoid and shut down
-      code = 500;
-      server._requestQuit();
-    }
-
-    // make attempted reuse of data an error
-    this._data = null;
-
-    this._connection.processError(code, this._metadata);
-  },
-
-  /**
-   * Now that we've read the request line and headers, we can actually hand off
-   * the request to be handled.
-   *
-   * This method is called once per request, after the request line and all
-   * headers and the body, if any, have been received.
-   */
-  _handleResponse: function()
-  {
-    NS_ASSERT(this._state == READER_FINISHED);
-
-    // We don't need the line-based data any more, so make attempted reuse an
-    // error.
-    this._data = null;
-
-    this._connection.process(this._metadata);
-  },
-
-
-  // PARSING
-
-  /**
-   * Parses the request line for the HTTP request associated with this.
-   *
-   * @param line : string
-   *   the request line
-   */
-  _parseRequestLine: function(line)
-  {
-    NS_ASSERT(this._state == READER_IN_REQUEST_LINE);
-
-    dumpn("*** _parseRequestLine('" + line + "')");
-
-    var metadata = this._metadata;
-
-    // clients and servers SHOULD accept any amount of SP or HT characters
-    // between fields, even though only a single SP is required (section 19.3)
-    var request = line.split(/[ \t]+/);
-    if (!request || request.length != 3)
-      throw HTTP_400;
-
-    metadata._method = request[0];
-
-    // get the HTTP version
-    var ver = request[2];
-    var match = ver.match(/^HTTP\/(\d+\.\d+)$/);
-    if (!match)
-      throw HTTP_400;
-
-    // determine HTTP version
-    try
-    {
-      metadata._httpVersion = new nsHttpVersion(match[1]);
-      if (!metadata._httpVersion.atLeast(nsHttpVersion.HTTP_1_0))
-        throw "unsupported HTTP version";
-    }
-    catch (e)
-    {
-      // we support HTTP/1.0 and HTTP/1.1 only
-      throw HTTP_501;
-    }
-
-
-    var fullPath = request[1];
-    var serverIdentity = this._connection.server.identity;
-
-    var scheme, host, port;
-
-    if (fullPath.charAt(0) != "/")
-    {
-      // No absolute paths in the request line in HTTP prior to 1.1
-      if (!metadata._httpVersion.atLeast(nsHttpVersion.HTTP_1_1))
-        throw HTTP_400;
-
-      try
-      {
-        var uri = Cc["@mozilla.org/network/io-service;1"]
-                    .getService(Ci.nsIIOService)
-                    .newURI(fullPath, null, null);
-        fullPath = uri.path;
-        scheme = uri.scheme;
-        host = metadata._host = uri.asciiHost;
-        port = uri.port;
-        if (port === -1)
-        {
-          if (scheme === "http")
-            port = 80;
-          else if (scheme === "https")
-            port = 443;
-          else
-            throw HTTP_400;
-        }
-      }
-      catch (e)
-      {
-        // If the host is not a valid host on the server, the response MUST be a
-        // 400 (Bad Request) error message (section 5.2).  Alternately, the URI
-        // is malformed.
-        throw HTTP_400;
-      }
-
-      if (!serverIdentity.has(scheme, host, port) || fullPath.charAt(0) != "/")
-        throw HTTP_400;
-    }
-
-    var splitter = fullPath.indexOf("?");
-    if (splitter < 0)
-    {
-      // _queryString already set in ctor
-      metadata._path = fullPath;
-    }
-    else
-    {
-      metadata._path = fullPath.substring(0, splitter);
-      metadata._queryString = fullPath.substring(splitter + 1);
-    }
-
-    metadata._scheme = scheme;
-    metadata._host = host;
-    metadata._port = port;
-  },
-
-  /**
-   * Parses all available HTTP headers in this until the header-ending CRLFCRLF,
-   * adding them to the store of headers in the request.
-   *
-   * @throws
-   *   HTTP_400 if the headers are malformed
-   * @returns boolean
-   *   true if all headers have now been processed, false otherwise
-   */
-  _parseHeaders: function()
-  {
-    NS_ASSERT(this._state == READER_IN_HEADERS);
-
-    dumpn("*** _parseHeaders");
-
-    var data = this._data;
-
-    var headers = this._metadata._headers;
-    var lastName = this._lastHeaderName;
-    var lastVal = this._lastHeaderValue;
-
-    var line = {};
-    while (true)
-    {
-      NS_ASSERT(!((lastVal === undefined) ^ (lastName === undefined)),
-                lastName === undefined ?
-                  "lastVal without lastName?  lastVal: '" + lastVal + "'" :
-                  "lastName without lastVal?  lastName: '" + lastName + "'");
-
-      if (!data.readLine(line))
-      {
-        // save any data we have from the header we might still be processing
-        this._lastHeaderName = lastName;
-        this._lastHeaderValue = lastVal;
-        return false;
-      }
-
-      var lineText = line.value;
-      var firstChar = lineText.charAt(0);
-
-      // blank line means end of headers
-      if (lineText == "")
-      {
-        // we're finished with the previous header
-        if (lastName)
-        {
-          try
-          {
-            headers.setHeader(lastName, lastVal, true);
-          }
-          catch (e)
-          {
-            dumpn("*** e == " + e);
-            throw HTTP_400;
-          }
-        }
-        else
-        {
-          // no headers in request -- valid for HTTP/1.0 requests
-        }
-
-        // either way, we're done processing headers
-        this._state = READER_IN_BODY;
-        return true;
-      }
-      else if (firstChar == " " || firstChar == "\t")
-      {
-        // multi-line header if we've already seen a header line
-        if (!lastName)
-        {
-          // we don't have a header to continue!
-          throw HTTP_400;
-        }
-
-        // append this line's text to the value; starts with SP/HT, so no need
-        // for separating whitespace
-        lastVal += lineText;
-      }
-      else
-      {
-        // we have a new header, so set the old one (if one existed)
-        if (lastName)
-        {
-          try
-          {
-            headers.setHeader(lastName, lastVal, true);
-          }
-          catch (e)
-          {
-            dumpn("*** e == " + e);
-            throw HTTP_400;
-          }
-        }
-
-        var colon = lineText.indexOf(":"); // first colon must be splitter
-        if (colon < 1)
-        {
-          // no colon or missing header field-name
-          throw HTTP_400;
-        }
-
-        // set header name, value (to be set in the next loop, usually)
-        lastName = lineText.substring(0, colon);
-        lastVal = lineText.substring(colon + 1);
-      } // empty, continuation, start of header
-    } // while (true)
-  }
-};
-
-
-/** The character codes for CR and LF. */
-const CR = 0x0D, LF = 0x0A;
-
-/**
- * Calculates the number of characters before the first CRLF pair in array, or
- * -1 if the array contains no CRLF pair.
- *
- * @param array : Array
- *   an array of numbers in the range [0, 256), each representing a single
- *   character; the first CRLF is the lowest index i where
- *   |array[i] == "\r".charCodeAt(0)| and |array[i+1] == "\n".charCodeAt(0)|,
- *   if such an |i| exists, and -1 otherwise
- * @param start : uint
- *   start index from which to begin searching in array
- * @returns int
- *   the index of the first CRLF if any were present, -1 otherwise
- */
-function findCRLF(array, start)
-{
-  for (var i = array.indexOf(CR, start); i >= 0; i = array.indexOf(CR, i + 1))
-  {
-    if (array[i + 1] == LF)
-      return i;
-  }
-  return -1;
-}
-
-
-/**
- * A container which provides line-by-line access to the arrays of bytes with
- * which it is seeded.
- */
-function LineData()
-{
-  /** An array of queued bytes from which to get line-based characters. */
-  this._data = [];
-
-  /** Start index from which to search for CRLF. */
-  this._start = 0;
-}
-LineData.prototype =
-{
-  /**
-   * Appends the bytes in the given array to the internal data cache maintained
-   * by this.
-   */
-  appendBytes: function(bytes)
-  {
-    var count = bytes.length;
-    var quantum = 262144; // just above half SpiderMonkey's argument-count limit
-    if (count < quantum)
-    {
-      Array.prototype.push.apply(this._data, bytes);
-      return;
-    }
-
-    // Large numbers of bytes may cause Array.prototype.push to be called with
-    // more arguments than the JavaScript engine supports.  In that case append
-    // bytes in fixed-size amounts until all bytes are appended.
-    for (var start = 0; start < count; start += quantum)
-    {
-      var slice = bytes.slice(start, Math.min(start + quantum, count));
-      Array.prototype.push.apply(this._data, slice);
-    }
-  },
-
-  /**
-   * Removes and returns a line of data, delimited by CRLF, from this.
-   *
-   * @param out
-   *   an object whose "value" property will be set to the first line of text
-   *   present in this, sans CRLF, if this contains a full CRLF-delimited line
-   *   of text; if this doesn't contain enough data, the value of the property
-   *   is undefined
-   * @returns boolean
-   *   true if a full line of data could be read from the data in this, false
-   *   otherwise
-   */
-  readLine: function(out)
-  {
-    var data = this._data;
-    var length = findCRLF(data, this._start);
-    if (length < 0)
-    {
-      this._start = data.length;
-      return false;
-    }
-
-    // Reset for future lines.
-    this._start = 0;
-
-    //
-    // We have the index of the CR, so remove all the characters, including
-    // CRLF, from the array with splice, and convert the removed array
-    // (excluding the trailing CRLF characters) into the corresponding string.
-    //
-    var leading = data.splice(0, length + 2);
-    var quantum = 262144;
-    var line = "";
-    for (var start = 0; start < length; start += quantum)
-    {
-      var slice = leading.slice(start, Math.min(start + quantum, length));
-      line += String.fromCharCode.apply(null, slice);
-    }
-
-    out.value = line;
-    return true;
-  },
-
-  /**
-   * Removes the bytes currently within this and returns them in an array.
-   *
-   * @returns Array
-   *   the bytes within this when this method is called
-   */
-  purge: function()
-  {
-    var data = this._data;
-    this._data = [];
-    return data;
-  }
-};
-
-
-
-/**
- * Creates a request-handling function for an nsIHttpRequestHandler object.
- */
-function createHandlerFunc(handler)
-{
-  return function(metadata, response) { handler.handle(metadata, response); };
-}
-
-
-/**
- * The default handler for directories; writes an HTML response containing a
- * slightly-formatted directory listing.
- */
-function defaultIndexHandler(metadata, response)
-{
-  response.setHeader("Content-Type", "text/html", false);
-
-  var path = htmlEscape(decodeURI(metadata.path));
-
-  //
-  // Just do a very basic bit of directory listings -- no need for too much
-  // fanciness, especially since we don't have a style sheet in which we can
-  // stick rules (don't want to pollute the default path-space).
-  //
-
-  var body = '<html>\
-                <head>\
-                  <title>' + path + '</title>\
-                </head>\
-                <body>\
-                  <h1>' + path + '</h1>\
-                  <ol style="list-style-type: none">';
-
-  var directory = metadata.getProperty("directory");
-  NS_ASSERT(directory && directory.isDirectory());
-
-  var fileList = [];
-  var files = directory.directoryEntries;
-  while (files.hasMoreElements())
-  {
-    var f = files.getNext().QueryInterface(Ci.nsIFile);
-    var name = f.leafName;
-    if (!f.isHidden() &&
-        (name.charAt(name.length - 1) != HIDDEN_CHAR ||
-         name.charAt(name.length - 2) == HIDDEN_CHAR))
-      fileList.push(f);
-  }
-
-  fileList.sort(fileSort);
-
-  for (var i = 0; i < fileList.length; i++)
-  {
-    var file = fileList[i];
-    try
-    {
-      var name = file.leafName;
-      if (name.charAt(name.length - 1) == HIDDEN_CHAR)
-        name = name.substring(0, name.length - 1);
-      var sep = file.isDirectory() ? "/" : "";
-
-      // Note: using " to delimit the attribute here because encodeURIComponent
-      //       passes through '.
-      var item = '<li><a href="' + encodeURIComponent(name) + sep + '">' +
-                   htmlEscape(name) + sep +
-                 '</a></li>';
-
-      body += item;
-    }
-    catch (e) { /* some file system error, ignore the file */ }
-  }
-
-  body    += '    </ol>\
-                </body>\
-              </html>';
-
-  response.bodyOutputStream.write(body, body.length);
-}
-
-/**
- * Sorts a and b (nsIFile objects) into an aesthetically pleasing order.
- */
-function fileSort(a, b)
-{
-  var dira = a.isDirectory(), dirb = b.isDirectory();
-
-  if (dira && !dirb)
-    return -1;
-  if (dirb && !dira)
-    return 1;
-
-  var namea = a.leafName.toLowerCase(), nameb = b.leafName.toLowerCase();
-  return nameb > namea ? -1 : 1;
-}
-
-
-/**
- * Converts an externally-provided path into an internal path for use in
- * determining file mappings.
- *
- * @param path
- *   the path to convert
- * @param encoded
- *   true if the given path should be passed through decodeURI prior to
- *   conversion
- * @throws URIError
- *   if path is incorrectly encoded
- */
-function toInternalPath(path, encoded)
-{
-  if (encoded)
-    path = decodeURI(path);
-
-  var comps = path.split("/");
-  for (var i = 0, sz = comps.length; i < sz; i++)
-  {
-    var comp = comps[i];
-    if (comp.charAt(comp.length - 1) == HIDDEN_CHAR)
-      comps[i] = comp + HIDDEN_CHAR;
-  }
-  return comps.join("/");
-}
-
-
-/**
- * Adds custom-specified headers for the given file to the given response, if
- * any such headers are specified.
- *
- * @param file
- *   the file on the disk which is to be written
- * @param metadata
- *   metadata about the incoming request
- * @param response
- *   the Response to which any specified headers/data should be written
- * @throws HTTP_500
- *   if an error occurred while processing custom-specified headers
- */
-function maybeAddHeaders(file, metadata, response)
-{
-  var name = file.leafName;
-  if (name.charAt(name.length - 1) == HIDDEN_CHAR)
-    name = name.substring(0, name.length - 1);
-
-  var headerFile = file.parent;
-  headerFile.append(name + HEADERS_SUFFIX);
-
-  if (!headerFile.exists())
-    return;
-
-  const PR_RDONLY = 0x01;
-  var fis = new FileInputStream(headerFile, PR_RDONLY, 0444,
-                                Ci.nsIFileInputStream.CLOSE_ON_EOF);
-
-  try
-  {
-    var lis = new ConverterInputStream(fis, "UTF-8", 1024, 0x0);
-    lis.QueryInterface(Ci.nsIUnicharLineInputStream);
-
-    var line = {value: ""};
-    var more = lis.readLine(line);
-
-    if (!more && line.value == "")
-      return;
-
-
-    // request line
-
-    var status = line.value;
-    if (status.indexOf("HTTP ") == 0)
-    {
-      status = status.substring(5);
-      var space = status.indexOf(" ");
-      var code, description;
-      if (space < 0)
-      {
-        code = status;
-        description = "";
-      }
-      else
-      {
-        code = status.substring(0, space);
-        description = status.substring(space + 1, status.length);
-      }
-    
-      response.setStatusLine(metadata.httpVersion, parseInt(code, 10), description);
-
-      line.value = "";
-      more = lis.readLine(line);
-    }
-
-    // headers
-    while (more || line.value != "")
-    {
-      var header = line.value;
-      var colon = header.indexOf(":");
-
-      response.setHeader(header.substring(0, colon),
-                         header.substring(colon + 1, header.length),
-                         false); // allow overriding server-set headers
-
-      line.value = "";
-      more = lis.readLine(line);
-    }
-  }
-  catch (e)
-  {
-    dumpn("WARNING: error in headers for " + metadata.path + ": " + e);
-    throw HTTP_500;
-  }
-  finally
-  {
-    fis.close();
-  }
-}
-
-
-/**
- * An object which handles requests for a server, executing default and
- * overridden behaviors as instructed by the code which uses and manipulates it.
- * Default behavior includes the paths / and /trace (diagnostics), with some
- * support for HTTP error pages for various codes and fallback to HTTP 500 if
- * those codes fail for any reason.
- *
- * @param server : nsHttpServer
- *   the server in which this handler is being used
- */
-function ServerHandler(server)
-{
-  // FIELDS
-
-  /**
-   * The nsHttpServer instance associated with this handler.
-   */
-  this._server = server;
-
-  /**
-   * A FileMap object containing the set of path->nsILocalFile mappings for
-   * all directory mappings set in the server (e.g., "/" for /var/www/html/,
-   * "/foo/bar/" for /local/path/, and "/foo/bar/baz/" for /local/path2).
-   *
-   * Note carefully: the leading and trailing "/" in each path (not file) are
-   * removed before insertion to simplify the code which uses this.  You have
-   * been warned!
-   */
-  this._pathDirectoryMap = new FileMap();
-
-  /**
-   * Custom request handlers for the server in which this resides.  Path-handler
-   * pairs are stored as property-value pairs in this property.
-   *
-   * @see ServerHandler.prototype._defaultPaths
-   */
-  this._overridePaths = {};
-  
-  /**
-   * Custom request handlers for the error handlers in the server in which this
-   * resides.  Path-handler pairs are stored as property-value pairs in this
-   * property.
-   *
-   * @see ServerHandler.prototype._defaultErrors
-   */
-  this._overrideErrors = {};
-
-  /**
-   * Maps file extensions to their MIME types in the server, overriding any
-   * mapping that might or might not exist in the MIME service.
-   */
-  this._mimeMappings = {};
-
-  /**
-   * The default handler for requests for directories, used to serve directories
-   * when no index file is present.
-   */
-  this._indexHandler = defaultIndexHandler;
-
-  /** Per-path state storage for the server. */
-  this._state = {};
-
-  /** Entire-server state storage. */
-  this._sharedState = {};
-
-  /** Entire-server state storage for nsISupports values. */
-  this._objectState = {};
-}
-ServerHandler.prototype =
-{
-  // PUBLIC API
-
-  /**
-   * Handles a request to this server, responding to the request appropriately
-   * and initiating server shutdown if necessary.
-   *
-   * This method never throws an exception.
-   *
-   * @param connection : Connection
-   *   the connection for this request
-   */
-  handleResponse: function(connection)
-  {
-    var request = connection.request;
-    var response = new Response(connection);
-
-    var path = request.path;
-    dumpn("*** path == " + path);
-
-    try
-    {
-      try
-      {
-        if (path in this._overridePaths)
-        {
-          // explicit paths first, then files based on existing directory mappings,
-          // then (if the file doesn't exist) built-in server default paths
-          dumpn("calling override for " + path);
-          this._overridePaths[path](request, response);
-        }
-        else
-        {
-          this._handleDefault(request, response);
-        }
-      }
-      catch (e)
-      {
-        if (response.partiallySent())
-        {
-          response.abort(e);
-          return;
-        }
-
-        if (!(e instanceof HttpError))
-        {
-          dumpn("*** unexpected error: e == " + e);
-          throw HTTP_500;
-        }
-        if (e.code !== 404)
-          throw e;
-
-        dumpn("*** default: " + (path in this._defaultPaths));
-
-        response = new Response(connection);
-        if (path in this._defaultPaths)
-          this._defaultPaths[path](request, response);
-        else
-          throw HTTP_404;
-      }
-    }
-    catch (e)
-    {
-      if (response.partiallySent())
-      {
-        response.abort(e);
-        return;
-      }
-
-      var errorCode = "internal";
-
-      try
-      {
-        if (!(e instanceof HttpError))
-          throw e;
-
-        errorCode = e.code;
-        dumpn("*** errorCode == " + errorCode);
-
-        response = new Response(connection);
-        if (e.customErrorHandling)
-          e.customErrorHandling(response);
-        this._handleError(errorCode, request, response);
-        return;
-      }
-      catch (e2)
-      {
-        dumpn("*** error handling " + errorCode + " error: " +
-              "e2 == " + e2 + ", shutting down server");
-
-        connection.server._requestQuit();
-        response.abort(e2);
-        return;
-      }
-    }
-
-    response.complete();
-  },
-
-  //
-  // see nsIHttpServer.registerFile
-  //
-  registerFile: function(path, file)
-  {
-    if (!file)
-    {
-      dumpn("*** unregistering '" + path + "' mapping");
-      delete this._overridePaths[path];
-      return;
-    }
-
-    dumpn("*** registering '" + path + "' as mapping to " + file.path);
-    file = file.clone();
-
-    var self = this;
-    this._overridePaths[path] =
-      function(request, response)
-      {
-        if (!file.exists())
-          throw HTTP_404;
-
-        response.setStatusLine(request.httpVersion, 200, "OK");
-        self._writeFileResponse(request, file, response, 0, file.fileSize);
-      };
-  },
-
-  //
-  // see nsIHttpServer.registerPathHandler
-  //
-  registerPathHandler: function(path, handler)
-  {
-    // XXX true path validation!
-    if (path.charAt(0) != "/")
-      throw Cr.NS_ERROR_INVALID_ARG;
-
-    this._handlerToField(handler, this._overridePaths, path);
-  },
-
-  //
-  // see nsIHttpServer.registerDirectory
-  //
-  registerDirectory: function(path, directory)
-  {
-    // strip off leading and trailing '/' so that we can use lastIndexOf when
-    // determining exactly how a path maps onto a mapped directory --
-    // conditional is required here to deal with "/".substring(1, 0) being
-    // converted to "/".substring(0, 1) per the JS specification
-    var key = path.length == 1 ? "" : path.substring(1, path.length - 1);
-
-    // the path-to-directory mapping code requires that the first character not
-    // be "/", or it will go into an infinite loop
-    if (key.charAt(0) == "/")
-      throw Cr.NS_ERROR_INVALID_ARG;
-
-    key = toInternalPath(key, false);
-
-    if (directory)
-    {
-      dumpn("*** mapping '" + path + "' to the location " + directory.path);
-      this._pathDirectoryMap.put(key, directory);
-    }
-    else
-    {
-      dumpn("*** removing mapping for '" + path + "'");
-      this._pathDirectoryMap.put(key, null);
-    }
-  },
-
-  //
-  // see nsIHttpServer.registerErrorHandler
-  //
-  registerErrorHandler: function(err, handler)
-  {
-    if (!(err in HTTP_ERROR_CODES))
-      dumpn("*** WARNING: registering non-HTTP/1.1 error code " +
-            "(" + err + ") handler -- was this intentional?");
-
-    this._handlerToField(handler, this._overrideErrors, err);
-  },
-
-  //
-  // see nsIHttpServer.setIndexHandler
-  //
-  setIndexHandler: function(handler)
-  {
-    if (!handler)
-      handler = defaultIndexHandler;
-    else if (typeof(handler) != "function")
-      handler = createHandlerFunc(handler);
-
-    this._indexHandler = handler;
-  },
-
-  //
-  // see nsIHttpServer.registerContentType
-  //
-  registerContentType: function(ext, type)
-  {
-    if (!type)
-      delete this._mimeMappings[ext];
-    else
-      this._mimeMappings[ext] = headerUtils.normalizeFieldValue(type);
-  },
-
-  // PRIVATE API
-
-  /**
-   * Sets or remove (if handler is null) a handler in an object with a key.
-   *
-   * @param handler
-   *   a handler, either function or an nsIHttpRequestHandler
-   * @param dict
-   *   The object to attach the handler to.
-   * @param key
-   *   The field name of the handler.
-   */
-  _handlerToField: function(handler, dict, key)
-  {
-    // for convenience, handler can be a function if this is run from xpcshell
-    if (typeof(handler) == "function")
-      dict[key] = handler;
-    else if (handler)
-      dict[key] = createHandlerFunc(handler);
-    else
-      delete dict[key];
-  },
-
-  /**
-   * Handles a request which maps to a file in the local filesystem (if a base
-   * path has already been set; otherwise the 404 error is thrown).
-   *
-   * @param metadata : Request
-   *   metadata for the incoming request
-   * @param response : Response
-   *   an uninitialized Response to the given request, to be initialized by a
-   *   request handler
-   * @throws HTTP_###
-   *   if an HTTP error occurred (usually HTTP_404); note that in this case the
-   *   calling code must handle post-processing of the response
-   */
-  _handleDefault: function(metadata, response)
-  {
-    dumpn("*** _handleDefault()");
-
-    response.setStatusLine(metadata.httpVersion, 200, "OK");
-
-    var path = metadata.path;
-    NS_ASSERT(path.charAt(0) == "/", "invalid path: <" + path + ">");
-
-    // determine the actual on-disk file; this requires finding the deepest
-    // path-to-directory mapping in the requested URL
-    var file = this._getFileForPath(path);
-
-    // the "file" might be a directory, in which case we either serve the
-    // contained index.html or make the index handler write the response
-    if (file.exists() && file.isDirectory())
-    {
-      file.append("index.html"); // make configurable?
-      if (!file.exists() || file.isDirectory())
-      {
-        metadata._ensurePropertyBag();
-        metadata._bag.setPropertyAsInterface("directory", file.parent);
-        this._indexHandler(metadata, response);
-        return;
-      }
-    }
-
-    // alternately, the file might not exist
-    if (!file.exists())
-      throw HTTP_404;
-
-    var start, end;
-    if (metadata._httpVersion.atLeast(nsHttpVersion.HTTP_1_1) &&
-        metadata.hasHeader("Range") &&
-        this._getTypeFromFile(file) !== SJS_TYPE)
-    {
-      var rangeMatch = metadata.getHeader("Range").match(/^bytes=(\d+)?-(\d+)?$/);
-      if (!rangeMatch)
-        throw HTTP_400;
-
-      if (rangeMatch[1] !== undefined)
-        start = parseInt(rangeMatch[1], 10);
-
-      if (rangeMatch[2] !== undefined)
-        end = parseInt(rangeMatch[2], 10);
-
-      if (start === undefined && end === undefined)
-        throw HTTP_400;
-
-      // No start given, so the end is really the count of bytes from the
-      // end of the file.
-      if (start === undefined)
-      {
-        start = Math.max(0, file.fileSize - end);
-        end   = file.fileSize - 1;
-      }
-
-      // start and end are inclusive
-      if (end === undefined || end >= file.fileSize)
-        end = file.fileSize - 1;
-
-      if (start !== undefined && start >= file.fileSize) {
-        var HTTP_416 = new HttpError(416, "Requested Range Not Satisfiable");
-        HTTP_416.customErrorHandling = function(errorResponse)
-        {
-          maybeAddHeaders(file, metadata, errorResponse);
-        };
-        throw HTTP_416;
-      }
-
-      if (end < start)
-      {
-        response.setStatusLine(metadata.httpVersion, 200, "OK");
-        start = 0;
-        end = file.fileSize - 1;
-      }
-      else
-      {
-        response.setStatusLine(metadata.httpVersion, 206, "Partial Content");
-        var contentRange = "bytes " + start + "-" + end + "/" + file.fileSize;
-        response.setHeader("Content-Range", contentRange);
-      }
-    }
-    else
-    {
-      start = 0;
-      end = file.fileSize - 1;
-    }
-
-    // finally...
-    dumpn("*** handling '" + path + "' as mapping to " + file.path + " from " +
-          start + " to " + end + " inclusive");
-    this._writeFileResponse(metadata, file, response, start, end - start + 1);
-  },
-
-  /**
-   * Writes an HTTP response for the given file, including setting headers for
-   * file metadata.
-   *
-   * @param metadata : Request
-   *   the Request for which a response is being generated
-   * @param file : nsILocalFile
-   *   the file which is to be sent in the response
-   * @param response : Response
-   *   the response to which the file should be written
-   * @param offset: uint
-   *   the byte offset to skip to when writing
-   * @param count: uint
-   *   the number of bytes to write
-   */
-  _writeFileResponse: function(metadata, file, response, offset, count)
-  {
-    const PR_RDONLY = 0x01;
-
-    var type = this._getTypeFromFile(file);
-    if (type === SJS_TYPE)
-    {
-      var fis = new FileInputStream(file, PR_RDONLY, 0444,
-                                    Ci.nsIFileInputStream.CLOSE_ON_EOF);
-
-      try
-      {
-        var sis = new ScriptableInputStream(fis);
-        var s = Cu.Sandbox(gGlobalObject);
-        s.importFunction(dump, "dump");
-
-        // Define a basic key-value state-preservation API across requests, with
-        // keys initially corresponding to the empty string.
-        var self = this;
-        var path = metadata.path;
-        s.importFunction(function getState(k)
-        {
-          return self._getState(path, k);
-        });
-        s.importFunction(function setState(k, v)
-        {
-          self._setState(path, k, v);
-        });
-        s.importFunction(function getSharedState(k)
-        {
-          return self._getSharedState(k);
-        });
-        s.importFunction(function setSharedState(k, v)
-        {
-          self._setSharedState(k, v);
-        });
-        s.importFunction(function getObjectState(k, callback)
-        {
-          callback(self._getObjectState(k));
-        });
-        s.importFunction(function setObjectState(k, v)
-        {
-          self._setObjectState(k, v);
-        });
-        s.importFunction(function registerPathHandler(p, h)
-        {
-          self.registerPathHandler(p, h);
-        });
-
-        // Make it possible for sjs files to access their location
-        this._setState(path, "__LOCATION__", file.path);
-
-        try
-        {
-          // Alas, the line number in errors dumped to console when calling the
-          // request handler is simply an offset from where we load the SJS file.
-          // Work around this in a reasonably non-fragile way by dynamically
-          // getting the line number where we evaluate the SJS file.  Don't
-          // separate these two lines!
-          var line = new Error().lineNumber;
-          Cu.evalInSandbox(sis.read(file.fileSize), s);
-        }
-        catch (e)
-        {
-          dumpn("*** syntax error in SJS at " + file.path + ": " + e);
-          throw HTTP_500;
-        }
-
-        try
-        {
-          s.handleRequest(metadata, response);
-        }
-        catch (e)
-        {
-          dump("*** error running SJS at " + file.path + ": " +
-               e + " on line " +
-               (e instanceof Error
-               ? e.lineNumber + " in httpd.js"
-               : (e.lineNumber - line)) + "\n");
-          throw HTTP_500;
-        }
-      }
-      finally
-      {
-        fis.close();
-      }
-    }
-    else
-    {
-      try
-      {
-        response.setHeader("Last-Modified",
-                           toDateString(file.lastModifiedTime),
-                           false);
-      }
-      catch (e) { /* lastModifiedTime threw, ignore */ }
-
-      response.setHeader("Content-Type", type, false);
-      maybeAddHeaders(file, metadata, response);
-      response.setHeader("Content-Length", "" + count, false);
-
-      var fis = new FileInputStream(file, PR_RDONLY, 0444,
-                                    Ci.nsIFileInputStream.CLOSE_ON_EOF);
-
-      offset = offset || 0;
-      count  = count || file.fileSize;
-      NS_ASSERT(offset === 0 || offset < file.fileSize, "bad offset");
-      NS_ASSERT(count >= 0, "bad count");
-      NS_ASSERT(offset + count <= file.fileSize, "bad total data size");
-
-      try
-      {
-        if (offset !== 0)
-        {
-          // Seek (or read, if seeking isn't supported) to the correct offset so
-          // the data sent to the client matches the requested range.
-          if (fis instanceof Ci.nsISeekableStream)
-            fis.seek(Ci.nsISeekableStream.NS_SEEK_SET, offset);
-          else
-            new ScriptableInputStream(fis).read(offset);
-        }
-      }
-      catch (e)
-      {
-        fis.close();
-        throw e;
-      }
-
-      function writeMore()
-      {
-        gThreadManager.currentThread
-                      .dispatch(writeData, Ci.nsIThread.DISPATCH_NORMAL);
-      }
-
-      var input = new BinaryInputStream(fis);
-      var output = new BinaryOutputStream(response.bodyOutputStream);
-      var writeData =
-        {
-          run: function()
-          {
-            var chunkSize = Math.min(65536, count);
-            count -= chunkSize;
-            NS_ASSERT(count >= 0, "underflow");
-
-            try
-            {
-              var data = input.readByteArray(chunkSize);
-              NS_ASSERT(data.length === chunkSize,
-                        "incorrect data returned?  got " + data.length +
-                        ", expected " + chunkSize);
-              output.writeByteArray(data, data.length);
-              if (count === 0)
-              {
-                fis.close();
-                response.finish();
-              }
-              else
-              {
-                writeMore();
-              }
-            }
-            catch (e)
-            {
-              try
-              {
-                fis.close();
-              }
-              finally
-              {
-                response.finish();
-              }
-              throw e;
-            }
-          }
-        };
-
-      writeMore();
-
-      // Now that we know copying will start, flag the response as async.
-      response.processAsync();
-    }
-  },
-
-  /**
-   * Get the value corresponding to a given key for the given path for SJS state
-   * preservation across requests.
-   *
-   * @param path : string
-   *   the path from which the given state is to be retrieved
-   * @param k : string
-   *   the key whose corresponding value is to be returned
-   * @returns string
-   *   the corresponding value, which is initially the empty string
-   */
-  _getState: function(path, k)
-  {
-    var state = this._state;
-    if (path in state && k in state[path])
-      return state[path][k];
-    return "";
-  },
-
-  /**
-   * Set the value corresponding to a given key for the given path for SJS state
-   * preservation across requests.
-   *
-   * @param path : string
-   *   the path from which the given state is to be retrieved
-   * @param k : string
-   *   the key whose corresponding value is to be set
-   * @param v : string
-   *   the value to be set
-   */
-  _setState: function(path, k, v)
-  {
-    if (typeof v !== "string")
-      throw new Error("non-string value passed");
-    var state = this._state;
-    if (!(path in state))
-      state[path] = {};
-    state[path][k] = v;
-  },
-
-  /**
-   * Get the value corresponding to a given key for SJS state preservation
-   * across requests.
-   *
-   * @param k : string
-   *   the key whose corresponding value is to be returned
-   * @returns string
-   *   the corresponding value, which is initially the empty string
-   */
-  _getSharedState: function(k)
-  {
-    var state = this._sharedState;
-    if (k in state)
-      return state[k];
-    return "";
-  },
-
-  /**
-   * Set the value corresponding to a given key for SJS state preservation
-   * across requests.
-   *
-   * @param k : string
-   *   the key whose corresponding value is to be set
-   * @param v : string
-   *   the value to be set
-   */
-  _setSharedState: function(k, v)
-  {
-    if (typeof v !== "string")
-      throw new Error("non-string value passed");
-    this._sharedState[k] = v;
-  },
-
-  /**
-   * Returns the object associated with the given key in the server for SJS
-   * state preservation across requests.
-   *
-   * @param k : string
-   *  the key whose corresponding object is to be returned
-   * @returns nsISupports
-   *  the corresponding object, or null if none was present
-   */
-  _getObjectState: function(k)
-  {
-    if (typeof k !== "string")
-      throw new Error("non-string key passed");
-    return this._objectState[k] || null;
-  },
-
-  /**
-   * Sets the object associated with the given key in the server for SJS
-   * state preservation across requests.
-   *
-   * @param k : string
-   *  the key whose corresponding object is to be set
-   * @param v : nsISupports
-   *  the object to be associated with the given key; may be null
-   */
-  _setObjectState: function(k, v)
-  {
-    if (typeof k !== "string")
-      throw new Error("non-string key passed");
-    if (typeof v !== "object")
-      throw new Error("non-object value passed");
-    if (v && !("QueryInterface" in v))
-    {
-      throw new Error("must pass an nsISupports; use wrappedJSObject to ease " +
-                      "pain when using the server from JS");
-    }
-
-    this._objectState[k] = v;
-  },
-
-  /**
-   * Gets a content-type for the given file, first by checking for any custom
-   * MIME-types registered with this handler for the file's extension, second by
-   * asking the global MIME service for a content-type, and finally by failing
-   * over to application/octet-stream.
-   *
-   * @param file : nsIFile
-   *   the nsIFile for which to get a file type
-   * @returns string
-   *   the best content-type which can be determined for the file
-   */
-  _getTypeFromFile: function(file)
-  {
-    try
-    {
-      var name = file.leafName;
-      var dot = name.lastIndexOf(".");
-      if (dot > 0)
-      {
-        var ext = name.slice(dot + 1);
-        if (ext in this._mimeMappings)
-          return this._mimeMappings[ext];
-      }
-      return Cc["@mozilla.org/uriloader/external-helper-app-service;1"]
-               .getService(Ci.nsIMIMEService)
-               .getTypeFromFile(file);
-    }
-    catch (e)
-    {
-      return "application/octet-stream";
-    }
-  },
-
-  /**
-   * Returns the nsILocalFile which corresponds to the path, as determined using
-   * all registered path->directory mappings and any paths which are explicitly
-   * overridden.
-   *
-   * @param path : string
-   *   the server path for which a file should be retrieved, e.g. "/foo/bar"
-   * @throws HttpError
-   *   when the correct action is the corresponding HTTP error (i.e., because no
-   *   mapping was found for a directory in path, the referenced file doesn't
-   *   exist, etc.)
-   * @returns nsILocalFile
-   *   the file to be sent as the response to a request for the path
-   */
-  _getFileForPath: function(path)
-  {
-    // decode and add underscores as necessary
-    try
-    {
-      path = toInternalPath(path, true);
-    }
-    catch (e)
-    {
-      throw HTTP_400; // malformed path
-    }
-
-    // next, get the directory which contains this path
-    var pathMap = this._pathDirectoryMap;
-
-    // An example progression of tmp for a path "/foo/bar/baz/" might be:
-    // "foo/bar/baz/", "foo/bar/baz", "foo/bar", "foo", ""
-    var tmp = path.substring(1);
-    while (true)
-    {
-      // do we have a match for current head of the path?
-      var file = pathMap.get(tmp);
-      if (file)
-      {
-        // XXX hack; basically disable showing mapping for /foo/bar/ when the
-        //     requested path was /foo/bar, because relative links on the page
-        //     will all be incorrect -- we really need the ability to easily
-        //     redirect here instead
-        if (tmp == path.substring(1) &&
-            tmp.length != 0 &&
-            tmp.charAt(tmp.length - 1) != "/")
-          file = null;
-        else
-          break;
-      }
-
-      // if we've finished trying all prefixes, exit
-      if (tmp == "")
-        break;
-
-      tmp = tmp.substring(0, tmp.lastIndexOf("/"));
-    }
-
-    // no mapping applies, so 404
-    if (!file)
-      throw HTTP_404;
-
-
-    // last, get the file for the path within the determined directory
-    var parentFolder = file.parent;
-    var dirIsRoot = (parentFolder == null);
-
-    // Strategy here is to append components individually, making sure we
-    // never move above the given directory; this allows paths such as
-    // "<file>/foo/../bar" but prevents paths such as "<file>/../base-sibling";
-    // this component-wise approach also means the code works even on platforms
-    // which don't use "/" as the directory separator, such as Windows
-    var leafPath = path.substring(tmp.length + 1);
-    var comps = leafPath.split("/");
-    for (var i = 0, sz = comps.length; i < sz; i++)
-    {
-      var comp = comps[i];
-
-      if (comp == "..")
-        file = file.parent;
-      else if (comp == "." || comp == "")
-        continue;
-      else
-        file.append(comp);
-
-      if (!dirIsRoot && file.equals(parentFolder))
-        throw HTTP_403;
-    }
-
-    return file;
-  },
-
-  /**
-   * Writes the error page for the given HTTP error code over the given
-   * connection.
-   *
-   * @param errorCode : uint
-   *   the HTTP error code to be used
-   * @param connection : Connection
-   *   the connection on which the error occurred
-   */
-  handleError: function(errorCode, connection)
-  {
-    var response = new Response(connection);
-
-    dumpn("*** error in request: " + errorCode);
-
-    this._handleError(errorCode, new Request(connection.port), response);
-  }, 
-
-  /**
-   * Handles a request which generates the given error code, using the
-   * user-defined error handler if one has been set, gracefully falling back to
-   * the x00 status code if the code has no handler, and failing to status code
-   * 500 if all else fails.
-   *
-   * @param errorCode : uint
-   *   the HTTP error which is to be returned
-   * @param metadata : Request
-   *   metadata for the request, which will often be incomplete since this is an
-   *   error
-   * @param response : Response
-   *   an uninitialized Response should be initialized when this method
-   *   completes with information which represents the desired error code in the
-   *   ideal case or a fallback code in abnormal circumstances (i.e., 500 is a
-   *   fallback for 505, per HTTP specs)
-   */
-  _handleError: function(errorCode, metadata, response)
-  {
-    if (!metadata)
-      throw Cr.NS_ERROR_NULL_POINTER;
-
-    var errorX00 = errorCode - (errorCode % 100);
-
-    try
-    {
-      if (!(errorCode in HTTP_ERROR_CODES))
-        dumpn("*** WARNING: requested invalid error: " + errorCode);
-
-      // RFC 2616 says that we should try to handle an error by its class if we
-      // can't otherwise handle it -- if that fails, we revert to handling it as
-      // a 500 internal server error, and if that fails we throw and shut down
-      // the server
-
-      // actually handle the error
-      try
-      {
-        if (errorCode in this._overrideErrors)
-          this._overrideErrors[errorCode](metadata, response);
-        else
-          this._defaultErrors[errorCode](metadata, response);
-      }
-      catch (e)
-      {
-        if (response.partiallySent())
-        {
-          response.abort(e);
-          return;
-        }
-
-        // don't retry the handler that threw
-        if (errorX00 == errorCode)
-          throw HTTP_500;
-
-        dumpn("*** error in handling for error code " + errorCode + ", " +
-              "falling back to " + errorX00 + "...");
-        response = new Response(response._connection);
-        if (errorX00 in this._overrideErrors)
-          this._overrideErrors[errorX00](metadata, response);
-        else if (errorX00 in this._defaultErrors)
-          this._defaultErrors[errorX00](metadata, response);
-        else
-          throw HTTP_500;
-      }
-    }
-    catch (e)
-    {
-      if (response.partiallySent())
-      {
-        response.abort();
-        return;
-      }
-
-      // we've tried everything possible for a meaningful error -- now try 500
-      dumpn("*** error in handling for error code " + errorX00 + ", falling " +
-            "back to 500...");
-
-      try
-      {
-        response = new Response(response._connection);
-        if (500 in this._overrideErrors)
-          this._overrideErrors[500](metadata, response);
-        else
-          this._defaultErrors[500](metadata, response);
-      }
-      catch (e2)
-      {
-        dumpn("*** multiple errors in default error handlers!");
-        dumpn("*** e == " + e + ", e2 == " + e2);
-        response.abort(e2);
-        return;
-      }
-    }
-
-    response.complete();
-  },
-
-  // FIELDS
-
-  /**
-   * This object contains the default handlers for the various HTTP error codes.
-   */
-  _defaultErrors:
-  {
-    400: function(metadata, response)
-    {
-      // none of the data in metadata is reliable, so hard-code everything here
-      response.setStatusLine("1.1", 400, "Bad Request");
-      response.setHeader("Content-Type", "text/plain", false);
-
-      var body = "Bad request\n";
-      response.bodyOutputStream.write(body, body.length);
-    },
-    403: function(metadata, response)
-    {
-      response.setStatusLine(metadata.httpVersion, 403, "Forbidden");
-      response.setHeader("Content-Type", "text/html", false);
-
-      var body = "<html>\
-                    <head><title>403 Forbidden</title></head>\
-                    <body>\
-                      <h1>403 Forbidden</h1>\
-                    </body>\
-                  </html>";
-      response.bodyOutputStream.write(body, body.length);
-    },
-    404: function(metadata, response)
-    {
-      response.setStatusLine(metadata.httpVersion, 404, "Not Found");
-      response.setHeader("Content-Type", "text/html", false);
-
-      var body = "<html>\
-                    <head><title>404 Not Found</title></head>\
-                    <body>\
-                      <h1>404 Not Found</h1>\
-                      <p>\
-                        <span style='font-family: monospace;'>" +
-                          htmlEscape(metadata.path) +
-                       "</span> was not found.\
-                      </p>\
-                    </body>\
-                  </html>";
-      response.bodyOutputStream.write(body, body.length);
-    },
-    416: function(metadata, response)
-    {
-      response.setStatusLine(metadata.httpVersion,
-                            416,
-                            "Requested Range Not Satisfiable");
-      response.setHeader("Content-Type", "text/html", false);
-
-      var body = "<html>\
-                   <head>\
-                    <title>416 Requested Range Not Satisfiable</title></head>\
-                    <body>\
-                     <h1>416 Requested Range Not Satisfiable</h1>\
-                     <p>The byte range was not valid for the\
-                        requested resource.\
-                     </p>\
-                    </body>\
-                  </html>";
-      response.bodyOutputStream.write(body, body.length);
-    },
-    500: function(metadata, response)
-    {
-      response.setStatusLine(metadata.httpVersion,
-                             500,
-                             "Internal Server Error");
-      response.setHeader("Content-Type", "text/html", false);
-
-      var body = "<html>\
-                    <head><title>500 Internal Server Error</title></head>\
-                    <body>\
-                      <h1>500 Internal Server Error</h1>\
-                      <p>Something's broken in this server and\
-                        needs to be fixed.</p>\
-                    </body>\
-                  </html>";
-      response.bodyOutputStream.write(body, body.length);
-    },
-    501: function(metadata, response)
-    {
-      response.setStatusLine(metadata.httpVersion, 501, "Not Implemented");
-      response.setHeader("Content-Type", "text/html", false);
-
-      var body = "<html>\
-                    <head><title>501 Not Implemented</title></head>\
-                    <body>\
-                      <h1>501 Not Implemented</h1>\
-                      <p>This server is not (yet) Apache.</p>\
-                    </body>\
-                  </html>";
-      response.bodyOutputStream.write(body, body.length);
-    },
-    505: function(metadata, response)
-    {
-      response.setStatusLine("1.1", 505, "HTTP Version Not Supported");
-      response.setHeader("Content-Type", "text/html", false);
-
-      var body = "<html>\
-                    <head><title>505 HTTP Version Not Supported</title></head>\
-                    <body>\
-                      <h1>505 HTTP Version Not Supported</h1>\
-                      <p>This server only supports HTTP/1.0 and HTTP/1.1\
-                        connections.</p>\
-                    </body>\
-                  </html>";
-      response.bodyOutputStream.write(body, body.length);
-    }
-  },
-
-  /**
-   * Contains handlers for the default set of URIs contained in this server.
-   */
-  _defaultPaths:
-  {
-    "/": function(metadata, response)
-    {
-      response.setStatusLine(metadata.httpVersion, 200, "OK");
-      response.setHeader("Content-Type", "text/html", false);
-
-      var body = "<html>\
-                    <head><title>httpd.js</title></head>\
-                    <body>\
-                      <h1>httpd.js</h1>\
-                      <p>If you're seeing this page, httpd.js is up and\
-                        serving requests!  Now set a base path and serve some\
-                        files!</p>\
-                    </body>\
-                  </html>";
-
-      response.bodyOutputStream.write(body, body.length);
-    },
-
-    "/trace": function(metadata, response)
-    {
-      response.setStatusLine(metadata.httpVersion, 200, "OK");
-      response.setHeader("Content-Type", "text/plain", false);
-
-      var body = "Request-URI: " +
-                 metadata.scheme + "://" + metadata.host + ":" + metadata.port +
-                 metadata.path + "\n\n";
-      body += "Request (semantically equivalent, slightly reformatted):\n\n";
-      body += metadata.method + " " + metadata.path;
-
-      if (metadata.queryString)
-        body +=  "?" + metadata.queryString;
-        
-      body += " HTTP/" + metadata.httpVersion + "\r\n";
-
-      var headEnum = metadata.headers;
-      while (headEnum.hasMoreElements())
-      {
-        var fieldName = headEnum.getNext()
-                                .QueryInterface(Ci.nsISupportsString)
-                                .data;
-        body += fieldName + ": " + metadata.getHeader(fieldName) + "\r\n";
-      }
-
-      response.bodyOutputStream.write(body, body.length);
-    }
-  }
-};
-
-
-/**
- * Maps absolute paths to files on the local file system (as nsILocalFiles).
- */
-function FileMap()
-{
-  /** Hash which will map paths to nsILocalFiles. */
-  this._map = {};
-}
-FileMap.prototype =
-{
-  // PUBLIC API
-
-  /**
-   * Maps key to a clone of the nsILocalFile value if value is non-null;
-   * otherwise, removes any extant mapping for key.
-   *
-   * @param key : string
-   *   string to which a clone of value is mapped
-   * @param value : nsILocalFile
-   *   the file to map to key, or null to remove a mapping
-   */
-  put: function(key, value)
-  {
-    if (value)
-      this._map[key] = value.clone();
-    else
-      delete this._map[key];
-  },
-
-  /**
-   * Returns a clone of the nsILocalFile mapped to key, or null if no such
-   * mapping exists.
-   *
-   * @param key : string
-   *   key to which the returned file maps
-   * @returns nsILocalFile
-   *   a clone of the mapped file, or null if no mapping exists
-   */
-  get: function(key)
-  {
-    var val = this._map[key];
-    return val ? val.clone() : null;
-  }
-};
-
-
-// Response CONSTANTS
-
-// token       = *<any CHAR except CTLs or separators>
-// CHAR        = <any US-ASCII character (0-127)>
-// CTL         = <any US-ASCII control character (0-31) and DEL (127)>
-// separators  = "(" | ")" | "<" | ">" | "@"
-//             | "," | ";" | ":" | "\" | <">
-//             | "/" | "[" | "]" | "?" | "="
-//             | "{" | "}" | SP  | HT
-const IS_TOKEN_ARRAY =
-  [0, 0, 0, 0, 0, 0, 0, 0, //   0
-   0, 0, 0, 0, 0, 0, 0, 0, //   8
-   0, 0, 0, 0, 0, 0, 0, 0, //  16
-   0, 0, 0, 0, 0, 0, 0, 0, //  24
-
-   0, 1, 0, 1, 1, 1, 1, 1, //  32
-   0, 0, 1, 1, 0, 1, 1, 0, //  40
-   1, 1, 1, 1, 1, 1, 1, 1, //  48
-   1, 1, 0, 0, 0, 0, 0, 0, //  56
-
-   0, 1, 1, 1, 1, 1, 1, 1, //  64
-   1, 1, 1, 1, 1, 1, 1, 1, //  72
-   1, 1, 1, 1, 1, 1, 1, 1, //  80
-   1, 1, 1, 0, 0, 0, 1, 1, //  88
-
-   1, 1, 1, 1, 1, 1, 1, 1, //  96
-   1, 1, 1, 1, 1, 1, 1, 1, // 104
-   1, 1, 1, 1, 1, 1, 1, 1, // 112
-   1, 1, 1, 0, 1, 0, 1];   // 120
-
-
-/**
- * Determines whether the given character code is a CTL.
- *
- * @param code : uint
- *   the character code
- * @returns boolean
- *   true if code is a CTL, false otherwise
- */
-function isCTL(code)
-{
-  return (code >= 0 && code <= 31) || (code == 127);
-}
-
-/**
- * Represents a response to an HTTP request, encapsulating all details of that
- * response.  This includes all headers, the HTTP version, status code and
- * explanation, and the entity itself.
- *
- * @param connection : Connection
- *   the connection over which this response is to be written
- */
-function Response(connection)
-{
-  /** The connection over which this response will be written. */
-  this._connection = connection;
-
-  /**
-   * The HTTP version of this response; defaults to 1.1 if not set by the
-   * handler.
-   */
-  this._httpVersion = nsHttpVersion.HTTP_1_1;
-
-  /**
-   * The HTTP code of this response; defaults to 200.
-   */
-  this._httpCode = 200;
-
-  /**
-   * The description of the HTTP code in this response; defaults to "OK".
-   */
-  this._httpDescription = "OK";
-
-  /**
-   * An nsIHttpHeaders object in which the headers in this response should be
-   * stored.  This property is null after the status line and headers have been
-   * written to the network, and it may be modified up until it is cleared,
-   * except if this._finished is set first (in which case headers are written
-   * asynchronously in response to a finish() call not preceded by
-   * flushHeaders()).
-   */
-  this._headers = new nsHttpHeaders();
-
-  /**
-   * Set to true when this response is ended (completely constructed if possible
-   * and the connection closed); further actions on this will then fail.
-   */
-  this._ended = false;
-
-  /**
-   * A stream used to hold data written to the body of this response.
-   */
-  this._bodyOutputStream = null;
-
-  /**
-   * A stream containing all data that has been written to the body of this
-   * response so far.  (Async handlers make the data contained in this
-   * unreliable as a way of determining content length in general, but auxiliary
-   * saved information can sometimes be used to guarantee reliability.)
-   */
-  this._bodyInputStream = null;
-
-  /**
-   * A stream copier which copies data to the network.  It is initially null
-   * until replaced with a copier for response headers; when headers have been
-   * fully sent it is replaced with a copier for the response body, remaining
-   * so for the duration of response processing.
-   */
-  this._asyncCopier = null;
-
-  /**
-   * True if this response has been designated as being processed
-   * asynchronously rather than for the duration of a single call to
-   * nsIHttpRequestHandler.handle.
-   */
-  this._processAsync = false;
-
-  /**
-   * True iff finish() has been called on this, signaling that no more changes
-   * to this may be made.
-   */
-  this._finished = false;
-
-  /**
-   * True iff powerSeized() has been called on this, signaling that this
-   * response is to be handled manually by the response handler (which may then
-   * send arbitrary data in response, even non-HTTP responses).
-   */
-  this._powerSeized = false;
-}
-Response.prototype =
-{
-  // PUBLIC CONSTRUCTION API
-
-  //
-  // see nsIHttpResponse.bodyOutputStream
-  //
-  get bodyOutputStream()
-  {
-    if (this._finished)
-      throw Cr.NS_ERROR_NOT_AVAILABLE;
-
-    if (!this._bodyOutputStream)
-    {
-      var pipe = new Pipe(true, false, Response.SEGMENT_SIZE, PR_UINT32_MAX,
-                          null);
-      this._bodyOutputStream = pipe.outputStream;
-      this._bodyInputStream = pipe.inputStream;
-      if (this._processAsync || this._powerSeized)
-        this._startAsyncProcessor();
-    }
-
-    return this._bodyOutputStream;
-  },
-
-  //
-  // see nsIHttpResponse.write
-  //
-  write: function(data)
-  {
-    if (this._finished)
-      throw Cr.NS_ERROR_NOT_AVAILABLE;
-
-    var dataAsString = String(data);
-    this.bodyOutputStream.write(dataAsString, dataAsString.length);
-  },
-
-  //
-  // see nsIHttpResponse.setStatusLine
-  //
-  setStatusLine: function(httpVersion, code, description)
-  {
-    if (!this._headers || this._finished || this._powerSeized)
-      throw Cr.NS_ERROR_NOT_AVAILABLE;
-    this._ensureAlive();
-
-    if (!(code >= 0 && code < 1000))
-      throw Cr.NS_ERROR_INVALID_ARG;
-
-    try
-    {
-      var httpVer;
-      // avoid version construction for the most common cases
-      if (!httpVersion || httpVersion == "1.1")
-        httpVer = nsHttpVersion.HTTP_1_1;
-      else if (httpVersion == "1.0")
-        httpVer = nsHttpVersion.HTTP_1_0;
-      else
-        httpVer = new nsHttpVersion(httpVersion);
-    }
-    catch (e)
-    {
-      throw Cr.NS_ERROR_INVALID_ARG;
-    }
-
-    // Reason-Phrase = *<TEXT, excluding CR, LF>
-    // TEXT          = <any OCTET except CTLs, but including LWS>
-    //
-    // XXX this ends up disallowing octets which aren't Unicode, I think -- not
-    //     much to do if description is IDL'd as string
-    if (!description)
-      description = "";
-    for (var i = 0; i < description.length; i++)
-      if (isCTL(description.charCodeAt(i)) && description.charAt(i) != "\t")
-        throw Cr.NS_ERROR_INVALID_ARG;
-
-    // set the values only after validation to preserve atomicity
-    this._httpDescription = description;
-    this._httpCode = code;
-    this._httpVersion = httpVer;
-  },
-
-  //
-  // see nsIHttpResponse.setHeader
-  //
-  setHeader: function(name, value, merge)
-  {
-    if (!this._headers || this._finished || this._powerSeized)
-      throw Cr.NS_ERROR_NOT_AVAILABLE;
-    this._ensureAlive();
-
-    this._headers.setHeader(name, value, merge);
-  },
-
-  //
-  // see nsIHttpResponse.processAsync
-  //
-  processAsync: function()
-  {
-    if (this._finished)
-      throw Cr.NS_ERROR_UNEXPECTED;
-    if (this._powerSeized)
-      throw Cr.NS_ERROR_NOT_AVAILABLE;
-    if (this._processAsync)
-      return;
-    this._ensureAlive();
-
-    dumpn("*** processing connection " + this._connection.number + " async");
-    this._processAsync = true;
-
-    /*
-     * Either the bodyOutputStream getter or this method is responsible for
-     * starting the asynchronous processor and catching writes of data to the
-     * response body of async responses as they happen, for the purpose of
-     * forwarding those writes to the actual connection's output stream.
-     * If bodyOutputStream is accessed first, calling this method will create
-     * the processor (when it first is clear that body data is to be written
-     * immediately, not buffered).  If this method is called first, accessing
-     * bodyOutputStream will create the processor.  If only this method is
-     * called, we'll write nothing, neither headers nor the nonexistent body,
-     * until finish() is called.  Since that delay is easily avoided by simply
-     * getting bodyOutputStream or calling write(""), we don't worry about it.
-     */
-    if (this._bodyOutputStream && !this._asyncCopier)
-      this._startAsyncProcessor();
-  },
-
-  //
-  // see nsIHttpResponse.seizePower
-  //
-  seizePower: function()
-  {
-    if (this._processAsync)
-      throw Cr.NS_ERROR_NOT_AVAILABLE;
-    if (this._finished)
-      throw Cr.NS_ERROR_UNEXPECTED;
-    if (this._powerSeized)
-      return;
-    this._ensureAlive();
-
-    dumpn("*** forcefully seizing power over connection " +
-          this._connection.number + "...");
-
-    // Purge any already-written data without sending it.  We could as easily
-    // swap out the streams entirely, but that makes it possible to acquire and
-    // unknowingly use a stale reference, so we require there only be one of
-    // each stream ever for any response to avoid this complication.
-    if (this._asyncCopier)
-      this._asyncCopier.cancel(Cr.NS_BINDING_ABORTED);
-    this._asyncCopier = null;
-    if (this._bodyOutputStream)
-    {
-      var input = new BinaryInputStream(this._bodyInputStream);
-      var avail;
-      while ((avail = input.available()) > 0)
-        input.readByteArray(avail);
-    }
-
-    this._powerSeized = true;
-    if (this._bodyOutputStream)
-      this._startAsyncProcessor();
-  },
-
-  //
-  // see nsIHttpResponse.finish
-  //
-  finish: function()
-  {
-    if (!this._processAsync && !this._powerSeized)
-      throw Cr.NS_ERROR_UNEXPECTED;
-    if (this._finished)
-      return;
-
-    dumpn("*** finishing connection " + this._connection.number);
-    this._startAsyncProcessor(); // in case bodyOutputStream was never accessed
-    if (this._bodyOutputStream)
-      this._bodyOutputStream.close();
-    this._finished = true;
-  },
-
-
-  // NSISUPPORTS
-
-  //
-  // see nsISupports.QueryInterface
-  //
-  QueryInterface: function(iid)
-  {
-    if (iid.equals(Ci.nsIHttpResponse) || iid.equals(Ci.nsISupports))
-      return this;
-
-    throw Cr.NS_ERROR_NO_INTERFACE;
-  },
-
-
-  // POST-CONSTRUCTION API (not exposed externally)
-
-  /**
-   * The HTTP version number of this, as a string (e.g. "1.1").
-   */
-  get httpVersion()
-  {
-    this._ensureAlive();
-    return this._httpVersion.toString();
-  },
-
-  /**
-   * The HTTP status code of this response, as a string of three characters per
-   * RFC 2616.
-   */
-  get httpCode()
-  {
-    this._ensureAlive();
-
-    var codeString = (this._httpCode < 10 ? "0" : "") +
-                     (this._httpCode < 100 ? "0" : "") +
-                     this._httpCode;
-    return codeString;
-  },
-
-  /**
-   * The description of the HTTP status code of this response, or "" if none is
-   * set.
-   */
-  get httpDescription()
-  {
-    this._ensureAlive();
-
-    return this._httpDescription;
-  },
-
-  /**
-   * The headers in this response, as an nsHttpHeaders object.
-   */
-  get headers()
-  {
-    this._ensureAlive();
-
-    return this._headers;
-  },
-
-  //
-  // see nsHttpHeaders.getHeader
-  //
-  getHeader: function(name)
-  {
-    this._ensureAlive();
-
-    return this._headers.getHeader(name);
-  },
-
-  /**
-   * Determines whether this response may be abandoned in favor of a newly
-   * constructed response.  A response may be abandoned only if it is not being
-   * sent asynchronously and if raw control over it has not been taken from the
-   * server.
-   *
-   * @returns boolean
-   *   true iff no data has been written to the network
-   */
-  partiallySent: function()
-  {
-    dumpn("*** partiallySent()");
-    return this._processAsync || this._powerSeized;
-  },
-
-  /**
-   * If necessary, kicks off the remaining request processing needed to be done
-   * after a request handler performs its initial work upon this response.
-   */
-  complete: function()
-  {
-    dumpn("*** complete()");
-    if (this._processAsync || this._powerSeized)
-    {
-      NS_ASSERT(this._processAsync ^ this._powerSeized,
-                "can't both send async and relinquish power");
-      return;
-    }
-
-    NS_ASSERT(!this.partiallySent(), "completing a partially-sent response?");
-
-    this._startAsyncProcessor();
-
-    // Now make sure we finish processing this request!
-    if (this._bodyOutputStream)
-      this._bodyOutputStream.close();
-  },
-
-  /**
-   * Abruptly ends processing of this response, usually due to an error in an
-   * incoming request but potentially due to a bad error handler.  Since we
-   * cannot handle the error in the usual way (giving an HTTP error page in
-   * response) because data may already have been sent (or because the response
-   * might be expected to have been generated asynchronously or completely from
-   * scratch by the handler), we stop processing this response and abruptly
-   * close the connection.
-   *
-   * @param e : Error
-   *   the exception which precipitated this abort, or null if no such exception
-   *   was generated
-   */
-  abort: function(e)
-  {
-    dumpn("*** abort(<" + e + ">)");
-
-    // This response will be ended by the processor if one was created.
-    var copier = this._asyncCopier;
-    if (copier)
-    {
-      // We dispatch asynchronously here so that any pending writes of data to
-      // the connection will be deterministically written.  This makes it easier
-      // to specify exact behavior, and it makes observable behavior more
-      // predictable for clients.  Note that the correctness of this depends on
-      // callbacks in response to _waitToReadData in WriteThroughCopier
-      // happening asynchronously with respect to the actual writing of data to
-      // bodyOutputStream, as they currently do; if they happened synchronously,
-      // an event which ran before this one could write more data to the
-      // response body before we get around to canceling the copier.  We have
-      // tests for this in test_seizepower.js, however, and I can't think of a
-      // way to handle both cases without removing bodyOutputStream access and
-      // moving its effective write(data, length) method onto Response, which
-      // would be slower and require more code than this anyway.
-      gThreadManager.currentThread.dispatch({
-        run: function()
-        {
-          dumpn("*** canceling copy asynchronously...");
-          copier.cancel(Cr.NS_ERROR_UNEXPECTED);
-        }
-      }, Ci.nsIThread.DISPATCH_NORMAL);
-    }
-    else
-    {
-      this.end();
-    }
-  },
-
-  /**
-   * Closes this response's network connection, marks the response as finished,
-   * and notifies the server handler that the request is done being processed.
-   */
-  end: function()
-  {
-    NS_ASSERT(!this._ended, "ending this response twice?!?!");
-
-    this._connection.close();
-    if (this._bodyOutputStream)
-      this._bodyOutputStream.close();
-
-    this._finished = true;
-    this._ended = true;
-  },
-
-  // PRIVATE IMPLEMENTATION
-
-  /**
-   * Sends the status line and headers of this response if they haven't been
-   * sent and initiates the process of copying data written to this response's
-   * body to the network.
-   */
-  _startAsyncProcessor: function()
-  {
-    dumpn("*** _startAsyncProcessor()");
-
-    // Handle cases where we're being called a second time.  The former case
-    // happens when this is triggered both by complete() and by processAsync(),
-    // while the latter happens when processAsync() in conjunction with sent
-    // data causes abort() to be called.
-    if (this._asyncCopier || this._ended)
-    {
-      dumpn("*** ignoring second call to _startAsyncProcessor");
-      return;
-    }
-
-    // Send headers if they haven't been sent already and should be sent, then
-    // asynchronously continue to send the body.
-    if (this._headers && !this._powerSeized)
-    {
-      this._sendHeaders();
-      return;
-    }
-
-    this._headers = null;
-    this._sendBody();
-  },
-
-  /**
-   * Signals that all modifications to the response status line and headers are
-   * complete and then sends that data over the network to the client.  Once
-   * this method completes, a different response to the request that resulted
-   * in this response cannot be sent -- the only possible action in case of
-   * error is to abort the response and close the connection.
-   */
-  _sendHeaders: function()
-  {
-    dumpn("*** _sendHeaders()");
-
-    NS_ASSERT(this._headers);
-    NS_ASSERT(!this._powerSeized);
-
-    // request-line
-    var statusLine = "HTTP/" + this.httpVersion + " " +
-                     this.httpCode + " " +
-                     this.httpDescription + "\r\n";
-
-    // header post-processing
-
-    var headers = this._headers;
-    headers.setHeader("Connection", "close", false);
-    headers.setHeader("Server", "httpd.js", false);
-    if (!headers.hasHeader("Date"))
-      headers.setHeader("Date", toDateString(Date.now()), false);
-
-    // Any response not being processed asynchronously must have an associated
-    // Content-Length header for reasons of backwards compatibility with the
-    // initial server, which fully buffered every response before sending it.
-    // Beyond that, however, it's good to do this anyway because otherwise it's
-    // impossible to test behaviors that depend on the presence or absence of a
-    // Content-Length header.
-    if (!this._processAsync)
-    {
-      dumpn("*** non-async response, set Content-Length");
-
-      var bodyStream = this._bodyInputStream;
-      var avail = bodyStream ? bodyStream.available() : 0;
-
-      // XXX assumes stream will always report the full amount of data available
-      headers.setHeader("Content-Length", "" + avail, false);
-    }
-
-
-    // construct and send response
-    dumpn("*** header post-processing completed, sending response head...");
-
-    // request-line
-    var preambleData = [statusLine];
-
-    // headers
-    var headEnum = headers.enumerator;
-    while (headEnum.hasMoreElements())
-    {
-      var fieldName = headEnum.getNext()
-                              .QueryInterface(Ci.nsISupportsString)
-                              .data;
-      var values = headers.getHeaderValues(fieldName);
-      for (var i = 0, sz = values.length; i < sz; i++)
-        preambleData.push(fieldName + ": " + values[i] + "\r\n");
-    }
-
-    // end request-line/headers
-    preambleData.push("\r\n");
-
-    var preamble = preambleData.join("");
-
-    var responseHeadPipe = new Pipe(true, false, 0, PR_UINT32_MAX, null);
-    responseHeadPipe.outputStream.write(preamble, preamble.length);
-
-    var response = this;
-    var copyObserver =
-      {
-        onStartRequest: function(request, cx)
-        {
-          dumpn("*** preamble copying started");
-        },
-
-        onStopRequest: function(request, cx, statusCode)
-        {
-          dumpn("*** preamble copying complete " +
-                "[status=0x" + statusCode.toString(16) + "]");
-
-          if (!Components.isSuccessCode(statusCode))
-          {
-            dumpn("!!! header copying problems: non-success statusCode, " +
-                  "ending response");
-
-            response.end();
-          }
-          else
-          {
-            response._sendBody();
-          }
-        },
-
-        QueryInterface: function(aIID)
-        {
-          if (aIID.equals(Ci.nsIRequestObserver) || aIID.equals(Ci.nsISupports))
-            return this;
-
-          throw Cr.NS_ERROR_NO_INTERFACE;
-        }
-      };
-
-    var headerCopier = this._asyncCopier =
-      new WriteThroughCopier(responseHeadPipe.inputStream,
-                             this._connection.output,
-                             copyObserver, null);
-
-    responseHeadPipe.outputStream.close();
-
-    // Forbid setting any more headers or modifying the request line.
-    this._headers = null;
-  },
-
-  /**
-   * Asynchronously writes the body of the response (or the entire response, if
-   * seizePower() has been called) to the network.
-   */
-  _sendBody: function()
-  {
-    dumpn("*** _sendBody");
-
-    NS_ASSERT(!this._headers, "still have headers around but sending body?");
-
-    // If no body data was written, we're done
-    if (!this._bodyInputStream)
-    {
-      dumpn("*** empty body, response finished");
-      this.end();
-      return;
-    }
-
-    var response = this;
-    var copyObserver =
-      {
-        onStartRequest: function(request, context)
-        {
-          dumpn("*** onStartRequest");
-        },
-
-        onStopRequest: function(request, cx, statusCode)
-        {
-          dumpn("*** onStopRequest [status=0x" + statusCode.toString(16) + "]");
-
-          if (statusCode === Cr.NS_BINDING_ABORTED)
-          {
-            dumpn("*** terminating copy observer without ending the response");
-          }
-          else
-          {
-            if (!Components.isSuccessCode(statusCode))
-              dumpn("*** WARNING: non-success statusCode in onStopRequest");
-
-            response.end();
-          }
-        },
-
-        QueryInterface: function(aIID)
-        {
-          if (aIID.equals(Ci.nsIRequestObserver) || aIID.equals(Ci.nsISupports))
-            return this;
-
-          throw Cr.NS_ERROR_NO_INTERFACE;
-        }
-      };
-
-    dumpn("*** starting async copier of body data...");
-    this._asyncCopier =
-      new WriteThroughCopier(this._bodyInputStream, this._connection.output,
-                            copyObserver, null);
-  },
-
-  /** Ensures that this hasn't been ended. */
-  _ensureAlive: function()
-  {
-    NS_ASSERT(!this._ended, "not handling response lifetime correctly");
-  }
-};
-
-/**
- * Size of the segments in the buffer used in storing response data and writing
- * it to the socket.
- */
-Response.SEGMENT_SIZE = 8192;
-
-/** Serves double duty in WriteThroughCopier implementation. */
-function notImplemented()
-{
-  throw Cr.NS_ERROR_NOT_IMPLEMENTED;
-}
-
-/** Returns true iff the given exception represents stream closure. */
-function streamClosed(e)
-{
-  return e === Cr.NS_BASE_STREAM_CLOSED ||
-         (typeof e === "object" && e.result === Cr.NS_BASE_STREAM_CLOSED);
-}
-
-/** Returns true iff the given exception represents a blocked stream. */
-function wouldBlock(e)
-{
-  return e === Cr.NS_BASE_STREAM_WOULD_BLOCK ||
-         (typeof e === "object" && e.result === Cr.NS_BASE_STREAM_WOULD_BLOCK);
-}
-
-/**
- * Copies data from source to sink as it becomes available, when that data can
- * be written to sink without blocking.
- *
- * @param source : nsIAsyncInputStream
- *   the stream from which data is to be read
- * @param sink : nsIAsyncOutputStream
- *   the stream to which data is to be copied
- * @param observer : nsIRequestObserver
- *   an observer which will be notified when the copy starts and finishes
- * @param context : nsISupports
- *   context passed to observer when notified of start/stop
- * @throws NS_ERROR_NULL_POINTER
- *   if source, sink, or observer are null
- */
-function WriteThroughCopier(source, sink, observer, context)
-{
-  if (!source || !sink || !observer)
-    throw Cr.NS_ERROR_NULL_POINTER;
-
-  /** Stream from which data is being read. */
-  this._source = source;
-
-  /** Stream to which data is being written. */
-  this._sink = sink;
-
-  /** Observer watching this copy. */
-  this._observer = observer;
-
-  /** Context for the observer watching this. */
-  this._context = context;
-
-  /**
-   * True iff this is currently being canceled (cancel has been called, the
-   * callback may not yet have been made).
-   */
-  this._canceled = false;
-
-  /**
-   * False until all data has been read from input and written to output, at
-   * which point this copy is completed and cancel() is asynchronously called.
-   */
-  this._completed = false;
-
-  /** Required by nsIRequest, meaningless. */
-  this.loadFlags = 0;
-  /** Required by nsIRequest, meaningless. */
-  this.loadGroup = null;
-  /** Required by nsIRequest, meaningless. */
-  this.name = "response-body-copy";
-
-  /** Status of this request. */
-  this.status = Cr.NS_OK;
-
-  /** Arrays of byte strings waiting to be written to output. */
-  this._pendingData = [];
-
-  // start copying
-  try
-  {
-    observer.onStartRequest(this, context);
-    this._waitToReadData();
-    this._waitForSinkClosure();
-  }
-  catch (e)
-  {
-    dumpn("!!! error starting copy: " + e +
-          ("lineNumber" in e ? ", line " + e.lineNumber : ""));
-    dumpn(e.stack);
-    this.cancel(Cr.NS_ERROR_UNEXPECTED);
-  }
-}
-WriteThroughCopier.prototype =
-{
-  /* nsISupports implementation */
-
-  QueryInterface: function(iid)
-  {
-    if (iid.equals(Ci.nsIInputStreamCallback) ||
-        iid.equals(Ci.nsIOutputStreamCallback) ||
-        iid.equals(Ci.nsIRequest) ||
-        iid.equals(Ci.nsISupports))
-    {
-      return this;
-    }
-
-    throw Cr.NS_ERROR_NO_INTERFACE;
-  },
-
-
-  // NSIINPUTSTREAMCALLBACK
-
-  /**
-   * Receives a more-data-in-input notification and writes the corresponding
-   * data to the output.
-   *
-   * @param input : nsIAsyncInputStream
-   *   the input stream on whose data we have been waiting
-   */
-  onInputStreamReady: function(input)
-  {
-    if (this._source === null)
-      return;
-
-    dumpn("*** onInputStreamReady");
-
-    //
-    // Ordinarily we'll read a non-zero amount of data from input, queue it up
-    // to be written and then wait for further callbacks.  The complications in
-    // this method are the cases where we deviate from that behavior when errors
-    // occur or when copying is drawing to a finish.
-    //
-    // The edge cases when reading data are:
-    //
-    //   Zero data is read
-    //     If zero data was read, we're at the end of available data, so we can
-    //     should stop reading and move on to writing out what we have (or, if
-    //     we've already done that, onto notifying of completion).
-    //   A stream-closed exception is thrown
-    //     This is effectively a less kind version of zero data being read; the
-    //     only difference is that we notify of completion with that result
-    //     rather than with NS_OK.
-    //   Some other exception is thrown
-    //     This is the least kind result.  We don't know what happened, so we
-    //     act as though the stream closed except that we notify of completion
-    //     with the result NS_ERROR_UNEXPECTED.
-    //
-
-    var bytesWanted = 0, bytesConsumed = -1;
-    try
-    {
-      input = new BinaryInputStream(input);
-
-      bytesWanted = Math.min(input.available(), Response.SEGMENT_SIZE);
-      dumpn("*** input wanted: " + bytesWanted);
-
-      if (bytesWanted > 0)
-      {
-        var data = input.readByteArray(bytesWanted);
-        bytesConsumed = data.length;
-        this._pendingData.push(String.fromCharCode.apply(String, data));
-      }
-
-      dumpn("*** " + bytesConsumed + " bytes read");
-
-      // Handle the zero-data edge case in the same place as all other edge
-      // cases are handled.
-      if (bytesWanted === 0)
-        throw Cr.NS_BASE_STREAM_CLOSED;
-    }
-    catch (e)
-    {
-      if (streamClosed(e))
-      {
-        dumpn("*** input stream closed");
-        e = bytesWanted === 0 ? Cr.NS_OK : Cr.NS_ERROR_UNEXPECTED;
-      }
-      else
-      {
-        dumpn("!!! unexpected error reading from input, canceling: " + e);
-        e = Cr.NS_ERROR_UNEXPECTED;
-      }
-
-      this._doneReadingSource(e);
-      return;
-    }
-
-    var pendingData = this._pendingData;
-
-    NS_ASSERT(bytesConsumed > 0);
-    NS_ASSERT(pendingData.length > 0, "no pending data somehow?");
-    NS_ASSERT(pendingData[pendingData.length - 1].length > 0,
-              "buffered zero bytes of data?");
-
-    NS_ASSERT(this._source !== null);
-
-    // Reading has gone great, and we've gotten data to write now.  What if we
-    // don't have a place to write that data, because output went away just
-    // before this read?  Drop everything on the floor, including new data, and
-    // cancel at this point.
-    if (this._sink === null)
-    {
-      pendingData.length = 0;
-      this._doneReadingSource(Cr.NS_ERROR_UNEXPECTED);
-      return;
-    }
-
-    // Okay, we've read the data, and we know we have a place to write it.  We
-    // need to queue up the data to be written, but *only* if none is queued
-    // already -- if data's already queued, the code that actually writes the
-    // data will make sure to wait on unconsumed pending data.
-    try
-    {
-      if (pendingData.length === 1)
-        this._waitToWriteData();
-    }
-    catch (e)
-    {
-      dumpn("!!! error waiting to write data just read, swallowing and " +
-            "writing only what we already have: " + e);
-      this._doneWritingToSink(Cr.NS_ERROR_UNEXPECTED);
-      return;
-    }
-
-    // Whee!  We successfully read some data, and it's successfully queued up to
-    // be written.  All that remains now is to wait for more data to read.
-    try
-    {
-      this._waitToReadData();
-    }
-    catch (e)
-    {
-      dumpn("!!! error waiting to read more data: " + e);
-      this._doneReadingSource(Cr.NS_ERROR_UNEXPECTED);
-    }
-  },
-
-
-  // NSIOUTPUTSTREAMCALLBACK
-
-  /**
-   * Callback when data may be written to the output stream without blocking, or
-   * when the output stream has been closed.
-   *
-   * @param output : nsIAsyncOutputStream
-   *   the output stream on whose writability we've been waiting, also known as
-   *   this._sink
-   */
-  onOutputStreamReady: function(output)
-  {
-    if (this._sink === null)
-      return;
-
-    dumpn("*** onOutputStreamReady");
-
-    var pendingData = this._pendingData;
-    if (pendingData.length === 0)
-    {
-      // There's no pending data to write.  The only way this can happen is if
-      // we're waiting on the output stream's closure, so we can respond to a
-      // copying failure as quickly as possible (rather than waiting for data to
-      // be available to read and then fail to be copied).  Therefore, we must
-      // be done now -- don't bother to attempt to write anything and wrap
-      // things up.
-      dumpn("!!! output stream closed prematurely, ending copy");
-
-      this._doneWritingToSink(Cr.NS_ERROR_UNEXPECTED);
-      return;
-    }
-
-
-    NS_ASSERT(pendingData[0].length > 0, "queued up an empty quantum?");
-
-    //
-    // Write out the first pending quantum of data.  The possible errors here
-    // are:
-    //
-    //   The write might fail because we can't write that much data
-    //     Okay, we've written what we can now, so re-queue what's left and
-    //     finish writing it out later.
-    //   The write failed because the stream was closed
-    //     Discard pending data that we can no longer write, stop reading, and
-    //     signal that copying finished.
-    //   Some other error occurred.
-    //     Same as if the stream were closed, but notify with the status
-    //     NS_ERROR_UNEXPECTED so the observer knows something was wonky.
-    //
-
-    try
-    {
-      var quantum = pendingData[0];
-
-      // XXX |quantum| isn't guaranteed to be ASCII, so we're relying on
-      //     undefined behavior!  We're only using this because writeByteArray
-      //     is unusably broken for asynchronous output streams; see bug 532834
-      //     for details.
-      var bytesWritten = output.write(quantum, quantum.length);
-      if (bytesWritten === quantum.length)
-        pendingData.shift();
-      else
-        pendingData[0] = quantum.substring(bytesWritten);
-
-      dumpn("*** wrote " + bytesWritten + " bytes of data");
-    }
-    catch (e)
-    {
-      if (wouldBlock(e))
-      {
-        NS_ASSERT(pendingData.length > 0,
-                  "stream-blocking exception with no data to write?");
-        NS_ASSERT(pendingData[0].length > 0,
-                  "stream-blocking exception with empty quantum?");
-        this._waitToWriteData();
-        return;
-      }
-
-      if (streamClosed(e))
-        dumpn("!!! output stream prematurely closed, signaling error...");
-      else
-        dumpn("!!! unknown error: " + e + ", quantum=" + quantum);
-
-      this._doneWritingToSink(Cr.NS_ERROR_UNEXPECTED);
-      return;
-    }
-
-    // The day is ours!  Quantum written, now let's see if we have more data
-    // still to write.
-    try
-    {
-      if (pendingData.length > 0)
-      {
-        this._waitToWriteData();
-        return;
-      }
-    }
-    catch (e)
-    {
-      dumpn("!!! unexpected error waiting to write pending data: " + e);
-      this._doneWritingToSink(Cr.NS_ERROR_UNEXPECTED);
-      return;
-    }
-
-    // Okay, we have no more pending data to write -- but might we get more in
-    // the future?
-    if (this._source !== null)
-    {
-      /*
-       * If we might, then wait for the output stream to be closed.  (We wait
-       * only for closure because we have no data to write -- and if we waited
-       * for a specific amount of data, we would get repeatedly notified for no
-       * reason if over time the output stream permitted more and more data to
-       * be written to it without blocking.)
-       */
-       this._waitForSinkClosure();
-    }
-    else
-    {
-      /*
-       * On the other hand, if we can't have more data because the input
-       * stream's gone away, then it's time to notify of copy completion.
-       * Victory!
-       */
-      this._sink = null;
-      this._cancelOrDispatchCancelCallback(Cr.NS_OK);
-    }
-  },
-
-
-  // NSIREQUEST
-
-  /** Returns true if the cancel observer hasn't been notified yet. */
-  isPending: function()
-  {
-    return !this._completed;
-  },
-
-  /** Not implemented, don't use! */
-  suspend: notImplemented,
-  /** Not implemented, don't use! */
-  resume: notImplemented,
-
-  /**
-   * Cancels data reading from input, asynchronously writes out any pending
-   * data, and causes the observer to be notified with the given error code when
-   * all writing has finished.
-   *
-   * @param status : nsresult
-   *   the status to pass to the observer when data copying has been canceled
-   */
-  cancel: function(status)
-  {
-    dumpn("*** cancel(" + status.toString(16) + ")");
-
-    if (this._canceled)
-    {
-      dumpn("*** suppressing a late cancel");
-      return;
-    }
-
-    this._canceled = true;
-    this.status = status;
-
-    // We could be in the middle of absolutely anything at this point.  Both
-    // input and output might still be around, we might have pending data to
-    // write, and in general we know nothing about the state of the world.  We
-    // therefore must assume everything's in progress and take everything to its
-    // final steady state (or so far as it can go before we need to finish
-    // writing out remaining data).
-
-    this._doneReadingSource(status);
-  },
-
-
-  // PRIVATE IMPLEMENTATION
-
-  /**
-   * Stop reading input if we haven't already done so, passing e as the status
-   * when closing the stream, and kick off a copy-completion notice if no more
-   * data remains to be written.
-   *
-   * @param e : nsresult
-   *   the status to be used when closing the input stream
-   */
-  _doneReadingSource: function(e)
-  {
-    dumpn("*** _doneReadingSource(0x" + e.toString(16) + ")");
-
-    this._finishSource(e);
-    if (this._pendingData.length === 0)
-      this._sink = null;
-    else
-      NS_ASSERT(this._sink !== null, "null output?");
-
-    // If we've written out all data read up to this point, then it's time to
-    // signal completion.
-    if (this._sink === null)
-    {
-      NS_ASSERT(this._pendingData.length === 0, "pending data still?");
-      this._cancelOrDispatchCancelCallback(e);
-    }
-  },
-
-  /**
-   * Stop writing output if we haven't already done so, discard any data that
-   * remained to be sent, close off input if it wasn't already closed, and kick
-   * off a copy-completion notice.
-   *
-   * @param e : nsresult
-   *   the status to be used when closing input if it wasn't already closed
-   */
-  _doneWritingToSink: function(e)
-  {
-    dumpn("*** _doneWritingToSink(0x" + e.toString(16) + ")");
-
-    this._pendingData.length = 0;
-    this._sink = null;
-    this._doneReadingSource(e);
-  },
-
-  /**
-   * Completes processing of this copy: either by canceling the copy if it
-   * hasn't already been canceled using the provided status, or by dispatching
-   * the cancel callback event (with the originally provided status, of course)
-   * if it already has been canceled.
-   *
-   * @param status : nsresult
-   *   the status code to use to cancel this, if this hasn't already been
-   *   canceled
-   */
-  _cancelOrDispatchCancelCallback: function(status)
-  {
-    dumpn("*** _cancelOrDispatchCancelCallback(" + status + ")");
-
-    NS_ASSERT(this._source === null, "should have finished input");
-    NS_ASSERT(this._sink === null, "should have finished output");
-    NS_ASSERT(this._pendingData.length === 0, "should have no pending data");
-
-    if (!this._canceled)
-    {
-      this.cancel(status);
-      return;
-    }
-
-    var self = this;
-    var event =
-      {
-        run: function()
-        {
-          dumpn("*** onStopRequest async callback");
-
-          self._completed = true;
-          try
-          {
-            self._observer.onStopRequest(self, self._context, self.status);
-          }
-          catch (e)
-          {
-            NS_ASSERT(false,
-                      "how are we throwing an exception here?  we control " +
-                      "all the callers!  " + e);
-          }
-        }
-      };
-
-    gThreadManager.currentThread.dispatch(event, Ci.nsIThread.DISPATCH_NORMAL);
-  },
-
-  /**
-   * Kicks off another wait for more data to be available from the input stream.
-   */
-  _waitToReadData: function()
-  {
-    dumpn("*** _waitToReadData");
-    this._source.asyncWait(this, 0, Response.SEGMENT_SIZE,
-                           gThreadManager.mainThread);
-  },
-
-  /**
-   * Kicks off another wait until data can be written to the output stream.
-   */
-  _waitToWriteData: function()
-  {
-    dumpn("*** _waitToWriteData");
-
-    var pendingData = this._pendingData;
-    NS_ASSERT(pendingData.length > 0, "no pending data to write?");
-    NS_ASSERT(pendingData[0].length > 0, "buffered an empty write?");
-
-    this._sink.asyncWait(this, 0, pendingData[0].length,
-                         gThreadManager.mainThread);
-  },
-
-  /**
-   * Kicks off a wait for the sink to which data is being copied to be closed.
-   * We wait for stream closure when we don't have any data to be copied, rather
-   * than waiting to write a specific amount of data.  We can't wait to write
-   * data because the sink might be infinitely writable, and if no data appears
-   * in the source for a long time we might have to spin quite a bit waiting to
-   * write, waiting to write again, &c.  Waiting on stream closure instead means
-   * we'll get just one notification if the sink dies.  Note that when data
-   * starts arriving from the sink we'll resume waiting for data to be written,
-   * dropping this closure-only callback entirely.
-   */
-  _waitForSinkClosure: function()
-  {
-    dumpn("*** _waitForSinkClosure");
-
-    this._sink.asyncWait(this, Ci.nsIAsyncOutputStream.WAIT_CLOSURE_ONLY, 0,
-                         gThreadManager.mainThread);
-  },
-
-  /**
-   * Closes input with the given status, if it hasn't already been closed;
-   * otherwise a no-op.
-   *
-   * @param status : nsresult
-   *   status code use to close the source stream if necessary
-   */
-  _finishSource: function(status)
-  {
-    dumpn("*** _finishSource(" + status.toString(16) + ")");
-
-    if (this._source !== null)
-    {
-      this._source.closeWithStatus(status);
-      this._source = null;
-    }
-  }
-};
-
-
-/**
- * A container for utility functions used with HTTP headers.
- */
-const headerUtils =
-{
-  /**
-   * Normalizes fieldName (by converting it to lowercase) and ensures it is a
-   * valid header field name (although not necessarily one specified in RFC
-   * 2616).
-   *
-   * @throws NS_ERROR_INVALID_ARG
-   *   if fieldName does not match the field-name production in RFC 2616
-   * @returns string
-   *   fieldName converted to lowercase if it is a valid header, for characters
-   *   where case conversion is possible
-   */
-  normalizeFieldName: function(fieldName)
-  {
-    if (fieldName == "")
-      throw Cr.NS_ERROR_INVALID_ARG;
-
-    for (var i = 0, sz = fieldName.length; i < sz; i++)
-    {
-      if (!IS_TOKEN_ARRAY[fieldName.charCodeAt(i)])
-      {
-        dumpn(fieldName + " is not a valid header field name!");
-        throw Cr.NS_ERROR_INVALID_ARG;
-      }
-    }
-
-    return fieldName.toLowerCase();
-  },
-
-  /**
-   * Ensures that fieldValue is a valid header field value (although not
-   * necessarily as specified in RFC 2616 if the corresponding field name is
-   * part of the HTTP protocol), normalizes the value if it is, and
-   * returns the normalized value.
-   *
-   * @param fieldValue : string
-   *   a value to be normalized as an HTTP header field value
-   * @throws NS_ERROR_INVALID_ARG
-   *   if fieldValue does not match the field-value production in RFC 2616
-   * @returns string
-   *   fieldValue as a normalized HTTP header field value
-   */
-  normalizeFieldValue: function(fieldValue)
-  {
-    // field-value    = *( field-content | LWS )
-    // field-content  = <the OCTETs making up the field-value
-    //                  and consisting of either *TEXT or combinations
-    //                  of token, separators, and quoted-string>
-    // TEXT           = <any OCTET except CTLs,
-    //                  but including LWS>
-    // LWS            = [CRLF] 1*( SP | HT )
-    //
-    // quoted-string  = ( <"> *(qdtext | quoted-pair ) <"> )
-    // qdtext         = <any TEXT except <">>
-    // quoted-pair    = "\" CHAR
-    // CHAR           = <any US-ASCII character (octets 0 - 127)>
-
-    // Any LWS that occurs between field-content MAY be replaced with a single
-    // SP before interpreting the field value or forwarding the message
-    // downstream (section 4.2); we replace 1*LWS with a single SP
-    var val = fieldValue.replace(/(?:(?:\r\n)?[ \t]+)+/g, " ");
-
-    // remove leading/trailing LWS (which has been converted to SP)
-    val = val.replace(/^ +/, "").replace(/ +$/, "");
-
-    // that should have taken care of all CTLs, so val should contain no CTLs
-    for (var i = 0, len = val.length; i < len; i++)
-      if (isCTL(val.charCodeAt(i)))
-        throw Cr.NS_ERROR_INVALID_ARG;
-
-    // XXX disallows quoted-pair where CHAR is a CTL -- will not invalidly
-    //     normalize, however, so this can be construed as a tightening of the
-    //     spec and not entirely as a bug
-    return val;
-  }
-};
-
-
-
-/**
- * Converts the given string into a string which is safe for use in an HTML
- * context.
- *
- * @param str : string
- *   the string to make HTML-safe
- * @returns string
- *   an HTML-safe version of str
- */
-function htmlEscape(str)
-{
-  // this is naive, but it'll work
-  var s = "";
-  for (var i = 0; i < str.length; i++)
-    s += "&#" + str.charCodeAt(i) + ";";
-  return s;
-}
-
-
-/**
- * Constructs an object representing an HTTP version (see section 3.1).
- *
- * @param versionString
- *   a string of the form "#.#", where # is an non-negative decimal integer with
- *   or without leading zeros
- * @throws
- *   if versionString does not specify a valid HTTP version number
- */
-function nsHttpVersion(versionString)
-{
-  var matches = /^(\d+)\.(\d+)$/.exec(versionString);
-  if (!matches)
-    throw "Not a valid HTTP version!";
-
-  /** The major version number of this, as a number. */
-  this.major = parseInt(matches[1], 10);
-
-  /** The minor version number of this, as a number. */
-  this.minor = parseInt(matches[2], 10);
-
-  if (isNaN(this.major) || isNaN(this.minor) ||
-      this.major < 0    || this.minor < 0)
-    throw "Not a valid HTTP version!";
-}
-nsHttpVersion.prototype =
-{
-  /**
-   * Returns the standard string representation of the HTTP version represented
-   * by this (e.g., "1.1").
-   */
-  toString: function ()
-  {
-    return this.major + "." + this.minor;
-  },
-
-  /**
-   * Returns true if this represents the same HTTP version as otherVersion,
-   * false otherwise.
-   *
-   * @param otherVersion : nsHttpVersion
-   *   the version to compare against this
-   */
-  equals: function (otherVersion)
-  {
-    return this.major == otherVersion.major &&
-           this.minor == otherVersion.minor;
-  },
-
-  /** True if this >= otherVersion, false otherwise. */
-  atLeast: function(otherVersion)
-  {
-    return this.major > otherVersion.major ||
-           (this.major == otherVersion.major &&
-            this.minor >= otherVersion.minor);
-  }
-};
-
-nsHttpVersion.HTTP_1_0 = new nsHttpVersion("1.0");
-nsHttpVersion.HTTP_1_1 = new nsHttpVersion("1.1");
-
-
-/**
- * An object which stores HTTP headers for a request or response.
- *
- * Note that since headers are case-insensitive, this object converts headers to
- * lowercase before storing them.  This allows the getHeader and hasHeader
- * methods to work correctly for any case of a header, but it means that the
- * values returned by .enumerator may not be equal case-sensitively to the
- * values passed to setHeader when adding headers to this.
- */
-function nsHttpHeaders()
-{
-  /**
-   * A hash of headers, with header field names as the keys and header field
-   * values as the values.  Header field names are case-insensitive, but upon
-   * insertion here they are converted to lowercase.  Header field values are
-   * normalized upon insertion to contain no leading or trailing whitespace.
-   *
-   * Note also that per RFC 2616, section 4.2, two headers with the same name in
-   * a message may be treated as one header with the same field name and a field
-   * value consisting of the separate field values joined together with a "," in
-   * their original order.  This hash stores multiple headers with the same name
-   * in this manner.
-   */
-  this._headers = {};
-}
-nsHttpHeaders.prototype =
-{
-  /**
-   * Sets the header represented by name and value in this.
-   *
-   * @param name : string
-   *   the header name
-   * @param value : string
-   *   the header value
-   * @throws NS_ERROR_INVALID_ARG
-   *   if name or value is not a valid header component
-   */
-  setHeader: function(fieldName, fieldValue, merge)
-  {
-    var name = headerUtils.normalizeFieldName(fieldName);
-    var value = headerUtils.normalizeFieldValue(fieldValue);
-
-    // The following three headers are stored as arrays because their real-world
-    // syntax prevents joining individual headers into a single header using 
-    // ",".  See also <http://hg.mozilla.org/mozilla-central/diff/9b2a99adc05e/netwerk/protocol/http/src/nsHttpHeaderArray.cpp#l77>
-    if (merge && name in this._headers)
-    {
-      if (name === "www-authenticate" ||
-          name === "proxy-authenticate" ||
-          name === "set-cookie") 
-      {
-        this._headers[name].push(value);
-      }
-      else 
-      {
-        this._headers[name][0] += "," + value;
-        NS_ASSERT(this._headers[name].length === 1,
-            "how'd a non-special header have multiple values?")
-      }
-    }
-    else
-    {
-      this._headers[name] = [value];
-    }
-  },
-
-  /**
-   * Returns the value for the header specified by this.
-   *
-   * @throws NS_ERROR_INVALID_ARG
-   *   if fieldName does not constitute a valid header field name
-   * @throws NS_ERROR_NOT_AVAILABLE
-   *   if the given header does not exist in this
-   * @returns string
-   *   the field value for the given header, possibly with non-semantic changes
-   *   (i.e., leading/trailing whitespace stripped, whitespace runs replaced
-   *   with spaces, etc.) at the option of the implementation; multiple 
-   *   instances of the header will be combined with a comma, except for 
-   *   the three headers noted in the description of getHeaderValues
-   */
-  getHeader: function(fieldName)
-  {
-    return this.getHeaderValues(fieldName).join("\n");
-  },
-
-  /**
-   * Returns the value for the header specified by fieldName as an array.
-   *
-   * @throws NS_ERROR_INVALID_ARG
-   *   if fieldName does not constitute a valid header field name
-   * @throws NS_ERROR_NOT_AVAILABLE
-   *   if the given header does not exist in this
-   * @returns [string]
-   *   an array of all the header values in this for the given
-   *   header name.  Header values will generally be collapsed
-   *   into a single header by joining all header values together
-   *   with commas, but certain headers (Proxy-Authenticate,
-   *   WWW-Authenticate, and Set-Cookie) violate the HTTP spec
-   *   and cannot be collapsed in this manner.  For these headers
-   *   only, the returned array may contain multiple elements if
-   *   that header has been added more than once.
-   */
-  getHeaderValues: function(fieldName)
-  {
-    var name = headerUtils.normalizeFieldName(fieldName);
-
-    if (name in this._headers)
-      return this._headers[name];
-    else
-      throw Cr.NS_ERROR_NOT_AVAILABLE;
-  },
-
-  /**
-   * Returns true if a header with the given field name exists in this, false
-   * otherwise.
-   *
-   * @param fieldName : string
-   *   the field name whose existence is to be determined in this
-   * @throws NS_ERROR_INVALID_ARG
-   *   if fieldName does not constitute a valid header field name
-   * @returns boolean
-   *   true if the header's present, false otherwise
-   */
-  hasHeader: function(fieldName)
-  {
-    var name = headerUtils.normalizeFieldName(fieldName);
-    return (name in this._headers);
-  },
-
-  /**
-   * Returns a new enumerator over the field names of the headers in this, as
-   * nsISupportsStrings.  The names returned will be in lowercase, regardless of
-   * how they were input using setHeader (header names are case-insensitive per
-   * RFC 2616).
-   */
-  get enumerator()
-  {
-    var headers = [];
-    for (var i in this._headers)
-    {
-      var supports = new SupportsString();
-      supports.data = i;
-      headers.push(supports);
-    }
-
-    return new nsSimpleEnumerator(headers);
-  }
-};
-
-
-/**
- * Constructs an nsISimpleEnumerator for the given array of items.
- *
- * @param items : Array
- *   the items, which must all implement nsISupports
- */
-function nsSimpleEnumerator(items)
-{
-  this._items = items;
-  this._nextIndex = 0;
-}
-nsSimpleEnumerator.prototype =
-{
-  hasMoreElements: function()
-  {
-    return this._nextIndex < this._items.length;
-  },
-  getNext: function()
-  {
-    if (!this.hasMoreElements())
-      throw Cr.NS_ERROR_NOT_AVAILABLE;
-
-    return this._items[this._nextIndex++];
-  },
-  QueryInterface: function(aIID)
-  {
-    if (Ci.nsISimpleEnumerator.equals(aIID) ||
-        Ci.nsISupports.equals(aIID))
-      return this;
-
-    throw Cr.NS_ERROR_NO_INTERFACE;
-  }
-};
-
-
-/**
- * A representation of the data in an HTTP request.
- *
- * @param port : uint
- *   the port on which the server receiving this request runs
- */
-function Request(port)
-{
-  /** Method of this request, e.g. GET or POST. */
-  this._method = "";
-
-  /** Path of the requested resource; empty paths are converted to '/'. */
-  this._path = "";
-
-  /** Query string, if any, associated with this request (not including '?'). */
-  this._queryString = "";
-
-  /** Scheme of requested resource, usually http, always lowercase. */
-  this._scheme = "http";
-
-  /** Hostname on which the requested resource resides. */
-  this._host = undefined;
-
-  /** Port number over which the request was received. */
-  this._port = port;
-
-  var bodyPipe = new Pipe(false, false, 0, PR_UINT32_MAX, null);
-
-  /** Stream from which data in this request's body may be read. */
-  this._bodyInputStream = bodyPipe.inputStream;
-
-  /** Stream to which data in this request's body is written. */
-  this._bodyOutputStream = bodyPipe.outputStream;
-
-  /**
-   * The headers in this request.
-   */
-  this._headers = new nsHttpHeaders();
-
-  /**
-   * For the addition of ad-hoc properties and new functionality without having
-   * to change nsIHttpRequest every time; currently lazily created, as its only
-   * use is in directory listings.
-   */
-  this._bag = null;
-}
-Request.prototype =
-{
-  // SERVER METADATA
-
-  //
-  // see nsIHttpRequest.scheme
-  //
-  get scheme()
-  {
-    return this._scheme;
-  },
-
-  //
-  // see nsIHttpRequest.host
-  //
-  get host()
-  {
-    return this._host;
-  },
-
-  //
-  // see nsIHttpRequest.port
-  //
-  get port()
-  {
-    return this._port;
-  },
-
-  // REQUEST LINE
-
-  //
-  // see nsIHttpRequest.method
-  //
-  get method()
-  {
-    return this._method;
-  },
-
-  //
-  // see nsIHttpRequest.httpVersion
-  //
-  get httpVersion()
-  {
-    return this._httpVersion.toString();
-  },