Backed out changeset f7e0ffc1debd (bug 879475) for B2G reftest crashes
authorEd Morley <emorley@mozilla.com>
Mon, 09 Jun 2014 11:28:40 +0100
changeset 206764 43a2f570cea26b5ee50699a321462b23f6a98ce8
parent 206763 403e528b14dd77c181e949e98eac7709c1978bea
child 206809 8bbb61b80df4579958b38b74a9487f559466c740
child 208391 a31a36670f9251f54a19afcfa3db69eae59c5276
push id3741
push userasasaki@mozilla.com
push dateMon, 21 Jul 2014 20:25:18 +0000
treeherdermozilla-beta@4d6f46f5af68 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs879475
milestone32.0a1
backs outf7e0ffc1debdbac432fa5a96bd0d5ae7765c1fc9
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Backed out changeset f7e0ffc1debd (bug 879475) for B2G reftest crashes
content/base/src/nsFrameLoader.cpp
content/base/src/nsFrameLoader.h
content/base/src/nsFrameMessageManager.cpp
content/base/src/nsFrameMessageManager.h
dom/base/nsContentPermissionHelper.cpp
dom/ipc/Blob.cpp
dom/ipc/Blob.h
dom/ipc/ContentParent.cpp
dom/ipc/ContentParent.h
dom/ipc/ProcessPriorityManager.cpp
dom/ipc/TabParent.cpp
dom/ipc/TabParent.h
dom/ipc/moz.build
dom/ipc/nsIContentParent.cpp
dom/ipc/nsIContentParent.h
--- a/content/base/src/nsFrameLoader.cpp
+++ b/content/base/src/nsFrameLoader.cpp
@@ -2296,17 +2296,17 @@ nsFrameLoader::DoSendAsyncMessage(JSCont
                                   const nsAString& aMessage,
                                   const StructuredCloneData& aData,
                                   JS::Handle<JSObject *> aCpows,
                                   nsIPrincipal* aPrincipal)
 {
   TabParent* tabParent = mRemoteBrowser;
   if (tabParent) {
     ClonedMessageData data;
-    nsIContentParent* cp = tabParent->Manager();
+    ContentParent* cp = tabParent->Manager();
     if (!BuildClonedMessageDataForParent(cp, aData, data)) {
       return false;
     }
     InfallibleTArray<mozilla::jsipc::CpowEntry> cpows;
     if (aCpows && !cp->GetCPOWManager()->Wrap(aCx, aCpows, &cpows)) {
       return false;
     }
     return tabParent->SendAsyncMessage(nsString(aMessage), data, cpows,
--- a/content/base/src/nsFrameLoader.h
+++ b/content/base/src/nsFrameLoader.h
@@ -440,17 +440,17 @@ private:
 
   // Backs nsIFrameLoader::{Get,Set}Visible.  Visibility state here relates to
   // whether this frameloader's <iframe mozbrowser> is setVisible(true)'ed, and
   // doesn't necessarily correlate with docshell/document visibility.
   bool mVisible : 1;
 
   // The ContentParent associated with mRemoteBrowser.  This was added as a
   // strong ref in bug 545237, and we're not sure if we can get rid of it.
-  nsRefPtr<mozilla::dom::nsIContentParent> mContentParent;
+  nsRefPtr<mozilla::dom::ContentParent> mContentParent;
   RenderFrameParent* mCurrentRemoteFrame;
   TabParent* mRemoteBrowser;
   uint64_t mChildID;
 
   // See nsIFrameLoader.idl.  Short story, if !(mRenderMode &
   // RENDER_MODE_ASYNC_SCROLL), all the fields below are ignored in
   // favor of what content tells.
   uint32_t mRenderMode;
--- a/content/base/src/nsFrameMessageManager.cpp
+++ b/content/base/src/nsFrameMessageManager.cpp
@@ -4,16 +4,17 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "base/basictypes.h"
 
 #include "nsFrameMessageManager.h"
 
 #include "AppProcessChecker.h"
 #include "ContentChild.h"
+#include "ContentParent.h"
 #include "nsContentUtils.h"
 #include "nsCxPusher.h"
 #include "nsError.h"
 #include "nsIXPConnect.h"
 #include "jsapi.h"
 #include "nsJSUtils.h"
 #include "nsJSPrincipals.h"
 #include "nsNetUtil.h"
@@ -25,26 +26,23 @@
 #include "nsIMemoryReporter.h"
 #include "nsIProtocolHandler.h"
 #include "nsIScriptSecurityManager.h"
 #include "nsIJSRuntimeService.h"
 #include "nsIDOMClassInfo.h"
 #include "nsIDOMFile.h"
 #include "xpcpublic.h"
 #include "mozilla/Preferences.h"
-#include "mozilla/dom/nsIContentParent.h"
-#include "mozilla/dom/PermissionMessageUtils.h"
 #include "mozilla/dom/StructuredCloneUtils.h"
 #include "mozilla/dom/PBlobChild.h"
 #include "mozilla/dom/PBlobParent.h"
 #include "JavaScriptChild.h"
 #include "JavaScriptParent.h"
 #include "mozilla/dom/DOMStringList.h"
 #include "nsPrintfCString.h"
-#include "nsXULAppAPI.h"
 #include <algorithm>
 
 #ifdef ANDROID
 #include <android/log.h>
 #endif
 #ifdef XP_WIN
 #include <windows.h>
 # if defined(SendMessage)
@@ -141,17 +139,17 @@ template <ActorFlavorEnum>
 struct BlobTraits
 { };
 
 template <>
 struct BlobTraits<Parent>
 {
   typedef mozilla::dom::BlobParent BlobType;
   typedef mozilla::dom::PBlobParent ProtocolType;
-  typedef mozilla::dom::nsIContentParent ConcreteContentManagerType;
+  typedef mozilla::dom::ContentParent ConcreteContentManagerType;
 };
 
 template <>
 struct BlobTraits<Child>
 {
   typedef mozilla::dom::BlobChild BlobType;
   typedef mozilla::dom::PBlobChild ProtocolType;
   typedef mozilla::dom::ContentChild ConcreteContentManagerType;
@@ -216,17 +214,17 @@ BuildClonedMessageData(typename BlobTrai
       }
       blobList.AppendElement(protocolActor);
     }
   }
   return true;
 }
 
 bool
-MessageManagerCallback::BuildClonedMessageDataForParent(nsIContentParent* aParent,
+MessageManagerCallback::BuildClonedMessageDataForParent(ContentParent* aParent,
                                                         const StructuredCloneData& aData,
                                                         ClonedMessageData& aClonedData)
 {
   return BuildClonedMessageData<Parent>(aParent, aData, aClonedData);
 }
 
 bool
 MessageManagerCallback::BuildClonedMessageDataForChild(ContentChild* aChild,
@@ -1877,17 +1875,17 @@ NS_NewParentProcessMessageManager(nsIMes
                                                                  MM_CHROME | MM_PROCESSMANAGER | MM_BROADCASTER);
   nsFrameMessageManager::sParentProcessManager = mm;
   nsFrameMessageManager::NewProcessMessageManager(nullptr); // Create same process message manager.
   return CallQueryInterface(mm, aResult);
 }
 
 
 nsFrameMessageManager*
-nsFrameMessageManager::NewProcessMessageManager(mozilla::dom::nsIContentParent* aProcess)
+nsFrameMessageManager::NewProcessMessageManager(mozilla::dom::ContentParent* aProcess)
 {
   if (!nsFrameMessageManager::sParentProcessManager) {
      nsCOMPtr<nsIMessageBroadcaster> dummy =
        do_GetService("@mozilla.org/parentprocessmessagemanager;1");
   }
 
   MOZ_ASSERT(nsFrameMessageManager::sParentProcessManager,
              "parent process manager not created");
--- a/content/base/src/nsFrameMessageManager.h
+++ b/content/base/src/nsFrameMessageManager.h
@@ -27,17 +27,17 @@
 #include "mozilla/Attributes.h"
 #include "js/RootingAPI.h"
 #include "nsTObserverArray.h"
 #include "mozilla/dom/StructuredCloneUtils.h"
 
 namespace mozilla {
 namespace dom {
 
-class nsIContentParent;
+class ContentParent;
 class ContentChild;
 class ClonedMessageData;
 class MessageManagerReporter;
 
 namespace ipc {
 
 enum MessageManagerFlags {
   MM_CHILD = 0,
@@ -94,17 +94,17 @@ public:
   }
 
   virtual bool CheckAppHasStatus(unsigned short aStatus)
   {
     return false;
   }
 
 protected:
-  bool BuildClonedMessageDataForParent(nsIContentParent* aParent,
+  bool BuildClonedMessageDataForParent(ContentParent* aParent,
                                        const StructuredCloneData& aData,
                                        ClonedMessageData& aClonedData);
   bool BuildClonedMessageDataForChild(ContentChild* aChild,
                                       const StructuredCloneData& aData,
                                       ClonedMessageData& aClonedData);
 };
 
 StructuredCloneData UnpackClonedMessageDataForParent(const ClonedMessageData& aData);
@@ -212,17 +212,17 @@ public:
   NS_DECL_NSIMESSAGESENDER
   NS_DECL_NSIMESSAGEBROADCASTER
   NS_DECL_NSISYNCMESSAGESENDER
   NS_DECL_NSICONTENTFRAMEMESSAGEMANAGER
   NS_DECL_NSIFRAMESCRIPTLOADER
   NS_DECL_NSIPROCESSCHECKER
 
   static nsFrameMessageManager*
-  NewProcessMessageManager(mozilla::dom::nsIContentParent* aProcess);
+  NewProcessMessageManager(mozilla::dom::ContentParent* aProcess);
 
   nsresult ReceiveMessage(nsISupports* aTarget, const nsAString& aMessage,
                           bool aIsSync, const StructuredCloneData* aCloneData,
                           CpowHolder* aCpows, nsIPrincipal* aPrincipal,
                           InfallibleTArray<nsString>* aJSONRetVal);
 
   void AddChildManager(nsFrameMessageManager* aManager);
   void RemoveChildManager(nsFrameMessageManager* aManager)
--- a/dom/base/nsContentPermissionHelper.cpp
+++ b/dom/base/nsContentPermissionHelper.cpp
@@ -307,24 +307,22 @@ nsContentPermissionRequestProxy::Allow(J
   }
 
 #ifdef MOZ_WIDGET_GONK
   uint32_t len = mPermissionRequests.Length();
   for (uint32_t i = 0; i < len; i++) {
     if (mPermissionRequests[i].type().EqualsLiteral("audio-capture")) {
       GonkPermissionService::GetInstance()->addGrantInfo(
         "android.permission.RECORD_AUDIO",
-        static_cast<TabParent*>(
-          mParent->Manager())->Manager()->AsContentParent()->Pid());
+        static_cast<TabParent*>(mParent->Manager())->Manager()->Pid());
     }
     if (mPermissionRequests[i].type().EqualsLiteral("video-capture")) {
       GonkPermissionService::GetInstance()->addGrantInfo(
         "android.permission.CAMERA",
-        static_cast<TabParent*>(
-          mParent->Manager())->Manager()->AsContentParent()->Pid());
+        static_cast<TabParent*>(mParent->Manager())->Manager()->Pid());
     }
   }
 #endif
 
   nsTArray<PermissionChoice> choices;
   if (aChoices.isNullOrUndefined()) {
     // No choice is specified.
   } else if (aChoices.isObject()) {
--- a/dom/ipc/Blob.cpp
+++ b/dom/ipc/Blob.cpp
@@ -7,17 +7,16 @@
 #include "ContentChild.h"
 #include "ContentParent.h"
 #include "FileDescriptorSetChild.h"
 #include "jsapi.h"
 #include "mozilla/Assertions.h"
 #include "mozilla/DebugOnly.h"
 #include "mozilla/Monitor.h"
 #include "mozilla/unused.h"
-#include "mozilla/dom/nsIContentParent.h"
 #include "mozilla/dom/PBlobStreamChild.h"
 #include "mozilla/dom/PBlobStreamParent.h"
 #include "mozilla/dom/PFileDescriptorSetParent.h"
 #include "mozilla/ipc/InputStreamUtils.h"
 #include "nsCOMPtr.h"
 #include "nsDOMFile.h"
 #include "nsIDOMFile.h"
 #include "nsIInputStream.h"
@@ -1759,34 +1758,34 @@ RemoteBlob::GetPBlob()
 {
   return static_cast<PBlobParent*>(mActor);
 }
 
 /*******************************************************************************
  * BlobParent
  ******************************************************************************/
 
-BlobParent::BlobParent(nsIContentParent* aManager, nsIDOMBlob* aBlob)
+BlobParent::BlobParent(ContentParent* aManager, nsIDOMBlob* aBlob)
   : mBlob(aBlob)
   , mRemoteBlob(nullptr)
   , mStrongManager(aManager)
   , mOwnsBlob(true)
   , mBlobIsFile(false)
 {
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(aManager);
   MOZ_ASSERT(aBlob);
 
   aBlob->AddRef();
 
   nsCOMPtr<nsIDOMFile> file = do_QueryInterface(aBlob);
   mBlobIsFile = !!file;
 }
 
-BlobParent::BlobParent(nsIContentParent* aManager,
+BlobParent::BlobParent(ContentParent* aManager,
                        const ParentBlobConstructorParams& aParams)
   : mBlob(nullptr)
   , mRemoteBlob(nullptr)
   , mStrongManager(aManager)
   , mOwnsBlob(false)
   , mBlobIsFile(false)
 {
   MOZ_ASSERT(NS_IsMainThread());
@@ -1809,17 +1808,17 @@ BlobParent::BlobParent(nsIContentParent*
   mOwnsBlob = true;
 }
 
 BlobParent::~BlobParent()
 {
 }
 
 BlobParent*
-BlobParent::Create(nsIContentParent* aManager,
+BlobParent::Create(ContentParent* aManager,
                    const ParentBlobConstructorParams& aParams)
 {
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(aManager);
 
   const ChildBlobConstructorParams& blobParams = aParams.blobParams();
 
   MOZ_ASSERT(blobParams.type() !=
@@ -1916,22 +1915,16 @@ BlobParent::SetMysteryBlobInfo(const nsS
 
   ToConcreteBlob(mBlob)->SetLazyData(voidString, aContentType, aLength,
                                      UINT64_MAX);
 
   NormalBlobConstructorParams params(aContentType, aLength);
   return SendResolveMystery(params);
 }
 
-nsIContentParent*
-BlobParent::Manager()
-{
-  return mStrongManager;
-}
-
 already_AddRefed<BlobParent::RemoteBlob>
 BlobParent::CreateRemoteBlob(const ParentBlobConstructorParams& aParams)
 {
   MOZ_ASSERT(NS_IsMainThread());
 
   const ChildBlobConstructorParams& blobParams = aParams.blobParams();
 
   nsRefPtr<RemoteBlob> remoteBlob;
--- a/dom/ipc/Blob.h
+++ b/dom/ipc/Blob.h
@@ -14,17 +14,17 @@
 class nsIDOMBlob;
 class nsString;
 template <class> class nsRevocableEventPtr;
 
 namespace mozilla {
 namespace dom {
 
 class ContentChild;
-class nsIContentParent;
+class ContentParent;
 class PBlobStreamChild;
 class PBlobStreamParent;
 
 class BlobChild MOZ_FINAL
   : public PBlobChild
 {
   friend class ContentChild;
 
@@ -98,44 +98,44 @@ private:
 
   virtual bool
   DeallocPBlobStreamChild(PBlobStreamChild* aActor) MOZ_OVERRIDE;
 };
 
 class BlobParent MOZ_FINAL
   : public PBlobParent
 {
-  friend class nsIContentParent;
+  friend class ContentParent;
 
   class OpenStreamRunnable;
   friend class OpenStreamRunnable;
 
   class RemoteBlob;
   friend class RemoteBlob;
 
   nsIDOMBlob* mBlob;
   RemoteBlob* mRemoteBlob;
-  nsRefPtr<nsIContentParent> mStrongManager;
+  nsRefPtr<ContentParent> mStrongManager;
 
   // nsIInputStreams backed by files must ensure that the files are actually
   // opened and closed on a background thread before we can send their file
   // handles across to the child. The child process could crash during this
   // process so we need to make sure we cancel the intended response in such a
   // case. We do that by holding an array of nsRevocableEventPtr. If the child
   // crashes then this actor will be destroyed and the nsRevocableEventPtr
   // destructor will cancel any stream events that are currently in flight.
   nsTArray<nsRevocableEventPtr<OpenStreamRunnable>> mOpenStreamRunnables;
 
   bool mOwnsBlob;
   bool mBlobIsFile;
 
 public:
   // This create function is called on the sending side.
   static BlobParent*
-  Create(nsIContentParent* aManager, nsIDOMBlob* aBlob)
+  Create(ContentParent* aManager, nsIDOMBlob* aBlob)
   {
     return new BlobParent(aManager, aBlob);
   }
 
   // Get the blob associated with this actor. This may always be called on the
   // sending side. It may also be called on the receiving side unless this is a
   // "mystery" blob that has not yet received a SetMysteryBlobInfo() call.
   already_AddRefed<nsIDOMBlob>
@@ -145,31 +145,29 @@ public:
   bool
   SetMysteryBlobInfo(const nsString& aName, const nsString& aContentType,
                      uint64_t aLength, uint64_t aLastModifiedDate);
 
   // Use this for non-file blobs.
   bool
   SetMysteryBlobInfo(const nsString& aContentType, uint64_t aLength);
 
-  nsIContentParent* Manager();
-
 private:
   // This constructor is called on the sending side.
-  BlobParent(nsIContentParent* aManager, nsIDOMBlob* aBlob);
+  BlobParent(ContentParent* aManager, nsIDOMBlob* aBlob);
 
   // This constructor is called on the receiving side.
-  BlobParent(nsIContentParent* aManager,
+  BlobParent(ContentParent* aManager,
              const ParentBlobConstructorParams& aParams);
 
   ~BlobParent();
 
   // This create function is called on the receiving side by ContentParent.
   static BlobParent*
-  Create(nsIContentParent* aManager, const ParentBlobConstructorParams& aParams);
+  Create(ContentParent* aManager, const ParentBlobConstructorParams& aParams);
 
   static already_AddRefed<RemoteBlob>
   CreateRemoteBlob(const ParentBlobConstructorParams& aParams);
 
   void
   NoteDyingRemoteBlob();
 
   void
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -475,18 +475,17 @@ ContentParentsMemoryReporter::CollectRep
                 channelStr = "open channel";
             }
             numQueuedMessages = channel->Unsound_NumQueuedMessages();
         }
 
         nsPrintfCString path("queued-ipc-messages/content-parent"
                              "(%s, pid=%d, %s, 0x%p, refcnt=%d)",
                              NS_ConvertUTF16toUTF8(friendlyName).get(),
-                             cp->Pid(), channelStr,
-                             static_cast<nsIContentParent*>(cp), refcnt);
+                             cp->Pid(), channelStr, cp, refcnt);
 
         NS_NAMED_LITERAL_CSTRING(desc,
             "The number of unset IPC messages held in this ContentParent's "
             "channel.  A large value here might indicate that we're leaking "
             "messages.  Similarly, a ContentParent object for a process that's no "
             "longer running could indicate that we're leaking ContentParents.");
 
         nsresult rv = cb->Callback(/* process */ EmptyCString(),
@@ -1518,18 +1517,17 @@ ContentParent::InitializeMembers()
     mCalledKillHard = false;
 }
 
 ContentParent::ContentParent(mozIApplication* aApp,
                              bool aIsForBrowser,
                              bool aIsForPreallocated,
                              ProcessPriority aInitialPriority /* = PROCESS_PRIORITY_FOREGROUND */,
                              bool aIsNuwaProcess /* = false */)
-    : nsIContentParent()
-    , mIsForBrowser(aIsForBrowser)
+    : mIsForBrowser(aIsForBrowser)
     , mIsNuwaProcess(aIsNuwaProcess)
 {
     InitializeMembers();  // Perform common initialization.
 
     // No more than one of !!aApp, aIsForBrowser, aIsForPreallocated should be
     // true.
     MOZ_ASSERT(!!aApp + aIsForBrowser + aIsForPreallocated <= 1);
 
@@ -1730,16 +1728,18 @@ ContentParent::InitInternal(ProcessPrior
 
     if (aSendRegisteredChrome) {
         nsCOMPtr<nsIChromeRegistry> registrySvc = nsChromeRegistry::GetService();
         nsChromeRegistryChrome* chromeRegistry =
             static_cast<nsChromeRegistryChrome*>(registrySvc.get());
         chromeRegistry->SendRegisteredChrome(this);
     }
 
+    mMessageManager = nsFrameMessageManager::NewProcessMessageManager(this);
+
     if (gAppData) {
         nsCString version(gAppData->version);
         nsCString buildID(gAppData->buildID);
         nsCString name(gAppData->name);
         nsCString UAName(gAppData->UAName);
 
         // Sending all information to content process.
         unused << SendAppInfo(version, buildID, name, UAName);
@@ -2188,17 +2188,16 @@ ContentParent::RecvAddNewProcess(const u
 // We want ContentParent to show up in CC logs for debugging purposes, but we
 // don't actually cycle collect it.
 NS_IMPL_CYCLE_COLLECTION_0(ContentParent)
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(ContentParent)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(ContentParent)
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(ContentParent)
-  NS_INTERFACE_MAP_ENTRY(nsIContentParent)
   NS_INTERFACE_MAP_ENTRY(nsIObserver)
   NS_INTERFACE_MAP_ENTRY(nsIDOMGeoPositionCallback)
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIObserver)
 NS_INTERFACE_MAP_END
 
 NS_IMETHODIMP
 ContentParent::Observe(nsISupports* aSubject,
                        const char* aTopic,
@@ -2393,43 +2392,95 @@ ContentParent::RecvGetXPCOMProcessAttrib
 
     return true;
 }
 
 mozilla::jsipc::PJavaScriptParent *
 ContentParent::AllocPJavaScriptParent()
 {
     MOZ_ASSERT(!ManagedPJavaScriptParent().Length());
-    return nsIContentParent::AllocPJavaScriptParent();
+
+    nsCOMPtr<nsIJSRuntimeService> svc = do_GetService("@mozilla.org/js/xpc/RuntimeService;1");
+    NS_ENSURE_TRUE(svc, nullptr);
+
+    JSRuntime *rt;
+    svc->GetRuntime(&rt);
+    NS_ENSURE_TRUE(svc, nullptr);
+
+    mozilla::jsipc::JavaScriptParent *parent = new mozilla::jsipc::JavaScriptParent(rt);
+    if (!parent->init()) {
+        delete parent;
+        return nullptr;
+    }
+    return parent;
 }
 
 bool
 ContentParent::DeallocPJavaScriptParent(PJavaScriptParent *parent)
 {
-    return nsIContentParent::DeallocPJavaScriptParent(parent);
+    static_cast<mozilla::jsipc::JavaScriptParent *>(parent)->decref();
+    return true;
 }
 
 PBrowserParent*
 ContentParent::AllocPBrowserParent(const IPCTabContext& aContext,
                                    const uint32_t& aChromeFlags,
                                    const uint64_t& aId,
                                    const bool& aIsForApp,
                                    const bool& aIsForBrowser)
 {
-    return nsIContentParent::AllocPBrowserParent(aContext,
-                                                 aChromeFlags,
-                                                 aId,
-                                                 aIsForApp,
-                                                 aIsForBrowser);
+    unused << aChromeFlags;
+
+    const IPCTabAppBrowserContext& appBrowser = aContext.appBrowserContext();
+
+    // We don't trust the IPCTabContext we receive from the child, so we'll bail
+    // if we receive an IPCTabContext that's not a PopupIPCTabContext.
+    // (PopupIPCTabContext lets the child process prove that it has access to
+    // the app it's trying to open.)
+    if (appBrowser.type() != IPCTabAppBrowserContext::TPopupIPCTabContext) {
+        NS_ERROR("Unexpected IPCTabContext type.  Aborting AllocPBrowserParent.");
+        return nullptr;
+    }
+
+    const PopupIPCTabContext& popupContext = appBrowser.get_PopupIPCTabContext();
+    TabParent* opener = static_cast<TabParent*>(popupContext.openerParent());
+    if (!opener) {
+        NS_ERROR("Got null opener from child; aborting AllocPBrowserParent.");
+        return nullptr;
+    }
+
+    // Popup windows of isBrowser frames must be isBrowser if the parent
+    // isBrowser.  Allocating a !isBrowser frame with same app ID would allow
+    // the content to access data it's not supposed to.
+    if (!popupContext.isBrowserElement() && opener->IsBrowserElement()) {
+        NS_ERROR("Child trying to escalate privileges!  Aborting AllocPBrowserParent.");
+        return nullptr;
+    }
+
+    MaybeInvalidTabContext tc(aContext);
+    if (!tc.IsValid()) {
+        NS_ERROR(nsPrintfCString("Child passed us an invalid TabContext.  (%s)  "
+                                 "Aborting AllocPBrowserParent.",
+                                 tc.GetInvalidReason()).get());
+        return nullptr;
+    }
+
+    TabParent* parent = new TabParent(this, tc.GetTabContext(), aChromeFlags);
+
+    // We release this ref in DeallocPBrowserParent()
+    NS_ADDREF(parent);
+    return parent;
 }
 
 bool
 ContentParent::DeallocPBrowserParent(PBrowserParent* frame)
 {
-    return nsIContentParent::DeallocPBrowserParent(frame);
+    TabParent* parent = static_cast<TabParent*>(frame);
+    NS_RELEASE(parent);
+    return true;
 }
 
 PDeviceStorageRequestParent*
 ContentParent::AllocPDeviceStorageRequestParent(const DeviceStorageParams& aParams)
 {
     nsRefPtr<DeviceStorageRequestParent> result = new DeviceStorageRequestParent(aParams);
     if (!result->EnsureRequiredPermissions(this)) {
         return nullptr;
@@ -2462,26 +2513,101 @@ ContentParent::DeallocPFileSystemRequest
     FileSystemRequestParent* parent = static_cast<FileSystemRequestParent*>(doomed);
     NS_RELEASE(parent);
     return true;
 }
 
 PBlobParent*
 ContentParent::AllocPBlobParent(const BlobConstructorParams& aParams)
 {
-    return nsIContentParent::AllocPBlobParent(aParams);
+    return BlobParent::Create(this, aParams);
 }
 
 bool
 ContentParent::DeallocPBlobParent(PBlobParent* aActor)
 {
     delete aActor;
     return true;
 }
 
+BlobParent*
+ContentParent::GetOrCreateActorForBlob(nsIDOMBlob* aBlob)
+{
+    MOZ_ASSERT(NS_IsMainThread());
+    MOZ_ASSERT(aBlob);
+
+    // If the blob represents a remote blob for this ContentParent then we can
+    // simply pass its actor back here.
+    if (nsCOMPtr<nsIRemoteBlob> remoteBlob = do_QueryInterface(aBlob)) {
+        if (BlobParent* actor = static_cast<BlobParent*>(
+              static_cast<PBlobParent*>(remoteBlob->GetPBlob()))) {
+            if (static_cast<ContentParent*>(actor->Manager()) == this) {
+              return actor;
+            }
+        }
+    }
+
+    // All blobs shared between processes must be immutable.
+    nsCOMPtr<nsIMutable> mutableBlob = do_QueryInterface(aBlob);
+    if (!mutableBlob || NS_FAILED(mutableBlob->SetMutable(false))) {
+        NS_WARNING("Failed to make blob immutable!");
+        return nullptr;
+    }
+
+    // XXX This is only safe so long as all blob implementations in our tree
+    //     inherit nsDOMFileBase. If that ever changes then this will need to grow
+    //     a real interface or something.
+    const auto* blob = static_cast<nsDOMFileBase*>(aBlob);
+
+    ChildBlobConstructorParams params;
+
+    if (blob->IsSizeUnknown() || blob->IsDateUnknown()) {
+        // We don't want to call GetSize or GetLastModifiedDate
+        // yet since that may stat a file on the main thread
+        // here. Instead we'll learn the size lazily from the
+        // other process.
+        params = MysteryBlobConstructorParams();
+    }
+    else {
+        nsString contentType;
+        nsresult rv = aBlob->GetType(contentType);
+        NS_ENSURE_SUCCESS(rv, nullptr);
+
+        uint64_t length;
+        rv = aBlob->GetSize(&length);
+        NS_ENSURE_SUCCESS(rv, nullptr);
+
+        nsCOMPtr<nsIDOMFile> file = do_QueryInterface(aBlob);
+        if (file) {
+            FileBlobConstructorParams fileParams;
+
+            rv = file->GetMozLastModifiedDate(&fileParams.modDate());
+            NS_ENSURE_SUCCESS(rv, nullptr);
+
+            rv = file->GetName(fileParams.name());
+            NS_ENSURE_SUCCESS(rv, nullptr);
+
+            fileParams.contentType() = contentType;
+            fileParams.length() = length;
+
+            params = fileParams;
+        } else {
+            NormalBlobConstructorParams blobParams;
+            blobParams.contentType() = contentType;
+            blobParams.length() = length;
+            params = blobParams;
+        }
+    }
+
+    BlobParent* actor = BlobParent::Create(this, aBlob);
+    NS_ENSURE_TRUE(actor, nullptr);
+
+    return SendPBlobConstructor(actor, params) ? actor : nullptr;
+}
+
 void
 ContentParent::KillHard()
 {
     // On Windows, calling KillHard multiple times causes problems - the
     // process handle becomes invalid on the first call, causing a second call
     // to crash our process - more details in bug 890840.
     if (mCalledKillHard) {
         return;
@@ -3049,38 +3175,76 @@ ContentParent::RecvCloseAlert(const nsSt
 
 bool
 ContentParent::RecvSyncMessage(const nsString& aMsg,
                                const ClonedMessageData& aData,
                                const InfallibleTArray<CpowEntry>& aCpows,
                                const IPC::Principal& aPrincipal,
                                InfallibleTArray<nsString>* aRetvals)
 {
-    return nsIContentParent::RecvSyncMessage(aMsg, aData, aCpows, aPrincipal,
-                                             aRetvals);
+    nsIPrincipal* principal = aPrincipal;
+    if (!Preferences::GetBool("dom.testing.ignore_ipc_principal", false) &&
+        principal && !AssertAppPrincipal(this, principal)) {
+        return false;
+    }
+
+    nsRefPtr<nsFrameMessageManager> ppm = mMessageManager;
+    if (ppm) {
+        StructuredCloneData cloneData = ipc::UnpackClonedMessageDataForParent(aData);
+        CpowIdHolder cpows(GetCPOWManager(), aCpows);
+
+        ppm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm.get()),
+                            aMsg, true, &cloneData, &cpows, aPrincipal, aRetvals);
+    }
+    return true;
 }
 
 bool
 ContentParent::AnswerRpcMessage(const nsString& aMsg,
                                 const ClonedMessageData& aData,
                                 const InfallibleTArray<CpowEntry>& aCpows,
                                 const IPC::Principal& aPrincipal,
                                 InfallibleTArray<nsString>* aRetvals)
 {
-    return nsIContentParent::AnswerRpcMessage(aMsg, aData, aCpows, aPrincipal,
-                                              aRetvals);
+    nsIPrincipal* principal = aPrincipal;
+    if (!Preferences::GetBool("dom.testing.ignore_ipc_principal", false) &&
+        principal && !AssertAppPrincipal(this, principal)) {
+        return false;
+    }
+
+    nsRefPtr<nsFrameMessageManager> ppm = mMessageManager;
+    if (ppm) {
+        StructuredCloneData cloneData = ipc::UnpackClonedMessageDataForParent(aData);
+        CpowIdHolder cpows(GetCPOWManager(), aCpows);
+        ppm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm.get()),
+                            aMsg, true, &cloneData, &cpows, aPrincipal, aRetvals);
+    }
+    return true;
 }
 
 bool
 ContentParent::RecvAsyncMessage(const nsString& aMsg,
                                 const ClonedMessageData& aData,
                                 const InfallibleTArray<CpowEntry>& aCpows,
                                 const IPC::Principal& aPrincipal)
 {
-    return nsIContentParent::RecvAsyncMessage(aMsg, aData, aCpows, aPrincipal);
+    nsIPrincipal* principal = aPrincipal;
+    if (!Preferences::GetBool("dom.testing.ignore_ipc_principal", false) &&
+        principal && !AssertAppPrincipal(this, principal)) {
+        return false;
+    }
+
+    nsRefPtr<nsFrameMessageManager> ppm = mMessageManager;
+    if (ppm) {
+        StructuredCloneData cloneData = ipc::UnpackClonedMessageDataForParent(aData);
+        CpowIdHolder cpows(GetCPOWManager(), aCpows);
+        ppm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm.get()),
+                            aMsg, false, &cloneData, &cpows, aPrincipal, nullptr);
+    }
+    return true;
 }
 
 bool
 ContentParent::RecvFilePathUpdateNotify(const nsString& aType,
                                         const nsString& aStorageName,
                                         const nsString& aFilePath,
                                         const nsCString& aReason)
 {
@@ -3278,23 +3442,16 @@ ContentParent::CheckAppHasPermission(con
 }
 
 bool
 ContentParent::CheckAppHasStatus(unsigned short aStatus)
 {
     return AssertAppHasStatus(this, aStatus);
 }
 
-PBlobParent*
-ContentParent::SendPBlobConstructor(PBlobParent* aActor,
-                                    const BlobConstructorParams& aParams)
-{
-    return PContentParent::SendPBlobConstructor(aActor, aParams);
-}
-
 bool
 ContentParent::RecvSystemMessageHandled()
 {
     SystemMessageHandledListener::OnSystemMessageHandled();
     return true;
 }
 
 bool
--- a/dom/ipc/ContentParent.h
+++ b/dom/ipc/ContentParent.h
@@ -3,17 +3,16 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef mozilla_dom_ContentParent_h
 #define mozilla_dom_ContentParent_h
 
 #include "mozilla/dom/PContentParent.h"
-#include "mozilla/dom/nsIContentParent.h"
 #include "mozilla/ipc/GeckoChildProcessHost.h"
 #include "mozilla/dom/ipc/Blob.h"
 #include "mozilla/Attributes.h"
 #include "mozilla/FileUtils.h"
 #include "mozilla/HalTypes.h"
 #include "mozilla/LinkedList.h"
 #include "mozilla/StaticPtr.h"
 
@@ -59,29 +58,28 @@ class Element;
 class TabParent;
 class PStorageParent;
 class ClonedMessageData;
 class MemoryReport;
 class TabContext;
 class PFileDescriptorSetParent;
 
 class ContentParent : public PContentParent
-                    , public nsIContentParent
                     , public nsIObserver
                     , public nsIDOMGeoPositionCallback
+                    , public mozilla::dom::ipc::MessageManagerCallback
                     , public mozilla::LinkedListElement<ContentParent>
 {
     typedef mozilla::ipc::GeckoChildProcessHost GeckoChildProcessHost;
     typedef mozilla::ipc::OptionalURIParams OptionalURIParams;
     typedef mozilla::ipc::TestShellParent TestShellParent;
     typedef mozilla::ipc::URIParams URIParams;
     typedef mozilla::dom::ClonedMessageData ClonedMessageData;
 
 public:
-    virtual bool IsContentParent() MOZ_OVERRIDE { return true; }
     /**
      * Start up the content-process machinery.  This might include
      * scheduling pre-launch tasks.
      */
     static void StartUp();
     /** Shut down the content-process machinery. */
     static void ShutDown();
     /**
@@ -171,24 +169,26 @@ public:
     bool NeedsPermissionsUpdate() const {
         return mSendPermissionUpdates;
     }
 
     bool NeedsDataStoreInfos() const {
         return mSendDataStoreInfos;
     }
 
+    BlobParent* GetOrCreateActorForBlob(nsIDOMBlob* aBlob);
+
     /**
      * Kill our subprocess and make sure it dies.  Should only be used
      * in emergency situations since it bypasses the normal shutdown
      * process.
      */
     void KillHard();
 
-    uint64_t ChildID() MOZ_OVERRIDE { return mChildID; }
+    uint64_t ChildID() { return mChildID; }
     const nsString& AppManifestURL() const { return mAppManifestURL; }
 
     bool IsPreallocated();
 
     /**
      * Get a user-friendly name for this ContentParent.  We make no guarantees
      * about this name: It might not be unique, apps can spoof special names,
      * etc.  So please don't use this name to make any decisions about the
@@ -236,20 +236,16 @@ public:
                                            const nsString& aPageURL,
                                            const bool& aIsAudio,
                                            const bool& aIsVideo) MOZ_OVERRIDE;
 
     bool CycleCollectWithLogs(bool aDumpAllTraces,
                               nsICycleCollectorLogSink* aSink,
                               nsIDumpGCAndCCLogsCallback* aCallback);
 
-    virtual PBlobParent* SendPBlobConstructor(
-        PBlobParent* aActor,
-        const BlobConstructorParams& aParams) MOZ_OVERRIDE;
-
 protected:
     void OnChannelConnected(int32_t pid) MOZ_OVERRIDE;
     virtual void ActorDestroy(ActorDestroyReason why) MOZ_OVERRIDE;
     void OnNuwaForkTimeout();
 
     bool ShouldContinueFromReplyTimeout() MOZ_OVERRIDE;
     bool ShouldSandboxContentProcesses();
 
@@ -603,16 +599,18 @@ private:
 
     /**
      * We cache mAppName instead of looking it up using mAppManifestURL when we
      * need it because it turns out that getting an app from the apps service is
      * expensive.
      */
     nsString mAppName;
 
+    nsRefPtr<nsFrameMessageManager> mMessageManager;
+
     // After we initiate shutdown, we also start a timer to ensure
     // that even content processes that are 100% blocked (say from
     // SIGSTOP), are still killed eventually.  This task enforces that
     // timer.
     CancelableTask* mForceKillTask;
     // How many tabs we're waiting to finish their destruction
     // sequence.  Precisely, how many TabParents have called
     // NotifyTabDestroying() but not called NotifyTabDestroyed().
--- a/dom/ipc/ProcessPriorityManager.cpp
+++ b/dom/ipc/ProcessPriorityManager.cpp
@@ -497,19 +497,19 @@ ProcessPriorityManagerImpl::SetProcessPr
 }
 
 void
 ProcessPriorityManagerImpl::ObserveContentParentCreated(
   nsISupports* aContentParent)
 {
   // Do nothing; it's sufficient to get the PPPM.  But assign to nsRefPtr so we
   // don't leak the already_AddRefed object.
-  nsCOMPtr<nsIContentParent> cp = do_QueryInterface(aContentParent);
+  nsCOMPtr<nsIObserver> cp = do_QueryInterface(aContentParent);
   nsRefPtr<ParticularProcessPriorityManager> pppm =
-    GetParticularProcessPriorityManager(cp->AsContentParent());
+    GetParticularProcessPriorityManager(static_cast<ContentParent*>(cp.get()));
 }
 
 static PLDHashOperator
 EnumerateParticularProcessPriorityManagers(
   const uint64_t& aKey,
   nsRefPtr<ParticularProcessPriorityManager> aValue,
   void* aUserData)
 {
@@ -811,31 +811,29 @@ ParticularProcessPriorityManager::OnRemo
   if (!isBrowserOrApp) {
     return;
   }
 
   nsCOMPtr<nsITabParent> tp;
   fl->GetTabParent(getter_AddRefs(tp));
   NS_ENSURE_TRUE_VOID(tp);
 
-  MOZ_ASSERT(XRE_GetProcessType() == GeckoProcessType_Default);
   if (static_cast<TabParent*>(tp.get())->Manager() != mContentParent) {
     return;
   }
 
   ResetPriority();
 }
 
 void
 ParticularProcessPriorityManager::OnTabParentDestroyed(nsISupports* aSubject)
 {
   nsCOMPtr<nsITabParent> tp = do_QueryInterface(aSubject);
   NS_ENSURE_TRUE_VOID(tp);
 
-  MOZ_ASSERT(XRE_GetProcessType() == GeckoProcessType_Default);
   if (static_cast<TabParent*>(tp.get())->Manager() != mContentParent) {
     return;
   }
 
   ResetPriority();
 }
 
 void
@@ -845,17 +843,16 @@ ParticularProcessPriorityManager::OnFram
   NS_ENSURE_TRUE_VOID(fl);
 
   nsCOMPtr<nsITabParent> tp;
   fl->GetTabParent(getter_AddRefs(tp));
   if (!tp) {
     return;
   }
 
-  MOZ_ASSERT(XRE_GetProcessType() == GeckoProcessType_Default);
   if (static_cast<TabParent*>(tp.get())->Manager() != mContentParent) {
     return;
   }
 
   // Most of the time when something changes in a process we call
   // ResetPriority(), giving a grace period before downgrading its priority.
   // But notice that here don't give a grace period: We call ResetPriorityNow()
   // instead.
--- a/dom/ipc/TabParent.cpp
+++ b/dom/ipc/TabParent.cpp
@@ -201,17 +201,17 @@ TabParent* sEventCapturer;
 TabParent *TabParent::mIMETabParent = nullptr;
 
 NS_IMPL_ISUPPORTS(TabParent,
                   nsITabParent,
                   nsIAuthPromptProvider,
                   nsISecureBrowserUI,
                   nsISupportsWeakReference)
 
-TabParent::TabParent(nsIContentParent* aManager, const TabContext& aContext, uint32_t aChromeFlags)
+TabParent::TabParent(ContentParent* aManager, const TabContext& aContext, uint32_t aChromeFlags)
   : TabContext(aContext)
   , mFrameElement(nullptr)
   , mIMESelectionAnchor(0)
   , mIMESelectionFocus(0)
   , mIMEComposing(false)
   , mIMECompositionEnding(false)
   , mIMECompositionStart(0)
   , mIMESeqno(0)
@@ -225,17 +225,16 @@ TabParent::TabParent(nsIContentParent* a
   , mShown(false)
   , mUpdatedDimensions(false)
   , mManager(aManager)
   , mMarkedDestroying(false)
   , mIsDestroyed(false)
   , mAppPackageFileDescriptorSent(false)
   , mChromeFlags(aChromeFlags)
 {
-  MOZ_ASSERT(aManager);
 }
 
 TabParent::~TabParent()
 {
 }
 
 void
 TabParent::SetOwnerElement(Element* aElement)
@@ -295,28 +294,24 @@ TabParent::Destroy()
     ocuParent->StopSendingMessagesToChild();
   }
 
   if (RenderFrameParent* frame = GetRenderFrame()) {
     frame->Destroy();
   }
   mIsDestroyed = true;
 
-  if (XRE_GetProcessType() == GeckoProcessType_Default) {
-    Manager()->AsContentParent()->NotifyTabDestroying(this);
-  }
+  Manager()->NotifyTabDestroying(this);
   mMarkedDestroying = true;
 }
 
 bool
 TabParent::Recv__delete__()
 {
-  if (XRE_GetProcessType() == GeckoProcessType_Default) {
-    Manager()->AsContentParent()->NotifyTabDestroyed(this, mMarkedDestroying);
-  }
+  Manager()->NotifyTabDestroyed(this, mMarkedDestroying);
   return true;
 }
 
 void
 TabParent::ActorDestroy(ActorDestroyReason why)
 {
   if (sEventCapturer == this) {
     sEventCapturer = nullptr;
@@ -972,65 +967,62 @@ TabParent::TryCapture(const WidgetGUIEve
 
 bool
 TabParent::RecvSyncMessage(const nsString& aMessage,
                            const ClonedMessageData& aData,
                            const InfallibleTArray<CpowEntry>& aCpows,
                            const IPC::Principal& aPrincipal,
                            InfallibleTArray<nsString>* aJSONRetVal)
 {
-  // FIXME Permission check for TabParent in Content process
   nsIPrincipal* principal = aPrincipal;
-  ContentParent* parent = Manager()->AsContentParent();
+  ContentParent* parent = static_cast<ContentParent*>(Manager());
   if (!Preferences::GetBool("dom.testing.ignore_ipc_principal", false) &&
-      parent && principal && !AssertAppPrincipal(parent, principal)) {
+      principal && !AssertAppPrincipal(parent, principal)) {
     return false;
   }
 
   StructuredCloneData cloneData = ipc::UnpackClonedMessageDataForParent(aData);
-  CpowIdHolder cpows(Manager()->GetCPOWManager(), aCpows);
+  CpowIdHolder cpows(parent->GetCPOWManager(), aCpows);
   return ReceiveMessage(aMessage, true, &cloneData, &cpows, aPrincipal, aJSONRetVal);
 }
 
 bool
 TabParent::AnswerRpcMessage(const nsString& aMessage,
                             const ClonedMessageData& aData,
                             const InfallibleTArray<CpowEntry>& aCpows,
                             const IPC::Principal& aPrincipal,
                             InfallibleTArray<nsString>* aJSONRetVal)
 {
-  // FIXME Permission check for TabParent in Content process
   nsIPrincipal* principal = aPrincipal;
-  ContentParent* parent = Manager()->AsContentParent();
+  ContentParent* parent = static_cast<ContentParent*>(Manager());
   if (!Preferences::GetBool("dom.testing.ignore_ipc_principal", false) &&
-      parent && principal && !AssertAppPrincipal(parent, principal)) {
+      principal && !AssertAppPrincipal(parent, principal)) {
     return false;
   }
 
   StructuredCloneData cloneData = ipc::UnpackClonedMessageDataForParent(aData);
-  CpowIdHolder cpows(Manager()->GetCPOWManager(), aCpows);
+  CpowIdHolder cpows(parent->GetCPOWManager(), aCpows);
   return ReceiveMessage(aMessage, true, &cloneData, &cpows, aPrincipal, aJSONRetVal);
 }
 
 bool
 TabParent::RecvAsyncMessage(const nsString& aMessage,
                             const ClonedMessageData& aData,
                             const InfallibleTArray<CpowEntry>& aCpows,
                             const IPC::Principal& aPrincipal)
 {
-  // FIXME Permission check for TabParent in Content process
   nsIPrincipal* principal = aPrincipal;
-  ContentParent* parent = Manager()->AsContentParent();
+  ContentParent* parent = static_cast<ContentParent*>(Manager());
   if (!Preferences::GetBool("dom.testing.ignore_ipc_principal", false) &&
-      parent && principal && !AssertAppPrincipal(parent, principal)) {
+      principal && !AssertAppPrincipal(parent, principal)) {
     return false;
   }
 
   StructuredCloneData cloneData = ipc::UnpackClonedMessageDataForParent(aData);
-  CpowIdHolder cpows(Manager()->GetCPOWManager(), aCpows);
+  CpowIdHolder cpows(parent->GetCPOWManager(), aCpows);
   return ReceiveMessage(aMessage, false, &cloneData, &cpows, aPrincipal, nullptr);
 }
 
 bool
 TabParent::RecvSetCursor(const uint32_t& aCursor, const bool& aForce)
 {
   nsCOMPtr<nsIWidget> widget = GetWidget();
   if (widget) {
@@ -1705,21 +1697,21 @@ TabParent::RecvPIndexedDBConstructor(PIn
   // Let's do a current inner check to see if the inner is active or is in
   // bf cache, and bail out if it's not active.
   nsCOMPtr<nsPIDOMWindow> outer = doc->GetWindow();
   if (!outer || outer->GetCurrentInnerWindow() != window) {
     *aAllowed = false;
     return true;
   }
 
-  NS_ASSERTION(Manager(), "Null manager?!");
+  ContentParent* contentParent = Manager();
+  NS_ASSERTION(contentParent, "Null manager?!");
 
   nsRefPtr<IDBFactory> factory;
-  rv = IDBFactory::Create(window, aGroup, aASCIIOrigin,
-                          Manager()->AsContentParent(),
+  rv = IDBFactory::Create(window, aGroup, aASCIIOrigin, contentParent,
                           getter_AddRefs(factory));
   NS_ENSURE_SUCCESS(rv, false);
 
   if (!factory) {
     *aAllowed = false;
     return true;
   }
 
--- a/dom/ipc/TabParent.h
+++ b/dom/ipc/TabParent.h
@@ -38,17 +38,17 @@ struct TextureFactoryIdentifier;
 
 namespace layout {
 class RenderFrameParent;
 }
 
 namespace dom {
 
 class ClonedMessageData;
-class nsIContentParent;
+class ContentParent;
 class Element;
 struct StructuredCloneData;
 
 class TabParent : public PBrowserParent 
                 , public nsITabParent 
                 , public nsIAuthPromptProvider
                 , public nsISecureBrowserUI
                 , public nsSupportsWeakReference
@@ -56,17 +56,17 @@ class TabParent : public PBrowserParent
 {
     typedef mozilla::dom::ClonedMessageData ClonedMessageData;
     typedef mozilla::layout::ScrollingBehavior ScrollingBehavior;
 
 public:
     // nsITabParent
     NS_DECL_NSITABPARENT
 
-    TabParent(nsIContentParent* aManager, const TabContext& aContext, uint32_t aChromeFlags);
+    TabParent(ContentParent* aManager, const TabContext& aContext, uint32_t aChromeFlags);
     virtual ~TabParent();
     Element* GetOwnerElement() const { return mFrameElement; }
     void SetOwnerElement(Element* aElement);
 
     /**
      * Get the mozapptype attribute from this TabParent's owner DOM element.
      */
     void GetAppType(nsAString& aOut);
@@ -286,17 +286,17 @@ public:
     bool HandleQueryContentEvent(mozilla::WidgetQueryContentEvent& aEvent);
     bool SendCompositionEvent(mozilla::WidgetCompositionEvent& event);
     bool SendTextEvent(mozilla::WidgetTextEvent& event);
     bool SendSelectionEvent(mozilla::WidgetSelectionEvent& event);
 
     static TabParent* GetFrom(nsFrameLoader* aFrameLoader);
     static TabParent* GetFrom(nsIContent* aContent);
 
-    nsIContentParent* Manager() { return mManager; }
+    ContentParent* Manager() { return mManager; }
 
     /**
      * Let managees query if Destroy() is already called so they don't send out
      * messages when the PBrowser actor is being destroyed.
      */
     bool IsDestroyed() const { return mIsDestroyed; }
 
 protected:
@@ -363,17 +363,17 @@ protected:
     CSSToLayoutDeviceScale mDefaultScale;
     bool mShown;
     bool mUpdatedDimensions;
 
 private:
     already_AddRefed<nsFrameLoader> GetFrameLoader() const;
     already_AddRefed<nsIWidget> GetWidget() const;
     layout::RenderFrameParent* GetRenderFrame();
-    nsRefPtr<nsIContentParent> mManager;
+    nsRefPtr<ContentParent> mManager;
     void TryCacheDPIAndScale();
 
     CSSPoint AdjustTapToChildWidget(const CSSPoint& aPoint);
 
     // When true, we create a pan/zoom controller for our frame and
     // notify it of input events targeting us.
     bool UseAsyncPanZoom();
     // If we have a render frame currently, notify it that we're about
--- a/dom/ipc/moz.build
+++ b/dom/ipc/moz.build
@@ -20,17 +20,16 @@ EXPORTS.mozilla.dom += [
     'ContentChild.h',
     'ContentParent.h',
     'ContentProcess.h',
     'CrashReporterChild.h',
     'CrashReporterParent.h',
     'FileDescriptorSetChild.h',
     'FileDescriptorSetParent.h',
     'FilePickerParent.h',
-    'nsIContentParent.h',
     'PermissionMessageUtils.h',
     'StructuredCloneUtils.h',
     'TabChild.h',
     'TabContext.h',
     'TabMessageUtils.h',
     'TabParent.h',
 ]
 
@@ -44,17 +43,16 @@ UNIFIED_SOURCES += [
     'AppProcessChecker.cpp',
     'ColorPickerParent.cpp',
     'ContentParent.cpp',
     'ContentProcess.cpp',
     'CrashReporterParent.cpp',
     'FileDescriptorSetChild.cpp',
     'FileDescriptorSetParent.cpp',
     'FilePickerParent.cpp',
-    'nsIContentParent.cpp',
     'PermissionMessageUtils.cpp',
     'PreallocatedProcessManager.cpp',
     'ProcessPriorityManager.cpp',
     'StructuredCloneUtils.cpp',
     'TabChild.cpp',
     'TabContext.cpp',
     'TabMessageUtils.cpp',
     'TabParent.cpp',
deleted file mode 100644
--- a/dom/ipc/nsIContentParent.cpp
+++ /dev/null
@@ -1,294 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsIContentParent.h"
-
-#include "mozilla/AppProcessChecker.h"
-#include "mozilla/Preferences.h"
-#include "mozilla/dom/ContentParent.h"
-#include "mozilla/dom/PTabContext.h"
-#include "mozilla/dom/PermissionMessageUtils.h"
-#include "mozilla/dom/StructuredCloneUtils.h"
-#include "mozilla/dom/TabParent.h"
-#include "mozilla/dom/ipc/nsIRemoteBlob.h"
-#include "mozilla/unused.h"
-
-#include "JavaScriptParent.h"
-#include "nsDOMFile.h"
-#include "nsFrameMessageManager.h"
-#include "nsIJSRuntimeService.h"
-#include "nsPrintfCString.h"
-
-using namespace mozilla::jsipc;
-
-namespace mozilla {
-namespace dom {
-
-nsIContentParent::nsIContentParent()
-{
-  mMessageManager = nsFrameMessageManager::NewProcessMessageManager(this);
-}
-
-ContentParent*
-nsIContentParent::AsContentParent()
-{
-  MOZ_ASSERT(IsContentParent());
-  return static_cast<ContentParent*>(this);
-}
-
-PJavaScriptParent*
-nsIContentParent::AllocPJavaScriptParent()
-{
-  nsCOMPtr<nsIJSRuntimeService> svc =
-    do_GetService("@mozilla.org/js/xpc/RuntimeService;1");
-  NS_ENSURE_TRUE(svc, nullptr);
-
-  JSRuntime *rt;
-  svc->GetRuntime(&rt);
-  NS_ENSURE_TRUE(svc, nullptr);
-
-  nsAutoPtr<JavaScriptParent> parent(new JavaScriptParent(rt));
-  if (!parent->init()) {
-    return nullptr;
-  }
-  return parent.forget();
-}
-
-bool
-nsIContentParent::DeallocPJavaScriptParent(PJavaScriptParent* aParent)
-{
-  static_cast<JavaScriptParent*>(aParent)->decref();
-  return true;
-}
-
-PBrowserParent*
-nsIContentParent::AllocPBrowserParent(const IPCTabContext& aContext,
-                                      const uint32_t& aChromeFlags,
-                                      const uint64_t& aId,
-                                      const bool& aIsForApp,
-                                      const bool& aIsForBrowser)
-{
-  unused << aChromeFlags;
-  unused << aId;
-  unused << aIsForApp;
-  unused << aIsForBrowser;
-
-  const IPCTabAppBrowserContext& appBrowser = aContext.appBrowserContext();
-
-  // We don't trust the IPCTabContext we receive from the child, so we'll bail
-  // if we receive an IPCTabContext that's not a PopupIPCTabContext.
-  // (PopupIPCTabContext lets the child process prove that it has access to
-  // the app it's trying to open.)
-  if (appBrowser.type() != IPCTabAppBrowserContext::TPopupIPCTabContext) {
-    NS_ERROR("Unexpected IPCTabContext type.  Aborting AllocPBrowserParent.");
-    return nullptr;
-  }
-
-  const PopupIPCTabContext& popupContext = appBrowser.get_PopupIPCTabContext();
-  TabParent* opener = static_cast<TabParent*>(popupContext.openerParent());
-  if (!opener) {
-    NS_ERROR("Got null opener from child; aborting AllocPBrowserParent.");
-    return nullptr;
-  }
-
-  // Popup windows of isBrowser frames must be isBrowser if the parent
-  // isBrowser.  Allocating a !isBrowser frame with same app ID would allow
-  // the content to access data it's not supposed to.
-  if (!popupContext.isBrowserElement() && opener->IsBrowserElement()) {
-    NS_ERROR("Child trying to escalate privileges!  Aborting AllocPBrowserParent.");
-    return nullptr;
-  }
-
-  MaybeInvalidTabContext tc(aContext);
-  if (!tc.IsValid()) {
-    NS_ERROR(nsPrintfCString("Child passed us an invalid TabContext.  (%s)  "
-                             "Aborting AllocPBrowserParent.",
-                             tc.GetInvalidReason()).get());
-    return nullptr;
-  }
-
-  TabParent* parent = new TabParent(this, tc.GetTabContext(), aChromeFlags);
-
-  // We release this ref in DeallocPBrowserParent()
-  NS_ADDREF(parent);
-  return parent;
-}
-
-bool
-nsIContentParent::DeallocPBrowserParent(PBrowserParent* aFrame)
-{
-  TabParent* parent = static_cast<TabParent*>(aFrame);
-  NS_RELEASE(parent);
-  return true;
-}
-
-PBlobParent*
-nsIContentParent::AllocPBlobParent(const BlobConstructorParams& aParams)
-{
-  return BlobParent::Create(this, aParams);
-}
-
-bool
-nsIContentParent::DeallocPBlobParent(PBlobParent* aActor)
-{
-  delete aActor;
-  return true;
-}
-
-BlobParent*
-nsIContentParent::GetOrCreateActorForBlob(nsIDOMBlob* aBlob)
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  MOZ_ASSERT(aBlob);
-
-  // If the blob represents a remote blob for this ContentParent then we can
-  // simply pass its actor back here.
-  if (nsCOMPtr<nsIRemoteBlob> remoteBlob = do_QueryInterface(aBlob)) {
-    if (BlobParent* actor = static_cast<BlobParent*>(
-          static_cast<PBlobParent*>(remoteBlob->GetPBlob()))) {
-      MOZ_ASSERT(actor);
-
-      if (actor->Manager() == this) {
-        return actor;
-      }
-    }
-  }
-
-  // All blobs shared between processes must be immutable.
-  nsCOMPtr<nsIMutable> mutableBlob = do_QueryInterface(aBlob);
-  if (!mutableBlob || NS_FAILED(mutableBlob->SetMutable(false))) {
-    NS_WARNING("Failed to make blob immutable!");
-    return nullptr;
-  }
-
-  // XXX This is only safe so long as all blob implementations in our tree
-  //     inherit nsDOMFileBase. If that ever changes then this will need to grow
-  //     a real interface or something.
-  const auto* blob = static_cast<nsDOMFileBase*>(aBlob);
-
-  ChildBlobConstructorParams params;
-
-  if (blob->IsSizeUnknown() || blob->IsDateUnknown()) {
-    // We don't want to call GetSize or GetLastModifiedDate
-    // yet since that may stat a file on the main thread
-    // here. Instead we'll learn the size lazily from the
-    // other process.
-    params = MysteryBlobConstructorParams();
-  }
-  else {
-    nsString contentType;
-    nsresult rv = aBlob->GetType(contentType);
-    NS_ENSURE_SUCCESS(rv, nullptr);
-
-    uint64_t length;
-    rv = aBlob->GetSize(&length);
-    NS_ENSURE_SUCCESS(rv, nullptr);
-
-    nsCOMPtr<nsIDOMFile> file = do_QueryInterface(aBlob);
-    if (file) {
-      FileBlobConstructorParams fileParams;
-
-      rv = file->GetMozLastModifiedDate(&fileParams.modDate());
-      NS_ENSURE_SUCCESS(rv, nullptr);
-
-      rv = file->GetName(fileParams.name());
-      NS_ENSURE_SUCCESS(rv, nullptr);
-
-      fileParams.contentType() = contentType;
-      fileParams.length() = length;
-
-      params = fileParams;
-    } else {
-      NormalBlobConstructorParams blobParams;
-      blobParams.contentType() = contentType;
-      blobParams.length() = length;
-      params = blobParams;
-    }
-  }
-
-  BlobParent* actor = BlobParent::Create(this, aBlob);
-  NS_ENSURE_TRUE(actor, nullptr);
-
-  return SendPBlobConstructor(actor, params) ? actor : nullptr;
-}
-
-bool
-nsIContentParent::RecvSyncMessage(const nsString& aMsg,
-                                  const ClonedMessageData& aData,
-                                  const InfallibleTArray<CpowEntry>& aCpows,
-                                  const IPC::Principal& aPrincipal,
-                                  InfallibleTArray<nsString>* aRetvals)
-{
-  // FIXME Permission check in Content process
-  nsIPrincipal* principal = aPrincipal;
-  ContentParent* parent = AsContentParent();
-  if (!Preferences::GetBool("dom.testing.ignore_ipc_principal", false) &&
-      parent && principal && !AssertAppPrincipal(parent, principal)) {
-    return false;
-  }
-
-  nsRefPtr<nsFrameMessageManager> ppm = mMessageManager;
-  if (ppm) {
-    StructuredCloneData cloneData = ipc::UnpackClonedMessageDataForParent(aData);
-    CpowIdHolder cpows(GetCPOWManager(), aCpows);
-
-    ppm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm.get()),
-                        aMsg, true, &cloneData, &cpows, aPrincipal, aRetvals);
-  }
-  return true;
-}
-
-bool
-nsIContentParent::AnswerRpcMessage(const nsString& aMsg,
-                                   const ClonedMessageData& aData,
-                                   const InfallibleTArray<CpowEntry>& aCpows,
-                                   const IPC::Principal& aPrincipal,
-                                   InfallibleTArray<nsString>* aRetvals)
-{
-  // FIXME Permission check in Content process
-  nsIPrincipal* principal = aPrincipal;
-  ContentParent* parent = AsContentParent();
-  if (!Preferences::GetBool("dom.testing.ignore_ipc_principal", false) &&
-      parent && principal && !AssertAppPrincipal(parent, principal)) {
-    return false;
-  }
-
-  nsRefPtr<nsFrameMessageManager> ppm = mMessageManager;
-  if (ppm) {
-    StructuredCloneData cloneData = ipc::UnpackClonedMessageDataForParent(aData);
-    CpowIdHolder cpows(GetCPOWManager(), aCpows);
-    ppm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm.get()),
-                        aMsg, true, &cloneData, &cpows, aPrincipal, aRetvals);
-  }
-  return true;
-}
-
-bool
-nsIContentParent::RecvAsyncMessage(const nsString& aMsg,
-                                   const ClonedMessageData& aData,
-                                   const InfallibleTArray<CpowEntry>& aCpows,
-                                   const IPC::Principal& aPrincipal)
-{
-  // FIXME Permission check in Content process
-  nsIPrincipal* principal = aPrincipal;
-  ContentParent* parent = AsContentParent();
-  if (!Preferences::GetBool("dom.testing.ignore_ipc_principal", false) &&
-      parent && principal && !AssertAppPrincipal(parent, principal)) {
-    return false;
-  }
-
-  nsRefPtr<nsFrameMessageManager> ppm = mMessageManager;
-  if (ppm) {
-    StructuredCloneData cloneData = ipc::UnpackClonedMessageDataForParent(aData);
-    CpowIdHolder cpows(GetCPOWManager(), aCpows);
-    ppm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm.get()),
-                        aMsg, false, &cloneData, &cpows, aPrincipal, nullptr);
-  }
-  return true;
-}
-
-} // namespace dom
-} // namespace mozilla
deleted file mode 100644
--- a/dom/ipc/nsIContentParent.h
+++ /dev/null
@@ -1,95 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef mozilla_dom_nsIContentParent_h
-#define mozilla_dom_nsIContentParent_h
-
-#include "mozilla/dom/ipc/Blob.h"
-
-#include "nsFrameMessageManager.h"
-#include "nsISupports.h"
-
-#define NS_ICONTENTPARENT_IID                                   \
-  { 0xeeec9ebf, 0x8ecf, 0x4e38,                                 \
-    { 0x81, 0xda, 0xb7, 0x34, 0x13, 0x7e, 0xac, 0xf3 } }
-
-class nsFrameMessageManager;
-
-namespace IPC {
-class Principal;
-} // namespace IPC
-
-namespace mozilla {
-
-namespace jsipc {
-class PJavaScriptParent;
-class JavaScriptParent;
-class CpowEntry;
-} // namespace jsipc
-
-namespace dom {
-struct IPCTabContext;
-class ContentParent;
-
-class nsIContentParent : public nsISupports
-                       , public mozilla::dom::ipc::MessageManagerCallback
-{
-public:
-  NS_DECLARE_STATIC_IID_ACCESSOR(NS_ICONTENTPARENT_IID)
-
-  nsIContentParent();
-  BlobParent* GetOrCreateActorForBlob(nsIDOMBlob* aBlob);
-
-  virtual uint64_t ChildID() = 0;
-
-  virtual PBlobParent* SendPBlobConstructor(
-    PBlobParent* actor,
-    const BlobConstructorParams& params) NS_WARN_UNUSED_RESULT = 0;
-
-  virtual jsipc::JavaScriptParent *GetCPOWManager() = 0;
-
-  virtual bool IsContentParent() { return false; }
-  ContentParent* AsContentParent();
-
-protected: // IPDL methods
-  virtual mozilla::jsipc::PJavaScriptParent* AllocPJavaScriptParent();
-  virtual bool DeallocPJavaScriptParent(mozilla::jsipc::PJavaScriptParent*);
-
-  virtual PBrowserParent* AllocPBrowserParent(const IPCTabContext& aContext,
-                                              const uint32_t& aChromeFlags,
-                                              const uint64_t& aId,
-                                              const bool& aIsForApp,
-                                              const bool& aIsForBrowser);
-  virtual bool DeallocPBrowserParent(PBrowserParent* frame);
-
-  virtual PBlobParent* AllocPBlobParent(const BlobConstructorParams& aParams);
-  virtual bool DeallocPBlobParent(PBlobParent*);
-
-  virtual bool RecvSyncMessage(const nsString& aMsg,
-                               const ClonedMessageData& aData,
-                               const InfallibleTArray<jsipc::CpowEntry>& aCpows,
-                               const IPC::Principal& aPrincipal,
-                               InfallibleTArray<nsString>* aRetvals);
-  virtual bool AnswerRpcMessage(const nsString& aMsg,
-                                const ClonedMessageData& aData,
-                                const InfallibleTArray<jsipc::CpowEntry>& aCpows,
-                                const IPC::Principal& aPrincipal,
-                                InfallibleTArray<nsString>* aRetvals);
-  virtual bool RecvAsyncMessage(const nsString& aMsg,
-                                const ClonedMessageData& aData,
-                                const InfallibleTArray<jsipc::CpowEntry>& aCpows,
-                                const IPC::Principal& aPrincipal);
-
-protected: // members
-  nsRefPtr<nsFrameMessageManager> mMessageManager;
-};
-
-NS_DEFINE_STATIC_IID_ACCESSOR(nsIContentParent, NS_ICONTENTPARENT_IID)
-
-} // namespace dom
-} // namespace mozilla
-
-#endif /* mozilla_dom_nsIContentParent_h */