--- a/accessible/generic/ARIAGridAccessible.cpp
+++ b/accessible/generic/ARIAGridAccessible.cpp
@@ -542,18 +542,19 @@ ARIARowAccessible::
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(ARIARowAccessible, Accessible)
 
 GroupPos
 ARIARowAccessible::GroupPosition()
 {
   int32_t count = 0, index = 0;
-  if (nsCoreUtils::GetUIntAttr(nsAccUtils::TableFor(this)->GetContent(),
-                               nsGkAtoms::aria_rowcount, &count) &&
+  Accessible* table = nsAccUtils::TableFor(this);
+  if (table && nsCoreUtils::GetUIntAttr(table->GetContent(),
+                                        nsGkAtoms::aria_rowcount, &count) &&
       nsCoreUtils::GetUIntAttr(mContent, nsGkAtoms::aria_rowindex, &index)) {
     return GroupPos(0, index, count);
   }
 
   return AccessibleWrap::GroupPosition();
 }
 
 

--- a/browser/components/extensions/test/browser/browser.ini
+++ b/browser/components/extensions/test/browser/browser.ini
@@ -1,10 +1,9 @@
 [DEFAULT]
-skip-if = os == 'android' || buildapp == 'b2g' || os == 'mac'
 support-files =
   head.js
   context.html
   ctxmenu-image.png
 
 [browser_ext_simple.js]
 [browser_ext_currentWindow.js]
 [browser_ext_browserAction_simple.js]

--- a/build/mach_bootstrap.py
+++ b/build/mach_bootstrap.py
@@ -98,24 +98,25 @@ SEARCH_PATHS = [
     'testing/marionette/transport',
     'testing/marionette/driver',
     'testing/luciddream',
     'testing/mozbase/mozcrash',
     'testing/mozbase/mozdebug',
     'testing/mozbase/mozdevice',
     'testing/mozbase/mozfile',
     'testing/mozbase/mozhttpd',
+    'testing/mozbase/mozinfo',
+    'testing/mozbase/mozinstall',
     'testing/mozbase/mozleak',
     'testing/mozbase/mozlog',
     'testing/mozbase/moznetwork',
     'testing/mozbase/mozprocess',
     'testing/mozbase/mozprofile',
     'testing/mozbase/mozrunner',
     'testing/mozbase/mozsystemmonitor',
-    'testing/mozbase/mozinfo',
     'testing/mozbase/mozscreenshot',
     'testing/mozbase/moztest',
     'testing/mozbase/mozversion',
     'testing/mozbase/manifestparser',
     'xpcom/idl-parser',
 ]
 
 # Individual files providing mach commands.

--- a/docshell/test/unit/test_nsDefaultURIFixup_info.js
+++ b/docshell/test/unit/test_nsDefaultURIFixup_info.js
@@ -207,21 +207,20 @@ var testcases = [ {
     fixedURI: "http://[64:ff9b::8.8.8.8]/~moz",
     protocolChange: true
   }, {
     input: "[::1][::1]",
     keywordLookup: true,
     protocolChange: true
   }, {
     input: "[::1][100",
-    fixedURI: "http://[::1][100/",
-    alternateURI: "http://[::1][100/",
+    fixedURI: null,
+    alternateURI: null,
     keywordLookup: true,
-    protocolChange: true,
-    affectedByDNSForSingleHosts: true,
+    protocolChange: true
   }, {
     input: "[::1]]",
     keywordLookup: true,
     protocolChange: true
   }, {
     input: "1234",
     fixedURI: "http://1234/",
     alternateURI: "http://www.1234.com/",
@@ -498,23 +497,24 @@ if (Services.appinfo.OS.toLowerCase().st
     fixedURI: "file:///some/file.txt",
     protocolChange: true,
   });
   testcases.push({
     input: "//mozilla",
     fixedURI: "file:////mozilla",
     protocolChange: true,
   });
+  // \ is an invalid character in the hostname until bug 652186 is implemented
   testcases.push({
     input: "mozilla\\",
-    fixedURI: "http://mozilla\\/",
-    alternateURI: "http://www.mozilla/",
+    // fixedURI: "http://mozilla\\/",
+    // alternateURI: "http://www.mozilla/",
     keywordLookup: true,
     protocolChange: true,
-    affectedByDNSForSingleHosts: true,
+    // affectedByDNSForSingleHosts: true,
   });
 }
 
 function sanitize(input) {
   return input.replace(/\r|\n/g, "").trim();
 }
 
 

--- a/dom/media/MP3Demuxer.cpp
+++ b/dom/media/MP3Demuxer.cpp
@@ -79,21 +79,20 @@ MP3Demuxer::GetTrackDemuxer(TrackInfo::T
 }
 
 bool
 MP3Demuxer::IsSeekable() const {
   return true;
 }
 
 void
-MP3Demuxer::NotifyDataArrived(uint32_t aLength, int64_t aOffset) {
+MP3Demuxer::NotifyDataArrived() {
   // TODO: bug 1169485.
   NS_WARNING("Unimplemented function NotifyDataArrived");
-  MP3DEMUXER_LOGV("NotifyDataArrived(%u, %" PRId64 ") mOffset=%" PRId64,
-                  aLength, aOffset, mTrackDemuxer->GetResourceOffset());
+  MP3DEMUXER_LOGV("NotifyDataArrived()");
 }
 
 void
 MP3Demuxer::NotifyDataRemoved() {
   // TODO: bug 1169485.
   NS_WARNING("Unimplemented function NotifyDataRemoved");
   MP3DEMUXER_LOGV("NotifyDataRemoved()");
 }

--- a/dom/media/MP3Demuxer.h
+++ b/dom/media/MP3Demuxer.h
@@ -20,17 +20,17 @@ public:
   // MediaDataDemuxer interface.
   explicit MP3Demuxer(MediaResource* aSource);
   nsRefPtr<InitPromise> Init() override;
   bool HasTrackType(TrackInfo::TrackType aType) const override;
   uint32_t GetNumberTracks(TrackInfo::TrackType aType) const override;
   already_AddRefed<MediaTrackDemuxer> GetTrackDemuxer(
       TrackInfo::TrackType aType, uint32_t aTrackNumber) override;
   bool IsSeekable() const override;
-  void NotifyDataArrived(uint32_t aLength, int64_t aOffset) override;
+  void NotifyDataArrived() override;
   void NotifyDataRemoved() override;
   // Do not shift the calculated buffered range by the start time of the first
   // decoded frame. The mac MP3 decoder will buffer some samples and the first
   // frame returned has typically a start time that is non-zero, causing our
   // buffered range to have a negative start time.
   bool ShouldComputeStartTime() const override { return false; }
 
 private:

--- a/dom/media/MediaDataDemuxer.h
+++ b/dom/media/MediaDataDemuxer.h
@@ -72,25 +72,27 @@ public:
 
   // Returns the media's crypto information, or nullptr if media isn't
   // encrypted.
   virtual UniquePtr<EncryptionInfo> GetCrypto()
   {
     return nullptr;
   }
 
-  // Notifies the demuxer that the underlying resource has received more data.
+  // Notifies the demuxer that the underlying resource has received more data
+  // since the demuxer was initialized.
   // The demuxer can use this mechanism to inform all track demuxers that new
-  // data is available.
-  virtual void NotifyDataArrived(uint32_t aLength, int64_t aOffset) { }
+  // data is available and to refresh its buffered range.
+  virtual void NotifyDataArrived() { }
 
-  // Notifies the demuxer that the underlying resource has had data removed.
+  // Notifies the demuxer that the underlying resource has had data removed
+  // since the demuxer was initialized.
   // The demuxer can use this mechanism to inform all track demuxers to update
-  // its TimeIntervals.
-  // This will be called should the demuxer be used with MediaSource.
+  // its buffered range.
+  // This will be called should the demuxer be used with MediaSourceResource.
   virtual void NotifyDataRemoved() { }
 
   // Indicate to MediaFormatReader if it should compute the start time
   // of the demuxed data. If true (default) the first sample returned will be
   // used as reference time base.
   virtual bool ShouldComputeStartTime() const { return true; }
 
 protected:

--- a/dom/media/MediaFormatReader.cpp
+++ b/dom/media/MediaFormatReader.cpp
@@ -1598,17 +1598,17 @@ MediaFormatReader::NotifyDemuxer(uint32_
 
   LOGV("aLength=%u, aOffset=%lld", aLength, aOffset);
   if (mShutdown || !mDemuxer ||
       (!mDemuxerInitDone && !mDemuxerInitRequest.Exists())) {
     return;
   }
 
   if (aLength || aOffset) {
-    mDemuxer->NotifyDataArrived(aLength, aOffset);
+    mDemuxer->NotifyDataArrived();
   } else {
     mDemuxer->NotifyDataRemoved();
   }
   if (!mInitDone) {
     return;
   }
   if (HasVideo()) {
     mVideo.mReceivedNewData = true;

--- a/dom/media/fmp4/MP4Demuxer.cpp
+++ b/dom/media/fmp4/MP4Demuxer.cpp
@@ -181,17 +181,17 @@ MP4Demuxer::GetTrackDemuxer(TrackInfo::T
 
 bool
 MP4Demuxer::IsSeekable() const
 {
   return mMetadata->CanSeek();
 }
 
 void
-MP4Demuxer::NotifyDataArrived(uint32_t aLength, int64_t aOffset)
+MP4Demuxer::NotifyDataArrived()
 {
   for (uint32_t i = 0; i < mDemuxers.Length(); i++) {
     mDemuxers[i]->NotifyDataArrived();
   }
 }
 
 void
 MP4Demuxer::NotifyDataRemoved()

--- a/dom/media/fmp4/MP4Demuxer.h
+++ b/dom/media/fmp4/MP4Demuxer.h
@@ -35,17 +35,17 @@ public:
 
   virtual already_AddRefed<MediaTrackDemuxer> GetTrackDemuxer(TrackInfo::TrackType aType,
                                                               uint32_t aTrackNumber) override;
 
   virtual bool IsSeekable() const override;
 
   virtual UniquePtr<EncryptionInfo> GetCrypto() override;
 
-  virtual void NotifyDataArrived(uint32_t aLength, int64_t aOffset) override;
+  virtual void NotifyDataArrived() override;
 
   virtual void NotifyDataRemoved() override;
 
 private:
   friend class MP4TrackDemuxer;
   nsRefPtr<MediaResource> mResource;
   nsRefPtr<mp4_demuxer::ResourceStream> mStream;
   nsRefPtr<MediaByteBuffer> mInitData;

--- a/dom/media/mediasource/MediaSourceDemuxer.cpp
+++ b/dom/media/mediasource/MediaSourceDemuxer.cpp
@@ -48,17 +48,17 @@ MediaSourceDemuxer::AttemptInit()
     return InitPromise::CreateAndResolve(NS_OK, __func__);
   }
 
   nsRefPtr<InitPromise> p = mInitPromise.Ensure(__func__);
 
   return p;
 }
 
-void MediaSourceDemuxer::NotifyDataArrived(uint32_t aLength, int64_t aOffset)
+void MediaSourceDemuxer::NotifyDataArrived()
 {
   nsRefPtr<MediaSourceDemuxer> self = this;
   nsCOMPtr<nsIRunnable> task =
     NS_NewRunnableFunction([self] () {
       if (self->mInitPromise.IsEmpty()) {
         return;
       }
       if (self->ScanSourceBuffersForContent()) {

--- a/dom/media/mediasource/MediaSourceDemuxer.h
+++ b/dom/media/mediasource/MediaSourceDemuxer.h
@@ -37,17 +37,17 @@ public:
                                                               uint32_t aTrackNumber) override;
 
   bool IsSeekable() const override;
 
   UniquePtr<EncryptionInfo> GetCrypto() override;
 
   bool ShouldComputeStartTime() const override { return false; }
 
-  void NotifyDataArrived(uint32_t aLength, int64_t aOffset) override;
+  void NotifyDataArrived() override;
 
   /* interface for TrackBuffersManager */
   void AttachSourceBuffer(TrackBuffersManager* aSourceBuffer);
   void DetachSourceBuffer(TrackBuffersManager* aSourceBuffer);
   TaskQueue* GetTaskQueue() { return mTaskQueue; }
 
   // Returns a string describing the state of the MediaSource internal
   // buffered data. Used for debugging purposes.

--- a/dom/media/mediasource/TrackBuffersManager.cpp
+++ b/dom/media/mediasource/TrackBuffersManager.cpp
@@ -871,20 +871,18 @@ TrackBuffersManager::OnDemuxerResetDone(
 
   SegmentParserLoop();
 }
 
 void
 TrackBuffersManager::AppendDataToCurrentInputBuffer(MediaByteBuffer* aData)
 {
   MOZ_ASSERT(mCurrentInputBuffer);
-  int64_t offset = mCurrentInputBuffer->GetLength();
   mCurrentInputBuffer->AppendData(aData);
-  // A MediaByteBuffer has a maximum size of 2GiB.
-  mInputDemuxer->NotifyDataArrived(uint32_t(aData->Length()), offset);
+  mInputDemuxer->NotifyDataArrived();
 }
 
 void
 TrackBuffersManager::InitializationSegmentReceived()
 {
   MOZ_ASSERT(mParser->HasCompleteInitData());
   mCurrentInputBuffer = new SourceBufferResource(mType);
   // The demuxer isn't initialized yet ; we don't want to notify it

--- a/dom/media/omx/MediaCodecProxy.cpp
+++ b/dom/media/omx/MediaCodecProxy.cpp
@@ -9,17 +9,16 @@
 #include <binder/IPCThreadState.h>
 #include <stagefright/foundation/ABuffer.h>
 #include <stagefright/foundation/ADebug.h>
 #include <stagefright/MetaData.h>
 #include "stagefright/MediaErrors.h"
 
 #include <android/log.h>
 #define MCP_LOG(...) __android_log_print(ANDROID_LOG_DEBUG, "MediaCodecProxy", __VA_ARGS__)
-#define TIMEOUT_DEQUEUE_INPUTBUFFER_MS 1000000ll
 
 namespace android {
 
 // General Template: MediaCodec::getOutputGraphicBufferFromIndex(...)
 template <typename T, bool InterfaceSupported>
 struct OutputGraphicBufferStub
 {
   static status_t GetOutputGraphicBuffer(T *aMediaCodec,
@@ -566,31 +565,34 @@ bool MediaCodecProxy::UpdateOutputBuffer
   if (err != OK){
     MCP_LOG("Couldn't update output buffers from MediaCodec");
     return false;
   }
   return true;
 }
 
 status_t MediaCodecProxy::Input(const uint8_t* aData, uint32_t aDataSize,
-                                int64_t aTimestampUsecs, uint64_t aflags)
+                                int64_t aTimestampUsecs, uint64_t aflags,
+                                int64_t aTimeoutUs)
 {
   // Read Lock for mCodec
   {
     RWLock::AutoRLock autolock(mCodecLock);
     if (mCodec == nullptr) {
       MCP_LOG("MediaCodec has not been inited from input!");
       return NO_INIT;
     }
   }
 
   size_t index;
-  status_t err = dequeueInputBuffer(&index, TIMEOUT_DEQUEUE_INPUTBUFFER_MS);
+  status_t err = dequeueInputBuffer(&index, aTimeoutUs);
   if (err != OK) {
-    MCP_LOG("dequeueInputBuffer returned %d", err);
+    if (err != -EAGAIN) {
+      MCP_LOG("dequeueInputBuffer returned %d", err);
+    }
     return err;
   }
 
   if (aData) {
     const sp<ABuffer> &dstBuffer = mInputBuffers.itemAt(index);
 
     CHECK_LE(aDataSize, dstBuffer->capacity());
     dstBuffer->setRange(0, aDataSize);

--- a/dom/media/omx/MediaCodecProxy.h
+++ b/dom/media/omx/MediaCodecProxy.h
@@ -124,17 +124,17 @@ public:
                                            sp<GraphicBuffer> *aGraphicBuffer);
 
   status_t getCapability(uint32_t *aCapability);
 
   // Utility functions
 
   // If aData is null, will notify decoder input EOS
   status_t Input(const uint8_t* aData, uint32_t aDataSize,
-                 int64_t aTimestampUsecs, uint64_t flags);
+                 int64_t aTimestampUsecs, uint64_t flags, int64_t aTimeoutUs = 0);
   status_t Output(MediaBuffer** aBuffer, int64_t aTimeoutUs);
   bool Prepare();
   void ReleaseMediaResources();
   // This updates mOutputBuffer when receiving INFO_OUTPUT_BUFFERS_CHANGED event.
   bool UpdateOutputBuffers();
 
   void ReleaseMediaBuffer(MediaBuffer* abuffer);
 

--- a/dom/media/platforms/gonk/GonkAudioDecoderManager.cpp
+++ b/dom/media/platforms/gonk/GonkAudioDecoderManager.cpp
@@ -16,71 +16,66 @@
 #include "stagefright/MetaData.h"
 #include "stagefright/MediaErrors.h"
 #include <stagefright/foundation/AMessage.h>
 #include <stagefright/foundation/ALooper.h>
 #include "media/openmax/OMX_Audio.h"
 #include "MediaData.h"
 #include "MediaInfo.h"
 
+#define CODECCONFIG_TIMEOUT_US 10000LL
+#define READ_OUTPUT_BUFFER_TIMEOUT_US  0LL
+
 #include <android/log.h>
 #define GADM_LOG(...) __android_log_print(ANDROID_LOG_DEBUG, "GonkAudioDecoderManager", __VA_ARGS__)
 
 extern PRLogModuleInfo* GetPDMLog();
 #define LOG(...) MOZ_LOG(GetPDMLog(), mozilla::LogLevel::Debug, (__VA_ARGS__))
-#define READ_OUTPUT_BUFFER_TIMEOUT_US  3000
 
 using namespace android;
 typedef android::MediaCodecProxy MediaCodecProxy;
 
 namespace mozilla {
 
 GonkAudioDecoderManager::GonkAudioDecoderManager(const AudioInfo& aConfig)
-  : mLastDecodedTime(0)
-  , mAudioChannels(aConfig.mChannels)
+  : mAudioChannels(aConfig.mChannels)
   , mAudioRate(aConfig.mRate)
   , mAudioProfile(aConfig.mProfile)
   , mAudioBuffer(nullptr)
-  , mMonitor("GonkAudioDecoderManager")
 {
   MOZ_COUNT_CTOR(GonkAudioDecoderManager);
   MOZ_ASSERT(mAudioChannels);
   mCodecSpecificData = aConfig.mCodecSpecificConfig;
   mMimeType = aConfig.mMimeType;
-
 }
 
 GonkAudioDecoderManager::~GonkAudioDecoderManager()
 {
   MOZ_COUNT_DTOR(GonkAudioDecoderManager);
 }
 
 nsRefPtr<MediaDataDecoder::InitPromise>
-GonkAudioDecoderManager::Init(MediaDataDecoderCallback* aCallback)
+GonkAudioDecoderManager::Init()
 {
-  if (InitMediaCodecProxy(aCallback)) {
+  if (InitMediaCodecProxy()) {
     return InitPromise::CreateAndResolve(TrackType::kAudioTrack, __func__);
   } else {
     return InitPromise::CreateAndReject(DecoderFailureReason::INIT_ERROR, __func__);
   }
 }
 
 bool
-GonkAudioDecoderManager::InitMediaCodecProxy(MediaDataDecoderCallback* aCallback)
+GonkAudioDecoderManager::InitMediaCodecProxy()
 {
   status_t rv = OK;
-  if (mLooper != nullptr) {
+  if (!InitLoopers(MediaData::AUDIO_DATA)) {
     return false;
   }
-  // Create ALooper
-  mLooper = new ALooper;
-  mLooper->setName("GonkAudioDecoderManager");
-  mLooper->start();
 
-  mDecoder = MediaCodecProxy::CreateByType(mLooper, mMimeType.get(), false, nullptr);
+  mDecoder = MediaCodecProxy::CreateByType(mDecodeLooper, mMimeType.get(), false, nullptr);
   if (!mDecoder.get()) {
     return false;
   }
   if (!mDecoder->AskMediaCodecAndWait())
   {
     mDecoder = nullptr;
     return false;
   }
@@ -94,73 +89,28 @@ GonkAudioDecoderManager::InitMediaCodecP
   format->setInt32("aac-profile", mAudioProfile);
   status_t err = mDecoder->configure(format, nullptr, nullptr, 0);
   if (err != OK || !mDecoder->Prepare()) {
     return false;
   }
 
   if (mMimeType.EqualsLiteral("audio/mp4a-latm")) {
     rv = mDecoder->Input(mCodecSpecificData->Elements(), mCodecSpecificData->Length(), 0,
-                         android::MediaCodec::BUFFER_FLAG_CODECCONFIG);
+                         android::MediaCodec::BUFFER_FLAG_CODECCONFIG,
+                         CODECCONFIG_TIMEOUT_US);
   }
 
   if (rv == OK) {
     return true;
   } else {
     GADM_LOG("Failed to input codec specific data!");
     return false;
   }
 }
 
-bool
-GonkAudioDecoderManager::HasQueuedSample()
-{
-    MonitorAutoLock mon(mMonitor);
-    return mQueueSample.Length();
-}
-
-nsresult
-GonkAudioDecoderManager::Input(MediaRawData* aSample)
-{
-  MonitorAutoLock mon(mMonitor);
-  nsRefPtr<MediaRawData> sample;
-
-  if (aSample) {
-    sample = aSample;
-  } else {
-    // It means EOS with empty sample.
-    sample = new MediaRawData();
-  }
-
-  mQueueSample.AppendElement(sample);
-
-  status_t rv;
-  while (mQueueSample.Length()) {
-    nsRefPtr<MediaRawData> data = mQueueSample.ElementAt(0);
-    {
-      MonitorAutoUnlock mon_exit(mMonitor);
-      rv = mDecoder->Input(reinterpret_cast<const uint8_t*>(data->Data()),
-                           data->Size(),
-                           data->mTime,
-                           0);
-    }
-    if (rv == OK) {
-      mQueueSample.RemoveElementAt(0);
-    } else if (rv == -EAGAIN || rv == -ETIMEDOUT) {
-      // In most cases, EAGAIN or ETIMEOUT are safe because OMX can't fill
-      // buffer on time.
-      return NS_OK;
-    } else {
-      return NS_ERROR_UNEXPECTED;
-    }
-  }
-
-  return NS_OK;
-}
-
 nsresult
 GonkAudioDecoderManager::CreateAudioData(int64_t aStreamOffset, AudioData **v) {
   if (!(mAudioBuffer != nullptr && mAudioBuffer->data() != nullptr)) {
     GADM_LOG("Audio Buffer is not valid!");
     return NS_ERROR_UNEXPECTED;
   }
 
   int64_t timeUs;
@@ -170,23 +120,23 @@ GonkAudioDecoderManager::CreateAudioData
 
   if (mAudioBuffer->range_length() == 0) {
     // Some decoders may return spurious empty buffers that we just want to ignore
     // quoted from Android's AwesomePlayer.cpp
     ReleaseAudioBuffer();
     return NS_ERROR_NOT_AVAILABLE;
   }
 
-  if (mLastDecodedTime > timeUs) {
+  if (mLastTime > timeUs) {
     ReleaseAudioBuffer();
     GADM_LOG("Output decoded sample time is revert. time=%lld", timeUs);
     MOZ_ASSERT(false);
     return NS_ERROR_NOT_AVAILABLE;
   }
-  mLastDecodedTime = timeUs;
+  mLastTime = timeUs;
 
   const uint8_t *data = static_cast<const uint8_t*>(mAudioBuffer->data());
   size_t dataOffset = mAudioBuffer->range_offset();
   size_t size = mAudioBuffer->range_length();
 
   nsAutoArrayPtr<AudioDataValue> buffer(new AudioDataValue[size/2]);
   memcpy(buffer.get(), data+dataOffset, size);
   uint32_t frames = size / (2 * mAudioChannels);
@@ -203,33 +153,16 @@ GonkAudioDecoderManager::CreateAudioData
                                                 mAudioChannels,
                                                 mAudioRate);
   ReleaseAudioBuffer();
   audioData.forget(v);
   return NS_OK;
 }
 
 nsresult
-GonkAudioDecoderManager::Flush()
-{
-  {
-    MonitorAutoLock mon(mMonitor);
-    mQueueSample.Clear();
-  }
-
-  mLastDecodedTime = 0;
-
-  if (mDecoder->flush() != OK) {
-    return NS_ERROR_FAILURE;
-  }
-
-  return NS_OK;
-}
-
-nsresult
 GonkAudioDecoderManager::Output(int64_t aStreamOffset,
                                 nsRefPtr<MediaData>& aOutData)
 {
   aOutData = nullptr;
   status_t err;
   err = mDecoder->Output(&mAudioBuffer, READ_OUTPUT_BUFFER_TIMEOUT_US);
 
   switch (err) {

--- a/dom/media/platforms/gonk/GonkAudioDecoderManager.h
+++ b/dom/media/platforms/gonk/GonkAudioDecoderManager.h
@@ -8,62 +8,43 @@
 #define GonkAudioDecoderManager_h_
 
 #include "mozilla/RefPtr.h"
 #include "GonkMediaDataDecoder.h"
 
 using namespace android;
 
 namespace android {
-struct MOZ_EXPORT ALooper;
 class MOZ_EXPORT MediaBuffer;
 } // namespace android
 
 namespace mozilla {
 
 class GonkAudioDecoderManager : public GonkDecoderManager {
 typedef android::MediaCodecProxy MediaCodecProxy;
 public:
   GonkAudioDecoderManager(const AudioInfo& aConfig);
 
-  virtual ~GonkAudioDecoderManager() override;
+  virtual ~GonkAudioDecoderManager();
 
-  nsRefPtr<InitPromise> Init(MediaDataDecoderCallback* aCallback) override;
-
-  nsresult Input(MediaRawData* aSample) override;
+  nsRefPtr<InitPromise> Init() override;
 
   nsresult Output(int64_t aStreamOffset,
                           nsRefPtr<MediaData>& aOutput) override;
 
-  nsresult Flush() override;
-
-  bool HasQueuedSample() override;
-
 private:
-  bool InitMediaCodecProxy(MediaDataDecoderCallback* aCallback);
+  bool InitMediaCodecProxy();
 
   nsresult CreateAudioData(int64_t aStreamOffset,
                               AudioData** aOutData);
 
   void ReleaseAudioBuffer();
 
-  int64_t mLastDecodedTime;
-
   uint32_t mAudioChannels;
   uint32_t mAudioRate;
   const uint32_t mAudioProfile;
 
-  MediaDataDecoderCallback*  mReaderCallback;
   android::MediaBuffer* mAudioBuffer;
-  android::sp<ALooper> mLooper;
-
-  // This monitor protects mQueueSample.
-  Monitor mMonitor;
-
-  // An queue with the MP4 samples which are waiting to be sent into OMX.
-  // If an element is an empty MP4Sample, that menas EOS. There should not
-  // any sample be queued after EOS.
-  nsTArray<nsRefPtr<MediaRawData>> mQueueSample;
 };
 
 } // namespace mozilla
 
 #endif // GonkAudioDecoderManager_h_

--- a/dom/media/platforms/gonk/GonkMediaDataDecoder.cpp
+++ b/dom/media/platforms/gonk/GonkMediaDataDecoder.cpp
@@ -3,64 +3,282 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 #include "GonkMediaDataDecoder.h"
 #include "VideoUtils.h"
 #include "nsTArray.h"
 #include "MediaCodecProxy.h"
 
+#include <stagefright/foundation/ADebug.h>
+
 #include "mozilla/Logging.h"
 #include <android/log.h>
 #define GMDD_LOG(...) __android_log_print(ANDROID_LOG_DEBUG, "GonkMediaDataDecoder", __VA_ARGS__)
+#define INPUT_TIMEOUT_US 0LL // Don't wait for buffer if none is available.
+#define MIN_QUEUED_SAMPLES 2
 
 extern PRLogModuleInfo* GetPDMLog();
 #define LOG(...) MOZ_LOG(GetPDMLog(), mozilla::LogLevel::Debug, (__VA_ARGS__))
 
 using namespace android;
 
 namespace mozilla {
 
+bool
+GonkDecoderManager::InitLoopers(MediaData::Type aType)
+{
+  MOZ_ASSERT(mDecodeLooper.get() == nullptr && mTaskLooper.get() == nullptr);
+  MOZ_ASSERT(aType == MediaData::VIDEO_DATA || aType == MediaData::AUDIO_DATA);
+
+  const char* suffix = (aType == MediaData::VIDEO_DATA ? "video" : "audio");
+  mDecodeLooper = new ALooper;
+  android::AString name("MediaCodecProxy/");
+  name.append(suffix);
+  mDecodeLooper->setName(name.c_str());
+
+  mTaskLooper = new ALooper;
+  name.setTo("GonkDecoderManager/");
+  name.append(suffix);
+  mTaskLooper->setName(name.c_str());
+  mTaskLooper->registerHandler(this);
+
+  return mDecodeLooper->start() == OK && mTaskLooper->start() == OK;
+}
+
+nsresult
+GonkDecoderManager::Input(MediaRawData* aSample)
+{
+  nsRefPtr<MediaRawData> sample;
+
+  if (aSample) {
+    sample = aSample;
+  } else {
+    // It means EOS with empty sample.
+    sample = new MediaRawData();
+  }
+  {
+    MutexAutoLock lock(mMutex);
+    mQueuedSamples.AppendElement(sample);
+  }
+
+  sp<AMessage> input = new AMessage(kNotifyProcessInput, id());
+  if (!aSample) {
+    input->setInt32("input-eos", 1);
+  }
+  input->post();
+  return NS_OK;
+}
+
+int32_t
+GonkDecoderManager::ProcessQueuedSamples()
+{
+  MutexAutoLock lock(mMutex);
+  status_t rv;
+  while (mQueuedSamples.Length()) {
+    nsRefPtr<MediaRawData> data = mQueuedSamples.ElementAt(0);
+    {
+      rv = mDecoder->Input(reinterpret_cast<const uint8_t*>(data->Data()),
+                           data->Size(),
+                           data->mTime,
+                           0,
+                           INPUT_TIMEOUT_US);
+    }
+    if (rv == OK) {
+      mQueuedSamples.RemoveElementAt(0);
+      mWaitOutput.AppendElement(data->mOffset);
+    } else if (rv == -EAGAIN || rv == -ETIMEDOUT) {
+      // In most cases, EAGAIN or ETIMEOUT are safe because OMX can't fill
+      // buffer on time.
+      break;
+    } else {
+      return rv;
+    }
+  }
+  return mQueuedSamples.Length();
+}
+
+nsresult
+GonkDecoderManager::Flush()
+{
+  if (mDecoder == nullptr) {
+    GMDD_LOG("Decoder is not initialized");
+    return NS_ERROR_UNEXPECTED;
+  }
+  {
+    MutexAutoLock lock(mMutex);
+    mQueuedSamples.Clear();
+  }
+
+  mLastTime = 0;
+
+  MonitorAutoLock lock(mFlushMonitor);
+  mIsFlushing = true;
+  sp<AMessage> flush = new AMessage(kNotifyProcessFlush, id());
+  flush->post();
+  while (mIsFlushing) {
+    lock.Wait();
+  }
+  return NS_OK;
+}
+
 nsresult
 GonkDecoderManager::Shutdown()
 {
   if (mDecoder.get()) {
     mDecoder->stop();
     mDecoder->ReleaseMediaResources();
     mDecoder = nullptr;
   }
 
   mInitPromise.RejectIfExists(DecoderFailureReason::CANCELED, __func__);
 
   return NS_OK;
 }
 
+bool
+GonkDecoderManager::HasQueuedSample()
+{
+  MutexAutoLock lock(mMutex);
+  return mQueuedSamples.Length();
+}
+
+void
+GonkDecoderManager::ProcessInput(bool aEndOfStream)
+{
+  status_t rv = ProcessQueuedSamples();
+  if (rv >= 0) {
+    if (!aEndOfStream && rv <= MIN_QUEUED_SAMPLES) {
+      mDecodeCallback->InputExhausted();
+    }
+
+    if (mToDo.get() == nullptr) {
+      mToDo = new AMessage(kNotifyDecoderActivity, id());
+      if (aEndOfStream) {
+        mToDo->setInt32("input-eos", 1);
+      }
+      mDecoder->requestActivityNotification(mToDo);
+    }
+  } else {
+    GMDD_LOG("input processed: error#%d", rv);
+    mDecodeCallback->Error();
+  }
+}
+
+void
+GonkDecoderManager::ProcessFlush()
+{
+  MonitorAutoLock lock(mFlushMonitor);
+  mWaitOutput.Clear();
+  if (mDecoder->flush() != OK) {
+    GMDD_LOG("flush error");
+    mDecodeCallback->Error();
+  }
+  mIsFlushing = false;
+  lock.NotifyAll();
+}
+
+void
+GonkDecoderManager::ProcessToDo(bool aEndOfStream)
+{
+  MOZ_ASSERT(mToDo.get() != nullptr);
+  mToDo.clear();
+
+  if (HasQueuedSample()) {
+    status_t pendingInput = ProcessQueuedSamples();
+    if (pendingInput < 0) {
+      mDecodeCallback->Error();
+      return;
+    }
+    if (!aEndOfStream && pendingInput <= MIN_QUEUED_SAMPLES) {
+      mDecodeCallback->InputExhausted();
+    }
+  }
+
+  nsresult rv = NS_OK;
+  while (mWaitOutput.Length() > 0) {
+    nsRefPtr<MediaData> output;
+    int64_t offset = mWaitOutput.ElementAt(0);
+    rv = Output(offset, output);
+    if (rv == NS_OK) {
+      mWaitOutput.RemoveElementAt(0);
+      mDecodeCallback->Output(output);
+    } else if (rv == NS_ERROR_ABORT) {
+      GMDD_LOG("eos output");
+      mWaitOutput.RemoveElementAt(0);
+      MOZ_ASSERT(mQueuedSamples.IsEmpty());
+      MOZ_ASSERT(mWaitOutput.IsEmpty());
+      // EOS
+      if (output) {
+        mDecodeCallback->Output(output);
+      }
+      mDecodeCallback->DrainComplete();
+      return;
+    } else if (rv == NS_ERROR_NOT_AVAILABLE) {
+      break;
+    } else {
+      mDecodeCallback->Error();
+      return;
+    }
+  }
+
+  if (HasQueuedSample() || mWaitOutput.Length() > 0) {
+    mToDo = new AMessage(kNotifyDecoderActivity, id());
+    mDecoder->requestActivityNotification(mToDo);
+  }
+}
+
+void
+GonkDecoderManager::onMessageReceived(const sp<AMessage> &aMessage)
+{
+  switch (aMessage->what()) {
+    case kNotifyProcessInput:
+    {
+      int32_t eos = 0;
+      ProcessInput(aMessage->findInt32("input-eos", &eos) && eos);
+      break;
+    }
+    case kNotifyProcessFlush:
+    {
+      ProcessFlush();
+      break;
+    }
+    case kNotifyDecoderActivity:
+    {
+      int32_t eos = 0;
+      ProcessToDo(aMessage->findInt32("input-eos", &eos) && eos);
+      break;
+    }
+    default:
+      {
+        TRESPASS();
+        break;
+      }
+  }
+}
+
 GonkMediaDataDecoder::GonkMediaDataDecoder(GonkDecoderManager* aManager,
                                            FlushableTaskQueue* aTaskQueue,
                                            MediaDataDecoderCallback* aCallback)
   : mTaskQueue(aTaskQueue)
-  , mCallback(aCallback)
   , mManager(aManager)
-  , mSignaledEOS(false)
-  , mDrainComplete(false)
 {
   MOZ_COUNT_CTOR(GonkMediaDataDecoder);
+  mManager->SetDecodeCallback(aCallback);
 }
 
 GonkMediaDataDecoder::~GonkMediaDataDecoder()
 {
   MOZ_COUNT_DTOR(GonkMediaDataDecoder);
 }
 
 nsRefPtr<MediaDataDecoder::InitPromise>
 GonkMediaDataDecoder::Init()
 {
-  mDrainComplete = false;
-
-  return mManager->Init(mCallback);
+  return mManager->Init();
 }
 
 nsresult
 GonkMediaDataDecoder::Shutdown()
 {
   nsresult rv = mManager->Shutdown();
 
   // Because codec allocated runnable and init promise is at reader TaskQueue,
@@ -68,112 +286,31 @@ GonkMediaDataDecoder::Shutdown()
   mManager = nullptr;
   return rv;
 }
 
 // Inserts data into the decoder's pipeline.
 nsresult
 GonkMediaDataDecoder::Input(MediaRawData* aSample)
 {
-  nsCOMPtr<nsIRunnable> runnable(
-    NS_NewRunnableMethodWithArg<nsRefPtr<MediaRawData>>(
-      this,
-      &GonkMediaDataDecoder::ProcessDecode,
-      nsRefPtr<MediaRawData>(aSample)));
-  mTaskQueue->Dispatch(runnable.forget());
+  mManager->Input(aSample);
   return NS_OK;
 }
 
-void
-GonkMediaDataDecoder::ProcessDecode(MediaRawData* aSample)
-{
-  nsresult rv = mManager->Input(aSample);
-  if (rv != NS_OK) {
-    NS_WARNING("GonkMediaDataDecoder failed to input data");
-    GMDD_LOG("Failed to input data err: %d",int(rv));
-    mCallback->Error();
-    return;
-  }
-  if (aSample) {
-    mLastStreamOffset = aSample->mOffset;
-  }
-  ProcessOutput();
-}
-
-void
-GonkMediaDataDecoder::ProcessOutput()
-{
-  nsRefPtr<MediaData> output;
-  nsresult rv = NS_ERROR_ABORT;
-
-  while (!mDrainComplete) {
-    // There are samples in queue, try to send them into decoder when EOS.
-    if (mSignaledEOS && mManager->HasQueuedSample()) {
-      GMDD_LOG("ProcessOutput: drain all input samples");
-      rv = mManager->Input(nullptr);
-    }
-    rv = mManager->Output(mLastStreamOffset, output);
-    if (rv == NS_OK) {
-      mCallback->Output(output);
-      continue;
-    } else if (rv == NS_ERROR_NOT_AVAILABLE && mSignaledEOS) {
-      // Try to get more frames before getting EOS frame
-      continue;
-    }
-    else {
-      break;
-    }
-  }
-
-  if (rv == NS_ERROR_NOT_AVAILABLE && !mSignaledEOS) {
-    mCallback->InputExhausted();
-    return;
-  }
-  if (rv != NS_OK) {
-    NS_WARNING("GonkMediaDataDecoder failed to output data");
-    GMDD_LOG("Failed to output data");
-    // GonkDecoderManangers report NS_ERROR_ABORT when EOS is reached.
-    if (rv == NS_ERROR_ABORT) {
-      if (output) {
-        mCallback->Output(output);
-      }
-      mCallback->DrainComplete();
-      MOZ_ASSERT_IF(mSignaledEOS, !mManager->HasQueuedSample());
-      mSignaledEOS = false;
-      mDrainComplete = true;
-      return;
-    }
-    GMDD_LOG("Callback error!");
-    mCallback->Error();
-  }
-}
-
 nsresult
 GonkMediaDataDecoder::Flush()
 {
   // Flush the input task queue. This cancels all pending Decode() calls.
   // Note this blocks until the task queue finishes its current job, if
   // it's executing at all. Note the MP4Reader ignores all output while
   // flushing.
   mTaskQueue->Flush();
-  mDrainComplete = false;
   return mManager->Flush();
 }
 
-void
-GonkMediaDataDecoder::ProcessDrain()
-{
-  // Notify decoder input EOS by sending a null data.
-  ProcessDecode(nullptr);
-  mSignaledEOS = true;
-  ProcessOutput();
-}
-
 nsresult
 GonkMediaDataDecoder::Drain()
 {
-  nsCOMPtr<nsIRunnable> runnable =
-    NS_NewRunnableMethod(this, &GonkMediaDataDecoder::ProcessDrain);
-  mTaskQueue->Dispatch(runnable.forget());
+  mManager->Input(nullptr);
   return NS_OK;
 }
 
 } // namespace mozilla

--- a/dom/media/platforms/gonk/GonkMediaDataDecoder.h
+++ b/dom/media/platforms/gonk/GonkMediaDataDecoder.h
@@ -2,66 +2,128 @@
 /* vim:set ts=2 sw=2 sts=2 et cindent: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #if !defined(GonkMediaDataDecoder_h_)
 #define GonkMediaDataDecoder_h_
 #include "PlatformDecoderModule.h"
+#include <stagefright/foundation/AHandler.h>
 
 namespace android {
+struct ALooper;
 class MediaCodecProxy;
 } // namespace android
 
 namespace mozilla {
 class MediaRawData;
 
 // Manage the data flow from inputting encoded data and outputting decode data.
-class GonkDecoderManager {
+class GonkDecoderManager : public android::AHandler {
 public:
   typedef TrackInfo::TrackType TrackType;
   typedef MediaDataDecoder::InitPromise InitPromise;
   typedef MediaDataDecoder::DecoderFailureReason DecoderFailureReason;
 
   virtual ~GonkDecoderManager() {}
 
-  virtual nsRefPtr<InitPromise> Init(MediaDataDecoderCallback* aCallback) = 0;
-
-  // Add samples into OMX decoder or queue them if decoder is out of input buffer.
-  virtual nsresult Input(MediaRawData* aSample) = 0;
+  virtual nsRefPtr<InitPromise> Init() = 0;
 
-  // Produces decoded output, it blocks until output can be produced or a timeout
-  // is expired or until EOS. Returns NS_OK on success, or NS_ERROR_NOT_AVAILABLE
-  // if there's not enough data to produce more output. If this returns a failure
-  // code other than NS_ERROR_NOT_AVAILABLE, an error will be reported to the
-  // MP4Reader.
-  // The overrided class should follow the same behaviour.
-  virtual nsresult Output(int64_t aStreamOffset,
-                          nsRefPtr<MediaData>& aOutput) = 0;
+  // Asynchronously send sample into mDecoder. If out of input buffer, aSample
+  // will be queued for later re-send.
+  nsresult Input(MediaRawData* aSample);
 
   // Flush the queued sample.
-  virtual nsresult Flush() = 0;
+  nsresult Flush();
 
   // Shutdown decoder and rejects the init promise.
   nsresult Shutdown();
 
   // True if sample is queued.
-  virtual bool HasQueuedSample() = 0;
+  bool HasQueuedSample();
+
+  // Set callback for decoder events, such as requesting more input,
+  // returning output, or reporting error.
+  void SetDecodeCallback(MediaDataDecoderCallback* aCallback)
+  {
+    mDecodeCallback = aCallback;
+  }
 
 protected:
+  GonkDecoderManager()
+    : mMutex("GonkDecoderManager")
+    , mLastTime(0)
+    , mFlushMonitor("GonkDecoderManager::Flush")
+    , mIsFlushing(false)
+    , mDecodeCallback(nullptr)
+  {}
+
+  bool InitLoopers(MediaData::Type aType);
+
+  void onMessageReceived(const android::sp<android::AMessage> &aMessage) override;
+
+  // Produces decoded output. It returns NS_OK on success, or NS_ERROR_NOT_AVAILABLE
+  // when output is not produced yet.
+  // If this returns a failure code other than NS_ERROR_NOT_AVAILABLE, an error
+  // will be reported through mDecodeCallback.
+  virtual nsresult Output(int64_t aStreamOffset,
+                          nsRefPtr<MediaData>& aOutput) = 0;
+
+  // Send queued samples to OMX. It returns how many samples are still in
+  // queue after processing, or negtive error code if failed.
+  int32_t ProcessQueuedSamples();
+
+  void ProcessInput(bool aEndOfStream);
+  void ProcessFlush();
+  void ProcessToDo(bool aEndOfStream);
+
   nsRefPtr<MediaByteBuffer> mCodecSpecificData;
 
   nsAutoCString mMimeType;
 
   // MediaCodedc's wrapper that performs the decoding.
   android::sp<android::MediaCodecProxy> mDecoder;
+  // Looper for mDecoder to run on.
+  android::sp<android::ALooper> mDecodeLooper;
+  // Looper to run decode tasks such as processing input, output, flush, and
+  // recycling output buffers.
+  android::sp<android::ALooper> mTaskLooper;
+  enum {
+    // Decoder will send this to indicate internal state change such as input or
+    // output buffers availability. Used to run pending input & output tasks.
+    kNotifyDecoderActivity = 'nda ',
+    // Signal the decoder to flush.
+    kNotifyProcessFlush = 'npf ',
+    // Used to process queued samples when there is new input.
+    kNotifyProcessInput = 'npi ',
+  };
 
   MozPromiseHolder<InitPromise> mInitPromise;
 
+  Mutex mMutex; // Protects mQueuedSamples.
+  // A queue that stores the samples waiting to be sent to mDecoder.
+  // Empty element means EOS and there shouldn't be any sample be queued after it.
+  // Samples are queued in caller's thread and dequeued in mTaskLooper.
+  nsTArray<nsRefPtr<MediaRawData>> mQueuedSamples;
+
+  int64_t mLastTime;  // The last decoded frame presentation time.
+
+  Monitor mFlushMonitor; // Waits for flushing to complete.
+  bool mIsFlushing;
+
+  // Remembers the notification that is currently waiting for the decoder event
+  // to avoid requesting more than one notification at the time, which is
+  // forbidden by mDecoder.
+  android::sp<android::AMessage> mToDo;
+
+  // Stores the offset of every output that needs to be read from mDecoder.
+  nsTArray<int64_t> mWaitOutput;
+
+  MediaDataDecoderCallback* mDecodeCallback; // Reports decoder output or error.
 };
 
 // Samples are decoded using the GonkDecoder (MediaCodec)
 // created by the GonkDecoderManager. This class implements
 // the higher-level logic that drives mapping the Gonk to the async
 // MediaDataDecoder interface. The specifics of decoding the exact stream
 // type are handled by GonkDecoderManager and the GonkDecoder it creates.
 class GonkMediaDataDecoder : public MediaDataDecoder {
@@ -78,40 +140,16 @@ public:
 
   nsresult Flush() override;
 
   nsresult Drain() override;
 
   nsresult Shutdown() override;
 
 private:
-
-  // Called on the task queue. Inserts the sample into the decoder, and
-  // extracts output if available, if aSample is null, it means there is
-  // no data from source, it will notify the decoder EOS and flush all the
-  // decoded frames.
-  void ProcessDecode(MediaRawData* aSample);
-
-  // Called on the task queue. Extracts output if available, and delivers
-  // it to the reader. Called after ProcessDecode() and ProcessDrain().
-  void ProcessOutput();
+  RefPtr<FlushableTaskQueue> mTaskQueue;
 
-  // Called on the task queue. Orders the Gonk to drain, and then extracts
-  // all available output.
-  void ProcessDrain();
-
-  RefPtr<FlushableTaskQueue> mTaskQueue;
-  MediaDataDecoderCallback* mCallback;
-
-  nsAutoPtr<GonkDecoderManager> mManager;
-
-  // The last offset into the media resource that was passed into Input().
-  // This is used to approximate the decoder's position in the media resource.
-  int64_t mLastStreamOffset;
-  // Set it ture when there is no input data
-  bool mSignaledEOS;
-  // Set if there is no more output data from decoder
-  bool mDrainComplete;
+  android::sp<GonkDecoderManager> mManager;
 };
 
 } // namespace mozilla
 
 #endif // GonkMediaDataDecoder_h_

--- a/dom/media/platforms/gonk/GonkVideoDecoderManager.cpp
+++ b/dom/media/platforms/gonk/GonkVideoDecoderManager.cpp
@@ -12,76 +12,70 @@
 #include "ImageContainer.h"
 #include "VideoUtils.h"
 #include "nsThreadUtils.h"
 #include "Layers.h"
 #include "mozilla/Logging.h"
 #include "stagefright/MediaBuffer.h"
 #include "stagefright/MetaData.h"
 #include "stagefright/MediaErrors.h"
-#include <stagefright/foundation/ADebug.h>
-#include <stagefright/foundation/AMessage.h>
 #include <stagefright/foundation/AString.h>
-#include <stagefright/foundation/ALooper.h>
 #include "GonkNativeWindow.h"
 #include "GonkNativeWindowClient.h"
 #include "mozilla/layers/GrallocTextureClient.h"
 #include "mozilla/layers/TextureClient.h"
 #include <cutils/properties.h>
 
-#define READ_OUTPUT_BUFFER_TIMEOUT_US  3000
+#define CODECCONFIG_TIMEOUT_US 10000LL
+#define READ_OUTPUT_BUFFER_TIMEOUT_US  0LL
 
 #include <android/log.h>
 #define GVDM_LOG(...) __android_log_print(ANDROID_LOG_DEBUG, "GonkVideoDecoderManager", __VA_ARGS__)
 
 extern PRLogModuleInfo* GetPDMLog();
 #define LOG(...) MOZ_LOG(GetPDMLog(), mozilla::LogLevel::Debug, (__VA_ARGS__))
 using namespace mozilla::layers;
 using namespace android;
 typedef android::MediaCodecProxy MediaCodecProxy;
 
 namespace mozilla {
 
 GonkVideoDecoderManager::GonkVideoDecoderManager(
   mozilla::layers::ImageContainer* aImageContainer,
   const VideoInfo& aConfig)
   : mImageContainer(aImageContainer)
-  , mReaderCallback(nullptr)
-  , mLastDecodedTime(0)
   , mColorConverterBufferSize(0)
   , mNativeWindow(nullptr)
   , mPendingReleaseItemsLock("GonkVideoDecoderManager::mPendingReleaseItemsLock")
-  , mMonitor("GonkVideoDecoderManager")
 {
   MOZ_COUNT_CTOR(GonkVideoDecoderManager);
   mMimeType = aConfig.mMimeType;
   mVideoWidth  = aConfig.mDisplay.width;
   mVideoHeight = aConfig.mDisplay.height;
   mDisplayWidth = aConfig.mDisplay.width;
   mDisplayHeight = aConfig.mDisplay.height;
   mInfo.mVideo = aConfig;
 
   mCodecSpecificData = aConfig.mCodecSpecificConfig;
   nsIntRect pictureRect(0, 0, mVideoWidth, mVideoHeight);
   nsIntSize frameSize(mVideoWidth, mVideoHeight);
   mPicture = pictureRect;
   mInitialFrame = frameSize;
-  mHandler = new MessageHandler(this);
   mVideoListener = new VideoResourceListener(this);
 
 }
 
 GonkVideoDecoderManager::~GonkVideoDecoderManager()
 {
   mVideoListener->NotifyManagerRelease();
   MOZ_COUNT_DTOR(GonkVideoDecoderManager);
 }
 
 nsRefPtr<MediaDataDecoder::InitPromise>
-GonkVideoDecoderManager::Init(MediaDataDecoderCallback* aCallback)
+GonkVideoDecoderManager::Init()
 {
   nsIntSize displaySize(mDisplayWidth, mDisplayHeight);
   nsIntRect pictureRect(0, 0, mVideoWidth, mVideoHeight);
 
   uint32_t maxWidth, maxHeight;
   char propValue[PROPERTY_VALUE_MAX];
   property_get("ro.moz.omx.hw.max_width", propValue, "-1");
   maxWidth = -1 == atoi(propValue) ? MAX_VIDEO_WIDTH : atoi(propValue);
@@ -96,94 +90,41 @@ GonkVideoDecoderManager::Init(MediaDataD
   // Validate the container-reported frame and pictureRect sizes. This ensures
   // that our video frame creation code doesn't overflow.
   nsIntSize frameSize(mVideoWidth, mVideoHeight);
   if (!IsValidVideoRegion(frameSize, pictureRect, displaySize)) {
     GVDM_LOG("It is not a valid region");
     return InitPromise::CreateAndReject(DecoderFailureReason::INIT_ERROR, __func__);
   }
 
-  mReaderCallback = aCallback;
-
   mReaderTaskQueue = AbstractThread::GetCurrent()->AsTaskQueue();
   MOZ_ASSERT(mReaderTaskQueue);
 
-  if (mLooper.get() != nullptr) {
+  if (mDecodeLooper.get() != nullptr) {
     return InitPromise::CreateAndReject(DecoderFailureReason::INIT_ERROR, __func__);
   }
-  // Create ALooper
-  mLooper = new ALooper;
-  mManagerLooper = new ALooper;
-  mManagerLooper->setName("GonkVideoDecoderManager");
-  // Register AMessage handler to ALooper.
-  mManagerLooper->registerHandler(mHandler);
-  // Start ALooper thread.
-  if (mLooper->start() != OK || mManagerLooper->start() != OK ) {
+
+  if (!InitLoopers(MediaData::VIDEO_DATA)) {
     return InitPromise::CreateAndReject(DecoderFailureReason::INIT_ERROR, __func__);
   }
+
   nsRefPtr<InitPromise> p = mInitPromise.Ensure(__func__);
-  mDecoder = MediaCodecProxy::CreateByType(mLooper, mMimeType.get(), false, mVideoListener);
+  mDecoder = MediaCodecProxy::CreateByType(mDecodeLooper, mMimeType.get(), false, mVideoListener);
   mDecoder->AsyncAskMediaCodec();
 
   uint32_t capability = MediaCodecProxy::kEmptyCapability;
   if (mDecoder->getCapability(&capability) == OK && (capability &
       MediaCodecProxy::kCanExposeGraphicBuffer)) {
     mNativeWindow = new GonkNativeWindow();
   }
 
   return p;
 }
 
 nsresult
-GonkVideoDecoderManager::Input(MediaRawData* aSample)
-{
-  MonitorAutoLock mon(mMonitor);
-  nsRefPtr<MediaRawData> sample;
-
-  if (!aSample) {
-    // It means EOS with empty sample.
-    sample = new MediaRawData();
-  } else {
-    sample = aSample;
-  }
-
-  mQueueSample.AppendElement(sample);
-
-  status_t rv;
-  while (mQueueSample.Length()) {
-    nsRefPtr<MediaRawData> data = mQueueSample.ElementAt(0);
-    {
-      MonitorAutoUnlock mon_unlock(mMonitor);
-      rv = mDecoder->Input(reinterpret_cast<const uint8_t*>(data->Data()),
-                           data->Size(),
-                           data->mTime,
-                           0);
-    }
-    if (rv == OK) {
-      mQueueSample.RemoveElementAt(0);
-    } else if (rv == -EAGAIN || rv == -ETIMEDOUT) {
-      // In most cases, EAGAIN or ETIMEOUT are safe because OMX can't fill
-      // buffer on time.
-      return NS_OK;
-    } else {
-      return NS_ERROR_UNEXPECTED;
-    }
-  }
-
-  return NS_OK;
-}
-
-bool
-GonkVideoDecoderManager::HasQueuedSample()
-{
-    MonitorAutoLock mon(mMonitor);
-    return mQueueSample.Length();
-}
-
-nsresult
 GonkVideoDecoderManager::CreateVideoData(int64_t aStreamOffset, VideoData **v)
 {
   *v = nullptr;
   nsRefPtr<VideoData> data;
   int64_t timeUs;
   int32_t keyFrame;
 
   if (mVideoBuffer == nullptr) {
@@ -192,22 +133,22 @@ GonkVideoDecoderManager::CreateVideoData
   }
 
   if (!mVideoBuffer->meta_data()->findInt64(kKeyTime, &timeUs)) {
     ReleaseVideoBuffer();
     GVDM_LOG("Decoder did not return frame time");
     return NS_ERROR_UNEXPECTED;
   }
 
-  if (mLastDecodedTime > timeUs) {
+  if (mLastTime > timeUs) {
     ReleaseVideoBuffer();
     GVDM_LOG("Output decoded sample time is revert. time=%lld", timeUs);
     return NS_ERROR_NOT_AVAILABLE;
   }
-  mLastDecodedTime = timeUs;
+  mLastTime = timeUs;
 
   if (mVideoBuffer->range_length() == 0) {
     // Some decoders may return spurious empty buffers that we just want to ignore
     // quoted from Android's AwesomePlayer.cpp
     ReleaseVideoBuffer();
     return NS_ERROR_NOT_AVAILABLE;
   }
 
@@ -362,37 +303,16 @@ GonkVideoDecoderManager::SetVideoFormat(
       return false;
     }
     return true;
   }
   GVDM_LOG("Fail to get output format");
   return false;
 }
 
-nsresult
-GonkVideoDecoderManager::Flush()
-{
-  if (mDecoder == nullptr) {
-    GVDM_LOG("Decoder is not inited");
-    return NS_ERROR_UNEXPECTED;
-  }
-  {
-    MonitorAutoLock mon(mMonitor);
-    mQueueSample.Clear();
-  }
-
- mLastDecodedTime = 0;
-
-  if (mDecoder->flush() != OK) {
-    return NS_ERROR_FAILURE;
-  }
-
-  return NS_OK;
-}
-
 // Blocks until decoded sample is produced by the deoder.
 nsresult
 GonkVideoDecoderManager::Output(int64_t aStreamOffset,
                                 nsRefPtr<MediaData>& aOutData)
 {
   aOutData = nullptr;
   status_t err;
   if (mDecoder == nullptr) {
@@ -492,17 +412,18 @@ GonkVideoDecoderManager::codecReserved()
     surface = new Surface(mNativeWindow->getBufferQueue());
   }
   mDecoder->configure(format, surface, nullptr, 0);
   mDecoder->Prepare();
 
   if (mMimeType.EqualsLiteral("video/mp4v-es")) {
     rv = mDecoder->Input(mCodecSpecificData->Elements(),
                          mCodecSpecificData->Length(), 0,
-                         android::MediaCodec::BUFFER_FLAG_CODECCONFIG);
+                         android::MediaCodec::BUFFER_FLAG_CODECCONFIG,
+                         CODECCONFIG_TIMEOUT_US);
   }
 
   if (rv != OK) {
     GVDM_LOG("Failed to configure codec!!!!");
     mInitPromise.Reject(DecoderFailureReason::INIT_ERROR, __func__);
     return;
   }
 
@@ -511,48 +432,32 @@ GonkVideoDecoderManager::codecReserved()
 
 void
 GonkVideoDecoderManager::codecCanceled()
 {
   GVDM_LOG("codecCanceled");
   mInitPromise.RejectIfExists(DecoderFailureReason::CANCELED, __func__);
 }
 
-// Called on GonkVideoDecoderManager::mManagerLooper thread.
+// Called on GonkDecoderManager::mTaskLooper thread.
 void
 GonkVideoDecoderManager::onMessageReceived(const sp<AMessage> &aMessage)
 {
   switch (aMessage->what()) {
     case kNotifyPostReleaseBuffer:
     {
       ReleaseAllPendingVideoBuffers();
       break;
     }
 
     default:
-      TRESPASS();
+    {
+      GonkDecoderManager::onMessageReceived(aMessage);
       break;
-  }
-}
-
-GonkVideoDecoderManager::MessageHandler::MessageHandler(GonkVideoDecoderManager *aManager)
-  : mManager(aManager)
-{
-}
-
-GonkVideoDecoderManager::MessageHandler::~MessageHandler()
-{
-  mManager = nullptr;
-}
-
-void
-GonkVideoDecoderManager::MessageHandler::onMessageReceived(const android::sp<android::AMessage> &aMessage)
-{
-  if (mManager != nullptr) {
-    mManager->onMessageReceived(aMessage);
+    }
   }
 }
 
 GonkVideoDecoderManager::VideoResourceListener::VideoResourceListener(GonkVideoDecoderManager *aManager)
   : mManager(aManager)
 {
 }
 
@@ -647,17 +552,17 @@ void GonkVideoDecoderManager::PostReleas
 {
   {
     MutexAutoLock autoLock(mPendingReleaseItemsLock);
     if (aBuffer) {
       mPendingReleaseItems.AppendElement(ReleaseItem(aBuffer, aReleaseFence));
     }
   }
   sp<AMessage> notify =
-            new AMessage(kNotifyPostReleaseBuffer, mHandler->id());
+            new AMessage(kNotifyPostReleaseBuffer, id());
   notify->post();
 
 }
 
 void GonkVideoDecoderManager::ReleaseAllPendingVideoBuffers()
 {
   nsTArray<ReleaseItem> releasingItems;
   {

--- a/dom/media/platforms/gonk/GonkVideoDecoderManager.h
+++ b/dom/media/platforms/gonk/GonkVideoDecoderManager.h
@@ -2,32 +2,29 @@
 /* vim:set ts=2 sw=2 sts=2 et cindent: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #if !defined(GonkVideoDecoderManager_h_)
 #define GonkVideoDecoderManager_h_
 
-#include <set>
 #include "nsRect.h"
 #include "GonkMediaDataDecoder.h"
 #include "mozilla/RefPtr.h"
 #include "I420ColorConverterHelper.h"
 #include "MediaCodecProxy.h"
-#include <stagefright/foundation/AHandler.h>
 #include "GonkNativeWindow.h"
 #include "GonkNativeWindowClient.h"
 #include "mozilla/layers/FenceUtils.h"
 #include <ui/Fence.h>
 
 using namespace android;
 
 namespace android {
-struct ALooper;
 class MediaBuffer;
 struct MOZ_EXPORT AString;
 class GonkNativeWindow;
 } // namespace android
 
 namespace mozilla {
 
 namespace layers {
@@ -37,61 +34,40 @@ class TextureClient;
 class GonkVideoDecoderManager : public GonkDecoderManager {
 typedef android::MediaCodecProxy MediaCodecProxy;
 typedef mozilla::layers::TextureClient TextureClient;
 
 public:
   GonkVideoDecoderManager(mozilla::layers::ImageContainer* aImageContainer,
                           const VideoInfo& aConfig);
 
-  virtual ~GonkVideoDecoderManager() override;
+  virtual ~GonkVideoDecoderManager();
 
-  nsRefPtr<InitPromise> Init(MediaDataDecoderCallback* aCallback) override;
-
-  nsresult Input(MediaRawData* aSample) override;
+  nsRefPtr<InitPromise> Init() override;
 
   nsresult Output(int64_t aStreamOffset,
                           nsRefPtr<MediaData>& aOutput) override;
 
-  nsresult Flush() override;
-
-  bool HasQueuedSample() override;
-
   static void RecycleCallback(TextureClient* aClient, void* aClosure);
 
 private:
   struct FrameInfo
   {
     int32_t mWidth = 0;
     int32_t mHeight = 0;
     int32_t mStride = 0;
     int32_t mSliceHeight = 0;
     int32_t mColorFormat = 0;
     int32_t mCropLeft = 0;
     int32_t mCropTop = 0;
     int32_t mCropRight = 0;
     int32_t mCropBottom = 0;
   };
-  class MessageHandler : public android::AHandler
-  {
-  public:
-    MessageHandler(GonkVideoDecoderManager *aManager);
-    ~MessageHandler();
 
-    void onMessageReceived(const android::sp<android::AMessage> &aMessage) override;
-
-  private:
-    // Forbidden
-    MessageHandler() = delete;
-    MessageHandler(const MessageHandler &rhs) = delete;
-    const MessageHandler &operator=(const MessageHandler &rhs) = delete;
-
-    GonkVideoDecoderManager *mManager;
-  };
-  friend class MessageHandler;
+  void onMessageReceived(const android::sp<android::AMessage> &aMessage) override;
 
   class VideoResourceListener : public android::MediaCodecProxy::CodecResourceListener
   {
   public:
     VideoResourceListener(GonkVideoDecoderManager *aManager);
     ~VideoResourceListener();
 
     void codecReserved() override;
@@ -114,43 +90,36 @@ private:
 
   nsresult CreateVideoData(int64_t aStreamOffset, VideoData** aOutData);
   void ReleaseVideoBuffer();
   uint8_t* GetColorConverterBuffer(int32_t aWidth, int32_t aHeight);
 
   // For codec resource management
   void codecReserved();
   void codecCanceled();
-  void onMessageReceived(const sp<AMessage> &aMessage);
 
   void ReleaseAllPendingVideoBuffers();
   void PostReleaseVideoBuffer(android::MediaBuffer *aBuffer,
                               layers::FenceHandle mReleaseFence);
 
   uint32_t mVideoWidth;
   uint32_t mVideoHeight;
   uint32_t mDisplayWidth;
   uint32_t mDisplayHeight;
   nsIntRect mPicture;
   nsIntSize mInitialFrame;
 
   nsRefPtr<layers::ImageContainer> mImageContainer;
 
   android::MediaBuffer* mVideoBuffer;
 
-  MediaDataDecoderCallback*  mReaderCallback;
   MediaInfo mInfo;
   android::sp<VideoResourceListener> mVideoListener;
-  android::sp<MessageHandler> mHandler;
-  android::sp<ALooper> mLooper;
-  android::sp<ALooper> mManagerLooper;
   FrameInfo mFrameInfo;
 
-  int64_t mLastDecodedTime;  // The last decoded frame presentation time.
-
   // color converter
   android::I420ColorConverterHelper mColorConverter;
   nsAutoArrayPtr<uint8_t> mColorConverterBuffer;
   size_t mColorConverterBufferSize;
 
   android::sp<android::GonkNativeWindow> mNativeWindow;
   enum {
     kNotifyPostReleaseBuffer = 'nprb',
@@ -163,24 +132,16 @@ private:
     android::MediaBuffer* mBuffer;
     layers::FenceHandle mReleaseFence;
   };
   nsTArray<ReleaseItem> mPendingReleaseItems;
 
   // The lock protects mPendingReleaseItems.
   Mutex mPendingReleaseItemsLock;
 
-  // This monitor protects mQueueSample.
-  Monitor mMonitor;
-
-  // This TaskQueue should be the same one in mReaderCallback->OnReaderTaskQueue().
+  // This TaskQueue should be the same one in mDecodeCallback->OnReaderTaskQueue().
   // It is for codec resource mangement, decoding task should not dispatch to it.
   nsRefPtr<TaskQueue> mReaderTaskQueue;
-
-  // An queue with the MP4 samples which are waiting to be sent into OMX.
-  // If an element is an empty MP4Sample, that menas EOS. There should not
-  // any sample be queued after EOS.
-  nsTArray<nsRefPtr<MediaRawData>> mQueueSample;
 };
 
 } // namespace mozilla
 
 #endif // GonkVideoDecoderManager_h_

--- a/dom/media/webaudio/WaveShaperNode.cpp
+++ b/dom/media/webaudio/WaveShaperNode.cpp
@@ -225,36 +225,44 @@ public:
       // Optimize the case where we don't have a curve buffer,
       // or the input is null.
       *aOutput = aInput;
       return;
     }
 
     aOutput->AllocateChannels(channelCount);
     for (uint32_t i = 0; i < channelCount; ++i) {
-      float* scaledSample = (float *)(aInput.mChannelData[i]);
-      AudioBlockInPlaceScale(scaledSample, aInput.mVolume);
-      const float* inputBuffer = static_cast<const float*>(scaledSample);
+      const float* inputSamples;
+      float scaledInput[WEBAUDIO_BLOCK_SIZE];
+      if (aInput.mVolume != 1.0f) {
+        AudioBlockCopyChannelWithScale(
+            static_cast<const float*>(aInput.mChannelData[i]),
+                                      aInput.mVolume,
+                                      scaledInput);
+        inputSamples = scaledInput;
+      } else {
+        inputSamples = static_cast<const float*>(aInput.mChannelData[i]);
+      }
       float* outputBuffer = aOutput->ChannelFloatsForWrite(i);
       float* sampleBuffer;
 
       switch (mType) {
       case OverSampleType::None:
         mResampler.Reset(channelCount, aStream->SampleRate(), OverSampleType::None);
-        ProcessCurve<1>(inputBuffer, outputBuffer);
+        ProcessCurve<1>(inputSamples, outputBuffer);
         break;
       case OverSampleType::_2x:
         mResampler.Reset(channelCount, aStream->SampleRate(), OverSampleType::_2x);
-        sampleBuffer = mResampler.UpSample(i, inputBuffer, 2);
+        sampleBuffer = mResampler.UpSample(i, inputSamples, 2);
         ProcessCurve<2>(sampleBuffer, sampleBuffer);
         mResampler.DownSample(i, outputBuffer, 2);
         break;
       case OverSampleType::_4x:
         mResampler.Reset(channelCount, aStream->SampleRate(), OverSampleType::_4x);
-        sampleBuffer = mResampler.UpSample(i, inputBuffer, 4);
+        sampleBuffer = mResampler.UpSample(i, inputSamples, 4);
         ProcessCurve<4>(sampleBuffer, sampleBuffer);
         mResampler.DownSample(i, outputBuffer, 4);
         break;
       default:
         NS_NOTREACHED("We should never reach here");
       }
     }
   }

--- a/dom/media/webaudio/test/mochitest.ini
+++ b/dom/media/webaudio/test/mochitest.ini
@@ -167,11 +167,12 @@ skip-if = (toolkit == 'gonk' && !debug) 
 [test_scriptProcessorNodePassThrough.html]
 [test_scriptProcessorNode_playbackTime1.html]
 [test_scriptProcessorNodeZeroInputOutput.html]
 [test_scriptProcessorNodeNotConnected.html]
 [test_singleSourceDest.html]
 [test_stereoPanningWithGain.html]
 [test_waveDecoder.html]
 [test_waveShaper.html]
+[test_waveShaperGain.html]
 [test_waveShaperNoCurve.html]
 [test_waveShaperPassThrough.html]
 [test_waveShaperInvalidLengthCurve.html]

new file mode 100644
--- /dev/null
+++ b/dom/media/webaudio/test/test_waveShaperGain.html
@@ -0,0 +1,51 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<meta charset="utf-8">
+  <title>Test that WaveShaperNode doesn't corrupt its inputs when the gain is !=
+    1.0 (bug 1203616)</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<script class="testbody" type="text/javascript">
+SimpleTest.waitForExplicitFinish();
+var samplerate = 44100;
+var context = new OfflineAudioContext(1, 44100, samplerate);
+
+var dc = context.createBufferSource();
+
+var buffer = context.createBuffer(1, 1, samplerate);
+buffer.getChannelData(0)[0] = 1.0;
+dc.buffer = buffer;
+
+var gain = context.createGain();
+var ws2 = context.createWaveShaper();
+var ws = [];
+
+// No-op waveshaper curves.
+for (var i = 0; i < 2; i++) {
+  ws[i] = context.createWaveShaper();
+  var curve = new Float32Array(2);
+  curve[0] = -1.0;
+  curve[1] = 1.0;
+  ws[i].curve = curve;
+  ws[i].connect(context.destination);
+  gain.connect(ws[i]);
+}
+
+dc.connect(gain);
+dc.start();
+
+gain.gain.value = 0.5;
+
+context.startRendering().then(buffer => {
+  document.querySelector("pre").innerHTML = buffer.getChannelData(0)[0];
+  ok(buffer.getChannelData(0)[0] == 1.0, "Volume was handled properly");
+  SimpleTest.finish();
+});
+</script>
+<pre>
+</pre>
+</body>
+

--- a/dom/media/webm/WebMDemuxer.cpp
+++ b/dom/media/webm/WebMDemuxer.cpp
@@ -457,19 +457,19 @@ WebMDemuxer::EnsureUpToDateIndex()
   if (!mIsMediaSource) {
     return;
   }
   mLastWebMBlockOffset = mBufferedState->GetLastBlockOffset();
   MOZ_ASSERT(mLastWebMBlockOffset <= mResource.GetLength());
 }
 
 void
-WebMDemuxer::NotifyDataArrived(uint32_t aLength, int64_t aOffset)
+WebMDemuxer::NotifyDataArrived()
 {
-  WEBM_DEBUG("length: %ld offset: %ld", aLength, aOffset);
+  WEBM_DEBUG("");
   mNeedReIndex = true;
 }
 
 void
 WebMDemuxer::NotifyDataRemoved()
 {
   mBufferedState->Reset();
   if (mInitData) {

--- a/dom/media/webm/WebMDemuxer.h
+++ b/dom/media/webm/WebMDemuxer.h
@@ -124,17 +124,17 @@ public:
 
 private:
   friend class WebMTrackDemuxer;
 
   ~WebMDemuxer();
   void Cleanup();
   void InitBufferedState();
   nsresult ReadMetadata();
-  void NotifyDataArrived(uint32_t aLength, int64_t aOffset) override;
+  void NotifyDataArrived() override;
   void NotifyDataRemoved() override;
   void EnsureUpToDateIndex();
   media::TimeIntervals GetBuffered();
   virtual nsresult SeekInternal(const media::TimeUnit& aTarget);
 
   // Read a packet from the nestegg file. Returns nullptr if all packets for
   // the particular track have been read. Pass TrackInfo::kVideoTrack or
   // TrackInfo::kVideoTrack to indicate the type of the packet we want to read.

--- a/dom/presentation/PresentationReceiver.cpp
+++ b/dom/presentation/PresentationReceiver.cpp
@@ -163,17 +163,17 @@ PresentationReceiver::NotifySessionConne
                                            const nsAString& aSessionId)
 {
   if (NS_WARN_IF(aWindowId != GetOwner()->WindowID())) {
     return NS_ERROR_INVALID_ARG;
   }
 
   nsRefPtr<PresentationSession> session =
     PresentationSession::Create(GetOwner(), aSessionId,
-                                PresentationSessionState::Disconnected);
+                                PresentationSessionState::Closed);
   if (NS_WARN_IF(!session)) {
     return NS_ERROR_NOT_AVAILABLE;
   }
   mSessions.AppendElement(session);
 
   // Resolve pending |GetSession| promises if any.
   if (!mPendingGetSessionPromises.IsEmpty()) {
     for(uint32_t i = 0; i < mPendingGetSessionPromises.Length(); i++) {

--- a/dom/presentation/PresentationService.cpp
+++ b/dom/presentation/PresentationService.cpp
@@ -424,27 +424,41 @@ PresentationService::SendSessionMessage(
   if (NS_WARN_IF(!info)) {
     return NS_ERROR_NOT_AVAILABLE;
   }
 
   return info->Send(aStream);
 }
 
 NS_IMETHODIMP
-PresentationService::Terminate(const nsAString& aSessionId)
+PresentationService::CloseSession(const nsAString& aSessionId)
 {
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(!aSessionId.IsEmpty());
 
   nsRefPtr<PresentationSessionInfo> info = GetSessionInfo(aSessionId);
   if (NS_WARN_IF(!info)) {
     return NS_ERROR_NOT_AVAILABLE;
   }
 
-  return info->Close(NS_OK);
+  return info->Close(NS_OK, nsIPresentationSessionListener::STATE_CLOSED);
+}
+
+NS_IMETHODIMP
+PresentationService::TerminateSession(const nsAString& aSessionId)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(!aSessionId.IsEmpty());
+
+  nsRefPtr<PresentationSessionInfo> info = GetSessionInfo(aSessionId);
+  if (NS_WARN_IF(!info)) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
+  return info->Close(NS_OK, nsIPresentationSessionListener::STATE_TERMINATED);
 }
 
 NS_IMETHODIMP
 PresentationService::RegisterAvailabilityListener(nsIPresentationAvailabilityListener* aListener)
 {
   MOZ_ASSERT(NS_IsMainThread());
 
   if (NS_WARN_IF(mAvailabilityListeners.Contains(aListener))) {
@@ -490,17 +504,17 @@ PresentationService::RegisterSessionList
 
 NS_IMETHODIMP
 PresentationService::UnregisterSessionListener(const nsAString& aSessionId)
 {
   MOZ_ASSERT(NS_IsMainThread());
 
   nsRefPtr<PresentationSessionInfo> info = GetSessionInfo(aSessionId);
   if (info) {
-    NS_WARN_IF(NS_FAILED(info->Close(NS_OK)));
+    NS_WARN_IF(NS_FAILED(info->Close(NS_OK, nsIPresentationSessionListener::STATE_TERMINATED)));
     UntrackSessionInfo(aSessionId);
     return info->SetListener(nullptr);
   }
   return NS_OK;
 }
 
 NS_IMETHODIMP
 PresentationService::RegisterRespondingListener(uint64_t aWindowId,

--- a/dom/presentation/PresentationSession.cpp
+++ b/dom/presentation/PresentationSession.cpp
@@ -137,58 +137,71 @@ PresentationSession::Send(const nsAStrin
   if(NS_WARN_IF(NS_FAILED(rv))) {
     aRv.Throw(NS_ERROR_DOM_INVALID_STATE_ERR);
     return;
   }
 
   nsCOMPtr<nsIPresentationService> service =
     do_GetService(PRESENTATION_SERVICE_CONTRACTID);
   if(NS_WARN_IF(!service)) {
-    aRv.Throw(NS_ERROR_DOM_INVALID_STATE_ERR);
+    aRv.Throw(NS_ERROR_DOM_OPERATION_ERR);
     return;
   }
 
   rv = service->SendSessionMessage(mId, stream);
   if(NS_WARN_IF(NS_FAILED(rv))) {
-    aRv.Throw(NS_ERROR_DOM_INVALID_STATE_ERR);
+    aRv.Throw(NS_ERROR_DOM_OPERATION_ERR);
   }
 }
 
 void
-PresentationSession::Close()
+PresentationSession::Close(ErrorResult& aRv)
 {
-  // Closing does nothing if the session is already terminated.
-  if (NS_WARN_IF(mState == PresentationSessionState::Terminated)) {
+  // It only works when the state is CONNECTED.
+  if (NS_WARN_IF(mState != PresentationSessionState::Connected)) {
+    return;
+  }
+
+  // TODO Bug 1210340 - Support close semantics.
+  aRv.Throw(NS_ERROR_NOT_IMPLEMENTED);
+}
+
+void
+PresentationSession::Terminate(ErrorResult& aRv)
+{
+  // It only works when the state is CONNECTED.
+  if (NS_WARN_IF(mState != PresentationSessionState::Connected)) {
     return;
   }
 
   nsCOMPtr<nsIPresentationService> service =
     do_GetService(PRESENTATION_SERVICE_CONTRACTID);
   if(NS_WARN_IF(!service)) {
+    aRv.Throw(NS_ERROR_DOM_OPERATION_ERR);
     return;
   }
 
-  NS_WARN_IF(NS_FAILED(service->Terminate(mId)));
+  NS_WARN_IF(NS_FAILED(service->TerminateSession(mId)));
 }
 
 NS_IMETHODIMP
 PresentationSession::NotifyStateChange(const nsAString& aSessionId,
                                        uint16_t aState)
 {
   if (!aSessionId.Equals(mId)) {
     return NS_ERROR_INVALID_ARG;
   }
 
   PresentationSessionState state;
   switch (aState) {
     case nsIPresentationSessionListener::STATE_CONNECTED:
       state = PresentationSessionState::Connected;
       break;
-    case nsIPresentationSessionListener::STATE_DISCONNECTED:
-      state = PresentationSessionState::Disconnected;
+    case nsIPresentationSessionListener::STATE_CLOSED:
+      state = PresentationSessionState::Closed;
       break;
     case nsIPresentationSessionListener::STATE_TERMINATED:
       state = PresentationSessionState::Terminated;
       break;
     default:
       NS_WARNING("Unknown presentation session state.");
       return NS_ERROR_INVALID_ARG;
   }

--- a/dom/presentation/PresentationSession.h
+++ b/dom/presentation/PresentationSession.h
@@ -18,34 +18,36 @@ class PresentationSession final : public
                                 , public nsIPresentationSessionListener
 {
 public:
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(PresentationSession,
                                            DOMEventTargetHelper)
   NS_DECL_NSIPRESENTATIONSESSIONLISTENER
 
-  static already_AddRefed<PresentationSession>
-    Create(nsPIDOMWindow* aWindow,
-           const nsAString& aId,
-           PresentationSessionState aState);
+  static already_AddRefed<PresentationSession> Create(nsPIDOMWindow* aWindow,
+                                                      const nsAString& aId,
+                                                      PresentationSessionState aState);
 
   virtual void DisconnectFromOwner() override;
 
   virtual JSObject* WrapObject(JSContext* aCx,
                                JS::Handle<JSObject*> aGivenProto) override;
 
   // WebIDL (public APIs)
   void GetId(nsAString& aId) const;
 
   PresentationSessionState State() const;
 
-  void Send(const nsAString& aData, ErrorResult& aRv);
+  void Send(const nsAString& aData,
+            ErrorResult& aRv);
 
-  void Close();
+  void Close(ErrorResult& aRv);
+
+  void Terminate(ErrorResult& aRv);
 
   IMPL_EVENT_HANDLER(statechange);
   IMPL_EVENT_HANDLER(message);
 
 private:
   PresentationSession(nsPIDOMWindow* aWindow,
                       const nsAString& aId,
                       PresentationSessionState aState);

--- a/dom/presentation/PresentationSessionInfo.cpp
+++ b/dom/presentation/PresentationSessionInfo.cpp
@@ -169,20 +169,17 @@ PresentationSessionInfo::SetListener(nsI
       nsresult rv = mTransport->EnableDataNotification();
       if (NS_WARN_IF(NS_FAILED(rv))) {
         return rv;
       }
     }
 
     // The transport might become ready, or might become un-ready again, before
     // the listener has registered. So notify the listener of the state change.
-    uint16_t state = IsSessionReady() ?
-                     nsIPresentationSessionListener::STATE_CONNECTED :
-                     nsIPresentationSessionListener::STATE_DISCONNECTED;
-    return mListener->NotifyStateChange(mSessionId, state);
+    return mListener->NotifyStateChange(mSessionId, mState);
   }
 
   return NS_OK;
 }
 
 nsresult
 PresentationSessionInfo::Send(nsIInputStream* aData)
 {
@@ -193,46 +190,33 @@ PresentationSessionInfo::Send(nsIInputSt
   if (NS_WARN_IF(!mTransport)) {
     return NS_ERROR_NOT_AVAILABLE;
   }
 
   return mTransport->Send(aData);
 }
 
 nsresult
-PresentationSessionInfo::Close(nsresult aReason)
+PresentationSessionInfo::Close(nsresult aReason,
+                               uint32_t aState)
 {
-  // The session is disconnected and it's a normal close. Simply change the
-  // state to TERMINATED.
-  if (!IsSessionReady() && NS_SUCCEEDED(aReason)) {
-    if (mListener) {
-      // Notify the listener and the service will untrack the session info after
-      // the listener calls |UnregisterSessionListener|.
-      nsresult rv = mListener->NotifyStateChange(mSessionId,
-                                                 nsIPresentationSessionListener::STATE_TERMINATED);
-      NS_WARN_IF(NS_FAILED(rv));
-    } else {
-      // Directly untrack the session info from the service.
-      NS_WARN_IF(NS_FAILED(UntrackFromService()));
-    }
+  if (NS_WARN_IF(!IsSessionReady())) {
+    return NS_ERROR_DOM_INVALID_STATE_ERR;
   }
 
+  SetState(aState);
+
   Shutdown(aReason);
   return NS_OK;
 }
 
 nsresult
 PresentationSessionInfo::ReplySuccess()
 {
-  if (mListener) {
-    // Notify session state change.
-    nsresult rv = mListener->NotifyStateChange(mSessionId,
-                                               nsIPresentationSessionListener::STATE_CONNECTED);
-    NS_WARN_IF(NS_FAILED(rv));
-  }
+  SetState(nsIPresentationSessionListener::STATE_CONNECTED);
 
   if (mCallback) {
     NS_WARN_IF(NS_FAILED(mCallback->NotifySuccess()));
     SetCallback(nullptr);
   }
 
   return NS_OK;
 }
@@ -303,27 +287,24 @@ PresentationSessionInfo::NotifyTransport
   if (NS_WARN_IF(!IsSessionReady())) {
     // It happens before the session is ready. Reply the callback.
     return ReplyError(NS_ERROR_DOM_OPERATION_ERR);
   }
 
   // Unset |mIsTransportReady| here so it won't affect |IsSessionReady()| above.
   mIsTransportReady = false;
 
+  if (mState == nsIPresentationSessionListener::STATE_CONNECTED) {
+    // The transport channel is closed unexpectedly (not caused by a |Close| call).
+    SetState(nsIPresentationSessionListener::STATE_CLOSED);
+  }
+
   Shutdown(aReason);
 
-  uint16_t state = (NS_WARN_IF(NS_FAILED(aReason))) ?
-                   nsIPresentationSessionListener::STATE_DISCONNECTED :
-                   nsIPresentationSessionListener::STATE_TERMINATED;
-  if (mListener) {
-    // It happens after the session is ready. Notify session state change.
-    // If the new state is TERMINATED. the service will untrack the session info
-    // after the listener calls |UnregisterSessionListener|.
-    return mListener->NotifyStateChange(mSessionId, state);
-  } else if (state == nsIPresentationSessionListener::STATE_TERMINATED) {
+  if (mState == nsIPresentationSessionListener::STATE_TERMINATED) {
     // Directly untrack the session info from the service.
     return UntrackFromService();
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
@@ -504,22 +485,19 @@ PresentationControllingInfo::NotifyClose
 {
   MOZ_ASSERT(NS_IsMainThread());
 
   // Unset control channel here so it won't try to re-close it in potential
   // subsequent |Shutdown| calls.
   SetControlChannel(nullptr);
 
   if (NS_WARN_IF(NS_FAILED(aReason))) {
-    if (mListener) {
-      // The presentation session instance at receiver side may already exist.
-      // Change the state to TERMINATED since it never succeeds.
-      return mListener->NotifyStateChange(mSessionId,
-                                          nsIPresentationSessionListener::STATE_TERMINATED);
-    }
+    // The presentation session instance may already exist.
+    // Change the state to TERMINATED since it never succeeds.
+    SetState(nsIPresentationSessionListener::STATE_TERMINATED);
 
     // Reply error for an abnormal close.
     return ReplyError(NS_ERROR_DOM_OPERATION_ERR);
   }
 
   return NS_OK;
 }
 
@@ -561,21 +539,18 @@ PresentationControllingInfo::OnStopListe
 
   Shutdown(aStatus);
 
   if (NS_WARN_IF(!IsSessionReady())) {
     // It happens before the session is ready. Reply the callback.
     return ReplyError(NS_ERROR_DOM_OPERATION_ERR);
   }
 
-  // It happens after the session is ready. Notify session state change.
-  if (mListener) {
-    return mListener->NotifyStateChange(mSessionId,
-                                        nsIPresentationSessionListener::STATE_DISCONNECTED);
-  }
+  // It happens after the session is ready. Change the state to CLOSED.
+  SetState(nsIPresentationSessionListener::STATE_CLOSED);
 
   return NS_OK;
 }
 
 /*
  * Implementation of PresentationPresentingInfo
  *
  * During presentation session establishment, the receiver expects the following
@@ -770,22 +745,19 @@ PresentationPresentingInfo::NotifyClosed
 {
   MOZ_ASSERT(NS_IsMainThread());
 
   // Unset control channel here so it won't try to re-close it in potential
   // subsequent |Shutdown| calls.
   SetControlChannel(nullptr);
 
   if (NS_WARN_IF(NS_FAILED(aReason))) {
-    if (mListener) {
-      // The presentation session instance at receiver side may already exist.
-      // Change the state to TERMINATED since it never succeeds.
-      return mListener->NotifyStateChange(mSessionId,
-                                          nsIPresentationSessionListener::STATE_TERMINATED);
-    }
+    // The presentation session instance may already exist.
+    // Change the state to TERMINATED since it never succeeds.
+    SetState(nsIPresentationSessionListener::STATE_TERMINATED);
 
     // Reply error for an abnormal close.
     return ReplyError(NS_ERROR_DOM_OPERATION_ERR);
   }
 
   return NS_OK;
 }
 

--- a/dom/presentation/PresentationSessionInfo.h
+++ b/dom/presentation/PresentationSessionInfo.h
@@ -34,16 +34,17 @@ public:
 
   PresentationSessionInfo(const nsAString& aUrl,
                           const nsAString& aSessionId,
                           nsIPresentationServiceCallback* aCallback)
     : mUrl(aUrl)
     , mSessionId(aSessionId)
     , mIsResponderReady(false)
     , mIsTransportReady(false)
+    , mState(nsIPresentationSessionListener::STATE_CLOSED)
     , mCallback(aCallback)
   {
     MOZ_ASSERT(!mUrl.IsEmpty());
     MOZ_ASSERT(!mSessionId.IsEmpty());
   }
 
   virtual nsresult Init(nsIPresentationControlChannel* aControlChannel);
 
@@ -84,17 +85,18 @@ public:
     mControlChannel = aControlChannel;
     if (mControlChannel) {
       mControlChannel->SetListener(this);
     }
   }
 
   nsresult Send(nsIInputStream* aData);
 
-  nsresult Close(nsresult aReason);
+  nsresult Close(nsresult aReason,
+                 uint32_t aState);
 
   nsresult ReplyError(nsresult aReason);
 
   virtual bool IsAccessible(base::ProcessId aProcessId);
 
 protected:
   virtual ~PresentationSessionInfo()
   {
@@ -107,20 +109,36 @@ protected:
 
   bool IsSessionReady()
   {
     return mIsResponderReady && mIsTransportReady;
   }
 
   virtual nsresult UntrackFromService();
 
+  void SetState(uint32_t aState)
+  {
+    if (mState == aState) {
+      return;
+    }
+
+    mState = aState;
+
+    // Notify session state change.
+    if (mListener) {
+      nsresult rv = mListener->NotifyStateChange(mSessionId, mState);
+      NS_WARN_IF(NS_FAILED(rv));
+    }
+  }
+
   nsString mUrl;
   nsString mSessionId;
   bool mIsResponderReady;
   bool mIsTransportReady;
+  uint32_t mState; // CONNECTED, CLOSED, TERMINATED
   nsCOMPtr<nsIPresentationServiceCallback> mCallback;
   nsCOMPtr<nsIPresentationSessionListener> mListener;
   nsCOMPtr<nsIPresentationDevice> mDevice;
   nsCOMPtr<nsIPresentationSessionTransport> mTransport;
   nsCOMPtr<nsIPresentationControlChannel> mControlChannel;
 };
 
 // Session info with controlling browsing context (sender side) behaviors.

--- a/dom/presentation/interfaces/nsIPresentationListener.idl
+++ b/dom/presentation/interfaces/nsIPresentationListener.idl
@@ -8,21 +8,21 @@
 interface nsIPresentationAvailabilityListener : nsISupports
 {
   /*
    * Called when device availability changes.
    */
   void notifyAvailableChange(in bool available);
 };
 
-[scriptable, uuid(3b9ae71f-2905-4969-9117-101627c1c2ea)]
+[scriptable, uuid(7dd48df8-8f8c-48c7-ac37-7b9fd1acf2f8)]
 interface nsIPresentationSessionListener : nsISupports
 {
   const unsigned short STATE_CONNECTED = 0;
-  const unsigned short STATE_DISCONNECTED = 1;
+  const unsigned short STATE_CLOSED = 1;
   const unsigned short STATE_TERMINATED = 2;
 
   /*
    * Called when session state changes.
    */
   void notifyStateChange(in DOMString sessionId,
                          in unsigned short state);
 

--- a/dom/presentation/interfaces/nsIPresentationService.idl
+++ b/dom/presentation/interfaces/nsIPresentationService.idl
@@ -28,17 +28,17 @@ interface nsIPresentationServiceCallback
   /*
    * Called when the operation fails.
    *
    * @param error: error message.
    */
   void notifyError(in nsresult error);
 };
 
-[scriptable, uuid(5a254519-45c3-4229-9b16-f58c05b78fc6)]
+[scriptable, uuid(c177a13a-bf1a-48bf-8032-d415c3343c46)]
 interface nsIPresentationService : nsISupports
 {
   /*
    * Start a new presentation session and display a prompt box which asks users
    * to select a device.
    *
    * @param url: The url of presenting page.
    * @param sessionId: An ID to identify presentation session.
@@ -58,21 +58,28 @@ interface nsIPresentationService : nsISu
    *
    * @param sessionId: An ID to identify presentation session.
    * @param stream: The message is converted to an input stream.
    */
   void sendSessionMessage(in DOMString sessionId,
                           in nsIInputStream stream);
 
   /*
+   * Close the session.
+   *
+   * @param sessionId: An ID to identify presentation session.
+   */
+  void closeSession(in DOMString sessionId);
+
+  /*
    * Terminate the session.
    *
    * @param sessionId: An ID to identify presentation session.
    */
-  void terminate(in DOMString sessionId);
+  void terminateSession(in DOMString sessionId);
 
   /*
    * Register an availability listener. Must be called from the main thread.
    *
    * @param listener: The listener to register.
    */
   void registerAvailabilityListener(in nsIPresentationAvailabilityListener listener);
 

--- a/dom/presentation/ipc/PPresentation.ipdl
+++ b/dom/presentation/ipc/PPresentation.ipdl
@@ -20,26 +20,32 @@ struct StartSessionRequest
 };
 
 struct SendSessionMessageRequest
 {
   nsString sessionId;
   InputStreamParams data;
 };
 
-struct TerminateRequest
+struct CloseSessionRequest
+{
+  nsString sessionId;
+};
+
+struct TerminateSessionRequest
 {
   nsString sessionId;
 };
 
 union PresentationIPCRequest
 {
   StartSessionRequest;
   SendSessionMessageRequest;
-  TerminateRequest;
+  CloseSessionRequest;
+  TerminateSessionRequest;
 };
 
 sync protocol PPresentation
 {
   manager PContent;
   manages PPresentationRequest;
 
 child:

--- a/dom/presentation/ipc/PresentationIPCService.cpp
+++ b/dom/presentation/ipc/PresentationIPCService.cpp
@@ -66,21 +66,29 @@ PresentationIPCService::SendSessionMessa
   nsTArray<mozilla::ipc::FileDescriptor> fds;
   SerializeInputStream(aStream, stream, fds);
   MOZ_ASSERT(fds.IsEmpty());
 
   return SendRequest(nullptr, SendSessionMessageRequest(nsAutoString(aSessionId), stream));
 }
 
 NS_IMETHODIMP
-PresentationIPCService::Terminate(const nsAString& aSessionId)
+PresentationIPCService::CloseSession(const nsAString& aSessionId)
 {
   MOZ_ASSERT(!aSessionId.IsEmpty());
 
-  return SendRequest(nullptr, TerminateRequest(nsAutoString(aSessionId)));
+  return SendRequest(nullptr, CloseSessionRequest(nsAutoString(aSessionId)));
+}
+
+NS_IMETHODIMP
+PresentationIPCService::TerminateSession(const nsAString& aSessionId)
+{
+  MOZ_ASSERT(!aSessionId.IsEmpty());
+
+  return SendRequest(nullptr, TerminateSessionRequest(nsAutoString(aSessionId)));
 }
 
 nsresult
 PresentationIPCService::SendRequest(nsIPresentationServiceCallback* aCallback,
                                     const PresentationIPCRequest& aRequest)
 {
   if (sPresentationChild) {
     PresentationRequestChild* actor = new PresentationRequestChild(aCallback);

--- a/dom/presentation/ipc/PresentationParent.cpp
+++ b/dom/presentation/ipc/PresentationParent.cpp
@@ -69,18 +69,21 @@ PresentationParent::RecvPPresentationReq
   nsresult rv = NS_ERROR_FAILURE;
   switch (aRequest.type()) {
     case PresentationIPCRequest::TStartSessionRequest:
       rv = actor->DoRequest(aRequest.get_StartSessionRequest());
       break;
     case PresentationIPCRequest::TSendSessionMessageRequest:
       rv = actor->DoRequest(aRequest.get_SendSessionMessageRequest());
       break;
-    case PresentationIPCRequest::TTerminateRequest:
-      rv = actor->DoRequest(aRequest.get_TerminateRequest());
+    case PresentationIPCRequest::TCloseSessionRequest:
+      rv = actor->DoRequest(aRequest.get_CloseSessionRequest());
+      break;
+    case PresentationIPCRequest::TTerminateSessionRequest:
+      rv = actor->DoRequest(aRequest.get_TerminateSessionRequest());
       break;
     default:
       MOZ_CRASH("Unknown PresentationIPCRequest type");
   }
 
   return NS_WARN_IF(NS_FAILED(rv)) ? false : true;
 }
 
@@ -273,28 +276,47 @@ PresentationRequestParent::DoRequest(con
   nsresult rv = mService->SendSessionMessage(aRequest.sessionId(), stream);
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return NotifyError(rv);
   }
   return NotifySuccess();
 }
 
 nsresult
-PresentationRequestParent::DoRequest(const TerminateRequest& aRequest)
+PresentationRequestParent::DoRequest(const CloseSessionRequest& aRequest)
 {
   MOZ_ASSERT(mService);
 
   // Validate the accessibility (primarily for receiver side) so that a
   // compromised child process can't fake the ID.
   if (NS_WARN_IF(!static_cast<PresentationService*>(mService.get())->
                   IsSessionAccessible(aRequest.sessionId(), OtherPid()))) {
     return NotifyError(NS_ERROR_DOM_SECURITY_ERR);
   }
 
-  nsresult rv = mService->Terminate(aRequest.sessionId());
+  nsresult rv = mService->CloseSession(aRequest.sessionId());
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return NotifyError(rv);
+  }
+  return NotifySuccess();
+}
+
+nsresult
+PresentationRequestParent::DoRequest(const TerminateSessionRequest& aRequest)
+{
+  MOZ_ASSERT(mService);
+
+  // Validate the accessibility (primarily for receiver side) so that a
+  // compromised child process can't fake the ID.
+  if (NS_WARN_IF(!static_cast<PresentationService*>(mService.get())->
+                  IsSessionAccessible(aRequest.sessionId(), OtherPid()))) {
+    return NotifyError(NS_ERROR_DOM_SECURITY_ERR);
+  }
+
+  nsresult rv = mService->TerminateSession(aRequest.sessionId());
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return NotifyError(rv);
   }
   return NotifySuccess();
 }
 
 NS_IMETHODIMP
 PresentationRequestParent::NotifySuccess()

--- a/dom/presentation/ipc/PresentationParent.h
+++ b/dom/presentation/ipc/PresentationParent.h
@@ -84,17 +84,19 @@ private:
   virtual ~PresentationRequestParent();
 
   nsresult SendResponse(nsresult aResult);
 
   nsresult DoRequest(const StartSessionRequest& aRequest);
 
   nsresult DoRequest(const SendSessionMessageRequest& aRequest);
 
-  nsresult DoRequest(const TerminateRequest& aRequest);
+  nsresult DoRequest(const CloseSessionRequest& aRequest);
+
+  nsresult DoRequest(const TerminateSessionRequest& aRequest);
 
   bool mActorDestroyed;
   nsCOMPtr<nsIPresentationService> mService;
 };
 
 } // namespace dom
 } // namespace mozilla
 

--- a/dom/presentation/tests/mochitest/file_presentation_receiver.html
+++ b/dom/presentation/tests/mochitest/file_presentation_receiver.html
@@ -37,22 +37,22 @@ function testSessionAvailable() {
     ok(navigator.presentation, "navigator.presentation should be available.");
     ok(navigator.presentation.receiver, "navigator.presentation.receiver should be available.");
 
     navigator.presentation.receiver.getSession().then(
       function(aSession) {
         session = aSession;
 
         ok(session.id, "Session ID should be set: " + session.id);
-        is(session.state, "disconnected", "Session state at receiver side should be disconnected by default.");
+        is(session.state, "closed", "Session state at receiver side should be closed by default.");
         aResolve();
       },
       function(aError) {
         ok(false, "Error occurred when getting the session: " + aError);
-        teardown();
+        finish();
         aReject();
       }
     );
   });
 }
 
 function testSessionReady() {
   return new Promise(function(aResolve, aReject) {
@@ -76,29 +76,29 @@ function testIncomingMessage() {
       aResolve();
     });
 
     command({ name: 'trigger-incoming-message',
     	      data: incomingMessage });
   });
 }
 
-function testCloseSession() {
+function testTerminateSession() {
   return new Promise(function(aResolve, aReject) {
     session.onstatechange = function() {
       session.onstatechange = null;
       is(session.state, "terminated", "Session should be terminated.");
       aResolve();
     };
 
-    session.close();
+    session.terminate();
   });
 }
 
 testSessionAvailable().
 then(testSessionReady).
 then(testIncomingMessage).
-then(testCloseSession).
+then(testTerminateSession).
 then(finish);
 
 </script>
 </body>
 </html>

--- a/dom/presentation/tests/mochitest/file_presentation_receiver_oop.html
+++ b/dom/presentation/tests/mochitest/file_presentation_receiver_oop.html
@@ -37,22 +37,22 @@ function testSessionAvailable() {
     ok(navigator.presentation, "navigator.presentation should be available.");
     ok(navigator.presentation.receiver, "navigator.presentation.receiver should be available.");
 
     navigator.presentation.receiver.getSession().then(
       function(aSession) {
         session = aSession;
 
         ok(session.id, "Session ID should be set: " + session.id);
-        is(session.state, "disconnected", "Session state at receiver side should be disconnected by default.");
+        is(session.state, "closed", "Session state at receiver side should be closed by default.");
         aResolve();
       },
       function(aError) {
         ok(false, "Error occurred when getting the session: " + aError);
-        teardown();
+        finish();
         aReject();
       }
     );
   });
 }
 
 function testSessionReady() {
   return new Promise(function(aResolve, aReject) {
@@ -76,29 +76,29 @@ function testIncomingMessage() {
       aResolve();
     });
 
     command({ name: 'trigger-incoming-message',
     	      data: incomingMessage });
   });
 }
 
-function testCloseSession() {
+function testTerminateSession() {
   return new Promise(function(aResolve, aReject) {
     session.onstatechange = function() {
       session.onstatechange = null;
       is(session.state, "terminated", "Session should be terminated.");
       aResolve();
     };
 
-    session.close();
+    session.terminate();
   });
 }
 
 testSessionAvailable().
 then(testSessionReady).
 then(testIncomingMessage).
-then(testCloseSession).
+then(testTerminateSession).
 then(finish);
 
 </script>
 </body>
 </html>

--- a/dom/presentation/tests/mochitest/file_presentation_receiver_start_session_error.html
+++ b/dom/presentation/tests/mochitest/file_presentation_receiver_start_session_error.html
@@ -37,22 +37,22 @@ function testSessionAvailable() {
     ok(navigator.presentation, "navigator.presentation should be available.");
     ok(navigator.presentation.receiver, "navigator.presentation.receiver should be available.");
 
     navigator.presentation.receiver.getSession().then(
       function(aSession) {
         session = aSession;
 
         ok(session.id, "Session ID should be set: " + session.id);
-        is(session.state, "disconnected", "Session state at receiver side should be disconnected by default.");
+        is(session.state, "closed", "Session state at receiver side should be closed by default.");
         aResolve();
       },
       function(aError) {
         ok(false, "Error occurred when getting the session: " + aError);
-        teardown();
+        finish();
         aReject();
       }
     );
   });
 }
 
 function testUnexpectedControlChannelClose() {
   return new Promise(function(aResolve, aReject) {

--- a/dom/presentation/tests/mochitest/test_presentation_sender.html
+++ b/dom/presentation/tests/mochitest/test_presentation_sender.html
@@ -143,30 +143,30 @@ function testIncomingMessage() {
       is(aEvent.data, incomingMessage, "An incoming message should be received.");
       aResolve();
     });
 
     gScript.sendAsyncMessage('trigger-incoming-message', incomingMessage);
   });
 }
 
-function testCloseSession() {
+function testTerminateSession() {
   return new Promise(function(aResolve, aReject) {
     gScript.addMessageListener('data-transport-closed', function dataTransportClosedHandler(aReason) {
       gScript.removeMessageListener('data-transport-closed', dataTransportClosedHandler);
       info("The data transport is closed. " + aReason);
     });
 
     session.onstatechange = function() {
       session.onstatechange = null;
       is(session.state, "terminated", "Session should be terminated.");
       aResolve();
     };
 
-    session.close();
+    session.terminate();
   });
 }
 
 function teardown() {
   gScript.addMessageListener('teardown-complete', function teardownCompleteHandler() {
     gScript.removeMessageListener('teardown-complete', teardownCompleteHandler);
     gScript.destroy();
     SimpleTest.finish();
@@ -177,17 +177,17 @@ function teardown() {
 
 function runTests() {
   ok(window.PresentationRequest, "PresentationRequest should be available.");
 
   testSetup().
   then(testStartSession).
   then(testSend).
   then(testIncomingMessage).
-  then(testCloseSession).
+  then(testTerminateSession).
   then(teardown);
 }
 
 SimpleTest.expectAssertions(0, 5);
 SimpleTest.waitForExplicitFinish();
 SpecialPowers.pushPermissions([
   {type: 'presentation-device-manage', allow: false, context: document},
   {type: 'presentation', allow: true, context: document},

--- a/dom/presentation/tests/mochitest/test_presentation_sender_default_request.html
+++ b/dom/presentation/tests/mochitest/test_presentation_sender_default_request.html
@@ -92,30 +92,30 @@ function testStartSession() {
       aResolve();
     };
 
     // Simulate the UA triggers |start()| of the default request.
     navigator.presentation.defaultRequest.start();
   });
 }
 
-function testCloseSession() {
+function testTerminateSession() {
   return new Promise(function(aResolve, aReject) {
     gScript.addMessageListener('data-transport-closed', function dataTransportClosedHandler(aReason) {
       gScript.removeMessageListener('data-transport-closed', dataTransportClosedHandler);
       info("The data transport is closed. " + aReason);
     });
 
     session.onstatechange = function() {
       session.onstatechange = null;
       is(session.state, "terminated", "Session should be terminated.");
       aResolve();
     };
 
-    session.close();
+    session.terminate();
   });
 }
 
 function teardown() {
   gScript.addMessageListener('teardown-complete', function teardownCompleteHandler() {
     gScript.removeMessageListener('teardown-complete', teardownCompleteHandler);
     gScript.destroy();
     SimpleTest.finish();
@@ -125,17 +125,17 @@ function teardown() {
 }
 
 function runTests() {
   ok(window.PresentationRequest, "PresentationRequest should be available.");
   ok(navigator.presentation, "navigator.presentation should be available.");
 
   testSetup().
   then(testStartSession).
-  then(testCloseSession).
+  then(testTerminateSession).
   then(teardown);
 }
 
 SimpleTest.expectAssertions(0, 5);
 SimpleTest.waitForExplicitFinish();
 SpecialPowers.pushPermissions([
   {type: 'presentation-device-manage', allow: false, context: document},
   {type: 'presentation', allow: true, context: document},

--- a/dom/presentation/tests/mochitest/test_presentation_sender_disconnect.html
+++ b/dom/presentation/tests/mochitest/test_presentation_sender_disconnect.html
@@ -108,53 +108,40 @@ function testSessionDisconnection() {
   return new Promise(function(aResolve, aReject) {
     gScript.addMessageListener('data-transport-closed', function dataTransportClosedHandler(aReason) {
       gScript.removeMessageListener('data-transport-closed', dataTransportClosedHandler);
       info("The data transport is closed. " + aReason);
     });
 
     session.onstatechange = function() {
       session.onstatechange = null;
-      is(session.state, "disconnected", "Session should be disconnected.");
+      is(session.state, "closed", "Session should be closed.");
       aResolve();
     };
 
     gScript.sendAsyncMessage('trigger-data-transport-close', SpecialPowers.Cr.NS_ERROR_FAILURE);
   });
 }
 
-function testCloseSession() {
-  return new Promise(function(aResolve, aReject) {
-    session.onstatechange = function() {
-      session.onstatechange = null;
-      is(session.state, "terminated", "Session should be terminated.");
-      aResolve();
-    };
-
-    session.close();
-  });
-}
-
 function teardown() {
   gScript.addMessageListener('teardown-complete', function teardownCompleteHandler() {
     gScript.removeMessageListener('teardown-complete', teardownCompleteHandler);
     gScript.destroy();
     SimpleTest.finish();
   });
 
   gScript.sendAsyncMessage('teardown');
 }
 
 function runTests() {
   ok(window.PresentationRequest, "PresentationRequest should be available.");
 
   testSetup().
   then(testStartSession).
   then(testSessionDisconnection).
-  then(testCloseSession).
   then(teardown);
 }
 
 SimpleTest.expectAssertions(0, 5);
 SimpleTest.waitForExplicitFinish();
 SpecialPowers.pushPermissions([
   {type: 'presentation-device-manage', allow: false, context: document},
   {type: 'presentation', allow: true, context: document},

--- a/dom/tv/TVSimulatorService.manifest
+++ b/dom/tv/TVSimulatorService.manifest
@@ -1,3 +1,2 @@
 component {94b065ad-d45a-436a-b394-6dabc3cf110f} TVSimulatorService.js
 contract @mozilla.org/tv/simulatorservice;1 {94b065ad-d45a-436a-b394-6dabc3cf110f}
-TVSimulatorService @mozilla.org/tv/simulatorservice;1

--- a/dom/webidl/PresentationSession.webidl
+++ b/dom/webidl/PresentationSession.webidl
@@ -5,65 +5,71 @@
  */
 
 enum PresentationSessionState
 {
   // Existing presentation, and the communication channel is active.
   "connected",
 
   // Existing presentation, but the communication channel is inactive.
-  "disconnected",
+  "closed",
 
   // The presentation is nonexistent anymore. It could be terminated manually,
-  // or either requesting page or presenting page is no longer available.
+  // or either controlling or receiving browsing context is no longer available.
   "terminated"
 };
 
 [Pref="dom.presentation.enabled",
  CheckAnyPermissions="presentation"]
 interface PresentationSession : EventTarget {
   /*
    * Unique id for all existing sessions.
    */
   [Constant]
   readonly attribute DOMString id;
 
   /*
-   * Please refer to PresentationSessionStateEvent.webidl for the declaration of
-   * PresentationSessionState.
-   *
-   * @value "connected", "disconnected", or "terminated".
+   * @value "connected", "closed", or "terminated".
    */
   readonly attribute PresentationSessionState state;
 
   /*
-   * It is called when session state changes. New state is dispatched with the
-   * event.
+   * It is called when session state changes.
    */
   attribute EventHandler onstatechange;
 
   /*
-   * After a communication channel has been established between the requesting
-   * page and the presenting page, send() is called to send message out, and the
-   * event handler "onmessage" will be invoked on the remote side.
+   * After a communication channel has been established between the controlling
+   * and receiving context, this function is called to send message out, and the
+   * event handler "onmessage" will be invoked at the remote side.
    *
-   * This function only works when state equals "connected".
+   * This function only works when the state is "connected".
    *
-   * @data: String literal-only for current implementation.
+   * TODO bug 1148307 Implement PresentationSessionTransport with DataChannel to
+   * support other binary types.
    */
   [Throws]
   void send(DOMString data);
 
   /*
    * It is triggered when receiving messages.
    */
   attribute EventHandler onmessage;
 
   /*
-   * Both the requesting page and the presenting page can close the session by
-   * calling terminate(). Then, the session is destroyed and its state is
-   * truned into "terminated". After getting into the state of "terminated",
-   * resumeSession() is incapable of re-establishing the connection.
+   * Both the controlling and receving browsing context can close the session.
+   * Then, the session state should turn into "closed".
    *
-   * This function does nothing if the state has already been "terminated".
+   * This function only works when the state is not "connected".
    */
-  void close();
+  // TODO Bug 1210340 - Support close semantics.
+  // [Throws]
+  // void close();
+
+  /*
+   * Both the controlling and receving browsing context can terminate the session.
+   * Then the session state should turn into "terminated".
+   *
+   * This function only works when the state is not "connected".
+   */
+   [Throws]
+   void terminate();
 };

--- a/extensions/cookie/nsPermissionManager.cpp
+++ b/extensions/cookie/nsPermissionManager.cpp
@@ -2310,40 +2310,16 @@ nsPermissionManager::RemoveAllModifiedSi
 }
 
 NS_IMETHODIMP
 nsPermissionManager::RemovePermissionsForApp(uint32_t aAppId, bool aBrowserOnly)
 {
   ENSURE_NOT_CHILD_PROCESS;
   NS_ENSURE_ARG(aAppId != nsIScriptSecurityManager::NO_APP_ID);
 
-  // We begin by removing all the permissions from the DB.
-  // After clearing the DB, we call AddInternal() to make sure that all
-  // processes are aware of this change and the representation of the DB in
-  // memory is updated.
-  // We have to get all permissions associated with an application first
-  // because removing entries from the permissions table while iterating over
-  // it is dangerous.
-
-  nsAutoCString sql;
-  sql.AppendLiteral("DELETE FROM moz_perms WHERE appId=");
-  sql.AppendInt(aAppId);
-
-  if (aBrowserOnly) {
-    sql.AppendLiteral(" AND isInBrowserElement=1");
-  }
-
-  nsCOMPtr<mozIStorageAsyncStatement> removeStmt;
-  nsresult rv = mDBConn->CreateAsyncStatement(sql, getter_AddRefs(removeStmt));
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  nsCOMPtr<mozIStoragePendingStatement> pending;
-  rv = removeStmt->ExecuteAsync(nullptr, getter_AddRefs(pending));
-  NS_ENSURE_SUCCESS(rv, rv);
-
   nsCOMArray<nsIPermission> permissions;
   for (auto iter = mPermissionTable.Iter(); !iter.Done(); iter.Next()) {
     PermissionHashKey* entry = iter.Get();
 
     nsCOMPtr<nsIPrincipal> principal;
     nsresult rv = GetPrincipalFromOrigin(entry->GetKey()->mOrigin,
                                          getter_AddRefs(principal));
     if (NS_FAILED(rv)) {

new file mode 100644
--- /dev/null
+++ b/extensions/cookie/test/unit/test_permmanager_removeforapp.js
@@ -0,0 +1,96 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+function run_test() {
+  // initialize the permission manager service
+  let ssm = Services.scriptSecurityManager;
+  let pm = Services.perms;
+
+  function mkPrin(uri, appId, inBrowser) {
+    return ssm.createCodebasePrincipal(Services.io.newURI(uri, null, null),
+                                       {appId: appId, inBrowser: inBrowser});
+  }
+
+  function checkPerms(perms) {
+    perms.forEach((perm) => {
+      // Look up the expected permission
+      do_check_eq(pm.getPermissionObject(mkPrin(perm[0],  perm[1], perm[2]),
+                                         perm[3], true).capability,
+                  perm[4], "Permission is expected in the permission database");
+    });
+
+    // Count the entries
+    let count = 0;
+    let enumerator = Services.perms.enumerator;
+    while (enumerator.hasMoreElements()) { enumerator.getNext(); count++; }
+
+    do_check_eq(count, perms.length, "There should be the right number of permissions in the DB");
+  }
+
+  checkPerms([]);
+
+  let permissions = [
+    ['http://google.com',  1001, false, 'a', 1],
+    ['http://google.com',  1001, false, 'b', 1],
+    ['http://mozilla.com', 1001, false, 'b', 1],
+    ['http://mozilla.com', 1001, false, 'a', 1],
+
+    ['http://google.com',  1001, true, 'a', 1],
+    ['http://google.com',  1001, true, 'b', 1],
+    ['http://mozilla.com', 1001, true, 'b', 1],
+    ['http://mozilla.com', 1001, true, 'a', 1],
+
+    ['http://google.com',  1011, false, 'a', 1],
+    ['http://google.com',  1011, false, 'b', 1],
+    ['http://mozilla.com', 1011, false, 'b', 1],
+    ['http://mozilla.com', 1011, false, 'a', 1],
+  ];
+
+  permissions.forEach((perm) => {
+    pm.addFromPrincipal(mkPrin(perm[0], perm[1], perm[2]), perm[3], perm[4]);
+  });
+
+  checkPerms(permissions);
+
+  let remove_false_perms = [
+    ['http://google.com',  1011, false, 'a', 1],
+    ['http://google.com',  1011, false, 'b', 1],
+    ['http://mozilla.com', 1011, false, 'b', 1],
+    ['http://mozilla.com', 1011, false, 'a', 1],
+  ];
+
+  pm.removePermissionsForApp(1001, false);
+  checkPerms(remove_false_perms);
+
+  let restore = [
+    ['http://google.com',  1001, false, 'a', 1],
+    ['http://google.com',  1001, false, 'b', 1],
+    ['http://mozilla.com', 1001, false, 'b', 1],
+    ['http://mozilla.com', 1001, false, 'a', 1],
+
+    ['http://google.com',  1001, true, 'a', 1],
+    ['http://google.com',  1001, true, 'b', 1],
+    ['http://mozilla.com', 1001, true, 'b', 1],
+    ['http://mozilla.com', 1001, true, 'a', 1],
+  ];
+
+  restore.forEach((perm) => {
+    pm.addFromPrincipal(mkPrin(perm[0],  perm[1], perm[2]), perm[3], perm[4]);
+  });
+  checkPerms(permissions);
+
+  let remove_true_perms = [
+    ['http://google.com',  1001, false, 'a', 1],
+    ['http://google.com',  1001, false, 'b', 1],
+    ['http://mozilla.com', 1001, false, 'b', 1],
+    ['http://mozilla.com', 1001, false, 'a', 1],
+
+    ['http://google.com',  1011, false, 'a', 1],
+    ['http://google.com',  1011, false, 'b', 1],
+    ['http://mozilla.com', 1011, false, 'b', 1],
+    ['http://mozilla.com', 1011, false, 'a', 1],
+  ];
+
+  pm.removePermissionsForApp(1001, true);
+  checkPerms(remove_true_perms);
+}

--- a/extensions/cookie/test/unit/xpcshell.ini
+++ b/extensions/cookie/test/unit/xpcshell.ini
@@ -21,16 +21,17 @@ skip-if = true # Bug 863738
 [test_domain_eviction.js]
 [test_eviction.js]
 [test_permmanager_defaults.js]
 [test_permmanager_expiration.js]
 [test_permmanager_getPermissionObject.js]
 [test_permmanager_notifications.js]
 [test_permmanager_removeall.js]
 [test_permmanager_removesince.js]
+[test_permmanager_removeforapp.js]
 [test_permmanager_load_invalid_entries.js]
 skip-if = debug == true
 [test_permmanager_idn.js]
 [test_permmanager_subdomains.js]
 [test_permmanager_local_files.js]
 [test_permmanager_cleardata.js]
 [test_schema_2_migration.js]
 [test_schema_3_migration.js]

--- a/gfx/2d/FilterNodeD2D1.cpp
+++ b/gfx/2d/FilterNodeD2D1.cpp
@@ -531,16 +531,37 @@ IsTransferFilterType(FilterType aType)
     case FilterType::TABLE_TRANSFER:
     case FilterType::DISCRETE_TRANSFER:
       return true;
     default:
       return false;
   }
 }
 
+static bool
+HasUnboundedOutputRegion(FilterType aType)
+{
+  if (IsTransferFilterType(aType)) {
+    return true;
+  }
+
+  switch (aType) {
+    case FilterType::COLOR_MATRIX:
+    case FilterType::POINT_DIFFUSE:
+    case FilterType::SPOT_DIFFUSE:
+    case FilterType::DISTANT_DIFFUSE:
+    case FilterType::POINT_SPECULAR:
+    case FilterType::SPOT_SPECULAR:
+    case FilterType::DISTANT_SPECULAR:
+      return true;
+    default:
+      return false;
+  }
+}
+
 /* static */
 already_AddRefed<FilterNode>
 FilterNodeD2D1::Create(ID2D1DeviceContext *aDC, FilterType aType)
 {
   if (aType == FilterType::CONVOLVE_MATRIX) {
     return MakeAndAddRef<FilterNodeConvolveD2D1>(aDC);
   }
 
@@ -551,17 +572,17 @@ FilterNodeD2D1::Create(ID2D1DeviceContex
 
   if (FAILED(hr) || !effect) {
     gfxCriticalErrorOnce() << "Failed to create effect for FilterType: " << hexa(hr);
     return nullptr;
   }
 
   RefPtr<FilterNodeD2D1> filter = new FilterNodeD2D1(effect, aType);
 
-  if (IsTransferFilterType(aType) || aType == FilterType::COLOR_MATRIX) {
+  if (HasUnboundedOutputRegion(aType)) {
     // These filters can produce non-transparent output from transparent
     // input pixels, and we want them to have an unbounded output region.
     filter = new FilterNodeExtendInputAdapterD2D1(aDC, filter, aType);
   }
 
   if (IsTransferFilterType(aType)) {
     // Component transfer filters should appear to apply on unpremultiplied
     // colors, but the D2D1 effects apply on premultiplied colors.

--- a/gfx/2d/FilterNodeSoftware.cpp
+++ b/gfx/2d/FilterNodeSoftware.cpp
@@ -3335,17 +3335,17 @@ FilterNodeLightingSoftware<LightType, Li
   mColor = aColor;
   Invalidate();
 }
 
 template<typename LightType, typename LightingType>
 IntRect
 FilterNodeLightingSoftware<LightType, LightingType>::GetOutputRectInRect(const IntRect& aRect)
 {
-  return GetInputRectInRect(IN_LIGHTING_IN, aRect);
+  return aRect;
 }
 
 Point3D
 PointLightSoftware::GetVectorToLight(const Point3D &aTargetPoint)
 {
   return Normalized(mPosition - aTargetPoint);
 }
 
@@ -3477,17 +3477,17 @@ FilterNodeLightingSoftware<LightType, Li
                   ceil(float(aKernelUnitLengthY)));
 
   // Inflate the source rect by another pixel because the bilinear filtering in
   // ColorComponentAtPoint may want to access the margins.
   srcRect.Inflate(1);
 
   RefPtr<DataSourceSurface> input =
     GetInputDataSourceSurface(IN_LIGHTING_IN, srcRect, CAN_HANDLE_A8,
-                              EDGE_MODE_DUPLICATE);
+                              EDGE_MODE_NONE);
 
   if (!input) {
     return nullptr;
   }
 
   if (input->GetFormat() != SurfaceFormat::A8) {
     input = FilterProcessing::ExtractAlpha(input);
   }

--- a/gfx/layers/LayerScope.cpp
+++ b/gfx/layers/LayerScope.cpp
@@ -430,38 +430,41 @@ protected:
 
 #ifdef MOZ_WIDGET_GONK
 // B2G optimization.
 class DebugGLGraphicBuffer final: public DebugGLData {
 public:
     DebugGLGraphicBuffer(void *layerRef,
                          GLenum target,
                          GLuint name,
-                         const LayerRenderState &aState)
+                         const LayerRenderState &aState,
+                         bool aIsMask)
         : DebugGLData(Packet::TEXTURE),
           mLayerRef(reinterpret_cast<uint64_t>(layerRef)),
           mTarget(target),
           mName(name),
-          mState(aState)
+          mState(aState),
+          mIsMask(aIsMask)
     {
     }
 
     virtual bool Write() override {
         return WriteToStream(mPacket);
     }
 
     bool TryPack(bool packData) {
         android::sp<android::GraphicBuffer> buffer = mState.mSurface;
         MOZ_ASSERT(buffer.get());
 
         mPacket.set_type(mDataType);
         TexturePacket* tp = mPacket.mutable_texture();
         tp->set_layerref(mLayerRef);
         tp->set_name(mName);
         tp->set_target(mTarget);
+        tp->set_ismask(mIsMask);
 
         int pFormat = buffer->getPixelFormat();
         if (HAL_PIXEL_FORMAT_RGBA_8888 != pFormat &&
             HAL_PIXEL_FORMAT_RGBX_8888 != pFormat) {
             return false;
         }
 
         int32_t stride = buffer->getStride() * 4;
@@ -508,33 +511,36 @@ public:
         return true;
     }
 
 private:
     uint64_t mLayerRef;
     GLenum mTarget;
     GLuint mName;
     const LayerRenderState &mState;
+    bool mIsMask;
     Packet mPacket;
 };
 #endif
 
 class DebugGLTextureData final: public DebugGLData {
 public:
     DebugGLTextureData(GLContext* cx,
                        void* layerRef,
                        GLenum target,
                        GLuint name,
-                       DataSourceSurface* img)
+                       DataSourceSurface* img,
+                       bool aIsMask)
         : DebugGLData(Packet::TEXTURE),
           mLayerRef(reinterpret_cast<uint64_t>(layerRef)),
           mTarget(target),
           mName(name),
           mContextAddress(reinterpret_cast<intptr_t>(cx)),
-          mDatasize(0)
+          mDatasize(0),
+          mIsMask(aIsMask)
     {
         // pre-packing
         // DataSourceSurface may have locked buffer,
         // so we should compress now, and then it could
         // be unlocked outside.
         pack(img);
     }
 
@@ -547,16 +553,17 @@ private:
         mPacket.set_type(mDataType);
 
         TexturePacket* tp = mPacket.mutable_texture();
         tp->set_layerref(mLayerRef);
         tp->set_name(mName);
         tp->set_target(mTarget);
         tp->set_dataformat(LOCAL_GL_RGBA);
         tp->set_glcontext(static_cast<uint64_t>(mContextAddress));
+        tp->set_ismask(mIsMask);
 
         if (aImage) {
             tp->set_width(aImage->GetSize().width);
             tp->set_height(aImage->GetSize().height);
             tp->set_stride(aImage->Stride());
 
             mDatasize = aImage->GetSize().height * aImage->Stride();
 
@@ -585,16 +592,17 @@ private:
     }
 
 protected:
     uint64_t mLayerRef;
     GLenum mTarget;
     GLuint mName;
     intptr_t mContextAddress;
     uint32_t mDatasize;
+    bool mIsMask;
 
     // Packet data
     Packet mPacket;
 };
 
 class DebugGLColorData final: public DebugGLData {
 public:
     DebugGLColorData(void* layerRef,
@@ -867,19 +875,21 @@ NS_IMPL_ISUPPORTS(DebugDataSender::SendT
 
 
 /*
  * LayerScope SendXXX Structure
  * 1. SendLayer
  * 2. SendEffectChain
  *   1. SendTexturedEffect
  *      -> SendTextureSource
- *   2. SendYCbCrEffect
+ *   2. SendMaskEffect
  *      -> SendTextureSource
- *   3. SendColor
+ *   3. SendYCbCrEffect
+ *      -> SendTextureSource
+ *   4. SendColor
  */
 class SenderHelper
 {
 // Sender public APIs
 public:
     static void SendLayer(LayerComposite* aLayer,
                           int aWidth,
                           int aHeight);
@@ -890,80 +900,74 @@ public:
                                 int aHeight = 0);
 
     static void SetLayersTreeSendable(bool aSet) {sLayersTreeSendable = aSet;}
 
     static void SetLayersBufferSendable(bool aSet) {sLayersBufferSendable = aSet;}
 
     static bool GetLayersTreeSendable() {return sLayersTreeSendable;}
 
-    static void ClearTextureIdList();
+    static void ClearSentTextureIds();
 
 
 // Sender private functions
 private:
     static void SendColor(void* aLayerRef,
                           const Color& aColor,
                           int aWidth,
                           int aHeight);
     static void SendTextureSource(GLContext* aGLContext,
                                   void* aLayerRef,
                                   TextureSourceOGL* aSource,
-                                  GLuint aTexID,
-                                  bool aFlipY);
+                                  bool aFlipY,
+                                  bool aIsMask);
 #ifdef MOZ_WIDGET_GONK
-    static bool SendGraphicBuffer(void* aLayerRef,
+    static bool SendGraphicBuffer(GLContext* aGLContext,
+                                  void* aLayerRef,
                                   TextureSourceOGL* aSource,
-                                  GLuint aTexID,
-                                  const TexturedEffect* aEffect);
+                                  const TexturedEffect* aEffect,
+                                  bool aIsMask);
 #endif
     static void SendTexturedEffect(GLContext* aGLContext,
                                    void* aLayerRef,
                                    const TexturedEffect* aEffect);
+    static void SendMaskEffect(GLContext* aGLContext,
+                                   void* aLayerRef,
+                                   const EffectMask* aEffect);
     static void SendYCbCrEffect(GLContext* aGLContext,
                                 void* aLayerRef,
                                 const EffectYCbCr* aEffect);
     static GLuint GetTextureID(GLContext* aGLContext,
                                TextureSourceOGL* aSource);
-    static bool IsTextureIdContainsInList(GLuint aTextureId);
+    static bool HasTextureIdBeenSent(GLuint aTextureId);
 // Data fields
 private:
     static bool sLayersTreeSendable;
     static bool sLayersBufferSendable;
-    static std::list<GLuint> sTextureIdList;
+    static std::vector<GLuint> sSentTextureIds;
 };
 
 bool SenderHelper::sLayersTreeSendable = true;
 bool SenderHelper::sLayersBufferSendable = true;
-std::list<GLuint> SenderHelper::sTextureIdList;
+std::vector<GLuint> SenderHelper::sSentTextureIds;
 
 
 // ----------------------------------------------
 // SenderHelper implementation
 // ----------------------------------------------
 void
-SenderHelper::ClearTextureIdList()
+SenderHelper::ClearSentTextureIds()
 {
-    std::list<GLuint>::iterator it;
-    while (!sTextureIdList.empty()) {
-        it = sTextureIdList.begin();
-        sTextureIdList.erase(it);
-    }
+    sSentTextureIds.clear();
 }
 
 bool
-SenderHelper::IsTextureIdContainsInList(GLuint aTextureId)
+SenderHelper::HasTextureIdBeenSent(GLuint aTextureId)
 {
-    for (std::list<GLuint>::iterator it = sTextureIdList.begin();
-         it != sTextureIdList.end(); ++it) {
-        if (*it == aTextureId) {
-          return true;
-        }
-    }
-    return false;
+    return std::find(sSentTextureIds.begin(), sSentTextureIds.end(), aTextureId) != sSentTextureIds.end();
 }
 
 void
 SenderHelper::SendLayer(LayerComposite* aLayer,
                         int aWidth,
                         int aHeight)
 {
     MOZ_ASSERT(aLayer && aLayer->GetLayer());
@@ -1030,132 +1034,138 @@ SenderHelper::GetTextureID(GLContext* aG
 
     return texID;
 }
 
 void
 SenderHelper::SendTextureSource(GLContext* aGLContext,
                                 void* aLayerRef,
                                 TextureSourceOGL* aSource,
-                                GLuint aTexID,
-                                bool aFlipY)
+                                bool aFlipY,
+                                bool aIsMask)
 {
     MOZ_ASSERT(aGLContext);
     if (!aGLContext) {
         return;
     }
+    GLuint texID = GetTextureID(aGLContext, aSource);
+    if (HasTextureIdBeenSent(texID)) {
+        return;
+    }
 
     GLenum textureTarget = aSource->GetTextureTarget();
     ShaderConfigOGL config = ShaderConfigFromTargetAndFormat(textureTarget,
                                                              aSource->GetFormat());
     int shaderConfig = config.mFeatures;
 
     gfx::IntSize size = aSource->GetSize();
 
     // By sending 0 to ReadTextureImage rely upon aSource->BindTexture binding
     // texture correctly. texID is used for tracking in DebugGLTextureData.
     RefPtr<DataSourceSurface> img =
         aGLContext->ReadTexImageHelper()->ReadTexImage(0, textureTarget,
                                                          size,
                                                          shaderConfig, aFlipY);
     gLayerScopeManager.GetSocketManager()->AppendDebugData(
         new DebugGLTextureData(aGLContext, aLayerRef, textureTarget,
-                               aTexID, img));
+                               texID, img, aIsMask));
 
-    sTextureIdList.push_back(aTexID);
-    gLayerScopeManager.CurrentSession().mTexIDs.push_back(aTexID);
+    sSentTextureIds.push_back(texID);
+    gLayerScopeManager.CurrentSession().mTexIDs.push_back(texID);
 
 }
 
 #ifdef MOZ_WIDGET_GONK
 bool
-SenderHelper::SendGraphicBuffer(void* aLayerRef,
+SenderHelper::SendGraphicBuffer(GLContext* aGLContext,
+                                void* aLayerRef,
                                 TextureSourceOGL* aSource,
-                                GLuint aTexID,
-                                const TexturedEffect* aEffect) {
+                                const TexturedEffect* aEffect,
+                                bool aIsMask) {
+    GLuint texID = GetTextureID(aGLContext, aSource);
+    if (HasTextureIdBeenSent(texID)) {
+        return false;
+    }
     if (!aEffect->mState.mSurface.get()) {
         return false;
     }
 
     GLenum target = aSource->GetTextureTarget();
     mozilla::UniquePtr<DebugGLGraphicBuffer> package =
-        MakeUnique<DebugGLGraphicBuffer>(aLayerRef, target, aTexID, aEffect->mState);
+        MakeUnique<DebugGLGraphicBuffer>(aLayerRef, target, texID, aEffect->mState, aIsMask);
 
     // The texure content in this TexureHost is not altered,
     // we don't need to send it again.
     bool changed = gLayerScopeManager.GetContentMonitor()->IsChangedOrNew(
         aEffect->mState.mTexture);
     if (!package->TryPack(changed)) {
         return false;
     }
 
     // Transfer ownership to SocketManager.
     gLayerScopeManager.GetSocketManager()->AppendDebugData(package.release());
-    sTextureIdList.push_back(aTexID);
+    sSentTextureIds.push_back(texID);
 
-    gLayerScopeManager.CurrentSession().mTexIDs.push_back(aTexID);
+    gLayerScopeManager.CurrentSession().mTexIDs.push_back(texID);
 
     gLayerScopeManager.GetContentMonitor()->ClearChangedHost(aEffect->mState.mTexture);
     return true;
 }
 #endif
 
 void
 SenderHelper::SendTexturedEffect(GLContext* aGLContext,
                                  void* aLayerRef,
                                  const TexturedEffect* aEffect)
 {
     TextureSourceOGL* source = aEffect->mTexture->AsSourceOGL();
     if (!source) {
         return;
     }
 
-    GLuint texID = GetTextureID(aGLContext, source);
-    if (IsTextureIdContainsInList(texID)) {
-        return;
-    }
-
 #ifdef MOZ_WIDGET_GONK
-    if (SendGraphicBuffer(aLayerRef, source, texID, aEffect)) {
+    if (SendGraphicBuffer(aGLContext, aLayerRef, source, aEffect, false)) {
         return;
     }
 #endif
     // Fallback texture sending path.
     // Render to texture and read pixels back.
-    SendTextureSource(aGLContext, aLayerRef, source, texID, false);
+    SendTextureSource(aGLContext, aLayerRef, source, false, false);
+}
+
+void
+SenderHelper::SendMaskEffect(GLContext* aGLContext,
+                                 void* aLayerRef,
+                                 const EffectMask* aEffect)
+{
+    TextureSourceOGL* source = aEffect->mMaskTexture->AsSourceOGL();
+    if (!source) {
+        return;
+    }
+
+    SendTextureSource(aGLContext, aLayerRef, source, false, true);
 }
 
 void
 SenderHelper::SendYCbCrEffect(GLContext* aGLContext,
                               void* aLayerRef,
                               const EffectYCbCr* aEffect)
 {
     TextureSource* sourceYCbCr = aEffect->mTexture;
     if (!sourceYCbCr)
         return;
 
     const int Y = 0, Cb = 1, Cr = 2;
     TextureSourceOGL* sourceY =  sourceYCbCr->GetSubSource(Y)->AsSourceOGL();
     TextureSourceOGL* sourceCb = sourceYCbCr->GetSubSource(Cb)->AsSourceOGL();
     TextureSourceOGL* sourceCr = sourceYCbCr->GetSubSource(Cr)->AsSourceOGL();
 
-    GLuint texID = GetTextureID(aGLContext, sourceY);
-    if (!IsTextureIdContainsInList(texID)) {
-        SendTextureSource(aGLContext, aLayerRef, sourceY, texID, false);
-    }
-
-    texID = GetTextureID(aGLContext, sourceCb);
-    if (!IsTextureIdContainsInList(texID)) {
-        SendTextureSource(aGLContext, aLayerRef, sourceCb, texID, false);
-    }
-
-    texID = GetTextureID(aGLContext, sourceCr);
-    if (!IsTextureIdContainsInList(texID)) {
-        SendTextureSource(aGLContext, aLayerRef, sourceCr, texID, false);
-    }
+    SendTextureSource(aGLContext, aLayerRef, sourceY, false, false);
+    SendTextureSource(aGLContext, aLayerRef, sourceCb, false, false);
+    SendTextureSource(aGLContext, aLayerRef, sourceCr, false, false);
 }
 
 void
 SenderHelper::SendEffectChain(GLContext* aGLContext,
                               const EffectChain& aEffectChain,
                               int aWidth,
                               int aHeight)
 {
@@ -1183,18 +1193,21 @@ SenderHelper::SendEffectChain(GLContext*
             break;
         }
         case EffectTypes::COMPONENT_ALPHA:
         case EffectTypes::RENDER_TARGET:
         default:
             break;
     }
 
-    //const Effect* secondaryEffect = aEffectChain.mSecondaryEffects[EffectTypes::MASK];
-    // TODO:
+    if (aEffectChain.mSecondaryEffects[EffectTypes::MASK]) {
+        const EffectMask* effectMask =
+            static_cast<const EffectMask*>(aEffectChain.mSecondaryEffects[EffectTypes::MASK].get());
+        SendMaskEffect(aGLContext, aEffectChain.mLayerRef, effectMask);
+    }
 }
 
 void
 LayerScope::ContentChanged(TextureHost *host)
 {
     if (!CheckSendable()) {
       return;
     }
@@ -1867,17 +1880,17 @@ LayerScopeAutoFrame::~LayerScopeAutoFram
 }
 
 void
 LayerScopeAutoFrame::BeginFrame(int64_t aFrameStamp)
 {
     if (!LayerScope::CheckSendable()) {
         return;
     }
-    SenderHelper::ClearTextureIdList();
+    SenderHelper::ClearSentTextureIds();
 
     gLayerScopeManager.GetSocketManager()->AppendDebugData(
         new DebugGLFrameStatusData(Packet::FRAMESTART, aFrameStamp));
 }
 
 void
 LayerScopeAutoFrame::EndFrame()
 {

--- a/gfx/layers/TextureDIB.cpp
+++ b/gfx/layers/TextureDIB.cpp
@@ -48,16 +48,20 @@ TextureClientDIB::BorrowDrawTarget()
 {
   MOZ_ASSERT(mIsLocked && IsAllocated());
 
   if (!mDrawTarget) {
     mDrawTarget =
       gfxPlatform::GetPlatform()->CreateDrawTargetForSurface(mSurface, mSize);
   }
 
+  if (!mDrawTarget) {
+    gfxCriticalNote << "DIB failed draw target surface " << mSize << ", " << (int)mIsLocked << ", " << IsAllocated();
+  }
+
   return mDrawTarget;
 }
 
 void
 TextureClientDIB::UpdateFromSurface(gfx::SourceSurface* aSurface)
 {
   MOZ_ASSERT(mIsLocked && IsAllocated());
 

--- a/gfx/layers/d3d11/TextureD3D11.cpp
+++ b/gfx/layers/d3d11/TextureD3D11.cpp
@@ -419,17 +419,17 @@ TextureClientD3D11::BorrowDrawTarget()
   if (mTexture) {
     mDrawTarget = Factory::CreateDrawTargetForD3D11Texture(mTexture, mFormat);
   } else
   {
     MOZ_ASSERT(mTexture10);
     mDrawTarget = Factory::CreateDrawTargetForD3D10Texture(mTexture10, mFormat);
   }
   if (!mDrawTarget) {
-      gfxWarning() << "Invalid draw target for borrowing";
+    gfxCriticalNote << "Invalid draw target for borrowing D3D11 " << (int)mFormat;
   }
   return mDrawTarget;
 }
 
 void
 TextureClientD3D11::UpdateFromSurface(gfx::SourceSurface* aSurface)
 {
   RefPtr<DataSourceSurface> srcSurf = aSurface->GetDataSurface();