Merge m-c to fx-team.
authorRyan VanderMeulen <ryanvm@gmail.com>
Mon, 02 Jun 2014 17:22:45 -0400
changeset 205426 4c520a1107b69acf6ed65e4124d4737cc9e9b600
parent 205425 0b5b627caf3ab3b69e1ddacbe9495dcd9ea33e62 (current diff)
parent 205410 99137ca577706fe4563d9048641917654cd7ddf9 (diff)
child 205427 83ad75d867af7862a18a4b44a4874f5878c9024f
child 205484 5d9621220437aecf2155f88a847e0ff1fff74e49
push id3741
push userasasaki@mozilla.com
push dateMon, 21 Jul 2014 20:25:18 +0000
treeherdermozilla-beta@4d6f46f5af68 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone32.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Merge m-c to fx-team.
--- a/b2g/config/emulator-ics/sources.xml
+++ b/b2g/config/emulator-ics/sources.xml
@@ -14,23 +14,23 @@
   <!--original fetch url was git://github.com/apitrace/-->
   <remote fetch="https://git.mozilla.org/external/apitrace" name="apitrace"/>
   <default remote="caf" revision="refs/tags/android-4.0.4_r2.1" sync-j="4"/>
   <!-- Gonk specific things and forks -->
   <project name="platform_build" path="build" remote="b2g" revision="2a165bebfa19b11b697837409f9550dd2917c46c">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="82679a5ce84d1b6bf388da6536d5682a3ad56de3"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="8341cddb04773957069ac1334692a888b8bb1091"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="531cf670e485649c69746e46d567929fcd54cbc5"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="8e4420c0c5c8e8c8e58a000278a7129403769f96"/>
   <project name="platform_external_qemu" path="external/qemu" remote="b2g" revision="9100fa82fc355f5201e23e400fc6b40e875304ed"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="ce95d372e6d285725b96490afdaaf489ad8f9ca9"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="c629a8c1e0101d3937ceb4c52a60f7569b9d4243"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="600ef6ddc915ceffc1a89d51b7be8453fe709992"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="dd924f92906085b831bf1cbbc7484d3c043d613c"/>
   <project name="platform/bionic" path="bionic" revision="c72b8f6359de7ed17c11ddc9dfdde3f615d188a9"/>
   <project name="platform/bootable/recovery" path="bootable/recovery" revision="425f8b5fadf5889834c5acd27d23c9e0b2129c28"/>
   <project name="device/common" path="device/common" revision="42b808b7e93d0619286ae8e59110b176b7732389"/>
   <project name="device/sample" path="device/sample" revision="237bd668d0f114d801a8d6455ef5e02cc3577587"/>
   <project name="platform_external_apriori" path="external/apriori" remote="b2g" revision="11816ad0406744f963537b23d68ed9c2afb412bd"/>
   <project name="platform/external/bluetooth/bluez" path="external/bluetooth/bluez" revision="52a1a862a8bac319652b8f82d9541ba40bfa45ce"/>
--- a/b2g/config/emulator-jb/sources.xml
+++ b/b2g/config/emulator-jb/sources.xml
@@ -12,20 +12,20 @@
   <!--original fetch url was https://git.mozilla.org/releases-->
   <remote fetch="https://git.mozilla.org/releases" name="mozillaorg"/>
   <!-- B2G specific things. -->
   <project name="platform_build" path="build" remote="b2g" revision="6e2a3b589d1e8cc1d9df25f5e630ce30a0aa39f3">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="82679a5ce84d1b6bf388da6536d5682a3ad56de3"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="8341cddb04773957069ac1334692a888b8bb1091"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="531cf670e485649c69746e46d567929fcd54cbc5"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="ce95d372e6d285725b96490afdaaf489ad8f9ca9"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="c629a8c1e0101d3937ceb4c52a60f7569b9d4243"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="600ef6ddc915ceffc1a89d51b7be8453fe709992"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <!-- Stock Android things -->
   <project groups="linux" name="platform/prebuilts/clang/linux-x86/3.1" path="prebuilts/clang/linux-x86/3.1" revision="5c45f43419d5582949284eee9cef0c43d866e03b"/>
   <project groups="linux" name="platform/prebuilts/clang/linux-x86/3.2" path="prebuilts/clang/linux-x86/3.2" revision="3748b4168e7bd8d46457d4b6786003bc6a5223ce"/>
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" revision="9025e50b9d29b3cabbbb21e1dd94d0d13121a17e"/>
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" revision="b89fda71fcd0fa0cf969310e75be3ea33e048b44"/>
   <project groups="linux,arm" name="platform/prebuilts/gcc/linux-x86/arm/arm-eabi-4.7" path="prebuilts/gcc/linux-x86/arm/arm-eabi-4.7" revision="2e7d5348f35575870b3c7e567a9a9f6d66f8d6c5"/>
--- a/b2g/config/emulator-kk/sources.xml
+++ b/b2g/config/emulator-kk/sources.xml
@@ -10,25 +10,25 @@
   <!--original fetch url was git://codeaurora.org/-->
   <remote fetch="https://git.mozilla.org/external/caf" name="caf"/>
   <!--original fetch url was https://git.mozilla.org/releases-->
   <remote fetch="https://git.mozilla.org/releases" name="mozillaorg"/>
   <!-- B2G specific things. -->
   <project name="platform_build" path="build" remote="b2g" revision="276ce45e78b09c4a4ee643646f691d22804754c1">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="82679a5ce84d1b6bf388da6536d5682a3ad56de3"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="8341cddb04773957069ac1334692a888b8bb1091"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="531cf670e485649c69746e46d567929fcd54cbc5"/>
   <project name="librecovery" patch="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="ce95d372e6d285725b96490afdaaf489ad8f9ca9"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="c629a8c1e0101d3937ceb4c52a60f7569b9d4243"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="600ef6ddc915ceffc1a89d51b7be8453fe709992"/>
   <!-- Stock Android things -->
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" revision="f92a936f2aa97526d4593386754bdbf02db07a12"/>
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" revision="6e47ff2790f5656b5b074407829ceecf3e6188c4"/>
   <project groups="linux,arm" name="platform/prebuilts/gcc/linux-x86/arm/arm-eabi-4.7" path="prebuilts/gcc/linux-x86/arm/arm-eabi-4.7" revision="1950e4760fa14688b83cdbb5acaa1af9f82ef434"/>
   <project groups="linux,arm" name="platform/prebuilts/gcc/linux-x86/arm/arm-linux-androideabi-4.7" path="prebuilts/gcc/linux-x86/arm/arm-linux-androideabi-4.7" revision="ac6eb97a37035c09fb5ede0852f0881e9aadf9ad"/>
   <project groups="linux,x86" name="platform/prebuilts/gcc/linux-x86/x86/i686-linux-android-4.7" path="prebuilts/gcc/linux-x86/x86/i686-linux-android-4.7" revision="737f591c5f95477148d26602c7be56cbea0cdeb9"/>
   <project groups="linux,x86" name="platform/prebuilts/python/linux-x86/2.7.5" path="prebuilts/python/linux-x86/2.7.5" revision="51da9b1981be481b92a59a826d4d78dc73d0989a"/>
   <project name="device/common" path="device/common" revision="798a3664597e6041985feab9aef42e98d458bc3d"/>
--- a/b2g/config/emulator/sources.xml
+++ b/b2g/config/emulator/sources.xml
@@ -14,23 +14,23 @@
   <!--original fetch url was git://github.com/apitrace/-->
   <remote fetch="https://git.mozilla.org/external/apitrace" name="apitrace"/>
   <default remote="caf" revision="refs/tags/android-4.0.4_r2.1" sync-j="4"/>
   <!-- Gonk specific things and forks -->
   <project name="platform_build" path="build" remote="b2g" revision="2a165bebfa19b11b697837409f9550dd2917c46c">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="82679a5ce84d1b6bf388da6536d5682a3ad56de3"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="8341cddb04773957069ac1334692a888b8bb1091"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="531cf670e485649c69746e46d567929fcd54cbc5"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="8e4420c0c5c8e8c8e58a000278a7129403769f96"/>
   <project name="platform_external_qemu" path="external/qemu" remote="b2g" revision="9100fa82fc355f5201e23e400fc6b40e875304ed"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="ce95d372e6d285725b96490afdaaf489ad8f9ca9"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="c629a8c1e0101d3937ceb4c52a60f7569b9d4243"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="600ef6ddc915ceffc1a89d51b7be8453fe709992"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="dd924f92906085b831bf1cbbc7484d3c043d613c"/>
   <project name="platform/bionic" path="bionic" revision="c72b8f6359de7ed17c11ddc9dfdde3f615d188a9"/>
   <project name="platform/bootable/recovery" path="bootable/recovery" revision="425f8b5fadf5889834c5acd27d23c9e0b2129c28"/>
   <project name="device/common" path="device/common" revision="42b808b7e93d0619286ae8e59110b176b7732389"/>
   <project name="device/sample" path="device/sample" revision="237bd668d0f114d801a8d6455ef5e02cc3577587"/>
   <project name="platform_external_apriori" path="external/apriori" remote="b2g" revision="11816ad0406744f963537b23d68ed9c2afb412bd"/>
   <project name="platform/external/bluetooth/bluez" path="external/bluetooth/bluez" revision="52a1a862a8bac319652b8f82d9541ba40bfa45ce"/>
--- a/b2g/config/flame/sources.xml
+++ b/b2g/config/flame/sources.xml
@@ -12,20 +12,20 @@
   <!--original fetch url was https://git.mozilla.org/releases-->
   <remote fetch="https://git.mozilla.org/releases" name="mozillaorg"/>
   <!-- B2G specific things. -->
   <project name="platform_build" path="build" remote="b2g" revision="6e2a3b589d1e8cc1d9df25f5e630ce30a0aa39f3">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="82679a5ce84d1b6bf388da6536d5682a3ad56de3"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="8341cddb04773957069ac1334692a888b8bb1091"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="531cf670e485649c69746e46d567929fcd54cbc5"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="ce95d372e6d285725b96490afdaaf489ad8f9ca9"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="c629a8c1e0101d3937ceb4c52a60f7569b9d4243"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="600ef6ddc915ceffc1a89d51b7be8453fe709992"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <!-- Stock Android things -->
   <project groups="linux" name="platform/prebuilts/clang/linux-x86/3.1" path="prebuilts/clang/linux-x86/3.1" revision="e95b4ce22c825da44d14299e1190ea39a5260bde"/>
   <project groups="linux" name="platform/prebuilts/clang/linux-x86/3.2" path="prebuilts/clang/linux-x86/3.2" revision="471afab478649078ad7c75ec6b252481a59e19b8"/>
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" revision="95bb5b66b3ec5769c3de8d3f25d681787418e7d2"/>
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" revision="ebdad82e61c16772f6cd47e9f11936bf6ebe9aa0"/>
   <project groups="linux,arm" name="platform/prebuilts/gcc/linux-x86/arm/arm-eabi-4.7" path="prebuilts/gcc/linux-x86/arm/arm-eabi-4.7" revision="8b880805d454664b3eed11d0f053cdeafa1ff06e"/>
@@ -113,17 +113,17 @@
   <project name="platform/system/media" path="system/media" revision="df2cdd433738a891102873710bdd3c3db7adb0cc"/>
   <project name="platform/system/netd" path="system/netd" revision="ea8103eae5642621ca8202e00620f4ca954ed413"/>
   <project name="platform/system/security" path="system/security" revision="360f51f7af191316cd739f229db1c5f7233be063"/>
   <project name="platform/system/vold" path="system/vold" revision="153df4d067a4149c7d78f1c92fed2ce2bd6a272e"/>
   <default remote="caf" revision="jb_3.2" sync-j="4"/>
   <!-- Flame specific things -->
   <project name="device/generic/armv7-a-neon" path="device/generic/armv7-a-neon" revision="e8a318f7690092e639ba88891606f4183e846d3f"/>
   <project name="device/qcom/common" path="device/qcom/common" revision="34ed8345250bb97262d70a052217a92e83444ede"/>
-  <project name="device-flame" path="device/t2m/flame" remote="b2g" revision="76f960b9512ec5c4726b5f52dd94bdf3c07e5071"/>
+  <project name="device-flame" path="device/t2m/flame" remote="b2g" revision="75c65fce94693c9b990a7b1dab751bd2a536559b"/>
   <project name="kernel/msm" path="kernel" revision="228d59147ff524e90774c566eef03260cc6857b8"/>
   <project name="platform/bootable/recovery" path="bootable/recovery" revision="f2914eacee9120680a41463708bb6ee8291749fc"/>
   <project name="platform/external/bluetooth/bluedroid" path="external/bluetooth/bluedroid" revision="81c4a859d75d413ad688067829d21b7ba9205f81"/>
   <project name="platform/external/bluetooth/bluez" path="external/bluetooth/bluez" revision="f0689ac1914cdbc59e53bdc9edd9013dc157c299"/>
   <project name="platform/external/bluetooth/glib" path="external/bluetooth/glib" revision="dd925f76e4f149c3d5571b80e12f7e24bbe89c59"/>
   <project name="platform/external/dbus" path="external/dbus" revision="ea87119c843116340f5df1d94eaf8275e1055ae8"/>
   <project name="platform/external/libnfc-nci" path="external/libnfc-nci" revision="494c177966fdc31183a5f7af82dc9130f523da4b"/>
   <project name="platform/external/wpa_supplicant_8" path="external/wpa_supplicant_8" revision="320b05a5761eb2a4816f7529c91ea49422979b55"/>
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,9 +1,9 @@
 {
     "git": {
         "git_revision": "", 
         "remote": "", 
         "branch": ""
     }, 
-    "revision": "01ae06e7d0c3c72d51e6801986339d6c06229c9b", 
+    "revision": "e204b914c3ddada45ae5ff5c9fc5e8f55f906ca7", 
     "repo_path": "/integration/gaia-central"
 }
--- a/b2g/config/hamachi/sources.xml
+++ b/b2g/config/hamachi/sources.xml
@@ -12,22 +12,22 @@
   <!--original fetch url was git://github.com/apitrace/-->
   <remote fetch="https://git.mozilla.org/external/apitrace" name="apitrace"/>
   <default remote="caf" revision="b2g/ics_strawberry" sync-j="4"/>
   <!-- Gonk specific things and forks -->
   <project name="platform_build" path="build" remote="b2g" revision="2a165bebfa19b11b697837409f9550dd2917c46c">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="82679a5ce84d1b6bf388da6536d5682a3ad56de3"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="8341cddb04773957069ac1334692a888b8bb1091"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="531cf670e485649c69746e46d567929fcd54cbc5"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="ce95d372e6d285725b96490afdaaf489ad8f9ca9"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="c629a8c1e0101d3937ceb4c52a60f7569b9d4243"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="600ef6ddc915ceffc1a89d51b7be8453fe709992"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="6426040f1be4a844082c9769171ce7f5341a5528"/>
   <project name="platform/bionic" path="bionic" revision="d2eb6c7b6e1bc7643c17df2d9d9bcb1704d0b9ab"/>
   <project name="platform/bootable/recovery" path="bootable/recovery" revision="746bc48f34f5060f90801925dcdd964030c1ab6d"/>
   <project name="platform/development" path="development" revision="2460485184bc8535440bb63876d4e63ec1b4770c"/>
   <project name="device/common" path="device/common" revision="0dcc1e03659db33b77392529466f9eb685cdd3c7"/>
   <project name="device/sample" path="device/sample" revision="68b1cb978a20806176123b959cb05d4fa8adaea4"/>
   <project name="platform_external_apriori" path="external/apriori" remote="b2g" revision="11816ad0406744f963537b23d68ed9c2afb412bd"/>
--- a/b2g/config/helix/sources.xml
+++ b/b2g/config/helix/sources.xml
@@ -10,17 +10,17 @@
   <!--original fetch url was https://git.mozilla.org/releases-->
   <remote fetch="https://git.mozilla.org/releases" name="mozillaorg"/>
   <default remote="caf" revision="b2g/ics_strawberry" sync-j="4"/>
   <!-- Gonk specific things and forks -->
   <project name="platform_build" path="build" remote="b2g" revision="2a165bebfa19b11b697837409f9550dd2917c46c">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="82679a5ce84d1b6bf388da6536d5682a3ad56de3"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="8341cddb04773957069ac1334692a888b8bb1091"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="531cf670e485649c69746e46d567929fcd54cbc5"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="ce95d372e6d285725b96490afdaaf489ad8f9ca9"/>
   <project name="gonk-patches" path="patches" remote="b2g" revision="223a2421006e8f5da33f516f6891c87cae86b0f6"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="6426040f1be4a844082c9769171ce7f5341a5528"/>
   <project name="platform/bionic" path="bionic" revision="d2eb6c7b6e1bc7643c17df2d9d9bcb1704d0b9ab"/>
--- a/b2g/config/nexus-4/sources.xml
+++ b/b2g/config/nexus-4/sources.xml
@@ -12,20 +12,20 @@
   <!--original fetch url was https://git.mozilla.org/releases-->
   <remote fetch="https://git.mozilla.org/releases" name="mozillaorg"/>
   <!-- B2G specific things. -->
   <project name="platform_build" path="build" remote="b2g" revision="6e2a3b589d1e8cc1d9df25f5e630ce30a0aa39f3">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="82679a5ce84d1b6bf388da6536d5682a3ad56de3"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="8341cddb04773957069ac1334692a888b8bb1091"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="531cf670e485649c69746e46d567929fcd54cbc5"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="ce95d372e6d285725b96490afdaaf489ad8f9ca9"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="c629a8c1e0101d3937ceb4c52a60f7569b9d4243"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="600ef6ddc915ceffc1a89d51b7be8453fe709992"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <!-- Stock Android things -->
   <project groups="linux" name="platform/prebuilts/clang/linux-x86/3.1" path="prebuilts/clang/linux-x86/3.1" revision="5c45f43419d5582949284eee9cef0c43d866e03b"/>
   <project groups="linux" name="platform/prebuilts/clang/linux-x86/3.2" path="prebuilts/clang/linux-x86/3.2" revision="3748b4168e7bd8d46457d4b6786003bc6a5223ce"/>
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" revision="9025e50b9d29b3cabbbb21e1dd94d0d13121a17e"/>
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" revision="b89fda71fcd0fa0cf969310e75be3ea33e048b44"/>
   <project groups="linux,arm" name="platform/prebuilts/gcc/linux-x86/arm/arm-eabi-4.7" path="prebuilts/gcc/linux-x86/arm/arm-eabi-4.7" revision="2e7d5348f35575870b3c7e567a9a9f6d66f8d6c5"/>
--- a/b2g/config/wasabi/sources.xml
+++ b/b2g/config/wasabi/sources.xml
@@ -12,22 +12,22 @@
   <!--original fetch url was git://github.com/apitrace/-->
   <remote fetch="https://git.mozilla.org/external/apitrace" name="apitrace"/>
   <default remote="caf" revision="ics_chocolate_rb4.2" sync-j="4"/>
   <!-- Gonk specific things and forks -->
   <project name="platform_build" path="build" remote="b2g" revision="2a165bebfa19b11b697837409f9550dd2917c46c">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="82679a5ce84d1b6bf388da6536d5682a3ad56de3"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="8341cddb04773957069ac1334692a888b8bb1091"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="531cf670e485649c69746e46d567929fcd54cbc5"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="ce95d372e6d285725b96490afdaaf489ad8f9ca9"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="c629a8c1e0101d3937ceb4c52a60f7569b9d4243"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="600ef6ddc915ceffc1a89d51b7be8453fe709992"/>
   <project name="gonk-patches" path="patches" remote="b2g" revision="223a2421006e8f5da33f516f6891c87cae86b0f6"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="6426040f1be4a844082c9769171ce7f5341a5528"/>
   <project name="platform/bionic" path="bionic" revision="cd5dfce80bc3f0139a56b58aca633202ccaee7f8"/>
   <project name="platform/bootable/recovery" path="bootable/recovery" revision="e0a9ac010df3afaa47ba107192c05ac8b5516435"/>
   <project name="platform/development" path="development" revision="a384622f5fcb1d2bebb9102591ff7ae91fe8ed2d"/>
   <project name="device/common" path="device/common" revision="7c65ea240157763b8ded6154a17d3c033167afb7"/>
   <project name="device/sample" path="device/sample" revision="c328f3d4409db801628861baa8d279fb8855892f"/>
--- a/b2g/confvars.sh
+++ b/b2g/confvars.sh
@@ -61,8 +61,11 @@ MOZ_NUWA_PROCESS=1
 fi
 MOZ_FOLD_LIBS=1
 
 MOZ_JSDOWNLOADS=1
 
 MOZ_SERVICES_FXACCOUNTS=1
 
 MOZ_BUNDLED_FONTS=1
+
+# Enable exact rooting on b2g.
+JSGC_USE_EXACT_ROOTING=1
--- a/browser/components/shell/src/nsGNOMEShellService.h
+++ b/browser/components/shell/src/nsGNOMEShellService.h
@@ -13,24 +13,24 @@
 class nsGNOMEShellService MOZ_FINAL : public nsIShellService
 {
 public:
   nsGNOMEShellService() : mCheckedThisSession(false), mAppIsInPath(false) { }
 
   NS_DECL_ISUPPORTS
   NS_DECL_NSISHELLSERVICE
 
-  nsresult Init() NS_HIDDEN;
+  nsresult Init();
 
 private:
   ~nsGNOMEShellService() {}
 
-  NS_HIDDEN_(bool) KeyMatchesAppName(const char *aKeyValue) const;
-  NS_HIDDEN_(bool) CheckHandlerMatchesAppName(const nsACString& handler) const;
+  bool KeyMatchesAppName(const char *aKeyValue) const;
+  bool CheckHandlerMatchesAppName(const nsACString& handler) const;
 
-  NS_HIDDEN_(bool) GetAppPathFromLauncher();
+  bool GetAppPathFromLauncher();
   bool mCheckedThisSession;
   bool mUseLocaleFilenames;
   nsCString    mAppPath;
   bool mAppIsInPath;
 };
 
 #endif // nsgnomeshellservice_h____
--- a/content/base/public/Element.h
+++ b/content/base/public/Element.h
@@ -944,30 +944,30 @@ public:
   /**
    * Helper method for NS_IMPL_BOOL_ATTR macro.
    * Gets value of boolean attribute. Only works for attributes in null
    * namespace.
    *
    * @param aAttr    name of attribute.
    * @param aValue   Boolean value of attribute.
    */
-  NS_HIDDEN_(bool) GetBoolAttr(nsIAtom* aAttr) const
+  bool GetBoolAttr(nsIAtom* aAttr) const
   {
     return HasAttr(kNameSpaceID_None, aAttr);
   }
 
   /**
    * Helper method for NS_IMPL_BOOL_ATTR macro.
    * Sets value of boolean attribute by removing attribute or setting it to
    * the empty string. Only works for attributes in null namespace.
    *
    * @param aAttr    name of attribute.
    * @param aValue   Boolean value of attribute.
    */
-  NS_HIDDEN_(nsresult) SetBoolAttr(nsIAtom* aAttr, bool aValue);
+  nsresult SetBoolAttr(nsIAtom* aAttr, bool aValue);
 
   /**
    * Retrieve the ratio of font-size-inflated text font size to computed font
    * size for this element. This will query the element for its primary frame,
    * and then use this to get font size inflation information about the frame.
    *
    * @returns The font size inflation ratio (inflated font size to uninflated
    *          font size) for the primary frame of this element. Returns 1.0
--- a/content/base/public/nsXMLNameSpaceMap.h
+++ b/content/base/public/nsXMLNameSpaceMap.h
@@ -26,49 +26,49 @@ struct nsNameSpaceEntry
  */
 class nsXMLNameSpaceMap
 {
 public:
   /**
    * Allocates a new nsXMLNameSpaceMap (with new()) and if aForXML is
    * true initializes it with the xmlns and xml namespaces.
    */
-  static NS_HIDDEN_(nsXMLNameSpaceMap*) Create(bool aForXML);
+  static nsXMLNameSpaceMap* Create(bool aForXML);
 
   /**
    * Add a prefix and its corresponding namespace ID to the map.
    * Passing a null |aPrefix| corresponds to the default namespace, which may
    * be set to something other than kNameSpaceID_None.
    */
-  NS_HIDDEN_(nsresult) AddPrefix(nsIAtom *aPrefix, int32_t aNameSpaceID);
+  nsresult AddPrefix(nsIAtom *aPrefix, int32_t aNameSpaceID);
 
   /**
    * Add a prefix and a namespace URI to the map.  The URI will be converted
    * to its corresponding namespace ID.
    */
-  NS_HIDDEN_(nsresult) AddPrefix(nsIAtom *aPrefix, nsString &aURI);
+  nsresult AddPrefix(nsIAtom *aPrefix, nsString &aURI);
 
   /*
    * Returns the namespace ID for the given prefix, if it is in the map.
    * If |aPrefix| is null and is not in the map, then a null namespace
    * (kNameSpaceID_None) is returned.  If |aPrefix| is non-null and is not in
    * the map, then kNameSpaceID_Unknown is returned.
    */
-  NS_HIDDEN_(int32_t) FindNameSpaceID(nsIAtom *aPrefix) const;
+  int32_t FindNameSpaceID(nsIAtom *aPrefix) const;
 
   /**
    * If the given namespace ID is in the map, then the first prefix which
    * maps to that namespace is returned.  Otherwise, null is returned.
    */
-  NS_HIDDEN_(nsIAtom*) FindPrefix(int32_t aNameSpaceID) const;
+  nsIAtom* FindPrefix(int32_t aNameSpaceID) const;
 
   /* Removes all prefix mappings. */
-  NS_HIDDEN_(void) Clear();
+  void Clear();
 
   ~nsXMLNameSpaceMap() { Clear(); }
 
 private:
-  nsXMLNameSpaceMap() NS_HIDDEN;  // use Create() to create new instances
+  nsXMLNameSpaceMap();  // use Create() to create new instances
 
   nsTArray<nsNameSpaceEntry> mNameSpaces;
 };
 
 #endif
--- a/content/base/src/nsContentList.h
+++ b/content/base/src/nsContentList.h
@@ -279,19 +279,19 @@ public:
     mozilla::dom::Element* item = NamedItem(aName, true);
     aFound = !!item;
     return item;
   }
   virtual void GetSupportedNames(unsigned aFlags,
                                  nsTArray<nsString>& aNames) MOZ_OVERRIDE;
 
   // nsContentList public methods
-  NS_HIDDEN_(uint32_t) Length(bool aDoFlush);
-  NS_HIDDEN_(nsIContent*) Item(uint32_t aIndex, bool aDoFlush);
-  NS_HIDDEN_(mozilla::dom::Element*)
+  uint32_t Length(bool aDoFlush);
+  nsIContent* Item(uint32_t aIndex, bool aDoFlush);
+  mozilla::dom::Element*
   NamedItem(const nsAString& aName, bool aDoFlush);
 
   // nsIMutationObserver
   NS_DECL_NSIMUTATIONOBSERVER_ATTRIBUTECHANGED
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTAPPENDED
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTINSERTED
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTREMOVED
   NS_DECL_NSIMUTATIONOBSERVER_NODEWILLBEDESTROYED
--- a/content/base/src/nsContentSink.h
+++ b/content/base/src/nsContentSink.h
@@ -87,23 +87,23 @@ class nsContentSink : public nsICSSLoade
 
   // nsICSSLoaderObserver
   NS_IMETHOD StyleSheetLoaded(nsCSSStyleSheet* aSheet, bool aWasAlternate,
                               nsresult aStatus) MOZ_OVERRIDE;
 
   virtual nsresult ProcessMETATag(nsIContent* aContent);
 
   // nsIContentSink implementation helpers
-  NS_HIDDEN_(nsresult) WillParseImpl(void);
-  NS_HIDDEN_(nsresult) WillInterruptImpl(void);
-  NS_HIDDEN_(nsresult) WillResumeImpl(void);
-  NS_HIDDEN_(nsresult) DidProcessATokenImpl(void);
-  NS_HIDDEN_(void) WillBuildModelImpl(void);
-  NS_HIDDEN_(void) DidBuildModelImpl(bool aTerminated);
-  NS_HIDDEN_(void) DropParserAndPerfHint(void);
+  nsresult WillParseImpl(void);
+  nsresult WillInterruptImpl(void);
+  nsresult WillResumeImpl(void);
+  nsresult DidProcessATokenImpl(void);
+  void WillBuildModelImpl(void);
+  void DidBuildModelImpl(bool aTerminated);
+  void DropParserAndPerfHint(void);
   bool IsScriptExecutingImpl();
 
   void NotifyAppend(nsIContent* aContent, uint32_t aStartIndex);
 
   // nsIDocumentObserver
   NS_DECL_NSIDOCUMENTOBSERVER_BEGINUPDATE
   NS_DECL_NSIDOCUMENTOBSERVER_ENDUPDATE
 
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -315,17 +315,17 @@ struct FireChangeArgs {
   Element* mTo;
   bool mImageOnly;
   bool mHaveImageOverride;
 };
 
 // XXX Workaround for bug 980560 to maintain the existing broken semantics
 template<>
 struct nsIStyleRule::COMTypeInfo<css::Rule, void> {
-  static const nsIID kIID NS_HIDDEN;
+  static const nsIID kIID;
 };
 const nsIID nsIStyleRule::COMTypeInfo<css::Rule, void>::kIID = NS_ISTYLE_RULE_IID;
 
 namespace mozilla {
 namespace dom {
 
 static PLDHashOperator
 CustomDefinitionsTraverse(CustomElementHashKey* aKey,
--- a/content/base/src/nsDocument.h
+++ b/content/base/src/nsDocument.h
@@ -964,63 +964,63 @@ public:
   NS_DECL_NSIDOMXPATHEVALUATOR
 
   virtual nsresult Init();
 
   virtual nsresult CreateElem(const nsAString& aName, nsIAtom *aPrefix,
                               int32_t aNamespaceID,
                               nsIContent **aResult) MOZ_OVERRIDE;
 
-  virtual NS_HIDDEN_(void) Sanitize();
+  virtual void Sanitize();
 
-  virtual NS_HIDDEN_(void) EnumerateSubDocuments(nsSubDocEnumFunc aCallback,
+  virtual void EnumerateSubDocuments(nsSubDocEnumFunc aCallback,
                                                  void *aData);
 
-  virtual NS_HIDDEN_(bool) CanSavePresentation(nsIRequest *aNewRequest);
-  virtual NS_HIDDEN_(void) Destroy();
-  virtual NS_HIDDEN_(void) RemovedFromDocShell();
-  virtual NS_HIDDEN_(already_AddRefed<nsILayoutHistoryState>) GetLayoutHistoryState() const;
+  virtual bool CanSavePresentation(nsIRequest *aNewRequest);
+  virtual void Destroy();
+  virtual void RemovedFromDocShell();
+  virtual already_AddRefed<nsILayoutHistoryState> GetLayoutHistoryState() const;
 
-  virtual NS_HIDDEN_(void) BlockOnload();
-  virtual NS_HIDDEN_(void) UnblockOnload(bool aFireSync);
+  virtual void BlockOnload();
+  virtual void UnblockOnload(bool aFireSync);
 
-  virtual NS_HIDDEN_(void) AddStyleRelevantLink(mozilla::dom::Link* aLink);
-  virtual NS_HIDDEN_(void) ForgetLink(mozilla::dom::Link* aLink);
+  virtual void AddStyleRelevantLink(mozilla::dom::Link* aLink);
+  virtual void ForgetLink(mozilla::dom::Link* aLink);
 
-  NS_HIDDEN_(void) ClearBoxObjectFor(nsIContent* aContent);
+  void ClearBoxObjectFor(nsIContent* aContent);
   already_AddRefed<nsIBoxObject> GetBoxObjectFor(mozilla::dom::Element* aElement,
                                                  mozilla::ErrorResult& aRv) MOZ_OVERRIDE;
 
-  virtual NS_HIDDEN_(Element*)
+  virtual Element*
     GetAnonymousElementByAttribute(nsIContent* aElement,
                                    nsIAtom* aAttrName,
                                    const nsAString& aAttrValue) const;
 
-  virtual NS_HIDDEN_(Element*) ElementFromPointHelper(float aX, float aY,
+  virtual Element* ElementFromPointHelper(float aX, float aY,
                                                       bool aIgnoreRootScrollFrame,
                                                       bool aFlushLayout);
 
-  virtual NS_HIDDEN_(nsresult) NodesFromRectHelper(float aX, float aY,
+  virtual nsresult NodesFromRectHelper(float aX, float aY,
                                                    float aTopSize, float aRightSize,
                                                    float aBottomSize, float aLeftSize,
                                                    bool aIgnoreRootScrollFrame,
                                                    bool aFlushLayout,
                                                    nsIDOMNodeList** aReturn);
 
-  virtual NS_HIDDEN_(void) FlushSkinBindings();
+  virtual void FlushSkinBindings();
 
-  virtual NS_HIDDEN_(nsresult) InitializeFrameLoader(nsFrameLoader* aLoader);
-  virtual NS_HIDDEN_(nsresult) FinalizeFrameLoader(nsFrameLoader* aLoader);
-  virtual NS_HIDDEN_(void) TryCancelFrameLoaderInitialization(nsIDocShell* aShell);
-  virtual NS_HIDDEN_(bool) FrameLoaderScheduledToBeFinalized(nsIDocShell* aShell);
-  virtual NS_HIDDEN_(nsIDocument*)
+  virtual nsresult InitializeFrameLoader(nsFrameLoader* aLoader);
+  virtual nsresult FinalizeFrameLoader(nsFrameLoader* aLoader);
+  virtual void TryCancelFrameLoaderInitialization(nsIDocShell* aShell);
+  virtual bool FrameLoaderScheduledToBeFinalized(nsIDocShell* aShell);
+  virtual nsIDocument*
     RequestExternalResource(nsIURI* aURI,
                             nsINode* aRequestingNode,
                             ExternalResourceLoad** aPendingLoad);
-  virtual NS_HIDDEN_(void)
+  virtual void
     EnumerateExternalResources(nsSubDocEnumFunc aCallback, void* aData);
 
   nsTArray<nsCString> mHostObjectURIs;
 
   // Returns our (lazily-initialized) animation controller.
   // If HasAnimationController is true, this is guaranteed to return non-null.
   nsSMILAnimationController* GetAnimationController() MOZ_OVERRIDE;
 
@@ -1094,19 +1094,19 @@ public:
 
   virtual Element *GetElementById(const nsAString& aElementId) MOZ_OVERRIDE;
   virtual const nsSmallVoidArray* GetAllElementsForId(const nsAString& aElementId) const MOZ_OVERRIDE;
 
   virtual Element *LookupImageElement(const nsAString& aElementId) MOZ_OVERRIDE;
   virtual void MozSetImageElement(const nsAString& aImageElementId,
                                   Element* aElement) MOZ_OVERRIDE;
 
-  virtual NS_HIDDEN_(nsresult) AddImage(imgIRequest* aImage);
-  virtual NS_HIDDEN_(nsresult) RemoveImage(imgIRequest* aImage, uint32_t aFlags);
-  virtual NS_HIDDEN_(nsresult) SetImageLockingState(bool aLocked);
+  virtual nsresult AddImage(imgIRequest* aImage);
+  virtual nsresult RemoveImage(imgIRequest* aImage, uint32_t aFlags);
+  virtual nsresult SetImageLockingState(bool aLocked);
 
   // AddPlugin adds a plugin-related element to mPlugins when the element is
   // added to the tree.
   virtual nsresult AddPlugin(nsIObjectLoadingContent* aPlugin) MOZ_OVERRIDE;
   // RemovePlugin removes a plugin-related element to mPlugins when the
   // element is removed from the tree.
   virtual void RemovePlugin(nsIObjectLoadingContent* aPlugin) MOZ_OVERRIDE;
   // GetPlugins returns the plugin-related elements from
--- a/content/base/src/nsFrameLoader.h
+++ b/content/base/src/nsFrameLoader.h
@@ -169,17 +169,17 @@ public:
   static nsFrameLoader* Create(mozilla::dom::Element* aOwner,
                                bool aNetworkCreated);
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(nsFrameLoader, nsIFrameLoader)
   NS_DECL_NSIFRAMELOADER
   NS_DECL_NSICONTENTVIEWMANAGER
   NS_DECL_NSIMUTATIONOBSERVER_ATTRIBUTECHANGED
-  NS_HIDDEN_(nsresult) CheckForRecursiveLoad(nsIURI* aURI);
+  nsresult CheckForRecursiveLoad(nsIURI* aURI);
   nsresult ReallyStartLoading();
   void Finalize();
   nsIDocShell* GetExistingDocShell() { return mDocShell; }
   mozilla::dom::EventTarget* GetTabChildGlobalAsEventTarget();
   nsresult CreateStaticClone(nsIFrameLoader* aDest);
 
   /**
    * MessageManagerCallback methods that we override.
@@ -367,17 +367,17 @@ private:
   nsresult MaybeCreateDocShell();
   nsresult EnsureMessageManager();
 
   // Properly retrieves documentSize of any subdocument type.
   nsresult GetWindowDimensions(nsRect& aRect);
 
   // Updates the subdocument position and size. This gets called only
   // when we have our own in-process DocShell.
-  NS_HIDDEN_(nsresult) UpdateBaseWindowPositionAndSize(nsSubDocumentFrame *aIFrame);
+  nsresult UpdateBaseWindowPositionAndSize(nsSubDocumentFrame *aIFrame);
   nsresult CheckURILoad(nsIURI* aURI);
   void FireErrorEvent();
   nsresult ReallyStartLoadingInternal();
 
   // Return true if remote browser created; nothing else to do
   bool TryRemoteBrowser();
 
   // Tell the remote browser that it's now "virtually visible"
--- a/content/base/src/nsGkAtomList.h
+++ b/content/base/src/nsGkAtomList.h
@@ -647,16 +647,17 @@ GK_ATOM(observes, "observes")
 GK_ATOM(odd, "odd")
 GK_ATOM(OFF, "OFF")
 GK_ATOM(ol, "ol")
 GK_ATOM(omitXmlDeclaration, "omit-xml-declaration")
 GK_ATOM(ona2dpstatuschanged, "ona2dpstatuschanged")
 GK_ATOM(onabort, "onabort")
 GK_ATOM(onactivate, "onactivate")
 GK_ATOM(onadapteradded, "onadapteradded")
+GK_ATOM(onadapterremoved, "onadapterremoved")
 GK_ATOM(onafterprint, "onafterprint")
 GK_ATOM(onafterscriptexecute, "onafterscriptexecute")
 GK_ATOM(onalerting, "onalerting")
 GK_ATOM(onanimationend, "onanimationend")
 GK_ATOM(onanimationiteration, "onanimationiteration")
 GK_ATOM(onanimationstart, "onanimationstart")
 GK_ATOM(onantennaavailablechange, "onantennaavailablechange")
 GK_ATOM(onAppCommand, "onAppCommand")
--- a/content/base/src/nsPropertyTable.cpp
+++ b/content/base/src/nsPropertyTable.cpp
@@ -35,27 +35,27 @@ struct PropertyListMapEntry : public PLD
 
 //----------------------------------------------------------------------
 
 class nsPropertyTable::PropertyList {
 public:
   PropertyList(nsIAtom*           aName,
                NSPropertyDtorFunc aDtorFunc,
                void*              aDtorData,
-               bool               aTransfer) NS_HIDDEN;
-  ~PropertyList() NS_HIDDEN;
+               bool               aTransfer);
+  ~PropertyList();
 
   // Removes the property associated with the given object, and destroys
   // the property value
-  NS_HIDDEN_(bool) DeletePropertyFor(nsPropertyOwner aObject);
+  bool DeletePropertyFor(nsPropertyOwner aObject);
 
   // Destroy all remaining properties (without removing them)
-  NS_HIDDEN_(void) Destroy();
+  void Destroy();
 
-  NS_HIDDEN_(bool) Equals(nsIAtom *aPropertyName)
+  bool Equals(nsIAtom *aPropertyName)
   {
     return mName == aPropertyName;
   }
 
   size_t SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf);
 
   nsCOMPtr<nsIAtom>  mName;           // property name
   PLDHashTable       mObjectValueMap; // map of object/value pairs
--- a/content/base/src/nsPropertyTable.h
+++ b/content/base/src/nsPropertyTable.h
@@ -88,33 +88,33 @@ class nsPropertyTable
    * it will contain the old value after the function returns (the destructor
    * for the old value will not be run in that case). If |aTransfer| is true
    * the property will be transfered to the new table when the property table
    * for |aObject| changes (currently the tables for nodes are owned by their
    * ownerDocument, so if the ownerDocument for a node changes, its property
    * table changes too). If |aTransfer| is false the property will just be
    * deleted instead.
    */
-  NS_HIDDEN_(nsresult) SetProperty(nsPropertyOwner     aObject,
+  nsresult SetProperty(nsPropertyOwner     aObject,
                                    nsIAtom            *aPropertyName,
                                    void               *aPropertyValue,
                                    NSPropertyDtorFunc  aDtor,
                                    void               *aDtorData,
                                    bool                aTransfer = false,
                                    void              **aOldValue = nullptr)
   {
     return SetPropertyInternal(aObject, aPropertyName, aPropertyValue,
                                aDtor, aDtorData, aTransfer, aOldValue);
   }
 
   /**
    * Delete the property |aPropertyName| in the global category for object
    * |aObject|. The property's destructor function will be called.
    */
-  NS_HIDDEN_(nsresult) DeleteProperty(nsPropertyOwner aObject,
+  nsresult DeleteProperty(nsPropertyOwner aObject,
                                       nsIAtom    *aPropertyName);
 
   /**
    * Unset the property |aPropertyName| in the global category for object
    * |aObject|, but do not call the property's destructor function.  The
    * property value is returned.
    */
   void* UnsetProperty(nsPropertyOwner aObject,
@@ -123,49 +123,49 @@ class nsPropertyTable
   {
     return GetPropertyInternal(aObject, aPropertyName, true, aStatus);
   }
 
   /**
    * Deletes all of the properties for object |aObject|, calling the
    * destructor function for each property.
    */
-  NS_HIDDEN_(void) DeleteAllPropertiesFor(nsPropertyOwner aObject);
+  void DeleteAllPropertiesFor(nsPropertyOwner aObject);
 
   /**
    * Transfers all properties for object |aObject| that were set with the
    * |aTransfer| argument as true to |aTable|. Deletes the other properties
    * for object |aObject|, calling the destructor function for each property.
    * If transfering a property fails, this deletes all the properties for
    * object |aObject|.
    */
-  NS_HIDDEN_(nsresult)
+  nsresult
     TransferOrDeleteAllPropertiesFor(nsPropertyOwner aObject,
                                      nsPropertyTable *aOtherTable);
 
   /**
    * Enumerate the properties for object |aObject|.
    * For every property |aCallback| will be called with as arguments |aObject|,
    * the property name, the property value and |aData|.
    */
-  NS_HIDDEN_(void) Enumerate(nsPropertyOwner aObject,
+  void Enumerate(nsPropertyOwner aObject,
                              NSPropertyFunc aCallback, void *aData);
 
   /**
    * Enumerate all the properties.
    * For every property |aCallback| will be called with arguments the owner,
    * the property name, the property value and |aData|.
    */
-  NS_HIDDEN_(void) EnumerateAll(NSPropertyFunc aCallback, void *aData);
+  void EnumerateAll(NSPropertyFunc aCallback, void *aData);
 
   /**
    * Deletes all of the properties for all objects in the property
    * table, calling the destructor function for each property.
    */
-  NS_HIDDEN_(void) DeleteAllProperties();
+  void DeleteAllProperties();
 
   nsPropertyTable() : mPropertyList(nullptr) {}  
   ~nsPropertyTable() {
     DeleteAllProperties();
   }
 
   /**
    * Function useable as destructor function for property data that is
@@ -176,23 +176,23 @@ class nsPropertyTable
                                void *aPropertyValue, void *aData);
 
   class PropertyList;
 
   size_t SizeOfExcludingThis(mozilla::MallocSizeOf aMallocSizeOf) const;
   size_t SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf) const;
 
  private:
-  NS_HIDDEN_(void) DestroyPropertyList();
-  NS_HIDDEN_(PropertyList*) GetPropertyListFor(nsIAtom *aPropertyName) const;
-  NS_HIDDEN_(void*) GetPropertyInternal(nsPropertyOwner aObject,
+  void DestroyPropertyList();
+  PropertyList* GetPropertyListFor(nsIAtom *aPropertyName) const;
+  void* GetPropertyInternal(nsPropertyOwner aObject,
                                         nsIAtom    *aPropertyName,
                                         bool        aRemove,
                                         nsresult   *aStatus);
-  NS_HIDDEN_(nsresult) SetPropertyInternal(nsPropertyOwner     aObject,
+  nsresult SetPropertyInternal(nsPropertyOwner     aObject,
                                            nsIAtom            *aPropertyName,
                                            void               *aPropertyValue,
                                            NSPropertyDtorFunc  aDtor,
                                            void               *aDtorData,
                                            bool                aTransfer,
                                            void              **aOldValue);
 
   PropertyList *mPropertyList;
--- a/content/html/content/src/HTMLInputElement.cpp
+++ b/content/html/content/src/HTMLInputElement.cpp
@@ -114,17 +114,17 @@
 NS_IMPL_NS_NEW_HTML_ELEMENT_CHECK_PARSER(Input)
 
 // XXX align=left, hspace, vspace, border? other nav4 attrs
 
 static NS_DEFINE_CID(kXULControllersCID,  NS_XULCONTROLLERS_CID);
 
 // This must come outside of any namespace, or else it won't overload with the
 // double based version in nsMathUtils.h
-inline NS_HIDDEN_(mozilla::Decimal)
+inline mozilla::Decimal
 NS_floorModulo(mozilla::Decimal x, mozilla::Decimal y)
 {
   return (x - y * (x / y).floor());
 }
 
 namespace mozilla {
 namespace dom {
 
@@ -6783,65 +6783,83 @@ HTMLInputElement::GetValidationMessage(n
                                                    "FormValidationPatternMismatchWithTitle",
                                                    params, message);
       }
       aValidationMessage = message;
       break;
     }
     case VALIDITY_STATE_RANGE_OVERFLOW:
     {
+      static const char kNumberOverTemplate[] = "FormValidationNumberRangeOverflow";
+      static const char kDateOverTemplate[] = "FormValidationDateRangeOverflow";
+      static const char kTimeOverTemplate[] = "FormValidationTimeRangeOverflow";
+
+      const char* msgTemplate;
       nsXPIDLString message;
 
       nsAutoString maxStr;
       if (mType == NS_FORM_INPUT_NUMBER ||
           mType == NS_FORM_INPUT_RANGE) {
+        msgTemplate = kNumberOverTemplate;
+
         //We want to show the value as parsed when it's a number
         Decimal maximum = GetMaximum();
         MOZ_ASSERT(!maximum.isNaN());
 
         char buf[32];
         DebugOnly<bool> ok = maximum.toString(buf, ArrayLength(buf));
         maxStr.AssignASCII(buf);
         MOZ_ASSERT(ok, "buf not big enough");
       } else if (mType == NS_FORM_INPUT_DATE || mType == NS_FORM_INPUT_TIME) {
+        msgTemplate = mType == NS_FORM_INPUT_DATE ? kDateOverTemplate : kTimeOverTemplate;
         GetAttr(kNameSpaceID_None, nsGkAtoms::max, maxStr);
       } else {
+        msgTemplate = kNumberOverTemplate;
         NS_NOTREACHED("Unexpected input type");
       }
 
       const char16_t* params[] = { maxStr.get() };
       rv = nsContentUtils::FormatLocalizedString(nsContentUtils::eDOM_PROPERTIES,
-                                                 "FormValidationRangeOverflow",
+                                                 msgTemplate,
                                                  params, message);
       aValidationMessage = message;
       break;
     }
     case VALIDITY_STATE_RANGE_UNDERFLOW:
     {
+      static const char kNumberUnderTemplate[] = "FormValidationNumberRangeUnderflow";
+      static const char kDateUnderTemplate[] = "FormValidationDateRangeUnderflow";
+      static const char kTimeUnderTemplate[] = "FormValidationTimeRangeUnderflow";
+
+      const char* msgTemplate;
       nsXPIDLString message;
 
       nsAutoString minStr;
       if (mType == NS_FORM_INPUT_NUMBER ||
           mType == NS_FORM_INPUT_RANGE) {
+        msgTemplate = kNumberUnderTemplate;
+
         Decimal minimum = GetMinimum();
         MOZ_ASSERT(!minimum.isNaN());
 
         char buf[32];
         DebugOnly<bool> ok = minimum.toString(buf, ArrayLength(buf));
         minStr.AssignASCII(buf);
         MOZ_ASSERT(ok, "buf not big enough");
       } else if (mType == NS_FORM_INPUT_DATE || mType == NS_FORM_INPUT_TIME) {
+        msgTemplate = mType == NS_FORM_INPUT_DATE ? kDateUnderTemplate : kTimeUnderTemplate;
         GetAttr(kNameSpaceID_None, nsGkAtoms::min, minStr);
       } else {
+        msgTemplate = kNumberUnderTemplate;
         NS_NOTREACHED("Unexpected input type");
       }
 
       const char16_t* params[] = { minStr.get() };
       rv = nsContentUtils::FormatLocalizedString(nsContentUtils::eDOM_PROPERTIES,
-                                                 "FormValidationRangeUnderflow",
+                                                 msgTemplate,
                                                  params, message);
       aValidationMessage = message;
       break;
     }
     case VALIDITY_STATE_STEP_MISMATCH:
     {
       nsXPIDLString message;
 
--- a/content/html/content/src/HTMLLinkElement.cpp
+++ b/content/html/content/src/HTMLLinkElement.cpp
@@ -247,21 +247,16 @@ HTMLLinkElement::CreateAndDispatchEvent(
   // Always run async in order to avoid running script when the content
   // sink isn't expecting it.
   asyncDispatcher->PostDOMEvent();
 }
 
 void
 HTMLLinkElement::UpdateImport()
 {
-  if (!Preferences::GetBool("dom.webcomponents.enabled")) {
-    // For now imports are hidden behind a pref...
-    return;
-  }
-
   // 1. link node should be attached to the document.
   nsCOMPtr<nsIDocument> doc = GetCurrentDoc();
   if (!doc) {
     // We might have been just removed from the document, so
     // let's remove ourself from the list of link nodes of
     // the import and reset mImportLoader.
     if (mImportLoader) {
       mImportLoader->RemoveLinkElement(this);
@@ -289,16 +284,21 @@ HTMLLinkElement::UpdateImport()
   }
 
   nsCOMPtr<nsIURI> uri = GetHrefURI();
   if (!uri) {
     mImportLoader = nullptr;
     return;
   }
 
+  if (!Preferences::GetBool("dom.webcomponents.enabled")) {
+    // For now imports are hidden behind a pref...
+    return;
+  }
+
   nsRefPtr<ImportManager> manager = doc->ImportManager();
   MOZ_ASSERT(manager, "ImportManager should be created lazily when needed");
 
   {
     // The load even might fire sooner than we could set mImportLoader so
     // we must use async event and a scriptBlocker here.
     nsAutoScriptBlocker scriptBlocker;
     // CORS check will happen at the start of the load.
--- a/content/html/content/src/HTMLObjectElement.h
+++ b/content/html/content/src/HTMLObjectElement.h
@@ -220,17 +220,17 @@ public:
   {
     return GetContentDocument();
   }
 
 private:
   /**
    * Calls LoadObject with the correct arguments to start the plugin load.
    */
-  NS_HIDDEN_(void) StartObjectLoad(bool aNotify);
+  void StartObjectLoad(bool aNotify);
 
   /**
    * Returns if the element is currently focusable regardless of it's tabindex
    * value. This is used to know the default tabindex value.
    */
   bool IsFocusableForTabIndex();
   
   virtual void GetItemValueText(nsAString& text) MOZ_OVERRIDE;
--- a/content/html/content/src/HTMLSharedObjectElement.h
+++ b/content/html/content/src/HTMLSharedObjectElement.h
@@ -187,17 +187,17 @@ public:
   {
     return GetContentDocument();
   }
 
 private:
   /**
    * Calls LoadObject with the correct arguments to start the plugin load.
    */
-  NS_HIDDEN_(void) StartObjectLoad(bool aNotify);
+  void StartObjectLoad(bool aNotify);
 
   nsIAtom *URIAttrName() const
   {
     return mNodeInfo->Equals(nsGkAtoms::applet) ?
            nsGkAtoms::code :
            nsGkAtoms::src;
   }
 
--- a/content/html/content/src/nsGenericHTMLElement.h
+++ b/content/html/content/src/nsGenericHTMLElement.h
@@ -820,17 +820,17 @@ public:
    * @see GetAttributeMappingFunction
    */
   static void MapScrollingAttributeInto(const nsMappedAttributes* aAttributes,
                                         nsRuleData* aData);
   /**
    * Get the presentation context for this content node.
    * @return the presentation context
    */
-  NS_HIDDEN_(nsPresContext*) GetPresContext();
+  nsPresContext* GetPresContext();
 
   // Form Helper Routines
   /**
    * Find an ancestor of this content node which is a form (could be null)
    * @param aCurrentForm the current form for this node.  If this is
    *        non-null, and no ancestor form is found, and the current form is in
    *        a connected subtree with the node, the current form will be
    *        returned.  This is needed to handle cases when HTML elements have a
@@ -846,30 +846,30 @@ public:
    * See if the document being tested has nav-quirks mode enabled.
    * @param doc the document
    */
   static bool InNavQuirksMode(nsIDocument* aDoc);
 
   /**
    * Locate an nsIEditor rooted at this content node, if there is one.
    */
-  NS_HIDDEN_(nsresult) GetEditor(nsIEditor** aEditor);
+  nsresult GetEditor(nsIEditor** aEditor);
 
   /**
    * Helper method for NS_IMPL_URI_ATTR macro.
    * Gets the absolute URI value of an attribute, by resolving any relative
    * URIs in the attribute against the baseuri of the element. If the attribute
    * isn't a relative URI the value of the attribute is returned as is. Only
    * works for attributes in null namespace.
    *
    * @param aAttr      name of attribute.
    * @param aBaseAttr  name of base attribute.
    * @param aResult    result value [out]
    */
-  NS_HIDDEN_(void) GetURIAttr(nsIAtom* aAttr, nsIAtom* aBaseAttr, nsAString& aResult) const;
+  void GetURIAttr(nsIAtom* aAttr, nsIAtom* aBaseAttr, nsAString& aResult) const;
 
   /**
    * Gets the absolute URI values of an attribute, by resolving any relative
    * URIs in the attribute against the baseuri of the element. If a substring
    * isn't a relative URI, the substring is returned as is. Only works for
    * attributes in null namespace.
    */
   bool GetURIAttr(nsIAtom* aAttr, nsIAtom* aBaseAttr, nsIURI** aURI) const;
@@ -1028,38 +1028,38 @@ protected:
    * Helper method for NS_IMPL_STRING_ATTR macro.
    * Sets the value of an attribute, returns specified default value if the
    * attribute isn't set. Only works for attributes in null namespace.
    *
    * @param aAttr    name of attribute.
    * @param aDefault default-value to return if attribute isn't set.
    * @param aResult  result value [out]
    */
-  NS_HIDDEN_(nsresult) SetAttrHelper(nsIAtom* aAttr, const nsAString& aValue);
+  nsresult SetAttrHelper(nsIAtom* aAttr, const nsAString& aValue);
 
   /**
    * Helper method for NS_IMPL_INT_ATTR macro.
    * Gets the integer-value of an attribute, returns specified default value
    * if the attribute isn't set or isn't set to an integer. Only works for
    * attributes in null namespace.
    *
    * @param aAttr    name of attribute.
    * @param aDefault default-value to return if attribute isn't set.
    */
-  NS_HIDDEN_(int32_t) GetIntAttr(nsIAtom* aAttr, int32_t aDefault) const;
+  int32_t GetIntAttr(nsIAtom* aAttr, int32_t aDefault) const;
 
   /**
    * Helper method for NS_IMPL_INT_ATTR macro.
    * Sets value of attribute to specified integer. Only works for attributes
    * in null namespace.
    *
    * @param aAttr    name of attribute.
    * @param aValue   Integer value of attribute.
    */
-  NS_HIDDEN_(nsresult) SetIntAttr(nsIAtom* aAttr, int32_t aValue);
+  nsresult SetIntAttr(nsIAtom* aAttr, int32_t aValue);
 
   /**
    * Helper method for NS_IMPL_UINT_ATTR macro.
    * Gets the unsigned integer-value of an attribute, returns specified default
    * value if the attribute isn't set or isn't set to an integer. Only works for
    * attributes in null namespace.
    *
    * @param aAttr    name of attribute.
@@ -1106,43 +1106,43 @@ protected:
    * Gets the absolute URI values of an attribute, by resolving any relative
    * URIs in the attribute against the baseuri of the element. If a substring
    * isn't a relative URI, the substring is returned as is. Only works for
    * attributes in null namespace.
    *
    * @param aAttr    name of attribute.
    * @param aResult  result value [out]
    */
-  NS_HIDDEN_(nsresult) GetURIListAttr(nsIAtom* aAttr, nsAString& aResult);
+  nsresult GetURIListAttr(nsIAtom* aAttr, nsAString& aResult);
 
   /**
    * Helper method for NS_IMPL_ENUM_ATTR_DEFAULT_VALUE.
    * Gets the enum value string of an attribute and using a default value if
    * the attribute is missing or the string is an invalid enum value.
    *
    * @param aType     the name of the attribute.
    * @param aDefault  the default value if the attribute is missing or invalid.
    * @param aResult   string corresponding to the value [out].
    */
-  NS_HIDDEN_(void) GetEnumAttr(nsIAtom* aAttr,
+  void GetEnumAttr(nsIAtom* aAttr,
                                const char* aDefault,
                                nsAString& aResult) const;
 
   /**
    * Helper method for NS_IMPL_ENUM_ATTR_DEFAULT_MISSING_INVALID_VALUES.
    * Gets the enum value string of an attribute and using the default missing
    * value if the attribute is missing or the default invalid value if the
    * string is an invalid enum value.
    *
    * @param aType            the name of the attribute.
    * @param aDefaultMissing  the default value if the attribute is missing.
    * @param aDefaultInvalid  the default value if the attribute is invalid.
    * @param aResult          string corresponding to the value [out].
    */
-  NS_HIDDEN_(void) GetEnumAttr(nsIAtom* aAttr,
+  void GetEnumAttr(nsIAtom* aAttr,
                                const char* aDefaultMissing,
                                const char* aDefaultInvalid,
                                nsAString& aResult) const;
 
   /**
    * Locates the nsIEditor associated with this node.  In general this is
    * equivalent to GetEditorInternal(), but for designmode or contenteditable,
    * this may need to get an editor that's not actually on this element's
@@ -1178,17 +1178,17 @@ protected:
   };
 
   /**
    * Returns eTrue if the element has a contentEditable attribute and its value
    * is "true" or an empty string. Returns eFalse if the element has a
    * contentEditable attribute and its value is "false". Otherwise returns
    * eInherit.
    */
-  NS_HIDDEN_(ContentEditableTristate) GetContentEditableValue() const
+  ContentEditableTristate GetContentEditableValue() const
   {
     static const nsIContent::AttrValuesArray values[] =
       { &nsGkAtoms::_false, &nsGkAtoms::_true, &nsGkAtoms::_empty, nullptr };
 
     if (!MayHaveContentEditableAttr())
       return eInherit;
 
     int32_t value = FindAttrValueIn(kNameSpaceID_None,
--- a/content/html/content/test/forms/test_max_attribute.html
+++ b/content/html/content/test/forms/test_max_attribute.html
@@ -64,19 +64,22 @@ document.getElementById('content').appen
 function checkValidity(aElement, aValidity, aApply, aRangeApply)
 {
   aValidity = aApply ? aValidity : true;
 
   is(aElement.validity.valid, aValidity,
      "element validity should be " + aValidity);
   is(aElement.validity.rangeOverflow, !aValidity,
      "element overflow status should be " + !aValidity);
-  is(aElement.validationMessage, aValidity
-       ? "" : "Please select a value that is lower than " + aElement.max + ".",
-     "validation message");
+  var overflowMsg =
+        (aElement.type == "date" || aElement.type == "time") ?
+        ("Please select a value that is no later than " + aElement.max + ".") :
+        ("Please select a value that is no more than " + aElement.max + ".");
+  is(aElement.validationMessage,
+     aValidity ? "" : overflowMsg, "Checking range overflow validation message");
 
   is(aElement.mozMatchesSelector(":valid"), aElement.willValidate && aValidity,
      (aElement.willValidate && aValidity) ? ":valid should apply" : "valid shouldn't apply");
   is(aElement.mozMatchesSelector(":invalid"), aElement.willValidate && !aValidity,
      (aElement.wil && aValidity) ? ":invalid shouldn't apply" : "valid should apply");
 
   if (!aRangeApply) {
     ok(!aElement.mozMatchesSelector(":in-range"), ":in-range should not match");
@@ -253,17 +256,17 @@ for (var test of data) {
       input.max = 'foo';
       checkValidity(input, true, apply, false);
 
       // Check that we correctly convert input.max to a double in validationMessage.
       if (input.type == 'number') {
         input.max = "4.333333333333333333333333333333333331";
         input.value = "5";
         is(input.validationMessage,
-           "Please select a value that is lower than 4.33333333333333.",
+           "Please select a value that is no more than 4.33333333333333.",
            "validation message");
       }
 
       break;
     case 'range':
       input.max = '2';
       input.value = '1';
       checkValidity(input, true, apply, apply);
@@ -294,17 +297,17 @@ for (var test of data) {
       checkValidity(input, true, apply, apply);
 
       // Check that we correctly convert input.max to a double in validationMessage.
       input.step = 'any';
       input.min = 5;
       input.max = 0.66666666666666666666666666666666666
       input.value = 1;
       is(input.validationMessage,
-         "Please select a value that is lower than 0.666666666666667.",
+         "Please select a value that is no more than 0.666666666666667.",
          "validation message")
 
       break;
     case 'time':
       // Don't worry about that.
       input.step = 'any';
 
       input.max = '10:10';
--- a/content/html/content/test/forms/test_min_attribute.html
+++ b/content/html/content/test/forms/test_min_attribute.html
@@ -64,19 +64,22 @@ document.getElementById('content').appen
 function checkValidity(aElement, aValidity, aApply, aRangeApply)
 {
   aValidity = aApply ? aValidity : true;
 
   is(aElement.validity.valid, aValidity,
      "element validity should be " + aValidity);
   is(aElement.validity.rangeUnderflow, !aValidity,
      "element underflow status should be " + !aValidity);
-  is(aElement.validationMessage, aValidity
-       ? "" : "Please select a value that is higher than " + aElement.min + ".",
-     "validation message");
+  var underflowMsg =
+        (aElement.type == "date" || aElement.type == "time") ?
+        ("Please select a value that is no earlier than " + aElement.min + ".") :
+        ("Please select a value that is no less than " + aElement.min + ".");
+  is(aElement.validationMessage,
+     aValidity ? "" : underflowMsg, "Checking range underflow validation message");
 
   is(aElement.mozMatchesSelector(":valid"), aElement.willValidate && aValidity,
      (aElement.willValidate && aValidity) ? ":valid should apply" : "valid shouldn't apply");
   is(aElement.mozMatchesSelector(":invalid"), aElement.willValidate && !aValidity,
      (aElement.wil && aValidity) ? ":invalid shouldn't apply" : "valid should apply");
 
   if (!aRangeApply) {
     ok(!aElement.mozMatchesSelector(":in-range"), ":in-range should not match");
@@ -249,17 +252,17 @@ for (var test of data) {
       input.min = 'foo';
       checkValidity(input, true, apply, false);
 
       // Check that we correctly convert input.min to a double in
       // validationMessage.
       input.min = "4.333333333333333333333333333333333331";
       input.value = "2";
       is(input.validationMessage,
-         "Please select a value that is higher than 4.33333333333333.",
+         "Please select a value that is no less than 4.33333333333333.",
          "validation message");
       break;
     case 'range':
       input.min = '0';
       input.value = '1';
       checkValidity(input, true, apply, apply);
 
       input.value = '0';
--- a/content/html/content/test/forms/test_step_attribute.html
+++ b/content/html/content/test/forms/test_step_attribute.html
@@ -59,18 +59,22 @@ function checkValidity(aElement, aValidi
      "element validity should be " + aValidity);
   is(aElement.validity.stepMismatch, !aValidity,
      "element step mismatch status should be " + !aValidity);
 
   if (aValidity) {
     is(aElement.validationMessage, "", "There should be no validation message.");
   } else {
     if (aElement.validity.rangeUnderflow) {
-      is(aElement.validationMessage, "Please select a value that is higher than " +
-         aElement.min + ".", "There should be a validation message.");
+      var underflowMsg =
+            (aElement.type == "date" || aElement.type == "time") ?
+            ("Please select a value that is no earlier than " + aElement.min + ".") :
+            ("Please select a value that is no less than " + aElement.min + ".");
+      is(aElement.validationMessage, underflowMsg,
+         "Checking range underflow validation message.");
     } else if (aData.low == aData.high) {
       is(aElement.validationMessage, "Please select a valid value. " +
          "The nearest valid value is " + aData.low + ".",
          "There should be a validation message.");
     } else {
       is(aElement.validationMessage, "Please select a valid value. "  +
          "The two nearest valid values are " + aData.low + " and " + aData.high + ".",
          "There should be a validation message.");
--- a/content/html/content/test/test_anchor_ping.html
+++ b/content/html/content/test/test_anchor_ping.html
@@ -34,17 +34,17 @@ addLoadEvent(function () {
   });
 });
 
 let tests = [
 
   // Ensure that sending pings is enabled.
   function* setup() {
     Services.prefs.setBoolPref("browser.send_pings", true);
-    Services.prefs.setIntPref("browser.send_pings.max_per_link", 4);
+    Services.prefs.setIntPref("browser.send_pings.max_per_link", -1);
 
     SimpleTest.registerCleanupFunction(() => {
       Services.prefs.clearUserPref("browser.send_pings");
       Services.prefs.clearUserPref("browser.send_pings.max_per_link");
     });
   },
 
   // If both the address of the document containing the hyperlink being audited
--- a/content/html/document/src/nsHTMLDocument.h
+++ b/content/html/document/src/nsHTMLDocument.h
@@ -75,19 +75,19 @@ public:
   // nsIHTMLDocument
   virtual void SetCompatibilityMode(nsCompatibility aMode) MOZ_OVERRIDE;
 
   virtual bool IsWriting() MOZ_OVERRIDE
   {
     return mWriteLevel != uint32_t(0);
   }
 
-  virtual NS_HIDDEN_(nsContentList*) GetForms();
+  virtual nsContentList* GetForms();
  
-  virtual NS_HIDDEN_(nsContentList*) GetFormControls();
+  virtual nsContentList* GetFormControls();
  
   // nsIDOMDocument interface
   using nsDocument::CreateElement;
   using nsDocument::CreateElementNS;
   NS_FORWARD_NSIDOMDOCUMENT(nsDocument::)
 
   // And explicitly import the things from nsDocument that we just shadowed
   using nsDocument::GetImplementation;
@@ -150,17 +150,17 @@ public:
   friend class nsAutoEditingState;
 
   void EndUpdate(nsUpdateType aUpdateType) MOZ_OVERRIDE;
 
   virtual nsresult SetEditingState(EditingState aState) MOZ_OVERRIDE;
 
   virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const MOZ_OVERRIDE;
 
-  virtual NS_HIDDEN_(void) RemovedFromDocShell() MOZ_OVERRIDE;
+  virtual void RemovedFromDocShell() MOZ_OVERRIDE;
 
   virtual mozilla::dom::Element *GetElementById(const nsAString& aElementId)
   {
     return nsDocument::GetElementById(aElementId);
   }
 
   virtual void DocAddSizeOfExcludingThis(nsWindowSizes* aWindowSizes) const MOZ_OVERRIDE;
   // DocAddSizeOfIncludingThis is inherited from nsIDocument.
--- a/content/xul/document/src/XULDocument.h
+++ b/content/xul/document/src/XULDocument.h
@@ -276,17 +276,17 @@ protected:
     BroadcastAttributeChangeFromOverlay(nsIContent* aNode,
                                         int32_t aNameSpaceID,
                                         nsIAtom* aAttribute,
                                         nsIAtom* aPrefix,
                                         const nsAString& aValue);
 
     already_AddRefed<nsPIWindowRoot> GetWindowRoot();
 
-    static NS_HIDDEN_(void) DirectionChanged(const char* aPrefName, void* aData);
+    static void DirectionChanged(const char* aPrefName, void* aData);
 
     // pseudo constants
     static int32_t gRefCnt;
 
     static nsIAtom** kIdentityAttrs[];
 
     static nsIRDFService* gRDFService;
     static nsIRDFResource* kNC_persist;
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -537,17 +537,17 @@ struct SendPingInfo {
   nsIURI *target;
   nsIURI *referrer;
 };
 
 static void
 SendPing(void *closure, nsIContent *content, nsIURI *uri, nsIIOService *ios)
 {
   SendPingInfo *info = static_cast<SendPingInfo *>(closure);
-  if (info->numPings >= info->maxPings)
+  if (info->maxPings > -1 && info->numPings >= info->maxPings)
     return;
 
   if (info->requireSameHost) {
     // Make sure the referrer and the given uri share the same origin.  We
     // only require the same hostname.  The scheme and port may differ.
     if (!IsSameHost(uri, info->referrer))
       return;
   }
--- a/dom/base/nsDOMWindowUtils.cpp
+++ b/dom/base/nsDOMWindowUtils.cpp
@@ -3193,17 +3193,17 @@ nsDOMWindowUtils::GetPlugins(JSContext* 
 
   nsCOMPtr<nsIDocument> doc = GetDocument();
   NS_ENSURE_STATE(doc);
 
   nsTArray<nsIObjectLoadingContent*> plugins;
   doc->GetPlugins(plugins);
 
   JS::Rooted<JSObject*> jsPlugins(cx);
-  nsresult rv = nsTArrayToJSArray(cx, plugins, jsPlugins.address());
+  nsresult rv = nsTArrayToJSArray(cx, plugins, &jsPlugins);
   NS_ENSURE_SUCCESS(rv, rv);
 
   aPlugins.setObject(*jsPlugins);
   return NS_OK;
 }
 
 static void
 MaybeReflowForInflationScreenWidthChange(nsPresContext *aPresContext)
--- a/dom/base/nsGlobalWindow.h
+++ b/dom/base/nsGlobalWindow.h
@@ -424,77 +424,77 @@ public:
 
   // nsITouchEventReceiver
   NS_DECL_NSITOUCHEVENTRECEIVER
 
   // nsIInlineEventHandlers
   NS_DECL_NSIINLINEEVENTHANDLERS
 
   // nsPIDOMWindow
-  virtual NS_HIDDEN_(nsPIDOMWindow*) GetPrivateRoot();
+  virtual nsPIDOMWindow* GetPrivateRoot();
 
   // Outer windows only.
-  virtual NS_HIDDEN_(void) ActivateOrDeactivate(bool aActivate);
-  virtual NS_HIDDEN_(void) SetActive(bool aActive);
-  virtual NS_HIDDEN_(void) SetIsBackground(bool aIsBackground);
-  virtual NS_HIDDEN_(void) SetChromeEventHandler(mozilla::dom::EventTarget* aChromeEventHandler);
+  virtual void ActivateOrDeactivate(bool aActivate);
+  virtual void SetActive(bool aActive);
+  virtual void SetIsBackground(bool aIsBackground);
+  virtual void SetChromeEventHandler(mozilla::dom::EventTarget* aChromeEventHandler);
 
   // Outer windows only.
-  virtual NS_HIDDEN_(void) SetInitialPrincipalToSubject();
+  virtual void SetInitialPrincipalToSubject();
 
-  virtual NS_HIDDEN_(PopupControlState) PushPopupControlState(PopupControlState state, bool aForce) const;
-  virtual NS_HIDDEN_(void) PopPopupControlState(PopupControlState state) const;
-  virtual NS_HIDDEN_(PopupControlState) GetPopupControlState() const;
+  virtual PopupControlState PushPopupControlState(PopupControlState state, bool aForce) const;
+  virtual void PopPopupControlState(PopupControlState state) const;
+  virtual PopupControlState GetPopupControlState() const;
 
   virtual already_AddRefed<nsISupports> SaveWindowState();
-  virtual NS_HIDDEN_(nsresult) RestoreWindowState(nsISupports *aState);
-  virtual NS_HIDDEN_(void) SuspendTimeouts(uint32_t aIncrease = 1,
+  virtual nsresult RestoreWindowState(nsISupports *aState);
+  virtual void SuspendTimeouts(uint32_t aIncrease = 1,
                                            bool aFreezeChildren = true);
-  virtual NS_HIDDEN_(nsresult) ResumeTimeouts(bool aThawChildren = true);
-  virtual NS_HIDDEN_(uint32_t) TimeoutSuspendCount();
-  virtual NS_HIDDEN_(nsresult) FireDelayedDOMEvents();
-  virtual NS_HIDDEN_(bool) IsFrozen() const
+  virtual nsresult ResumeTimeouts(bool aThawChildren = true);
+  virtual uint32_t TimeoutSuspendCount();
+  virtual nsresult FireDelayedDOMEvents();
+  virtual bool IsFrozen() const
   {
     return mIsFrozen;
   }
-  virtual NS_HIDDEN_(bool) IsRunningTimeout() { return mTimeoutFiringDepth > 0; }
+  virtual bool IsRunningTimeout() { return mTimeoutFiringDepth > 0; }
 
   // Outer windows only.
-  virtual NS_HIDDEN_(bool) WouldReuseInnerWindow(nsIDocument* aNewDocument);
+  virtual bool WouldReuseInnerWindow(nsIDocument* aNewDocument);
 
-  virtual NS_HIDDEN_(void) SetDocShell(nsIDocShell* aDocShell);
+  virtual void SetDocShell(nsIDocShell* aDocShell);
   virtual void DetachFromDocShell();
-  virtual NS_HIDDEN_(nsresult) SetNewDocument(nsIDocument *aDocument,
+  virtual nsresult SetNewDocument(nsIDocument *aDocument,
                                               nsISupports *aState,
                                               bool aForceReuseInnerWindow);
 
   // Outer windows only.
   void DispatchDOMWindowCreated();
 
-  virtual NS_HIDDEN_(void) SetOpenerWindow(nsIDOMWindow* aOpener,
+  virtual void SetOpenerWindow(nsIDOMWindow* aOpener,
                                            bool aOriginalOpener);
 
   // Outer windows only.
-  virtual NS_HIDDEN_(void) EnsureSizeUpToDate();
+  virtual void EnsureSizeUpToDate();
 
-  virtual NS_HIDDEN_(void) EnterModalState();
-  virtual NS_HIDDEN_(void) LeaveModalState();
+  virtual void EnterModalState();
+  virtual void LeaveModalState();
 
   // Outer windows only.
-  virtual NS_HIDDEN_(bool) CanClose();
-  virtual NS_HIDDEN_(void) ForceClose();
+  virtual bool CanClose();
+  virtual void ForceClose();
 
-  virtual NS_HIDDEN_(void) MaybeUpdateTouchState();
-  virtual NS_HIDDEN_(void) UpdateTouchState();
-  virtual NS_HIDDEN_(bool) DispatchCustomEvent(const char *aEventName);
-  virtual NS_HIDDEN_(bool) DispatchResizeEvent(const nsIntSize& aSize);
-  virtual NS_HIDDEN_(void) RefreshCompartmentPrincipal();
-  virtual NS_HIDDEN_(nsresult) SetFullScreenInternal(bool aIsFullScreen, bool aRequireTrust);
+  virtual void MaybeUpdateTouchState();
+  virtual void UpdateTouchState();
+  virtual bool DispatchCustomEvent(const char *aEventName);
+  virtual bool DispatchResizeEvent(const nsIntSize& aSize);
+  virtual void RefreshCompartmentPrincipal();
+  virtual nsresult SetFullScreenInternal(bool aIsFullScreen, bool aRequireTrust);
 
-  virtual NS_HIDDEN_(void) SetHasGamepadEventListener(bool aHasGamepad = true);
+  virtual void SetHasGamepadEventListener(bool aHasGamepad = true);
 
   // nsIInterfaceRequestor
   NS_DECL_NSIINTERFACEREQUESTOR
 
   // WebIDL interface.
   already_AddRefed<nsIDOMWindow> IndexedGetter(uint32_t aIndex, bool& aFound);
 
   void GetSupportedNames(nsTArray<nsString>& aNames);
@@ -630,20 +630,20 @@ public:
                                                                    nsIDOMEventTarget)
 
 #ifdef DEBUG
   // Call Unlink on this window. This may cause bad things to happen, so use
   // with caution.
   void RiskyUnlink();
 #endif
 
-  virtual NS_HIDDEN_(JSObject*)
+  virtual JSObject*
     GetCachedXBLPrototypeHandler(nsXBLPrototypeHandler* aKey);
 
-  virtual NS_HIDDEN_(void)
+  virtual void
     CacheXBLPrototypeHandler(nsXBLPrototypeHandler* aKey,
                              JS::Handle<JSObject*> aHandler);
 
   virtual bool TakeFocus(bool aFocus, uint32_t aFocusMethod);
   virtual void SetReadyForFocus();
   virtual void PageHidden();
   virtual nsresult DispatchAsyncHashchange(nsIURI *aOldURI, nsIURI *aNewURI);
   virtual nsresult DispatchSyncPopState();
@@ -1149,17 +1149,17 @@ protected:
    * @param aExtraArgument Another way to pass arguments in.  This is mutually
    *        exclusive with the argv/argc approach.
    *
    * @param aJSCallerContext The calling script's context. This must be null
    *        when aCalledNoScript is true.
    *
    * @param aReturn [out] The window that was opened, if any.
    */
-  NS_HIDDEN_(nsresult) OpenInternal(const nsAString& aUrl,
+  nsresult OpenInternal(const nsAString& aUrl,
                                     const nsAString& aName,
                                     const nsAString& aOptions,
                                     bool aDialog,
                                     bool aContentModal,
                                     bool aCalledNoScript,
                                     bool aDoJSFixups,
                                     bool aNavigate,
                                     nsIArray *argv,
--- a/dom/base/nsPIDOMWindow.h
+++ b/dom/base/nsPIDOMWindow.h
@@ -183,17 +183,17 @@ public:
   nsIDocument* GetDoc()
   {
     if (!mDoc) {
       MaybeCreateDoc();
     }
     return mDoc;
   }
 
-  virtual NS_HIDDEN_(bool) IsRunningTimeout() = 0;
+  virtual bool IsRunningTimeout() = 0;
 
   // Audio API
   bool GetAudioMuted() const;
   void SetAudioMuted(bool aMuted);
 
   float GetAudioVolume() const;
   nsresult SetAudioVolume(float aVolume);
 
--- a/dom/bluetooth/BluetoothAdapter.cpp
+++ b/dom/bluetooth/BluetoothAdapter.cpp
@@ -99,17 +99,17 @@ public:
     nsIScriptContext* sc = mAdapterPtr->GetContextForEventHandlers(&rv);
     if (!sc) {
       BT_WARNING("Cannot create script context!");
       SetError(NS_LITERAL_STRING("BluetoothScriptContextError"));
       return false;
     }
 
     AutoPushJSContext cx(sc->GetNativeContext());
-    JSObject* JsDevices = nullptr;
+    JS::Rooted<JSObject*> JsDevices(cx);
     rv = nsTArrayToJSArray(cx, devices, &JsDevices);
     if (!JsDevices) {
       BT_WARNING("Cannot create JS array!");
       SetError(NS_LITERAL_STRING("BluetoothError"));
       return false;
     }
 
     aValue.setObject(*JsDevices);
@@ -255,34 +255,33 @@ BluetoothAdapter::SetPropertyByValue(con
     mUuids = value.get_ArrayOfnsString();
     nsresult rv;
     nsIScriptContext* sc = GetContextForEventHandlers(&rv);
     NS_ENSURE_SUCCESS_VOID(rv);
     NS_ENSURE_TRUE_VOID(sc);
 
     AutoPushJSContext cx(sc->GetNativeContext());
     JS::Rooted<JSObject*> uuids(cx);
-    if (NS_FAILED(nsTArrayToJSArray(cx, mUuids, uuids.address()))) {
+    if (NS_FAILED(nsTArrayToJSArray(cx, mUuids, &uuids))) {
       BT_WARNING("Cannot set JS UUIDs object!");
       return;
     }
     mJsUuids = uuids;
     Root();
   } else if (name.EqualsLiteral("Devices")) {
     mDeviceAddresses = value.get_ArrayOfnsString();
 
     nsresult rv;
     nsIScriptContext* sc = GetContextForEventHandlers(&rv);
     NS_ENSURE_SUCCESS_VOID(rv);
     NS_ENSURE_TRUE_VOID(sc);
 
     AutoPushJSContext cx(sc->GetNativeContext());
     JS::Rooted<JSObject*> deviceAddresses(cx);
-    if (NS_FAILED(nsTArrayToJSArray(cx, mDeviceAddresses,
-                                    deviceAddresses.address()))) {
+    if (NS_FAILED(nsTArrayToJSArray(cx, mDeviceAddresses, &deviceAddresses))) {
       BT_WARNING("Cannot set JS Devices object!");
       return;
     }
     mJsDeviceAddresses = deviceAddresses;
     Root();
   } else {
 #ifdef DEBUG
     nsCString warningMsg;
--- a/dom/bluetooth/BluetoothDevice.cpp
+++ b/dom/bluetooth/BluetoothDevice.cpp
@@ -132,33 +132,33 @@ BluetoothDevice::SetPropertyByValue(cons
     nsresult rv;
     nsIScriptContext* sc = GetContextForEventHandlers(&rv);
     NS_ENSURE_SUCCESS_VOID(rv);
     NS_ENSURE_TRUE_VOID(sc);
 
     AutoPushJSContext cx(sc->GetNativeContext());
 
     JS::Rooted<JSObject*> uuids(cx);
-    if (NS_FAILED(nsTArrayToJSArray(cx, mUuids, uuids.address()))) {
+    if (NS_FAILED(nsTArrayToJSArray(cx, mUuids, &uuids))) {
       BT_WARNING("Cannot set JS UUIDs object!");
       return;
     }
     mJsUuids = uuids;
     Root();
   } else if (name.EqualsLiteral("Services")) {
     mServices = value.get_ArrayOfnsString();
     nsresult rv;
     nsIScriptContext* sc = GetContextForEventHandlers(&rv);
     NS_ENSURE_SUCCESS_VOID(rv);
     NS_ENSURE_TRUE_VOID(sc);
 
     AutoPushJSContext cx(sc->GetNativeContext());
 
     JS::Rooted<JSObject*> services(cx);
-    if (NS_FAILED(nsTArrayToJSArray(cx, mServices, services.address()))) {
+    if (NS_FAILED(nsTArrayToJSArray(cx, mServices, &services))) {
       BT_WARNING("Cannot set JS Services object!");
       return;
     }
     mJsServices = services;
     Root();
   } else {
     nsCString warningMsg;
     warningMsg.AssignLiteral("Not handling device property: ");
--- a/dom/bluetooth2/BluetoothCommon.h
+++ b/dom/bluetooth2/BluetoothCommon.h
@@ -53,16 +53,22 @@ extern bool gBluetoothDebugFlag;
     }                                                                \
   } while(0)
 
 #define BT_LOGR(msg, ...) printf("%s: " msg, __FUNCTION__, ##__VA_ARGS__))
 #define BT_WARNING(msg, ...) printf("%s: " msg, __FUNCTION__, ##__VA_ARGS__))
 #endif
 
 /**
+ * Prints 'R'ELEASE build logs for WebBluetooth API v2.
+ */
+#define BT_API2_LOGR(msg, ...)                                       \
+  BT_LOGR("[WEBBT-API2] " msg, ##__VA_ARGS__)
+
+/**
  * Wrap literal name and value into a BluetoothNamedValue
  * and append it to the array.
  */
 #define BT_APPEND_NAMED_VALUE(array, name, value)                    \
   array.AppendElement(BluetoothNamedValue(NS_LITERAL_STRING(name), value))
 
 /**
  * Ensure success of system message broadcast with void return.
--- a/dom/bluetooth2/BluetoothManager.cpp
+++ b/dom/bluetooth2/BluetoothManager.cpp
@@ -6,229 +6,296 @@
 
 #include "base/basictypes.h"
 #include "BluetoothManager.h"
 #include "BluetoothCommon.h"
 #include "BluetoothAdapter.h"
 #include "BluetoothService.h"
 #include "BluetoothReplyRunnable.h"
 
-#include "DOMRequest.h"
+#include "mozilla/dom/bluetooth/BluetoothTypes.h"
+#include "mozilla/dom/BluetoothManager2Binding.h"
+#include "mozilla/Services.h"
 #include "nsContentUtils.h"
 #include "nsDOMClassInfo.h"
 #include "nsIPermissionManager.h"
 #include "nsThreadUtils.h"
-#include "mozilla/dom/bluetooth/BluetoothTypes.h"
-#include "mozilla/dom/BluetoothManager2Binding.h"
-#include "mozilla/Services.h"
 
 using namespace mozilla;
 
 USING_BLUETOOTH_NAMESPACE
 
 // QueryInterface implementation for BluetoothManager
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(BluetoothManager)
 NS_INTERFACE_MAP_END_INHERITING(DOMEventTargetHelper)
 
 NS_IMPL_ADDREF_INHERITED(BluetoothManager, DOMEventTargetHelper)
 NS_IMPL_RELEASE_INHERITED(BluetoothManager, DOMEventTargetHelper)
 
-class GetAdapterTask : public BluetoothReplyRunnable
+class GetAdaptersTask : public BluetoothReplyRunnable
 {
-public:
-  GetAdapterTask(BluetoothManager* aManager,
-                 nsIDOMDOMRequest* aReq) :
-    BluetoothReplyRunnable(aReq),
-    mManagerPtr(aManager)
-  {
-  }
+ public:
+  GetAdaptersTask(BluetoothManager* aManager)
+    : BluetoothReplyRunnable(nullptr)
+    , mManager(aManager)
+  { }
 
   bool
   ParseSuccessfulReply(JS::MutableHandle<JS::Value> aValue)
   {
-    aValue.setUndefined();
+    /**
+     * Unwrap BluetoothReply.BluetoothReplySuccess.BluetoothValue =
+     *   BluetoothNamedValue[]
+     *     |
+     *     |__ BluetoothNamedValue =
+     *     |     {"Adapter", BluetoothValue = BluetoothNamedValue[]}
+     *     |
+     *     |__ BluetoothNamedValue =
+     *     |     {"Adapter", BluetoothValue = BluetoothNamedValue[]}
+     *     ...
+     */
 
-    const BluetoothValue& v = mReply->get_BluetoothReplySuccess().value();
-    if (v.type() != BluetoothValue::TArrayOfBluetoothNamedValue) {
-      BT_WARNING("Not a BluetoothNamedValue array!");
-      SetError(NS_LITERAL_STRING("BluetoothReplyTypeError"));
-      return false;
-    }
+    // Extract the array of all adapters' properties
+    const BluetoothValue& adaptersProperties =
+      mReply->get_BluetoothReplySuccess().value();
+    NS_ENSURE_TRUE(adaptersProperties.type() ==
+                   BluetoothValue::TArrayOfBluetoothNamedValue, false);
 
-    if (!mManagerPtr->GetOwner()) {
-      BT_WARNING("Bluetooth manager was disconnected from owner window.");
+    const InfallibleTArray<BluetoothNamedValue>& adaptersPropertiesArray =
+      adaptersProperties.get_ArrayOfBluetoothNamedValue();
+    BT_API2_LOGR("GetAdaptersTask: len[%d]", adaptersPropertiesArray.Length());
 
-      // Stop to create adapter since owner window of Bluetooth manager was
-      // gone. These is no need to create a DOMEvent target which has no owner
-      // to reply to.
-      return false;
+    // Append a BluetoothAdapter into adapters array for each properties array
+    uint32_t numAdapters = adaptersPropertiesArray.Length();
+    for (uint32_t i = 0; i < numAdapters; i++) {
+      MOZ_ASSERT(adaptersPropertiesArray[i].name().EqualsLiteral("Adapter"));
+
+      const BluetoothValue& properties = adaptersPropertiesArray[i].value();
+      mManager->AppendAdapter(properties);
     }
 
-    const InfallibleTArray<BluetoothNamedValue>& values =
-      v.get_ArrayOfBluetoothNamedValue();
-    nsRefPtr<BluetoothAdapter> adapter =
-      BluetoothAdapter::Create(mManagerPtr->GetOwner(), values);
-
-    nsresult rv;
-    nsIScriptContext* sc = mManagerPtr->GetContextForEventHandlers(&rv);
-    if (!sc) {
-      BT_WARNING("Cannot create script context!");
-      SetError(NS_LITERAL_STRING("BluetoothScriptContextError"));
-      return false;
-    }
-
-    AutoPushJSContext cx(sc->GetNativeContext());
-
-    JS::Rooted<JSObject*> scope(cx, sc->GetWindowProxy());
-    JSAutoCompartment ac(cx, scope);
-    rv = nsContentUtils::WrapNative(cx, adapter, aValue);
-    if (NS_FAILED(rv)) {
-      BT_WARNING("Cannot create native object!");
-      SetError(NS_LITERAL_STRING("BluetoothNativeObjectError"));
-      return false;
-    }
-
+    aValue.setUndefined();
     return true;
   }
 
   void
   ReleaseMembers()
   {
     BluetoothReplyRunnable::ReleaseMembers();
-    mManagerPtr = nullptr;
+    mManager = nullptr;
   }
 
 private:
-  nsRefPtr<BluetoothManager> mManagerPtr;
+  nsRefPtr<BluetoothManager> mManager;
 };
 
 BluetoothManager::BluetoothManager(nsPIDOMWindow *aWindow)
   : DOMEventTargetHelper(aWindow)
-  , BluetoothPropertyContainer(BluetoothObjectType::TYPE_MANAGER)
+  , mDefaultAdapterIndex(-1)
 {
   MOZ_ASSERT(aWindow);
   MOZ_ASSERT(IsDOMBinding());
 
-  mPath.Assign('/');
+  ListenToBluetoothSignal(true);
+  BT_API2_LOGR("aWindow %p", aWindow);
 
+  // Query adapters list from bluetooth backend
   BluetoothService* bs = BluetoothService::Get();
   NS_ENSURE_TRUE_VOID(bs);
-  bs->RegisterBluetoothSignalHandler(NS_LITERAL_STRING(KEY_MANAGER), this);
+
+  nsRefPtr<BluetoothReplyRunnable> result = new GetAdaptersTask(this);
+  NS_ENSURE_SUCCESS_VOID(bs->GetAdaptersInternal(result));
 }
 
 BluetoothManager::~BluetoothManager()
 {
-  BluetoothService* bs = BluetoothService::Get();
-  NS_ENSURE_TRUE_VOID(bs);
-  bs->UnregisterBluetoothSignalHandler(NS_LITERAL_STRING(KEY_MANAGER), this);
+  ListenToBluetoothSignal(false);
 }
 
 void
 BluetoothManager::DisconnectFromOwner()
 {
   DOMEventTargetHelper::DisconnectFromOwner();
-
-  BluetoothService* bs = BluetoothService::Get();
-  NS_ENSURE_TRUE_VOID(bs);
-  bs->UnregisterBluetoothSignalHandler(NS_LITERAL_STRING(KEY_MANAGER), this);
+  ListenToBluetoothSignal(false);
 }
 
 void
-BluetoothManager::SetPropertyByValue(const BluetoothNamedValue& aValue)
+BluetoothManager::ListenToBluetoothSignal(bool aStart)
 {
-#ifdef DEBUG
-    const nsString& name = aValue.name();
-    nsCString warningMsg;
-    warningMsg.AssignLiteral("Not handling manager property: ");
-    warningMsg.Append(NS_ConvertUTF16toUTF8(name));
-    BT_WARNING(warningMsg.get());
-#endif
+  BluetoothService* bs = BluetoothService::Get();
+  NS_ENSURE_TRUE_VOID(bs);
+
+  if (aStart) {
+    bs->RegisterBluetoothSignalHandler(NS_LITERAL_STRING(KEY_MANAGER), this);
+  } else {
+    bs->UnregisterBluetoothSignalHandler(NS_LITERAL_STRING(KEY_MANAGER), this);
+  }
 }
 
-bool
-BluetoothManager::GetEnabled(ErrorResult& aRv)
+BluetoothAdapter*
+BluetoothManager::GetDefaultAdapter()
 {
-  BluetoothService* bs = BluetoothService::Get();
-  if (!bs) {
-    aRv.Throw(NS_ERROR_FAILURE);
-    return false;
-  }
+  BT_API2_LOGR("mDefaultAdapterIndex: %d", mDefaultAdapterIndex);
 
-  return bs->IsEnabled();
+  return DefaultAdapterExists() ? mAdapters[mDefaultAdapterIndex] : nullptr;
 }
 
-already_AddRefed<dom::DOMRequest>
-BluetoothManager::GetDefaultAdapter(ErrorResult& aRv)
+void
+BluetoothManager::AppendAdapter(const BluetoothValue& aValue)
 {
-  nsCOMPtr<nsPIDOMWindow> win = GetOwner();
-  if (!win) {
-    aRv.Throw(NS_ERROR_FAILURE);
-    return nullptr;
-  }
+  MOZ_ASSERT(aValue.type() == BluetoothValue::TArrayOfBluetoothNamedValue);
 
-  nsRefPtr<DOMRequest> request = new DOMRequest(win);
-  nsRefPtr<BluetoothReplyRunnable> results =
-    new GetAdapterTask(this, request);
+  // Create a new BluetoothAdapter and append it to adapters array
+  const InfallibleTArray<BluetoothNamedValue>& values =
+    aValue.get_ArrayOfBluetoothNamedValue();
+  nsRefPtr<BluetoothAdapter> adapter =
+    BluetoothAdapter::Create(GetOwner(), values);
 
-  BluetoothService* bs = BluetoothService::Get();
-  if (!bs) {
-    aRv.Throw(NS_ERROR_FAILURE);
-    return nullptr;
-  }
+  mAdapters.AppendElement(adapter);
 
-  nsresult rv = bs->GetDefaultAdapterPathInternal(results);
-  if (NS_FAILED(rv)) {
-    aRv.Throw(rv);
-    return nullptr;
+  // Set this adapter as default adapter if no adapter exists
+  if (!DefaultAdapterExists()) {
+    MOZ_ASSERT(mAdapters.Length() == 1);
+    ReselectDefaultAdapter();
   }
+}
 
-  return request.forget();
+void
+BluetoothManager::GetAdapters(nsTArray<nsRefPtr<BluetoothAdapter> >& aAdapters)
+{
+  aAdapters = mAdapters;
 }
 
 // static
 already_AddRefed<BluetoothManager>
 BluetoothManager::Create(nsPIDOMWindow* aWindow)
 {
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(aWindow);
 
   nsRefPtr<BluetoothManager> manager = new BluetoothManager(aWindow);
   return manager.forget();
 }
 
 void
+BluetoothManager::HandleAdapterAdded(const BluetoothValue& aValue)
+{
+  MOZ_ASSERT(aValue.type() == BluetoothValue::TArrayOfBluetoothNamedValue);
+  BT_API2_LOGR();
+
+  AppendAdapter(aValue);
+
+  // Notify application of added adapter
+  BluetoothAdapterEventInit init;
+  init.mAdapter = mAdapters.LastElement();
+  DispatchAdapterEvent(NS_LITERAL_STRING("adapteradded"), init);
+}
+
+void
+BluetoothManager::HandleAdapterRemoved(const BluetoothValue& aValue)
+{
+  MOZ_ASSERT(aValue.type() == BluetoothValue::TnsString);
+  MOZ_ASSERT(DefaultAdapterExists());
+
+  // Remove the adapter of given address from adapters array
+  nsString addressToRemove = aValue.get_nsString();
+
+  uint32_t numAdapters = mAdapters.Length();
+  for (uint32_t i = 0; i < numAdapters; i++) {
+    nsString address;
+    mAdapters[i]->GetAddress(address);
+    if (address.Equals(addressToRemove)) {
+      mAdapters.RemoveElementAt(i);
+
+      if (mDefaultAdapterIndex == (int)i) {
+        ReselectDefaultAdapter();
+      }
+      break;
+    }
+  }
+
+  // Notify application of removed adapter
+  BluetoothAdapterEventInit init;
+  init.mAddress = addressToRemove;
+  DispatchAdapterEvent(NS_LITERAL_STRING("adapterremoved"), init);
+}
+
+void
+BluetoothManager::ReselectDefaultAdapter()
+{
+  // Select the first of existing/remaining adapters as default adapter
+  mDefaultAdapterIndex = mAdapters.IsEmpty() ? -1 : 0;
+  BT_API2_LOGR("mAdapters length: %d => NEW mDefaultAdapterIndex: %d",
+               mAdapters.Length(), mDefaultAdapterIndex);
+
+  // Notify application of default adapter change
+  DispatchAttributeEvent();
+}
+
+void
+BluetoothManager::DispatchAdapterEvent(const nsAString& aType,
+                                       const BluetoothAdapterEventInit& aInit)
+{
+  BT_API2_LOGR("aType (%s)", NS_ConvertUTF16toUTF8(aType).get());
+
+  nsRefPtr<BluetoothAdapterEvent> event =
+    BluetoothAdapterEvent::Constructor(this, aType, aInit);
+  DispatchTrustedEvent(event);
+}
+
+void
+BluetoothManager::DispatchAttributeEvent()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  BT_API2_LOGR();
+
+  // Wrap default adapter
+  AutoJSContext cx;
+  JS::Rooted<JS::Value> value(cx, JS::NullValue());
+  if (DefaultAdapterExists()) {
+    BluetoothAdapter* adapter = mAdapters[mDefaultAdapterIndex];
+    nsCOMPtr<nsIGlobalObject> global =
+      do_QueryInterface(adapter->GetParentObject());
+    NS_ENSURE_TRUE_VOID(global);
+
+    JS::Rooted<JSObject*> scope(cx, global->GetGlobalJSObject());
+    NS_ENSURE_TRUE_VOID(scope);
+
+    JSAutoCompartment ac(cx, scope);
+    if (!ToJSValue(cx, adapter, &value)) {
+      JS_ClearPendingException(cx);
+      return;
+    }
+
+    BT_API2_LOGR("Default adapter is wrapped");
+  }
+
+  // Notify application of default adapter change
+  RootedDictionary<BluetoothAttributeEventInit> init(cx);
+  init.mAttr = (uint16_t)BluetoothManagerAttribute::DefaultAdapter;
+  init.mValue = value;
+  nsRefPtr<BluetoothAttributeEvent> event =
+    BluetoothAttributeEvent::Constructor(this,
+                                         NS_LITERAL_STRING("attributechanged"),
+                                         init);
+  DispatchTrustedEvent(event);
+}
+
+void
 BluetoothManager::Notify(const BluetoothSignal& aData)
 {
-  BT_LOGD("[M] %s: %s", __FUNCTION__, NS_ConvertUTF16toUTF8(aData.name()).get());
+  BT_LOGD("[M] %s", NS_ConvertUTF16toUTF8(aData.name()).get());
 
   if (aData.name().EqualsLiteral("AdapterAdded")) {
-    DispatchTrustedEvent(NS_LITERAL_STRING("adapteradded"));
-  } else if (aData.name().EqualsLiteral("Enabled")) {
-    DispatchTrustedEvent(NS_LITERAL_STRING("enabled"));
-  } else if (aData.name().EqualsLiteral("Disabled")) {
-    DispatchTrustedEvent(NS_LITERAL_STRING("disabled"));
+    HandleAdapterAdded(aData.value());
+  } else if (aData.name().EqualsLiteral("AdapterRemoved")) {
+    HandleAdapterRemoved(aData.value());
   } else {
-#ifdef DEBUG
-    nsCString warningMsg;
-    warningMsg.AssignLiteral("Not handling manager signal: ");
-    warningMsg.Append(NS_ConvertUTF16toUTF8(aData.name()));
-    BT_WARNING(warningMsg.get());
-#endif
+    BT_WARNING("Not handling manager signal: %s",
+               NS_ConvertUTF16toUTF8(aData.name()).get());
   }
 }
 
-bool
-BluetoothManager::IsConnected(uint16_t aProfileId, ErrorResult& aRv)
-{
-  BluetoothService* bs = BluetoothService::Get();
-  if (!bs) {
-    aRv.Throw(NS_ERROR_FAILURE);
-    return false;
-  }
-
-  return bs->IsConnected(aProfileId);
-}
-
 JSObject*
 BluetoothManager::WrapObject(JSContext* aCx)
 {
   return BluetoothManagerBinding::Wrap(aCx, this);
 }
--- a/dom/bluetooth2/BluetoothManager.h
+++ b/dom/bluetooth2/BluetoothManager.h
@@ -2,66 +2,137 @@
 /* vim: set ts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef mozilla_dom_bluetooth_bluetoothmanager_h__
 #define mozilla_dom_bluetooth_bluetoothmanager_h__
 
+#include "BluetoothCommon.h"
 #include "mozilla/Attributes.h"
+#include "mozilla/dom/BluetoothAdapterEvent.h"
+#include "mozilla/dom/BluetoothAttributeEvent.h"
 #include "mozilla/DOMEventTargetHelper.h"
 #include "mozilla/Observer.h"
-#include "BluetoothCommon.h"
-#include "BluetoothPropertyContainer.h"
 #include "nsISupportsImpl.h"
 
-namespace mozilla {
-namespace dom {
-class DOMRequest;
-}
-}
-
 BEGIN_BLUETOOTH_NAMESPACE
 
-class BluetoothNamedValue;
+class BluetoothAdapter;
+class BluetoothValue;
 
 class BluetoothManager : public DOMEventTargetHelper
                        , public BluetoothSignalObserver
-                       , public BluetoothPropertyContainer
 {
 public:
   NS_DECL_ISUPPORTS_INHERITED
 
   // Never returns null
-  static already_AddRefed<BluetoothManager>
-    Create(nsPIDOMWindow* aWindow);
+  static already_AddRefed<BluetoothManager> Create(nsPIDOMWindow* aWindow);
   static bool CheckPermission(nsPIDOMWindow* aWindow);
-  void Notify(const BluetoothSignal& aData);
-  virtual void SetPropertyByValue(const BluetoothNamedValue& aValue) MOZ_OVERRIDE;
+
+  /**
+   * Return default adapter if it exists, nullptr otherwise. The function is
+   * called when applications access property BluetoothManager.defaultAdapter
+   */
+  BluetoothAdapter* GetDefaultAdapter();
 
-  bool GetEnabled(ErrorResult& aRv);
-  bool IsConnected(uint16_t aProfileId, ErrorResult& aRv);
-
-  already_AddRefed<DOMRequest> GetDefaultAdapter(ErrorResult& aRv);
+  /**
+   * Return adapters array. The function is called when applications call
+   * method BluetoothManager.getAdapters()
+   *
+   * @param aAdapters [out] Adapters array to return
+   */
+  void GetAdapters(nsTArray<nsRefPtr<BluetoothAdapter> >& aAdapters);
 
-  IMPL_EVENT_HANDLER(enabled);
-  IMPL_EVENT_HANDLER(disabled);
+  /**
+   * Create a BluetoothAdapter object based on properties array
+   * and append it into adapters array.
+   *
+   * @param aValue [in] Properties array to create BluetoothAdapter object
+   */
+  void AppendAdapter(const BluetoothValue& aValue);
+
+  IMPL_EVENT_HANDLER(attributechanged);
   IMPL_EVENT_HANDLER(adapteradded);
+  IMPL_EVENT_HANDLER(adapterremoved);
 
+  void Notify(const BluetoothSignal& aData); // BluetoothSignalObserver
   nsPIDOMWindow* GetParentObject() const
   {
-     return GetOwner();
+    return GetOwner();
   }
 
-  virtual JSObject*
-    WrapObject(JSContext* aCx) MOZ_OVERRIDE;
-
+  virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
   virtual void DisconnectFromOwner() MOZ_OVERRIDE;
 
 private:
   BluetoothManager(nsPIDOMWindow* aWindow);
   ~BluetoothManager();
+
+  /**
+   * Start/Stop listening to bluetooth signal.
+   *
+   * @param aStart [in] Whether to start or stop listening to bluetooth signal
+   */
+  void ListenToBluetoothSignal(bool aStart);
+
+  /**
+   * Check whether default adapter exists.
+   */
+  bool DefaultAdapterExists()
+  {
+    return (mDefaultAdapterIndex >= 0);
+  }
+
+  /**
+   * Handle "AdapterAdded" bluetooth signal.
+   *
+   * @param aValue [in] Properties array of the added adapter
+   */
+  void HandleAdapterAdded(const BluetoothValue& aValue);
+
+  /**
+   * Handle "AdapterRemoved" bluetooth signal.
+   *
+   * @param aValue [in] Address of the removed adapter
+   */
+  void HandleAdapterRemoved(const BluetoothValue& aValue);
+
+  /**
+   * Re-select default adapter from adapters array. The function is called
+   * when an adapter is added/removed.
+   */
+  void ReselectDefaultAdapter();
+
+  /**
+   * Fire BluetoothAdapterEvent to trigger
+   * onadapteradded/onadapterremoved event handler.
+   *
+   * @param aType [in] Event type to fire
+   * @param aInit [in] Event initialization value
+   */
+  void DispatchAdapterEvent(const nsAString& aType,
+                            const BluetoothAdapterEventInit& aInit);
+
+  /**
+   * Fire BluetoothAttributeEvent to trigger onattributechanged event handler.
+   */
+  void DispatchAttributeEvent();
+
+  /****************************************************************************
+   * Variables
+   ***************************************************************************/
+  /**
+   * The index of default adapter in the adapters array.
+   */
+  int mDefaultAdapterIndex;
+
+  /**
+   * The adapters array.
+   */
+  nsTArray<nsRefPtr<BluetoothAdapter> > mAdapters;
 };
 
 END_BLUETOOTH_NAMESPACE
 
 #endif
--- a/dom/bluetooth2/BluetoothReplyRunnable.cpp
+++ b/dom/bluetooth2/BluetoothReplyRunnable.cpp
@@ -29,40 +29,43 @@ BluetoothReplyRunnable::ReleaseMembers()
 }
 
 BluetoothReplyRunnable::~BluetoothReplyRunnable()
 {}
 
 nsresult
 BluetoothReplyRunnable::FireReply(JS::Handle<JS::Value> aVal)
 {
+  NS_ENSURE_TRUE(mDOMRequest, NS_OK);
+
   nsCOMPtr<nsIDOMRequestService> rs =
     do_GetService(DOMREQUEST_SERVICE_CONTRACTID);
   NS_ENSURE_TRUE(rs, NS_ERROR_FAILURE);
 
   return mReply->type() == BluetoothReply::TBluetoothReplySuccess ?
     rs->FireSuccessAsync(mDOMRequest, aVal) :
     rs->FireErrorAsync(mDOMRequest, mReply->get_BluetoothReplyError().error());
 }
 
 nsresult
 BluetoothReplyRunnable::FireErrorString()
 {
+  NS_ENSURE_TRUE(mDOMRequest, NS_OK);
+
   nsCOMPtr<nsIDOMRequestService> rs =
     do_GetService("@mozilla.org/dom/dom-request-service;1");
   NS_ENSURE_TRUE(rs, NS_ERROR_FAILURE);
 
   return rs->FireErrorAsync(mDOMRequest, mErrorString);
 }
 
 NS_IMETHODIMP
 BluetoothReplyRunnable::Run()
 {
   MOZ_ASSERT(NS_IsMainThread());
-  MOZ_ASSERT(mDOMRequest);
   MOZ_ASSERT(mReply);
 
   nsresult rv;
 
   AutoSafeJSContext cx;
   JS::Rooted<JS::Value> v(cx, JSVAL_VOID);
 
   if (mReply->type() != BluetoothReply::TBluetoothReplySuccess) {
--- a/dom/bluetooth2/BluetoothReplyRunnable.h
+++ b/dom/bluetooth2/BluetoothReplyRunnable.h
@@ -43,16 +43,20 @@ protected:
   // header. We assume we'll only be running this once and it should die on
   // scope out of Run() anyways.
   nsAutoPtr<BluetoothReply> mReply;
 
 private:
   nsresult FireReply(JS::Handle<JS::Value> aVal);
   nsresult FireErrorString();
 
+  /**
+   * mDOMRequest is nullptr for internal IPC that require no DOMRequest,
+   * e.g., GetAdaptersTask triggered by BluetoothManager
+   */
   nsCOMPtr<nsIDOMDOMRequest> mDOMRequest;
   nsString mErrorString;
 };
 
 class BluetoothVoidReplyRunnable : public BluetoothReplyRunnable
 {
 public:
   BluetoothVoidReplyRunnable(nsIDOMDOMRequest* aReq);
--- a/dom/bluetooth2/BluetoothService.cpp
+++ b/dom/bluetooth2/BluetoothService.cpp
@@ -370,21 +370,18 @@ BluetoothService::DistributeSignal(const
     return;
   } else if (aSignal.path().EqualsLiteral(KEY_REMOTE_AGENT)) {
     Notify(aSignal);
     return;
   }
 
   BluetoothSignalObserverList* ol;
   if (!mBluetoothSignalObserverTable.Get(aSignal.path(), &ol)) {
-#if DEBUG
-    nsAutoCString msg("No observer registered for path ");
-    msg.Append(NS_ConvertUTF16toUTF8(aSignal.path()));
-    BT_WARNING(msg.get());
-#endif
+    BT_WARNING("No observer registered for path %s",
+               NS_ConvertUTF16toUTF8(aSignal.path()).get());
     return;
   }
   MOZ_ASSERT(ol->Length());
   ol->Broadcast(aSignal);
 }
 
 nsresult
 BluetoothService::StartBluetooth(bool aIsStartup)
--- a/dom/bluetooth2/BluetoothService.h
+++ b/dom/bluetooth2/BluetoothService.h
@@ -118,23 +118,23 @@ public:
   static already_AddRefed<BluetoothService>
   FactoryCreate()
   {
     nsRefPtr<BluetoothService> service = Get();
     return service.forget();
   }
 
   /**
-   * Returns the path of the default adapter, implemented via a platform
+   * Returns an array of each adapter's properties, implemented via a platform
    * specific method.
    *
    * @return NS_OK on success, NS_ERROR_FAILURE otherwise
    */
   virtual nsresult
-  GetDefaultAdapterPathInternal(BluetoothReplyRunnable* aRunnable) = 0;
+  GetAdaptersInternal(BluetoothReplyRunnable* aRunnable) = 0;
 
   /**
    * Returns the properties of paired devices, implemented via a platform
    * specific method.
    *
    * @return NS_OK on success, NS_ERROR_FAILURE otherwise
    */
   virtual nsresult
--- a/dom/bluetooth2/bluedroid/BluetoothServiceBluedroid.cpp
+++ b/dom/bluetooth2/bluedroid/BluetoothServiceBluedroid.cpp
@@ -803,40 +803,55 @@ BluetoothServiceBluedroid::StopInternal(
     }
     BT_LOGR("Error");
   }
 
   return ret;
 }
 
 nsresult
-BluetoothServiceBluedroid::GetDefaultAdapterPathInternal(
+BluetoothServiceBluedroid::GetAdaptersInternal(
   BluetoothReplyRunnable* aRunnable)
 {
   MOZ_ASSERT(NS_IsMainThread());
 
-  BluetoothValue v = InfallibleTArray<BluetoothNamedValue>();
+  /**
+   * Wrap BluetoothValue =
+   *   BluetoothNamedValue[]
+   *     |
+   *     |__ BluetoothNamedValue =
+   *     |     {"Adapter", BluetoothValue = BluetoothNamedValue[]}
+   *     |
+   *     |__ BluetoothNamedValue =
+   *     |     {"Adapter", BluetoothValue = BluetoothNamedValue[]}
+   *     ...
+   */
+  BluetoothValue adaptersProperties = InfallibleTArray<BluetoothNamedValue>();
+  uint32_t numAdapters = 1; // Bluedroid supports single adapter only
 
-  BT_APPEND_NAMED_VALUE(v.get_ArrayOfBluetoothNamedValue(),
-                        "Address", sAdapterBdAddress);
-
-  BT_APPEND_NAMED_VALUE(v.get_ArrayOfBluetoothNamedValue(),
-                        "Name", sAdapterBdName);
+  for (uint32_t i = 0; i < numAdapters; i++) {
+    BluetoothValue properties = InfallibleTArray<BluetoothNamedValue>();
 
-  BT_APPEND_NAMED_VALUE(v.get_ArrayOfBluetoothNamedValue(),
-                        "Discoverable", sAdapterDiscoverable);
-
-  BT_APPEND_NAMED_VALUE(v.get_ArrayOfBluetoothNamedValue(),
-                        "DiscoverableTimeout", sAdapterDiscoverableTimeout);
+    // TODO: Revise here based on new BluetoothAdapter interface
+    BT_APPEND_NAMED_VALUE(properties.get_ArrayOfBluetoothNamedValue(),
+                          "Address", sAdapterBdAddress);
+    BT_APPEND_NAMED_VALUE(properties.get_ArrayOfBluetoothNamedValue(),
+                          "Name", sAdapterBdName);
+    BT_APPEND_NAMED_VALUE(properties.get_ArrayOfBluetoothNamedValue(),
+                          "Discoverable", sAdapterDiscoverable);
+    BT_APPEND_NAMED_VALUE(properties.get_ArrayOfBluetoothNamedValue(),
+                          "DiscoverableTimeout", sAdapterDiscoverableTimeout);
+    BT_APPEND_NAMED_VALUE(properties.get_ArrayOfBluetoothNamedValue(),
+                          "Devices", sAdapterBondedAddressArray);
 
-  BT_APPEND_NAMED_VALUE(v.get_ArrayOfBluetoothNamedValue(),
-                        "Devices", sAdapterBondedAddressArray);
+    BT_APPEND_NAMED_VALUE(adaptersProperties.get_ArrayOfBluetoothNamedValue(),
+                          "Adapter", properties);
+  }
 
-  DispatchBluetoothReply(aRunnable, v, EmptyString());
-
+  DispatchBluetoothReply(aRunnable, adaptersProperties, EmptyString());
   return NS_OK;
 }
 
 nsresult
 BluetoothServiceBluedroid::GetConnectedDevicePropertiesInternal(
   uint16_t aServiceUuid, BluetoothReplyRunnable* aRunnable)
 {
   MOZ_ASSERT(NS_IsMainThread());
--- a/dom/bluetooth2/bluedroid/BluetoothServiceBluedroid.h
+++ b/dom/bluetooth2/bluedroid/BluetoothServiceBluedroid.h
@@ -20,25 +20,26 @@ public:
   static const bt_interface_t* GetBluetoothInterface();
 
   BluetoothServiceBluedroid();
   ~BluetoothServiceBluedroid();
 
   virtual nsresult StartInternal();
   virtual nsresult StopInternal();
 
-  virtual nsresult GetDefaultAdapterPathInternal(
-                                             BluetoothReplyRunnable* aRunnable);
+  virtual nsresult
+  GetAdaptersInternal(BluetoothReplyRunnable* aRunnable);
 
-  virtual nsresult GetConnectedDevicePropertiesInternal(uint16_t aProfileId,
-                                             BluetoothReplyRunnable* aRunnable);
+  virtual nsresult
+  GetConnectedDevicePropertiesInternal(uint16_t aProfileId,
+                                       BluetoothReplyRunnable* aRunnable);
 
-  virtual nsresult GetPairedDevicePropertiesInternal(
-                                     const nsTArray<nsString>& aDeviceAddress,
-                                     BluetoothReplyRunnable* aRunnable);
+  virtual nsresult
+  GetPairedDevicePropertiesInternal(const nsTArray<nsString>& aDeviceAddress,
+                                    BluetoothReplyRunnable* aRunnable);
 
   virtual nsresult StartDiscoveryInternal(BluetoothReplyRunnable* aRunnable);
   virtual nsresult StopDiscoveryInternal(BluetoothReplyRunnable* aRunnable);
 
   virtual nsresult
   SetProperty(BluetoothObjectType aType,
               const BluetoothNamedValue& aValue,
               BluetoothReplyRunnable* aRunnable);
--- a/dom/bluetooth2/bluez/BluetoothDBusService.cpp
+++ b/dom/bluetooth2/bluez/BluetoothDBusService.cpp
@@ -2371,21 +2371,24 @@ public:
     unused << handler.forget(); // picked up by callback handler
   }
 
 private:
   nsRefPtr<BluetoothReplyRunnable> mRunnable;
 };
 
 nsresult
-BluetoothDBusService::GetDefaultAdapterPathInternal(
-                                              BluetoothReplyRunnable* aRunnable)
+BluetoothDBusService::GetAdaptersInternal(BluetoothReplyRunnable* aRunnable)
 {
   MOZ_ASSERT(NS_IsMainThread());
 
+  /**
+   * TODO: implement method GetAdaptersInternal for bluez
+   */
+
   if (!IsReady()) {
     NS_NAMED_LITERAL_STRING(errorStr, "Bluetooth service is not ready yet!");
     DispatchBluetoothReply(aRunnable, BluetoothValue(), errorStr);
     return NS_OK;
   }
 
   Task* task = new DefaultAdapterTask(aRunnable);
   DispatchToDBusThread(task);
--- a/dom/bluetooth2/bluez/BluetoothDBusService.h
+++ b/dom/bluetooth2/bluez/BluetoothDBusService.h
@@ -46,25 +46,26 @@ public:
   ~BluetoothDBusService();
 
   bool IsReady();
 
   virtual nsresult StartInternal() MOZ_OVERRIDE;
 
   virtual nsresult StopInternal() MOZ_OVERRIDE;
 
-  virtual nsresult GetDefaultAdapterPathInternal(
-                                             BluetoothReplyRunnable* aRunnable) MOZ_OVERRIDE;
+  virtual nsresult
+  GetAdaptersInternal(BluetoothReplyRunnable* aRunnable) MOZ_OVERRIDE;
 
-  virtual nsresult GetConnectedDevicePropertiesInternal(uint16_t aServiceUuid,
-                                             BluetoothReplyRunnable* aRunnable) MOZ_OVERRIDE;
+  virtual nsresult
+  GetConnectedDevicePropertiesInternal(uint16_t aServiceUuid,
+                                       BluetoothReplyRunnable* aRunnable) MOZ_OVERRIDE;
 
-  virtual nsresult GetPairedDevicePropertiesInternal(
-                                     const nsTArray<nsString>& aDeviceAddresses,
-                                     BluetoothReplyRunnable* aRunnable) MOZ_OVERRIDE;
+  virtual nsresult
+  GetPairedDevicePropertiesInternal(const nsTArray<nsString>& aDeviceAddresses,
+                                    BluetoothReplyRunnable* aRunnable) MOZ_OVERRIDE;
 
   virtual nsresult StartDiscoveryInternal(BluetoothReplyRunnable* aRunnable) MOZ_OVERRIDE;
 
   virtual nsresult StopDiscoveryInternal(BluetoothReplyRunnable* aRunnable) MOZ_OVERRIDE;
 
   virtual nsresult
   SetProperty(BluetoothObjectType aType,
               const BluetoothNamedValue& aValue,
--- a/dom/bluetooth2/ipc/BluetoothParent.cpp
+++ b/dom/bluetooth2/ipc/BluetoothParent.cpp
@@ -178,18 +178,18 @@ BluetoothParent::RecvPBluetoothRequestCo
 {
   BluetoothRequestParent* actor = static_cast<BluetoothRequestParent*>(aActor);
 
 #ifdef DEBUG
   actor->mRequestType = aRequest.type();
 #endif
 
   switch (aRequest.type()) {
-    case Request::TDefaultAdapterPathRequest:
-      return actor->DoRequest(aRequest.get_DefaultAdapterPathRequest());
+    case Request::TGetAdaptersRequest:
+      return actor->DoRequest(aRequest.get_GetAdaptersRequest());
     case Request::TSetPropertyRequest:
       return actor->DoRequest(aRequest.get_SetPropertyRequest());
     case Request::TStartDiscoveryRequest:
       return actor->DoRequest(aRequest.get_StartDiscoveryRequest());
     case Request::TStopDiscoveryRequest:
       return actor->DoRequest(aRequest.get_StopDiscoveryRequest());
     case Request::TPairRequest:
       return actor->DoRequest(aRequest.get_PairRequest());
@@ -298,22 +298,22 @@ BluetoothRequestParent::RequestComplete(
 {
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(mReplyRunnable.IsPending());
 
   mReplyRunnable.Forget();
 }
 
 bool
-BluetoothRequestParent::DoRequest(const DefaultAdapterPathRequest& aRequest)
+BluetoothRequestParent::DoRequest(const GetAdaptersRequest& aRequest)
 {
   MOZ_ASSERT(mService);
-  MOZ_ASSERT(mRequestType == Request::TDefaultAdapterPathRequest);
+  MOZ_ASSERT(mRequestType == Request::TGetAdaptersRequest);
 
-  nsresult rv = mService->GetDefaultAdapterPathInternal(mReplyRunnable.get());
+  nsresult rv = mService->GetAdaptersInternal(mReplyRunnable.get());
   NS_ENSURE_SUCCESS(rv, false);
 
   return true;
 }
 
 bool
 BluetoothRequestParent::DoRequest(const SetPropertyRequest& aRequest)
 {
--- a/dom/bluetooth2/ipc/BluetoothParent.h
+++ b/dom/bluetooth2/ipc/BluetoothParent.h
@@ -121,17 +121,17 @@ protected:
 
   virtual void
   ActorDestroy(ActorDestroyReason aWhy) MOZ_OVERRIDE;
 
   void
   RequestComplete();
 
   bool
-  DoRequest(const DefaultAdapterPathRequest& aRequest);
+  DoRequest(const GetAdaptersRequest& aRequest);
 
   bool
   DoRequest(const SetPropertyRequest& aRequest);
 
   bool
   DoRequest(const GetPropertyRequest& aRequest);
 
   bool
--- a/dom/bluetooth2/ipc/BluetoothServiceChildProcess.cpp
+++ b/dom/bluetooth2/ipc/BluetoothServiceChildProcess.cpp
@@ -91,20 +91,20 @@ BluetoothServiceChildProcess::Unregister
 {
   BluetoothService::UnregisterBluetoothSignalHandler(aNodeName, aHandler);
   if (sBluetoothChild && !IsSignalRegistered(aNodeName)) {
     sBluetoothChild->SendUnregisterSignalHandler(nsString(aNodeName));
   }
 }
 
 nsresult
-BluetoothServiceChildProcess::GetDefaultAdapterPathInternal(
+BluetoothServiceChildProcess::GetAdaptersInternal(
                                               BluetoothReplyRunnable* aRunnable)
 {
-  SendRequest(aRunnable, DefaultAdapterPathRequest());
+  SendRequest(aRunnable, GetAdaptersRequest());
   return NS_OK;
 }
 
 nsresult
 BluetoothServiceChildProcess::GetConnectedDevicePropertiesInternal(
                                               uint16_t aServiceUuid,
                                               BluetoothReplyRunnable* aRunnable)
 {
--- a/dom/bluetooth2/ipc/BluetoothServiceChildProcess.h
+++ b/dom/bluetooth2/ipc/BluetoothServiceChildProcess.h
@@ -39,17 +39,17 @@ public:
                                  MOZ_OVERRIDE;
 
   virtual void
   UnregisterBluetoothSignalHandler(const nsAString& aNodeName,
                                    BluetoothSignalObserver* aMsgHandler)
                                    MOZ_OVERRIDE;
 
   virtual nsresult
-  GetDefaultAdapterPathInternal(BluetoothReplyRunnable* aRunnable) MOZ_OVERRIDE;
+  GetAdaptersInternal(BluetoothReplyRunnable* aRunnable) MOZ_OVERRIDE;
 
   virtual nsresult
   GetPairedDevicePropertiesInternal(const nsTArray<nsString>& aDeviceAddresses,
                                     BluetoothReplyRunnable* aRunnable)
                                     MOZ_OVERRIDE;
 
   virtual nsresult
   GetConnectedDevicePropertiesInternal(uint16_t aServiceUuid,
--- a/dom/bluetooth2/ipc/PBluetooth.ipdl
+++ b/dom/bluetooth2/ipc/PBluetooth.ipdl
@@ -17,17 +17,17 @@ using mozilla::dom::bluetooth::Bluetooth
 namespace mozilla {
 namespace dom {
 namespace bluetooth {
 
 /**
  * Bluetooth request types.
  */
 
-struct DefaultAdapterPathRequest
+struct GetAdaptersRequest
 { };
 
 struct SetPropertyRequest
 {
   BluetoothObjectType type;
   BluetoothNamedValue value;
 };
 
@@ -160,17 +160,17 @@ struct SendPlayStatusRequest
 {
   int64_t duration;
   int64_t position;
   nsString playStatus;
 };
 
 union Request
 {
-  DefaultAdapterPathRequest;
+  GetAdaptersRequest;
   SetPropertyRequest;
   GetPropertyRequest;
   StartDiscoveryRequest;
   StopDiscoveryRequest;
   PairRequest;
   UnpairRequest;
   SetPinCodeRequest;
   SetPasskeyRequest;
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -305,17 +305,17 @@ MaybeTestPBackground()
                                                false);
     MOZ_RELEASE_ASSERT(NS_SUCCEEDED(rv));
 #endif
 }
 
 // XXX Workaround for bug 986973 to maintain the existing broken semantics
 template<>
 struct nsIConsoleService::COMTypeInfo<nsConsoleService, void> {
-  static const nsIID kIID NS_HIDDEN;
+  static const nsIID kIID;
 };
 const nsIID nsIConsoleService::COMTypeInfo<nsConsoleService, void>::kIID = NS_ICONSOLESERVICE_IID;
 
 namespace mozilla {
 namespace dom {
 
 #define NS_IPC_IOSERVICE_SET_OFFLINE_TOPIC "ipc:network:set-offline"
 
--- a/dom/ipc/TabParent.cpp
+++ b/dom/ipc/TabParent.cpp
@@ -2007,20 +2007,36 @@ TabParent::InjectTouchEvent(const nsAStr
   if (!widget) {
     return NS_ERROR_FAILURE;
   }
 
   WidgetTouchEvent event(true, msg, widget);
   event.modifiers = aModifiers;
   event.time = PR_IntervalNow();
 
+  nsCOMPtr<nsIContent> content = do_QueryInterface(mFrameElement);
+  if (!content || !content->OwnerDoc()) {
+    return NS_ERROR_FAILURE;
+  }
+
+  nsIDocument* doc = content->OwnerDoc();
+  if (!doc || !doc->GetShell()) {
+    return NS_ERROR_FAILURE;
+  }
+  nsPresContext* presContext = doc->GetShell()->GetPresContext();
+
   event.touches.SetCapacity(aCount);
   for (uint32_t i = 0; i < aCount; ++i) {
+    LayoutDeviceIntPoint pt =
+      LayoutDeviceIntPoint::FromAppUnitsRounded(
+        CSSPoint::ToAppUnits(CSSPoint(aXs[i], aYs[i])),
+        presContext->AppUnitsPerDevPixel());
+
     nsRefPtr<Touch> t = new Touch(aIdentifiers[i],
-                                  nsIntPoint(aXs[i], aYs[i]),
+                                  LayoutDeviceIntPoint::ToUntyped(pt),
                                   nsIntPoint(aRxs[i], aRys[i]),
                                   aRotationAngles[i],
                                   aForces[i]);
 
     // Consider all injected touch events as changedTouches. For more details
     // about the meaning of changedTouches for each event, see
     // https://developer.mozilla.org/docs/Web/API/TouchEvent.changedTouches
     t->mChanged = true;
--- a/dom/locales/en-US/chrome/dom/dom.properties
+++ b/dom/locales/en-US/chrome/dom/dom.properties
@@ -28,20 +28,28 @@ FormValidationCheckboxMissing=Please che
 FormValidationRadioMissing=Please select one of these options.
 FormValidationFileMissing=Please select a file.
 FormValidationSelectMissing=Please select an item in the list.
 FormValidationInvalidEmail=Please enter an email address.
 FormValidationInvalidURL=Please enter a URL.
 FormValidationPatternMismatch=Please match the requested format.
 # LOCALIZATION NOTE (FormValidationPatternMismatchWithTitle): %S is the (possibly truncated) title attribute value.
 FormValidationPatternMismatchWithTitle=Please match the requested format: %S.
-# LOCALIZATION NOTE (FormValidationRangeOverflow): %S can be a number, a date or a time.
-FormValidationRangeOverflow=Please select a value that is lower than %S.
-# LOCALIZATION NOTE (FormValidationRangeUnderflow): %S can be a number, a date or a time.
-FormValidationRangeUnderflow=Please select a value that is higher than %S.
+# LOCALIZATION NOTE (FormValidationNumberRangeOverflow): %S is a number.
+FormValidationNumberRangeOverflow=Please select a value that is no more than %S.
+# LOCALIZATION NOTE (FormValidationDateRangeOverflow): %S is a date.
+FormValidationDateRangeOverflow=Please select a value that is no later than %S.
+# LOCALIZATION NOTE (FormValidationTimeRangeOverflow): %S is a time.
+FormValidationTimeRangeOverflow=Please select a value that is no later than %S.
+# LOCALIZATION NOTE (FormValidationNumberRangeUnderflow): %S is a number.
+FormValidationNumberRangeUnderflow=Please select a value that is no less than %S.
+# LOCALIZATION NOTE (FormValidationDateRangeUnderflow): %S is a date.
+FormValidationDateRangeUnderflow=Please select a value that is no earlier than %S.
+# LOCALIZATION NOTE (FormValidationTimeRangeUnderflow): %S is a time.
+FormValidationTimeRangeUnderflow=Please select a value that is no earlier than %S.
 # LOCALIZATION NOTE (FormValidationStepMismatch): both %S can be a number, a date or a time.
 FormValidationStepMismatch=Please select a valid value. The two nearest valid values are %S and %S.
 # LOCALIZATION NOTE (FormValidationStepMismatchOneValue): %S can be a number, a date or a time. This is called instead of FormValidationStepMismatch when the second value is the same as the first.
 FormValidationStepMismatchOneValue=Please select a valid value. The nearest valid value is %S.
 FormValidationBadInputNumber=Please enter a number.
 GetAttributeNodeWarning=Use of getAttributeNode() is deprecated. Use getAttribute() instead.
 SetAttributeNodeWarning=Use of setAttributeNode() is deprecated. Use setAttribute() instead.
 GetAttributeNodeNSWarning=Use of getAttributeNodeNS() is deprecated. Use getAttributeNS() instead.
--- a/dom/media/MediaManager.cpp
+++ b/dom/media/MediaManager.cpp
@@ -57,22 +57,22 @@
 // GetTickCount() and conflicts with MediaStream::GetCurrentTime.
 #ifdef GetCurrentTime
 #undef GetCurrentTime
 #endif
 
 // XXX Workaround for bug 986974 to maintain the existing broken semantics
 template<>
 struct nsIMediaDevice::COMTypeInfo<mozilla::VideoDevice, void> {
-  static const nsIID kIID NS_HIDDEN;
+  static const nsIID kIID;
 };
 const nsIID nsIMediaDevice::COMTypeInfo<mozilla::VideoDevice, void>::kIID = NS_IMEDIADEVICE_IID;
 template<>
 struct nsIMediaDevice::COMTypeInfo<mozilla::AudioDevice, void> {
-  static const nsIID kIID NS_HIDDEN;
+  static const nsIID kIID;
 };
 const nsIID nsIMediaDevice::COMTypeInfo<mozilla::AudioDevice, void>::kIID = NS_IMEDIADEVICE_IID;
 
 namespace mozilla {
 
 #ifdef LOG
 #undef LOG
 #endif
--- a/dom/mobilemessage/src/MmsMessage.cpp
+++ b/dom/mobilemessage/src/MmsMessage.cpp
@@ -480,21 +480,21 @@ MmsMessage::GetSender(nsAString& aSender
 {
   aSender = mSender;
   return NS_OK;
 }
 
 NS_IMETHODIMP
 MmsMessage::GetReceivers(JSContext* aCx, JS::MutableHandle<JS::Value> aReceivers)
 {
-  JS::Rooted<JSObject*> reveiversObj(aCx);
-  nsresult rv = nsTArrayToJSArray(aCx, mReceivers, reveiversObj.address());
+  JS::Rooted<JSObject*> receiversObj(aCx);
+  nsresult rv = nsTArrayToJSArray(aCx, mReceivers, &receiversObj);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  aReceivers.setObject(*reveiversObj);
+  aReceivers.setObject(*receiversObj);
   return NS_OK;
 }
 
 NS_IMETHODIMP
 MmsMessage::GetTimestamp(DOMTimeStamp* aTimestamp)
 {
   *aTimestamp = mTimestamp;
   return NS_OK;
--- a/dom/mobilemessage/src/MobileMessageThread.cpp
+++ b/dom/mobilemessage/src/MobileMessageThread.cpp
@@ -145,17 +145,17 @@ MobileMessageThread::GetUnreadCount(uint
 }
 
 NS_IMETHODIMP
 MobileMessageThread::GetParticipants(JSContext* aCx,
                                      JS::MutableHandle<JS::Value> aParticipants)
 {
   JS::Rooted<JSObject*> obj(aCx);
 
-  nsresult rv = nsTArrayToJSArray(aCx, mData.participants(), obj.address());
+  nsresult rv = nsTArrayToJSArray(aCx, mData.participants(), &obj);
   NS_ENSURE_SUCCESS(rv, rv);
 
   aParticipants.setObject(*obj);
   return NS_OK;
 }
 
 NS_IMETHODIMP
 MobileMessageThread::GetTimestamp(DOMTimeStamp* aDate)
--- a/dom/mobilemessage/src/ipc/SmsParent.cpp
+++ b/dom/mobilemessage/src/ipc/SmsParent.cpp
@@ -92,19 +92,18 @@ GetParamsFromSendMmsMessageRequest(JSCon
                                                             aRequest.subject().Length()));
   NS_ENSURE_TRUE(subjectStr, false);
   if(!JS_DefineProperty(aCx, paramsObj, "subject", subjectStr, 0)) {
     return false;
   }
 
   // receivers
   JS::Rooted<JSObject*> receiverArray(aCx);
-  if (NS_FAILED(nsTArrayToJSArray(aCx,
-                                  aRequest.receivers(),
-                                  receiverArray.address()))) {
+  if (NS_FAILED(nsTArrayToJSArray(aCx, aRequest.receivers(), &receiverArray)))
+  {
     return false;
   }
   if (!JS_DefineProperty(aCx, paramsObj, "receivers", receiverArray, 0)) {
     return false;
   }
 
   // attachments
   JS::Rooted<JSObject*> attachmentArray(aCx, JS_NewArrayObject(aCx,
--- a/dom/webidl/BluetoothManager2.webidl
+++ b/dom/webidl/BluetoothManager2.webidl
@@ -1,18 +1,22 @@
 /* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-interface BluetoothManager : EventTarget {
-  [Throws]
-  readonly attribute boolean      enabled;
+[CheckPermissions="bluetooth"]
+interface BluetoothManager: EventTarget
+{
+  readonly attribute BluetoothAdapter? defaultAdapter;
 
-           attribute EventHandler onenabled;
-           attribute EventHandler ondisabled;
+           attribute EventHandler onattributechanged;
            attribute EventHandler onadapteradded;
+           attribute EventHandler onadapterremoved;
 
-  [Throws]
-  boolean     isConnected(unsigned short aProfile);
-  [NewObject, Throws]
-  DOMRequest? getDefaultAdapter();
+  sequence<BluetoothAdapter> getAdapters();
 };
+
+enum BluetoothManagerAttribute
+{
+  "unknown",
+  "defaultAdapter"
+};
--- a/dom/xbl/nsBindingManager.h
+++ b/dom/xbl/nsBindingManager.h
@@ -113,17 +113,17 @@ public:
    * the characteristics of the medium, and return whether this rule
    * processor's rules have changed (e.g., because of media queries).
    */
   nsresult MediumFeaturesChanged(nsPresContext* aPresContext,
                                  bool* aRulesChanged);
 
   void AppendAllSheets(nsTArray<nsCSSStyleSheet*>& aArray);
 
-  NS_HIDDEN_(void) Traverse(nsIContent *aContent,
+  void Traverse(nsIContent *aContent,
                             nsCycleCollectionTraversalCallback &cb);
 
   NS_DECL_CYCLE_COLLECTION_CLASS(nsBindingManager)
 
   // Notify the binding manager when an outermost update begins and
   // ends.  The end method can execute script.
   void BeginOutermostUpdate();
   void EndOutermostUpdate();
--- a/gfx/thebes/gfxFT2FontList.cpp
+++ b/gfx/thebes/gfxFT2FontList.cpp
@@ -510,16 +510,25 @@ FT2FontEntry::ReadCMAP(FontInfoData *aFo
                 if (hasGSUB && SupportsScriptInGSUB(sr->tags)) {
                     continue;
                 }
                 charmap->ClearRange(sr->rangeStart, sr->rangeEnd);
             }
         }
     }
 
+#ifdef MOZ_WIDGET_ANDROID
+    // Hack for the SamsungDevanagari font, bug 1012365:
+    // pretend the font supports U+0972.
+    if (!charmap->test(0x0972) &&
+        charmap->test(0x0905) && charmap->test(0x0945)) {
+        charmap->set(0x0972);
+    }
+#endif
+
     mHasCmapTable = NS_SUCCEEDED(rv);
     if (mHasCmapTable) {
         gfxPlatformFontList *pfl = gfxPlatformFontList::PlatformFontList();
         mCharacterMap = pfl->FindCharMap(charmap);
     } else {
         // if error occurred, initialize to null cmap
         mCharacterMap = new gfxCharacterMap();
     }
--- a/gfx/thebes/gfxFont.h
+++ b/gfx/thebes/gfxFont.h
@@ -3773,11 +3773,11 @@ protected:
 
     static bool FontResolverProc(const nsAString& aName, void *aClosure);
 
     static bool FindPlatformFont(const nsAString& aName,
                                    const nsACString& aGenericName,
                                    bool aUseFontSet,
                                    void *closure);
 
-    static NS_HIDDEN_(nsILanguageAtomService*) gLangService;
+    static nsILanguageAtomService* gLangService;
 };
 #endif
--- a/gfx/thebes/gfxHarfBuzzShaper.cpp
+++ b/gfx/thebes/gfxHarfBuzzShaper.cpp
@@ -790,16 +790,25 @@ HBUnicodeCompose(hb_unicode_funcs_t *ufu
 
 static hb_bool_t
 HBUnicodeDecompose(hb_unicode_funcs_t *ufuncs,
                    hb_codepoint_t      ab,
                    hb_codepoint_t     *a,
                    hb_codepoint_t     *b,
                    void               *user_data)
 {
+#ifdef MOZ_WIDGET_ANDROID
+    // Hack for the SamsungDevanagari font, bug 1012365:
+    // support U+0972 by decomposing it.
+    if (ab == 0x0972) {
+        *a = 0x0905;
+        *b = 0x0945;
+        return true;
+    }
+#endif
     return nsUnicodeNormalizer::DecomposeNonRecursively(ab, a, b);
 }
 
 static PLDHashOperator
 AddOpenTypeFeature(const uint32_t& aTag, uint32_t& aValue, void *aUserArg)
 {
     nsTArray<hb_feature_t>* features = static_cast<nsTArray<hb_feature_t>*> (aUserArg);
 
--- a/image/decoders/icon/android/nsIconChannel.h
+++ b/image/decoders/icon/android/nsIconChannel.h
@@ -27,17 +27,17 @@ class nsIconChannel MOZ_FINAL : public n
     nsIconChannel() {}
     ~nsIconChannel() {}
 
     /**
      * Called by nsIconProtocolHandler after it creates this channel.
      * Must be called before calling any other function on this object.
      * If this method fails, no other function must be called on this object.
      */
-    NS_HIDDEN_(nsresult) Init(nsIURI* aURI);
+    nsresult Init(nsIURI* aURI);
   private:
     /**
      * The channel to the temp icon file (e.g. to /tmp/2qy9wjqw.html).
      * Will always be non-null after a successful Init.
      */
     nsCOMPtr<nsIChannel> mRealChannel;
 };
 
--- a/image/decoders/icon/gtk/nsIconChannel.h
+++ b/image/decoders/icon/gtk/nsIconChannel.h
@@ -29,17 +29,17 @@ class nsIconChannel MOZ_FINAL : public n
 
     static void Shutdown();
 
     /**
      * Called by nsIconProtocolHandler after it creates this channel.
      * Must be called before calling any other function on this object.
      * If this method fails, no other function must be called on this object.
      */
-    NS_HIDDEN_(nsresult) Init(nsIURI* aURI);
+    nsresult Init(nsIURI* aURI);
   private:
     /**
      * The channel to the temp icon file (e.g. to /tmp/2qy9wjqw.html).
      * Will always be non-null after a successful Init.
      */
     nsCOMPtr<nsIChannel> mRealChannel;
 
     /**
--- a/image/decoders/icon/qt/nsIconChannel.h
+++ b/image/decoders/icon/qt/nsIconChannel.h
@@ -28,17 +28,17 @@ class nsIconChannel MOZ_FINAL : public n
     nsIconChannel() {}
     ~nsIconChannel() {}
 
     /**
      * Called by nsIconProtocolHandler after it creates this channel.
      * Must be called before calling any other function on this object.
      * If this method fails, no other function must be called on this object.
      */
-    NS_HIDDEN_(nsresult) Init(nsIURI* aURI);
+    nsresult Init(nsIURI* aURI);
   private:
     /**
      * The channel to the temp icon file (e.g. to /tmp/2qy9wjqw.html).
      * Will always be non-null after a successful Init.
      */
     nsCOMPtr<nsIChannel> mRealChannel;
 };
 
--- a/intl/locale/src/nsLanguageAtomService.h
+++ b/intl/locale/src/nsLanguageAtomService.h
@@ -14,31 +14,31 @@
   {0xB7C65853, 0x2996, 0x435E, {0x96, 0x54, 0xDC, 0xC1, 0x78, 0xAA, 0xB4, 0x8C}}
 
 class nsLanguageAtomService MOZ_FINAL : public nsILanguageAtomService
 {
 public:
   NS_DECL_ISUPPORTS
 
   // nsILanguageAtomService
-  virtual NS_HIDDEN_(nsIAtom*)
+  virtual nsIAtom*
     LookupLanguage(const nsACString &aLanguage, nsresult *aError);
 
-  virtual NS_HIDDEN_(already_AddRefed<nsIAtom>)
+  virtual already_AddRefed<nsIAtom>
     LookupCharSet(const nsACString& aCharSet);
 
-  virtual NS_HIDDEN_(nsIAtom*) GetLocaleLanguage(nsresult *aError);
+  virtual nsIAtom* GetLocaleLanguage(nsresult *aError);
 
-  virtual NS_HIDDEN_(nsIAtom*) GetLanguageGroup(nsIAtom *aLanguage,
+  virtual nsIAtom* GetLanguageGroup(nsIAtom *aLanguage,
                                                 nsresult *aError);
 
-  nsLanguageAtomService() NS_HIDDEN;
+  nsLanguageAtomService();
 
 private:
-  NS_HIDDEN ~nsLanguageAtomService() { }
+  ~nsLanguageAtomService() { }
 
 protected:
-  NS_HIDDEN_(nsresult) InitLangGroupTable();
+  nsresult InitLangGroupTable();
 
   nsInterfaceHashtable<nsISupportsHashKey, nsIAtom> mLangToGroup;
   nsCOMPtr<nsIStringBundle> mLangGroups;
   nsCOMPtr<nsIAtom> mLocaleLanguage;
 };
--- a/intl/unicharutil/util/IrishCasing.cpp
+++ b/intl/unicharutil/util/IrishCasing.cpp
@@ -203,43 +203,46 @@ const uint8_t IrishCasing::sUcClasses[26
   kClass_Vowel, kClass_B, kClass_cC, kClass_DG, kClass_Vowel,
   kClass_fF, kClass_DG, kClass_letter, kClass_Vowel, kClass_letter,
   kClass_letter, kClass_lLNrR, kClass_letter, kClass_lLNrR, kClass_Vowel,
   kClass_pP, kClass_letter, kClass_lLNrR, kClass_sS, kClass_T,
   kClass_Vowel, kClass_letter, kClass_letter, kClass_letter, kClass_letter,
   kClass_letter
 };
 
+uint8_t
+IrishCasing::GetClass(uint32_t aCh)
+{
+  using mozilla::unicode::GetGenCategory;
+  if (aCh >= 'a' && aCh <= 'z') {
+    return sLcClasses[aCh - 'a'];
+  } else if (aCh >= 'A' && aCh <= 'Z') {
+    return sUcClasses[aCh - 'A'];
+  } else if (GetGenCategory(aCh) == nsIUGenCategory::kLetter) {
+    if (aCh == a_ACUTE || aCh == e_ACUTE || aCh == i_ACUTE ||
+        aCh == o_ACUTE || aCh == u_ACUTE) {
+      return kClass_vowel;
+    } else if (aCh == A_ACUTE || aCh == E_ACUTE || aCh == I_ACUTE ||
+               aCh == O_ACUTE || aCh == U_ACUTE) {
+      return kClass_Vowel;
+    } else {
+      return kClass_letter;
+    }
+  } else if (aCh == '-' || aCh == HYPHEN || aCh == NO_BREAK_HYPHEN) {
+    return kClass_hyph;
+  } else {
+    return kClass_other;
+  }
+}
+
 uint32_t
 IrishCasing::UpperCase(uint32_t aCh, State& aState,
                        bool& aMarkPos, uint8_t& aAction)
 {
-  using mozilla::unicode::GetGenCategory;
-  uint8_t cls;
-
-  if (aCh >= 'a' && aCh <= 'z') {
-    cls = sLcClasses[aCh - 'a'];
-  } else if (aCh >= 'A' && aCh <= 'Z') {
-    cls = sUcClasses[aCh - 'A'];
-  } else if (GetGenCategory(aCh) == nsIUGenCategory::kLetter) {
-    if (aCh == a_ACUTE || aCh == e_ACUTE || aCh == i_ACUTE ||
-        aCh == o_ACUTE || aCh == u_ACUTE) {
-      cls = kClass_vowel;
-    } else if (aCh == A_ACUTE || aCh == E_ACUTE || aCh == I_ACUTE ||
-               aCh == O_ACUTE || aCh == U_ACUTE) {
-      cls = kClass_Vowel;
-    } else {
-      cls = kClass_letter;
-    }
-  } else if (aCh == '-' || aCh == HYPHEN || aCh == NO_BREAK_HYPHEN) {
-    cls = kClass_hyph;
-  } else {
-    cls = kClass_other;
-  }
-
+  uint8_t cls = GetClass(aCh);
   uint8_t stateEntry = sUppercaseStateTable[cls][aState];
   aMarkPos = !!(stateEntry & kMarkPositionFlag);
   aAction = (stateEntry & kActionMask) >> kActionShift;
   aState = (stateEntry & kNextStateMask);
 
   return ToUpperCase(aCh);
 }
 
--- a/intl/unicharutil/util/IrishCasing.h
+++ b/intl/unicharutil/util/IrishCasing.h
@@ -96,13 +96,21 @@ public:
   };
 
   static const uint8_t sUppercaseStateTable[kNumClasses][kNumStates];
   static const uint8_t sLcClasses[26];
   static const uint8_t sUcClasses[26];
 
   static uint32_t UpperCase(uint32_t aCh, State& aState,
                             bool& aMarkPos, uint8_t& aAction);
+
+  static bool IsUpperVowel(uint32_t aCh)
+  {
+    return GetClass(aCh) == kClass_Vowel;
+  }
+
+private:
+  static uint8_t GetClass(uint32_t aCh);
 };
 
 } // namespace mozilla
 
 #endif
--- a/js/public/GCAPI.h
+++ b/js/public/GCAPI.h
@@ -40,17 +40,17 @@ namespace JS {
     D(API)                                      \
     D(MAYBEGC)                                  \
     D(DESTROY_RUNTIME)                          \
     D(DESTROY_CONTEXT)                          \
     D(LAST_DITCH)                               \
     D(TOO_MUCH_MALLOC)                          \
     D(ALLOC_TRIGGER)                            \
     D(DEBUG_GC)                                 \
-    D(TRANSPLANT)                               \
+    D(COMPARTMENT_REVIVED)                      \
     D(RESET)                                    \
     D(OUT_OF_NURSERY)                           \
     D(EVICT_NURSERY)                            \
     D(FULL_STORE_BUFFER)                        \
                                                 \
     /* These are reserved for future use. */    \
     D(RESERVED0)                                \
     D(RESERVED1)                                \
--- a/js/public/HeapAPI.h
+++ b/js/public/HeapAPI.h
@@ -53,18 +53,18 @@ const size_t ChunkLocationOffset = Chunk
  */
 static const uint32_t BLACK = 0;
 static const uint32_t GRAY = 1;
 
 /*
  * Constants used to indicate whether a chunk is part of the tenured heap or the
  * nusery.
  */
-const uintptr_t ChunkLocationNursery = 0;
-const uintptr_t ChunkLocationTenuredHeap = 1;
+const uint32_t ChunkLocationNursery = 0;
+const uint32_t ChunkLocationTenuredHeap = 1;
 
 #ifdef JS_DEBUG
 /* When downcasting, ensure we are actually the right type. */
 extern JS_FRIEND_API(void)
 AssertGCThingHasType(js::gc::Cell *cell, JSGCTraceKind kind);
 #else
 inline void
 AssertGCThingHasType(js::gc::Cell *cell, JSGCTraceKind kind) {}
--- a/js/public/Value.h
+++ b/js/public/Value.h
@@ -249,16 +249,17 @@ typedef union jsval_layout
     uint64_t asBits;
     struct {
         union {
             int32_t        i32;
             uint32_t       u32;
             uint32_t       boo;     // Don't use |bool| -- it must be four bytes.
             JSString       *str;
             JSObject       *obj;
+            js::gc::Cell   *cell;
             void           *ptr;
             JSWhyMagic     why;
             size_t         word;
             uintptr_t      uintptr;
         } payload;
         JSValueTag tag;
     } s;
     double asDouble;
@@ -556,20 +557,20 @@ JSVAL_TO_PRIVATE_PTR_IMPL(jsval_layout l
 
 static inline bool
 JSVAL_IS_GCTHING_IMPL(jsval_layout l)
 {
     /* gcc sometimes generates signed < without explicit casts. */
     return (uint32_t)l.s.tag >= (uint32_t)JSVAL_LOWER_INCL_TAG_OF_GCTHING_SET;
 }
 
-static inline void *
+static inline js::gc::Cell *
 JSVAL_TO_GCTHING_IMPL(jsval_layout l)
 {
-    return l.s.payload.ptr;
+    return l.s.payload.cell;
 }
 
 static inline bool
 JSVAL_IS_TRACEABLE_IMPL(jsval_layout l)
 {
     return l.s.tag == JSVAL_TAG_STRING || l.s.tag == JSVAL_TAG_OBJECT;
 }
 
@@ -772,22 +773,22 @@ JSVAL_IS_NULL_IMPL(jsval_layout l)
 }
 
 static inline bool
 JSVAL_IS_GCTHING_IMPL(jsval_layout l)
 {
     return l.asBits >= JSVAL_LOWER_INCL_SHIFTED_TAG_OF_GCTHING_SET;
 }
 
-static inline void *
+static inline js::gc::Cell *
 JSVAL_TO_GCTHING_IMPL(jsval_layout l)
 {
     uint64_t ptrBits = l.asBits & JSVAL_PAYLOAD_MASK;
     MOZ_ASSERT((ptrBits & 0x7) == 0);
-    return (void *)ptrBits;
+    return reinterpret_cast<js::gc::Cell *>(ptrBits);
 }
 
 static inline bool
 JSVAL_IS_TRACEABLE_IMPL(jsval_layout l)
 {
     return JSVAL_IS_GCTHING_IMPL(l) && !JSVAL_IS_NULL_IMPL(l);
 }
 
@@ -1155,17 +1156,17 @@ class Value
         return *JSVAL_TO_OBJECT_IMPL(data);
     }
 
     JSObject *toObjectOrNull() const {
         MOZ_ASSERT(isObjectOrNull());
         return JSVAL_TO_OBJECT_IMPL(data);
     }
 
-    void *toGCThing() const {
+    js::gc::Cell *toGCThing() const {
         MOZ_ASSERT(isGCThing());
         return JSVAL_TO_GCTHING_IMPL(data);
     }
 
     bool toBoolean() const {
         MOZ_ASSERT(isBoolean());
         return JSVAL_TO_BOOLEAN_IMPL(data);
     }
--- a/js/src/NamespaceImports.h
+++ b/js/src/NamespaceImports.h
@@ -36,17 +36,17 @@ class AutoGCRooter;
 template <typename T> class AutoVectorRooter;
 template<typename K, typename V> class AutoHashMapRooter;
 template<typename T> class AutoHashSetRooter;
 
 class SourceBufferHolder;
 
 class HandleValueArray;
 
-class AutoCheckCannotGC;
+class JS_PUBLIC_API(AutoCheckCannotGC);
 
 }
 
 // Do the importing.
 namespace js {
 
 using JS::Value;
 using JS::BooleanValue;
new file mode 100644
--- /dev/null
+++ b/js/src/devtools/rootAnalysis/expect.b2g.json
@@ -0,0 +1,3 @@
+{
+  "expect-hazards": 2
+}
--- a/js/src/devtools/rootAnalysis/expect.shell.json
+++ b/js/src/devtools/rootAnalysis/expect.shell.json
@@ -1,3 +1,3 @@
 {
-  "expect-hazards": 16
+  "expect-hazards": 0
 }
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -183,19 +183,16 @@ CheckMarkedThing(JSTracer *trc, T **thin
         return;
 
     JS_ASSERT(thing->zone());
     JS_ASSERT(thing->zone()->runtimeFromMainThread() == trc->runtime());
     JS_ASSERT(trc->hasTracingDetails());
 
     DebugOnly<JSRuntime *> rt = trc->runtime();
 
-    JS_ASSERT_IF(IS_GC_MARKING_TRACER(trc) && rt->gc.manipulatingDeadZones,
-                 !thing->zone()->scheduledForDestruction);
-
     JS_ASSERT(CurrentThreadCanAccessRuntime(rt));
 
     JS_ASSERT_IF(thing->zone()->requireGCTracer(),
                  IS_GC_MARKING_TRACER(trc));
 
     JS_ASSERT(thing->isAligned());
 
     JS_ASSERT(MapTypeToTraceKind<T>::kind == GetGCThingTraceKind(thing));
@@ -216,16 +213,43 @@ CheckMarkedThing(JSTracer *trc, T **thin
      * ArenaHeader may not be synced with the real one in ArenaLists.
      */
     JS_ASSERT_IF(IsThingPoisoned(thing) && rt->isHeapBusy(),
                  !InFreeList(thing->arenaHeader(), thing));
 #endif
 
 }
 
+/*
+ * We only set the maybeAlive flag for objects and scripts. It's assumed that,
+ * if a compartment is alive, then it will have at least some live object or
+ * script it in. Even if we get this wrong, the worst that will happen is that
+ * scheduledForDestruction will be set on the compartment, which will cause some
+ * extra GC activity to try to free the compartment.
+ */
+template<typename T>
+static inline void
+SetMaybeAliveFlag(T *thing)
+{
+}
+
+template<>
+void
+SetMaybeAliveFlag(JSObject *thing)
+{
+    thing->compartment()->maybeAlive = true;
+}
+
+template<>
+void
+SetMaybeAliveFlag(JSScript *thing)
+{
+    thing->compartment()->maybeAlive = true;
+}
+
 template<typename T>
 static void
 MarkInternal(JSTracer *trc, T **thingp)
 {
     CheckMarkedThing(trc, thingp);
     T *thing = *thingp;
 
     if (!trc->callback) {
@@ -249,17 +273,17 @@ MarkInternal(JSTracer *trc, T **thingp)
         /*
          * Don't mark things outside a compartment if we are in a
          * per-compartment GC.
          */
         if (!thing->zone()->isGCMarking())
             return;
 
         PushMarkStack(AsGCMarker(trc), thing);
-        thing->zone()->maybeAlive = true;
+        SetMaybeAliveFlag(thing);
     } else {
         trc->callback(trc, (void **)thingp, MapTypeToTraceKind<T>::kind);
         trc->unsetTracingLocation();
     }
 
     trc->clearTracingDetails();
 }
 
--- a/js/src/gc/Nursery.cpp
+++ b/js/src/gc/Nursery.cpp
@@ -51,18 +51,18 @@ js::Nursery::init()
     if (!hugeSlots.init())
         return false;
 
     void *heap = runtime()->gc.pageAllocator.mapAlignedPages(NurserySize, Alignment);
     if (!heap)
         return false;
 
     heapStart_ = uintptr_t(heap);
+    heapEnd_ = heapStart_ + NurserySize;
     currentStart_ = start();
-    heapEnd_ = chunk(LastNurseryChunk).end();
     numActiveChunks_ = 1;
     JS_POISON(heap, JS_FRESH_NURSERY_PATTERN, NurserySize);
     setCurrentChunk(0);
     updateDecommittedRegion();
 
 #ifdef PROFILE_NURSERY
     char *env = getenv("JS_MINORGC_TIME");
     if (env)
@@ -83,18 +83,20 @@ void
 js::Nursery::updateDecommittedRegion()
 {
 #ifndef JS_GC_ZEAL
     if (numActiveChunks_ < NumNurseryChunks) {
         // Bug 994054: madvise on MacOS is too slow to make this
         //             optimization worthwhile.
 # ifndef XP_MACOSX
         uintptr_t decommitStart = chunk(numActiveChunks_).start();
-        JS_ASSERT(decommitStart == AlignBytes(decommitStart, 1 << 20));
-        runtime()->gc.pageAllocator.markPagesUnused((void *)decommitStart, heapEnd() - decommitStart);
+        uintptr_t decommitSize = heapEnd() - decommitStart;
+        JS_ASSERT(decommitStart == AlignBytes(decommitStart, Alignment));
+        JS_ASSERT(decommitSize == AlignBytes(decommitStart, Alignment));
+        runtime()->gc.pageAllocator.markPagesUnused((void *)decommitStart, decommitSize);
 # endif
     }
 #endif
 }
 
 void
 js::Nursery::enable()
 {
@@ -126,16 +128,33 @@ js::Nursery::isEmpty() const
 {
     JS_ASSERT(runtime_);
     if (!isEnabled())
         return true;
     JS_ASSERT_IF(runtime_->gc.zealMode != ZealGenerationalGCValue, currentStart_ == start());
     return position() == currentStart_;
 }
 
+#ifdef JS_GC_ZEAL
+void
+js::Nursery::enterZealMode() {
+    if (isEnabled())
+        numActiveChunks_ = NumNurseryChunks;
+}
+
+void
+js::Nursery::leaveZealMode() {
+    if (isEnabled()) {
+        JS_ASSERT(isEmpty());
+        setCurrentChunk(0);
+        currentStart_ = start();
+    }
+}
+#endif // JS_GC_ZEAL
+
 JSObject *
 js::Nursery::allocateObject(JSContext *cx, size_t size, size_t numDynamic)
 {
     /* Ensure there's enough space to replace the contents with a RelocationOverlay. */
     JS_ASSERT(size >= sizeof(RelocationOverlay));
 
     /* Attempt to allocate slots contiguously after object, if possible. */
     if (numDynamic && numDynamic <= MaxNurserySlots) {
@@ -264,25 +283,16 @@ HeapSlot *
 js::Nursery::allocateHugeSlots(JSContext *cx, size_t nslots)
 {
     HeapSlot *slots = cx->pod_malloc<HeapSlot>(nslots);
     /* If this put fails, we will only leak the slots. */
     (void)hugeSlots.put(slots);
     return slots;
 }
 
-void
-js::Nursery::notifyInitialSlots(Cell *cell, HeapSlot *slots)
-{
-    if (IsInsideNursery(cell) && !isInside(slots)) {
-        /* If this put fails, we will only leak the slots. */
-        (void)hugeSlots.put(slots);
-    }
-}
-
 namespace js {
 namespace gc {
 
 class MinorCollectionTracer : public JSTracer
 {
   public:
     Nursery *nursery;
     AutoTraceSession session;
@@ -836,21 +846,21 @@ js::Nursery::collect(JSRuntime *rt, JS::
             if (entry.count >= 3000)
                 pretenureTypes->append(entry.type); // ignore alloc failure
         }
     }
     TIME_END(pretenure);
 
     // Sweep.
     TIME_START(freeHugeSlots);
-    freeHugeSlots(rt);
+    freeHugeSlots();
     TIME_END(freeHugeSlots);
 
     TIME_START(sweep);
-    sweep(rt);
+    sweep();
     TIME_END(sweep);
 
     TIME_START(clearStoreBuffer);
     rt->gc.storeBuffer.clear();
     TIME_END(clearStoreBuffer);
 
     // We ignore gcMaxBytes when allocating for minor collection. However, if we
     // overflowed, we disable the nursery. The next time we allocate, we'll fail
@@ -898,33 +908,34 @@ js::Nursery::collect(JSRuntime *rt, JS::
                 TIME_TOTAL(clearStoreBuffer),
                 TIME_TOTAL(sweep));
 #undef FMT
     }
 #endif
 }
 
 void
-js::Nursery::freeHugeSlots(JSRuntime *rt)
+js::Nursery::freeHugeSlots()
 {
+    FreeOp *fop = runtime()->defaultFreeOp();
     for (HugeSlotsSet::Range r = hugeSlots.all(); !r.empty(); r.popFront())
-        rt->defaultFreeOp()->free_(r.front());
+        fop->free_(r.front());
     hugeSlots.clear();
 }
 
 void
-js::Nursery::sweep(JSRuntime *rt)
+js::Nursery::sweep()
 {
 #ifdef JS_GC_ZEAL
     /* Poison the nursery contents so touching a freed object will crash. */
     JS_POISON((void *)start(), JS_SWEPT_NURSERY_PATTERN, NurserySize);
     for (int i = 0; i < NumNurseryChunks; ++i)
         initChunk(i);
 
-    if (rt->gc.zealMode == ZealGenerationalGCValue) {
+    if (runtime()->gc.zealMode == ZealGenerationalGCValue) {
         MOZ_ASSERT(numActiveChunks_ == NumNurseryChunks);
 
         /* Only reset the alloc point when we are close to the end. */
         if (currentChunk_ + 1 == NumNurseryChunks)
             setCurrentChunk(0);
     } else
 #endif
     {
--- a/js/src/gc/Nursery.h
+++ b/js/src/gc/Nursery.h
@@ -106,19 +106,16 @@ class Nursery
 
     /* Resize an existing elements vector. */
     ObjectElements *reallocateElements(JSContext *cx, JSObject *obj, ObjectElements *oldHeader,
                                        uint32_t oldCount, uint32_t newCount);
 
     /* Free a slots array. */
     void freeSlots(JSContext *cx, HeapSlot *slots);
 
-    /* Add a slots to our tracking list if it is out-of-line. */
-    void notifyInitialSlots(gc::Cell *cell, HeapSlot *slots);
-
     typedef Vector<types::TypeObject *, 0, SystemAllocPolicy> TypeObjectList;
 
     /*
      * Do a minor collection, optionally specifying a list to store types which
      * should be pretenured afterwards.
      */
     void collect(JSRuntime *rt, JS::gcreason::Reason reason, TypeObjectList *pretenureTypes);
 
@@ -151,34 +148,18 @@ class Nursery
         return heapStart_;
     }
 
     MOZ_ALWAYS_INLINE uintptr_t heapEnd() const {
         return heapEnd_;
     }
 
 #ifdef JS_GC_ZEAL
-    /*
-     * In debug and zeal builds, these bytes indicate the state of an unused
-     * segment of nursery-allocated memory.
-     */
-    void enterZealMode() {
-        if (isEnabled())
-            numActiveChunks_ = NumNurseryChunks;
-    }
-    void leaveZealMode() {
-        if (isEnabled()) {
-            JS_ASSERT(isEmpty());
-            setCurrentChunk(0);
-            currentStart_ = start();
-        }
-    }
-#else
-    void enterZealMode() {}
-    void leaveZealMode() {}
+    void enterZealMode();
+    void leaveZealMode();
 #endif
 
   private:
     /*
      * The start and end pointers are stored under the runtime so that we can
      * inline the isInsideNursery check into embedder code. Use the start()
      * and heapEnd() functions to access these values.
      */
@@ -249,20 +230,16 @@ class Nursery
 
     void updateDecommittedRegion();
 
     MOZ_ALWAYS_INLINE uintptr_t allocationEnd() const {
         JS_ASSERT(numActiveChunks_ > 0);
         return chunk(numActiveChunks_ - 1).end();
     }
 
-    MOZ_ALWAYS_INLINE bool isFullyGrown() const {
-        return numActiveChunks_ == NumNurseryChunks;
-    }
-
     MOZ_ALWAYS_INLINE uintptr_t currentEnd() const {
         JS_ASSERT(runtime_);
         JS_ASSERT(currentEnd_ == chunk(currentChunk_).end());
         return currentEnd_;
     }
     void *addressOfCurrentEnd() const {
         JS_ASSERT(runtime_);
         return (void *)&currentEnd_;
@@ -300,23 +277,23 @@ class Nursery
     void forwardTypedArrayPointers(JSObject *dst, JSObject *src);
 
     /* Handle relocation of slots/elements pointers stored in Ion frames. */
     void setSlotsForwardingPointer(HeapSlot *oldSlots, HeapSlot *newSlots, uint32_t nslots);
     void setElementsForwardingPointer(ObjectElements *oldHeader, ObjectElements *newHeader,
                                       uint32_t nelems);
 
     /* Free malloced pointers owned by freed things in the nursery. */
-    void freeHugeSlots(JSRuntime *rt);
+    void freeHugeSlots();
 
     /*
      * Frees all non-live nursery-allocated things at the end of a minor
      * collection.
      */
-    void sweep(JSRuntime *rt);
+    void sweep();
 
     /* Change the allocable space provided by the nursery. */
     void growAllocableSpace();
     void shrinkAllocableSpace();
 
     static void MinorGCCallback(JSTracer *trc, void **thingp, JSGCTraceKind kind);
 
     friend class gc::MinorCollectionTracer;
--- a/js/src/gc/Tracer.cpp
+++ b/js/src/gc/Tracer.cpp
@@ -633,17 +633,30 @@ GCMarker::appendGrayRoot(void *thing, JS
 #ifdef DEBUG
     root.debugPrinter = debugPrinter();
     root.debugPrintArg = debugPrintArg();
     root.debugPrintIndex = debugPrintIndex();
 #endif
 
     Zone *zone = static_cast<Cell *>(thing)->tenuredZone();
     if (zone->isCollecting()) {
-        zone->maybeAlive = true;
+        // See the comment on SetMaybeAliveFlag to see why we only do this for
+        // objects and scripts. We rely on gray root buffering for this to work,
+        // but we only need to worry about uncollected dead compartments during
+        // incremental GCs (when we do gray root buffering).
+        switch (kind) {
+          case JSTRACE_OBJECT:
+            static_cast<JSObject *>(thing)->compartment()->maybeAlive = true;
+            break;
+          case JSTRACE_SCRIPT:
+            static_cast<JSScript *>(thing)->compartment()->maybeAlive = true;
+            break;
+          default:
+            break;
+        }
         if (!zone->gcGrayRoots.append(root)) {
             resetBufferedGrayRoots();
             grayBufferState = GRAY_BUFFER_FAILED;
         }
     }
 }
 
 void
--- a/js/src/gc/Zone.cpp
+++ b/js/src/gc/Zone.cpp
@@ -30,18 +30,16 @@ JS::Zone::Zone(JSRuntime *rt)
     gcHeapGrowthFactor(3.0),
     gcMallocBytes(0),
     gcMallocGCTriggered(false),
     gcBytes(0),
     gcTriggerBytes(0),
     data(nullptr),
     isSystem(false),
     usedByExclusiveThread(false),
-    scheduledForDestruction(false),
-    maybeAlive(true),
     active(false),
     jitZone_(nullptr),
     gcState_(NoGC),
     gcScheduled_(false),
     gcPreserveCode_(false),
     ionUsingBarriers_(false)
 {
     /* Ensure that there are no vtables to mess us up here. */
@@ -153,20 +151,20 @@ Zone::sweepBreakpoints(FreeOp *fop)
         for (unsigned i = 0; i < script->length(); i++) {
             BreakpointSite *site = script->getBreakpointSite(script->offsetToPC(i));
             if (!site)
                 continue;
 
             Breakpoint *nextbp;
             for (Breakpoint *bp = site->firstBreakpoint(); bp; bp = nextbp) {
                 nextbp = bp->nextInSite();
-                HeapPtrObject& dbgobj = bp->debugger->toJSObjectRef();
-                JS_ASSERT(dbgobj->zone()->isGCSweeping());
+                HeapPtrObject &dbgobj = bp->debugger->toJSObjectRef();
+                JS_ASSERT_IF(dbgobj->zone()->isCollecting(), dbgobj->zone()->isGCSweeping());
                 bool dying = scriptGone || IsObjectAboutToBeFinalized(&dbgobj);
-                JS_ASSERT_IF(!dying, bp->getHandler()->isMarked());
+                JS_ASSERT_IF(!dying, !IsAboutToBeFinalized(&bp->getHandlerRef()));
                 if (dying)
                     bp->destroy(fop);
             }
         }
     }
 }
 
 void
--- a/js/src/gc/Zone.h
+++ b/js/src/gc/Zone.h
@@ -261,21 +261,16 @@ struct Zone : public JS::shadow::Zone,
 
     // Per-zone data for use by an embedder.
     void *data;
 
     bool isSystem;
 
     bool usedByExclusiveThread;
 
-    // These flags help us to discover if a compartment that shouldn't be alive
-    // manages to outlive a GC.
-    bool scheduledForDestruction;
-    bool maybeAlive;
-
     // True when there are active frames.
     bool active;
 
     mozilla::DebugOnly<unsigned> gcLastZoneGroupIndex;
 
   private:
     js::jit::JitZone *jitZone_;
 
--- a/js/src/jit-test/tests/asm.js/bug941877.js
+++ b/js/src/jit-test/tests/asm.js/bug941877.js
@@ -1,35 +1,50 @@
-(function(stdlib, n, heap) {
-    "use asm"
+load(libdir + "asm.js");
+
+function FunctionBody(f) {
+    var str = f.toString();
+    var firstBrace = str.indexOf('{');
+    var lastBrace = str.lastIndexOf('}');
+    return str.substr(firstBrace + 1, lastBrace - firstBrace - 1);
+}
+
+var F = (function (stdlib, n, heap) {
     var Int16ArrayView = new stdlib.Int16Array(heap);
     function f(i0, d1) {
         i0 = i0 | 0
         d1 = +d1
         var d2 = 1.
         var i3 = 0
         Int16ArrayView[0] = i0
         d2 = (.0 / .0)
         switch ((i0 + i0) | 0) {
             case 0:
                 d2 = .0
                 break
         };
         (((i3 - (0 < 0)) >>> ((.0 < -0) + (.0 > .0))) / 0) >> (0 + (((0 + 0) ^
 (9 > 0)) | 0))
     }
-})(this, null, new ArrayBuffer(4096));
+    return f;
+});
 
-(function(stdlib, n, heap) {
-    "use asm"
+var compiled = asmCompile('stdlib', 'n', 'heap', USE_ASM + FunctionBody(F));
+asmLink(compiled, this, null, new ArrayBuffer(4096))();
+
+var F = (function(stdlib, n, heap) {
     var Float64ArrayView = new stdlib.Float64Array(heap)
     function f() {
         Float64ArrayView[0] = +(0xffffffff / 0xffffffff >> 0)
     }
-})(this, null, new ArrayBuffer(4096));
+    return f;
+});
+
+var compiled = asmCompile('stdlib', 'n', 'heap', USE_ASM + FunctionBody(F));
+asmLink(compiled, this, null, new ArrayBuffer(4096))();
 
 function test0(x)
 {
    return (x >>> 0) % 10;
 }
 assertEq(test0(25), 5);
 assertEq(test0(24), 4);
 assertEq(test0(23), 3);
@@ -51,93 +66,99 @@ function test2(x, y)
 }
 assertEq(test2(25, 3), 1);
 assertEq(test2(24, 4), 0);
 assertEq(test2(4294967295, 10), 5);
 assertEq(test2(23, 0), NaN);
 
 function test3()
 {
-    "use asm";
     function f(x, y)
     {
         x = x|0;
         y = y|0;
         var t = 0;
-        t = (x % y) > -2;
+        t = (((x|0) % (y|0))|0) > -2;
         return t|0;
     }
     return f;
 }
-assertEq(test3()(4294967290, 4294967295), 1);
-assertEq(test3()(4294967290, 4294967295), 1);
+var compiled = asmCompile(USE_ASM + FunctionBody(test3));
+var linked = asmLink(compiled);
+assertEq(linked(4294967290, 4294967295), 1);
+assertEq(linked(4294967290, 4294967295), 1);
 
 function test4()
 {
-    "use asm";
     function f(x, y)
     {
         x = x|0;
         y = y|0;
         var t = 0;
-        t = ((x>>>0) % (y>>>0)) > -2;
+        t = (((x>>>0) % (y>>>0)) >>> 0) > 0;
         return t|0;
     }
     return f;
 }
-assertEq(test4()(4294967290, 4294967295), 1);
-assertEq(test4()(4294967290, 4294967295), 1);
+var compiled = asmCompile(USE_ASM + FunctionBody(test4));
+var linked = asmLink(compiled);
+assertEq(linked(4294967290, 4294967295), 1);
+assertEq(linked(4294967290, 4294967295), 1);
 
 function test5()
 {
-    "use asm";
     function f(x, y)
     {
         x = x|0;
         y = y|0;
-        var t = 0;
-        t = ((x>>>0) % (y>>>0)) * 1.01;
+        var t = 0.;
+        t = +(((x>>>0) % (y>>>0)) >>> 0) * 1.01;
         return +t;
     }
     return f;
 }
-assertEq(test5()(4294967290, 4294967295), 4337916962.9);
-assertEq(test5()(4294967290, 4294967295), 4337916962.9);
+var compiled = asmCompile(USE_ASM + FunctionBody(test5));
+var linked = asmLink(compiled);
+assertEq(linked(4294967290, 4294967295), 4337916962.9);
+assertEq(linked(4294967290, 4294967295), 4337916962.9);
 
 function test6()
 {
-    "use asm";
     function f(x, y)
     {
         x = x|0;
         y = y|0;
         return ((x>>>1) % (y>>>1))|0;
     }
     return f;
 }
-assertEq(test6()(23847, 7), 1);
-assertEq(test6()(23848, 7), 2);
+var compiled = asmCompile(USE_ASM + FunctionBody(test6));
+var linked = asmLink(compiled);
+assertEq(linked(23847, 7), 1);
+assertEq(linked(23848, 7), 2);
 
 function test7()
 {
-    "use asm";
     function f(x)
     {
         x = x|0;
         return ((x>>>0) / 8)|0;
     }
     return f;
 }
-assertEq(test7()(23847, 7), 2980);
-assertEq(test7()(23848, 7), 2981);
+var compiled = asmCompile(USE_ASM + FunctionBody(test7));
+var linked = asmLink(compiled);
+assertEq(linked(23847, 7), 2980);
+assertEq(linked(23848, 7), 2981);
 
 function test8()
 {
-    "use asm";
     function f(i,j)
     {
         i=i|0;j=j|0;
         return ((i>>>0)/(j>>>0))|0;
     }
     return f;
 }
-assertEq(test8()(2147483647, 0), 0);
-assertEq(test8()(2147483646, 0), 0);
+var compiled = asmCompile(USE_ASM + FunctionBody(test8));
+var linked = asmLink(compiled);
+assertEq(linked(2147483647, 0), 0);
+assertEq(linked(2147483646, 0), 0);
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/latin1-indexOf.js
@@ -0,0 +1,151 @@
+function testLastIndexOf() {
+    var s1 = toLatin1("abcdefgh123456\u0081defg");
+    var s2 = toLatin1("456\u0081de");
+
+    // Latin1 + Latin1
+    assertEq(s1.lastIndexOf(s1), 0);
+    assertEq(s1.lastIndexOf(s2), 11);
+    assertEq(s1.lastIndexOf(s2, 10), -1);
+    assertEq(s2.lastIndexOf(s1), -1);
+
+    // Latin1 + TwoByte
+    assertEq(s1.lastIndexOf("abc\u1234"), -1);
+    assertEq(s1.lastIndexOf("def\u1234".substring(0, 3)), 15);
+    assertEq(s1.lastIndexOf("def\u1234".substring(0, 3), 9), 3);
+
+    // TwoByte + Latin1
+    var s3 = "123456\u0081defg\u1123a456\u0081defg";
+    assertEq(isLatin1(s2), true);
+    assertEq(s3.lastIndexOf(s2), 13);
+    assertEq(s3.lastIndexOf(s2, 12), 3);
+    assertEq(s3.lastIndexOf(toLatin1("defg7")), -1);
+
+    // TwoByte + TwoByte
+    assertEq(s3.lastIndexOf("\u1123a4"), 11);
+    assertEq(s3.lastIndexOf("\u1123a4", 10), -1);
+    assertEq(s3.lastIndexOf("\u1123a\u1098"), -1);
+    assertEq(s3.lastIndexOf(s3), 0);
+}
+testLastIndexOf();
+
+function testIndexOf() {
+    var s1 = toLatin1("abcdefgh123456d\u00AAefghi");
+    var s2 = toLatin1("456d\u00AA");
+
+    // Latin1 + Latin1
+    assertEq(s1.indexOf(s1), 0);
+    assertEq(s1.indexOf(s2), 11);
+    assertEq(s1.indexOf(s2, 12), -1);
+    assertEq(s2.indexOf(s1), -1);
+
+    // Latin1 + TwoByte
+    assertEq(s1.indexOf("abc\u1234"), -1);
+    assertEq(s1.indexOf("def\u1234".substring(0, 3)), 3);
+    assertEq(s1.indexOf("d\u00AAef\u1234".substring(0, 3), 9), 14);
+
+    // TwoByte + Latin1
+    var s3 = "123456d\u00AAefg\u1123a456d\u00AAefg";
+    assertEq(isLatin1(s2), true);
+    assertEq(s3.indexOf(s2), 3);
+    assertEq(s3.indexOf(s2, 11), 13);
+    assertEq(s3.indexOf(toLatin1("d\u00AAefg7")), -1);
+
+    // TwoByte + TwoByte
+    assertEq(s3.indexOf("\u1123a4"), 11);
+    assertEq(s3.indexOf("\u1123a4", 12), -1);
+    assertEq(s3.indexOf("\u1123a\u1098"), -1);
+    assertEq(s3.indexOf(s3), 0);
+}
+testIndexOf();
+
+function testContains() {
+    var s1 = toLatin1("abcdefgh123456defghi\u00EEj");
+    var s2 = toLatin1("456defghi\u00EE");
+
+    // Latin1 + Latin1
+    assertEq(s1.contains(s1), true);
+    assertEq(s1.contains(s2), true);
+    assertEq(s1.contains(s2, 12), false);
+    assertEq(s2.contains(s1), false);
+
+    // Latin1 + TwoByte
+    assertEq(s1.contains("abc\u1234"), false);
+    assertEq(s1.contains("def\u1234".substring(0, 3)), true);
+    assertEq(s1.contains("def\u1234".substring(0, 3), 9), true);
+
+    // TwoByte + Latin1
+    var s3 = "123456defg\u1123a456defghi\u00EEj";
+    assertEq(isLatin1(s2), true);
+    assertEq(s3.contains(s2), true);
+    assertEq(s3.contains(s2, 13), false);
+    assertEq(s3.contains(toLatin1("defg8")), false);
+
+    // TwoByte + TwoByte
+    assertEq(s3.contains("\u1123a4"), true);
+    assertEq(s3.contains("\u1123a4", 11), false);
+    assertEq(s3.contains("\u1123a\u1098"), false);
+    assertEq(s3.contains(s3), true);
+}
+testContains();
+
+function testIndexOfBMH() {
+    // BoyerMooreHorspool algorithm is used for large strings.
+    var s = "012345678901234567890123456789".repeat(20);
+    var text = s + "abcdefghijklmnopqrst\u00C1uvwxyz";
+    text.indexOf("333");
+
+    var textL1 = toLatin1(text);
+    var patL1 = toLatin1("cdefghijklmnopqrst\u00C1uvwx");
+
+    // Latin1 + Latin1
+    assertEq(textL1.indexOf(patL1), 602);
+    assertEq(textL1.indexOf(patL1, 603), -1);
+    assertEq(textL1.indexOf(textL1), 0);
+
+    // Latin1 + TwoByte
+    assertEq(textL1.indexOf("cdefghijklmnopqrst\u00C1uvwxy"), 602);
+    assertEq(textL1.indexOf("cdefghijklmnopqrst\u00C1uvwxy", 603), -1);
+    assertEq(textL1.indexOf("cdefghijklmnopqrst\u00C1uvwxy\uaa00", -1), -1);
+
+    // TwoByte + Latin1
+    var textTB = s + "abcdefghijklmnopqrst\u00C1uvwxyz\u1200";
+    text.indexOf("333");
+    assertEq(textTB.indexOf(patL1), 602);
+    assertEq(textTB.indexOf(patL1, 603), -1);
+
+    // TwoByte + TwoByte
+    assertEq(textTB.indexOf("defghijklmnopqrst\u00C1uvwxyz\u1200"), 603);
+    assertEq(textTB.indexOf("defghijklmnopqrst\u00C1uvwxyz\u1200", 604), -1);
+    assertEq(textTB.indexOf("defghijklmnopqrst\u00C1uvwxyz\u1201"), -1);
+}
+testIndexOfBMH();
+
+function testIndexOfLargePattern() {
+    // If the pattern length > 128, memcmp is used (text length has to be < 512
+    // or we'll use BoyerMooreHorspool). This is only valid if both
+    // strings have the same encoding.
+    var text = "012345678901234567890123456789".repeat(10) + "abcdefghijklmnopqrst\u00C1uvwxyz";
+    text.indexOf("333"); // flatten
+    var pat = "012345678901234567890123456789".repeat(5) + "abcdefghijklmnopqr";
+    pat.indexOf("333"); // flatten
+
+    // Latin1 + Latin1
+    text = toLatin1(text);
+    pat = toLatin1(pat);
+    assertEq(text.indexOf(pat), 150);
+
+    // Latin1 + TwoByte
+    assertEq(text.indexOf(pat + "\u1200"), -1);
+    assertEq(text.indexOf((pat + "\u1200").slice(0, -1)), 150);
+
+    // TwoByte + Latin1
+    text = text + "\u1100";
+    assertEq(isLatin1(pat), true);
+    assertEq(text.indexOf(pat), 150);
+
+    // TwoByte + TwoByte
+    pat = pat + "st\u00C1uvwxyz\u1100";
+    assertEq(text.indexOf(pat), 150);
+    assertEq(text.indexOf(pat + "\u2000"), -1);
+}
+testIndexOfLargePattern();
--- a/js/src/jit/AsmJS.cpp
+++ b/js/src/jit/AsmJS.cpp
@@ -1441,16 +1441,20 @@ class MOZ_STACK_CLASS ModuleCompiler
         unsigned startCodeOffset = func.code()->offset();
         perfSpewer.noteBlocksOffsets();
         unsigned endInlineCodeOffset = perfSpewer.endInlineCode.offset();
         return module_->trackPerfProfiledBlocks(func.name(), startCodeOffset, endInlineCodeOffset,
                                                 endCodeOffset, perfSpewer.basicBlocks());
     }
 #endif
 
+    bool addFunctionCounts(IonScriptCounts *counts) {
+        return module_->addFunctionCounts(counts);
+    }
+
     void finishFunctionBodies() {
         JS_ASSERT(!finishedFunctionBodies_);
         masm_.align(AsmJSPageSize);
         finishedFunctionBodies_ = true;
         module_->initFunctionBytes(masm_.size());
     }
 
     void setInterpExitOffset(unsigned exitIndex) {
@@ -5476,16 +5480,22 @@ GenerateCode(ModuleCompiler &m, ModuleCo
     m.masm().resetForNewCodeGenerator(mir.alloc());
 
     m.masm().bind(func.code());
 
     ScopedJSDeletePtr<CodeGenerator> codegen(js_new<CodeGenerator>(&mir, &lir, &m.masm()));
     if (!codegen || !codegen->generateAsmJS(&m.stackOverflowLabel()))
         return m.fail(nullptr, "internal codegen failure (probably out of memory)");
 
+    jit::IonScriptCounts *counts = codegen->extractScriptCounts();
+    if (counts && !m.addFunctionCounts(counts)) {
+        js_delete(counts);
+        return false;
+    }
+
 #if defined(MOZ_VTUNE) || defined(JS_ION_PERF)
     // Profiling might not be active now, but it may be activated later (perhaps
     // after the module has been cached and reloaded from the cache). Function
     // profiling info isn't huge, so store it always (in --enable-profiling
     // builds, which is only Nightly builds, but default).
     if (!m.trackProfiledFunction(func, m.masm().size()))
         return false;
 #endif
--- a/js/src/jit/AsmJSModule.cpp
+++ b/js/src/jit/AsmJSModule.cpp
@@ -369,16 +369,19 @@ AsmJSModule::~AsmJSModule()
                 continue;
 
             jit::DependentAsmJSModuleExit exit(this, i);
             script->ionScript()->removeDependentAsmJSModule(exit);
         }
 
         DeallocateExecutableMemory(code_, pod.totalBytes_);
     }
+
+    for (size_t i = 0; i < numFunctionCounts(); i++)
+        js_delete(functionCounts(i));
 }
 
 void
 AsmJSModule::addSizeOfMisc(mozilla::MallocSizeOf mallocSizeOf, size_t *asmJSModuleCode,
                            size_t *asmJSModuleData)
 {
     *asmJSModuleCode += pod.totalBytes_;
     *asmJSModuleData += mallocSizeOf(this) +
@@ -389,16 +392,17 @@ AsmJSModule::addSizeOfMisc(mozilla::Mall
                         functionNames_.sizeOfExcludingThis(mallocSizeOf) +
                         heapAccesses_.sizeOfExcludingThis(mallocSizeOf) +
 #if defined(MOZ_VTUNE) || defined(JS_ION_PERF)
                         profiledFunctions_.sizeOfExcludingThis(mallocSizeOf) +
 #endif
 #if defined(JS_ION_PERF)
                         perfProfiledBlocksFunctions_.sizeOfExcludingThis(mallocSizeOf) +
 #endif
+                        functionCounts_.sizeOfExcludingThis(mallocSizeOf) +
                         staticLinkData_.sizeOfExcludingThis(mallocSizeOf);
 }
 
 static void
 AsmJSModuleObject_finalize(FreeOp *fop, JSObject *obj)
 {
     fop->delete_(&obj->as<AsmJSModuleObject>().module());
 }
--- a/js/src/jit/AsmJSModule.h
+++ b/js/src/jit/AsmJSModule.h
@@ -460,16 +460,18 @@ class AsmJSModule
     // The next two fields need to be kept out of the Pod as they depend on the
     // position of the module within the ScriptSource and thus aren't invariant
     // with caching.
     uint32_t                              funcStart_;
     uint32_t                              offsetToEndOfUseAsm_;
 
     ScriptSource *                        scriptSource_;
 
+    FunctionCountsVector                  functionCounts_;
+
     // This field is accessed concurrently when requesting an interrupt.
     // Access must be synchronized via the runtime's interrupt lock.
     mutable bool                          codeIsProtected_;
 
   public:
     explicit AsmJSModule(ScriptSource *scriptSource, uint32_t functStart,
                          uint32_t offsetToEndOfUseAsm, bool strict);
     ~AsmJSModule();
@@ -598,16 +600,19 @@ class AsmJSModule
         if (SIZE_MAX - pod.funcPtrTableAndExitBytes_ < sizeof(ExitDatum))
             return false;
         uint32_t globalDataOffset = globalDataBytes();
         JS_STATIC_ASSERT(sizeof(ExitDatum) % sizeof(void*) == 0);
         pod.funcPtrTableAndExitBytes_ += sizeof(ExitDatum);
         *exitIndex = unsigned(exits_.length());
         return exits_.append(Exit(ffiIndex, globalDataOffset));
     }
+    bool addFunctionCounts(jit::IonScriptCounts *counts) {
+        return functionCounts_.append(counts);
+    }
 
     bool addExportedFunction(PropertyName *name, uint32_t srcStart, uint32_t srcEnd,
                              PropertyName *maybeFieldName,
                              ArgCoercionVector &&argCoercions,
                              ReturnType returnType)
     {
         ExportedFunction func(name, srcStart, srcEnd, maybeFieldName,
                               mozilla::Move(argCoercions), returnType);
@@ -696,16 +701,22 @@ class AsmJSModule
     uint8_t *interpExitTrampoline(const Exit &exit) const {
         JS_ASSERT(exit.interpCodeOffset_);
         return code_ + exit.interpCodeOffset_;
     }
     uint8_t *ionExitTrampoline(const Exit &exit) const {
         JS_ASSERT(exit.ionCodeOffset_);
         return code_ + exit.ionCodeOffset_;
     }
+    unsigned numFunctionCounts() const {
+        return functionCounts_.length();
+    }
+    jit::IonScriptCounts *functionCounts(unsigned i) {
+        return functionCounts_[i];
+    }
 
     // An Exit holds bookkeeping information about an exit; the ExitDatum
     // struct overlays the actual runtime data stored in the global data
     // section.
     struct ExitDatum
     {
         uint8_t *exit;
         HeapPtrFunction fun;
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -147,22 +147,24 @@ CodeGenerator::visitOutOfLineCache(OutOf
 StringObject *
 MNewStringObject::templateObj() const {
     return &templateObj_->as<StringObject>();
 }
 
 CodeGenerator::CodeGenerator(MIRGenerator *gen, LIRGraph *graph, MacroAssembler *masm)
   : CodeGeneratorSpecific(gen, graph, masm)
   , ionScriptLabels_(gen->alloc())
+  , scriptCounts_(nullptr)
 {
 }
 
 CodeGenerator::~CodeGenerator()
 {
     JS_ASSERT_IF(!gen->compilingAsmJS(), masm.numAsmJSAbsoluteLinks() == 0);
+    js_delete(scriptCounts_);
 }
 
 typedef bool (*StringToNumberFn)(ThreadSafeContext *, JSString *, double *);
 typedef bool (*StringToNumberParFn)(ForkJoinContext *, JSString *, double *);
 static const VMFunctionsModal StringToNumberInfo = VMFunctionsModal(
     FunctionInfo<StringToNumberFn>(StringToNumber),
     FunctionInfo<StringToNumberParFn>(StringToNumberPar));
 
@@ -3152,57 +3154,56 @@ CodeGenerator::visitOutOfLineInterruptCh
     masm.jump(ool->rejoin());
 
     return true;
 }
 
 IonScriptCounts *
 CodeGenerator::maybeCreateScriptCounts()
 {
-    // If scripts are being profiled, create a new IonScriptCounts and attach
-    // it to the script. This must be done on the main thread.
-    JSContext *cx = GetIonContext()->cx;
-    if (!cx || !cx->runtime()->profilingScripts)
+    // If scripts are being profiled, create a new IonScriptCounts for the
+    // profiling data, which will be attached to the associated JSScript or
+    // AsmJS module after code generation finishes.
+    if (!GetIonContext()->runtime->profilingScripts())
         return nullptr;
 
+    IonScriptCounts *counts = nullptr;
+
     CompileInfo *outerInfo = &gen->info();
     JSScript *script = outerInfo->script();
-    if (!script)
-        return nullptr;
-
-    if (!script->hasScriptCounts() && !script->initScriptCounts(cx))
-        return nullptr;
-
-    IonScriptCounts *counts = js_new<IonScriptCounts>();
+
+    counts = js_new<IonScriptCounts>();
     if (!counts || !counts->init(graph.numBlocks())) {
         js_delete(counts);
         return nullptr;
     }
 
     for (size_t i = 0; i < graph.numBlocks(); i++) {
         MBasicBlock *block = graph.getBlock(i)->mir();
 
-        // Find a PC offset in the outermost script to use. If this block
-        // is from an inlined script, find a location in the outer script
-        // to associate information about the inlining with.
-        MResumePoint *resume = block->entryResumePoint();
-        while (resume->caller())
-            resume = resume->caller();
-
-        uint32_t offset = script->pcToOffset(resume->pc());
+        uint32_t offset = 0;
+        if (script) {
+            // Find a PC offset in the outermost script to use. If this block
+            // is from an inlined script, find a location in the outer script
+            // to associate information about the inlining with.
+            MResumePoint *resume = block->entryResumePoint();
+            while (resume->caller())
+                resume = resume->caller();
+            offset = script->pcToOffset(resume->pc());
+        }
+
         if (!counts->block(i).init(block->id(), offset, block->numSuccessors())) {
             js_delete(counts);
             return nullptr;
         }
-
         for (size_t j = 0; j < block->numSuccessors(); j++)
             counts->block(i).setSuccessor(j, block->getSuccessor(j)->id());
     }
 
-    script->addIonCounts(counts);
+    scriptCounts_ = counts;
     return counts;
 }
 
 // Structure for managing the state tracked for a block by script counters.
 struct ScriptCountBlockState
 {
     IonBlockCounts &block;
     MacroAssembler &masm;
@@ -6697,16 +6698,19 @@ CodeGenerator::link(JSContext *cx, types
         // since that will cancel this compilation too.
         if (!Invalidate(cx, script, SequentialExecution,
                         /* resetUses */ false, /* cancelOffThread*/ false))
         {
             return false;
         }
     }
 
+    if (scriptCounts_ && !script->hasScriptCounts() && !script->initScriptCounts(cx))
+        return false;
+
     // Check to make sure we didn't have a mid-build invalidation. If so, we
     // will trickle to jit::Compile() and return Method_Skipped.
     types::RecompileInfo recompileInfo;
     if (!types::FinishCompilation(cx, script, executionMode, constraints, &recompileInfo))
         return true;
 
     uint32_t scriptFrameSize = frameClass_ == FrameSizeClass::None()
                            ? frameDepth_
@@ -6874,16 +6878,20 @@ CodeGenerator::link(JSContext *cx, types
       case ParallelExecution:
         // We don't run incremental GC during parallel execution; no need to
         // turn on barriers.
         break;
       default:
         MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 
+    // Attach any generated script counts to the script.
+    if (IonScriptCounts *counts = extractScriptCounts())
+        script->addIonCounts(counts);
+
     return true;
 }
 
 // An out-of-line path to convert a boxed int32 to either a float or double.
 class OutOfLineUnboxFloatingPoint : public OutOfLineCodeBase<CodeGenerator>
 {
     LUnboxFloatingPoint *unboxFloatingPoint_;
 
--- a/js/src/jit/CodeGenerator.h
+++ b/js/src/jit/CodeGenerator.h
@@ -349,16 +349,22 @@ class CodeGenerator : public CodeGenerat
     bool visitAssertRangeI(LAssertRangeI *ins);
     bool visitAssertRangeD(LAssertRangeD *ins);
     bool visitAssertRangeF(LAssertRangeF *ins);
     bool visitAssertRangeV(LAssertRangeV *ins);
 
     bool visitInterruptCheck(LInterruptCheck *lir);
     bool visitRecompileCheck(LRecompileCheck *ins);
 
+    IonScriptCounts *extractScriptCounts() {
+        IonScriptCounts *counts = scriptCounts_;
+        scriptCounts_ = nullptr;  // prevent delete in dtor
+        return counts;
+    }
+
   private:
     bool addGetPropertyCache(LInstruction *ins, RegisterSet liveRegs, Register objReg,
                              PropertyName *name, TypedOrValueRegister output,
                              bool monitoredResult, jsbytecode *profilerLeavePc);
     bool addGetElementCache(LInstruction *ins, Register obj, ConstantOrRegister index,
                             TypedOrValueRegister output, bool monitoredResult,
                             bool allowDoubleResult, jsbytecode *profilerLeavePc);
     bool addSetPropertyCache(LInstruction *ins, RegisterSet liveRegs, Register objReg,
@@ -454,16 +460,19 @@ class CodeGenerator : public CodeGenerat
 #ifdef DEBUG
     bool branchIfInvalidated(Register temp, Label *invalidated);
 
     bool emitDebugResultChecks(LInstruction *ins);
     bool emitObjectOrStringResultChecks(LInstruction *lir, MDefinition *mir);
     bool emitValueResultChecks(LInstruction *lir, MDefinition *mir);
 #endif
 
+    // Script counts created during code generation.
+    IonScriptCounts *scriptCounts_;
+
 #if defined(JS_ION_PERF)
     PerfSpewer perfSpewer_;
 #endif
 };
 
 } // namespace jit
 } // namespace js
 
--- a/js/src/jit/CompileWrappers.cpp
+++ b/js/src/jit/CompileWrappers.cpp
@@ -117,16 +117,22 @@ CompileRuntime::jitSupportsFloatingPoint
 }
 
 bool
 CompileRuntime::hadOutOfMemory()
 {
     return runtime()->hadOutOfMemory;
 }
 
+bool
+CompileRuntime::profilingScripts()
+{
+    return runtime()->profilingScripts;
+}
+
 const JSAtomState &
 CompileRuntime::names()
 {
     return *runtime()->commonNames;
 }
 
 const StaticStrings &
 CompileRuntime::staticStrings()
--- a/js/src/jit/CompileWrappers.h
+++ b/js/src/jit/CompileWrappers.h
@@ -63,16 +63,17 @@ class CompileRuntime
     const JitRuntime *jitRuntime();
 
     // Compilation does not occur off thread when the SPS profiler is enabled.
     SPSProfiler &spsProfiler();
 
     bool signalHandlersInstalled();
     bool jitSupportsFloatingPoint();
     bool hadOutOfMemory();
+    bool profilingScripts();
 
     const JSAtomState &names();
     const StaticStrings &staticStrings();
     const Value &NaNValue();
     const Value &positiveInfinityValue();
 
 #ifdef DEBUG
     bool isInsideNursery(gc::Cell *cell);
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -1741,24 +1741,19 @@ OffThreadCompilationAvailable(JSContext 
 {
 #ifdef JS_THREADSAFE
     // Even if off thread compilation is enabled, compilation must still occur
     // on the main thread in some cases. Do not compile off thread during an
     // incremental GC, as this may trip incremental read barriers.
     //
     // Require cpuCount > 1 so that Ion compilation jobs and main-thread
     // execution are not competing for the same resources.
-    //
-    // Skip off thread compilation if PC count profiling is enabled, as
-    // CodeGenerator::maybeCreateScriptCounts will not attach script profiles
-    // when running off thread.
     return cx->runtime()->canUseParallelIonCompilation()
         && HelperThreadState().cpuCount > 1
-        && cx->runtime()->gc.incrementalState == gc::NO_INCREMENTAL
-        && !cx->runtime()->profilingScripts;
+        && cx->runtime()->gc.incrementalState == gc::NO_INCREMENTAL;
 #else
     return false;
 #endif
 }
 
 static void
 TrackAllProperties(JSContext *cx, JSObject *obj)
 {
@@ -1983,20 +1978,19 @@ CheckScriptSize(JSContext *cx, JSScript*
 #ifdef JS_THREADSAFE
         size_t cpuCount = HelperThreadState().cpuCount;
 #else
         size_t cpuCount = 1;
 #endif
         if (cx->runtime()->canUseParallelIonCompilation() && cpuCount > 1) {
             // Even if off thread compilation is enabled, there are cases where
             // compilation must still occur on the main thread. Don't compile
-            // in these cases (except when profiling scripts, as compilations
-            // occurring with profiling should reflect those without), but do
-            // not forbid compilation so that the script may be compiled later.
-            if (!OffThreadCompilationAvailable(cx) && !cx->runtime()->profilingScripts) {
+            // in these cases, but do not forbid compilation so that the script
+            // may be compiled later.
+            if (!OffThreadCompilationAvailable(cx)) {
                 IonSpew(IonSpew_Abort,
                         "Script too large for main thread, skipping (%u bytes) (%u locals/args)",
                         script->length(), numLocalsAndArgs);
                 return Method_Skipped;
             }
         } else {
             IonSpew(IonSpew_Abort, "Script too large (%u bytes) (%u locals/args)",
                     script->length(), numLocalsAndArgs);
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -1085,17 +1085,16 @@ JS_WrapId(JSContext *cx, JS::MutableHand
 JS_PUBLIC_API(JSObject *)
 JS_TransplantObject(JSContext *cx, HandleObject origobj, HandleObject target)
 {
     AssertHeapIsIdle(cx);
     JS_ASSERT(origobj != target);
     JS_ASSERT(!origobj->is<CrossCompartmentWrapperObject>());
     JS_ASSERT(!target->is<CrossCompartmentWrapperObject>());
 
-    AutoMaybeTouchDeadZones agc(cx);
     AutoDisableProxyCheck adpc(cx->runtime());
 
     JSCompartment *destination = target->compartment();
     RootedValue origv(cx, ObjectValue(*origobj));
     RootedObject newIdentity(cx);
 
     if (origobj->compartment() == destination) {
         // If the original object is in the same compartment as the
@@ -4200,18 +4199,16 @@ js_generic_native_method_dispatcher(JSCo
 JS_PUBLIC_API(bool)
 JS_DefineFunctions(JSContext *cx, HandleObject obj, const JSFunctionSpec *fs)
 {
     JS_ASSERT(!cx->runtime()->isAtomsCompartment(cx->compartment()));
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, obj);
 
-    RootedObject ctor(cx);
-
     for (; fs->name; fs++) {
         RootedAtom atom(cx);
         // If the name starts with "@@", it must be a well-known symbol.
         if (fs->name[0] != '@' || fs->name[1] != '@')
             atom = Atomize(cx, fs->name, strlen(fs->name));
         else if (strcmp(fs->name, "@@iterator") == 0)
             // FIXME: This atom should be a symbol: bug 918828.
             atom = cx->names().std_iterator;
@@ -4223,21 +4220,22 @@ JS_DefineFunctions(JSContext *cx, Handle
         Rooted<jsid> id(cx, AtomToId(atom));
 
         /*
          * Define a generic arity N+1 static method for the arity N prototype
          * method if flags contains JSFUN_GENERIC_NATIVE.
          */
         unsigned flags = fs->flags;
         if (flags & JSFUN_GENERIC_NATIVE) {
-            if (!ctor) {
-                ctor = JS_GetConstructor(cx, obj);
-                if (!ctor)
-                    return false;
-            }
+            // We require that any consumers using JSFUN_GENERIC_NATIVE stash
+            // the prototype and constructor in the global slots before invoking
+            // JS_DefineFunctions on the proto.
+            JSProtoKey key = JSCLASS_CACHED_PROTO_KEY(obj->getClass());
+            JS_ASSERT(obj == &obj->global().getPrototype(key).toObject());
+            RootedObject ctor(cx, &obj->global().getConstructor(key).toObject());
 
             flags &= ~JSFUN_GENERIC_NATIVE;
             JSFunction *fun = DefineFunction(cx, ctor, id,
                                              js_generic_native_method_dispatcher,
                                              fs->nargs + 1, flags,
                                              JSFunction::ExtendedFinalizeKind);
             if (!fun)
                 return false;
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -826,33 +826,16 @@ js::ObjectMayHaveExtraIndexedProperties(
             return true;
         if (obj->is<TypedArrayObject>())
             return true;
     }
 
     return false;
 }
 
-const Class ArrayObject::class_ = {
-    "Array",
-    JSCLASS_HAS_CACHED_PROTO(JSProto_Array),
-    array_addProperty,
-    JS_DeletePropertyStub,   /* delProperty */
-    JS_PropertyStub,         /* getProperty */
-    JS_StrictPropertyStub,   /* setProperty */
-    JS_EnumerateStub,
-    JS_ResolveStub,
-    JS_ConvertStub,
-    nullptr,
-    nullptr,        /* call        */
-    nullptr,        /* hasInstance */
-    nullptr,        /* construct   */
-    nullptr         /* trace       */
-};
-
 static bool
 AddLengthProperty(ExclusiveContext *cx, HandleObject obj)
 {
     /*
      * Add the 'length' property for a newly created array,
      * and update the elements to be an empty array owned by the object.
      * The shared emptyObjectElements singleton cannot be used for slow arrays,
      * as accesses to 'length' will use the elements header.
@@ -3065,24 +3048,21 @@ js_Array(JSContext *cx, unsigned argc, V
     /* If the length calculation overflowed, make sure that is marked for the new type. */
     if (arr->length() > INT32_MAX)
         arr->setLength(cx, arr->length());
 
     args.rval().setObject(*arr);
     return true;
 }
 
-JSObject *
-js_InitArrayClass(JSContext *cx, HandleObject obj)
+static JSObject *
+CreateArrayPrototype(JSContext *cx, JSProtoKey key)
 {
-    JS_ASSERT(obj->isNative());
-
-    Rooted<GlobalObject*> global(cx, &obj->as<GlobalObject>());
-
-    RootedObject proto(cx, global->getOrCreateObjectPrototype(cx));
+    JS_ASSERT(key == JSProto_Array);
+    RootedObject proto(cx, cx->global()->getOrCreateObjectPrototype(cx));
     if (!proto)
         return nullptr;
 
     RootedTypeObject type(cx, cx->getNewType(&ArrayObject::class_, TaggedProto(proto)));
     if (!type)
         return nullptr;
 
     JSObject *metadata = nullptr;
@@ -3094,45 +3074,51 @@ js_InitArrayClass(JSContext *cx, HandleO
                                                       gc::FINALIZE_OBJECT0));
     if (!shape)
         return nullptr;
 
     RootedObject arrayProto(cx, JSObject::createArray(cx, gc::FINALIZE_OBJECT4, gc::TenuredHeap, shape, type, 0));
     if (!arrayProto || !JSObject::setSingletonType(cx, arrayProto) || !AddLengthProperty(cx, arrayProto))
         return nullptr;
 
-    RootedFunction ctor(cx);
-    ctor = global->createConstructor(cx, js_Array, cx->names().Array, 1);
-    if (!ctor)
-        return nullptr;
-
     /*
      * The default 'new' type of Array.prototype is required by type inference
      * to have unknown properties, to simplify handling of e.g. heterogenous
      * arrays in JSON and script literals and allows setDenseArrayElement to
      * be used without updating the indexed type set for such default arrays.
      */
     if (!JSObject::setNewTypeUnknown(cx, &ArrayObject::class_, arrayProto))
         return nullptr;
 
-    if (!LinkConstructorAndPrototype(cx, ctor, arrayProto))
-        return nullptr;
-
-    if (!DefinePropertiesAndBrand(cx, arrayProto, nullptr, array_methods) ||
-        !DefinePropertiesAndBrand(cx, ctor, nullptr, array_static_methods))
-    {
-        return nullptr;
-    }
-
-    if (!GlobalObject::initBuiltinConstructor(cx, global, JSProto_Array, ctor, arrayProto))
-        return nullptr;
-
     return arrayProto;
 }
 
+const Class ArrayObject::class_ = {
+    "Array",
+    JSCLASS_HAS_CACHED_PROTO(JSProto_Array),
+    array_addProperty,
+    JS_DeletePropertyStub,   /* delProperty */
+    JS_PropertyStub,         /* getProperty */
+    JS_StrictPropertyStub,   /* setProperty */
+    JS_EnumerateStub,
+    JS_ResolveStub,
+    JS_ConvertStub,
+    nullptr,
+    nullptr,        /* call        */
+    nullptr,        /* hasInstance */
+    nullptr,        /* construct   */
+    nullptr,        /* trace       */
+    {
+        GenericCreateConstructor<js_Array, NAME_OFFSET(Array), 1>,
+        CreateArrayPrototype,
+        array_static_methods,
+        array_methods
+    }
+};
+
 /*
  * Array allocation functions.
  */
 
 static inline bool
 EnsureNewArrayElements(ExclusiveContext *cx, JSObject *obj, uint32_t length)
 {
     /*
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -60,17 +60,19 @@ JSCompartment::JSCompartment(Zone *zone,
     gcWeakMapList(nullptr),
     debugModeBits(runtime_->debugMode ? DebugFromC : 0),
     rngState(0),
     watchpointMap(nullptr),
     scriptCountsMap(nullptr),
     debugScriptMap(nullptr),
     debugScopes(nullptr),
     enumerators(nullptr),
-    compartmentStats(nullptr)
+    compartmentStats(nullptr),
+    scheduledForDestruction(false),
+    maybeAlive(true)
 #ifdef JS_ION
     , jitCompartment_(nullptr)
 #endif
 {
     runtime_->numCompartments++;
     JS_ASSERT_IF(options.mergeable(), options.invisibleToDebugger());
 }
 
--- a/js/src/jscompartment.h
+++ b/js/src/jscompartment.h
@@ -442,16 +442,21 @@ struct JSCompartment
      * List of potentially active iterators that may need deleted property
      * suppression.
      */
     js::NativeIterator *enumerators;
 
     /* Used by memory reporters and invalid otherwise. */
     void               *compartmentStats;
 
+    // These flags help us to discover if a compartment that shouldn't be alive
+    // manages to outlive a GC.
+    bool scheduledForDestruction;
+    bool maybeAlive;
+
 #ifdef JS_ION
   private:
     js::jit::JitCompartment *jitCompartment_;
 
   public:
     bool ensureJitCompartmentExists(JSContext *cx);
     js::jit::JitCompartment *jitCompartment() {
         return jitCompartment_;
--- a/js/src/jsfriendapi.cpp
+++ b/js/src/jsfriendapi.cpp
@@ -964,35 +964,33 @@ JS::IsIncrementalBarrierNeeded(JSContext
 JS_FRIEND_API(void)
 JS::IncrementalObjectBarrier(JSObject *obj)
 {
     if (!obj)
         return;
 
     JS_ASSERT(!obj->zone()->runtimeFromMainThread()->isHeapMajorCollecting());
 
-    AutoMarkInDeadZone amn(obj->zone());
-
     JSObject::writeBarrierPre(obj);
 }
 
 JS_FRIEND_API(void)
 JS::IncrementalReferenceBarrier(void *ptr, JSGCTraceKind kind)
 {
     if (!ptr)
         return;
 
     gc::Cell *cell = static_cast<gc::Cell *>(ptr);
+
+#ifdef DEBUG
     Zone *zone = kind == JSTRACE_OBJECT
                  ? static_cast<JSObject *>(cell)->zone()
                  : cell->tenuredZone();
-
     JS_ASSERT(!zone->runtimeFromMainThread()->isHeapMajorCollecting());
-
-    AutoMarkInDeadZone amn(zone);
+#endif
 
     if (kind == JSTRACE_OBJECT)
         JSObject::writeBarrierPre(static_cast<JSObject*>(cell));
     else if (kind == JSTRACE_STRING)
         JSString::writeBarrierPre(static_cast<JSString*>(cell));
     else if (kind == JSTRACE_SCRIPT)
         JSScript::writeBarrierPre(static_cast<JSScript*>(cell));
     else if (kind == JSTRACE_LAZY_SCRIPT)
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -1110,24 +1110,24 @@ GCRuntime::GCRuntime(JSRuntime *rt) :
 #endif
     validate(true),
     fullCompartmentChecks(false),
     gcCallback(nullptr),
     sliceCallback(nullptr),
     mallocBytes(0),
     mallocGCTriggered(false),
     scriptAndCountsVector(nullptr),
-    helperState(rt),
+    inUnsafeRegion(0),
     alwaysPreserveCode(false),
 #ifdef DEBUG
     noGCOrAllocationCheck(0),
 #endif
     lock(nullptr),
     lockOwner(nullptr),
-    inUnsafeRegion(0)
+    helperState(rt)
 {
 }
 
 #ifdef JS_GC_ZEAL
 
 extern void
 js::SetGCZeal(JSRuntime *rt, uint8_t zeal, uint32_t frequency)
 {
@@ -2894,24 +2894,24 @@ GCRuntime::beginMarkPhase()
             if (!rt->isAtomsZone(zone)) {
                 any = true;
                 zone->setGCState(Zone::Mark);
             }
         } else {
             isFull = false;
         }
 
-        zone->scheduledForDestruction = false;
-        zone->maybeAlive = false;
         zone->setPreservingCode(false);
     }
 
     for (CompartmentsIter c(rt, WithAtoms); !c.done(); c.next()) {
         JS_ASSERT(c->gcLiveArrayBuffers.empty());
         c->marked = false;
+        c->scheduledForDestruction = false;
+        c->maybeAlive = false;
         if (shouldPreserveJITCode(c, currentTime))
             c->zone()->setPreservingCode(true);
     }
 
     if (!rt->gc.shouldCleanUpEverything) {
 #ifdef JS_ION
         if (JSCompartment *comp = jit::TopmostIonActivationCompartment(rt))
             comp->zone()->setPreservingCode(true);
@@ -3002,61 +3002,71 @@ GCRuntime::beginMarkPhase()
     if (isFull)
         UnmarkScriptData(rt);
 
     markRuntime(gcmarker);
     if (isIncremental)
         bufferGrayRoots();
 
     /*
-     * This code ensures that if a zone is "dead", then it will be
-     * collected in this GC. A zone is considered dead if its maybeAlive
+     * This code ensures that if a compartment is "dead", then it will be
+     * collected in this GC. A compartment is considered dead if its maybeAlive
      * flag is false. The maybeAlive flag is set if:
-     *   (1) the zone has incoming cross-compartment edges, or
-     *   (2) an object in the zone was marked during root marking, either
+     *   (1) the compartment has incoming cross-compartment edges, or
+     *   (2) an object in the compartment was marked during root marking, either
      *       as a black root or a gray root.
      * If the maybeAlive is false, then we set the scheduledForDestruction flag.
-     * At any time later in the GC, if we try to mark an object whose
-     * zone is scheduled for destruction, we will assert.
-     * NOTE: Due to bug 811587, we only assert if gcManipulatingDeadCompartments
-     * is true (e.g., if we're doing a brain transplant).
+     * At the end of the GC, we look for compartments where
+     * scheduledForDestruction is true. These are compartments that were somehow
+     * "revived" during the incremental GC. If any are found, we do a special,
+     * non-incremental GC of those compartments to try to collect them.
      *
-     * The purpose of this check is to ensure that a zone that we would
-     * normally destroy is not resurrected by a read barrier or an
-     * allocation. This might happen during a function like JS_TransplantObject,
-     * which iterates over all compartments, live or dead, and operates on their
-     * objects. See bug 803376 for details on this problem. To avoid the
-     * problem, we are very careful to avoid allocation and read barriers during
-     * JS_TransplantObject and the like. The code here ensures that we don't
-     * regress.
+     * Compartments can be revived for a variety of reasons. On reason is bug
+     * 811587, where a reflector that was dead can be revived by DOM code that
+     * still refers to the underlying DOM node.
      *
-     * Note that there are certain cases where allocations or read barriers in
-     * dead zone are difficult to avoid. We detect such cases (via the
-     * gcObjectsMarkedInDeadCompartment counter) and redo any ongoing GCs after
-     * the JS_TransplantObject function has finished. This ensures that the dead
-     * zones will be cleaned up. See AutoMarkInDeadZone and
-     * AutoMaybeTouchDeadZones for details.
+     * Read barriers and allocations can also cause revival. This might happen
+     * during a function like JS_TransplantObject, which iterates over all
+     * compartments, live or dead, and operates on their objects. See bug 803376
+     * for details on this problem. To avoid the problem, we try to avoid
+     * allocation and read barriers during JS_TransplantObject and the like.
      */
 
     /* Set the maybeAlive flag based on cross-compartment edges. */
     for (CompartmentsIter c(rt, SkipAtoms); !c.done(); c.next()) {
         for (JSCompartment::WrapperEnum e(c); !e.empty(); e.popFront()) {
-            Cell *dst = e.front().key().wrapped;
-            dst->tenuredZone()->maybeAlive = true;
+            const CrossCompartmentKey &key = e.front().key();
+            JSCompartment *dest;
+            switch (key.kind) {
+              case CrossCompartmentKey::ObjectWrapper:
+              case CrossCompartmentKey::DebuggerObject:
+              case CrossCompartmentKey::DebuggerSource:
+              case CrossCompartmentKey::DebuggerEnvironment:
+                dest = static_cast<JSObject *>(key.wrapped)->compartment();
+                break;
+              case CrossCompartmentKey::DebuggerScript:
+                dest = static_cast<JSScript *>(key.wrapped)->compartment();
+                break;
+              default:
+                dest = nullptr;
+                break;
+            }
+            if (dest)
+                dest->maybeAlive = true;
         }
     }
 
     /*
      * For black roots, code in gc/Marking.cpp will already have set maybeAlive
      * during MarkRuntime.
      */
 
-    for (GCZonesIter zone(rt); !zone.done(); zone.next()) {
-        if (!zone->maybeAlive && !rt->isAtomsZone(zone))
-            zone->scheduledForDestruction = true;
+    for (GCCompartmentsIter c(rt); !c.done(); c.next()) {
+        if (!c->maybeAlive && !rt->isAtomsCompartment(c))
+            c->scheduledForDestruction = true;
     }
     foundBlackGrayEdges = false;
 
     return true;
 }
 
 template <class CompartmentIterT>
 void
@@ -3461,18 +3471,20 @@ Zone::findOutgoingEdges(ComponentFinder<
      */
     JSRuntime *rt = runtimeFromMainThread();
     if (rt->atomsCompartment()->zone()->isGCMarking())
         finder.addEdgeTo(rt->atomsCompartment()->zone());
 
     for (CompartmentsInZoneIter comp(this); !comp.done(); comp.next())
         comp->findOutgoingEdges(finder);
 
-    for (ZoneSet::Range r = gcZoneGroupEdges.all(); !r.empty(); r.popFront())
-        finder.addEdgeTo(r.front());
+    for (ZoneSet::Range r = gcZoneGroupEdges.all(); !r.empty(); r.popFront()) {
+        if (r.front()->isGCMarking())
+            finder.addEdgeTo(r.front());
+    }
     gcZoneGroupEdges.clear();
 }
 
 bool
 GCRuntime::findZoneEdgesForWeakMaps()
 {
     /*
      * Weakmaps which have keys with delegates in a different zone introduce the
@@ -3501,32 +3513,41 @@ GCRuntime::findZoneGroups()
 
     for (GCZonesIter zone(rt); !zone.done(); zone.next()) {
         JS_ASSERT(zone->isGCMarking());
         finder.addNode(zone);
     }
     zoneGroups = finder.getResultsList();
     currentZoneGroup = zoneGroups;
     zoneGroupIndex = 0;
+
+    for (Zone *head = currentZoneGroup; head; head = head->nextGroup()) {
+        for (Zone *zone = head; zone; zone = zone->nextNodeInGroup())
+            JS_ASSERT(zone->isGCMarking());
+    }
+
     JS_ASSERT_IF(!isIncremental, !currentZoneGroup->nextGroup());
 }
 
 static void
 ResetGrayList(JSCompartment* comp);
 
 void
 GCRuntime::getNextZoneGroup()
 {
     currentZoneGroup = currentZoneGroup->nextGroup();
     ++zoneGroupIndex;
     if (!currentZoneGroup) {
         abortSweepAfterCurrentGroup = false;
         return;
     }
 
+    for (Zone *zone = currentZoneGroup; zone; zone = zone->nextNodeInGroup())
+        JS_ASSERT(zone->isGCMarking());
+
     if (!isIncremental)
         ComponentFinder<Zone>::mergeGroups(currentZoneGroup);
 
     if (abortSweepAfterCurrentGroup) {
         JS_ASSERT(!isIncremental);
         for (GCZoneGroupIter zone(rt); !zone.done(); zone.next()) {
             JS_ASSERT(!zone->gcNextGraphComponent);
             JS_ASSERT(zone->isGCMarking());
@@ -4407,18 +4428,18 @@ GCRuntime::resetIncrementalGC(const char
         JS_ASSERT(!strictCompartmentChecking);
 
         break;
       }
 
       case SWEEP:
         marker.reset();
 
-        for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next())
-            zone->scheduledForDestruction = false;
+        for (CompartmentsIter c(rt, SkipAtoms); !c.done(); c.next())
+            c->scheduledForDestruction = false;
 
         /* Finish sweeping the current zone group, then abort. */
         abortSweepAfterCurrentGroup = true;
         incrementalCollectSlice(SliceBudget::Unlimited, JS::gcreason::RESET, GC_NORMAL);
 
         {
             gcstats::AutoPhase ap(stats, gcstats::PHASE_WAIT_BACKGROUND_THREAD);
             rt->gc.waitBackgroundSweepOrAllocEnd();
@@ -4887,22 +4908,39 @@ GCRuntime::collect(bool incremental, int
                 gcCallback(rt, JSGC_END, gcCallbackData);
         }
 
         /* Need to re-schedule all zones for GC. */
         if (poke && shouldCleanUpEverything)
             JS::PrepareForFullGC(rt);
 
         /*
+         * This code makes an extra effort to collect compartments that we
+         * thought were dead at the start of the GC. See the large comment in
+         * beginMarkPhase.
+         */
+        bool repeatForDeadZone = false;
+        if (incremental && incrementalState == NO_INCREMENTAL) {
+            for (CompartmentsIter c(rt, SkipAtoms); !c.done(); c.next()) {
+                if (c->scheduledForDestruction) {
+                    incremental = false;
+                    repeatForDeadZone = true;
+                    reason = JS::gcreason::COMPARTMENT_REVIVED;
+                    c->zone()->scheduleGC();
+                }
+            }
+        }
+
+        /*
          * If we reset an existing GC, we need to start a new one. Also, we
          * repeat GCs that happen during shutdown (the gcShouldCleanUpEverything
          * case) until we can be sure that no additional garbage is created
          * (which typically happens if roots are dropped during finalizers).
          */
-        repeat = (poke && shouldCleanUpEverything) || wasReset;
+        repeat = (poke && shouldCleanUpEverything) || wasReset || repeatForDeadZone;
     } while (repeat);
 
     if (incrementalState == NO_INCREMENTAL) {
 #ifdef JS_THREADSAFE
         EnqueuePendingParseTasksAfterGC(rt);
 #endif
     }
 }
@@ -5515,44 +5553,16 @@ ArenaLists::containsArena(JSRuntime *rt,
     for (ArenaHeader *aheader = arenaLists[allocKind].head(); aheader; aheader = aheader->next) {
         if (aheader == needle)
             return true;
     }
     return false;
 }
 
 
-AutoMaybeTouchDeadZones::AutoMaybeTouchDeadZones(JSContext *cx)
-  : runtime(cx->runtime()),
-    markCount(runtime->gc.objectsMarkedInDeadZones),
-    inIncremental(JS::IsIncrementalGCInProgress(runtime)),
-    manipulatingDeadZones(runtime->gc.manipulatingDeadZones)
-{
-    runtime->gc.manipulatingDeadZones = true;
-}
-
-AutoMaybeTouchDeadZones::AutoMaybeTouchDeadZones(JSObject *obj)
-  : runtime(obj->compartment()->runtimeFromMainThread()),
-    markCount(runtime->gc.objectsMarkedInDeadZones),
-    inIncremental(JS::IsIncrementalGCInProgress(runtime)),
-    manipulatingDeadZones(runtime->gc.manipulatingDeadZones)
-{
-    runtime->gc.manipulatingDeadZones = true;
-}
-
-AutoMaybeTouchDeadZones::~AutoMaybeTouchDeadZones()
-{
-    runtime->gc.manipulatingDeadZones = manipulatingDeadZones;
-
-    if (inIncremental && runtime->gc.objectsMarkedInDeadZones != markCount) {
-        JS::PrepareForFullGC(runtime);
-        js::GC(runtime, GC_NORMAL, JS::gcreason::TRANSPLANT);
-    }
-}
-
 AutoSuppressGC::AutoSuppressGC(ExclusiveContext *cx)
   : suppressGC_(cx->perThreadData->suppressGC)
 {
     suppressGC_++;
 }
 
 AutoSuppressGC::AutoSuppressGC(JSCompartment *comp)
   : suppressGC_(comp->runtimeFromMainThread()->mainThread.suppressGC)
--- a/js/src/jsgcinlines.h
+++ b/js/src/jsgcinlines.h
@@ -10,43 +10,16 @@
 #include "jsgc.h"
 
 #include "gc/Zone.h"
 
 namespace js {
 
 class Shape;
 
-/*
- * This auto class should be used around any code that might cause a mark bit to
- * be set on an object in a dead zone. See AutoMaybeTouchDeadZones
- * for more details.
- */
-struct AutoMarkInDeadZone
-{
-    explicit AutoMarkInDeadZone(JS::Zone *zone)
-      : zone(zone),
-        scheduled(zone->scheduledForDestruction)
-    {
-        JSRuntime *rt = zone->runtimeFromMainThread();
-        if (rt->gc.manipulatingDeadZones && zone->scheduledForDestruction) {
-            rt->gc.objectsMarkedInDeadZones++;
-            zone->scheduledForDestruction = false;
-        }
-    }
-
-    ~AutoMarkInDeadZone() {
-        zone->scheduledForDestruction = scheduled;
-    }
-
-  private:
-    JS::Zone *zone;
-    bool scheduled;
-};
-
 inline Allocator *
 ThreadSafeContext::allocator() const
 {
     JS_ASSERT_IF(isJSContext(), &asJSContext()->zone()->allocator == allocator_);
     return allocator_;
 }
 
 template <typename T>
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -2507,19 +2507,16 @@ JSObject::TradeGuts(JSContext *cx, JSObj
     }
 #endif
 }
 
 /* Use this method with extreme caution. It trades the guts of two objects. */
 bool
 JSObject::swap(JSContext *cx, HandleObject a, HandleObject b)
 {
-    AutoMarkInDeadZone adc1(a->zone());
-    AutoMarkInDeadZone adc2(b->zone());
-
     // Ensure swap doesn't cause a finalizer to not be run.
     JS_ASSERT(IsBackgroundFinalized(a->tenuredGetAllocKind()) ==
               IsBackgroundFinalized(b->tenuredGetAllocKind()));
     JS_ASSERT(a->compartment() == b->compartment());
 
     unsigned r = NotifyGCPreSwap(a, b);
 
     TradeGutsReserved reserved(cx);
--- a/js/src/jsprototypes.h
+++ b/js/src/jsprototypes.h
@@ -59,17 +59,17 @@
 #else
 #define IF_SAB(real,imaginary) imaginary
 #endif
 
 #define JS_FOR_PROTOTYPES(real,imaginary) \
     imaginary(Null,              0,     js_InitNullClass,          dummy) \
     real(Object,                 1,     js_InitViaClassSpec,       &JSObject::class_) \
     real(Function,               2,     js_InitViaClassSpec,       &JSFunction::class_) \
-    real(Array,                  3,     js_InitArrayClass,         OCLASP(Array)) \
+    real(Array,                  3,     js_InitViaClassSpec,       OCLASP(Array)) \
     real(Boolean,                4,     js_InitBooleanClass,       OCLASP(Boolean)) \
     real(JSON,                   5,     js_InitJSONClass,          CLASP(JSON)) \
     real(Date,                   6,     js_InitViaClassSpec,       OCLASP(Date)) \
     real(Math,                   7,     js_InitMathClass,          CLASP(Math)) \
     real(Number,                 8,     js_InitNumberClass,        OCLASP(Number)) \
     real(String,                 9,     js_InitStringClass,        OCLASP(String)) \
     real(RegExp,                10,     js_InitRegExpClass,        OCLASP(RegExp)) \
     real(Error,                 11,     js_InitExceptionClasses,   OCLASP(Error)) \
@@ -77,31 +77,31 @@
     real(EvalError,             13,     js_InitExceptionClasses,   OCLASP(Error)) \
     real(RangeError,            14,     js_InitExceptionClasses,   OCLASP(Error)) \
     real(ReferenceError,        15,     js_InitExceptionClasses,   OCLASP(Error)) \
     real(SyntaxError,           16,     js_InitExceptionClasses,   OCLASP(Error)) \
     real(TypeError,             17,     js_InitExceptionClasses,   OCLASP(Error)) \
     real(URIError,              18,     js_InitExceptionClasses,   OCLASP(Error)) \
     real(Iterator,              19,     js_InitIteratorClasses,    OCLASP(PropertyIterator)) \
     real(StopIteration,         20,     js_InitIteratorClasses,    OCLASP(StopIteration)) \
-    real(ArrayBuffer,           21,     js_InitTypedArrayClasses,  &js::ArrayBufferObject::protoClass) \
-    real(Int8Array,             22,     js_InitTypedArrayClasses,  TYPED_ARRAY_CLASP(TYPE_INT8)) \
-    real(Uint8Array,            23,     js_InitTypedArrayClasses,  TYPED_ARRAY_CLASP(TYPE_UINT8)) \
-    real(Int16Array,            24,     js_InitTypedArrayClasses,  TYPED_ARRAY_CLASP(TYPE_INT16)) \
-    real(Uint16Array,           25,     js_InitTypedArrayClasses,  TYPED_ARRAY_CLASP(TYPE_UINT16)) \
-    real(Int32Array,            26,     js_InitTypedArrayClasses,  TYPED_ARRAY_CLASP(TYPE_INT32)) \
-    real(Uint32Array,           27,     js_InitTypedArrayClasses,  TYPED_ARRAY_CLASP(TYPE_UINT32)) \
-    real(Float32Array,          28,     js_InitTypedArrayClasses,  TYPED_ARRAY_CLASP(TYPE_FLOAT32)) \
-    real(Float64Array,          29,     js_InitTypedArrayClasses,  TYPED_ARRAY_CLASP(TYPE_FLOAT64)) \
-    real(Uint8ClampedArray,     30,     js_InitTypedArrayClasses,  TYPED_ARRAY_CLASP(TYPE_UINT8_CLAMPED)) \
+    real(ArrayBuffer,           21,     js_InitArrayBufferClass,   &js::ArrayBufferObject::protoClass) \
+    real(Int8Array,             22,     js_InitViaClassSpec,       TYPED_ARRAY_CLASP(TYPE_INT8)) \
+    real(Uint8Array,            23,     js_InitViaClassSpec,       TYPED_ARRAY_CLASP(TYPE_UINT8)) \
+    real(Int16Array,            24,     js_InitViaClassSpec,       TYPED_ARRAY_CLASP(TYPE_INT16)) \
+    real(Uint16Array,           25,     js_InitViaClassSpec,       TYPED_ARRAY_CLASP(TYPE_UINT16)) \
+    real(Int32Array,            26,     js_InitViaClassSpec,       TYPED_ARRAY_CLASP(TYPE_INT32)) \
+    real(Uint32Array,           27,     js_InitViaClassSpec,       TYPED_ARRAY_CLASP(TYPE_UINT32)) \
+    real(Float32Array,          28,     js_InitViaClassSpec,       TYPED_ARRAY_CLASP(TYPE_FLOAT32)) \
+    real(Float64Array,          29,     js_InitViaClassSpec,       TYPED_ARRAY_CLASP(TYPE_FLOAT64)) \
+    real(Uint8ClampedArray,     30,     js_InitViaClassSpec,       TYPED_ARRAY_CLASP(TYPE_UINT8_CLAMPED)) \
     real(Proxy,                 31,     js_InitProxyClass,         &ProxyObject::uncallableClass_) \
     real(WeakMap,               32,     js_InitWeakMapClass,       OCLASP(WeakMap)) \
     real(Map,                   33,     js_InitMapClass,           OCLASP(Map)) \
     real(Set,                   34,     js_InitSetClass,           OCLASP(Set)) \
-    real(DataView,              35,     js_InitTypedArrayClasses,  OCLASP(DataView)) \
+    real(DataView,              35,     js_InitDataViewClass,      OCLASP(DataView)) \
 IF_SAB(real,imaginary)(SharedArrayBuffer,       36,     js_InitSharedArrayBufferClass, &js::SharedArrayBufferObject::protoClass) \
 IF_INTL(real,imaginary) (Intl,                  37,     js_InitIntlClass,          CLASP(Intl)) \
 IF_BDATA(real,imaginary)(TypedObject,           38,     js_InitTypedObjectModuleObject,   OCLASP(TypedObjectModule)) \
     imaginary(GeneratorFunction,     39,     js_InitIteratorClasses, dummy) \
 IF_BDATA(real,imaginary)(SIMD,                  40,     js_InitSIMDClass, OCLASP(SIMD)) \
 
 #define JS_FOR_EACH_PROTOTYPE(macro) JS_FOR_PROTOTYPES(macro,macro)
 
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -17,16 +17,17 @@
 
 #include "jsstr.h"
 
 #include "mozilla/Attributes.h"
 #include "mozilla/Casting.h"
 #include "mozilla/CheckedInt.h"
 #include "mozilla/FloatingPoint.h"
 #include "mozilla/PodOperations.h"
+#include "mozilla/TypeTraits.h"
 
 #include <ctype.h>
 #include <string.h>
 
 #include "jsapi.h"
 #include "jsarray.h"
 #include "jsatom.h"
 #include "jsbool.h"
@@ -61,16 +62,17 @@
 using namespace js;
 using namespace js::gc;
 using namespace js::types;
 using namespace js::unicode;
 
 using mozilla::CheckedInt;
 using mozilla::IsNaN;
 using mozilla::IsNegativeZero;
+using mozilla::IsSame;
 using mozilla::PodCopy;
 using mozilla::PodEqual;
 using mozilla::SafeCast;
 
 typedef Handle<JSLinearString*> HandleLinearString;
 
 static JSLinearString *
 ArgToRootedString(JSContext *cx, CallArgs &args, unsigned argno)
@@ -1002,82 +1004,89 @@ out_of_range:
  * The patlen argument must be positive and no greater than sBMHPatLenMax.
  *
  * Return the index of pat in text, or -1 if not found.
  */
 static const uint32_t sBMHCharSetSize = 256; /* ISO-Latin-1 */
 static const uint32_t sBMHPatLenMax   = 255; /* skip table element is uint8_t */
 static const int      sBMHBadPattern  = -2;  /* return value if pat is not ISO-Latin-1 */
 
-int
-js_BoyerMooreHorspool(const jschar *text, uint32_t textlen,
-                      const jschar *pat, uint32_t patlen)
+template <typename TextChar, typename PatChar>
+static int
+BoyerMooreHorspool(const TextChar *text, uint32_t textLen, const PatChar *pat, uint32_t patLen)
 {
+    JS_ASSERT(0 < patLen && patLen <= sBMHPatLenMax);
+
     uint8_t skip[sBMHCharSetSize];
-
-    JS_ASSERT(0 < patlen && patlen <= sBMHPatLenMax);
     for (uint32_t i = 0; i < sBMHCharSetSize; i++)
-        skip[i] = (uint8_t)patlen;
-    uint32_t m = patlen - 1;
-    for (uint32_t i = 0; i < m; i++) {
-        jschar c = pat[i];
+        skip[i] = uint8_t(patLen);
+
+    uint32_t patLast = patLen - 1;
+    for (uint32_t i = 0; i < patLast; i++) {
+        PatChar c = pat[i];
         if (c >= sBMHCharSetSize)
             return sBMHBadPattern;
-        skip[c] = (uint8_t)(m - i);
+        skip[c] = uint8_t(patLast - i);
     }
-    jschar c;
-    for (uint32_t k = m;
-         k < textlen;
-         k += ((c = text[k]) >= sBMHCharSetSize) ? patlen : skip[c]) {
-        for (uint32_t i = k, j = m; ; i--, j--) {
+
+    for (uint32_t k = patLast; k < textLen; ) {
+        for (uint32_t i = k, j = patLast; ; i--, j--) {
             if (text[i] != pat[j])
                 break;
             if (j == 0)
                 return static_cast<int>(i);  /* safe: max string size */
         }
+
+        TextChar c = text[k];
+        k += (c >= sBMHCharSetSize) ? patLen : skip[c];
     }
     return -1;
 }
 
+template <typename TextChar, typename PatChar>
 struct MemCmp {
     typedef uint32_t Extent;
-    static MOZ_ALWAYS_INLINE Extent computeExtent(const jschar *, uint32_t patlen) {
-        return (patlen - 1) * sizeof(jschar);
+    static MOZ_ALWAYS_INLINE Extent computeExtent(const PatChar *, uint32_t patLen) {
+        return (patLen - 1) * sizeof(PatChar);
     }
-    static MOZ_ALWAYS_INLINE bool match(const jschar *p, const jschar *t, Extent extent) {
+    static MOZ_ALWAYS_INLINE bool match(const PatChar *p, const TextChar *t, Extent extent) {
+        MOZ_ASSERT(sizeof(TextChar) == sizeof(PatChar));
         return memcmp(p, t, extent) == 0;
     }
 };
 
+template <typename TextChar, typename PatChar>
 struct ManualCmp {
-    typedef const jschar *Extent;
-    static MOZ_ALWAYS_INLINE Extent computeExtent(const jschar *pat, uint32_t patlen) {
-        return pat + patlen;
+    typedef const PatChar *Extent;
+    static MOZ_ALWAYS_INLINE Extent computeExtent(const PatChar *pat, uint32_t patLen) {
+        return pat + patLen;
     }
-    static MOZ_ALWAYS_INLINE bool match(const jschar *p, const jschar *t, Extent extent) {
+    static MOZ_ALWAYS_INLINE bool match(const PatChar *p, const TextChar *t, Extent extent) {
         for (; p != extent; ++p, ++t) {
             if (*p != *t)
                 return false;
         }
         return true;
     }
 };
 
-template <class InnerMatch>
+template <class InnerMatch, typename TextChar, typename PatChar>
 static int
-UnrolledMatch(const jschar *text, uint32_t textlen, const jschar *pat, uint32_t patlen)
+UnrolledMatch(const TextChar *text, uint32_t textLen, const PatChar *pat, uint32_t patLen)
 {
-    JS_ASSERT(patlen > 0 && textlen > 0);
-    const jschar *textend = text + textlen - (patlen - 1);
-    const jschar p0 = *pat;
-    const jschar *const patNext = pat + 1;
-    const typename InnerMatch::Extent extent = InnerMatch::computeExtent(pat, patlen);
+    JS_ASSERT(patLen > 0);
+    JS_ASSERT(textLen > 0);
+
+    const TextChar *textend = text + textLen - (patLen - 1);
+    const PatChar p0 = *pat;
+    const PatChar *const patNext = pat + 1;
+    const typename InnerMatch::Extent extent = InnerMatch::computeExtent(pat, patLen);
     uint8_t fixup;
 
-    const jschar *t = text;
+    const TextChar *t = text;
     switch ((textend - t) & 7) {
       case 0: if (*t++ == p0) { fixup = 8; goto match; }
       case 7: if (*t++ == p0) { fixup = 7; goto match; }
       case 6: if (*t++ == p0) { fixup = 6; goto match; }
       case 5: if (*t++ == p0) { fixup = 5; goto match; }
       case 4: if (*t++ == p0) { fixup = 4; goto match; }
       case 3: if (*t++ == p0) { fixup = 3; goto match; }
       case 2: if (*t++ == p0) { fixup = 2; goto match; }
@@ -1102,87 +1111,89 @@ UnrolledMatch(const jschar *text, uint32
                 return t - text - 1;
             }
           failed_match:;
         } while (--fixup > 0);
     }
     return -1;
 }
 
+template <typename TextChar, typename PatChar>
 static MOZ_ALWAYS_INLINE int
-StringMatch(const jschar *text, uint32_t textlen,
-            const jschar *pat, uint32_t patlen)
+StringMatch(const TextChar *text, uint32_t textLen, const PatChar *pat, uint32_t patLen)
 {
-    if (patlen == 0)
+    if (patLen == 0)
         return 0;
-    if (textlen < patlen)
+    if (textLen < patLen)
         return -1;
 
 #if defined(__i386__) || defined(_M_IX86) || defined(__i386)
     /*
      * Given enough registers, the unrolled loop below is faster than the
      * following loop. 32-bit x86 does not have enough registers.
      */
-    if (patlen == 1) {
-        const jschar p0 = *pat;
-        for (const jschar *c = text, *end = text + textlen; c != end; ++c) {
+    if (patLen == 1) {
+        const PatChar p0 = *pat;
+        for (const TextChar *c = text, *end = text + textLen; c != end; ++c) {
             if (*c == p0)
                 return c - text;
         }
         return -1;
     }
 #endif
 
     /*
      * If the text or pattern string is short, BMH will be more expensive than
      * the basic linear scan due to initialization cost and a more complex loop
      * body. While the correct threshold is input-dependent, we can make a few
      * conservative observations:
-     *  - When |textlen| is "big enough", the initialization time will be
+     *  - When |textLen| is "big enough", the initialization time will be
      *    proportionally small, so the worst-case slowdown is minimized.
-     *  - When |patlen| is "too small", even the best case for BMH will be
-     *    slower than a simple scan for large |textlen| due to the more complex
+     *  - When |patLen| is "too small", even the best case for BMH will be
+     *    slower than a simple scan for large |textLen| due to the more complex
      *    loop body of BMH.
      * From this, the values for "big enough" and "too small" are determined
      * empirically. See bug 526348.
      */
-    if (textlen >= 512 && patlen >= 11 && patlen <= sBMHPatLenMax) {
-        int index = js_BoyerMooreHorspool(text, textlen, pat, patlen);
+    if (textLen >= 512 && patLen >= 11 && patLen <= sBMHPatLenMax) {
+        int index = BoyerMooreHorspool(text, textLen, pat, patLen);
         if (index != sBMHBadPattern)
             return index;
     }
 
     /*
      * For big patterns with large potential overlap we want the SIMD-optimized
-     * speed of memcmp. For small patterns, a simple loop is faster.
+     * speed of memcmp. For small patterns, a simple loop is faster. We also can't
+     * use memcmp if one of the strings is TwoByte and the other is Latin1.
      *
      * FIXME: Linux memcmp performance is sad and the manual loop is faster.
      */
     return
 #if !defined(__linux__)
-           patlen > 128 ? UnrolledMatch<MemCmp>(text, textlen, pat, patlen)
-                        :
+        (patLen > 128 && IsSame<TextChar, PatChar>::value)
+            ? UnrolledMatch<MemCmp<TextChar, PatChar>>(text, textLen, pat, patLen)
+            :
 #endif
-                          UnrolledMatch<ManualCmp>(text, textlen, pat, patlen);
+              UnrolledMatch<ManualCmp<TextChar, PatChar>>(text, textLen, pat, patLen);
 }
 
 static const size_t sRopeMatchThresholdRatioLog2 = 5;
 
 bool
-js::StringHasPattern(const jschar *text, uint32_t textlen,
-                     const jschar *pat, uint32_t patlen)
+js::StringHasPattern(const jschar *text, uint32_t textLen,
+                     const jschar *pat, uint32_t patLen)
 {
-    return StringMatch(text, textlen, pat, patlen) != -1;
+    return StringMatch(text, textLen, pat, patLen) != -1;
 }
 
 int
-js::StringFindPattern(const jschar *text, uint32_t textlen,
-                      const jschar *pat, uint32_t patlen)
+js::StringFindPattern(const jschar *text, uint32_t textLen,
+                      const jschar *pat, uint32_t patLen)
 {
-    return StringMatch(text, textlen, pat, patlen);
+    return StringMatch(text, textLen, pat, patLen);
 }
 
 // When an algorithm does not need a string represented as a single linear
 // array of characters, this range utility may be used to traverse the string a
 // sequence of linear arrays of characters. This avoids flattening ropes.
 class StringSegmentRange
 {
     // If malloc() shows up in any profiles from this vector, we can add a new
@@ -1231,25 +1242,25 @@ class StringSegmentRange
 };
 
 /*
  * RopeMatch takes the text to search and the pattern to search for in the text.
  * RopeMatch returns false on OOM and otherwise returns the match index through
  * the 'match' outparam (-1 for not found).
  */
 static bool
-RopeMatch(JSContext *cx, JSString *textstr, const jschar *pat, uint32_t patlen, int *match)
+RopeMatch(JSContext *cx, JSString *textstr, const jschar *pat, uint32_t patLen, int *match)
 {
     JS_ASSERT(textstr->isRope());
 
-    if (patlen == 0) {
+    if (patLen == 0) {
         *match = 0;
         return true;
     }
-    if (textstr->length() < patlen) {
+    if (textstr->length() < patLen) {
         *match = -1;
         return true;
     }
 
     /*
      * List of leaf nodes in the rope. If we run out of memory when trying to
      * append to this list, we can still fall back to StringMatch, so use the
      * system allocator so we don't report OOM in that case.
@@ -1268,45 +1279,45 @@ RopeMatch(JSContext *cx, JSString *texts
         StringSegmentRange r(cx);
         if (!r.init(textstr))
             return false;
         while (!r.empty()) {
             if (threshold-- == 0 || !strs.append(r.front())) {
                 const jschar *chars = textstr->getChars(cx);
                 if (!chars)
                     return false;
-                *match = StringMatch(chars, textstrlen, pat, patlen);
+                *match = StringMatch(chars, textstrlen, pat, patLen);
                 return true;
             }
             if (!r.popFront())
                 return false;
         }
     }
 
     /* Absolute offset from the beginning of the logical string textstr. */
     int pos = 0;
 
     for (JSLinearString **outerp = strs.begin(); outerp != strs.end(); ++outerp) {
         /* Try to find a match within 'outer'. */
         JSLinearString *outer = *outerp;
         const jschar *chars = outer->chars();
         size_t len = outer->length();
-        int matchResult = StringMatch(chars, len, pat, patlen);
+        int matchResult = StringMatch(chars, len, pat, patLen);
         if (matchResult != -1) {
             /* Matched! */
             *match = pos + matchResult;
             return true;
         }
 
         /* Try to find a match starting in 'outer' and running into other nodes. */
-        const jschar *const text = chars + (patlen > len ? 0 : len - patlen + 1);
+        const jschar *const text = chars + (patLen > len ? 0 : len - patLen + 1);
         const jschar *const textend = chars + len;
         const jschar p0 = *pat;
         const jschar *const p1 = pat + 1;
-        const jschar *const patend = pat + patlen;
+        const jschar *const patend = pat + patLen;
         for (const jschar *t = text; t != textend; ) {
             if (*t++ != p0)
                 continue;
             JSLinearString **innerp = outerp;
             const jschar *ttend = textend;
             for (const jschar *pp = p1, *tt = t; pp != patend; ++pp, ++tt) {
                 while (tt == ttend) {
                     if (++innerp == strs.end()) {
@@ -1330,16 +1341,42 @@ RopeMatch(JSContext *cx, JSString *texts
 
         pos += len;
     }
 
     *match = -1;
     return true;
 }
 
+static int32_t
+IndexOfImpl(JSLinearString *text, JSLinearString *pat, uint32_t start)
+{
+    MOZ_ASSERT(start <= text->length());
+    uint32_t textLen = text->length() - start;
+    uint32_t patLen = pat->length();
+
+    int match;
+    AutoCheckCannotGC nogc;
+    if (text->hasLatin1Chars()) {
+        const Latin1Char *textChars = text->latin1Chars(nogc) + start;
+        if (pat->hasLatin1Chars())
+            match = StringMatch(textChars, textLen, pat->latin1Chars(nogc), patLen);
+        else
+            match = StringMatch(textChars, textLen, pat->twoByteChars(nogc), patLen);
+    } else {
+        const jschar *textChars = text->twoByteChars(nogc) + start;
+        if (pat->hasLatin1Chars())
+            match = StringMatch(textChars, textLen, pat->latin1Chars(nogc), patLen);
+        else
+            match = StringMatch(textChars, textLen, pat->twoByteChars(nogc), patLen);
+    }
+
+    return (match == -1) ? -1 : start + match;
+}
+
 /* ES6 20121026 draft 15.5.4.24. */
 static bool
 str_contains(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
     // Steps 1, 2, and 3
     RootedString str(cx, ThisToStringForStringProto(cx, args));
@@ -1362,32 +1399,26 @@ str_contains(JSContext *cx, unsigned arg
             if (!ToInteger(cx, args[1], &d))
                 return false;
             pos = uint32_t(Min(Max(d, 0.0), double(UINT32_MAX)));
         }
     }
 
     // Step 8
     uint32_t textLen = str->length();
-    const jschar *textChars = str->getChars(cx);
-    if (!textChars)
-        return false;
 
     // Step 9
     uint32_t start = Min(Max(pos, 0U), textLen);
 
-    // Step 10
-    uint32_t searchLen = searchStr->length();
-    const jschar *searchChars = searchStr->chars();
-
-    // Step 11
-    textChars += start;
-    textLen -= start;
-    int match = StringMatch(textChars, textLen, searchChars, searchLen);
-    args.rval().setBoolean(match != -1);
+    // Steps 10 and 11
+    JSLinearString *text = str->ensureLinear(cx);
+    if (!text)
+        return false;
+
+    args.rval().setBoolean(IndexOfImpl(text, searchStr, start) != -1);
     return true;
 }
 
 /* ES6 20120927 draft 15.5.4.7. */
 static bool
 str_indexOf(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
@@ -1413,109 +1444,125 @@ str_indexOf(JSContext *cx, unsigned argc
             if (!ToInteger(cx, args[1], &d))
                 return false;
             pos = uint32_t(Min(Max(d, 0.0), double(UINT32_MAX)));
         }
     }
 
    // Step 8
     uint32_t textLen = str->length();
-    const jschar *textChars = str->getChars(cx);
-    if (!textChars)
-        return false;
 
     // Step 9
     uint32_t start = Min(Max(pos, 0U), textLen);
 
-    // Step 10
-    uint32_t searchLen = searchStr->length();
-    const jschar *searchChars = searchStr->chars();
-
-    // Step 11
-    textChars += start;
-    textLen -= start;
-    int match = StringMatch(textChars, textLen, searchChars, searchLen);
-    args.rval().setInt32((match == -1) ? -1 : start + match);
+    // Steps 10 and 11
+    JSLinearString *text = str->ensureLinear(cx);
+    if (!text)
+        return false;
+
+    args.rval().setInt32(IndexOfImpl(text, searchStr, start));
     return true;
 }
 
+template <typename TextChar, typename PatChar>
+static int32_t
+LastIndexOfImpl(const TextChar *text, size_t textLen, const PatChar *pat, size_t patLen,
+                size_t start)
+{
+    MOZ_ASSERT(patLen > 0);
+    MOZ_ASSERT(patLen <= textLen);
+    MOZ_ASSERT(start <= textLen - patLen);
+
+    const PatChar p0 = *pat;
+    const PatChar *patNext = pat + 1;
+    const PatChar *patEnd = pat + patLen;
+
+    for (const TextChar *t = text + start; t >= text; --t) {
+        if (*t == p0) {
+            const TextChar *t1 = t + 1;
+            for (const PatChar *p1 = patNext; p1 < patEnd; ++p1, ++t1) {
+                if (*t1 != *p1)
+                    goto break_continue;
+            }
+
+            return static_cast<int32_t>(t - text);
+        }
+      break_continue:;
+    }
+
+    return -1;
+}
+
 static bool
 str_lastIndexOf(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     RootedString textstr(cx, ThisToStringForStringProto(cx, args));
     if (!textstr)
         return false;
 
-    size_t textlen = textstr->length();
-
-    Rooted<JSLinearString*> patstr(cx, ArgToRootedString(cx, args, 0));
-    if (!patstr)
+    Rooted<JSLinearString*> pat(cx, ArgToRootedString(cx, args, 0));
+    if (!pat)
         return false;
 
-    size_t patlen = patstr->length();
-
-    int i = textlen - patlen; // Start searching here
-    if (i < 0) {
+    size_t textLen = textstr->length();
+    size_t patLen = pat->length();
+    int start = textLen - patLen; // Start searching here
+    if (start < 0) {
         args.rval().setInt32(-1);
         return true;
     }
 
-    if (args.length() > 1) {
+    if (args.hasDefined(1)) {
         if (args[1].isInt32()) {
-            int j = args[1].toInt32();
-            if (j <= 0)
-                i = 0;
-            else if (j < i)
-                i = j;
+            int i = args[1].toInt32();
+            if (i <= 0)
+                start = 0;
+            else if (i < start)
+                start = i;
         } else {
             double d;
             if (!ToNumber(cx, args[1], &d))
                 return false;
             if (!IsNaN(d)) {
                 d = ToInteger(d);
                 if (d <= 0)
-                    i = 0;
-                else if (d < i)
-                    i = (int)d;
+                    start = 0;
+                else if (d < start)
+                    start = int(d);
             }
         }
     }
 
-    if (patlen == 0) {
-        args.rval().setInt32(i);
+    if (patLen == 0) {
+        args.rval().setInt32(start);
         return true;
     }
 
-    const jschar *text = textstr->getChars(cx);
+    JSLinearString *text = textstr->ensureLinear(cx);
     if (!text)
         return false;
 
-    const jschar *pat = patstr->chars();
-
-    const jschar *t = text + i;
-    const jschar *textend = text - 1;
-    const jschar p0 = *pat;
-    const jschar *patNext = pat + 1;
-    const jschar *patEnd = pat + patlen;
-
-    for (; t != textend; --t) {
-        if (*t == p0) {
-            const jschar *t1 = t + 1;
-            for (const jschar *p1 = patNext; p1 != patEnd; ++p1, ++t1) {
-                if (*t1 != *p1)
-                    goto break_continue;
-            }
-            args.rval().setInt32(t - text);
-            return true;
-        }
-      break_continue:;
+    int32_t res;
+    AutoCheckCannotGC nogc;
+    if (text->hasLatin1Chars()) {
+        const Latin1Char *textChars = text->latin1Chars(nogc);
+        if (pat->hasLatin1Chars())
+            res = LastIndexOfImpl(textChars, textLen, pat->latin1Chars(nogc), patLen, start);
+        else
+            res = LastIndexOfImpl(textChars, textLen, pat->twoByteChars(nogc), patLen, start);
+    } else {
+        const jschar *textChars = text->twoByteChars(nogc);
+        if (pat->hasLatin1Chars())
+            res = LastIndexOfImpl(textChars, textLen, pat->latin1Chars(nogc), patLen, start);
+        else
+            res = LastIndexOfImpl(textChars, textLen, pat->twoByteChars(nogc), patLen, start);
     }
 
-    args.rval().setInt32(-1);
+    args.rval().setInt32(res);
     return true;
 }
 
 /* ES6 20131108 draft 21.1.3.18. */
 static bool
 str_startsWith(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
@@ -1696,25 +1743,25 @@ str_trimRight(JSContext *cx, unsigned ar
 
 namespace {
 
 /* Result of a successfully performed flat match. */
 class FlatMatch
 {
     RootedAtom patstr;
     const jschar *pat;
-    size_t       patlen;
+    size_t       patLen;
     int32_t      match_;
 
     friend class StringRegExpGuard;
 
   public:
     explicit FlatMatch(JSContext *cx) : patstr(cx) {}
     JSLinearString *pattern() const { return patstr; }
-    size_t patternLength() const { return patlen; }
+    size_t patternLength() const { return patLen; }
 
     /*
      * Note: The match is -1 when the match is performed successfully,
      * but no match is found.
      */
     int32_t match() const { return match_; }
 };
 
@@ -1850,37 +1897,37 @@ class MOZ_STACK_CLASS StringRegExpGuard
     const FlatMatch *
     tryFlatMatch(JSContext *cx, JSString *textstr, unsigned optarg, unsigned argc,
                  bool checkMetaChars = true)
     {
         if (re_.initialized())
             return nullptr;
 
         fm.pat = fm.patstr->chars();
-        fm.patlen = fm.patstr->length();
+        fm.patLen = fm.patstr->length();
 
         if (optarg < argc)
             return nullptr;
 
         if (checkMetaChars &&
-            (fm.patlen > MAX_FLAT_PAT_LEN || HasRegExpMetaChars(fm.pat, fm.patlen))) {
+            (fm.patLen > MAX_FLAT_PAT_LEN || HasRegExpMetaChars(fm.pat, fm.patLen))) {
             return nullptr;
         }
 
         /*
          * textstr could be a rope, so we want to avoid flattening it for as
          * long as possible.
          */
         if (textstr->isRope()) {
-            if (!RopeMatch(cx, textstr, fm.pat, fm.patlen, &fm.match_))
+            if (!RopeMatch(cx, textstr, fm.pat, fm.patLen, &fm.match_))
                 return nullptr;
         } else {
             const jschar *text = textstr->asLinear().chars();
-            size_t textlen = textstr->length();
-            fm.match_ = StringMatch(text, textlen, fm.pat, fm.patlen);
+            size_t textLen = textstr->length();
+            fm.match_ = StringMatch(text, textLen, fm.pat, fm.patLen);
         }
         return &fm;
     }
 
     /* If the pattern is not already a regular expression, make it so. */
     bool normalizeRegExp(JSContext *cx, bool flat, unsigned optarg, CallArgs args)
     {
         if (re_.initialized())
@@ -3939,28 +3986,28 @@ js_InitStringClass(JSContext *cx, Handle
         return nullptr;
 
     /* Now create the String function. */
     RootedFunction ctor(cx);
     ctor = global->createConstructor(cx, js_String, cx->names().String, 1);
     if (!ctor)
         return nullptr;
 
+    if (!GlobalObject::initBuiltinConstructor(cx, global, JSProto_String, ctor, proto))
+        return nullptr;
+
     if (!LinkConstructorAndPrototype(cx, ctor, proto))
         return nullptr;
 
     if (!DefinePropertiesAndBrand(cx, proto, nullptr, string_methods) ||
         !DefinePropertiesAndBrand(cx, ctor, nullptr, string_static_methods))
     {
         return nullptr;
     }
 
-    if (!GlobalObject::initBuiltinConstructor(cx, global, JSProto_String, ctor, proto))
-        return nullptr;
-
     /*
      * Define escape/unescape, the URI encode/decode functions, and maybe
      * uneval on the global object.
      */
     if (!JS_DefineFunctions(cx, global, string_functions))
         return nullptr;
 
     return proto;
--- a/js/src/jswrapper.cpp
+++ b/js/src/jswrapper.cpp
@@ -39,18 +39,16 @@ Wrapper::defaultValue(JSContext *cx, Han
 }
 
 JSObject *
 Wrapper::New(JSContext *cx, JSObject *obj, JSObject *parent, Wrapper *handler,
              const WrapperOptions *options)
 {
     JS_ASSERT(parent);
 
-    AutoMarkInDeadZone amd(cx->zone());
-
     RootedValue priv(cx, ObjectValue(*obj));
     mozilla::Maybe<WrapperOptions> opts;
     if (!options) {
         opts.construct();
         opts.ref().selectDefaultClass(obj->isCallable());
         options = opts.addr();
     }
     return NewProxyObject(cx, handler, priv, options->proto(), parent, *options);
@@ -1032,18 +1030,16 @@ js::RemapAllWrappersForObject(JSContext 
 
     return true;
 }
 
 JS_FRIEND_API(bool)
 js::RecomputeWrappers(JSContext *cx, const CompartmentFilter &sourceFilter,
                       const CompartmentFilter &targetFilter)
 {
-    AutoMaybeTouchDeadZones agc(cx);
-
     AutoWrapperVector toRecompute(cx);
 
     for (CompartmentsIter c(cx->runtime(), SkipAtoms); !c.done(); c.next()) {
         // Filter by source compartment.
         if (!sourceFilter.match(c))
             continue;
 
         // Iterate over the wrappers, filtering appropriately.
--- a/js/src/jswrapper.h
+++ b/js/src/jswrapper.h
@@ -299,39 +299,11 @@ RemapAllWrappersForObject(JSContext *cx,
                           JSObject *newTarget);
 
 // API to recompute all cross-compartment wrappers whose source and target
 // match the given filters.
 JS_FRIEND_API(bool)
 RecomputeWrappers(JSContext *cx, const CompartmentFilter &sourceFilter,
                   const CompartmentFilter &targetFilter);
 
-/*
- * This auto class should be used around any code, such as brain transplants,
- * that may touch dead zones. Brain transplants can cause problems
- * because they operate on all compartments, whether live or dead. A brain
- * transplant can cause a formerly dead object to be "reanimated" by causing a
- * read or write barrier to be invoked on it during the transplant. In this way,
- * a zone becomes a zombie, kept alive by repeatedly consuming
- * (transplanted) brains.
- *
- * To work around this issue, we observe when mark bits are set on objects in
- * dead zones. If this happens during a brain transplant, we do a full,
- * non-incremental GC at the end of the brain transplant. This will clean up any
- * objects that were improperly marked.
- */
-struct JS_FRIEND_API(AutoMaybeTouchDeadZones)
-{
-    // The version that takes an object just uses it for its runtime.
-    explicit AutoMaybeTouchDeadZones(JSContext *cx);
-    explicit AutoMaybeTouchDeadZones(JSObject *obj);
-    ~AutoMaybeTouchDeadZones();
-
-  private:
-    JSRuntime *runtime;
-    unsigned markCount;
-    bool inIncremental;
-    bool manipulatingDeadZones;
-};
-
 } /* namespace js */
 
 #endif /* jswrapper_h */
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -2031,17 +2031,17 @@ Debugger::addAllGlobalsAsDebuggees(JSCon
     for (ZonesIter zone(cx->runtime(), SkipAtoms); !zone.done(); zone.next()) {
         // Invalidate a zone at a time to avoid doing a ZoneCellIter
         // per compartment.
         AutoDebugModeInvalidation invalidate(zone);
 
         for (CompartmentsInZoneIter c(zone); !c.done(); c.next()) {
             if (c == dbg->object->compartment() || c->options().invisibleToDebugger())
                 continue;
-            c->zone()->scheduledForDestruction = false;
+            c->scheduledForDestruction = false;
             GlobalObject *global = c->maybeGlobal();
             if (global) {
                 Rooted<GlobalObject*> rg(cx, global);
                 if (!dbg->addDebuggeeGlobal(cx, rg, invalidate))
                     return false;
             }
         }
     }
@@ -2828,17 +2828,17 @@ Debugger::findAllGlobals(JSContext *cx, 
     RootedObject result(cx, NewDenseEmptyArray(cx));
     if (!result)
         return false;
 
     for (CompartmentsIter c(cx->runtime(), SkipAtoms); !c.done(); c.next()) {
         if (c->options().invisibleToDebugger())
             continue;
 
-        c->zone()->scheduledForDestruction = false;
+        c->scheduledForDestruction = false;
 
         GlobalObject *global = c->maybeGlobal();
 
         if (cx->runtime()->isSelfHostingGlobal(global))
             continue;
 
         if (global) {
             /*
--- a/js/src/vm/GlobalObject.h
+++ b/js/src/vm/GlobalObject.h
@@ -14,19 +14,16 @@
 #include "jsnum.h"
 
 #include "builtin/RegExp.h"
 #include "js/Vector.h"
 #include "vm/ArrayBufferObject.h"
 #include "vm/ErrorObject.h"
 
 extern JSObject *
-js_InitTypedArrayClasses(JSContext *cx, js::HandleObject obj);
-
-extern JSObject *
 js_InitSharedArrayBufferClass(JSContext *cx, js::HandleObject obj);
 
 namespace js {
 
 class Debugger;
 class TypedObjectModuleObject;
 
 /*
@@ -240,25 +237,20 @@ class GlobalObject : public JSObject
         return classIsInitialized(JSProto_SharedArrayBuffer);
     }
     bool errorClassesInitialized() const {
         return classIsInitialized(JSProto_Error);
     }
     bool dataViewClassInitialized() const {
         return classIsInitialized(JSProto_DataView);
     }
-    bool typedArrayClassesInitialized() const {
-        // This alias exists only for clarity: in reality all the typed array
-        // classes constitute a (semi-)coherent whole.
-        return classIsInitialized(JSProto_DataView);
-    }
 
     Value createArrayFromBufferHelper(uint32_t slot) const {
-        JS_ASSERT(typedArrayClassesInitialized());
         JS_ASSERT(FROM_BUFFER_UINT8 <= slot && slot <= FROM_BUFFER_UINT8CLAMPED);
+        JS_ASSERT(!getSlot(slot).isUndefined());
         return getSlot(slot);
     }
 
     void setCreateArrayFromBufferHelper(uint32_t slot, Handle<JSFunction*> fun) {
         JS_ASSERT(getSlotRef(slot).isUndefined());
         setSlot(slot, ObjectValue(*fun));
     }
 
--- a/js/src/vm/OldDebugAPI.cpp
+++ b/js/src/vm/OldDebugAPI.cpp
@@ -838,16 +838,44 @@ JS_DumpCompartmentPCCounts(JSContext *cx
     for (ZoneCellIter i(cx->zone(), gc::FINALIZE_SCRIPT); !i.done(); i.next()) {
         RootedScript script(cx, i.get<JSScript>());
         if (script->compartment() != cx->compartment())
             continue;
 
         if (script->hasScriptCounts())
             JS_DumpPCCounts(cx, script);
     }
+
+#if defined(JS_ION)
+    for (unsigned thingKind = FINALIZE_OBJECT0; thingKind < FINALIZE_OBJECT_LIMIT; thingKind++) {
+        for (ZoneCellIter i(cx->zone(), (AllocKind) thingKind); !i.done(); i.next()) {
+            JSObject *obj = i.get<JSObject>();
+            if (obj->compartment() != cx->compartment())
+                continue;
+
+            if (obj->is<AsmJSModuleObject>()) {
+                AsmJSModule &module = obj->as<AsmJSModuleObject>().module();
+
+                Sprinter sprinter(cx);
+                if (!sprinter.init())
+                    return;
+
+                fprintf(stdout, "--- Asm.js Module ---\n");
+
+                for (size_t i = 0; i < module.numFunctionCounts(); i++) {
+                    jit::IonScriptCounts *counts = module.functionCounts(i);
+                    DumpIonScriptCounts(&sprinter, counts);
+                }
+
+                fputs(sprinter.string(), stdout);
+                fprintf(stdout, "--- END Asm.js Module ---\n");
+            }
+        }
+    }
+#endif
 }
 
 JS_FRIEND_API(bool)
 js::CanCallContextDebugHandler(JSContext *cx)
 {
     return !!cx->runtime()->debugHooks.debuggerHandler;
 }
 
--- a/js/src/vm/ProxyObject.cpp
+++ b/js/src/vm/ProxyObject.cpp
@@ -72,24 +72,17 @@ void
 ProxyObject::initHandler(BaseProxyHandler *handler)
 {
     initSlot(HANDLER_SLOT, PrivateValue(handler));
 }
 
 static void
 NukeSlot(ProxyObject *proxy, uint32_t slot)
 {
-    Value old = proxy->getSlot(slot);
-    if (old.isMarkable()) {
-        Zone *zone = ZoneOfValue(old);
-        AutoMarkInDeadZone amd(zone);
-        proxy->setReservedSlot(slot, NullValue());
-    } else {
-        proxy->setReservedSlot(slot, NullValue());
-    }
+    proxy->setReservedSlot(slot, NullValue());
 }
 
 void
 ProxyObject::nuke(BaseProxyHandler *handler)
 {
     /* Allow people to add their own number of reserved slots beyond the expected 4 */
     unsigned numSlots = JSCLASS_RESERVED_SLOTS(getClass());
     for (unsigned i = 0; i < numSlots; i++)
--- a/js/src/vm/TypedArrayObject.cpp
+++ b/js/src/vm/TypedArrayObject.cpp
@@ -201,16 +201,23 @@ class TypedArrayObjectTemplate : public 
 
     static const size_t BYTES_PER_ELEMENT = sizeof(ThisType);
 
     static inline const Class *protoClass()
     {
         return &TypedArrayObject::protoClasses[ArrayTypeID()];
     }
 
+    static JSObject *CreatePrototype(JSContext *cx, JSProtoKey key)
+    {
+        return cx->global()->createBlankPrototype(cx, protoClass());
+    }
+
+    static bool FinishClassInit(JSContext *cx, HandleObject ctor, HandleObject proto);
+
     static inline const Class *instanceClass()
     {
         return &TypedArrayObject::classes[ArrayTypeID()];
     }
 
     static bool is(HandleValue v) {
         return v.isObject() && v.toObject().hasClass(instanceClass());
     }
@@ -478,34 +485,16 @@ class TypedArrayObjectTemplate : public 
         if (!getter)
             return false;
 
         return DefineNativeProperty(cx, proto, id, UndefinedHandleValue,
                                     JS_DATA_TO_FUNC_PTR(PropertyOp, getter), nullptr,
                                     attrs);
     }
 
-    static
-    bool defineGetters(JSContext *cx, HandleObject proto)
-    {
-        if (!DefineGetter(cx, proto, cx->names().length, Getter<lengthValue>))
-            return false;
-
-        if (!DefineGetter(cx, proto, cx->names().buffer, BufferGetter))
-            return false;
-
-        if (!DefineGetter(cx, proto, cx->names().byteLength, Getter<byteLengthValue>))
-            return false;
-
-        if (!DefineGetter(cx, proto, cx->names().byteOffset, Getter<byteOffsetValue>))
-            return false;
-
-        return true;
-    }
-
     /* subarray(start[, end]) */
     static bool
     fun_subarray_impl(JSContext *cx, CallArgs args)
     {
         JS_ASSERT(IsThisClass(args.thisv()));
         Rooted<TypedArrayObject*> tarray(cx, &args.thisv().toObject().as<TypedArrayObject>());
 
         // these are the default values
@@ -1144,64 +1133,73 @@ class TypedArrayObjectTemplate : public 
     }
 };
 
 class Int8ArrayObject : public TypedArrayObjectTemplate<int8_t> {
   public:
     enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_INT8 };
     static const JSProtoKey key = JSProto_Int8Array;
     static const JSFunctionSpec jsfuncs[];
+    static const JSPropertySpec jsprops[];
 };
 class Uint8ArrayObject : public TypedArrayObjectTemplate<uint8_t> {
   public:
     enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_UINT8 };
     static const JSProtoKey key = JSProto_Uint8Array;
     static const JSFunctionSpec jsfuncs[];
+    static const JSPropertySpec jsprops[];
 };
 class Int16ArrayObject : public TypedArrayObjectTemplate<int16_t> {
   public:
     enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_INT16 };
     static const JSProtoKey key = JSProto_Int16Array;
     static const JSFunctionSpec jsfuncs[];
+    static const JSPropertySpec jsprops[];
 };
 class Uint16ArrayObject : public TypedArrayObjectTemplate<uint16_t> {
   public:
     enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_UINT16 };
     static const JSProtoKey key = JSProto_Uint16Array;
     static const JSFunctionSpec jsfuncs[];
+    static const JSPropertySpec jsprops[];
 };
 class Int32ArrayObject : public TypedArrayObjectTemplate<int32_t> {
   public:
     enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_INT32 };
     static const JSProtoKey key = JSProto_Int32Array;
     static const JSFunctionSpec jsfuncs[];
+    static const JSPropertySpec jsprops[];
 };
 class Uint32ArrayObject : public TypedArrayObjectTemplate<uint32_t> {
   public:
     enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_UINT32 };
     static const JSProtoKey key = JSProto_Uint32Array;
     static const JSFunctionSpec jsfuncs[];
+    static const JSPropertySpec jsprops[];
 };
 class Float32ArrayObject : public TypedArrayObjectTemplate<float> {
   public:
     enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_FLOAT32 };
     static const JSProtoKey key = JSProto_Float32Array;
     static const JSFunctionSpec jsfuncs[];
+    static const JSPropertySpec jsprops[];
 };
 class Float64ArrayObject : public TypedArrayObjectTemplate<double> {
   public:
     enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_FLOAT64 };
     static const JSProtoKey key = JSProto_Float64Array;
     static const JSFunctionSpec jsfuncs[];
+    static const JSPropertySpec jsprops[];
 };
 class Uint8ClampedArrayObject : public TypedArrayObjectTemplate<uint8_clamped> {
   public:
     enum { ACTUAL_TYPE = ScalarTypeDescr::TYPE_UINT8_CLAMPED };
     static const JSProtoKey key = JSProto_Uint8ClampedArray;
     static const JSFunctionSpec jsfuncs[];
+    static const JSPropertySpec jsprops[];
 };
 
 } /* anonymous namespace */
 
 template<typename T>
 bool
 ArrayBufferObject::createTypedArrayFromBufferImpl(JSContext *cx, CallArgs args)
 {
@@ -2037,33 +2035,56 @@ TypedArrayObject::setElement(TypedArrayO
  *** JS impl
  ***/
 
 /*
  * TypedArrayObject boilerplate
  */
 
 #ifndef RELEASE_BUILD
-# define IMPL_TYPED_ARRAY_STATICS(_typedArray)                                     \
+# define EXPERIMENTAL_FUNCTIONS(_t) JS_FN("move", _t##Object::fun_move, 3, JSFUN_GENERIC_NATIVE),
+#else
+# define EXPERIMENTAL_FUNCTIONS(_t)
+#endif
+
+#define IMPL_TYPED_ARRAY_STATICS(_typedArray)                                      \
 const JSFunctionSpec _typedArray##Object::jsfuncs[] = {                            \
     JS_SELF_HOSTED_FN("@@iterator", "ArrayValues", 0, 0),                          \
     JS_FN("subarray", _typedArray##Object::fun_subarray, 2, JSFUN_GENERIC_NATIVE), \
     JS_FN("set", _typedArray##Object::fun_set, 2, JSFUN_GENERIC_NATIVE),           \
-    JS_FN("move", _typedArray##Object::fun_move, 3, JSFUN_GENERIC_NATIVE),         \
+    EXPERIMENTAL_FUNCTIONS(_typedArray)                                            \
     JS_FS_END                                                                      \
-}
-#else
-# define IMPL_TYPED_ARRAY_STATICS(_typedArray)                                     \
-const JSFunctionSpec _typedArray##Object::jsfuncs[] = {                            \
-    JS_SELF_HOSTED_FN("@@iterator", "ArrayValues", 0, 0),                          \
-    JS_FN("subarray", _typedArray##Object::fun_subarray, 2, JSFUN_GENERIC_NATIVE), \
-    JS_FN("set", _typedArray##Object::fun_set, 2, JSFUN_GENERIC_NATIVE),           \
-    JS_FS_END                                                                      \
-}
-#endif
+};                                                                                 \
+/* These next 3 functions are brought to you by the buggy GCC we use to build      \
+   B2G ICS. Older GCC versions have a bug in which they fail to compile            \
+   reinterpret_casts of templated functions with the message: "insufficient        \
+   contextual information to determine type". JS_PSG needs to                      \
+   reinterpret_cast<JSPropertyOp>, so this causes problems for us here.            \
+                                                                                   \
+   We could restructure all this code to make this nicer, but since ICS isn't      \
+   going to be around forever (and since this bug is fixed with the newer GCC      \
+   versions we use on JB and KK), the workaround here is designed for ease of      \
+   removal. When you stop seeing ICS Emulator builds on TBPL, remove these 3       \
+   JSNatives and insert the templated callee directly into the JS_PSG below. */    \
+bool _typedArray##_lengthGetter(JSContext *cx, unsigned argc, Value *vp) {         \
+    return _typedArray##Object::Getter<_typedArray##Object::lengthValue>(cx, argc, vp); \
+}                                                                                  \
+bool _typedArray##_byteLengthGetter(JSContext *cx, unsigned argc, Value *vp) {     \
+    return _typedArray##Object::Getter<_typedArray##Object::byteLengthValue>(cx, argc, vp); \
+}                                                                                  \
+bool _typedArray##_byteOffsetGetter(JSContext *cx, unsigned argc, Value *vp) {     \
+    return _typedArray##Object::Getter<_typedArray##Object::byteOffsetValue>(cx, argc, vp); \
+}                                                                                  \
+const JSPropertySpec _typedArray##Object::jsprops[] = {                            \
+    JS_PSG("length", _typedArray##_lengthGetter, JSPROP_PERMANENT),                \
+    JS_PSG("buffer", _typedArray##Object::BufferGetter, JSPROP_PERMANENT),         \
+    JS_PSG("byteLength", _typedArray##_byteLengthGetter, JSPROP_PERMANENT),        \
+    JS_PSG("byteOffset", _typedArray##_byteOffsetGetter, JSPROP_PERMANENT),        \
+    JS_PS_END                                                                      \
+};
 
 #define IMPL_TYPED_ARRAY_JSAPI_CONSTRUCTORS(Name,NativeType)                                    \
   JS_FRIEND_API(JSObject *) JS_New ## Name ## Array(JSContext *cx, uint32_t nelements)          \
   {                                                                                             \
       return TypedArrayObjectTemplate<NativeType>::fromLength(cx, nelements);                   \
   }                                                                                             \
   JS_FRIEND_API(JSObject *) JS_New ## Name ## ArrayFromArray(JSContext *cx, HandleObject other) \
   {                                                                                             \
@@ -2157,89 +2178,74 @@ IMPL_TYPED_ARRAY_COMBINED_UNWRAPPERS(Flo
     JSCLASS_HAS_CACHED_PROTO(JSProto_##_typedArray),                           \
     JS_PropertyStub,         /* addProperty */                                 \
     JS_DeletePropertyStub,   /* delProperty */                                 \
     JS_PropertyStub,         /* getProperty */                                 \
     JS_StrictPropertyStub,   /* setProperty */                                 \
     JS_EnumerateStub,                                                          \
     JS_ResolveStub,                                                            \
     JS_ConvertStub,                                                            \
-    nullptr,                 /* finalize */                                    \
+    nullptr,                 /* finalize    */                                 \
     nullptr,                 /* call        */                                 \
     nullptr,                 /* hasInstance */                                 \
     nullptr,                 /* construct   */                                 \
     ArrayBufferViewObject::trace, /* trace  */                                 \
+    {                                                                          \
+        GenericCreateConstructor<_typedArray##Object::class_constructor,       \
+                                 NAME_OFFSET(_typedArray), 3>,                 \
+        _typedArray##Object::CreatePrototype,                                  \
+        nullptr,                                                               \
+        _typedArray##Object::jsfuncs,                                          \
+        _typedArray##Object::jsprops,                                          \
+        _typedArray##Object::FinishClassInit                                   \
+    }                                                                          \
 }
 
-template<class ArrayType>
-static inline bool
-InitTypedArrayClass(JSContext *cx)
+template<typename NativeType>
+bool
+TypedArrayObjectTemplate<NativeType>::FinishClassInit(JSContext *cx,
+                                                      HandleObject ctor,
+                                                      HandleObject proto)
 {
-    Rooted<GlobalObject*> global(cx, cx->compartment()->maybeGlobal());
-    if (global->isStandardClassResolved(ArrayType::key))
-        return true;
-
-    RootedObject proto(cx, global->createBlankPrototype(cx, ArrayType::protoClass()));
-    if (!proto)
-        return false;
-
-    RootedFunction ctor(cx);
-    ctor = global->createConstructor(cx, ArrayType::class_constructor,
-                                     ClassName(ArrayType::key, cx), 3);
-    if (!ctor)
-        return false;
-
-    if (!LinkConstructorAndPrototype(cx, ctor, proto))
-        return false;
-
-    RootedValue bytesValue(cx, Int32Value(ArrayType::BYTES_PER_ELEMENT));
+    RootedValue bytesValue(cx, Int32Value(BYTES_PER_ELEMENT));
 
     if (!JSObject::defineProperty(cx, ctor,
                                   cx->names().BYTES_PER_ELEMENT, bytesValue,
                                   JS_PropertyStub, JS_StrictPropertyStub,
                                   JSPROP_PERMANENT | JSPROP_READONLY) ||
         !JSObject::defineProperty(cx, proto,
                                   cx->names().BYTES_PER_ELEMENT, bytesValue,
                                   JS_PropertyStub, JS_StrictPropertyStub,
                                   JSPROP_PERMANENT | JSPROP_READONLY))
     {
         return false;
     }
 
-    if (!ArrayType::defineGetters(cx, proto))
-        return false;
-
-    if (!JS_DefineFunctions(cx, proto, ArrayType::jsfuncs))
-        return false;
-
     RootedFunction fun(cx);
     fun =
         NewFunction(cx, NullPtr(),
-                    ArrayBufferObject::createTypedArrayFromBuffer<typename ArrayType::ThisType>,
-                    0, JSFunction::NATIVE_FUN, global, NullPtr());
+                    ArrayBufferObject::createTypedArrayFromBuffer<ThisType>,
+                    0, JSFunction::NATIVE_FUN, cx->global(), NullPtr());
     if (!fun)
         return false;
 
-    if (!GlobalObject::initBuiltinConstructor(cx, global, ArrayType::key, ctor, proto))
-        return false;
-
-    global->setCreateArrayFromBuffer<typename ArrayType::ThisType>(fun);
+    cx->global()->setCreateArrayFromBuffer<ThisType>(fun);
 
     return true;
-}
-
-IMPL_TYPED_ARRAY_STATICS(Int8Array);
-IMPL_TYPED_ARRAY_STATICS(Uint8Array);
-IMPL_TYPED_ARRAY_STATICS(Int16Array);
-IMPL_TYPED_ARRAY_STATICS(Uint16Array);
-IMPL_TYPED_ARRAY_STATICS(Int32Array);
-IMPL_TYPED_ARRAY_STATICS(Uint32Array);
-IMPL_TYPED_ARRAY_STATICS(Float32Array);
-IMPL_TYPED_ARRAY_STATICS(Float64Array);
-IMPL_TYPED_ARRAY_STATICS(Uint8ClampedArray);
+};
+
+IMPL_TYPED_ARRAY_STATICS(Int8Array)
+IMPL_TYPED_ARRAY_STATICS(Uint8Array)
+IMPL_TYPED_ARRAY_STATICS(Int16Array)
+IMPL_TYPED_ARRAY_STATICS(Uint16Array)
+IMPL_TYPED_ARRAY_STATICS(Int32Array)
+IMPL_TYPED_ARRAY_STATICS(Uint32Array)
+IMPL_TYPED_ARRAY_STATICS(Float32Array)
+IMPL_TYPED_ARRAY_STATICS(Float64Array)
+IMPL_TYPED_ARRAY_STATICS(Uint8ClampedArray)
 
 const Class TypedArrayObject::classes[ScalarTypeDescr::TYPE_MAX] = {
     IMPL_TYPED_ARRAY_FAST_CLASS(Int8Array),
     IMPL_TYPED_ARRAY_FAST_CLASS(Uint8Array),
     IMPL_TYPED_ARRAY_FAST_CLASS(Int16Array),
     IMPL_TYPED_ARRAY_FAST_CLASS(Uint16Array),
     IMPL_TYPED_ARRAY_FAST_CLASS(Int32Array),
     IMPL_TYPED_ARRAY_FAST_CLASS(Uint32Array),
@@ -2272,32 +2278,38 @@ js::IsTypedArrayThisCheck(JS::IsAcceptab
     CHECK(test, Uint32ArrayObject);
     CHECK(test, Float32ArrayObject);
     CHECK(test, Float64ArrayObject);
     CHECK(test, Uint8ClampedArrayObject);
     return false;
 }
 #undef CHECK
 
-static JSObject *
-InitArrayBufferClass(JSContext *cx)
+JSObject *
+js_InitArrayBufferClass(JSContext *cx, HandleObject obj)
 {
     Rooted<GlobalObject*> global(cx, cx->compartment()->maybeGlobal());
     if (global->isStandardClassResolved(JSProto_ArrayBuffer))
         return &global->getPrototype(JSProto_ArrayBuffer).toObject();
 
     RootedObject arrayBufferProto(cx, global->createBlankPrototype(cx, &ArrayBufferObject::protoClass));
     if (!arrayBufferProto)
         return nullptr;
 
     RootedFunction ctor(cx, global->createConstructor(cx, ArrayBufferObject::class_constructor,
                                                       cx->names().ArrayBuffer, 1));
     if (!ctor)
         return nullptr;
 
+    if (!GlobalObject::initBuiltinConstructor(cx, global, JSProto_ArrayBuffer,
+                                              ctor, arrayBufferProto))
+    {
+        return nullptr;
+    }
+
     if (!LinkConstructorAndPrototype(cx, ctor, arrayBufferProto))
         return nullptr;
 
     RootedId byteLengthId(cx, NameToId(cx->names().byteLength));
     unsigned attrs = JSPROP_SHARED | JSPROP_GETTER | JSPROP_PERMANENT;
     JSObject *getter = NewFunction(cx, NullPtr(), ArrayBufferObject::byteLengthGetter, 0,
                                    JSFunction::NATIVE_FUN, global, NullPtr());
     if (!getter)
@@ -2308,22 +2320,16 @@ InitArrayBufferClass(JSContext *cx)
         return nullptr;
 
     if (!JS_DefineFunctions(cx, ctor, ArrayBufferObject::jsstaticfuncs))
         return nullptr;
 
     if (!JS_DefineFunctions(cx, arrayBufferProto, ArrayBufferObject::jsfuncs))
         return nullptr;
 
-    if (!GlobalObject::initBuiltinConstructor(cx, global, JSProto_ArrayBuffer,
-                                              ctor, arrayBufferProto))
-    {
-        return nullptr;
-    }
-
     return arrayBufferProto;
 }
 
 const Class DataViewObject::protoClass = {
     "DataViewPrototype",
     JSCLASS_HAS_PRIVATE |
     JSCLASS_HAS_RESERVED_SLOTS(DataViewObject::RESERVED_SLOTS) |
     JSCLASS_HAS_CACHED_PROTO(JSProto_DataView),
@@ -2462,33 +2468,21 @@ void
 DataViewObject::neuter(void *newData)
 {
     setSlot(BYTELENGTH_SLOT, Int32Value(0));
     setSlot(BYTEOFFSET_SLOT, Int32Value(0));
     setPrivate(newData);
 }
 
 JSObject *
-js_InitTypedArrayClasses(JSContext *cx, HandleObject obj)
+js_InitDataViewClass(JSContext *cx, HandleObject obj)
 {
-    if (!InitTypedArrayClass<Int8ArrayObject>(cx) ||
-        !InitTypedArrayClass<Uint8ArrayObject>(cx) ||
-        !InitTypedArrayClass<Int16ArrayObject>(cx) ||
-        !InitTypedArrayClass<Uint16ArrayObject>(cx) ||
-        !InitTypedArrayClass<Int32ArrayObject>(cx) ||
-        !InitTypedArrayClass<Uint32ArrayObject>(cx) ||
-        !InitTypedArrayClass<Float32ArrayObject>(cx) ||
-        !InitTypedArrayClass<Float64ArrayObject>(cx) ||
-        !InitTypedArrayClass<Uint8ClampedArrayObject>(cx) ||
-        !DataViewObject::initClass(cx))
-    {
+    if (!DataViewObject::initClass(cx))
         return nullptr;
-    }
-
-    return InitArrayBufferClass(cx);
+    return &cx->global()->getPrototype(JSProto_DataView).toObject();
 }
 
 bool
 js::IsTypedArrayConstructor(HandleValue v, uint32_t type)
 {
     switch (type) {
       case ScalarTypeDescr::TYPE_INT8:
         return IsNativeFunction(v, Int8ArrayObject::class_constructor);
--- a/js/xpconnect/public/nsTArrayHelpers.h
+++ b/js/xpconnect/public/nsTArrayHelpers.h
@@ -9,17 +9,17 @@
 
 #include "jsapi.h"
 #include "nsContentUtils.h"
 #include "nsTArray.h"
 
 template <class T>
 inline nsresult
 nsTArrayToJSArray(JSContext* aCx, const nsTArray<T>& aSourceArray,
-                  JSObject** aResultArray)
+                  JS::MutableHandle<JSObject*> aResultArray)
 {
   MOZ_ASSERT(aCx);
 
   JS::Rooted<JSObject*> arrayObj(aCx,
     JS_NewArrayObject(aCx, aSourceArray.Length()));
   if (!arrayObj) {
     NS_WARNING("JS_NewArrayObject failed!");
     return NS_ERROR_OUT_OF_MEMORY;
@@ -40,25 +40,25 @@ nsTArrayToJSArray(JSContext* aCx, const 
     }
   }
 
   if (!JS_FreezeObject(aCx, arrayObj)) {
     NS_WARNING("JS_FreezeObject failed!");
     return NS_ERROR_FAILURE;
   }
 
-  *aResultArray = arrayObj;
+  aResultArray.set(arrayObj);
   return NS_OK;
 }
 
 template <>
 inline nsresult
 nsTArrayToJSArray<nsString>(JSContext* aCx,
                             const nsTArray<nsString>& aSourceArray,
-                            JSObject** aResultArray)
+                            JS::MutableHandle<JSObject*> aResultArray)
 {
   MOZ_ASSERT(aCx);
 
   JS::Rooted<JSObject*> arrayObj(aCx,
     JS_NewArrayObject(aCx, aSourceArray.Length()));
   if (!arrayObj) {
     NS_WARNING("JS_NewArrayObject failed!");
     return NS_ERROR_OUT_OF_MEMORY;
@@ -80,13 +80,13 @@ nsTArrayToJSArray<nsString>(JSContext* a
     }
   }
 
   if (!JS_FreezeObject(aCx, arrayObj)) {
     NS_WARNING("JS_FreezeObject failed!");
     return NS_ERROR_FAILURE;
   }
 
-  *aResultArray = arrayObj;
+  aResultArray.set(arrayObj);
   return NS_OK;
 }
 
 #endif /* __NSTARRAYHELPERS_H__ */
--- a/js/xpconnect/src/XPCWrappedNative.cpp
+++ b/js/xpconnect/src/XPCWrappedNative.cpp
@@ -351,19 +351,16 @@ XPCWrappedNative::GetNewOrUsed(xpcObject
 
     RootedObject parent(cx, Scope->GetGlobalJSObject());
 
     RootedValue newParentVal(cx, NullValue());
 
     mozilla::Maybe<JSAutoCompartment> ac;
 
     if (sciWrapper.GetFlags().WantPreCreate()) {
-        // PreCreate may touch dead compartments.
-        js::AutoMaybeTouchDeadZones agc(parent);
-
         RootedObject plannedParent(cx, parent);
         nsresult rv = sciWrapper.GetCallback()->PreCreate(identity, cx,
                                                           parent, parent.address());
         if (NS_FAILED(rv))
             return rv;
         rv = NS_OK;
 
         MOZ_ASSERT(!xpc::WrapperFactory::IsXrayWrapper(parent),
@@ -1280,19 +1277,16 @@ RescueOrphans(HandleObject obj)
     // NB: We pass stopAtOuter=false during the unwrap because Location objects
     // are parented to outer window proxies.
     nsresult rv;
     RootedObject parentObj(cx, js::GetObjectParent(obj));
     if (!parentObj)
         return NS_OK; // Global object. We're done.
     parentObj = js::UncheckedUnwrap(parentObj, /* stopAtOuter = */ false);
 
-    // PreCreate may touch dead compartments.
-    js::AutoMaybeTouchDeadZones agc(parentObj);
-
     // Recursively fix up orphans on the parent chain.
     rv = RescueOrphans(parentObj);
     NS_ENSURE_SUCCESS(rv, rv);
 
     // Now that we know our parent is in the right place, determine if we've
     // been orphaned. If not, we have nothing to do.
     if (!js::IsCrossCompartmentWrapper(parentObj))
         return NS_OK;
--- a/layout/base/RestyleManager.h
+++ b/layout/base/RestyleManager.h
@@ -89,35 +89,35 @@ public:
   /**
    * Reparent the style contexts of this frame subtree.  The parent frame of
    * aFrame must be changed to the new parent before this function is called;
    * the new parent style context will be automatically computed based on the
    * new position in the frame tree.
    *
    * @param aFrame the root of the subtree to reparent.  Must not be null.
    */
-  NS_HIDDEN_(nsresult) ReparentStyleContext(nsIFrame* aFrame);
+  nsresult ReparentStyleContext(nsIFrame* aFrame);
 
   /**
    * Re-resolve the style contexts for a frame tree, building
    * aChangeList based on the resulting style changes, plus aMinChange
    * applied to aFrame.
    */
-  NS_HIDDEN_(void)
+  void
     ComputeStyleChangeFor(nsIFrame* aFrame,
                           nsStyleChangeList* aChangeList,
                           nsChangeHint aMinChange,
                           RestyleTracker& aRestyleTracker,
                           bool aRestyleDescendants);
 
 #ifdef DEBUG
   /**
    * DEBUG ONLY method to verify integrity of style tree versus frame tree
    */
-  NS_HIDDEN_(void) DebugVerifyStyleTree(nsIFrame* aFrame);
+  void DebugVerifyStyleTree(nsIFrame* aFrame);
 #endif
 
   // Note: It's the caller's responsibility to make sure to wrap a
   // ProcessRestyledFrames call in a view update batch and a script blocker.
   // This function does not call ProcessAttachedQueue() on the binding manager.
   // If the caller wants that to happen synchronously, it needs to handle that
   // itself.
   nsresult ProcessRestyledFrames(nsStyleChangeList& aRestyleArray);
--- a/layout/base/nsFrameManager.cpp
+++ b/layout/base/nsFrameManager.cpp
@@ -79,40 +79,40 @@ static const PLDHashTableOps Placeholder
 
 //----------------------------------------------------------------------
 
 // XXXldb This seems too complicated for what I think it's doing, and it
 // should also be using pldhash rather than plhash to use less memory.
 
 class nsFrameManagerBase::UndisplayedMap {
 public:
-  UndisplayedMap(uint32_t aNumBuckets = 16) NS_HIDDEN;
-  ~UndisplayedMap(void) NS_HIDDEN;
+  UndisplayedMap(uint32_t aNumBuckets = 16);
+  ~UndisplayedMap(void);
 
-  NS_HIDDEN_(UndisplayedNode*) GetFirstNode(nsIContent* aParentContent);
+  UndisplayedNode* GetFirstNode(nsIContent* aParentContent);
 
-  NS_HIDDEN_(nsresult) AddNodeFor(nsIContent* aParentContent,
+  nsresult AddNodeFor(nsIContent* aParentContent,
                                   nsIContent* aChild, nsStyleContext* aStyle);
 
-  NS_HIDDEN_(void) RemoveNodeFor(nsIContent* aParentContent,
+  void RemoveNodeFor(nsIContent* aParentContent,
                                  UndisplayedNode* aNode);
 
-  NS_HIDDEN_(void) RemoveNodesFor(nsIContent* aParentContent);
+  void RemoveNodesFor(nsIContent* aParentContent);
 
   // Removes all entries from the hash table
-  NS_HIDDEN_(void)  Clear(void);
+  void  Clear(void);
 
 protected:
   /**
    * Gets the entry for the provided parent content. If the content
    * is a <xbl:children> element, |**aParentContent| is set to
    * the parent of the children element.
    */
-  NS_HIDDEN_(PLHashEntry**) GetEntryFor(nsIContent** aParentContent);
-  NS_HIDDEN_(void)          AppendNodeFor(UndisplayedNode* aNode,
+  PLHashEntry** GetEntryFor(nsIContent** aParentContent);
+  void          AppendNodeFor(UndisplayedNode* aNode,
                                           nsIContent* aParentContent);
 
   PLHashTable*  mTable;
   PLHashEntry** mLastLookup;
 };
 
 //----------------------------------------------------------------------
 
--- a/layout/base/nsFrameManager.h
+++ b/layout/base/nsFrameManager.h
@@ -34,17 +34,17 @@ struct UndisplayedNode {
   UndisplayedNode(nsIContent* aContent, nsStyleContext* aStyle)
     : mContent(aContent),
       mStyle(aStyle),
       mNext(nullptr)
   {
     MOZ_COUNT_CTOR(mozilla::UndisplayedNode);
   }
 
-  NS_HIDDEN ~UndisplayedNode()
+  ~UndisplayedNode()
   {
     MOZ_COUNT_DTOR(mozilla::UndisplayedNode);
 
     // Delete mNext iteratively to avoid blowing up the stack (bug 460461).
     UndisplayedNode* cur = mNext;
     while (cur) {
       UndisplayedNode* next = cur->mNext;
       cur->mNext = nullptr;
@@ -71,95 +71,95 @@ struct UndisplayedNode {
  * Do not add virtual methods to this class, or bryner will punish you.
  */
 
 class nsFrameManager : public nsFrameManagerBase
 {
   typedef nsIFrame::ChildListID ChildListID;
 
 public:
-  nsFrameManager(nsIPresShell *aPresShell, nsStyleSet* aStyleSet) NS_HIDDEN {
+  nsFrameManager(nsIPresShell *aPresShell, nsStyleSet* aStyleSet) {
     mPresShell = aPresShell;
     mStyleSet = aStyleSet;
     MOZ_ASSERT(mPresShell, "need a pres shell");
     MOZ_ASSERT(mStyleSet, "need a style set");
   }
-  ~nsFrameManager() NS_HIDDEN;
+  ~nsFrameManager();
 
   /*
    * After Destroy is called, it is an error to call any FrameManager methods.
    * Destroy should be called when the frame tree managed by the frame
    * manager is no longer being displayed.
    */
-  NS_HIDDEN_(void) Destroy();
+  void Destroy();
 
   // Placeholder frame functions
-  NS_HIDDEN_(nsPlaceholderFrame*) GetPlaceholderFrameFor(const nsIFrame* aFrame);
-  NS_HIDDEN_(nsresult)
+  nsPlaceholderFrame* GetPlaceholderFrameFor(const nsIFrame* aFrame);
+  nsresult
     RegisterPlaceholderFrame(nsPlaceholderFrame* aPlaceholderFrame);
 
-  NS_HIDDEN_(void)
+  void
     UnregisterPlaceholderFrame(nsPlaceholderFrame* aPlaceholderFrame);
 
-  NS_HIDDEN_(void)      ClearPlaceholderFrameMap();
+  void      ClearPlaceholderFrameMap();
 
   // Mapping undisplayed content
-  NS_HIDDEN_(nsStyleContext*) GetUndisplayedContent(nsIContent* aContent);
-  NS_HIDDEN_(mozilla::UndisplayedNode*)
+  nsStyleContext* GetUndisplayedContent(nsIContent* aContent);
+  mozilla::UndisplayedNode*
     GetAllUndisplayedContentIn(nsIContent* aParentContent);
-  NS_HIDDEN_(void) SetUndisplayedContent(nsIContent* aContent,
+  void SetUndisplayedContent(nsIContent* aContent,
                                          nsStyleContext* aStyleContext);
-  NS_HIDDEN_(void) ChangeUndisplayedContent(nsIContent* aContent,
+  void ChangeUndisplayedContent(nsIContent* aContent,
                                             nsStyleContext* aStyleContext);
-  NS_HIDDEN_(void) ClearUndisplayedContentIn(nsIContent* aContent,
+  void ClearUndisplayedContentIn(nsIContent* aContent,
                                              nsIContent* aParentContent);
-  NS_HIDDEN_(void) ClearAllUndisplayedContentIn(nsIContent* aParentContent);
+  void ClearAllUndisplayedContentIn(nsIContent* aParentContent);
 
   // Functions for manipulating the frame model
-  NS_HIDDEN_(void) AppendFrames(nsContainerFrame* aParentFrame,
-                                ChildListID       aListID,
-                                nsFrameList&      aFrameList);
+  void AppendFrames(nsContainerFrame* aParentFrame,
+                    ChildListID       aListID,
+                    nsFrameList&      aFrameList);
 
-  NS_HIDDEN_(void) InsertFrames(nsContainerFrame* aParentFrame,
-                                ChildListID       aListID,
-                                nsIFrame*         aPrevFrame,
-                                nsFrameList&      aFrameList);
+  void InsertFrames(nsContainerFrame* aParentFrame,
+                    ChildListID       aListID,
+                    nsIFrame*         aPrevFrame,
+                    nsFrameList&      aFrameList);
 
-  NS_HIDDEN_(void) RemoveFrame(ChildListID     aListID,
-                               nsIFrame*       aOldFrame);
+  void RemoveFrame(ChildListID     aListID,
+                   nsIFrame*       aOldFrame);
 
   /*
    * Notification that a frame is about to be destroyed. This allows any
    * outstanding references to the frame to be cleaned up.
    */
-  NS_HIDDEN_(void)     NotifyDestroyingFrame(nsIFrame* aFrame);
+  void     NotifyDestroyingFrame(nsIFrame* aFrame);
 
   /*
    * Capture/restore frame state for the frame subtree rooted at aFrame.
    * aState is the document state storage object onto which each frame
    * stores its state.  Callers of CaptureFrameState are responsible for
    * traversing next continuations of special siblings of aFrame as
    * needed; this method will only work with actual frametree descendants
    * of aFrame.
    */
 
-  NS_HIDDEN_(void) CaptureFrameState(nsIFrame*              aFrame,
+  void CaptureFrameState(nsIFrame*              aFrame,
                                      nsILayoutHistoryState* aState);
 
-  NS_HIDDEN_(void) RestoreFrameState(nsIFrame*              aFrame,
+  void RestoreFrameState(nsIFrame*              aFrame,
                                      nsILayoutHistoryState* aState);
 
   /*
    * Add/restore state for one frame
    */
-  NS_HIDDEN_(void) CaptureFrameStateFor(nsIFrame*              aFrame,
+  void CaptureFrameStateFor(nsIFrame*              aFrame,
                                         nsILayoutHistoryState* aState);
 
-  NS_HIDDEN_(void) RestoreFrameStateFor(nsIFrame*              aFrame,
+  void RestoreFrameStateFor(nsIFrame*              aFrame,
                                         nsILayoutHistoryState* aState);
 
-  NS_HIDDEN_(nsIPresShell*) GetPresShell() const { return mPresShell; }
-  NS_HIDDEN_(nsPresContext*) GetPresContext() const {
+  nsIPresShell* GetPresShell() const { return mPresShell; }
+  nsPresContext* GetPresContext() const {
     return mPresShell->GetPresContext();
   }
 };
 
 #endif
--- a/layout/base/nsFrameManagerBase.h
+++ b/layout/base/nsFrameManagerBase.h
@@ -41,18 +41,18 @@ public:
 
   bool IsDestroyingFrames() { return mIsDestroyingFrames; }
 
   /*
    * Gets and sets the root frame (typically the viewport). The lifetime of the
    * root frame is controlled by the frame manager. When the frame manager is
    * destroyed, it destroys the entire frame hierarchy.
    */
-  NS_HIDDEN_(nsIFrame*) GetRootFrame() const { return mRootFrame; }
-  NS_HIDDEN_(void)      SetRootFrame(nsIFrame* aRootFrame)
+  nsIFrame* GetRootFrame() const { return mRootFrame; }
+  void      SetRootFrame(nsIFrame* aRootFrame)
   {
     NS_ASSERTION(!mRootFrame, "already have a root frame");
     mRootFrame = aRootFrame;
   }
 
   static uint32_t GetGlobalGenerationNumber() { return sGlobalGenerationNumber; }
 
 protected:
--- a/layout/base/nsIPresShell.h
+++ b/layout/base/nsIPresShell.h
@@ -186,31 +186,31 @@ protected:
 public:
   /**
    * All callers are responsible for calling |Destroy| after calling
    * |EndObservingDocument|.  It needs to be separate only because form
    * controls incorrectly store their data in the frames rather than the
    * content model and printing calls |EndObservingDocument| multiple
    * times to make form controls behave nicely when printed.
    */
-  virtual NS_HIDDEN_(void) Destroy() = 0;
+  virtual void Destroy() = 0;
 
   bool IsDestroying() { return mIsDestroying; }
 
   /**
    * Make a one-way transition into a "zombie" state.  In this state,
    * no reflow is done, no painting is done, and no refresh driver
    * ticks are processed.  This is a dangerous state: it can leave
    * areas of the composition target unpainted if callers aren't
    * careful.  (Don't let your zombie presshell out of the shed.)
    *
    * This is used in cases where a presshell is created for reasons
    * other than reflow/painting.
    */
-  virtual NS_HIDDEN_(void) MakeZombie() = 0;
+  virtual void MakeZombie() = 0;
 
   /**
    * All frames owned by the shell are allocated from an arena.  They
    * are also recycled using free lists.  Separate free lists are
    * maintained for each frame type (aID), which must always correspond
    * to the same aSize value.  AllocateFrame returns zero-filled memory.
    * AllocateFrame is infallible and will abort on out-of-memory.
    */
@@ -322,66 +322,66 @@ public:
 
 #endif
 
   /* Enable/disable author style level. Disabling author style disables the entire
    * author level of the cascade, including the HTML preshint level.
    */
   // XXX these could easily be inlined, but there is a circular #include
   // problem with nsStyleSet.
-  NS_HIDDEN_(void) SetAuthorStyleDisabled(bool aDisabled);
-  NS_HIDDEN_(bool) GetAuthorStyleDisabled() const;
+  void SetAuthorStyleDisabled(bool aDisabled);
+  bool GetAuthorStyleDisabled() const;
 
   /*
    * Called when stylesheets are added/removed/enabled/disabled to rebuild
    * all style data for a given pres shell without necessarily reconstructing
    * all of the frames.  This will not reconstruct style synchronously; if
    * you need to do that, call FlushPendingNotifications to flush out style
    * reresolves.
    * // XXXbz why do we have this on the interface anyway?  The only consumer
    * is calling AddOverrideStyleSheet/RemoveOverrideStyleSheet, and I think
    * those should just handle reconstructing style data...
    */
-  virtual NS_HIDDEN_(void) ReconstructStyleDataExternal();
-  NS_HIDDEN_(void) ReconstructStyleDataInternal();
+  virtual void ReconstructStyleDataExternal();
+  void ReconstructStyleDataInternal();
 #ifdef MOZILLA_INTERNAL_API
   void ReconstructStyleData() { ReconstructStyleDataInternal(); }
 #else
   void ReconstructStyleData() { ReconstructStyleDataExternal(); }
 #endif
 
   /** Setup all style rules required to implement preferences
    * - used for background/text/link colors and link underlining
    *    may be extended for any prefs that are implemented via style rules
    * - aForceReflow argument is used to force a full reframe to make the rules show
    *   (only used when the current page needs to reflect changed pref rules)
    *
    * - initially created for bugs 31816, 20760, 22963
    */
-  virtual NS_HIDDEN_(nsresult) SetPreferenceStyleRules(bool aForceReflow) = 0;
+  virtual nsresult SetPreferenceStyleRules(bool aForceReflow) = 0;
 
   /**
    * FrameSelection will return the Frame based selection API.
    * You cannot go back and forth anymore with QI between nsIDOM sel and
    * nsIFrame sel.
    */
   already_AddRefed<nsFrameSelection> FrameSelection();
 
   /**
    * ConstFrameSelection returns an object which methods are safe to use for
    * example in nsIFrame code.
    */
   const nsFrameSelection* ConstFrameSelection() const { return mSelection; }
 
   // Make shell be a document observer.  If called after Destroy() has
   // been called on the shell, this will be ignored.
-  virtual NS_HIDDEN_(void) BeginObservingDocument() = 0;
+  virtual void BeginObservingDocument() = 0;
 
   // Make shell stop being a document observer
-  virtual NS_HIDDEN_(void) EndObservingDocument() = 0;
+  virtual void EndObservingDocument() = 0;
 
   /**
    * Return whether Initialize() was previously called.
    */
   bool DidInitialize() const { return mDidInitialize; }
 
   /**
    * Perform initialization. Constructs the frame for the root content
@@ -389,49 +389,49 @@ public:
    * specified width and height.
    *
    * The coordinates for aWidth and aHeight must be in standard nscoords.
    *
    * Callers of this method must hold a reference to this shell that
    * is guaranteed to survive through arbitrary script execution.
    * Calling Initialize can execute arbitrary script.
    */
-  virtual NS_HIDDEN_(nsresult) Initialize(nscoord aWidth, nscoord aHeight) = 0;
+  virtual nsresult Initialize(nscoord aWidth, nscoord aHeight) = 0;
 
   /**
    * Reflow the frame model into a new width and height.  The
    * coordinates for aWidth and aHeight must be in standard nscoord's.
    */
-  virtual NS_HIDDEN_(nsresult) ResizeReflow(nscoord aWidth, nscoord aHeight) = 0;
+  virtual nsresult ResizeReflow(nscoord aWidth, nscoord aHeight) = 0;
   /**
    * Reflow, and also change presshell state so as to only permit
    * reflowing off calls to ResizeReflowOverride() in the future.
    * ResizeReflow() calls are ignored after ResizeReflowOverride().
    */
-  virtual NS_HIDDEN_(nsresult) ResizeReflowOverride(nscoord aWidth, nscoord aHeight) = 0;
+  virtual nsresult ResizeReflowOverride(nscoord aWidth, nscoord aHeight) = 0;
 
   /**
    * Returns true if ResizeReflowOverride has been called.
    */
   virtual bool GetIsViewportOverridden() = 0;
 
   /**
    * Return true if the presshell expects layout flush.
    */
   virtual bool IsLayoutFlushObserver() = 0;
 
   /**
    * Called when document load completes.
    */
-  virtual NS_HIDDEN_(void) LoadComplete() = 0;
+  virtual void LoadComplete() = 0;
 
   /**
    * This calls through to the frame manager to get the root frame.
    */
-  virtual NS_HIDDEN_(nsIFrame*) GetRootFrameExternal() const;
+  virtual nsIFrame* GetRootFrameExternal() const;
   nsIFrame* GetRootFrame() const {
 #ifdef MOZILLA_INTERNAL_API
     return mFrameManager->GetRootFrame();
 #else
     return GetRootFrameExternal();
 #endif
   }
 
@@ -460,47 +460,47 @@ public:
    */
   enum ScrollDirection { eHorizontal, eVertical, eEither };
   nsIScrollableFrame* GetFrameToScrollAsScrollable(ScrollDirection aDirection);
 
   /**
    * Returns the page sequence frame associated with the frame hierarchy.
    * Returns nullptr if not a paginated view.
    */
-  virtual NS_HIDDEN_(nsIPageSequenceFrame*) GetPageSequenceFrame() const = 0;
+  virtual nsIPageSequenceFrame* GetPageSequenceFrame() const = 0;
 
   /**
    * Gets the real primary frame associated with the content object.
    *
    * In the case of absolutely positioned elements and floated elements,
    * the real primary frame is the frame that is out of the flow and not the
    * placeholder frame.
    */
-  virtual NS_HIDDEN_(nsIFrame*) GetRealPrimaryFrameFor(nsIContent* aContent) const = 0;
+  virtual nsIFrame* GetRealPrimaryFrameFor(nsIContent* aContent) const = 0;
 
   /**
    * Gets the placeholder frame associated with the specified frame. This is
    * a helper frame that forwards the request to the frame manager.
    */
-  virtual NS_HIDDEN_(nsIFrame*) GetPlaceholderFrameFor(nsIFrame* aFrame) const = 0;
+  virtual nsIFrame* GetPlaceholderFrameFor(nsIFrame* aFrame) const = 0;
 
   /**
    * Tell the pres shell that a frame needs to be marked dirty and needs
    * Reflow.  It's OK if this is an ancestor of the frame needing reflow as
    * long as the ancestor chain between them doesn't cross a reflow root.  The
    * bit to add should be either NS_FRAME_IS_DIRTY or
    * NS_FRAME_HAS_DIRTY_CHILDREN (but not both!).
    */
   enum IntrinsicDirty {
     // XXXldb eResize should be renamed
     eResize,     // don't mark any intrinsic widths dirty
     eTreeChange, // mark intrinsic widths dirty on aFrame and its ancestors
     eStyleChange // Do eTreeChange, plus all of aFrame's descendants
   };
-  virtual NS_HIDDEN_(void) FrameNeedsReflow(nsIFrame *aFrame,
+  virtual void FrameNeedsReflow(nsIFrame *aFrame,
                                             IntrinsicDirty aIntrinsicDirty,
                                             nsFrameState aBitToAdd) = 0;
 
   /**
    * Calls FrameNeedsReflow on all fixed position children of the root frame.
    */
   virtual void MarkFixedFramesForReflow(IntrinsicDirty aIntrinsicDirty);
 
@@ -510,88 +510,88 @@ public:
    * to the nearest ancestor with a dirty subtree, or to the reflow root
    * currently being reflowed if no such ancestor exists (inclusive).  This is
    * to be done immediately after reflow of the current reflow root completes.
    * This method must only be called during reflow, and the frame it's being
    * called on must be in the process of being reflowed when it's called.  This
    * method doesn't mark any intrinsic widths dirty and doesn't add any bits
    * other than NS_FRAME_HAS_DIRTY_CHILDREN.
    */
-  virtual NS_HIDDEN_(void) FrameNeedsToContinueReflow(nsIFrame *aFrame) = 0;
+  virtual void FrameNeedsToContinueReflow(nsIFrame *aFrame) = 0;
 
-  virtual NS_HIDDEN_(void) CancelAllPendingReflows() = 0;
+  virtual void CancelAllPendingReflows() = 0;
 
   /**
    * Recreates the frames for a node
    */
-  virtual NS_HIDDEN_(nsresult) RecreateFramesFor(nsIContent* aContent) = 0;
+  virtual nsresult RecreateFramesFor(nsIContent* aContent) = 0;
 
   void PostRecreateFramesFor(mozilla::dom::Element* aElement);
   void RestyleForAnimation(mozilla::dom::Element* aElement,
                            nsRestyleHint aHint);
 
   // ShadowRoot has APIs that can change styles so we only
   // want to restyle elements in the ShadowRoot and not the whole
   // document.
   virtual void RestyleShadowRoot(mozilla::dom::ShadowRoot* aShadowRoot) = 0;
 
   /**
    * Determine if it is safe to flush all pending notifications
    * @param aIsSafeToFlush true if it is safe, false otherwise.
    *
    */
-  virtual NS_HIDDEN_(bool) IsSafeToFlush() const = 0;
+  virtual bool IsSafeToFlush() const = 0;
 
   /**
    * Flush pending notifications of the type specified.  This method
    * will not affect the content model; it'll just affect style and
    * frames. Callers that actually want up-to-date presentation (other
    * than the document itself) should probably be calling
    * nsIDocument::FlushPendingNotifications.
    *
    * @param aType the type of notifications to flush
    */
-  virtual NS_HIDDEN_(void) FlushPendingNotifications(mozFlushType aType) = 0;
-  virtual NS_HIDDEN_(void) FlushPendingNotifications(mozilla::ChangesToFlush aType) = 0;
+  virtual void FlushPendingNotifications(mozFlushType aType) = 0;
+  virtual void FlushPendingNotifications(mozilla::ChangesToFlush aType) = 0;
 
   /**
    * Callbacks will be called even if reflow itself fails for
    * some reason.
    */
-  virtual NS_HIDDEN_(nsresult) PostReflowCallback(nsIReflowCallback* aCallback) = 0;
-  virtual NS_HIDDEN_(void) CancelReflowCallback(nsIReflowCallback* aCallback) = 0;
+  virtual nsresult PostReflowCallback(nsIReflowCallback* aCallback) = 0;
+  virtual void CancelReflowCallback(nsIReflowCallback* aCallback) = 0;
 
-  virtual NS_HIDDEN_(void) ClearFrameRefs(nsIFrame* aFrame) = 0;
+  virtual void ClearFrameRefs(nsIFrame* aFrame) = 0;
 
   /**
    * Get a reference rendering context. This is a context that should not
    * be rendered to, but is suitable for measuring text and performing
    * other non-rendering operations. Guaranteed to return non-null.
    */
   virtual already_AddRefed<nsRenderingContext> CreateReferenceRenderingContext() = 0;
 
   /**
    * Informs the pres shell that the document is now at the anchor with
    * the given name.  If |aScroll| is true, scrolls the view of the
    * document so that the anchor with the specified name is displayed at
    * the top of the window.  If |aAnchorName| is empty, then this informs
    * the pres shell that there is no current target, and |aScroll| must
    * be false.
    */
-  virtual NS_HIDDEN_(nsresult) GoToAnchor(const nsAString& aAnchorName, bool aScroll) = 0;
+  virtual nsresult GoToAnchor(const nsAString& aAnchorName, bool aScroll) = 0;
 
   /**
    * Tells the presshell to scroll again to the last anchor scrolled to by
    * GoToAnchor, if any. This scroll only happens if the scroll
    * position has not changed since the last GoToAnchor. This is called
    * by nsDocumentViewer::LoadComplete. This clears the last anchor
    * scrolled to by GoToAnchor (we don't want to keep it alive if it's
    * removed from the DOM), so don't call this more than once.
    */
-  virtual NS_HIDDEN_(nsresult) ScrollToAnchor() = 0;
+  virtual nsresult ScrollToAnchor() = 0;
 
   enum {
     SCROLL_TOP     = 0,
     SCROLL_BOTTOM  = 100,
     SCROLL_LEFT    = 0,
     SCROLL_RIGHT   = 100,
     SCROLL_CENTER  = 50,
     SCROLL_MINIMUM = -1
@@ -664,17 +664,17 @@ public:
    *                  If SCROLL_OVERFLOW_HIDDEN is set then we may scroll in a
    *                  direction even if overflow:hidden is specified in that
    *                  direction; otherwise we will not scroll in that direction
    *                  when overflow:hidden is set for that direction.
    *                  If SCROLL_NO_PARENT_FRAMES is set then we only scroll
    *                  nodes in this document, not in any parent documents which
    *                  contain this document in a iframe or the like.
    */
-  virtual NS_HIDDEN_(nsresult) ScrollContentIntoView(nsIContent* aContent,
+  virtual nsresult ScrollContentIntoView(nsIContent* aContent,
                                                      ScrollAxis  aVertical,
                                                      ScrollAxis  aHorizontal,
                                                      uint32_t    aFlags) = 0;
 
   enum {
     SCROLL_FIRST_ANCESTOR_ONLY = 0x01,
     SCROLL_OVERFLOW_HIDDEN = 0x02,
     SCROLL_NO_PARENT_FRAMES = 0x04
@@ -721,36 +721,36 @@ public:
   virtual nsRectVisibility GetRectVisibility(nsIFrame *aFrame,
                                              const nsRect &aRect,
                                              nscoord aMinTwips) const = 0;
 
   /**
    * Suppress notification of the frame manager that frames are
    * being destroyed.
    */
-  virtual NS_HIDDEN_(void) SetIgnoreFrameDestruction(bool aIgnore) = 0;
+  virtual void SetIgnoreFrameDestruction(bool aIgnore) = 0;
 
   /**
    * Notification sent by a frame informing the pres shell that it is about to
    * be destroyed.
    * This allows any outstanding references to the frame to be cleaned up
    */
-  virtual NS_HIDDEN_(void) NotifyDestroyingFrame(nsIFrame* aFrame) = 0;
+  virtual void NotifyDestroyingFrame(nsIFrame* aFrame) = 0;
 
   /**
    * Get the caret, if it exists. AddRefs it.
    */
-  virtual NS_HIDDEN_(already_AddRefed<nsCaret>) GetCaret() const = 0;
+  virtual already_AddRefed<nsCaret> GetCaret() const = 0;
 
   /**
    * Invalidate the caret's current position if it's outside of its frame's
    * boundaries. This function is useful if you're batching selection
    * notifications and might remove the caret's frame out from under it.
    */
-  virtual NS_HIDDEN_(void) MaybeInvalidateCaretPosition() = 0;
+  virtual void MaybeInvalidateCaretPosition() = 0;
 
   /**
    * Set the current caret to a new caret. To undo this, call RestoreCaret.
    */
   virtual void SetCaret(nsCaret *aNewCaret) = 0;
 
   /**
    * Restore the caret to the original caret that this pres shell was created
@@ -776,55 +776,55 @@ public:
   int16_t GetSelectionFlags() const { return mSelectionFlags; }
 
   virtual mozilla::dom::Selection* GetCurrentSelection(SelectionType aType) = 0;
 
   /**
     * Interface to dispatch events via the presshell
     * @note The caller must have a strong reference to the PresShell.
     */
-  virtual NS_HIDDEN_(nsresult) HandleEventWithTarget(
+  virtual nsresult HandleEventWithTarget(
                                  mozilla::WidgetEvent* aEvent,
                                  nsIFrame* aFrame,
                                  nsIContent* aContent,
                                  nsEventStatus* aStatus) = 0;
 
   /**
    * Dispatch event to content only (NOT full processing)
    * @note The caller must have a strong reference to the PresShell.
    */
-  virtual NS_HIDDEN_(nsresult) HandleDOMEventWithTarget(
+  virtual nsresult HandleDOMEventWithTarget(
                                  nsIContent* aTargetContent,
                                  mozilla::WidgetEvent* aEvent,
                                  nsEventStatus* aStatus) = 0;
 
   /**
    * Dispatch event to content only (NOT full processing)
    * @note The caller must have a strong reference to the PresShell.
    */
-  virtual NS_HIDDEN_(nsresult) HandleDOMEventWithTarget(nsIContent* aTargetContent,
+  virtual nsresult HandleDOMEventWithTarget(nsIContent* aTargetContent,
                                                         nsIDOMEvent* aEvent,
                                                         nsEventStatus* aStatus) = 0;
 
   /**
     * Gets the current target event frame from the PresShell
     */
-  virtual NS_HIDDEN_(nsIFrame*) GetEventTargetFrame() = 0;
+  virtual nsIFrame* GetEventTargetFrame() = 0;
 
   /**
     * Gets the current target event frame from the PresShell
     */
-  virtual NS_HIDDEN_(already_AddRefed<nsIContent>) GetEventTargetContent(
+  virtual already_AddRefed<nsIContent> GetEventTargetContent(
                                                      mozilla::WidgetEvent* aEvent) = 0;
 
   /**
    * Get and set the history state for the current document
    */
 
-  virtual NS_HIDDEN_(nsresult) CaptureHistoryState(nsILayoutHistoryState** aLayoutHistoryState) = 0;
+  virtual nsresult CaptureHistoryState(nsILayoutHistoryState** aLayoutHistoryState) = 0;
 
   /**
    * Determine if reflow is currently locked
    * returns true if reflow is locked, false otherwise
    */
   bool IsReflowLocked() const { return mIsReflowing; }
 
   /**
@@ -846,17 +846,17 @@ public:
    * presentations. This may not have the desired effect if this pres shell
    * has its own refresh driver.
    */
   virtual void ResumePainting() = 0;
 
   /**
    * Unsuppress painting.
    */
-  virtual NS_HIDDEN_(void) UnsuppressPainting() = 0;
+  virtual void UnsuppressPainting() = 0;
 
   /**
    * Called to disable nsITheme support in a specific presshell.
    */
   void DisableThemeSupport()
   {
     // Doesn't have to be dynamic.  Just set the bool.
     mIsThemeSupportDisabled = true;
@@ -910,25 +910,25 @@ public:
   /**
    * Set the verify-reflow enable flag.
    */
   static void SetVerifyReflowEnable(bool aEnabled);
 
   virtual nsIFrame* GetAbsoluteContainingBlock(nsIFrame* aFrame);
 
 #ifdef MOZ_REFLOW_PERF
-  virtual NS_HIDDEN_(void) DumpReflows() = 0;
-  virtual NS_HIDDEN_(void) CountReflows(const char * aName, nsIFrame * aFrame) = 0;
-  virtual NS_HIDDEN_(void) PaintCount(const char * aName,
+  virtual void DumpReflows() = 0;
+  virtual void CountReflows(const char * aName, nsIFrame * aFrame) = 0;
+  virtual void PaintCount(const char * aName,
                                       nsRenderingContext* aRenderingContext,
                                       nsPresContext * aPresContext,
                                       nsIFrame * aFrame,
                                       const nsPoint& aOffset,
                                       uint32_t aColor) = 0;
-  virtual NS_HIDDEN_(void) SetPaintFrameCount(bool aOn) = 0;
+  virtual void SetPaintFrameCount(bool aOn) = 0;
   virtual bool IsPaintingFrameCounts() = 0;
 #endif
 
 #ifdef DEBUG
   // Debugging hooks
   virtual void ListStyleContexts(nsIFrame *aRootFrame, FILE *out,
                                  int32_t aIndent = 0) = 0;
 
@@ -1011,17 +1011,17 @@ public:
     RENDER_IS_UNTRUSTED = 0x01,
     RENDER_IGNORE_VIEWPORT_SCROLLING = 0x02,
     RENDER_CARET = 0x04,
     RENDER_USE_WIDGET_LAYERS = 0x08,
     RENDER_ASYNC_DECODE_IMAGES = 0x10,
     RENDER_DOCUMENT_RELATIVE = 0x20,
     RENDER_DRAWWINDOW_NOT_FLUSHING = 0x40
   };
-  virtual NS_HIDDEN_(nsresult) RenderDocument(const nsRect& aRect, uint32_t aFlags,
+  virtual nsresult RenderDocument(const nsRect& aRect, uint32_t aFlags,
                                               nscolor aBackgroundColor,
                                               gfxContext* aRenderedContext) = 0;
 
   /**
    * Renders a node aNode to a surface and returns it. The aRegion may be used
    * to clip the rendering. This region is measured in CSS pixels from the
    * edge of the presshell area. The aPoint, aScreenRect and aSurface
    * arguments function in a similar manner as RenderSelection.
@@ -1082,17 +1082,17 @@ public:
 
   /**
    * Stop or restart non synthetic test mouse event handling on *all*
    * presShells.
    *
    * @param aDisable If true, disable all non synthetic test mouse
    * events on all presShells.  Otherwise, enable them.
    */
-  virtual NS_HIDDEN_(void) DisableNonTestMouseEvents(bool aDisable) = 0;
+  virtual void DisableNonTestMouseEvents(bool aDisable) = 0;
 
   /**
    * Record the background color of the most recently drawn canvas. This color
    * is composited on top of the user's default background color and then used
    * to draw the background color of the canvas. See PresShell::Paint,
    * PresShell::PaintDefaultBackground, and nsDocShell::SetupNewViewer;
    * bug 488242, bug 476557 and other bugs mentioned there.
    */
--- a/layout/base/nsPresArena.cpp
+++ b/layout/base/nsPresArena.cpp
@@ -35,17 +35,17 @@ nsPresArena::nsPresArena()
 nsPresArena::~nsPresArena()
 {
 #if defined(MOZ_HAVE_MEM_CHECKS)
   mFreeLists.EnumerateEntries(UnpoisonFreeList, nullptr);
 #endif
   PL_FinishArenaPool(&mPool);
 }
 
-NS_HIDDEN_(void*)
+void*
 nsPresArena::Allocate(uint32_t aCode, size_t aSize)
 {
   NS_ABORT_IF_FALSE(aSize > 0, "PresArena cannot allocate zero bytes");
 
   // We only hand out aligned sizes
   aSize = PL_ARENA_ALIGN(&mPool, aSize);
 
   // If there is no free-list entry for this type already, we have
@@ -93,17 +93,17 @@ nsPresArena::Allocate(uint32_t aCode, si
   list->mEntriesEverAllocated++;
   PL_ARENA_ALLOCATE(result, &mPool, aSize);
   if (!result) {
     NS_RUNTIMEABORT("out of memory");
   }
   return result;
 }
 
-NS_HIDDEN_(void)
+void
 nsPresArena::Free(uint32_t aCode, void* aPtr)
 {
   // Try to recycle this entry.
   FreeList* list = mFreeLists.GetEntry(aCode);
   NS_ABORT_IF_FALSE(list, "no free list for pres arena object");
   NS_ABORT_IF_FALSE(list->mEntrySize > 0, "PresArena cannot free zero bytes");
 
   mozWritePoison(aPtr, list->mEntrySize);
--- a/layout/base/nsPresArena.h
+++ b/layout/base/nsPresArena.h
@@ -41,61 +41,61 @@ public:
      * whether enumeration constants are signed.
      */
     NON_OBJECT_MARKER = 0x40000000
   };
 
   /**
    * Pool allocation with recycler lists indexed by object size, aSize.
    */
-  NS_HIDDEN_(void*) AllocateBySize(size_t aSize)
+  void* AllocateBySize(size_t aSize)
   {
     return Allocate(uint32_t(aSize) | uint32_t(NON_OBJECT_MARKER), aSize);
   }
-  NS_HIDDEN_(void) FreeBySize(size_t aSize, void* aPtr)
+  void FreeBySize(size_t aSize, void* aPtr)
   {
     Free(uint32_t(aSize) | uint32_t(NON_OBJECT_MARKER), aPtr);
   }
 
   /**
    * Pool allocation with recycler lists indexed by frame-type ID.
    * Every aID must always be used with the same object size, aSize.
    */
-  NS_HIDDEN_(void*) AllocateByFrameID(nsQueryFrame::FrameIID aID, size_t aSize)
+  void* AllocateByFrameID(nsQueryFrame::FrameIID aID, size_t aSize)
   {
     return Allocate(aID, aSize);
   }
-  NS_HIDDEN_(void) FreeByFrameID(nsQueryFrame::FrameIID aID, void* aPtr)
+  void FreeByFrameID(nsQueryFrame::FrameIID aID, void* aPtr)
   {
     Free(aID, aPtr);
   }
 
   /**
    * Pool allocation with recycler lists indexed by object-type ID (see above).
    * Every aID must always be used with the same object size, aSize.
    */
-  NS_HIDDEN_(void*) AllocateByObjectID(ObjectID aID, size_t aSize)
+  void* AllocateByObjectID(ObjectID aID, size_t aSize)
   {
     return Allocate(aID, aSize);
   }
-  NS_HIDDEN_(void) FreeByObjectID(ObjectID aID, void* aPtr)
+  void FreeByObjectID(ObjectID aID, void* aPtr)
   {
     Free(aID, aPtr);
   }
 
   /**
    * Increment aArenaStats with sizes of interesting objects allocated in this
    * arena and its mOther field with the size of everything else.
    */
   void AddSizeOfExcludingThis(mozilla::MallocSizeOf aMallocSizeOf,
                               nsArenaMemoryStats* aArenaStats);
 
 private:
-  NS_HIDDEN_(void*) Allocate(uint32_t aCode, size_t aSize);
-  NS_HIDDEN_(void) Free(uint32_t aCode, void* aPtr);
+  void* Allocate(uint32_t aCode, size_t aSize);
+  void Free(uint32_t aCode, void* aPtr);
 
   // All keys to this hash table fit in 32 bits (see below) so we do not
   // bother actually hashing them.
   class FreeList : public PLDHashEntryHdr
   {
   public:
     typedef uint32_t KeyType;
     nsTArray<void *> mEntries;
--- a/layout/base/nsPresContext.h
+++ b/layout/base/nsPresContext.h
@@ -150,31 +150,31 @@ public:
   };
 
   // Policies for rebuilding style data.
   enum StyleRebuildType {
     eRebuildStyleIfNeeded,
     eAlwaysRebuildStyle
   };
 
-  nsPresContext(nsIDocument* aDocument, nsPresContextType aType) NS_HIDDEN;
+  nsPresContext(nsIDocument* aDocument, nsPresContextType aType);
 
   /**
    * Initialize the presentation context from a particular device.
    */
-  NS_HIDDEN_(nsresult) Init(nsDeviceContext* aDeviceContext);
+  nsresult Init(nsDeviceContext* aDeviceContext);
 
   /**
    * Set the presentation shell that this context is bound to.
    * A presentation context may only be bound to a single shell.
    */
-  NS_HIDDEN_(void) SetShell(nsIPresShell* aShell);
+  void SetShell(nsIPresShell* aShell);
 
 
-  NS_HIDDEN_(nsPresContextType) Type() const { return mType; }
+  nsPresContextType Type() const { return mType; }
 
   /**
    * Get the PresentationShell that this context is bound to.
    */
   nsIPresShell* PresShell() const
   {
     NS_ASSERTION(mShell, "Null pres shell");
     return mShell;
@@ -255,17 +255,17 @@ public:
    * Just like RebuildAllStyleData, except (1) asynchronous and (2) it
    * doesn't rebuild the user font set.
    */
   void PostRebuildAllStyleDataEvent(nsChangeHint aExtraHint);
 
   void MediaFeatureValuesChanged(StyleRebuildType aShouldRebuild,
                                  nsChangeHint aChangeHint = nsChangeHint(0));
   void PostMediaFeatureValuesChangedEvent();
-  NS_HIDDEN_(void) HandleMediaFeatureValuesChangedEvent();
+  void HandleMediaFeatureValuesChangedEvent();
   void FlushPendingMediaFeatureValuesChanged() {
     if (mPendingMediaFeatureValuesChanged)
       MediaFeatureValuesChanged(eRebuildStyleIfNeeded);
   }
 
   /**
    * Support for window.matchMedia()
    */
@@ -276,24 +276,24 @@ public:
    * Access compatibility mode for this context.  This is the same as
    * our document's compatibility mode.
    */
   nsCompatibility CompatibilityMode() const;
 
   /**
    * Notify the context that the document's compatibility mode has changed
    */
-  NS_HIDDEN_(void) CompatibilityModeChanged();
+  void CompatibilityModeChanged();
 
   /**
    * Access the image animation mode for this context
    */
   uint16_t     ImageAnimationMode() const { return mImageAnimationMode; }
-  virtual NS_HIDDEN_(void) SetImageAnimationModeExternal(uint16_t aMode);
-  NS_HIDDEN_(void) SetImageAnimationModeInternal(uint16_t aMode);
+  virtual void SetImageAnimationModeExternal(uint16_t aMode);
+  void SetImageAnimationModeInternal(uint16_t aMode);
 #ifdef MOZILLA_INTERNAL_API
   void SetImageAnimationMode(uint16_t aMode)
   { SetImageAnimationModeInternal(aMode); }
 #else
   void SetImageAnimationMode(uint16_t aMode)
   { SetImageAnimationModeExternal(aMode); }
 #endif
 
@@ -345,17 +345,17 @@ public:
    * as the default font size for variable or fixed fonts for the
    * language group.
    *
    * For aFontID corresponding to a CSS Generic, the nsFont returned has
    * its name set to that generic font's name, and its size set to
    * the user's preference for font size for that generic and the
    * given language.
    */
-  NS_HIDDEN_(const nsFont*) GetDefaultFont(uint8_t aFontID,
+  const nsFont* GetDefaultFont(uint8_t aFontID,
                                            nsIAtom *aLanguage) const;
 
   /** Get a cached boolean pref, by its type */
   // *  - initially created for bugs 31816, 20760, 22963
   bool GetCachedBoolPref(nsPresContext_CachedBoolPrefType aPrefType) const
   {
     // If called with a constant parameter, the compiler should optimize
     // this switch statement away.
@@ -408,17 +408,17 @@ public:
   const nscolor BodyTextColor() const { return mBodyTextColor; }
   void SetBodyTextColor(nscolor aColor) { mBodyTextColor = aColor; }
 
   bool GetUseFocusColors() const { return mUseFocusColors; }
   uint8_t FocusRingWidth() const { return mFocusRingWidth; }
   bool GetFocusRingOnAnything() const { return mFocusRingOnAnything; }
   uint8_t GetFocusRingStyle() const { return mFocusRingStyle; }
 
-  NS_HIDDEN_(void) SetContainer(nsIDocShell* aContainer);
+  void SetContainer(nsIDocShell* aContainer);
 
   virtual nsISupports* GetContainerWeakExternal() const;
   nsISupports* GetContainerWeakInternal() const;
 #ifdef MOZILLA_INTERNAL_API
   nsISupports* GetContainerWeak() const
   { return GetContainerWeakInternal(); }
 #else
   nsISupports* GetContainerWeak() const
@@ -466,17 +466,17 @@ public:
    * context.
    */
   bool IsPaginated() const { return mPaginated; }
 
   /**
    * Sets whether the presentation context can scroll for a paginated
    * context.
    */
-  NS_HIDDEN_(void) SetPaginatedScrolling(bool aResult);
+  void SetPaginatedScrolling(bool aResult);
 
   /**
    * Return true if this presentation context can scroll for paginated
    * context.
    */
   bool HasPaginatedScrolling() const { return mCanPaginatedScroll; }
 
   /**
@@ -705,17 +705,17 @@ public:
   virtual bool BidiEnabledExternal() const;
   bool BidiEnabledInternal() const;
 
   /**
    *  Set bidi enabled. This means we should apply the Unicode Bidi Algorithm
    *
    *  @lina 07/12/2000
    */
-  NS_HIDDEN_(void) SetBidiEnabled() const;
+  void SetBidiEnabled() const;
 
   /**
    *  Set visual or implicit mode into the pres context.
    *
    *  Visual directionality is a presentation method that displays text
    *  as if it were a uni-directional, according to the primary display
    *  direction only.
    *
@@ -738,85 +738,85 @@ public:
    */
   bool IsVisualMode() const { return mIsVisual; }
 
 //Mohamed
 
   /**
    * Set the Bidi options for the presentation context
    */
-  NS_HIDDEN_(void) SetBidi(uint32_t aBidiOptions,
+  void SetBidi(uint32_t aBidiOptions,
                            bool aForceRestyle = false);
 
   /**
    * Get the Bidi options for the presentation context
    * Not inline so consumers of nsPresContext are not forced to
    * include nsIDocument.
    */
-  NS_HIDDEN_(uint32_t) GetBidi() const;
+  uint32_t GetBidi() const;
 
   /**
    * Render only Selection
    */
   void SetIsRenderingOnlySelection(bool aResult)
   {
     mIsRenderingOnlySelection = aResult;
   }
 
   bool IsRenderingOnlySelection() const { return mIsRenderingOnlySelection; }
 
-  NS_HIDDEN_(bool) IsTopLevelWindowInactive();
+  bool IsTopLevelWindowInactive();
 
   /*
    * Obtain a native them for rendering our widgets (both form controls and html)
    */
-  NS_HIDDEN_(nsITheme*) GetTheme();
+  nsITheme* GetTheme();
 
   /*
    * Notify the pres context that the theme has changed.  An internal switch
    * means it's one of our Mozilla themes that changed (e.g., Modern to Classic).
    * Otherwise, the OS is telling us that the native theme for the platform
    * has changed.
    */
-  NS_HIDDEN_(void) ThemeChanged();
+  void ThemeChanged();
 
   /*
    * Notify the pres context that the resolution of the user interface has
    * changed. This happens if a window is moved between HiDPI and non-HiDPI
    * displays, so that the ratio of points to device pixels changes.
    */
-  NS_HIDDEN_(void) UIResolutionChanged();
+  void UIResolutionChanged();
 
   /**
    * Recursively notify all remote leaf descendants of a given message manager
    * that the resolution of the user interface has changed.
    */
-  NS_HIDDEN_(void) NotifyUIResolutionChanged(nsIMessageBroadcaster* aManager);
+  void NotifyUIResolutionChanged(nsIMessageBroadcaster* aManager);
 
   /*
    * Notify the pres context that a system color has changed
    */
-  NS_HIDDEN_(void) SysColorChanged();
+  void SysColorChanged();
 
   /** Printing methods below should only be used for Medium() == print **/
-  NS_HIDDEN_(void) SetPrintSettings(nsIPrintSettings *aPrintSettings);
+  void SetPrintSettings(nsIPrintSettings *aPrintSettings);
 
   nsIPrintSettings* GetPrintSettings() { return mPrintSettings; }
 
   /* Accessor for table of frame properties */
   FramePropertyTable* PropertyTable() { return &mPropertyTable; }
 
   /* Helper function that ensures that this prescontext is shown in its
      docshell if it's the most recent prescontext for the docshell.  Returns
      whether the prescontext is now being shown.
   */
-  NS_HIDDEN_(bool) EnsureVisible();
+  bool EnsureVisible();
 
 #ifdef MOZ_REFLOW_PERF
-  NS_HIDDEN_(void) CountReflows(const char * aName,
+  void CountReflows(const char * aName,
                                 nsIFrame * aFrame);
 #endif
 
   /**
    * This table maps border-width enums 'thin', 'medium', 'thick'
    * to actual nscoord values.
    */
   const nscoord* GetBorderWidthTable() { return mBorderWidthTable; }
@@ -848,18 +848,18 @@ public:
   }
 
   // This method should be used instead of directly accessing mPaintFlashing,
   // as that value may be out of date when mPaintFlashingInitialized is false.
   bool GetPaintFlashing() const;
 
   bool             SupressingResizeReflow() const { return mSupressResizeReflow; }
 
-  virtual NS_HIDDEN_(gfxUserFontSet*) GetUserFontSetExternal();
-  NS_HIDDEN_(gfxUserFontSet*) GetUserFontSetInternal();
+  virtual gfxUserFontSet* GetUserFontSetExternal();
+  gfxUserFontSet* GetUserFontSetInternal();
 #ifdef MOZILLA_INTERNAL_API
   gfxUserFontSet* GetUserFontSet() { return GetUserFontSetInternal(); }
 #else
   gfxUserFontSet* GetUserFontSet() { return GetUserFontSetExternal(); }
 #endif
 
   void FlushUserFontSet();
   void RebuildUserFontSet(); // asynchronously
@@ -1030,35 +1030,35 @@ public:
   }
 
   void SetHasWarnedAboutPositionedTableParts() {
     mHasWarnedAboutPositionedTableParts = true;
   }
 
 protected:
   friend class nsRunnableMethod<nsPresContext>;
-  NS_HIDDEN_(void) ThemeChangedInternal();
-  NS_HIDDEN_(void) SysColorChangedInternal();
-  NS_HIDDEN_(void) UIResolutionChangedInternal();
+  void ThemeChangedInternal();
+  void SysColorChangedInternal();
+  void UIResolutionChangedInternal();
 
-  static NS_HIDDEN_(bool)
+  static bool
   UIResolutionChangedSubdocumentCallback(nsIDocument* aDocument, void* aData);
 
-  NS_HIDDEN_(void) SetImgAnimations(nsIContent *aParent, uint16_t aMode);
-  NS_HIDDEN_(void) SetSMILAnimations(nsIDocument *aDoc, uint16_t aNewMode,
+  void SetImgAnimations(nsIContent *aParent, uint16_t aMode);
+  void SetSMILAnimations(nsIDocument *aDoc, uint16_t aNewMode,
                                      uint16_t aOldMode);
-  NS_HIDDEN_(void) GetDocumentColorPreferences();
+  void GetDocumentColorPreferences();
 
-  NS_HIDDEN_(void) PreferenceChanged(const char* aPrefName);
-  static NS_HIDDEN_(void) PrefChangedCallback(const char*, void*);
+  void PreferenceChanged(const char* aPrefName);
+  static void PrefChangedCallback(const char*, void*);
 
-  NS_HIDDEN_(void) UpdateAfterPreferencesChanged();
-  static NS_HIDDEN_(void) PrefChangedUpdateTimerCallback(nsITimer *aTimer, void *aClosure);
+  void UpdateAfterPreferencesChanged();
+  static void PrefChangedUpdateTimerCallback(nsITimer *aTimer, void *aClosure);
 
-  NS_HIDDEN_(void) GetUserPreferences();
+  void GetUserPreferences();
 
   // Allow nsAutoPtr<LangGroupFontPrefs> dtor to access this protected struct's
   // dtor:
   struct LangGroupFontPrefs;
   friend class nsAutoPtr<LangGroupFontPrefs>;
   struct LangGroupFontPrefs {
     // Font sizes default to zero; they will be set in GetFontPreferences
     LangGroupFontPrefs()
@@ -1122,17 +1122,17 @@ protected:
   void ResetCachedFontPrefs() {
     // Throw away any other LangGroupFontPrefs objects:
     mLangGroupFontPrefs.mNext = nullptr;
 
     // Make GetFontPreferences reinitialize mLangGroupFontPrefs:
     mLangGroupFontPrefs.mLangGroup = nullptr;
   }
 
-  NS_HIDDEN_(void) UpdateCharSet(const nsCString& aCharSet);
+  void UpdateCharSet(const nsCString& aCharSet);
 
 public:
   void DoChangeCharSet(const nsCString& aCharSet);
 
   /**
    * Checks for MozAfterPaint listeners on the document
    */
   bool MayHavePaintEventListener();
@@ -1340,17 +1340,17 @@ protected:
 
 #ifdef DEBUG
   bool                  mInitialized;
 #endif
 
 
 protected:
 
-  virtual ~nsPresContext() NS_HIDDEN;
+  virtual ~nsPresContext();
 
   // these are private, use the list in nsFont.h if you want a public list
   enum {
     eDefaultFont_Variable,
     eDefaultFont_Fixed,
     eDefaultFont_Serif,
     eDefaultFont_SansSerif,
     eDefaultFont_Monospace,
@@ -1372,17 +1372,17 @@ public:
     return mLayoutPhaseCount[aPhase];
   }
 #endif
 
 };
 
 class nsRootPresContext MOZ_FINAL : public nsPresContext {
 public:
-  nsRootPresContext(nsIDocument* aDocument, nsPresContextType aType) NS_HIDDEN;
+  nsRootPresContext(nsIDocument* aDocument, nsPresContextType aType);
   virtual ~nsRootPresContext();
   virtual void Detach() MOZ_OVERRIDE;
 
   /**
    * Ensure that NotifyDidPaintForSubtree is eventually called on this
    * object after a timeout.
    */
   void EnsureEventualDidPaintEvent();
--- a/layout/base/nsPresShell.h
+++ b/layout/base/nsPresShell.h
@@ -65,105 +65,105 @@ public:
   NS_DECL_AND_IMPL_ZEROING_OPERATOR_NEW
 
   // nsISupports
   NS_DECL_ISUPPORTS
 
   void Init(nsIDocument* aDocument, nsPresContext* aPresContext,
             nsViewManager* aViewManager, nsStyleSet* aStyleSet,
             nsCompatibility aCompatMode);
-  virtual NS_HIDDEN_(void) Destroy() MOZ_OVERRIDE;
-  virtual NS_HIDDEN_(void) MakeZombie() MOZ_OVERRIDE;
+  virtual void Destroy() MOZ_OVERRIDE;
+  virtual void MakeZombie() MOZ_OVERRIDE;
 
-  virtual NS_HIDDEN_(nsresult) SetPreferenceStyleRules(bool aForceReflow) MOZ_OVERRIDE;
+  virtual nsresult SetPreferenceStyleRules(bool aForceReflow) MOZ_OVERRIDE;
 
   NS_IMETHOD GetSelection(SelectionType aType, nsISelection** aSelection);
   virtual mozilla::dom::Selection* GetCurrentSelection(SelectionType aType) MOZ_OVERRIDE;
 
   NS_IMETHOD SetDisplaySelection(int16_t aToggle) MOZ_OVERRIDE;
   NS_IMETHOD GetDisplaySelection(int16_t *aToggle) MOZ_OVERRIDE;
   NS_IMETHOD ScrollSelectionIntoView(SelectionType aType, SelectionRegion aRegion,
                                      int16_t aFlags) MOZ_OVERRIDE;
   NS_IMETHOD RepaintSelection(SelectionType aType) MOZ_OVERRIDE;
 
-  virtual NS_HIDDEN_(void) BeginObservingDocument() MOZ_OVERRIDE;
-  virtual NS_HIDDEN_(void) EndObservingDocument() MOZ_OVERRIDE;
-  virtual NS_HIDDEN_(nsresult) Initialize(nscoord aWidth, nscoord aHeight) MOZ_OVERRIDE;
-  virtual NS_HIDDEN_(nsresult) ResizeReflow(nscoord aWidth, nscoord aHeight) MOZ_OVERRIDE;
-  virtual NS_HIDDEN_(nsresult) ResizeReflowOverride(nscoord aWidth, nscoord aHeight) MOZ_OVERRIDE;
-  virtual NS_HIDDEN_(nsIPageSequenceFrame*) GetPageSequenceFrame() const MOZ_OVERRIDE;
-  virtual NS_HIDDEN_(nsIFrame*) GetRealPrimaryFrameFor(nsIContent* aContent) const MOZ_OVERRIDE;
+  virtual void BeginObservingDocument() MOZ_OVERRIDE;
+  virtual void EndObservingDocument() MOZ_OVERRIDE;
+  virtual nsresult Initialize(nscoord aWidth, nscoord aHeight) MOZ_OVERRIDE;
+  virtual nsresult ResizeReflow(nscoord aWidth, nscoord aHeight) MOZ_OVERRIDE;
+  virtual nsresult ResizeReflowOverride(nscoord aWidth, nscoord aHeight) MOZ_OVERRIDE;
+  virtual nsIPageSequenceFrame* GetPageSequenceFrame() const MOZ_OVERRIDE;
+  virtual nsIFrame* GetRealPrimaryFrameFor(nsIContent* aContent) const MOZ_OVERRIDE;
 
-  virtual NS_HIDDEN_(nsIFrame*) GetPlaceholderFrameFor(nsIFrame* aFrame) const MOZ_OVERRIDE;
-  virtual NS_HIDDEN_(void) FrameNeedsReflow(nsIFrame *aFrame, IntrinsicDirty aIntrinsicDirty,
+  virtual nsIFrame* GetPlaceholderFrameFor(nsIFrame* aFrame) const MOZ_OVERRIDE;
+  virtual void FrameNeedsReflow(nsIFrame *aFrame, IntrinsicDirty aIntrinsicDirty,
                                             nsFrameState aBitToAdd) MOZ_OVERRIDE;
-  virtual NS_HIDDEN_(void) FrameNeedsToContinueReflow(nsIFrame *aFrame) MOZ_OVERRIDE;
-  virtual NS_HIDDEN_(void) CancelAllPendingReflows() MOZ_OVERRIDE;
-  virtual NS_HIDDEN_(bool) IsSafeToFlush() const MOZ_OVERRIDE;
-  virtual NS_HIDDEN_(void) FlushPendingNotifications(mozFlushType aType) MOZ_OVERRIDE;
-  virtual NS_HIDDEN_(void) FlushPendingNotifications(mozilla::ChangesToFlush aType) MOZ_OVERRIDE;
+  virtual void FrameNeedsToContinueReflow(nsIFrame *aFrame) MOZ_OVERRIDE;
+  virtual void CancelAllPendingReflows() MOZ_OVERRIDE;
+  virtual bool IsSafeToFlush() const MOZ_OVERRIDE;
+  virtual void FlushPendingNotifications(mozFlushType aType) MOZ_OVERRIDE;
+  virtual void FlushPendingNotifications(mozilla::ChangesToFlush aType) MOZ_OVERRIDE;
 
   /**
    * Recreates the frames for a node
    */
-  virtual NS_HIDDEN_(nsresult) RecreateFramesFor(nsIContent* aContent) MOZ_OVERRIDE;
+  virtual nsresult RecreateFramesFor(nsIContent* aContent) MOZ_OVERRIDE;
 
   /**
    * Post a callback that should be handled after reflow has finished.
    */
-  virtual NS_HIDDEN_(nsresult) PostReflowCallback(nsIReflowCallback* aCallback) MOZ_OVERRIDE;
-  virtual NS_HIDDEN_(void) CancelReflowCallback(nsIReflowCallback* aCallback) MOZ_OVERRIDE;
+  virtual nsresult PostReflowCallback(nsIReflowCallback* aCallback) MOZ_OVERRIDE;
+  virtual void CancelReflowCallback(nsIReflowCallback* aCallback) MOZ_OVERRIDE;
 
-  virtual NS_HIDDEN_(void) ClearFrameRefs(nsIFrame* aFrame) MOZ_OVERRIDE;
-  virtual NS_HIDDEN_(already_AddRefed<nsRenderingContext>) CreateReferenceRenderingContext();
-  virtual NS_HIDDEN_(nsresult) GoToAnchor(const nsAString& aAnchorName, bool aScroll) MOZ_OVERRIDE;
-  virtual NS_HIDDEN_(nsresult) ScrollToAnchor() MOZ_OVERRIDE;
+  virtual void ClearFrameRefs(nsIFrame* aFrame) MOZ_OVERRIDE;
+  virtual already_AddRefed<nsRenderingContext> CreateReferenceRenderingContext();
+  virtual nsresult GoToAnchor(const nsAString& aAnchorName, bool aScroll) MOZ_OVERRIDE;
+  virtual nsresult ScrollToAnchor() MOZ_OVERRIDE;
 
-  virtual NS_HIDDEN_(nsresult) ScrollContentIntoView(nsIContent* aContent,
+  virtual nsresult ScrollContentIntoView(nsIContent* aContent,
                                                      ScrollAxis  aVertical,
                                                      ScrollAxis  aHorizontal,
                                                      uint32_t    aFlags) MOZ_OVERRIDE;
   virtual bool ScrollFrameRectIntoView(nsIFrame*     aFrame,
                                        const nsRect& aRect,
                                        ScrollAxis    aVertical,
                                        ScrollAxis    aHorizontal,
                                        uint32_t      aFlags) MOZ_OVERRIDE;
   virtual nsRectVisibility GetRectVisibility(nsIFrame *aFrame,
                                              const nsRect &aRect,
                                              nscoord aMinTwips) const MOZ_OVERRIDE;
 
-  virtual NS_HIDDEN_(void) SetIgnoreFrameDestruction(bool aIgnore) MOZ_OVERRIDE;
-  virtual NS_HIDDEN_(void) NotifyDestroyingFrame(nsIFrame* aFrame) MOZ_OVERRIDE;
+  virtual void SetIgnoreFrameDestruction(bool aIgnore) MOZ_OVERRIDE;
+  virtual void NotifyDestroyingFrame(nsIFrame* aFrame) MOZ_OVERRIDE;
 
-  virtual NS_HIDDEN_(nsresult) CaptureHistoryState(nsILayoutHistoryState** aLayoutHistoryState) MOZ_OVERRIDE;
+  virtual nsresult CaptureHistoryState(nsILayoutHistoryState** aLayoutHistoryState) MOZ_OVERRIDE;
 
-  virtual NS_HIDDEN_(void) UnsuppressPainting() MOZ_OVERRIDE;
+  virtual void UnsuppressPainting() MOZ_OVERRIDE;
 
   virtual nsresult GetAgentStyleSheets(nsCOMArray<nsIStyleSheet>& aSheets) MOZ_OVERRIDE;
   virtual nsresult SetAgentStyleSheets(const nsCOMArray<nsIStyleSheet>& aSheets) MOZ_OVERRIDE;
 
   virtual nsresult AddOverrideStyleSheet(nsIStyleSheet *aSheet) MOZ_OVERRIDE;
   virtual nsresult RemoveOverrideStyleSheet(nsIStyleSheet *aSheet) MOZ_OVERRIDE;
 
-  virtual NS_HIDDEN_(nsresult) HandleEventWithTarget(
+  virtual nsresult HandleEventWithTarget(
                                  mozilla::WidgetEvent* aEvent,
                                  nsIFrame* aFrame,
                                  nsIContent* aContent,
                                  nsEventStatus* aStatus) MOZ_OVERRIDE;
-  virtual NS_HIDDEN_(nsIFrame*) GetEventTargetFrame() MOZ_OVERRIDE;
-  virtual NS_HIDDEN_(already_AddRefed<nsIContent>) GetEventTargetContent(
+  virtual nsIFrame* GetEventTargetFrame() MOZ_OVERRIDE;
+  virtual already_AddRefed<nsIContent> GetEventTargetContent(
                                                      mozilla::WidgetEvent* aEvent) MOZ_OVERRIDE;
 
 
   virtual nsresult ReconstructFrames(void) MOZ_OVERRIDE;
   virtual void Freeze() MOZ_OVERRIDE;
   virtual void Thaw() MOZ_OVERRIDE;
   virtual void FireOrClearDelayedEvents(bool aFireEvents) MOZ_OVERRIDE;
 
-  virtual NS_HIDDEN_(nsresult) RenderDocument(const nsRect& aRect, uint32_t aFlags,
+  virtual nsresult RenderDocument(const nsRect& aRect, uint32_t aFlags,
                                               nscolor aBackgroundColor,
                                               gfxContext* aThebesContext) MOZ_OVERRIDE;
 
   virtual mozilla::TemporaryRef<SourceSurface>
   RenderNode(nsIDOMNode* aNode,
              nsIntRegion* aRegion,
              nsIntPoint& aPoint,
              nsIntRect* aScreenRect) MOZ_OVERRIDE;
@@ -185,36 +185,36 @@ public:
   //nsIViewObserver interface
 
   virtual void Paint(nsView* aViewToPaint, const nsRegion& aDirtyRegion,
                      uint32_t aFlags) MOZ_OVERRIDE;
   virtual nsresult HandleEvent(nsIFrame* aFrame,
                                mozilla::WidgetGUIEvent* aEvent,
                                bool aDontRetargetEvents,
                                nsEventStatus* aEventStatus) MOZ_OVERRIDE;
-  virtual NS_HIDDEN_(nsresult) HandleDOMEventWithTarget(
+  virtual nsresult HandleDOMEventWithTarget(
                                  nsIContent* aTargetContent,
                                  mozilla::WidgetEvent* aEvent,
                                  nsEventStatus* aStatus) MOZ_OVERRIDE;
-  virtual NS_HIDDEN_(nsresult) HandleDOMEventWithTarget(nsIContent* aTargetContent,
+  virtual nsresult HandleDOMEventWithTarget(nsIContent* aTargetContent,
                                                         nsIDOMEvent* aEvent,
                                                         nsEventStatus* aStatus) MOZ_OVERRIDE;
   virtual bool ShouldIgnoreInvalidation() MOZ_OVERRIDE;
   virtual void WillPaint() MOZ_OVERRIDE;
   virtual void WillPaintWindow() MOZ_OVERRIDE;
   virtual void DidPaintWindow() MOZ_OVERRIDE;
   virtual void ScheduleViewManagerFlush(PaintType aType = PAINT_DEFAULT) MOZ_OVERRIDE;
   virtual void DispatchSynthMouseMove(mozilla::WidgetGUIEvent* aEvent,
                                       bool aFlushOnHoverChange) MOZ_OVERRIDE;
   virtual void ClearMouseCaptureOnView(nsView* aView) MOZ_OVERRIDE;
   virtual bool IsVisible() MOZ_OVERRIDE;
 
   // caret handling
-  virtual NS_HIDDEN_(already_AddRefed<nsCaret>) GetCaret() const MOZ_OVERRIDE;
-  virtual NS_HIDDEN_(void) MaybeInvalidateCaretPosition() MOZ_OVERRIDE;
+  virtual already_AddRefed<nsCaret> GetCaret() const MOZ_OVERRIDE;
+  virtual void MaybeInvalidateCaretPosition() MOZ_OVERRIDE;
   NS_IMETHOD SetCaretEnabled(bool aInEnable) MOZ_OVERRIDE;
   NS_IMETHOD SetCaretReadOnly(bool aReadOnly) MOZ_OVERRIDE;
   NS_IMETHOD GetCaretEnabled(bool *aOutEnabled) MOZ_OVERRIDE;
   NS_IMETHOD SetCaretVisibilityDuringSelection(bool aVisibility) MOZ_OVERRIDE;
   NS_IMETHOD GetCaretVisible(bool *_retval) MOZ_OVERRIDE;
   virtual void SetCaret(nsCaret *aNewCaret) MOZ_OVERRIDE;
   virtual void RestoreCaret() MOZ_OVERRIDE;
 
@@ -262,41 +262,41 @@ public:
   NS_DECL_NSIMUTATIONOBSERVER_ATTRIBUTECHANGED
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTAPPENDED
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTINSERTED
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTREMOVED
 
   NS_DECL_NSIOBSERVER
 
 #ifdef MOZ_REFLOW_PERF
-  virtual NS_HIDDEN_(void) DumpReflows() MOZ_OVERRIDE;
-  virtual NS_HIDDEN_(void) CountReflows(const char * aName, nsIFrame * aFrame) MOZ_OVERRIDE;
-  virtual NS_HIDDEN_(void) PaintCount(const char * aName,
+  virtual void DumpReflows() MOZ_OVERRIDE;
+  virtual void CountReflows(const char * aName, nsIFrame * aFrame) MOZ_OVERRIDE;
+  virtual void PaintCount(const char * aName,
                                       nsRenderingContext* aRenderingContext,
                                       nsPresContext* aPresContext,
                                       nsIFrame * aFrame,
                                       const nsPoint& aOffset,
                                       uint32_t aColor) MOZ_OVERRIDE;
-  virtual NS_HIDDEN_(void) SetPaintFrameCount(bool aOn) MOZ_OVERRIDE;
+  virtual void SetPaintFrameCount(bool aOn) MOZ_OVERRIDE;
   virtual bool IsPaintingFrameCounts() MOZ_OVERRIDE;
 #endif
 
 #ifdef DEBUG
   virtual void ListStyleContexts(nsIFrame *aRootFrame, FILE *out,
                                  int32_t aIndent = 0) MOZ_OVERRIDE;
 
   virtual void ListStyleSheets(FILE *out, int32_t aIndent = 0) MOZ_OVERRIDE;
   virtual void VerifyStyleTree() MOZ_OVERRIDE;
 #endif
 
 #ifdef PR_LOGGING
   static PRLogModuleInfo* gLog;
 #endif
 
-  virtual NS_HIDDEN_(void) DisableNonTestMouseEvents(bool aDisable) MOZ_OVERRIDE;
+  virtual void DisableNonTestMouseEvents(bool aDisable) MOZ_OVERRIDE;
 
   virtual void UpdateCanvasBackground() MOZ_OVERRIDE;
 
   virtual void AddCanvasBackgroundColorItem(nsDisplayListBuilder& aBuilder,
                                             nsDisplayList& aList,
                                             nsIFrame* aFrame,
                                             const nsRect& aBounds,
                                             nscolor aBackstopColor,
@@ -304,17 +304,17 @@ public:
 
   virtual void AddPrintPreviewBackgroundItem(nsDisplayListBuilder& aBuilder,
                                              nsDisplayList& aList,
                                              nsIFrame* aFrame,
                                              const nsRect& aBounds) MOZ_OVERRIDE;
 
   virtual nscolor ComputeBackstopColor(nsView* aDisplayRoot) MOZ_OVERRIDE;
 
-  virtual NS_HIDDEN_(nsresult) SetIsActive(bool aIsActive) MOZ_OVERRIDE;
+  virtual nsresult SetIsActive(bool aIsActive) MOZ_OVERRIDE;
 
   virtual bool GetIsViewportOverridden() MOZ_OVERRIDE { return mViewportOverridden; }
 
   virtual bool IsLayoutFlushObserver() MOZ_OVERRIDE
   {
     return GetPresContext()->RefreshDriver()->
       IsLayoutFlushObserver(this);
   }
--- a/layout/base/nsStyleSheetService.h
+++ b/layout/base/nsStyleSheetService.h
@@ -27,45 +27,45 @@ class nsIStyleSheet;
 #define NS_STYLESHEETSERVICE_CONTRACTID \
   "@mozilla.org/content/style-sheet-service;1"
 
 class nsStyleSheetService MOZ_FINAL
   : public nsIStyleSheetService
   , public nsIMemoryReporter
 {
  public:
-  nsStyleSheetService() NS_HIDDEN;
-  ~nsStyleSheetService() NS_HIDDEN;
+  nsStyleSheetService();
+  ~nsStyleSheetService();
 
   NS_DECL_ISUPPORTS
   NS_DECL_NSISTYLESHEETSERVICE
   NS_DECL_NSIMEMORYREPORTER
 
-  NS_HIDDEN_(nsresult) Init();
+  nsresult Init();
 
   nsCOMArray<nsIStyleSheet>* AgentStyleSheets() { return &mSheets[AGENT_SHEET]; }
   nsCOMArray<nsIStyleSheet>* UserStyleSheets() { return &mSheets[USER_SHEET]; }
   nsCOMArray<nsIStyleSheet>* AuthorStyleSheets() { return &mSheets[AUTHOR_SHEET]; }
 
   size_t SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf) const;
 
   static nsStyleSheetService *GetInstance();
   static nsStyleSheetService *gInstance;
 
  private:
 
-  NS_HIDDEN_(void) RegisterFromEnumerator(nsICategoryManager  *aManager,
+  void RegisterFromEnumerator(nsICategoryManager  *aManager,
                                           const char          *aCategory,
                                           nsISimpleEnumerator *aEnumerator,
                                           uint32_t             aSheetType);
 
-  NS_HIDDEN_(int32_t) FindSheetByURI(const nsCOMArray<nsIStyleSheet> &sheets,
+  int32_t FindSheetByURI(const nsCOMArray<nsIStyleSheet> &sheets,
                                      nsIURI *sheetURI);
 
   // Like LoadAndRegisterSheet, but doesn't notify.  If successful, the
   // new sheet will be the last sheet in mSheets[aSheetType].
-  NS_HIDDEN_(nsresult) LoadAndRegisterSheetInternal(nsIURI *aSheetURI,
+  nsresult LoadAndRegisterSheetInternal(nsIURI *aSheetURI,
                                                     uint32_t aSheetType);
 
   nsCOMArray<nsIStyleSheet> mSheets[3];
 };
 
 #endif
--- a/layout/forms/nsFieldSetFrame.h
+++ b/layout/forms/nsFieldSetFrame.h
@@ -11,17 +11,17 @@
 
 class nsFieldSetFrame MOZ_FINAL : public nsContainerFrame
 {
 public:
   NS_DECL_FRAMEARENA_HELPERS
 
   nsFieldSetFrame(nsStyleContext* aContext);
 
-  NS_HIDDEN_(nscoord)
+  nscoord
     GetIntrinsicWidth(nsRenderingContext* aRenderingContext,
                       nsLayoutUtils::IntrinsicWidthType);
   virtual nscoord GetMinWidth(nsRenderingContext* aRenderingContext) MOZ_OVERRIDE;
   virtual nscoord GetPrefWidth(nsRenderingContext* aRenderingContext) MOZ_OVERRIDE;
   virtual nsSize ComputeSize(nsRenderingContext *aRenderingContext,
                              nsSize aCBSize, nscoord aAvailableWidth,
                              nsSize aMargin, nsSize aBorder, nsSize aPadding,
                              uint32_t aFlags) MOZ_OVERRIDE;
--- a/layout/generic/nsIFrame.h
+++ b/layout/generic/nsIFrame.h
@@ -2648,35 +2648,35 @@ NS_PTR_TO_INT32(frame->Properties().Get(
   virtual bool IsCollapsed() = 0;
   // This does not alter the overflow area. If the caller is changing
   // the box size, the caller is responsible for updating the overflow
   // area. It's enough to just call Layout or SyncLayout on the
   // box. You can pass true to aRemoveOverflowArea as a
   // convenience.
   virtual void SetBounds(nsBoxLayoutState& aBoxLayoutState, const nsRect& aRect,
                          bool aRemoveOverflowAreas = false) = 0;
-  NS_HIDDEN_(nsresult) Layout(nsBoxLayoutState& aBoxLayoutState);
+  nsresult Layout(nsBoxLayoutState& aBoxLayoutState);
   // Box methods.  Note that these do NOT just get the CSS border, padding,
   // etc.  They also talk to nsITheme.
   virtual nsresult GetBorderAndPadding(nsMargin& aBorderAndPadding);
   virtual nsresult GetBorder(nsMargin& aBorder)=0;
   virtual nsresult GetPadding(nsMargin& aBorderAndPadding)=0;
   virtual nsresult GetMargin(nsMargin& aMargin)=0;
   virtual void SetLayoutManager(nsBoxLayout* aLayout) { }
   virtual nsBoxLayout* GetLayoutManager() { return nullptr; }
-  NS_HIDDEN_(nsresult) GetClientRect(nsRect& aContentRect);
+  nsresult GetClientRect(nsRect& aContentRect);
 
   // For nsSprocketLayout
   virtual Valignment GetVAlign() const = 0;
   virtual Halignment GetHAlign() const = 0;
 
   bool IsHorizontal() const { return (mState & NS_STATE_IS_HORIZONTAL) != 0; }
   bool IsNormalDirection() const { return (mState & NS_STATE_IS_DIRECTION_NORMAL) != 0; }
 
-  NS_HIDDEN_(nsresult) Redraw(nsBoxLayoutState& aState);
+  nsresult Redraw(nsBoxLayoutState& aState);
   virtual nsresult RelayoutChildAtOrdinal(nsBoxLayoutState& aState, nsIFrame* aChild)=0;
   // XXX take this out after we've branched
   virtual bool GetMouseThrough() const { return false; }
 
 #ifdef DEBUG_LAYOUT
   virtual nsresult SetDebug(nsBoxLayoutState& aState, bool aDebug)=0;
   virtual nsresult GetDebug(bool& aDebug)=0;
 
--- a/layout/generic/nsTextRunTransformations.cpp
+++ b/layout/generic/nsTextRunTransformations.cpp
@@ -271,16 +271,18 @@ nsCaseTransformTextRunFactory::Transform
 
   uint32_t length = aString.Length();
   const char16_t* str = aString.BeginReading();
 
   bool mergeNeeded = false;
 
   bool capitalizeDutchIJ = false;
   bool prevIsLetter = false;
+  bool ntPrefix = false; // true immediately after a word-initial 'n' or 't'
+                         // when doing Irish lowercasing
   uint32_t sigmaIndex = uint32_t(-1);
   nsIUGenCategory::nsUGenCategory cat;
 
   uint8_t style = aAllUppercase ? NS_STYLE_TEXT_TRANSFORM_UPPERCASE : 0;
   const nsIAtom* lang = aLanguage;
 
   LanguageSpecificCasingBehavior languageSpecificCasing = GetCasingFor(lang);
   mozilla::GreekCasing::State greekState;
@@ -326,16 +328,34 @@ nsCaseTransformTextRunFactory::Transform
         if (ch == LATIN_CAPITAL_LETTER_I_WITH_DOT_ABOVE) {
           ch = 'i';
           prevIsLetter = true;
           sigmaIndex = uint32_t(-1);
           break;
         }
       }
 
+      cat = mozilla::unicode::GetGenCategory(ch);
+
+      if (languageSpecificCasing == eLSCB_Irish &&
+          cat == nsIUGenCategory::kLetter) {
+        // See bug 1018805 for Irish lowercasing requirements
+        if (!prevIsLetter && (ch == 'n' || ch == 't')) {
+          ntPrefix = true;
+        } else {
+          if (ntPrefix && mozilla::IrishCasing::IsUpperVowel(ch)) {
+            aConvertedString.Append('-');
+            ++extraChars;
+          }
+          ntPrefix = false;
+        }
+      } else {
+        ntPrefix = false;
+      }
+
       // Special lowercasing behavior for Greek Sigma: note that this is listed
       // as context-sensitive in Unicode's SpecialCasing.txt, but is *not* a
       // language-specific mapping; it applies regardless of the language of
       // the element.
       //
       // The lowercase mapping for CAPITAL SIGMA should be to SMALL SIGMA (i.e.
       // the non-final form) whenever there is a following letter, or when the
       // CAPITAL SIGMA occurs in isolation (neither preceded nor followed by a
@@ -344,18 +364,16 @@ nsCaseTransformTextRunFactory::Transform
       //
       // To implement the context-sensitive nature of this mapping, we keep
       // track of whether the previous character was a letter. If not, CAPITAL
       // SIGMA will map directly to SMALL SIGMA. If the previous character
       // was a letter, CAPITAL SIGMA maps to FINAL SIGMA and we record the
       // position in the converted string; if we then encounter another letter,
       // that FINAL SIGMA is replaced with a standard SMALL SIGMA.
 
-      cat = mozilla::unicode::GetGenCategory(ch);
-
       // If sigmaIndex is not -1, it marks where we have provisionally mapped
       // a CAPITAL SIGMA to FINAL SIGMA; if we now find another letter, we
       // need to change it to SMALL SIGMA.
       if (sigmaIndex != uint32_t(-1)) {
         if (cat == nsIUGenCategory::kLetter) {
           aConvertedString.SetCharAt(GREEK_SMALL_LETTER_SIGMA, sigmaIndex);
         }
       }
new file mode 100644
--- /dev/null
+++ b/layout/reftests/text-transform/irish-lowercase-1-ref.html
@@ -0,0 +1,226 @@
+<!DOCTYPE html>
+<html lang="ga-IE">
+<head>
+<meta charset="utf-8">
+<title>Test for Irish lowercasing</title>
+<style>
+body {
+  font: 16px/20px monospace;
+  text-transform: none;
+}
+</style>
+</head>
+<body>
+  ár n-acmhainní uisce
+/ ár n-acmhainní uisce
+/ ár n-acmhainní uisce
+/ ár n-acmhainní uisce
+/ ár n-acmhainní uisce
+/ ár nathair
+/ ár nathair
+/ ár nathair
+/ n-a shaighdiúir
+/ gan dul as aca ach le n-a chabhair
+/ eolaíocht na n-ábhar
+/ eolaíocht na n-ábhar
+/ eolaíocht na n-ábhar
+/ eolaíocht na n-ábhar
+/ eolaíocht na n-ábhar
+/ amhrán náisiúnta
+/ amhrán náisiúnta
+/ amhrán náisiúnta
+/ lucht na n-ealaíon
+/ lucht na n-ealaíon
+/ lucht na n-ealaíon
+/ lucht na n-ealaíon
+/ lucht na n-ealaíon
+/ neart daoine
+/ neart daoine
+/ neart daoine
+/ ceol na n-éan
+/ ceol na n-éan
+/ ceol na n-éan
+/ ceol na n-éan
+/ ceol na n-éan
+/ sa néal
+/ sa néal
+/ sa néal
+/ ord na n-imeachtaí
+/ ord na n-imeachtaí
+/ ord na n-imeachtaí
+/ ord na n-imeachtaí
+/ ord na n-imeachtaí
+/ nathair nimhe
+/ nathair nimhe
+/ nathair nimhe
+/ lucht adhartha na n-íomhánna
+/ lucht adhartha na n-íomhánna
+/ lucht adhartha na n-íomhánna
+/ lucht adhartha na n-íomhánna
+/ lucht adhartha na n-íomhánna
+/ níos measa
+/ níos measa
+/ níos measa
+/ gnéithe dár n-oidhreacht
+/ gnéithe dár n-oidhreacht
+/ gnéithe dár n-oidhreacht
+/ gnéithe dár n-oidhreacht
+/ gnéithe dár n-oidhreacht
+/ duine nochta
+/ duine nochta
+/ duine nochta
+/ cultúr na n-óg
+/ cultúr na n-óg
+/ cultúr na n-óg
+/ cultúr na n-óg
+/ cultúr na n-óg
+/ dhá nóiméad
+/ dhá nóiméad
+/ dhá nóiméad
+/ ocht n-uaire sa lá
+/ ocht n-uaire sa lá
+/ ocht n-uaire sa lá
+/ ocht n-uaire sa lá
+/ ocht n-uaire sa lá
+/ gúna nua
+/ gúna nua
+/ gúna nua
+/ formhór na n-údarás
+/ formhór na n-údarás
+/ formhór na n-údarás
+/ formhór na n-údarás
+/ formhór na n-údarás
+/ imoibreoir núicléach
+/ imoibreoir núicléach
+/ imoibreoir núicléach
+/ sean-airteagal
+/ seanairteagal
+/ bunioncaim
+/ bun-ioncaim
+/ buanorduithe
+/ buan-orduithe
+/ ár n-athair
+/ ár n-athair
+/ clár na n-ábhar
+/ clár na n-ábhar
+/ ceol na ndaoine
+/ ceol na ndaoine
+/ táim i ngrá leat
+/ táim i ngrá leat
+/ cén t-am é?
+/ cén t-am é?
+/ cén t-am é?
+/ cén t-am é?
+/ cén t-am é?
+/ tar ar ais!
+/ tar ar ais!
+/ tá an t-ádh orm inniu!
+/ tá an t-ádh orm inniu!
+/ tá an t-ádh orm inniu!
+/ tá an t-ádh orm inniu!
+/ tá an t-ádh orm inniu!
+/ rud tábhachtach
+/ rud tábhachtach
+/ rud tábhachtach
+/ den obair an t-eolas
+/ den obair an t-eolas
+/ den obair an t-eolas
+/ den obair an t-eolas
+/ den obair an t-eolas
+/ an t-éileamh a íoc
+/ an t-éileamh a íoc
+/ an t-éileamh a íoc
+/ an t-éileamh a íoc
+/ an t-éileamh a íoc
+/ an t-inneall cuardaigh is fearr
+/ an t-inneall cuardaigh is fearr
+/ an t-inneall cuardaigh is fearr
+/ an t-inneall cuardaigh is fearr
+/ an t-inneall cuardaigh is fearr
+/ an t-íochtar a chur in uachtar
+/ an t-íochtar a chur in uachtar
+/ an t-íochtar a chur in uachtar
+/ an t-íochtar a chur in uachtar
+/ an t-íochtar a chur in uachtar
+/ tabhair an t-ordú seo dó!
+/ tabhair an t-ordú seo dó!
+/ tabhair an t-ordú seo dó!
+/ tabhair an t-ordú seo dó!
+/ tabhair an t-ordú seo dó!
+/ tá an t-ór buí aige.
+/ tá an t-ór buí aige.
+/ tá an t-ór buí aige.
+/ tá an t-ór buí aige.
+/ tá an t-ór buí aige.
+/ an t-uisce beatha ar an tábla.
+/ an t-uisce beatha ar an tábla.
+/ an t-uisce beatha ar an tábla.
+/ an t-uisce beatha ar an tábla.
+/ an t-uisce beatha ar an tábla.
+/ an t-úrscéal is deireanaí
+/ an t-úrscéal is deireanaí
+/ an t-úrscéal is deireanaí
+/ an t-úrscéal is deireanaí
+/ an t-úrscéal is deireanaí
+/ dréacht-acht
+/ dréachtphlean
+/ dréacht-phlean
+/ dréacht-íocaíocht
+/ áitainmneacha
+/ áit-ainmneacha
+/ státurraithe
+/ stát-urraithe
+/ ar aon tslí
+/ ar aon tslí
+/ amach ón tsnáthaid
+/ amach ón tsnáthaid
+/ ar an tsráid
+/ ar an tsráid
+/ caint an tsráidbhaile
+/ caint an tsráidbhaile
+/ cora crua an tsaoil
+/ cora crua an tsaoil
+/ bholadh an tsáile
+/ bholadh an tsáile
+/ uair sa tseachtain
+/ uair sa tseachtain
+/ deireadh an tséasúir
+/ deireadh an tséasúir
+/ fear an tsiopa
+/ fear an tsiopa
+/ an tsíocháin a choimeád
+/ an tsíocháin a choimeád
+/ an tsochaí faisnéise
+/ an tsochaí faisnéise
+/ gaoth an tsóláis
+/ gaoth an tsóláis
+/ is beag an tsuim iad
+/ is beag an tsuim iad
+/ infheicthe ag an tsúil
+/ infheicthe ag an tsúil
+/ scríobhfaidh
+/ scríobhfaidh
+/ preabphas
+/ preabphas
+/ úsáidtear
+/ úsáidtear
+/ snagcheol
+/ snagcheol
+/ in-athnuaite agatsa
+/ in-athnuaite agatsa
+/ teanga dhomhanda
+/ teanga dhomhanda
+/ réaltsruth
+/ réaltsruth
+/ na hataí
+/ na hataí
+/ t-léine
+/ t-léine
+/ t-léine
+/ t-léine
+/ torc allta
+/ torc allta
+/ tsk tsk tsk a chara
+/ tsk tsk tsk a chara
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/reftests/text-transform/irish-lowercase-1.html
@@ -0,0 +1,226 @@
+<!DOCTYPE html>
+<html lang="ga-IE">
+<head>
+<meta charset="utf-8">
+<title>Test for Irish lowercasing</title>
+<style>
+body {
+  font: 16px/20px monospace;
+  text-transform: lowercase;
+}
+</style>
+</head>
+<body>
+  ÁR nACMHAINNÍ UISCE
+/ ÁR N-ACMHAINNÍ UISCE
+/ Ár nAcmhainní Uisce
+/ Ár n-Acmhainní Uisce
+/ ár n-acmhainní uisce
+/ Ár nathair
+/ ÁR NATHAIR
+/ Ár Nathair
+/ N-a shaighdiúir
+/ gan dul as aca ach le nA chabhair
+/ EOLAÍOCHT NA nÁBHAR
+/ EOLAÍOCHT NA n-ÁBHAR
+/ Eolaíocht na nÁbhar
+/ Eolaíocht na n-Ábhar
+/ eolaíocht na n-ábhar
+/ Amhrán náisiúnta
+/ Amhrán Náisiúnta
+/ AMHRÁN NÁISIÚNTA
+/ LUCHT NA nEALAÍON
+/ LUCHT NA n-EALAÍON
+/ Lucht na nEalaíon
+/ Lucht na n-Ealaíon
+/ lucht na n-ealaíon
+/ Neart Daoine
+/ neart daoine
+/ NEART DAOINE
+/ CEOL NA nÉAN
+/ CEOL NA n-ÉAN
+/ Ceol na nÉan
+/ Ceol na n-Éan
+/ ceol na n-éan
+/ Sa Néal
+/ Sa néal
+/ SA NÉAL
+/ ORD NA nIMEACHTAÍ
+/ ORD NA n-IMEACHTAÍ
+/ Ord na nImeachtaí
+/ Ord na n-Imeachtaí
+/ ord na n-imeachtaí
+/ Nathair Nimhe
+/ Nathair nimhe
+/ NATHAIR NIMHE
+/ LUCHT ADHARTHA NA nÍOMHÁNNA
+/ LUCHT ADHARTHA NA n-ÍOMHÁNNA
+/ Lucht Adhartha na nÍomhánna
+/ Lucht Adhartha na n-Íomhánna
+/ lucht adhartha na n-íomhánna
+/ Níos Measa
+/ níos measa
+/ NÍOS MEASA
+/ GNÉITHE DÁR nOIDHREACHT
+/ GNÉITHE DÁR n-OIDHREACHT
+/ Gnéithe Dár nOidhreacht
+/ Gnéithe Dár n-Oidhreacht
+/ gnéithe dár n-oidhreacht
+/ Duine Nochta
+/ Duine nochta
+/ DUINE NOCHTA
+/ CULTÚR NA nÓG
+/ CULTÚR NA n-ÓG
+/ Cultúr na nÓg
+/ Cultúr na n-Óg
+/ cultúr na n-óg
+/ Dhá Nóiméad
+/ Dhá nóiméad
+/ DHÁ NÓIMÉAD
+/ OCHT nUAIRE SA LÁ
+/ OCHT n-UAIRE SA LÁ
+/ Ocht nUaire Sa Lá
+/ Ocht n-Uaire Sa Lá
+/ ocht n-uaire sa lá
+/ Gúna Nua
+/ gúna nua
+/ GÚNA NUA
+/ FORMHÓR NA nÚDARÁS
+/ FORMHÓR NA n-ÚDARÁS
+/ Formhór na nÚdarás
+/ Formhór na n-Údarás
+/ formhór na n-údarás
+/ Imoibreoir Núicléach
+/ Imoibreoir núicléach
+/ IMOIBREOIR NÚICLÉACH
+/ sean-Airteagal
+/ SeanAirteagal
+/ BunIoncaim
+/ Bun-Ioncaim
+/ BuanOrduithe
+/ Buan-Orduithe
+/ ÁR nATHAIR
+/ Ár nAthair
+/ CLÁR NA nÁBHAR
+/ Clár na nÁbhar
+/ CEOL NA nDAOINE
+/ Ceol na nDaoine
+/ TÁIM I nGRÁ LEAT
+/ Táim i nGrá Leat
+/ CÉN tAM É?
+/ CÉN t-AM É?
+/ Cén tAm É?
+/ Cén t-Am É?
+/ cén t-am é?
+/ Tar Ar Ais!
+/ tar ar ais!
+/ TÁ AN tÁDH ORM INNIU!
+/ TÁ AN t-ÁDH ORM INNIU!
+/ Tá An tÁdh Orm Inniu!
+/ Tá An t-Ádh Orm Inniu!
+/ tá an t-ádh orm inniu!
+/ Rud Tábhachtach
+/ Rud tábhachtach
+/ rud tábhachtach
+/ DEN OBAIR AN tEOLAS
+/ DEN OBAIR AN t-EOLAS
+/ Den Obair an tEolas
+/ Den Obair an t-Eolas
+/ den obair an t-eolas
+/ AN tÉILEAMH A ÍOC
+/ AN t-ÉILEAMH A ÍOC
+/ An tÉileamh a Íoc
+/ An t-Éileamh a Íoc
+/ an t-éileamh a íoc
+/ AN tINNEALL CUARDAIGH IS FEARR
+/ AN t-INNEALL CUARDAIGH IS FEARR
+/ An tInneall Cuardaigh Is Fearr
+/ An t-Inneall Cuardaigh Is Fearr
+/ an t-inneall cuardaigh is fearr
+/ AN tÍOCHTAR A CHUR IN UACHTAR
+/ AN t-ÍOCHTAR A CHUR IN UACHTAR
+/ An tÍochtar a Chur In Uachtar
+/ An t-Íochtar a Chur In Uachtar
+/ an t-íochtar a chur in uachtar
+/ TABHAIR AN tORDÚ SEO DÓ!
+/ TABHAIR AN t-ORDÚ SEO DÓ!
+/ Tabhair An tOrdú Seo Dó!
+/ Tabhair An t-Ordú Seo Dó!
+/ tabhair an t-ordú seo dó!
+/ TÁ AN tÓR BUÍ AIGE.
+/ TÁ AN t-ÓR BUÍ AIGE.
+/ Tá An tÓr Buí Aige.
+/ Tá An t-Ór Buí Aige.
+/ tá an t-ór buí aige.
+/ AN tUISCE BEATHA AR AN TÁBLA.
+/ AN t-UISCE BEATHA AR AN TÁBLA.
+/ An tUisce Beatha Ar An Tábla.
+/ An t-Uisce Beatha Ar An Tábla.
+/ an t-uisce beatha ar an tábla.
+/ AN tÚRSCÉAL IS DEIREANAÍ
+/ AN t-ÚRSCÉAL IS DEIREANAÍ
+/ An tÚrscéal Is Deireanaí
+/ An t-Úrscéal Is Deireanaí
+/ an t-úrscéal is deireanaí
+/ Dréacht-Acht
+/ DréachtPhlean
+/ Dréacht-Phlean
+/ Dréacht-Íocaíocht
+/ ÁitAinmneacha
+/ Áit-Ainmneacha
+/ StátUrraithe
+/ Stát-Urraithe
+/ AR AON tSLÍ
+/ Ar Aon tSlí
+/ AMACH ÓN tSNÁTHAID
+/ Amach Ón tSnáthaid
+/ AR AN tSRÁID
+/ Ar An tSráid
+/ CAINT AN tSRÁIDBHAILE
+/ Caint An tSráidbhaile
+/ CORA CRUA AN tSAOIL
+/ Cora Crua An tSaoil
+/ BHOLADH AN tSÁILE
+/ Bholadh An tSáile
+/ UAIR SA tSEACHTAIN
+/ Uair Sa tSeachtain
+/ DEIREADH AN tSÉASÚIR
+/ Deireadh An tSéasúir
+/ FEAR AN tSIOPA
+/ Fear an tSiopa
+/ AN tSÍOCHÁIN A CHOIMEÁD
+/ An tSíocháin a Choimeád
+/ AN tSOCHAÍ FAISNÉISE
+/ An tSochaí Faisnéise
+/ GAOTH AN tSÓLÁIS
+/ Gaoth aN tSóláis
+/ IS BEAG AN tSUIM IAD
+/ Is Beag An tSuim Iad
+/ INFHEICTHE AG AN tSÚIL
+/ Infheicthe Ag An tSúil
+/ SCRÍOBHFAIDH
+/ Scríobhfaidh
+/ PREABPHAS
+/ Preabphas
+/ ÚSÁIDTEAR
+/ Úsáidtear
+/ SNAGCHEOL
+/ Snagcheol
+/ IN-ATHNUAITE AGATSA
+/ In-Athnuaite AGATSA
+/ TEANGA DHOMHANDA
+/ Teanga Dhomhanda
+/ RÉALTSRUTH
+/ Réaltsruth
+/ NA HATAÍ
+/ Na Hataí
+/ T-LÉINE
+/ T-Léine
+/ t-Léine
+/ t-léine
+/ TORC ALLTA
+/ Torc Allta
+/ TSK TSK TSK A CHARA
+/ Tsk Tsk Tsk a Chara
+</body>
+</html>
--- a/layout/reftests/text-transform/reftest.list
+++ b/layout/reftests/text-transform/reftest.list
@@ -24,11 +24,12 @@ skip-if(B2G) HTTP(..) == all-title.html 
 == smtp-lower.html smtp-lower-ref.html
 == smtp-title.html smtp-title-ref.html
 == turkish-casing-1.html turkish-casing-1-ref.html
 HTTP(..) != small-caps-turkish-1.html small-caps-turkish-1-notref.html
 == greek-uppercase-1.html greek-uppercase-1-ref.html
 == greek-uppercase-2.html greek-uppercase-2-ref.html
 HTTP(..) == greek-small-caps-1.html greek-small-caps-1-ref.html
 == irish-uppercase-1.html irish-uppercase-1-ref.html
+== irish-lowercase-1.html irish-lowercase-1-ref.html
 == fullwidth-1.html fullwidth-1-ref.html
 == fullwidth-2.html fullwidth-2-ref.html
 == fullwidth-all.html fullwidth-all-ref.html
--- a/layout/xul/nsBox.h
+++ b/layout/xul/nsBox.h
@@ -42,30 +42,30 @@ public:
   virtual nsresult RelayoutChildAtOrdinal(nsBoxLayoutState& aState, nsIFrame* aChild) MOZ_OVERRIDE;
 
 #ifdef DEBUG_LAYOUT
   NS_IMETHOD GetDebugBoxAt(const nsPoint& aPoint, nsIFrame** aBox);
   virtual nsresult GetDebug(bool& aDebug) MOZ_OVERRIDE;
   virtual nsresult SetDebug(nsBoxLayoutState& aState, bool aDebug) MOZ_OVERRIDE;
 
   virtual nsresult DumpBox(FILE* out) MOZ_OVERRIDE;
-  NS_HIDDEN_(void) PropagateDebug(nsBoxLayoutState& aState);
+  void PropagateDebug(nsBoxLayoutState& aState);
 #endif
 
   nsBox();
   virtual ~nsBox();
 
   /**
    * Returns true if this box clips its children, e.g., if this box is an sc
 rollbox.
   */
   virtual bool DoesClipChildren();
   virtual bool ComputesOwnOverflowArea() = 0;
 
-  NS_HIDDEN_(nsresult) SyncLayout(nsBoxLayoutState& aBoxLayoutState);
+  nsresult SyncLayout(nsBoxLayoutState& aBoxLayoutState);
 
   bool DoesNeedRecalc(const nsSize& aSize);
   bool DoesNeedRecalc(nscoord aCoord);
   void SizeNeedsRecalc(nsSize& aSize);
   void CoordNeedsRecalc(nscoord& aCoord);
 
   void AddBorderAndPadding(nsSize& aSize);
 
@@ -86,23 +86,23 @@ protected:
 #ifdef DEBUG_LAYOUT
   virtual void AppendAttribute(const nsAutoString& aAttribute, const nsAutoString& aValue, nsAutoString& aResult);
 
   virtual void ListBox(nsAutoString& aResult);
 #endif
   
   virtual void GetLayoutFlags(uint32_t& aFlags);
 
-  NS_HIDDEN_(nsresult) BeginLayout(nsBoxLayoutState& aState);
+  nsresult BeginLayout(nsBoxLayoutState& aState);
   NS_IMETHOD DoLayout(nsBoxLayoutState& aBoxLayoutState);
-  NS_HIDDEN_(nsresult) EndLayout(nsBoxLayoutState& aState);
+  nsresult EndLayout(nsBoxLayoutState& aState);
 
 #ifdef DEBUG_LAYOUT
   virtual void GetBoxName(nsAutoString& aName);
-  NS_HIDDEN_(void) PropagateDebug(nsBoxLayoutState& aState);
+  void PropagateDebug(nsBoxLayoutState& aState);
 #endif
 
   static bool gGotTheme;
   static nsITheme* gTheme;
 
   enum eMouseThrough {
     unset,
     never,
--- a/layout/xul/nsBoxFrame.h
+++ b/layout/xul/nsBoxFrame.h
@@ -200,17 +200,17 @@ protected:
     bool GetEventPoint(mozilla::WidgetGUIEvent* aEvent, nsPoint& aPoint);
     // Gets the event coordinates relative to the widget offset associated with
     // this frame. Return true if a single valid point was found.
     bool GetEventPoint(mozilla::WidgetGUIEvent* aEvent, nsIntPoint& aPoint);
 
 protected:
     void RegUnregAccessKey(bool aDoReg);
 
-  NS_HIDDEN_(void) CheckBoxOrder();
+  void CheckBoxOrder();
 
 private: 
 
 #ifdef DEBUG_LAYOUT
     nsresult SetDebug(nsPresContext* aPresContext, bool aDebug);
     bool GetInitialDebug(bool& aDebug);
     void GetDebugPref(nsPresContext* aPresContext);
 
--- a/layout/xul/nsBoxLayoutState.h
+++ b/layout/xul/nsBoxLayoutState.h
@@ -26,18 +26,18 @@ class nsHTMLReflowCommand;
 
 class MOZ_STACK_CLASS nsBoxLayoutState
 {
 public:
   nsBoxLayoutState(nsPresContext* aPresContext,
                    nsRenderingContext* aRenderingContext = nullptr,
                    // see OuterReflowState() below
                    const nsHTMLReflowState* aOuterReflowState = nullptr,
-                   uint16_t aReflowDepth = 0) NS_HIDDEN;
-  nsBoxLayoutState(const nsBoxLayoutState& aState) NS_HIDDEN;
+                   uint16_t aReflowDepth = 0);
+  nsBoxLayoutState(const nsBoxLayoutState& aState);
 
   nsPresContext* PresContext() const { return mPresContext; }
   nsIPresShell* PresShell() const { return mPresContext->PresShell(); }
 
   uint32_t LayoutFlags() const { return mLayoutFlags; }
   void SetLayoutFlags(uint32_t aFlags) { mLayoutFlags = aFlags; }
 
   // if true no one under us will paint during reflow.
--- a/layout/xul/nsMenuFrame.h
+++ b/layout/xul/nsMenuFrame.h
@@ -261,17 +261,17 @@ protected:
   void CreateMenuCommandEvent(mozilla::WidgetGUIEvent* aEvent,
                               bool aFlipChecked);
   void PassMenuCommandEventToPopupManager();
 
 protected:
 #ifdef DEBUG_LAYOUT
   nsresult SetDebug(nsBoxLayoutState& aState, nsIFrame* aList, bool aDebug);
 #endif
-  NS_HIDDEN_(nsresult) Notify(nsITimer* aTimer);
+  nsresult Notify(nsITimer* aTimer);
 
   bool mIsMenu; // Whether or not we can even have children or not.
   bool mChecked;              // are we checked?
   bool mIgnoreAccelTextChange; // temporarily set while determining the accelerator key
   nsMenuType mType;
 
   // Reference to the mediator which wraps this frame.
   nsRefPtr<nsMenuTimerMediator> mTimerMediator;
--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
@@ -146,17 +146,17 @@ PRLogModuleInfo *signalingLogInfo() {
     logModuleInfo = PR_NewLogModule("signaling");
   }
   return logModuleInfo;
 }
 
 // XXX Workaround for bug 998092 to maintain the existing broken semantics
 template<>
 struct nsISupportsWeakReference::COMTypeInfo<nsSupportsWeakReference, void> {
-  static const nsIID kIID NS_HIDDEN;
+  static const nsIID kIID;
 };
 const nsIID nsISupportsWeakReference::COMTypeInfo<nsSupportsWeakReference, void>::kIID = NS_ISUPPORTSWEAKREFERENCE_IID;
 
 namespace sipcc {
 
 #ifdef MOZILLA_INTERNAL_API
 RTCStatsQuery::RTCStatsQuery(bool internal) :
   failed(false),
--- a/mobile/android/config/mozconfigs/common
+++ b/mobile/android/config/mozconfigs/common
@@ -31,16 +31,18 @@ fi
 ac_add_options --with-android-gnu-compiler-version=4.7
 ac_add_options --with-android-version=9
 ac_add_options --with-system-zlib
 ac_add_options --enable-update-channel=${MOZ_UPDATE_CHANNEL}
 
 # Treat warnings as errors in directories with FAIL_ON_WARNINGS.
 ac_add_options --enable-warnings-as-errors
 
+ac_add_options --with-mozilla-api-keyfile=/builds/mozilla-api.key
+
 # Package js shell.
 export MOZ_PACKAGE_JSSHELL=1
 
 # Use ccache
 . "$topsrcdir/build/mozconfig.cache"
 
 HOST_CC="/tools/gcc-4.7.2-0moz1/bin/gcc"
 HOST_CXX="/tools/gcc-4.7.2-0moz1/bin/g++"
--- a/modules/libjar/zipwriter/src/StreamFunctions.cpp
+++ b/modules/libjar/zipwriter/src/StreamFunctions.cpp
@@ -6,17 +6,17 @@
 #include "nscore.h"
 #include "nsIInputStream.h"
 #include "nsIOutputStream.h"
 
 /*
  * Fully reads the required amount of data. Keeps reading until all the
  * data is retrieved or an error is hit.
  */
-NS_HIDDEN_(nsresult) ZW_ReadData(nsIInputStream *aStream, char *aBuffer, uint32_t aCount)
+nsresult ZW_ReadData(nsIInputStream *aStream, char *aBuffer, uint32_t aCount)
 {
     while (aCount > 0) {
         uint32_t read;
         nsresult rv = aStream->Read(aBuffer, aCount, &read);
         NS_ENSURE_SUCCESS(rv, rv);
         aCount -= read;
         aBuffer += read;
         // If we hit EOF before reading the data we need then throw.
@@ -26,17 +26,17 @@ NS_HIDDEN_(nsresult) ZW_ReadData(nsIInpu
 
     return NS_OK;
 }
 
 /*
  * Fully writes the required amount of data. Keeps writing until all the
  * data is written or an error is hit.
  */
-NS_HIDDEN_(nsresult) ZW_WriteData(nsIOutputStream *aStream, const char *aBuffer,
+nsresult ZW_WriteData(nsIOutputStream *aStream, const char *aBuffer,
                                   uint32_t aCount)
 {
     while (aCount > 0) {
         uint32_t written;
         nsresult rv = aStream->Write(aBuffer, aCount, &written);
         NS_ENSURE_SUCCESS(rv, rv);
         if (written <= 0)
             return NS_ERROR_FAILURE;
--- a/modules/libjar/zipwriter/src/StreamFunctions.h
+++ b/modules/libjar/zipwriter/src/StreamFunctions.h
@@ -11,58 +11,58 @@
 #include "nsIOutputStream.h"
 
 /*
  * ZIP file data is stored little-endian. These are helper functions to read and
  * write little endian data to/from a char buffer.
  * The off argument, where present, is incremented according to the number of
  * bytes consumed from the buffer.
  */
-inline NS_HIDDEN_(void) WRITE8(uint8_t* buf, uint32_t* off, uint8_t val)
+inline void WRITE8(uint8_t* buf, uint32_t* off, uint8_t val)
 {
   buf[(*off)++] = val;
 }
 
-inline NS_HIDDEN_(void) WRITE16(uint8_t* buf, uint32_t* off, uint16_t val)
+inline void WRITE16(uint8_t* buf, uint32_t* off, uint16_t val)
 {
   WRITE8(buf, off, val & 0xff);
   WRITE8(buf, off, (val >> 8) & 0xff);
 }
 
-inline NS_HIDDEN_(void) WRITE32(uint8_t* buf, uint32_t* off, uint32_t val)
+inline void WRITE32(uint8_t* buf, uint32_t* off, uint32_t val)
 {
   WRITE16(buf, off, val & 0xffff);
   WRITE16(buf, off, (val >> 16) & 0xffff);
 }
 
-inline NS_HIDDEN_(uint8_t) READ8(const uint8_t* buf, uint32_t* off)
+inline uint8_t READ8(const uint8_t* buf, uint32_t* off)
 {
   return buf[(*off)++];
 }
 
-inline NS_HIDDEN_(uint16_t) READ16(const uint8_t* buf, uint32_t* off)
+inline uint16_t READ16(const uint8_t* buf, uint32_t* off)
 {
   uint16_t val = READ8(buf, off);
   val |= READ8(buf, off) << 8;
   return val;
 }
 
-inline NS_HIDDEN_(uint32_t) READ32(const uint8_t* buf, uint32_t* off)
+inline uint32_t READ32(const uint8_t* buf, uint32_t* off)
 {
   uint32_t val = READ16(buf, off);
   val |= READ16(buf, off) << 16;
   return val;
 }
 
-inline NS_HIDDEN_(uint32_t) PEEK32(const uint8_t* buf)
+inline uint32_t PEEK32(const uint8_t* buf)
 {
   return (uint32_t)( (buf [0]      ) |
                      (buf [1] <<  8) |
                      (buf [2] << 16) |
                      (buf [3] << 24) );
 }
 
-NS_HIDDEN_(nsresult) ZW_ReadData(nsIInputStream *aStream, char *aBuffer, uint32_t aCount);
+nsresult ZW_ReadData(nsIInputStream *aStream, char *aBuffer, uint32_t aCount);
 
-NS_HIDDEN_(nsresult) ZW_WriteData(nsIOutputStream *aStream, const char *aBuffer,
+nsresult ZW_WriteData(nsIOutputStream *aStream, const char *aBuffer,
                       uint32_t aCount);
 
 #endif
--- a/netwerk/base/public/nsNetStrings.h
+++ b/netwerk/base/public/nsNetStrings.h
@@ -13,12 +13,12 @@
  */
 class nsNetStrings {
 public:
   nsNetStrings();
 
   const nsLiteralString kChannelPolicy;
 };
 
-extern NS_HIDDEN_(nsNetStrings*) gNetStrings;
+extern nsNetStrings* gNetStrings;
 
 
 #endif
--- a/netwerk/base/public/nsNetUtil.h
+++ b/netwerk/base/public/nsNetUtil.h
@@ -2341,18 +2341,18 @@ NS_GenerateHostPort(const nsCString& hos
  * content type could not be sniffed.
  */
 inline void
 NS_SniffContent(const char* aSnifferType, nsIRequest* aRequest,
                 const uint8_t* aData, uint32_t aLength,
                 nsACString& aSniffedType)
 {
   typedef nsCategoryCache<nsIContentSniffer> ContentSnifferCache;
-  extern NS_HIDDEN_(ContentSnifferCache*) gNetSniffers;
-  extern NS_HIDDEN_(ContentSnifferCache*) gDataSniffers;
+  extern ContentSnifferCache* gNetSniffers;
+  extern ContentSnifferCache* gDataSniffers;
   ContentSnifferCache* cache = nullptr;
   if (!strcmp(aSnifferType, NS_CONTENT_SNIFFER_CATEGORY)) {
     if (!gNetSniffers) {
       gNetSniffers = new ContentSnifferCache(NS_CONTENT_SNIFFER_CATEGORY);
     }
     cache = gNetSniffers;
   } else if (!strcmp(aSnifferType, NS_DATA_SNIFFER_CATEGORY)) {
     if (!gDataSniffers) {
--- a/netwerk/base/src/nsIOService.h
+++ b/netwerk/base/src/nsIOService.h
@@ -51,18 +51,18 @@ public:
     NS_DECL_NSINETUTIL
     NS_DECL_NSISPECULATIVECONNECT
 
     // Gets the singleton instance of the IO Service, creating it as needed
     // Returns nullptr on out of memory or failure to initialize.
     // Returns an addrefed pointer.
     static nsIOService* GetInstance();
 
-    NS_HIDDEN_(nsresult) Init();
-    NS_HIDDEN_(nsresult) NewURI(const char* aSpec, nsIURI* aBaseURI,
+    nsresult Init();
+    nsresult NewURI(const char* aSpec, nsIURI* aBaseURI,
                                 nsIURI* *result,
                                 nsIProtocolHandler* *hdlrResult);
 
     // Called by channels before a redirect happens. This notifies the global
     // redirect observers.
     nsresult AsyncOnChannelRedirect(nsIChannel* oldChan, nsIChannel* newChan,
                                     uint32_t flags,
                                     nsAsyncRedirectVerifyHelper *helper);
@@ -73,32 +73,32 @@ public:
     bool IsComingOnline() const {
       return mOffline && mSettingOffline && !mSetOfflineValue;
     }
 
 private:
     // These shouldn't be called directly:
     // - construct using GetInstance
     // - destroy using Release
-    nsIOService() NS_HIDDEN;
-    ~nsIOService() NS_HIDDEN;
+    nsIOService();
+    ~nsIOService();
 
-    NS_HIDDEN_(nsresult) TrackNetworkLinkStatusForOffline();
+    nsresult TrackNetworkLinkStatusForOffline();
 
-    NS_HIDDEN_(nsresult) GetCachedProtocolHandler(const char *scheme,
+    nsresult GetCachedProtocolHandler(const char *scheme,
                                                   nsIProtocolHandler* *hdlrResult,
                                                   uint32_t start=0,
                                                   uint32_t end=0);
-    NS_HIDDEN_(nsresult) CacheProtocolHandler(const char *scheme,
+    nsresult CacheProtocolHandler(const char *scheme,
                                               nsIProtocolHandler* hdlr);
 
     // Prefs wrangling
-    NS_HIDDEN_(void) PrefsChanged(nsIPrefBranch *prefs, const char *pref = nullptr);
-    NS_HIDDEN_(void) GetPrefBranch(nsIPrefBranch **);
-    NS_HIDDEN_(void) ParsePortList(nsIPrefBranch *prefBranch, const char *pref, bool remove);
+    void PrefsChanged(nsIPrefBranch *prefs, const char *pref = nullptr);
+    void GetPrefBranch(nsIPrefBranch **);
+    void ParsePortList(nsIPrefBranch *prefBranch, const char *pref, bool remove);
 
     nsresult InitializeSocketTransportService();
     nsresult InitializeNetworkLinkService();
 
     // consolidated helper function
     void LookupProxyInfo(nsIURI *aURI, nsIURI *aProxyURI, uint32_t aProxyFlags,
                          nsCString *aScheme, nsIProxyInfo **outPI);
 
--- a/netwerk/base/src/nsInputStreamPump.h
+++ b/netwerk/base/src/nsInputStreamPump.h
@@ -27,17 +27,17 @@ public:
     NS_DECL_NSIREQUEST
     NS_DECL_NSIINPUTSTREAMPUMP
     NS_DECL_NSIINPUTSTREAMCALLBACK
     NS_DECL_NSITHREADRETARGETABLEREQUEST
 
     nsInputStreamPump(); 
     ~nsInputStreamPump();
 
-    static NS_HIDDEN_(nsresult)
+    static nsresult
                       Create(nsInputStreamPump  **result,
                              nsIInputStream      *stream,
                              int64_t              streamPos = -1,
                              int64_t              streamLen = -1,
                              uint32_t             segsize = 0,
                              uint32_t             segcount = 0,
                              bool                 closeWhenDone = false);
 
@@ -48,17 +48,17 @@ public:
      * method will not call the callback when there is no data in the stream.
      * The callback will be called at most once.
      *
      * The data from the stream will not be consumed, i.e. the pump's listener
      * can still read all the data.
      *
      * Do not call before asyncRead. Do not call after onStopRequest.
      */
-    NS_HIDDEN_(nsresult) PeekStream(PeekSegmentFun callback, void *closure);
+    nsresult PeekStream(PeekSegmentFun callback, void *closure);
 
     /**
      * Dispatched (to the main thread) by OnStateStop if it's called off main
      * thread. Updates mState based on return value of OnStateStop.
      */
     nsresult CallOnStateStop();
 
 protected:
--- a/netwerk/base/src/nsNetStrings.cpp
+++ b/netwerk/base/src/nsNetStrings.cpp
@@ -1,14 +1,14 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsNetStrings.h"
 #include "nsChannelProperties.h"
 
-NS_HIDDEN_(nsNetStrings*) gNetStrings;
+nsNetStrings* gNetStrings;
 
 nsNetStrings::nsNetStrings()
   : NS_LITERAL_STRING_INIT(kChannelPolicy, NS_CHANNEL_PROP_CHANNEL_POLICY_STR)
 {}
 
 
--- a/netwerk/base/src/nsPACMan.h
+++ b/netwerk/base/src/nsPACMan.h
@@ -144,17 +144,17 @@ public:
     if (mPACURISpec.IsEmpty() && mPACURIRedirectSpec.IsEmpty())
       return false;
 
     nsAutoCString tmp;
     uri->GetSpec(tmp);
     return IsPACURI(tmp);
   }
 
-  NS_HIDDEN_(nsresult) Init(nsISystemProxySettings *);
+  nsresult Init(nsISystemProxySettings *);
   static nsPACMan *sInstance;
 
   // PAC thread operations only
   void ProcessPendingQ();
   void CancelPendingQ(nsresult);
 
 private:
   NS_DECL_NSISTREAMLOADEROBSERVER
--- a/netwerk/base/src/nsProtocolProxyService.h
+++ b/netwerk/base/src/nsProtocolProxyService.h
@@ -31,36 +31,36 @@ class nsProtocolProxyService MOZ_FINAL :
                                        , public nsIObserver
 {
 public:
     NS_DECL_ISUPPORTS
     NS_DECL_NSIPROTOCOLPROXYSERVICE2
     NS_DECL_NSIPROTOCOLPROXYSERVICE
     NS_DECL_NSIOBSERVER
 
-    nsProtocolProxyService() NS_HIDDEN;
+    nsProtocolProxyService();
 
-    NS_HIDDEN_(nsresult) Init();
+    nsresult Init();
 
 protected:
     friend class nsAsyncResolveRequest;
 
-    ~nsProtocolProxyService() NS_HIDDEN;
+    ~nsProtocolProxyService();
 
     /**
      * This method is called whenever a preference may have changed or
      * to initialize all preferences.
      *
      * @param prefs
      *        This must be a pointer to the root pref branch.
      * @param name
      *        This can be the name of a fully-qualified preference, or it can
      *        be null, in which case all preferences will be initialized.
      */
-    NS_HIDDEN_(void) PrefsChanged(nsIPrefBranch *prefs, const char *name);
+    void PrefsChanged(nsIPrefBranch *prefs, const char *name);
 
     /**
      * This method is called to create a nsProxyInfo instance from the given
      * PAC-style proxy string.  It parses up to the end of the string, or to
      * the next ';' character.
      * 
      * @param proxy
      *        The PAC-style proxy string to parse.  This must not be null.
@@ -68,98 +68,98 @@ protected:
      *        The flags passed to Resolve or AsyncResolve that are stored in 
      *        proxyInfo.
      * @param result
      *        Upon return this points to a newly allocated nsProxyInfo or null
      *        if the proxy string was invalid.
      *
      * @return A pointer beyond the parsed proxy string (never null).
      */
-    NS_HIDDEN_(const char *) ExtractProxyInfo(const char *proxy,
+    const char * ExtractProxyInfo(const char *proxy,
                                               uint32_t aResolveFlags,
                                               nsProxyInfo **result);
 
     /**
      * Load the specified PAC file.
      * 
      * @param pacURI
      *        The URI spec of the PAC file to load.
      */
-    NS_HIDDEN_(nsresult) ConfigureFromPAC(const nsCString &pacURI, bool forceReload);
+    nsresult ConfigureFromPAC(const nsCString &pacURI, bool forceReload);
 
     /**
      * This method builds a list of nsProxyInfo objects from the given PAC-
      * style string.
      *
      * @param pacString
      *        The PAC-style proxy string to parse.  This may be empty.
      * @param aResolveFlags
      *        The flags passed to Resolve or AsyncResolve that are stored in 
      *        proxyInfo.
      * @param result
      *        The resulting list of proxy info objects.
      */
-    NS_HIDDEN_(void) ProcessPACString(const nsCString &pacString,
+    void ProcessPACString(const nsCString &pacString,
                                       uint32_t aResolveFlags,
                                       nsIProxyInfo **result);
 
     /**
      * This method generates a string valued identifier for the given
      * nsProxyInfo object.
      *
      * @param pi
      *        The nsProxyInfo object from which to generate the key.
      * @param result
      *        Upon return, this parameter holds the generated key.
      */
-    NS_HIDDEN_(void) GetProxyKey(nsProxyInfo *pi, nsCString &result);
+    void GetProxyKey(nsProxyInfo *pi, nsCString &result);
 
     /**
      * @return Seconds since start of session.
      */
-    NS_HIDDEN_(uint32_t) SecondsSinceSessionStart();
+    uint32_t SecondsSinceSessionStart();
 
     /**
      * This method removes the specified proxy from the disabled list.
      *
      * @param pi
      *        The nsProxyInfo object identifying the proxy to enable.
      */
-    NS_HIDDEN_(void) EnableProxy(nsProxyInfo *pi);
+    void EnableProxy(nsProxyInfo *pi);
 
     /**
      * This method adds the specified proxy to the disabled list.
      *
      * @param pi
      *        The nsProxyInfo object identifying the proxy to disable.
      */
-    NS_HIDDEN_(void) DisableProxy(nsProxyInfo *pi);
+    void DisableProxy(nsProxyInfo *pi);
 
     /**
      * This method tests to see if the given proxy is disabled.
      *
      * @param pi
      *        The nsProxyInfo object identifying the proxy to test.
      *
      * @return True if the specified proxy is disabled.
      */
-    NS_HIDDEN_(bool) IsProxyDisabled(nsProxyInfo *pi);
+    bool IsProxyDisabled(nsProxyInfo *pi);
 
     /**
      * This method queries the protocol handler for the given scheme to check
      * for the protocol flags and default port.
      *
      * @param uri
      *        The URI to query.
      * @param info
      *        Holds information about the protocol upon return.  Pass address
      *        of structure when you call this method.  This parameter must not
      *        be null.
      */
-    NS_HIDDEN_(nsresult) GetProtocolInfo(nsIURI *uri, nsProtocolInfo *result);
+    nsresult GetProtocolInfo(nsIURI *uri, nsProtocolInfo *result);
 
     /**
      * This method is an internal version nsIProtocolProxyService::newProxyInfo
      * that expects a string literal for the type.
      *
      * @param type
      *        The proxy type.
      * @param host
@@ -172,17 +172,17 @@ protected:
      *        The failover timeout for this proxy.
      * @param next
      *        The next proxy to try if this one fails.
      * @param aResolveFlags
      *        The flags passed to resolve (from nsIProtocolProxyService).
      * @param result
      *        The resulting nsIProxyInfo object.
      */
-    NS_HIDDEN_(nsresult) NewProxyInfo_Internal(const char *type,
+    nsresult NewProxyInfo_Internal(const char *type,
                                                const nsACString &host,
                                                int32_t port,
                                                uint32_t flags,
                                                uint32_t timeout,
                                                nsIProxyInfo *next,
                                                uint32_t aResolveFlags,
                                                nsIProxyInfo **result);
 
@@ -199,34 +199,34 @@ protected:
      * @param flags
      *        The flags passed to either the resolve or the asyncResolve method.
      * @param usePAC
      *        If this flag is set upon return, then PAC should be queried to
      *        resolve the proxy info.
      * @param result
      *        The resulting proxy info or null.
      */
-    NS_HIDDEN_(nsresult) Resolve_Internal(nsIURI *uri,
+    nsresult Resolve_Internal(nsIURI *uri,
                                           const nsProtocolInfo &info,
                                           uint32_t flags,
                                           bool *usePAC, 
                                           nsIProxyInfo **result);
 
     /**
      * This method applies the registered filters to the given proxy info
      * list, and returns a possibly modified list.
      *
      * @param uri
      *        The URI corresponding to this proxy info list.
      * @param info
      *        Information about the URI's protocol.
      * @param proxyInfo
      *        The proxy info list to be modified.  This is an inout param.
      */
-    NS_HIDDEN_(void) ApplyFilters(nsIURI *uri, const nsProtocolInfo &info,
+    void ApplyFilters(nsIURI *uri, const nsProtocolInfo &info,
                                   nsIProxyInfo **proxyInfo);
 
     /**
      * This method is a simple wrapper around ApplyFilters that takes the
      * proxy info list inout param as a nsCOMPtr.
      */
     inline void ApplyFilters(nsIURI *uri, const nsProtocolInfo &info,
                              nsCOMPtr<nsIProxyInfo> &proxyInfo)
@@ -241,46 +241,46 @@ protected:
      * This method prunes out disabled and disallowed proxies from a given
      * proxy info list.
      *
      * @param info
      *        Information about the URI's protocol.
      * @param proxyInfo
      *        The proxy info list to be modified.  This is an inout param.
      */
-    NS_HIDDEN_(void) PruneProxyInfo(const nsProtocolInfo &info,
+    void PruneProxyInfo(const nsProtocolInfo &info,
                                     nsIProxyInfo **proxyInfo);
 
     /**
      * This method populates mHostFiltersArray from the given string.
      *
      * @param hostFilters
      *        A "no-proxy-for" exclusion list.
      */
-    NS_HIDDEN_(void) LoadHostFilters(const char *hostFilters);
+    void LoadHostFilters(const char *hostFilters);
 
     /**
      * This method checks the given URI against mHostFiltersArray.
      *
      * @param uri
      *        The URI to test.
      * @param defaultPort
      *        The default port for the given URI.
      *
      * @return True if the URI can use the specified proxy.
      */
-    NS_HIDDEN_(bool) CanUseProxy(nsIURI *uri, int32_t defaultPort);
+    bool CanUseProxy(nsIURI *uri, int32_t defaultPort);
 
     /**
      * Disable Prefetch in the DNS service if a proxy is in use.
      *
      * @param aProxy
      *        The proxy information
      */
-    NS_HIDDEN_(void) MaybeDisableDNSPrefetch(nsIProxyInfo *aProxy);
+    void MaybeDisableDNSPrefetch(nsIProxyInfo *aProxy);
 
 private:
     nsresult SetupPACThread();
     nsresult ResetPACThread();
 
 public:
     // The Sun Forte compiler and others implement older versions of the
     // C++ standard's rules on access and nested classes.  These structs
--- a/netwerk/base/src/nsTransportUtils.h
+++ b/netwerk/base/src/nsTransportUtils.h
@@ -15,15 +15,15 @@
  * the previous event has not yet been delivered, then only one event will
  * be delivered.  The progress reported will be that from the second event.
  * If aCoalesceAllEvents is true, then any undelivered event will be replaced
  * with the next event if it arrives early enough.  This option should be used
  * cautiously since it can cause states to be effectively skipped.  Coalescing
  * events can help prevent a backlog of unprocessed transport events in the
  * case that the target thread is overworked.
  */
-NS_HIDDEN_(nsresult)
+nsresult
 net_NewTransportEventSinkProxy(nsITransportEventSink **aResult,
                                nsITransportEventSink *aSink,
                                nsIEventTarget *aTarget,
                                bool aCoalesceAllEvents = false);
 
 #endif // nsTransportUtils_h__
--- a/netwerk/base/src/nsURLHelper.h
+++ b/netwerk/base/src/nsURLHelper.h
@@ -29,76 +29,76 @@ enum netCoalesceFlags
   NET_COALESCE_DOUBLE_SLASH_IS_ROOT = 1<<1
 };
 
 //----------------------------------------------------------------------------
 // This module contains some private helper functions related to URL parsing.
 //----------------------------------------------------------------------------
 
 /* shutdown frees URL parser */
-NS_HIDDEN_(void) net_ShutdownURLHelper();
+void net_ShutdownURLHelper();
 #ifdef XP_MACOSX
-NS_HIDDEN_(void) net_ShutdownURLHelperOSX();
+void net_ShutdownURLHelperOSX();
 #endif
 
 /* access URL parsers */
-NS_HIDDEN_(nsIURLParser *) net_GetAuthURLParser();
-NS_HIDDEN_(nsIURLParser *) net_GetNoAuthURLParser();
-NS_HIDDEN_(nsIURLParser *) net_GetStdURLParser();
+nsIURLParser * net_GetAuthURLParser();
+nsIURLParser * net_GetNoAuthURLParser();
+nsIURLParser * net_GetStdURLParser();
 
 /* convert between nsIFile and file:// URL spec 
  * net_GetURLSpecFromFile does an extra stat, so callers should
  * avoid it if possible in favor of net_GetURLSpecFromActualFile
  * and net_GetURLSpecFromDir */
-NS_HIDDEN_(nsresult) net_GetURLSpecFromFile(nsIFile *, nsACString &);
-NS_HIDDEN_(nsresult) net_GetURLSpecFromDir(nsIFile *, nsACString &);
-NS_HIDDEN_(nsresult) net_GetURLSpecFromActualFile(nsIFile *, nsACString &);
-NS_HIDDEN_(nsresult) net_GetFileFromURLSpec(const nsACString &, nsIFile **);
+nsresult net_GetURLSpecFromFile(nsIFile *, nsACString &);
+nsresult net_GetURLSpecFromDir(nsIFile *, nsACString &);
+nsresult net_GetURLSpecFromActualFile(nsIFile *, nsACString &);
+nsresult net_GetFileFromURLSpec(const nsACString &, nsIFile **);
 
 /* extract file path components from file:// URL */
-NS_HIDDEN_(nsresult) net_ParseFileURL(const nsACString &inURL,
+nsresult net_ParseFileURL(const nsACString &inURL,
                                       nsACString &outDirectory,
                                       nsACString &outFileBaseName,
                                       nsACString &outFileExtension);
 
 /* handle .. in dirs while resolving URLs (path is UTF-8) */
-NS_HIDDEN_(void) net_CoalesceDirs(netCoalesceFlags flags, char* path);
+void net_CoalesceDirs(netCoalesceFlags flags, char* path);
 
 /**
  * Resolves a relative path string containing "." and ".."
  * with respect to a base path (assumed to already be resolved). 
  * For example, resolving "../../foo/./bar/../baz.html" w.r.t.
  * "/a/b/c/d/e/" yields "/a/b/c/foo/baz.html". Attempting to 
  * ascend above the base results in the NS_ERROR_MALFORMED_URI
  * exception. If basePath is null, it treats it as "/".
  *
  * @param relativePath  a relative URI
  * @param basePath      a base URI
  *
  * @return a new string, representing canonical uri
  */
-NS_HIDDEN_(nsresult) net_ResolveRelativePath(const nsACString &relativePath,
+nsresult net_ResolveRelativePath(const nsACString &relativePath,
                                              const nsACString &basePath,
                                              nsACString &result);
 
 /**
  * Extract URI-Scheme if possible
  *
  * @param inURI     URI spec
  * @param startPos  start of scheme (may be null)
  * @param endPos    end of scheme; index of colon (may be null)
  * @param scheme    scheme copied to this buffer on return (may be null)
  */
-NS_HIDDEN_(nsresult) net_ExtractURLScheme(const nsACString &inURI,
+nsresult net_ExtractURLScheme(const nsACString &inURI,
                                           uint32_t *startPos, 
                                           uint32_t *endPos,
                                           nsACString *scheme = nullptr);
 
 /* check that the given scheme conforms to RFC 2396 */
-NS_HIDDEN_(bool) net_IsValidScheme(const char *scheme, uint32_t schemeLen);
+bool net_IsValidScheme(const char *scheme, uint32_t schemeLen);
 
 inline bool net_IsValidScheme(const nsAFlatCString &scheme)
 {
     return net_IsValidScheme(scheme.get(), scheme.Length());
 }
 
 /**
  * Filter out whitespace from a URI string.  The input is the |str|
@@ -111,87 +111,87 @@ inline bool net_IsValidScheme(const nsAF
  * call on things like javascript: urls or data: urls, where we may in fact run
  * into whitespace that is not properly encoded.  Note that stripping does not
  * occur in the scheme portion itself.
  *
  * @param str the pointer to the string to filter.  Must be non-null.
  * @param result the out param to write to if filtering happens
  * @return whether result was written to
  */
-NS_HIDDEN_(bool) net_FilterURIString(const char *str, nsACString& result);
+bool net_FilterURIString(const char *str, nsACString& result);
 
 #if defined(XP_WIN)
 /**
  * On Win32 and OS/2 system's a back-slash in a file:// URL is equivalent to a
  * forward-slash.  This function maps any back-slashes to forward-slashes.
  *
  * @param aURL
  *        The URL string to normalize (UTF-8 encoded).  This can be a
  *        relative URL segment.
  * @param aResultBuf 
  *        The resulting string is appended to this string.  If the input URL
  *        is already normalized, then aResultBuf is unchanged.
  *
  * @returns false if aURL is already normalized.  Otherwise, returns true.
  */
-NS_HIDDEN_(bool) net_NormalizeFileURL(const nsACString &aURL,
+bool net_NormalizeFileURL(const nsACString &aURL,
                                         nsCString &aResultBuf);
 #endif
 
 /*****************************************************************************
  * generic string routines follow (XXX move to someplace more generic).
  */
 
 /* convert to lower case */
-NS_HIDDEN_(void) net_ToLowerCase(char* str, uint32_t length);
-NS_HIDDEN_(void) net_ToLowerCase(char* str);
+void net_ToLowerCase(char* str, uint32_t length);
+void net_ToLowerCase(char* str);
 
 /**
  * returns pointer to first character of |str| in the given set.  if not found,
  * then |end| is returned.  stops prematurely if a null byte is encountered,
  * and returns the address of the null byte.
  */
-NS_HIDDEN_(char *) net_FindCharInSet(const char *str, const char *end, const char *set);
+char * net_FindCharInSet(const char *str, const char *end, const char *set);
 
 /**
  * returns pointer to first character of |str| NOT in the given set.  if all
  * characters are in the given set, then |end| is returned.  if '\0' is not
  * included in |set|, then stops prematurely if a null byte is encountered,
  * and returns the address of the null byte.
  */
-NS_HIDDEN_(char *) net_FindCharNotInSet(const char *str, const char *end, const char *set);
+char * net_FindCharNotInSet(const char *str, const char *end, const char *set);
 
 /**
  * returns pointer to last character of |str| NOT in the given set.  if all
  * characters are in the given set, then |str - 1| is returned.
  */
-NS_HIDDEN_(char *) net_RFindCharNotInSet(const char *str, const char *end, const char *set);
+char * net_RFindCharNotInSet(const char *str, const char *end, const char *set);
 
 /**
  * Parses a content-type header and returns the content type and
  * charset (if any).  aCharset is not modified if no charset is
  * specified in anywhere in aHeaderStr.  In that case (no charset
  * specified), aHadCharset is set to false.  Otherwise, it's set to
  * true.  Note that aContentCharset can be empty even if aHadCharset
  * is true.
  */
-NS_HIDDEN_(void) net_ParseContentType(const nsACString &aHeaderStr,
+void net_ParseContentType(const nsACString &aHeaderStr,
                                       nsACString       &aContentType,
                                       nsACString       &aContentCharset,
                                       bool*          aHadCharset);
 /**
  * As above, but also returns the start and end indexes for the charset
  * parameter in aHeaderStr.  These are indices for the entire parameter, NOT
  * just the value.  If there is "effectively" no charset parameter (e.g. if an
  * earlier type with one is overridden by a later type without one),
  * *aHadCharset will be true but *aCharsetStart will be set to -1.  Note that
  * it's possible to have aContentCharset empty and *aHadCharset true when
  * *aCharsetStart is nonnegative; this corresponds to charset="".
  */
-NS_HIDDEN_(void) net_ParseContentType(const nsACString &aHeaderStr,
+void net_ParseContentType(const nsACString &aHeaderStr,
                                       nsACString       &aContentType,
                                       nsACString       &aContentCharset,
                                       bool             *aHadCharset,
                                       int32_t          *aCharsetStart,
                                       int32_t          *aCharsetEnd);
 
 /* inline versions */
 
@@ -210,21 +210,21 @@ inline char *net_RFindCharNotInSet(const
 {
     return net_RFindCharNotInSet(str, str + strlen(str), set);
 }
 
 /**
  * This function returns true if the given hostname does not include any
  * restricted characters.  Otherwise, false is returned.
  */
-NS_HIDDEN_(bool) net_IsValidHostName(const nsCSubstring &host);
+bool net_IsValidHostName(const nsCSubstring &host);
 
 /**
  * Checks whether the IPv4 address is valid according to RFC 3986 section 3.2.2.
  */
-NS_HIDDEN_(bool) net_IsValidIPv4Addr(const char *addr, int32_t addrLen);
+bool net_IsValidIPv4Addr(const char *addr, int32_t addrLen);
 
 /**
  * Checks whether the IPv6 address is valid according to RFC 3986 section 3.2.2.
  */
-NS_HIDDEN_(bool) net_IsValidIPv6Addr(const char *addr, int32_t addrLen);
+bool net_IsValidIPv6Addr(const char *addr, int32_t addrLen);
 
 #endif // !nsURLHelper_h__
--- a/netwerk/build/nsNetModule.cpp
+++ b/netwerk/build/nsNetModule.cpp
@@ -44,18 +44,18 @@
 
 #include "nsNetCID.h"
 
 #ifndef XP_MACOSX
 #define BUILD_BINHEX_DECODER 1
 #endif
 
 typedef nsCategoryCache<nsIContentSniffer> ContentSnifferCache;
-NS_HIDDEN_(ContentSnifferCache*) gNetSniffers = nullptr;
-NS_HIDDEN_(ContentSnifferCache*) gDataSniffers = nullptr;
+ContentSnifferCache* gNetSniffers = nullptr;
+ContentSnifferCache* gDataSniffers = nullptr;
 
 ///////////////////////////////////////////////////////////////////////////////
 
 #include "nsIOService.h"
 NS_GENERIC_FACTORY_SINGLETON_CONSTRUCTOR(nsIOService, nsIOService::GetInstance)
 
 #include "nsDNSService2.h"
 NS_GENERIC_FACTORY_SINGLETON_CONSTRUCTOR(nsIDNSService,
--- a/netwerk/protocol/data/nsDataHandler.h
+++ b/netwerk/protocol/data/nsDataHandler.h
@@ -22,17 +22,17 @@ public:
 
     // Define a Create method to be used with a factory:
     static nsresult
     Create(nsISupports* aOuter, const nsIID& aIID, void* *aResult);
 
     // Parse a data: URI and return the individual parts
     // (the given spec will temporarily be modified but will be returned
     //  to the original before returning)
-    static NS_HIDDEN_(nsresult) ParseURI(nsCString& spec,
+    static nsresult ParseURI(nsCString& spec,
                                          nsCString& contentType,
                                          nsCString& contentCharset,
                                          bool&    isBase64,
                                          nsCString& dataBuffer,
                                          nsCString& hashRef);
 };
 
 #endif /* nsDataHandler_h___ */
--- a/netwerk/protocol/viewsource/nsViewSourceChannel.h
+++ b/netwerk/protocol/viewsource/nsViewSourceChannel.h
@@ -42,19 +42,19 @@ public:
     NS_FORWARD_SAFE_NSIUPLOADCHANNEL(mUploadChannel)
     NS_FORWARD_SAFE_NSIHTTPCHANNELINTERNAL(mHttpChannelInternal)
 
     // nsViewSourceChannel methods:
     nsViewSourceChannel()
         : mIsDocument(false)
         , mOpened(false) {}
 
-    NS_HIDDEN_(nsresult) Init(nsIURI* uri);
+    nsresult Init(nsIURI* uri);
 
-    NS_HIDDEN_(nsresult) InitSrcdoc(nsIURI* aURI, const nsAString &aSrcdoc,
+    nsresult InitSrcdoc(nsIURI* aURI, const nsAString &aSrcdoc,
                                     nsIURI* aBaseURI);
 
 protected:
     nsCOMPtr<nsIChannel>        mChannel;
     nsCOMPtr<nsIHttpChannel>    mHttpChannel;
     nsCOMPtr<nsIHttpChannelInternal>    mHttpChannelInternal;
     nsCOMPtr<nsICachingChannel> mCachingChannel;
     nsCOMPtr<nsIApplicationCacheChannel> mApplicationCacheChannel;
--- a/parser/htmlparser/public/nsScannerString.h
+++ b/parser/htmlparser/public/nsScannerString.h
@@ -286,17 +286,17 @@ class nsScannerSharedSubstring
 
       ~nsScannerSharedSubstring()
         {
           if (mBufferList)
             ReleaseBuffer();
         }
 
         // Acquire a copy-on-write reference to the given substring.
-      NS_HIDDEN_(void) Rebind(const nsScannerIterator& aStart,
+      void Rebind(const nsScannerIterator& aStart,
                               const nsScannerIterator& aEnd);
 
        // Get a mutable reference to this string
       nsSubstring& writable()
         {
           if (mBufferList)
             MakeMutable();
 
@@ -304,18 +304,18 @@ class nsScannerSharedSubstring
         }
 
         // Get a const reference to this string
       const nsSubstring& str() const { return mString; }
 
     private:
       typedef nsScannerBufferList::Buffer Buffer;
 
-      NS_HIDDEN_(void) ReleaseBuffer();
-      NS_HIDDEN_(void) MakeMutable();
+      void ReleaseBuffer();
+      void MakeMutable();
 
       nsDependentSubstring  mString;
       Buffer               *mBuffer;
       nsScannerBufferList  *mBufferList;
   };
 
   /**
    * nsScannerIterator works just like nsReadingIterator<CharT> except that
--- a/storage/src/FileSystemModule.h
+++ b/storage/src/FileSystemModule.h
@@ -9,14 +9,14 @@
 
 #include "nscore.h"
 
 struct sqlite3;
 
 namespace mozilla {
 namespace storage {
 
-NS_HIDDEN_(int) RegisterFileSystemModule(sqlite3* aDB, const char* aName);
+int RegisterFileSystemModule(sqlite3* aDB, const char* aName);
 
 } // namespace storage
 } // namespace mozilla
 
 #endif // mozilla_storage_FileSystemModule_h
--- a/storage/src/SQLCollations.h
+++ b/storage/src/SQLCollations.h
@@ -21,17 +21,17 @@ namespace storage {
  * database and Service.
  *
  * @param  aDB
  *         The database we'll be registering the collations with.
  * @param  aService
  *         The Service that owns the nsICollation used by our collations.
  * @return the SQLite status code indicating success or failure.
  */
-NS_HIDDEN_(int) registerCollations(sqlite3 *aDB, Service *aService);
+int registerCollations(sqlite3 *aDB, Service *aService);
 
 ////////////////////////////////////////////////////////////////////////////////
 //// Predefined Functions
 
 /**
  * Custom UTF-8 collating sequence that respects the application's locale.
  * Comparison is case- and accent-insensitive.  This is called by SQLite.
  *
@@ -46,17 +46,17 @@ NS_HIDDEN_(int) registerCollations(sqlit
  *         The number of bytes in aStr2.
  * @param  aStr2
  *         The string to be compared against aStr1.  It will be passed in by
  *         SQLite as a non-null-terminated char* buffer.
  * @return aStr1 - aStr2.  That is, if aStr1 < aStr2, returns a negative number.
  *         If aStr1 > aStr2, returns a positive number.  If aStr1 == aStr2,
  *         returns 0.
  */
-NS_HIDDEN_(int) localeCollation8(void *aService,
+int localeCollation8(void *aService,
                                  int aLen1,
                                  const void *aStr1,
                                  int aLen2,
                                  const void *aStr2);
 
 /**
  * Custom UTF-8 collating sequence that respects the application's locale.
  * Comparison is case-sensitive and accent-insensitive.  This is called by
@@ -73,17 +73,17 @@ NS_HIDDEN_(int) localeCollation8(void *a
  *         The number of bytes in aStr2.
  * @param  aStr2
  *         The string to be compared against aStr1.  It will be passed in by
  *         SQLite as a non-null-terminated char* buffer.
  * @return aStr1 - aStr2.  That is, if aStr1 < aStr2, returns a negative number.
  *         If aStr1 > aStr2, returns a positive number.  If aStr1 == aStr2,
  *         returns 0.
  */
-NS_HIDDEN_(int) localeCollationCaseSensitive8(void *aService,
+int localeCollationCaseSensitive8(void *aService,
                                               int aLen1,
                                               const void *aStr1,
                                               int aLen2,
                                               const void *aStr2);
 
 /**
  * Custom UTF-8 collating sequence that respects the application's locale.
  * Comparison is case-insensitive and accent-sensitive.  This is called by
@@ -100,17 +100,17 @@ NS_HIDDEN_(int) localeCollationCaseSensi
  *         The number of bytes in aStr2.
  * @param  aStr2
  *         The string to be compared against aStr1.  It will be passed in by
  *         SQLite as a non-null-terminated char* buffer.
  * @return aStr1 - aStr2.  That is, if aStr1 < aStr2, returns a negative number.
  *         If aStr1 > aStr2, returns a positive number.  If aStr1 == aStr2,
  *         returns 0.
  */
-NS_HIDDEN_(int) localeCollationAccentSensitive8(void *aService,
+int localeCollationAccentSensitive8(void *aService,
                                                 int aLen1,
                                                 const void *aStr1,
                                                 int aLen2,
                                                 const void *aStr2);
 
 /**
  * Custom UTF-8 collating sequence that respects the application's locale.
  * Comparison is case- and accent-sensitive.  This is called by SQLite.
@@ -126,17 +126,17 @@ NS_HIDDEN_(int) localeCollationAccentSen
  *         The number of bytes in aStr2.
  * @param  aStr2
  *         The string to be compared against aStr1.  It will be passed in by
  *         SQLite as a non-null-terminated char* buffer.
  * @return aStr1 - aStr2.  That is, if aStr1 < aStr2, returns a negative number.
  *         If aStr1 > aStr2, returns a positive number.  If aStr1 == aStr2,
  *         returns 0.
  */
-NS_HIDDEN_(int) localeCollationCaseAccentSensitive8(void *aService,
+int localeCollationCaseAccentSensitive8(void *aService,
                                                     int aLen1,
                                                     const void *aStr1,
                                                     int aLen2,
                                                     const void *aStr2);
 
 /**
  * Custom UTF-16 collating sequence that respects the application's locale.
  * Comparison is case- and accent-insensitive.  This is called by SQLite.
@@ -152,17 +152,17 @@ NS_HIDDEN_(int) localeCollationCaseAccen
  *         The number of bytes (not characters) in aStr2.
  * @param  aStr2
  *         The string to be compared against aStr1.  It will be passed in by
  *         SQLite as a non-null-terminated char16_t* buffer.
  * @return aStr1 - aStr2.  That is, if aStr1 < aStr2, returns a negative number.
  *         If aStr1 > aStr2, returns a positive number.  If aStr1 == aStr2,
  *         returns 0.
  */
-NS_HIDDEN_(int) localeCollation16(void *aService,
+int localeCollation16(void *aService,
                                   int aLen1,
                                   const void *aStr1,
                                   int aLen2,
                                   const void *aStr2);
 
 /**
  * Custom UTF-16 collating sequence that respects the application's locale.
  * Comparison is case-sensitive and accent-insensitive.  This is called by
@@ -179,17 +179,17 @@ NS_HIDDEN_(int) localeCollation16(void *
  *         The number of bytes (not characters) in aStr2.
  * @param  aStr2
  *         The string to be compared against aStr1.  It will be passed in by
  *         SQLite as a non-null-terminated char16_t* buffer.
  * @return aStr1 - aStr2.  That is, if aStr1 < aStr2, returns a negative number.
  *         If aStr1 > aStr2, returns a positive number.  If aStr1 == aStr2,
  *         returns 0.
  */
-NS_HIDDEN_(int) localeCollationCaseSensitive16(void *aService,
+int localeCollationCaseSensitive16(void *aService,
                                                int aLen1,
                                                const void *aStr1,
                                                int aLen2,
                                                const void *aStr2);
 
 /**
  * Custom UTF-16 collating sequence that respects the application's locale.
  * Comparison is case-insensitive and accent-sensitive.  This is called by
@@ -206,17 +206,17 @@ NS_HIDDEN_(int) localeCollationCaseSensi
  *         The number of bytes (not characters) in aStr2.
  * @param  aStr2
  *         The string to be compared against aStr1.  It will be passed in by
  *         SQLite as a non-null-terminated char16_t* buffer.
  * @return aStr1 - aStr2.  That is, if aStr1 < aStr2, returns a negative number.
  *         If aStr1 > aStr2, returns a positive number.  If aStr1 == aStr2,
  *         returns 0.
  */
-NS_HIDDEN_(int) localeCollationAccentSensitive16(void *aService,
+int localeCollationAccentSensitive16(void *aService,
                                                  int aLen1,
                                                  const void *aStr1,
                                                  int aLen2,
                                                  const void *aStr2);
 
 /**
  * Custom UTF-16 collating sequence that respects the application's locale.
  * Comparison is case- and accent-sensitive.  This is called by SQLite.
@@ -232,17 +232,17 @@ NS_HIDDEN_(int) localeCollationAccentSen
  *         The number of bytes (not characters) in aStr2.
  * @param  aStr2
  *         The string to be compared against aStr1.  It will be passed in by
  *         SQLite as a non-null-terminated char16_t* buffer.
  * @return aStr1 - aStr2.  That is, if aStr1 < aStr2, returns a negative number.
  *         If aStr1 > aStr2, returns a positive number.  If aStr1 == aStr2,
  *         returns 0.
  */
-NS_HIDDEN_(int) localeCollationCaseAccentSensitive16(void *aService,
+int localeCollationCaseAccentSensitive16(void *aService,
                                                      int aLen1,
                                                      const void *aStr1,
                                                      int aLen2,
                                                      const void *aStr2);
 
 } // namespace storage
 } // namespace mozilla
 
--- a/storage/src/mozStorageSQLFunctions.h
+++ b/storage/src/mozStorageSQLFunctions.h
@@ -15,62 +15,62 @@ namespace storage {
 
 /**
  * Registers the functions declared here with the specified database.
  *
  * @param aDB
  *        The database we'll be registering the functions with.
  * @return the SQLite status code indicating success or failure.
  */
-NS_HIDDEN_(int) registerFunctions(sqlite3 *aDB);
+int registerFunctions(sqlite3 *aDB);
 
 ////////////////////////////////////////////////////////////////////////////////
 //// Predefined Functions
 
 /**
  * Overridden function to perform the SQL functions UPPER and LOWER.  These
  * support unicode, which the default implementations do not do.
  *
  * @param aCtx
  *        The sqlite_context that this function is being called on.
  * @param aArgc
  *        The number of arguments the function is being called with.
  * @param aArgv
  *        An array of the arguments the functions is being called with.
  */
-NS_HIDDEN_(void) caseFunction(sqlite3_context *aCtx,
+void caseFunction(sqlite3_context *aCtx,
                               int aArgc,
                               sqlite3_value **aArgv);
 
 /**
  * Overridden function to perform the SQL function LIKE.  This supports unicode,
  * which the default implementation does not do.
  *
  * @param aCtx
  *        The sqlite_context that this function is being called on.
  * @param aArgc
  *        The number of arguments the function is being called with.
  * @param aArgv
  *        An array of the arguments the functions is being called with.
  */
-NS_HIDDEN_(void) likeFunction(sqlite3_context *aCtx,
+void likeFunction(sqlite3_context *aCtx,
                               int aArgc,
                               sqlite3_value **aArgv);
 
 /**
  * An implementation of the Levenshtein Edit Distance algorithm for use in
  * Sqlite queries.
  * 
  * @param aCtx
  *        The sqlite_context that this function is being called on.
  * @param aArgc
  *        The number of arguments the function is being called with.
  * @param aArgv
  *        An array of the arguments the functions is being called with.
  */
-NS_HIDDEN_(void) levenshteinDistanceFunction(sqlite3_context *aCtx,
+void levenshteinDistanceFunction(sqlite3_context *aCtx,
                                              int aArgc,
                                              sqlite3_value **aArgv);
 
 } // namespace storage
 } // namespace mozilla
 
 #endif // mozStorageSQLFunctions_h
--- a/testing/marionette/transport/marionette_transport/transport.py
+++ b/testing/marionette/transport/marionette_transport/transport.py
@@ -98,10 +98,11 @@ class MarionetteTransport(object):
                     raise e
 
         response = self.receive()
         return response
 
     def close(self):
         """ Close the socket.
         """
-        self.sock.close()
+        if self.sock:
+            self.sock.close()
         self.sock = None
--- a/toolkit/components/typeaheadfind/nsTypeAheadFind.h
+++ b/toolkit/components/typeaheadfind/nsTypeAheadFind.h
@@ -63,17 +63,17 @@ protected:
   nsresult GetSearchContainers(nsISupports *aContainer,
                                nsISelectionController *aSelectionController,
                                bool aIsFirstVisiblePreferred,
                                bool aFindPrev, nsIPresShell **aPresShell,
                                nsPresContext **aPresContext);
 
   // Get the pres shell from mPresShell and return it only if it is still
   // attached to the DOM window.
-  NS_HIDDEN_(already_AddRefed<nsIPresShell>) GetPresShell();
+  already_AddRefed<nsIPresShell> GetPresShell();
 
   void ReleaseStrongMemberVariables();
 
   // Current find state
   nsString mTypeAheadBuffer;
   nsCString mNotFoundSoundURL;
 
   // PRBools are used instead of PRPackedBools because the address of the
--- a/toolkit/profile/nsToolkitProfileService.cpp
+++ b/toolkit/profile/nsToolkitProfileService.cpp
@@ -117,17 +117,17 @@ private:
     {
         gService = this;
     }
     ~nsToolkitProfileService()
     {
         gService = nullptr;
     }
 
-    NS_HIDDEN_(nsresult) Init();
+    nsresult Init();
 
     nsresult CreateTimesInternal(nsIFile *profileDir);
 
     nsresult CreateProfileInternal(nsIFile* aRootDir,
                                    const nsACString& aName,
                                    const nsACString* aProfileName,
                                    const nsACString* aAppName,
                                    const nsACString* aVendorName,
--- a/toolkit/system/gnome/nsGConfService.h
+++ b/toolkit/system/gnome/nsGConfService.h
@@ -15,17 +15,17 @@
 
 class nsGConfService MOZ_FINAL : public nsIGConfService
 {
 public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSIGCONFSERVICE
 
   nsGConfService() : mClient(nullptr) {}
-  NS_HIDDEN_(nsresult) Init();
+  nsresult Init();
 
 private:
-  ~nsGConfService() NS_HIDDEN;
+  ~nsGConfService();
 
   GConfClient *mClient;
 };
 
 #endif
--- a/toolkit/system/gnome/nsGSettingsService.h
+++ b/toolkit/system/gnome/nsGSettingsService.h
@@ -12,16 +12,16 @@
 {0xbfd4a9d8, 0xd886, 0x4161, {0x81, 0xef, 0x88, 0x68, 0xda, 0x11, 0x41, 0x70}}
 
 class nsGSettingsService MOZ_FINAL : public nsIGSettingsService
 {
 public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSIGSETTINGSSERVICE
 
-  NS_HIDDEN_(nsresult) Init();
+  nsresult Init();
 
 private:
   ~nsGSettingsService();
 };
 
 #endif
 
--- a/toolkit/system/gnome/nsGnomeVFSService.h
+++ b/toolkit/system/gnome/nsGnomeVFSService.h
@@ -13,12 +13,12 @@
 {0x5f43022c, 0x6194, 0x4b37, {0xb2, 0x6d, 0xe4, 0x10, 0x24, 0x62, 0x52, 0x64}}
 
 class nsGnomeVFSService MOZ_FINAL : public nsIGnomeVFSService
 {
 public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSIGNOMEVFSSERVICE
 
-  NS_HIDDEN_(nsresult) Init();
+  nsresult Init();
 };
 
 #endif
--- a/toolkit/xre/nsAppRunner.h
+++ b/toolkit/xre/nsAppRunner.h
@@ -60,20 +60,20 @@ extern bool gLogConsoleErrors;
 
 /**
  * Create the nativeappsupport implementation.
  *
  * @note XPCOMInit has not happened yet.
  */
 nsresult NS_CreateNativeAppSupport(nsINativeAppSupport* *aResult);
 
-NS_HIDDEN_(nsresult)
+nsresult
 NS_NewToolkitProfileService(nsIToolkitProfileService* *aResult);
 
-NS_HIDDEN_(nsresult)
+nsresult
 NS_NewToolkitProfileFactory(nsIFactory* *aResult);
 
 /**
  * Try to acquire exclusive access to the specified profile directory.
  *
  * @param aPath
  *        The profile directory to lock.
  * @param aTempPath
@@ -83,21 +83,21 @@ NS_NewToolkitProfileFactory(nsIFactory* 
  *        appears to be locked.
  * @param aResult
  *        The resulting profile lock object (or null if the profile could
  *        not be locked).
  *
  * @return NS_ERROR_FILE_ACCESS_DENIED to indicate that the profile
  *         directory cannot be unlocked.
  */
-NS_HIDDEN_(nsresult)
+nsresult
 NS_LockProfilePath(nsIFile* aPath, nsIFile* aTempPath,
                    nsIProfileUnlocker* *aUnlocker, nsIProfileLock* *aResult);
 
-NS_HIDDEN_(void)
+void
 WriteConsoleLog();
 
 #ifdef XP_WIN
 BOOL
 WinLaunchChild(const wchar_t *exePath, int argc,
                char **argv, HANDLE userToken = nullptr,
                HANDLE *hProcess = nullptr);
 BOOL
--- a/toolkit/xre/nsUpdateDriver.h
+++ b/toolkit/xre/nsUpdateDriver.h
@@ -43,17 +43,17 @@ class nsIFile;
  * version and is used to determine if an update's version is older than the
  * current application version.
  *
  * If you want the update to be processed without restarting, set the restart
  * parameter to false.
  *
  * This function does not modify appDir.
  */
-NS_HIDDEN_(nsresult) ProcessUpdates(nsIFile *greDir, nsIFile *appDir,
+nsresult ProcessUpdates(nsIFile *greDir, nsIFile *appDir,
                                     nsIFile *updRootDir,
                                     int argc, char **argv,
                                     const char *appVersion,
                                     bool restart = true,
                                     bool isOSUpdate = false,
                                     nsIFile *osApplyToDir = nullptr,
                                     ProcessType *pid = nullptr);
 
--- a/uriloader/base/nsURILoader.h
+++ b/uriloader/base/nsURILoader.h
@@ -33,17 +33,17 @@ public:
   nsURILoader();
   ~nsURILoader();
 
 protected:
   /**
    * Equivalent to nsIURILoader::openChannel, but allows specifying whether the
    * channel is opened already.
    */
-  NS_HIDDEN_(nsresult) OpenChannel(nsIChannel* channel,
+  nsresult OpenChannel(nsIChannel* channel,
                                    uint32_t aFlags,
                                    nsIInterfaceRequestor* aWindowContext,
                                    bool aChannelOpen,
                                    nsIStreamListener** aListener);
 
   /**
    * we shouldn't need to have an owning ref count on registered
    * content listeners because they are supposed to unregister themselves
--- a/uriloader/exthandler/android/nsAndroidHandlerApp.cpp
+++ b/uriloader/exthandler/android/nsAndroidHandlerApp.cpp
@@ -53,17 +53,17 @@ nsAndroidHandlerApp::SetDetailedDescript
   mDescription.Assign(aDescription);
 
   return NS_OK;
 }