Merge mozilla-central into services-central.
authorRichard Newman <rnewman@mozilla.com>
Fri, 01 Apr 2011 19:18:38 -0700
changeset 67765 5f926a6429fc8e57ad1f7e7b4e657c5a0a3b6d96
parent 67764 7b7cb3e1360d53b4f25017aec367d40288bfbbe3 (current diff)
parent 64578 8d3f6093c42502338f16aec5ec68e1f5a0f672a2 (diff)
child 67766 fc6f2ff82c2b2db93da73d43241b62dc7028b61e
push id1
push userroot
push dateTue, 26 Apr 2011 22:38:44 +0000
treeherdermozilla-beta@bfdb6e623a36 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone2.2a1pre
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Merge mozilla-central into services-central.
browser/app/apprunner-beos.rsrc
build/cygwin-wrapper
build/unix/vms/component_symvec.opt
build/unix/vms/getinfo.com
build/unix/vms/install.com
build/unix/vms/libxpcom_dbg_symvec.opt
build/unix/vms/libxpcom_symvec.opt
build/unix/vms/mozilla.com
config/make-jars.pl
content/xml/document/public/nsIFIXptr.idl
content/xml/document/public/nsIModifyableXPointer.idl
content/xml/document/public/nsIXPointer.idl
content/xml/tests/xpointer/xpointer.xml
content/xslt/src/xpath/nsXPath1Scheme.cpp
content/xslt/src/xpath/nsXPath1Scheme.h
dom/interfaces/core/nsIDOM3Document.idl
dom/interfaces/load-save/nsIDOMDOMImplementationLS.idl
dom/interfaces/load-save/nsIDOMLSException.idl
dom/interfaces/load-save/nsIDOMLSInput.idl
dom/interfaces/load-save/nsIDOMLSLoadEvent.idl
dom/interfaces/load-save/nsIDOMLSOutput.idl
dom/interfaces/load-save/nsIDOMLSParser.idl
dom/interfaces/load-save/nsIDOMLSParserFilter.idl
dom/interfaces/load-save/nsIDOMLSResourceResolver.idl
dom/interfaces/load-save/nsIDOMLSSerializer.idl
dom/interfaces/load-save/nsIDOMLSSerializerFilter.idl
dom/tests/mochitest/dom-level0/innerWidthHeight_metaviewport.html
dom/tests/mochitest/dom-level0/test_innerWidthHeight_metaviewport.html
editor/idl/nsICiter.idl
editor/idl/nsIHTMLEditor_MOZILLA_2_0_BRANCH.idl
gfx/src/thebes/Makefile.in
gfx/src/thebes/mozilla-decoder.cpp
gfx/src/thebes/mozilla-decoder.h
gfx/src/thebes/nsIThebesFontMetrics.h
gfx/src/thebes/nsSystemFontsAndroid.cpp
gfx/src/thebes/nsSystemFontsAndroid.h
gfx/src/thebes/nsSystemFontsBeOS.cpp
gfx/src/thebes/nsSystemFontsBeOS.h
gfx/src/thebes/nsSystemFontsGTK2.cpp
gfx/src/thebes/nsSystemFontsGTK2.h
gfx/src/thebes/nsSystemFontsMac.h
gfx/src/thebes/nsSystemFontsMac.mm
gfx/src/thebes/nsSystemFontsOS2.cpp
gfx/src/thebes/nsSystemFontsOS2.h
gfx/src/thebes/nsSystemFontsQt.cpp
gfx/src/thebes/nsSystemFontsQt.h
gfx/src/thebes/nsSystemFontsWin.cpp
gfx/src/thebes/nsSystemFontsWin.h
gfx/src/thebes/nsThebesDeviceContext.cpp
gfx/src/thebes/nsThebesDeviceContext.h
gfx/src/thebes/nsThebesFontEnumerator.cpp
gfx/src/thebes/nsThebesFontEnumerator.h
gfx/src/thebes/nsThebesFontMetrics.cpp
gfx/src/thebes/nsThebesFontMetrics.h
gfx/src/thebes/nsThebesGfxFactory.cpp
gfx/src/thebes/nsThebesRegion.cpp
gfx/src/thebes/nsThebesRegion.h
gfx/src/thebes/nsThebesRenderingContext.cpp
gfx/src/thebes/nsThebesRenderingContext.h
gfx/thebes/gfxBeOSPlatform.cpp
gfx/thebes/gfxBeOSPlatform.h
gfx/thebes/gfxBeOSSurface.cpp
gfx/thebes/gfxBeOSSurface.h
intl/uconv/src/nsBeOSCharset.cpp
intl/uconv/tests/unit/test_bug335531.js
intl/uconv/ucvja/jis0212.uf
intl/uconv/ucvko/nsUnicodeToISO2022KR.cpp
intl/uconv/ucvko/nsUnicodeToISO2022KR.h
intl/uconv/ucvlatin/nsUTF32ToUnicode.cpp
intl/uconv/ucvlatin/nsUTF32ToUnicode.h
intl/uconv/ucvlatin/nsUnicodeToUTF32.cpp
intl/uconv/ucvlatin/nsUnicodeToUTF32.h
intl/uconv/ucvlatin/nsUnicodeToVIQR.cpp
intl/uconv/ucvlatin/nsUnicodeToVIQR.h
intl/uconv/ucvlatin/nsUnicodeToVNI.cpp
intl/uconv/ucvlatin/nsUnicodeToVNI.h
intl/uconv/ucvlatin/nsVIQRToUnicode.cpp
intl/uconv/ucvlatin/nsVIQRToUnicode.h
intl/uconv/ucvlatin/nsVNIToUnicode.cpp
intl/uconv/ucvlatin/nsVNIToUnicode.h
jpeg/cdjpeg.c
jpeg/change.log
jpeg/cjpeg.c
jpeg/ckconfig.c
jpeg/coderules.doc
jpeg/djpeg.c
jpeg/example.c
jpeg/filelist.doc
jpeg/install.doc
jpeg/jconfig-mac-cw.h
jpeg/jconfig.doc
jpeg/jconfig.wat
jpeg/jmemansi.c
jpeg/jmemdos.c
jpeg/jmemdosa.asm
jpeg/jmemname.c
jpeg/jos2fig.h
jpeg/jwinfig.h
jpeg/libjpeg.doc
jpeg/makefile.gen
jpeg/netscape_mods.doc
jpeg/structure.doc
jpeg/usage.doc
jpeg/wizard.doc
js/src/build/cygwin-wrapper
js/src/jit-test/tests/basic/bug633890.js
js/src/tests/js1_8/extensions/regress-476871-01.js
layout/reftests/svg/smil/motion/animateMotion-rotate-1.svg
layout/style/nsCSSStruct.cpp
layout/style/nsCSSStruct.h
layout/style/nsCSSStyleRule.cpp
layout/style/nsICSSImportRule.h
layout/style/nsICSSNameSpaceRule.h
layout/style/nsICSSStyleRule.h
modules/libpr0n/decoders/icon/beos/Makefile.in
modules/libpr0n/decoders/icon/beos/nsIconChannel.cpp
modules/libpr0n/decoders/icon/beos/nsIconChannel.h
modules/plugin/base/src/nsPluginsDirBeOS.cpp
modules/plugin/sdk/Makefile.in
modules/plugin/sdk/readme.txt
modules/plugin/sdk/samples/Makefile.in
modules/plugin/sdk/samples/basic/mac/BasicPlugin.c
modules/plugin/sdk/samples/basic/mac/BasicPlugin.h
modules/plugin/sdk/samples/basic/mac/BasicPlugin.xcodeproj/project.pbxproj
modules/plugin/sdk/samples/basic/mac/BasicPlugin_Prefix.pch
modules/plugin/sdk/samples/basic/mac/COPYING
modules/plugin/sdk/samples/basic/mac/English.lproj/InfoPlist.strings
modules/plugin/sdk/samples/basic/mac/Info.plist
modules/plugin/sdk/samples/basic/readme.txt
modules/plugin/sdk/samples/basic/test.html
modules/plugin/sdk/samples/basic/unix/BasicPlugin.c
modules/plugin/sdk/samples/basic/unix/BasicPlugin.h
modules/plugin/sdk/samples/basic/unix/COPYING
modules/plugin/sdk/samples/basic/unix/Makefile
modules/plugin/sdk/samples/basic/windows/Makefile.in
modules/plugin/sdk/samples/basic/windows/basic.def
modules/plugin/sdk/samples/basic/windows/basic.rc
modules/plugin/sdk/samples/basic/windows/npbasic.dsp
modules/plugin/sdk/samples/basic/windows/npbasic.dsw
modules/plugin/sdk/samples/basic/windows/plugin.cpp
modules/plugin/sdk/samples/basic/windows/plugin.h
modules/plugin/sdk/samples/basic/windows/resource.h
modules/plugin/sdk/samples/common/Makefile.in
modules/plugin/sdk/samples/common/np_entry.cpp
modules/plugin/sdk/samples/common/npn_gate.cpp
modules/plugin/sdk/samples/common/npp_gate.cpp
modules/plugin/sdk/samples/include/npplat.h
modules/plugin/sdk/samples/include/pluginbase.h
modules/plugin/sdk/samples/npruntime/Makefile.in
modules/plugin/sdk/samples/npruntime/np_entry.cpp
modules/plugin/sdk/samples/npruntime/npn_gate.cpp
modules/plugin/sdk/samples/npruntime/npp_gate.cpp
modules/plugin/sdk/samples/npruntime/nprt.def
modules/plugin/sdk/samples/npruntime/nprt.rc
modules/plugin/sdk/samples/npruntime/plugin.cpp
modules/plugin/sdk/samples/npruntime/plugin.h
modules/plugin/sdk/samples/npruntime/readme.txt
modules/plugin/sdk/samples/npruntime/resource.h
modules/plugin/sdk/samples/npruntime/test.html
modules/plugin/sdk/samples/npthread/readme.txt
modules/plugin/sdk/samples/npthread/windows/action.cpp
modules/plugin/sdk/samples/npthread/windows/action.h
modules/plugin/sdk/samples/npthread/windows/dbg.cpp
modules/plugin/sdk/samples/npthread/windows/dbg.h
modules/plugin/sdk/samples/npthread/windows/np_entry.cpp
modules/plugin/sdk/samples/npthread/windows/npn_gate.cpp
modules/plugin/sdk/samples/npthread/windows/npp_gate.cpp
modules/plugin/sdk/samples/npthread/windows/npthread.def
modules/plugin/sdk/samples/npthread/windows/npthread.dsp
modules/plugin/sdk/samples/npthread/windows/npthread.dsw
modules/plugin/sdk/samples/npthread/windows/npthread.rc
modules/plugin/sdk/samples/npthread/windows/plugin.cpp
modules/plugin/sdk/samples/npthread/windows/plugin.h
modules/plugin/sdk/samples/npthread/windows/plugload.cpp
modules/plugin/sdk/samples/npthread/windows/plugload.h
modules/plugin/sdk/samples/npthread/windows/resource.h
modules/plugin/sdk/samples/npthread/windows/thread.cpp
modules/plugin/sdk/samples/npthread/windows/thread.h
modules/plugin/sdk/samples/unixprinting/Makefile.in
modules/plugin/sdk/samples/unixprinting/npshell.c
modules/plugin/sdk/samples/unixprinting/npunix.c
modules/plugin/sdk/samples/unixprinting/printplugin.c
modules/plugin/sdk/samples/unixprinting/printplugin.h
modules/plugin/sdk/samples/unixprinting/readme.txt
modules/plugin/sdk/samples/unixprinting/unixprintplugin_test1.html
modules/plugin/sdk/samples/unixprinting/unixprintplugin_test2.html
modules/plugin/sdk/samples/winless/readme.txt
modules/plugin/sdk/samples/winless/test.html
modules/plugin/sdk/samples/winless/windows/Makefile.in
modules/plugin/sdk/samples/winless/windows/npwinless.def
modules/plugin/sdk/samples/winless/windows/npwinless.dsp
modules/plugin/sdk/samples/winless/windows/npwinless.dsw
modules/plugin/sdk/samples/winless/windows/npwinless.rc
modules/plugin/sdk/samples/winless/windows/plugin.cpp
modules/plugin/sdk/samples/winless/windows/plugin.h
modules/plugin/sdk/samples/winless/windows/resource.h
toolkit/components/alerts/public/Makefile.in
toolkit/components/alerts/public/nsIAlertsService.idl
toolkit/components/alerts/public/nsINotificationsList.idl
toolkit/components/alerts/src/Makefile.in
toolkit/components/alerts/src/mac/Makefile.in
toolkit/components/alerts/src/mac/growl/CFGrowlAdditions.c
toolkit/components/alerts/src/mac/growl/CFGrowlAdditions.h
toolkit/components/alerts/src/mac/growl/CFGrowlDefines.h
toolkit/components/alerts/src/mac/growl/CFMutableDictionaryAdditions.c
toolkit/components/alerts/src/mac/growl/CFMutableDictionaryAdditions.h
toolkit/components/alerts/src/mac/growl/CFURLAdditions.c
toolkit/components/alerts/src/mac/growl/CFURLAdditions.h
toolkit/components/alerts/src/mac/growl/GrowlAbstractSingletonObject.h
toolkit/components/alerts/src/mac/growl/GrowlApplicationBridge.h
toolkit/components/alerts/src/mac/growl/GrowlApplicationBridge.m
toolkit/components/alerts/src/mac/growl/GrowlDefines.h
toolkit/components/alerts/src/mac/growl/GrowlDefinesInternal.h
toolkit/components/alerts/src/mac/growl/GrowlPathUtilities.h
toolkit/components/alerts/src/mac/growl/GrowlPathUtilities.m
toolkit/components/alerts/src/mac/growl/GrowlPathway.h
toolkit/components/alerts/src/mac/growl/GrowlPreferencesController.h
toolkit/components/alerts/src/mac/growl/GrowlTicketController.h
toolkit/components/alerts/src/mac/growl/Makefile.in
toolkit/components/alerts/src/mac/growl/license.txt
toolkit/components/alerts/src/mac/mozGrowlDelegate.h
toolkit/components/alerts/src/mac/mozGrowlDelegate.mm
toolkit/components/alerts/src/mac/nsAlertsImageLoadListener.h
toolkit/components/alerts/src/mac/nsAlertsImageLoadListener.mm
toolkit/components/alerts/src/mac/nsAlertsService.h
toolkit/components/alerts/src/mac/nsAlertsService.mm
toolkit/components/alerts/src/mac/nsAlertsServiceModule.cpp
toolkit/components/alerts/src/mac/nsNotificationsList.h
toolkit/components/alerts/src/mac/nsNotificationsList.mm
toolkit/components/alerts/src/nsAlertsService.cpp
toolkit/components/alerts/src/nsAlertsService.h
toolkit/components/autocomplete/public/Makefile.in
toolkit/components/autocomplete/public/nsIAutoCompleteController.idl
toolkit/components/autocomplete/public/nsIAutoCompleteInput.idl
toolkit/components/autocomplete/public/nsIAutoCompletePopup.idl
toolkit/components/autocomplete/public/nsIAutoCompleteResult.idl
toolkit/components/autocomplete/public/nsIAutoCompleteSearch.idl
toolkit/components/autocomplete/public/nsIAutoCompleteSimpleResult.idl
toolkit/components/autocomplete/src/Makefile.in
toolkit/components/autocomplete/src/nsAutoCompleteController.cpp
toolkit/components/autocomplete/src/nsAutoCompleteController.h
toolkit/components/autocomplete/src/nsAutoCompleteSimpleResult.cpp
toolkit/components/autocomplete/src/nsAutoCompleteSimpleResult.h
toolkit/components/commandlines/public/Makefile.in
toolkit/components/commandlines/public/nsICommandLine.idl
toolkit/components/commandlines/public/nsICommandLineHandler.idl
toolkit/components/commandlines/public/nsICommandLineRunner.idl
toolkit/components/commandlines/public/nsICommandLineValidator.idl
toolkit/components/commandlines/src/Makefile.in
toolkit/components/commandlines/src/nsCommandLine.cpp
toolkit/components/contentprefs/src/Makefile.in
toolkit/components/contentprefs/src/nsContentPrefService.js
toolkit/components/contentprefs/src/nsContentPrefService.manifest
toolkit/components/downloads/public/Makefile.in
toolkit/components/downloads/public/nsIDownload.idl
toolkit/components/downloads/public/nsIDownloadManager.idl
toolkit/components/downloads/public/nsIDownloadManagerUI.idl
toolkit/components/downloads/public/nsIDownloadProgressListener.idl
toolkit/components/downloads/src/Makefile.in
toolkit/components/downloads/src/nsDownloadManager.cpp
toolkit/components/downloads/src/nsDownloadManager.h
toolkit/components/downloads/src/nsDownloadManagerUI.js
toolkit/components/downloads/src/nsDownloadManagerUI.manifest
toolkit/components/downloads/src/nsDownloadProxy.h
toolkit/components/downloads/src/nsDownloadScanner.cpp
toolkit/components/downloads/src/nsDownloadScanner.h
toolkit/components/feeds/public/Makefile.in
toolkit/components/feeds/public/nsIFeed.idl
toolkit/components/feeds/public/nsIFeedContainer.idl
toolkit/components/feeds/public/nsIFeedElementBase.idl
toolkit/components/feeds/public/nsIFeedEntry.idl
toolkit/components/feeds/public/nsIFeedGenerator.idl
toolkit/components/feeds/public/nsIFeedListener.idl
toolkit/components/feeds/public/nsIFeedPerson.idl
toolkit/components/feeds/public/nsIFeedProcessor.idl
toolkit/components/feeds/public/nsIFeedResult.idl
toolkit/components/feeds/public/nsIFeedTextConstruct.idl
toolkit/components/feeds/public/nsIScriptableUnescapeHTML.idl
toolkit/components/feeds/src/FeedProcessor.js
toolkit/components/feeds/src/FeedProcessor.manifest
toolkit/components/feeds/src/Makefile.in
toolkit/components/feeds/src/nsScriptableUnescapeHTML.cpp
toolkit/components/feeds/src/nsScriptableUnescapeHTML.h
toolkit/components/filepicker/public/Makefile.in
toolkit/components/filepicker/public/nsIFileView.idl
toolkit/components/filepicker/src/Makefile.in
toolkit/components/filepicker/src/nsFilePicker.js
toolkit/components/filepicker/src/nsFilePicker.manifest
toolkit/components/filepicker/src/nsFileView.cpp
toolkit/components/find/public/Makefile.in
toolkit/components/find/public/nsIFindService.idl
toolkit/components/find/src/Makefile.in
toolkit/components/find/src/nsFindService.cpp
toolkit/components/find/src/nsFindService.h
toolkit/components/microformats/src/Makefile.in
toolkit/components/microformats/src/Microformats.js
toolkit/components/parentalcontrols/public/Makefile.in
toolkit/components/parentalcontrols/public/nsIParentalControlsService.idl
toolkit/components/parentalcontrols/src/Makefile.in
toolkit/components/parentalcontrols/src/nsParentalControlsServiceWin.cpp
toolkit/components/parentalcontrols/src/nsParentalControlsServiceWin.h
toolkit/components/passwordmgr/public/Makefile.in
toolkit/components/passwordmgr/public/nsILoginInfo.idl
toolkit/components/passwordmgr/public/nsILoginManager.idl
toolkit/components/passwordmgr/public/nsILoginManagerCrypto.idl
toolkit/components/passwordmgr/public/nsILoginManagerIEMigrationHelper.idl
toolkit/components/passwordmgr/public/nsILoginManagerPrompter.idl
toolkit/components/passwordmgr/public/nsILoginManagerStorage.idl
toolkit/components/passwordmgr/public/nsILoginMetaInfo.idl
toolkit/components/passwordmgr/src/Makefile.in
toolkit/components/passwordmgr/src/crypto-SDR.js
toolkit/components/passwordmgr/src/nsLoginInfo.js
toolkit/components/passwordmgr/src/nsLoginManager.js
toolkit/components/passwordmgr/src/nsLoginManagerPrompter.js
toolkit/components/passwordmgr/src/passwordmgr.manifest
toolkit/components/passwordmgr/src/storage-Legacy.js
toolkit/components/passwordmgr/src/storage-mozStorage.js
toolkit/components/places/public/Makefile.in
toolkit/components/places/public/mozIAsyncHistory.idl
toolkit/components/places/public/mozIPlacesAutoComplete.idl
toolkit/components/places/public/nsIAnnotationService.idl
toolkit/components/places/public/nsIBrowserHistory.idl
toolkit/components/places/public/nsIDynamicContainer.idl
toolkit/components/places/public/nsIFaviconService.idl
toolkit/components/places/public/nsILivemarkService.idl
toolkit/components/places/public/nsIMicrosummaryService.idl
toolkit/components/places/public/nsINavBookmarksService.idl
toolkit/components/places/public/nsINavHistoryService.idl
toolkit/components/places/public/nsIPlacesImportExportService.idl
toolkit/components/places/public/nsITaggingService.idl
toolkit/components/places/public/nsPIPlacesDatabase.idl
toolkit/components/places/public/nsPIPlacesHistoryListenersNotifier.idl
toolkit/components/places/src/AsyncFaviconHelpers.cpp
toolkit/components/places/src/AsyncFaviconHelpers.h
toolkit/components/places/src/Helpers.cpp
toolkit/components/places/src/Helpers.h
toolkit/components/places/src/History.cpp
toolkit/components/places/src/History.h
toolkit/components/places/src/Makefile.in
toolkit/components/places/src/PlaceInfo.cpp
toolkit/components/places/src/PlaceInfo.h
toolkit/components/places/src/PlacesCategoriesStarter.js
toolkit/components/places/src/PlacesDBUtils.jsm
toolkit/components/places/src/PlacesUtils.jsm
toolkit/components/places/src/SQLFunctions.cpp
toolkit/components/places/src/SQLFunctions.h
toolkit/components/places/src/VisitInfo.cpp
toolkit/components/places/src/VisitInfo.h
toolkit/components/places/src/nsAnnoProtocolHandler.cpp
toolkit/components/places/src/nsAnnoProtocolHandler.h
toolkit/components/places/src/nsAnnotationService.cpp
toolkit/components/places/src/nsAnnotationService.h
toolkit/components/places/src/nsFaviconService.cpp
toolkit/components/places/src/nsFaviconService.h
toolkit/components/places/src/nsLivemarkService.js
toolkit/components/places/src/nsMaybeWeakPtr.cpp
toolkit/components/places/src/nsMaybeWeakPtr.h
toolkit/components/places/src/nsMicrosummaryService.js
toolkit/components/places/src/nsMorkHistoryImporter.cpp
toolkit/components/places/src/nsNavBookmarks.cpp
toolkit/components/places/src/nsNavBookmarks.h
toolkit/components/places/src/nsNavHistory.cpp
toolkit/components/places/src/nsNavHistory.h
toolkit/components/places/src/nsNavHistoryQuery.cpp
toolkit/components/places/src/nsNavHistoryQuery.h
toolkit/components/places/src/nsNavHistoryResult.cpp
toolkit/components/places/src/nsNavHistoryResult.h
toolkit/components/places/src/nsPlacesAutoComplete.js
toolkit/components/places/src/nsPlacesAutoComplete.manifest
toolkit/components/places/src/nsPlacesExpiration.js
toolkit/components/places/src/nsPlacesImportExportService.cpp
toolkit/components/places/src/nsPlacesImportExportService.h
toolkit/components/places/src/nsPlacesIndexes.h
toolkit/components/places/src/nsPlacesMacros.h
toolkit/components/places/src/nsPlacesModule.cpp
toolkit/components/places/src/nsPlacesTables.h
toolkit/components/places/src/nsPlacesTriggers.h
toolkit/components/places/src/nsTaggingService.js
toolkit/components/places/src/toolkitplaces.manifest
toolkit/components/places/src/utils.js
toolkit/components/satchel/public/Makefile.in
toolkit/components/satchel/public/nsIFormAutoComplete.idl
toolkit/components/satchel/public/nsIFormFillController.idl
toolkit/components/satchel/public/nsIFormHistory.idl
toolkit/components/satchel/public/nsIInputListAutoComplete.idl
toolkit/components/satchel/src/Makefile.in
toolkit/components/satchel/src/formSubmitListener.js
toolkit/components/satchel/src/nsFormAutoComplete.js
toolkit/components/satchel/src/nsFormAutoCompleteResult.jsm
toolkit/components/satchel/src/nsFormFillController.cpp
toolkit/components/satchel/src/nsFormFillController.h
toolkit/components/satchel/src/nsFormHistory.js
toolkit/components/satchel/src/nsInputListAutoComplete.js
toolkit/components/satchel/src/satchel.manifest
toolkit/components/startup/src/Makefile.in
toolkit/components/startup/src/nsAppStartup.cpp
toolkit/components/startup/src/nsAppStartup.h
toolkit/components/startup/src/nsTryToClose.js
toolkit/components/startup/src/nsTryToClose.manifest
toolkit/components/startup/src/nsUserInfo.h
toolkit/components/startup/src/nsUserInfoMac.h
toolkit/components/startup/src/nsUserInfoMac.mm
toolkit/components/startup/src/nsUserInfoOS2.cpp
toolkit/components/startup/src/nsUserInfoUnix.cpp
toolkit/components/startup/src/nsUserInfoWin.cpp
toolkit/components/typeaheadfind/public/Makefile.in
toolkit/components/typeaheadfind/public/nsITypeAheadFind.idl
toolkit/components/typeaheadfind/src/Makefile.in
toolkit/components/typeaheadfind/src/nsTypeAheadFind.cpp
toolkit/components/typeaheadfind/src/nsTypeAheadFind.h
toolkit/components/url-classifier/public/Makefile.in
toolkit/components/url-classifier/public/nsIUrlClassifierDBService.idl
toolkit/components/url-classifier/public/nsIUrlClassifierHashCompleter.idl
toolkit/components/url-classifier/public/nsIUrlClassifierStreamUpdater.idl
toolkit/components/url-classifier/public/nsIUrlClassifierTable.idl
toolkit/components/url-classifier/public/nsIUrlClassifierUtils.idl
toolkit/components/url-classifier/public/nsIUrlListManager.idl
toolkit/components/url-classifier/src/Makefile.in
toolkit/components/url-classifier/src/nsURLClassifier.manifest
toolkit/components/url-classifier/src/nsUrlClassifierDBService.cpp
toolkit/components/url-classifier/src/nsUrlClassifierDBService.h
toolkit/components/url-classifier/src/nsUrlClassifierHashCompleter.cpp
toolkit/components/url-classifier/src/nsUrlClassifierHashCompleter.h
toolkit/components/url-classifier/src/nsUrlClassifierLib.js
toolkit/components/url-classifier/src/nsUrlClassifierListManager.js
toolkit/components/url-classifier/src/nsUrlClassifierStreamUpdater.cpp
toolkit/components/url-classifier/src/nsUrlClassifierStreamUpdater.h
toolkit/components/url-classifier/src/nsUrlClassifierUtils.cpp
toolkit/components/url-classifier/src/nsUrlClassifierUtils.h
toolkit/components/urlformatter/public/Makefile.in
toolkit/components/urlformatter/public/nsIURLFormatter.idl
toolkit/components/urlformatter/src/Makefile.in
toolkit/components/urlformatter/src/nsURLFormatter.js
toolkit/components/urlformatter/src/nsURLFormatter.manifest
toolkit/crashreporter/google-breakpad/src/client/mac/gcov/libgcov.a
toolkit/crashreporter/google-breakpad/src/third_party/linux/lib/gflags/libgflags.a
toolkit/crashreporter/google-breakpad/src/third_party/linux/lib/glog/libglog.a
toolkit/crashreporter/google-breakpad/src/tools/solaris/dump_syms/testdata/dump_syms_regtest.o
toolkit/mozapps/Makefile.in
toolkit/mozapps/jar.mn
toolkit/profile/public/Makefile.in
toolkit/profile/public/nsIProfileMigrator.idl
toolkit/profile/public/nsIToolkitProfile.idl
toolkit/profile/public/nsIToolkitProfileService.idl
toolkit/profile/src/Makefile.in
toolkit/profile/src/nsToolkitProfileService.cpp
toolkit/themes/pinstripe/global/tree/sort-asc.gif
toolkit/themes/pinstripe/global/tree/sort-dsc.gif
toolkit/xre/nsNativeAppSupportBeOS.cpp
uriloader/exthandler/beos/nsMIMEInfoBeOS.cpp
uriloader/exthandler/beos/nsMIMEInfoBeOS.h
uriloader/exthandler/beos/nsOSHelperAppService.cpp
uriloader/exthandler/beos/nsOSHelperAppService.h
webshell/Makefile.in
webshell/public/Makefile.in
webshell/public/nsIClipboardCommands.idl
webshell/public/nsIContentViewerContainer.idl
webshell/public/nsIDocumentLoaderFactory.idl
webshell/public/nsILinkHandler.h
webshell/public/nsIRefreshURI.idl
webshell/public/nsIWebShellServices.h
widget/public/nsIDragSessionBeOS.h
widget/src/beos/Makefile.in
widget/src/beos/nsAppShell.cpp
widget/src/beos/nsAppShell.h
widget/src/beos/nsBeOSCursors.h
widget/src/beos/nsBidiKeyboard.cpp
widget/src/beos/nsBidiKeyboard.h
widget/src/beos/nsCList.h
widget/src/beos/nsChildView.cpp
widget/src/beos/nsChildView.h
widget/src/beos/nsClipboard.cpp
widget/src/beos/nsClipboard.h
widget/src/beos/nsDeviceContextSpecB.cpp
widget/src/beos/nsDeviceContextSpecB.h
widget/src/beos/nsDragService.cpp
widget/src/beos/nsDragService.h
widget/src/beos/nsFilePicker.cpp
widget/src/beos/nsFilePicker.h
widget/src/beos/nsLookAndFeel.cpp
widget/src/beos/nsLookAndFeel.h
widget/src/beos/nsPopupWindow.cpp
widget/src/beos/nsPopupWindow.h
widget/src/beos/nsPrintOptionsBeOS.cpp
widget/src/beos/nsPrintOptionsBeOS.h
widget/src/beos/nsPrintdBeOS.h
widget/src/beos/nsScreenBeOS.cpp
widget/src/beos/nsScreenBeOS.h
widget/src/beos/nsScreenManagerBeOS.cpp
widget/src/beos/nsScreenManagerBeOS.h
widget/src/beos/nsSound.cpp
widget/src/beos/nsSound.h
widget/src/beos/nsSwitchToUIThread.h
widget/src/beos/nsToolkit.cpp
widget/src/beos/nsToolkit.h
widget/src/beos/nsWidgetFactory.cpp
widget/src/beos/nsWindow.cpp
widget/src/beos/nsWindow.h
widget/src/beos/nsdefs.h
widget/src/beos/resource.h
xpcom/glue/nsAutoLock.cpp
xpcom/glue/nsAutoLock.h
xpcom/glue/standalone/nsGlueLinkingBeOS.cpp
xpcom/reflect/xptcall/src/md/unix/xptcinvoke_asm_openvms_alpha.s
xpcom/reflect/xptcall/src/md/unix/xptcinvoke_openvms_alpha.cpp
xpcom/reflect/xptcall/src/md/unix/xptcstubs_asm_openvms_alpha.s
xpcom/reflect/xptcall/src/md/unix/xptcstubs_openvms_alpha.cpp
xpcom/reflect/xptcall/src/md/win32/xptcinvoke_alpha.cpp
xpcom/reflect/xptcall/src/md/win32/xptcinvoke_asm_alpha.s
xpcom/reflect/xptcall/src/md/win32/xptcstubs_alpha.cpp
xpcom/reflect/xptcall/src/md/win32/xptcstubs_asm_alpha.s
--- a/.hgtags
+++ b/.hgtags
@@ -50,8 +50,10 @@ 138f593553b66c9f815e8f57870c19d6347f7702
 138f593553b66c9f815e8f57870c19d6347f7702 UPDATE_PACKAGING_R10
 138f593553b66c9f815e8f57870c19d6347f7702 UPDATE_PACKAGING_R11
 0327e126ea245112c0aa7283fee154e084866fb5 bsmedberg-static-xpcom-registration-base
 0327e126ea245112c0aa7283fee154e084866fb5 bsmedberg-static-xpcom-registration-base
 2f83edbbeef0de7dd901411d270da61106c8afae bsmedberg-static-xpcom-registration-base
 138f593553b66c9f815e8f57870c19d6347f7702 UPDATE_PACKAGING_R12
 138f593553b66c9f815e8f57870c19d6347f7702 UPDATE_PACKAGING_R13
 138f593553b66c9f815e8f57870c19d6347f7702 UPDATE_PACKAGING_R11_1_MU
+e56ecd8b3a68c158025207c5fd081d043e28f5ce GECKO_2_0_BASE
+e273946b74c8d631ed86bd74ba9afe0e67b12378 GECKO_2_1_BASE
--- a/Makefile.in
+++ b/Makefile.in
@@ -78,17 +78,17 @@ ifdef COMPILE_ENVIRONMENT
 include $(topsrcdir)/$(MOZ_BUILD_APP)/build.mk
 endif
 
 
 include $(topsrcdir)/config/config.mk
 
 GARBAGE_DIRS += dist _javagen _profile _tests staticlib
 DIST_GARBAGE = config.cache config.log config.status config-defs.h \
-   dependencies.beos config/autoconf.mk \
+   config/autoconf.mk \
    unallmakefiles mozilla-config.h \
    netwerk/necko-config.h xpcom/xpcom-config.h xpcom/xpcom-private.h \
    $(topsrcdir)/.mozconfig.mk $(topsrcdir)/.mozconfig.out
 
 ifdef WINCE
 check::
 	$(PYTHON) $(topsrcdir)/build/mobile/devicemanager-utils.py copy $(DIST)/bin
 endif
@@ -129,24 +129,20 @@ endif
 include $(topsrcdir)/config/rules.mk
 
 distclean::
 	cat unallmakefiles | $(XARGS) rm -f
 	rm -f unallmakefiles $(DIST_GARBAGE)
 
 ifeq ($(OS_ARCH),WINNT)
 # we want to copy PDB files on Windows
-MAKE_SYM_STORE_ARGS := -c
+MAKE_SYM_STORE_ARGS := -c --vcs-info
 ifdef PDBSTR_PATH
 MAKE_SYM_STORE_ARGS += -i
 endif
-ifeq (,$(CYGWIN_WRAPPER))
-# this doesn't work with Cygwin Python
-MAKE_SYM_STORE_ARGS += --vcs-info
-endif
 DUMP_SYMS_BIN ?= $(topsrcdir)/toolkit/crashreporter/tools/win32/dump_syms_vc$(_MSC_VER).exe
 # PDB files don't get moved to dist, so we need to scan the whole objdir
 MAKE_SYM_STORE_PATH := .
 endif
 ifeq ($(OS_ARCH),Darwin)
 # need to pass arch flags for universal builds
 ifdef UNIVERSAL_BINARY
 MAKE_SYM_STORE_ARGS := -c -a "i386 x86_64" --vcs-info
@@ -171,16 +167,19 @@ ifdef MOZ_SYMBOLS_EXTRA_BUILDID
 EXTRA_BUILDID := -$(MOZ_SYMBOLS_EXTRA_BUILDID)
 endif
 
 export SYMBOL_INDEX_NAME = \
   $(MOZ_APP_NAME)-$(MOZ_APP_VERSION)-$(OS_TARGET)-$(BUILDID)$(EXTRA_BUILDID)-symbols.txt
 
 buildsymbols:
 ifdef MOZ_CRASHREPORTER
+ifdef USE_ELF_HACK
+	$(MAKE) -C $(MOZ_BUILD_APP)/installer elfhack
+endif
 	echo building symbol store
 	$(RM) -rf $(DIST)/crashreporter-symbols
 	$(RM) -f "$(DIST)/$(SYMBOL_ARCHIVE_BASENAME).zip"
 	$(NSINSTALL) -D $(DIST)/crashreporter-symbols
 	$(PYTHON) $(topsrcdir)/toolkit/crashreporter/tools/symbolstore.py \
 	  $(MAKE_SYM_STORE_ARGS)                                          \
 	  $(foreach dir,$(SYM_STORE_SOURCE_DIRS),-s $(dir))               \
 	  $(DUMP_SYMS_BIN)                                                \
--- a/README.txt
+++ b/README.txt
@@ -18,8 +18,10 @@ on http://developer.mozilla.org, you can
 mozilla.* Usenet group, or on IRC at irc.mozilla.org. [The Mozilla news groups
 are accessible on Google Groups, or news.mozilla.org with a NNTP reader.]
 
 You can download nightly development builds from the Mozilla FTP server.
 Keep in mind that nightly builds, which are used by Mozilla developers for
 testing, may be buggy. Firefox nightlies, for example, can be found at:
 
     ftp://ftp.mozilla.org/pub/firefox/nightly/latest-trunk/
+            - or -
+    http://nightly.mozilla.org/
--- a/accessible/src/Makefile.in
+++ b/accessible/src/Makefile.in
@@ -69,13 +69,8 @@ ifdef MOZ_XUL
 DIRS +=   xul
 endif
 
 ifndef DISABLE_XFORMS_HOOKS
 DIRS +=   xforms
 endif
 
 include $(topsrcdir)/config/rules.mk
-
-GARBAGE += $(LIB_PREFIX)accessibility_toolkit_s.$(LIB_SUFFIX)  $(LIB_PREFIX)accessibility_toolkit_s.$(LIB_SUFFIX).fake
-
-libs::
-	$(INSTALL) $(PLATFORM_DIR)/$(LIB_PREFIX)accessibility_toolkit_s.$(LIB_SUFFIX) $(wildcard $(PLATFORM_DIR)/$(LIB_PREFIX)accessibility_toolkit_s.$(LIB_SUFFIX).fake) .
--- a/accessible/src/atk/Makefile.in
+++ b/accessible/src/atk/Makefile.in
@@ -38,16 +38,17 @@ DEPTH = ../../..
 topsrcdir = @top_srcdir@
 srcdir = @srcdir@
 VPATH = @srcdir@
 
 include $(DEPTH)/config/autoconf.mk
 
 MODULE = accessibility
 LIBRARY_NAME = accessibility_toolkit_s
+EXPORT_LIBRARY = ..
 LIBXUL_LIBRARY = 1
 
 
 CPPSRCS = \
   nsAccessNodeWrap.cpp \
   nsAccessibleWrap.cpp \
   nsDocAccessibleWrap.cpp \
   nsRootAccessibleWrap.cpp \
--- a/accessible/src/atk/nsAccessibleWrap.cpp
+++ b/accessible/src/atk/nsAccessibleWrap.cpp
@@ -1267,16 +1267,37 @@ nsAccessibleWrap::FirePlatformEvent(AccE
         MAI_LOG_DEBUG(("\n\nReceived: EVENT_WINDOW_DEACTIVATED\n"));
         nsRootAccessible *rootAcc =
           static_cast<nsRootAccessible *>(accessible);
         rootAcc->mActivated = PR_FALSE;
         guint id = g_signal_lookup ("deactivate", MAI_TYPE_ATK_OBJECT);
         g_signal_emit(atkObj, id, 0);
       } break;
 
+    case nsIAccessibleEvent::EVENT_WINDOW_MAXIMIZE:
+      {
+        MAI_LOG_DEBUG(("\n\nReceived: EVENT_WINDOW_MAXIMIZE\n"));
+        guint id = g_signal_lookup ("maximize", MAI_TYPE_ATK_OBJECT);
+        g_signal_emit(atkObj, id, 0);
+      } break;
+
+    case nsIAccessibleEvent::EVENT_WINDOW_MINIMIZE:
+      {
+        MAI_LOG_DEBUG(("\n\nReceived: EVENT_WINDOW_MINIMIZE\n"));
+        guint id = g_signal_lookup ("minimize", MAI_TYPE_ATK_OBJECT);
+        g_signal_emit(atkObj, id, 0);
+      } break;
+
+    case nsIAccessibleEvent::EVENT_WINDOW_RESTORE:
+      {
+        MAI_LOG_DEBUG(("\n\nReceived: EVENT_WINDOW_RESTORE\n"));
+        guint id = g_signal_lookup ("restore", MAI_TYPE_ATK_OBJECT);
+        g_signal_emit(atkObj, id, 0);
+      } break;
+
     case nsIAccessibleEvent::EVENT_DOCUMENT_LOAD_COMPLETE:
       {
         MAI_LOG_DEBUG(("\n\nReceived: EVENT_DOCUMENT_LOAD_COMPLETE\n"));
         g_signal_emit_by_name (atkObj, "load_complete");
       } break;
 
     case nsIAccessibleEvent::EVENT_DOCUMENT_RELOAD:
       {
--- a/accessible/src/atk/nsApplicationAccessibleWrap.cpp
+++ b/accessible/src/atk/nsApplicationAccessibleWrap.cpp
@@ -213,16 +213,34 @@ mai_util_get_type(void)
         };
 
         type = g_type_register_static(ATK_TYPE_UTIL,
                                       "MaiUtil", &tinfo, GTypeFlags(0));
     }
     return type;
 }
 
+static void
+window_added (AtkObject *atk_obj,
+              guint     index,
+              AtkObject *child)
+{
+  guint id =  g_signal_lookup ("create", MAI_TYPE_ATK_OBJECT);
+  g_signal_emit (child, id, 0);
+}
+
+static void
+window_removed (AtkObject *atk_obj,
+                guint     index,
+                AtkObject *child)
+{
+  guint id =  g_signal_lookup ("destroy", MAI_TYPE_ATK_OBJECT);
+  g_signal_emit (child, id, 0);
+}
+
 /* intialize the the atk interface (function pointers) with MAI implementation.
  * When atk bridge get loaded, these interface can be used.
  */
 static void
 mai_util_class_init(MaiUtilClass *klass)
 {
     AtkUtilClass *atk_class;
     gpointer data;
@@ -243,16 +261,20 @@ mai_util_class_init(MaiUtilClass *klass)
     atk_class->add_key_event_listener = mai_util_add_key_event_listener;
     atk_class->remove_key_event_listener = mai_util_remove_key_event_listener;
     atk_class->get_root = mai_util_get_root;
     atk_class->get_toolkit_name = mai_util_get_toolkit_name;
     atk_class->get_toolkit_version = mai_util_get_toolkit_version;
 
     listener_list = g_hash_table_new_full(g_int_hash, g_int_equal, NULL,
                                           _listener_info_destroy);
+    // Keep track of added/removed windows.
+    AtkObject *root = atk_get_root ();
+    g_signal_connect (root, "children-changed::add", (GCallback) window_added, NULL);
+    g_signal_connect (root, "children-changed::remove", (GCallback) window_removed, NULL);
 }
 
 static guint
 mai_util_add_global_event_listener(GSignalEmissionHook listener,
                                    const gchar *event_type)
 {
     guint rc = 0;
     gchar **split_string;
--- a/accessible/src/base/NotificationController.cpp
+++ b/accessible/src/base/NotificationController.cpp
@@ -176,19 +176,17 @@ NotificationController::ScheduleProcessi
     if (mPresShell->AddRefreshObserver(this, Flush_Display))
       mObservingState = eRefreshObserving;
   }
 }
 
 bool
 NotificationController::IsUpdatePending()
 {
-  nsCOMPtr<nsIPresShell_MOZILLA_2_0_BRANCH2> presShell =
-    do_QueryInterface(mPresShell);
-  return presShell->IsLayoutFlushObserver() ||
+  return mPresShell->IsLayoutFlushObserver() ||
     mObservingState == eRefreshProcessingForUpdate ||
     mContentInsertions.Length() != 0 || mNotifications.Length() != 0 ||
     mTextHash.Count() != 0;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // NotificationCollector: private
 
@@ -299,20 +297,20 @@ NotificationController::WillRefresh(mozi
   events.SwapElements(mEvents);
 
   PRUint32 eventCount = events.Length();
   for (PRUint32 idx = 0; idx < eventCount; idx++) {
     AccEvent* accEvent = events[idx];
     if (accEvent->mEventRule != AccEvent::eDoNotEmit) {
       mDocument->ProcessPendingEvent(accEvent);
 
-      AccMutationEvent* showOrhideEvent = downcast_accEvent(accEvent);
-      if (showOrhideEvent) {
-        if (showOrhideEvent->mTextChangeEvent)
-          mDocument->ProcessPendingEvent(showOrhideEvent->mTextChangeEvent);
+      AccMutationEvent* showOrHideEvent = downcast_accEvent(accEvent);
+      if (showOrHideEvent) {
+        if (showOrHideEvent->mTextChangeEvent)
+          mDocument->ProcessPendingEvent(showOrHideEvent->mTextChangeEvent);
       }
     }
     if (!mDocument)
       return;
   }
 
   // Stop further processing if there are no newly queued insertions,
   // notifications or events.
--- a/accessible/src/base/TextUpdater.cpp
+++ b/accessible/src/base/TextUpdater.cpp
@@ -65,17 +65,20 @@ TextUpdater::Run(nsDocAccessible* aDocum
   }
 }
 
 void
 TextUpdater::DoUpdate(const nsAString& aNewText, const nsAString& aOldText,
                       PRUint32 aSkipStart)
 {
   nsAccessible* parent = mTextLeaf->GetParent();
-  NS_ASSERTION(parent, "No parent for text leaf!");
+  if (!parent) {
+    NS_ERROR("No parent for text leaf!");
+    return;
+  }
 
   mHyperText = parent->AsHyperText();
   if (!mHyperText) {
     NS_ERROR("Text leaf parent is not hypertext!");
     return;
   }
 
   // Get the text leaf accessible offset and invalidate cached offsets after it.
--- a/accessible/src/base/nsAccTreeWalker.cpp
+++ b/accessible/src/base/nsAccTreeWalker.cpp
@@ -89,18 +89,18 @@ nsAccTreeWalker::~nsAccTreeWalker()
     PopState();
 
   MOZ_COUNT_DTOR(nsAccTreeWalker);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccTreeWalker: private
 
-already_AddRefed<nsAccessible>
-nsAccTreeWalker::GetNextChildInternal(PRBool aNoWalkUp)
+nsAccessible*
+nsAccTreeWalker::NextChildInternal(bool aNoWalkUp)
 {
   if (!mState || !mState->content)
     return nsnull;
 
   if (!mState->childList)
     mState->childList = mState->content->GetChildren(mChildFilter);
 
   nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
@@ -109,38 +109,38 @@ nsAccTreeWalker::GetNextChildInternal(PR
   if (mState->childList)
     mState->childList->GetLength(&length);
 
   while (mState->childIdx < length) {
     nsIContent* childNode = mState->childList->GetNodeAt(mState->childIdx);
     mState->childIdx++;
 
     bool isSubtreeHidden = false;
-    nsRefPtr<nsAccessible> accessible =
+    nsAccessible* accessible =
       GetAccService()->GetOrCreateAccessible(childNode, presShell, mWeakShell,
                                              &isSubtreeHidden);
 
     if (accessible)
-      return accessible.forget();
+      return accessible;
 
     // Walk down into subtree to find accessibles.
     if (!isSubtreeHidden) {
       if (!PushState(childNode))
         break;
 
-      accessible = GetNextChildInternal(PR_TRUE);
+      accessible = NextChildInternal(true);
       if (accessible)
-        return accessible.forget();
+        return accessible;
     }
   }
 
   // No more children, get back to the parent.
   PopState();
 
-  return aNoWalkUp ? nsnull : GetNextChildInternal(PR_FALSE);
+  return aNoWalkUp ? nsnull : NextChildInternal(false);
 }
 
 void
 nsAccTreeWalker::PopState()
 {
   WalkState* prevToLastState = mState->prevState;
   delete mState;
   mState = prevToLastState;
--- a/accessible/src/base/nsAccTreeWalker.h
+++ b/accessible/src/base/nsAccTreeWalker.h
@@ -54,33 +54,36 @@ class nsAccTreeWalker
 {
 public:
   nsAccTreeWalker(nsIWeakReference *aShell, nsIContent *aNode, 
                   PRBool aWalkAnonymousContent);
   virtual ~nsAccTreeWalker();
 
   /**
    * Return the next child accessible.
+   *
+   * @note Returned accessible is bound to the document, if the accessible is
+   *       rejected during tree creation then the caller should be unbind it
+   *       from the document.
    */
-  already_AddRefed<nsAccessible> GetNextChild()
+  inline nsAccessible* NextChild()
   {
-    return GetNextChildInternal(PR_FALSE);
+    return NextChildInternal(false);
   }
 
 private:
 
   /**
    * Return the next child accessible.
    *
    * @param  aNoWalkUp  [in] specifies the walk direction, true means we
    *                     shouldn't go up through the tree if we failed find
    *                     accessible children.
    */
-  already_AddRefed<nsAccessible>
-    GetNextChildInternal(PRBool aNoWalkUp = PR_FALSE);
+  nsAccessible* NextChildInternal(bool aNoWalkUp);
 
   /**
    * Create new state for the given node and push it on top of stack.
    *
    * @note State stack is used to navigate up/down the DOM subtree during
    *        accessible children search.
    */
   PRBool PushState(nsIContent *aNode);
--- a/accessible/src/base/nsAccUtils.cpp
+++ b/accessible/src/base/nsAccUtils.cpp
@@ -39,17 +39,16 @@
 #include "nsCoreUtils.h"
 #include "nsAccUtils.h"
 
 #include "nsIAccessibleStates.h"
 #include "nsIAccessibleTypes.h"
 
 #include "nsAccessibilityService.h"
 #include "nsAccessibilityAtoms.h"
-#include "nsAccTreeWalker.h"
 #include "nsARIAMap.h"
 #include "nsDocAccessible.h"
 #include "nsHyperTextAccessible.h"
 #include "nsHTMLTableAccessible.h"
 #include "nsTextAccessible.h"
 #include "nsXULTreeGridAccessible.h"
 
 #include "nsIDOMXULContainerElement.h"
@@ -329,33 +328,16 @@ nsAccUtils::HasDefinedARIAToken(nsIConte
                             nsAccessibilityAtoms::_empty, eCaseMatters) ||
       aContent->AttrValueIs(kNameSpaceID_None, aAtom,
                             nsAccessibilityAtoms::_undefined, eCaseMatters)) {
         return PR_FALSE;
   }
   return PR_TRUE;
 }
 
-PRBool
-nsAccUtils::HasAccessibleChildren(nsINode *aNode)
-{
-  if (!aNode)
-    return PR_FALSE;
-
-  nsIPresShell *presShell = nsCoreUtils::GetPresShellFor(aNode);
-  if (!presShell)
-    return PR_FALSE;
-
-  nsIContent *content = nsCoreUtils::GetRoleContent(aNode);
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(presShell));
-  nsAccTreeWalker walker(weakShell, content, PR_FALSE);
-  nsRefPtr<nsAccessible> accessible = walker.GetNextChild();
-  return accessible ? PR_TRUE : PR_FALSE;
-}
-
 nsAccessible *
 nsAccUtils::GetAncestorWithRole(nsAccessible *aDescendant, PRUint32 aRole)
 {
   nsAccessible *document = aDescendant->GetDocAccessible();
   nsAccessible *parent = aDescendant;
   while ((parent = parent->GetParent())) {
     PRUint32 testRole = parent->Role();
     if (testRole == aRole)
--- a/accessible/src/base/nsAccUtils.h
+++ b/accessible/src/base/nsAccUtils.h
@@ -178,21 +178,16 @@ public:
     nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(aContainer));
     nsCOMPtr<nsIPresShell> presShell;
     docShell->GetPresShell(getter_AddRefs(presShell));
     return presShell ?
       GetAccService()->GetDocAccessible(presShell->GetDocument()) : nsnull;
   }
 
   /**
-   * Return true if the given DOM node contains accessible children.
-   */
-  static PRBool HasAccessibleChildren(nsINode *aNode);
-
-  /**
     * Return ancestor in this document with the given role if it exists.
     *
     * @param  aDescendant  [in] descendant to start search with
     * @param  aRole        [in] role to find matching ancestor for
     * @return               the ancestor accessible with the given role, or
     *                       nsnull if no match is found
     */
    static nsAccessible * GetAncestorWithRole(nsAccessible *aDescendant,
@@ -370,26 +365,16 @@ public:
   {
     PRUint32 role = Role(aAcc);
     return role != nsIAccessibleRole::ROLE_TEXT_LEAF &&
            role != nsIAccessibleRole::ROLE_WHITESPACE &&
            role != nsIAccessibleRole::ROLE_STATICTEXT;
   }
 
   /**
-   * Return true if the given accessible hasn't children.
-   */
-  static inline PRBool IsLeaf(nsIAccessible *aAcc)
-  {
-    PRInt32 numChildren = 0;
-    aAcc->GetChildCount(&numChildren);
-    return numChildren == 0;
-  }
-
-  /**
    * Return true if the given accessible can't have children. Used when exposing
    * to platform accessibility APIs, should the children be pruned off?
    */
   static PRBool MustPrune(nsIAccessible *aAccessible);
 
   /**
    * Search hint enum constants. Used by GetHeaderCellsFor() method.
    */
--- a/accessible/src/base/nsAccessibilityService.cpp
+++ b/accessible/src/base/nsAccessibilityService.cpp
@@ -95,16 +95,18 @@
 #endif
 
 #ifndef DISABLE_XFORMS_HOOKS
 #include "nsXFormsFormControlsAccessible.h"
 #include "nsXFormsWidgetsAccessible.h"
 #endif
 
 #include "mozilla/FunctionTimer.h"
+#include "mozilla/dom/Element.h"
+#include "nsImageMapUtils.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessibilityService
 ////////////////////////////////////////////////////////////////////////////////
 
 nsAccessibilityService *nsAccessibilityService::gAccessibilityService = nsnull;
 PRBool nsAccessibilityService::gIsShutdown = PR_TRUE;
 
@@ -258,31 +260,22 @@ nsAccessibilityService::CreateHTMLCombob
   NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLImageAccessible(nsIContent* aContent,
                                                   nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIHTMLDocument> htmlDoc =
-    do_QueryInterface(aContent->GetCurrentDoc());
-
-  nsCOMPtr<nsIDOMHTMLMapElement> mapElm;
-  if (htmlDoc) {
-    nsAutoString mapElmName;
-    aContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::usemap,
-                      mapElmName);
-
-    if (!mapElmName.IsEmpty()) {
-      if (mapElmName.CharAt(0) == '#')
-        mapElmName.Cut(0,1);
-      mapElm = htmlDoc->GetImageMap(mapElmName);
-    }
-  }
+  nsAutoString mapElmName;
+  aContent->GetAttr(kNameSpaceID_None,
+                    nsAccessibilityAtoms::usemap,
+                    mapElmName);
+  nsCOMPtr<nsIDOMHTMLMapElement> mapElm =
+    nsImageMapUtils::FindImageMap(aContent->GetCurrentDoc(), mapElmName);
 
   nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
   nsAccessible* accessible = mapElm ?
     new nsHTMLImageMapAccessible(aContent, weakShell, mapElm) :
     new nsHTMLImageAccessibleWrap(aContent, weakShell);
   NS_IF_ADDREF(accessible);
   return accessible;
 }
@@ -533,16 +526,32 @@ nsAccessibilityService::UpdateText(nsIPr
                                    nsIContent* aContent)
 {
   nsDocAccessible* document = GetDocAccessible(aPresShell->GetDocument());
   if (document)
     document->UpdateText(aContent);
 }
 
 void
+nsAccessibilityService::UpdateListBullet(nsIPresShell* aPresShell,
+                                         nsIContent* aHTMLListItemContent,
+                                         bool aHasBullet)
+{
+  nsDocAccessible* document = GetDocAccessible(aPresShell->GetDocument());
+  if (document) {
+    nsAccessible* accessible = document->GetAccessible(aHTMLListItemContent);
+    if (accessible) {
+      nsHTMLLIAccessible* listItem = accessible->AsHTMLListItem();
+      if (listItem)
+        listItem->UpdateBullet(aHasBullet);
+    }
+  }
+}
+
+void
 nsAccessibilityService::PresShellDestroyed(nsIPresShell *aPresShell)
 {
   // Presshell destruction will automatically destroy shells for descendant
   // documents, so no need to worry about those. Just shut down the accessible
   // for this one document. That keeps us from having bad behavior in case of
   // deep bushy subtrees.
   // When document subtree containing iframe is hidden then we don't get
   // pagehide event for the iframe's underlying document and its presshell is
@@ -844,44 +853,40 @@ static PRBool HasRelatedContent(nsIConte
         // ancestor has activedescendant property, this content could be active
       return PR_TRUE;
     }
   }
 
   return PR_FALSE;
 }
 
-already_AddRefed<nsAccessible>
+nsAccessible*
 nsAccessibilityService::GetOrCreateAccessible(nsINode* aNode,
                                               nsIPresShell* aPresShell,
                                               nsIWeakReference* aWeakShell,
                                               bool* aIsSubtreeHidden)
 {
   if (!aPresShell || !aWeakShell || !aNode || gIsShutdown)
     return nsnull;
 
   if (aIsSubtreeHidden)
     *aIsSubtreeHidden = false;
 
   // Check to see if we already have an accessible for this node in the cache.
   nsAccessible* cachedAccessible = GetAccessibleInWeakShell(aNode, aWeakShell);
-  if (cachedAccessible) {
-    NS_ADDREF(cachedAccessible);
+  if (cachedAccessible)
     return cachedAccessible;
-  }
 
   // No cache entry, so we must create the accessible.
 
   if (aNode->IsNodeOfType(nsINode::eDOCUMENT)) {
     // If it's document node then ask accessible document loader for
     // document accessible, otherwise return null.
     nsCOMPtr<nsIDocument> document(do_QueryInterface(aNode));
-    nsAccessible *accessible = GetDocAccessible(document);
-    NS_IF_ADDREF(accessible);
-    return accessible;
+    return GetDocAccessible(document);
   }
 
   // We have a content node.
   if (!aNode->IsInDoc()) {
     NS_WARNING("Creating accessible for node with no document");
     return nsnull;
   }
 
@@ -910,26 +915,23 @@ nsAccessibilityService::GetOrCreateAcces
   }
 
   if (weakFrame.GetFrame()->GetContent() != content) {
     // Not the main content for this frame. This happens because <area>
     // elements return the image frame as their primary frame. The main content
     // for the image frame is the image content. If the frame is not an image
     // frame or the node is not an area element then null is returned.
     // This setup will change when bug 135040 is fixed.
-    nsAccessible* areaAcc = GetAreaAccessible(weakFrame.GetFrame(),
-                                              aNode, aWeakShell);
-    NS_IF_ADDREF(areaAcc);
-    return areaAcc;
+    return GetAreaAccessible(weakFrame.GetFrame(), aNode, aWeakShell);
   }
 
   nsDocAccessible* docAcc =
     GetAccService()->GetDocAccessible(aNode->GetOwnerDoc());
   if (!docAcc) {
-    NS_NOTREACHED("No document for accessible being created!");
+    NS_NOTREACHED("Node has no host document accessible!");
     return nsnull;
   }
 
   // Attempt to create an accessible based on what we know.
   nsRefPtr<nsAccessible> newAcc;
 
   // Create accessible for visible text frames.
   if (content->IsNodeOfType(nsINode::eTEXT)) {
@@ -940,17 +942,17 @@ nsAccessibilityService::GetOrCreateAcces
         *aIsSubtreeHidden = true;
 
       return nsnull;
     }
 
     newAcc = weakFrame->CreateAccessible();
     if (docAcc->BindToDocument(newAcc, nsnull)) {
       newAcc->AsTextLeaf()->SetText(text);
-      return newAcc.forget();
+      return newAcc;
     }
 
     return nsnull;
   }
 
   PRBool isHTML = content->IsHTML();
   if (isHTML && content->Tag() == nsAccessibilityAtoms::map) {
     // Create hyper text accessible for HTML map if it is used to group links
@@ -967,17 +969,17 @@ nsAccessibilityService::GetOrCreateAcces
       if (aIsSubtreeHidden)
         *aIsSubtreeHidden = true;
 
       return nsnull;
     }
 
     newAcc = new nsHyperTextAccessibleWrap(content, aWeakShell);
     if (docAcc->BindToDocument(newAcc, nsAccUtils::GetRoleMapEntry(aNode)))
-      return newAcc.forget();
+      return newAcc;
     return nsnull;
   }
 
   nsRoleMapEntry *roleMapEntry = nsAccUtils::GetRoleMapEntry(aNode);
   if (roleMapEntry && !nsCRT::strcmp(roleMapEntry->roleString, "presentation") &&
       !content->IsFocusable()) { // For presentation only
     // Only create accessible for role of "presentation" if it is focusable --
     // in that case we need an accessible in case it gets focused, we
@@ -1153,19 +1155,17 @@ nsAccessibilityService::GetOrCreateAcces
       newAcc = new nsHyperTextAccessibleWrap(content, aWeakShell);
     }
     else {  // XUL, SVG, MathML etc.
       // Interesting generic non-HTML container
       newAcc = new nsAccessibleWrap(content, aWeakShell);
     }
   }
 
-  if (docAcc->BindToDocument(newAcc, roleMapEntry))
-    return newAcc.forget();
-  return nsnull;
+  return docAcc->BindToDocument(newAcc, roleMapEntry) ? newAcc : nsnull;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessibilityService private
 
 PRBool
 nsAccessibilityService::Init()
 {
--- a/accessible/src/base/nsAccessibilityService.h
+++ b/accessible/src/base/nsAccessibilityService.h
@@ -115,16 +115,23 @@ public:
                                     nsIContent* aStartChild,
                                     nsIContent* aEndChild);
 
   virtual void ContentRemoved(nsIPresShell* aPresShell, nsIContent* aContainer,
                               nsIContent* aChild);
 
   virtual void UpdateText(nsIPresShell* aPresShell, nsIContent* aContent);
 
+  /**
+   * Update list bullet accessible.
+   */
+  virtual void UpdateListBullet(nsIPresShell* aPresShell,
+                                nsIContent* aHTMLListItemContent,
+                                bool aHasBullet);
+
   virtual void NotifyOfAnchorJumpTo(nsIContent *aTarget);
 
   virtual void PresShellDestroyed(nsIPresShell* aPresShell);
 
   /**
    * Notify that presshell is activated.
    */
   virtual void PresShellActivated(nsIPresShell* aPresShell);
@@ -146,20 +153,19 @@ public:
    * one.
    *
    * @param  aNode             [in] the given node
    * @param  aPresShell        [in] the pres shell of the node
    * @param  aWeakShell        [in] the weak shell for the pres shell
    * @param  aIsSubtreeHidden  [out, optional] indicates whether the node's
    *                             frame and its subtree is hidden
    */
-  already_AddRefed<nsAccessible>
-    GetOrCreateAccessible(nsINode* aNode, nsIPresShell* aPresShell,
-                          nsIWeakReference* aWeakShell,
-                          bool* aIsSubtreeHidden = nsnull);
+  nsAccessible* GetOrCreateAccessible(nsINode* aNode, nsIPresShell* aPresShell,
+                                      nsIWeakReference* aWeakShell,
+                                      bool* aIsSubtreeHidden = nsnull);
 
   /**
    * Return an accessible for the given DOM node.
    */
   nsAccessible* GetAccessible(nsINode* aNode);
 
   /**
    * Return an accessible for a DOM node in the given presshell.
--- a/accessible/src/base/nsAccessible.cpp
+++ b/accessible/src/base/nsAccessible.cpp
@@ -760,70 +760,64 @@ nsAccessible::GetFocusedChild(nsIAccessi
       focusedChild = nsnull;
   }
 
   NS_IF_ADDREF(*aFocusedChild = focusedChild);
   return NS_OK;
 }
 
 // nsAccessible::GetChildAtPoint()
-nsresult
-nsAccessible::GetChildAtPoint(PRInt32 aX, PRInt32 aY, PRBool aDeepestChild,
-                              nsIAccessible **aChild)
+nsAccessible*
+nsAccessible::GetChildAtPoint(PRInt32 aX, PRInt32 aY,
+                              EWhichChildAtPoint aWhichChild)
 {
   // If we can't find the point in a child, we will return the fallback answer:
   // we return |this| if the point is within it, otherwise nsnull.
   PRInt32 x = 0, y = 0, width = 0, height = 0;
   nsresult rv = GetBounds(&x, &y, &width, &height);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  nsCOMPtr<nsIAccessible> fallbackAnswer;
+  NS_ENSURE_SUCCESS(rv, nsnull);
+
+  nsAccessible* fallbackAnswer = nsnull;
   if (aX >= x && aX < x + width && aY >= y && aY < y + height)
     fallbackAnswer = this;
 
-  if (nsAccUtils::MustPrune(this)) {  // Do not dig any further
-    NS_IF_ADDREF(*aChild = fallbackAnswer);
-    return NS_OK;
-  }
+  if (nsAccUtils::MustPrune(this))  // Do not dig any further
+    return fallbackAnswer;
 
   // Search an accessible at the given point starting from accessible document
   // because containing block (see CSS2) for out of flow element (for example,
   // absolutely positioned element) may be different from its DOM parent and
   // therefore accessible for containing block may be different from accessible
   // for DOM parent but GetFrameForPoint() should be called for containing block
   // to get an out of flow element.
   nsDocAccessible *accDocument = GetDocAccessible();
-  NS_ENSURE_TRUE(accDocument, NS_ERROR_FAILURE);
+  NS_ENSURE_TRUE(accDocument, nsnull);
 
   nsIFrame *frame = accDocument->GetFrame();
-  NS_ENSURE_STATE(frame);
+  NS_ENSURE_TRUE(frame, nsnull);
 
   nsPresContext *presContext = frame->PresContext();
 
   nsIntRect screenRect = frame->GetScreenRectExternal();
   nsPoint offset(presContext->DevPixelsToAppUnits(aX - screenRect.x),
                  presContext->DevPixelsToAppUnits(aY - screenRect.y));
 
   nsCOMPtr<nsIPresShell> presShell = presContext->PresShell();
   nsIFrame *foundFrame = presShell->GetFrameForPoint(frame, offset);
 
   nsIContent* content = nsnull;
-  if (!foundFrame || !(content = foundFrame->GetContent())) {
-    NS_IF_ADDREF(*aChild = fallbackAnswer);
-    return NS_OK;
-  }
+  if (!foundFrame || !(content = foundFrame->GetContent()))
+    return fallbackAnswer;
 
   // Get accessible for the node with the point or the first accessible in
   // the DOM parent chain.
   nsAccessible* accessible =
    GetAccService()->GetAccessibleOrContainer(content, mWeakShell);
-  if (!accessible) {
-    NS_IF_ADDREF(*aChild = fallbackAnswer);
-    return NS_OK;
-  }
+  if (!accessible)
+    return fallbackAnswer;
 
   if (accessible == this) {
     // Manually walk through accessible children and see if the are within this
     // point. Skip offscreen or invisible accessibles. This takes care of cases
     // where layout won't walk into things for us, such as image map areas and
     // sub documents (XXX: subdocuments should be handled by methods of
     // nsOuterDocAccessibles).
     PRInt32 childCount = GetChildCount();
@@ -831,78 +825,76 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
       nsAccessible *child = GetChildAt(childIdx);
 
       PRInt32 childX, childY, childWidth, childHeight;
       child->GetBounds(&childX, &childY, &childWidth, &childHeight);
       if (aX >= childX && aX < childX + childWidth &&
           aY >= childY && aY < childY + childHeight &&
           (nsAccUtils::State(child) & nsIAccessibleStates::STATE_INVISIBLE) == 0) {
 
-        if (aDeepestChild)
-          return child->GetDeepestChildAtPoint(aX, aY, aChild);
-
-        NS_IF_ADDREF(*aChild = child);
-        return NS_OK;
+        if (aWhichChild == eDeepestChild)
+          return child->GetChildAtPoint(aX, aY, eDeepestChild);
+
+        return child;
       }
     }
 
     // The point is in this accessible but not in a child. We are allowed to
     // return |this| as the answer.
-    NS_IF_ADDREF(*aChild = accessible);
-    return NS_OK;
+    return accessible;
   }
 
   // Since DOM node of obtained accessible may be out of flow then we should
   // ensure obtained accessible is a child of this accessible.
-  nsCOMPtr<nsIAccessible> parent, child(accessible);
-  while (PR_TRUE) {
-    child->GetParent(getter_AddRefs(parent));
+  nsAccessible* child = accessible;
+  while (true) {
+    nsAccessible* parent = child->GetParent();
     if (!parent) {
       // Reached the top of the hierarchy. These bounds were inside an
       // accessible that is not a descendant of this one.
-      NS_IF_ADDREF(*aChild = fallbackAnswer);      
-      return NS_OK;
+      return fallbackAnswer;
     }
 
-    if (parent == this) {
-      NS_ADDREF(*aChild = (aDeepestChild ? accessible : child));
-      return NS_OK;
-    }
-    child.swap(parent);
+    if (parent == this)
+      return aWhichChild == eDeepestChild ? accessible : child;
+
+    child = parent;
   }
 
-  return NS_OK;
+  return nsnull;
 }
 
 // nsIAccessible getChildAtPoint(in long x, in long y)
 NS_IMETHODIMP
 nsAccessible::GetChildAtPoint(PRInt32 aX, PRInt32 aY,
                               nsIAccessible **aAccessible)
 {
   NS_ENSURE_ARG_POINTER(aAccessible);
   *aAccessible = nsnull;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  return GetChildAtPoint(aX, aY, PR_FALSE, aAccessible);
+  NS_IF_ADDREF(*aAccessible = GetChildAtPoint(aX, aY, eDirectChild));
+  return NS_OK;
 }
 
 // nsIAccessible getDeepestChildAtPoint(in long x, in long y)
 NS_IMETHODIMP
 nsAccessible::GetDeepestChildAtPoint(PRInt32 aX, PRInt32 aY,
                                      nsIAccessible **aAccessible)
 {
   NS_ENSURE_ARG_POINTER(aAccessible);
   *aAccessible = nsnull;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  return GetChildAtPoint(aX, aY, PR_TRUE, aAccessible);
+  NS_IF_ADDREF(*aAccessible = GetChildAtPoint(aX, aY, eDeepestChild));
+  return NS_OK;
 }
 
 void nsAccessible::GetBoundsRect(nsRect& aTotalBounds, nsIFrame** aBoundingFrame)
 {
 /*
  * This method is used to determine the bounds of a content node.
  * Because HTML wraps and links are not always rectangular, this
  * method uses the following algorithm:
@@ -2711,17 +2703,17 @@ nsAccessible::GetNameInternal(nsAString&
 void
 nsAccessible::BindToParent(nsAccessible* aParent, PRUint32 aIndexInParent)
 {
   NS_PRECONDITION(aParent, "This method isn't used to set null parent!");
 
   if (mParent) {
     if (mParent != aParent) {
       NS_ERROR("Adopting child!");
-      mParent->InvalidateChildren();
+      mParent->RemoveChild(this);
     } else {
       NS_ERROR("Binding to the same parent!");
       return;
     }
   }
 
   mParent = aParent;
   mIndexInParent = aIndexInParent;
@@ -3125,18 +3117,18 @@ nsAccessible::UnselectAll()
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessible protected methods
 
 void
 nsAccessible::CacheChildren()
 {
   nsAccTreeWalker walker(mWeakShell, mContent, GetAllowsAnonChildAccessibles());
 
-  nsRefPtr<nsAccessible> child;
-  while ((child = walker.GetNextChild()) && AppendChild(child));
+  nsAccessible* child = nsnull;
+  while ((child = walker.NextChild()) && AppendChild(child));
 }
 
 void
 nsAccessible::TestChildCache(nsAccessible* aCachedChild) const
 {
 #ifdef DEBUG
   PRInt32 childCount = mChildren.Length();
   if (childCount == 0) {
@@ -3223,25 +3215,47 @@ nsAccessible::GetSiblingAtOffset(PRInt32
     *aError = NS_ERROR_UNEXPECTED;
 
   return child;
 }
 
 nsAccessible *
 nsAccessible::GetFirstAvailableAccessible(nsINode *aStartNode) const
 {
-  nsAccessible *accessible =
+  nsAccessible* accessible =
     GetAccService()->GetAccessibleInWeakShell(aStartNode, mWeakShell);
   if (accessible)
     return accessible;
 
-  nsIContent *content = nsCoreUtils::GetRoleContent(aStartNode);
-  nsAccTreeWalker walker(mWeakShell, content, PR_FALSE);
-  nsRefPtr<nsAccessible> childAccessible = walker.GetNextChild();
-  return childAccessible;
+  nsCOMPtr<nsIDOMDocumentTraversal> trav =
+    do_QueryInterface(aStartNode->GetOwnerDoc());
+  NS_ENSURE_TRUE(trav, nsnull);
+
+  nsCOMPtr<nsIDOMNode> currentNode = do_QueryInterface(aStartNode);
+  nsCOMPtr<nsIDOMNode> rootNode(do_QueryInterface(GetNode()));
+  nsCOMPtr<nsIDOMTreeWalker> walker;
+  trav->CreateTreeWalker(rootNode,
+                         nsIDOMNodeFilter::SHOW_ELEMENT | nsIDOMNodeFilter::SHOW_TEXT,
+                         nsnull, PR_FALSE, getter_AddRefs(walker));
+  NS_ENSURE_TRUE(walker, nsnull);
+
+  walker->SetCurrentNode(currentNode);
+  while (true) {
+    walker->NextNode(getter_AddRefs(currentNode));
+    if (!currentNode)
+      return nsnull;
+
+    nsCOMPtr<nsINode> node(do_QueryInterface(currentNode));
+    nsAccessible* accessible =
+      GetAccService()->GetAccessibleInWeakShell(node, mWeakShell);
+    if (accessible)
+      return accessible;
+  }
+
+  return nsnull;
 }
 
 PRBool nsAccessible::CheckVisibilityInParentChain(nsIDocument* aDocument, nsIView* aView)
 {
   nsIDocument* document = aDocument;
   nsIView* view = aView;
   // both view chain and widget chain are broken between chrome and content
   while (document != nsnull) {
@@ -3292,17 +3306,17 @@ nsAccessible::GetAttrValue(nsIAtom *aPro
   nsAutoString attrValue;
   mContent->GetAttr(kNameSpaceID_None, aProperty, attrValue);
 
   // Return zero value if there is no attribute or its value is empty.
   if (attrValue.IsEmpty())
     return NS_OK;
 
   PRInt32 error = NS_OK;
-  double value = attrValue.ToFloat(&error);
+  double value = attrValue.ToDouble(&error);
   if (NS_SUCCEEDED(error))
     *aValue = value;
 
   return NS_OK;
 }
 
 PRUint32
 nsAccessible::GetActionRule(PRUint32 aStates)
--- a/accessible/src/base/nsAccessible.h
+++ b/accessible/src/base/nsAccessible.h
@@ -53,16 +53,17 @@
 #include "nsTArray.h"
 #include "nsRefPtrHashtable.h"
 
 class AccEvent;
 class AccGroupInfo;
 class EmbeddedObjCollector;
 class nsAccessible;
 class nsHyperTextAccessible;
+class nsHTMLLIAccessible;
 struct nsRoleMapEntry;
 class nsTextAccessible;
 
 struct nsRect;
 class nsIContent;
 class nsIFrame;
 class nsIAtom;
 class nsIView;
@@ -184,26 +185,33 @@ public:
 
   /**
    * Returns attributes for accessible without explicitly setted ARIA
    * attributes.
    */
   virtual nsresult GetAttributesInternal(nsIPersistentProperties *aAttributes);
 
   /**
+   * Used by GetChildAtPoint() method to get direct or deepest child at point.
+   */
+  enum EWhichChildAtPoint {
+    eDirectChild,
+    eDeepestChild
+  };
+
+  /**
    * Return direct or deepest child at the given point.
    *
-   * @param  aX             [in] x coordinate relative screen
-   * @param  aY             [in] y coordinate relative screen
-   * @param  aDeepestChild  [in] flag points if deep child should be returned
-   * @param  aChild         [out] found child
+   * @param  aX           [in] x coordinate relative screen
+   * @param  aY           [in] y coordinate relative screen
+   * @param  aWhichChild  [in] flag points if deepest or direct child
+   *                        should be returned
    */
-  virtual nsresult GetChildAtPoint(PRInt32 aX, PRInt32 aY,
-                                   PRBool aDeepestChild,
-                                   nsIAccessible **aChild);
+  virtual nsAccessible* GetChildAtPoint(PRInt32 aX, PRInt32 aY,
+                                        EWhichChildAtPoint aWhichChild);
 
   /**
    * Return calculated group level based on accessible hierarchy.
    */
   virtual PRInt32 GetLevelInternal();
 
   /**
    * Calculate position in group and group size ('posinset' and 'setsize') based
@@ -359,16 +367,19 @@ public:
   //////////////////////////////////////////////////////////////////////////////
   // Downcasting
 
   inline bool IsApplication() const { return mFlags & eApplicationAccessible; }
 
   inline bool IsHyperText() const { return mFlags & eHyperTextAccessible; }
   nsHyperTextAccessible* AsHyperText();
 
+  inline bool IsHTMLListItem() const { return mFlags & eHTMLListItemAccessible; }
+  nsHTMLLIAccessible* AsHTMLListItem();
+
   inline bool IsRoot() const { return mFlags & eRootAccessible; }
   nsRootAccessible* AsRoot();
 
   inline bool IsTextLeaf() const { return mFlags & eTextLeafAccessible; }
   nsTextAccessible* AsTextLeaf();
 
   //////////////////////////////////////////////////////////////////////////////
   // HyperLinkAccessible
@@ -507,18 +518,19 @@ protected:
 
   /**
    * Flags describing the accessible itself.
    * @note keep these flags in sync with ChildrenFlags
    */
   enum AccessibleTypes {
     eApplicationAccessible = 1 << 2,
     eHyperTextAccessible = 1 << 3,
-    eRootAccessible = 1 << 4,
-    eTextLeafAccessible = 1 << 5
+    eHTMLListItemAccessible = 1 << 4,
+    eRootAccessible = 1 << 5,
+    eTextLeafAccessible = 1 << 6
   };
 
   //////////////////////////////////////////////////////////////////////////////
   // Miscellaneous helpers
 
   /**
    * Return ARIA role (helper method).
    */
--- a/accessible/src/base/nsApplicationAccessible.cpp
+++ b/accessible/src/base/nsApplicationAccessible.cpp
@@ -165,32 +165,21 @@ nsApplicationAccessible::GroupPosition(P
   *aGroupLevel = 0;
   NS_ENSURE_ARG_POINTER(aSimilarItemsInGroup);
   *aSimilarItemsInGroup = 0;
   NS_ENSURE_ARG_POINTER(aPositionInGroup);
   *aPositionInGroup = 0;
   return NS_OK;
 }
 
-NS_IMETHODIMP
+nsAccessible*
 nsApplicationAccessible::GetChildAtPoint(PRInt32 aX, PRInt32 aY,
-                                         nsIAccessible **aChild)
+                                         EWhichChildAtPoint aWhichChild)
 {
-  NS_ENSURE_ARG_POINTER(aChild);
-  *aChild = nsnull;
-  return NS_ERROR_NOT_IMPLEMENTED;
-}
-
-NS_IMETHODIMP
-nsApplicationAccessible::GetDeepestChildAtPoint(PRInt32 aX, PRInt32 aY,
-                                                nsIAccessible **aChild)
-{
-  NS_ENSURE_ARG_POINTER(aChild);
-  *aChild = nsnull;
-  return NS_ERROR_NOT_IMPLEMENTED;
+  return nsnull;
 }
 
 NS_IMETHODIMP
 nsApplicationAccessible::GetRelationByType(PRUint32 aRelationType,
                                            nsIAccessibleRelation **aRelation)
 {
   NS_ENSURE_ARG_POINTER(aRelation);
   *aRelation = nsnull;
--- a/accessible/src/base/nsApplicationAccessible.h
+++ b/accessible/src/base/nsApplicationAccessible.h
@@ -93,18 +93,16 @@ public:
   NS_IMETHOD GetName(nsAString &aName);
   NS_IMETHOD GetValue(nsAString &aValue);
   NS_IMETHOD GetDescription(nsAString &aDescription);
   NS_IMETHOD GetKeyboardShortcut(nsAString &aKeyboardShortcut);
   NS_IMETHOD GetState(PRUint32 *aState , PRUint32 *aExtraState );
   NS_IMETHOD GetAttributes(nsIPersistentProperties **aAttributes);
   NS_IMETHOD GroupPosition(PRInt32 *aGroupLevel, PRInt32 *aSimilarItemsInGroup,
                            PRInt32 *aPositionInGroup);
-  NS_IMETHOD GetChildAtPoint(PRInt32 aX, PRInt32 aY, nsIAccessible **aChild);
-  NS_IMETHOD GetDeepestChildAtPoint(PRInt32 aX, PRInt32 aY, nsIAccessible **aChild);
   NS_IMETHOD GetRelationByType(PRUint32 aRelationType,
                                nsIAccessibleRelation **aRelation);
   NS_IMETHOD GetRelationsCount(PRUint32 *aRelationsCount);
   NS_IMETHOD GetRelation(PRUint32 aIndex, nsIAccessibleRelation **aRelation);
   NS_IMETHOD GetRelations(nsIArray **aRelations);
   NS_IMETHOD GetBounds(PRInt32 *aX, PRInt32 *aY,
                        PRInt32 *aWidth, PRInt32 *aHeight);
   NS_IMETHOD SetSelected(PRBool aIsSelected);
@@ -123,16 +121,18 @@ public:
   virtual PRBool Init();
   virtual void Shutdown();
   virtual bool IsPrimaryForNode() const;
 
   // nsAccessible
   virtual nsresult GetARIAState(PRUint32 *aState, PRUint32 *aExtraState);
   virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
+  virtual nsAccessible* GetChildAtPoint(PRInt32 aX, PRInt32 aY,
+                                        EWhichChildAtPoint aWhichChild);
 
   virtual void InvalidateChildren();
 
 protected:
 
   // nsAccessible
   virtual void CacheChildren();
   virtual nsAccessible* GetSiblingAtOffset(PRInt32 aOffset,
--- a/accessible/src/base/nsBaseWidgetAccessible.cpp
+++ b/accessible/src/base/nsBaseWidgetAccessible.cpp
@@ -62,24 +62,22 @@ nsLeafAccessible::
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsLeafAccessible, nsAccessible)
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsLeafAccessible: nsAccessible public
 
-nsresult
+nsAccessible*
 nsLeafAccessible::GetChildAtPoint(PRInt32 aX, PRInt32 aY,
-                                  PRBool aDeepestChild,
-                                  nsIAccessible **aChild)
+                                  EWhichChildAtPoint aWhichChild)
 {
   // Don't walk into leaf accessibles.
-  NS_ADDREF(*aChild = this);
-  return NS_OK;
+  return this;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsLeafAccessible: nsAccessible private
 
 void
 nsLeafAccessible::CacheChildren()
 {
--- a/accessible/src/base/nsBaseWidgetAccessible.h
+++ b/accessible/src/base/nsBaseWidgetAccessible.h
@@ -58,19 +58,18 @@ public:
   using nsAccessible::GetChildAtPoint;
 
   nsLeafAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsAccessible
-  virtual nsresult GetChildAtPoint(PRInt32 aX, PRInt32 aY,
-                                   PRBool aDeepestChild,
-                                   nsIAccessible **aChild);
+  virtual nsAccessible* GetChildAtPoint(PRInt32 aX, PRInt32 aY,
+                                        EWhichChildAtPoint aWhichChild);
 
 protected:
 
   // nsAccessible
   virtual void CacheChildren();
 };
 
 /**
--- a/accessible/src/base/nsDocAccessible.cpp
+++ b/accessible/src/base/nsDocAccessible.cpp
@@ -645,16 +645,21 @@ nsDocAccessible::Shutdown()
 
   if (mNotificationController) {
     mNotificationController->Shutdown();
     mNotificationController = nsnull;
   }
 
   RemoveEventListeners();
 
+  // Mark the document as shutdown before AT is notified about the document
+  // removal from its container (valid for root documents on ATK).
+  nsCOMPtr<nsIDocument> kungFuDeathGripDoc = mDocument;
+  mDocument = nsnull;
+
   if (mParent) {
     nsDocAccessible* parentDocument = mParent->GetDocAccessible();
     if (parentDocument)
       parentDocument->RemoveChildDocument(this);
 
     mParent->RemoveChild(this);
   }
 
@@ -667,19 +672,16 @@ nsDocAccessible::Shutdown()
   mChildDocuments.Clear();
 
   mWeakShell = nsnull;  // Avoid reentrancy
 
   mDependentIDsHash.Clear();
   mNodeToAccessibleMap.Clear();
   ClearCache(mAccessibleCache);
 
-  nsCOMPtr<nsIDocument> kungFuDeathGripDoc = mDocument;
-  mDocument = nsnull;
-
   nsHyperTextAccessibleWrap::Shutdown();
 
   GetAccService()->NotifyOfDocumentShutdown(kungFuDeathGripDoc);
 }
 
 nsIFrame*
 nsDocAccessible::GetFrame() const
 {
@@ -1224,29 +1226,27 @@ nsDocAccessible::ARIAAttributeChanged(ns
 
 void nsDocAccessible::ContentAppended(nsIDocument *aDocument,
                                       nsIContent* aContainer,
                                       nsIContent* aFirstNewContent,
                                       PRInt32 /* unused */)
 {
 }
 
-void nsDocAccessible::ContentStatesChanged(nsIDocument* aDocument,
-                                           nsIContent* aContent1,
-                                           nsIContent* aContent2,
-                                           nsEventStates aStateMask)
+void nsDocAccessible::ContentStateChanged(nsIDocument* aDocument,
+                                          nsIContent* aContent,
+                                          nsEventStates aStateMask)
 {
   if (aStateMask.HasState(NS_EVENT_STATE_CHECKED)) {
-    nsHTMLSelectOptionAccessible::SelectionChangedIfOption(aContent1);
-    nsHTMLSelectOptionAccessible::SelectionChangedIfOption(aContent2);
+    nsHTMLSelectOptionAccessible::SelectionChangedIfOption(aContent);
   }
 
   if (aStateMask.HasState(NS_EVENT_STATE_INVALID)) {
     nsRefPtr<AccEvent> event =
-      new AccStateChangeEvent(aContent1, nsIAccessibleStates::STATE_INVALID,
+      new AccStateChangeEvent(aContent, nsIAccessibleStates::STATE_INVALID,
                               PR_FALSE, PR_TRUE);
     FireDelayedAccessibleEvent(event);
    }
 }
 
 void nsDocAccessible::DocumentStatesChanged(nsIDocument* aDocument,
                                             nsEventStates aStateMask)
 {
@@ -1467,17 +1467,20 @@ nsDocAccessible::NotifyOfCachingEnd(nsAc
     // Invalidate children of container accessible for each element in
     // invalidation list.
     for (PRUint32 idx = 0; idx < mInvalidationList.Length(); idx++) {
       nsIContent* content = mInvalidationList[idx];
       if (!HasAccessible(content)) {
         // Make sure we keep children updated. While we're inside of caching
         // loop then we must exist it with cached children.
         nsAccessible* container = GetContainerAccessible(content);
-        container->UpdateChildren();
+        NS_ASSERTION(container,
+                     "Got a referenced element that is not in document!");
+        if (container)
+          container->UpdateChildren();
       }
     }
     mInvalidationList.Clear();
 
     mCacheRoot = nsnull;
     mIsPostCacheProcessing = PR_FALSE;
   }
 }
@@ -1488,18 +1491,18 @@ nsDocAccessible::NotifyOfCachingEnd(nsAc
 void
 nsDocAccessible::CacheChildren()
 {
   // Search for accessible children starting from the document element since
   // some web pages tend to insert elements under it rather than document body.
   nsAccTreeWalker walker(mWeakShell, mDocument->GetRootElement(),
                          GetAllowsAnonChildAccessibles());
 
-  nsRefPtr<nsAccessible> child;
-  while ((child = walker.GetNextChild()) && AppendChild(child));
+  nsAccessible* child = nsnull;
+  while ((child = walker.NextChild()) && AppendChild(child));
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // Protected members
 
 void
 nsDocAccessible::NotifyOfInitialUpdate()
 {
@@ -1945,18 +1948,19 @@ nsDocAccessible::UpdateTreeInternal(nsIC
 void
 nsDocAccessible::CacheChildrenInSubtree(nsAccessible* aRoot)
 {
   aRoot->EnsureChildren();
 
   PRUint32 count = aRoot->GetChildCount();
   for (PRUint32 idx = 0; idx < count; idx++)  {
     nsAccessible* child = aRoot->GetChildAt(idx);
+    NS_ASSERTION(child, "Illicit tree change while tree is created!");
     // Don't cross document boundaries.
-    if (child->IsContent())
+    if (child && child->IsContent())
       CacheChildrenInSubtree(child);
   }
 }
 
 void
 nsDocAccessible::UncacheChildrenInSubtree(nsAccessible* aRoot)
 {
   if (aRoot->IsElement())
--- a/accessible/src/base/nsOuterDocAccessible.cpp
+++ b/accessible/src/base/nsOuterDocAccessible.cpp
@@ -71,42 +71,35 @@ nsOuterDocAccessible::GetStateInternal(P
 {
   nsresult rv = nsAccessible::GetStateInternal(aState, aExtraState);
   NS_ENSURE_A11Y_SUCCESS(rv, rv);
 
   *aState &= ~nsIAccessibleStates::STATE_FOCUSABLE;
   return NS_OK;
 }
 
-nsresult
+nsAccessible*
 nsOuterDocAccessible::GetChildAtPoint(PRInt32 aX, PRInt32 aY,
-                                      PRBool aDeepestChild,
-                                      nsIAccessible **aChild)
+                                      EWhichChildAtPoint aWhichChild)
 {
   PRInt32 docX = 0, docY = 0, docWidth = 0, docHeight = 0;
   nsresult rv = GetBounds(&docX, &docY, &docWidth, &docHeight);
-  NS_ENSURE_SUCCESS(rv, rv);
+  NS_ENSURE_SUCCESS(rv, nsnull);
 
   if (aX < docX || aX >= docX + docWidth || aY < docY || aY >= docY + docHeight)
-    return NS_OK;
+    return nsnull;
 
   // Always return the inner doc as direct child accessible unless bounds
   // outside of it.
-  nsCOMPtr<nsIAccessible> childAcc;
-  rv = GetFirstChild(getter_AddRefs(childAcc));
-  NS_ENSURE_SUCCESS(rv, rv);
+  nsAccessible* child = GetChildAt(0);
+  NS_ENSURE_TRUE(child, nsnull);
 
-  if (!childAcc)
-    return NS_OK;
-
-  if (aDeepestChild)
-    return childAcc->GetDeepestChildAtPoint(aX, aY, aChild);
-
-  NS_ADDREF(*aChild = childAcc);
-  return NS_OK;
+  if (aWhichChild = eDeepestChild)
+    return child->GetChildAtPoint(aX, aY, eDeepestChild);
+  return child;
 }
 
 nsresult
 nsOuterDocAccessible::GetAttributesInternal(nsIPersistentProperties *aAttributes)
 {
   nsAutoString tag;
   aAttributes->GetStringProperty(NS_LITERAL_CSTRING("tag"), tag);
   if (!tag.IsEmpty()) {
--- a/accessible/src/base/nsOuterDocAccessible.h
+++ b/accessible/src/base/nsOuterDocAccessible.h
@@ -65,19 +65,18 @@ public:
 
   // nsAccessNode
   virtual void Shutdown();
 
   // nsAccessible
   virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
   virtual nsresult GetAttributesInternal(nsIPersistentProperties *aAttributes);
-  virtual nsresult GetChildAtPoint(PRInt32 aX, PRInt32 aY,
-                                   PRBool aDeepestChild,
-                                   nsIAccessible **aChild);
+  virtual nsAccessible* GetChildAtPoint(PRInt32 aX, PRInt32 aY,
+                                        EWhichChildAtPoint aWhichChild);
 
   virtual void InvalidateChildren();
   virtual PRBool AppendChild(nsAccessible *aAccessible);
   virtual PRBool RemoveChild(nsAccessible *aAccessible);
 
 protected:
   // nsAccessible
   virtual void CacheChildren();
--- a/accessible/src/html/nsHTMLImageMapAccessible.cpp
+++ b/accessible/src/html/nsHTMLImageMapAccessible.cpp
@@ -241,24 +241,22 @@ nsHTMLAreaAccessible::GetStateInternal(P
       mRoleMapEntry->role != nsIAccessibleRole::ROLE_NOTHING &&
       mRoleMapEntry->role != nsIAccessibleRole::ROLE_LINK) {
     return nsAccessible::GetStateInternal(aState,aExtraState);
   }
 
   return nsHTMLLinkAccessible::GetStateInternal(aState, aExtraState);
 }
 
-nsresult
+nsAccessible*
 nsHTMLAreaAccessible::GetChildAtPoint(PRInt32 aX, PRInt32 aY,
-                                      PRBool aDeepestChild,
-                                      nsIAccessible **aChild)
+                                      EWhichChildAtPoint aWhichChild)
 {
   // Don't walk into area accessibles.
-  NS_ADDREF(*aChild = this);
-  return NS_OK;
+  return this;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLImageMapAccessible: HyperLinkAccessible
 
 PRUint32
 nsHTMLAreaAccessible::StartOffset()
 {
--- a/accessible/src/html/nsHTMLImageMapAccessible.h
+++ b/accessible/src/html/nsHTMLImageMapAccessible.h
@@ -89,19 +89,18 @@ public:
   // nsIAccessible
   NS_IMETHOD GetDescription(nsAString& aDescription);
 
   NS_IMETHOD GetBounds(PRInt32 *x, PRInt32 *y, PRInt32 *width, PRInt32 *height);
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
-  virtual nsresult GetChildAtPoint(PRInt32 aX, PRInt32 aY,
-                                   PRBool aDeepestChild,
-                                   nsIAccessible **aChild);
+  virtual nsAccessible* GetChildAtPoint(PRInt32 aX, PRInt32 aY,
+                                        EWhichChildAtPoint aWhichChild);
 
   // HyperLinkAccessible
   virtual PRUint32 StartOffset();
   virtual PRUint32 EndOffset();
 
 protected:
 
   // nsAccessible
--- a/accessible/src/html/nsHTMLTableAccessible.cpp
+++ b/accessible/src/html/nsHTMLTableAccessible.cpp
@@ -434,21 +434,21 @@ void
 nsHTMLTableAccessible::CacheChildren()
 {
   // Move caption accessible so that it's the first child. Check for the first
   // caption only, because nsAccessibilityService ensures we don't create
   // accessibles for the other captions, since only the first is actually
   // visible.
   nsAccTreeWalker walker(mWeakShell, mContent, GetAllowsAnonChildAccessibles());
 
-  nsRefPtr<nsAccessible> child;
-  while ((child = walker.GetNextChild())) {
+  nsAccessible* child = nsnull;
+  while ((child = walker.NextChild())) {
     if (child->Role() == nsIAccessibleRole::ROLE_CAPTION) {
       InsertChildAt(0, child);
-      while ((child = walker.GetNextChild()) && AppendChild(child));
+      while ((child = walker.NextChild()) && AppendChild(child));
       break;
     }
     AppendChild(child);
   }
 }
 
 PRUint32
 nsHTMLTableAccessible::NativeRole()
--- a/accessible/src/html/nsHTMLTextAccessible.cpp
+++ b/accessible/src/html/nsHTMLTextAccessible.cpp
@@ -249,37 +249,36 @@ nsHTMLOutputAccessible::GetAttributesInt
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLLIAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLLIAccessible::
   nsHTMLLIAccessible(nsIContent* aContent, nsIWeakReference* aShell) :
-  nsHyperTextAccessibleWrap(aContent, aShell)
+  nsHyperTextAccessibleWrap(aContent, aShell), mBullet(nsnull)
 {
+  mFlags |= eHTMLListItemAccessible;
+
   nsBlockFrame* blockFrame = do_QueryFrame(GetFrame());
-  if (blockFrame && !blockFrame->BulletIsEmptyExternal()) {
-    mBulletAccessible = new nsHTMLListBulletAccessible(mContent, mWeakShell);
-    GetDocAccessible()->BindToDocument(mBulletAccessible, nsnull);
+  if (blockFrame && blockFrame->HasBullet()) {
+    mBullet = new nsHTMLListBulletAccessible(mContent, mWeakShell);
+    if (!GetDocAccessible()->BindToDocument(mBullet, nsnull))
+      mBullet = nsnull;
   }
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsHTMLLIAccessible, nsHyperTextAccessible)
 
 void
 nsHTMLLIAccessible::Shutdown()
 {
-  if (mBulletAccessible) {
-    // Ensure that pointer to this is nulled out.
-    mBulletAccessible->Shutdown();
-  }
+  mBullet = nsnull;
 
   nsHyperTextAccessibleWrap::Shutdown();
-  mBulletAccessible = nsnull;
 }
 
 PRUint32
 nsHTMLLIAccessible::NativeRole()
 {
   return nsIAccessibleRole::ROLE_LISTITEM;
 }
 
@@ -292,63 +291,81 @@ nsHTMLLIAccessible::GetStateInternal(PRU
 
   *aState |= nsIAccessibleStates::STATE_READONLY;
   return NS_OK;
 }
 
 NS_IMETHODIMP nsHTMLLIAccessible::GetBounds(PRInt32 *x, PRInt32 *y, PRInt32 *width, PRInt32 *height)
 {
   nsresult rv = nsAccessibleWrap::GetBounds(x, y, width, height);
-  if (NS_FAILED(rv) || !mBulletAccessible) {
+  if (NS_FAILED(rv) || !mBullet)
     return rv;
-  }
 
   PRInt32 bulletX, bulletY, bulletWidth, bulletHeight;
-  rv = mBulletAccessible->GetBounds(&bulletX, &bulletY, &bulletWidth, &bulletHeight);
+  rv = mBullet->GetBounds(&bulletX, &bulletY, &bulletWidth, &bulletHeight);
   NS_ENSURE_SUCCESS(rv, rv);
 
   *x = bulletX; // Move x coordinate of list item over to cover bullet as well
   *width += bulletWidth;
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
+// nsHTMLLIAccessible: public
+
+void
+nsHTMLLIAccessible::UpdateBullet(bool aHasBullet)
+{
+  if (aHasBullet == !!mBullet) {
+    NS_NOTREACHED("Bullet and accessible are in sync already!");
+    return;
+  }
+
+  nsDocAccessible* document = GetDocAccessible();
+  if (aHasBullet) {
+    mBullet = new nsHTMLListBulletAccessible(mContent, mWeakShell);
+    if (document->BindToDocument(mBullet, nsnull)) {
+      InsertChildAt(0, mBullet);
+    }
+  } else {
+    RemoveChild(mBullet);
+    document->UnbindFromDocument(mBullet);
+    mBullet = nsnull;
+  }
+
+  // XXXtodo: fire show/hide and reorder events. That's hard to make it
+  // right now because coalescence happens by DOM node.
+}
+
+////////////////////////////////////////////////////////////////////////////////
 // nsHTMLLIAccessible: nsAccessible protected
 
 void
 nsHTMLLIAccessible::CacheChildren()
 {
-  if (mBulletAccessible)
-    AppendChild(mBulletAccessible);
+  if (mBullet)
+    AppendChild(mBullet);
 
   // Cache children from subtree.
   nsAccessibleWrap::CacheChildren();
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLListBulletAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLListBulletAccessible::
   nsHTMLListBulletAccessible(nsIContent* aContent, nsIWeakReference* aShell) :
     nsLeafAccessible(aContent, aShell)
 {
-  mBulletText += ' '; // Otherwise bullets are jammed up against list text
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLListBulletAccessible: nsAccessNode
 
-void
-nsHTMLListBulletAccessible::Shutdown()
-{
-  mBulletText.Truncate();
-  nsLeafAccessible::Shutdown();
-}
-
 bool
 nsHTMLListBulletAccessible::IsPrimaryForNode() const
 {
   return false;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLListBulletAccessible: nsAccessible
@@ -358,16 +375,17 @@ nsHTMLListBulletAccessible::GetName(nsAS
 {
   aName.Truncate();
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   // Native anonymous content, ARIA can't be used. Get list bullet text.
   nsBlockFrame* blockFrame = do_QueryFrame(mContent->GetPrimaryFrame());
+  NS_ASSERTION(blockFrame, "No frame for list item!");
   if (blockFrame) {
     blockFrame->GetBulletText(aName);
 
     // Append space otherwise bullets are jammed up against list text.
     aName.Append(' ');
   }
 
   return NS_OK;
@@ -389,27 +407,23 @@ nsHTMLListBulletAccessible::GetStateInte
   *aState |= nsIAccessibleStates::STATE_READONLY;
   return NS_OK;
 }
 
 void
 nsHTMLListBulletAccessible::AppendTextTo(nsAString& aText, PRUint32 aStartOffset,
                                          PRUint32 aLength)
 {
+  nsAutoString bulletText;
   nsBlockFrame* blockFrame = do_QueryFrame(mContent->GetPrimaryFrame());
-  if (blockFrame) {
-    nsAutoString bulletText;
+  NS_ASSERTION(blockFrame, "No frame for list item!");
+  if (blockFrame)
     blockFrame->GetBulletText(bulletText);
 
-    PRUint32 maxLength = bulletText.Length() - aStartOffset;
-    if (aLength > maxLength)
-      aLength = maxLength;
-
-    aText += Substring(bulletText, aStartOffset, aLength);
-  }
+  aText.Append(Substring(bulletText, aStartOffset, aLength));
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLListAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLListAccessible::
   nsHTMLListAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
--- a/accessible/src/html/nsHTMLTextAccessible.h
+++ b/accessible/src/html/nsHTMLTextAccessible.h
@@ -131,33 +131,23 @@ class nsHTMLListBulletAccessible : publi
 {
 public:
   nsHTMLListBulletAccessible(nsIContent* aContent, nsIWeakReference* aShell);
 
   // nsIAccessible
   NS_IMETHOD GetName(nsAString& aName);
 
   // nsAccessNode
-  virtual void Shutdown();
   virtual bool IsPrimaryForNode() const;
 
   // nsAccessible
   virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
   virtual void AppendTextTo(nsAString& aText, PRUint32 aStartOffset = 0,
                             PRUint32 aLength = PR_UINT32_MAX);
-
-protected:
-  // XXX: Ideally we'd get the bullet text directly from the bullet frame via
-  // nsBulletFrame::GetListItemText(), but we'd need an interface for getting
-  // text from contentless anonymous frames. Perhaps something like
-  // nsIAnonymousFrame::GetText() ? However, in practice storing the bullet text
-  // here should not be a problem if we invalidate the right parts of
-  // the accessibility cache when mutation events occur.
-  nsString mBulletText;
 };
 
 /**
  * Used for HTML list (like HTML ul).
  */
 class nsHTMLListAccessible : public nsHyperTextAccessibleWrap
 {
 public:
@@ -177,27 +167,37 @@ public:
 class nsHTMLLIAccessible : public nsHyperTextAccessibleWrap
 {
 public:
   nsHTMLLIAccessible(nsIContent* aContent, nsIWeakReference* aShell);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
+  // nsAccessNode
+  virtual void Shutdown();
+
   // nsIAccessible
   NS_IMETHOD GetBounds(PRInt32 *x, PRInt32 *y, PRInt32 *width, PRInt32 *height);
 
-  // nsAccessNode
-  virtual void Shutdown();
-
   // nsAccessible
   virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 
+  // nsHTMLLIAccessible
+  void UpdateBullet(bool aHasBullet);
+
 protected:
   // nsAccessible
   virtual void CacheChildren();
 
 private:
-  nsRefPtr<nsHTMLListBulletAccessible> mBulletAccessible;
+  nsRefPtr<nsHTMLListBulletAccessible> mBullet;
 };
 
-#endif  
+inline nsHTMLLIAccessible*
+nsAccessible::AsHTMLListItem()
+{
+  return mFlags & eHTMLListItemAccessible ?
+    static_cast<nsHTMLLIAccessible*>(this) : nsnull;
+}
+
+#endif
--- a/accessible/src/html/nsHyperTextAccessible.cpp
+++ b/accessible/src/html/nsHyperTextAccessible.cpp
@@ -190,21 +190,18 @@ nsHyperTextAccessible::GetStateInternal(
     if (0 == (flags & nsIPlaintextEditor::eEditorReadonlyMask)) {
       *aExtraState |= nsIAccessibleStates::EXT_STATE_EDITABLE;
     }
   } else if (mContent->Tag() == nsAccessibilityAtoms::article) {
     // We want <article> to behave like a document in terms of readonly state.
     *aState |= nsIAccessibleStates::STATE_READONLY;
   }
 
-  PRInt32 childCount;
-  GetChildCount(&childCount);
-  if (childCount > 0) {
+  if (GetChildCount() > 0)
     *aExtraState |= nsIAccessibleStates::EXT_STATE_SELECTABLE_TEXT;
-  }
 
   return NS_OK;
 }
 
 // Substring must be entirely within the same text node
 nsIntRect nsHyperTextAccessible::GetBoundsForString(nsIFrame *aFrame, PRUint32 aStartRenderedOffset,
                                                     PRUint32 aEndRenderedOffset)
 {
--- a/accessible/src/mac/Makefile.in
+++ b/accessible/src/mac/Makefile.in
@@ -38,16 +38,17 @@ DEPTH = ../../..
 topsrcdir = @top_srcdir@
 srcdir = @srcdir@
 VPATH = @srcdir@
 
 include $(DEPTH)/config/autoconf.mk
 
 MODULE = accessibility
 LIBRARY_NAME = accessibility_toolkit_s
+EXPORT_LIBRARY = ..
 LIBXUL_LIBRARY = 1
 
   
   
 CMMSRCS = nsAccessNodeWrap.mm \
           nsDocAccessibleWrap.mm \
           nsRootAccessibleWrap.mm \
           nsAccessibleWrap.mm \
--- a/accessible/src/msaa/Makefile.in
+++ b/accessible/src/msaa/Makefile.in
@@ -38,16 +38,17 @@ DEPTH = ../../..
 topsrcdir = @top_srcdir@
 srcdir = @srcdir@
 VPATH = @srcdir@
 
 include $(DEPTH)/config/autoconf.mk
 
 MODULE = accessibility
 LIBRARY_NAME = accessibility_toolkit_s
+EXPORT_LIBRARY = ..
 LIBXUL_LIBRARY = 1
 
 
 CPPSRCS = \
   nsAccessNodeWrap.cpp \
   nsAccessibleWrap.cpp \
   nsTextAccessibleWrap.cpp \
   nsDocAccessibleWrap.cpp \
--- a/accessible/src/msaa/nsAccessNodeWrap.cpp
+++ b/accessible/src/msaa/nsAccessNodeWrap.cpp
@@ -303,17 +303,17 @@ STDMETHODIMP nsAccessNodeWrap::get_attri
 
 STDMETHODIMP nsAccessNodeWrap::get_attributesForNames( 
     /* [in] */ unsigned short aNumAttribs,
     /* [length_is][size_is][in] */ BSTR __RPC_FAR *aAttribNames,
     /* [length_is][size_is][in] */ short __RPC_FAR *aNameSpaceID,
     /* [length_is][size_is][retval] */ BSTR __RPC_FAR *aAttribValues)
 {
 __try {
-  if (IsDefunct() || IsDocument())
+  if (IsDefunct() || !IsElement())
     return E_FAIL;
 
   nsCOMPtr<nsIDOMElement> domElement(do_QueryInterface(mContent));
   nsCOMPtr<nsINameSpaceManager> nameSpaceManager =
     do_GetService(NS_NAMESPACEMANAGER_CONTRACTID);
 
   PRInt32 index;
 
@@ -611,35 +611,27 @@ void nsAccessNodeWrap::InitAccessibility
     if (!gmNotifyWinEvent)
       gmNotifyWinEvent = (LPFNNOTIFYWINEVENT)GetProcAddress(gmUserLib,"NotifyWinEvent");
     if (!gmGetGUIThreadInfo)
       gmGetGUIThreadInfo = (LPFNGETGUITHREADINFO)GetProcAddress(gmUserLib,"GetGUIThreadInfo");
   }
 
   DoATSpecificProcessing();
 
-  // Register window class that'll be used for document accessibles associated
-  // with tabs.
-  if (nsWinUtils::IsWindowEmulationEnabled()) {
-    nsWinUtils::RegisterNativeWindow(kClassNameTabContent);
-    sHWNDCache.Init(4);
-  }
+  nsWinUtils::MaybeStartWindowEmulation();
 
   nsAccessNode::InitXPAccessibility();
 }
 
 void nsAccessNodeWrap::ShutdownAccessibility()
 {
   NS_IF_RELEASE(gTextEvent);
   ::DestroyCaret();
 
-  // Unregister window call that's used for document accessibles associated
-  // with tabs.
-  if (nsWinUtils::IsWindowEmulationEnabled())
-    ::UnregisterClassW(kClassNameTabContent, GetModuleHandle(NULL));
+  nsWinUtils::ShutdownWindowEmulation();
 
   nsAccessNode::ShutdownXPAccessibility();
 }
 
 int nsAccessNodeWrap::FilterA11yExceptions(unsigned int aCode, EXCEPTION_POINTERS *aExceptionInfo)
 {
   if (aCode == EXCEPTION_ACCESS_VIOLATION) {
 #ifdef MOZ_CRASHREPORTER
--- a/accessible/src/msaa/nsAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsAccessibleWrap.cpp
@@ -198,17 +198,17 @@ STDMETHODIMP nsAccessibleWrap::get_accPa
   if (IsDefunct())
     return E_FAIL;
 
   nsRefPtr<nsDocAccessible> doc(do_QueryObject(this));
   if (doc) {
     // Return window system accessible object for root document and tab document
     // accessibles.
     if (!doc->ParentDocument() ||
-        nsWinUtils::IsWindowEmulationEnabled() &&
+        nsWinUtils::IsWindowEmulationStarted() &&
         nsWinUtils::IsTabDocument(doc->GetDocumentNode())) {
       HWND hwnd = static_cast<HWND>(doc->GetNativeWindow());
       if (hwnd && SUCCEEDED(AccessibleObjectFromWindow(hwnd, OBJID_WINDOW,
                                                        IID_IAccessible,
                                                        (void**)ppdispParent))) {
         return S_OK;
       }
     }
@@ -231,19 +231,17 @@ STDMETHODIMP nsAccessibleWrap::get_accPa
 
 STDMETHODIMP nsAccessibleWrap::get_accChildCount( long __RPC_FAR *pcountChildren)
 {
 __try {
   *pcountChildren = 0;
   if (nsAccUtils::MustPrune(this))
     return NS_OK;
 
-  PRInt32 numChildren;
-  GetChildCount(&numChildren);
-  *pcountChildren = numChildren;
+  *pcountChildren = GetChildCount();
 } __except(FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
 
   return S_OK;
 }
 
 STDMETHODIMP nsAccessibleWrap::get_accChild(
       /* [in] */ VARIANT varChild,
       /* [retval][out] */ IDispatch __RPC_FAR *__RPC_FAR *ppdispChild)
@@ -1009,19 +1007,17 @@ STDMETHODIMP
 nsAccessibleWrap::Skip(ULONG aNumElements)
 {
 __try {
   if (mEnumVARIANTPosition == kIEnumVariantDisconnected)
     return CO_E_OBJNOTCONNECTED;
 
   mEnumVARIANTPosition += aNumElements;
 
-  PRInt32 numChildren;
-  GetChildCount(&numChildren);
-
+  PRInt32 numChildren = GetChildCount();
   if (mEnumVARIANTPosition > numChildren)
   {
     mEnumVARIANTPosition = numChildren;
     return S_FALSE;
   }
 } __except(nsAccessNodeWrap::FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return NOERROR;
 }
--- a/accessible/src/msaa/nsDocAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsDocAccessibleWrap.cpp
@@ -250,20 +250,21 @@ STDMETHODIMP nsDocAccessibleWrap::get_ac
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessNode
 
 void
 nsDocAccessibleWrap::Shutdown()
 {
-  if (nsWinUtils::IsWindowEmulationEnabled()) {
+  // Do window emulation specific shutdown if emulation was started.
+  if (nsWinUtils::IsWindowEmulationStarted()) {
     // Destroy window created for root document.
     if (nsWinUtils::IsTabDocument(mDocument)) {
-      nsAccessibleWrap::sHWNDCache.Remove(mHWND);
+      sHWNDCache.Remove(mHWND);
       ::DestroyWindow(static_cast<HWND>(mHWND));
     }
 
     mHWND = nsnull;
   }
 
   nsDocAccessible::Shutdown();
 }
@@ -280,40 +281,40 @@ nsDocAccessibleWrap::GetNativeWindow() c
 ////////////////////////////////////////////////////////////////////////////////
 // nsDocAccessible protected
 
 void
 nsDocAccessibleWrap::NotifyOfInitialUpdate()
 {
   nsDocAccessible::NotifyOfInitialUpdate();
 
-  if (nsWinUtils::IsWindowEmulationEnabled()) {
+  if (nsWinUtils::IsWindowEmulationStarted()) {
     // Create window for tab document.
     if (nsWinUtils::IsTabDocument(mDocument)) {
       nsRootAccessible* rootDocument = RootAccessible();
 
       PRBool isActive = PR_TRUE;
       PRInt32 x = CW_USEDEFAULT, y = CW_USEDEFAULT, width = 0, height = 0;
-      if (nsWinUtils::IsWindowEmulationEnabled(kDolphinModuleHandle)) {
+      if (nsWinUtils::IsWindowEmulationFor(kDolphinModuleHandle)) {
         GetBounds(&x, &y, &width, &height);
         PRInt32 rootX = 0, rootY = 0, rootWidth = 0, rootHeight = 0;
         rootDocument->GetBounds(&rootX, &rootY, &rootWidth, &rootHeight);
         x = rootX - x;
         y -= rootY;
 
         nsCOMPtr<nsISupports> container = mDocument->GetContainer();
         nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(container);
         docShell->GetIsActive(&isActive);
       }
 
       HWND parentWnd = static_cast<HWND>(rootDocument->GetNativeWindow());
       mHWND = nsWinUtils::CreateNativeWindow(kClassNameTabContent, parentWnd,
                                              x, y, width, height, isActive);
 
-      nsAccessibleWrap::sHWNDCache.Put(mHWND, this);
+      sHWNDCache.Put(mHWND, this);
 
     } else {
       nsDocAccessible* parentDocument = ParentDocument();
       if (parentDocument)
         mHWND = parentDocument->GetNativeWindow();
     }
   }
 }
--- a/accessible/src/msaa/nsRootAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsRootAccessibleWrap.cpp
@@ -58,17 +58,17 @@ nsRootAccessibleWrap::~nsRootAccessibleW
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsRootAccessible
 
 void
 nsRootAccessibleWrap::DocumentActivated(nsDocAccessible* aDocument)
 {
-  if (nsWinUtils::IsWindowEmulationEnabled(kDolphinModuleHandle) &&
+  if (nsWinUtils::IsWindowEmulationFor(kDolphinModuleHandle) &&
       nsWinUtils::IsTabDocument(aDocument->GetDocumentNode())) {
     PRUint32 count = mChildDocuments.Length();
     for (PRUint32 idx = 0; idx < count; idx++) {
       nsDocAccessible* childDoc = mChildDocuments[idx];
       HWND childDocHWND = static_cast<HWND>(childDoc->GetNativeWindow());
       if (childDoc != aDocument)
         nsWinUtils::HideNativeWindow(childDocHWND);
       else
--- a/accessible/src/msaa/nsWinUtils.cpp
+++ b/accessible/src/msaa/nsWinUtils.cpp
@@ -94,16 +94,44 @@ nsWinUtils::ConvertToIA2Array(nsIArray *
     ::CoTaskMemFree(*aIA2Array);
     return GetHRESULT(rv);
   }
 
   *aIA2ArrayLen = length;
   return S_OK;
 }
 
+bool
+nsWinUtils::MaybeStartWindowEmulation()
+{
+  // Register window class that'll be used for document accessibles associated
+  // with tabs.
+  if (IsWindowEmulationFor(0)) {
+    RegisterNativeWindow(kClassNameTabContent);
+    nsAccessNodeWrap::sHWNDCache.Init(4);
+    return true;
+  }
+  return false;
+}
+
+void
+nsWinUtils::ShutdownWindowEmulation()
+{
+  // Unregister window call that's used for document accessibles associated
+  // with tabs.
+  if (IsWindowEmulationFor(0))
+    ::UnregisterClassW(kClassNameTabContent, GetModuleHandle(NULL));
+}
+
+bool
+nsWinUtils::IsWindowEmulationStarted()
+{
+  return nsAccessNodeWrap::sHWNDCache.IsInitialized();
+}
+
 void
 nsWinUtils::RegisterNativeWindow(LPCWSTR aWindowClass)
 {
   WNDCLASSW wc;
   wc.style = CS_GLOBALCLASS;
   wc.lpfnWndProc = nsAccessNodeWrap::WindowProc;
   wc.cbClsExtra = 0;
   wc.cbWndExtra = 0;
@@ -141,17 +169,17 @@ void
 nsWinUtils::HideNativeWindow(HWND aWnd)
 {
   ::SetWindowPos(aWnd, NULL, 0, 0, 0, 0,
                  SWP_HIDEWINDOW | SWP_NOSIZE | SWP_NOMOVE |
                  SWP_NOZORDER | SWP_NOACTIVATE);
 }
 
 bool
-nsWinUtils::IsWindowEmulationEnabled(LPCWSTR kModuleHandle)
+nsWinUtils::IsWindowEmulationFor(LPCWSTR kModuleHandle)
 {
   return kModuleHandle ? ::GetModuleHandleW(kModuleHandle) :
     ::GetModuleHandleW(kJAWSModuleHandle) ||
     ::GetModuleHandleW(kWEModuleHandle)  ||
     ::GetModuleHandleW(kDolphinModuleHandle);
 }
 
 bool
--- a/accessible/src/msaa/nsWinUtils.h
+++ b/accessible/src/msaa/nsWinUtils.h
@@ -59,16 +59,31 @@ public:
   /**
    * Convert nsIArray array of accessible objects to an array of IUnknown*
    * objects used in IA2 methods.
    */
   static HRESULT ConvertToIA2Array(nsIArray *aCollection,
                                    IUnknown ***aAccessibles, long *aCount);
 
   /**
+   * Start window emulation if presence of specific AT is detected.
+   */
+  static bool MaybeStartWindowEmulation();
+
+  /**
+   * Free resources used for window emulation.
+   */
+  static void ShutdownWindowEmulation();
+
+  /**
+   * Return true if window emulation is started.
+   */
+  static bool IsWindowEmulationStarted();
+
+  /**
    * Helper to register window class.
    */
   static void RegisterNativeWindow(LPCWSTR aWindowClass);
 
   /**
    * Helper to create a window.
    */
   static HWND CreateNativeWindow(LPCWSTR aWindowClass, HWND aParentWnd,
@@ -83,17 +98,17 @@ public:
   /**
    * Helper to hide window.
    */
   static void HideNativeWindow(HWND aWnd);
 
   /**
    * Return true if window emulation is enabled.
    */
-  static bool IsWindowEmulationEnabled(LPCWSTR kModuleHandle = 0);
+  static bool IsWindowEmulationFor(LPCWSTR kModuleHandle);
 
   /**
    * Return true if the given document node is for tab document accessible.
    */
   static bool IsTabDocument(nsIDocument* aDocumentNode);
 };
 
 #endif
--- a/accessible/src/other/Makefile.in
+++ b/accessible/src/other/Makefile.in
@@ -38,16 +38,17 @@ DEPTH = ../../..
 topsrcdir = @top_srcdir@
 srcdir = @srcdir@
 VPATH = @srcdir@
 
 include $(DEPTH)/config/autoconf.mk
 
 MODULE = accessibility
 LIBRARY_NAME = accessibility_toolkit_s
+EXPORT_LIBRARY = ..
 LIBXUL_LIBRARY = 1
 
 
 CPPSRCS = \
   nsAccessNodeWrap.cpp \
   nsAccessibleWrap.cpp \
   nsRootAccessibleWrap.cpp \
   $(NULL)
--- a/accessible/src/xforms/nsXFormsAccessible.cpp
+++ b/accessible/src/xforms/nsXFormsAccessible.cpp
@@ -125,17 +125,17 @@ nsXFormsAccessible::CacheSelectChildren(
 
   for (PRUint32 index = 0; index < length; index++) {
     nsCOMPtr<nsIDOMNode> DOMChild;
     children->Item(index, getter_AddRefs(DOMChild));
     if (!DOMChild)
       continue;
 
     nsCOMPtr<nsIContent> child(do_QueryInterface(DOMChild));
-    nsRefPtr<nsAccessible> accessible =
+    nsAccessible* accessible =
       GetAccService()->GetOrCreateAccessible(child, presShell, mWeakShell);
     if (!accessible)
       continue;
 
     AppendChild(accessible);
   }
 }
 
--- a/accessible/src/xforms/nsXFormsFormControlsAccessible.cpp
+++ b/accessible/src/xforms/nsXFormsFormControlsAccessible.cpp
@@ -357,62 +357,62 @@ nsXFormsRangeAccessible::GetMaximumValue
   NS_ENSURE_ARG_POINTER(aMaximumValue);
 
   nsAutoString value;
   nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mContent));
   nsresult rv = sXFormsService->GetRangeEnd(DOMNode, value);
   NS_ENSURE_SUCCESS(rv, rv);
 
   PRInt32 error = NS_OK;
-  *aMaximumValue = value.ToFloat(&error);
+  *aMaximumValue = value.ToDouble(&error);
   return error;
 }
 
 NS_IMETHODIMP
 nsXFormsRangeAccessible::GetMinimumValue(double *aMinimumValue)
 {
   NS_ENSURE_ARG_POINTER(aMinimumValue);
 
   nsAutoString value;
   nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mContent));
   nsresult rv = sXFormsService->GetRangeStart(DOMNode, value);
   NS_ENSURE_SUCCESS(rv, rv);
 
   PRInt32 error = NS_OK;
-  *aMinimumValue = value.ToFloat(&error);
+  *aMinimumValue = value.ToDouble(&error);
   return error;
 }
 
 NS_IMETHODIMP
 nsXFormsRangeAccessible::GetMinimumIncrement(double *aMinimumIncrement)
 {
   NS_ENSURE_ARG_POINTER(aMinimumIncrement);
 
   nsAutoString value;
   nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mContent));
   nsresult rv = sXFormsService->GetRangeStep(DOMNode, value);
   NS_ENSURE_SUCCESS(rv, rv);
 
   PRInt32 error = NS_OK;
-  *aMinimumIncrement = value.ToFloat(&error);
+  *aMinimumIncrement = value.ToDouble(&error);
   return error;
 }
 
 NS_IMETHODIMP
 nsXFormsRangeAccessible::GetCurrentValue(double *aCurrentValue)
 {
   NS_ENSURE_ARG_POINTER(aCurrentValue);
 
   nsAutoString value;
   nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mContent));
   nsresult rv = sXFormsService->GetValue(DOMNode, value);
   NS_ENSURE_SUCCESS(rv, rv);
 
   PRInt32 error = NS_OK;
-  *aCurrentValue = value.ToFloat(&error);
+  *aCurrentValue = value.ToDouble(&error);
   return error;
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsSelectAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
--- a/accessible/src/xul/nsXULColorPickerAccessible.cpp
+++ b/accessible/src/xul/nsXULColorPickerAccessible.cpp
@@ -158,21 +158,21 @@ nsXULColorPickerAccessible::NativeRole()
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULColorPickerAccessible: protected nsAccessible
 
 void
 nsXULColorPickerAccessible::CacheChildren()
 {
   nsAccTreeWalker walker(mWeakShell, mContent, PR_TRUE);
 
-  nsRefPtr<nsAccessible> child;
-  while ((child = walker.GetNextChild())) {
+  nsAccessible* child = nsnull;
+  while ((child = walker.NextChild())) {
     PRUint32 role = child->Role();
 
-    // Get an accessbile for menupopup or panel elements.
+    // Get an accessible for menupopup or panel elements.
     if (role == nsIAccessibleRole::ROLE_ALERT) {
       AppendChild(child);
       return;
     }
 
     // Unbind rejected accessibles from the document.
     GetDocAccessible()->UnbindFromDocument(child);
   }
--- a/accessible/src/xul/nsXULFormControlAccessible.cpp
+++ b/accessible/src/xul/nsXULFormControlAccessible.cpp
@@ -200,47 +200,47 @@ nsXULButtonAccessible::CacheChildren()
   PRBool isMenuButton = isMenu ?
     PR_FALSE :
     mContent->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
                           nsAccessibilityAtoms::menuButton, eCaseMatters);
 
   if (!isMenu && !isMenuButton)
     return;
 
-  nsRefPtr<nsAccessible> menupopupAccessible;
-  nsRefPtr<nsAccessible> buttonAccessible;
+  nsAccessible* menupopup = nsnull;
+  nsAccessible* button = nsnull;
 
   nsAccTreeWalker walker(mWeakShell, mContent, PR_TRUE);
 
-  nsRefPtr<nsAccessible> child;
-  while ((child = walker.GetNextChild())) {
+  nsAccessible* child = nsnull;
+  while ((child = walker.NextChild())) {
     PRUint32 role = child->Role();
 
     if (role == nsIAccessibleRole::ROLE_MENUPOPUP) {
-      // Get an accessbile for menupopup or panel elements.
-      menupopupAccessible.swap(child);
+      // Get an accessible for menupopup or panel elements.
+      menupopup = child;
 
     } else if (isMenuButton && role == nsIAccessibleRole::ROLE_PUSHBUTTON) {
       // Button type="menu-button" contains a real button. Get an accessible
-      // for it. Ignore dropmarker button what is placed as a last child.
-      buttonAccessible.swap(child);
+      // for it. Ignore dropmarker button which is placed as a last child.
+      button = child;
       break;
 
     } else {
       // Unbind rejected accessible from document.
       GetDocAccessible()->UnbindFromDocument(child);
     }
   }
 
-  if (!menupopupAccessible)
+  if (!menupopup)
     return;
 
-  AppendChild(menupopupAccessible);
-  if (buttonAccessible)
-    AppendChild(buttonAccessible);
+  AppendChild(menupopup);
+  if (button)
+    AppendChild(button);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULButtonAccessible protected
 
 PRBool
 nsXULButtonAccessible::ContainsMenu()
 {
@@ -564,17 +564,17 @@ nsXULProgressMeterAccessible::GetMaximum
 {
   nsresult rv = nsFormControlAccessible::GetMaximumValue(aMaximumValue);
   if (rv != NS_OK_NO_ARIA_VALUE)
     return rv;
 
   nsAutoString value;
   if (mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::max, value)) {
     PRInt32 result = NS_OK;
-    *aMaximumValue = value.ToFloat(&result);
+    *aMaximumValue = value.ToDouble(&result);
     return result;
   }
 
   *aMaximumValue = 1; // 100% = 1;
   return NS_OK;
 }
 
 NS_IMETHODIMP
@@ -609,17 +609,17 @@ nsXULProgressMeterAccessible::GetCurrent
   nsAutoString attrValue;
   mContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::value, attrValue);
 
   // Return zero value if there is no attribute or its value is empty.
   if (attrValue.IsEmpty())
     return NS_OK;
 
   PRInt32 error = NS_OK;
-  double value = attrValue.ToFloat(&error);
+  double value = attrValue.ToDouble(&error);
   if (NS_FAILED(error))
     return NS_OK; // Zero value because of wrong markup.
 
   // If no max value then value is between 0 and 1 (refer to GetMaximumValue()
   // method where max value is assumed to be equal to 1 in this case).
   if (!mContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::max))
     value /= 100;
 
@@ -1040,18 +1040,18 @@ nsXULTextFieldAccessible::CacheChildren(
   // Create child accessibles for native anonymous content of underlying HTML
   // input element.
   nsCOMPtr<nsIContent> inputContent(GetInputField());
   if (!inputContent)
     return;
 
   nsAccTreeWalker walker(mWeakShell, inputContent, PR_FALSE);
 
-  nsRefPtr<nsAccessible> child;
-  while ((child = walker.GetNextChild()) && AppendChild(child));
+  nsAccessible* child = nsnull;
+  while ((child = walker.NextChild()) && AppendChild(child));
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTextFieldAccessible protected
 
 already_AddRefed<nsIContent>
 nsXULTextFieldAccessible::GetInputField() const
 {
--- a/accessible/src/xul/nsXULSliderAccessible.cpp
+++ b/accessible/src/xul/nsXULSliderAccessible.cpp
@@ -267,17 +267,17 @@ nsXULSliderAccessible::GetSliderAttr(nsI
   nsresult rv = GetSliderAttr(aName, attrValue);
   NS_ENSURE_SUCCESS(rv, rv);
 
   // Return zero value if there is no attribute or its value is empty.
   if (attrValue.IsEmpty())
     return NS_OK;
 
   PRInt32 error = NS_OK;
-  double value = attrValue.ToFloat(&error);
+  double value = attrValue.ToDouble(&error);
   if (NS_SUCCEEDED(error))
     *aValue = value;
 
   return NS_OK;
 }
 
 nsresult
 nsXULSliderAccessible::SetSliderAttr(nsIAtom *aName, double aValue)
--- a/accessible/src/xul/nsXULTreeAccessible.cpp
+++ b/accessible/src/xul/nsXULTreeAccessible.cpp
@@ -223,59 +223,57 @@ nsXULTreeAccessible::GetFocusedChild(nsI
   }
 
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeAccessible: nsAccessible implementation (DON'T put methods here)
 
-nsresult
+nsAccessible*
 nsXULTreeAccessible::GetChildAtPoint(PRInt32 aX, PRInt32 aY,
-                                     PRBool aDeepestChild,
-                                     nsIAccessible **aChild)
+                                     EWhichChildAtPoint aWhichChild)
 {
   nsIFrame *frame = GetFrame();
   if (!frame)
-    return NS_ERROR_FAILURE;
+    return nsnull;
 
   nsPresContext *presContext = frame->PresContext();
   nsCOMPtr<nsIPresShell> presShell = presContext->PresShell();
 
   nsIFrame *rootFrame = presShell->GetRootFrame();
-  NS_ENSURE_STATE(rootFrame);
+  NS_ENSURE_TRUE(rootFrame, nsnull);
 
   nsIntRect rootRect = rootFrame->GetScreenRectExternal();
 
   PRInt32 clientX = presContext->DevPixelsToIntCSSPixels(aX - rootRect.x);
   PRInt32 clientY = presContext->DevPixelsToIntCSSPixels(aY - rootRect.y);
 
   PRInt32 row = -1;
   nsCOMPtr<nsITreeColumn> column;
   nsCAutoString childEltUnused;
   mTree->GetCellAt(clientX, clientY, &row, getter_AddRefs(column),
                    childEltUnused);
 
   // If we failed to find tree cell for the given point then it might be
   // tree columns.
   if (row == -1 || !column)
-    return nsAccessibleWrap::GetChildAtPoint(aX, aY, aDeepestChild, aChild);
+    return nsAccessibleWrap::GetChildAtPoint(aX, aY, aWhichChild);
 
   nsAccessible *child = GetTreeItemAccessible(row);
-  if (aDeepestChild && child) {
+  if (aWhichChild == eDeepestChild && child) {
     // Look for accessible cell for the found item accessible.
     nsRefPtr<nsXULTreeItemAccessibleBase> treeitem = do_QueryObject(child);
 
     nsAccessible *cell = treeitem->GetCellAccessible(column);
     if (cell)
       child = cell;
   }
 
-  NS_IF_ADDREF(*aChild = child);
-  return NS_OK;
+  return child;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeAccessible: SelectAccessible
 
 bool
 nsXULTreeAccessible::IsSelect()
 {
--- a/accessible/src/xul/nsXULTreeAccessible.h
+++ b/accessible/src/xul/nsXULTreeAccessible.h
@@ -81,19 +81,18 @@ public:
 
   // nsAccessNode
   virtual PRBool IsDefunct();
   virtual void Shutdown();
 
   // nsAccessible
   virtual PRUint32 NativeRole();
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
-  virtual nsresult GetChildAtPoint(PRInt32 aX, PRInt32 aY,
-                                   PRBool aDeepestChild,
-                                   nsIAccessible **aChild);
+  virtual nsAccessible* GetChildAtPoint(PRInt32 aX, PRInt32 aY,
+                                        EWhichChildAtPoint aWhichChild);
 
   virtual nsAccessible* GetChildAt(PRUint32 aIndex);
   virtual PRInt32 GetChildCount();
 
   // SelectAccessible
   virtual bool IsSelect();
   virtual already_AddRefed<nsIArray> SelectedItems();
   virtual PRUint32 SelectedItemCount();
--- a/accessible/src/xul/nsXULTreeGridAccessible.cpp
+++ b/accessible/src/xul/nsXULTreeGridAccessible.cpp
@@ -659,48 +659,46 @@ nsXULTreeGridRowAccessible::Shutdown()
 // nsXULTreeGridRowAccessible: nsAccessible implementation
 
 PRUint32
 nsXULTreeGridRowAccessible::NativeRole()
 {
   return nsIAccessibleRole::ROLE_ROW;
 }
 
-nsresult
+nsAccessible*
 nsXULTreeGridRowAccessible::GetChildAtPoint(PRInt32 aX, PRInt32 aY,
-                                            PRBool aDeepestChild,
-                                            nsIAccessible **aChild)
+                                            EWhichChildAtPoint aWhichChild)
 {
   nsIFrame *frame = GetFrame();
   if (!frame)
-    return NS_ERROR_FAILURE;
+    return nsnull;
 
   nsPresContext *presContext = frame->PresContext();
   nsCOMPtr<nsIPresShell> presShell = presContext->PresShell();
 
   nsIFrame *rootFrame = presShell->GetRootFrame();
-  NS_ENSURE_STATE(rootFrame);
+  NS_ENSURE_TRUE(rootFrame, nsnull);
 
   nsIntRect rootRect = rootFrame->GetScreenRectExternal();
 
   PRInt32 clientX = presContext->DevPixelsToIntCSSPixels(aX - rootRect.x);
   PRInt32 clientY = presContext->DevPixelsToIntCSSPixels(aY - rootRect.y);
 
   PRInt32 row = -1;
   nsCOMPtr<nsITreeColumn> column;
   nsCAutoString childEltUnused;
   mTree->GetCellAt(clientX, clientY, &row, getter_AddRefs(column),
                    childEltUnused);
 
   // Return if we failed to find tree cell in the row for the given point.
   if (row != mRow || !column)
-    return NS_OK;
+    return nsnull;
 
-  NS_IF_ADDREF(*aChild = GetCellAccessible(column));
-  return NS_OK;
+  return GetCellAccessible(column);
 }
 
 nsAccessible*
 nsXULTreeGridRowAccessible::GetChildAt(PRUint32 aIndex)
 {
   if (IsDefunct())
     return nsnull;
 
--- a/accessible/src/xul/nsXULTreeGridAccessible.h
+++ b/accessible/src/xul/nsXULTreeGridAccessible.h
@@ -88,19 +88,18 @@ public:
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsXULTreeGridRowAccessible,
                                            nsAccessible)
 
   // nsAccessNode
   virtual void Shutdown();
 
   // nsAccessible
   virtual PRUint32 NativeRole();
-  virtual nsresult GetChildAtPoint(PRInt32 aX, PRInt32 aY,
-                                   PRBool aDeepestChild,
-                                   nsIAccessible **aChild);
+  virtual nsAccessible* GetChildAtPoint(PRInt32 aX, PRInt32 aY,
+                                        EWhichChildAtPoint aWhichChild);
 
   virtual nsAccessible* GetChildAt(PRUint32 aIndex);
   virtual PRInt32 GetChildCount();
 
   // nsXULTreeItemAccessibleBase
   virtual nsAccessible* GetCellAccessible(nsITreeColumn *aColumn);
   virtual void RowInvalidated(PRInt32 aStartColIdx, PRInt32 aEndColIdx);
 
--- a/accessible/tests/mochitest/attributes/test_text.html
+++ b/accessible/tests/mochitest/attributes/test_text.html
@@ -1,12 +1,13 @@
 <html>
 
 <head>
   <title>Text attributes tests</title>
+  <meta charset="utf-8" />
   <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css" />
 
   <script type="application/javascript"
           src="chrome://mochikit/content/MochiKit/packed.js"></script>
   <script type="application/javascript"
           src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
 
   <script type="application/javascript"
@@ -185,53 +186,53 @@
       //////////////////////////////////////////////////////////////////////////
       // area7
       ID = "area7";
       defAttrs = buildDefaultTextAttrs(ID, "12pt");
       defAttrs["language"] = "en";
       testDefaultTextAttrs(ID, defAttrs);
 
       attrs = {"language": "ru"};
-      testTextAttrs(ID, 0, attrs, defAttrs, 0, 12);
+      testTextAttrs(ID, 0, attrs, defAttrs, 0, 6);
 
       attrs = {};
-      testTextAttrs(ID, 12, attrs, defAttrs, 12, 13);
+      testTextAttrs(ID, 6, attrs, defAttrs, 6, 7);
 
       tempElem = getNode(ID).firstChild.nextSibling.nextSibling.nextSibling;
       gComputedStyle = document.defaultView.getComputedStyle(tempElem, "");
       attrs = { "background-color": gComputedStyle.backgroundColor};
-      testTextAttrs(ID, 13, attrs, defAttrs, 13, 26);
+      testTextAttrs(ID, 13, attrs, defAttrs, 7, 20);
 
       attrs = {};
-      testTextAttrs(ID, 26, attrs, defAttrs, 26, 27);
+      testTextAttrs(ID, 20, attrs, defAttrs, 20, 21);
 
       attrs = {"language": "de"};
-      testTextAttrs(ID, 27, attrs, defAttrs, 27, 42);
+      testTextAttrs(ID, 21, attrs, defAttrs, 21, 36);
 
       attrs = {};
-      testTextAttrs(ID, 42, attrs, defAttrs, 42, 50);
+      testTextAttrs(ID, 36, attrs, defAttrs, 36, 44);
 
       attrs = {};
-      testTextAttrs(ID, 43, attrs, defAttrs, 42, 50);
+      testTextAttrs(ID, 37, attrs, defAttrs, 36, 44);
 
       tempElem = tempElem.nextSibling.nextSibling.nextSibling.nextSibling.firstChild.nextSibling;
       gComputedStyle = document.defaultView.getComputedStyle(tempElem, "");
       attrs = {"color": gComputedStyle.color};
-      testTextAttrs(ID, 50, attrs, defAttrs, 50, 57);
+      testTextAttrs(ID, 44, attrs, defAttrs, 44, 51);
 
       tempElem = tempElem.firstChild.nextSibling;
       gComputedStyle = document.defaultView.getComputedStyle(tempElem, "");
       attrs = {"font-weight": kBoldFontWeight,
                "color": gComputedStyle.color};
-      testTextAttrs(ID, 57, attrs, defAttrs, 57, 61);
+      testTextAttrs(ID, 51, attrs, defAttrs, 51, 55);
 
       tempElem = tempElem.parentNode;
       gComputedStyle = document.defaultView.getComputedStyle(tempElem, "");
       attrs = {"color": gComputedStyle.color};
-      testTextAttrs(ID, 61, attrs, defAttrs, 61, 68);
+      testTextAttrs(ID, 55, attrs, defAttrs, 55, 62);
 
       //////////////////////////////////////////////////////////////////////////
       // area9, different single style spans in styled paragraph
       ID = "area9";
       defAttrs = buildDefaultTextAttrs(ID, "10pt");
       testDefaultTextAttrs(ID, defAttrs);
 
       attrs = {};
--- a/accessible/tests/mochitest/common.js
+++ b/accessible/tests/mochitest/common.js
@@ -59,16 +59,20 @@ const WIN = (navigator.platform.indexOf(
 
 ////////////////////////////////////////////////////////////////////////////////
 // Accessible general
 
 const STATE_BUSY = nsIAccessibleStates.STATE_BUSY;
 
 const kEmbedChar = String.fromCharCode(0xfffc);
 
+const kDiscBulletText = String.fromCharCode(0x2022) + " ";
+const kCircleBulletText = String.fromCharCode(0x25e6) + " ";
+const kSquareBulletText = String.fromCharCode(0x25aa) + " ";
+
 /**
  * nsIAccessibleRetrieval, initialized when test is loaded.
  */
 var gAccRetrieval = null;
 
 /**
  * Invokes the given function when document is loaded and focused. Preferable
  * to mochitests 'addLoadEvent' function -- additionally ensures state of the
--- a/accessible/tests/mochitest/name/Makefile.in
+++ b/accessible/tests/mochitest/name/Makefile.in
@@ -49,15 +49,16 @@ include $(topsrcdir)/config/rules.mk
 		general.css \
 		general.xbl \
 		markup.js \
 		nsRootAcc_wnd.xul \
 		test_button.html \
 		test_general.html \
 		test_general.xul \
 		test_link.html \
+		test_list.html \
 		test_markup.html \
 		test_nsRootAcc.xul \
 		markuprules.xml \
 		$(NULL)
 
 libs:: $(_TEST_FILES)
 	$(INSTALL) $(foreach f,$^,"$f") $(DEPTH)/_tests/testing/mochitest/a11y/$(relativesrcdir)
new file mode 100644
--- /dev/null
+++ b/accessible/tests/mochitest/name/test_list.html
@@ -0,0 +1,91 @@
+<html>
+
+<head>
+  <title>nsIAccessible::name calculation for HTML li</title>
+  <link rel="stylesheet" type="text/css"
+        href="chrome://mochikit/content/tests/SimpleTest/test.css" />
+
+  <script type="application/javascript"
+          src="chrome://mochikit/content/MochiKit/packed.js"></script>
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+
+  <script type="application/javascript"
+          src="../common.js"></script>
+  <script type="application/javascript"
+          src="../name.js"></script>
+  <script type="application/javascript"
+          src="../events.js"></script>
+
+  <script type="application/javascript">
+    /**
+     * Alter list item numbering and change list style type.
+     */
+    function bulletUpdate()
+    {
+      this.eventSeq = [
+        new invokerChecker(EVENT_REORDER, getNode("list"))
+      ];
+
+      this.invoke = function bulletUpdate_invoke()
+      {
+        testName("li_end", "1. list end");
+
+        var li = document.createElement("li");
+        li.setAttribute("id", "li_start");
+        li.textContent = "list start";
+        getNode("list").insertBefore(li, getNode("li_end"));
+      }
+
+      this.finalCheck = function bulletUpdate_finalCheck()
+      {
+        testName("li_start", "1. list start");
+        testName("li_end", "2. list end");
+
+        // change list style type
+        var list = getNode("list");
+        list.setAttribute("style", "list-style-type: disc;");
+        getComputedStyle(list, "").color; // make style processing sync
+
+        testName("li_start", kDiscBulletText + "list start");
+        testName("li_end", kDiscBulletText + "list end");
+      }
+
+      this.getID = function bulletUpdate_getID()
+      {
+        return "Update bullet of list items";
+      }
+    }
+
+    var gQueue = null;
+    function doTest()
+    {
+      gQueue = new eventQueue();
+      gQueue.push(new bulletUpdate());
+      gQueue.invoke(); // SimpleTest.finish();
+    }
+
+    SimpleTest.waitForExplicitFinish();
+    addA11yLoadEvent(doTest);
+  </script>
+
+</head>
+
+<body>
+
+  <a target="_blank"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=634200"
+     title="crash [@ nsIFrame::GetStyleVisibility() ]">
+    Mozilla Bug 634200
+  </a>
+  <p id="display"></p>
+  <div id="content" style="display: none"></div>
+  <pre id="test">
+  </pre>
+
+  <ol id="list">
+    <li id="li_end">list end</li>
+  </ol>
+
+</body>
+</html>
--- a/accessible/tests/mochitest/relations/test_tabbrowser.xul
+++ b/accessible/tests/mochitest/relations/test_tabbrowser.xul
@@ -20,16 +20,17 @@
 
   <script type="application/javascript"
           src="../common.js" />
   <script type="application/javascript"
           src="../role.js" />
   <script type="application/javascript"
           src="../relations.js" />
 
+  <script type="application/javascript" src="chrome://global/content/globalOverlay.js"/>
   <script type="application/javascript">
   <![CDATA[
     ////////////////////////////////////////////////////////////////////////////
     // Test
 
     const Ci = Components.interfaces;
 
     // Hack to make xul:tabbrowser work.
@@ -55,18 +56,17 @@
                                               aStateFlags,
                                               aStatus)
        {
         if (aStateFlags & Ci.nsIWebProgressListener.STATE_STOP)
           testRelations();
        }
       };
 
-      tabBrowser.addProgressListener(progressListener,
-                                     Ci.nsIWebProgress.NOTIFY_STATE_WINDOW);
+      tabBrowser.addProgressListener(progressListener);
 
       tabBrowser.loadTabs(["about:", "about:mozilla"], false, true);
     }
 
     function testRelations()
     {
       //////////////////////////////////////////////////////////////////////////
       // 'labelled by'/'label for' relations for xul:tab and xul:tabpanel
@@ -74,17 +74,17 @@
       var tabs = getNode("tabbrowser").tabContainer.childNodes;
       var panels = getNode("tabbrowser").mTabBox.tabpanels.childNodes;
 
       testRelation(panels[0], RELATION_LABELLED_BY, tabs[0]);
       testRelation(tabs[0], RELATION_LABEL_FOR, panels[0]);
       testRelation(panels[1], RELATION_LABELLED_BY, tabs[1]);
       testRelation(tabs[1], RELATION_LABEL_FOR, panels[1]);
 
-      SimpleTest.finish()
+      SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
     addA11yLoadEvent(doTest);
   ]]>
   </script>
 
   <vbox flex="1" style="overflow: auto;">
--- a/accessible/tests/mochitest/text/test_hypertext.html
+++ b/accessible/tests/mochitest/text/test_hypertext.html
@@ -1,15 +1,21 @@
 <!DOCTYPE html>
 <html>
 <head>
   <title>nsIAccessibleText getText related function tests for rich text</title>
   <link rel="stylesheet" type="text/css"
         href="chrome://mochikit/content/tests/SimpleTest/test.css" />
 
+  <style>
+    h6.gencontent:before {
+      content: "aga"
+    }
+  </style>
+
   <script type="application/javascript"
           src="chrome://mochikit/content/MochiKit/packed.js"></script>
   <script type="application/javascript"
           src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
   <script type="application/javascript"
           src="../common.js"></script>
   <script type="application/javascript"
           src="../text.js"></script>
@@ -35,16 +41,26 @@
       ////////////////////////////////////////////////////////////////////////
       // getText
 
       testText(IDs, 0, 1, "h");
       testText(IDs, 5, 7, " " + kEmbedChar);
       testText(IDs, 10, 13, "e " + kEmbedChar);
       testText(IDs, 0, 13, "hello " + kEmbedChar + " see " + kEmbedChar);
 
+      ////////////////////////////////////////////////////////////////////////
+      // getTextAtOffset line boundary
+
+      testTextAtOffset(0, BOUNDARY_LINE_START, "line ", 0, 5,
+                       "hypertext3", kOk, kOk, kOk);
+
+      // XXX: see bug 638684.
+      testTextAtOffset(0, BOUNDARY_LINE_START, "line ", 0, 5,
+                       "hypertext4", kTodo, kOk, kTodo);
+
       //////////////////////////////////////////////////////////////////////////
       // list
       //////////////////////////////////////////////////////////////////////////
 
       IDs = [ "list" ];
       testCharacterCount(IDs, 1);
       testText(IDs, 0, 1, kEmbedChar);
 
@@ -58,20 +74,39 @@
     SimpleTest.waitForExplicitFinish();
     addA11yLoadEvent(doTest);
   </script>
 </head>
 <body>
 
   <a target="_blank"
      title="Fix getText"
-     href="https://bugzilla.mozilla.org/show_bug.cgi?id=630001">Mozilla Bug 630001, part3</a>
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=630001">
+    Bug 630001, part3
+  </a>
+  <a target="_blank"
+     title="getTextAtOffset line boundary may return more than one line"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=638326">
+    Bug 638326
+  </a>
   <p id="display"></p>
   <div id="content" style="display: none"></div>
   <pre id="test">
   </pre>
 
   <div id="hypertext">hello <a>friend</a> see <img></div>
   <div id="hypertext2">hello <a>friend</a> see <input></div>
   <ol id="list"><li id="listitem">foo</li></ol>
 
+  <div id="hypertext3">line
+<!-- haha -->
+<!-- hahaha -->
+<h6>heading</h6>
+  </div>
+
+  <div id="hypertext4">line
+<!-- haha -->
+<!-- hahaha -->
+<h6 role="presentation" class="gencontent">heading</h6>
+  </div>
+
 </body>
 </html>
--- a/accessible/tests/mochitest/text/test_words.html
+++ b/accessible/tests/mochitest/text/test_words.html
@@ -1,12 +1,13 @@
 <!DOCTYPE html>
 <html>
 <head>
   <title>nsIAccessibleText getText related function tests for html:input,html:div and html:textarea</title>
+  <meta charset="utf-8" />
   <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css" />
 
   <script type="application/javascript"
           src="chrome://mochikit/content/MochiKit/packed.js"></script>
   <script type="application/javascript"
           src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
   <script type="application/javascript"
           src="../common.js"></script>
@@ -60,17 +61,17 @@
 
       // "3.1416"
       testWords("div11", ["3.1416"], kTodo);
 
       // "4,261.01"
       testWords("div12", ["4,261.01"], kTodo);
 
       // "カタカナ"
-      testWords("div13", ["カタカナ"], kTodo);
+      testWords("div13", ["カタカナ"], kOk);
 
       // "Peter's car"
       testWords("div14", ["Peter's", "car"], kTodo);
 
       // "N.A.T.O."
       testWords("div15", ["N.A.T.O."], kTodo);
 
       // "3+4*5=23"
--- a/accessible/tests/mochitest/tree/test_combobox.xul
+++ b/accessible/tests/mochitest/tree/test_combobox.xul
@@ -187,19 +187,16 @@
         ]
       };
 
       // XPFE and Toolkit autocomplete widgets differ.
       var ac2cmp = document.getElementById("autocomplete2");
       if ("clearResults" in ac2cmp) {
         SimpleTest.ok(true, "Testing (Old) XPFE autocomplete widget. (ac2mp)");
 
-        // Toolkit has the menupopup first ...
-        var mp = accTree.children.splice(0, 1);
-
         // Popup is always created.
         accTree.children.push(
           {
             // xul:panel
             role: ROLE_COMBOBOX_LIST,
             children: [
               {
                 // xul:tree
@@ -216,19 +213,16 @@
                       }
                     ]
                   }
                 ]
               }
             ]
           }
           );
-
-        // ... whereas XPFE has it last.
-        accTree.children.push(mp[0]);
       } else {
         SimpleTest.ok(true, "Testing (New) Toolkit autocomplete widget. (ac2mp)");
 
         // Popup is lazily created, so not present in this case.
       }
 
       testAccessibleTree("autocomplete2", accTree);
 
--- a/accessible/tests/mochitest/tree/test_cssoverflow.html
+++ b/accessible/tests/mochitest/tree/test_cssoverflow.html
@@ -32,25 +32,29 @@
     {
       this.linkNode = getNode(aID);
       this.link = getAccessible(this.linkNode);
 
       this.eventSeq = [
         new invokerChecker(EVENT_FOCUS, getAccessible, this.linkNode)
       ];
 
+      this.unexpectedEventSeq = [
+        new invokerChecker(EVENT_REORDER, this.linkNode.parentNode)
+      ];
+
       this.invoke = function focusAnchor_invoke()
       {
         this.linkNode.focus();
       }
 
       this.check = function focusAnchor_check(aEvent)
       {
-        isnot(this.link, aEvent.accessible,
-              "Focus should be fired against new link accessible!");
+        is(this.link, aEvent.accessible,
+           "The link accessible shouldn't be recreated!");
       }
 
       this.getID = function focusAnchor_getID()
       {
         return "focus a:focus{overflow:scroll} #1";
       }
     }
 
@@ -58,25 +62,29 @@
     {
       this.linkNode = getNode(aID);
       this.link = getAccessible(this.linkNode);
 
       this.eventSeq = [
         new invokerChecker(EVENT_FOCUS, getAccessible, this.linkNode)
       ];
 
+      this.unexpectedEventSeq = [
+        new invokerChecker(EVENT_REORDER, this.linkNode.parentNode)
+      ];
+
       this.invoke = function tabAnchor_invoke()
       {
         synthesizeKey("VK_TAB", { shiftKey: false });
       }
 
       this.check = function tabAnchor_check(aEvent)
       {
-        isnot(this.link, aEvent.accessible,
-              "Focus should be fired against new link accessible!");
+        is(this.link, aEvent.accessible,
+           "The link accessible shouldn't be recreated!");
       }
 
       this.getID = function tabAnchor_getID()
       {
         return "focus a:focus{overflow:scroll} #2";
       }
     }
 
@@ -114,16 +122,21 @@
      title="mochitest for bug 413777: focus the a:focus {overflow: scroll;} shouldn't recreate HTML a accessible">
     Mozilla Bug 591163
   </a><br>
   <a target="_blank"
      title="Rework accessible tree update code"
      href="https://bugzilla.mozilla.org/show_bug.cgi?id=570275">
     Mozilla Bug 570275
   </a><br>
+  <a target="_blank"
+     title="Don't recreate frames for inlines with overflow style applied"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=606087">
+    Mozilla Bug 606087
+  </a><br>
 
   <p id="display"></p>
   <div id="content" style="display: none"></div>
   <pre id="test">
   </pre>
   <div id="eventdump"></div>
 
   <div>
--- a/accessible/tests/mochitest/tree/test_list.html
+++ b/accessible/tests/mochitest/tree/test_list.html
@@ -35,51 +35,47 @@
       if (aSubtree)
         obj.children.push(aSubtree);
 
       return obj;
     }
 
     function doTest()
     {
-      const discBulletText = String.fromCharCode(0x2022) + " ";
-      const circleBulletText = String.fromCharCode(0x25e6) + " ";
-      const squareBulletText = String.fromCharCode(0x25aa) + " ";
-
       // list1
       var discAccTree = {
         role: ROLE_LIST,
         children: [
-          new listItemTree(discBulletText, "Oranges"),
-          new listItemTree(discBulletText, "Apples"),
-          new listItemTree(discBulletText, "Bananas")
+          new listItemTree(kDiscBulletText, "Oranges"),
+          new listItemTree(kDiscBulletText, "Apples"),
+          new listItemTree(kDiscBulletText, "Bananas")
         ]
       };
 
       testAccessibleTree("list1", discAccTree);
 
       // list2
       var circleAccTree = {
         role: ROLE_LIST,
         children: [
-          new listItemTree(circleBulletText, "Oranges"),
-          new listItemTree(circleBulletText, "Apples"),
-          new listItemTree(circleBulletText, "Bananas")
+          new listItemTree(kCircleBulletText, "Oranges"),
+          new listItemTree(kCircleBulletText, "Apples"),
+          new listItemTree(kCircleBulletText, "Bananas")
         ]
       };
 
       testAccessibleTree("list2", circleAccTree);
 
       // list3
       var squareAccTree = {
         role: ROLE_LIST,
         children: [
-          new listItemTree(squareBulletText, "Oranges"),
-          new listItemTree(squareBulletText, "Apples"),
-          new listItemTree(squareBulletText, "Bananas")
+          new listItemTree(kSquareBulletText, "Oranges"),
+          new listItemTree(kSquareBulletText, "Apples"),
+          new listItemTree(kSquareBulletText, "Bananas")
         ]
       };
 
       testAccessibleTree("list3", squareAccTree);
 
       // list4
       var nestedAccTree = {
         role: ROLE_LIST,
@@ -87,16 +83,53 @@
           new listItemTree("1. ", "Oranges"),
           new listItemTree("2. ", "Apples"),
           new listItemTree("3. ", "Bananas", circleAccTree)
         ]
       };
 
       testAccessibleTree("list4", nestedAccTree);
 
+      // dl list
+      var tree =
+        { LIST: [ // dl
+          { LISTITEM: [ // dt
+            { TEXT_LEAF: [] },
+          ] },
+          { PARAGRAPH: [ // dd
+            { TEXT_LEAF: [] }
+          ] },
+          { LISTITEM: [ // dt
+            { TEXT_LEAF: [] }
+          ] },
+          { PARAGRAPH: [ // dd
+            { TEXT_LEAF: [] }
+          ] }
+        ] };
+
+      testAccessibleTree("list5", tree);
+
+      // dl list inside ordered list
+      tree =
+        { LIST: [ // ol
+          { LISTITEM: [ // li
+            { STATICTEXT: [ ] },
+            { LIST: [ // dl
+              { LISTITEM: [ // dt
+                { TEXT_LEAF: [] }
+              ] },
+              { PARAGRAPH: [ // dd
+                { TEXT_LEAF: [] }
+              ] }
+            ] }
+          ] }
+        ] };
+
+      testAccessibleTree("list6", tree);
+
       SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
     addA11yLoadEvent(doTest);
   </script>
 </head>
 <body>
@@ -106,16 +139,21 @@
      href="https://bugzilla.mozilla.org/show_bug.cgi?id=342045">
     Mozilla Bug 342045
   </a>
   <a target="_blank"
      title="Bullets of nested not ordered lists have one and the same character."
      href="https://bugzilla.mozilla.org/show_bug.cgi?id=604587">
     Mozilla Bug 604587
   </a>
+  <a target="_blank"
+     title="Fix list bullets for DL list (crash [@ nsBulletFrame::GetListItemText])"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=629114">
+    Mozilla Bug 629114
+  </a>
   <p id="display"></p>
   <div id="content" style="display: none"></div>
   <pre id="test">
   </pre>
 
   <ul id="list1">
     <li id="l1_li1">Oranges</li>
     <li id="l1_li2">Apples</li>
@@ -139,10 +177,23 @@
     <li id="li5">Apples</li>
     <li id="li6">Bananas<ul>
         <li id="n_li4">Oranges</li>
         <li id="n_li5">Apples</li>
         <li id="n_li6">Bananas</li>
       </ul>
     </li>
   </ol>
+
+  <dl id="list5">
+    <dt>item1</dt><dd>description</dd>
+    <dt>item2</td><dd>description</dd>
+  </dl>
+
+  <ol id="list6">
+    <li>
+      <dl id="dl">
+        <dt>item1</dt><dd>description</dd>
+      </dl>
+    </li>
+  </ol>
 </body>
 </html>
--- a/accessible/tests/mochitest/tree/test_tabbrowser.xul
+++ b/accessible/tests/mochitest/tree/test_tabbrowser.xul
@@ -9,111 +9,209 @@
                  type="text/css"?>
 
 <?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
                  type="text/css"?>
 
 <window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
         title="Accessible XUL tabbrowser hierarchy tests">
 
-  <script type="application/javascript" 
+  <script type="application/javascript"
           src="chrome://mochikit/content/MochiKit/packed.js" />
   <script type="application/javascript"
           src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js" />
 
   <script type="application/javascript"
           src="../common.js" />
   <script type="application/javascript"
           src="../role.js" />
 
+  <script type="application/javascript" src="chrome://global/content/globalOverlay.js"/>
   <script type="application/javascript">
   <![CDATA[
     ////////////////////////////////////////////////////////////////////////////
     // Test
 
     const Ci = Components.interfaces;
 
     // Hack to make xul:tabbrowser work.
     Components.utils.import("resource://gre/modules/Services.jsm");
     var handleDroppedLink = null;
     var XULBrowserWindow = {
       isBusy: false,
-      setOverLink: function (link, b) {
-      }
+      setOverLink: function (link, b) {}
     };
     var gFindBar = {
       hidden: true
     };
 
     function doTest()
     {
       var tabBrowser = document.getElementById("tabbrowser");
 
       var progressListener =
       {
         onStateChange: function onStateChange(aWebProgress,
                                               aRequest,
                                               aStateFlags,
                                               aStatus)
-       {
-        if (aStateFlags & Ci.nsIWebProgressListener.STATE_STOP)
-          testAccTree();
-       }
+        {
+          if (aStateFlags & Ci.nsIWebProgressListener.STATE_STOP) {
+            tabBrowser.removeProgressListener(progressListener);
+
+            SimpleTest.executeSoon(testAccTree);
+          }
+        }
       };
+      tabBrowser.addProgressListener(progressListener);
 
-      tabBrowser.addProgressListener(progressListener,
-                                     Ci.nsIWebProgress.NOTIFY_STATE_WINDOW);
-
+      // Test XUL and HTML documents.
       tabBrowser.loadTabs(["about:", "about:mozilla"], false, true);
     }
 
     function testAccTree()
     {
+      var tabBrowser = document.getElementById("tabbrowser");
+
+      ////////////////////
+      // Tab bar
+      ////////////////////
       var tabsAccTree = {
+        // xul:tabs
         role: ROLE_PAGETABLIST,
         children: [
+          // Children depend on application (UI): see below.
+        ]
+      };
+
+      // SeaMonkey and Firefox tabbrowser UIs differ.
+      if ("restoreTab" in tabBrowser) {
+        SimpleTest.ok(true, "Testing SeaMonkey tabbrowser UI.");
+
+        tabsAccTree.children.splice(0, 0,
           {
+            // xul:toolbarbutton ("Open a new tab")
+            role: ROLE_PUSHBUTTON,
+            children: []
+          },
+          {
+            // xul:tab ("about:")
             role: ROLE_PAGETAB,
+            children: []
+          },
+          {
+            // tab ("about:mozilla")
+            role: ROLE_PAGETAB,
+            children: []
+          },
+          {
+            // xul:toolbarbutton ("List all tabs")
+            role: ROLE_PUSHBUTTON,
             children: [
               {
-                role: ROLE_PUSHBUTTON
+                // xul:menupopup
+                role: ROLE_MENUPOPUP,
+                children: []
               }
             ]
           },
           {
+            // xul:toolbarbutton ("Close current tab")
+            role: ROLE_PUSHBUTTON,
+            children: []
+          }
+          );
+      } else {
+        SimpleTest.ok(true, "Testing Firefox tabbrowser UI.");
+
+        // NB: The (3) buttons are not visible, unless manually hovered,
+        //     probably due to size reduction in this test.
+        tabsAccTree.children.splice(0, 0,
+          {
+            // xul:tab ("about:")
             role: ROLE_PAGETAB,
             children: [
               {
-                role: ROLE_PUSHBUTTON
+                // xul:toolbarbutton ("Close Tab")
+                role: ROLE_PUSHBUTTON,
+                children: []
               }
             ]
           },
           {
-            role: ROLE_PUSHBUTTON
+            // tab ("about:mozilla")
+            role: ROLE_PAGETAB,
+            children: [
+              {
+                // xul:toolbarbutton ("Close Tab")
+                role: ROLE_PUSHBUTTON,
+                children: []
+              }
+            ]
+          },
+          {
+            // xul:toolbarbutton ("Open a new tab")
+            role: ROLE_PUSHBUTTON,
+            children: []
           }
-        ]
-      };
-      testAccessibleTree(getNode("tabbrowser").tabContainer, tabsAccTree);
+          // "List all tabs" dropdown
+          // XXX: This child(?) is not present in this test.
+          //      I'm not sure why (though probably expected).
+          );
+      }
 
+      testAccessibleTree(tabBrowser.tabContainer, tabsAccTree);
+
+      ////////////////////
+      // Tab contents
+      ////////////////////
       var tabboxAccTree = {
+        // xul:tabpanels
         role: ROLE_PANE,
         children: [
           {
-            role: ROLE_PROPERTYPAGE
+            // xul:notificationbox
+            role: ROLE_PROPERTYPAGE,
+            children: [
+              {
+                // xul:browser
+                role: ROLE_INTERNAL_FRAME,
+                children: [
+                  {
+                    // #document ("about:")
+                    role: ROLE_DOCUMENT
+                    // children: [ ... ] // Ignore document content.
+                  }
+                ]
+              }
+            ]
           },
           {
-            role: ROLE_PROPERTYPAGE
+            // notificationbox
+            role: ROLE_PROPERTYPAGE,
+            children: [
+              {
+                // browser
+                role: ROLE_INTERNAL_FRAME,
+                children: [
+                  {
+                    // #document ("about:mozilla")
+                    role: ROLE_DOCUMENT
+                    // children: [ ... ] // Ignore document content.
+                  }
+                ]
+              }
+            ]
           }
         ]
       };
 
-      testAccessibleTree(getNode("tabbrowser").mTabBox.tabpanels,
-                         tabboxAccTree);
+      testAccessibleTree(tabBrowser.mTabBox.tabpanels, tabboxAccTree);
 
-      SimpleTest.finish()
+      SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
     addA11yLoadEvent(doTest);
   ]]>
   </script>
 
   <vbox flex="1" style="overflow: auto;">
@@ -153,9 +251,8 @@
     <tabbrowser id="tabbrowser"
                 type="content-primary"
                 tabcontainer="tabbrowser-tabs"
                 flex="1"/>
     <toolbar id="addon-bar"/>
   </vbox>
 
 </window>
-
--- a/accessible/tests/mochitest/treeupdate/Makefile.in
+++ b/accessible/tests/mochitest/treeupdate/Makefile.in
@@ -43,16 +43,17 @@ VPATH		= @srcdir@
 relativesrcdir  = accessible/treeupdate
 
 include $(DEPTH)/config/autoconf.mk
 include $(topsrcdir)/config/rules.mk
 
 _TEST_FILES =\
 		test_ariadialog.html \
 		test_doc.html \
+		test_gencontent.html \
 		test_list_editabledoc.html \
 		test_list.html \
 		test_menu.xul \
 		test_recreation.html \
 		test_select.html \
 		test_textleaf.html \
 		test_visibility.html \
 		test_whitespace.html \
new file mode 100644
--- /dev/null
+++ b/accessible/tests/mochitest/treeupdate/test_gencontent.html
@@ -0,0 +1,160 @@
+<html>
+
+<head>
+  <title>Elements with CSS generated content</title>
+
+  <link rel="stylesheet" type="text/css"
+        href="chrome://mochikit/content/tests/SimpleTest/test.css" />
+
+  <style>
+    .gentext:before {
+      content: "START"
+    }
+    .gentext:after {
+      content: "END"
+    }
+  </style>
+
+  <script type="application/javascript"
+          src="chrome://mochikit/content/MochiKit/packed.js"></script>
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+
+  <script type="application/javascript"
+          src="../common.js"></script>
+  <script type="application/javascript"
+          src="../events.js"></script>
+
+  <script type="application/javascript">
+
+    ////////////////////////////////////////////////////////////////////////////
+    // Invokers
+    ////////////////////////////////////////////////////////////////////////////
+
+    /**
+     * Insert new node with CSS generated content style applied to container.
+     */
+    function insertNodeHavingGenContent(aContainerID)
+    {
+      this.containerNode = getNode(aContainerID);
+      this.container = getAccessible(this.containerNode);
+
+      this.eventSeq = [
+        new invokerChecker(EVENT_SHOW, getFirstChild, this.container),
+        new invokerChecker(EVENT_REORDER, this.container)
+      ];
+
+      this.invoke = function insertNodeHavingGenContent_invoke()
+      {
+        var node = document.createElement("div");
+        node.textContent = "text";
+        node.setAttribute("class", "gentext");
+        this.containerNode.appendChild(node);
+      }
+
+      this.finalCheck = function insertNodeHavingGenContent_finalCheck()
+      {
+        var accTree =
+          { SECTION: [ // container
+            { SECTION: [ // inserted node
+              { STATICTEXT: [] }, // :before
+              { TEXT_LEAF: [] }, // primary text
+              { STATICTEXT: [] } // :after
+            ] }
+          ] };
+        testAccessibleTree(this.container, accTree);
+      }
+
+      this.getID = function insertNodeHavingGenContent_getID()
+      {
+        return "insert node having generated content to " + prettyName(aContainerID);
+      }
+    }
+
+    /**
+     * Add CSS generated content to the given node contained by container node.
+     */
+    function addGenContent(aContainerID, aNodeID)
+    {
+      this.container = getAccessible(aContainerID);
+      this.node = getNode(aNodeID);
+
+      this.eventSeq = [
+        new invokerChecker(EVENT_HIDE, this.container.firstChild),
+        new invokerChecker(EVENT_SHOW, getFirstChild, this.container),
+        new invokerChecker(EVENT_REORDER, this.container)
+      ];
+
+      this.invoke = function addGenContent_invoke()
+      {
+        this.node.setAttribute("class", "gentext");
+      }
+
+      this.finalCheck = function insertNodeHavingGenContent_finalCheck()
+      {
+        var accTree =
+          { SECTION: [ // container
+            { SECTION: [ // inserted node
+              { STATICTEXT: [] }, // :before
+              { TEXT_LEAF: [] }, // primary text
+              { STATICTEXT: [] } // :after
+            ] }
+          ] };
+        testAccessibleTree(this.container, accTree);
+      }
+
+      this.getID = function addGenContent_getID()
+      {
+        return "add generated content to" + prettyName(aNodeID);
+      }
+    }
+
+    /**
+     * Target getters.
+     */
+    function getFirstChild(aAcc)
+    {
+      try { return aAcc.getChildAt(0); }
+      catch (e) { return null; }
+    }
+
+    ////////////////////////////////////////////////////////////////////////////
+    // Do tests
+    ////////////////////////////////////////////////////////////////////////////
+
+    var gQueue = null;
+    //gA11yEventDumpID = "eventdump"; // debug stuff
+    //gA11yEventDumpToConsole = true;
+
+    function doTests()
+    {
+      gQueue = new eventQueue();
+
+      gQueue.push(new insertNodeHavingGenContent("container1"));
+      gQueue.push(new addGenContent("container2", "container2_child"));
+
+      gQueue.invoke(); // Will call SimpleTest.finish();
+    }
+
+    SimpleTest.waitForExplicitFinish();
+    addA11yLoadEvent(doTests);
+  </script>
+</head>
+
+<body>
+
+  <a target="_blank"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=646350"
+     title="Add a test for dynamic chnages of CSS generated content">
+    Mozilla Bug 646350</a>
+
+  <p id="display"></p>
+  <div id="content" style="display: none"></div>
+  <pre id="test">
+  </pre>
+  <div id="eventdump"></div>
+
+  <div id="container1"></div>
+  <div id="container2"><div id="container2_child">text</div></div>
+</body>
+</html>
--- a/aclocal.m4
+++ b/aclocal.m4
@@ -7,16 +7,17 @@ builtin(include, build/autoconf/glib.m4)
 builtin(include, build/autoconf/libIDL.m4)dnl
 builtin(include, build/autoconf/nspr.m4)dnl
 builtin(include, build/autoconf/nss.m4)dnl
 builtin(include, build/autoconf/pkg.m4)dnl
 builtin(include, build/autoconf/freetype2.m4)dnl
 builtin(include, build/autoconf/codeset.m4)dnl
 builtin(include, build/autoconf/altoptions.m4)dnl
 builtin(include, build/autoconf/mozprog.m4)dnl
+builtin(include, build/autoconf/mozheader.m4)dnl
 builtin(include, build/autoconf/acwinpaths.m4)dnl
 
 MOZ_PROG_CHECKMSYS()
 
 # Read the user's .mozconfig script.  We can't do this in
 # configure.in: autoconf puts the argument parsing code above anything
 # expanded from configure.in, and we need to get the configure options
 # from .mozconfig in place before that argument parsing code.
--- a/allmakefiles.sh
+++ b/allmakefiles.sh
@@ -64,16 +64,17 @@ build/pgo/js-input/Makefile
 build/unix/Makefile
 build/win32/Makefile
 build/win32/crashinjectdll/Makefile
 config/Makefile
 config/autoconf.mk
 config/mkdepend/Makefile
 config/nspr/Makefile
 config/doxygen.cfg
+config/expandlibs_config.py
 config/tests/src-simple/Makefile
 probes/Makefile
 extensions/Makefile
 "
 
 if [ "$WINCE" ]; then
   add_makefiles "
     build/wince/tools/Makefile
--- a/browser/app/Makefile.in
+++ b/browser/app/Makefile.in
@@ -119,26 +119,31 @@ APP_XPCOM_LIBS = $(XPCOM_GLUE_LDOPTS)
 else
 MOZILLA_INTERNAL_API = 1
 APP_XPCOM_LIBS = $(XPCOM_LIBS)
 endif
 
 LIBS += \
 	$(STATIC_COMPONENTS_LINKER_PATH) \
 	$(EXTRA_DSO_LIBS) \
-	$(MOZ_JS_LIBS) \
 	$(APP_XPCOM_LIBS) \
 	$(NSPR_LIBS) \
+	$(NULL)
+
+ifdef BUILD_STATIC_LIBS
+LIBS += \
+	$(MOZ_JS_LIBS) \
 	$(TK_LIBS) \
 	$(NULL)
 
 # Add explicit X11 dependency when building against X11 toolkits
 ifneq (,$(filter gtk2,$(MOZ_WIDGET_TOOLKIT)))
 LIBS += $(XLDFLAGS) $(XLIBS) $(ZLIB_LIBS)
 endif
+endif
 
 ifdef MOZ_JPROF
 LIBS += -ljprof
 endif
 
 ifndef MOZ_WINCONSOLE
 ifdef MOZ_DEBUG
 MOZ_WINCONSOLE = 1
@@ -194,23 +199,16 @@ endif
 ifdef BUILD_STATIC_LIBS
 RCFLAGS += -DMOZ_STATIC_BUILD
 endif
 ifdef DEBUG
 RCFLAGS += -DDEBUG
 endif
 endif
 
-ifeq ($(OS_ARCH),BeOS)
-BEOS_PROGRAM_RESOURCE = $(srcdir)/apprunner-beos.rsrc
-ifdef BUILD_STATIC_LIBS
-OS_LIBS += -ltracker -lgame
-endif
-endif
-
 ifeq ($(OS_ARCH),OS2)
 RESFILE=splashos2.res
 RCFLAGS += -DMOZ_PHOENIX
 ifdef BUILD_STATIC_LIBS
 RCFLAGS += -DMOZ_STATIC_BUILD -i $(DIST)/include
 endif
 ifdef DEBUG
 RCFLAGS += -DDEBUG
@@ -245,18 +243,16 @@ ifndef GNU_CC
 LDFLAGS += /HEAP:0x40000
 ifeq ($(OS_TEST),x86_64)
 # set stack to 2MB on x64 build.  See bug 582910
 LDFLAGS += -STACK:2097152
 endif
 endif
 endif
 
-$(PROGRAM): $(DEPTH)/toolkit/xre/$(LIB_PREFIX)xulapp_s.$(LIB_SUFFIX)
-
 ifneq (,$(filter-out OS2 WINNT WINCE,$(OS_ARCH)))
 
 $(MOZ_APP_NAME):: $(topsrcdir)/build/unix/mozilla.in $(GLOBAL_DEPS)
 	cat $< | sed -e "s|%MOZAPPDIR%|$(installdir)|" \
 		-e "s|%MOZ_APP_DISPLAYNAME%|$(MOZ_APP_DISPLAYNAME)|" > $@
 	chmod +x $@
 
 libs:: $(MOZ_APP_NAME)
deleted file mode 100644
index 145e9ca36dfca8072be0b28e2c1c6c93b6dff813..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391
GIT binary patch
literal 0
Hc$@<O00001
--- a/browser/app/blocklist.xml
+++ b/browser/app/blocklist.xml
@@ -3,16 +3,23 @@
   <emItems>
     <emItem id="fdm_ffext@freedownloadmanager.org">
       <versionRange minVersion="1.0" maxVersion="1.3.1">
         <targetApplication id="{ec8030f7-c20a-464f-9b0e-13a3a9e97384}">
            <versionRange minVersion="3.0a1" maxVersion="*"/>
         </targetApplication>
       </versionRange>
     </emItem>
+    <emItem id="firefox@bandoo.com">
+      <versionRange minVersion="5.0" maxVersion="5.0" severity="1">
+        <targetApplication id="{ec8030f7-c20a-464f-9b0e-13a3a9e97384}">
+           <versionRange minVersion="3.7a1pre" maxVersion="*"/>
+        </targetApplication>
+      </versionRange>
+    </emItem>
     <emItem id="langpack-vi-VN@firefox.mozilla.org">
       <versionRange minVersion="2.0" maxVersion="2.0"/>
     </emItem>
     <emItem id="masterfiler@gmail.com">
       <versionRange severity="3"/>
     </emItem>
     <emItem id="mozilla_cc@internetdownloadmanager.com">
       <versionRange minVersion=" " maxVersion="6.9.8">
@@ -65,23 +72,37 @@
     </emItem>
     <emItem id="{4B3803EA-5230-4DC3-A7FC-33638F3D3542}">
       <versionRange minVersion="1.2" maxVersion="1.2">
         <targetApplication id="{ec8030f7-c20a-464f-9b0e-13a3a9e97384}">
            <versionRange minVersion="3.0a1" maxVersion="*"/>
         </targetApplication>
       </versionRange>
     </emItem>
+    <emItem id="{6E19037A-12E3-4295-8915-ED48BC341614}">
+      <versionRange minVersion="0.1" maxVersion="1.3.328.4" severity="1">
+        <targetApplication id="{ec8030f7-c20a-464f-9b0e-13a3a9e97384}">
+           <versionRange minVersion="3.7a1pre" maxVersion="*"/>
+        </targetApplication>
+      </versionRange>
+    </emItem>
     <emItem id="{8CE11043-9A15-4207-A565-0C94C42D590D}"/>
     <emItem id="{AB2CE124-6272-4b12-94A9-7303C7397BD1}">
-      <versionRange severity="1"/>
+      <versionRange minVersion="0.1" maxVersion="5.2.0.7164" severity="1"/>
     </emItem>
     <emItem id="{B13721C7-F507-4982-B2E5-502A71474FED}">
       <versionRange severity="1"/>
     </emItem>
+    <emItem id="{B7082FAA-CB62-4872-9106-E42DD88EDE45}">
+      <versionRange minVersion="0.1" maxVersion="3.3.0.*">
+        <targetApplication id="{ec8030f7-c20a-464f-9b0e-13a3a9e97384}">
+           <versionRange minVersion="3.7a1" maxVersion="*"/>
+        </targetApplication>
+      </versionRange>
+    </emItem>
     <emItem id="{E8E88AB0-7182-11DF-904E-6045E0D72085}"/>
   </emItems>
 <pluginItems>
   <pluginItem>
     <match name="name" exp="^Yahoo Application State Plugin$"/>
     <match name="description" exp="^Yahoo Application State Plugin$"/>
     <match name="filename" exp="npYState.dll"/>
     <versionRange>
@@ -127,9 +148,41 @@
     <match name="filename" exp="[Nn][Pp][Jj][Pp][Ii]1[56]0_[0-9]+\.[Dd][Ll][Ll]"/>
     <versionRange>
       <targetApplication id="{ec8030f7-c20a-464f-9b0e-13a3a9e97384}">
         <versionRange minVersion="3.6a1pre" maxVersion="*"/>
       </targetApplication>
     </versionRange>
   </pluginItem>
 </pluginItems>
+<gfxItems>
+  <gfxBlacklistEntry>
+    <os>WINNT 6.1</os>
+    <vendor>0x10de</vendor>
+    <devices>
+      <device>0x0a6c</device>
+    </devices>
+    <feature>DIRECT2D</feature>
+    <featureStatus>BLOCKED_DRIVER_VERSION</featureStatus>
+    <driverVersion>8.17.12.5896</driverVersion>
+    <driverVersionComparator>LESS_THAN_OR_EQUAL</driverVersionComparator>
+  </gfxBlacklistEntry>
+  <gfxBlacklistEntry>
+    <os>WINNT 6.1</os>
+    <vendor>0x10de</vendor>
+    <devices>
+      <device>0x0a6c</device>
+    </devices>
+    <feature>DIRECT3D_9_LAYERS</feature>
+    <featureStatus>BLOCKED_DRIVER_VERSION</featureStatus>
+    <driverVersion>8.17.12.5896</driverVersion>
+    <driverVersionComparator>LESS_THAN_OR_EQUAL</driverVersionComparator>
+  </gfxBlacklistEntry>
+  <gfxBlacklistEntry>
+    <os>WINNT 5.1</os>
+    <vendor>0x10de</vendor>
+    <feature>DIRECT3D_9_LAYERS</feature>
+    <featureStatus>BLOCKED_DRIVER_VERSION</featureStatus>
+    <driverVersion>7.0.0.0</driverVersion>
+    <driverVersionComparator>GREATER_THAN_OR_EQUAL</driverVersionComparator>
+  </gfxBlacklistEntry>
+</gfxItems>
 </blocklist>
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -43,18 +43,16 @@
 #  The first character after a period must be alphabetic.
 
 #ifdef XP_UNIX
 #ifndef XP_MACOSX
 #define UNIX_BUT_NOT_MAC
 #endif
 #endif
 
-pref("general.startup.browser", true);
-
 pref("browser.chromeURL","chrome://browser/content/");
 pref("browser.hiddenWindowChromeURL", "chrome://browser/content/hiddenWindow.xul");
 
 // Enables some extra Extension System Logging (can reduce performance)
 pref("extensions.logging.enabled", false);
 
 // Preferences for AMO integration
 pref("extensions.getAddons.cache.enabled", true);
@@ -531,21 +529,16 @@ pref("mousewheel.withaltkey.numlines",1)
 pref("mousewheel.withmetakey.action",0);
 pref("mousewheel.withmetakey.sysnumlines",true);
 pref("mousewheel.withmetakey.numlines",1);
 #endif
 pref("mousewheel.withcontrolkey.action",3);
 pref("mousewheel.withcontrolkey.sysnumlines",false);
 pref("mousewheel.withcontrolkey.numlines",1);
 
-pref("profile.allow_automigration", false);   // setting to false bypasses automigration in the profile code
-
-// Customizable toolbar stuff
-pref("custtoolbar.personal_toolbar_folder", "");
-
 // pref to control the alert notification 
 pref("alerts.slideIncrement", 1);
 pref("alerts.slideIncrementTime", 10);
 pref("alerts.totalOpenTime", 4000);
 
 pref("browser.xul.error_pages.enabled", true);
 pref("browser.xul.error_pages.expert_bad_cert", false);
 
--- a/browser/base/content/browser-places.js
+++ b/browser/base/content/browser-places.js
@@ -166,16 +166,19 @@ var StarUI = {
     }
 
     var loadObserver = {
       _self: this,
       _itemId: aItemId,
       _anchorElement: aAnchorElement,
       _position: aPosition,
       observe: function (aSubject, aTopic, aData) {
+        //XXX We just caused localstore.rdf to be re-applied (bug 640158)
+        retrieveToolbarIconsizesFromTheme();
+
         this._self._overlayLoading = false;
         this._self._overlayLoaded = true;
         this._self._doShowEditBookmarkPanel(this._itemId, this._anchorElement,
                                             this._position);
       }
     };
     this._overlayLoading = true;
     document.loadOverlay("chrome://browser/content/places/editBookmarkOverlay.xul",
--- a/browser/base/content/browser-sets.inc
+++ b/browser/base/content/browser-sets.inc
@@ -75,17 +75,17 @@
 
 
     <commandset id="editMenuCommands"/>
 
     <command id="View:PageSource" oncommand="BrowserViewSourceOfDocument(content.document);" observes="isImage"/>
     <command id="View:PageInfo" oncommand="BrowserPageInfo();"/>
     <command id="View:FullScreen" oncommand="BrowserFullScreen();"/>
     <command id="cmd_find"
-             oncommand="if (TabView.isVisible()) TabView.enableSearch(event); else gFindBar.onFindCommand();"
+             oncommand="gFindBar.onFindCommand();"
              observes="isImage"/>
     <command id="cmd_findAgain"
              oncommand="gFindBar.onFindAgainCommand(false);"
              observes="isImage"/>
     <command id="cmd_findPrevious"
              oncommand="gFindBar.onFindAgainCommand(true);"
              observes="isImage"/>
     <!-- work-around bug 392512 -->
--- a/browser/base/content/browser-tabview.js
+++ b/browser/base/content/browser-tabview.js
@@ -258,22 +258,16 @@ let TabView = {
       let self = this;
       this._initFrame(function() {
         self._window.GroupItems.moveTabToGroupItem(tab, groupItemId);
       });
     }
   },
 
   // ----------
-  enableSearch: function TabView_enableSearch(event) {
-    if (this._window)
-      this._window.UI.enableSearch(event);
-  },
-
-  // ----------
   // Adds new key commands to the browser, for invoking the Tab Candy UI
   // and for switching between groups of tabs when outside of the Tab Candy UI.
   _setBrowserKeyHandlers: function TabView__setBrowserKeyHandlers() {
     if (this._browserKeyHandlerInitialized)
       return;
 
     this._browserKeyHandlerInitialized = true;
 
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -1391,16 +1391,17 @@ function prepareForStartup() {
   } catch (e) {
     alert("Error launching browser window:" + e);
     window.close(); // Give up.
     return;
   }
 
   // initialize observers and listeners
   // and give C++ access to gBrowser
+  gBrowser.init();
   XULBrowserWindow.init();
   window.QueryInterface(Ci.nsIInterfaceRequestor)
         .getInterface(nsIWebNavigation)
         .QueryInterface(Ci.nsIDocShellTreeItem).treeOwner
         .QueryInterface(Ci.nsIInterfaceRequestor)
         .getInterface(Ci.nsIXULWindow)
         .XULBrowserWindow = window.XULBrowserWindow;
   window.QueryInterface(Ci.nsIDOMChromeWindow).browserDOMWindow =
@@ -1433,17 +1434,17 @@ function prepareForStartup() {
   // enable global history
   try {
     gBrowser.docShell.QueryInterface(Components.interfaces.nsIDocShellHistory).useGlobalHistory = true;
   } catch(ex) {
     Components.utils.reportError("Places database may be locked: " + ex);
   }
 
   // hook up UI through progress listener
-  gBrowser.addProgressListener(window.XULBrowserWindow, Components.interfaces.nsIWebProgress.NOTIFY_ALL);
+  gBrowser.addProgressListener(window.XULBrowserWindow);
   gBrowser.addTabsProgressListener(window.TabsProgressListener);
 
   // setup our common DOMLinkAdded listener
   gBrowser.addEventListener("DOMLinkAdded", DOMLinkHandler, false);
 
   // setup our MozApplicationManifest listener
   gBrowser.addEventListener("MozApplicationManifest",
                             OfflineApps, false);
@@ -3346,22 +3347,20 @@ const BrowserSearch = {
 
     // getSubmission can return null if the engine doesn't have a URL
     // with a text/html response type.  This is unlikely (since
     // SearchService._addEngineToStore() should fail for such an engine),
     // but let's be on the safe side.
     if (!submission)
       return;
 
-    if (useNewTab) {
-      gBrowser.loadOneTab(submission.uri.spec, {
-                          postData: submission.postData,
-                          relatedToCurrent: true});
-    } else
-      loadURI(submission.uri.spec, null, submission.postData, false);
+    openLinkIn(submission.uri.spec,
+               useNewTab ? "tab" : "current",
+               { postData: submission.postData,
+                 relatedToCurrent: true });
   },
 
   /**
    * Returns the search bar element if it is present in the toolbar, null otherwise.
    */
   get searchBar() {
     return document.getElementById("searchbar");
   },
@@ -4251,24 +4250,20 @@ var XULBrowserWindow = {
           this.throbberElement.setAttribute("busy", "true");
 
         // XXX: This needs to be based on window activity...
         this.stopCommand.removeAttribute("disabled");
         CombinedStopReload.switchToStop();
       }
     }
     else if (aStateFlags & nsIWebProgressListener.STATE_STOP) {
-      if (aStateFlags & nsIWebProgressListener.STATE_IS_NETWORK) {
-        if (aWebProgress.DOMWindow == content) {
-          if (aRequest)
-            this.endDocumentLoad(aRequest, aStatus);
-          if (!gBrowser.mTabbedMode && !gBrowser.getIcon())
-            gBrowser.useDefaultIcon(gBrowser.selectedTab);
-        }
-      }
+      if (aStateFlags & nsIWebProgressListener.STATE_IS_NETWORK &&
+          aWebProgress.DOMWindow == content &&
+          aRequest)
+        this.endDocumentLoad(aRequest, aStatus);
 
       // This (thanks to the filter) is a network stop or the last
       // request stop outside of loading the document, stop throbbers
       // and progress bars and such
       if (aRequest) {
         let msg = "";
         let location;
         // Get the URI either from a channel or a pseudo-object
@@ -4394,19 +4389,16 @@ var XULBrowserWindow = {
       if ((location == "about:blank" && !content.opener) ||
           location == "") {  // Second condition is for new tabs, otherwise
                              // reload function is enabled until tab is refreshed.
         this.reloadCommand.setAttribute("disabled", "true");
       } else {
         this.reloadCommand.removeAttribute("disabled");
       }
 
-      if (!gBrowser.mTabbedMode && aWebProgress.isLoadingDocument)
-        gBrowser.setIcon(gBrowser.selectedTab, null);
-
       if (gURLBar) {
         // Strip off "wyciwyg://" and passwords for the location bar
         let uri = aLocationURI;
         try {
           uri = this._uriFixup.createExposableURI(uri);
         } catch (e) {}
         URLBarSetURI(uri);
 
@@ -5071,33 +5063,29 @@ var TabsInTitlebar = {
     let docElement = document.documentElement;
     if (allowed == (docElement.getAttribute("tabsintitlebar") == "true"))
       return;
 
     function $(id) document.getElementById(id);
     let titlebar = $("titlebar");
 
     if (allowed) {
-      let availTop = screen.availTop;
-      function top(ele)    ele.boxObject.screenY - availTop;
-      function bottom(ele) top(ele) + rect(ele).height;
       function rect(ele)   ele.getBoundingClientRect();
 
       let tabsToolbar       = $("TabsToolbar");
+
       let appmenuButtonBox  = $("appmenu-button-container");
       let captionButtonsBox = $("titlebar-buttonbox");
-
       this._sizePlaceholder("appmenu-button", rect(appmenuButtonBox).width);
       this._sizePlaceholder("caption-buttons", rect(captionButtonsBox).width);
 
-      let maxMargin = top(gNavToolbox);
-      let tabsBottom = maxMargin + rect(tabsToolbar).height;
-      let titlebarBottom = Math.max(bottom(appmenuButtonBox), bottom(captionButtonsBox));
-      let distance = tabsBottom - titlebarBottom;
-      titlebar.style.marginBottom = - Math.min(distance, maxMargin) + "px";
+      let tabsToolbarRect = rect(tabsToolbar);
+      let titlebarTop = rect($("titlebar-content")).top;
+      titlebar.style.marginBottom = - Math.min(tabsToolbarRect.top - titlebarTop,
+                                               tabsToolbarRect.height) + "px";
 
       docElement.setAttribute("tabsintitlebar", "true");
 
       if (!this._draghandle) {
         let tmp = {};
         Components.utils.import("resource://gre/modules/WindowDraggingUtils.jsm", tmp);
         this._draghandle = new tmp.WindowDraggingElement(tabsToolbar, window);
         this._draghandle.mouseDownCheck = function () {
@@ -8513,18 +8501,27 @@ XPCOMUtils.defineLazyGetter(this, "HUDCo
 
 // Prompt user to restart the browser in safe mode 
 function safeModeRestart()
 {
   // prompt the user to confirm 
   let promptTitle = gNavigatorBundle.getString("safeModeRestartPromptTitle");
   let promptMessage = 
     gNavigatorBundle.getString("safeModeRestartPromptMessage");
-  let rv = Services.prompt.confirm(window, promptTitle, promptMessage);
-  if (rv) {
+  let restartText = gNavigatorBundle.getString("safeModeRestartButton");
+  let buttonFlags = (Services.prompt.BUTTON_POS_0 *
+                     Services.prompt.BUTTON_TITLE_IS_STRING) +
+                    (Services.prompt.BUTTON_POS_1 *
+                     Services.prompt.BUTTON_TITLE_CANCEL) +
+                    Services.prompt.BUTTON_POS_0_DEFAULT;
+
+  let rv = Services.prompt.confirmEx(window, promptTitle, promptMessage,
+                                     buttonFlags, restartText, null, null,
+                                     null, {});
+  if (rv == 0) {
     let environment = Components.classes["@mozilla.org/process/environment;1"].
       getService(Components.interfaces.nsIEnvironment);
     environment.set("MOZ_SAFE_MODE_RESTART", "1");
     Application.restart();
   }
 }
 
 /* duplicateTabIn duplicates tab in a place specified by the parameter |where|.
--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@@ -788,16 +788,17 @@
 #ifdef MENUBAR_CAN_AUTOHIDE
 #ifndef CAN_DRAW_IN_TITLEBAR
 #define APPMENU_ON_TABBAR
 #endif
 #endif
 
 
     <toolbar id="TabsToolbar"
+             class="toolbar-primary"
              fullscreentoolbar="true"
              customizable="true"
              mode="icons" lockmode="true"
              iconsize="small" defaulticonsize="small" lockiconsize="true"
              aria-label="&tabsToolbar.label;"
              context="toolbar-context-menu"
 #ifdef APPMENU_ON_TABBAR
              defaultset="appmenu-toolbar-button,tabbrowser-tabs,new-tab-button,alltabs-button,tabs-closebutton"
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -129,23 +129,20 @@
       </field>
       <field name="mProgressListeners">
         []
       </field>
       <field name="mTabsProgressListeners">
         []
       </field>
       <field name="mTabListeners">
-        new Array()
+        []
       </field>
       <field name="mTabFilters">
-        new Array()
-      </field>
-      <field name="mTabbedMode">
-        false
+        []
       </field>
       <field name="mIsBusy">
         false
       </field>
       <field name="arrowKeysShouldWrap" readonly="true">
 #ifdef XP_MACOSX
         true
 #else
@@ -1059,57 +1056,16 @@
             if (aTab.selected)
               this.updateTitlebar();
 
             return true;
           ]]>
         </body>
       </method>
 
-      <method name="enterTabbedMode">
-        <body>
-          <![CDATA[
-            if (this.mTabbedMode)
-              return;
-
-            this.mTabbedMode = true; // Welcome to multi-tabbed mode.
-
-            if (XULBrowserWindow.isBusy) {
-              this.mCurrentTab.setAttribute("busy", "true");
-              this.mIsBusy = true;
-              this.setTabTitleLoading(this.mCurrentTab);
-            } else {
-              this.setIcon(this.mCurrentTab, this.mCurrentBrowser.mIconURL);
-            }
-
-            var filter;
-            if (this.mTabFilters.length > 0) {
-              // Use the filter hooked up in our addProgressListener
-              filter = this.mTabFilters[0];
-            } else {
-              // create a filter and hook it up to our first browser
-              filter = Components.classes["@mozilla.org/appshell/component/browser-status-filter;1"]
-                                 .createInstance(Components.interfaces.nsIWebProgress);
-              this.mTabFilters[0] = filter;
-              this.mCurrentBrowser.webProgress.addProgressListener(filter, Components.interfaces.nsIWebProgress.NOTIFY_ALL);
-            }
-
-            // Remove all our progress listeners from the active browser's filter.
-            this.mProgressListeners.forEach(filter.removeProgressListener, filter);
-
-            // Wire up a progress listener to our filter.
-            const listener = this.mTabProgressListener(this.mCurrentTab,
-                                                       this.mCurrentBrowser,
-                                                       false);
-            filter.addProgressListener(listener, Components.interfaces.nsIWebProgress.NOTIFY_ALL);
-            this.mTabListeners[0] = listener;
-          ]]>
-        </body>
-      </method>
-
       <method name="loadOneTab">
         <parameter name="aURI"/>
         <parameter name="aReferrerURI"/>
         <parameter name="aCharset"/>
         <parameter name="aPostData"/>
         <parameter name="aLoadInBackground"/>
         <parameter name="aAllowThirdPartyFixup"/>
         <body>
@@ -1223,18 +1179,16 @@
               aAllowThirdPartyFixup = params.allowThirdPartyFixup;
               aFromExternal         = params.fromExternal;
               aRelatedToCurrent     = params.relatedToCurrent;
               aSkipAnimation        = params.skipAnimation;
             }
 
             this._browsers = null; // invalidate cache
 
-            this.enterTabbedMode();
-
             // if we're adding tabs, we're past interrupt mode, ditch the owner
             if (this.mCurrentTab.owner)
               this.mCurrentTab.owner = null;
 
             var t = document.createElementNS(
               "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul",
                                              "tab");
 
@@ -1861,70 +1815,48 @@
           <![CDATA[
             this.getBrowserForTab(aTab).reload();
           ]]>
         </body>
       </method>
 
       <method name="addProgressListener">
         <parameter name="aListener"/>
-        <parameter name="aMask"/>
         <body>
           <![CDATA[
+            if (arguments.length != 1) {
+              Components.utils.reportError("gBrowser.addProgressListener was " +
+                                           "called with a second argument, " +
+                                           "which is not supported. See bug " +
+                                           "608628.");
+            }
+
             if (!this.mAddProgressListenerWasCalled) {
               this.mAddProgressListenerWasCalled = true;
               this.tabContainer.updateVisibility();
             }
 
-            if (this.mProgressListeners.length == 1) {
-              // If we are adding a 2nd progress listener, we need to enter tabbed mode
-              // because the browser status filter can only handle one progress listener.
-              // In tabbed mode, mTabProgressListener is used which will iterate over all listeners.
-              this.enterTabbedMode();
-            }
-
             this.mProgressListeners.push(aListener);
-
-            if (!this.mTabbedMode) {
-              // If someone does this:
-              // addProgressListener, removeProgressListener, addProgressListener
-              // don't create a new filter; reuse the existing filter.
-              if (this.mTabFilters.length == 0) {
-                // hook a filter up to our first browser
-                const filter = Components.classes["@mozilla.org/appshell/component/browser-status-filter;1"]
-                                         .createInstance(Components.interfaces.nsIWebProgress);
-                this.mTabFilters[0] = filter;
-                this.mCurrentBrowser.webProgress.addProgressListener(filter, Components.interfaces.nsIWebProgress.NOTIFY_ALL);
-              }
-
-              // Directly hook the listener up to the filter for better performance
-              this.mTabFilters[0].addProgressListener(aListener, aMask);
-            }
           ]]>
         </body>
       </method>
 
       <method name="removeProgressListener">
         <parameter name="aListener"/>
         <body>
           <![CDATA[
             this.mProgressListeners =
               this.mProgressListeners.filter(function (l) l != aListener);
-
-            if (!this.mTabbedMode)
-              // Don't forget to remove it from the filter we hooked it up to
-              this.mTabFilters[0].removeProgressListener(aListener);
          ]]>
         </body>
       </method>
 
       <method name="addTabsProgressListener">
         <parameter name="aListener"/>
         <body>
-          this.enterTabbedMode();
           this.mTabsProgressListeners.push(aListener);
         </body>
       </method>
 
       <method name="removeTabsProgressListener">
         <parameter name="aListener"/>
         <body>
         <![CDATA[
@@ -2484,19 +2416,43 @@
 
           // set up the shared autoscroll popup
           this._autoScrollPopup = this.mCurrentBrowser._createAutoScrollPopup();
           this._autoScrollPopup.id = "autoscroller";
           this.appendChild(this._autoScrollPopup);
           this.mCurrentBrowser.setAttribute("autoscrollpopup", this._autoScrollPopup.id);
           this.mCurrentBrowser.droppedLinkHandler = handleDroppedLink;
           this.updateWindowResizers();
+
+          // Hook up the event listeners to the first browser
+          var tabListener = this.mTabProgressListener(this.mCurrentTab, this.mCurrentBrowser, true);
+          const nsIWebProgress = Components.interfaces.nsIWebProgress;
+          const filter = Components.classes["@mozilla.org/appshell/component/browser-status-filter;1"]
+                                   .createInstance(nsIWebProgress);
+          filter.addProgressListener(tabListener, nsIWebProgress.NOTIFY_ALL);
+          this.mTabListeners[0] = tabListener;
+          this.mTabFilters[0] = filter;
+          this.init();
         ]]>
       </constructor>
 
+      <method name="init">
+        <body><![CDATA[
+          if (!this._initialProgressListenerAdded) {
+            this._initialProgressListenerAdded = true;
+            try {
+              this.webProgress.addProgressListener(this.mTabFilters[0], Components.interfaces.nsIWebProgress.NOTIFY_ALL);
+            } catch (e) {
+              // The binding was constructed too early, need to try this again later. See bug 463384.
+              this._initialProgressListenerAdded = false;
+            }
+          }
+        ]]></body>
+      </method>
+
       <destructor>
         <![CDATA[
           for (var i = 0; i < this.mTabListeners.length; ++i) {
             let browser = this.getBrowserAtIndex(i);
             if (browser.registeredOpenURI) {
               this._placesAutocomplete.unregisterOpenPage(browser.registeredOpenURI);
               delete browser.registeredOpenURI;
             }
@@ -2506,16 +2462,23 @@
             this.mTabListeners[i].destroy();
             this.mTabListeners[i] = null;
           }
           document.removeEventListener("keypress", this, false);
         ]]>
       </destructor>
 
       <!-- Deprecated stuff, implemented for backwards compatibility. -->
+      <method name="enterTabbedMode">
+        <body>
+          Application.console.log("enterTabbedMode is an obsolete method and " +
+                                  "will be removed in a future release.");
+        </body>
+      </method>
+      <field name="mTabbedMode" readonly="true">true</field>
       <method name="setStripVisibilityTo">
         <parameter name="aShow"/>
         <body>
           this.tabContainer.visible = aShow;
         </body>
       </method>
       <method name="getStripVisibility">
         <body>
@@ -2762,35 +2725,32 @@
       <property name="visible"
                 onget="return !this._container.collapsed;">
         <setter><![CDATA[
           if (val == this.visible)
             return val;
 
           this._container.collapsed = !val;
 
-          if (val)
-            this.tabbrowser.enterTabbedMode();
-
           document.getElementById("menu_closeWindow").hidden = !val;
           document.getElementById("menu_close").setAttribute("label",
             this.tabbrowser.mStringBundle.getString(val ? "tabs.closeTab" : "tabs.close"));
 
           if (window.TabsInTitlebar)
             TabsInTitlebar.allowedBy("tabs-visible", val);
 
           return val;
         ]]></setter>
       </property>
 
       <method name="updateVisibility">
         <body><![CDATA[
-          if (this.childNodes.length - this.tabbrowser._removingTabs.length == 1 &&
-              window.toolbar.visible)
-            this.visible = !Services.prefs.getBoolPref("browser.tabs.autoHide");
+          if (this.childNodes.length - this.tabbrowser._removingTabs.length == 1)
+            this.visible = window.toolbar.visible &&
+                           !Services.prefs.getBoolPref("browser.tabs.autoHide");
           else
             this.visible = true;
         ]]></body>
       </method>
 
       <method name="adjustTabstrip">
         <body><![CDATA[
           // modes for tabstrip
--- a/browser/base/content/tabview/drag.js
+++ b/browser/base/content/tabview/drag.js
@@ -97,16 +97,23 @@ function Drag(item, event, isFauxDrag) {
     } else if (this.item.isATabItem) {
       UI.setActiveTab(this.item);
     }
   }
 };
 
 Drag.prototype = {
   // ----------
+  // Function: toString
+  // Prints [Drag (item)] for debug use
+  toString: function Drag_toString() {
+    return "[Drag (" + this.item + ")]";
+  },
+
+  // ----------
   // Function: snapBounds
   // Adjusts the given bounds according to the currently active trenches. Used by <Drag.snap>
   //
   // Parameters:
   //   bounds             - (<Rect>) bounds
   //   stationaryCorner   - which corner is stationary? by default, the top left in LTR mode,
   //                        and top right in RTL mode.
   //                        "topleft", "bottomleft", "topright", "bottomright"
--- a/browser/base/content/tabview/groupitems.js
+++ b/browser/base/content/tabview/groupitems.js
@@ -79,16 +79,17 @@ function GroupItem(listOfEls, options) {
   this._isStacked = false;
   this.expanded = null;
   this.topChild = null;
   this.hidden = false;
   this.fadeAwayUndoButtonDelay = 15000;
   this.fadeAwayUndoButtonDuration = 300;
 
   this.keepProportional = false;
+  this._frozenItemSizeData = {};
 
   // Double click tracker
   this._lastClick = 0;
   this._lastClickPositions = null;
 
   // Variable: _activeTab
   // The <TabItem> for the groupItem's active tab.
   this._activeTab = null;
@@ -189,16 +190,17 @@ function GroupItem(listOfEls, options) {
   this.$title
     .blur(function() {
       self._titleFocused = false;
       self.$titleShield.show();
       if (self.getTitle())
         gTabView.firstUseExperienced = true;
     })
     .focus(function() {
+      self._unfreezeItemSize();
       if (!self._titleFocused) {
         (self.$title)[0].select();
         self._titleFocused = true;
       }
     })
     .mousedown(function(e) {
       e.stopPropagation();
     })
@@ -277,16 +279,23 @@ function GroupItem(listOfEls, options) {
   this.save();
 
   GroupItems.updateGroupCloseButtons();
 };
 
 // ----------
 GroupItem.prototype = Utils.extend(new Item(), new Subscribable(), {
   // ----------
+  // Function: toString
+  // Prints [GroupItem id=id] for debug use
+  toString: function GroupItem_toString() {
+    return "[GroupItem id=" + this.id + "]";
+  },
+
+  // ----------
   // Variable: defaultName
   // The prompt text for the title field.
   defaultName: tabviewString('groupItem.defaultName'),
 
   // -----------
   // Function: setActiveTab
   // Sets the active <TabItem> for this groupItem; can be null, but only
   // if there are no children.
@@ -632,16 +641,19 @@ GroupItem.prototype = Utils.extend(new I
   //   options - An object with optional settings for this call.
   //
   // Options:
   //   immediately - (bool) if true, no animation will be used
   close: function GroupItem_close(options) {
     this.removeAll({dontClose: true});
     GroupItems.unregister(this);
 
+    // remove unfreeze event handlers, if item size is frozen
+    this._unfreezeItemSize({dontArrange: true});
+
     let self = this;
     let destroyGroup = function () {
       iQ(self.container).remove();
       if (self.$undoContainer) {
         self.$undoContainer.remove();
         self.$undoContainer = null;
       }
       self.removeTrenches();
@@ -665,16 +677,17 @@ GroupItem.prototype = Utils.extend(new I
     this.deleteData();
   },
 
   // ----------
   // Function: closeAll
   // Closes the groupItem and all of its children.
   closeAll: function GroupItem_closeAll() {
     if (this._children.length > 0) {
+      this._unfreezeItemSize();
       this._children.forEach(function(child) {
         iQ(child.container).hide();
       });
 
       iQ(this.container).animate({
          opacity: 0,
          "-moz-transform": "scale(.3)",
       }, {
@@ -866,18 +879,20 @@ GroupItem.prototype = Utils.extend(new I
   // ----------
   // Function: _createUndoButton
   // Makes the affordance for undo a close group action
   _createUndoButton: function GroupItem__createUndoButton() {
     let self = this;
     this.$undoContainer = iQ("<div/>")
       .addClass("undo")
       .attr("type", "button")
+      .appendTo("body");
+    iQ("<span/>")
       .text(tabviewString("groupItem.undoCloseGroup"))
-      .appendTo("body");
+      .appendTo(this.$undoContainer);
     let undoClose = iQ("<span/>")
       .addClass("close")
       .appendTo(this.$undoContainer);
 
     this.$undoContainer.css({
       left: this.bounds.left + this.bounds.width/2 - iQ(self.$undoContainer).width()/2,
       top:  this.bounds.top + this.bounds.height/2 - iQ(self.$undoContainer).height()/2,
       "-moz-transform": "scale(.1)",
@@ -995,18 +1010,23 @@ GroupItem.prototype = Utils.extend(new I
       item.setZ(this.getZ() + 1);
       $el.addClass("tabInGroupItem");
 
       if (!wasAlreadyInThisGroupItem) {
         item.droppable(false);
         item.groupItemData = {};
 
         item.addSubscriber(this, "close", function() {
+          let count = self._children.length;
+          let dontArrange = self.expanded || !self.shouldStack(count);
           let dontClose = !item.closedManually && gBrowser._numPinnedTabs > 0;
-          self.remove(item, { dontClose: dontClose });
+          self.remove(item, {dontArrange: dontArrange, dontClose: dontClose});
+
+          if (dontArrange)
+            self._freezeItemSize(count);
 
           if (self._children.length > 0 && self._activeTab) {
             GroupItems.setActiveGroupItem(self);
             UI.setActiveTab(self._activeTab);
           }
         });
 
         item.setParent(this);
@@ -1023,16 +1043,17 @@ GroupItem.prototype = Utils.extend(new I
         if (item.tab == gBrowser.selectedTab || 
             (!GroupItems.getActiveGroupItem() && !item.tab.hidden))
           GroupItems.setActiveGroupItem(this);
       }
 
       if (!options.dontArrange)
         this.arrange({animate: !options.immediately});
 
+      this._unfreezeItemSize({dontArrange: true});
       this._sendToSubscribers("childAdded",{ groupItemId: this.id, item: item });
 
       UI.setReorderTabsOnHide(this);
     } catch(e) {
       Utils.log('GroupItem.add error', e);
     }
   },
 
@@ -1079,32 +1100,40 @@ GroupItem.prototype = Utils.extend(new I
       item.setParent(null);
       item.removeClass("tabInGroupItem");
       item.removeClass("stacked");
       item.isStacked = false;
       item.setHidden(false);
       item.removeClass("stack-trayed");
       item.setRotation(0);
 
+      // Force tabItem resize if it's dragged out of a stacked groupItem.
+      // The tabItems's title will be visible and that's why we need to
+      // recalculate its height.
+      if (item.isDragging && this.isStacked())
+        item.setBounds(item.getBounds(), true, {force: true});
+
       item.droppable(true);
       item.removeSubscriber(this, "close");
 
       if (typeof item.setResizable == 'function')
         item.setResizable(true, options.immediately);
 
       // if a blank tab is selected while restoring a tab the blank tab gets
       // removed. we need to keep the group alive for the restored tab.
       if (item.tab._tabViewTabIsRemovedAfterRestore)
         options.dontClose = true;
 
       let closed = options.dontClose ? false : this.closeIfEmpty();
       if (closed)
         this._makeClosestTabActive();
-      else if (!options.dontArrange)
+      else if (!options.dontArrange) {
         this.arrange({animate: !options.immediately});
+        this._unfreezeItemSize({dontArrange: true});
+      }
 
       this._sendToSubscribers("childRemoved",{ groupItemId: this.id, item: item });
     } catch(e) {
       Utils.log(e);
     }
   },
 
   // ----------
@@ -1226,16 +1255,76 @@ GroupItem.prototype = Utils.extend(new I
  
     let shouldStack = arrObj.childWidth < TabItems.minTabWidth * 1.35;
     this._columns = shouldStack ? null : arrObj.columns;
 
     return shouldStack;
   },
 
   // ----------
+  // Function: _freezeItemSize
+  // Freezes current item size (when removing a child).
+  //
+  // Parameters:
+  //   itemCount - the number of children before the last one was removed
+  _freezeItemSize: function GroupItem__freezeItemSize(itemCount) {
+    let data = this._frozenItemSizeData;
+
+    if (!data.lastItemCount) {
+      let self = this;
+      data.lastItemCount = itemCount;
+
+      // unfreeze item size when tabview is hidden
+      data.onTabViewHidden = function () self._unfreezeItemSize();
+      window.addEventListener('tabviewhidden', data.onTabViewHidden, false);
+
+      // we don't need to observe mouse movement when expanded because the
+      // tray is closed when we leave it and collapse causes unfreezing
+      if (self.expanded)
+        return;
+
+      // unfreeze item size when cursor is moved out of group bounds
+      data.onMouseMove = function (e) {
+        let cursor = new Point(e.pageX, e.pageY);
+        if (!self.bounds.contains(cursor))
+          self._unfreezeItemSize();
+      }
+      iQ(window).mousemove(data.onMouseMove);
+    }
+
+    this.arrange({animate: true, count: data.lastItemCount});
+  },
+
+  // ----------
+  // Function: _unfreezeItemSize
+  // Unfreezes and updates item size.
+  //
+  // Parameters:
+  //   options - various options (see below)
+  //
+  // Possible options:
+  //   dontArrange - do not arrange items when unfreezing
+  _unfreezeItemSize: function GroupItem__unfreezeItemSize(options) {
+    let data = this._frozenItemSizeData;
+    if (!data.lastItemCount)
+      return;
+
+    if (!options || !options.dontArrange)
+      this.arrange({animate: true});
+
+    // unbind event listeners
+    window.removeEventListener('tabviewhidden', data.onTabViewHidden, false);
+    if (data.onMouseMove)
+      iQ(window).unbind('mousemove', data.onMouseMove);
+
+    // reset freeze status
+    this._frozenItemSizeData = {};
+  },
+
+  // ----------
   // Function: arrange
   // Lays out all of the children.
   //
   // Parameters:
   //   options - passed to <Items.arrange> or <_stackArrange>, except those below
   //
   // Options:
   //   addTab - (boolean) if true, we add one to the child count
@@ -1549,16 +1638,17 @@ GroupItem.prototype = Utils.extend(new I
       this.expanded.$shield.remove();
       this.expanded = null;
 
       this._children.forEach(function(child) {
         child.removeClass("stack-trayed");
       });
 
       this.arrange({z: z + 2});
+      this._unfreezeItemSize({dontArrange: true});
     }
   },
 
   // ----------
   // Function: _addHandlers
   // Helper routine for the constructor; adds various event handlers to the container.
   _addHandlers: function GroupItem__addHandlers(container) {
     let self = this;
@@ -1676,18 +1766,21 @@ GroupItem.prototype = Utils.extend(new I
       self.expand();
     });
   },
 
   // ----------
   // Function: setResizable
   // Sets whether the groupItem is resizable and updates the UI accordingly.
   setResizable: function GroupItem_setResizable(value, immediately) {
+    var self = this;
+
     this.resizeOptions.minWidth = GroupItems.minGroupWidth;
     this.resizeOptions.minHeight = GroupItems.minGroupHeight;
+    this.resizeOptions.start = function () self._unfreezeItemSize();
 
     if (value) {
       immediately ? this.$resizer.show() : this.$resizer.fadeIn();
       this.resizable(true);
     } else {
       immediately ? this.$resizer.hide() : this.$resizer.fadeOut();
       this.resizable(false);
     }
@@ -1788,16 +1881,23 @@ let GroupItems = {
   _arrangesPending: [],
   _removingHiddenGroups: false,
   _delayedModUpdates: [],
   _autoclosePaused: false,
   minGroupHeight: 110,
   minGroupWidth: 125,
 
   // ----------
+  // Function: toString
+  // Prints [GroupItems] for debug use
+  toString: function GroupItems_toString() {
+    return "[GroupItems count=" + this.groupItems.length + "]";
+  },
+
+  // ----------
   // Function: init
   init: function GroupItems_init() {
     let self = this;
 
     // setup attr modified handler, and prepare for its uninit
     function handleAttrModified(xulTab) {
       self._handleAttrModified(xulTab);
     }
--- a/browser/base/content/tabview/iq.js
+++ b/browser/base/content/tabview/iq.js
@@ -181,16 +181,33 @@ function iQClass(selector, context) {
       Utils.merge(ret, selector);
     }
   }
   return ret;
 };
   
 iQClass.prototype = {
 
+  // ----------
+  // Function: toString
+  // Prints [iQ...] for debug use
+  toString: function iQClass_toString() {
+    if (this.length > 1) {
+      if (this.selector)
+        return "[iQ (" + this.selector + ")]";
+      else
+        return "[iQ multi-object]";
+    }
+
+    if (this.length == 1)
+      return "[iQ (" + this[0].toString() + ")]";
+
+    return "[iQ non-object]";
+  },
+
   // Start with an empty selector
   selector: "",
 
   // The default length of a iQ object is 0
   length: 0,
 
   // ----------
   // Function: each
--- a/browser/base/content/tabview/items.js
+++ b/browser/base/content/tabview/items.js
@@ -18,16 +18,17 @@
  * Portions created by the Initial Developer are Copyright (C) 2010
  * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
  * Ian Gilman <ian@iangilman.com>
  * Aza Raskin <aza@mozilla.com>
  * Michael Yoshitaka Erlewine <mitcho@mitcho.com>
  * Sean Dunn <seanedunn@yahoo.com>
+ * Tim Taubert <tim.taubert@gmx.de>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
  * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
  * in which case the provisions of the GPL or the LGPL are applicable instead
  * of those above. If you wish to allow use of your version of this file only
  * under the terms of either the GPL or the LGPL, and not to allow others to
  * use your version of this file under the terms of the MPL, indicate your
@@ -164,18 +165,20 @@ Item.prototype = {
     }
 
     iQ(this.container).data('item', this);
 
     // ___ drag
     this.dragOptions = {
       cancelClass: 'close stackExpander',
       start: function(e, ui) {
-        if (this.isAGroupItem)
+        if (this.isAGroupItem) {
           GroupItems.setActiveGroupItem(this);
+          this._unfreezeItemSize();
+        }
         // if we start dragging a tab within a group, start with dropSpace on.
         else if (this.parent != null)
           this.parent._dropSpaceActive = true;
         drag.info = new Drag(this, e);
       },
       drag: function(e) {
         drag.info.drag(e);
       },
@@ -593,16 +596,45 @@ Item.prototype = {
       var $container = iQ(this.container);
       var startMouse;
       var startPos;
       var startSent;
       var startEvent;
       var droppables;
       var dropTarget;
 
+      // determine the best drop target based on the current mouse coordinates
+      let determineBestDropTarget = function (e, box) {
+        // drop events
+        var best = {
+          dropTarget: null,
+          score: 0
+        };
+
+        droppables.forEach(function(droppable) {
+          var intersection = box.intersection(droppable.bounds);
+          if (intersection && intersection.area() > best.score) {
+            var possibleDropTarget = droppable.item;
+            var accept = true;
+            if (possibleDropTarget != dropTarget) {
+              var dropOptions = possibleDropTarget.dropOptions;
+              if (dropOptions && typeof dropOptions.accept == "function")
+                accept = dropOptions.accept.apply(possibleDropTarget, [self]);
+            }
+
+            if (accept) {
+              best.dropTarget = possibleDropTarget;
+              best.score = intersection.area();
+            }
+          }
+        });
+
+        return best.dropTarget;
+      }
+
       // ___ mousemove
       var handleMouseMove = function(e) {
         // global drag tracking
         drag.lastMoveTime = Date.now();
 
         // positioning
         var mouse = new Point(e.pageX, e.pageY);
         if (!startSent) {
@@ -619,49 +651,27 @@ Item.prototype = {
           var box = self.getBounds();
           box.left = startPos.x + (mouse.x - startMouse.x);
           box.top = startPos.y + (mouse.y - startMouse.y);
           self.setBounds(box, true);
 
           if (typeof self.dragOptions.drag == "function")
             self.dragOptions.drag.apply(self, [e]);
 
-          // drop events
-          var best = {
-            dropTarget: null,
-            score: 0
-          };
+          let bestDropTarget = determineBestDropTarget(e, box);
 
-          droppables.forEach(function(droppable) {
-            var intersection = box.intersection(droppable.bounds);
-            if (intersection && intersection.area() > best.score) {
-              var possibleDropTarget = droppable.item;
-              var accept = true;
-              if (possibleDropTarget != dropTarget) {
-                var dropOptions = possibleDropTarget.dropOptions;
-                if (dropOptions && typeof dropOptions.accept == "function")
-                  accept = dropOptions.accept.apply(possibleDropTarget, [self]);
-              }
-
-              if (accept) {
-                best.dropTarget = possibleDropTarget;
-                best.score = intersection.area();
-              }
-            }
-          });
-
-          if (best.dropTarget != dropTarget) {
+          if (bestDropTarget != dropTarget) {
             var dropOptions;
             if (dropTarget) {
               dropOptions = dropTarget.dropOptions;
               if (dropOptions && typeof dropOptions.out == "function")
                 dropOptions.out.apply(dropTarget, [e]);
             }
 
-            dropTarget = best.dropTarget;
+            dropTarget = bestDropTarget;
 
             if (dropTarget) {
               dropOptions = dropTarget.dropOptions;
               if (dropOptions && typeof dropOptions.over == "function")
                 dropOptions.over.apply(dropTarget, [e]);
             }
           }
           if (dropTarget) {
@@ -705,32 +715,34 @@ Item.prototype = {
         });
 
         if (cancel) {
           e.preventDefault();
           return;
         }
 
         startMouse = new Point(e.pageX, e.pageY);
-        startPos = self.getBounds().position();
+        let bounds = self.getBounds();
+        startPos = bounds.position();
         startEvent = e;
         startSent = false;
-        dropTarget = null;
 
         droppables = [];
         iQ('.iq-droppable').each(function(elem) {
           if (elem != self.container) {
             var item = Items.item(elem);
             droppables.push({
               item: item,
               bounds: item.getBounds()
             });
           }
         });
 
+        dropTarget = determineBestDropTarget(e, bounds);
+
         iQ(gWindow)
           .mousemove(handleMouseMove)
           .mouseup(handleMouseUp);
 
         e.preventDefault();
       });
     } catch(e) {
       Utils.log(e);
@@ -850,16 +862,23 @@ Item.prototype = {
   }
 };
 
 // ##########
 // Class: Items
 // Keeps track of all Items.
 let Items = {
   // ----------
+  // Function: toString
+  // Prints [Items] for debug use
+  toString: function Items_toString() {
+    return "[Items]";
+  },
+
+  // ----------
   // Variable: defaultGutter
   // How far apart Items should be from each other and from bounds
   defaultGutter: 15,
 
   // ----------
   // Function: item
   // Given a DOM element representing an Item, returns the Item.
   item: function Items_item(el) {
--- a/browser/base/content/tabview/modules/AllTabs.jsm
+++ b/browser/base/content/tabview/modules/AllTabs.jsm
@@ -36,16 +36,23 @@
  * ***** END LICENSE BLOCK ***** */
 
 const Cu = Components.utils;
 Cu.import("resource://gre/modules/Services.jsm");
 
 let EXPORTED_SYMBOLS = ["AllTabs"];
 
 let AllTabs = {
+  // ----------
+  // Function: toString
+  // Prints [AllTabs] for debug use
+  toString: function AllTabs_toString() {
+    return "[AllTabs]";
+  },
+
   /**
    * Get an array of all tabs from all tabbrowser windows.
    *
    * @usage let numAllTabs = AllTabs.tabs.length;
    *        AllTabs.tabs.forEach(handleAllTabs);
    */
   get tabs() {
     // Get tabs from each browser window and flatten them into one array
--- a/browser/base/content/tabview/modules/utils.jsm
+++ b/browser/base/content/tabview/modules/utils.jsm
@@ -16,16 +16,17 @@
  * The Initial Developer of the Original Code is the Mozilla Foundation.
  * Portions created by the Initial Developer are Copyright (C) 2010
  * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
  * Aza Raskin <aza@mozilla.com>
  * Ian Gilman <ian@iangilman.com>
  * Michael Yoshitaka Erlewine <mitcho@mitcho.com>
+ * Tim Taubert <tim.taubert@gmx.de>
  *
  * This file incorporates work from:
  * jQuery JavaScript Library v1.4.2: http://code.jquery.com/jquery-1.4.2.js
  * This incorporated work is covered by the following copyright and
  * permission notice:
  * Copyright 2010, John Resig
  * Dual licensed under the MIT or GPL Version 2 licenses.
  * http://jquery.org/license
@@ -70,16 +71,23 @@ function Point(a, y) {
   } else {
     this.x = (Utils.isNumber(a) ? a : 0);
     this.y = (Utils.isNumber(y) ? y : 0);
   }
 };
 
 Point.prototype = {
   // ----------
+  // Function: toString
+  // Prints [Point (x,y)] for debug use
+  toString: function Point_toString() {
+    return "[Point (" + this.x + "," + this.y + ")]";
+  },
+
+  // ----------
   // Function: distance
   // Returns the distance from this point to the given <Point>.
   distance: function Point_distance(point) {
     var ax = this.x - point.x;
     var ay = this.y - point.y;
     return Math.sqrt((ax * ax) + (ay * ay));
   }
 };
@@ -104,16 +112,23 @@ function Rect(a, top, width, height) {
     this.left = a;
     this.top = top;
     this.width = width;
     this.height = height;
   }
 };
 
 Rect.prototype = {
+  // ----------
+  // Function: toString
+  // Prints [Rect (left,top,width,height)] for debug use
+  toString: function Rect_toString() {
+    return "[Rect (" + this.left + "," + this.top + "," +
+            this.width + "," + this.height + ")]";
+  },
 
   get right() this.left + this.width,
   set right(value) {
     this.width = value - this.left;
   },
 
   get bottom() this.top + this.height,
   set bottom(value) {
@@ -151,26 +166,32 @@ Rect.prototype = {
     if (box.width > 0 && box.height > 0)
       return box;
 
     return null;
   },
 
   // ----------
   // Function: contains
-  // Returns a boolean denoting if the given <Rect> is contained within
+  // Returns a boolean denoting if the <Rect> or <Point> is contained inside
   // this rectangle.
   //
-  // Paramaters
-  //  - A <Rect>
-  contains: function Rect_contains(rect) {
-    return (rect.left >= this.left &&
-            rect.right <= this.right &&
-            rect.top >= this.top &&
-            rect.bottom <= this.bottom);
+  // Parameters
+  //  - A <Rect> or a <Point>
+  contains: function Rect_contains(a) {
+    if (Utils.isPoint(a))
+      return (a.x > this.left &&
+              a.x < this.right &&
+              a.y > this.top &&
+              a.y < this.bottom);
+
+    return (a.left >= this.left &&
+            a.right <= this.right &&
+            a.top >= this.top &&
+            a.bottom <= this.bottom);
   },
 
   // ----------
   // Function: center
   // Returns a new <Point> with the center location of this rectangle.
   center: function Rect_center() {
     return new Point(this.left + (this.width / 2), this.top + (this.height / 2));
   },
@@ -277,16 +298,23 @@ function Range(min, max) {
     this.max = min.max;
   } else {
     this.min = min || 0;
     this.max = max || 0;
   }
 };
 
 Range.prototype = {
+  // ----------
+  // Function: toString
+  // Prints [Range (min,max)] for debug use
+  toString: function Range_toString() {
+    return "[Range (" + this.min + "," + this.max + ")]";
+  },
+
   // Variable: extent
   // Equivalent to max-min
   get extent() {
     return (this.max - this.min);
   },
 
   set extent(extent) {
     this.max = extent - this.min;
@@ -459,16 +487,23 @@ Subscribable.prototype = {
 };
 
 // ##########
 // Class: Utils
 // Singelton with common utility functions.
 let Utils = {
   defaultFaviconURL: "chrome://mozapps/skin/places/defaultFavicon.png",
 
+  // ----------
+  // Function: toString
+  // Prints [Utils] for debug use
+  toString: function Utils_toString() {
+    return "[Utils]";
+  },
+
   // ___ Logging
   useConsole: true, // as opposed to dump
   showTime: false,
 
   // ----------
   // Function: log
   // Prints the given arguments to the JavaScript error console as a message.
   // Pass as many arguments as you want, it'll print them all.
--- a/browser/base/content/tabview/search.js
+++ b/browser/base/content/tabview/search.js
@@ -111,16 +111,23 @@ function scorePatternMatch(pattern, matc
 
 // ##########
 // Class: TabUtils
 // 
 // A collection of helper functions for dealing with both
 // <TabItem>s and <xul:tab>s without having to worry which
 // one is which.
 var TabUtils = {
+  // ----------
+  // Function: toString
+  // Prints [TabUtils] for debug use
+  toString: function TabUtils_toString() {
+    return "[TabUtils]";
+  },
+
   // ---------
   // Function: _nameOfTab
   // Given a <TabItem> or a <xul:tab> returns the tab's name.
   nameOf: function TabUtils_nameOfTab(tab) {
     // We can have two types of tabs: A <TabItem> or a <xul:tab>
     // because we have to deal with both tabs represented inside
     // of active Panoramas as well as for windows in which
     // Panorama has yet to be activated. We uses object sniffing to
@@ -161,17 +168,24 @@ var TabUtils = {
 // 
 // A singleton class that allows you to iterate over
 // matching and not-matching tabs, given a case-insensitive
 // search term.
 function TabMatcher(term) { 
   this.term = term; 
 }
 
-TabMatcher.prototype = {  
+TabMatcher.prototype = {
+  // ----------
+  // Function: toString
+  // Prints [TabMatcher (term)] for debug use
+  toString: function TabMatcher_toString() {
+    return "[TabMatcher (" + this.term + ")]";
+  },
+
   // ---------
   // Function: _filterAndSortMatches
   // Given an array of <TabItem>s and <xul:tab>s returns a new array
   // of tabs whose name matched the search term, sorted by lexical
   // closeness.  
   _filterAndSortForMatches: function TabMatcher__filterAndSortForMatches(tabs) {
     var self = this;
     tabs = tabs.filter(function(tab){
@@ -312,23 +326,29 @@ TabMatcher.prototype = {
 // A singleton class that handles all of the
 // event handlers.
 function SearchEventHandlerClass() { 
   this.init(); 
 }
 
 SearchEventHandlerClass.prototype = {
   // ----------
+  // Function: toString
+  // Prints [SearchEventHandler] for debug use
+  toString: function SearchEventHandlerClass_toString() {
+    return "[SearchEventHandler]";
+  },
+
+  // ----------
   // Function: init
   // Initializes the searchbox to be focused, and everything
   // else to be hidden, and to have everything have the appropriate
   // event handlers;
   init: function () {
-    var self = this;
-    iQ("#searchbox")[0].focus(); 
+    let self = this;
     iQ("#search").hide();
     iQ("#searchshade").hide().click(function(event) {
       if ( event.target.id != "searchbox")
         hideSearch();
     });
     
     iQ("#searchbox").keyup(function() {
       performSearch();
@@ -364,16 +384,23 @@ SearchEventHandlerClass.prototype = {
         (!event.keyCode && !event.charCode)) {
       return;
     }
 
     // If we are already in an input field, allow typing as normal.
     if (event.target.nodeName == "INPUT")
       return;
 
+    // / is used to activate the search feature so the key shouldn't be entered 
+    // into the search box.
+    if (event.keyCode == KeyEvent.DOM_VK_SLASH) {
+      event.stopPropagation();
+      event.preventDefault();
+    }
+
     this.switchToInMode();
     this.initiatedBy = "keydown";
     ensureSearchShown(true);
   },
 
   // ----------
   // Function: inSearchKeyHandler
   // Handles all keydown while search mode.
@@ -500,31 +527,36 @@ var TabHandlers = {
   
   _mouseDownLocation: null
 };
 
 function createSearchTabMacher() {
   return new TabMatcher(iQ("#searchbox").val());
 }
 
-function hideSearch(event){
+function hideSearch(event) {
   iQ("#searchbox").val("");
   iQ("#searchshade").hide();
   iQ("#search").hide();
 
   iQ("#searchbutton").css({ opacity:.8 });
 
 #ifdef XP_MACOSX
   UI.setTitlebarColors(true);
 #endif
 
   performSearch();
   SearchEventHandler.switchToBeforeMode();
 
-  if (event){
+  if (event) {
+    // when hiding the search mode, we need to prevent the keypress handler
+    // in UI__setTabViewFrameKeyHandlers to handle the key press again. e.g. Esc
+    // which is already handled by the key down in this class.
+    if (event.type == "keydown")
+      UI.ignoreKeypressForSearch = true;
     event.preventDefault();
     event.stopPropagation();
   }
 
   // Return focus to the tab window
   UI.blurAll();
   gTabViewFrame.contentWindow.focus();
 
--- a/browser/base/content/tabview/storage.js
+++ b/browser/base/content/tabview/storage.js
@@ -46,16 +46,23 @@ let Storage = {
   GROUP_DATA_IDENTIFIER: "tabview-group",
   GROUPS_DATA_IDENTIFIER: "tabview-groups",
   TAB_DATA_IDENTIFIER: "tabview-tab",
   UI_DATA_IDENTIFIER: "tabview-ui",
   CACHE_CLIENT_IDENTIFIER: "tabview-cache",
   CACHE_PREFIX: "moz-panorama:",
 
   // ----------
+  // Function: toString
+  // Prints [Storage] for debug use
+  toString: function Storage_toString() {
+    return "[Storage]";
+  },
+
+  // ----------
   // Function: init
   // Sets up the object.
   init: function Storage_init() {
     this._sessionStore =
       Cc["@mozilla.org/browser/sessionstore;1"].
         getService(Ci.nsISessionStore);
     
     // Create stream-based cache session for tabview
@@ -408,13 +415,20 @@ let Storage = {
 // Calls <callback>(entry, access, status) when the requested cache entry
 // is available.
 function CacheListener(callback) {
   Utils.assert(typeof callback == "function", "callback arg must be a function");
   this.callback = callback;
 };
 
 CacheListener.prototype = {
+  // ----------
+  // Function: toString
+  // Prints [CacheListener] for debug use
+  toString: function CacheListener_toString() {
+    return "[CacheListener]";
+  },
+
   QueryInterface: XPCOMUtils.generateQI([Ci.nsICacheListener]),
   onCacheEntryAvailable: function (entry, access, status) {
     this.callback(entry, access, status);
   }
 };
--- a/browser/base/content/tabview/tabitems.js
+++ b/browser/base/content/tabview/tabitems.js
@@ -208,16 +208,23 @@ function TabItem(tab, options) {
 
   // ___ reconnect to data from Storage
   if (!TabItems.reconnectingPaused())
     this._reconnect();
 };
 
 TabItem.prototype = Utils.extend(new Item(), new Subscribable(), {
   // ----------
+  // Function: toString
+  // Prints [TabItem (tab)] for debug use
+  toString: function TabItem_toString() {
+    return "[TabItem (" + this.tab + ")]";
+  },
+
+  // ----------
   // Function: forceCanvasSize
   // Repaints the thumbnail with the given resolution, and forces it
   // to stay that resolution until unforceCanvasSize is called.
   forceCanvasSize: function TabItem_forceCanvasSize(w, h) {
     this.canvasSizeForced = true;
     this.$canvas[0].width = w;
     this.$canvas[0].height = h;
     this.tabCanvas.paint();
@@ -667,16 +674,18 @@ TabItem.prototype = Utils.extend(new Ite
         self.parent.collapse();
     }
 
     let animateZoom = gPrefBranch.getBoolPref("animate_zoom");
     if (animateZoom) {
       let transform = this.getZoomTransform();
       TabItems.pausePainting();
 
+      if (this.parent && this.parent.expanded)
+        $tabEl.removeClass("stack-trayed");
       $tabEl.addClass("front");
       $canvas
         .css({ '-moz-transform-origin': transform.transformOrigin })
         .animate({ '-moz-transform': transform.transform }, {
           duration: 230,
           easing: 'fast',
           complete: function() {
             onZoomDone();
@@ -707,16 +716,17 @@ TabItem.prototype = Utils.extend(new Ite
       $canvas.css("-moz-transform", null);
 
       GroupItems.setActiveOrphanTab(null);
 
       if (typeof complete == "function")
         complete();
     };
 
+    UI.setActiveTab(this);
     TabItems._update(this.tab, {force: true});
 
     $tab.addClass("front");
 
     // If we're in a stacked group, make sure we become the
     // topChild now so that we show the zoom animation correctly.
     if (this.parent && this.parent.isStacked())
       this.parent.setTopChild(this);
@@ -808,16 +818,23 @@ let TabItems = {
   _eventListeners: [],
   _pauseUpdateForTest: false,
   creatingNewOrphanTab: false,
   tempCanvas: null,
   _reconnectingPaused: false,
   tabItemPadding: {},
 
   // ----------
+  // Function: toString
+  // Prints [TabItems count=count] for debug use
+  toString: function TabItems_toString() {
+    return "[TabItems count=" + this.items.length + "]";
+  },
+
+  // ----------
   // Function: init
   // Set up the necessary tracking to maintain the <TabItems>s.
   init: function TabItems_init() {
     Utils.assert(window.AllTabs, "AllTabs must be initialized first");
     let self = this;
     
     // Set up tab priority queue
     this._tabsWaitingForUpdate = new TabPriorityQueue();
@@ -850,17 +867,19 @@ let TabItems = {
 
       self.update(tab);
     }
     // When a tab is closed, unlink.
     this._eventListeners["close"] = function(tab) {
       if (tab.ownerDocument.defaultView != gWindow || tab.pinned)
         return;
 
-      self.unlink(tab);
+      // XXX bug #635975 - don't unlink the tab if the dom window is closing.
+      if (!UI.isDOMWindowClosing)
+        self.unlink(tab);
     }
     for (let name in this._eventListeners) {
       AllTabs.register(name, this._eventListeners[name]);
     }
 
     // For each tab, create the link.
     AllTabs.tabs.forEach(function(tab) {
       if (tab.ownerDocument.defaultView != gWindow || tab.pinned)
@@ -1334,16 +1353,23 @@ let TabItems = {
 function TabPriorityQueue() {
 };
 
 TabPriorityQueue.prototype = {
   _low: [], // low priority queue
   _high: [], // high priority queue
 
   // ----------
+  // Function: toString
+  // Prints [TabPriorityQueue count=count] for debug use
+  toString: function TabPriorityQueue_toString() {
+    return "[TabPriorityQueue count=" + (this._low.length + this._high.length) + "]";
+  },
+
+  // ----------
   // Function: clear
   // Empty the update queue
   clear: function TabPriorityQueue_clear() {
     this._low = [];
     this._high = [];
   },
 
   // ----------
@@ -1435,16 +1461,23 @@ TabPriorityQueue.prototype = {
 // Does not need to be accessed from outside of tabitems.js
 function TabCanvas(tab, canvas) {
   this.tab = tab;
   this.canvas = canvas;
 };
 
 TabCanvas.prototype = {
   // ----------
+  // Function: toString
+  // Prints [TabCanvas (tab)] for debug use
+  toString: function TabCanvas_toString() {
+    return "[TabCanvas (" + this.tab + ")]";
+  },
+
+  // ----------
   // Function: paint
   paint: function TabCanvas_paint(evt) {
     var w = this.canvas.width;
     var h = this.canvas.height;
     if (!w || !h)
       return;
 
     if (!this.tab.linkedBrowser.contentWindow) {
--- a/browser/base/content/tabview/tabview.css
+++ b/browser/base/content/tabview/tabview.css
@@ -107,21 +107,16 @@ body {
 
 /* Other Items
 ----------------------------------*/
 
 .undo {
   position: absolute;
 }
 
-.undo .close {
-  display: inline-block;
-  position: relative;
-}
-
 .info-item {
   position: absolute;
 }
 
 /* Trenches
 ----------------------------------*/
 
 .guideTrench, 
--- a/browser/base/content/tabview/trench.js
+++ b/browser/base/content/tabview/trench.js
@@ -105,16 +105,25 @@ function Trench(element, xory, type, edg
   //   minRange - (<Range>) the minimum active range
   //   activeRange - (<Range>) the currently active range
   this.range = new Range(0,10000);
   this.minRange = new Range(0,0);
   this.activeRange = new Range(0,10000);
 };
 
 Trench.prototype = {
+  // ----------
+  // Function: toString
+  // Prints [Trench edge type (parentItem)] for debug use
+  toString: function Trench_toString() {
+    return "[Trench " + this.edge + " " + this.type +
+           (this.parentItem ? " (" + this.parentItem + ")" : "") +
+           "]";
+  },
+
   //----------
   // Variable: radius
   // (integer) radius is how far away we should snap from
   get radius() this.customRadius || Trenches.defaultRadius,
 
   setParentItem: function Trench_setParentItem(item) {
     if (!item.isAnItem) {
       Utils.assert(false, "parentItem must be an Item");
@@ -476,16 +485,23 @@ var Trenches = {
   // Variables: snapping preferences; used to break ties in snapping.
   //   preferTop - (boolean) prefer snapping to the top to the bottom
   //   preferLeft - (boolean) prefer snapping to the left to the right
   preferTop: true,
   get preferLeft() { return !UI.rtl; },
 
   trenches: [],
 
+  // ----------
+  // Function: toString
+  // Prints [Trenches count=count] for debug use
+  toString: function Trenches_toString() {
+    return "[Trenches count=" + this.trenches.length + "]";
+  },
+
   // ---------
   // Function: getById
   // Return the specified <Trench>.
   //
   // Parameters:
   //   id - (integer)
   getById: function Trenches_getById(id) {
     return this.trenches[id];
--- a/browser/base/content/tabview/ui.js
+++ b/browser/base/content/tabview/ui.js
@@ -127,16 +127,31 @@ let UI = {
   // Used to keep track of how many calls to storageBusy vs storageReady.
   _storageBusyCount: 0,
 
   // Variable: isDOMWindowClosing
   // Tells wether we already received the "domwindowclosed" event and the parent
   // windows is about to close.
   isDOMWindowClosing: false,
 
+  // Variable: _browserKeys
+  // Used to keep track of allowed browser keys.
+  _browserKeys: null,
+
+  // Variable: ignoreKeypressForSearch
+  // Used to prevent keypress being handled after quitting search mode.
+  ignoreKeypressForSearch: false,
+
+  // ----------
+  // Function: toString
+  // Prints [UI] for debug use
+  toString: function UI_toString() {
+    return "[UI]";
+  },
+
   // ----------
   // Function: init
   // Must be called after the object is created.
   init: function UI_init() {
     try {
       let self = this;
 
       // initialize the direction of the page
@@ -920,52 +935,137 @@ let UI = {
         cl = item;
         clDist = testDist;
       }
     });
     return cl;
   },
 
   // ----------
+  // Function: _setupBrowserKeys
+  // Sets up the allowed browser keys using key elements.
+  _setupBrowserKeys: function UI__setupKeyWhiteList() {
+    let keys = {};
+
+    [
+#ifdef XP_UNIX
+      "quitApplication",
+#endif
+#ifdef XP_MACOSX
+      "preferencesCmdMac", "minimizeWindow",
+#endif
+      "newNavigator", "newNavigatorTab", "find"
+     ].forEach(function(key) {
+      let element = gWindow.document.getElementById("key_" + key);
+      keys[key] = element.getAttribute("key").toLocaleLowerCase().charCodeAt(0);
+    });
+
+    // for key combinations with shift key, the charCode of upper case letters 
+    // are different to the lower case ones so need to handle them differently.
+    ["closeWindow", "tabview", "undoCloseTab", "undoCloseWindow",
+     "privatebrowsing"].forEach(function(key) {
+      let element = gWindow.document.getElementById("key_" + key);
+      keys[key] = element.getAttribute("key").toLocaleUpperCase().charCodeAt(0);
+    });
+
+    delete this._browserKeys;
+    this._browserKeys = keys;
+  },
+
+  // ----------
   // Function: _setTabViewFrameKeyHandlers
   // Sets up the key handlers for navigating between tabs within the TabView UI.
   _setTabViewFrameKeyHandlers: function UI__setTabViewFrameKeyHandlers() {
-    var self = this;
+    let self = this;
+
+    this._setupBrowserKeys();
 
     iQ(window).keyup(function(event) {
-      if (!event.metaKey) 
+      if (!event.metaKey)
         Keys.meta = false;
     });
 
-    iQ(window).keydown(function(event) {
-      if (event.metaKey) 
+    iQ(window).keypress(function(event) {
+      if (event.metaKey)
         Keys.meta = true;
 
-      if ((iQ(":focus").length > 0 && iQ(":focus")[0].nodeName == "INPUT") || 
-          isSearchEnabled())
+      function processBrowserKeys(evt) {
+#ifdef XP_MACOSX
+        if (evt.metaKey) {
+#else
+        if (evt.ctrlKey) {
+#endif
+          let preventDefault = true;
+          if (evt.shiftKey) {
+            switch (evt.charCode) {
+              case self._browserKeys.privatebrowsing:
+              case self._browserKeys.undoCloseTab:
+              case self._browserKeys.undoCloseWindow:
+              case self._browserKeys.closeWindow:
+                preventDefault = false;
+                break;
+              case self._browserKeys.tabview:
+                self.exit();
+                break;
+            }
+          } else {
+            switch (evt.charCode) {
+              case self._browserKeys.find:
+                self.enableSearch();
+                break;
+              case self._browserKeys.newNavigator:
+              case self._browserKeys.newNavigatorTab:
+                preventDefault = false;
+                break;
+#ifdef XP_UNIX
+              case self._browserKeys.quitApplication:
+                preventDefault = false;
+                break;
+#endif
+#ifdef XP_MACOSX
+              case self._browserKeys.preferencesCmdMac:
+              case self._browserKeys.minimizeWindow:
+                preventDefault = false;
+                break;
+#endif
+            }
+          }
+          if (preventDefault) {
+            evt.stopPropagation();
+            evt.preventDefault();
+          }
+        }
+      }
+      if ((iQ(":focus").length > 0 && iQ(":focus")[0].nodeName == "INPUT") ||
+          isSearchEnabled() || self.ignoreKeypressForSearch) {
+        self.ignoreKeypressForSearch = false;
+        processBrowserKeys(event);
         return;
+      }
 
       function getClosestTabBy(norm) {
         if (!self.getActiveTab())
           return null;
-        var centers =
+        let centers =
           [[item.bounds.center(), item]
              for each(item in TabItems.getItems()) if (!item.parent || !item.parent.hidden)];
-        var myCenter = self.getActiveTab().bounds.center();
-        var matches = centers
+        let myCenter = self.getActiveTab().bounds.center();
+        let matches = centers
           .filter(function(item){return norm(item[0], myCenter)})
           .sort(function(a,b){
             return myCenter.distance(a[0]) - myCenter.distance(b[0]);
           });
         if (matches.length > 0)
           return matches[0][1];
         return null;
       }
 
-      var norm = null;
+      let preventDefault = true;
+      let activeTab;
+      let norm = null;
       switch (event.keyCode) {
         case KeyEvent.DOM_VK_RIGHT:
           norm = function(a, me){return a.x > me.x};
           break;
         case KeyEvent.DOM_VK_LEFT:
           norm = function(a, me){return a.x < me.x};
           break;
         case KeyEvent.DOM_VK_DOWN:
@@ -978,87 +1078,75 @@ let UI = {
 
       if (norm != null) {
         var nextTab = getClosestTabBy(norm);
         if (nextTab) {
           if (nextTab.isStacked && !nextTab.parent.expanded)
             nextTab = nextTab.parent.getChild(0);
           self.setActiveTab(nextTab);
         }
-        event.stopPropagation();
-        event.preventDefault();
-      } else if (event.keyCode == KeyEvent.DOM_VK_ESCAPE) {
-        let activeGroupItem = GroupItems.getActiveGroupItem();
-        if (activeGroupItem && activeGroupItem.expanded)
-          activeGroupItem.collapse();
-        else 
-          self.exit();
-
-        event.stopPropagation();
-        event.preventDefault();
-      } else if (event.keyCode == KeyEvent.DOM_VK_RETURN ||
-                 event.keyCode == KeyEvent.DOM_VK_ENTER) {
-        let activeTab = self.getActiveTab();
-        if (activeTab)
-          activeTab.zoomIn();
+      } else {
+        switch(event.keyCode) {
+          case KeyEvent.DOM_VK_ESCAPE:
+            let activeGroupItem = GroupItems.getActiveGroupItem();
+            if (activeGroupItem && activeGroupItem.expanded)
+              activeGroupItem.collapse();
+            else
+              self.exit();
+            break;
+          case KeyEvent.DOM_VK_RETURN:
+          case KeyEvent.DOM_VK_ENTER:
+            activeTab = self.getActiveTab();
+            if (activeTab)
+              activeTab.zoomIn();
+            break;
+          case KeyEvent.DOM_VK_TAB:
+            // tab/shift + tab to go to the next tab.
+            activeTab = self.getActiveTab();
+            if (activeTab) {
+              let tabItems = (activeTab.parent ? activeTab.parent.getChildren() :
+                              [activeTab]);
+              let length = tabItems.length;
+              let currentIndex = tabItems.indexOf(activeTab);
 
-        event.stopPropagation();
-        event.preventDefault();
-      } else if (event.keyCode == KeyEvent.DOM_VK_TAB) {
-        // tab/shift + tab to go to the next tab.
-        var activeTab = self.getActiveTab();
-        if (activeTab) {
-          var tabItems = (activeTab.parent ? activeTab.parent.getChildren() :
-                          [activeTab]);
-          var length = tabItems.length;
-          var currentIndex = tabItems.indexOf(activeTab);
-
-          if (length > 1) {
-            if (event.shiftKey) {
-              if (currentIndex == 0)
-                newIndex = (length - 1);
-              else
-                newIndex = (currentIndex - 1);
-            } else {
-              if (currentIndex == (length - 1))
-                newIndex = 0;
-              else
-                newIndex = (currentIndex + 1);
+              if (length > 1) {
+                if (event.shiftKey) {
+                  if (currentIndex == 0)
+                    newIndex = (length - 1);
+                  else
+                    newIndex = (currentIndex - 1);
+                } else {
+                  if (currentIndex == (length - 1))
+                    newIndex = 0;
+                  else
+                    newIndex = (currentIndex + 1);
+                }
+                self.setActiveTab(tabItems[newIndex]);
+              }
             }
-            self.setActiveTab(tabItems[newIndex]);
-          }
+            break;
+          default:
+            processBrowserKeys(event);
+            preventDefault = false;
         }
-        event.stopPropagation();
-        event.preventDefault();
-      } else if (event.keyCode == KeyEvent.DOM_VK_SLASH) {
-        // the / event handler for find bar is defined in the findbar.xml
-        // binding.  To keep things in its own module, we handle our slash here.
-        self.enableSearch(event);
-      } else if (event.keyCode == KeyEvent.DOM_VK_BACK_SPACE) {
-        // prevent navigating backward in the selected tab's history
-        event.stopPropagation();
-        event.preventDefault();
+        if (preventDefault) {
+          event.stopPropagation();
+          event.preventDefault();
+        }
       }
     });
   },
 
   // ----------
   // Function: enableSearch
   // Enables the search feature.
-  // Parameters:
-  //   event - the event triggers this action.
-  enableSearch: function UI_enableSearch(event) {
+  enableSearch: function UI_enableSearch() {
     if (!isSearchEnabled()) {
       ensureSearchShown();
       SearchEventHandler.switchToInMode();
-      
-      if (event) {
-        event.stopPropagation();
-        event.preventDefault();
-      }
     }
   },
 
   // ----------
   // Function: _createGroupItemOnDrag
   // Called in response to a mousedown in empty space in the TabView UI;
   // creates a new groupItem based on the user's drag.
   _createGroupItemOnDrag: function UI__createGroupItemOnDrag(e) {
--- a/browser/base/content/test/Makefile.in
+++ b/browser/base/content/test/Makefile.in
@@ -200,16 +200,17 @@ endif
                  browser_pluginnotification.js \
                  browser_relatedTabs.js \
                  browser_sanitize-passwordDisabledHosts.js \
                  browser_sanitize-sitepermissions.js \
                  browser_sanitize-timespans.js \
                  browser_clearplugindata.js \
                  browser_clearplugindata.html \
                  browser_clearplugindata_noage.html \
+                 browser_popupUI.js \
                  browser_sanitizeDialog.js \
                  browser_scope.js \
                  browser_selectTabAtIndex.js \
                  browser_tab_dragdrop.js \
                  browser_tab_dragdrop2.js \
                  browser_tab_dragdrop2_frame1.xul \
                  browser_tabfocus.js \
                  browser_tabs_isActive.js \
@@ -244,19 +245,16 @@ endif
                  app_subframe_bug575561.html \
                  browser_contentAreaClick.js \
                  browser_addon_bar_close_button.js \
                  browser_addon_bar_shortcut.js \
                  browser_addon_bar_aomlistener.js \
                  test_bug628179.html \
                  $(NULL)
 
-# compartment-disabled
-#                 browser_popupUI.js \
-
 ifneq (cocoa,$(MOZ_WIDGET_TOOLKIT))
 _BROWSER_FILES += \
 		browser_bug462289.js \
 		$(NULL)
 else
 _BROWSER_FILES += \
 		browser_bug565667.js \
 		browser_customize.js \
--- a/browser/base/content/test/browser_popupUI.js
+++ b/browser/base/content/test/browser_popupUI.js
@@ -16,17 +16,17 @@ function test() {
     "data:text/html,<html><script>popup=open('about:blank','','width=300,height=200')</script>";
 }
 
 function findPopup() {
   var enumerator = Services.wm.getEnumerator("navigator:browser");
 
   while (enumerator.hasMoreElements()) {
     let win = enumerator.getNext();
-    if (win.content == content.wrappedJSObject.popup) {
+    if (win.content.wrappedJSObject == content.wrappedJSObject.popup) {
       testPopupUI(win);
       return;
     }
   }
 
   throw "couldn't find the popup";
 }
 
--- a/browser/base/content/test/browser_utilityOverlay.js
+++ b/browser/base/content/test/browser_utilityOverlay.js
@@ -1,15 +1,15 @@
 var gTestTab;
 
 function test() {
   waitForExplicitFinish();
 
   is(getTopWin(), window, "got top window");
-  is(getBoolPref("general.startup.browser", false), true, "getBoolPref");
+  is(getBoolPref("browser.search.openintab", false), false, "getBoolPref");
   is(getBoolPref("this.pref.doesnt.exist", true), true, "getBoolPref fallback");
   is(getBoolPref("this.pref.doesnt.exist", false), false, "getBoolPref fallback #2");
 
 
   gTestTab = openNewTabWith("http://example.com");
   gBrowser.selectedTab = gTestTab;
   gTestTab.linkedBrowser.addEventListener("load", function () {
     gTestTab.linkedBrowser.removeEventListener("load", arguments.callee, true);
--- a/browser/base/content/test/tabview/Makefile.in
+++ b/browser/base/content/test/tabview/Makefile.in
@@ -45,16 +45,17 @@ include $(topsrcdir)/config/rules.mk
 
 _BROWSER_FILES = \
                  browser_tabview_alltabs.js \
                  browser_tabview_apptabs.js \
                  browser_tabview_bug580412.js \
                  browser_tabview_bug586553.js \
                  browser_tabview_bug587043.js \
                  browser_tabview_bug587231.js \
+                 browser_tabview_bug587276.js \
                  browser_tabview_bug587351.js \
                  browser_tabview_bug587503.js \
                  browser_tabview_bug587990.js \
                  browser_tabview_bug588265.js \
                  browser_tabview_bug589324.js \
                  browser_tabview_bug590606.js \
                  browser_tabview_bug591706.js \
                  browser_tabview_bug594958.js \
@@ -80,16 +81,17 @@ include $(topsrcdir)/config/rules.mk
                  browser_tabview_bug604098.js \
                  browser_tabview_bug604699.js \
                  browser_tabview_bug606657.js \
                  browser_tabview_bug606905.js \
                  browser_tabview_bug608037.js \
                  browser_tabview_bug608184.js \
                  browser_tabview_bug608158.js \
                  browser_tabview_bug608405.js \
+                 browser_tabview_bug610208.js \
                  browser_tabview_bug610242.js \
                  browser_tabview_bug612470.js \
                  browser_tabview_bug613541.js \
                  browser_tabview_bug616729.js \
                  browser_tabview_bug616967.js \
                  browser_tabview_bug618816.js \
                  browser_tabview_bug618828.js \
                  browser_tabview_bug619937.js \
@@ -110,24 +112,26 @@ include $(topsrcdir)/config/rules.mk
                  browser_tabview_bug627736.js \
                  browser_tabview_bug628165.js \
                  browser_tabview_bug628270.js \
                  browser_tabview_bug629189.js \
                  browser_tabview_bug629195.js \
                  browser_tabview_bug630102.js \
                  browser_tabview_bug630157.js \
                  browser_tabview_bug631662.js \
+                 browser_tabview_bug631752.js \
                  browser_tabview_bug633788.js \
                  browser_tabview_bug634077.js \
                  browser_tabview_bug634085.js \
                  browser_tabview_bug634158.js \
                  browser_tabview_bug635696.js \
                  browser_tabview_dragdrop.js \
                  browser_tabview_exit_button.js \
                  browser_tabview_expander.js \
+                 browser_tabview_firstrun_pref.js \
                  browser_tabview_group.js \
                  browser_tabview_launch.js \
                  browser_tabview_multiwindow_search.js \
                  browser_tabview_orphaned_tabs.js \
                  browser_tabview_privatebrowsing.js \
                  browser_tabview_rtl.js \
                  browser_tabview_search.js \
                  browser_tabview_snapping.js \
new file mode 100644
--- /dev/null
+++ b/browser/base/content/test/tabview/browser_tabview_bug587276.js
@@ -0,0 +1,102 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+let contentWindow;
+
+function test() {
+  waitForExplicitFinish();
+
+  showTabView(test1);
+}
+
+function test1() {
+  ok(TabView.isVisible(), "Tab View is visible");
+
+  contentWindow = document.getElementById("tab-view").contentWindow;
+  whenTabViewIsHidden(function() {
+    ok(!TabView.isVisible(), "Tab View is not visible");
+    showTabView(test2);
+  });
+  EventUtils.synthesizeKey("E", { accelKey: true, shiftKey: true }, contentWindow);
+}
+
+function test2() {
+  ok(TabView.isVisible(), "Tab View is visible");
+
+  whenSearchIsEnabled(function() {
+    ok(contentWindow.isSearchEnabled(), "The search is enabled")
+
+    whenSearchIsDisabled(test3);
+    hideSearch();
+  });
+  EventUtils.synthesizeKey("f", { accelKey: true }, contentWindow);
+}
+
+function test3() {
+  ok(!contentWindow.isSearchEnabled(), "The search is disabled")
+
+  is(gBrowser.tabs.length, 1, "There is one tab before cmd/ctrl + t is pressed");
+  EventUtils.synthesizeKey("t", { accelKey: true }, contentWindow);
+  is(gBrowser.tabs.length, 2, "There are two tabs after cmd/ctrl + t is pressed");
+
+  gBrowser.tabs[0].linkedBrowser.loadURI("about:robots");
+  gBrowser.tabs[1].linkedBrowser.loadURI("http://example.com/");
+
+  afterAllTabsLoaded(function () {
+    showTabView(test4);
+  });
+}
+
+function test4() {
+  is(gBrowser.tabs.length, 2, "There are two tabs");
+  
+  let onTabClose = function() {
+    gBrowser.tabContainer.removeEventListener("TabClose", onTabClose, true);
+    executeSoon(function() {
+      is(gBrowser.tabs.length, 1, "There is one tab after removing one");
+
+      EventUtils.synthesizeKey("T", { accelKey: true, shiftKey: true }, contentWindow);
+      is(gBrowser.tabs.length, 2, "There are two tabs after restoring one");
+
+      gBrowser.tabs[0].linkedBrowser.loadURI("about:blank");
+      gBrowser.removeTab(gBrowser.tabs[1]);
+      test8();
+    });
+  };
+  gBrowser.tabContainer.addEventListener("TabClose", onTabClose, true);
+  gBrowser.removeTab(gBrowser.tabs[1]);
+}
+
+// below key combination shouldn't trigger actions in tabview UI
+function test8() {
+  let newTab = gBrowser.loadOneTab("about:blank", { inBackground: true });
+
+  is(gBrowser.tabs.length, 2, "There are two tabs before cmd/ctrl + w is pressed");
+  EventUtils.synthesizeKey("w", { accelKey: true }, contentWindow);
+  is(gBrowser.tabs.length, 2, "There are two tabs after cmd/ctrl + w is pressed");
+
+  gBrowser.removeTab(newTab);
+  test9();
+}
+
+function test9() {
+  let zoomLevel = ZoomManager.zoom;
+  EventUtils.synthesizeKey("+", { accelKey: true }, contentWindow);
+  is(ZoomManager.zoom, zoomLevel, "The zoom level remains unchanged after cmd/ctrl + + is pressed");
+
+  EventUtils.synthesizeKey("-", { accelKey: true }, contentWindow);
+  is(ZoomManager.zoom, zoomLevel, "The zoom level remains unchanged after cmd/ctrl + - is pressed");
+
+  test10();
+}
+
+function test10() {
+  is(gBrowser.tabs.length, 1, "There is one tab before cmd/ctrl + shift + a is pressed");
+  // it would open about:addons on a new tab if it passes through the white list.
+  EventUtils.synthesizeKey("A", { accelKey: true, shiftKey: true }, contentWindow);
+
+  executeSoon(function() {
+    is(gBrowser.tabs.length, 1, "There is still one tab after cmd/ctrl + shift + a is pressed");
+    hideTabView(finish);
+  })
+}
--- a/browser/base/content/test/tabview/browser_tabview_bug594958.js
+++ b/browser/base/content/test/tabview/browser_tabview_bug594958.js
@@ -4,30 +4,16 @@
 function test() {
   let win;
   let cw;
 
   let getGroupItem = function (index) {
     return cw.GroupItems.groupItems[index];
   }
 
-  let newWindow = function (callback) {
-    newWindowWithTabView(function (tvwin) {
-      registerCleanupFunction(function () {
-        if (!tvwin.closed)
-          tvwin.close();
-      });
-
-      win = tvwin;
-      cw = win.TabView.getContentWindow();
-
-      callback();
-    });
-  }
-
   let finishTest = function () {
     win.close();
     finish();
   }
 
   // very long page that produces black bars at the right
   let html1 = '<html><body style="background-color: #00f;">' +
               '<div style="background: #fff; width: 95%; height: 10000px; ' +
@@ -133,20 +119,21 @@ function test() {
 
   let checkPixelColor = function (ctx, url, color, x, y, edge) {
     let data = ctx.getImageData(x, y, 1, 1).data;
     let check = (data[0] == color[0] && data[1] == color[1] && data[2] == color[2]);
     ok(check, url + ': ' + edge + ' edge color matches pixel value');
   }
 
   waitForExplicitFinish();
-  newWindow(next);
+  newWindowWithTabView(function(newWin) {
+    win = newWin;
+
+    registerCleanupFunction(function () {
+      if (!win.closed)
+        win.close();
+    });
+
+    cw = win.TabView.getContentWindow();
+    next();
+  }, null, 800, 600);
 }
 
-// ---------
-function newWindowWithTabView(callback) {
-  let win = window.openDialog(getBrowserURL(), "_blank", 
-                              "chrome,all,dialog=no,height=600,width=800");
-  win.addEventListener("load", function onLoad() {
-    win.removeEventListener("load", onLoad, false);
-    showTabView(function () callback(win), win);
-  }, false);
-}
--- a/browser/base/content/test/tabview/browser_tabview_bug595191.js
+++ b/browser/base/content/test/tabview/browser_tabview_bug595191.js
@@ -52,10 +52,10 @@ function toggleTabViewTest(contentWindow
   let onTabViewHidden = function() {
     contentWindow.removeEventListener("tabviewhidden", onTabViewHidden, false);
 
     ok(!TabView.isVisible(), "Tab View is hidden");
     finish();
   }
   contentWindow.addEventListener("tabviewhidden", onTabViewHidden, false);
   // Use keyboard shortcut to toggle back to browser view
-  EventUtils.synthesizeKey("e", { accelKey: true, shiftKey: true });
+  EventUtils.synthesizeKey("E", { accelKey: true, shiftKey: true });
 }
--- a/browser/base/content/test/tabview/browser_tabview_bug595518.js
+++ b/browser/base/content/test/tabview/browser_tabview_bug595518.js
@@ -23,17 +23,17 @@ function onTabViewWindowLoaded() {
     
     // verify that the exit button no longer has focus
     is(contentWindow.iQ("#exit-button:focus").length, 0, 
        "The exit button doesn't have the focus");
 
     // verify that the keyboard combo works (this is the crux of bug 595518)
     // Prepare the key combo
     window.addEventListener("tabviewshown", onTabViewShown, false);
-    EventUtils.synthesizeKey("e", { accelKey: true, shiftKey: true }, contentWindow);
+    EventUtils.synthesizeKey("E", { accelKey: true, shiftKey: true }, contentWindow);
   }
   
   let onTabViewShown = function() {
     window.removeEventListener("tabviewshown", onTabViewShown, false);
     
     // test if the key combo worked
     ok(TabView.isVisible(), "Tab View is visible");
 
--- a/browser/base/content/test/tabview/browser_tabview_bug595560.js
+++ b/browser/base/content/test/tabview/browser_tabview_bug595560.js
@@ -28,18 +28,18 @@ function onTabViewWindowLoaded() {
   let contentWindow = document.getElementById("tab-view").contentWindow;
   testOne(contentWindow);
 }
 
 function testOne(contentWindow) {
   onSearchEnabledAndDisabled(contentWindow, function() {
     testTwo(contentWindow); 
   });
-  // execute a find command (i.e. press cmd/ctrl F)
-  document.getElementById("cmd_find").doCommand();
+  // press cmd/ctrl F
+  EventUtils.synthesizeKey("f", { accelKey: true });
 }
 
 function testTwo(contentWindow) {
   onSearchEnabledAndDisabled(contentWindow, function() { 
     testThree(contentWindow);
   });
   // press /
   EventUtils.synthesizeKey("VK_SLASH", { type: "keydown" }, contentWindow);
--- a/browser/base/content/test/tabview/browser_tabview_bug595930.js
+++ b/browser/base/content/test/tabview/browser_tabview_bug595930.js
@@ -36,17 +36,17 @@ function onTabViewWindowLoaded() {
       finish();
     };
     window.addEventListener("tabviewhidden", onTabViewHidden, false);
 
     // delay to give time for hidden group DOM element to be removed so
     // the appropriate group would get selected when the key
     // combination is pressed
     executeSoon(function() { 
-      EventUtils.synthesizeKey("e", {accelKey : true, shiftKey: true}, contentWindow);
+      EventUtils.synthesizeKey("E", {accelKey : true, shiftKey: true}, contentWindow);
     });
   });
 
   group1.addSubscriber(group1, "groupHidden", function() {
     group1.removeSubscriber(group1, "groupHidden");
 
     // close undo group
     let closeButton = group1.$undoContainer.find(".close");
--- a/browser/base/content/test/tabview/browser_tabview_bug597248.js
+++ b/browser/base/content/test/tabview/browser_tabview_bug597248.js
@@ -1,31 +1,34 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 let newTabOne;
 let newTabTwo;
-let restoredNewTabOneLoaded = false;
+let newTabThree;
 let restoredNewTabTwoLoaded = false;
+let restoredNewTabThreeLoaded = false;
 let frameInitialized = false;
 
 function test() {
   waitForExplicitFinish();
   newWindowWithTabView(setupOne);
 }
 
 function setupOne(win) {
   win.TabView.firstUseExperienced = true;
 
   win.gBrowser.addTab("http://mochi.test:8888/browser/browser/base/content/test/tabview/search1.html");
   win.gBrowser.addTab("http://mochi.test:8888/browser/browser/base/content/test/tabview/dummy_page.html");
 
   afterAllTabsLoaded(function () setupTwo(win), win);
 }
 
+let restoreWin;
+
 function setupTwo(win) {
   let contentWindow = win.TabView.getContentWindow();
 
   let tabItems = contentWindow.TabItems.getItems();
   is(tabItems.length, 3, "There should be 3 tab items before closing");
 
   let numTabsToSave = tabItems.length;
 
@@ -41,143 +44,110 @@ function setupTwo(win) {
   // after the window is closed, restore it.
   let xulWindowDestory = function() {
     Services.obs.removeObserver(
        xulWindowDestory, "xul-window-destroyed", false);
 
     // "xul-window-destroyed" is just fired just before a XUL window is
     // destroyed so restore window and test it after a delay
     executeSoon(function() {
-      let restoredWin = undoCloseWindow();
+      restoredWin = undoCloseWindow();
       restoredWin.addEventListener("load", function onLoad(event) {
         restoredWin.removeEventListener("load", onLoad, false);
 
+        registerCleanupFunction(function() restoredWin.close());
+
         // ensure that closed tabs have been saved
         is(numTabsToSave, 0, "All tabs were saved when window was closed.");
+        is(restoredWin.gBrowser.tabs.length, 3, "The total number of tabs is 3");
 
-        // execute code when the frame is initialized.
+        // setup tab variables and listen to the tabs load progress
+        newTabOne = restoredWin.gBrowser.tabs[0];
+        newTabTwo = restoredWin.gBrowser.tabs[1];
+        newTabThree = restoredWin.gBrowser.tabs[2];
+        restoredWin.gBrowser.addTabsProgressListener(gTabsProgressListener);
+
+        // execute code when the frame is initialized
         let onTabViewFrameInitialized = function() {
           restoredWin.removeEventListener(
             "tabviewframeinitialized", onTabViewFrameInitialized, false);
 
-          /*
-          // bug 615954 happens too often so we disable this until we have a fix
-          let restoredContentWindow = 
+          let restoredContentWindow =
             restoredWin.document.getElementById("tab-view").contentWindow;
           // prevent TabItems._update being called before checking cached images
           restoredContentWindow.TabItems._pauseUpdateForTest = true;
-          */
-          restoredWin.close();
-          finish();
+
+          let nextStep = function() {
+            // since we are not sure whether the frame is initialized first or two tabs
+            // compete loading first so we need this.
+            if (restoredNewTabTwoLoaded && restoredNewTabThreeLoaded)
+              updateAndCheck();
+            else
+              frameInitialized = true;
+          }
+
+          let tabItems = restoredContentWindow.TabItems.getItems();
+          let count = tabItems.length;
+
+          tabItems.forEach(function(tabItem) {
+            tabItem.addSubscriber(tabItem, "loadedCachedImageData", function() {
+              tabItem.removeSubscriber(tabItem, "loadedCachedImageData");
+              ok(tabItem.isShowingCachedData(),
+                "Tab item is showing cached data and is just connected. " +
+                tabItem.tab.linkedBrowser.currentURI.spec);
+              if (--count == 0)
+                nextStep();
+            });
+          });
         }
+
         restoredWin.addEventListener(
           "tabviewframeinitialized", onTabViewFrameInitialized, false);
-
-        is(restoredWin.gBrowser.tabs.length, 3, "The total number of tabs is 3");
-
-        /*
-        // bug 615954 happens too often so we disable this until we have a fix
-        restoredWin.addEventListener("tabviewshown", onTabViewShown, false);
-
-        // setup tab variables and listen to the load progress.
-        newTabOne = restoredWin.gBrowser.tabs[0];
-        newTabTwo = restoredWin.gBrowser.tabs[1];
-        restoredWin.gBrowser.addTabsProgressListener(gTabsProgressListener);
-        */
       }, false);
     });
   };
-
-  Services.obs.addObserver(
-    xulWindowDestory, "xul-window-destroyed", false);
+  Services.obs.addObserver(xulWindowDestory, "xul-window-destroyed", false);
 
   win.close();
 }
 
-/*let gTabsProgressListener = {
+let gTabsProgressListener = {
   onStateChange: function(browser, webProgress, request, stateFlags, status) {
     // ensure about:blank doesn't trigger the code
     if ((stateFlags & Ci.nsIWebProgressListener.STATE_STOP) &&
         (stateFlags & Ci.nsIWebProgressListener.STATE_IS_WINDOW) &&
          browser.currentURI.spec != "about:blank") {
-      if (newTabOne.linkedBrowser == browser)
-        restoredNewTabOneLoaded = true;
-      else if (newTabTwo.linkedBrowser == browser)
+      if (newTabTwo.linkedBrowser == browser)
         restoredNewTabTwoLoaded = true;
+      else if (newTabThree.linkedBrowser == browser)
+        restoredNewTabThreeLoaded = true;
 
       // since we are not sure whether the frame is initialized first or two tabs
       // compete loading first so we need this.
-      if (restoredNewTabOneLoaded && restoredNewTabTwoLoaded) {
+      if (restoredNewTabTwoLoaded && restoredNewTabThreeLoaded) {
         restoredWin.gBrowser.removeTabsProgressListener(gTabsProgressListener);
 
-        if (frameInitialized) {
-          // since a tabs progress listener is used in the code to set 
-          // tabItem.shouldHideCachedData, executeSoon is used to avoid a racing
-          // condition.
-          executeSoon(updateAndCheck); 
-        }
+        if (frameInitialized)
+          updateAndCheck();
       }
     }
   }
 };
 
-function onTabViewShown() {
-  restoredWin.removeEventListener("tabviewshown", onTabViewShown, false);
-
-  let contentWindow = 
-    restoredWin.document.getElementById("tab-view").contentWindow;
-
-  let nextStep = function() {
-    // since we are not sure whether the frame is initialized first or two tabs
-    // compete loading first so we need this.
-    if (restoredNewTabOneLoaded && restoredNewTabTwoLoaded) {
-      // executeSoon is used to ensure tabItem.shouldHideCachedData is set
-      // because tabs progress listener might run at the same time as this test 
-      // code.
-      executeSoon(updateAndCheck);
-    } else {
-      frameInitialized = true;
-    }
-  }
-
-  let tabItems = contentWindow.TabItems.getItems();
-  let count = tabItems.length;
-  tabItems.forEach(function(tabItem) {
-    // tabitem might not be connected so use subscriber for those which are not
-    // connected.
-    if (tabItem._reconnected) {
-      ok(tabItem.isShowingCachedData(), 
-         "Tab item is showing cached data and is already connected. " +
-         tabItem.tab.linkedBrowser.currentURI.spec);
-      if (--count == 0)
-        nextStep();
-    } else {
-      tabItem.addSubscriber(tabItem, "reconnected", function() {
-        tabItem.removeSubscriber(tabItem, "reconnected");
-        ok(tabItem.isShowingCachedData(), 
-           "Tab item is showing cached data and is just connected. "  +
-           tabItem.tab.linkedBrowser.currentURI.spec);
-        if (--count == 0)
-          nextStep();
-      });
-    }
-  });
-}
-
 function updateAndCheck() {
   // force all canvas to update
   let contentWindow = 
     restoredWin.document.getElementById("tab-view").contentWindow;
 
   contentWindow.TabItems._pauseUpdateForTest = false;
 
   let tabItems = contentWindow.TabItems.getItems();
   tabItems.forEach(function(tabItem) {
     contentWindow.TabItems._update(tabItem.tab);
-    ok(!tabItem.isShowingCachedData(), 
+    ok(!tabItem.isShowingCachedData(),
       "Tab item is not showing cached data anymore. " +
       tabItem.tab.linkedBrowser.currentURI.spec);
   });
 
   // clean up and finish
   restoredWin.close();
   finish();
-}*/
+}
--- a/browser/base/content/test/tabview/browser_tabview_bug597980.js
+++ b/browser/base/content/test/tabview/browser_tabview_bug597980.js
@@ -1,18 +1,20 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 function test() {
   waitForExplicitFinish();
 
-  newWindowWithTabView(onTabViewShown);
+  newWindowWithTabView(part1);
 }
 
-function onTabViewShown(win) {
+function part1(win) {
+  registerCleanupFunction(function() win.close());
+
   let contentWindow = win.document.getElementById("tab-view").contentWindow;
   is(contentWindow.GroupItems.groupItems.length, 1, "Has only one group");
 
   let originalTab = win.gBrowser.selectedTab;
   let originalGroup = contentWindow.GroupItems.groupItems[0];
   let newTab = win.gBrowser.loadOneTab("about:blank", {inBackground: true});
   
   is(originalGroup.getChildren().length, 2, "The original group now has two tabs");
@@ -47,13 +49,37 @@ function onTabViewShown(win) {
   EventUtils.sendMouseEvent({ type: "mousedown" },
                             newTab._tabViewTabItem.container, contentWindow);
   EventUtils.sendMouseEvent({ type: "mouseup" },
                             newTab._tabViewTabItem.container, contentWindow);
   setTimeout(function() {
     checkActive(function() {
       checkActive(function() {
         win.close();
-        finish();
+        newWindowWithTabView(part2);
       });
     }, 490);
   }, 10)
 }
+
+function part2(win) {
+  registerCleanupFunction(function() win.close());
+
+  let newTab = win.gBrowser.loadOneTab("about:blank", {inBackground: true});
+  hideTabView(function() {
+    let selectedTab = win.gBrowser.selectedTab;
+    isnot(selectedTab, newTab, "They are different tabs");
+
+    // switch the selected tab to new tab
+    win.gBrowser.selectedTab = newTab;
+
+    win.addEventListener("tabviewhidden", function () {
+      win.removeEventListener("tabviewhidden", arguments.callee, false);
+      is(win.gBrowser.selectedTab, newTab, "The seleted tab should be the same as before (new tab)");
+       win.close();
+       finish();
+    }, false);
+    // show tabview
+    EventUtils.synthesizeKey("E", { accelKey: true, shiftKey: true }, win);
+    // hide tabview
+    EventUtils.synthesizeKey("E", { accelKey: true, shiftKey: true }, win);
+  })
+}
--- a/browser/base/content/test/tabview/browser_tabview_bug599626.js
+++ b/browser/base/content/test/tabview/browser_tabview_bug599626.js
@@ -1,12 +1,13 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 let handleDialog;
+let timer; // keep in outer scope so it's not GC'd before firing
 
 function test() {
   waitForExplicitFinish();
 
   window.addEventListener("tabviewshown", onTabViewWindowLoaded, false);
   TabView.toggle();
 }
 
@@ -119,17 +120,17 @@ let observer = {
   }
 };
 
 function startCallbackTimer() {
    // Delay before the callback twiddles the prompt.
    const dialogDelay = 10;
 
    // Use a timer to invoke a callback to twiddle the authentication dialog
-   let timer = Cc["@mozilla.org/timer;1"].createInstance(Ci.nsITimer);
+   timer = Cc["@mozilla.org/timer;1"].createInstance(Ci.nsITimer);
    timer.init(observer, dialogDelay, Ci.nsITimer.TYPE_ONE_SHOT);
 }
 
 function getDialogDoc() {
   // Find the <browser> which contains notifyWindow, by looking
   // through all the open windows and all the <browsers> in each.
   let wm = Cc["@mozilla.org/appshell/window-mediator;1"].
             getService(Ci.nsIWindowMediator);
--- a/browser/base/content/test/tabview/browser_tabview_bug600812.js
+++ b/browser/base/content/test/tabview/browser_tabview_bug600812.js
@@ -10,18 +10,18 @@ function test() {
 
     cw.GroupItems.setActiveGroupItem(groupItem);
     gBrowser.loadOneTab('about:blank', {inBackground: true});
 
     return groupItem;
   }
 
   let testVeryQuickDragAndDrop = function () {
-    let sourceGroup = cw.GroupItems.groupItems[0];
-    let targetGroup = createGroupItem();
+    let sourceGroup = createGroupItem();
+    let targetGroup = cw.GroupItems.groupItems[0];
 
     sourceGroup.pushAway(true);
     targetGroup.pushAway(true);
 
     let sourceTab = sourceGroup.getChild(0).container;
     EventUtils.synthesizeMouseAtCenter(sourceTab, {type: 'mousedown'}, cw);
 
     let targetTab = targetGroup.getChild(0).container;
new file mode 100644
--- /dev/null
+++ b/browser/base/content/test/tabview/browser_tabview_bug610208.js
@@ -0,0 +1,231 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+function test() {
+  let cw;
+  let win;
+  let groupItem;
+
+  let next = function () {
+    let test = tests.shift();
+
+    if (test) {
+      test();
+      return;
+    }
+
+    win.close();
+    finish();
+  }
+
+  let prepareTest = function (testName) {
+    let originalBounds = groupItem.getChild(0).getBounds();
+
+    let tabItem = groupItem.getChild(1);
+    let bounds = tabItem.getBounds();
+    tabItem.close();
+
+    ok(originalBounds.equals(groupItem.getChild(0).getBounds()), testName + ': tabs did not change their size');
+    ok(bounds.equals(groupItem.getChild(1).getBounds()), testName + ': third tab is now on second tab\'s previous position');
+    
+    return originalBounds;
+  }
+
+  let cleanUpTest = function (testName, originalBounds, callback) {
+    // Use setTimeout here because the groupItem.arrange() call uses
+    // animation to re-arrange the tabItems.
+    win.setTimeout(function () {
+      ok(!originalBounds.equals(groupItem.getChild(0).getBounds()), testName + ': tabs changed their size');
+
+      // cleanup
+      cw.GroupItems.setActiveGroupItem(groupItem);
+      win.gBrowser.loadOneTab('about:blank', {inBackground: true});
+      afterAllTabsLoaded(callback, win);
+    }, 500);
+  }
+
+  let tests = [];
+
+  // focus group title's input field to cause item arrange
+  let testFocusTitle = function () {
+    let originalBounds = prepareTest('testFocusTitle');
+
+    let target = groupItem.$titleShield[0];
+    EventUtils.synthesizeMouseAtCenter(target, {}, cw);
+
+    cleanUpTest('testFocusTitle', originalBounds, next);
+  }
+
+  // hide tabview to cause item arrange
+  let testHideTabView = function () {
+    let originalBounds = prepareTest('testHideTabView');
+
+    hideTabView(function () {
+      cleanUpTest('testHideTabView', originalBounds, function () {
+        showTabView(next, win);
+      });
+    }, win);
+  }
+
+  // (undo) close a group to cause item arrange
+  let testCloseGroupUndo = function () {
+    let originalBounds = prepareTest('testCloseGroupUndo');
+
+    hideGroupItem(groupItem, function () {
+      unhideGroupItem(groupItem, function () {
+        cleanUpTest('testCloseGroupUndo', originalBounds, next);
+      });
+    });
+  }
+
+  // leave the group's container with the mouse to cause item arrange
+  let testMouseOut = function () {
+    let originalBounds = prepareTest('testMouseOut');
+    let doc = cw.document.documentElement;
+    let bounds = groupItem.getBounds();
+
+    EventUtils.synthesizeMouse(doc, bounds.right - 5, bounds.bottom - 5, {type: 'mousemove'}, cw);
+    ok(originalBounds.equals(groupItem.getChild(0).getBounds()), 'testMouseOut: tabs did not change their size');
+
+    EventUtils.synthesizeMouse(doc, bounds.right + 1, bounds.bottom + 1, {type: 'mousemove'}, cw);
+    cleanUpTest('testMouseOut', originalBounds, next);
+  }
+
+  // sort item (drag it around) in its group to cause item arrange
+  let testSortInGroup = function () {
+    let originalBounds = prepareTest('testSortInGroup');
+    let target = groupItem.getChild(0).container;
+
+    // simulate drag/drop sorting
+    EventUtils.synthesizeMouse(target, 20, 20, {type: 'mousedown'}, cw);
+    EventUtils.synthesizeMouse(target, 40, 20, {type: 'mousemove'}, cw);
+    EventUtils.synthesizeMouse(target, 20, 20, {type: 'mouseup'}, cw);
+
+    cleanUpTest('testSortInGroup', originalBounds, next);
+  }
+
+  // arrange items when the containing group is resized
+  let testResizeGroup = function () {
+    let originalBounds = prepareTest('testResizeGroup');
+    let oldBounds = groupItem.getBounds();
+    let resizer = groupItem.$resizer[0];
+
+    // simulate drag/drop resizing
+    EventUtils.synthesizeMouse(resizer, 5, 5, {type: 'mousedown'}, cw);
+    EventUtils.synthesizeMouse(resizer, 40, 20, {type: 'mousemove'}, cw);
+    EventUtils.synthesizeMouse(resizer, 20, 20, {type: 'mouseup'}, cw);
+
+    // reset group size
+    groupItem.setBounds(oldBounds);
+    groupItem.setUserSize();
+
+    cleanUpTest('testResizeGroup', originalBounds, next);
+  }
+
+  // make sure we don't freeze item size when removing an item from a stack
+  let testRemoveWhileStacked = function () {
+    let oldBounds = groupItem.getBounds();
+    groupItem.setSize(150, 200, true);
+    groupItem.setUserSize();
+
+    let originalBounds = groupItem.getChild(0).getBounds();
+    ok(!groupItem._isStacked, 'testRemoveWhileStacked: group is not stacked');
+
+    // add a new tab to let the group stack
+    win.gBrowser.loadOneTab('about:blank', {inBackground: true});
+    ok(groupItem._isStacked, 'testRemoveWhileStacked: group is now stacked');
+
+    afterAllTabsLoaded(function () {
+      groupItem.getChild(0).close();
+      let bounds = groupItem.getChild(0).getBounds();
+      ok(originalBounds.equals(bounds), 'testRemoveWhileStacked: tabs did not change their size');
+
+      // reset group size
+      groupItem.setBounds(oldBounds);
+      groupItem.setUserSize();
+
+      next();
+    }, win);
+  }
+
+  // 1) make sure item size is frozen when removing an item in expanded mode
+  // 2) make sure item size stays frozen while moving the mouse in the expanded
+  // layer
+  let testExpandedMode = function () {
+    let oldBounds = groupItem.getBounds();
+    groupItem.setSize(100, 100, true);
+    groupItem.setUserSize();
+
+    ok(groupItem._isStacked, 'testExpandedMode: group is stacked');
+
+    groupItem.addSubscriber(groupItem, 'expanded', function () {
+      groupItem.removeSubscriber(groupItem, 'expanded');
+      onExpanded();
+    });
+
+    groupItem.addSubscriber(groupItem, 'collapsed', function () {
+      groupItem.removeSubscriber(groupItem, 'collapsed');
+      onCollapsed();
+    });
+
+    let onExpanded = function () {
+      let originalBounds = groupItem.getChild(0).getBounds();
+      let tabItem = groupItem.getChild(1);
+      let bounds = tabItem.getBounds();
+
+      for (let i=0; i<3; i++)
+        groupItem.getChild(1).close();
+
+      ok(originalBounds.equals(groupItem.getChild(0).getBounds()), 'testExpandedMode: tabs did not change their size');
+
+      // move the mouse over the expanded layer
+      let trayBounds = groupItem.expanded.bounds;
+      let target = groupItem.expanded.$tray[0];
+      EventUtils.synthesizeMouse(target, trayBounds.right - 5, trayBounds.bottom -5, {type: 'mousemove'}, cw);
+
+      ok(originalBounds.equals(groupItem.getChild(0).getBounds()), 'testExpandedMode: tabs did not change their size');
+      groupItem.collapse();
+    }
+
+    let onCollapsed = function () {
+      // reset group size
+      groupItem.setBounds(oldBounds);
+      groupItem.setUserSize();
+
+      next();
+    }
+
+    groupItem.expand();
+  }
+
+  tests.push(testFocusTitle);
+  tests.push(testHideTabView);
+  tests.push(testCloseGroupUndo);
+  tests.push(testMouseOut);
+  tests.push(testSortInGroup);
+  tests.push(testResizeGroup);
+  tests.push(testRemoveWhileStacked);
+  tests.push(testExpandedMode);
+
+  waitForExplicitFinish();
+
+  newWindowWithTabView(function (tvwin) {
+    win = tvwin;
+
+    registerCleanupFunction(function () {
+      if (!win.closed)
+        win.close();
+    });
+
+    cw = win.TabView.getContentWindow();
+
+    groupItem = cw.GroupItems.groupItems[0];
+    groupItem.setSize(400, 200, true);
+    groupItem.setUserSize();
+
+    for (let i=0; i<3; i++)
+      win.gBrowser.loadOneTab('about:blank', {inBackground: true});
+
+    afterAllTabsLoaded(next, win);
+  });
+}
--- a/browser/base/content/test/tabview/browser_tabview_bug618828.js
+++ b/browser/base/content/test/tabview/browser_tabview_bug618828.js
@@ -71,24 +71,8 @@ function onTabViewWindowLoaded(win, tab)
   }
 
   enableSearch();
   assertSearchIsEnabled();
 
   testClickOnSearchBox();
   testClickOnOtherSearchResult();
 }
-
-// ---------
-function newWindowWithTabView(callback) {
-  let win = window.openDialog(getBrowserURL(), "_blank", 
-                              "chrome,all,dialog=no,height=800,width=800");
-  let onLoad = function() {
-    win.removeEventListener("load", onLoad, false);
-    let onShown = function() {
-      win.removeEventListener("tabviewshown", onShown, false);
-      callback(win);
-    };
-    win.addEventListener("tabviewshown", onShown, false);
-    win.TabView.toggle();
-  }
-  win.addEventListener("load", onLoad, false);
-}
--- a/browser/base/content/test/tabview/browser_tabview_bug626791.js
+++ b/browser/base/content/test/tabview/browser_tabview_bug626791.js
@@ -37,43 +37,16 @@ function test() {
     if (-1 < pos) {
       currentSet.splice(pos, 1);
       toolbar.setAttribute("currentset", currentSet.join(","));
       toolbar.currentSet = currentSet.join(",");
       win.document.persist(toolbar.id, "currentset");
     }
   }
 
-  let newWindowWithTabView = function (callback) {
-    win = window.openDialog(getBrowserURL(), "_blank", 
-                            "chrome,all,dialog=no,height=800,width=800");
-    let onLoad = function() {
-      win.removeEventListener("load", onLoad, false);
-
-      removeToolbarButton();
-      TabView.firstUseExperienced = false;
-      TabView.init();
-
-      let onShown = function() {
-        win.removeEventListener("tabviewshown", onShown, false);
-
-        cw = win.TabView.getContentWindow();
-        let groupItem = cw.GroupItems.groupItems[0];
-        groupItem.setSize(200, 200, true);
-        groupItem.setUserSize();
-
-        callback();
-      };
-
-      win.addEventListener("tabviewshown", onShown, false);
-      win.TabView.toggle();
-    }
-    win.addEventListener("load", onLoad, false);
-  }
-
   let testNameGroup = function () {
     prefix = 'name-group';
     assertToolbarButtonNotExists();
     let groupItem = cw.GroupItems.groupItems[0];
 
     groupItem.setTitle('title');
     assertToolbarButtonNotExists();
     groupItem.setTitle('');
@@ -170,20 +143,33 @@ function test() {
     if (win)
       win.close();
 
     if (!test) {
       finish();
       return;
     }
 
-    newWindowWithTabView(function () {
-      assertToolbarButtonNotExists();
-      test();
-    });
+    newWindowWithTabView(
+      function (newWin) {
+        cw = win.TabView.getContentWindow();
+        let groupItem = cw.GroupItems.groupItems[0];
+        groupItem.setSize(200, 200, true);
+        groupItem.setUserSize();
+
+        assertToolbarButtonNotExists();