Merge central and inbound
authorMarco Bonardo <mbonardo@mozilla.com>
Tue, 03 Apr 2012 14:36:57 +0200
changeset 94218 679211c9474323838a22a629e97aed5bcabe53d2
parent 94217 ab9a5eb634870263234596968ee74ae3f65fe231 (current diff)
parent 94204 c410b2d6d57095bbb39b0cba13ed2099debac44b (diff)
child 94219 d698e656b1e083dd6f536ad4c1b2f99adbb1bcc8
child 94223 f9053a07fb7ac1ac58a13c44e1b06c5a4d8debb9
push id886
push userlsblakk@mozilla.com
push dateMon, 04 Jun 2012 19:57:52 +0000
treeherdermozilla-beta@bbd8d5efd6d1 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone14.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Merge central and inbound
content/base/public/nsIMutationObserver2.h
content/base/test/test_bug590771.html
content/base/test/test_bug598877.html
content/base/test/test_bug600466.html
content/base/test/test_bug600468.html
content/base/test/test_bug600471.html
--- a/content/base/public/Makefile.in
+++ b/content/base/public/Makefile.in
@@ -52,17 +52,16 @@ nsIAttribute.h \
 nsIContentIterator.h \
 nsContentErrors.h \
 nsContentPolicyUtils.h \
 nsContentUtils.h \
 nsIDocument.h \
 nsDeprecatedOperationList.h \
 nsIDocumentObserver.h \
 nsIMutationObserver.h \
-nsIMutationObserver2.h \
 nsINameSpaceManager.h \
 nsINode.h \
 nsINodeInfo.h \
 nsINodeList.h \
 nsIScriptElement.h \
 nsIStyleSheetLinkingElement.h \
 nsIContentSerializer.h \
 nsIXPathEvaluatorInternal.h \
--- a/content/base/public/nsContentUtils.h
+++ b/content/base/public/nsContentUtils.h
@@ -246,30 +246,16 @@ public:
   static nsresult Init();
 
   /**
    * Get a JSContext from the document's scope object.
    */
   static JSContext* GetContextFromDocument(nsIDocument *aDocument);
 
   /**
-   * Get a scope from aNewDocument. Also get a context through the scope of one
-   * of the documents, from the stack or the safe context.
-   *
-   * @param aOldDocument The document to try to get a context from. May be null.
-   * @param aNewDocument The document to get aNewScope from.
-   * @param aCx [out] Context gotten through one of the scopes, from the stack
-   *                  or the safe context.
-   * @param aNewScope [out] Scope gotten from aNewDocument.
-   */
-  static nsresult GetContextAndScope(nsIDocument *aOldDocument,
-                                     nsIDocument *aNewDocument,
-                                     JSContext **aCx, JSObject **aNewScope);
-
-  /**
    * When a document's scope changes (e.g., from document.open(), call this
    * function to move all content wrappers from the old scope to the new one.
    */
   static nsresult ReparentContentWrappersInScope(JSContext *cx,
                                                  nsIScriptGlobalObject *aOldScope,
                                                  nsIScriptGlobalObject *aNewScope);
 
   static bool     IsCallerChrome();
@@ -463,16 +449,18 @@ public:
 
   static void Shutdown();
 
   /**
    * Checks whether two nodes come from the same origin.
    */
   static nsresult CheckSameOrigin(nsINode* aTrustedNode,
                                   nsIDOMNode* aUnTrustedNode);
+  static nsresult CheckSameOrigin(nsINode* aTrustedNode,
+                                  nsINode* unTrustedNode);
 
   // Check if the (JS) caller can access aNode.
   static bool CanCallerAccess(nsIDOMNode *aNode);
 
   // Check if the (JS) caller can access aWindow.
   // aWindow can be either outer or inner window.
   static bool CanCallerAccess(nsPIDOMWindow* aWindow);
 
deleted file mode 100644
--- a/content/base/public/nsIMutationObserver2.h
+++ /dev/null
@@ -1,93 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is mozilla.org code.
- *
- * The Initial Developer of the Original Code is Mozilla Foundation.
- * Portions created by the Initial Developer are Copyright (C) 1998
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- * Mounir Lamouri <mounir.lamouri@mozilla.com> (Original author)
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either of the GNU General Public License Version 2 or later (the "GPL"),
- * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#ifndef nsIMutationObserver2_h___
-#define nsIMutationObserver2_h___
-
-#include "nsIMutationObserver.h"
-
-class nsIContent;
-class nsINode;
-
-#define NS_IMUTATION_OBSERVER_2_IID \
-{0x61ac1cfd, 0xf3ef, 0x4408, \
-  {0x8a, 0x72, 0xee, 0xf0, 0x41, 0xbe, 0xc7, 0xe9 } }
-
-/**
- * Mutation observer interface 2 is adding AttributeChildRemoved to
- * nsIMutationObserver.
- *
- * @see nsIMutationObserver.
- */
-class nsIMutationObserver2 : public nsIMutationObserver
-{
-public:
-  NS_DECLARE_STATIC_IID_ACCESSOR(NS_IMUTATION_OBSERVER_2_IID)
-
-  /**
-   * Notification that an attribute's child has been removed.
-   *
-   * @param aContainer The attribute that had its child removed.
-   * @param aChild     The child that was removed.
-   *
-   * @note Attributes can't have more than one child so it will be always the
-   *       first one being removed.
-   */
-  virtual void AttributeChildRemoved(nsINode* aAttribute,
-                                     nsIContent* aChild) = 0;
-};
-
-NS_DEFINE_STATIC_IID_ACCESSOR(nsIMutationObserver2, NS_IMUTATION_OBSERVER_2_IID)
-
-#define NS_DECL_NSIMUTATIONOBSERVER2_ATTRIBUTECHILDREMOVED                \
-    virtual void AttributeChildRemoved(nsINode* aAttribute,               \
-                                       nsIContent* aChild);
-
-#define NS_DECL_NSIMUTATIONOBSERVER2                                      \
-    NS_DECL_NSIMUTATIONOBSERVER                                           \
-    NS_DECL_NSIMUTATIONOBSERVER2_ATTRIBUTECHILDREMOVED
-
-#define NS_IMPL_NSIMUTATIONOBSERVER2_CONTENT(_class)                      \
-NS_IMPL_NSIMUTATIONOBSERVER_CONTENT(_class)                               \
-void                                                                      \
-_class::AttributeChildRemoved(nsINode* aAttribute, nsIContent *aChild)    \
-{                                                                         \
-}
-
-
-#endif /* nsIMutationObserver2_h___ */
-
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -1463,35 +1463,44 @@ nsContentUtils::CallerHasUniversalXPConn
  * Never call this function with the first node provided by script, it
  * must always be known to be a 'real' node!
  */
 // static
 nsresult
 nsContentUtils::CheckSameOrigin(nsINode *aTrustedNode,
                                 nsIDOMNode *aUnTrustedNode)
 {
-  NS_PRECONDITION(aTrustedNode, "There must be a trusted node");
+  MOZ_ASSERT(aTrustedNode);
+
+  // Make sure it's a real node.
+  nsCOMPtr<nsINode> unTrustedNode = do_QueryInterface(aUnTrustedNode);
+  NS_ENSURE_TRUE(unTrustedNode, NS_ERROR_UNEXPECTED);
+  return CheckSameOrigin(aTrustedNode, unTrustedNode);
+}
+
+nsresult
+nsContentUtils::CheckSameOrigin(nsINode* aTrustedNode,
+                                nsINode* unTrustedNode)
+{
+  MOZ_ASSERT(aTrustedNode);
+  MOZ_ASSERT(unTrustedNode);
 
   bool isSystem = false;
   nsresult rv = sSecurityManager->SubjectPrincipalIsSystem(&isSystem);
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (isSystem) {
     // we're running as system, grant access to the node.
 
     return NS_OK;
   }
 
   /*
    * Get hold of each node's principal
    */
-  nsCOMPtr<nsINode> unTrustedNode = do_QueryInterface(aUnTrustedNode);
-
-  // Make sure these are both real nodes
-  NS_ENSURE_TRUE(aTrustedNode && unTrustedNode, NS_ERROR_UNEXPECTED);
 
   nsIPrincipal* trustedPrincipal = aTrustedNode->NodePrincipal();
   nsIPrincipal* unTrustedPrincipal = unTrustedNode->NodePrincipal();
 
   if (trustedPrincipal == unTrustedPrincipal) {
     return NS_OK;
   }
 
@@ -1602,74 +1611,16 @@ nsContentUtils::GetContextFromDocument(n
   if (!scx) {
     // No context left in the scope...
     return nsnull;
   }
 
   return scx->GetNativeContext();
 }
 
-// static
-nsresult
-nsContentUtils::GetContextAndScope(nsIDocument *aOldDocument,
-                                   nsIDocument *aNewDocument, JSContext **aCx,
-                                   JSObject **aNewScope)
-{
-  *aCx = nsnull;
-  *aNewScope = nsnull;
-
-  JSObject *newScope = aNewDocument->GetWrapper();
-  JSObject *global;
-  if (!newScope) {
-    nsIScriptGlobalObject *newSGO = aNewDocument->GetScopeObject();
-    if (!newSGO || !(global = newSGO->GetGlobalJSObject())) {
-      return NS_OK;
-    }
-  }
-
-  NS_ENSURE_TRUE(sXPConnect, NS_ERROR_NOT_INITIALIZED);
-
-  JSContext *cx = aOldDocument ? GetContextFromDocument(aOldDocument) : nsnull;
-  if (!cx) {
-    cx = GetContextFromDocument(aNewDocument);
-
-    if (!cx) {
-      // No context reachable from the old or new document, use the
-      // calling context, or the safe context if no caller can be
-      // found.
-
-      sThreadJSContextStack->Peek(&cx);
-
-      if (!cx) {
-        sThreadJSContextStack->GetSafeJSContext(&cx);
-
-        if (!cx) {
-          // No safe context reachable, bail.
-          NS_WARNING("No context reachable in GetContextAndScopes()!");
-
-          return NS_ERROR_NOT_AVAILABLE;
-        }
-      }
-    }
-  }
-
-  if (!newScope && cx) {
-    jsval v;
-    nsresult rv = WrapNative(cx, global, aNewDocument, aNewDocument, &v);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    newScope = JSVAL_TO_OBJECT(v);
-  }
-
-  *aCx = cx;
-  *aNewScope = newScope;
-
-  return NS_OK;
-}
-
 //static
 void
 nsContentUtils::TraceSafeJSContext(JSTracer* aTrc)
 {
   if (!sThreadJSContextStack) {
     return;
   }
   JSContext* cx = nsnull;
--- a/content/base/src/nsDOMAttribute.cpp
+++ b/content/base/src/nsDOMAttribute.cpp
@@ -65,79 +65,51 @@
 using namespace mozilla::dom;
 
 //----------------------------------------------------------------------
 bool nsDOMAttribute::sInitialized;
 
 nsDOMAttribute::nsDOMAttribute(nsDOMAttributeMap *aAttrMap,
                                already_AddRefed<nsINodeInfo> aNodeInfo,
                                const nsAString   &aValue, bool aNsAware)
-  : nsIAttribute(aAttrMap, aNodeInfo, aNsAware), mValue(aValue), mChild(nsnull)
+  : nsIAttribute(aAttrMap, aNodeInfo, aNsAware), mValue(aValue)
 {
   NS_ABORT_IF_FALSE(mNodeInfo, "We must get a nodeinfo here!");
   NS_ABORT_IF_FALSE(mNodeInfo->NodeType() == nsIDOMNode::ATTRIBUTE_NODE,
                     "Wrong nodeType");
 
   // We don't add a reference to our content. It will tell us
   // to drop our reference when it goes away.
-
-  EnsureChildState();
-
-  nsIContent* content = GetContentInternal();
-  if (content) {
-    content->AddMutationObserver(this);
-  }
-}
-
-nsDOMAttribute::~nsDOMAttribute()
-{
-  if (mChild) {
-    static_cast<nsTextNode*>(mChild)->UnbindFromAttribute();
-    NS_RELEASE(mChild);
-    mFirstChild = nsnull;
-  }
-
-  nsIContent* content = GetContentInternal();
-  if (content) {
-    content->RemoveMutationObserver(this);
-  }
 }
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsDOMAttribute)
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsDOMAttribute)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_SCRIPT_OBJECTS
 
   if (!nsINode::Traverse(tmp, cb)) {
     return NS_SUCCESS_INTERRUPTED_TRAVERSE;
   }
-
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_RAWPTR(mChild)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(nsDOMAttribute)
   nsINode::Trace(tmp, aCallback, aClosure);
 NS_IMPL_CYCLE_COLLECTION_TRACE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsDOMAttribute)
   nsINode::Unlink(tmp);
-  if (tmp->mChild) {
-    static_cast<nsTextNode*>(tmp->mChild)->UnbindFromAttribute();
-    NS_RELEASE(tmp->mChild);
-    tmp->mFirstChild = nsnull;
-  }
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 DOMCI_NODE_DATA(Attr, nsDOMAttribute)
 
 // QueryInterface implementation for nsDOMAttribute
 NS_INTERFACE_TABLE_HEAD(nsDOMAttribute)
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
-  NS_NODE_INTERFACE_TABLE5(nsDOMAttribute, nsIDOMAttr, nsIAttribute, nsIDOMNode,
-                           nsIDOMEventTarget, nsIMutationObserver)
+  NS_NODE_INTERFACE_TABLE4(nsDOMAttribute, nsIDOMAttr, nsIAttribute, nsIDOMNode,
+                           nsIDOMEventTarget)
   NS_INTERFACE_MAP_ENTRIES_CYCLE_COLLECTION(nsDOMAttribute)
   NS_INTERFACE_MAP_ENTRY_TEAROFF(nsISupportsWeakReference,
                                  new nsNodeSupportsWeakRefTearoff(this))
   NS_INTERFACE_MAP_ENTRY_TEAROFF(nsIDOMXPathNSResolver,
                                  new nsNode3Tearoff(this))
   NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(Attr)
 NS_INTERFACE_MAP_END
 
@@ -149,28 +121,17 @@ void
 nsDOMAttribute::SetMap(nsDOMAttributeMap *aMap)
 {
   if (mAttrMap && !aMap && sInitialized) {
     // We're breaking a relationship with content and not getting a new one,
     // need to locally cache value. GetValue() does that.
     GetValue(mValue);
   }
 
-  nsIContent* content = GetContentInternal();
-  if (content) {
-    content->RemoveMutationObserver(this);
-  }
-
   mAttrMap = aMap;
-
-  // If we have a new content, we sholud start listening to it.
-  content = GetContentInternal();
-  if (content) {
-    content->AddMutationObserver(this);
-  }
 }
 
 nsIContent*
 nsDOMAttribute::GetContent() const
 {
   return GetContentInternal();
 }
 
@@ -236,41 +197,28 @@ nsDOMAttribute::GetValue(nsAString& aVal
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsDOMAttribute::SetValue(const nsAString& aValue)
 {
-  nsresult rv = NS_OK;
   nsIContent* content = GetContentInternal();
-  if (content) {
-    nsCOMPtr<nsIAtom> nameAtom = GetNameAtom(content);
-    rv = content->SetAttr(mNodeInfo->NamespaceID(),
+  if (!content) {
+    mValue = aValue;
+    return NS_OK;
+  }
+
+  nsCOMPtr<nsIAtom> nameAtom = GetNameAtom(content);
+  return content->SetAttr(mNodeInfo->NamespaceID(),
                           nameAtom,
                           mNodeInfo->GetPrefixAtom(),
                           aValue,
                           true);
-  }
-  else {
-    mValue = aValue;
-
-    if (mChild) {
-      if (mValue.IsEmpty()) {
-        doRemoveChild(true);
-      } else {
-        mChild->SetText(mValue, false);
-      }
-    } else {
-      EnsureChildState();
-    }
-  }
-
-  return rv;
 }
 
 
 NS_IMETHODIMP
 nsDOMAttribute::GetSpecified(bool* aSpecified)
 {
   NS_ENSURE_ARG_POINTER(aSpecified);
   OwnerDoc()->WarnOnceAbout(nsIDocument::eSpecified);
@@ -354,17 +302,17 @@ nsDOMAttribute::GetChildNodes(nsIDOMNode
   return nsINode::GetChildNodes(aChildNodes);
 }
 
 NS_IMETHODIMP
 nsDOMAttribute::HasChildNodes(bool* aHasChildNodes)
 {
   OwnerDoc()->WarnOnceAbout(nsIDocument::eHasChildNodes);
 
-  *aHasChildNodes = mFirstChild != nsnull;
+  *aHasChildNodes = false;
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsDOMAttribute::HasAttributes(bool* aHasAttributes)
 {
   NS_ENSURE_ARG_POINTER(aHasAttributes);
@@ -377,20 +325,16 @@ nsDOMAttribute::HasAttributes(bool* aHas
 
 NS_IMETHODIMP
 nsDOMAttribute::GetFirstChild(nsIDOMNode** aFirstChild)
 {
   *aFirstChild = nsnull;
 
   OwnerDoc()->WarnOnceAbout(nsIDocument::eFirstChild);
 
-  if (mFirstChild) {
-    CallQueryInterface(mFirstChild, aFirstChild);
-  }
-  
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsDOMAttribute::GetLastChild(nsIDOMNode** aLastChild)
 {
   OwnerDoc()->WarnOnceAbout(nsIDocument::eLastChild);
 
@@ -653,40 +597,36 @@ bool
 nsDOMAttribute::IsNodeOfType(PRUint32 aFlags) const
 {
     return !(aFlags & ~eATTRIBUTE);
 }
 
 PRUint32
 nsDOMAttribute::GetChildCount() const
 {
-  return mFirstChild ? 1 : 0;
+  return 0;
 }
 
 nsIContent *
 nsDOMAttribute::GetChildAt(PRUint32 aIndex) const
 {
-  return aIndex == 0 ? mFirstChild : nsnull;
+  return nsnull;
 }
 
 nsIContent * const *
 nsDOMAttribute::GetChildArray(PRUint32* aChildCount) const
 {
-  *aChildCount = GetChildCount();
-  return &mFirstChild;
+  *aChildCount = 0;
+  return NULL;
 }
 
 PRInt32
 nsDOMAttribute::IndexOf(nsINode* aPossibleChild) const
 {
-  if (!aPossibleChild || aPossibleChild != mFirstChild) {
-    return -1;
-  }
-
-  return 0;
+  return -1;
 }
 
 nsresult
 nsDOMAttribute::InsertChildAt(nsIContent* aKid, PRUint32 aIndex,
                               bool aNotify)
 {
   return NS_ERROR_NOT_IMPLEMENTED;
 }
@@ -695,106 +635,28 @@ nsresult
 nsDOMAttribute::AppendChildTo(nsIContent* aKid, bool aNotify)
 {
   return NS_ERROR_NOT_IMPLEMENTED;
 }
 
 void
 nsDOMAttribute::RemoveChildAt(PRUint32 aIndex, bool aNotify)
 {
-  if (aIndex != 0 || !mChild) {
-    return;
-  }
-
-  doRemoveChild(aNotify);
-
-  nsString nullString;
-  SetDOMStringToNull(nullString);
-  SetValue(nullString);
 }
 
 nsresult
 nsDOMAttribute::PreHandleEvent(nsEventChainPreVisitor& aVisitor)
 {
   aVisitor.mCanHandle = true;
   return NS_OK;
 }
 
 void
-nsDOMAttribute::EnsureChildState()
-{
-  NS_PRECONDITION(!mChild, "Someone screwed up");
-
-  nsAutoString value;
-  GetValue(value);
-
-  if (!value.IsEmpty()) {
-    NS_NewTextNode(&mChild, mNodeInfo->NodeInfoManager());
-
-    static_cast<nsTextNode*>(mChild)->BindToAttribute(this);
-    mFirstChild = mChild;
-
-    mChild->SetText(value, false);
-  }
-}
-
-void
-nsDOMAttribute::AttributeChanged(nsIDocument* aDocument,
-                                 Element* aElement,
-                                 PRInt32 aNameSpaceID,
-                                 nsIAtom* aAttribute,
-                                 PRInt32 aModType)
-{
-  nsIContent* content = GetContentInternal();
-  if (aElement != content) {
-    return;
-  }
-
-  if (aNameSpaceID != mNodeInfo->NamespaceID()) {
-    return;
-  }
-
-  nsCOMPtr<nsIAtom> nameAtom = GetNameAtom(content);
-  if (nameAtom != aAttribute) {
-    return;
-  }
-
-  nsCOMPtr<nsIMutationObserver> kungFuDeathGrip(this);
-  
-  // Just blow away our mChild and recreate it if needed
-  if (mChild) {
-    doRemoveChild(true);
-  }
-  EnsureChildState();
-}
-
-void
 nsDOMAttribute::Initialize()
 {
   sInitialized = true;
 }
 
 void
 nsDOMAttribute::Shutdown()
 {
   sInitialized = false;
 }
-
-void
-nsDOMAttribute::doRemoveChild(bool aNotify)
-{
-  NS_ASSERTION(mChild && mFirstChild, "Why are we here?");
-  NS_ASSERTION(mChild == mFirstChild, "Something got out of sync!");
-
-  nsRefPtr<nsTextNode> child = static_cast<nsTextNode*>(mChild);
-  nsMutationGuard::DidMutate();
-  mozAutoDocUpdate updateBatch(OwnerDoc(), UPDATE_CONTENT_MODEL, aNotify);
-
-  NS_RELEASE(mChild);
-  mFirstChild = nsnull;
-
-  if (aNotify) {
-    nsNodeUtils::AttributeChildRemoved(this, child);
-  }
-
-  child->UnbindFromAttribute();
-}
-
--- a/content/base/src/nsDOMAttribute.h
+++ b/content/base/src/nsDOMAttribute.h
@@ -51,25 +51,24 @@
 #include "nsINodeInfo.h"
 #include "nsDOMAttributeMap.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsStubMutationObserver.h"
 
 // Attribute helper class used to wrap up an attribute with a dom
 // object that implements nsIDOMAttr and nsIDOMNode
 class nsDOMAttribute : public nsIAttribute,
-                       public nsIDOMAttr,
-                       public nsStubMutationObserver
+                       public nsIDOMAttr
 {
 public:
   nsDOMAttribute(nsDOMAttributeMap* aAttrMap,
                  already_AddRefed<nsINodeInfo> aNodeInfo,
                  const nsAString& aValue,
                  bool aNsAware);
-  virtual ~nsDOMAttribute();
+  virtual ~nsDOMAttribute() {}
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
 
   // nsIDOMNode interface
   NS_DECL_NSIDOMNODE
 
   // nsIDOMAttr interface
   NS_DECL_NSIDOMATTR
@@ -95,43 +94,29 @@ public:
   virtual already_AddRefed<nsIURI> GetBaseURI() const;
 
   static void Initialize();
   static void Shutdown();
 
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_AMBIGUOUS(nsDOMAttribute,
                                                          nsIAttribute)
 
-  NS_DECL_NSIMUTATIONOBSERVER_ATTRIBUTECHANGED
-
   virtual nsXPCClassInfo* GetClassInfo();
 protected:
   virtual mozilla::dom::Element* GetNameSpaceElement()
   {
     return GetContentInternal();
   }
 
   static bool sInitialized;
 
 private:
   already_AddRefed<nsIAtom> GetNameAtom(nsIContent* aContent);
-
-  void EnsureChildState();
-
-  /**
-   * Really removing the attribute child (unbind and release).
-   */
-  void doRemoveChild(bool aNotify);
-
-  nsString mValue;
-  // XXX For now, there's only a single child - a text element
-  // representing the value.  This is strong ref, but we use a raw
-  // pointer so we can implement GetChildArray().
-  nsIContent* mChild;
-
   mozilla::dom::Element *GetContentInternal() const
   {
     return mAttrMap ? mAttrMap->GetContent() : nsnull;
   }
+
+  nsString mValue;
 };
 
 
 #endif /* nsDOMAttribute_h___ */
--- a/content/base/src/nsDOMMutationObserver.cpp
+++ b/content/base/src/nsDOMMutationObserver.cpp
@@ -532,19 +532,16 @@ nsDOMMutationObserver::Observe(nsIDOMNod
 
 NS_IMETHODIMP
 nsDOMMutationObserver::Disconnect()
 {
   for (PRInt32 i = 0; i < mReceivers.Count(); ++i) {
     mReceivers[i]->Disconnect();
   }
   mReceivers.Clear();
-  for (PRUint32 i = 0; i < mCurrentMutations.Length(); ++i) {
-    nsDOMMutationRecord* r = mCurrentMutations[i];
-  }
   mCurrentMutations.Clear();
   mPendingMutations.Clear();
   return NS_OK;
 }
 
 
 NS_IMETHODIMP
 nsDOMMutationObserver::Initialize(nsISupports* aOwner, JSContext* cx,
@@ -568,38 +565,21 @@ nsDOMMutationObserver::Initialize(nsISup
                                       NS_GET_IID(nsIMutationObserverCallback),
                                       getter_AddRefs(tmp));
   mCallback = do_QueryInterface(tmp);
   NS_ENSURE_STATE(mCallback);
   
   return NS_OK;
 }
 
-static PLDHashOperator
-TransientReceiverTraverser(nsISupports* aKey,
-                           nsCOMArray<nsMutationReceiver>* aArray,
-                           void* aUserArg)
-{
-  PRInt32 count = aArray->Count();
-  for (PRInt32 i = 0; i < count; ++i) {
-    nsMutationReceiver* r = aArray->ObjectAt(i);
-    nsMutationReceiver* p = r->GetParent();
-    if (p) {
-      p->RemoveClones();
-    }
-    r->Disconnect();
-  }
-  return PL_DHASH_NEXT;
-}
-
 void
 nsDOMMutationObserver::HandleMutation()
 {
   NS_ASSERTION(nsContentUtils::IsSafeToRunScript(), "Whaat!");
-  NS_ASSERTION(mCurrentMutations.Length() == 0,
+  NS_ASSERTION(mCurrentMutations.IsEmpty(),
                "Still generating MutationRecords?");
 
   mWaitingForRun = false;
 
   for (PRInt32 i = 0; i < mReceivers.Count(); ++i) {
     mReceivers[i]->RemoveClones();
   }
   mTransientReceivers.Clear();
@@ -744,17 +724,16 @@ nsDOMMutationObserver::LeaveMutationHand
       sCurrentlyHandlingObservers->Length() == sMutationLevel) {
     nsCOMArray<nsIDOMMozMutationObserver>& obs =
       sCurrentlyHandlingObservers->ElementAt(sMutationLevel - 1);
     for (PRInt32 i = 0; i < obs.Count(); ++i) {
       nsDOMMutationObserver* o =
         static_cast<nsDOMMutationObserver*>(obs[i]);
       if (o->mCurrentMutations.Length() == sMutationLevel) {
         // It is already in pending mutations.
-        nsDOMMutationRecord* r = o->mCurrentMutations[sMutationLevel - 1];
         o->mCurrentMutations.RemoveElementAt(sMutationLevel - 1);
       }
     }
     sCurrentlyHandlingObservers->RemoveElementAt(sMutationLevel - 1);
   }
   --sMutationLevel;
 }
 
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -4808,65 +4808,54 @@ nsDocument::GetCharacterSet(nsAString& a
 }
 
 NS_IMETHODIMP
 nsDocument::ImportNode(nsIDOMNode* aImportedNode,
                        bool aDeep,
                        PRUint8 aArgc,
                        nsIDOMNode** aResult)
 {
-  NS_ENSURE_ARG(aImportedNode);
   if (aArgc == 0) {
     aDeep = true;
   }
 
   *aResult = nsnull;
 
-  nsresult rv = nsContentUtils::CheckSameOrigin(this, aImportedNode);
-  if (NS_FAILED(rv)) {
-    return rv;
-  }
-
-  PRUint16 nodeType;
-  aImportedNode->GetNodeType(&nodeType);
-  switch (nodeType) {
+  nsCOMPtr<nsINode> imported = do_QueryInterface(aImportedNode);
+  NS_ENSURE_TRUE(imported, NS_ERROR_UNEXPECTED);
+
+  nsresult rv = nsContentUtils::CheckSameOrigin(this, imported);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  switch (imported->NodeType()) {
     case nsIDOMNode::ATTRIBUTE_NODE:
     case nsIDOMNode::DOCUMENT_FRAGMENT_NODE:
     case nsIDOMNode::ELEMENT_NODE:
     case nsIDOMNode::PROCESSING_INSTRUCTION_NODE:
     case nsIDOMNode::TEXT_NODE:
     case nsIDOMNode::CDATA_SECTION_NODE:
     case nsIDOMNode::COMMENT_NODE:
     case nsIDOMNode::DOCUMENT_TYPE_NODE:
     {
-      nsCOMPtr<nsINode> imported = do_QueryInterface(aImportedNode);
-      NS_ENSURE_TRUE(imported, NS_ERROR_FAILURE);
-
       nsCOMPtr<nsIDOMNode> newNode;
       nsCOMArray<nsINode> nodesWithProperties;
       rv = nsNodeUtils::Clone(imported, aDeep, mNodeInfoManager,
                               nodesWithProperties, getter_AddRefs(newNode));
       NS_ENSURE_SUCCESS(rv, rv);
 
       nsIDocument *ownerDoc = imported->OwnerDoc();
       rv = nsNodeUtils::CallUserDataHandlers(nodesWithProperties, ownerDoc,
                                              nsIDOMUserDataHandler::NODE_IMPORTED,
                                              true);
       NS_ENSURE_SUCCESS(rv, rv);
 
       newNode.swap(*aResult);
 
       return NS_OK;
     }
-    case nsIDOMNode::ENTITY_NODE:
-    case nsIDOMNode::ENTITY_REFERENCE_NODE:
-    case nsIDOMNode::NOTATION_NODE:
-    {
-      return NS_ERROR_NOT_IMPLEMENTED;
-    }
     default:
     {
       NS_WARNING("Don't know how to clone this nodetype for importNode.");
 
       return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
     }
   }
 }
@@ -5058,34 +5047,29 @@ nsDocument::CreateNodeIterator(nsIDOMNod
                                nsIDOMNodeIterator **_retval)
 {
   *_retval = nsnull;
 
   if (!aOptionalArgc) {
     aWhatToShow = nsIDOMNodeFilter::SHOW_ALL;
   }
 
-  if (!aRoot)
+  if (!aRoot) {
     return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
-
-  nsresult rv = nsContentUtils::CheckSameOrigin(this, aRoot);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  NS_ENSURE_ARG_POINTER(_retval);
+  }
 
   nsCOMPtr<nsINode> root = do_QueryInterface(aRoot);
-  NS_ENSURE_TRUE(root, NS_ERROR_DOM_NOT_SUPPORTED_ERR);
-
-  nsNodeIterator *iterator = new nsNodeIterator(root,
-                                                aWhatToShow,
-                                                aFilter);
-  NS_ENSURE_TRUE(iterator, NS_ERROR_OUT_OF_MEMORY);
-
-  NS_ADDREF(*_retval = iterator);
-
+  NS_ENSURE_TRUE(root, NS_ERROR_UNEXPECTED);
+
+  nsresult rv = nsContentUtils::CheckSameOrigin(this, root);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsRefPtr<nsNodeIterator> iterator = new nsNodeIterator(root, aWhatToShow,
+                                                         aFilter);
+  iterator.forget(_retval);
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsDocument::CreateTreeWalker(nsIDOMNode *aRoot,
                              PRUint32 aWhatToShow,
                              nsIDOMNodeFilter *aFilter,
                              PRUint8 aOptionalArgc,
@@ -6015,43 +5999,111 @@ public:
     return NS_OK;
   }
 
 private:
   nsCOMArray<nsINode> mNodesWithProperties;
   nsCOMPtr<nsIDocument> mOwnerDoc;
 };
 
+/**
+ * Get a scope from aNewDocument. Also get a context through the scope of one
+ * of the documents, from the stack or the safe context.
+ *
+ * @param aOldDocument The document to try to get a context from.
+ * @param aNewDocument The document to get aNewScope from.
+ * @param aCx [out] Context gotten through one of the scopes, from the stack
+ *                  or the safe context.
+ * @param aNewScope [out] Scope gotten from aNewDocument.
+ */
+static nsresult
+GetContextAndScope(nsIDocument* aOldDocument, nsIDocument* aNewDocument,
+                   JSContext** aCx, JSObject** aNewScope)
+{
+  MOZ_ASSERT(aOldDocument);
+  MOZ_ASSERT(aNewDocument);
+
+  *aCx = nsnull;
+  *aNewScope = nsnull;
+
+  JSObject* newScope = aNewDocument->GetWrapper();
+  JSObject* global;
+  if (!newScope) {
+    nsIScriptGlobalObject *newSGO = aNewDocument->GetScopeObject();
+    if (!newSGO || !(global = newSGO->GetGlobalJSObject())) {
+      return NS_OK;
+    }
+  }
+
+  JSContext* cx = nsContentUtils::GetContextFromDocument(aOldDocument);
+  if (!cx) {
+    cx = nsContentUtils::GetContextFromDocument(aNewDocument);
+
+    if (!cx) {
+      // No context reachable from the old or new document, use the
+      // calling context, or the safe context if no caller can be
+      // found.
+
+      nsIThreadJSContextStack* stack = nsContentUtils::ThreadJSContextStack();
+      stack->Peek(&cx);
+
+      if (!cx) {
+        stack->GetSafeJSContext(&cx);
+
+        if (!cx) {
+          // No safe context reachable, bail.
+          NS_WARNING("No context reachable in GetContextAndScopes()!");
+
+          return NS_ERROR_NOT_AVAILABLE;
+        }
+      }
+    }
+  }
+
+  if (!newScope && cx) {
+    JS::Value v;
+    nsresult rv = nsContentUtils::WrapNative(cx, global, aNewDocument,
+                                             aNewDocument, &v);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    newScope = JSVAL_TO_OBJECT(v);
+  }
+
+  *aCx = cx;
+  *aNewScope = newScope;
+
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsDocument::AdoptNode(nsIDOMNode *aAdoptedNode, nsIDOMNode **aResult)
 {
   NS_ENSURE_ARG(aAdoptedNode);
 
   *aResult = nsnull;
 
-  nsresult rv = nsContentUtils::CheckSameOrigin(this, aAdoptedNode);
+  nsCOMPtr<nsINode> adoptedNode = do_QueryInterface(aAdoptedNode);
+  NS_ENSURE_TRUE(adoptedNode, NS_ERROR_UNEXPECTED);
+
+  nsresult rv = nsContentUtils::CheckSameOrigin(this, adoptedNode);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsCOMPtr<nsINode> adoptedNode = do_QueryInterface(aAdoptedNode);
-
   // Scope firing mutation events so that we don't carry any state that
   // might be stale
   {
     nsINode* parent = adoptedNode->GetNodeParent();
     if (parent) {
       nsContentUtils::MaybeFireNodeRemoved(adoptedNode, parent,
                                            adoptedNode->OwnerDoc());
     }
   }
 
   nsAutoScriptBlocker scriptBlocker;
 
-  PRUint16 nodeType;
-  aAdoptedNode->GetNodeType(&nodeType);
-  switch (nodeType) {
+  switch (adoptedNode->NodeType()) {
     case nsIDOMNode::ATTRIBUTE_NODE:
     {
       // Remove from ownerElement.
       nsCOMPtr<nsIDOMAttr> adoptedAttr = do_QueryInterface(aAdoptedNode);
       NS_ASSERTION(adoptedAttr, "Attribute not implementing nsIDOMAttr");
 
       nsCOMPtr<nsIDOMElement> ownerElement;
       rv = adoptedAttr->GetOwnerElement(getter_AddRefs(ownerElement));
@@ -6096,23 +6148,17 @@ nsDocument::AdoptNode(nsIDOMNode *aAdopt
       // Remove from parent.
       nsCOMPtr<nsINode> parent = adoptedNode->GetNodeParent();
       if (parent) {
         parent->RemoveChildAt(parent->IndexOf(adoptedNode), true);
       }
 
       break;
     }
-    case nsIDOMNode::ENTITY_REFERENCE_NODE:
-    {
-      return NS_ERROR_NOT_IMPLEMENTED;
-    }
     case nsIDOMNode::DOCUMENT_NODE:
-    case nsIDOMNode::ENTITY_NODE:
-    case nsIDOMNode::NOTATION_NODE:
     {
       return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
     }
     default:
     {
       NS_WARNING("Don't know how to adopt this nodetype for adoptNode.");
 
       return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
@@ -6120,17 +6166,17 @@ nsDocument::AdoptNode(nsIDOMNode *aAdopt
   }
 
   nsIDocument *oldDocument = adoptedNode->OwnerDoc();
   bool sameDocument = oldDocument == this;
 
   JSContext *cx = nsnull;
   JSObject *newScope = nsnull;
   if (!sameDocument) {
-    rv = nsContentUtils::GetContextAndScope(oldDocument, this, &cx, &newScope);
+    rv = GetContextAndScope(oldDocument, this, &cx, &newScope);
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
   nsCOMArray<nsINode> nodesWithProperties;
   rv = nsNodeUtils::Adopt(adoptedNode, sameDocument ? nsnull : mNodeInfoManager,
                           cx, newScope, nodesWithProperties);
   if (NS_FAILED(rv)) {
     // Disconnect all nodes from their parents, since some have the old document
@@ -6177,17 +6223,18 @@ nsDocument::AdoptNode(nsIDOMNode *aAdopt
   if (nodesWithProperties.Count()) {
     nsContentUtils::AddScriptRunner(new nsUserDataCaller(nodesWithProperties,
                                                          this));
   }
 
   NS_ASSERTION(adoptedNode->OwnerDoc() == this,
                "Should still be in the document we just got adopted into");
 
-  return CallQueryInterface(adoptedNode, aResult);
+  NS_ADDREF(*aResult = aAdoptedNode);
+  return NS_OK;
 }
 
 NS_IMETHODIMP
 nsDocument::GetOwnerDocument(nsIDOMDocument** aOwnerDocument)
 {
   return nsINode::GetOwnerDocument(aOwnerDocument);
 }
 
--- a/content/base/src/nsNodeIterator.cpp
+++ b/content/base/src/nsNodeIterator.cpp
@@ -202,17 +202,16 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 DOMCI_DATA(NodeIterator, nsNodeIterator)
 
 // QueryInterface implementation for nsNodeIterator
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsNodeIterator)
     NS_INTERFACE_MAP_ENTRY(nsIDOMNodeIterator)
     NS_INTERFACE_MAP_ENTRY(nsIMutationObserver)
-    NS_INTERFACE_MAP_ENTRY(nsIMutationObserver2)
     NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIDOMNodeIterator)
     NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(NodeIterator)
 NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsNodeIterator)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsNodeIterator)
 
 /* readonly attribute nsIDOMNode root; */
@@ -340,16 +339,8 @@ void nsNodeIterator::ContentRemoved(nsID
                                     PRInt32 aIndexInContainer,
                                     nsIContent *aPreviousSibling)
 {
     nsINode *container = NODE_FROM(aContainer, aDocument);
 
     mPointer.AdjustAfterRemoval(mRoot, container, aChild, aPreviousSibling);
     mWorkingPointer.AdjustAfterRemoval(mRoot, container, aChild, aPreviousSibling);
 }
-
-void nsNodeIterator::AttributeChildRemoved(nsINode* aAttribute,
-                                           nsIContent* aChild)
-{
-  mPointer.AdjustAfterRemoval(mRoot, aAttribute, aChild, 0);
-  mWorkingPointer.AdjustAfterRemoval(mRoot, aAttribute, aChild, 0);
-}
-
--- a/content/base/src/nsNodeIterator.h
+++ b/content/base/src/nsNodeIterator.h
@@ -50,29 +50,28 @@
 #include "nsStubMutationObserver.h"
 
 class nsINode;
 class nsIDOMNode;
 class nsIDOMNodeFilter;
 
 class nsNodeIterator : public nsIDOMNodeIterator,
                        public nsTraversal,
-                       public nsStubMutationObserver2
+                       public nsStubMutationObserver
 {
 public:
     NS_DECL_CYCLE_COLLECTING_ISUPPORTS
     NS_DECL_NSIDOMNODEITERATOR
 
     nsNodeIterator(nsINode *aRoot,
                    PRUint32 aWhatToShow,
                    nsIDOMNodeFilter *aFilter);
     virtual ~nsNodeIterator();
 
     NS_DECL_NSIMUTATIONOBSERVER_CONTENTREMOVED
-    NS_DECL_NSIMUTATIONOBSERVER2_ATTRIBUTECHILDREMOVED
 
     NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(nsNodeIterator, nsIDOMNodeIterator)
 
 private:
     struct NodePointer {
         NodePointer() : mNode(nsnull) {};
         NodePointer(nsINode *aNode, bool aBeforeNode);
 
--- a/content/base/src/nsNodeUtils.cpp
+++ b/content/base/src/nsNodeUtils.cpp
@@ -37,21 +37,19 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsNodeUtils.h"
 #include "nsContentUtils.h"
 #include "nsINode.h"
 #include "nsIContent.h"
 #include "mozilla/dom/Element.h"
 #include "nsIMutationObserver.h"
-#include "nsIMutationObserver2.h"
 #include "nsIDocument.h"
 #include "nsIDOMUserDataHandler.h"
 #include "nsEventListenerManager.h"
-#include "nsIAttribute.h"
 #include "nsIXPConnect.h"
 #include "nsGenericElement.h"
 #include "pldhash.h"
 #include "nsIDOMAttr.h"
 #include "nsCOMArray.h"
 #include "nsPIDOMWindow.h"
 #include "nsDocument.h"
 #ifdef MOZ_XUL
@@ -67,18 +65,16 @@
 #include "nsWrapperCacheInlines.h"
 #include "nsObjectLoadingContent.h"
 #include "nsDOMMutationObserver.h"
 
 using namespace mozilla::dom;
 
 // This macro expects the ownerDocument of content_ to be in scope as
 // |nsIDocument* doc|
-// NOTE: AttributeChildRemoved doesn't use this macro but has a very similar use.
-// If you change how this macro behave please update AttributeChildRemoved.
 #define IMPL_MUTATION_NOTIFICATION(func_, content_, params_)      \
   PR_BEGIN_MACRO                                                  \
   bool needsEnterLeave = doc->MayHaveDOMMutationObservers();      \
   if (needsEnterLeave) {                                          \
     nsDOMMutationObserver::EnterMutationHandling();               \
   }                                                               \
   nsINode* node = content_;                                       \
   NS_ASSERTION(node->OwnerDoc() == doc, "Bogus document");        \
@@ -202,42 +198,16 @@ nsNodeUtils::ContentRemoved(nsINode* aCo
   }
 
   IMPL_MUTATION_NOTIFICATION(ContentRemoved, aContainer,
                              (document, container, aChild, aIndexInContainer,
                               aPreviousSibling));
 }
 
 void
-nsNodeUtils::AttributeChildRemoved(nsINode* aAttribute,
-                                   nsIContent* aChild)
-{
-  NS_PRECONDITION(aAttribute->IsNodeOfType(nsINode::eATTRIBUTE),
-                  "container must be a nsIAttribute");
-
-  // This is a variant of IMPL_MUTATION_NOTIFICATION.
-  do {
-    nsINode::nsSlots* slots = aAttribute->GetExistingSlots();
-    if (slots && !slots->mMutationObservers.IsEmpty()) {
-      // This is a variant of NS_OBSERVER_ARRAY_NOTIFY_OBSERVERS.
-      nsTObserverArray<nsIMutationObserver*>::ForwardIterator iter_ =
-        slots->mMutationObservers;
-      nsCOMPtr<nsIMutationObserver2> obs_;
-      while (iter_.HasMore()) {
-        obs_ = do_QueryInterface(iter_.GetNext());
-        if (obs_) {
-          obs_->AttributeChildRemoved(aAttribute, aChild);
-        }
-      }
-    }
-    aAttribute = aAttribute->GetNodeParent();
-  } while (aAttribute);
-}
-
-void
 nsNodeUtils::LastRelease(nsINode* aNode)
 {
   nsINode::nsSlots* slots = aNode->GetExistingSlots();
   if (slots) {
     if (!slots->mMutationObservers.IsEmpty()) {
       NS_OBSERVER_ARRAY_NOTIFY_OBSERVERS(slots->mMutationObservers,
                                          nsIMutationObserver,
                                          NodeWillBeDestroyed, (aNode));
@@ -605,42 +575,21 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNod
     }
   }
 
   // XXX If there are any attribute nodes on this element with UserDataHandlers
   // we should technically adopt/clone/import such attribute nodes and notify
   // those handlers. However we currently don't have code to do so without
   // also notifying when it's not safe so we're not doing that at this time.
 
-  // The DOM spec says to always adopt/clone/import the children of attribute
-  // nodes.
-  // XXX The following block is here because our implementation of attribute
-  //     nodes is broken when it comes to inserting children. Instead of cloning
-  //     their children we force creation of the only child by calling
-  //     GetChildAt(0). We can remove this when
-  //     https://bugzilla.mozilla.org/show_bug.cgi?id=56758 is fixed.
-  if (aClone && aNode->IsNodeOfType(nsINode::eATTRIBUTE)) {
-    nsCOMPtr<nsINode> attrChildNode = aNode->GetChildAt(0);
-    // We only need to do this if the child node has properties (because we
-    // might need to call a userdata handler).
-    if (attrChildNode && attrChildNode->HasProperties()) {
-      nsCOMPtr<nsINode> clonedAttrChildNode = clone->GetChildAt(0);
-      if (clonedAttrChildNode) {
-        bool ok = aNodesWithProperties.AppendObject(attrChildNode) &&
-                    aNodesWithProperties.AppendObject(clonedAttrChildNode);
-        NS_ENSURE_TRUE(ok, NS_ERROR_OUT_OF_MEMORY);
-      }
-    }
-  }
-  // XXX End of workaround for broken attribute nodes.
-  else if (aDeep || aNode->IsNodeOfType(nsINode::eATTRIBUTE)) {
+  if (aDeep && (!aClone || !aNode->IsNodeOfType(nsINode::eATTRIBUTE))) {
     // aNode's children.
     for (nsIContent* cloneChild = aNode->GetFirstChild();
          cloneChild;
-       cloneChild = cloneChild->GetNextSibling()) {
+         cloneChild = cloneChild->GetNextSibling()) {
       nsCOMPtr<nsINode> child;
       rv = CloneAndAdopt(cloneChild, aClone, true, nodeInfoManager,
                          aCx, aNewScope, aNodesWithProperties, clone,
                          getter_AddRefs(child));
       NS_ENSURE_SUCCESS(rv, rv);
     }
   }
 
--- a/content/base/src/nsNodeUtils.h
+++ b/content/base/src/nsNodeUtils.h
@@ -125,23 +125,16 @@ public:
    * @param aIndexInContainer Index of removed child
    * @see nsIMutationObserver::ContentRemoved
    */
   static void ContentRemoved(nsINode* aContainer,
                              nsIContent* aChild,
                              PRInt32 aIndexInContainer,
                              nsIContent* aPreviousSibling);
   /**
-   * Send AttributeChildRemoved notifications to nsIMutationObservers.
-   * @param aAttribute Attribute from which the child has been removed.
-   * @param aChild     Removed child.
-   * @see nsIMutationObserver2::AttributeChildRemoved.
-   */
-  static void AttributeChildRemoved(nsINode* aAttribute, nsIContent* aChild);
-  /**
    * Send ParentChainChanged notifications to nsIMutationObservers
    * @param aContent  The piece of content that had its parent changed.
    * @see nsIMutationObserver::ParentChainChanged
    */
   static inline void ParentChainChanged(nsIContent *aContent)
   {
     nsINode::nsSlots* slots = aContent->GetExistingSlots();
     if (slots && !slots->mMutationObservers.IsEmpty()) {
--- a/content/base/src/nsStubMutationObserver.cpp
+++ b/content/base/src/nsStubMutationObserver.cpp
@@ -41,11 +41,8 @@
  * used as a base class within the content/layout library.  All methods do
  * nothing.
  */
 
 #include "nsStubMutationObserver.h"
 
 NS_IMPL_NSIMUTATIONOBSERVER_CORE_STUB(nsStubMutationObserver)
 NS_IMPL_NSIMUTATIONOBSERVER_CONTENT(nsStubMutationObserver)
-
-NS_IMPL_NSIMUTATIONOBSERVER_CORE_STUB(nsStubMutationObserver2)
-NS_IMPL_NSIMUTATIONOBSERVER2_CONTENT(nsStubMutationObserver2)
--- a/content/base/src/nsStubMutationObserver.h
+++ b/content/base/src/nsStubMutationObserver.h
@@ -41,30 +41,25 @@
  * used as a base class within the content/layout library.  All methods do
  * nothing.
  */
 
 #ifndef nsStubMutationObserver_h_
 #define nsStubMutationObserver_h_
 
 #include "nsIMutationObserver.h"
-#include "nsIMutationObserver2.h"
 
 /**
  * There are two advantages to inheriting from nsStubMutationObserver
  * rather than directly from nsIMutationObserver:
  *  1. smaller compiled code size (since there's no need for the code
  *     for the empty virtual function implementations for every
  *     nsIMutationObserver implementation)
  *  2. the performance of document's loop over observers benefits from
  *     the fact that more of the functions called are the same (which
  *     can reduce instruction cache misses and perhaps improve branch
  *     prediction)
  */
 class nsStubMutationObserver : public nsIMutationObserver {
   NS_DECL_NSIMUTATIONOBSERVER
 };
 
-class nsStubMutationObserver2 : public nsIMutationObserver2 {
-  NS_DECL_NSIMUTATIONOBSERVER2
-};
-
 #endif /* !defined(nsStubMutationObserver_h_) */
--- a/content/base/src/nsTextNode.cpp
+++ b/content/base/src/nsTextNode.cpp
@@ -38,17 +38,16 @@
 /*
  * Implementation of DOM Core's nsIDOMText node.
  */
 
 #include "nsTextNode.h"
 #include "nsContentUtils.h"
 #include "nsIDOMEventListener.h"
 #include "nsIDOMMutationEvent.h"
-#include "nsIAttribute.h"
 #include "nsIDocument.h"
 #include "nsThreadUtils.h"
 #ifdef DEBUG
 #include "nsRange.h"
 #endif
 
 using namespace mozilla::dom;
 
@@ -179,39 +178,16 @@ nsTextNode::CloneDataNode(nsINodeInfo *a
   nsTextNode *it = new nsTextNode(ni.forget());
   if (it && aCloneText) {
     it->mText = mText;
   }
 
   return it;
 }
 
-void
-nsTextNode::BindToAttribute(nsIAttribute* aAttr)
-{
-  NS_ASSERTION(!IsInDoc(), "Unbind before binding!");
-  NS_ASSERTION(!GetNodeParent(), "Unbind before binding!");
-  NS_ASSERTION(HasSameOwnerDoc(aAttr), "Wrong owner document!");
-
-  mParent = aAttr;
-  SetParentIsContent(false);
-  ClearInDocument();
-  SetSubtreeRootPointer(aAttr->SubtreeRoot());
-}
-
-void
-nsTextNode::UnbindFromAttribute()
-{
-  NS_ASSERTION(GetNodeParent(), "Bind before unbinding!");
-  NS_ASSERTION(GetNodeParent()->IsNodeOfType(nsINode::eATTRIBUTE),
-               "Use this method only to unbind from an attribute!");
-  mParent = nsnull;
-  SetSubtreeRootPointer(this);
-}
-
 nsresult
 nsTextNode::AppendTextForNormalize(const PRUnichar* aBuffer, PRUint32 aLength,
                                    bool aNotify, nsIContent* aNextSibling)
 {
   CharacterDataChangeInfo::Details details = {
     CharacterDataChangeInfo::Details::eMerge, aNextSibling
   };
   return SetTextInternal(mText.GetLength(), 0, aBuffer, aLength, aNotify, &details);
--- a/content/base/src/nsTextNode.h
+++ b/content/base/src/nsTextNode.h
@@ -37,20 +37,16 @@
 
 /*
  * Implementation of DOM Core's nsIDOMText node.
  */
 
 #include "nsGenericDOMDataNode.h"
 #include "nsIDOMText.h"
 
-#include "nsIAttribute.h"
-#include "nsIDocument.h"
-#include "nsThreadUtils.h"
-
 /**
  * Class used to implement DOM text nodes
  */
 class nsTextNode : public nsGenericDOMDataNode,
                    public nsIDOMText
 {
 public:
   nsTextNode(already_AddRefed<nsINodeInfo> aNodeInfo);
@@ -69,19 +65,16 @@ public:
   NS_FORWARD_NSIDOMTEXT(nsGenericDOMDataNode::)
 
   // nsINode
   virtual bool IsNodeOfType(PRUint32 aFlags) const;
 
   virtual nsGenericDOMDataNode* CloneDataNode(nsINodeInfo *aNodeInfo,
                                               bool aCloneText) const;
 
-  void BindToAttribute(nsIAttribute* aAttr);
-  void UnbindFromAttribute();
-
   virtual nsXPCClassInfo* GetClassInfo();
 
   nsresult AppendTextForNormalize(const PRUnichar* aBuffer, PRUint32 aLength,
                                   bool aNotify, nsIContent* aNextSibling);
 
 #ifdef DEBUG
   virtual void List(FILE* out, PRInt32 aIndent) const;
   virtual void DumpContent(FILE* out, PRInt32 aIndent, bool aDumpAll) const;
--- a/content/base/src/nsTreeWalker.cpp
+++ b/content/base/src/nsTreeWalker.cpp
@@ -139,22 +139,23 @@ NS_IMETHODIMP nsTreeWalker::GetCurrentNo
 
     *aCurrentNode = nsnull;
 
     return NS_OK;
 }
 NS_IMETHODIMP nsTreeWalker::SetCurrentNode(nsIDOMNode * aCurrentNode)
 {
     NS_ENSURE_TRUE(aCurrentNode, NS_ERROR_DOM_NOT_SUPPORTED_ERR);
-
-    nsresult rv = nsContentUtils::CheckSameOrigin(mRoot, aCurrentNode);
-    NS_ENSURE_SUCCESS(rv, rv);
+    NS_ENSURE_TRUE(mRoot, NS_ERROR_UNEXPECTED);
 
     nsCOMPtr<nsINode> node = do_QueryInterface(aCurrentNode);
-    NS_ENSURE_TRUE(node, NS_ERROR_DOM_NOT_SUPPORTED_ERR);
+    NS_ENSURE_TRUE(node, NS_ERROR_UNEXPECTED);
+
+    nsresult rv = nsContentUtils::CheckSameOrigin(mRoot, node);
+    NS_ENSURE_SUCCESS(rv, rv);
 
     mCurrentNode.swap(node);
     return NS_OK;
 }
 
 /*
  * nsIDOMTreeWalker functions
  */
--- a/content/base/test/Makefile.in
+++ b/content/base/test/Makefile.in
@@ -436,21 +436,17 @@ include $(topsrcdir)/config/rules.mk
 		test_bug564047.html \
 		test_bug567350.html \
 		test_bug578096.html \
 		test_bug585978.html \
 		test_bug592366.html \
 		test_bug597345.html \
 		script-1_bug597345.sjs \
 		script-2_bug597345.js \
-		test_bug598877.html \
 		test_bug599588.html \
-		test_bug600466.html \
-		test_bug600468.html \
-		test_bug600471.html \
 		test_bug601803.html \
 		file_bug601803a.html \
 		file_bug601803b.html \
 		test_bug602838.html \
 		script_bug602838.sjs \
 		test_bug614583.html \
 		test_bug604660.html \
 		file_bug604660-1.xml \
@@ -458,17 +454,16 @@ include $(topsrcdir)/config/rules.mk
 		file_bug604660-3.js \
 		file_bug604660-4.js \
 		file_bug604660-5.xml \
 		file_bug604660-6.xsl \
 		test_bug605982.html \
 		test_bug606729.html \
 		test_treewalker_nextsibling.xml \
 		test_bug614058.html \
-		test_bug590771.html \
 		test_bug622117.html \
 		test_base.xhtml \
 		file_base_xbl.xml \
 		test_bug622246.html \
 		test_bug484396.html \
 		test_bug466080.html \
 		bug466080.sjs \
 		test_bug625722.html \
deleted file mode 100644
--- a/content/base/test/test_bug590771.html
+++ /dev/null
@@ -1,73 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=590771
--->
-<head>
-  <title>Test for Bug 590771</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=590771">Mozilla Bug 590771</a>
-<p id="display"></p>
-<pre id="test">
-<script type="application/javascript">
-
-/** Test for Bug 590771 **/
-
-function test1()
-{
-  var attr = document.createAttribute("foo");
-  attr.value = "bar";
-  var ni = document.createNodeIterator(attr, -1, null, false);
-  ni.nextNode();
-  ni.nextNode();
-  is(ni.referenceNode, attr.firstChild,
-      "iterator should be on the first child attribute");
-
-  attr.removeChild(attr.firstChild);
-  is(ni.referenceNode, attr,
-     "iterator should be on the attribute now");
-}
-
-function test2()
-{
-  var attr = document.createAttribute("foo");
-  attr.value = "bar";
-  var ni = document.createNodeIterator(attr, -1, null, false);
-  ni.nextNode();
-  ni.nextNode();
-  is(ni.referenceNode, attr.firstChild,
-      "iterator should be on the first child attribute");
-
-  attr.value = "";
-  is(ni.referenceNode, attr,
-     "iterator should be on the attribute now");
-}
-
-function test3()
-{
-  var attr = document.createAttribute("foo");
-  attr.value = "bar";
-  var node = document.createElement("div");
-  node.setAttributeNode(attr);
-  var ni = document.createNodeIterator(attr, -1, null, false);
-  ni.nextNode();
-  ni.nextNode();
-  is(ni.referenceNode, attr.firstChild,
-      "iterator should be on the first child attribute");
-
-  node.setAttribute("foo", "");
-  is(ni.referenceNode, attr,
-     "iterator should be on the attribute now");
-}
-
-test1();
-test2();
-test3();
-
-</script>
-</pre>
-</body>
-</html>
deleted file mode 100644
--- a/content/base/test/test_bug598877.html
+++ /dev/null
@@ -1,27 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=598877
--->
-<head>
-  <title>Test for Bug 598877</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=598877">Mozilla Bug 598877</a>
-<p id="display"></p>
-<pre id="test">
-<script type="application/javascript">
-
-/** Test for Bug 598877 **/
-
-var attr = document.createAttribute("foo");
-attr.value = "bar";
-ok(attr.firstChild, "attr.firstChild should be a text node");
-is(attr.firstChild.nodeValue, "bar", "the text node value should be 'bar'");
-
-</script>
-</pre>
-</body>
-</html>
deleted file mode 100644
--- a/content/base/test/test_bug600466.html
+++ /dev/null
@@ -1,29 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=600466
--->
-<head>
-  <title>Test for Bug 600466</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=600466">Mozilla Bug 600466</a>
-<p id="display"></p>
-<pre id="test">
-<script type="application/javascript">
-
-/** Test for Bug 600466 **/
-
-var attr = document.createAttribute("foo");
-attr.value = "bar";
-ok(attr.firstChild, "attr should have a first child");
-
-attr.removeChild(attr.firstChild);
-ok(!attr.firstChild, "attr should not have a first child anymore");
-
-</script>
-</pre>
-</body>
-</html>
deleted file mode 100644
--- a/content/base/test/test_bug600468.html
+++ /dev/null
@@ -1,29 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=600468
--->
-<head>
-  <title>Test for Bug 600468</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=600468">Mozilla Bug 600468</a>
-<p id="display"></p>
-<pre id="test">
-<script type="application/javascript">
-
-/** Test for Bug 600468 **/
-
-var attr = document.createAttribute("foo");
-attr.value = "bar";
-ok(attr.firstChild, "attr should have a first child");
-
-attr.value = "";
-ok(!attr.firstChild, "attr should not have a first child");
-
-</script>
-</pre>
-</body>
-</html>
deleted file mode 100644
--- a/content/base/test/test_bug600471.html
+++ /dev/null
@@ -1,30 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=600471
--->
-<head>
-  <title>Test for Bug 600471</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=600471">Mozilla Bug 600471</a>
-<p id="display"></p>
-<pre id="test">
-<script type="application/javascript">
-
-/** Test for Bug 600471 **/
-
-var attr = document.createAttribute("foo");
-attr.value = "bar";
-var node = document.createElement("div");
-node.setAttributeNode(attr);
-
-node.setAttribute("foo", "newvalue");
-is(attr.firstChild.nodeValue, "newvalue", "the value should be updated");
-
-</script>
-</pre>
-</body>
-</html>
new file mode 100644
--- /dev/null
+++ b/content/html/document/crashtests/741218.json
@@ -0,0 +1,1 @@
+{}
new file mode 100644
--- /dev/null
+++ b/content/html/document/crashtests/741218.json^headers^
@@ -0,0 +1,1 @@
+Content-Type: application/json
--- a/content/html/document/crashtests/crashtests.list
+++ b/content/html/document/crashtests/crashtests.list
@@ -8,8 +8,9 @@ load 407053.html
 load 448564.html
 load 468562-1.html
 load 468562-2.html
 load 494225.html
 load 495543.svg
 load 564461.xhtml
 load 601422.html
 load 631421.html
+load 741218.json
--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@@ -579,24 +579,25 @@ nsHTMLDocument::StartDocumentLoad(const 
   bool viewSource = !strcmp(aCommand, "view-source");
   bool asData = !strcmp(aCommand, kLoadAsData);
   if(!(view || viewSource || asData)) {
     MOZ_NOT_REACHED("Bad parser command");
     return NS_ERROR_INVALID_ARG;
   }
 
   bool html = contentType.EqualsLiteral(TEXT_HTML);
-  bool xhtml = !html && contentType.Equals("application/xhtml+xml");
+  bool xhtml = !html && contentType.EqualsLiteral(APPLICATION_XHTML_XML);
   bool plainText = !html && !xhtml && (contentType.EqualsLiteral(TEXT_PLAIN) ||
     contentType.EqualsLiteral(TEXT_CSS) ||
     contentType.EqualsLiteral(APPLICATION_JAVASCRIPT) ||
     contentType.EqualsLiteral(APPLICATION_XJAVASCRIPT) ||
     contentType.EqualsLiteral(TEXT_ECMASCRIPT) ||
     contentType.EqualsLiteral(APPLICATION_ECMASCRIPT) ||
-    contentType.EqualsLiteral(TEXT_JAVASCRIPT));
+    contentType.EqualsLiteral(TEXT_JAVASCRIPT) ||
+    contentType.EqualsLiteral(APPLICATION_JSON));
   if (!(html || xhtml || plainText || viewSource)) {
     MOZ_NOT_REACHED("Channel with bad content type.");
     return NS_ERROR_INVALID_ARG;
   }
 
   bool loadAsHtml5 = true;
 
   if (!viewSource && xhtml) {
--- a/content/xul/document/src/nsXULCommandDispatcher.cpp
+++ b/content/xul/document/src/nsXULCommandDispatcher.cpp
@@ -285,16 +285,18 @@ NS_IMETHODIMP
 nsXULCommandDispatcher::AddCommandUpdater(nsIDOMElement* aElement,
                                           const nsAString& aEvents,
                                           const nsAString& aTargets)
 {
   NS_PRECONDITION(aElement != nsnull, "null ptr");
   if (! aElement)
     return NS_ERROR_NULL_POINTER;
 
+  NS_ENSURE_TRUE(mDocument, NS_ERROR_UNEXPECTED);
+
   nsresult rv = nsContentUtils::CheckSameOrigin(mDocument, aElement);
 
   if (NS_FAILED(rv)) {
     return rv;
   }
 
   Updater* updater = mUpdaters;
   Updater** link = &mUpdaters;
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -10511,25 +10511,25 @@ nsStorage2SH::GetProperty(nsIXPConnectWr
 
     rv = storage->Key(n, val);
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
   JSAutoRequest ar(cx);
 
   if (DOMStringIsNull(val)) {
-      *vp = JSVAL_NULL;
-  }
-  else {
-      JSString *str =
-        ::JS_NewUCStringCopyN(cx, reinterpret_cast<const jschar *>(val.get()),
-                              val.Length());
-      NS_ENSURE_TRUE(str, NS_ERROR_OUT_OF_MEMORY);
-
-      *vp = STRING_TO_JSVAL(str);
+    // No such key.
+    *vp = JSVAL_VOID;
+  } else {
+    JSString* str =
+      JS_NewUCStringCopyN(cx, static_cast<const jschar *>(val.get()),
+                          val.Length());
+    NS_ENSURE_TRUE(str, NS_ERROR_OUT_OF_MEMORY);
+
+    *vp = STRING_TO_JSVAL(str);
   }
 
   return NS_SUCCESS_I_DID_SOMETHING;
 }
 
 NS_IMETHODIMP
 nsStorage2SH::SetProperty(nsIXPConnectWrappedNative *wrapper,
                           JSContext *cx, JSObject *obj, jsid id,
--- a/dom/interfaces/storage/nsIDOMStorage.idl
+++ b/dom/interfaces/storage/nsIDOMStorage.idl
@@ -69,33 +69,33 @@ interface nsIDOMStorage : nsISupports
   DOMString key(in unsigned long index);
 
   /**
    * Retrieve an item with a given key
    *
    * @param key key to retrieve
    * @returns found data or empty string if the key was not found
    */
-  DOMString getItem(in DOMString key);
+  DOMString getItem([Null(Stringify)] in DOMString key);
 
   /**
    * Assign a value with a key. If the key does not exist already, a new
    * key is added associated with that value. If the key already exists,
    * then the existing value is replaced with a new value.
    *
    * @param key key to set
    * @param data data to associate with the key
    */
-  void setItem(in DOMString key, in DOMString data);
+  void setItem([Null(Stringify)] in DOMString key, [Null(Stringify)] in DOMString data);
 
   /**
    * Remove a key and its corresponding value.
    *
    * @param key key to remove
    */
-  void removeItem(in DOMString key);
+  void removeItem([Null(Stringify)] in DOMString key);
 
   /**
    * Clear the content of this storage bound to a domain
    * or an origin.
    */
   void clear();
 };
--- a/dom/tests/mochitest/dom-level1-core/exclusions.js
+++ b/dom/tests/mochitest/dom-level1-core/exclusions.js
@@ -74,17 +74,20 @@ var indexErrTests = ["characterdataindex
                      "characterdataindexsizeerrsubstringcountnegative", "hc_characterdataindexsizeerrdeletedatacountnegative",
                      "hc_characterdataindexsizeerrreplacedatacountnegative", "hc_characterdataindexsizeerrsubstringcountnegative"];
 
 var attributeModTests = ["hc_attrappendchild1", "hc_attrappendchild3", "hc_attrappendchild5",
                          "hc_attrappendchild6", "hc_attrchildnodes2", "hc_attrclonenode1", "hc_attrinsertbefore1",
                          "hc_attrinsertbefore2", "hc_attrinsertbefore3", "hc_attrinsertbefore4", "hc_attrinsertbefore6",
                          "hc_attrnormalize", "hc_attrreplacechild1", "hc_attrreplacechild2",
                          "hc_attrsetvalue2", "hc_elementnormalize2", "hc_elementnotfounderr", "hc_elementremoveattribute", "hc_elementnormalize2",
-                         "hc_elementnotfounderr", "hc_elementremoveattribute", ];
+                         "hc_elementnotfounderr", "hc_elementremoveattribute",
+                         "hc_attrchildnodes1", "hc_attrfirstchild",
+                         "hc_attrhaschildnodes", "hc_attrlastchild",
+                         "hc_attrremovechild1", "hc_attrsetvalue1"];
 var modTests = ["hc_elementwrongdocumenterr", "hc_namednodemapwrongdocumenterr", "hc_nodeappendchildnewchilddiffdocument", "hc_nodeinsertbeforenewchilddiffdocument",
                 "hc_nodereplacechildnewchilddiffdocument", "hc_elementwrongdocumenterr", "hc_namednodemapwrongdocumenterr", "hc_nodeappendchildnewchilddiffdocument",
                 "hc_nodeinsertbeforenewchilddiffdocument", "hc_nodereplacechildnewchilddiffdocument", "elementwrongdocumenterr", "namednodemapwrongdocumenterr",
                 "nodeappendchildnewchilddiffdocument", "nodeinsertbeforenewchilddiffdocument", "nodereplacechildnewchilddiffdocument"];
 // These tests rely on an implementation of document.createEntityReference.
 var createEntityRef = ["documentinvalidcharacterexceptioncreateentref",
                        "documentinvalidcharacterexceptioncreateentref1",
                        "hc_attrgetvalue2", "hc_nodevalue03"];
--- a/dom/tests/mochitest/localstorage/test_localStorageBase.html
+++ b/dom/tests/mochitest/localstorage/test_localStorageBase.html
@@ -2,36 +2,36 @@
 <head>
 <title>localStorage basic test</title>
 
 <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
 <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
 <script type="text/javascript">
 
-var MOZ_STORAGE_CHANGED_COUNT = 14;
+var MOZ_STORAGE_CHANGED_COUNT = 21;
 
 function startTest()
 {
   // Initially check the localStorage is empty
   is(localStorage.length, 0, "The storage is empty [1]");
   is(localStorage.key(0), null, "key() should return null for out-of-bounds access");
   is(localStorage.key(-1), null, "key() should return null for out-of-bounds access");
   is(localStorage.key(1), null, "key() should return null for out-of-bounds access");
   is(localStorage.getItem("nonexisting"), null, "Nonexisting item is null (getItem())");
-  is(localStorage["nonexisting"], null, "Nonexisting item is null (array access)");
-  is(localStorage.nonexisting, null, "Nonexisting item is null (property access)");
+  is(localStorage["nonexisting"], undefined, "Nonexisting item is undefined (array access)");
+  is(localStorage.nonexisting, undefined, "Nonexisting item is undefined (property access)");
   localStorage.removeItem("nonexisting"); // Just check there is no exception
 
   is(typeof localStorage.getItem("nonexisting"), "object", "getItem('nonexisting') is object");
-  is(typeof localStorage["nonexisting"], "object", "['nonexisting'] is object");
-  is(typeof localStorage.nonexisting, "object", "nonexisting is object");
+  is(typeof localStorage["nonexisting"], "undefined", "['nonexisting'] is undefined");
+  is(typeof localStorage.nonexisting, "undefined", "nonexisting is undefined");
   is(typeof localStorage.getItem("nonexisting2"), "object", "getItem('nonexisting2') is object");
-  is(typeof localStorage["nonexisting2"], "object", "['nonexisting2'] is object");
-  is(typeof localStorage.nonexisting2, "object", "nonexisting2 is object");
+  is(typeof localStorage["nonexisting2"], "undefined", "['nonexisting2'] is undefined");
+  is(typeof localStorage.nonexisting2, "undefined", "nonexisting2 is undefined");
 
   var mozStorageChangedReceived = 0;
   var localStorageCopy = localStorage;
 
   function onStorageChanged(e) {
     if (e.storageArea == localStorageCopy)
       mozStorageChangedReceived++;
   }
@@ -45,21 +45,21 @@ function startTest()
   is(localStorage["empty"], "", "Empty value (array access)");
   is(localStorage.empty, "", "Empty value (property access)");
   is(typeof localStorage.getItem("empty"), "string", "getItem('empty') is string");
   is(typeof localStorage["empty"], "string", "['empty'] is string");
   is(typeof localStorage.empty, "string", "empty is string");
   localStorage.removeItem("empty");
   is(localStorage.length, 0, "The storage has no keys");
   is(localStorage.getItem("empty"), null, "empty item is null (getItem())");
-  is(localStorage["empty"], null, "empty item is null (array access)");
-  is(localStorage.empty, null, "empty item is null (property access)");
+  is(localStorage["empty"], undefined, "empty item is undefined (array access)");
+  is(localStorage.empty, undefined, "empty item is undefined (property access)");
   is(typeof localStorage.getItem("empty"), "object", "getItem('empty') is object");
-  is(typeof localStorage["empty"], "object", "['empty'] is object");
-  is(typeof localStorage.empty, "object", "empty is object");
+  is(typeof localStorage["empty"], "undefined", "['empty'] is undefined");
+  is(typeof localStorage.empty, "undefined", "empty is undefined");
 
   // add one key, check it is there
   localStorage.setItem("key1", "value1");
   is(localStorage.length, 1, "The storage has one key-value pair");
   is(localStorage.key(0), "key1");
   is(localStorage.key(-1), null, "key() should return null for out-of-bounds access");
   is(localStorage.key(1), null, "key() should return null for out-of-bounds access");
 
@@ -75,18 +75,18 @@ function startTest()
 
   // remove the previously added key and check the storage is empty
   localStorage.removeItem("key1");
   is(localStorage.length, 0, "The storage is empty [2]");
   is(localStorage.key(0), null, "key() should return null for out-of-bounds access");
   is(localStorage.getItem("key1"), null, "\'key1\' removed");
 
   is(typeof localStorage.getItem("key1"), "object", "getItem('key1') is object");
-  is(typeof localStorage["key1"], "object", "['key1'] is object");
-  is(typeof localStorage.key1, "object", "key1 is object");
+  is(typeof localStorage["key1"], "undefined", "['key1'] is object");
+  is(typeof localStorage.key1, "undefined", "key1 is object");
 
   // add one key, check it is there
   localStorage.setItem("key1", "value1");
   is(localStorage.length, 1, "The storage has one key-value pair");
   is(localStorage.key(0), "key1");
   is(localStorage.getItem("key1"), "value1");
 
   // add a second key
@@ -154,16 +154,44 @@ function startTest()
   is(localStorage["testC"], "valueC");
   is(localStorage.getItem("testC"), "valueC");
   
   localStorage.setItem("testC", "valueC2");
   is(localStorage.testC, "valueC2");
   is(localStorage["testC"], "valueC2");
   is(localStorage.getItem("testC"), "valueC2");
   
+  localStorage.setItem("testC", null);
+  is("testC" in localStorage, true);
+  is(localStorage.getItem("testC"), "null");
+  is(localStorage["testC"], "null");
+  is(localStorage.testC, "null");
+
+  localStorage.removeItem("testC");
+  localStorage["testC"] = null;
+  is("testC" in localStorage, true);
+  is(localStorage.getItem("testC"), "null");
+  is(localStorage["testC"], "null");
+  is(localStorage.testC, "null");
+
+  localStorage.setItem(null, "test");
+  is("null" in localStorage, true);
+  is(localStorage.getItem("null"), "test");
+  is(localStorage.getItem(null), "test");
+  is(localStorage["null"], "test");
+  localStorage.removeItem(null, "test");
+  // bug 350023
+  todo_is("null" in localStorage, false);
+
+  localStorage.setItem(null, "test");
+  is("null" in localStorage, true);
+  localStorage.removeItem("null", "test");
+  // bug 350023
+  todo_is("null" in localStorage, false);
+
   // Clear the storage
   localStorage.clear();
   is("testB" in localStorage, false, "Keys are not in the JS scope of the storage");
   is("testC" in localStorage, false, "Keys are not in the JS scope of the storage");
   is(localStorage.length, 0, "The storage is empty [3]");
   is(localStorage.key(0), null, "key() should return null for out-of-bounds access");
   is(localStorage.key(-1), null, "key() should return null for out-of-bounds access");
   is(localStorage.key(1), null, "key() should return null for out-of-bounds access");
--- a/dom/tests/mochitest/localstorage/test_localStorageBasePrivateBrowsing.html
+++ b/dom/tests/mochitest/localstorage/test_localStorageBasePrivateBrowsing.html
@@ -29,43 +29,43 @@ function doTest()
   is(localStorage.getItem("persistent"), null, "previous values are inaccessible");
 
   // Initially check the localStorage is empty
   is(localStorage.length, 0, "The storage is empty [1]");
   is(localStorage.key(0), null, "key() should return null for out-of-bounds access");
   is(localStorage.key(-1), null, "key() should return null for out-of-bounds access");
   is(localStorage.key(1), null, "key() should return null for out-of-bounds access");
   is(localStorage.getItem("nonexisting"), null, "Nonexisting item is null (getItem())");
-  is(localStorage["nonexisting"], null, "Nonexisting item is null (array access)");
-  is(localStorage.nonexisting, null, "Nonexisting item is null (property access)");
+  is(localStorage["nonexisting"], undefined, "Nonexisting item is null (array access)");
+  is(localStorage.nonexisting, undefined, "Nonexisting item is null (property access)");
   localStorage.removeItem("nonexisting"); // Just check there is no exception
 
   is(typeof localStorage.getItem("nonexisting"), "object", "getItem('nonexisting') is object");
-  is(typeof localStorage["nonexisting"], "object", "['nonexisting'] is object");
-  is(typeof localStorage.nonexisting, "object", "nonexisting is object");
+  is(typeof localStorage["nonexisting"], "undefined", "['nonexisting'] is undefined");
+  is(typeof localStorage.nonexisting, "undefined", "nonexisting is undefined");
   is(typeof localStorage.getItem("nonexisting2"), "object", "getItem('nonexisting2') is object");
-  is(typeof localStorage["nonexisting2"], "object", "['nonexisting2'] is object");
-  is(typeof localStorage.nonexisting2, "object", "nonexisting2 is object");
+  is(typeof localStorage["nonexisting2"], "undefined", "['nonexisting2'] is undefined");
+  is(typeof localStorage.nonexisting2, "undefined", "nonexisting2 is undefined");
 
   // add an empty-value key
   localStorage.setItem("empty", "");
   is(localStorage.getItem("empty"), "", "Empty value (getItem())");
   is(localStorage["empty"], "", "Empty value (array access)");
   is(localStorage.empty, "", "Empty value (property access)");
   is(typeof localStorage.getItem("empty"), "string", "getItem('empty') is string");
   is(typeof localStorage["empty"], "string", "['empty'] is string");
   is(typeof localStorage.empty, "string", "empty is string");
   localStorage.removeItem("empty");
   is(localStorage.length, 0, "The storage has no keys");
   is(localStorage.getItem("empty"), null, "empty item is null (getItem())");
-  is(localStorage["empty"], null, "empty item is null (array access)");
-  is(localStorage.empty, null, "empty item is null (property access)");
+  is(localStorage["empty"], null, "empty item is undefined (array access)");
+  is(localStorage.empty, null, "empty item is undefined (property access)");
   is(typeof localStorage.getItem("empty"), "object", "getItem('empty') is object");
-  is(typeof localStorage["empty"], "object", "['empty'] is object");
-  is(typeof localStorage.empty, "object", "empty is object");
+  is(typeof localStorage["empty"], "undefined", "['empty'] is undefined");
+  is(typeof localStorage.empty, "undefined", "empty is undefined");
 
   // add one key, check it is there
   localStorage.setItem("key1", "value1");
   is(localStorage.length, 1, "The storage has one key-value pair");
   is(localStorage.key(0), "key1");
   is(localStorage.key(-1), null, "key() should return null for out-of-bounds access");
   is(localStorage.key(1), null, "key() should return null for out-of-bounds access");
 
@@ -81,18 +81,18 @@ function doTest()
 
   // remove the previously added key and check the storage is empty
   localStorage.removeItem("key1");
   is(localStorage.length, 0, "The storage is empty [2]");
   is(localStorage.key(0), null, "key() should return null for out-of-bounds access");
   is(localStorage.getItem("key1"), null, "\'key1\' removed");
 
   is(typeof localStorage.getItem("key1"), "object", "getItem('key1') is object");
-  is(typeof localStorage["key1"], "object", "['key1'] is object");
-  is(typeof localStorage.key1, "object", "key1 is object");
+  is(typeof localStorage["key1"], "undefined", "['key1'] is undefined");
+  is(typeof localStorage.key1, "undefined", "key1 is undefined");
 
   // add one key, check it is there
   localStorage.setItem("key1", "value1");
   is(localStorage.length, 1, "The storage has one key-value pair");
   is(localStorage.key(0), "key1");
   is(localStorage.getItem("key1"), "value1");
 
   // add a second key
@@ -160,16 +160,44 @@ function doTest()
   is(localStorage["testC"], "valueC");
   is(localStorage.getItem("testC"), "valueC");
 
   localStorage.setItem("testC", "valueC2");
   is(localStorage.testC, "valueC2");
   is(localStorage["testC"], "valueC2");
   is(localStorage.getItem("testC"), "valueC2");
 
+  localStorage.setItem("testC", null);
+  is("testC" in localStorage, true);
+  is(localStorage.getItem("testC"), "null");
+  is(localStorage["testC"], "null");
+  is(localStorage.testC, "null");
+
+  localStorage.removeItem("testC");
+  localStorage["testC"] = null;
+  is("testC" in localStorage, true);
+  is(localStorage.getItem("testC"), "null");
+  is(localStorage["testC"], "null");
+  is(localStorage.testC, "null");
+
+  localStorage.setItem(null, "test");
+  is("null" in localStorage, true);
+  is(localStorage.getItem("null"), "test");
+  is(localStorage.getItem(null), "test");
+  is(localStorage["null"], "test");
+  localStorage.removeItem(null, "test");
+  // bug 350023
+  todo_is("null" in localStorage, false);
+
+  localStorage.setItem(null, "test");
+  is("null" in localStorage, true);
+  localStorage.removeItem("null", "test");
+  // bug 350023
+  todo_is("null" in localStorage, false);
+
   // Clear the storage
   localStorage.clear();
   is(localStorage.length, 0, "The storage is empty [3]");
   is(localStorage.key(0), null, "key() should return null for out-of-bounds access");
   is(localStorage.key(-1), null, "key() should return null for out-of-bounds access");
   is(localStorage.key(1), null, "key() should return null for out-of-bounds access");
   is(localStorage.getItem("nonexisting"), null, "Nonexisting item is null");
   is(localStorage.getItem("key1"), null, "key1 removed");
--- a/dom/tests/mochitest/localstorage/test_localStorageBaseSessionOnly.html
+++ b/dom/tests/mochitest/localstorage/test_localStorageBaseSessionOnly.html
@@ -20,43 +20,43 @@ function startTest()
 
 
   // Initially check the localStorage is empty
   is(localStorage.length, 0, "The storage is empty [1]");
   is(localStorage.key(0), null, "key() should return null for out-of-bounds access");
   is(localStorage.key(-1), null, "key() should return null for out-of-bounds access");
   is(localStorage.key(1), null, "key() should return null for out-of-bounds access");
   is(localStorage.getItem("nonexisting"), null, "Nonexisting item is null (getItem())");
-  is(localStorage["nonexisting"], null, "Nonexisting item is null (array access)");
-  is(localStorage.nonexisting, null, "Nonexisting item is null (property access)");
+  is(localStorage["nonexisting"], undefined, "Nonexisting item is undefined (array access)");
+  is(localStorage.nonexisting, undefined, "Nonexisting item is undefined (property access)");
   localStorage.removeItem("nonexisting"); // Just check there is no exception
 
   is(typeof localStorage.getItem("nonexisting"), "object", "getItem('nonexisting') is object");
-  is(typeof localStorage["nonexisting"], "object", "['nonexisting'] is object");
-  is(typeof localStorage.nonexisting, "object", "nonexisting is object");
+  is(typeof localStorage["nonexisting"], "undefined", "['nonexisting'] is undefined");
+  is(typeof localStorage.nonexisting, "undefined", "nonexisting is undefined");
   is(typeof localStorage.getItem("nonexisting2"), "object", "getItem('nonexisting2') is object");
-  is(typeof localStorage["nonexisting2"], "object", "['nonexisting2'] is object");
-  is(typeof localStorage.nonexisting2, "object", "nonexisting2 is object");
+  is(typeof localStorage["nonexisting2"], "undefined", "['nonexisting2'] is undefined");
+  is(typeof localStorage.nonexisting2, "undefined", "nonexisting2 is undefined");
 
   // add an empty-value key
   localStorage.setItem("empty", "");
   is(localStorage.getItem("empty"), "", "Empty value (getItem())");
   is(localStorage["empty"], "", "Empty value (array access)");
   is(localStorage.empty, "", "Empty value (property access)");
   is(typeof localStorage.getItem("empty"), "string", "getItem('empty') is string");
   is(typeof localStorage["empty"], "string", "['empty'] is string");
   is(typeof localStorage.empty, "string", "empty is string");
   localStorage.removeItem("empty");
   is(localStorage.length, 0, "The storage has no keys");
   is(localStorage.getItem("empty"), null, "empty item is null (getItem())");
-  is(localStorage["empty"], null, "empty item is null (array access)");
-  is(localStorage.empty, null, "empty item is null (property access)");
+  is(localStorage["empty"], undefined, "empty item is undefined (array access)");
+  is(localStorage.empty, undefined, "empty item is undefined (property access)");
   is(typeof localStorage.getItem("empty"), "object", "getItem('empty') is object");
-  is(typeof localStorage["empty"], "object", "['empty'] is object");
-  is(typeof localStorage.empty, "object", "empty is object");
+  is(typeof localStorage["empty"], "undefined", "['empty'] is undefined");
+  is(typeof localStorage.empty, "undefined", "empty is undefined");
 
   // add one key, check it is there
   localStorage.setItem("key1", "value1");
   is(localStorage.length, 1, "The storage has one key-value pair");
   is(localStorage.key(0), "key1");
   is(localStorage.key(-1), null, "key() should return null for out-of-bounds access");
   is(localStorage.key(1), null, "key() should return null for out-of-bounds access");
 
@@ -72,18 +72,18 @@ function startTest()
 
   // remove the previously added key and check the storage is empty
   localStorage.removeItem("key1");
   is(localStorage.length, 0, "The storage is empty [2]");
   is(localStorage.key(0), null, "key() should return null for out-of-bounds access");
   is(localStorage.getItem("key1"), null, "\'key1\' removed");
 
   is(typeof localStorage.getItem("key1"), "object", "getItem('key1') is object");
-  is(typeof localStorage["key1"], "object", "['key1'] is object");
-  is(typeof localStorage.key1, "object", "key1 is object");
+  is(typeof localStorage["key1"], "undefined", "['key1'] is undefined");
+  is(typeof localStorage.key1, "undefined", "key1 is undefined");
 
   // add one key, check it is there
   localStorage.setItem("key1", "value1");
   is(localStorage.length, 1, "The storage has one key-value pair");
   is(localStorage.key(0), "key1");
   is(localStorage.getItem("key1"), "value1");
 
   // add a second key
@@ -151,16 +151,44 @@ function startTest()
   is(localStorage["testC"], "valueC");
   is(localStorage.getItem("testC"), "valueC");
 
   localStorage.setItem("testC", "valueC2");
   is(localStorage.testC, "valueC2");
   is(localStorage["testC"], "valueC2");
   is(localStorage.getItem("testC"), "valueC2");
 
+  localStorage.setItem("testC", null);
+  is("testC" in localStorage, true);
+  is(localStorage.getItem("testC"), "null");
+  is(localStorage["testC"], "null");
+  is(localStorage.testC, "null");
+
+  localStorage.removeItem("testC");
+  localStorage["testC"] = null;
+  is("testC" in localStorage, true);
+  is(localStorage.getItem("testC"), "null");
+  is(localStorage["testC"], "null");
+  is(localStorage.testC, "null");
+
+  localStorage.setItem(null, "test");
+  is("null" in localStorage, true);
+  is(localStorage.getItem("null"), "test");
+  is(localStorage.getItem(null), "test");
+  is(localStorage["null"], "test");
+  localStorage.removeItem(null, "test");
+  // bug 350023
+  todo_is("null" in localStorage, false);
+
+  localStorage.setItem(null, "test");
+  is("null" in localStorage, true);
+  localStorage.removeItem("null", "test");
+  // bug 350023
+  todo_is("null" in localStorage, false);
+
   // Clear the storage
   localStorage.clear();
   is(localStorage.length, 0, "The storage is empty [3]");
   is(localStorage.key(0), null, "key() should return null for out-of-bounds access");
   is(localStorage.key(-1), null, "key() should return null for out-of-bounds access");
   is(localStorage.key(1), null, "key() should return null for out-of-bounds access");
   is(localStorage.getItem("nonexisting"), null, "Nonexisting item is null");
   is(localStorage.getItem("key1"), null, "key1 removed");
--- a/dom/tests/mochitest/sessionstorage/test_sessionStorageBase.html
+++ b/dom/tests/mochitest/sessionstorage/test_sessionStorageBase.html
@@ -17,26 +17,26 @@ function setup() {
 function startTest()
 {
   // Initially check the sessionStorage is empty
   is(sessionStorage.length, 0, "The storage is empty [1]");
   is(sessionStorage.key(0), null, "key() should return null for out-of-bounds access");
   is(sessionStorage.key(-1), null, "key() should return null for out-of-bounds access");
   is(sessionStorage.key(1), null, "key() should return null for out-of-bounds access");
   is(sessionStorage.getItem("nonexisting"), null, "Nonexisting item is null (getItem())");
-  is(sessionStorage["nonexisting"], null, "Nonexisting item is null (array access)");
-  is(sessionStorage.nonexisting, null, "Nonexisting item is null (property access)");
+  is(sessionStorage["nonexisting"], undefined, "Nonexisting item is undefined (array access)");
+  is(sessionStorage.nonexisting, undefined, "Nonexisting item is undefined (property access)");
   sessionStorage.removeItem("nonexisting"); // Just check there is no exception
 
   is(typeof sessionStorage.getItem("nonexisting"), "object", "getItem('nonexisting') is object");
-  is(typeof sessionStorage["nonexisting"], "object", "['nonexisting'] is object");
-  is(typeof sessionStorage.nonexisting, "object", "nonexisting is object");
+  is(typeof sessionStorage["nonexisting"], "undefined", "['nonexisting'] is undefined");
+  is(typeof sessionStorage.nonexisting, "undefined", "nonexisting is undefined");
   is(typeof sessionStorage.getItem("nonexisting2"), "object", "getItem('nonexisting2') is object");
-  is(typeof sessionStorage["nonexisting2"], "object", "['nonexisting2'] is object");
-  is(typeof sessionStorage.nonexisting2, "object", "nonexisting2 is object");
+  is(typeof sessionStorage["nonexisting2"], "undefined", "['nonexisting2'] is undefined");
+  is(typeof sessionStorage.nonexisting2, "undefined", "nonexisting2 is undefined");
 
   var mozStorageChangedReceived = 0;
   var sessionStorageCopy = sessionStorage;
 
   function onStorageChanged(e) {
     if (e.storageArea == sessionStorageCopy)
       mozStorageChangedReceived++;
   }
@@ -50,21 +50,21 @@ function startTest()
   is(sessionStorage["empty"], "", "Empty value (array access)");
   is(sessionStorage.empty, "", "Empty value (property access)");
   is(typeof sessionStorage.getItem("empty"), "string", "getItem('empty') is string");
   is(typeof sessionStorage["empty"], "string", "['empty'] is string");
   is(typeof sessionStorage.empty, "string", "empty is string");
   sessionStorage.removeItem("empty");
   is(sessionStorage.length, 0, "The storage has no keys");
   is(sessionStorage.getItem("empty"), null, "empty item is null (getItem())");
-  is(sessionStorage["empty"], null, "empty item is null (array access)");
-  is(sessionStorage.empty, null, "empty item is null (property access)");
+  is(sessionStorage["empty"], undefined, "empty item is undefined (array access)");
+  is(sessionStorage.empty, undefined, "empty item is undefined (property access)");
   is(typeof sessionStorage.getItem("empty"), "object", "getItem('empty') is object");
-  is(typeof sessionStorage["empty"], "object", "['empty'] is object");
-  is(typeof sessionStorage.empty, "object", "empty is object");
+  is(typeof sessionStorage["empty"], "undefined", "['empty'] is undefined");
+  is(typeof sessionStorage.empty, "undefined", "empty is undefined");
 
   // add one key, check it is there
   sessionStorage.setItem("key1", "value1");
   is(sessionStorage.length, 1, "The storage has one key-value pair");
   is(sessionStorage.key(0), "key1");
   is(sessionStorage.key(-1), null, "key() should return null for out-of-bounds access");
   is(sessionStorage.key(1), null, "key() should return null for out-of-bounds access");
 
@@ -80,18 +80,18 @@ function startTest()
 
   // remove the previously added key and check the storage is empty
   sessionStorage.removeItem("key1");
   is(sessionStorage.length, 0, "The storage is empty [2]");
   is(sessionStorage.key(0), null, "key() should return null for out-of-bounds access");
   is(sessionStorage.getItem("key1"), null, "\'key1\' removed");
 
   is(typeof sessionStorage.getItem("key1"), "object", "getItem('key1') is object");
-  is(typeof sessionStorage["key1"], "object", "['key1'] is object");
-  is(typeof sessionStorage.key1, "object", "key1 is object");
+  is(typeof sessionStorage["key1"], "undefined", "['key1'] is undefined");
+  is(typeof sessionStorage.key1, "undefined", "key1 is undefined");
 
   // add one key, check it is there
   sessionStorage.setItem("key1", "value1");
   is(sessionStorage.length, 1, "The storage has one key-value pair");
   is(sessionStorage.key(0), "key1");
   is(sessionStorage.getItem("key1"), "value1");
 
   // add a second key