Merge cvs-trunk-mirror to mozilla-central up through FF3RC2build2
authorBenjamin Smedberg <benjamin@smedbergs.us>
Fri, 30 May 2008 12:08:47 -0400
changeset 15201 a61611c9992a4f57427da96bdc668713ae236ea1
parent 15150 c3fab88ef4f7e349b3fab748f2438834825df07e (current diff)
parent 15200 9a2801dccb5dff9e14056960bead0c73437174ec (diff)
child 15202 75f25ddb2329cb136a20d6f139f530e0b1e05c76
push id1
push userroot
push dateTue, 26 Apr 2011 22:38:44 +0000
treeherdermozilla-beta@bfdb6e623a36 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone1.9.1a1pre
Merge cvs-trunk-mirror to mozilla-central up through FF3RC2build2
client.mk
client.py
config/rules.mk
configure.in
js/src/Makefile.in
js/src/jsinterp.cpp
js/src/jsparse.cpp
--- a/accessible/src/base/nsDocAccessible.cpp
+++ b/accessible/src/base/nsDocAccessible.cpp
@@ -1523,18 +1523,18 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
     nsCOMPtr<nsIAccessible> accessible;
     accessibleEvent->GetAccessible(getter_AddRefs(accessible));
     nsCOMPtr<nsIDOMNode> domNode;
     accessibleEvent->GetDOMNode(getter_AddRefs(domNode));
     PRUint32 eventType = nsAccEvent::EventType(accessibleEvent);
     PRBool isFromUserInput = nsAccEvent::IsFromUserInput(accessibleEvent);
 
     if (domNode == gLastFocusedNode &&
-        eventType == nsIAccessibleEvent::EVENT_ASYNCH_HIDE || 
-        eventType == nsIAccessibleEvent::EVENT_ASYNCH_SHOW) {
+        (eventType == nsIAccessibleEvent::EVENT_ASYNCH_HIDE || 
+        eventType == nsIAccessibleEvent::EVENT_ASYNCH_SHOW)) {
       // If frame type didn't change for this event, then we don't actually need to invalidate
       // However, we only keep track of the old frame type for the focus, where it's very
       // important not to destroy and recreate the accessible for minor style changes,
       // such as a:focus { overflow: scroll; }
       nsCOMPtr<nsIContent> focusContent(do_QueryInterface(domNode));
       if (focusContent) {
         nsIFrame *focusFrame = presShell->GetRealPrimaryFrameFor(focusContent);
         nsIAtom *newFrameType =
--- a/browser/app/Makefile.in
+++ b/browser/app/Makefile.in
@@ -71,19 +71,16 @@ GRE_MILESTONE = $(shell $(PYTHON) $(tops
 GRE_BUILDID = $(shell $(PYTHON) $(topsrcdir)/config/printconfigsetting.py $(LIBXUL_DIST)/bin/platform.ini Build BuildID)
 
 DEFINES += -DGRE_MILESTONE=$(GRE_MILESTONE) -DGRE_BUILDID=$(GRE_BUILDID)
 
 ifdef MOZ_MEMORY
 ifneq ($(OS_ARCH),WINNT)
 LIBS += -ljemalloc
 endif
-ifeq ($(OS_ARCH),SunOS)
-SOLARIS_JEMALLOC_LDFLAGS = -L$(LIBXUL_DIST)/bin -lxul
-endif
 endif
 
 ifdef LIBXUL_SDK
 include $(topsrcdir)/config/rules.mk
 else
 # Build a binary bootstrapping with XRE_main
 
 ifeq ($(USE_SHORT_LIBNAME), 1)
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -479,17 +479,17 @@ pref("accessibility.typeaheadfind", fals
 pref("accessibility.typeaheadfind.timeout", 5000);
 pref("accessibility.typeaheadfind.linksonly", false);
 pref("accessibility.typeaheadfind.flashBar", 1);
 
 // Disable the default plugin for firefox
 pref("plugin.default_plugin_disabled", true);
 
 // plugin finder service url
-pref("pfs.datasource.url", "https://pfs.mozilla.org/plugins/PluginFinderService.php?mimetype=%PLUGIN_MIMETYPE%&appID=%APP_ID%&appVersion=%APP_VERSION%&clientOS=%CLIENT_OS%&chromeLocale=%CHROME_LOCALE%");
+pref("pfs.datasource.url", "https://pfs.mozilla.org/plugins/PluginFinderService.php?mimetype=%PLUGIN_MIMETYPE%&appID=%APP_ID%&appVersion=%APP_VERSION%&clientOS=%CLIENT_OS%&chromeLocale=%CHROME_LOCALE%&appRelease=%APP_RELEASE%");
 
 // by default we show an infobar message when pages require plugins the user has not installed
 pref("plugins.hide_infobar_for_missing_plugin", false);
 
 #ifdef XP_WIN
 pref("browser.preferences.instantApply", false);
 #else
 pref("browser.preferences.instantApply", true);
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -2544,23 +2544,18 @@ function FillInHTMLTooltip(tipElement)
   }
 
   return retVal;
 }
 
 var proxyIconDNDObserver = {
   onDragStart: function (aEvent, aXferData, aDragAction)
     {
-      var value = gURLBar.value;
-      // XXX - do we want to allow the user to set a blank page to their homepage?
-      //       if so then we want to modify this a little to set about:blank as
-      //       the homepage in the event of an empty urlbar.
-      if (!value) return;
-
-      var urlString = value + "\n" + window.content.document.title;
+      var value = content.location.href;
+      var urlString = value + "\n" + content.document.title;
       var htmlString = "<a href=\"" + value + "\">" + value + "</a>";
 
       aXferData.data = new TransferData();
       aXferData.data.addDataForFlavour("text/x-moz-url", urlString);
       aXferData.data.addDataForFlavour("text/unicode", value);
       aXferData.data.addDataForFlavour("text/html", htmlString);
 
       // we're copying the URL from the proxy icon, not moving
--- a/browser/components/places/content/toolbar.xml
+++ b/browser/components/places/content/toolbar.xml
@@ -757,58 +757,67 @@
         // dragging over this menu--insertion point, child index to drop
         // before, and folder to drop into.
         _getDropPoint: function TBV_DO_getDropPoint(event) {
           // Can't drop if the toolbar isn't a folder.
           var result = this._self.getResult();
           if (!PlacesUtils.nodeIsFolder(result.root))
             return null;
 
+          var isRTL = document.defaultView
+                              .getComputedStyle(this._self.parentNode, "")
+                              .direction == "rtl";
+
           var dropPoint = { ip: null, beforeIndex: null, folderNode: null };
           // Loop through all the nodes to see which one this should
           // get dropped in/next to
           for (var i = 0; i < this._self.childNodes.length; i++) {
             var xulNode = this._self.childNodes[i];
             if (PlacesUtils.nodeIsFolder(xulNode.node) &&
                 !PlacesUtils.nodeIsReadOnly(xulNode.node)) {
               // This is a folder. If the mouse is in the left 25% of the
-              // node, drop to the left of the folder.  If it's in the middle
-              // 50%, drop into the folder.  If it's past that, drop to the right.
-              if (event.clientX < xulNode.boxObject.x + (xulNode.boxObject.width * 0.25)) {
+              // node (or 25% of the right, in RTL UI), drop before the folder.
+              // If it's in the middle 50%, drop into the folder. If it's past
+              // that, drop after.
+              if ((isRTL && event.clientX > xulNode.boxObject.x + (xulNode.boxObject.width * 0.75)) ||
+                  (!isRTL && event.clientX < xulNode.boxObject.x + (xulNode.boxObject.width * 0.25))) {
                 // Drop to the left of this folder.
                 dropPoint.ip =
                   new InsertionPoint(PlacesUtils.getConcreteItemId(result.root),
                                      i, -1);
                 dropPoint.beforeIndex = i;
                 return dropPoint;
               }
-              else if (event.clientX < xulNode.boxObject.x + (xulNode.boxObject.width * 0.75)) {
+              else if ((isRTL && event.clientX > xulNode.boxObject.x + (xulNode.boxObject.width * 0.25)) ||
+                       (!isRTL && event.clientX < xulNode.boxObject.x + (xulNode.boxObject.width * 0.75))) {
                 // Drop inside this folder.
                 dropPoint.ip =
                   new InsertionPoint(PlacesUtils.getConcreteItemId(xulNode.node),
                                      -1, 1);
                 dropPoint.beforeIndex = i;
                 dropPoint.folderNode = xulNode;
                 return dropPoint;
               }
             }
             else {
-              // This is a non-folder node. If the mouse is left of the middle,
-              // drop to the left of the folder.  If it's right, drop to the right.
-              if (event.clientX < xulNode.boxObject.x + (xulNode.boxObject.width / 2)) {
-                // Drop to the left of this bookmark.
+              // This is a non-folder node. If the mouse is left (or right, in
+              // RTL UI) of the middle, drop before the folder.  Otehrwise,
+              // we'll drop after
+              if ((isRTL && event.clientX > xulNode.boxObject.x + (xulNode.boxObject.width / 2)) ||
+                  (!isRTL && event.clientX < xulNode.boxObject.x + (xulNode.boxObject.width / 2))) {
+                // Drop before this bookmark.
                 dropPoint.ip =
 	                new InsertionPoint(PlacesUtils.getConcreteItemId(result.root),
 	                                   i, -1);
                 dropPoint.beforeIndex = i;
                 return dropPoint;
               }
             }
           }
-          // Should drop to the right of the last node.
+          // Should drop after the last node.
           dropPoint.ip =
         	  new InsertionPoint(PlacesUtils.getConcreteItemId(result.root),
 	                             -1, 1);
           dropPoint.beforeIndex = -1;
           return dropPoint;
         },
         
         onDragStart: function TBV_DO_onDragStart(event, xferData, dragAction) {
@@ -888,22 +897,29 @@
                 ind.style.marginLeft = this._self.lastChild.boxObject.x + 
                                        this._self.lastChild.boxObject.width - this._self.boxObject.x - halfInd + 'px';
               else
                 ind.style.marginLeft = this._self.childNodes[dropPoint.beforeIndex].boxObject.x -
                                        this._self.boxObject.x - halfInd + 'px';
             }
             else {
               halfInd = Math.floor(halfInd);
-              if (dropPoint.beforeIndex == -1 || !this._self.childNodes.length)
-                ind.style.marginRight = '0px';
-              else
-                ind.style.marginRight = (this._self.childNodes[this._self.childNodes.length - 1].boxObject.x +
-                                         this._self.childNodes[this._self.childNodes.length - 1].boxObject.width) -
-                                        (this._self.childNodes[dropPoint.beforeIndex].boxObject.x) - halfInd + 'px';
+              if (this._self.childNodes.length == 0)
+                ind.style.marginRight = this._self.boxObject.width + 'px';
+              else if (dropPoint.beforeIndex == -1) {
+                ind.style.marginRight = this._self.boxObject.width -
+                                        (this._self.childNodes[this._self.childNodes.length - 1].boxObject.x +
+                                        halfInd) +'px';
+              }
+              else {
+                ind.style.marginRight = this._self.boxObject.width -
+                                        (this._self.childNodes[dropPoint.beforeIndex].boxObject.x +
+                                        this._self.childNodes[dropPoint.beforeIndex].boxObject.width -
+                                        this._self.boxObject.x + halfInd) + 'px';
+              }
             }
             // Clear out old folder information
             this._clearOverFolder();
           }
         },
 
         onDrop: function TBV_DO_onDrop(event, dropData, session) {
           var dropPoint = this._getDropPoint(event);
--- a/browser/installer/removed-files.in
+++ b/browser/installer/removed-files.in
@@ -605,20 +605,20 @@ init.d/README
 redo-prebinding.sh
 res/viewer.properties
 res/bloatcycle.html
 #endif
 #ifdef XP_UNIX
 #ifndef XP_MACOSX
 readme.txt
 chrome/icons/default/default.xpm
+dictionaries/PL.dic
+dictionaries/PL.aff
 #endif
 #endif
-dictionaries/PL.dic
-dictionaries/PL.aff
 #ifdef XP_WIN
 #ifdef MOZ_MEMORY
 Microsoft.VC80.CRT.manifest
 msvcm80.dll
 msvcp80.dll
 msvcr80.dll
 #else
 mozcrt19.dll
--- a/browser/locales/shipped-locales
+++ b/browser/locales/shipped-locales
@@ -32,16 +32,18 @@ nb-NO
 nl
 nn-NO
 pa-IN
 pl
 pt-BR
 pt-PT
 ro
 ru
+si
 sk
+sl
 sq
 sr
 sv-SE
 tr
 uk
 zh-CN
 zh-TW
--- a/browser/themes/gnomestripe/browser/browser.css
+++ b/browser/themes/gnomestripe/browser/browser.css
@@ -1076,20 +1076,16 @@ toolbar[iconsize="small"] #paste-button[
 }
 
 /* Go button */
 #go-button {
   padding: 3px 2px 2px 2px;
   list-style-image: url("chrome://browser/skin/Go-arrow.png");
 }
 
-#go-button[chromedir="rtl"] {
-  list-style-image: url("chrome://browser/skin/Go-arrow-rtl.png");
-}
-
 /* Star button */
 #star-button {
   padding: 1px;
   list-style-image: url("chrome://browser/skin/places/starPage.png");
 }
 
 #star-button[starred="true"] {
   list-style-image: url("chrome://browser/skin/places/pageStarred.png");
--- a/browser/themes/pinstripe/browser/browser.css
+++ b/browser/themes/pinstripe/browser/browser.css
@@ -92,21 +92,23 @@
 }
 
 #main-window:not([active="true"]) .tabbrowser-tab[selected="true"] > .tab-image-middle,
 #main-window:not([active="true"]) .tabbrowser-tab[selected="true"] > .tab-closebutton,
 #main-window:not([active="true"]) .tabbrowser-tab[selected="true"] > .tab-close-button {
   background-image: url("chrome://browser/skin/tabbrowser/tab-middle-inactive.png");
 }
 
-#main-window:not([active="true"]) .tabbrowser-tab[selected="true"] > .tab-image-left {
+#main-window:not([active="true"]) .tabbrowser-tab[selected="true"] > .tab-image-left,
+#main-window:not([active="true"]) .tabbrowser-tab[selected="true"][chromedir="rtl"] > .tab-image-right {
   background: url("chrome://browser/skin/tabbrowser/tab-left-inactive.png") no-repeat;
 }
 
-#main-window:not([active="true"]) .tabbrowser-tab[selected="true"] > .tab-image-right {
+#main-window:not([active="true"]) .tabbrowser-tab[selected="true"] > .tab-image-right,
+#main-window:not([active="true"]) .tabbrowser-tab[selected="true"][chromedir="rtl"] > .tab-image-left {
   background: url("chrome://browser/skin/tabbrowser/tab-right-inactive.png") no-repeat;
 }
 
 /* ----- SEARCH FIELD ----- */
 
 #wrapper-search-container #searchbar html|*.textbox-input {
   visibility: hidden;
 }
--- a/browser/themes/winstripe/browser/browser.css
+++ b/browser/themes/winstripe/browser/browser.css
@@ -1228,20 +1228,16 @@ statusbarpanel#statusbar-display {
 /* ::::: go button ::::: */
 
 #go-button {
   padding: 0 2px;
   list-style-image: url("chrome://browser/skin/Go-arrow.png");
   -moz-image-region: rect(0px 16px 16px 0px);
 }
 
-#go-button[chromedir="rtl"] {
-  list-style-image: url("chrome://browser/skin/Go-arrow-rtl.png");
-}
-
 #go-button:hover {
   -moz-image-region: rect(16px 16px 32px 0px);
 }
 
 /* star button */
 #star-button {
   padding: 0 2px;
   list-style-image: url("chrome://browser/skin/places/bookmark.png");
--- a/client.py
+++ b/client.py
@@ -1,12 +1,12 @@
 #!/usr/bin/python
 
 NSPR_CO_TAG = 'NSPR_4_7_1_RTM'
-NSS_CO_TAG  = 'NSS_3_12_RC3'
+NSS_CO_TAG  = 'NSS_3_12_RC4'
 
 NSPR_DIRS = ('nsprpub',)
 NSS_DIRS  = ('dbm',
              'security/nss',
              'security/coreconf',
              'security/dbm')
 
 # URL of the default hg repository to clone for Tamarin.
--- a/config/rules.mk
+++ b/config/rules.mk
@@ -1221,16 +1221,22 @@ endef
 
 MAKE_DEPS_AUTO_CC = $(MAKE_DEPS_AUTO)
 MAKE_DEPS_AUTO_CXX = $(MAKE_DEPS_AUTO)
 
 endif # COMPILER_DEPEND
 
 endif # MOZ_AUTO_DEPS
 
+ifdef MOZ_MEMORY
+ifeq ($(OS_ARCH),SunOS)
+SOLARIS_JEMALLOC_LDFLAGS = $(call EXPAND_LIBNAME_PATH,jemalloc,$(DIST)/lib)
+endif
+endif
+
 # Rules for building native targets must come first because of the host_ prefix
 host_%.$(OBJ_SUFFIX): %.c Makefile Makefile.in
 	$(REPORT_BUILD)
 	$(ELOG) $(HOST_CC) $(HOST_OUTOPTION)$@ -c $(HOST_CFLAGS) $(INCLUDES) $(NSPR_CFLAGS) $(_VPATH_SRCS)
 
 host_%.$(OBJ_SUFFIX): %.cpp Makefile Makefile.in
 	$(REPORT_BUILD)
 	$(ELOG) $(HOST_CXX) $(HOST_OUTOPTION)$@ -c $(HOST_CXXFLAGS) $(INCLUDES) $(NSPR_CFLAGS) $(_VPATH_SRCS)
--- a/configure.in
+++ b/configure.in
@@ -2114,17 +2114,17 @@ case "$target" in
             fi
         fi
         LIBIDL_LIBS="${LIBIDL_LIBS} ${GLIB_LIBS}"
         ;;
     esac 
 
 
     case "$host_os" in
-    cygwin*)
+    cygwin*|msvc*|mks*)
         AC_MSG_WARN([Using a cygwin build environment is unsupported. Configure cannot check for the presence of necessary headers. Please upgrade to MozillaBuild; see http://developer.mozilla.org/en/docs/Windows_Build_Prerequisites])
         ;;
 
     *)
         AC_CHECK_HEADERS(mmintrin.h oleacc.idl)
 
         AC_LANG_SAVE
         AC_LANG_CPLUSPLUS
--- a/content/base/src/nsScriptLoader.cpp
+++ b/content/base/src/nsScriptLoader.cpp
@@ -532,18 +532,22 @@ nsScriptLoader::EvaluateScript(nsScriptL
 {
   nsresult rv = NS_OK;
 
   // We need a document to evaluate scripts.
   if (!mDocument) {
     return NS_ERROR_FAILURE;
   }
 
-  nsIScriptGlobalObject *globalObject = mDocument->GetScriptGlobalObject();
-  NS_ENSURE_TRUE(globalObject, NS_ERROR_FAILURE);
+  nsPIDOMWindow *pwin = mDocument->GetInnerWindow();
+  if (!pwin || !pwin->IsInnerWindow()) {
+    return NS_ERROR_FAILURE;
+  }
+  nsCOMPtr<nsIScriptGlobalObject> globalObject = do_QueryInterface(pwin);
+  NS_ASSERTION(globalObject, "windows must be global objects");
 
   // Get the script-type to be used by this element.
   nsCOMPtr<nsIContent> scriptContent(do_QueryInterface(aRequest->mElement));
   NS_ASSERTION(scriptContent, "no content - what is default script-type?");
   PRUint32 stid = scriptContent ? scriptContent->GetScriptTypeID() :
                                   nsIProgrammingLanguage::JAVASCRIPT;
   // and make sure we are setup for this type of script.
   rv = globalObject->EnsureScriptEnvironment(stid);
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -6711,31 +6711,31 @@ nsDocShell::InternalLoad(nsIURI * aURI,
         }
 
         return NS_ERROR_CONTENT_BLOCKED;
     }
 
     nsCOMPtr<nsISupports> owner(aOwner);
     //
     // Get an owner from the current document if necessary.  Note that we only
-    // do this for URIs that inherit a security context; in particular we do
-    // NOT do this for about:blank.  This way, random about:blank loads that
-    // have no owner (which basically means they were done by someone from
-    // chrome manually messing with our nsIWebNavigation or by C++ setting
-    // document.location) don't get a funky principal.  If callers want
-    // something interesting to happen with the about:blank principal in this
-    // case, they should pass an owner in.
+    // do this for URIs that inherit a security context and local file URIs;
+    // in particular we do NOT do this for about:blank.  This way, random
+    // about:blank loads that have no owner (which basically means they were
+    // done by someone from chrome manually messing with our nsIWebNavigation
+    // or by C++ setting document.location) don't get a funky principal.  If
+    // callers want something interesting to happen with the about:blank
+    // principal in this case, they should pass an owner in.
     //
     {
         PRBool inherits;
         // One more twist: Don't inherit the owner for external loads.
         if (aLoadType != LOAD_NORMAL_EXTERNAL && !owner &&
             (aFlags & INTERNAL_LOAD_FLAGS_INHERIT_OWNER) &&
-            NS_SUCCEEDED(URIInheritsSecurityContext(aURI, &inherits)) &&
-            inherits) {
+            ((NS_SUCCEEDED(URIInheritsSecurityContext(aURI, &inherits)) &&
+              inherits) || URIIsLocalFile(aURI))) {
 
             // Don't allow loads that would inherit our security context
             // if this document came from an unsafe channel.
             nsCOMPtr<nsIDocShellTreeItem> treeItem = this;
             do {
                 nsCOMPtr<nsIDocShell> itemDocShell =
                     do_QueryInterface(treeItem);
                 PRBool isUnsafe;
--- a/editor/libeditor/base/nsEditor.cpp
+++ b/editor/libeditor/base/nsEditor.cpp
@@ -1294,21 +1294,23 @@ NS_IMETHODIMP nsEditor::GetInlineSpellCh
 
   if (mDidPreDestroy) {
     // Don't allow people to get or create the spell checker once the editor
     // is going away.
     *aInlineSpellChecker = nsnull;
     return autoCreate ? NS_ERROR_NOT_AVAILABLE : NS_OK;
   }
 
+  nsresult rv;
   if (!mInlineSpellChecker && autoCreate) {
-    nsresult rv;
     mInlineSpellChecker = do_CreateInstance(MOZ_INLINESPELLCHECKER_CONTRACTID, &rv);
     NS_ENSURE_SUCCESS(rv, rv);
-
+  }
+
+  if (mInlineSpellChecker) {
     rv = mInlineSpellChecker->Init(this);
     if (NS_FAILED(rv))
       mInlineSpellChecker = nsnull;
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
   NS_IF_ADDREF(*aInlineSpellChecker = mInlineSpellChecker);
 
--- a/editor/ui/composer/content/pref-composer.xul
+++ b/editor/ui/composer/content/pref-composer.xul
@@ -38,19 +38,17 @@
  ***** END LICENSE BLOCK ***** -->
 
 <?xml-stylesheet href="chrome://communicator/skin/" type="text/css"?>
 <?xul-overlay href="chrome://global/content/globalOverlay.xul"?>
 
 <!DOCTYPE overlay SYSTEM "chrome://editor/locale/pref-composer.dtd">
 
 <overlay xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-  <prefpane id="composer_pane"
-            label="&pref.composer.title;"
-            script="chrome://editor/content/EdDialogCommon.js chrome://editor/content/editorUtilities.js">
+  <prefpane id="composer_pane" label="&pref.composer.title;">
 
     <preferences id="composer_preferences">
       <preference id="editor.history.url_maximum"
                   name="editor.history.url_maximum"
                   type="int"/>
       <preference id="editor.prettyprint"
                   name="editor.prettyprint"
                   type="bool"
@@ -75,21 +73,24 @@
     <!-- Recent files menu -->
     <groupbox>
       <caption label="&recentFiles.title;"/>
       <hbox align="center">
         <label value="&documentsInMenu.label;"
                accesskey="&documentsInMenu.accesskey;"
                control="recentFiles"/>
         <textbox id="recentFiles"
-                 name="recent string" 
-                 size="3" 
-                 value="10" 
-                 preference="editor.history.url_maximum" 
-                 oninput=" ValidateNumber(this, null, 0, 99); LimitStringLength('recentFiles',2);"/>
+                 name="recent string"
+                 type="number"
+                 max="99"
+                 min="0"
+                 maxlength="2"
+                 size="3"
+                 value="10"
+                 preference="editor.history.url_maximum"/>
       </hbox>
     </groupbox>
 
     <!-- HTML formatting on output -->
     <groupbox>
       <caption label="&savingFiles.title;"/>
       <checkbox id="preserveFormatting"
                 label="&preserveExisting.label;"
--- a/editor/ui/dialogs/content/EdAEHTMLAttributes.js
+++ b/editor/ui/dialogs/content/EdAEHTMLAttributes.js
@@ -298,18 +298,18 @@ function onInputHTMLAttributeValue()
     return;
 
   // Trim spaces only from left since we must allow spaces within the string
   //  (we always reset the input field's value below)
   var value = TrimStringLeft(gDialog.AddHTMLAttributeValueInput.value);
   if (value)
   {
     // Do value filtering based on type of attribute
-    // (Do not use "LimitStringLength()" and "forceInteger()"
-    //  to avoid multiple reseting of input's value and flickering)
+    // (Do not use "forceInteger()" to avoid multiple
+    //  resetting of input's value and flickering)
     var selectedItem = gDialog.AddHTMLAttributeNameInput.selectedItem;
 
     if (selectedItem)
     {
       if ( selectedItem.getAttribute("forceOneChar") == "true" &&
            value.length > 1 )
         value = value.slice(0, 1);
 
--- a/editor/ui/dialogs/content/EdDialogCommon.js
+++ b/editor/ui/dialogs/content/EdDialogCommon.js
@@ -268,27 +268,16 @@ function forceInteger(elementID)
     if (!stringIn) stringIn = "";
 
     // Write back only if changed
     if (stringIn != editField.value)
       editField.value = stringIn;
   }
 }
 
-function LimitStringLength(elementID, length)
-{
-  var editField = document.getElementById( elementID );
-  if ( !editField )
-    return;
-
-  var stringIn = editField.value;
-  if (stringIn && stringIn.length > length)
-    editField.value = stringIn.slice(0,length);
-}
-
 function InitPixelOrPercentMenulist(elementForAtt, elementInDoc, attribute, menulistID, defaultIndex)
 {
   if (!defaultIndex) defaultIndex = gPixel;
 
   // var size  = elementForAtt.getAttribute(attribute);
   var size = GetHTMLOrCSSStyleValue(elementForAtt, attribute, attribute)
   var menulist = document.getElementById(menulistID);
   var pixelItem;
--- a/gfx/src/thebes/nsThebesDeviceContext.cpp
+++ b/gfx/src/thebes/nsThebesDeviceContext.cpp
@@ -235,18 +235,24 @@ nsThebesDeviceContext::SetDPI()
 
     NS_ASSERTION(dpi != -1, "no dpi set");
 
     if (dotsArePixels) {
         // First figure out the closest multiple of 96, which is the number of
         // dev pixels per CSS pixel.  Then, divide that into AppUnitsPerCSSPixel()
         // to get the number of app units per dev pixel.  The PR_MAXes are to
         // make sure we don't end up dividing by zero.
-        mAppUnitsPerDevNotScaledPixel = PR_MAX(1, AppUnitsPerCSSPixel() /
-                                        PR_MAX(1, dpi / 96));
+        PRUint32 roundedDPIScaleFactor = (dpi + 48)/96;
+#ifdef MOZ_WIDGET_GTK2
+        // be more conservative about activating scaling on GTK2, since the dpi
+        // information is more likely to be wrong
+        roundedDPIScaleFactor = dpi/96;
+#endif
+        mAppUnitsPerDevNotScaledPixel =
+          PR_MAX(1, AppUnitsPerCSSPixel() / PR_MAX(1, roundedDPIScaleFactor));
     } else {
         /* set mAppUnitsPerDevPixel so we're using exactly 72 dpi, even
          * though that means we have a non-integer number of device "pixels"
          * per CSS pixel
          */
         mAppUnitsPerDevNotScaledPixel = (AppUnitsPerCSSPixel() * 96) / dpi;
     }
 
--- a/gfx/thebes/public/gfxOS2Fonts.h
+++ b/gfx/thebes/public/gfxOS2Fonts.h
@@ -74,16 +74,18 @@ protected:
     virtual PRBool SetupCairoFont(gfxContext *aContext);
 
 private:
     cairo_font_face_t *mFontFace;
     cairo_scaled_font_t *mScaledFont;
     Metrics *mMetrics;
     gfxFloat mAdjustedSize;
     PRUint32 mSpaceGlyph;
+    int mHinting;
+    PRBool mAntialias;
 };
 
 
 class THEBES_API gfxOS2FontGroup : public gfxFontGroup {
 public:
     gfxOS2FontGroup(const nsAString& aFamilies, const gfxFontStyle* aStyle);
     virtual ~gfxOS2FontGroup();
 
--- a/gfx/thebes/src/gfxOS2Fonts.cpp
+++ b/gfx/thebes/src/gfxOS2Fonts.cpp
@@ -42,30 +42,50 @@
 #include "gfxContext.h"
 
 #include "gfxOS2Platform.h"
 #include "gfxOS2Surface.h"
 #include "gfxOS2Fonts.h"
 
 #include "nsIServiceManager.h"
 #include "nsIPlatformCharset.h"
+#include "nsIPrefBranch.h"
+#include "nsIPrefService.h"
 
 /**********************************************************************
  * class gfxOS2Font
  **********************************************************************/
 
 gfxOS2Font::gfxOS2Font(const nsAString &aName, const gfxFontStyle *aFontStyle)
     : gfxFont(aName, aFontStyle),
       mFontFace(nsnull), mScaledFont(nsnull),
-      mMetrics(nsnull), mAdjustedSize(0)
+      mMetrics(nsnull), mAdjustedSize(0),
+      mHinting(FC_HINT_MEDIUM), mAntialias(FcTrue)
 {
 #ifdef DEBUG_thebes_2
     printf("gfxOS2Font[%#x]::gfxOS2Font(\"%s\", aFontStyle)\n",
            (unsigned)this, NS_LossyConvertUTF16toASCII(aName).get());
 #endif
+    // try to get the preferences for hinting, antialias, and embolden options
+    nsCOMPtr<nsIPrefBranch> prefbranch = do_GetService(NS_PREFSERVICE_CONTRACTID);
+    if (prefbranch) {
+        int value;
+        nsresult rv = prefbranch->GetIntPref("gfx.os2.font.hinting", &value);
+        if (NS_SUCCEEDED(rv) && value >= FC_HINT_NONE && value <= FC_HINT_FULL)
+            mHinting = value;
+
+        PRBool enabled;
+        rv = prefbranch->GetBoolPref("gfx.os2.font.antialiasing", &enabled);
+        if (NS_SUCCEEDED(rv))
+            mAntialias = enabled;
+    }
+#ifdef DEBUG_thebes_2
+    printf("  font display options: hinting=%d, antialiasing=%s\n",
+           mHinting, mAntialias ? "on" : "off");
+#endif
 }
 
 gfxOS2Font::~gfxOS2Font()
 {
 #ifdef DEBUG_thebes_2
     printf("gfxOS2Font[%#x]::~gfxOS2Font()\n", (unsigned)this);
 #endif
     if (mFontFace) {
@@ -313,23 +333,30 @@ cairo_font_face_t *gfxOS2Font::CairoFont
         FcPatternGetDouble(fcMatch, FC_PIXEL_SIZE, 0, &s2);
         printf("  input=%s,%d,%d,%f\n  fcPattern=%s,%d,%d,%f\n  fcMatch=%s,%d,%d,%f\n",
                NS_LossyConvertUTF16toASCII(mName).get(),
                GetStyle()->weight, GetStyle()->style, GetStyle()->size,
                (char *)str1, w1, i1, s1,
                (char *)str2, w2, i2, s2);
 #endif
         FcPatternDestroy(fcPattern);
+
         if (mName == NS_LITERAL_STRING("Workplace Sans") && fcW >= FC_WEIGHT_DEMIBOLD) {
             // if we are dealing with Workplace Sans and want a bold font, we
             // need to artificially embolden it (no bold counterpart yet)
             FcPatternAddBool(fcMatch, FC_EMBOLDEN, FcTrue);
+        } else {
+            // if we don't embolden, we can possibly switch off antialiasing
+            FcPatternAddBool(fcMatch, FC_ANTIALIAS, mAntialias);
         }
+        FcPatternAddInteger(fcMatch, FC_HINT_STYLE, mHinting);
+
         // and ask cairo to return a font face for this
         mFontFace = cairo_ft_font_face_create_for_pattern(fcMatch);
+
         FcPatternDestroy(fcMatch);
     }
 
     NS_ASSERTION(mFontFace, "Failed to make font face");
     return mFontFace;
 }
 
 cairo_scaled_font_t *gfxOS2Font::CairoScaledFont()
--- a/gfx/thebes/src/gfxWindowsFonts.cpp
+++ b/gfx/thebes/src/gfxWindowsFonts.cpp
@@ -827,34 +827,47 @@ gfxWindowsFontGroup::gfxWindowsFontGroup
             mFonts.RemoveElementAt(0);
             continue;
         }
         mFonts[0] = font;
         break;
     }
 
     if (mFontEntries.Length() == 0) {
-        // Should append default GUI font if there are no available fonts.
+        // It is pretty important that we have at least one font, so
+        // try a few system fonts that should be there.
+        nsAutoString str;
         HGDIOBJ hGDI = ::GetStockObject(DEFAULT_GUI_FONT);
         LOGFONTW logFont;
-        if (!hGDI ||
-            !::GetObjectW(hGDI, sizeof(logFont), &logFont)) {
-            NS_ERROR("Failed to create font group");
-            return;
+        if (hGDI && ::GetObjectW(hGDI, sizeof(logFont), &logFont)) {
+            str.AppendLiteral("\"");
+            str.Append(nsDependentString(logFont.lfFaceName));
+            str.AppendLiteral("\"");
         }
-        nsRefPtr<FontEntry> fe = gfxWindowsPlatform::GetPlatform()->FindFontEntry(nsDependentString(logFont.lfFaceName), *aStyle);
-        mFontEntries.AppendElement(fe);
+
+        NONCLIENTMETRICSW ncm;
+        ncm.cbSize = sizeof(ncm);
+        BOOL status = ::SystemParametersInfoW(SPI_GETNONCLIENTMETRICS, 
+                                              sizeof(ncm), &ncm, 0);
+        if (status) {
+            str.AppendLiteral(",\"");
+            str.Append(nsDependentString(ncm.lfMessageFont.lfFaceName));
+            str.AppendLiteral("\"");
+        }
+
+        FamilyListToArrayList(str, mStyle.langGroup, &mFontEntries);
+
         // Keep length of mFonts in sync with length of mFontEntries.
         // Maybe we should eagerly set up mFonts[0] like we do above,
         // but if the resulting gfxWindowsFont is invalid then we can't
         // do much anyway. In that case the font will return zero metrics,
         // its mUnknownCMAP will be set to true, and HasCharacter will
         // just report false for all characters, so the fact that the font
         // is bogus should not cause problems.
-        mFonts.AppendElements(1);
+        mFonts.AppendElements(mFontEntries.Length());
     }
 
     if (!mStyle.systemFont) {
         for (PRUint32 i = 0; i < mFontEntries.Length(); ++i) {
             if (mFontEntries[i]->IsBadUnderlineFont()) {
                 gfxFloat first = GetFontAt(0)->GetMetrics().underlineOffset;
                 gfxFloat bad = GetFontAt(i)->GetMetrics().underlineOffset;
                 mUnderlineOffset = PR_MIN(first, bad);
--- a/js/narcissus/jsparse.js
+++ b/js/narcissus/jsparse.js
@@ -50,16 +50,19 @@ for (i in opTypeNames) {
         opRegExpSrc += "|^";
     opRegExpSrc += i.replace(/[?|^&(){}\[\]+\-*\/\.]/g, "\\$&");
 }
 var opRegExp = new RegExp(opRegExpSrc);
 
 // A regexp to match floating point literals (but not integer literals).
 var fpRegExp = /^\d+\.\d*(?:[eE][-+]?\d+)?|^\d+(?:\.\d*)?[eE][-+]?\d+|^\.\d+(?:[eE][-+]?\d+)?/;
 
+// A regexp to match regexp literals.
+var reRegExp = /^\/((?:\\.|\[(?:\\.|[^\]])*\]|[^\/])+)\/([gimy]*)/;
+
 function Tokenizer(s, f, l) {
     this.cursor = 0;
     this.source = String(s);
     this.tokens = [];
     this.tokenIndex = 0;
     this.lookahead = 0;
     this.scanNewlines = false;
     this.scanOperand = true;
@@ -156,21 +159,20 @@ Tokenizer.prototype = {
             token.value = parseFloat(match[0]);
         } else if ((match = /^0[xX][\da-fA-F]+|^0[0-7]*|^\d+/(input))) {
             token.type = NUMBER;
             token.value = parseInt(match[0]);
         } else if ((match = /^[$_\w]+/(input))) {       // FIXME no ES3 unicode
             var id = match[0];
             token.type = keywords[id] || IDENTIFIER;
             token.value = id;
-        } else if ((match = /^"(?:\\.|[^"])*"|^'(?:[^']|\\.)*'/(input))) { //"){
+        } else if ((match = /^"(?:\\.|[^"])*"|^'(?:\\.|[^'])*'/(input))) { //"){
             token.type = STRING;
             token.value = eval(match[0]);
-        } else if (this.scanOperand &&
-                   (match = /^\/((?:\\.|[^\/])+)\/([gimy]*)/(input))) {
+        } else if (this.scanOperand && (match = reRegExp(input))) {
             token.type = REGEXP;
             token.value = new RegExp(match[1], match[2]);
         } else if ((match = opRegExp(input))) {
             var op = match[0];
             if (assignOps[op] && input[op.length] == '=') {
                 token.type = ASSIGN;
                 token.assignOp = GLOBAL[opTypeNames[op]];
                 match[0] += '=';
--- a/js/src/Makefile.in
+++ b/js/src/Makefile.in
@@ -200,16 +200,22 @@ SDK_LIBRARY = $(IMPORT_LIBRARY)
 else
 SDK_LIBRARY = $(SHARED_LIBRARY)
 endif
 
 include $(topsrcdir)/config/config.mk
 
 EXTRA_DSO_LDOPTS += $(NSPR_LIBS)
 
+ifdef MOZ_MEMORY
+ifeq ($(OS_ARCH),SunOS)
+EXTRA_DSO_LDOPTS += $(call EXPAND_LIBNAME_PATH,jemalloc,$(DIST)/lib)
+endif
+endif
+
 # When using gcc the assembly is inlined in the C-file (see jslock.cpp)
 ifeq ($(OS_ARCH),SunOS)
 ifneq (86,$(findstring 86,$(OS_TEST)))
 ifndef GNU_CC
 ASFILES		= lock_$(OS_ARCH).s
 endif
 endif
 endif
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -933,18 +933,19 @@ js_OnUnknownMethod(JSContext *cx, jsval 
     }
     if (JSVAL_IS_PRIMITIVE(tvr.u.value)) {
         vp[0] = tvr.u.value;
     } else {
 #if JS_HAS_XML_SUPPORT
         /* Extract the function name from function::name qname. */
         if (!JSVAL_IS_PRIMITIVE(vp[0])) {
             obj = JSVAL_TO_OBJECT(vp[0]);
-            if (!js_IsFunctionQName(cx, obj, &id))
-                return JS_FALSE;
+            ok = js_IsFunctionQName(cx, obj, &id);
+            if (!ok)
+                goto out;
             if (id != 0)
                 vp[0] = ID_TO_VALUE(id);
         }
 #endif
         obj = js_NewObject(cx, &js_NoSuchMethodClass, NULL, NULL, 0);
         if (!obj) {
             ok = JS_FALSE;
             goto out;
--- a/js/src/jsparse.cpp
+++ b/js/src/jsparse.cpp
@@ -285,17 +285,18 @@ NewOrRecycledNode(JSContext *cx, JSTreeC
             }
             break;
           case PN_TERNARY:
             RecycleTree(pn->pn_kid1, tc);
             RecycleTree(pn->pn_kid2, tc);
             RecycleTree(pn->pn_kid3, tc);
             break;
           case PN_BINARY:
-            RecycleTree(pn->pn_left, tc);
+            if (pn->pn_left != pn->pn_right)
+                RecycleTree(pn->pn_left, tc);
             RecycleTree(pn->pn_right, tc);
             break;
           case PN_UNARY:
             RecycleTree(pn->pn_kid, tc);
             break;
           case PN_NAME:
             RecycleTree(pn->pn_expr, tc);
             break;
--- a/js/src/xpconnect/src/xpcprivate.h
+++ b/js/src/xpconnect/src/xpcprivate.h
@@ -1386,24 +1386,17 @@ public:
     JSBool GetConstantValue(XPCCallContext& ccx, XPCNativeInterface* iface,
                             jsval* pval)
         {NS_ASSERTION(IsConstant(),
                       "Only call this if you're sure this is a constant!");
          if(!IsResolved() && !Resolve(ccx, iface)) return JS_FALSE;
          *pval = mVal; return JS_TRUE;}
 
     JSBool NewFunctionObject(XPCCallContext& ccx, XPCNativeInterface* iface,
-                             JSObject *parent, jsval* pval)
-        {NS_ASSERTION(!IsConstant(),
-                      "Only call this if you're sure this is not a constant!");
-         if(!IsResolved() && !Resolve(ccx, iface)) return JS_FALSE;
-         JSObject* funobj =
-            xpc_CloneJSFunction(ccx, JSVAL_TO_OBJECT(mVal), parent);
-         if(!funobj) return JS_FALSE;
-         *pval = OBJECT_TO_JSVAL(funobj); return JS_TRUE;}
+                             JSObject *parent, jsval* pval);
 
     JSBool IsMethod() const
         {return 0 != (mFlags & METHOD);}
 
     JSBool IsConstant() const
         {return 0 != (mFlags & CONSTANT);}
 
     JSBool IsAttribute() const
@@ -3231,16 +3224,18 @@ private:
     JSUint32             mWrappedNativeThreadsafetyReportDepth;
 #endif
     PRThread*            mThread;
 
     static PRLock*           gLock;
     static XPCPerThreadData* gThreads;
     static PRUintn           gTLSIndex;
 
+    friend class AutoJSSuspendNonMainThreadRequest;
+
     // Cached value of cx->thread on the main thread. 
     static void *sMainJSThread;
 
     // Cached per thread data for the main thread. Only safe to access
     // if cx->thread == sMainJSThread.
     static XPCPerThreadData *sMainThreadData;
 };
 
@@ -3507,34 +3502,33 @@ private:
     XPCCallContext& mCCX;
     JSContext* mCX;
 };
 
 class AutoJSSuspendRequest
 {
 public:
     AutoJSSuspendRequest(XPCCallContext& aCCX)
-      : mCCX(aCCX), mCX(aCCX.GetJSContext()) {SuspendRequest();}
+      : mCX(aCCX.GetJSContext()) {SuspendRequest();}
     ~AutoJSSuspendRequest() {ResumeRequest();}
 
     void ResumeRequest() {
         if(mCX) {
             JS_ResumeRequest(mCX, mDepth);
             mCX = nsnull;
         }
     }
 private:
     void SuspendRequest() {
         if(JS_GetContextThread(mCX))
             mDepth = JS_SuspendRequest(mCX);
         else
             mCX = nsnull;
     }
 private:
-    XPCCallContext& mCCX;
     JSContext* mCX;
     jsrefcount mDepth;
 };
 
 class AutoJSSuspendRequestWithNoCallContext
 {
 public:
     AutoJSSuspendRequestWithNoCallContext(JSContext *aCX)
@@ -3554,16 +3548,43 @@ private:
         else
             mCX = nsnull;
     }
 private:
     JSContext* mCX;
     jsrefcount mDepth;
 };
 
+class AutoJSSuspendNonMainThreadRequest
+{
+public:
+    AutoJSSuspendNonMainThreadRequest(JSContext *aCX)
+        : mCX(aCX) {SuspendRequest();}
+    ~AutoJSSuspendNonMainThreadRequest() {ResumeRequest();}
+
+    void ResumeRequest() {
+        if (mCX) {
+            JS_ResumeRequest(mCX, mDepth);
+            mCX = nsnull;
+        }
+    }
+
+private:
+    void SuspendRequest() {
+        if (mCX && mCX->thread != XPCPerThreadData::sMainJSThread)
+            mDepth = JS_SuspendRequest(mCX);
+        else
+            mCX = nsnull;
+    }
+
+    JSContext *mCX;
+    jsrefcount mDepth;
+};
+        
+
 /*****************************************/
 
 class AutoJSRequestWithNoCallContext
 {
 public:
     AutoJSRequestWithNoCallContext(JSContext* aCX) : mCX(aCX) {BeginRequest();}
     ~AutoJSRequestWithNoCallContext() {EndRequest();}
 
--- a/js/src/xpconnect/src/xpcwrappednative.cpp
+++ b/js/src/xpconnect/src/xpcwrappednative.cpp
@@ -2002,17 +2002,20 @@ XPCWrappedNative::CallMethod(XPCCallCont
            (!(obj = JSVAL_TO_OBJECT(argv[0]))) ||
            (!(iid = xpc_JSObjectToID(ccx, obj))))
         {
             ThrowBadParam(NS_ERROR_XPC_BAD_CONVERT_JS, 0, ccx);
             return JS_FALSE;
         }
 
         nsISupports* qiresult = nsnull;
-        invokeResult = callee->QueryInterface(*iid, (void**) &qiresult);
+        {
+            AutoJSSuspendNonMainThreadRequest req(ccx.GetJSContext());
+            invokeResult = callee->QueryInterface(*iid, (void**) &qiresult);
+        }
 
         xpcc->SetLastResult(invokeResult);
 
         if(NS_FAILED(invokeResult))
         {
             ThrowBadResult(invokeResult, ccx);
             return JS_FALSE;
         }
@@ -2379,18 +2382,21 @@ XPCWrappedNative::CallMethod(XPCCallCont
                     goto done;
                 }
             }
         }
     }
 
 
     // do the invoke
-    invokeResult = NS_InvokeByIndex(callee, vtblIndex, paramCount,
-                                    dispatchParams);
+    {
+        AutoJSSuspendNonMainThreadRequest req(ccx.GetJSContext());
+        invokeResult = NS_InvokeByIndex(callee, vtblIndex, paramCount,
+                                        dispatchParams);
+    }
 
     xpcc->SetLastResult(invokeResult);
 
     if(NS_FAILED(invokeResult))
     {
         ThrowBadResult(invokeResult, ccx);
         goto done;
     }
--- a/js/src/xpconnect/src/xpcwrappednativeinfo.cpp
+++ b/js/src/xpconnect/src/xpcwrappednativeinfo.cpp
@@ -105,16 +105,37 @@ XPCNativeMember::GetCallInfo(XPCCallCont
 
     *pInterface = (XPCNativeInterface*) JSVAL_TO_PRIVATE(ifaceVal);
     *pMember = (XPCNativeMember*) JSVAL_TO_PRIVATE(memberVal);
 
     return JS_TRUE;
 }
 
 JSBool
+XPCNativeMember::NewFunctionObject(XPCCallContext& ccx,
+                                   XPCNativeInterface* iface, JSObject *parent,
+                                   jsval* pval)
+{
+    NS_ASSERTION(!IsConstant(),
+                 "Only call this if you're sure this is not a constant!");
+    if(!IsResolved() && !Resolve(ccx, iface))
+        return JS_FALSE;
+
+    AUTO_MARK_JSVAL(ccx, &mVal);
+    JSObject* funobj =
+        xpc_CloneJSFunction(ccx, JSVAL_TO_OBJECT(mVal), parent);
+    if(!funobj)
+        return JS_FALSE;
+
+    *pval = OBJECT_TO_JSVAL(funobj);
+
+    return JS_TRUE;
+}
+
+JSBool
 XPCNativeMember::Resolve(XPCCallContext& ccx, XPCNativeInterface* iface)
 {
     if(IsConstant())
     {
         const nsXPTConstant* constant;
         if(NS_FAILED(iface->GetInterfaceInfo()->GetConstant(mIndex, &constant)))
             return JS_FALSE;
 
--- a/layout/base/nsDocumentViewer.cpp
+++ b/layout/base/nsDocumentViewer.cpp
@@ -2709,18 +2709,20 @@ DocumentViewerImpl::SetFullZoom(float aF
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 DocumentViewerImpl::GetFullZoom(float* aFullZoom)
 {
   NS_ENSURE_ARG_POINTER(aFullZoom);
+  // Check the prescontext first because it might have a temporary
+  // setting for print-preview
   nsPresContext* pc = GetPresContext();
-  *aFullZoom = pc ? pc->GetFullZoom() : 1.0f;
+  *aFullZoom = pc ? pc->GetFullZoom() : mPageZoom;
   return NS_OK;
 }
 
 static void
 SetChildAuthorStyleDisabled(nsIMarkupDocumentViewer* aChild, void* aClosure)
 {
   PRBool styleDisabled  = *static_cast<PRBool*>(aClosure);
   aChild->SetAuthorStyleDisabled(styleDisabled);
--- a/layout/generic/nsAbsoluteContainingBlock.cpp
+++ b/layout/generic/nsAbsoluteContainingBlock.cpp
@@ -176,17 +176,17 @@ nsAbsoluteContainingBlock::Reflow(nsCont
           kidFrame->SetNextSibling(nextFrame->GetNextSibling());
           nextFrame->SetNextSibling(nsnull);
         }
         // Add it as an overflow container.
         //XXXfr This is a hack to fix some of our printing dataloss.
         // See bug 154892. Not sure how to do it "right" yet; probably want
         // to keep continuations within an nsAbsoluteContainingBlock eventually.
         tracker.Insert(nextFrame, kidStatus);
-        reflowStatus = NS_FRAME_MERGE_INCOMPLETE(reflowStatus, kidStatus);
+        NS_MergeReflowStatusInto(&reflowStatus, kidStatus);
       }
       else {
         // Delete any continuations
         if (nextFrame) {
           tracker.Finish(kidFrame);
           static_cast<nsContainerFrame*>(nextFrame->GetParent())
             ->DeleteNextInFlowChild(aPresContext, nextFrame);
         }
@@ -200,17 +200,17 @@ nsAbsoluteContainingBlock::Reflow(nsCont
       }
     }
   }
   // Abspos frames can't cause their parent to be incomplete,
   // only overflow incomplete.
   if (NS_FRAME_IS_NOT_COMPLETE(reflowStatus))
     NS_FRAME_SET_OVERFLOW_INCOMPLETE(reflowStatus);
 
-  aReflowStatus = NS_FRAME_MERGE_INCOMPLETE(reflowStatus, aReflowStatus);
+  NS_MergeReflowStatusInto(&aReflowStatus, reflowStatus);
   return NS_OK;
 }
 
 static inline PRBool IsFixedPaddingSize(nsStyleUnit aUnit) {
   return aUnit == eStyleUnit_Coord || aUnit == eStyleUnit_Chars;
 }
 static inline PRBool IsFixedMarginSize(nsStyleUnit aUnit) {
   return aUnit == eStyleUnit_Coord || aUnit == eStyleUnit_Chars;
--- a/layout/generic/nsBlockFrame.cpp
+++ b/layout/generic/nsBlockFrame.cpp
@@ -3127,18 +3127,17 @@ nsBlockFrame::ReflowBlockFrame(nsBlockRe
             }
             else if (madeContinuation) {
               frame->SetNextSibling(nextFrame->GetNextSibling());
               nextFrame->SetNextSibling(nsnull);
             }
 
             // Put it in our overflow list
             aState.mOverflowTracker.Insert(nextFrame, frameReflowStatus);
-            aState.mReflowStatus = NS_FRAME_MERGE_INCOMPLETE(frameReflowStatus,
-                                     aState.mReflowStatus);
+            NS_MergeReflowStatusInto(&aState.mReflowStatus, frameReflowStatus);
 
 #ifdef NOISY_VERTICAL_MARGINS
             ListTag(stdout);
             printf(": reflow complete but overflow incomplete for ");
             nsFrame::ListTag(stdout, frame);
             printf(" prevBottomMargin=%d collapsedBottomMargin=%d\n",
                    aState.mPrevBottomMargin, collapsedBottomMargin.get());
 #endif
--- a/layout/generic/nsContainerFrame.cpp
+++ b/layout/generic/nsContainerFrame.cpp
@@ -1005,17 +1005,17 @@ nsContainerFrame::ReflowOverflowContaine
           // used to be a normal next-in-flow; steal it from the child list
           rv = static_cast<nsContainerFrame*>(nif->GetParent())
                  ->StealFrame(aPresContext, nif);
           NS_ENSURE_SUCCESS(rv, rv);
         }
 
         tracker.Insert(nif, frameStatus);
       }
-      aStatus = NS_FRAME_MERGE_INCOMPLETE(aStatus, frameStatus);
+      NS_MergeReflowStatusInto(&aStatus, frameStatus);
       // At this point it would be nice to assert !frame->GetOverflowRect().IsEmpty(),
       // but we have some unsplittable frames that, when taller than
       // availableHeight will push zero-height content into a next-in-flow.
     }
     else {
       tracker.Skip(frame, aStatus);
     }
     ConsiderChildOverflow(aOverflowRect, frame);
--- a/layout/generic/nsContainerFrame.h
+++ b/layout/generic/nsContainerFrame.h
@@ -520,18 +520,17 @@ public:
    * it MAY be called on other children, but it isn't necessary (doesn't
    * do anything).
    */
   void Skip(nsIFrame* aChild, nsReflowStatus& aReflowStatus)
   {
     NS_PRECONDITION(aChild, "null ptr");
     if (aChild == mSentry) {
       StepForward();
-      aReflowStatus = NS_FRAME_MERGE_INCOMPLETE(aReflowStatus,
-                                                NS_FRAME_OVERFLOW_INCOMPLETE);
+      NS_MergeReflowStatusInto(&aReflowStatus, NS_FRAME_OVERFLOW_INCOMPLETE);
     }
   }
 
 private:
 
   void SetUpListWalker();
   void StepForward();
 
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -275,16 +275,27 @@ nsIFrameDebug::RootFrameList(nsPresConte
         debugFrame->List(out, aIndent);
     }
   }
 }
 #endif
 // end nsIFrameDebug
 
 void
+NS_MergeReflowStatusInto(nsReflowStatus* aPrimary, nsReflowStatus aSecondary)
+{
+  *aPrimary |= aSecondary &
+    (NS_FRAME_NOT_COMPLETE | NS_FRAME_OVERFLOW_INCOMPLETE |
+     NS_FRAME_TRUNCATED | NS_FRAME_REFLOW_NEXTINFLOW);
+  if (*aPrimary & NS_FRAME_NOT_COMPLETE) {
+    *aPrimary &= ~NS_FRAME_OVERFLOW_INCOMPLETE;
+  }
+}
+
+void
 nsWeakFrame::Init(nsIFrame* aFrame)
 {
   Clear(mFrame ? mFrame->PresContext()->GetPresShell() : nsnull);
   mFrame = aFrame;
   if (mFrame) {
     nsIPresShell* shell = mFrame->PresContext()->GetPresShell();
     NS_WARN_IF_FALSE(shell, "Null PresShell in nsWeakFrame!");
     if (shell) {
--- a/layout/generic/nsIFrame.h
+++ b/layout/generic/nsIFrame.h
@@ -311,17 +311,17 @@ enum nsSpread {
  * NS_FRAME_OVERFLOW_INCOMPLETE bit flag means that the frame has
  * overflow that is not complete, but its own box is complete.
  * (This happens when content overflows a fixed-height box.)
  * The reflower should place and size the frame and continue its reflow,
  * but needs to create an overflow container as a continuation for this
  * frame. See nsContainerFrame.h for more information.
  * This bit is mutually exclusive with NS_FRAME_NOT_COMPLETE.
  * 
- * Please use the SET and MERGE macros below for handling
+ * Please use the SET macro for handling
  * NS_FRAME_NOT_COMPLETE and NS_FRAME_OVERFLOW_INCOMPLETE.
  *
  * NS_FRAME_REFLOW_NEXTINFLOW bit flag means that the next-in-flow is
  * dirty, and also needs to be reflowed. This status only makes sense
  * for a frame that is not complete, i.e. you wouldn't set both
  * NS_FRAME_COMPLETE and NS_FRAME_REFLOW_NEXTINFLOW.
  *
  * The low 8 bits of the nsReflowStatus are reserved for future extensions;
@@ -353,25 +353,16 @@ typedef PRUint32 nsReflowStatus;
 // These macros set or switch incompete statuses without touching th
 // NS_FRAME_REFLOW_NEXTINFLOW bit.
 #define NS_FRAME_SET_INCOMPLETE(status) \
   status = status & ~NS_FRAME_OVERFLOW_INCOMPLETE | NS_FRAME_NOT_COMPLETE
 
 #define NS_FRAME_SET_OVERFLOW_INCOMPLETE(status) \
   status = status & ~NS_FRAME_NOT_COMPLETE | NS_FRAME_OVERFLOW_INCOMPLETE
 
-// Combines two statuses and returns the most severe bits of the pair
-#define NS_FRAME_MERGE_INCOMPLETE(status1, status2)        \
-  ( (NS_FRAME_REFLOW_NEXTINFLOW & (status1 | status2))     \
-  | ( (NS_FRAME_NOT_COMPLETE & (status1 | status2))        \
-    ? NS_FRAME_NOT_COMPLETE                                \
-    : NS_FRAME_OVERFLOW_INCOMPLETE & (status1 | status2)   \
-    )                                                      \
-  )
-
 // This macro tests to see if an nsReflowStatus is an error value
 // or just a regular return value
 #define NS_IS_REFLOW_ERROR(_status) (PRInt32(_status) < 0)
 
 /**
  * Extensions to the reflow status bits defined by nsIFrameReflow
  */
 
@@ -424,16 +415,21 @@ typedef PRUint32 nsReflowStatus;
 // wasn't at the top of a page. If it was at the top of a page, then it is not 
 // possible to reflow it again with more height, so we don't set it in that case.
 #define NS_FRAME_TRUNCATED  0x0010
 #define NS_FRAME_IS_TRUNCATED(status) \
   (0 != ((status) & NS_FRAME_TRUNCATED))
 #define NS_FRAME_SET_TRUNCATION(status, aReflowState, aMetrics) \
   aReflowState.SetTruncated(aMetrics, &status);
 
+// Merge the incompleteness, truncation and NS_FRAME_REFLOW_NEXTINFLOW
+// status from aSecondary into aPrimary.
+void NS_MergeReflowStatusInto(nsReflowStatus* aPrimary,
+                              nsReflowStatus aSecondary);
+
 //----------------------------------------------------------------------
 
 /**
  * DidReflow status values.
  */
 typedef PRBool nsDidReflowStatus;
 
 #define NS_FRAME_REFLOW_NOT_FINISHED PR_FALSE
--- a/storage/src/mozStorageConnection.cpp
+++ b/storage/src/mozStorageConnection.cpp
@@ -43,16 +43,18 @@
 #include <stdio.h>
 
 #include "nsError.h"
 #include "nsIMutableArray.h"
 #include "nsHashSets.h"
 #include "nsAutoPtr.h"
 #include "nsIFile.h"
 #include "nsIVariant.h"
+#include "nsIPrefService.h"
+#include "nsIPrefBranch.h"
 
 #include "mozIStorageAggregateFunction.h"
 #include "mozIStorageFunction.h"
 
 #include "mozStorageUnicodeFunctions.h"
 #include "mozStorageConnection.h"
 #include "mozStorageService.h"
 #include "mozStorageStatement.h"
@@ -61,16 +63,18 @@
 
 #include "prlog.h"
 #include "prprf.h"
 
 #ifdef PR_LOGGING
 PRLogModuleInfo* gStorageLog = nsnull;
 #endif
 
+#define PREF_TS_SYNCHRONOUS "toolkit.storage.synchronous"
+
 NS_IMPL_ISUPPORTS1(mozStorageConnection, mozIStorageConnection)
 
 mozStorageConnection::mozStorageConnection(mozIStorageService* aService)
     : mDBConn(nsnull), mTransactionInProgress(PR_FALSE),
       mProgressHandler(nsnull),
       mStorageService(aService)
 {
     mFunctions.Init();
@@ -152,16 +156,38 @@ mozStorageConnection::Initialize(nsIFile
 
     if (srv != SQLITE_OK) {
         sqlite3_close (mDBConn);
         mDBConn = nsnull;
 
         return ConvertResultCode(srv);
     }
 
+    // Set the synchronous PRAGMA, according to the pref
+    nsCOMPtr<nsIPrefBranch> pref(do_GetService(NS_PREFSERVICE_CONTRACTID));
+    PRInt32 synchronous = 1; // Default to NORMAL if pref not set
+    if (pref)
+        (void)pref->GetIntPref(PREF_TS_SYNCHRONOUS, &synchronous);
+    
+    switch (synchronous) {
+        case 2:
+            (void)ExecuteSimpleSQL(NS_LITERAL_CSTRING(
+                "PRAGMA synchronous = FULL;"));
+            break;
+        case 0:
+            (void)ExecuteSimpleSQL(NS_LITERAL_CSTRING(
+                "PRAGMA synchronous = OFF;"));
+            break;
+        case 1:
+        default:
+            (void)ExecuteSimpleSQL(NS_LITERAL_CSTRING(
+                "PRAGMA synchronous = NORMAL;"));
+            break;
+    }
+
     return NS_OK;
 }
 
 /*****************************************************************************
  ** mozIStorageConnection interface
  *****************************************************************************/
 
 /**
--- a/storage/test/unit/test_storage_connection.js
+++ b/storage/test/unit/test_storage_connection.js
@@ -192,16 +192,30 @@ function test_createTable(){
     if (temp.exists()) try {
       temp.remove(false);
     } catch (e2) {}
     do_check_true(e.result==Cr.NS_ERROR_NOT_INITIALIZED ||
                   e.result==Cr.NS_ERROR_FAILURE);
   }
 }
 
+function test_defaultSynchronousAtNormal()
+{
+  var msc = getOpenedDatabase();
+  var stmt = createStatement("PRAGMA synchronous;");
+  try {
+    stmt.executeStep();
+    do_check_eq(1, stmt.getInt32(0));
+  }
+  finally {
+    stmt.reset();
+    stmt.finalize();
+  }
+}
+
 var tests = [
   test_connectionReady_open,
   test_connectionReady_closed,
   test_databaseFile,
   test_tableExists_not_created,
   test_indexExists_not_created,
   test_createTable_not_created,
   test_indexExists_created,
@@ -211,16 +225,17 @@ var tests = [
   test_transactionInProgress_yes,
   test_commitTransaction_no_transaction,
   test_rollbackTransaction_no_transaction,
   test_get_schemaVersion_not_set,
   test_set_schemaVersion,
   test_set_schemaVersion_same,
   test_set_schemaVersion_negative,
   test_createTable,
+  test_defaultSynchronousAtNormal,
 ];
 
 function run_test()
 {
   for (var i = 0; i < tests.length; i++)
     tests[i]();
     
   cleanup();
--- a/testing/extensions/community/chrome/content/prefs.js
+++ b/testing/extensions/community/chrome/content/prefs.js
@@ -171,28 +171,28 @@ var CC_loginManager = Components.classes
       }
 
       var nsLoginInfo = new Components.Constructor("@mozilla.org/login-manager/loginInfo;1",
                                         Components.interfaces.nsILoginInfo,
                                         "init");
 
       // The LoginManager does not like "null" for username/password fields,
       // So we send in the field names from the XUL.
-      var newLogin = new nsLoginInfo('chrome://qa', 'Litmus Login', litmus.baseURL,
+      var newLogin = new nsLoginInfo('chrome://qa', null, litmus.baseURL,
                                      username, password, "username", "password");
       try {
         this.manager().addLogin(newLogin);
       } catch (err) {
         alert("ERROR: " + err);
       }
     },
     getPasswordObj: function() {
       try {
         var logins = this.manager().findLogins({}, 'chrome://qa',
-          'Litmus Login', litmus.baseURL);
+          null, litmus.baseURL);
         if (logins.length > 0 && logins[0] != null)
           return logins[0];
         return false;
       } catch(ex) {
         return false;
       }
     }
   };
--- a/testing/extensions/community/chrome/content/qa.js
+++ b/testing/extensions/community/chrome/content/qa.js
@@ -42,16 +42,21 @@ var qaMain = {
     window.open("chrome://qa/content/qa.xul", "_blank",
                 "chrome,all,dialog=no,resizable=yes");
   },
   onToolOpen : function() {
     if (qaPref.getPref(qaPref.prefBase+'.isFirstTime', 'bool') == true) {
       window.open("chrome://qa/content/setup.xul", "_blank",
                   "chrome,all,dialog=yes");
         }
+    else {
+      // We need to log the user into litmus
+      var storedLogin = qaPref.litmus.getPasswordObj();
+      this.correctCredentials(storedLogin.username, storedLogin.password, false);
+    }
     if (qaPref.getPref(qaPref.prefBase + '.currentTestcase.testrunSummary', 'char') != null) {
             litmus.readStateFromPref();
         }
   },
     onSwitchTab : function() {
     var newSelection = $('qa_tabrow').selectedItem;
 
     // user is switching to the prefs tab:
@@ -63,16 +68,55 @@ var qaMain = {
 
     // user is switching away from the prefs tab:
     if (qaPrefsWindow.lastSelectedTab != null &&
         qaPrefsWindow.lastSelectedTab == $('qa-tabbar-prefs')) {
       qaPrefsWindow.savePrefsWindow();
     }
 
     qaPrefsWindow.lastSelectedTab = newSelection;
+  },
+
+  correctCredentials : function(username, password,isSecondTry) {
+    var callback = function (resp) {
+      if (resp.responseText == 0) {
+        qaMain.doLogin(isSecondTry);
+      } else {
+        // Then we need to store our validated creds
+        qaPref.litmus.setPassword(username, password);
+      }
+    }
+
+    // First we validate our stored login.
+    litmus.validateLogin(username, password, callback);
+  },
+
+  doLogin : function(isSecondTry) {
+    try {
+      var username = {value: "username"};
+      var password = {value: "password"};
+      var check = {value: "null"};
+      var title = qaMain.bundle.getString("qa.getpassword.title");
+      var msg = "";
+
+      if (!isSecondTry)
+        msg = qaMain.bundle.getString("qa.getpassword.message");
+      else
+        msg = qaMain.bundle.getString("qa.getpassword.tryagainmessage");
+
+      var prompts = Components.classes["@mozilla.org/embedcomp/prompt-service;1"]
+                              .getService(Components.interfaces.nsIPromptService);
+      var result = prompts.promptUsernameAndPassword(null, title, msg, username,
+                                                     password, null, check);
+
+      this.correctCredentials(username.value, password.value, true);
+    } catch(ex) {
+      alert("ERROR LOGGING IN: " + ex);
+      dump("Error logging in: " + ex);
+    }
   }
 };
 
 qaMain.__defineGetter__("bundle", function(){return $("bundle_qa");});
 qaMain.__defineGetter__("urlbundle", function(){return $("bundle_urls");});
 function $() {
   var elements = new Array();
 
--- a/testing/extensions/community/chrome/locale/en-US/qa.properties
+++ b/testing/extensions/community/chrome/locale/en-US/qa.properties
@@ -37,9 +37,12 @@
 
 qa.extension.testcase.head = Testcase #
 qa.extension.prefs.loginError = Login Error. Please check your username and password or create a new account.
 qa.extension.prefs.loadingMsg = Validating account information. Please Wait...
 qa.extension.prefs.savedMsg = Your settings have been saved
 qa.extension.sysconfig.loadingMsg = Loading menu options...
 qa.extension.loading = Loading...
 qa.extension.litmus.progress = Now Testing %1$S of %2$S
-qa.extension.litmus.stats = Tests Completed - Week: %1$S, Month: %2$S, All Time: %3$S
\ No newline at end of file
+qa.extension.litmus.stats = Tests Completed - Week: %1$S, Month: %2$S, All Time: %3$S
+qa.getpassword.title = Login to Litmus
+qa.getpassword.message = Enter the login information for your Litmus Account
+qa.getpassword.tryagainmessage = Incorrect login information.  Please enter the email address and password for your Litmus Account, if you have forgotten it, ask on IRC in #qa to have it reset.
--- a/testing/extensions/community/install.rdf
+++ b/testing/extensions/community/install.rdf
@@ -1,19 +1,19 @@
 <?xml version="1.0"?>
 <RDF:RDF xmlns:em="http://www.mozilla.org/2004/em-rdf#"
          xmlns:NC="http://home.netscape.com/NC-rdf#"
          xmlns:RDF="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
   <RDF:Description RDF:about="rdf:#$QJqvE"
                    em:id="{ec8030f7-c20a-464f-9b0e-13a3a9e97384}"
                    em:minVersion="2.0"
-                   em:maxVersion="3.0"/>
+                   em:maxVersion="3.0.*"/>
   <RDF:Description RDF:about="urn:mozilla:install-manifest"
                    em:id="{667e9f3d-0096-4d2b-b171-9a96afbabe20}"
-                   em:version="0.1.12"
+                   em:version="0.1.14"
                    em:type="2"
                    em:name="Mozilla QA Companion"
                    em:description="The QA tool for testers."
                    em:creator="Mozilla QA Team"
                    em:homepageURL="http://quality.mozilla.org/"
                    em:iconURL="chrome://qa/skin/qmo_logo_32x32.png">
     <em:targetApplication RDF:resource="rdf:#$QJqvE"/>
   </RDF:Description>
--- a/testing/release/updates/moz19-firefox-linux.cfg
+++ b/testing/release/updates/moz19-firefox-linux.cfg
@@ -1,10 +1,12 @@
+# 3.0rc1 linux
+release="3.0" product="Firefox" platform="Linux_x86-gcc3" build_id="2008051202" locales="af ar be ca cs da de el en-GB en-US es-AR es-ES eu fi fr fy-NL ga-IE gu-IN he hu id it ja ka ko ku lt mk mn nb-NO nl nn-NO pa-IN pl pt-BR pt-PT ro ru sk sq sr sv-SE tr uk zh-CN zh-TW" channel="betatest" from="/firefox/releases/3.0rc1/linux-i686/%locale%/firefox-3.0rc1.tar.bz2" aus_server="https://aus2.mozilla.org" ftp_server="stage-old.mozilla.org/pub/mozilla.org" to="/firefox/nightly/3.0rc2-candidates/build1/firefox-3.0.%locale%.linux-i686.tar.bz2"
 # 3.0b5 linux
-release="3.0b5" product="Firefox" platform="Linux_x86-gcc3" build_id="2008032619" locales="af ar be ca cs da de el en-GB en-US es-AR es-ES eu fi fr fy-NL gu-IN he hu id it ja ka ko ku lt mk mn nb-NO nl nn-NO pa-IN pl pt-BR pt-PT ro ru sk sq sr sv-SE tr uk zh-CN zh-TW" channel="betatest" from="/firefox/releases/3.0b5/linux-i686/%locale%/firefox-3.0b5.tar.bz2" aus_server="https://aus2.mozilla.org" ftp_server="stage-old.mozilla.org/pub/mozilla.org" to="/firefox/nightly/3.0rc1-candidates/build1/firefox-3.0.%locale%.linux-i686.tar.bz2"
+release="3.0b5" product="Firefox" platform="Linux_x86-gcc3" build_id="2008032619" locales="af ar be ca cs da de el en-GB en-US es-AR es-ES eu fi fr fy-NL gu-IN he hu id it ja ka ko ku lt mk mn nb-NO nl nn-NO pa-IN pl pt-BR pt-PT ro ru sk sq sr sv-SE tr uk zh-CN zh-TW" channel="betatest" 
 # 3.0b4 linux
 release="3.0b4" product="Firefox" platform="Linux_x86-gcc3" build_id="2008030318" locales="ar be ca cs da de el en-GB en-US es-AR es-ES eu fi fr fy-NL ga-IE gu-IN he hu it ja ka ko lt mk nb-NO nl pa-IN pl pt-BR pt-PT ro ru sk sq sv-SE tr uk zh-CN zh-TW" channel="betatest" 
 # 3.0b3 linux
 release="3.0b3" product="Firefox" platform="Linux_x86-gcc3" build_id="2008020513" locales="ar be ca cs de en-US es-ES eu fi fr fy-NL ga-IE gu-IN he hu it ja ka ko lt nb-NO nl pa-IN pl pt-BR pt-PT ro ru sk sv-SE tr uk zh-CN zh-TW" channel="betatest" 
 # 3.0b2 linux
 release="3.0b2" product="Firefox" platform="Linux_x86-gcc3" build_id="2007121016" locales="be ca cs de el en-US es-AR es-ES eu fi fr fy-NL gu-IN he it ja ko nb-NO nl pa-IN pl pt-PT ro ru sk sv-SE tr uk zh-CN" channel="betatest" 
 # 3.0b1 linux
 release="3.0b1" product="Firefox" platform="Linux_x86-gcc3" build_id="2007110903" locales="be cs de el en-US es-ES fi fr fy-NL gu-IN ja ko nl pl ru sk sv-SE uk zh-CN" channel="betatest" 
--- a/testing/release/updates/moz19-firefox-mac.cfg
+++ b/testing/release/updates/moz19-firefox-mac.cfg
@@ -1,10 +1,12 @@
+# 3.0rc1 macosx
+release="3.0" product="Firefox" platform="Darwin_Universal-gcc3" build_id="2008051202" locales="af ar be ca cs da de el en-GB en-US es-AR es-ES eu fi fr fy-NL ga-IE he hu id it ja-JP-mac ka ko ku lt mk mn nb-NO nl nn-NO pa-IN pl pt-BR pt-PT ro ru sk sq sr sv-SE tr uk zh-CN zh-TW" channel="betatest" from="/firefox/releases/3.0rc1/mac/%locale%/Firefox 3.0 RC 1.dmg" aus_server="https://aus2.mozilla.org" ftp_server="stage-old.mozilla.org/pub/mozilla.org" to="/firefox/nightly/3.0rc2-candidates/build1/firefox-3.0.%locale%.mac.dmg"
 # 3.0b5 macosx
-release="3.0b5" product="Firefox" platform="Darwin_Universal-gcc3" build_id="2008032619" locales="af be ca cs da de el en-GB en-US es-AR es-ES eu fi fr fy-NL gu-IN hu id it ja-JP-mac ka ko ku lt mk mn nb-NO nl nn-NO pa-IN pl pt-BR pt-PT ro ru sk sq sr sv-SE tr uk zh-CN zh-TW" channel="betatest" from="/firefox/releases/3.0b5/mac/%locale%/Firefox 3.0 Beta 5.dmg" aus_server="https://aus2.mozilla.org" ftp_server="stage-old.mozilla.org/pub/mozilla.org" to="/firefox/nightly/3.0rc1-candidates/build1/firefox-3.0.%locale%.mac.dmg"
+release="3.0b5" product="Firefox" platform="Darwin_Universal-gcc3" build_id="2008032619" locales="af be ca cs da de el en-GB en-US es-AR es-ES eu fi fr fy-NL gu-IN hu id it ja-JP-mac ka ko ku lt mk mn nb-NO nl nn-NO pa-IN pl pt-BR pt-PT ro ru sk sq sr sv-SE tr uk zh-CN zh-TW" channel="betatest" 
 # 3.0b4 macosx
 release="3.0b4" product="Firefox" platform="Darwin_Universal-gcc3" build_id="2008030317" locales="ar be ca cs da de el en-GB en-US es-AR es-ES eu fi fr fy-NL ga-IE gu-IN he hu it ja-JP-mac ka ko lt mk nb-NO nl pa-IN pl pt-BR pt-PT ro ru sk sq sv-SE tr uk zh-CN zh-TW" channel="betatest" 
 # 3.0b3 macosx
 release="3.0b3" product="Firefox" platform="Darwin_Universal-gcc3" build_id="2008020511" locales="ar be ca cs de en-US es-ES eu fi fr fy-NL ga-IE gu-IN he hu it ja-JP-mac ka ko lt nb-NO nl pa-IN pl pt-BR pt-PT ro ru sk sv-SE tr uk zh-CN zh-TW" channel="betatest" 
 # 3.0b2 macosx
 release="3.0b2" product="Firefox" platform="Darwin_Universal-gcc3" build_id="2007121014" locales="be ca cs de el en-US es-AR es-ES eu fi fr fy-NL gu-IN he it ja-JP-mac ko nb-NO nl pa-IN pl pt-PT ro ru sk sv-SE tr uk zh-CN" channel="betatest" 
 # 3.0b1 macosx
 release="3.0b1" product="Firefox" platform="Darwin_Universal-gcc3" build_id="2007110903" locales="be cs de el en-US es-ES fi fr fy-NL gu-IN ja-JP-mac ko nl pl ru sk sv-SE uk zh-CN" channel="betatest" 
--- a/testing/release/updates/moz19-firefox-win32.cfg
+++ b/testing/release/updates/moz19-firefox-win32.cfg
@@ -1,10 +1,12 @@
+# 3.0rc1 win32
+release="3.0" product="Firefox" platform="WINNT_x86-msvc" build_id="2008051206" locales="af ar be ca cs da de el en-GB en-US es-AR es-ES eu fi fr fy-NL ga-IE gu-IN he hu id it ja ka ko ku lt mk mn nb-NO nl nn-NO pa-IN pl pt-BR pt-PT ro ru sk sq sr sv-SE tr uk zh-CN zh-TW" channel="betatest" from="/firefox/releases/3.0rc1/win32/%locale%/Firefox Setup 3.0 RC 1.exe" aus_server="https://aus2.mozilla.org" ftp_server="stage-old.mozilla.org/pub/mozilla.org" to="/firefox/nightly/3.0rc2-candidates/build1/firefox-3.0.%locale%.win32.installer.exe"
 # 3.0b5 win32
-release="3.0b5" product="Firefox" platform="WINNT_x86-msvc" build_id="2008032620" locales="af ar be ca cs da de el en-GB en-US es-AR es-ES eu fi fr fy-NL gu-IN he hu id it ja ka ko ku lt mk mn nb-NO nl nn-NO pa-IN pl pt-BR pt-PT ro ru sk sq sr sv-SE tr uk zh-CN zh-TW" channel="betatest" from="/firefox/releases/3.0b5/win32/%locale%/Firefox Setup 3.0 Beta 5.exe" aus_server="https://aus2.mozilla.org" ftp_server="stage-old.mozilla.org/pub/mozilla.org" to="/firefox/nightly/3.0rc1-candidates/build1/firefox-3.0.%locale%.win32.installer.exe"
+release="3.0b5" product="Firefox" platform="WINNT_x86-msvc" build_id="2008032620" locales="af ar be ca cs da de el en-GB en-US es-AR es-ES eu fi fr fy-NL gu-IN he hu id it ja ka ko ku lt mk mn nb-NO nl nn-NO pa-IN pl pt-BR pt-PT ro ru sk sq sr sv-SE tr uk zh-CN zh-TW" channel="betatest" 
 # 3.0b4 win32
 release="3.0b4" product="Firefox" platform="WINNT_x86-msvc" build_id="2008030714" locales="ar be ca cs da de el en-GB en-US es-AR es-ES eu fi fr fy-NL ga-IE gu-IN he hu it ja ka ko lt mk nb-NO nl pa-IN pl pt-BR pt-PT ro ru sk sq sv-SE tr uk zh-CN zh-TW" channel="betatest" 
 # 3.0b3 win32
 release="3.0b3" product="Firefox" platform="WINNT_x86-msvc" build_id="2008020514" locales="ar be ca cs de en-US es-ES eu fi fr fy-NL ga-IE gu-IN he hu it ja ka ko lt nb-NO nl pa-IN pl pt-BR pt-PT ro ru sk sv-SE tr uk zh-CN zh-TW" channel="betatest" 
 # 3.0b2 win32
 release="3.0b2" product="Firefox" platform="WINNT_x86-msvc" build_id="2007121120" locales="be ca cs de el en-US es-AR es-ES eu fi fr fy-NL gu-IN he it ja ko nb-NO nl pa-IN pl ro ru sk sv-SE tr uk zh-CN" channel="betatest" 
 # 3.0b1 win32
 release="3.0b1" product="Firefox" platform="WINNT_x86-msvc" build_id="2007110904" locales="be cs de el en-US es-ES fi fr fy-NL ja ko nl pl ru sk sv-SE uk zh-CN" channel="betatest" 
--- a/toolkit/components/contentprefs/src/nsContentPrefService.js
+++ b/toolkit/components/contentprefs/src/nsContentPrefService.js
@@ -78,16 +78,25 @@ ContentPrefService.prototype = {
   __consoleSvc: null,
   get _consoleSvc ContentPrefService_get__consoleSvc() {
     if (!this.__consoleSvc)
       this.__consoleSvc = Cc["@mozilla.org/consoleservice;1"].
                           getService(Ci.nsIConsoleService);
     return this.__consoleSvc;
   },
 
+  // Preferences Service
+  __prefSvc: null,
+  get _prefSvc ContentPrefService_get__prefSvc() {
+    if (!this.__prefSvc)
+      this.__prefSvc = Cc["@mozilla.org/preferences-service;1"].
+                       getService(Ci.nsIPrefBranch2);
+    return this.__prefSvc;
+  },
+
 
   //**************************************************************************//
   // Destruction
 
   _destroy: function ContentPrefService__destroy() {
     this._observerSvc.removeObserver(this, "xpcom-shutdown");
 
     // Delete references to XPCOM components to make sure we don't leak them
@@ -716,16 +725,31 @@ ContentPrefService.prototype = {
         }
         catch(ex) {
           Cu.reportError("error migrating DB: " + ex + "; backing up and recreating");
           dbConnection = this._dbBackUpAndRecreate(dbService, dbFile, dbConnection);
         }
       }
     }
 
+    // Turn off disk synchronization checking to reduce disk churn and speed up
+    // operations when prefs are changed rapidly (such as when a user repeatedly
+    // changes the value of the browser zoom setting for a site).
+    //
+    // Note: this could cause database corruption if the OS crashes or machine
+    // loses power before the data gets written to disk, but this is considered
+    // a reasonable risk for the not-so-critical data stored in this database.
+    //
+    // If you really don't want to take this risk, however, just set the
+    // toolkit.storage.synchronous pref to 1 (NORMAL synchronization) or 2
+    // (FULL synchronization), in which case mozStorageConnection::Initialize
+    // will use that value, and we won't override it here.
+    if (!this._prefSvc.prefHasUserValue("toolkit.storage.synchronous"))
+      dbConnection.executeSimpleSQL("PRAGMA synchronous = OFF");
+
     this._dbConnection = dbConnection;
   },
 
   _dbCreate: function ContentPrefService__dbCreate(aDBService, aDBFile) {
     var dbConnection = aDBService.openDatabase(aDBFile);
 
     try {
       this._dbCreateSchema(dbConnection);
--- a/toolkit/components/contentprefs/tests/unit/test_contentPrefs.js
+++ b/toolkit/components/contentprefs/tests/unit/test_contentPrefs.js
@@ -135,16 +135,20 @@ function run_test() {
 
 
   // Now get the content pref service for real for use by the rest of the tests.
   var cps = Cc["@mozilla.org/content-pref/service;1"].
             getService(Ci.nsIContentPrefService);
 
   var uri = ContentPrefTest.getURI("http://www.example.com/");
 
+  // Make sure disk synchronization checking is turned off by default.
+  var statement = cps.DBConnection.createStatement("PRAGMA synchronous");
+  statement.executeStep();
+  do_check_eq(0, statement.getInt32(0));
 
   //**************************************************************************//
   // Nonexistent Pref
 
   do_check_eq(cps.getPref(uri, "test.nonexistent.getPref"), undefined);
   do_check_eq(cps.setPref(uri, "test.nonexistent.setPref", 5), undefined);
   do_check_false(cps.hasPref(uri, "test.nonexistent.hasPref"));
   do_check_eq(cps.removePref(uri, "test.nonexistent.removePref"), undefined);
--- a/toolkit/components/places/src/nsNavHistoryAutoComplete.cpp
+++ b/toolkit/components/places/src/nsNavHistoryAutoComplete.cpp
@@ -97,17 +97,19 @@
 #define BOOK_TAG_SQL (\
   SQL_STR_FRAGMENT_GET_BOOK_TAG("parent", "b.parent", "!=", PR_TRUE) + \
   SQL_STR_FRAGMENT_GET_BOOK_TAG("bookmark", "b.title", "!=", PR_TRUE) + \
   SQL_STR_FRAGMENT_GET_BOOK_TAG("tags", "GROUP_CONCAT(t.title, ',')", "=", PR_FALSE))
 
 // This separator is used as an RTL-friendly way to split the title and tags.
 // It can also be used by an nsIAutoCompleteResult consumer to re-split the
 // "comment" back into the title and tag.
-NS_NAMED_LITERAL_STRING(kTitleTagsSeparator, " \u2013 ");
+// Use a Unichar array to avoid problems with 2-byte char strings: " \u2013 "
+const PRUnichar kTitleTagsSeparatorChars[] = { ' ', 0x2013, ' ', 0 };
+#define TITLE_TAGS_SEPARATOR nsAutoString(kTitleTagsSeparatorChars)
 
 ////////////////////////////////////////////////////////////////////////////////
 //// nsNavHistoryAutoComplete Helper Functions
 
 /**
  * Returns true if the string starts with javascript:
  */
 inline PRBool
@@ -765,17 +767,17 @@ nsNavHistory::AutoCompleteProcessSearch(
         }
       }
 
       // Always prefer to show tags if we have them
       PRBool showTags = !entryTags.IsEmpty();
 
       // Add the tags to the title if necessary
       if (showTags)
-        title += kTitleTagsSeparator + entryTags;
+        title += TITLE_TAGS_SEPARATOR + entryTags;
 
       // Tags have a special style to show a tag icon; otherwise, style the
       // bookmarks that aren't feed items and feed URIs as bookmark
       style = showTags ? NS_LITERAL_STRING("tag") : (parentId &&
         !mLivemarkFeedItemIds.Get(parentId, &dummy)) ||
         mLivemarkFeedURIs.Get(escapedEntryURL, &dummy) ?
         NS_LITERAL_STRING("bookmark") : NS_LITERAL_STRING("favicon");
 
--- a/toolkit/components/places/src/nsNavHistoryResult.cpp
+++ b/toolkit/components/places/src/nsNavHistoryResult.cpp
@@ -99,17 +99,26 @@ inline PRInt32 ComparePRTime(PRTime a, P
 inline PRInt32 CompareIntegers(PRUint32 a, PRUint32 b)
 {
   return a - b;
 }
 
 
 // nsNavHistoryResultNode ******************************************************
 
-NS_IMPL_CYCLE_COLLECTION_0(nsNavHistoryResultNode)
+
+NS_IMPL_CYCLE_COLLECTION_CLASS(nsNavHistoryResultNode)
+
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsNavHistoryResultNode)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mParent)
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END 
+
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsNavHistoryResultNode)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR_AMBIGUOUS(mParent, nsINavHistoryContainerResultNode);
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsNavHistoryResultNode)
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsINavHistoryResultNode)
   NS_INTERFACE_MAP_ENTRY(nsINavHistoryResultNode)
 NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(nsNavHistoryResultNode, nsINavHistoryResultNode)
 NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(nsNavHistoryResultNode, nsINavHistoryResultNode)
@@ -2090,17 +2099,17 @@ nsNavHistoryQueryResultNode::CanExpand()
 // nsNavHistoryQueryResultNode::IsContainersQuery
 //
 // Some query with a particular result type can contain other queries,
 // they must be always expandable
 
 PRBool
 nsNavHistoryQueryResultNode::IsContainersQuery()
 {
-  PRUint16 resultType = mOptions->ResultType();
+  PRUint16 resultType = Options()->ResultType();
   return resultType == nsINavHistoryQueryOptions::RESULTS_AS_DATE_QUERY ||
          resultType == nsINavHistoryQueryOptions::RESULTS_AS_DATE_SITE_QUERY ||
          resultType == nsINavHistoryQueryOptions::RESULTS_AS_TAG_QUERY ||
          resultType == nsINavHistoryQueryOptions::RESULTS_AS_SITE_QUERY;
 }
 
 // nsNavHistoryQueryResultNode::OnRemoving
 //
@@ -2258,25 +2267,34 @@ nsNavHistoryQueryResultNode::GetQueries(
 
 
 // nsNavHistoryQueryResultNode::GetQueryOptions
 
 NS_IMETHODIMP
 nsNavHistoryQueryResultNode::GetQueryOptions(
                                       nsINavHistoryQueryOptions** aQueryOptions)
 {
-  nsresult rv = VerifyQueriesParsed();
-  NS_ENSURE_SUCCESS(rv, rv);
-  NS_ASSERTION(mOptions, "Options invalid");
-
-  *aQueryOptions = mOptions;
+  *aQueryOptions = Options();
   NS_ADDREF(*aQueryOptions);
   return NS_OK;
 }
 
+// nsNavHistoryQueryResultNode::Options
+//
+//  Safe options getter, ensures queries are parsed first.
+
+nsNavHistoryQueryOptions*
+nsNavHistoryQueryResultNode::Options()
+{
+  nsresult rv = VerifyQueriesParsed();
+  if (NS_FAILED(rv))
+    return nsnull;
+  NS_ASSERTION(mOptions, "Options invalid, cannot generate from URI");
+  return mOptions;
+}
 
 // nsNavHistoryQueryResultNode::VerifyQueriesParsed
 
 nsresult
 nsNavHistoryQueryResultNode::VerifyQueriesParsed()
 {
   if (mQueries.Count() > 0) {
     NS_ASSERTION(mOptions, "If a result has queries, it also needs options");
@@ -3664,24 +3682,52 @@ nsNavHistorySeparatorResultNode::nsNavHi
                            0, 0, EmptyCString())
 {
 }
 
 
 // nsNavHistoryResult **********************************************************
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsNavHistoryResult)
 
+PR_STATIC_CALLBACK(PLDHashOperator)
+RemoveBookmarkFolderObserversCallback(nsTrimInt64HashKey::KeyType aKey,
+                                      nsNavHistoryResult::FolderObserverList*& aData,
+                                      void* userArg)
+{
+  delete aData;
+  return PL_DHASH_REMOVE;
+}
+
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsNavHistoryResult)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mRootNode)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mView)
+  tmp->mBookmarkFolderObservers.Enumerate(&RemoveBookmarkFolderObserversCallback, nsnull);
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END 
 
+PR_STATIC_CALLBACK(PLDHashOperator)
+TraverseBookmarkFolderObservers(nsTrimInt64HashKey::KeyType aKey,
+                                nsNavHistoryResult::FolderObserverList*& aData,
+                                void* aUserArg)
+{
+  nsCycleCollectionTraversalCallback* cb =
+    static_cast<nsCycleCollectionTraversalCallback*>(aUserArg);
+  PRUint32 i, count = aData->Length();
+  for (i = 0; i < count; ++i) {
+    NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(*cb,
+                                       "mBookmarkFolderObservers value[i]");
+    nsNavHistoryResultNode* node = aData->ElementAt(i);
+    cb->NoteXPCOMChild(node);
+  }
+  return PL_DHASH_NEXT;
+}
+
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsNavHistoryResult)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR_AMBIGUOUS(mRootNode, nsINavHistoryContainerResultNode)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mView)
+  tmp->mBookmarkFolderObservers.Enumerate(&TraverseBookmarkFolderObservers, &cb);
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsNavHistoryResult)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsNavHistoryResult)
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsNavHistoryResult)
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsINavHistoryResult)
   NS_INTERFACE_MAP_STATIC_AMBIGUOUS(nsNavHistoryResult)
@@ -3696,25 +3742,16 @@ nsNavHistoryResult::nsNavHistoryResult(n
   mIsHistoryObserver(PR_FALSE),
   mIsBookmarkFolderObserver(PR_FALSE),
   mIsAllBookmarksObserver(PR_FALSE),
   mBatchInProgress(PR_FALSE)
 {
   mRootNode->mResult = this;
 }
 
-PR_STATIC_CALLBACK(PLDHashOperator)
-RemoveBookmarkFolderObserversCallback(nsTrimInt64HashKey::KeyType aKey,
-                                      nsNavHistoryResult::FolderObserverList*& aData,
-                                      void* userArg)
-{
-  delete aData;
-  return PL_DHASH_REMOVE;
-}
-
 nsNavHistoryResult::~nsNavHistoryResult()
 {
   // delete all bookmark folder observer arrays which are allocated on the heap
   mBookmarkFolderObservers.Enumerate(&RemoveBookmarkFolderObserversCallback, nsnull);
 }
 
 
 // nsNavHistoryResult::Init
@@ -4135,20 +4172,20 @@ nsNavHistoryResult::OnItemChanged(PRInt6
   rv = bookmarkService->GetFolderIdForItem(aItemId, &folderId);
   NS_ENSURE_SUCCESS(rv, rv);
 
   FolderObserverList* list = BookmarkFolderObserversForId(folderId, PR_FALSE);
   if (!list)
     return NS_OK;
 
   for (PRUint32 i = 0; i < list->Length(); i++) {
-    nsNavHistoryFolderResultNode* folder = list->ElementAt(i);
+    nsRefPtr<nsNavHistoryFolderResultNode> folder = list->ElementAt(i);
     if (folder) {
       PRUint32 nodeIndex;
-      nsNavHistoryResultNode* node = folder->FindChildById(aItemId, &nodeIndex);
+      nsRefPtr<nsNavHistoryResultNode> node = folder->FindChildById(aItemId, &nodeIndex);
       // if ExcludeItems is true we don't update non visible items
       if (node &&
           (!folder->mOptions->ExcludeItems() ||
            !(node->IsURI() || node->IsSeparator())) &&
           folder->StartIncrementalUpdate()) {
         node->OnItemChanged(aItemId, aProperty, aIsAnnotationProperty, aValue);
       }
     }
--- a/toolkit/components/places/src/nsNavHistoryResult.h
+++ b/toolkit/components/places/src/nsNavHistoryResult.h
@@ -184,17 +184,17 @@ public:
 
   // node observers
   PRBool mIsHistoryObserver;
   PRBool mIsBookmarkFolderObserver;
   PRBool mIsAllBookmarksObserver;
 
   nsTArray<nsNavHistoryQueryResultNode*> mHistoryObservers;
   nsTArray<nsNavHistoryQueryResultNode*> mAllBookmarksObservers;
-  typedef nsTArray<nsNavHistoryFolderResultNode*> FolderObserverList;
+  typedef nsTArray<nsRefPtr<nsNavHistoryFolderResultNode> > FolderObserverList;
   nsDataHashtable<nsTrimInt64HashKey, FolderObserverList* > mBookmarkFolderObservers;
   FolderObserverList* BookmarkFolderObserversForId(PRInt64 aFolderId, PRBool aCreate);
 
   void RecursiveExpandCollapse(nsNavHistoryContainerResultNode* aContainer,
                                PRBool aExpand);
 
   void InvalidateTree();
   
@@ -378,17 +378,17 @@ public:
     NS_ASSERTION(IsFolder(), "Not a folder");
     return reinterpret_cast<nsNavHistoryFolderResultNode*>(this);
   }
   nsNavHistoryQueryResultNode* GetAsQuery() {
     NS_ASSERTION(IsQuery(), "Not a query");
     return reinterpret_cast<nsNavHistoryQueryResultNode*>(this);
   }
 
-  nsNavHistoryContainerResultNode* mParent;
+  nsRefPtr<nsNavHistoryContainerResultNode> mParent;
   nsCString mURI; // not necessarily valid for containers, call GetUri
   nsCString mTitle;
   nsString mTags;
   PRUint32 mAccessCount;
   PRInt64 mTime;
   nsCString mFaviconURI;
   PRInt32 mBookmarkIndex;
   PRInt64 mItemId;
@@ -720,16 +720,19 @@ public:
 
   // these may be constructed lazily from mURI, call VerifyQueriesParsed
   // either this or mURI should be valid
   nsCOMArray<nsNavHistoryQuery> mQueries;
   PRUint32 mLiveUpdate; // one of QUERYUPDATE_* in nsNavHistory.h
   PRBool mHasSearchTerms;
   nsresult VerifyQueriesParsed();
 
+  // safe options getter, ensures queries are parsed
+  nsNavHistoryQueryOptions* Options();
+
   // this indicates whether the query contents are valid, they don't go away
   // after the container is closed until a notification comes in
   PRBool mContentsValid;
 
   PRBool mBatchInProgress;
 
   nsresult FillChildren();
   void ClearChildren(PRBool unregister);
new file mode 100644
--- /dev/null
+++ b/toolkit/components/places/tests/unit/test_433525_hasChildren_crash.js
@@ -0,0 +1,83 @@
+/* -*- Mode: Java; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et: */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Bug 433525 code.
+ *
+ * The Initial Developer of the Original Code is Mozilla Corp.
+ * Portions created by the Initial Developer are Copyright (C) 2008
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *  Dietrich Ayala <dietrich@mozilla.com> (Original Author)
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+function run_test() {
+  try {
+    var histsvc = Cc["@mozilla.org/browser/nav-history-service;1"].
+                  getService(Ci.nsINavHistoryService);
+    var bmsvc = Cc["@mozilla.org/browser/nav-bookmarks-service;1"].
+              getService(Ci.nsINavBookmarksService);
+  } catch(ex) {
+    do_throw("Unable to initialize Places services");
+  }
+
+
+  // add a visit
+  var testURI = uri("http://test");
+  histsvc.addVisit(testURI, Date.now() * 1000, null,
+                   histsvc.TRANSITION_TYPED, false, 0);
+
+  // query for the visit
+  var options = histsvc.getNewQueryOptions();
+  options.maxResults = 1;
+  options.resultType = options.RESULTS_AS_URI;
+  var query = histsvc.getNewQuery();
+  query.uri = testURI;
+  var result = histsvc.executeQuery(query, options);
+  var root = result.root;
+
+  // check hasChildren while the container is closed
+  do_check_eq(root.hasChildren, true);
+
+  // now check via the saved search path
+  var queryURI = histsvc.queriesToQueryString([query], 1, options);
+  bmsvc.insertBookmark(bmsvc.toolbarFolder, uri(queryURI),
+                       0 /* first item */, "test query");
+
+  // query for that query
+  var options = histsvc.getNewQueryOptions();
+  var query = histsvc.getNewQuery();
+  query.setFolders([bmsvc.toolbarFolder], 1);
+  var result = histsvc.executeQuery(query, options);
+  var root = result.root;
+  root.containerOpen = true;
+  var queryNode = root.getChild(0);
+  do_check_eq(queryNode.title, "test query");
+  queryNode.QueryInterface(Ci.nsINavHistoryContainerResultNode);
+  do_check_eq(queryNode.hasChildren, true);
+}
--- a/toolkit/mozapps/extensions/src/nsExtensionManager.js.in
+++ b/toolkit/mozapps/extensions/src/nsExtensionManager.js.in
@@ -8068,17 +8068,17 @@ ExtensionsDataSource.prototype = {
    *          priority relationship to existing entries, false if the location
    *          should only be updated if its priority is lower than the existing
    *          value.
    */
   updateVisibleList: function(id, locationKey, forceReplace) {
     if (id in this.visibleItems && this.visibleItems[id]) {
       var oldLocation = InstallLocations.get(this.visibleItems[id]);
       var newLocation = InstallLocations.get(locationKey);
-      if (forceReplace || newLocation.priority < oldLocation.priority)
+      if (forceReplace || !oldLocation || newLocation.priority < oldLocation.priority)
         this.visibleItems[id] = locationKey;
     }
     else
       this.visibleItems[id] = locationKey;
   },
 
   /**
    * Load the Extensions Datasource from disk.
@@ -8172,16 +8172,18 @@ ExtensionsDataSource.prototype = {
    * @param   fallbackURL
    *          If the location fails, supply this URL instead
    * @returns An RDF Resource to the URL discovered, or the fallback
    *          if the discovery failed.
    */
   _getThemeImageURL: function(item, fileName, fallbackURL) {
     var id = stripPrefix(item.Value, PREFIX_ITEM_URI);
     var installLocation = this._em.getInstallLocation(id);
+    if (!installLocation)
+      return fallbackURL;
     var file = installLocation.getItemFile(id, fileName)
     if (file.exists())
       return gRDF.GetResource(getURLSpecFromFile(file));
 
     if (id == stripPrefix(RDFURI_DEFAULT_THEME, PREFIX_ITEM_URI)) {
       var jarFile = getFile(KEY_APPDIR, [DIR_CHROME, FILE_DEFAULT_THEME_JAR]);
       var url = "jar:" + getURLSpecFromFile(jarFile) + "!/" + fileName;
       return gRDF.GetResource(url);
--- a/toolkit/mozapps/extensions/test/unit/data/test_bug356370.rdf
+++ b/toolkit/mozapps/extensions/test/unit/data/test_bug356370.rdf
@@ -37,14 +37,28 @@
     <em:targetApplication>
       <RDF:Description>
         <em:id>xpcshell@tests.mozilla.org</em:id>
         <em:minVersion>1</em:minVersion>
         <em:maxVersion>1</em:maxVersion>
       </RDF:Description>
     </em:targetApplication>
   </RDF:Description>
+  <RDF:Description RDF:about="urn:mozilla:item:bug356370_4@tests.mozilla.org">
+    <em:installLocation>invalid</em:installLocation>
+    <em:version>1</em:version>
+    <em:name>Bug 356370 test 4</em:name>
+    <em:type NC:parseType="Integer">4</em:type>
+    <em:targetApplication>
+      <RDF:Description>
+        <em:id>xpcshell@tests.mozilla.org</em:id>
+        <em:minVersion>1</em:minVersion>
+        <em:maxVersion>1</em:maxVersion>
+      </RDF:Description>
+    </em:targetApplication>
+  </RDF:Description>
   <RDF:Seq RDF:about="urn:mozilla:item:root">
     <RDF:li RDF:resource="urn:mozilla:item:bug356370_1@tests.mozilla.org"/>
     <RDF:li RDF:resource="urn:mozilla:item:bug356370_2@tests.mozilla.org"/>
     <RDF:li RDF:resource="urn:mozilla:item:bug356370_3@tests.mozilla.org"/>
+    <RDF:li RDF:resource="urn:mozilla:item:bug356370_4@tests.mozilla.org"/>
   </RDF:Seq>
 </RDF:RDF>
new file mode 100644
--- /dev/null
+++ b/toolkit/mozapps/extensions/test/unit/data/test_bug356370_4.rdf
@@ -0,0 +1,21 @@
+<?xml version="1.0"?>
+
+<RDF xmlns="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+     xmlns:em="http://www.mozilla.org/2004/em-rdf#">
+
+  <Description about="urn:mozilla:install-manifest">
+    <em:id>bug356370_4@tests.mozilla.org</em:id>
+    <em:version>1</em:version>
+
+    <em:targetApplication>
+      <Description>
+        <em:id>xpcshell@tests.mozilla.org</em:id>
+        <em:minVersion>1</em:minVersion>
+        <em:maxVersion>1</em:maxVersion>
+      </Description>
+    </em:targetApplication>
+
+    <em:name>Bug 356370 test 4</em:name>
+    <em:type NC:parseType="Integer">4</em:type>
+  </Description>
+</RDF>
--- a/toolkit/mozapps/extensions/test/unit/test_bug356370.js
+++ b/toolkit/mozapps/extensions/test/unit/test_bug356370.js
@@ -39,20 +39,22 @@
 function write_cache_line(stream, location, id, mtime) {
   var line = location + "\t" + id + "\trel%" + id + "\t" + Math.floor(mtime / 1000) + "\t\r\n";
   stream.write(line, line.length);
 }
 
 /**
  * This copies two extensions, a default extensions datasource into the profile
  * It also manufactures an extensions.cache file with invalid items.
- * There are 3 test extensions:
+ * There are 4 test extensions:
  *   bug356370_1@tests.mozilla.org exists in app-profile and an unused version is in invalid-lo
- *   bug356370_2@tests.mozilla.org exists in invalid-hi and an unusd version is in app-profile
+ *   bug356370_2@tests.mozilla.org exists in invalid-hi and an unused version is in app-profile
  *   bug356370_3@tests.mozilla.org exists in invalid
+ *   bug356370_4@tests.mozilla.org is a theme existing in invalid and a new install
+ *     will be detected in app-profile
  *
  * After startup only the first two should exist in the correct install location
  * and installing extensions should be successful.
  */
 function setup_profile() {
   // Set up the profile with some existing extensions
   // Not nice to copy the extensions datasource in, but bringing up the EM to
   // create it properly will invalidate the test
@@ -80,38 +82,49 @@ function setup_profile() {
   addon.append("extensions");
   addon.append("bug356370_2@tests.mozilla.org");
   source = do_get_file("toolkit/mozapps/extensions/test/unit/data/test_bug356370_2.rdf");
   addon.create(Components.interfaces.nsIFile.DIRECTORY_TYPE, 0755);
   source.copyTo(addon, "install.rdf");
   write_cache_line(foStream, "app-profile", "bug356370_2@tests.mozilla.org",
                    addon.lastModifiedTime);
 
+  addon = gProfD.clone();
+  addon.append("extensions");
+  addon.append("bug356370_4@tests.mozilla.org");
+  source = do_get_file("toolkit/mozapps/extensions/test/unit/data/test_bug356370_4.rdf");
+  addon.create(Components.interfaces.nsIFile.DIRECTORY_TYPE, 0755);
+  source.copyTo(addon, "install.rdf");
+
   // Write out a set of invalid entries
   write_cache_line(foStream, "invalid-lo", "bug356370_1@tests.mozilla.org", 0);
   write_cache_line(foStream, "invalid-hi", "bug356370_2@tests.mozilla.org", 0);
   write_cache_line(foStream, "invalid", "bug356370_3@tests.mozilla.org", 0);
+  write_cache_line(foStream, "invalid", "bug356370_4@tests.mozilla.org", 0);
   foStream.close();
 }
 
 function run_test() {
   createAppInfo("xpcshell@tests.mozilla.org", "XPCShell", "1", "1.9");
   gPrefs.setCharPref("extensions.lastAppVersion", "4");
   setup_profile();
 
   startupEM();
   do_check_neq(gEM.getItemForID("bug356370_1@tests.mozilla.org"), null);
   do_check_eq(getManifestProperty("bug356370_1@tests.mozilla.org", "installLocation"), "app-profile");
   do_check_neq(gEM.getItemForID("bug356370_2@tests.mozilla.org"), null);
   do_check_eq(getManifestProperty("bug356370_2@tests.mozilla.org", "installLocation"), "app-profile");
   // This should still be disabled
   do_check_eq(getManifestProperty("bug356370_2@tests.mozilla.org", "isDisabled"), "true");
   do_check_eq(gEM.getItemForID("bug356370_3@tests.mozilla.org"), null);
+  do_check_neq(gEM.getItemForID("bug356370_4@tests.mozilla.org"), null);
+  do_check_eq(getManifestProperty("bug356370_4@tests.mozilla.org", "installLocation"), "app-profile");
 
   gEM.installItemFromFile(do_get_addon("test_bug257155"), NS_INSTALL_LOCATION_APPPROFILE);
   do_check_neq(gEM.getItemForID("bug257155@tests.mozilla.org"), null);
 
   restartEM();
   do_check_neq(gEM.getItemForID("bug257155@tests.mozilla.org"), null);
   do_check_neq(gEM.getItemForID("bug356370_1@tests.mozilla.org"), null);
   do_check_neq(gEM.getItemForID("bug356370_2@tests.mozilla.org"), null);
   do_check_eq(gEM.getItemForID("bug356370_3@tests.mozilla.org"), null);
+  do_check_neq(gEM.getItemForID("bug356370_4@tests.mozilla.org"), null);
 }
--- a/toolkit/mozapps/plugins/content/pluginInstallerDatasource.js
+++ b/toolkit/mozapps/plugins/content/pluginInstallerDatasource.js
@@ -43,32 +43,34 @@ function nsRDFItemUpdater(aClientOS, aCh
                         .getService(Components.interfaces.nsIRDFService);
   this._os = Components.classes["@mozilla.org/observer-service;1"]
                        .getService(Components.interfaces.nsIObserverService);
 
   var app = Components.classes["@mozilla.org/xre/app-info;1"]
                       .getService(Components.interfaces.nsIXULAppInfo);
   this.appID = app.ID;
   this.buildID = app.platformBuildID;
+  this.appRelease = app.version;
 
   this.clientOS = aClientOS;
   this.chromeLocale = aChromeLocale;
 
   var prefBranch = Components.classes["@mozilla.org/preferences-service;1"]
                              .getService(Components.interfaces.nsIPrefBranch);
   this.dsURI = prefBranch.getCharPref("pfs.datasource.url");
 }
 
 nsRDFItemUpdater.prototype = {
   checkForPlugin: function (aPluginRequestItem){
     var dsURI = this.dsURI;
     // escape the mimetype as mimetypes can contain '+', which will break pfs.
     dsURI = dsURI.replace(/%PLUGIN_MIMETYPE%/g, encodeURIComponent(aPluginRequestItem.mimetype));
     dsURI = dsURI.replace(/%APP_ID%/g, this.appID);
     dsURI = dsURI.replace(/%APP_VERSION%/g, this.buildID);
+    dsURI = dsURI.replace(/%APP_RELEASE%/g, this.appRelease);
     dsURI = dsURI.replace(/%CLIENT_OS%/g, this.clientOS);
     dsURI = dsURI.replace(/%CHROME_LOCALE%/g, this.chromeLocale);
 
     var ds = this._rdfService.GetDataSource(dsURI);
     var rds = ds.QueryInterface(Components.interfaces.nsIRDFRemoteDataSource)
     if (rds.loaded)
       this.onDatasourceLoaded(ds, aPluginRequestItem);
     else {
--- a/toolkit/mozapps/plugins/content/pluginInstallerWizard.js
+++ b/toolkit/mozapps/plugins/content/pluginInstallerWizard.js
@@ -542,17 +542,18 @@ nsPluginInstallerWizard.prototype.showPl
   var app = Components.classes["@mozilla.org/xre/app-info;1"]
                       .getService(Components.interfaces.nsIXULAppInfo);
 
   // set the get more info link to contain the mimetypes we couldn't install.
   notInstalledList +=
     "&appID=" + app.ID +
     "&appVersion=" + app.platformBuildID +
     "&clientOS=" + this.getOS() +
-    "&chromeLocale=" + this.getChromeLocale();
+    "&chromeLocale=" + this.getChromeLocale() +
+    "&appRelease=" + app.version;
 
   document.getElementById("moreInfoLink").addEventListener("click", function() { gPluginInstaller.loadURL("https://pfs.mozilla.org/plugins/" + notInstalledList) }, false);
 
   if (this.mNeedsRestart) {
     var cancel = document.getElementById("plugin-installer-wizard").getButton("cancel");
     cancel.label = this.getString("pluginInstallation.close.label");
     cancel.accessKey = this.getString("pluginInstallation.close.accesskey");
     var finish = document.getElementById("plugin-installer-wizard").getButton("finish");
--- a/tools/release/configs/fx-moz19-bootstrap.cfg
+++ b/tools/release/configs/fx-moz19-bootstrap.cfg
@@ -1,24 +1,23 @@
-version         = 3.0rc1
+version         = 3.0rc2
 appVersion      = 3.0
 milestone       = 1.9
 # _BUILDn and _RELEASE will be appended as-needed
-productTag      = FIREFOX_3_0rc1
+productTag      = FIREFOX_3_0rc2
 # Branch name and pull dates to use for base tag
 branchTag       = HEAD
 #RelbranchOverride = GECKO19b5_20080326_RELBRANCH
-pullDate        = 2008-05-11 17:50 PDT
-l10n_pullDate   = 2008-05-09 10:00 PDT
+pullDate        = 2008-05-28 17:00 PDT
+l10n_pullDate   = 2008-05-28 13:37 PDT
 build           = 1
-# oldVersion and oldRc refer to the previous release
-oldVersion      = 3.0b5
-# uncomment this when updating config for 3.0rc2 build1
-# oldAppVersion  = 3.0
-oldBuild        = 2
+# oldVersion and oldBuild refer to the previous release
+oldVersion      = 3.0rc1
+oldAppVersion   = 3.0
+oldBuild        = 1
 appName         = browser
 product         = firefox
 # Absolute path to tinderbox build directory
 # The win32 ones are kept short because of a long path issue detailed in
 # bug# 400846
 linux_buildDir       = /builds/tinderbox/Fx-Mozilla1.9-Release
 macosx_buildDir      = /builds/tinderbox/Fx-Mozilla1.9-Release
 win32_buildDir       = /e/fx19rel
--- a/tools/release/configs/xr-moz19-bootstrap.cfg
+++ b/tools/release/configs/xr-moz19-bootstrap.cfg
@@ -1,22 +1,22 @@
-version         = 3.0b4
-prettyAusVersion = 3 Beta 4
-milestone       = 1.9b4
+version         = 1.9rc2
+prettyAusVersion = XULRunner 3
+milestone       = 1.9rc2
 # _BUILDn and _RELEASE will be appended as-needed
-productTag      = FIREFOX_3_0b4
+productTag      = FIREFOX_3_0rc2
 # Branch name and pull dates to use for base tag
 branchTag       = HEAD
 #RelbranchOverride = GECKO190_20071207_RELBRANCH
-pullDate        = 2008-03-03 11:15 PST
-l10n_pullDate   = 2008-03-03 05:00 PST
+pullDate        = 2008-05-28 17:00 PDT
+l10n_pullDate   = 2008-05-28 13:37 PDT
 build           = 1
 # oldVersion and oldRc refer to the previous release
-oldVersion      = 3.0b3
-oldBuild        = 3
+oldVersion      = 1.9b4
+oldBuild        = 1
 appName         = xulrunner
 product         = xulrunner
 # Absolute path to tinderbox build directory
 # The win32 ones are kept short because of a long path issue detailed in
 # bug# 400846
 linux_buildDir       = /builds/tinderbox/Xr-Mozilla1.9-Release
 macosx_buildDir      = /builds/tinderbox/Xr-Mozilla1.9-Release
 win32_buildDir       = /e/xr19rel
@@ -26,17 +26,17 @@ win32_l10n_buildDir  = /e/xr19l10nrel
 # Absolute path to store bootstrap's logs
 linux_logDir    = /builds/logs
 macosx_logDir   = /builds/logs
 win32_logDir    = /builds/logs
 mozillaCvsroot  = cltbld@cvs.mozilla.org:/cvsroot
 l10nCvsroot     = cltbld@cvs.mozilla.org:/l10n
 mofoCvsroot     = cltbld@cvs.mozilla.org:/mofo
 anonCvsroot	    = :pserver:anonymous@cvs-mirror.mozilla.org:/cvsroot
-# private staging area 
+# private staging area
 stageHome       = /data/cltbld
 sourceDir       = /builds/source
 updateDir       = /builds/updates
 verifyDir       = /builds/verify
 tagDir          = /builds/tags
 configBumpDir   = /builds/config
 # Build platform, as specified by tinderbox
 linux_buildPlatform   = Linux_2.6.18-53.1.13.el5_Depend
--- a/tools/release/configs/xr-moz19-staging-bootstrap.cfg
+++ b/tools/release/configs/xr-moz19-staging-bootstrap.cfg
@@ -1,21 +1,21 @@
-version         = 3.0b3
-prettyAusVersion = XULRunner 3 Beta 3
-milestone       = 1.9b3
+version         = 1.9rc2
+prettyAusVersion = XULRunner 3
+milestone       = 1.9rc2
 # _BUILDn and _RELEASE will be appended as-needed
-productTag      = FIREFOX_3_0b3
+productTag      = FIREFOX_3_0rc2
 # Branch name and pull dates to use for base tag
 branchTag       = HEAD
 #RelbranchOverride = GECKO190_20071207_RELBRANCH
-pullDate        = 2008-01-07 09:00 PST
-l10n_pullDate   = 2008-01-07 09:00 PST
+pullDate        = 2008-05-28 17:00 PDT
+l10n_pullDate   = 2008-05-28 13:37 PDT
 build           = 1
 # oldVersion and oldRc refer to the previous release
-oldVersion      = 3.0b2
+oldVersion      = 1.9b4
 oldBuild        = 1
 appName         = xulrunner
 product         = xulrunner
 # Absolute path to tinderbox build directory
 # The win32 ones are kept short because of a long path issue detailed in
 # bug# 400846
 linux_buildDir       = /builds/tinderbox/Xr-Mozilla1.9-Release
 macosx_buildDir      = /builds/tinderbox/Xr-Mozilla1.9-Release
@@ -26,17 +26,17 @@ win32_l10n_buildDir  = /e/xr19l10nrel
 # Absolute path to store bootstrap's logs
 linux_logDir    = /builds/logs
 macosx_logDir   = /builds/logs
 win32_logDir    = /builds/logs
 mozillaCvsroot  = staging-1.9-master.build.mozilla.org:/builds/cvsmirror/cvsroot
 l10nCvsroot     = staging-1.9-master.build.mozilla.org:/builds/cvsmirror/l10n
 mofoCvsroot     = staging-1.9-master.build.mozilla.org:/builds/cvsmirror/mofo
 anonCvsroot	= staging-1.9-master.build.mozilla.org:/builds/cvsmirror/cvsroot
-# private staging area 
+# private staging area
 stageHome       = /data/cltbld
 sourceDir       = /builds/source
 updateDir       = /builds/updates
 verifyDir       = /builds/verify
 tagDir          = /builds/tags
 configBumpDir   = /builds/config
 # Build platform, as specified by tinderbox
 linux_buildPlatform   = Linux_2.6.18-53.1.13.el5_Depend
--- a/widget/src/cocoa/nsAppShell.mm
+++ b/widget/src/cocoa/nsAppShell.mm
@@ -51,17 +51,16 @@
 #include "nsIWidget.h"
 #include "nsThreadUtils.h"
 #include "nsIWindowMediator.h"
 #include "nsServiceManagerUtils.h"
 #include "nsIInterfaceRequestor.h"
 #include "nsIWebBrowserChrome.h"
 #include "nsObjCExceptions.h"
 #include "nsCocoaUtils.h"
-#include "nsChildView.h"
 
 // defined in nsChildView.mm
 extern nsIRollupListener * gRollupListener;
 extern nsIWidget         * gRollupWidget;
 
 // defined in nsCocoaWindow.mm
 extern PRInt32             gXULModalLevel;
 
@@ -232,18 +231,16 @@ nsAppShell::Init()
   
   mCFRunLoopSource = ::CFRunLoopSourceCreate(kCFAllocatorDefault, 0, &context);
   NS_ENSURE_STATE(mCFRunLoopSource);
 
   ::CFRunLoopAddSource(mCFRunLoop, mCFRunLoopSource, kCFRunLoopCommonModes);
 
   rv = nsBaseAppShell::Init();
 
-  NS_InstallPluginKeyEventsHandler();
-
   [localPool release];
 
   return rv;
 
   NS_OBJC_END_TRY_ABORT_BLOCK_NSRESULT;
 }
 
 // ProcessGeckoEvents
@@ -605,18 +602,16 @@ nsAppShell::Exit(void)
   // But we should also complain about it (since it isn't quite kosher).
   if (mTerminated) {
     NS_WARNING("nsAppShell::Exit() called redundantly");
     return NS_OK;
   }
 
   mTerminated = PR_TRUE;
 
-  NS_RemovePluginKeyEventsHandler();
-
   // Quoting from Apple's doc on the [NSApplication stop:] method (from their
   // doc on the NSApplication class):  "If this method is invoked during a
   // modal event loop, it will break that loop but not the main event loop."
   // nsAppShell::Exit() shouldn't be called from a modal event loop.  So if
   // it is we complain about it (to users of debug builds) and call [NSApp
   // stop:] one extra time.  (I'm not sure if modal event loops can be nested
   // -- Apple's docs don't say one way or the other.  But the return value
   // of [NSApp _isRunningModal] doesn't change immediately after a call to
--- a/widget/src/cocoa/nsChildView.h
+++ b/widget/src/cocoa/nsChildView.h
@@ -67,46 +67,16 @@
 
 #import <Carbon/Carbon.h>
 #import <Cocoa/Cocoa.h>
 
 class gfxASurface;
 class nsChildView;
 union nsPluginPort;
 
-enum {
-  // Currently focused ChildView (while this TSM document is active).
-  // Transient (only set while TSMProcessRawKeyEvent() is processing a key
-  // event), and the ChildView will be retained and released around the call
-  // to TSMProcessRawKeyEvent() -- so it can be weak.
-  kFocusedChildViewTSMDocPropertyTag  = 'GKFV', // type ChildView* [WEAK]
-};
-
-// Undocumented HIToolbox function used by WebKit to allow Carbon-based IME
-// to work in a Cocoa-based browser (like Safari or Cocoa-widgets Firefox).
-// (Recent WebKit versions actually use a thin wrapper around this function
-// called WKSendKeyEventToTSM().)
-//
-// Calling TSMProcessRawKeyEvent() from ChildView's keyDown: and keyUp:
-// methods (when the ChildView is a plugin view) bypasses Cocoa's IME
-// infrastructure and (instead) causes Carbon TSM events to be sent on each
-// NSKeyDown event.  We install a Carbon event handler
-// (PluginKeyEventsHandler()) to catch these events and pass them to Gecko
-// (which in turn passes them to the plugin).
-extern "C" long TSMProcessRawKeyEvent(EventRef carbonEvent);
-
-@interface NSEvent (Undocumented)
-
-// Return Cocoa event's corresponding Carbon event.  Not initialized (on
-// synthetic events) until the OS actually "sends" the event.  This method
-// has been present in the same form since at least OS X 10.2.8.
-- (EventRef)_eventRef;
-
-@end
-
 @interface ChildView : NSView<
 #ifdef ACCESSIBILITY
                               mozAccessible,
 #endif
                               mozView, NSTextInput>
 {
 @private
   NSWindow* mWindow; // shortcut to the top window, [WEAK]
@@ -157,35 +127,28 @@ extern "C" long TSMProcessRawKeyEvent(Ev
   // Holds our drag service across multiple drag calls. The reference to the
   // service is obtained when the mouse enters the view and is released when
   // the mouse exits or there is a drop. This prevents us from having to
   // re-establish the connection to the service manager many times per second
   // when handling |draggingUpdated:| messages.
   nsIDragService* mDragService;
   
   PRUint32 mLastModifierState;
-
-  // For use with plugins, so that we can support IME in them.  We can't use
-  // Cocoa TSM documents (those created and managed by the NSTSMInputContext
-  // class) -- for some reason TSMProcessRawKeyEvent() doesn't work with them.
-  TSMDocumentID mPluginTSMDoc;
 }
 
 // these are sent to the first responder when the window key status changes
 - (void)viewsWindowDidBecomeKey;
 - (void)viewsWindowDidResignKey;
 
 // Stop NSView hierarchy being changed during [ChildView drawRect:]
 - (void)delayedTearDown;
 
 - (void)setTransparent:(BOOL)transparent;
 
 - (void)sendFocusEvent:(PRUint32)eventType;
-
-- (void) processPluginKeyEvent:(EventRef)aKeyEvent;
 @end
 
 
 
 //-------------------------------------------------------------------------
 //
 // nsTSMManager
 //
@@ -414,12 +377,10 @@ protected:
   PRPackedBool          mPluginIsCG; // true if this is a CoreGraphics plugin
 
   PRPackedBool          mInSetFocus;
 
   nsPluginPort          mPluginPort;
   nsIPluginInstanceOwner* mPluginInstanceOwner; // [WEAK]
 };
 
-void NS_InstallPluginKeyEventsHandler();
-void NS_RemovePluginKeyEventsHandler();
 
 #endif // nsChildView_h_
--- a/widget/src/cocoa/nsChildView.mm
+++ b/widget/src/cocoa/nsChildView.mm
@@ -2159,18 +2159,16 @@ NSEvent* gLastDragEvent = nil;
     mKeyPressSent = NO;
 
     // initialization for NSTextInput
     mMarkedRange.location = NSNotFound;
     mMarkedRange.length = 0;
 
     mLastMouseDownEvent = nil;
     mDragService = nsnull;
-
-    mPluginTSMDoc = nil;
   }
   
   // register for things we'll take from other applications
   PR_LOG(sCocoaLog, PR_LOG_ALWAYS, ("ChildView initWithFrame: registering drag types\n"));
   [self registerForDraggedTypes:[NSArray arrayWithObjects:NSFilenamesPboardType,
                                                           NSStringPboardType,
                                                           NSURLPboardType,
                                                           NSFilesPromisePboardType,
@@ -2187,18 +2185,16 @@ NSEvent* gLastDragEvent = nil;
 
 
 - (void)dealloc
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
 
   [mPendingDirtyRects release];
   [mLastMouseDownEvent release];
-  if (mPluginTSMDoc)
-    ::DeleteTSMDocument(mPluginTSMDoc);
   
   if (sLastViewEntered == self)
     sLastViewEntered = nil;
 
   [super dealloc];    
 
   // This sets the current port to _savePort.
   // todo: Only do if a Quickdraw plugin is present in the hierarchy!
@@ -4433,81 +4429,16 @@ GetUSLayoutCharFromKeyTranslate(UInt32 a
 
   if (outGeckoEvent->message == NS_KEY_PRESS && !outGeckoEvent->isMeta)
     [NSCursor setHiddenUntilMouseMoves:YES];
 
   NS_OBJC_END_TRY_ABORT_BLOCK;
 }
 
 
-// Called from PluginKeyEventsHandler() (a handler for Carbon TSM events) to
-// process a Carbon key event for the currently focused plugin.  Both Unicode
-// characters and "Mac encoding characters" (in the MBCS or "multibyte
-// character system") are (or should be) available from aKeyEvent, but here we
-// use the MCBS characters.  This is how the WebKit does things, and seems to
-// be what plugins expect.
-- (void) processPluginKeyEvent:(EventRef)aKeyEvent
-{
-  NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
-
-  UInt32 numCharCodes;
-  OSStatus status = ::GetEventParameter(aKeyEvent, kEventParamKeyMacCharCodes,
-                                        typeChar, NULL, 0, &numCharCodes, NULL);
-  if (status != noErr)
-    return;
-
-  nsAutoTArray<unsigned char, 3> charCodes;
-  charCodes.SetLength(numCharCodes);
-  status = ::GetEventParameter(aKeyEvent, kEventParamKeyMacCharCodes,
-                              typeChar, NULL, numCharCodes, NULL, charCodes.Elements());
-  if (status != noErr)
-    return;
-
-  EventRef cloneEvent = ::CopyEvent(aKeyEvent);
-  for (unsigned int i = 0; i < numCharCodes; ++i) {
-    status = ::SetEventParameter(cloneEvent, kEventParamKeyMacCharCodes,
-                                 typeChar, 1, charCodes.Elements() + i);
-    if (status != noErr)
-      return;
-
-    EventRecord eventRec;
-    if (::ConvertEventRefToEventRecord(cloneEvent, &eventRec)) {
-      PRUint32 keyCode(GetGeckoKeyCodeFromChar((PRUnichar)charCodes.ElementAt(i)));
-      PRUint32 charCode(charCodes.ElementAt(i));
-
-      // For some reason we must send just an NS_KEY_PRESS to Gecko here:  If
-      // we send an NS_KEY_DOWN plus an NS_KEY_PRESS, or just an NS_KEY_DOWN,
-      // the plugin receives two events.
-      nsKeyEvent keyPressEvent(PR_TRUE, NS_KEY_PRESS, mGeckoChild);
-      keyPressEvent.time      = PR_IntervalNow();
-      keyPressEvent.nativeMsg = &eventRec;
-      if (IsSpecialGeckoKey(keyCode)) {
-        keyPressEvent.keyCode  = keyCode;
-      } else {
-        keyPressEvent.charCode = charCode;
-        keyPressEvent.isChar   = PR_TRUE;
-      }
-      mGeckoChild->DispatchWindowEvent(keyPressEvent);
-
-      // PluginKeyEventsHandler() never sends us keyUp events, so we need to
-      // synthesize them for Gecko.
-      nsKeyEvent keyUpEvent(PR_TRUE, NS_KEY_UP, mGeckoChild);
-      keyUpEvent.time      = PR_IntervalNow();
-      keyUpEvent.keyCode   = keyCode;
-      keyUpEvent.nativeMsg = &eventRec;
-      mGeckoChild->DispatchWindowEvent(keyUpEvent);
-    }
-  }
-
-  ::ReleaseEvent(cloneEvent);
-
-  NS_OBJC_END_TRY_ABORT_BLOCK;
-}
-
-
 - (nsRect)sendCompositionEvent:(PRInt32) aEventType
 {
 #ifdef DEBUG_IME
   NSLog(@"****in sendCompositionEvent; type = %d", aEventType);
 #endif
 
   if (!mGeckoChild)
     return nsRect(0, 0, 0, 0);
@@ -5113,73 +5044,19 @@ static const char* ToEscapedString(NSStr
   mKeyDownHandled = PR_FALSE;
 
   return handled;
 
   NS_OBJC_END_TRY_ABORT_BLOCK_RETURN(NO);
 }
 
 
-// Create a TSM document for use with plugins, so that we can support IME in
-// them.  Once it's created, if need be (re)activate it.  Some plugins (e.g.
-// the Flash plugin running in Camino) don't create their own TSM document --
-// without which IME can't work.  Others (e.g. the Flash plugin running in
-// Firefox) create a TSM document that (somehow) makes the input window behave
-// badly when it contains more than one kind of input (say Hiragana and
-// Romaji).  (We can't just use the per-NSView TSM documents that Cocoa
-// provices (those created and managed by the NSTSMInputContext class) -- for
-// some reason TSMProcessRawKeyEvent() doesn't work with them.)
-- (void)activatePluginTSMDoc
-{
-  if (!mPluginTSMDoc) {
-    // Create a TSM document that supports both non-Unicode and Unicode input.
-    // Though [ChildView processPluginKeyEvent:] only sends Mac char codes to
-    // the plugin, this makes the input window behave better when it contains
-    // more than one kind of input (say Hiragana and Romaji).  This is what
-    // the OS does when it creates a TSM document for use by an
-    // NSTSMInputContext class.
-    InterfaceTypeList supportedServices;
-    supportedServices[0] = kTextServiceDocumentInterfaceType;
-    supportedServices[1] = kUnicodeDocumentInterfaceType;
-    ::NewTSMDocument(2, supportedServices, &mPluginTSMDoc, 0);
-    // We'll need to use the "input window".
-    ::UseInputWindow(mPluginTSMDoc, YES);
-    ::ActivateTSMDocument(mPluginTSMDoc);
-  } else if (::TSMGetActiveDocument() != mPluginTSMDoc) {
-    ::ActivateTSMDocument(mPluginTSMDoc);
-  }
-}
-
-
 - (void)keyDown:(NSEvent*)theEvent
 {
-  NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
-
-  // If a plugin has the focus, we need to use an alternate method for
-  // handling NSKeyDown and NSKeyUp events (otherwise Carbon-based IME won't
-  // work in plugins like the Flash plugin).  The same strategy is used by the
-  // WebKit.  See PluginKeyEventsHandler() and [ChildView processPluginKeyEvent:]
-  // for more info.
-  if (mGeckoChild && mIsPluginView) {
-    [self activatePluginTSMDoc];
-    // We use the active TSM document to pass a pointer to ourselves (the
-    // currently focused ChildView) to PluginKeyEventsHandler().  Because this
-    // pointer is weak, we should retain and release ourselves around the call
-    // to TSMProcessRawKeyEvent().
-    nsAutoRetainCocoaObject kungFuDeathGrip(self);
-    ::TSMSetDocumentProperty(mPluginTSMDoc, kFocusedChildViewTSMDocPropertyTag,
-                             sizeof(ChildView *), &self);
-    ::TSMProcessRawKeyEvent([theEvent _eventRef]);
-    ::TSMRemoveDocumentProperty(mPluginTSMDoc, kFocusedChildViewTSMDocPropertyTag);
-    return;
-  }
-
   [self processKeyDownEvent:theEvent keyEquiv:NO];
-
-  NS_OBJC_END_TRY_ABORT_BLOCK;
 }
 
 
 static BOOL keyUpAlreadySentKeyDown = NO;
 
 - (void)keyUp:(NSEvent*)theEvent
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
@@ -5189,25 +5066,16 @@ static BOOL keyUpAlreadySentKeyDown = NO
   nsCAutoString str2;
 #endif
   PR_LOG(sCocoaLog, PR_LOG_ALWAYS,
          ("ChildView keyUp: keycode=%d,modifiers=%x,chars=%s,charsIgnoringModifiers=%s\n",
           [theEvent keyCode], [theEvent modifierFlags],
           ToEscapedString([theEvent characters], str1),
           ToEscapedString([theEvent charactersIgnoringModifiers], str2)));
 
-  if (mGeckoChild && mIsPluginView) {
-    // I'm not sure the call to TSMProcessRawKeyEvent() is needed here (though
-    // WebKit makes one).  But we definitely need to short-circuit NSKeyUp
-    // handling when a plugin has the focus -- since we synthesize keyUp events
-    // in [ChildView processPluginKeyEvent:].
-    ::TSMProcessRawKeyEvent([theEvent _eventRef]);
-    return;
-  }
-
   // if we don't have any characters we can't generate a keyUp event
   if (!mGeckoChild || [[theEvent characters] length] == 0)
     return;
 
   nsAutoRetainCocoaObject kungFuDeathGrip(self);
 
   // Cocoa doesn't send an NSKeyDown event for control-tab on 10.4, so if this
   // is an NSKeyUp event for control-tab, send a down event to gecko first.
@@ -5987,77 +5855,8 @@ nsTSMManager::CancelIME()
   // If the composing transaction is still there, KillComposing only kills the
   // composing in TSM. We also need to kill the our composing transaction too.
   NSAttributedString* str = [[NSAttributedString alloc] initWithString:@""];
   [sComposingView insertText:str];
   [str release];
 
   NS_OBJC_END_TRY_ABORT_BLOCK;
 }
-
-
-// Target for text services events sent as the result of calls made to
-// TSMProcessRawKeyEvent() in [ChildView keyDown:] (above) when a plugin has
-// the focus.  The calls to TSMProcessRawKeyEvent() short-circuit Cocoa-based
-// IME (which would otherwise interfere with our efforts) and allow Carbon-
-// based IME to work in plugins (via the NPAPI).  This strategy doesn't cause
-// trouble for plugins that (like the Java Embedding Plugin) bypass the NPAPI
-// to get their keyboard events and do their own Cocoa-based IME.
-OSStatus PluginKeyEventsHandler(EventHandlerCallRef inHandlerRef,
-                                EventRef inEvent, void *userData)
-{
-  id arp = [[NSAutoreleasePool alloc] init];
-
-  TSMDocumentID activeDoc = ::TSMGetActiveDocument();
-  if (!activeDoc) {
-    [arp release];
-    return eventNotHandledErr;
-  }
-
-  ChildView *target = nil;
-  OSStatus status = ::TSMGetDocumentProperty(activeDoc, kFocusedChildViewTSMDocPropertyTag,
-                                             sizeof(ChildView *), nil, &target);
-  if (status != noErr)
-    target = nil;
-  if (!target) {
-    [arp release];
-    return eventNotHandledErr;
-  }
-
-  EventRef keyEvent = NULL;
-  status = ::GetEventParameter(inEvent, kEventParamTextInputSendKeyboardEvent,
-                               typeEventRef, NULL, sizeof(EventRef), NULL, &keyEvent);
-  if ((status != noErr) || !keyEvent) {
-    [arp release];
-    return eventNotHandledErr;
-  }
-
-  [target processPluginKeyEvent:keyEvent];
-
-  [arp release];
-  return noErr;
-}
-
-static EventHandlerRef gPluginKeyEventsHandler = NULL;
-
-// Called from nsAppShell::Init()
-void NS_InstallPluginKeyEventsHandler()
-{
-  if (gPluginKeyEventsHandler)
-    return;
-  static const EventTypeSpec sTSMEvents[] =
-    { { kEventClassTextInput, kEventTextInputUnicodeForKeyEvent } };
-  ::InstallEventHandler(::GetEventDispatcherTarget(),
-                        ::NewEventHandlerUPP(PluginKeyEventsHandler),
-                        GetEventTypeCount(sTSMEvents),
-                        sTSMEvents,
-                        NULL,
-                        &gPluginKeyEventsHandler);
-}
-
-// Called from nsAppShell::Exit()
-void NS_RemovePluginKeyEventsHandler()
-{
-  if (!gPluginKeyEventsHandler)
-    return;
-  ::RemoveEventHandler(gPluginKeyEventsHandler);
-  gPluginKeyEventsHandler = NULL;
-}
--- a/widget/src/os2/Makefile.in
+++ b/widget/src/os2/Makefile.in
@@ -117,16 +117,18 @@ HAS_EXTRAEXPORTS = 1
 endif
 
 include $(topsrcdir)/config/rules.mk
 
 DEFINES		+= -D_IMPL_NS_WIDGET
 
 DEFINES += -DUSE_OS2_TOOLKIT_HEADERS
 
+DEFINES += -DMOZ_APP_DISPLAYNAME=\"$(MOZ_APP_DISPLAYNAME)\"
+
 LOCAL_INCLUDES	= -I. -I$(srcdir)/../xpwidgets -I$(srcdir)
 
 export::
 	test -d ./res || mkdir ./res
 	test -f ./res/aliasb.ptr || cp $(srcdir)/res/*.* ./res
 
 ADD_TO_DEF_FILE = cat < $(srcdir)/extradefs.os2 >>$(DEF_FILE)
 
--- a/widget/src/os2/nsDeviceContextSpecOS2.cpp
+++ b/widget/src/os2/nsDeviceContextSpecOS2.cpp
@@ -42,16 +42,17 @@
 #include "nsDeviceContextSpecOS2.h"
 
 #include "nsReadableUtils.h"
 #include "nsISupportsArray.h"
 
 #include "nsIPrefService.h"
 #include "nsIPrefBranch.h"
 #include "prenv.h" /* for PR_GetEnv */
+#include "prtime.h"
 
 #include "nsPrintfCString.h"
 #include "nsIServiceManager.h"
 #include "nsUnicharUtils.h"
 #include "nsStringFwd.h"
 #include "nsStringEnumerator.h"
 
 #include "nsOS2Uni.h"
@@ -339,27 +340,44 @@ nsresult nsDeviceContextSpecOS2::GetPRTQ
 NS_IMETHODIMP nsDeviceContextSpecOS2::GetSurfaceForPrinter(gfxASurface **surface)
 {
   NS_ASSERTION(mQueue, "Queue can't be NULL here");
 
   nsRefPtr<gfxASurface> newSurface;
 
   PRInt16 outputFormat;
   mPrintSettings->GetOutputFormat(&outputFormat);
+  // for now always set the output format to PDF, see bug 415522:
+  printf("print output format is %d but we are setting it to %d (PDF)\n",
+         outputFormat, nsIPrintSettings::kOutputFormatPDF);
+  outputFormat = nsIPrintSettings::kOutputFormatPDF;
+  mPrintSettings->SetOutputFormat(outputFormat); // save PDF format in settings
 
   if (outputFormat == nsIPrintSettings::kOutputFormatPDF) {
     nsXPIDLString filename;
     mPrintSettings->GetToFileName(getter_Copies(filename));
     nsresult rv;
     if (filename.IsEmpty()) {
       // print to a file that is visible, like one on the Desktop
       nsCOMPtr<nsIFile> pdfLocation;
       rv = NS_GetSpecialDirectory(NS_OS_DESKTOP_DIR, getter_AddRefs(pdfLocation));
       NS_ENSURE_SUCCESS(rv, rv);
-      rv = pdfLocation->AppendNative(NS_LITERAL_CSTRING("moz_print.pdf"));
+
+      // construct a print output name using the current time, to make it
+      // unique and not overwrite existing files
+      char printName[CCHMAXPATH];
+      PRExplodedTime time;
+      PR_ExplodeTime(PR_Now(), PR_LocalTimeParameters, &time);
+      snprintf(printName, CCHMAXPATH-1, "%s_%04d%02d%02d_%02d%02d%02d.pdf",
+               MOZ_APP_DISPLAYNAME, time.tm_year, time.tm_month+1, time.tm_mday,
+               time.tm_hour, time.tm_min, time.tm_sec);
+      printName[CCHMAXPATH-1] = '\0';
+
+      nsCAutoString printString(printName);
+      rv = pdfLocation->AppendNative(printString);
       NS_ENSURE_SUCCESS(rv, rv);
       rv = pdfLocation->GetPath(filename);
       NS_ENSURE_SUCCESS(rv, rv);
     }
 #ifdef debug_thebes_print
     printf("nsDeviceContextSpecOS2::GetSurfaceForPrinter(): print to filename=%s\n",
            NS_LossyConvertUTF16toASCII(filename).get());
 #endif
@@ -413,16 +431,29 @@ NS_IMETHODIMP nsDeviceContextSpecOS2::Ge
     width = width * hDPI / 1440;
     height = height * vDPI / 1440;
 #ifdef debug_thebes_print
     printf("nsDeviceContextSpecOS2::GetSurfaceForPrinter(): %fx%fpx (res=%fx%f)\n"
            "  expected size: %7.2f MiB\n",
            width, height, hDPI, vDPI, width*height*4./1024./1024.);
 #endif
 
+    // perhaps restrict to usable area
+    // (this or scaling down won't help, we will just get more pages and still crash!)
+    if (DevQueryCaps(mPrintDC, CAPS_WIDTH, 1, &value) && width > (double)value)
+      width = (double)value;
+    if (DevQueryCaps(mPrintDC, CAPS_HEIGHT, 1, &value) && height > (double)value)
+      height = (double)value;
+
+#ifdef debug_thebes_print
+    printf("nsDeviceContextSpecOS2::GetSurfaceForPrinter(): capped? %fx%fpx (res=%fx%f)\n"
+           "  expected size: %7.2f MiB per page\n",
+           width, height, hDPI, vDPI, width*height*4./1024./1024.);
+#endif
+
     // Now pass the created DC into the thebes surface for printing.
     // It gets destroyed there.
     newSurface = new(std::nothrow)
       gfxOS2Surface(mPrintDC, gfxIntSize(int(ceil(width)), int(ceil(height))));
   }
   if (!newSurface) {
     *surface = nsnull;
     return NS_ERROR_FAILURE;
@@ -453,41 +484,60 @@ NS_IMETHODIMP nsDeviceContextSpecOS2::Be
                                                     PRInt32 aStartPage,
                                                     PRInt32 aEndPage)
 {
 #ifdef debug_thebes_print
   printf("nsDeviceContextSpecOS2[%#x]::BeginPrinting(%s, %s)\n", (unsigned)this,
          NS_LossyConvertUTF16toASCII(nsString(aTitle)).get(),
          NS_LossyConvertUTF16toASCII(nsString(aPrintToFileName)).get());
 #endif
+  // don't try to send device escapes for non-native output (like PDF)
+  PRInt16 outputFormat;
+  mPrintSettings->GetOutputFormat(&outputFormat);
+  if (outputFormat != nsIPrintSettings::kOutputFormatNative) {
+    return NS_OK;
+  }
+
   char *title = GetACPString(aTitle);
   const PSZ pszGenericDocName = "Mozilla Document";
   PSZ pszDocName = title ? title : pszGenericDocName;
   LONG lResult = DevEscape(mPrintDC, DEVESC_STARTDOC,
                            strlen(pszDocName) + 1, pszDocName,
                            (PLONG)NULL, (PBYTE)NULL);
   mPrintingStarted = PR_TRUE;
   if (title) {
     nsMemory::Free(title);
   }
 
   return lResult == DEV_OK ? NS_OK : NS_ERROR_GFX_PRINTER_STARTDOC;
 }
 
 NS_IMETHODIMP nsDeviceContextSpecOS2::EndDocument()
 {
+  PRInt16 outputFormat;
+  mPrintSettings->GetOutputFormat(&outputFormat);
+  if (outputFormat != nsIPrintSettings::kOutputFormatNative) {
+    return NS_OK;
+  }
+
   LONG lOutCount = 2;
   USHORT usJobID = 0;
   LONG lResult = DevEscape(mPrintDC, DEVESC_ENDDOC, 0L, (PBYTE)NULL,
                            &lOutCount, (PBYTE)&usJobID);
   return lResult == DEV_OK ? NS_OK : NS_ERROR_GFX_PRINTER_ENDDOC;
 }
 
 NS_IMETHODIMP nsDeviceContextSpecOS2::BeginPage()
 {
+  PRInt16 outputFormat;
+  mPrintSettings->GetOutputFormat(&outputFormat);
+  if (outputFormat != nsIPrintSettings::kOutputFormatNative) {
+    return NS_OK;
+  }
+
   if (mPrintingStarted) {
     // we don't want an extra page break at the start of the document
     mPrintingStarted = PR_FALSE;
     return NS_OK;
   }
   LONG lResult = DevEscape(mPrintDC, DEVESC_NEWFRAME, 0L, (PBYTE)NULL,
                            (PLONG)NULL, (PBYTE)NULL);
   return lResult == DEV_OK ? NS_OK : NS_ERROR_GFX_PRINTER_STARTPAGE;
--- a/xpcom/typelib/xpidl/Makefile.in
+++ b/xpcom/typelib/xpidl/Makefile.in
@@ -129,16 +129,21 @@ LDFLAGS := $(shell echo $(LDFLAGS)|sed -
 endif # _STRIP_SDK
 
 endif # Darwin
 
 include $(topsrcdir)/config/rules.mk
 
 CFLAGS		+= $(LIBIDL_CFLAGS)
 
+# Do not link to jemalloc
+ifeq ($(OS_ARCH),SunOS)
+SOLARIS_JEMALLOC_LDFLAGS =
+endif
+
 # Compile directly against the static lib, so we can use xpidl during the build
 # without the shared library path being set.
 ifneq (,$(filter WINNT WINCE OS2,$(OS_ARCH)))
 DEFINES		+= -DEXPORT_XPT_API
 ifndef GNU_CC
 LDFLAGS += \
 	-SUBSYSTEM:CONSOLE \
 	-NODEFAULTLIB:MSVCRTD \
--- a/xpcom/typelib/xpt/tools/Makefile.in
+++ b/xpcom/typelib/xpt/tools/Makefile.in
@@ -57,16 +57,21 @@ ifdef CROSS_COMPILE
 HOST_SIMPLE_PROGRAMS	= $(addprefix host_, $(SIMPLE_PROGRAMS:$(BIN_SUFFIX)=$(HOST_BIN_SUFFIX)))
 HOST_CSRCS		= $(CSRCS)
 endif
 
 LIBS		= $(DIST)/lib/$(LIB_PREFIX)xpt.$(LIB_SUFFIX)
 
 include $(topsrcdir)/config/rules.mk
 
+# Do not link to jemalloc
+ifeq ($(OS_ARCH),SunOS)
+SOLARIS_JEMALLOC_LDFLAGS =
+endif
+
 # Compile directly against the static lib, so we can use the tools
 # during the build without the shared library path being set.
 ifeq (,$(filter-out WINNT WINCE,$(OS_ARCH)))
 DEFINES		+= -DEXPORT_XPT_API
 endif
 
 ifdef CROSS_COMPILE
 HOST_LIBS		= $(DIST)/host/lib/$(LIB_PREFIX)hostxpt.$(LIB_SUFFIX)
--- a/xpfe/components/autocomplete/resources/content/autocomplete.xml
+++ b/xpfe/components/autocomplete/resources/content/autocomplete.xml
@@ -50,20 +50,20 @@
         // set default property values
         this.ifSetAttribute("timeout", 50);
         this.ifSetAttribute("maxrows", 5);
         this.ifSetAttribute("showpopup", true);
         this.ifSetAttribute("disablehistory", true);
         this.ifSetAttribute("disableKeyNavigation", true);
         
         // initialize the search sessions
+        if (this.hasAttribute("autocompletesearch"))
+          this.initAutoCompleteSearch();
         if (this.hasAttribute("searchSessions"))
           this.initSearchSessions();
-        if (this.hasAttribute("autocompletesearch"))
-          this.initAutoCompleteSearch();
         
         // hack to work around lack of bottom-up constructor calling
         if ("initialize" in this.resultsPopup)
           this.resultsPopup.initialize();
       ]]></constructor>
 
       <destructor><![CDATA[
         this.clearResults(false);
@@ -1574,22 +1574,32 @@
         <body><![CDATA[
           if (!this.input) {
             this.tree.view = aInput.controller;
             this.view = this.tree.view;
             this.showCommentColumn = aInput.showCommentColumn;
             this.input = aInput;
             this.invalidate();
 
+            var viewer = aElement
+                .ownerDocument
+                .defaultView
+                .QueryInterface(Components.interfaces.nsIInterfaceRequestor)
+                .getInterface(Components.interfaces.nsIWebNavigation)
+                .QueryInterface(Components.interfaces.nsIDocShell)
+                .contentViewer
+                .QueryInterface(Components.interfaces.nsIMarkupDocumentViewer);
             var rect = aElement.getBoundingClientRect();
-            var width = rect.right - rect.left;
+            var width = Math.round((rect.right - rect.left) * viewer.fullZoom);
             this.setAttribute("width", width > 100 ? width : 100);
+            const nsIPopupBoxObject = Components.interfaces.nsIPopupBoxObject;
+            this.popupBoxObject.setConsumeRollupEvent(aInput.consumeRollupEvent
+              ? nsIPopupBoxObject.ROLLUP_CONSUME
+              : nsIPopupBoxObject.ROLLUP_NO_CONSUME);
             this.openPopup(aElement, "after_start", 0, 0, false, false);
-
-            this.popupBoxObject.setConsumeRollupEvent(aInput.consumeRollupEvent);
           }
         ]]></body>
       </method>
 
       <method name="closePopup">
         <body>
           this.hidePopup();
         </body>