--- a/.hgignore
+++ b/.hgignore
@@ -66,8 +66,12 @@
 # git checkout of libstagefright
 ^media/libstagefright/android$
 
 # Tag files generated by GNU Global
 GTAGS
 GRTAGS
 GSYMS
 GPATH
+
+# Unit tests for Loop
+^browser/components/loop/standalone/content/config\.js$
+^browser/components/loop/standalone/node_modules/

--- a/content/base/public/nsIDocument.h
+++ b/content/base/public/nsIDocument.h
@@ -46,17 +46,16 @@ class nsIDocShell;
 class nsIDocumentEncoder;
 class nsIDocumentObserver;
 class nsIDOMDocument;
 class nsIDOMDocumentFragment;
 class nsIDOMDocumentType;
 class nsIDOMElement;
 class nsIDOMNodeFilter;
 class nsIDOMNodeList;
-class nsIDOMXPathExpression;
 class nsIDOMXPathNSResolver;
 class nsIHTMLCollection;
 class nsILayoutHistoryState;
 class nsILoadContext;
 class nsIObjectLoadingContent;
 class nsIObserver;
 class nsIPresShell;
 class nsIPrincipal;
@@ -117,16 +116,17 @@ class NodeIterator;
 class ProcessingInstruction;
 class StyleSheetList;
 class SVGDocument;
 class Touch;
 class TouchList;
 class TreeWalker;
 class UndoManager;
 class XPathEvaluator;
+class XPathExpression;
 class XPathResult;
 template<typename> class OwningNonNull;
 template<typename> class Sequence;
 
 template<typename, typename> class CallbackObjectHolder;
 typedef CallbackObjectHolder<NodeFilter, nsIDOMNodeFilter> NodeFilterHolder;
 } // namespace dom
 } // namespace mozilla
@@ -2264,17 +2264,17 @@ public:
 
   // QuerySelector and QuerySelectorAll already defined on nsINode
   nsINodeList* GetAnonymousNodes(Element& aElement);
   Element* GetAnonymousElementByAttribute(Element& aElement,
                                           const nsAString& aAttrName,
                                           const nsAString& aAttrValue);
   Element* GetBindingParent(nsINode& aNode);
   void LoadBindingDocument(const nsAString& aURI, mozilla::ErrorResult& rv);
-  already_AddRefed<nsIDOMXPathExpression>
+  mozilla::dom::XPathExpression*
     CreateExpression(const nsAString& aExpression,
                      nsIDOMXPathNSResolver* aResolver,
                      mozilla::ErrorResult& rv);
   already_AddRefed<nsIDOMXPathNSResolver>
     CreateNSResolver(nsINode* aNodeResolver, mozilla::ErrorResult& rv);
   already_AddRefed<mozilla::dom::XPathResult>
     Evaluate(JSContext* aCx, const nsAString& aExpression, nsINode* aContextNode,
              nsIDOMXPathNSResolver* aResolver, uint16_t aType,

--- a/content/base/src/nsCSPParser.cpp
+++ b/content/base/src/nsCSPParser.cpp
@@ -325,17 +325,17 @@ nsCSPParser::subHost()
   uint32_t charCounter = 0;
 
   while (!atEnd() && !peek(COLON) && !peek(SLASH)) {
     ++charCounter;
     while (hostChar()) {
       /* consume */
       ++charCounter;
     }
-    if (accept(DOT) && !accept(isCharacterToken)) {
+    if (accept(DOT) && !hostChar()) {
       return false;
     }
     if (charCounter > kSubHostPathCharacterCutoff) {
       return false;
     }
   }
   return true;
 }
@@ -361,18 +361,18 @@ nsCSPParser::host()
     if (!accept(DOT)) {
       const char16_t* params[] = { mCurToken.get() };
       logWarningErrorToConsole(nsIScriptError::warningFlag, "couldntParseInvalidHost",
                                params, ArrayLength(params));
       return nullptr;
     }
   }
 
-  // Expecting at least one Character
-  if (!accept(isCharacterToken)) {
+  // Expecting at least one host-char
+  if (!hostChar()) {
     const char16_t* params[] = { mCurToken.get() };
     logWarningErrorToConsole(nsIScriptError::warningFlag, "couldntParseInvalidHost",
                              params, ArrayLength(params));
     return nullptr;
   }
 
   // There might be several sub hosts defined.
   if (!subHost()) {
@@ -679,16 +679,17 @@ nsCSPParser::sourceList(nsTArray<nsCSPBa
 {
   bool isNone = false;
 
   // remember, srcs start at index 1
   for (uint32_t i = 1; i < mCurDir.Length(); i++) {
     // mCurToken is only set here and remains the current token
     // to be processed, which avoid passing arguments between functions.
     mCurToken = mCurDir[i];
+    resetCurValue();
 
     CSPPARSERLOG(("nsCSPParser::sourceList, mCurToken: %s, mCurValue: %s",
                  NS_ConvertUTF16toUTF8(mCurToken).get(),
                  NS_ConvertUTF16toUTF8(mCurValue).get()));
 
     // Special case handling for none:
     // Ignore 'none' if any other src is available.
     // (See http://www.w3.org/TR/CSP11/#parsing)

--- a/content/base/src/nsCSPUtils.cpp
+++ b/content/base/src/nsCSPUtils.cpp
@@ -766,18 +766,19 @@ nsCSPPolicy::permits(nsContentPolicyType
   if (defaultDir) {
     if (!defaultDir->permits(aUri, aNonce)) {
       defaultDir->toString(outViolatedDirective);
       return false;
     }
     return true;
   }
 
-  // Didn't find a directive, load is not allowed.
-  return false;
+  // unspecified default-src should default to no restrictions
+  // see bug 764937
+  return true;
 }
 
 bool
 nsCSPPolicy::allows(nsContentPolicyType aContentType,
                     enum CSPKeyword aKeyword,
                     const nsAString& aHashOrNonce) const
 {
   CSPUTILSLOG(("nsCSPPolicy::allows, aKeyWord: %s, a HashOrNonce: %s",

--- a/content/base/src/nsDOMCaretPosition.cpp
+++ b/content/base/src/nsDOMCaretPosition.cpp
@@ -46,17 +46,17 @@ nsDOMCaretPosition::GetClientRect() cons
                                              mOffset,
                                              getter_AddRefs<nsRange>(domRange));
   if (!NS_SUCCEEDED(creationRv)) {
     return nullptr;
   }
 
   NS_ASSERTION(domRange, "unable to retrieve valid dom range from CaretPosition");
 
-  rect = domRange->GetBoundingClientRect();
+  rect = domRange->GetBoundingClientRect(false);
 
   return rect.forget();
 }
 
 JSObject*
 nsDOMCaretPosition::WrapObject(JSContext *aCx)
 {
   return mozilla::dom::CaretPositionBinding::Wrap(aCx, this);

--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -97,17 +97,16 @@
 // for radio group stuff
 #include "nsIDOMHTMLInputElement.h"
 #include "nsIRadioVisitor.h"
 #include "nsIFormControl.h"
 
 #include "nsBidiUtils.h"
 
 #include "nsIDOMUserDataHandler.h"
-#include "nsIDOMXPathExpression.h"
 #include "nsIDOMXPathNSResolver.h"
 #include "nsIParserService.h"
 #include "nsContentCreatorFunctions.h"
 
 #include "nsIScriptContext.h"
 #include "nsBindingManager.h"
 #include "nsIDOMHTMLDocument.h"
 #include "nsHTMLDocument.h"
@@ -12036,17 +12035,17 @@ nsIDocument::Constructor(const GlobalObj
   }
 
   nsCOMPtr<nsIDocument> doc = do_QueryInterface(document);
   doc->SetReadyStateInternal(nsIDocument::READYSTATE_COMPLETE);
 
   return doc.forget();
 }
 
-already_AddRefed<nsIDOMXPathExpression>
+XPathExpression*
 nsIDocument::CreateExpression(const nsAString& aExpression,
                               nsIDOMXPathNSResolver* aResolver,
                               ErrorResult& rv)
 {
   return XPathEvaluator()->CreateExpression(aExpression, aResolver, rv);
 }
 
 already_AddRefed<nsIDOMXPathNSResolver>
@@ -12062,24 +12061,16 @@ nsIDocument::Evaluate(JSContext* aCx, co
                       uint16_t aType, JS::Handle<JSObject*> aResult,
                       ErrorResult& rv)
 {
   return XPathEvaluator()->Evaluate(aCx, aExpression, aContextNode, aResolver,
                                     aType, aResult, rv);
 }
 
 NS_IMETHODIMP
-nsDocument::CreateExpression(const nsAString& aExpression,
-                             nsIDOMXPathNSResolver* aResolver,
-                             nsIDOMXPathExpression** aResult)
-{
-  return XPathEvaluator()->CreateExpression(aExpression, aResolver, aResult);
-}
-
-NS_IMETHODIMP
 nsDocument::CreateNSResolver(nsIDOMNode* aNodeResolver,
                              nsIDOMXPathNSResolver** aResult)
 {
   return XPathEvaluator()->CreateNSResolver(aNodeResolver, aResult);
 }
 
 NS_IMETHODIMP
 nsDocument::Evaluate(const nsAString& aExpression, nsIDOMNode* aContextNode,

--- a/content/base/src/nsRange.cpp
+++ b/content/base/src/nsRange.cpp
@@ -2720,27 +2720,33 @@ nsRange::CreateContextualFragment(const 
   }
 
   return nsContentUtils::CreateContextualFragment(mStartParent, aFragment,
                                                   false, aRv);
 }
 
 static void ExtractRectFromOffset(nsIFrame* aFrame,
                                   const nsIFrame* aRelativeTo, 
-                                  const int32_t aOffset, nsRect* aR, bool aKeepLeft)
+                                  const int32_t aOffset, nsRect* aR, bool aKeepLeft,
+                                  bool aClampToEdge)
 {
   nsPoint point;
   aFrame->GetPointFromOffset(aOffset, &point);
 
   point += aFrame->GetOffsetTo(aRelativeTo);
 
-  //given a point.x, extract left or right portion of rect aR
-  //point.x has to be within this rect
-  NS_ASSERTION(aR->x <= point.x && point.x <= aR->XMost(),
-                   "point.x should not be outside of rect r");
+  if (!aClampToEdge && !aR->Contains(point)) {
+    aR->width = 0;
+    aR->x = point.x;
+    return;
+  }
+
+  if (aClampToEdge) {
+    point = aR->ClampPoint(point);
+  }
 
   if (aKeepLeft) {
     aR->width = point.x - aR->x;
   } else {
     aR->width = aR->XMost() - point.x;
     aR->x = point.x;
   }
 }
@@ -2757,50 +2763,52 @@ GetTextFrameForContent(nsIContent* aCont
     if (frame && frame->GetType() == nsGkAtoms::textFrame) {
       return static_cast<nsTextFrame*>(frame);
     }
   }
   return nullptr;
 }
 
 static nsresult GetPartialTextRect(nsLayoutUtils::RectCallback* aCallback,
-                                   nsIContent* aContent, int32_t aStartOffset, int32_t aEndOffset)
+                                   nsIContent* aContent, int32_t aStartOffset,
+                                   int32_t aEndOffset, bool aClampToEdge)
 {
   nsTextFrame* textFrame = GetTextFrameForContent(aContent);
   if (textFrame) {
     nsIFrame* relativeTo = nsLayoutUtils::GetContainingBlockForClientRect(textFrame);
     for (nsTextFrame* f = textFrame; f; f = static_cast<nsTextFrame*>(f->GetNextContinuation())) {
       int32_t fstart = f->GetContentOffset(), fend = f->GetContentEnd();
       if (fend <= aStartOffset || fstart >= aEndOffset)
         continue;
 
       // overlapping with the offset we want
       f->EnsureTextRun(nsTextFrame::eInflated);
       NS_ENSURE_TRUE(f->GetTextRun(nsTextFrame::eInflated), NS_ERROR_OUT_OF_MEMORY);
       bool rtl = f->GetTextRun(nsTextFrame::eInflated)->IsRightToLeft();
       nsRect r(f->GetOffsetTo(relativeTo), f->GetSize());
       if (fstart < aStartOffset) {
         // aStartOffset is within this frame
-        ExtractRectFromOffset(f, relativeTo, aStartOffset, &r, rtl);
+        ExtractRectFromOffset(f, relativeTo, aStartOffset, &r, rtl, aClampToEdge);
       }
       if (fend > aEndOffset) {
         // aEndOffset is in the middle of this frame
-        ExtractRectFromOffset(f, relativeTo, aEndOffset, &r, !rtl);
+        ExtractRectFromOffset(f, relativeTo, aEndOffset, &r, !rtl, aClampToEdge);
       }
       aCallback->AddRect(r);
     }
   }
   return NS_OK;
 }
 
 /* static */ void
 nsRange::CollectClientRects(nsLayoutUtils::RectCallback* aCollector,
                             nsRange* aRange,
                             nsINode* aStartParent, int32_t aStartOffset,
-                            nsINode* aEndParent, int32_t aEndOffset)
+                            nsINode* aEndParent, int32_t aEndOffset,
+                            bool aClampToEdge)
 {
   // Hold strong pointers across the flush
   nsCOMPtr<nsINode> startContainer = aStartParent;
   nsCOMPtr<nsINode> endContainer = aEndParent;
 
   // Flush out layout so our frames are up to date.
   if (!aStartParent->IsInDoc()) {
     return;
@@ -2827,17 +2835,17 @@ nsRange::CollectClientRects(nsLayoutUtil
         int32_t outOffset;
         nsIFrame* outFrame;
         textFrame->GetChildFrameContainingOffset(aStartOffset, false,
           &outOffset, &outFrame);
         if (outFrame) {
            nsIFrame* relativeTo =
              nsLayoutUtils::GetContainingBlockForClientRect(outFrame);
            nsRect r(outFrame->GetOffsetTo(relativeTo), outFrame->GetSize());
-           ExtractRectFromOffset(outFrame, relativeTo, aStartOffset, &r, false);
+           ExtractRectFromOffset(outFrame, relativeTo, aStartOffset, &r, false, aClampToEdge);
            r.width = 0;
            aCollector->AddRect(r);
         }
       }
     }
     return;
   }
 
@@ -2846,78 +2854,78 @@ nsRange::CollectClientRects(nsLayoutUtil
     iter.Next();
     nsCOMPtr<nsIContent> content = do_QueryInterface(node);
     if (!content)
       continue;
     if (content->IsNodeOfType(nsINode::eTEXT)) {
        if (node == startContainer) {
          int32_t offset = startContainer == endContainer ?
            aEndOffset : content->GetText()->GetLength();
-         GetPartialTextRect(aCollector, content, aStartOffset, offset);
+         GetPartialTextRect(aCollector, content, aStartOffset, offset, aClampToEdge);
          continue;
        } else if (node == endContainer) {
-         GetPartialTextRect(aCollector, content, 0, aEndOffset);
+         GetPartialTextRect(aCollector, content, 0, aEndOffset, aClampToEdge);
          continue;
        }
     }
 
     nsIFrame* frame = content->GetPrimaryFrame();
     if (frame) {
       nsLayoutUtils::GetAllInFlowRects(frame,
         nsLayoutUtils::GetContainingBlockForClientRect(frame), aCollector);
     }
   } while (!iter.IsDone());
 }
 
 NS_IMETHODIMP
 nsRange::GetBoundingClientRect(nsIDOMClientRect** aResult)
 {
-  *aResult = GetBoundingClientRect().take();
+  *aResult = GetBoundingClientRect(true).take();
   return NS_OK;
 }
 
 already_AddRefed<DOMRect>
-nsRange::GetBoundingClientRect()
+nsRange::GetBoundingClientRect(bool aClampToEdge)
 {
   nsRefPtr<DOMRect> rect = new DOMRect(ToSupports(this));
   if (!mStartParent) {
     return rect.forget();
   }
 
   nsLayoutUtils::RectAccumulator accumulator;
   CollectClientRects(&accumulator, this, mStartParent, mStartOffset, 
-    mEndParent, mEndOffset);
+    mEndParent, mEndOffset, aClampToEdge);
 
   nsRect r = accumulator.mResultRect.IsEmpty() ? accumulator.mFirstRect : 
     accumulator.mResultRect;
   rect->SetLayoutRect(r);
   return rect.forget();
 }
 
 NS_IMETHODIMP
 nsRange::GetClientRects(nsIDOMClientRectList** aResult)
 {
-  *aResult = GetClientRects().take();
+  *aResult = GetClientRects(true).take();
   return NS_OK;
 }
 
 already_AddRefed<DOMRectList>
-nsRange::GetClientRects()
+nsRange::GetClientRects(bool aClampToEdge)
 {
   if (!mStartParent) {
     return nullptr;
   }
 
   nsRefPtr<DOMRectList> rectList =
     new DOMRectList(static_cast<nsIDOMRange*>(this));
 
   nsLayoutUtils::RectListBuilder builder(rectList);
 
   CollectClientRects(&builder, this, mStartParent, mStartOffset, 
-    mEndParent, mEndOffset);
+    mEndParent, mEndOffset, aClampToEdge);
   return rectList.forget();
 }
 
 NS_IMETHODIMP
 nsRange::GetUsedFontFaces(nsIDOMFontFaceList** aResult)
 {
   *aResult = nullptr;
 

--- a/content/base/src/nsRange.h
+++ b/content/base/src/nsRange.h
@@ -212,18 +212,18 @@ public:
   void SelectNodeContents(nsINode& aNode, ErrorResult& aErr);
   void SetEnd(nsINode& aNode, uint32_t aOffset, ErrorResult& aErr);
   void SetEndAfter(nsINode& aNode, ErrorResult& aErr);
   void SetEndBefore(nsINode& aNode, ErrorResult& aErr);
   void SetStart(nsINode& aNode, uint32_t aOffset, ErrorResult& aErr);
   void SetStartAfter(nsINode& aNode, ErrorResult& aErr);
   void SetStartBefore(nsINode& aNode, ErrorResult& aErr);
   void SurroundContents(nsINode& aNode, ErrorResult& aErr);
-  already_AddRefed<DOMRect> GetBoundingClientRect();
-  already_AddRefed<DOMRectList> GetClientRects();
+  already_AddRefed<DOMRect> GetBoundingClientRect(bool aClampToEdge = true);
+  already_AddRefed<DOMRectList> GetClientRects(bool aClampToEdge = true);
 
   nsINode* GetParentObject() const { return mOwner; }
   virtual JSObject* WrapObject(JSContext* cx) MOZ_OVERRIDE MOZ_FINAL;
 
 private:
   // no copy's or assigns
   nsRange(const nsRange&);
   nsRange& operator=(const nsRange&);
@@ -254,17 +254,18 @@ public:
                                      bool *outNodeAfter);
 
   static bool IsNodeSelected(nsINode* aNode, uint32_t aStartOffset,
                              uint32_t aEndOffset);
 
   static void CollectClientRects(nsLayoutUtils::RectCallback* aCollector,
                                  nsRange* aRange,
                                  nsINode* aStartParent, int32_t aStartOffset,
-                                 nsINode* aEndParent, int32_t aEndOffset);
+                                 nsINode* aEndParent, int32_t aEndOffset,
+                                 bool aClampToEdge);
 
   typedef nsTHashtable<nsPtrHashKey<nsRange> > RangeHashTable;
 protected:
   void RegisterCommonAncestor(nsINode* aNode);
   void UnregisterCommonAncestor(nsINode* aNode);
   nsINode* IsValidBoundary(nsINode* aNode);
 
   // CharacterDataChanged set aNotInsertedYet to true to disable an assertion

--- a/content/base/test/TestCSPParser.cpp
+++ b/content/base/test/TestCSPParser.cpp
@@ -390,16 +390,24 @@ nsresult TestSimplePolicies() {
     { " ; ; ; ;     default-src            abc    ; ; ; ;",
       "default-src http://abc" },
     { "script-src 'none' 'none' 'none';",
       "script-src 'none'" },
     { "script-src http://www.example.com/path-1//",
       "script-src http://www.example.com" },
     { "script-src http://www.example.com/path-1//path_2",
       "script-src http://www.example.com" },
+    { "default-src 127.0.0.1",
+      "default-src http://127.0.0.1" },
+    { "default-src 127.0.0.1:*",
+      "default-src http://127.0.0.1:*" },
+    { "default-src -; ",
+      "default-src http://-" },
+    { "script-src 1",
+      "script-src http://1" }
   };
 
   uint32_t policyCount = sizeof(policies) / sizeof(PolicyTest);
   return runTestSuite(policies, policyCount, 1);
 }
 
 // ============================= TestPoliciesThatLogWarning ========================
 
@@ -427,18 +435,16 @@ nsresult TestBadPolicies() {
     { "default-src 'self", "" },
     { "script-sr 'self", "" },
     { "default-src 'unsafe-inlin' ", "" },
     { "default-src */", "" },
     { "default-src", "" },
     { "", "" },
     { "; ; ; ; ; ; ;", "" },
     { "defaut-src asdf", "" },
-    { "default-src -; ", "" },
-    { "script-src 1", "" },
     { "default-src: aaa", "" },
     { "default-src 'unsafe-inlin' ", "" },
     { "default-src :88", "" },
     { "script-src abc::::::88", "" },
     { "asdf http://test.com", ""},
     { "script-src *.*:*", "" },
     { "img-src *::88", "" },
     { "object-src http://localhost:", "" },

--- a/content/base/test/mochitest.ini
+++ b/content/base/test/mochitest.ini
@@ -533,16 +533,17 @@ skip-if = (buildapp == 'b2g' && toolkit 
 [test_bug811701.xhtml]
 [test_bug813919.html]
 [test_bug814576.html]
 [test_bug819051.html]
 [test_bug820909.html]
 [test_bug827160.html]
 skip-if = buildapp == 'b2g' || toolkit == 'android' || e10s #needs plugin support # b2g(needs plugin support) b2g-debug(debug-only failure) b2g-desktop(needs plugin support)
 [test_bug840098.html]
+[test_bug864595.html]
 [test_bug868999.html]
 [test_bug869000.html]
 [test_bug869002.html]
 [test_bug869006.html]
 [test_bug876282.html]
 [test_bug890580.html]
 [test_bug891952.html]
 [test_bug894874.html]

new file mode 100644
--- /dev/null
+++ b/content/base/test/test_bug864595.html
@@ -0,0 +1,34 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=864595
+-->
+<head>
+  <title>Test for Bug 864595</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=864595">Mozilla Bug 864595</a>
+<div id='editable' style='display:inline-block;'>abcd  </div>
+<script type="application/javascript">
+/** Test for Bug 864595 **/
+var range = document.createRange();
+var elt = document.getElementById('editable');
+var eltRect = elt.getBoundingClientRect();
+
+var txtNode = elt.childNodes[0];
+range.setStart(txtNode, 0);
+range.setEnd(txtNode, 5);
+var rect = range.getBoundingClientRect();
+ok(rect.left >= eltRect.left && rect.right <= eltRect.right, "rect.left >= eltRect.left && rect.right <= eltRect.right");
+
+/* Put caret in the space */
+var caretPosX = rect.right + 10;
+var caretPosY = (rect.top + rect.bottom ) / 2;
+var caretRect = document.caretPositionFromPoint(caretPosX, caretPosY).getClientRect();
+ok(caretRect.right >= rect.right, "caretRect.right >= rect.right");
+
+</script>
+</body>
+</html>

--- a/content/media/fmp4/wmf/WMFMediaDataDecoder.h
+++ b/content/media/fmp4/wmf/WMFMediaDataDecoder.h
@@ -8,17 +8,19 @@
 #define WMFMediaDataDecoder_h_
 
 
 #include "WMF.h"
 #include "MP4Reader.h"
 #include "MFTDecoder.h"
 #include "mozilla/RefPtr.h"
 
-class mp4_demuxer::MP4Sample;
+namespace mp4_demuxer {
+class MP4Sample;
+}
 
 namespace mozilla {
 
 // Encapsulates the initialization of the MFTDecoder appropriate for decoding
 // a given stream, and the process of converting the IMFSample produced
 // by the MFT into a MediaData object.
 class WMFOutputSource {
 public:

--- a/content/xul/templates/src/nsXMLBinding.cpp
+++ b/content/xul/templates/src/nsXMLBinding.cpp
@@ -7,73 +7,45 @@
 #include "nsXULTemplateResultXML.h"
 #include "nsXMLBinding.h"
 #include "mozilla/ErrorResult.h"
 #include "mozilla/dom/XPathResult.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
 
-NS_IMPL_CYCLE_COLLECTING_NATIVE_ADDREF(nsXMLBindingSet)
-NS_IMPL_CYCLE_COLLECTING_NATIVE_RELEASE(nsXMLBindingSet)
-
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsXMLBindingSet)
-
-NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsXMLBindingSet)
-  nsXMLBinding* binding = tmp->mFirst;
-  while (binding) {
-    binding->mExpr = nullptr;
-    binding = binding->mNext;
-  }
-NS_IMPL_CYCLE_COLLECTION_UNLINK_END
-
-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsXMLBindingSet)
-  nsXMLBinding* binding = tmp->mFirst;
-  while (binding) {
-    NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "nsXMLBinding::mExpr"); 
-    cb.NoteXPCOMChild(binding->mExpr);
-    binding = binding->mNext;
-  }
-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
-
-NS_IMPL_CYCLE_COLLECTION_ROOT_NATIVE(nsXMLBindingSet, AddRef)
-NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(nsXMLBindingSet, Release)
-
 nsXMLBindingSet::~nsXMLBindingSet()
 {}
 
-nsresult
-nsXMLBindingSet::AddBinding(nsIAtom* aVar, nsIDOMXPathExpression* aExpr)
+void
+nsXMLBindingSet::AddBinding(nsIAtom* aVar, nsAutoPtr<XPathExpression>&& aExpr)
 {
-  nsAutoPtr<nsXMLBinding> newbinding(new nsXMLBinding(aVar, aExpr));
-  NS_ENSURE_TRUE(newbinding, NS_ERROR_OUT_OF_MEMORY);
+  nsAutoPtr<nsXMLBinding> newbinding(new nsXMLBinding(aVar, Move(aExpr)));
 
   if (mFirst) {
     nsXMLBinding* binding = mFirst;
 
     while (binding) {
       // if the target variable is already used in a binding, ignore it
       // since it won't be useful for anything
       if (binding->mVar == aVar)
-        return NS_OK;
+        return;
 
       // add the binding at the end of the list
       if (!binding->mNext) {
         binding->mNext = newbinding;
-        break;
+        return;
       }
 
       binding = binding->mNext;
     }
   }
   else {
     mFirst = newbinding;
   }
-
-  return NS_OK;
 }
 
 int32_t
 nsXMLBindingSet::LookupTargetIndex(nsIAtom* aTargetVariable,
                                    nsXMLBinding** aBinding)
 {
   int32_t idx = 0;
   nsXMLBinding* binding = mFirst;
@@ -97,49 +69,40 @@ nsXMLBindingValues::GetAssignmentFor(nsX
                                      int32_t aIndex,
                                      uint16_t aType)
 {
   XPathResult* value = mValues.SafeElementAt(aIndex);
   if (value) {
     return value;
   }
 
-  nsCOMPtr<nsIDOMNode> contextNode;
-  aResult->GetNode(getter_AddRefs(contextNode));
+  nsINode* contextNode = aResult->Node();
   if (!contextNode) {
     return nullptr;
   }
 
   mValues.EnsureLengthAtLeast(aIndex + 1);
 
-  nsCOMPtr<nsISupports> resultsupports;
-  aBinding->mExpr->Evaluate(contextNode, aType,
-                            nullptr, getter_AddRefs(resultsupports));
-
-  mValues.ReplaceElementAt(aIndex, XPathResult::FromSupports(resultsupports));
+  ErrorResult ignored;
+  mValues[aIndex] = aBinding->mExpr->Evaluate(*contextNode, aType, nullptr,
+                                              ignored);
 
   return mValues[aIndex];
 }
 
-void
+nsINode*
 nsXMLBindingValues::GetNodeAssignmentFor(nsXULTemplateResultXML* aResult,
                                          nsXMLBinding* aBinding,
-                                         int32_t aIndex,
-                                         nsIDOMNode** aNode)
+                                         int32_t aIndex)
 {
   XPathResult* result = GetAssignmentFor(aResult, aBinding, aIndex,
                                          XPathResult::FIRST_ORDERED_NODE_TYPE);
 
-  nsINode* node;
   ErrorResult rv;
-  if (result && (node = result->GetSingleNodeValue(rv))) {
-    CallQueryInterface(node, aNode);
-  } else {
-    *aNode = nullptr;
-  }
+  return result ? result->GetSingleNodeValue(rv) : nullptr;
 }
 
 void
 nsXMLBindingValues::GetStringAssignmentFor(nsXULTemplateResultXML* aResult,
                                            nsXMLBinding* aBinding,
                                            int32_t aIndex,
                                            nsAString& aValue)
 {

--- a/content/xul/templates/src/nsXMLBinding.h
+++ b/content/xul/templates/src/nsXMLBinding.h
@@ -3,19 +3,20 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef nsXMLBinding_h__
 #define nsXMLBinding_h__
 
 #include "nsAutoPtr.h"
 #include "nsIAtom.h"
-#include "nsCycleCollectionParticipant.h"
 #include "mozilla/Attributes.h"
+#include "mozilla/dom/XPathExpression.h"
 
+class nsINode;
 class nsXULTemplateResultXML;
 class nsXMLBindingValues;
 namespace mozilla {
 namespace dom {
 class XPathResult;
 }
 }
 
@@ -23,21 +24,21 @@ class XPathResult;
  * Classes related to storing bindings for XML handling.
  */
 
 /**
  * a <binding> description
  */
 struct nsXMLBinding {
   nsCOMPtr<nsIAtom> mVar;
-  nsCOMPtr<nsIDOMXPathExpression> mExpr;
+  nsAutoPtr<mozilla::dom::XPathExpression> mExpr;
 
   nsAutoPtr<nsXMLBinding> mNext;
 
-  nsXMLBinding(nsIAtom* aVar, nsIDOMXPathExpression* aExpr)
+  nsXMLBinding(nsIAtom* aVar, nsAutoPtr<mozilla::dom::XPathExpression>&& aExpr)
     : mVar(aVar), mExpr(aExpr), mNext(nullptr)
   {
     MOZ_COUNT_CTOR(nsXMLBinding);
   }
 
   ~nsXMLBinding()
   {
     MOZ_COUNT_DTOR(nsXMLBinding);
@@ -48,36 +49,26 @@ struct nsXMLBinding {
  * a collection of <binding> descriptors. This object is refcounted by
  * nsXMLBindingValues objects and the query processor.
  */
 class nsXMLBindingSet MOZ_FINAL
 {
   ~nsXMLBindingSet();
 
 public:
-
-  // results hold a reference to a binding set in their
-  // nsXMLBindingValues fields
-  nsCycleCollectingAutoRefCnt mRefCnt;
-
   // pointer to the first binding in a linked list
   nsAutoPtr<nsXMLBinding> mFirst;
 
-public:
-
-  NS_METHOD_(MozExternalRefCountType) AddRef();
-  NS_METHOD_(MozExternalRefCountType) Release();
-  NS_DECL_OWNINGTHREAD
-  NS_DECL_CYCLE_COLLECTION_NATIVE_CLASS(nsXMLBindingSet)
+  NS_INLINE_DECL_REFCOUNTING(nsXMLBindingSet);
 
   /**
    * Add a binding to the set
    */
-  nsresult
-  AddBinding(nsIAtom* aVar, nsIDOMXPathExpression* aExpr);
+  void
+  AddBinding(nsIAtom* aVar, nsAutoPtr<mozilla::dom::XPathExpression>&& aExpr);
 
   /**
    * The nsXMLBindingValues class stores an array of values, one for each
    * target symbol that could be set by the bindings in the set.
    * LookupTargetIndex determines the index into the array for a given
    * target symbol.
    */
   int32_t
@@ -126,21 +117,20 @@ public:
    * aType the type of result expected
    */
   mozilla::dom::XPathResult*
   GetAssignmentFor(nsXULTemplateResultXML* aResult,
                    nsXMLBinding* aBinding,
                    int32_t idx,
                    uint16_t type);
 
-  void
+  nsINode*
   GetNodeAssignmentFor(nsXULTemplateResultXML* aResult,
                        nsXMLBinding* aBinding,
-                       int32_t idx,
-                       nsIDOMNode** aValue);
+                       int32_t idx);
 
   void
   GetStringAssignmentFor(nsXULTemplateResultXML* aResult,
                          nsXMLBinding* aBinding,
                          int32_t idx,
                          nsAString& aValue);
 };
 

--- a/content/xul/templates/src/nsXULTemplateQueryProcessorXML.cpp
+++ b/content/xul/templates/src/nsXULTemplateQueryProcessorXML.cpp
@@ -16,20 +16,21 @@
 #include "nsGkAtoms.h"
 #include "nsIURI.h"
 #include "nsIArray.h"
 #include "nsIScriptContext.h"
 #include "nsArrayUtils.h"
 #include "nsPIDOMWindow.h"
 #include "nsXULContentUtils.h"
 #include "nsXMLHttpRequest.h"
-
+#include "mozilla/dom/XPathEvaluator.h"
 #include "nsXULTemplateQueryProcessorXML.h"
 #include "nsXULTemplateResultXML.h"
 #include "nsXULSortService.h"
+#include "mozilla/dom/Element.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
 
 NS_IMPL_ISUPPORTS(nsXMLQuery, nsXMLQuery)
 
 //----------------------------------------------------------------------
 //
@@ -48,25 +49,23 @@ nsXULTemplateResultSetXML::HasMoreElemen
     *aResult = !rv.Failed() && mPosition < length;
     return NS_OK;
 }
 
 NS_IMETHODIMP
 nsXULTemplateResultSetXML::GetNext(nsISupports **aResult)
 {
     ErrorResult rv;
-    nsCOMPtr<nsIDOMNode> node =
-        do_QueryInterface(mResults->SnapshotItem(mPosition, rv));
+    nsINode* node = mResults->SnapshotItem(mPosition, rv);
     if (rv.Failed()) {
         return rv.ErrorCode();
     }
 
     nsXULTemplateResultXML* result =
-        new nsXULTemplateResultXML(mQuery, node, mBindingSet);
-    NS_ENSURE_TRUE(result, NS_ERROR_OUT_OF_MEMORY);
+        new nsXULTemplateResultXML(mQuery, node->AsContent(), mBindingSet);
 
     ++mPosition;
     *aResult = result;
     NS_ADDREF(result);
     return NS_OK;
 }
 
 
@@ -77,18 +76,16 @@ nsXULTemplateResultSetXML::GetNext(nsISu
 
 static PLDHashOperator
 TraverseRuleToBindingsMap(nsISupports* aKey, nsXMLBindingSet* aMatch, void* aContext)
 {
     nsCycleCollectionTraversalCallback *cb =
         static_cast<nsCycleCollectionTraversalCallback*>(aContext);
     NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(*cb, "mRuleToBindingsMap key");
     cb->NoteXPCOMChild(aKey);
-    NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(*cb, "mRuleToBindingsMap value");
-    cb->NoteNativeChild(aMatch, NS_CYCLE_COLLECTION_PARTICIPANT(nsXMLBindingSet));
     return PL_DHASH_NEXT;
 }
   
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsXULTemplateQueryProcessorXML)
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsXULTemplateQueryProcessorXML)
     tmp->mRuleToBindingsMap.Clear();
     NS_IMPL_CYCLE_COLLECTION_UNLINK(mRoot)
@@ -205,25 +202,24 @@ NS_IMETHODIMP
 nsXULTemplateQueryProcessorXML::InitializeForBuilding(nsISupports* aDatasource,
                                                       nsIXULTemplateBuilder* aBuilder,
                                                       nsIDOMNode* aRootNode)
 {
     if (mGenerationStarted)
         return NS_ERROR_UNEXPECTED;
 
     // the datasource is either a document or a DOM element
-    nsCOMPtr<nsIDOMDocument> doc = do_QueryInterface(aDatasource);
+    nsCOMPtr<nsIDocument> doc = do_QueryInterface(aDatasource);
     if (doc)
-        doc->GetDocumentElement(getter_AddRefs(mRoot));
+        mRoot = doc->GetDocumentElement();
     else
       mRoot = do_QueryInterface(aDatasource);
     NS_ENSURE_STATE(mRoot);
 
-    mEvaluator = do_CreateInstance("@mozilla.org/dom/xpath-evaluator;1");
-    NS_ENSURE_TRUE(mEvaluator, NS_ERROR_OUT_OF_MEMORY);
+    mEvaluator = new XPathEvaluator();
 
     return NS_OK;
 }
 
 NS_IMETHODIMP
 nsXULTemplateQueryProcessorXML::Done()
 {
     mGenerationStarted = false;
@@ -235,76 +231,70 @@ nsXULTemplateQueryProcessorXML::Done()
 
 NS_IMETHODIMP
 nsXULTemplateQueryProcessorXML::CompileQuery(nsIXULTemplateBuilder* aBuilder,
                                              nsIDOMNode* aQueryNode,
                                              nsIAtom* aRefVariable,
                                              nsIAtom* aMemberVariable,
                                              nsISupports** _retval)
 {
-    nsresult rv = NS_OK;
-
     *_retval = nullptr;
 
     nsCOMPtr<nsIContent> content = do_QueryInterface(aQueryNode);
 
     nsAutoString expr;
     content->GetAttr(kNameSpaceID_None, nsGkAtoms::expr, expr);
 
     // if an expression is not specified, then the default is to
     // just take all of the children
     if (expr.IsEmpty())
         expr.Assign('*');
 
-    nsCOMPtr<nsIDOMXPathExpression> compiledexpr;
-    rv = CreateExpression(expr, aQueryNode, getter_AddRefs(compiledexpr));
-    if (NS_FAILED(rv)) {
+    ErrorResult rv;
+    nsAutoPtr<XPathExpression> compiledexpr;
+    compiledexpr = CreateExpression(expr, content, rv);
+    if (rv.Failed()) {
         nsXULContentUtils::LogTemplateError(ERROR_TEMPLATE_BAD_XPATH);
-        return rv;
+        return rv.ErrorCode();
     }
 
     nsRefPtr<nsXMLQuery> query =
-        new nsXMLQuery(this, aMemberVariable, compiledexpr);
-    NS_ENSURE_TRUE(query, NS_ERROR_OUT_OF_MEMORY);
+        new nsXMLQuery(this, aMemberVariable, Move(compiledexpr));
 
     for (nsIContent* condition = content->GetFirstChild();
          condition;
          condition = condition->GetNextSibling()) {
 
         if (condition->NodeInfo()->Equals(nsGkAtoms::assign,
                                           kNameSpaceID_XUL)) {
             nsAutoString var;
             condition->GetAttr(kNameSpaceID_None, nsGkAtoms::var, var);
 
             nsAutoString expr;
             condition->GetAttr(kNameSpaceID_None, nsGkAtoms::expr, expr);
 
             // ignore assignments without a variable or an expression
             if (!var.IsEmpty() && !expr.IsEmpty()) {
-                nsCOMPtr<nsIDOMNode> conditionNode =
-                    do_QueryInterface(condition);
-                rv = CreateExpression(expr, conditionNode,
-                                      getter_AddRefs(compiledexpr));
-                if (NS_FAILED(rv)) {
+                compiledexpr = CreateExpression(expr, condition, rv);
+                if (rv.Failed()) {
                     nsXULContentUtils::LogTemplateError(ERROR_TEMPLATE_BAD_ASSIGN_XPATH);
-                    return rv;
+                    return rv.ErrorCode();
                 }
 
                 nsCOMPtr<nsIAtom> varatom = do_GetAtom(var);
 
-                rv = query->AddBinding(varatom, compiledexpr);
-                NS_ENSURE_SUCCESS(rv, rv);
+                query->AddBinding(varatom, Move(compiledexpr));
             }
         }
     }
 
     *_retval = query;
     NS_ADDREF(*_retval);
 
-    return rv;
+    return NS_OK;
 }
 
 NS_IMETHODIMP
 nsXULTemplateQueryProcessorXML::GenerateResults(nsISupports* aDatasource,
                                                 nsIXULTemplateResult* aRef,
                                                 nsISupports* aQuery,
                                                 nsISimpleEnumerator** aResults)
 {
@@ -313,39 +303,39 @@ nsXULTemplateQueryProcessorXML::Generate
 
     mGenerationStarted = true;
 
     nsCOMPtr<nsXMLQuery> xmlquery = do_QueryInterface(aQuery);
     if (!xmlquery)
         return NS_ERROR_INVALID_ARG;
 
     nsCOMPtr<nsISupports> supports;
-    nsCOMPtr<nsIDOMNode> context;
+    nsCOMPtr<nsINode> context;
     if (aRef)
       aRef->GetBindingObjectFor(xmlquery->GetMemberVariable(),
                                 getter_AddRefs(supports));
     context = do_QueryInterface(supports);
     if (!context)
         context = mRoot;
 
-    nsIDOMXPathExpression* expr = xmlquery->GetResultsExpression();
+    XPathExpression* expr = xmlquery->GetResultsExpression();
     if (!expr)
         return NS_ERROR_FAILURE;
 
-    nsCOMPtr<nsISupports> exprsupportsresults;
-    nsresult rv = expr->Evaluate(context,
-                                 XPathResult::ORDERED_NODE_SNAPSHOT_TYPE,
-                                 nullptr, getter_AddRefs(exprsupportsresults));
-    NS_ENSURE_SUCCESS(rv, rv);
+    ErrorResult rv;
+    nsRefPtr<XPathResult> exprresults =
+        expr->Evaluate(*context, XPathResult::ORDERED_NODE_SNAPSHOT_TYPE,
+                       nullptr, rv);
+    if (rv.Failed()) {
+        return rv.ErrorCode();
+    }
 
-    XPathResult* exprresults = XPathResult::FromSupports(exprsupportsresults);
     nsXULTemplateResultSetXML* results =
-        new nsXULTemplateResultSetXML(xmlquery, exprresults,
+        new nsXULTemplateResultSetXML(xmlquery, exprresults.forget(),
                                       xmlquery->GetBindingSet());
-    NS_ENSURE_TRUE(results, NS_ERROR_OUT_OF_MEMORY);
 
     *aResults = results;
     NS_ADDREF(*aResults);
 
     return NS_OK;
 }
 
 NS_IMETHODIMP
@@ -358,52 +348,51 @@ nsXULTemplateQueryProcessorXML::AddBindi
         return NS_ERROR_FAILURE;
 
     nsRefPtr<nsXMLBindingSet> bindings = mRuleToBindingsMap.GetWeak(aRuleNode);
     if (!bindings) {
         bindings = new nsXMLBindingSet();
         mRuleToBindingsMap.Put(aRuleNode, bindings);
     }
 
-    nsCOMPtr<nsIDOMXPathExpression> compiledexpr;
-    nsresult rv =
-        CreateExpression(aExpr, aRuleNode, getter_AddRefs(compiledexpr));
-    if (NS_FAILED(rv)) {
+    nsCOMPtr<nsINode> ruleNode = do_QueryInterface(aRuleNode);
+
+    ErrorResult rv;
+    nsAutoPtr<XPathExpression> compiledexpr;
+    compiledexpr = CreateExpression(aExpr, ruleNode, rv);
+    if (rv.Failed()) {
         nsXULContentUtils::LogTemplateError(ERROR_TEMPLATE_BAD_BINDING_XPATH);
         return NS_OK;
     }
 
     // aRef isn't currently used for XML query processors
-    return bindings->AddBinding(aVar, compiledexpr);
+    bindings->AddBinding(aVar, Move(compiledexpr));
+    return NS_OK;
 }
 
 NS_IMETHODIMP
 nsXULTemplateQueryProcessorXML::TranslateRef(nsISupports* aDatasource,
                                              const nsAString& aRefString,
                                              nsIXULTemplateResult** aRef)
 {
     *aRef = nullptr;
 
     // the datasource is either a document or a DOM element
-    nsCOMPtr<nsIDOMElement> rootElement;
-    nsCOMPtr<nsIDOMDocument> doc = do_QueryInterface(aDatasource);
+    nsCOMPtr<Element> rootElement;
+    nsCOMPtr<nsIDocument> doc = do_QueryInterface(aDatasource);
     if (doc)
-        doc->GetDocumentElement(getter_AddRefs(rootElement));
+        rootElement = doc->GetRootElement();
     else
         rootElement = do_QueryInterface(aDatasource);
 
     // if no root element, just return. The document may not have loaded yet
     if (!rootElement)
         return NS_OK;
     
-    nsXULTemplateResultXML* result =
-        new nsXULTemplateResultXML(nullptr, rootElement, nullptr);
-    NS_ENSURE_TRUE(result, NS_ERROR_OUT_OF_MEMORY);
-
-    *aRef = result;
+    *aRef = new nsXULTemplateResultXML(nullptr, rootElement, nullptr);
     NS_ADDREF(*aRef);
 
     return NS_OK;
 }
 
 
 NS_IMETHODIMP
 nsXULTemplateQueryProcessorXML::CompareResults(nsIXULTemplateResult* aLeft,
@@ -429,34 +418,28 @@ nsXULTemplateQueryProcessorXML::CompareR
 }
 
 nsXMLBindingSet*
 nsXULTemplateQueryProcessorXML::GetOptionalBindingsForRule(nsIDOMNode* aRuleNode)
 {
     return mRuleToBindingsMap.GetWeak(aRuleNode);
 }
 
-nsresult
+XPathExpression*
 nsXULTemplateQueryProcessorXML::CreateExpression(const nsAString& aExpr,
-                                                 nsIDOMNode* aNode,
-                                                 nsIDOMXPathExpression** aCompiledExpr)
+                                                 nsINode* aNode,
+                                                 ErrorResult& aRv)
 {
-    nsCOMPtr<nsIDOMXPathNSResolver> nsResolver;
-
-    nsCOMPtr<nsIDOMDocument> doc;
-    aNode->GetOwnerDocument(getter_AddRefs(doc));
-
-    nsCOMPtr<nsIDOMXPathEvaluator> eval = do_QueryInterface(doc);
-    if (eval) {
-        nsresult rv =
-             eval->CreateNSResolver(aNode, getter_AddRefs(nsResolver));
-        NS_ENSURE_SUCCESS(rv, rv);
+    nsCOMPtr<nsIDOMXPathNSResolver> nsResolver =
+        aNode->OwnerDoc()->CreateNSResolver(aNode, aRv);
+    if (aRv.Failed()) {
+        return nullptr;
     }
 
-    return mEvaluator->CreateExpression(aExpr, nsResolver, aCompiledExpr);
+    return mEvaluator->CreateExpression(aExpr, nsResolver, aRv);
 }
 
 NS_IMETHODIMP
 nsXULTemplateQueryProcessorXML::HandleEvent(nsIDOMEvent* aEvent)
 {
     NS_PRECONDITION(aEvent, "aEvent null");
     nsAutoString eventType;
     aEvent->GetType(eventType);

--- a/content/xul/templates/src/nsXULTemplateQueryProcessorXML.h
+++ b/content/xul/templates/src/nsXULTemplateQueryProcessorXML.h
@@ -8,24 +8,24 @@
 
 #include "nsIXULTemplateBuilder.h"
 #include "nsIXULTemplateQueryProcessor.h"
 
 #include "nsISimpleEnumerator.h"
 #include "nsString.h"
 #include "nsCOMArray.h"
 #include "nsRefPtrHashtable.h"
-#include "nsIDOMElement.h"
 #include "nsIDOMEventListener.h"
-#include "nsIDOMXPathExpression.h"
 #include "nsIDOMXPathEvaluator.h"
 #include "nsXMLBinding.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsIXMLHttpRequest.h"
 #include "mozilla/Attributes.h"
+#include "mozilla/dom/Element.h"
+#include "mozilla/dom/XPathEvaluator.h"
 #include "mozilla/dom/XPathResult.h"
 
 class nsXULTemplateQueryProcessorXML;
 
 #define NS_IXMLQUERY_IID \
   {0x0358d692, 0xccce, 0x4a97, \
     { 0xb2, 0x51, 0xba, 0x8f, 0x17, 0x0f, 0x3b, 0x6f }}
  
@@ -38,49 +38,49 @@ class nsXMLQuery MOZ_FINAL : public nsIS
 
     // return a weak reference to the processor the query was created from
     nsXULTemplateQueryProcessorXML* Processor() { return mProcessor; }
 
     // return a weak reference t the member variable for the query
     nsIAtom* GetMemberVariable() { return mMemberVariable; }
 
     // return a weak reference to the expression used to generate results
-    nsIDOMXPathExpression* GetResultsExpression() { return mResultsExpr; }
+    mozilla::dom::XPathExpression* GetResultsExpression()
+      { return mResultsExpr; }
 
     // return a weak reference to the additional required bindings
     nsXMLBindingSet* GetBindingSet() { return mRequiredBindings; }
 
     // add a required binding for the query
-    nsresult
-    AddBinding(nsIAtom* aVar, nsIDOMXPathExpression* aExpr)
+    void
+    AddBinding(nsIAtom* aVar, nsAutoPtr<mozilla::dom::XPathExpression>&& aExpr)
     {
         if (!mRequiredBindings) {
             mRequiredBindings = new nsXMLBindingSet();
-            NS_ENSURE_TRUE(mRequiredBindings, NS_ERROR_OUT_OF_MEMORY);
         }
 
-        return mRequiredBindings->AddBinding(aVar, aExpr);
+        mRequiredBindings->AddBinding(aVar, mozilla::Move(aExpr));
     }
 
     nsXMLQuery(nsXULTemplateQueryProcessorXML* aProcessor,
-                        nsIAtom* aMemberVariable,
-                        nsIDOMXPathExpression* aResultsExpr)
+               nsIAtom* aMemberVariable,
+               nsAutoPtr<mozilla::dom::XPathExpression>&& aResultsExpr)
         : mProcessor(aProcessor),
           mMemberVariable(aMemberVariable),
           mResultsExpr(aResultsExpr)
     { }
 
   protected:
     ~nsXMLQuery() {}
 
     nsXULTemplateQueryProcessorXML* mProcessor;
 
     nsCOMPtr<nsIAtom> mMemberVariable;
 
-    nsCOMPtr<nsIDOMXPathExpression> mResultsExpr;
+    nsAutoPtr<mozilla::dom::XPathExpression> mResultsExpr;
 
     nsRefPtr<nsXMLBindingSet> mRequiredBindings;
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsXMLQuery, NS_IXMLQUERY_IID)
 
 class nsXULTemplateResultSetXML MOZ_FINAL : public nsISimpleEnumerator
 {
@@ -104,17 +104,17 @@ public:
 
     // nsISupports interface
     NS_DECL_ISUPPORTS
 
     // nsISimpleEnumerator interface
     NS_DECL_NSISIMPLEENUMERATOR
 
     nsXULTemplateResultSetXML(nsXMLQuery* aQuery,
-                              mozilla::dom::XPathResult* aResults,
+                              already_AddRefed<mozilla::dom::XPathResult> aResults,
                               nsXMLBindingSet* aBindingSet)
         : mQuery(aQuery),
           mBindingSet(aBindingSet),
           mResults(aResults),
           mPosition(0)
     {}
 };
 
@@ -138,32 +138,32 @@ public:
     // nsIDOMEventListener interface
     NS_DECL_NSIDOMEVENTLISTENER
 
     nsXMLBindingSet*
     GetOptionalBindingsForRule(nsIDOMNode* aRuleNode);
 
     // create an XPath expression from aExpr, using aNode for
     // resolving namespaces
-    nsresult
+    mozilla::dom::XPathExpression*
     CreateExpression(const nsAString& aExpr,
-                     nsIDOMNode* aNode,
-                     nsIDOMXPathExpression** aCompiledExpr);
+                     nsINode* aNode,
+                     mozilla::ErrorResult& aRv);
 
 private:
 
     ~nsXULTemplateQueryProcessorXML() {}
 
     bool mGenerationStarted;
 
     nsRefPtrHashtable<nsISupportsHashKey, nsXMLBindingSet> mRuleToBindingsMap;
 
-    nsCOMPtr<nsIDOMElement> mRoot;
+    nsCOMPtr<mozilla::dom::Element> mRoot;
 
-    nsCOMPtr<nsIDOMXPathEvaluator> mEvaluator;
+    nsRefPtr<mozilla::dom::XPathEvaluator> mEvaluator;
 
     nsCOMPtr<nsIXULTemplateBuilder> mTemplateBuilder;
 
     nsCOMPtr<nsIXMLHttpRequest> mRequest;
 };
 
 
 #endif // nsXULTemplateQueryProcessorXML_h__

--- a/content/xul/templates/src/nsXULTemplateResultXML.cpp
+++ b/content/xul/templates/src/nsXULTemplateResultXML.cpp
@@ -13,27 +13,25 @@
 #include "nsXULTemplateResultXML.h"
 #include "nsXMLBinding.h"
 
 static uint32_t sTemplateId = 0;
 
 NS_IMPL_ISUPPORTS(nsXULTemplateResultXML, nsIXULTemplateResult)
 
 nsXULTemplateResultXML::nsXULTemplateResultXML(nsXMLQuery* aQuery,
-                                               nsIDOMNode* aNode,
+                                               nsIContent* aNode,
                                                nsXMLBindingSet* aBindings)
     : mQuery(aQuery), mNode(aNode)
 {
-    nsCOMPtr<nsIContent> content = do_QueryInterface(mNode);
-
     // If the node has an id, create the uri from it. Otherwise, there isn't
     // anything to identify the node with so just use a somewhat random number.
-    nsCOMPtr<nsIAtom> id = content->GetID();
+    nsCOMPtr<nsIAtom> id = mNode->GetID();
     if (id) {
-      nsCOMPtr<nsIURI> uri = content->GetBaseURI();
+      nsCOMPtr<nsIURI> uri = mNode->GetBaseURI();
       nsAutoCString spec;
       uri->GetSpec(spec);
 
       mId = NS_ConvertUTF8toUTF16(spec);
 
       nsAutoString idstr;
       id->ToString(idstr);
       mId += NS_LITERAL_STRING("#") + idstr;
@@ -47,20 +45,17 @@ nsXULTemplateResultXML::nsXULTemplateRes
     if (aBindings)
         mRequiredValues.SetBindingSet(aBindings);
 }
 
 NS_IMETHODIMP
 nsXULTemplateResultXML::GetIsContainer(bool* aIsContainer)
 {
     // a node is considered a container if it has children
-    if (mNode)
-        mNode->HasChildNodes(aIsContainer);
-    else
-        *aIsContainer = false;
+    *aIsContainer = mNode && mNode->HasChildNodes();
     return NS_OK;
 }
 
 NS_IMETHODIMP
 nsXULTemplateResultXML::GetIsEmpty(bool* aIsEmpty)
 {
     // a node is considered empty if it has no elements as children
     nsCOMPtr<nsIContent> content = do_QueryInterface(mNode);
@@ -143,38 +138,35 @@ nsXULTemplateResultXML::GetBindingFor(ns
 }
 
 NS_IMETHODIMP
 nsXULTemplateResultXML::GetBindingObjectFor(nsIAtom* aVar, nsISupports** aValue)
 {
     NS_ENSURE_ARG_POINTER(aVar);
 
     nsXMLBinding* binding;
-    nsCOMPtr<nsIDOMNode> node;
+    nsCOMPtr<nsISupports> node;
 
     if (mQuery && aVar == mQuery->GetMemberVariable()) {
         node = mNode;
     }
     else {
         int32_t idx = mRequiredValues.LookupTargetIndex(aVar, &binding);
         if (idx > 0) {
-            mRequiredValues.GetNodeAssignmentFor(this, binding, idx,
-                                                 getter_AddRefs(node));
+            node = mRequiredValues.GetNodeAssignmentFor(this, binding, idx);
         }
         else {
             idx = mOptionalValues.LookupTargetIndex(aVar, &binding);
             if (idx > 0) {
-                mOptionalValues.GetNodeAssignmentFor(this, binding, idx,
-                                                     getter_AddRefs(node));
+                node = mOptionalValues.GetNodeAssignmentFor(this, binding, idx);
             }
         }
     }
 
-    *aValue = node;
-    NS_IF_ADDREF(*aValue);
+    node.forget(aValue);
     return NS_OK;
 }
 
 NS_IMETHODIMP
 nsXULTemplateResultXML::RuleMatched(nsISupports* aQueryNode,
                                     nsIDOMNode* aRuleNode)
 {
     // when a rule matches, set the bindings that must be used.
@@ -190,15 +182,8 @@ nsXULTemplateResultXML::RuleMatched(nsIS
     return NS_OK;
 }
 
 NS_IMETHODIMP
 nsXULTemplateResultXML::HasBeenRemoved()
 {
     return NS_OK;
 }
-
-void
-nsXULTemplateResultXML::GetNode(nsIDOMNode** aNode)
-{
-    *aNode = mNode;
-    NS_IF_ADDREF(*aNode);
-}

--- a/content/xul/templates/src/nsXULTemplateResultXML.h
+++ b/content/xul/templates/src/nsXULTemplateResultXML.h
@@ -2,16 +2,17 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef nsXULTemplateResultXML_h__
 #define nsXULTemplateResultXML_h__
 
 #include "nsCOMPtr.h"
+#include "nsIContent.h"
 #include "nsIURI.h"
 #include "nsIRDFResource.h"
 #include "nsXULTemplateQueryProcessorXML.h"
 #include "nsIXULTemplateResult.h"
 #include "mozilla/Attributes.h"
 
 /**
  * An single result of an query
@@ -19,36 +20,39 @@
 class nsXULTemplateResultXML MOZ_FINAL : public nsIXULTemplateResult
 {
 public:
     NS_DECL_ISUPPORTS
 
     NS_DECL_NSIXULTEMPLATERESULT
 
     nsXULTemplateResultXML(nsXMLQuery* aQuery,
-                           nsIDOMNode* aNode,
+                           nsIContent* aNode,
                            nsXMLBindingSet* aBindings);
 
-    void GetNode(nsIDOMNode** aNode);
+    nsIContent* Node()
+    {
+        return mNode;
+    }
 
 protected:
 
     ~nsXULTemplateResultXML() {}
 
     // ID used for persisting data. It is constructed using the mNode's
     // base uri plus the node's id to form 'baseuri#id'. If the node has no
     // id, then an id of the form 'row<some number>' is generated. In the
     // latter case, persistence will not work as there won't be a unique id.
     nsAutoString mId;
 
     // query that generated the result
     nsCOMPtr<nsXMLQuery> mQuery;
 
     // context node in datasource
-    nsCOMPtr<nsIDOMNode> mNode;
+    nsCOMPtr<nsIContent> mNode;
 
     // assignments in query
     nsXMLBindingValues mRequiredValues;
 
     // extra assignments made by rules (<binding> tags)
     nsXMLBindingValues mOptionalValues;
 };
 

--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -106,18 +106,16 @@
 #include "nsIBoxObject.h"
 #ifdef MOZ_XUL
 #include "nsITreeSelection.h"
 #include "nsITreeContentView.h"
 #include "nsITreeView.h"
 #include "nsIXULTemplateBuilder.h"
 #include "nsITreeColumns.h"
 #endif
-#include "nsIDOMXPathExpression.h"
-#include "nsIDOMNSXPathExpression.h"
 #include "nsIDOMXPathNSResolver.h"
 
 // Storage includes
 #include "nsIDOMStorage.h"
 #include "nsPIDOMStorage.h"
 
 // Drag and drop
 #include "nsIDOMFile.h"
@@ -339,18 +337,16 @@ static nsDOMClassInfoData sClassInfoData
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
 
   NS_DEFINE_CLASSINFO_DATA(CSSSupportsRule, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
 
   NS_DEFINE_CLASSINFO_DATA(XSLTProcessor, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
 
-  NS_DEFINE_CLASSINFO_DATA(XPathExpression, nsDOMGenericSH,
-                           DOM_DEFAULT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(XPathNSResolver, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
 
   // WhatWG Storage
 
   // mrbkap says we don't need WANT_ADDPROPERTY on Storage objects
   // since a call to addProperty() is always followed by a call to
   // setProperty(), except in the case when a getter or setter is set
@@ -937,21 +933,16 @@ nsDOMClassInfo::Init()
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMCSSSupportsRule)
   DOM_CLASSINFO_MAP_END
 
   DOM_CLASSINFO_MAP_BEGIN(XSLTProcessor, nsIXSLTProcessor)
     DOM_CLASSINFO_MAP_ENTRY(nsIXSLTProcessor)
     DOM_CLASSINFO_MAP_ENTRY(nsIXSLTProcessorPrivate)
   DOM_CLASSINFO_MAP_END
 
-  DOM_CLASSINFO_MAP_BEGIN(XPathExpression, nsIDOMXPathExpression)
-    DOM_CLASSINFO_MAP_ENTRY(nsIDOMXPathExpression)
-    DOM_CLASSINFO_MAP_ENTRY(nsIDOMNSXPathExpression)
-  DOM_CLASSINFO_MAP_END
-
   DOM_CLASSINFO_MAP_BEGIN(XPathNSResolver, nsIDOMXPathNSResolver)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMXPathNSResolver)
   DOM_CLASSINFO_MAP_END
 
   DOM_CLASSINFO_MAP_BEGIN(Storage, nsIDOMStorage)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMStorage)
   DOM_CLASSINFO_MAP_END
 

--- a/dom/base/nsDOMClassInfoClasses.h
+++ b/dom/base/nsDOMClassInfoClasses.h
@@ -41,17 +41,16 @@ DOMCI_CLASS(TreeColumn)
 
 DOMCI_CLASS(CSSMozDocumentRule)
 DOMCI_CLASS(CSSSupportsRule)
 
 // XSLTProcessor
 DOMCI_CLASS(XSLTProcessor)
 
 // DOM Level 3 XPath objects
-DOMCI_CLASS(XPathExpression)
 DOMCI_CLASS(XPathNSResolver)
 
 // WhatWG WebApps Objects
 DOMCI_CLASS(Storage)
 
 DOMCI_CLASS(Blob)
 DOMCI_CLASS(File)
 

--- a/dom/bindings/Bindings.conf
+++ b/dom/bindings/Bindings.conf
@@ -1667,16 +1667,21 @@ DOMInterfaces = {
 'XPathEvaluator': {
     'wrapperCache': False
 },
 
 'XPathResult': {
     'resultNotAddRefed': ['singleNodeValue', 'iterateNext', 'snapshotItem']
 },
 
+'XPathExpression': {
+    'wrapperCache': False,
+    'nativeOwnership': 'owned',
+},
+
 'XULDocument': {
     'headerFile': 'XULDocument.h'
 },
 
 'XULElement': {
     'nativeType': 'nsXULElement',
     'resultNotAddRefed': [ 'controllers', 'style' ]
 },
@@ -2006,11 +2011,10 @@ addExternalIface('OutputStream', nativeT
                  notflattened=True)
 addExternalIface('Principal', nativeType='nsIPrincipal',
                  headerFile='nsIPrincipal.h', notflattened=True)
 addExternalIface('StackFrame', nativeType='nsIStackFrame',
                  headerFile='nsIException.h', notflattened=True)
 addExternalIface('URI', nativeType='nsIURI', headerFile='nsIURI.h',
                  notflattened=True)
 addExternalIface('UserDataHandler')
-addExternalIface('XPathExpression')
 addExternalIface('XPathNSResolver')
 addExternalIface('XULCommandDispatcher')

--- a/dom/interfaces/xpath/moz.build
+++ b/dom/interfaces/xpath/moz.build
@@ -1,16 +1,14 @@
 # -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 XPIDL_SOURCES += [
-    'nsIDOMNSXPathExpression.idl',
     'nsIDOMXPathEvaluator.idl',
-    'nsIDOMXPathExpression.idl',
     'nsIDOMXPathNSResolver.idl',
     'nsIDOMXPathResult.idl',
 ]
 
 XPIDL_MODULE = 'dom_xpath'
 

deleted file mode 100644
--- a/dom/interfaces/xpath/nsIDOMNSXPathExpression.idl
+++ /dev/null
@@ -1,34 +0,0 @@
-/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "domstubs.idl"
-
-interface XPathException;
-
-/**
- * Interface for Mozilla specific XPathExpression functions.
- */
-[scriptable, uuid(ce600ca8-e98a-4419-ad61-2f6d0cb0ecc8)]
-interface nsIDOMNSXPathExpression : nsISupports
-{
-  /**
-   * Evaluate the expression with the given context. Similar to
-   * nsIDOMXPathExpression::evaluate(), except that this takes the context
-   * position and size too.
-   *
-   * @param contextNode       The context node
-   * @param contextPosition   The context position
-   * @param contextSize       The context size
-   * @param type              The needed result type
-   * @param result            The result
-   */
-  nsISupports evaluateWithContext(in nsIDOMNode contextNode,
-                                  in unsigned long contextPosition,
-                                  in unsigned long contextSize,
-                                  in unsigned short type,
-                                  in nsISupports result)
-                                    raises(XPathException,
-                                           DOMException);
-};

--- a/dom/interfaces/xpath/nsIDOMXPathEvaluator.idl
+++ b/dom/interfaces/xpath/nsIDOMXPathEvaluator.idl
@@ -5,26 +5,21 @@
 
 /**
  * Corresponds to http://www.w3.org/TR/2002/WD-DOM-Level-3-XPath-20020208
  */
 
 #include "domstubs.idl"
 
 interface nsIDOMXPathNSResolver;
-interface nsIDOMXPathExpression;
 interface XPathException;
 
-[uuid(75506f8a-b504-11d5-a7f2-ca108ab8b6fc)]
+[uuid(89a0fe71-c1d9-46bd-b76b-47f51fd935ff)]
 interface nsIDOMXPathEvaluator : nsISupports
 {
-  nsIDOMXPathExpression    createExpression(in DOMString expression, 
-                                            in nsIDOMXPathNSResolver resolver)
-                                      raises(XPathException,
-                                             DOMException);
   nsIDOMXPathNSResolver    createNSResolver(in nsIDOMNode nodeResolver);
   nsISupports              evaluate(in DOMString expression, 
                                     in nsIDOMNode contextNode, 
                                     in nsIDOMXPathNSResolver resolver, 
                                     in unsigned short type, 
                                     in nsISupports result)
                                       raises(XPathException,
                                              DOMException);

deleted file mode 100644
--- a/dom/interfaces/xpath/nsIDOMXPathExpression.idl
+++ /dev/null
@@ -1,22 +0,0 @@
-/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/**
- * Corresponds to http://www.w3.org/TR/2002/WD-DOM-Level-3-XPath-20020208
- */
-
-#include "domstubs.idl"
-
-interface XPathException;
-
-[scriptable, uuid(75506f82-b504-11d5-a7f2-ca108ab8b6fc)]
-interface nsIDOMXPathExpression : nsISupports
-{
-  nsISupports              evaluate(in nsIDOMNode contextNode, 
-                                    in unsigned short type, 
-                                    in nsISupports result)
-                                      raises(XPathException,
-                                             DOMException);
-};

--- a/dom/webidl/XPathEvaluator.webidl
+++ b/dom/webidl/XPathEvaluator.webidl
@@ -1,15 +1,14 @@
 /* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/.
  */
 
-interface XPathExpression;
 interface XPathNSResolver;
 
 [Constructor]
 interface XPathEvaluator {
   // Based on nsIDOMXPathEvaluator
   [NewObject, Throws]
   XPathExpression createExpression(DOMString expression,
                                    XPathNSResolver? resolver);

new file mode 100644
--- /dev/null
+++ b/dom/webidl/XPathExpression.webidl
@@ -0,0 +1,22 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+interface XPathExpression {
+  // The result specifies a specific result object which may be reused and
+  // returned by this method. If this is specified as null or it's not an
+  // XPathResult object, a new result object will be constructed and returned.
+  [Throws]
+  XPathResult evaluate(Node contextNode, unsigned short type, object? result);
+
+  // The result specifies a specific result object which may be reused and
+  // returned by this method. If this is specified as null or it's not an
+  // XPathResult object, a new result object will be constructed and returned.
+  [Throws, ChromeOnly]
+  XPathResult evaluateWithContext(Node contextNode,
+                                  unsigned long contextPosition,
+                                  unsigned long contextSize,
+                                  unsigned short type, object? result);
+};

--- a/dom/webidl/moz.build
+++ b/dom/webidl/moz.build
@@ -476,16 +476,17 @@ WEBIDL_FILES = [
     'WorkerNavigator.webidl',
     'XMLDocument.webidl',
     'XMLHttpRequest.webidl',
     'XMLHttpRequestEventTarget.webidl',
     'XMLHttpRequestUpload.webidl',
     'XMLSerializer.webidl',
     'XMLStylesheetProcessingInstruction.webidl',
     'XPathEvaluator.webidl',
+    'XPathExpression.webidl',
     'XPathResult.webidl',
     'XULCommandEvent.webidl',
     'XULDocument.webidl',
     'XULElement.webidl',
 ]
 
 if CONFIG['MOZ_AUDIO_CHANNEL_MANAGER']:
     WEBIDL_FILES += [

--- a/dom/workers/RuntimeService.cpp
+++ b/dom/workers/RuntimeService.cpp
@@ -16,16 +16,17 @@
 #include "nsIScriptContext.h"
 #include "nsIScriptSecurityManager.h"
 #include "nsISupportsPriority.h"
 #include "nsITimer.h"
 #include "nsIURI.h"
 #include "nsPIDOMWindow.h"
 
 #include <algorithm>
+#include "BackgroundChild.h"
 #include "GeckoProfiler.h"
 #include "js/OldDebugAPI.h"
 #include "jsfriendapi.h"
 #include "mozilla/ArrayUtils.h"
 #include "mozilla/CycleCollectedJSRuntime.h"
 #include "mozilla/dom/asmjscache/AsmJSCache.h"
 #include "mozilla/dom/AtomList.h"
 #include "mozilla/dom/BindingUtils.h"
@@ -34,16 +35,17 @@
 #include "mozilla/dom/MessageEventBinding.h"
 #include "mozilla/dom/WorkerBinding.h"
 #include "mozilla/DebugOnly.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/dom/Navigator.h"
 #include "nsContentUtils.h"
 #include "nsCycleCollector.h"
 #include "nsDOMJSUtils.h"
+#include "nsIIPCBackgroundChildCreateCallback.h"
 #include "nsISupportsImpl.h"
 #include "nsLayoutStatics.h"
 #include "nsNetUtil.h"
 #include "nsServiceManagerUtils.h"
 #include "nsThread.h"
 #include "nsThreadUtils.h"
 #include "nsXPCOM.h"
 #include "nsXPCOMPrivate.h"
@@ -58,16 +60,22 @@
 #include "nsThreadManager.h"
 #endif
 
 #include "ServiceWorker.h"
 #include "SharedWorker.h"
 #include "WorkerPrivate.h"
 #include "WorkerRunnable.h"
 
+#ifdef ENABLE_TESTS
+#include "BackgroundChildImpl.h"
+#include "mozilla/ipc/PBackgroundChild.h"
+#include "prrng.h"
+#endif
+
 using namespace mozilla;
 using namespace mozilla::dom;
 
 USING_WORKERS_NAMESPACE
 
 using mozilla::MutexAutoLock;
 using mozilla::MutexAutoUnlock;
 using mozilla::Preferences;
@@ -155,16 +163,20 @@ const JS::ContextOptions kRequiredContex
 uint32_t gMaxWorkersPerDomain = MAX_WORKERS_PER_DOMAIN;
 
 // Does not hold an owning reference.
 RuntimeService* gRuntimeService = nullptr;
 
 // Only non-null during the call to Init.
 RuntimeService* gRuntimeServiceDuringInit = nullptr;
 
+#ifdef ENABLE_TESTS
+bool gTestPBackground = false;
+#endif // ENABLE_TESTS
+
 enum {
   ID_Worker = 0,
   ID_ChromeWorker,
   ID_Event,
   ID_MessageEvent,
   ID_ErrorEvent,
 
   ID_COUNT
@@ -899,16 +911,47 @@ public:
       nsCycleCollector_collect(nullptr);
     }
   }
 
 private:
   WorkerPrivate* mWorkerPrivate;
 };
 
+class WorkerBackgroundChildCallback MOZ_FINAL :
+  public nsIIPCBackgroundChildCreateCallback
+{
+  bool* mDone;
+
+public:
+  WorkerBackgroundChildCallback(bool* aDone)
+  : mDone(aDone)
+  {
+    MOZ_ASSERT(mDone);
+  }
+
+  NS_DECL_ISUPPORTS
+
+private:
+  ~WorkerBackgroundChildCallback()
+  { }
+
+  virtual void
+  ActorCreated(PBackgroundChild* aActor) MOZ_OVERRIDE
+  {
+    *mDone = true;
+  }
+
+  virtual void
+  ActorFailed() MOZ_OVERRIDE
+  {
+    *mDone = true;
+  }
+};
+
 class WorkerThreadPrimaryRunnable MOZ_FINAL : public nsRunnable
 {
   WorkerPrivate* mWorkerPrivate;
   nsRefPtr<RuntimeService::WorkerThread> mThread;
   JSRuntime* mParentRuntime;
 
   class FinishedRunnable MOZ_FINAL : public nsRunnable
   {
@@ -941,16 +984,19 @@ public:
   }
 
   NS_DECL_ISUPPORTS_INHERITED
 
 private:
   ~WorkerThreadPrimaryRunnable()
   { }
 
+  nsresult
+  SynchronouslyCreatePBackground();
+
   NS_DECL_NSIRUNNABLE
 };
 
 class WorkerTaskRunnable MOZ_FINAL : public WorkerRunnable
 {
   nsRefPtr<WorkerTask> mTask;
 
 public:
@@ -1040,16 +1086,38 @@ public:
   void
   SetAcceptingNonWorkerRunnables(bool aAcceptingNonWorkerRunnables)
   {
     MutexAutoLock lock(mLock);
     mAcceptingNonWorkerRunnables = aAcceptingNonWorkerRunnables;
   }
 #endif
 
+#ifdef ENABLE_TESTS
+  void
+  TestPBackground()
+  {
+    using namespace mozilla::ipc;
+    if (gTestPBackground) {
+      // Randomize value to validate workers are not cross-posting messages.
+      uint32_t testValue;
+      PRSize randomSize = PR_GetRandomNoise(&testValue, sizeof(testValue));
+      MOZ_RELEASE_ASSERT(randomSize == sizeof(testValue));
+      nsCString testStr;
+      testStr.AppendInt(testValue);
+      testStr.AppendInt(reinterpret_cast<int64_t>(PR_GetCurrentThread()));
+      PBackgroundChild* existingBackgroundChild =
+        BackgroundChild::GetForCurrentThread();
+      MOZ_RELEASE_ASSERT(existingBackgroundChild);
+      bool ok = existingBackgroundChild->SendPBackgroundTestConstructor(testStr);
+      MOZ_RELEASE_ASSERT(ok);
+    }
+  }
+#endif // #ENABLE_TESTS
+
 private:
   WorkerThread()
   : nsThread(nsThread::NOT_MAIN_THREAD, WORKER_STACK_SIZE),
     mWorkerPrivate(nullptr)
 #ifdef DEBUG
     , mAcceptingNonWorkerRunnables(true)
 #endif
   { }
@@ -1243,16 +1311,20 @@ RuntimeService::GetOrCreateService()
   if (!gRuntimeService) {
     nsRefPtr<RuntimeService> service = new RuntimeService();
     if (NS_FAILED(service->Init())) {
       NS_WARNING("Failed to initialize!");
       service->Cleanup();
       return nullptr;
     }
 
+#ifdef ENABLE_TESTS
+    gTestPBackground = mozilla::Preferences::GetBool("pbackground.testing", false);
+#endif // ENABLE_TESTS
+
     // The observer service now owns us until shutdown.
     gRuntimeService = service;
   }
 
   return gRuntimeService;
 }
 
 // static
@@ -1532,20 +1604,16 @@ RuntimeService::ScheduleWorker(JSContext
   nsCOMPtr<nsIRunnable> runnable =
     new WorkerThreadPrimaryRunnable(aWorkerPrivate, thread, JS_GetParentRuntime(aCx));
   if (NS_FAILED(thread->Dispatch(runnable, NS_DISPATCH_NORMAL))) {
     UnregisterWorker(aCx, aWorkerPrivate);
     JS_ReportError(aCx, "Could not dispatch to thread!");
     return false;
   }
 
-#ifdef DEBUG
-  thread->SetAcceptingNonWorkerRunnables(false);
-#endif
-
   return true;
 }
 
 // static
 void
 RuntimeService::ShutdownIdleThreads(nsITimer* aTimer, void* /* aClosure */)
 {
   AssertIsOnMainThread();
@@ -2487,18 +2555,30 @@ RuntimeService::WorkerThread::Observer::
 }
 
 NS_IMETHODIMP
 RuntimeService::WorkerThread::Observer::OnProcessNextEvent(
                                                nsIThreadInternal* /* aThread */,
                                                bool aMayWait,
                                                uint32_t aRecursionDepth)
 {
+  using mozilla::ipc::BackgroundChild;
+
   mWorkerPrivate->AssertIsOnWorkerThread();
-  MOZ_ASSERT(!aMayWait);
+
+  // If the PBackground child is not created yet, then we must permit
+  // blocking event processing to support SynchronouslyCreatePBackground().
+  // If this occurs then we are spinning on the event queue at the start of
+  // PrimaryWorkerRunnable::Run() and don't want to process the event in
+  // mWorkerPrivate yet.
+  if (aMayWait) {
+    MOZ_ASSERT(aRecursionDepth == 2);
+    MOZ_ASSERT(!BackgroundChild::GetForCurrentThread());
+    return NS_OK;
+  }
 
   mWorkerPrivate->OnProcessNextEvent(aRecursionDepth);
   return NS_OK;
 }
 
 NS_IMETHODIMP
 RuntimeService::WorkerThread::Observer::AfterProcessNextEvent(
                                                nsIThreadInternal* /* aThread */,
@@ -2532,21 +2612,25 @@ LogViolationDetailsRunnable::Run()
   nsRefPtr<MainThreadStopSyncLoopRunnable> response =
     new MainThreadStopSyncLoopRunnable(mWorkerPrivate, mSyncLoopTarget.forget(),
                                        true);
   MOZ_ALWAYS_TRUE(response->Dispatch(nullptr));
 
   return NS_OK;
 }
 
+NS_IMPL_ISUPPORTS(WorkerBackgroundChildCallback, nsIIPCBackgroundChildCreateCallback)
+
 NS_IMPL_ISUPPORTS_INHERITED0(WorkerThreadPrimaryRunnable, nsRunnable)
 
 NS_IMETHODIMP
 WorkerThreadPrimaryRunnable::Run()
 {
+  using mozilla::ipc::BackgroundChild;
+
 #ifdef MOZ_NUWA_PROCESS
   if (IsNuwaProcess()) {
     NS_ASSERTION(NuwaMarkCurrentThread != nullptr,
                   "NuwaMarkCurrentThread is undefined!");
     NuwaMarkCurrentThread(nullptr, nullptr);
     NuwaFreezeCurrentThread();
   }
 #endif
@@ -2555,16 +2639,29 @@ WorkerThreadPrimaryRunnable::Run()
 
   nsAutoCString threadName;
   threadName.AssignLiteral("WebWorker '");
   threadName.Append(NS_LossyConvertUTF16toASCII(mWorkerPrivate->ScriptURL()));
   threadName.Append('\'');
 
   profiler_register_thread(threadName.get(), &stackBaseGuess);
 
+  // Note: SynchronouslyCreatePBackground() must be called prior to
+  //       mThread->SetWorker() in order to avoid accidentally consuming
+  //       worker messages here.
+  nsresult rv = SynchronouslyCreatePBackground();
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    // XXX need to fire an error at parent.
+    return rv;
+  }
+
+#ifdef ENABLE_TESTS
+  mThread->TestPBackground();
+#endif
+
   mThread->SetWorker(mWorkerPrivate);
 
   mWorkerPrivate->AssertIsOnWorkerThread();
 
   {
     nsCycleCollector_startup();
 
     WorkerJSRuntime runtime(mParentRuntime, mWorkerPrivate);
@@ -2588,16 +2685,22 @@ WorkerThreadPrimaryRunnable::Run()
       {
         JSAutoRequest ar(cx);
 
         mWorkerPrivate->DoRunLoop(cx);
 
         JS_ReportPendingException(cx);
       }
 
+#ifdef ENABLE_TESTS
+      mThread->TestPBackground();
+#endif
+
+      BackgroundChild::CloseForCurrentThread();
+
 #ifdef MOZ_ENABLE_PROFILER_SPS
       if (stack) {
         stack->sampleRuntime(nullptr);
       }
 #endif
     }
 
     // Destroy the main context.  This will unroot the main worker global and
@@ -2626,16 +2729,48 @@ WorkerThreadPrimaryRunnable::Run()
     new FinishedRunnable(mThread.forget());
   MOZ_ALWAYS_TRUE(NS_SUCCEEDED(mainThread->Dispatch(finishedRunnable,
                                                     NS_DISPATCH_NORMAL)));
 
   profiler_unregister_thread();
   return NS_OK;
 }
 
+nsresult
+WorkerThreadPrimaryRunnable::SynchronouslyCreatePBackground()
+{
+  using mozilla::ipc::BackgroundChild;
+
+  MOZ_ASSERT(!BackgroundChild::GetForCurrentThread());
+
+  bool done = false;
+  nsCOMPtr<nsIIPCBackgroundChildCreateCallback> callback =
+    new WorkerBackgroundChildCallback(&done);
+
+  if (NS_WARN_IF(!BackgroundChild::GetOrCreateForCurrentThread(callback))) {
+    return NS_ERROR_FAILURE;
+  }
+
+  while (!done) {
+    if (NS_WARN_IF(!NS_ProcessNextEvent(mThread, true /* aMayWay */))) {
+      return NS_ERROR_FAILURE;
+    }
+  }
+
+  if (NS_WARN_IF(!BackgroundChild::GetForCurrentThread())) {
+    return NS_ERROR_FAILURE;
+  }
+
+#ifdef DEBUG
+  mThread->SetAcceptingNonWorkerRunnables(false);
+#endif
+
+  return NS_OK;
+}
+
 NS_IMPL_ISUPPORTS_INHERITED0(WorkerThreadPrimaryRunnable::FinishedRunnable,
                              nsRunnable)
 
 NS_IMETHODIMP
 WorkerThreadPrimaryRunnable::FinishedRunnable::Run()
 {
   AssertIsOnMainThread();
 

--- a/dom/xslt/xpath/XPathEvaluator.cpp
+++ b/dom/xslt/xpath/XPathEvaluator.cpp
@@ -2,29 +2,30 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "mozilla/dom/XPathEvaluator.h"
 #include "mozilla/Move.h"
 #include "nsCOMPtr.h"
 #include "nsIAtom.h"
-#include "nsXPathExpression.h"
+#include "mozilla/dom/XPathExpression.h"
 #include "nsXPathNSResolver.h"
 #include "XPathResult.h"
 #include "nsContentCID.h"
 #include "txExpr.h"
 #include "txExprParser.h"
 #include "nsError.h"
 #include "txURIUtils.h"
 #include "nsIDocument.h"
 #include "nsIDOMDocument.h"
 #include "nsDOMString.h"
 #include "nsNameSpaceManager.h"
 #include "nsContentUtils.h"
+#include "txIXPathContext.h"
 #include "mozilla/dom/XPathEvaluatorBinding.h"
 #include "mozilla/dom/BindingUtils.h"
 
 extern nsresult
 TX_ResolveFunctionCallXPCOM(const nsCString &aContractID, int32_t aNamespaceID,
                             nsIAtom *aName, nsISupports *aState,
                             FunctionCall **aFunction);
 
@@ -89,64 +90,66 @@ XPathEvaluator::CreateNSResolver(nsIDOMN
 NS_IMETHODIMP
 XPathEvaluator::Evaluate(const nsAString & aExpression,
                          nsIDOMNode *aContextNode,
                          nsIDOMXPathNSResolver *aResolver,
                          uint16_t aType,
                          nsISupports *aInResult,
                          nsISupports **aResult)
 {
-    nsCOMPtr<nsIDOMXPathExpression> expression;
-    nsresult rv = CreateExpression(aExpression, aResolver,
-                                   getter_AddRefs(expression));
-    NS_ENSURE_SUCCESS(rv, rv);
+    ErrorResult rv;
+    nsAutoPtr<XPathExpression> expression(CreateExpression(aExpression,
+                                                           aResolver, rv));
+    if (rv.Failed()) {
+        return rv.ErrorCode();
+    }
+
+    nsCOMPtr<nsINode> node = do_QueryInterface(aContextNode);
+    if (!node) {
+        return NS_ERROR_FAILURE;
+    }
 
-    return expression->Evaluate(aContextNode, aType, aInResult, aResult);
+    nsCOMPtr<nsIXPathResult> inResult = do_QueryInterface(aInResult);
+    nsRefPtr<XPathResult> result =
+        expression->Evaluate(*node, aType,
+                             static_cast<XPathResult*>(inResult.get()), rv);
+    if (rv.Failed()) {
+        return rv.ErrorCode();
+    }
+
+    *aResult = ToSupports(result.forget().take());
+
+    return NS_OK;
 }
 
 
-NS_IMETHODIMP
+XPathExpression*
 XPathEvaluator::CreateExpression(const nsAString & aExpression,
                                  nsIDOMXPathNSResolver *aResolver,
-                                 nsIDOMXPathExpression **aResult)
+                                 ErrorResult& aRv)
 {
-    nsresult rv;
     if (!mRecycler) {
-        nsRefPtr<txResultRecycler> recycler = new txResultRecycler;
-        NS_ENSURE_TRUE(recycler, NS_ERROR_OUT_OF_MEMORY);
-        
-        rv = recycler->init();
-        NS_ENSURE_SUCCESS(rv, rv);
-        
-        mRecycler = recycler;
+        mRecycler = new txResultRecycler;
     }
 
     nsCOMPtr<nsIDocument> doc = do_QueryReferent(mDocument);
     XPathEvaluatorParseContext pContext(aResolver, !(doc && doc->IsHTML()));
 
     nsAutoPtr<Expr> expression;
-    rv = txExprParser::createExpr(PromiseFlatString(aExpression), &pContext,
-                                  getter_Transfers(expression));
-    if (NS_FAILED(rv)) {
-        if (rv == NS_ERROR_DOM_NAMESPACE_ERR) {
-            return NS_ERROR_DOM_NAMESPACE_ERR;
+    aRv = txExprParser::createExpr(PromiseFlatString(aExpression), &pContext,
+                                   getter_Transfers(expression));
+    if (aRv.Failed()) {
+        if (aRv.ErrorCode() != NS_ERROR_DOM_NAMESPACE_ERR) {
+            aRv.Throw(NS_ERROR_DOM_INVALID_EXPRESSION_ERR);
         }
 
-        return NS_ERROR_DOM_INVALID_EXPRESSION_ERR;
+        return nullptr;
     }
 
-    nsCOMPtr<nsIDOMDocument> document = do_QueryReferent(mDocument);
-
-    *aResult = new nsXPathExpression(Move(expression), mRecycler, document);
-    if (!*aResult) {
-        return NS_ERROR_OUT_OF_MEMORY;
-    }
-
-    NS_ADDREF(*aResult);
-    return NS_OK;
+    return new XPathExpression(Move(expression), mRecycler, doc);
 }
 
 JSObject*
 XPathEvaluator::WrapObject(JSContext* aCx)
 {
     return dom::XPathEvaluatorBinding::Wrap(aCx, this);
 }
 
@@ -154,26 +157,16 @@ XPathEvaluator::WrapObject(JSContext* aC
 already_AddRefed<XPathEvaluator>
 XPathEvaluator::Constructor(const GlobalObject& aGlobal,
                             ErrorResult& rv)
 {
     nsRefPtr<XPathEvaluator> newObj = new XPathEvaluator(nullptr);
     return newObj.forget();
 }
 
-already_AddRefed<nsIDOMXPathExpression>
-XPathEvaluator::CreateExpression(const nsAString& aExpression,
-                                 nsIDOMXPathNSResolver* aResolver,
-                                 ErrorResult& rv)
-{
-  nsCOMPtr<nsIDOMXPathExpression> expr;
-  rv = CreateExpression(aExpression, aResolver, getter_AddRefs(expr));
-  return expr.forget();
-}
-
 already_AddRefed<nsIDOMXPathNSResolver>
 XPathEvaluator::CreateNSResolver(nsINode* aNodeResolver,
                                  ErrorResult& rv)
 {
   nsCOMPtr<nsIDOMNode> nodeResolver = do_QueryInterface(aNodeResolver);
   nsCOMPtr<nsIDOMXPathNSResolver> res;
   rv = CreateNSResolver(nodeResolver, getter_AddRefs(res));
   return res.forget();

--- a/dom/xslt/xpath/XPathEvaluator.h
+++ b/dom/xslt/xpath/XPathEvaluator.h
@@ -16,16 +16,17 @@
 
 class nsINode;
 class txResultRecycler;
 
 namespace mozilla {
 namespace dom {
 
 class GlobalObject;
+class XPathExpression;
 class XPathResult;
 
 /**
  * A class for evaluating an XPath expression string
  */
 class XPathEvaluator MOZ_FINAL : public nsIDOMXPathEvaluator
 {
     ~XPathEvaluator();
@@ -42,17 +43,17 @@ public:
     JSObject* WrapObject(JSContext* aCx);
     nsIDocument* GetParentObject()
     {
         nsCOMPtr<nsIDocument> doc = do_QueryReferent(mDocument);
         return doc;
     }
     static already_AddRefed<XPathEvaluator>
         Constructor(const GlobalObject& aGlobal, ErrorResult& rv);
-    already_AddRefed<nsIDOMXPathExpression>
+    XPathExpression*
         CreateExpression(const nsAString& aExpression,
                          nsIDOMXPathNSResolver* aResolver,
                          ErrorResult& rv);
     already_AddRefed<nsIDOMXPathNSResolver>
         CreateNSResolver(nsINode* aNodeResolver, ErrorResult& rv);
     already_AddRefed<XPathResult>
         Evaluate(JSContext* aCx, const nsAString& aExpression,
                  nsINode* aContextNode, nsIDOMXPathNSResolver* aResolver,

rename from dom/xslt/xpath/nsXPathExpression.cpp
rename to dom/xslt/xpath/XPathExpression.cpp
--- a/dom/xslt/xpath/nsXPathExpression.cpp
+++ b/dom/xslt/xpath/XPathExpression.cpp
@@ -1,124 +1,162 @@
 /* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "mozilla/Move.h"
-#include "nsXPathExpression.h"
+#include "XPathExpression.h"
 #include "txExpr.h"
 #include "txExprResult.h"
+#include "txIXPathContext.h"
 #include "nsError.h"
 #include "nsIDOMCharacterData.h"
 #include "nsDOMClassInfoID.h"
 #include "nsIDOMDocument.h"
 #include "XPathResult.h"
 #include "txURIUtils.h"
 #include "txXPathTreeWalker.h"
+#include "mozilla/dom/BindingUtils.h"
+#include "mozilla/dom/XPathResultBinding.h"
 
-using namespace mozilla::dom;
 using mozilla::Move;
 
-NS_IMPL_CYCLE_COLLECTION(nsXPathExpression, mDocument)
+namespace mozilla {
+namespace dom {
 
-NS_IMPL_CYCLE_COLLECTING_ADDREF(nsXPathExpression)
-NS_IMPL_CYCLE_COLLECTING_RELEASE(nsXPathExpression)
-
-DOMCI_DATA(XPathExpression, nsXPathExpression)
+class EvalContextImpl : public txIEvalContext
+{
+public:
+    EvalContextImpl(const txXPathNode& aContextNode,
+                    uint32_t aContextPosition, uint32_t aContextSize,
+                    txResultRecycler* aRecycler)
+        : mContextNode(aContextNode),
+          mContextPosition(aContextPosition),
+          mContextSize(aContextSize),
+          mLastError(NS_OK),
+          mRecycler(aRecycler)
+    {
+    }
 
-NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsXPathExpression)
-  NS_INTERFACE_MAP_ENTRY(nsIDOMXPathExpression)
-  NS_INTERFACE_MAP_ENTRY(nsIDOMNSXPathExpression)
-  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIDOMXPathExpression)
-  NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(XPathExpression)
-NS_INTERFACE_MAP_END
+    nsresult getError()
+    {
+        return mLastError;
+    }
+
+    TX_DECL_EVAL_CONTEXT;
 
-nsXPathExpression::nsXPathExpression(nsAutoPtr<Expr>&& aExpression,
-                                     txResultRecycler* aRecycler,
-                                     nsIDOMDocument *aDocument)
+private:
+    const txXPathNode& mContextNode;
+    uint32_t mContextPosition;
+    uint32_t mContextSize;
+    nsresult mLastError;
+    nsRefPtr<txResultRecycler> mRecycler;
+};
+
+XPathExpression::XPathExpression(nsAutoPtr<Expr>&& aExpression,
+                                 txResultRecycler* aRecycler,
+                                 nsIDocument *aDocument)
     : mExpression(Move(aExpression)),
       mRecycler(aRecycler),
-      mDocument(aDocument)
+      mDocument(do_GetWeakReference(aDocument)),
+      mCheckDocument(aDocument != nullptr)
+{
+}
+
+XPathExpression::~XPathExpression()
 {
 }
 
-NS_IMETHODIMP
-nsXPathExpression::Evaluate(nsIDOMNode *aContextNode,
-                            uint16_t aType,
-                            nsISupports *aInResult,
-                            nsISupports **aResult)
+already_AddRefed<XPathResult>
+XPathExpression::EvaluateWithContext(JSContext* aCx,
+                                     nsINode& aContextNode,
+                                     uint32_t aContextPosition,
+                                     uint32_t aContextSize,
+                                     uint16_t aType,
+                                     JS::Handle<JSObject*> aInResult,
+                                     ErrorResult& aRv)
 {
-    return EvaluateWithContext(aContextNode, 1, 1, aType, aInResult, aResult);
-}
-
-NS_IMETHODIMP
-nsXPathExpression::EvaluateWithContext(nsIDOMNode *aContextNode,
-                                       uint32_t aContextPosition,
-                                       uint32_t aContextSize,
-                                       uint16_t aType,
-                                       nsISupports *aInResult,
-                                       nsISupports **aResult)
-{
-    nsCOMPtr<nsINode> context = do_QueryInterface(aContextNode);
-    NS_ENSURE_ARG(context);
-
-    if (aContextPosition > aContextSize)
-        return NS_ERROR_FAILURE;
-
-    if (!nsContentUtils::CanCallerAccess(aContextNode))
-        return NS_ERROR_DOM_SECURITY_ERR;
-
-    if (mDocument && mDocument != aContextNode) {
-        nsCOMPtr<nsIDOMDocument> contextDocument;
-        aContextNode->GetOwnerDocument(getter_AddRefs(contextDocument));
-
-        if (mDocument != contextDocument) {
-            return NS_ERROR_DOM_WRONG_DOCUMENT_ERR;
+    XPathResult* inResult = nullptr;
+    if (aInResult) {
+        nsresult rv = UNWRAP_OBJECT(XPathResult, aInResult, inResult);
+        if (NS_FAILED(rv) && rv != NS_ERROR_XPC_BAD_CONVERT_JS) {
+            aRv.Throw(rv);
+            return nullptr;
         }
     }
 
-    uint16_t nodeType = context->NodeType();
+    return EvaluateWithContext(aContextNode, aContextPosition, aContextSize,
+                               aType, inResult, aRv);
+}
+
+already_AddRefed<XPathResult>
+XPathExpression::EvaluateWithContext(nsINode& aContextNode,
+                                     uint32_t aContextPosition,
+                                     uint32_t aContextSize,
+                                     uint16_t aType,
+                                     XPathResult* aInResult,
+                                     ErrorResult& aRv)
+{
+    if (aContextPosition > aContextSize) {
+        aRv.Throw(NS_ERROR_FAILURE);
+        return nullptr;
+    }
+
+    if (!nsContentUtils::CanCallerAccess(&aContextNode)) {
+        aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
+        return nullptr;
+    }
+
+    if (mCheckDocument) {
+        nsCOMPtr<nsIDocument> doc = do_QueryReferent(mDocument);
+        if (doc != aContextNode.OwnerDoc()) {
+            aRv.Throw(NS_ERROR_DOM_WRONG_DOCUMENT_ERR);
+            return nullptr;
+        }
+    }
+
+    uint16_t nodeType = aContextNode.NodeType();
 
     if (nodeType == nsIDOMNode::TEXT_NODE ||
         nodeType == nsIDOMNode::CDATA_SECTION_NODE) {
-        nsCOMPtr<nsIDOMCharacterData> textNode = do_QueryInterface(aContextNode);
-        NS_ENSURE_TRUE(textNode, NS_ERROR_FAILURE);
+        nsCOMPtr<nsIDOMCharacterData> textNode =
+            do_QueryInterface(&aContextNode);
+        if (!textNode) {
+            aRv.Throw(NS_ERROR_FAILURE);
+            return nullptr;
+        }
 
-        if (textNode) {
-            uint32_t textLength;
-            textNode->GetLength(&textLength);
-            if (textLength == 0)
-                return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
+        uint32_t textLength;
+        textNode->GetLength(&textLength);
+        if (textLength == 0) {
+            aRv.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
+            return nullptr;
         }
 
         // XXX Need to get logical XPath text node for CDATASection
         //     and Text nodes.
     }
     else if (nodeType != nsIDOMNode::DOCUMENT_NODE &&
              nodeType != nsIDOMNode::ELEMENT_NODE &&
              nodeType != nsIDOMNode::ATTRIBUTE_NODE &&
              nodeType != nsIDOMNode::COMMENT_NODE &&
              nodeType != nsIDOMNode::PROCESSING_INSTRUCTION_NODE) {
-        return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
+        aRv.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
+        return nullptr;
     }
 
-    NS_ENSURE_ARG(aResult);
-    *aResult = nullptr;
-
-    nsAutoPtr<txXPathNode> contextNode(txXPathNativeNode::createXPathNode(aContextNode));
-    if (!contextNode) {
-        return NS_ERROR_OUT_OF_MEMORY;
-    }
-
+    nsAutoPtr<txXPathNode> contextNode(txXPathNativeNode::createXPathNode(&aContextNode));
     EvalContextImpl eContext(*contextNode, aContextPosition, aContextSize,
                              mRecycler);
     nsRefPtr<txAExprResult> exprResult;
-    nsresult rv = mExpression->evaluate(&eContext, getter_AddRefs(exprResult));
-    NS_ENSURE_SUCCESS(rv, rv);
+    aRv = mExpression->evaluate(&eContext, getter_AddRefs(exprResult));
+    if (aRv.Failed()) {
+        return nullptr;
+    }
 
     uint16_t resultType = aType;
     if (aType == XPathResult::ANY_TYPE) {
         short exprResultType = exprResult->getResultType();
         switch (exprResultType) {
             case txAExprResult::NUMBER:
                 resultType = XPathResult::NUMBER_TYPE;
                 break;
@@ -127,76 +165,83 @@ nsXPathExpression::EvaluateWithContext(n
                 break;
             case txAExprResult::BOOLEAN:
                 resultType = XPathResult::BOOLEAN_TYPE;
                 break;
             case txAExprResult::NODESET:
                 resultType = XPathResult::UNORDERED_NODE_ITERATOR_TYPE;
                 break;
             case txAExprResult::RESULT_TREE_FRAGMENT:
-                NS_ERROR("Can't return a tree fragment!");
-                return NS_ERROR_FAILURE;
+                aRv.Throw(NS_ERROR_FAILURE);
+                return nullptr;
         }
     }
 
-    // We need a result object and it must be our implementation.
-    nsCOMPtr<nsIXPathResult> xpathResult = do_QueryInterface(aInResult);
+    nsRefPtr<XPathResult> xpathResult = aInResult;
     if (!xpathResult) {
-        // Either no aInResult or not one of ours.
-        xpathResult = new XPathResult(context);
+        xpathResult = new XPathResult(&aContextNode);
     }
-    rv = xpathResult->SetExprResult(exprResult, resultType, context);
-    NS_ENSURE_SUCCESS(rv, rv);
 
-    return CallQueryInterface(xpathResult, aResult);
+    aRv = xpathResult->SetExprResult(exprResult, resultType, &aContextNode);
+
+    return xpathResult.forget();
 }
 
 /*
- * Implementation of the txIEvalContext private to nsXPathExpression
+ * Implementation of the txIEvalContext private to XPathExpression
  * EvalContextImpl bases on only one context node and no variables
  */
 
 nsresult
-nsXPathExpression::EvalContextImpl::getVariable(int32_t aNamespace,
-                                                nsIAtom* aLName,
-                                                txAExprResult*& aResult)
+EvalContextImpl::getVariable(int32_t aNamespace,
+                             nsIAtom* aLName,
+                             txAExprResult*& aResult)
 {
     aResult = 0;
     return NS_ERROR_INVALID_ARG;
 }
 
-bool nsXPathExpression::EvalContextImpl::isStripSpaceAllowed(const txXPathNode& aNode)
+bool
+EvalContextImpl::isStripSpaceAllowed(const txXPathNode& aNode)
 {
     return false;
 }
 
-void* nsXPathExpression::EvalContextImpl::getPrivateContext()
+void*
+EvalContextImpl::getPrivateContext()
 {
     // we don't have a private context here.
     return nullptr;
 }
 
-txResultRecycler* nsXPathExpression::EvalContextImpl::recycler()
+txResultRecycler*
+EvalContextImpl::recycler()
 {
     return mRecycler;
 }
 
-void nsXPathExpression::EvalContextImpl::receiveError(const nsAString& aMsg,
-                                                      nsresult aRes)
+void
+EvalContextImpl::receiveError(const nsAString& aMsg, nsresult aRes)
 {
     mLastError = aRes;
     // forward aMsg to console service?
 }
 
-const txXPathNode& nsXPathExpression::EvalContextImpl::getContextNode()
+const txXPathNode&
+EvalContextImpl::getContextNode()
 {
     return mContextNode;
 }
 
-uint32_t nsXPathExpression::EvalContextImpl::size()
+uint32_t
+EvalContextImpl::size()
 {
     return mContextSize;
 }
 
-uint32_t nsXPathExpression::EvalContextImpl::position()
+uint32_t
+EvalContextImpl::position()
 {
     return mContextPosition;
 }
+
+} // namespace dom
+} // namespace mozilla

rename from dom/xslt/xpath/nsXPathExpression.h
rename to dom/xslt/xpath/XPathExpression.h
--- a/dom/xslt/xpath/nsXPathExpression.h
+++ b/dom/xslt/xpath/XPathExpression.h
@@ -1,78 +1,75 @@
 /* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifndef nsXPathExpression_h__
-#define nsXPathExpression_h__
+#ifndef mozilla_dom_XPathExpression_h
+#define mozilla_dom_XPathExpression_h
 
-#include "nsIDOMXPathExpression.h"
-#include "nsIDOMNSXPathExpression.h"
-#include "txIXPathContext.h"
-#include "txResultRecycler.h"
 #include "nsAutoPtr.h"
 #include "nsCycleCollectionParticipant.h"
+#include "nsIWeakReferenceUtils.h"
 #include "mozilla/Attributes.h"
+#include "mozilla/dom/NonRefcountedDOMObject.h"
+#include "mozilla/dom/XPathExpressionBinding.h"
 
 class Expr;
+class nsIDocument;
+class nsINode;
+class txResultRecycler;
 class txXPathNode;
 
+namespace mozilla {
+namespace dom {
+
+class XPathResult;
+
 /**
  * A class for evaluating an XPath expression string
  */
-class nsXPathExpression MOZ_FINAL : public nsIDOMXPathExpression,
-                                    public nsIDOMNSXPathExpression
+class XPathExpression MOZ_FINAL : public NonRefcountedDOMObject
 {
 public:
-    nsXPathExpression(nsAutoPtr<Expr>&& aExpression, txResultRecycler* aRecycler,
-                      nsIDOMDocument *aDocument);
+    XPathExpression(nsAutoPtr<Expr>&& aExpression, txResultRecycler* aRecycler,
+                    nsIDocument *aDocument);
+    ~XPathExpression();
+
+    JSObject* WrapObject(JSContext* aCx, bool* aTookOwnership)
+    {
+        return XPathExpressionBinding::Wrap(aCx, this, aTookOwnership);
+    }
 
-    // nsISupports interface
-    NS_DECL_CYCLE_COLLECTING_ISUPPORTS
-    NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(nsXPathExpression,
-                                             nsIDOMXPathExpression)
-
-    // nsIDOMXPathExpression interface
-    NS_DECL_NSIDOMXPATHEXPRESSION
-
-    // nsIDOMNSXPathExpression interface
-    NS_DECL_NSIDOMNSXPATHEXPRESSION
+    already_AddRefed<XPathResult>
+        Evaluate(JSContext* aCx, nsINode& aContextNode, uint16_t aType,
+                 JS::Handle<JSObject*> aInResult, ErrorResult& aRv)
+    {
+        return EvaluateWithContext(aCx, aContextNode, 1, 1, aType, aInResult,
+                                   aRv);
+    }
+    already_AddRefed<XPathResult>
+        EvaluateWithContext(JSContext* aCx, nsINode& aContextNode,
+                            uint32_t aContextPosition, uint32_t aContextSize,
+                            uint16_t aType, JS::Handle<JSObject*> aInResult,
+                            ErrorResult& aRv);
+    already_AddRefed<XPathResult>
+        Evaluate(nsINode& aContextNode, uint16_t aType, XPathResult* aInResult,
+                 ErrorResult& aRv)
+    {
+        return EvaluateWithContext(aContextNode, 1, 1, aType, aInResult, aRv);
+    }
+    already_AddRefed<XPathResult>
+        EvaluateWithContext(nsINode& aContextNode, uint32_t aContextPosition,
+                            uint32_t aContextSize, uint16_t aType,
+                            XPathResult* aInResult, ErrorResult& aRv);
 
 private:
-    ~nsXPathExpression() {}
-
     nsAutoPtr<Expr> mExpression;
     nsRefPtr<txResultRecycler> mRecycler;
-    nsCOMPtr<nsIDOMDocument> mDocument;
-
-    class EvalContextImpl : public txIEvalContext
-    {
-    public:
-        EvalContextImpl(const txXPathNode& aContextNode,
-                        uint32_t aContextPosition, uint32_t aContextSize,
-                        txResultRecycler* aRecycler)
-            : mContextNode(aContextNode),
-              mContextPosition(aContextPosition),
-              mContextSize(aContextSize),
-              mLastError(NS_OK),
-              mRecycler(aRecycler)
-        {
-        }
-
-        nsresult getError()
-        {
-            return mLastError;
-        }
-
-        TX_DECL_EVAL_CONTEXT;
-
-    private:
-        const txXPathNode& mContextNode;
-        uint32_t mContextPosition;
-        uint32_t mContextSize;
-        nsresult mLastError;
-        nsRefPtr<txResultRecycler> mRecycler;
-    };
+    nsWeakPtr mDocument;
+    bool mCheckDocument;
 };
 
-#endif
+} // namespace dom
+} // namespace mozilla
+
+#endif /* mozilla_dom_XPathExpression_h */

--- a/dom/xslt/xpath/moz.build
+++ b/dom/xslt/xpath/moz.build
@@ -1,21 +1,21 @@
 # -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 EXPORTS.mozilla.dom += [
     'XPathEvaluator.h',
+    'XPathExpression.h',
     'XPathResult.h',
 ]
 
 UNIFIED_SOURCES += [
-    'nsXPathExpression.cpp',
     'nsXPathNSResolver.cpp',
     'txBooleanExpr.cpp',
     'txBooleanResult.cpp',
     'txCoreFunctionCall.cpp',
     'txErrorExpr.cpp',
     'txExpr.cpp',
     'txExprLexer.cpp',
     'txExprParser.cpp',
@@ -42,16 +42,17 @@ UNIFIED_SOURCES += [
     'txStringResult.cpp',
     'txUnaryExpr.cpp',
     'txUnionExpr.cpp',
     'txUnionNodeTest.cpp',
     'txVariableRefExpr.cpp',
     'txXPathOptimizer.cpp',
     'txXPCOMExtensionFunction.cpp',
     'XPathEvaluator.cpp',
+    'XPathExpression.cpp',
     'XPathResult.cpp',
 ]
 
 FAIL_ON_WARNINGS = True
 
 LOCAL_INCLUDES += [
     '../base',
     '../xml',

--- a/dom/xslt/xpath/txResultRecycler.cpp
+++ b/dom/xslt/xpath/txResultRecycler.cpp
@@ -3,19 +3,19 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "txResultRecycler.h"
 #include "txExprResult.h"
 #include "txNodeSet.h"
 
 txResultRecycler::txResultRecycler()
-    : mEmptyStringResult(nullptr),
-      mTrueResult(nullptr),
-      mFalseResult(nullptr)
+    : mEmptyStringResult(new StringResult(nullptr)),
+      mTrueResult(new BooleanResult(true)),
+      mFalseResult(new BooleanResult(false))
 {
 }
 
 txResultRecycler::~txResultRecycler()
 {
     txStackIterator stringIter(&mStringResults);
     while (stringIter.hasNext()) {
         delete static_cast<StringResult*>(stringIter.next());
@@ -23,44 +23,16 @@ txResultRecycler::~txResultRecycler()
     txStackIterator nodesetIter(&mNodeSetResults);
     while (nodesetIter.hasNext()) {
         delete static_cast<txNodeSet*>(nodesetIter.next());
     }
     txStackIterator numberIter(&mNumberResults);
     while (numberIter.hasNext()) {
         delete static_cast<NumberResult*>(numberIter.next());
     }
-
-    NS_IF_RELEASE(mEmptyStringResult);
-    NS_IF_RELEASE(mTrueResult);
-    NS_IF_RELEASE(mFalseResult);
-}
-
-
-nsresult
-txResultRecycler::init()
-{
-    NS_ASSERTION(!mEmptyStringResult && !mTrueResult && !mFalseResult,
-                 "Already inited");
-    mEmptyStringResult = new StringResult(nullptr);
-    NS_ENSURE_TRUE(mEmptyStringResult, NS_ERROR_OUT_OF_MEMORY);
-
-    NS_ADDREF(mEmptyStringResult);
-
-    mTrueResult = new BooleanResult(true);
-    NS_ENSURE_TRUE(mTrueResult, NS_ERROR_OUT_OF_MEMORY);
-
-    NS_ADDREF(mTrueResult);
-
-    mFalseResult = new BooleanResult(false);
-    NS_ENSURE_TRUE(mFalseResult, NS_ERROR_OUT_OF_MEMORY);
-
-    NS_ADDREF(mFalseResult);
-
-    return NS_OK;
 }
 
 
 void
 txResultRecycler::recycle(txAExprResult* aResult)
 {
     NS_ASSERTION(aResult->mRefCnt == 0, "In-use txAExprResult recycled");
     nsRefPtr<txResultRecycler> kungFuDeathGrip;

--- a/dom/xslt/xpath/txResultRecycler.h
+++ b/dom/xslt/xpath/txResultRecycler.h
@@ -2,31 +2,31 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef txResultRecycler_h__
 #define txResultRecycler_h__
 
 #include "nsCOMPtr.h"
+#include "nsAutoPtr.h"
 #include "txStack.h"
 
 class txAExprResult;
 class StringResult;
 class txNodeSet;
 class txXPathNode;
 class NumberResult;
 class BooleanResult;
 
 class txResultRecycler
 {
 public:
     txResultRecycler();
     ~txResultRecycler();
-    nsresult init();
 
     void AddRef()
     {
         ++mRefCnt;
         NS_LOG_ADDREF(this, mRefCnt, "txResultRecycler", sizeof(*this));
     }
     void Release()
     {
@@ -67,14 +67,14 @@ public:
      */
     nsresult getNonSharedNodeSet(txNodeSet* aNodeSet, txNodeSet** aResult);
 
 private:
     nsAutoRefCnt mRefCnt;
     txStack mStringResults;
     txStack mNodeSetResults;
     txStack mNumberResults;
-    StringResult* mEmptyStringResult;
-    BooleanResult* mTrueResult;
-    BooleanResult* mFalseResult;
+    nsRefPtr<StringResult> mEmptyStringResult;
+    nsRefPtr<BooleanResult> mTrueResult;
+    nsRefPtr<BooleanResult> mFalseResult;
 };
 
 #endif //txResultRecycler_h__

--- a/dom/xslt/xpath/txXPathOptimizer.cpp
+++ b/dom/xslt/xpath/txXPathOptimizer.cpp
@@ -75,21 +75,16 @@ txXPathOptimizer::optimize(Expr* aInExpr
     nsresult rv = NS_OK;
 
     // First check if the expression will produce the same result
     // under any context.
     Expr::ExprType exprType = aInExpr->getType();
     if (exprType != Expr::LITERAL_EXPR &&
         !aInExpr->isSensitiveTo(Expr::ANY_CONTEXT)) {
         nsRefPtr<txResultRecycler> recycler = new txResultRecycler;
-        NS_ENSURE_TRUE(recycler, NS_ERROR_OUT_OF_MEMORY);
-
-        rv = recycler->init();
-        NS_ENSURE_SUCCESS(rv, rv);
-
         txEarlyEvalContext context(recycler);
         nsRefPtr<txAExprResult> exprRes;
 
         // Don't throw if this fails since it could be that the expression
         // is or contains an error-expression.
         rv = aInExpr->evaluate(&context, getter_AddRefs(exprRes));
         if (NS_SUCCEEDED(rv)) {
             *aOutExpr = new txLiteralExpr(exprRes);

--- a/dom/xslt/xslt/txExecutionState.cpp
+++ b/dom/xslt/xslt/txExecutionState.cpp
@@ -120,20 +120,16 @@ txExecutionState::init(const txXPathNode
     // Set up loaded-documents-hash
     mLoadedDocuments.init(txXPathNodeUtils::getOwnerDocument(aNode));
 
     // Init members
     rv = mKeyHash.init();
     NS_ENSURE_SUCCESS(rv, rv);
     
     mRecycler = new txResultRecycler;
-    NS_ENSURE_TRUE(mRecycler, NS_ERROR_OUT_OF_MEMORY);
-    
-    rv = mRecycler->init();
-    NS_ENSURE_SUCCESS(rv, rv);
     
     // The actual value here doesn't really matter since noone should use this
     // value. But lets put something errorlike in just in case
     mGlobalVarPlaceholderValue = new StringResult(NS_LITERAL_STRING("Error"), nullptr);
     NS_ENSURE_TRUE(mGlobalVarPlaceholderValue, NS_ERROR_OUT_OF_MEMORY);
 
     // Initiate first instruction. This has to be done last since findTemplate
     // might use us.

--- a/dom/xslt/xslt/txMozillaXSLTProcessor.cpp
+++ b/dom/xslt/xslt/txMozillaXSLTProcessor.cpp
@@ -465,20 +465,16 @@ txMozillaXSLTProcessor::AddXSLTParam(con
 
         // Set up context
         nsAutoPtr<txXPathNode> contextNode(
           txXPathNativeNode::createXPathNode(aContext));
         NS_ENSURE_TRUE(contextNode, NS_ERROR_OUT_OF_MEMORY);
 
         if (!mRecycler) {
             mRecycler = new txResultRecycler;
-            NS_ENSURE_TRUE(mRecycler, NS_ERROR_OUT_OF_MEMORY);
-
-            rv = mRecycler->init();
-            NS_ENSURE_SUCCESS(rv, rv);
         }
 
         txXSLTParamContext paramContext(&mParamNamespaceMap, *contextNode,
                                         mRecycler);
 
         // Parse
         nsAutoPtr<Expr> expr;
         rv = txExprParser::createExpr(aSelect, &paramContext,

--- a/gfx/layers/ipc/ISurfaceAllocator.cpp
+++ b/gfx/layers/ipc/ISurfaceAllocator.cpp
@@ -173,17 +173,20 @@ ISurfaceAllocator::DestroySharedSurface(
       NS_RUNTIMEABORT("surface type not implemented!");
   }
   *aSurface = SurfaceDescriptor();
 }
 
 // XXX - We should actually figure out the minimum shmem allocation size on
 // a certain platform and use that.
 const uint32_t sShmemPageSize = 4096;
+
+#ifdef DEBUG
 const uint32_t sSupportedBlockSize = 4;
+#endif
 
 enum AllocationStatus
 {
   STATUS_ALLOCATED,
   STATUS_FREED
 };
 
 struct ShmemSectionHeapHeader
@@ -319,10 +322,10 @@ ISurfaceAllocator::AllocGrallocBuffer(co
 }
 
 void
 ISurfaceAllocator::DeallocGrallocBuffer(MaybeMagicGrallocBufferHandle* aHandle)
 {
   SharedBufferManagerChild::GetSingleton()->DeallocGrallocBuffer(*aHandle);
 }
 
-} // namespace
-} // namespace
+} // namespace layers
+} // namespace mozilla

--- a/gfx/layers/opengl/CompositorOGL.cpp
+++ b/gfx/layers/opengl/CompositorOGL.cpp
@@ -54,18 +54,16 @@
 
 #include "GeckoProfiler.h"
 
 #if defined(MOZ_WIDGET_GONK) && ANDROID_VERSION >= 17
 #include "libdisplay/GonkDisplay.h"     // for GonkDisplay
 #include <ui/Fence.h>
 #endif
 
-#define BUFFER_OFFSET(i) ((char *)nullptr + (i))
-
 namespace mozilla {
 
 using namespace std;
 using namespace gfx;
 
 namespace layers {
 
 using namespace mozilla::gl;
@@ -401,21 +399,23 @@ SetRects(int n,
 {
   if (flip_y) {
     std::swap(ty0, ty1);
   }
   aLayerRects[n] = Rect(x0, y0, x1 - x0, y1 - y0);
   aTextureRects[n] = Rect(tx0, ty0, tx1 - tx0, ty1 - ty0);
 }
 
+#ifdef DEBUG
 static inline bool
 FuzzyEqual(float a, float b)
 {
   return fabs(a - b) < 0.0001f;
 }
+#endif
 
 static int
 DecomposeIntoNoRepeatRects(const Rect& aRect,
                            const Rect& aTexCoordRect,
                            Rect* aLayerRects,
                            Rect* aTextureRects)
 {
   Rect texCoordRect = aTexCoordRect;

--- a/gfx/src/nsFontMetrics.cpp
+++ b/gfx/src/nsFontMetrics.cpp
@@ -157,23 +157,25 @@ nscoord
 nsFontMetrics::XHeight()
 {
     return ROUND_TO_TWIPS(GetMetrics().xHeight);
 }
 
 nscoord
 nsFontMetrics::SuperscriptOffset()
 {
-    return ROUND_TO_TWIPS(GetMetrics().superscriptOffset);
+    return ROUND_TO_TWIPS(GetMetrics().emHeight *
+                          NS_FONT_SUPERSCRIPT_OFFSET_RATIO);
 }
 
 nscoord
 nsFontMetrics::SubscriptOffset()
 {
-    return ROUND_TO_TWIPS(GetMetrics().subscriptOffset);
+    return ROUND_TO_TWIPS(GetMetrics().emHeight *
+                          NS_FONT_SUBSCRIPT_OFFSET_RATIO);
 }
 
 void
 nsFontMetrics::GetStrikeout(nscoord& aOffset, nscoord& aSize)
 {
     aOffset = ROUND_TO_TWIPS(GetMetrics().strikeoutOffset);
     aSize = ROUND_TO_TWIPS(GetMetrics().strikeoutSize);
 }

--- a/gfx/tests/gtest/TestAsyncPanZoomController.cpp
+++ b/gfx/tests/gtest/TestAsyncPanZoomController.cpp
@@ -8,16 +8,17 @@
 
 #include "mozilla/Attributes.h"
 #include "mozilla/layers/AsyncCompositionManager.h" // for ViewTransform
 #include "mozilla/layers/AsyncPanZoomController.h"
 #include "mozilla/layers/LayerManagerComposite.h"
 #include "mozilla/layers/GeckoContentController.h"
 #include "mozilla/layers/CompositorParent.h"
 #include "mozilla/layers/APZCTreeManager.h"
+#include "mozilla/Preferences.h"
 #include "base/task.h"
 #include "Layers.h"
 #include "TestLayers.h"
 #include "gfxPrefs.h"
 
 using namespace mozilla;
 using namespace mozilla::gfx;
 using namespace mozilla::layers;
@@ -53,16 +54,34 @@ public:
   MOCK_METHOD3(HandleDoubleTap, void(const CSSPoint&, int32_t, const ScrollableLayerGuid&));
   MOCK_METHOD3(HandleSingleTap, void(const CSSPoint&, int32_t, const ScrollableLayerGuid&));
   MOCK_METHOD3(HandleLongTap, void(const CSSPoint&, int32_t, const ScrollableLayerGuid&));
   MOCK_METHOD3(HandleLongTapUp, void(const CSSPoint&, int32_t, const ScrollableLayerGuid&));
   MOCK_METHOD3(SendAsyncScrollDOMEvent, void(bool aIsRoot, const CSSRect &aContentRect, const CSSSize &aScrollableSize));
   MOCK_METHOD2(PostDelayedTask, void(Task* aTask, int aDelayMs));
 };
 
+class TestScopedBoolPref {
+public:
+  TestScopedBoolPref(const char* aPref, bool aVal)
+    : mPref(aPref)
+  {
+    mOldVal = Preferences::GetBool(aPref);
+    Preferences::SetBool(aPref, aVal);
+  }
+
+  ~TestScopedBoolPref() {
+    Preferences::SetBool(mPref, mOldVal);
+  }
+
+private:
+  const char* mPref;
+  bool mOldVal;
+};
+
 class MockContentControllerDelayed : public MockContentController {
 public:
   MockContentControllerDelayed()
   {
   }
 
   void PostDelayedTask(Task* aTask, int aDelayMs) {
     mTaskQueue.AppendElement(aTask);
@@ -879,40 +898,100 @@ TEST_F(AsyncPanZoomControllerTester, Fli
   DoFlingStopTest(false);
 }
 
 TEST_F(AsyncPanZoomControllerTester, FlingStopTap) {
   DoFlingStopTest(true);
 }
 
 TEST_F(AsyncPanZoomControllerTester, OverScrollPanning) {
+  TestScopedBoolPref overscrollEnabledPref("apz.overscroll.enabled", true);
+
   TimeStamp testStartTime = TimeStamp::Now();
   AsyncPanZoomController::SetFrameTime(testStartTime);
 
   nsRefPtr<MockContentController> mcc = new NiceMock<MockContentController>();
   nsRefPtr<TestAPZCTreeManager> tm = new TestAPZCTreeManager();
   nsRefPtr<TestAsyncPanZoomController> apzc = new TestAsyncPanZoomController(0, mcc, tm);
 
   apzc->SetFrameMetrics(TestFrameMetrics());
   apzc->NotifyLayersUpdated(TestFrameMetrics(), true);
 
-  EXPECT_CALL(*mcc, SendAsyncScrollDOMEvent(_,_,_)).Times(AtLeast(1));
-  EXPECT_CALL(*mcc, RequestContentRepaint(_)).Times(1);
+  // Pan sufficiently to hit overscroll behavior
+  int time = 0;
+  int touchStart = 500;
+  int touchEnd = 10;
+  ApzcPan(apzc, tm, time, touchStart, touchEnd);
+  EXPECT_TRUE(apzc->IsOverscrolled());
+
+  // Note that in the calls to SampleContentTransformForFrame below, the time
+  // increment used is sufficiently large for the animation to have completed. However,
+  // any single call to SampleContentTransformForFrame will not finish an animation
+  // *and* also proceed through the following animation, if there is one.
+  // Therefore the minimum number of calls to go from an overscroll-inducing pan
+  // to a reset state is 3; these are documented further below.
+
+  ScreenPoint pointOut;
+  ViewTransform viewTransformOut;
+
+  // This sample will run to the end of the non-overscrolling fling animation
+  // and will schedule the overscrolling fling animation.
+  apzc->SampleContentTransformForFrame(testStartTime + TimeDuration::FromMilliseconds(10000), &viewTransformOut, pointOut);
+  EXPECT_EQ(ScreenPoint(0, 90), pointOut);
+  EXPECT_TRUE(apzc->IsOverscrolled());
+
+  // This sample will run to the end of the overscrolling fling animation and
+  // will schedule the snapback animation.
+  apzc->SampleContentTransformForFrame(testStartTime + TimeDuration::FromMilliseconds(20000), &viewTransformOut, pointOut);
+  EXPECT_EQ(ScreenPoint(0, 90), pointOut);
+  EXPECT_TRUE(apzc->IsOverscrolled());
+
+  // This sample will run to the end of the snapback animation and reset the state.
+  apzc->SampleContentTransformForFrame(testStartTime + TimeDuration::FromMilliseconds(30000), &viewTransformOut, pointOut);
+  EXPECT_EQ(ScreenPoint(0, 90), pointOut);
+  EXPECT_FALSE(apzc->IsOverscrolled());
+
+  apzc->AssertStateIsReset();
+  apzc->Destroy();
+}
+
+TEST_F(AsyncPanZoomControllerTester, OverScrollAbort) {
+  TestScopedBoolPref overscrollEnabledPref("apz.overscroll.enabled", true);
+
+  TimeStamp testStartTime = TimeStamp::Now();
+  AsyncPanZoomController::SetFrameTime(testStartTime);
+
+  nsRefPtr<MockContentController> mcc = new NiceMock<MockContentController>();
+  nsRefPtr<TestAPZCTreeManager> tm = new TestAPZCTreeManager();
+  nsRefPtr<TestAsyncPanZoomController> apzc = new TestAsyncPanZoomController(0, mcc, tm);
+
+  apzc->SetFrameMetrics(TestFrameMetrics());
+  apzc->NotifyLayersUpdated(TestFrameMetrics(), true);
 
   // Pan sufficiently to hit overscroll behavior
   int time = 0;
   int touchStart = 500;
   int touchEnd = 10;
+  ApzcPan(apzc, tm, time, touchStart, touchEnd);
+  EXPECT_TRUE(apzc->IsOverscrolled());
+
   ScreenPoint pointOut;
   ViewTransform viewTransformOut;
 
-  // Pan down
-  ApzcPan(apzc, tm, time, touchStart, touchEnd);
-  apzc->SampleContentTransformForFrame(testStartTime+TimeDuration::FromMilliseconds(1000), &viewTransformOut, pointOut);
-  EXPECT_EQ(ScreenPoint(0, 90), pointOut);
+  // This sample call will run to the end of the non-overscrolling fling animation
+  // and will schedule the overscrolling fling animation (see comment in OverScrollPanning
+  // above for more explanation).
+  apzc->SampleContentTransformForFrame(testStartTime + TimeDuration::FromMilliseconds(10000), &viewTransformOut, pointOut);
+  EXPECT_TRUE(apzc->IsOverscrolled());
+
+  // At this point, we have an active overscrolling fling animation.
+  // Check that cancelling the animation clears the overscroll.
+  apzc->CancelAnimation();
+  EXPECT_FALSE(apzc->IsOverscrolled());
+  apzc->AssertStateIsReset();
 
   apzc->Destroy();
 }
 
 TEST_F(AsyncPanZoomControllerTester, ShortPress) {
   nsRefPtr<MockContentControllerDelayed> mcc = new NiceMock<MockContentControllerDelayed>();
   nsRefPtr<TestAPZCTreeManager> tm = new TestAPZCTreeManager();
   nsRefPtr<TestAsyncPanZoomController> apzc = new TestAsyncPanZoomController(

--- a/gfx/thebes/gfxDWriteFonts.cpp
+++ b/gfx/thebes/gfxDWriteFonts.cpp
@@ -2,19 +2,17 @@
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "gfxDWriteFonts.h"
 
 #include "mozilla/MemoryReporting.h"
 
-#include "gfxHarfBuzzShaper.h"
 #include <algorithm>
-#include "gfxGraphiteShaper.h"
 #include "gfxDWriteFontList.h"
 #include "gfxContext.h"
 #include <dwrite.h>
 
 #include "harfbuzz/hb.h"
 
 // Chosen this as to resemble DWrite's own oblique face style.
 #define OBLIQUE_SKEW_FACTOR 0.3
@@ -101,24 +99,16 @@ gfxDWriteFont::gfxDWriteFont(gfxFontEntr
     rv = fe->CreateFontFace(getter_AddRefs(mFontFace), sims);
 
     if (NS_FAILED(rv)) {
         mIsValid = false;
         return;
     }
 
     ComputeMetrics(anAAOption);
-
-    if (FontCanSupportGraphite()) {
-        mGraphiteShaper = new gfxGraphiteShaper(this);
-    }
-
-    if (FontCanSupportHarfBuzz()) {
-        mHarfBuzzShaper = new gfxHarfBuzzShaper(this);
-    }
 }
 
 gfxDWriteFont::~gfxDWriteFont()
 {
     if (mCairoFontFace) {
         cairo_font_face_destroy(mCairoFontFace);
     }
     if (mScaledFont) {
@@ -129,42 +119,16 @@ gfxDWriteFont::~gfxDWriteFont()
 
 gfxFont*
 gfxDWriteFont::CopyWithAntialiasOption(AntialiasOption anAAOption)
 {
     return new gfxDWriteFont(static_cast<gfxDWriteFontEntry*>(mFontEntry.get()),
                              &mStyle, mNeedsBold, anAAOption);
 }
 
-bool
-gfxDWriteFont::ShapeText(gfxContext      *aContext,
-                         const char16_t *aText,
-                         uint32_t         aOffset,
-                         uint32_t         aLength,
-                         int32_t          aScript,
-                         gfxShapedText   *aShapedText,
-                         bool             aPreferPlatformShaping)
-{
-    bool ok = false;
-
-    if (mGraphiteShaper && gfxPlatform::GetPlatform()->UseGraphiteShaping()) {
-        ok = mGraphiteShaper->ShapeText(aContext, aText, aOffset, aLength,
-                                        aScript, aShapedText);
-    }
-
-    if (!ok && mHarfBuzzShaper) {
-        ok = mHarfBuzzShaper->ShapeText(aContext, aText, aOffset, aLength,
-                                        aScript, aShapedText);
-    }
-
-    PostShapingFixup(aContext, aText, aOffset, aLength, aShapedText);
-
-    return ok;
-}
-
 const gfxFont::Metrics&
 gfxDWriteFont::GetMetrics()
 {
     return *mMetrics;
 }
 
 bool
 gfxDWriteFont::GetFakeMetricsForArialBlack(DWRITE_FONT_METRICS *aFontMetrics)
@@ -311,32 +275,29 @@ gfxDWriteFont::ComputeMetrics(AntialiasO
     mMetrics->underlineOffset =
         fontMetrics.underlinePosition * mFUnitsConvFactor;
     mMetrics->underlineSize = 
         fontMetrics.underlineThickness * mFUnitsConvFactor;
     mMetrics->strikeoutOffset =
         fontMetrics.strikethroughPosition * mFUnitsConvFactor;
     mMetrics->strikeoutSize =
         fontMetrics.strikethroughThickness * mFUnitsConvFactor;
-    mMetrics->superscriptOffset = 0;
-    mMetrics->subscriptOffset = 0;
 
     SanitizeMetrics(mMetrics, GetFontEntry()->mIsBadUnderlineFont);
 
 #if 0
     printf("Font: %p (%s) size: %f\n", this,
            NS_ConvertUTF16toUTF8(GetName()).get(), mStyle.size);
     printf("    emHeight: %f emAscent: %f emDescent: %f\n", mMetrics->emHeight, mMetrics->emAscent, mMetrics->emDescent);
     printf("    maxAscent: %f maxDescent: %f maxAdvance: %f\n", mMetrics->maxAscent, mMetrics->maxDescent, mMetrics->maxAdvance);
     printf("    internalLeading: %f externalLeading: %f\n", mMetrics->internalLeading, mMetrics->externalLeading);
     printf("    spaceWidth: %f aveCharWidth: %f zeroOrAve: %f xHeight: %f\n",
            mMetrics->spaceWidth, mMetrics->aveCharWidth, mMetrics->zeroOrAveCharWidth, mMetrics->xHeight);
-    printf("    uOff: %f uSize: %f stOff: %f stSize: %f supOff: %f subOff: %f\n",
-           mMetrics->underlineOffset, mMetrics->underlineSize, mMetrics->strikeoutOffset, mMetrics->strikeoutSize,
-           mMetrics->superscriptOffset, mMetrics->subscriptOffset);
+    printf("    uOff: %f uSize: %f stOff: %f stSize: %f\n",
+           mMetrics->underlineOffset, mMetrics->underlineSize, mMetrics->strikeoutOffset, mMetrics->strikeoutSize);
 #endif
 }
 
 using namespace mozilla; // for AutoSwap_* types
 
 struct EBLCHeader {
     AutoSwap_PRUint32 version;
     AutoSwap_PRUint32 numSizes;

--- a/gfx/thebes/gfxDWriteFonts.h
+++ b/gfx/thebes/gfxDWriteFonts.h
@@ -66,24 +66,16 @@ public:
 
     virtual FontType GetType() const { return FONT_TYPE_DWRITE; }
 
     virtual mozilla::TemporaryRef<mozilla::gfx::ScaledFont> GetScaledFont(mozilla::gfx::DrawTarget *aTarget);
 
     virtual cairo_scaled_font_t *GetCairoScaledFont();
 
 protected:
-    virtual bool ShapeText(gfxContext     *aContext,
-                           const char16_t *aText,
-                           uint32_t        aOffset,
-                           uint32_t        aLength,
-                           int32_t         aScript,
-                           gfxShapedText  *aShapedText,
-                           bool            aPreferPlatformShaping = false);
-
     bool GetFakeMetricsForArialBlack(DWRITE_FONT_METRICS *aFontMetrics);
 
     void ComputeMetrics(AntialiasOption anAAOption);
 
     bool HasBitmapStrikeForSize(uint32_t aSize);
 
     cairo_font_face_t *CairoFontFace();
 

--- a/gfx/thebes/gfxFT2FontBase.cpp
+++ b/gfx/thebes/gfxFT2FontBase.cpp
@@ -128,17 +128,17 @@ gfxFT2FontBase::GetMetrics()
     //    printf("font name: %s %f\n", NS_ConvertUTF16toUTF8(GetName()).get(), GetStyle()->size);
     //    printf ("pango font %s\n", pango_font_description_to_string (pango_font_describe (font)));
 
     fprintf (stderr, "Font: %s\n", NS_ConvertUTF16toUTF8(GetName()).get());
     fprintf (stderr, "    emHeight: %f emAscent: %f emDescent: %f\n", mMetrics.emHeight, mMetrics.emAscent, mMetrics.emDescent);
     fprintf (stderr, "    maxAscent: %f maxDescent: %f\n", mMetrics.maxAscent, mMetrics.maxDescent);
     fprintf (stderr, "    internalLeading: %f externalLeading: %f\n", mMetrics.externalLeading, mMetrics.internalLeading);
     fprintf (stderr, "    spaceWidth: %f aveCharWidth: %f xHeight: %f\n", mMetrics.spaceWidth, mMetrics.aveCharWidth, mMetrics.xHeight);
-    fprintf (stderr, "    uOff: %f uSize: %f stOff: %f stSize: %f suOff: %f suSize: %f\n", mMetrics.underlineOffset, mMetrics.underlineSize, mMetrics.strikeoutOffset, mMetrics.strikeoutSize, mMetrics.superscriptOffset, mMetrics.subscriptOffset);
+    fprintf (stderr, "    uOff: %f uSize: %f stOff: %f stSize: %f\n", mMetrics.underlineOffset, mMetrics.underlineSize, mMetrics.strikeoutOffset, mMetrics.strikeoutSize);
 #endif
 
     mHasMetrics = true;
     return mMetrics;
 }
 
 // Get the glyphID of a space
 uint32_t

--- a/gfx/thebes/gfxFT2Fonts.cpp
+++ b/gfx/thebes/gfxFT2Fonts.cpp
@@ -19,18 +19,16 @@
 #endif
 
 #include "gfxTypes.h"
 #include "gfxFT2Fonts.h"
 #include "gfxFT2FontBase.h"
 #include "gfxFT2Utils.h"
 #include "gfxFT2FontList.h"
 #include <locale.h>
-#include "gfxHarfBuzzShaper.h"
-#include "gfxGraphiteShaper.h"
 #include "nsGkAtoms.h"
 #include "nsTArray.h"
 #include "nsUnicodeRange.h"
 #include "nsCRT.h"
 #include "nsXULAppAPI.h"
 
 #include "prlog.h"
 #include "prinit.h"
@@ -39,52 +37,30 @@
 #include "mozilla/Preferences.h"
 #include "mozilla/gfx/2D.h"
 
 /**
  * gfxFT2Font
  */
 
 bool
-gfxFT2Font::ShapeText(gfxContext      *aContext,
+gfxFT2Font::ShapeText(gfxContext     *aContext,
                       const char16_t *aText,
-                      uint32_t         aOffset,
-                      uint32_t         aLength,
-                      int32_t          aScript,
-                      gfxShapedText   *aShapedText,
-                      bool             aPreferPlatformShaping)
+                      uint32_t        aOffset,
+                      uint32_t        aLength,
+                      int32_t         aScript,
+                      gfxShapedText  *aShapedText)
 {
-    bool ok = false;
-
-    if (FontCanSupportGraphite()) {
-        if (gfxPlatform::GetPlatform()->UseGraphiteShaping()) {
-            if (!mGraphiteShaper) {
-                mGraphiteShaper = new gfxGraphiteShaper(this);
-            }
-            ok = mGraphiteShaper->ShapeText(aContext, aText,
-                                            aOffset, aLength,
-                                            aScript, aShapedText);
-        }
+    if (!gfxFont::ShapeText(aContext, aText, aOffset, aLength, aScript,
+                            aShapedText)) {
+        // harfbuzz must have failed(?!), just render raw glyphs
+        AddRange(aText, aOffset, aLength, aShapedText);
+        PostShapingFixup(aContext, aText, aOffset, aLength, aShapedText);
     }
 
-    if (!ok && gfxPlatform::GetPlatform()->UseHarfBuzzForScript(aScript)) {
-        if (!mHarfBuzzShaper) {
-            mHarfBuzzShaper = new gfxHarfBuzzShaper(this);
-        }
-        ok = mHarfBuzzShaper->ShapeText(aContext, aText,
-                                        aOffset, aLength,
-                                        aScript, aShapedText);
-    }
-
-    if (!ok) {
-        AddRange(aText, aOffset, aLength, aShapedText);
-    }
-
-    PostShapingFixup(aContext, aText, aOffset, aLength, aShapedText);
-
     return true;
 }
 
 void
 gfxFT2Font::AddRange(const char16_t *aText, uint32_t aOffset,
                      uint32_t aLength, gfxShapedText *aShapedText)
 {
     const uint32_t appUnitsPerDevUnit = aShapedText->GetAppUnitsPerDevUnit();

--- a/gfx/thebes/gfxFT2Fonts.h
+++ b/gfx/thebes/gfxFT2Fonts.h
@@ -72,18 +72,17 @@ public: // new functions
 #endif
 
 protected:
     virtual bool ShapeText(gfxContext      *aContext,
                            const char16_t *aText,
                            uint32_t         aOffset,
                            uint32_t         aLength,
                            int32_t          aScript,
-                           gfxShapedText   *aShapedText,
-                           bool             aPreferPlatformShaping);
+                           gfxShapedText   *aShapedText);
 
     void FillGlyphDataForChar(uint32_t ch, CachedGlyphData *gd);
 
     void AddRange(const char16_t *aText,
                   uint32_t         aOffset,
                   uint32_t         aLength,
                   gfxShapedText   *aShapedText);
 

--- a/gfx/thebes/gfxFT2Utils.cpp
+++ b/gfx/thebes/gfxFT2Utils.cpp
@@ -62,18 +62,16 @@ gfxFT2LockedFace::GetMetrics(gfxFont::Me
         aMetrics->externalLeading = 0.2 * emHeight;
         const gfxFloat spaceWidth = 0.5 * emHeight;
         aMetrics->spaceWidth = spaceWidth;
         aMetrics->maxAdvance = spaceWidth;
         aMetrics->aveCharWidth = spaceWidth;
         aMetrics->zeroOrAveCharWidth = spaceWidth;
         const gfxFloat xHeight = 0.5 * emHeight;
         aMetrics->xHeight = xHeight;
-        aMetrics->superscriptOffset = xHeight;
-        aMetrics->subscriptOffset = xHeight;
         const gfxFloat underlineSize = emHeight / 14.0;
         aMetrics->underlineSize = underlineSize;
         aMetrics->underlineOffset = -underlineSize;
         aMetrics->strikeoutOffset = 0.25 * emHeight;
         aMetrics->strikeoutSize = underlineSize;
 
         *aSpaceGlyph = 0;
         return;
@@ -238,34 +236,16 @@ gfxFT2LockedFace::GetMetrics(gfxFont::Me
     } else { // No strikeout info.
         aMetrics->strikeoutSize = aMetrics->underlineSize;
         // Use OpenType spec's suggested position for Roman font.
         aMetrics->strikeoutOffset = emHeight * 409.0 / 2048.0
             + 0.5 * aMetrics->strikeoutSize;
     }
     SnapLineToPixels(aMetrics->strikeoutOffset, aMetrics->strikeoutSize);
 
-    if (os2 && os2->ySuperscriptYOffset) {
-        gfxFloat val = ScaleRoundDesignUnits(os2->ySuperscriptYOffset,
-                                             ftMetrics.y_scale);
-        aMetrics->superscriptOffset = std::max(1.0, val);
-    } else {
-        aMetrics->superscriptOffset = aMetrics->xHeight;
-    }
-    
-    if (os2 && os2->ySubscriptYOffset) {
-        gfxFloat val = ScaleRoundDesignUnits(os2->ySubscriptYOffset,
-                                             ftMetrics.y_scale);
-        // some fonts have the incorrect sign. 
-        val = fabs(val);
-        aMetrics->subscriptOffset = std::max(1.0, val);
-    } else {
-        aMetrics->subscriptOffset = aMetrics->xHeight;
-    }
-
     aMetrics->maxHeight = aMetrics->maxAscent + aMetrics->maxDescent;
 
     // Make the line height an integer number of pixels so that lines will be
     // equally spaced (rather than just being snapped to pixels, some up and
     // some down).  Layout calculates line height from the emHeight +
     // internalLeading + externalLeading, but first each of these is rounded
     // to layout units.  To ensure that the result is an integer number of
     // pixels, round each of the components to pixels.

--- a/gfx/thebes/gfxFont.cpp
+++ b/gfx/thebes/gfxFont.cpp
@@ -18,16 +18,17 @@
 
 #include "gfxFont.h"
 #include "gfxPlatform.h"
 #include "nsGkAtoms.h"
 
 #include "gfxTypes.h"
 #include "gfxContext.h"
 #include "gfxFontMissingGlyphs.h"
+#include "gfxGraphiteShaper.h"
 #include "gfxHarfBuzzShaper.h"
 #include "gfxUserFontSet.h"
 #include "gfxPlatformFontList.h"
 #include "gfxScriptItemizer.h"
 #include "nsSpecialCasingData.h"
 #include "nsTextRunTransformations.h"
 #include "nsUnicodeProperties.h"
 #include "nsMathUtils.h"
@@ -4069,61 +4070,57 @@ gfxFont::CacheHashEntry::KeyEquals(const
 }
 
 bool
 gfxFont::ShapeText(gfxContext    *aContext,
                    const uint8_t *aText,
                    uint32_t       aOffset,
                    uint32_t       aLength,
                    int32_t        aScript,
-                   gfxShapedText *aShapedText,
-                   bool           aPreferPlatformShaping)
+                   gfxShapedText *aShapedText)
 {
     nsDependentCSubstring ascii((const char*)aText, aLength);
     nsAutoString utf16;
     AppendASCIItoUTF16(ascii, utf16);
     if (utf16.Length() != aLength) {
         return false;
     }
     return ShapeText(aContext, utf16.BeginReading(), aOffset, aLength,
-                     aScript, aShapedText, aPreferPlatformShaping);
+                     aScript, aShapedText);
 }
 
 bool
 gfxFont::ShapeText(gfxContext      *aContext,
                    const char16_t *aText,
                    uint32_t         aOffset,
                    uint32_t         aLength,
                    int32_t          aScript,
-                   gfxShapedText   *aShapedText,
-                   bool             aPreferPlatformShaping)
+                   gfxShapedText   *aShapedText)
 {
     bool ok = false;
 
-    if (mGraphiteShaper && gfxPlatform::GetPlatform()->UseGraphiteShaping()) {
-        ok = mGraphiteShaper->ShapeText(aContext, aText, aOffset, aLength,
-                                        aScript, aShapedText);
-    }
-
-    if (!ok && mHarfBuzzShaper && !aPreferPlatformShaping) {
-        if (gfxPlatform::GetPlatform()->UseHarfBuzzForScript(aScript)) {
-            ok = mHarfBuzzShaper->ShapeText(aContext, aText, aOffset, aLength,
+    if (FontCanSupportGraphite()) {
+        if (gfxPlatform::GetPlatform()->UseGraphiteShaping()) {
+            if (!mGraphiteShaper) {
+                mGraphiteShaper = new gfxGraphiteShaper(this);
+            }
+            ok = mGraphiteShaper->ShapeText(aContext, aText, aOffset, aLength,
                                             aScript, aShapedText);
         }
     }
 
     if (!ok) {
-        if (!mPlatformShaper) {
-            CreatePlatformShaper();
-        }
-        if (mPlatformShaper) {
-            ok = mPlatformShaper->ShapeText(aContext, aText, aOffset, aLength,
-                                            aScript, aShapedText);
-        }
-    }
+        if (!mHarfBuzzShaper) {
+            mHarfBuzzShaper = new gfxHarfBuzzShaper(this);
+        }
+        ok = mHarfBuzzShaper->ShapeText(aContext, aText, aOffset, aLength,
+                                        aScript, aShapedText);
+    }
+
+    NS_WARN_IF_FALSE(ok, "shaper failed, expect scrambled or missing text");
 
     PostShapingFixup(aContext, aText, aOffset, aLength, aShapedText);
 
     return ok;
 }
 
 void
 gfxFont::PostShapingFixup(gfxContext      *aContext,
@@ -4592,18 +4589,16 @@ gfxFont::InitMetricsFromSfntTables(Metri
             // version 2 and later includes the x-height field
             SET_SIGNED(xHeight, os2->sxHeight);
             // Abs because of negative xHeight seen in Kokonor (Tibetan) font
             aMetrics.xHeight = Abs(aMetrics.xHeight);
         }
         // this should always be present in any valid OS/2 of any version
         if (len >= offsetof(OS2Table, sTypoLineGap) + sizeof(int16_t)) {
             SET_SIGNED(aveCharWidth, os2->xAvgCharWidth);
-            SET_SIGNED(subscriptOffset, os2->ySubscriptYOffset);
-            SET_SIGNED(superscriptOffset, os2->ySuperscriptYOffset);
             SET_SIGNED(strikeoutSize, os2->yStrikeoutSize);
             SET_SIGNED(strikeoutOffset, os2->yStrikeoutPosition);
 
             // for fonts with USE_TYPO_METRICS set in the fsSelection field,
             // and for all OpenType math fonts (having a 'MATH' table),
             // let the OS/2 sTypo* metrics override those from the hhea table
             // (see http://www.microsoft.com/typography/otspec/os2.htm#fss)
             const uint16_t kUseTypoMetricsMask = 1 << 7;
@@ -4655,23 +4650,16 @@ void gfxFont::CalculateDerivedMetrics(Me
 
     if (GetFontEntry()->IsFixedPitch()) {
         // Some Quartz fonts are fixed pitch, but there's some glyph with a bigger
         // advance than the average character width... this forces
         // those fonts to be recognized like fixed pitch fonts by layout.
         aMetrics.maxAdvance = aMetrics.aveCharWidth;
     }
 
-    if (!aMetrics.subscriptOffset) {
-        aMetrics.subscriptOffset = aMetrics.xHeight;
-    }
-    if (!aMetrics.superscriptOffset) {
-        aMetrics.superscriptOffset = aMetrics.xHeight;
-    }
-
     if (!aMetrics.strikeoutOffset) {
         aMetrics.strikeoutOffset = aMetrics.xHeight * 0.5;
     }
     if (!aMetrics.strikeoutSize) {
         aMetrics.strikeoutSize = aMetrics.underlineSize;
     }
 }
 
@@ -4680,29 +4668,16 @@ gfxFont::SanitizeMetrics(gfxFont::Metric
 {
     // Even if this font size is zero, this font is created with non-zero size.
     // However, for layout and others, we should return the metrics of zero size font.
     if (mStyle.size == 0.0) {
         memset(aMetrics, 0, sizeof(gfxFont::Metrics));
         return;
     }
 
-    // MS (P)Gothic and MS (P)Mincho are not having suitable values in their super script offset.
-    // If the values are not suitable, we should use x-height instead of them.
-    // See https://bugzilla.mozilla.org/show_bug.cgi?id=353632
-    if (aMetrics->superscriptOffset <= 0 ||
-        aMetrics->superscriptOffset >= aMetrics->maxAscent) {
-        aMetrics->superscriptOffset = aMetrics->xHeight;
-    }
-    // And also checking the case of sub script offset. The old gfx for win has checked this too.
-    if (aMetrics->subscriptOffset <= 0 ||
-        aMetrics->subscriptOffset >= aMetrics->maxAscent) {
-        aMetrics->subscriptOffset = aMetrics->xHeight;
-    }
-
     aMetrics->underlineSize = std::max(1.0, aMetrics->underlineSize);
     aMetrics->strikeoutSize = std::max(1.0, aMetrics->strikeoutSize);
 
     aMetrics->underlineOffset = std::min(aMetrics->underlineOffset, -1.0);
 
     if (aMetrics->maxAscent < 1.0) {
         // We cannot draw strikeout line and overline in the ascent...
         aMetrics->underlineSize = 0;