--- a/b2g/installer/package-manifest.in
+++ b/b2g/installer/package-manifest.in
@@ -142,16 +142,17 @@
 @BINPATH@/components/content_xtf.xpt
 @BINPATH@/components/cookie.xpt
 @BINPATH@/components/directory.xpt
 @BINPATH@/components/docshell.xpt
 @BINPATH@/components/dom.xpt
 @BINPATH@/components/dom_base.xpt
 #ifdef MOZ_B2G_RIL
 @BINPATH@/components/dom_telephony.xpt
+@BINPATH@/components/dom_wifi.xpt
 @BINPATH@/components/dom_system_b2g.xpt
 #endif
 @BINPATH@/components/dom_battery.xpt
 @BINPATH@/components/dom_canvas.xpt
 @BINPATH@/components/dom_core.xpt
 @BINPATH@/components/dom_css.xpt
 @BINPATH@/components/dom_events.xpt
 @BINPATH@/components/dom_geolocation.xpt
@@ -391,16 +392,18 @@
 @BINPATH@/components/messageWakeupService.manifest
 @BINPATH@/components/nsFilePicker.js
 @BINPATH@/components/nsFilePicker.manifest
 #ifdef MOZ_B2G_RIL
 @BINPATH@/components/nsTelephonyWorker.manifest
 @BINPATH@/components/nsTelephonyWorker.js
 @BINPATH@/components/Telephony.manifest
 @BINPATH@/components/Telephony.js
+@BINPATH@/components/nsWifiWorker.js
+@BINPATH@/components/nsWifiWorker.manifest
 #endif
 #ifdef XP_MACOSX
 @BINPATH@/components/libalerts_s.dylib
 #endif
 #ifdef MOZ_ENABLE_DBUS
 @BINPATH@/components/@DLL_PREFIX@dbusservice@DLL_SUFFIX@
 #endif
 @BINPATH@/components/nsINIProcessor.manifest

--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -62,17 +62,17 @@ pref("extensions.strictCompatibility", f
 pref("extensions.minCompatibleAppVersion", "4.0");
 
 // Preferences for AMO integration
 pref("extensions.getAddons.cache.enabled", true);
 pref("extensions.getAddons.maxResults", 15);
 pref("extensions.getAddons.get.url", "https://services.addons.mozilla.org/%LOCALE%/firefox/api/%API_VERSION%/search/guid:%IDS%?src=firefox&appOS=%OS%&appVersion=%VERSION%");
 pref("extensions.getAddons.search.browseURL", "https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%");
 pref("extensions.getAddons.search.url", "https://services.addons.mozilla.org/%LOCALE%/firefox/api/%API_VERSION%/search/%TERMS%/all/%MAX_RESULTS%/%OS%/%VERSION%/%COMPATIBILITY_MODE%?src=firefox");
-pref("extensions.webservice.discoverURL", "https://services.addons.mozilla.org/%LOCALE%/firefox/discovery/pane/%VERSION%/%OS%");
+pref("extensions.webservice.discoverURL", "https://services.addons.mozilla.org/%LOCALE%/firefox/discovery/pane/%VERSION%/%OS%/%COMPATIBILITY_MODE%");
 
 // Blocklist preferences
 pref("extensions.blocklist.enabled", true);
 pref("extensions.blocklist.interval", 86400);
 // Controls what level the blocklist switches from warning about items to forcibly
 // blocking them.
 pref("extensions.blocklist.level", 2);
 pref("extensions.blocklist.url", "https://addons.mozilla.org/blocklist/3/%APP_ID%/%APP_VERSION%/%PRODUCT%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/%PING_COUNT%/%TOTAL_PING_COUNT%/%DAYS_SINCE_LAST_PING%/");

--- a/browser/base/content/browser.css
+++ b/browser/base/content/browser.css
@@ -42,24 +42,17 @@ tabbrowser {
                    max-width 250ms ease-out,
                    opacity 50ms ease-out 100ms /* hide the tab for the last 100ms of the max-width transition */;
 }
 
 .tab-throbber:not([fadein]):not([pinned]),
 .tab-label:not([fadein]):not([pinned]),
 .tab-icon-image:not([fadein]):not([pinned]),
 .tab-close-button:not([fadein]):not([pinned]) {
-  opacity: 0 !important;
-}
-
-.tab-throbber,
-.tab-label,
-.tab-icon-image,
-.tab-close-button {
-  -moz-transition: opacity 250ms;
+  display: none;
 }
 
 .tabbrowser-tabs[positionpinnedtabs] > .tabbrowser-tab[pinned] {
   position: fixed !important;
   display: block; /* position:fixed already does this (bug 579776), but let's be explicit */
 }
 
 #alltabs-popup {
@@ -102,20 +95,25 @@ toolbar[printpreview="true"] {
 }
 
 #main-window[tabsintitlebar] #appmenu-button-container,
 #main-window[tabsintitlebar] #titlebar-buttonbox {
   position: relative;
 }
 %endif
 
-toolbarpaletteitem[place="palette"] > toolbaritem > hbox[type="places"] {
+.bookmarks-toolbar-customize,
+#wrapper-personal-bookmarks > #personal-bookmarks > #PlacesToolbar > hbox > #PlacesToolbarItems {
   display: none;
 }
 
+#wrapper-personal-bookmarks[place="toolbar"] > #personal-bookmarks > #PlacesToolbar > .bookmarks-toolbar-customize {
+  display: -moz-box;
+}
+
 #main-window[disablechrome] #navigator-toolbox[tabsontop="true"] > toolbar:not(#toolbar-menubar):not(#TabsToolbar) {
   visibility: collapse;
 }
 
 #wrapper-urlbar-container #urlbar-container > #urlbar > toolbarbutton,
 #urlbar-container:not([combined]) > #urlbar > toolbarbutton,
 #urlbar-container[combined] + #reload-button + #stop-button,
 #urlbar-container[combined] + #reload-button,

--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -1559,33 +1559,37 @@ function delayedStartup(isLoadingBlank, 
     try {
       var ss = Cc["@mozilla.org/browser/sessionstartup;1"].
                getService(Ci.nsISessionStartup);
       willRecoverSession =
         (ss.sessionType == Ci.nsISessionStartup.RECOVER_SESSION);
     }
     catch (ex) { /* never mind; suppose SessionStore is broken */ }
     if (shouldCheck && !shell.isDefaultBrowser(true) && !willRecoverSession) {
-      var brandBundle = document.getElementById("bundle_brand");
-      var shellBundle = document.getElementById("bundle_shell");
-
-      var brandShortName = brandBundle.getString("brandShortName");
-      var promptTitle = shellBundle.getString("setDefaultBrowserTitle");
-      var promptMessage = shellBundle.getFormattedString("setDefaultBrowserMessage",
-                                                         [brandShortName]);
-      var checkboxLabel = shellBundle.getFormattedString("setDefaultBrowserDontAsk",
-                                                         [brandShortName]);
-      var checkEveryTime = { value: shouldCheck };
-      var ps = Services.prompt;
-      var rv = ps.confirmEx(window, promptTitle, promptMessage,
-                            ps.STD_YES_NO_BUTTONS,
-                            null, null, null, checkboxLabel, checkEveryTime);
-      if (rv == 0)
-        shell.setDefaultBrowser(true, false);
-      shell.shouldCheckDefaultBrowser = checkEveryTime.value;
+      // Delay the set-default-browser prompt so it doesn't block
+      // initialisation of the session store service.
+      setTimeout(function () {
+        var brandBundle = document.getElementById("bundle_brand");
+        var shellBundle = document.getElementById("bundle_shell");
+
+        var brandShortName = brandBundle.getString("brandShortName");
+        var promptTitle = shellBundle.getString("setDefaultBrowserTitle");
+        var promptMessage = shellBundle.getFormattedString("setDefaultBrowserMessage",
+                                                           [brandShortName]);
+        var checkboxLabel = shellBundle.getFormattedString("setDefaultBrowserDontAsk",
+                                                           [brandShortName]);
+        var checkEveryTime = { value: shouldCheck };
+        var ps = Services.prompt;
+        var rv = ps.confirmEx(window, promptTitle, promptMessage,
+                              ps.STD_YES_NO_BUTTONS,
+                              null, null, null, checkboxLabel, checkEveryTime);
+        if (rv == 0)
+          shell.setDefaultBrowser(true, false);
+        shell.shouldCheckDefaultBrowser = checkEveryTime.value;
+      }, 0);
     }
   }
 #endif
 
   // BiDi UI
   gBidiUI = isBidiEnabled();
   if (gBidiUI) {
     document.getElementById("documentDirection-separator").hidden = false;

--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@@ -393,30 +393,30 @@
       <iframe id="customizeToolbarSheetIFrame"
               style="&dialog.style;"
               hidden="true"/>
     </panel>
 
     <tooltip id="tabbrowser-tab-tooltip" onpopupshowing="gBrowser.createTooltip(event);"/>
 
     <tooltip id="back-button-tooltip">
-      <label value="&backButton.tooltip;"/>
+      <label class="tooltip-label" value="&backButton.tooltip;"/>
 #ifdef XP_MACOSX
-      <label value="&backForwardButtonMenuMac.tooltip;"/>
+      <label class="tooltip-label" value="&backForwardButtonMenuMac.tooltip;"/>
 #else
-      <label value="&backForwardButtonMenu.tooltip;"/>
+      <label class="tooltip-label" value="&backForwardButtonMenu.tooltip;"/>
 #endif
     </tooltip>
   
     <tooltip id="forward-button-tooltip">
-      <label value="&forwardButton.tooltip;"/>
+      <label class="tooltip-label" value="&forwardButton.tooltip;"/>
 #ifdef XP_MACOSX
-      <label value="&backForwardButtonMenuMac.tooltip;"/>
+      <label class="tooltip-label" value="&backForwardButtonMenuMac.tooltip;"/>
 #else
-      <label value="&backForwardButtonMenu.tooltip;"/>
+      <label class="tooltip-label" value="&backForwardButtonMenu.tooltip;"/>
 #endif
     </tooltip>
   </popupset>
 
 #ifdef CAN_DRAW_IN_TITLEBAR
 <vbox id="titlebar">
   <hbox id="titlebar-content">
     <hbox id="appmenu-button-container">

--- a/browser/components/build/Makefile.in
+++ b/browser/components/build/Makefile.in
@@ -7,23 +7,22 @@ include $(DEPTH)/config/autoconf.mk
 
 MODULE = browsercomps
 LIBRARY_NAME = browsercomps
 SHORT_LIBNAME = brwsrcmp
 IS_COMPONENT = 1
 MODULE_NAME = nsBrowserCompsModule
 FORCE_SHARED_LIB = 1
 
-# Because we are an application component, link against the CRT statically
-# (on Windows, but only if we're not building our own CRT for jemalloc)
-ifndef MOZ_MEMORY
+# Statically link the CRT on Windows if building against
+# a XULRunner SDK.
+ifdef LIBXUL_SDK
 USE_STATIC_LIBS = 1
 endif
 
-
 EXPORTS = nsBrowserCompsCID.h
 
 CPPSRCS = nsModule.cpp \
           $(NULL)
 
 ifeq ($(OS_ARCH),WINNT)
 OS_LIBS	+= $(call EXPAND_LIBNAME,ole32 shell32)
 endif
@@ -65,8 +64,11 @@ SHARED_LIBRARY_LIBS += ../migration/src/
 # GTK2: Need to link with glib for GNOME shell service
 ifneq (,$(filter cocoa gtk2,$(MOZ_WIDGET_TOOLKIT)))
 EXTRA_DSO_LDOPTS += \
   $(TK_LIBS) \
   $(NULL)
 endif
 
 include $(topsrcdir)/config/rules.mk
+
+# Ensure that we don't embed a manifest referencing the CRT.
+EMBED_MANIFEST_AT =

--- a/browser/components/places/content/places.css
+++ b/browser/components/places/content/places.css
@@ -1,21 +1,12 @@
 tree[type="places"] {
   -moz-binding: url("chrome://browser/content/places/tree.xml#places-tree");
 }
 
-.bookmarks-toolbar-customize,
-toolbarpaletteitem #PlacesToolbarItems {
-  display: none;
-}
-
-toolbarpaletteitem .bookmarks-toolbar-customize {
-  display: -moz-box;
-}
-
 .toolbar-drop-indicator {
   position: relative;
   z-index: 1;
 }
 
 menupopup[placespopup="true"] {
   -moz-binding: url("chrome://browser/content/places/menu.xml#places-popup-base");
 }

--- a/browser/devtools/highlighter/inspector.jsm
+++ b/browser/devtools/highlighter/inspector.jsm
@@ -155,16 +155,17 @@ Highlighter.prototype = {
       this.nodeInfo.container.setAttribute("locked", true);
     }
 
     this.browser.addEventListener("resize", this, true);
     this.browser.addEventListener("scroll", this, true);
 
     this.transitionDisabler = null;
 
+    this.computeZoomFactor();
     this.handleResize();
   },
 
   /**
    * Build the veil:
    *
    * <vbox id="highlighter-veil-container">
    *   <box id="highlighter-veil-topbox" class="highlighter-veil"/>
@@ -436,26 +437,20 @@ Highlighter.prototype = {
 
     let oldRect = this._contentRect;
 
     if (oldRect && aRect.top == oldRect.top && aRect.left == oldRect.left &&
         aRect.width == oldRect.width && aRect.height == oldRect.height) {
       return this._highlighting; // same rectangle
     }
 
-    // get page zoom factor, if any
-    let zoom =
-      this.win.QueryInterface(Components.interfaces.nsIInterfaceRequestor)
-      .getInterface(Components.interfaces.nsIDOMWindowUtils)
-      .screenPixelsPerCSSPixel;
-
     // adjust rect for zoom scaling
     let aRectScaled = {};
     for (let prop in aRect) {
-      aRectScaled[prop] = aRect[prop] * zoom;
+      aRectScaled[prop] = aRect[prop] * this.zoom;
     }
 
     if (aRectScaled.left >= 0 && aRectScaled.top >= 0 &&
         aRectScaled.width > 0 && aRectScaled.height > 0) {
 
       this.veilTransparentBox.style.visibility = "visible";
 
       // The bottom div and the right div are flexibles (flex=1).
@@ -518,24 +513,39 @@ Highlighter.prototype = {
     }
   },
 
   /**
    * Move the Infobar to the right place in the highlighter.
    */
   moveInfobar: function Highlighter_moveInfobar()
   {
-    let rect = this._highlightRect;
-    if (rect && this._highlighting) {
+    if (this._highlightRect) {
+      let winHeight = this.win.innerHeight * this.zoom;
+      let winWidth = this.win.innerWidth * this.zoom;
+
+      let rect = {top: this._highlightRect.top,
+                  left: this._highlightRect.left,
+                  width: this._highlightRect.width,
+                  height: this._highlightRect.height};
+
+      rect.top = Math.max(rect.top, 0);
+      rect.left = Math.max(rect.left, 0);
+      rect.width = Math.max(rect.width, 0);
+      rect.height = Math.max(rect.height, 0);
+
+      rect.top = Math.min(rect.top, winHeight);
+      rect.left = Math.min(rect.left, winWidth);
+
       this.nodeInfo.container.removeAttribute("disabled");
       // Can the bar be above the node?
       if (rect.top < this.nodeInfo.barHeight) {
         // No. Can we move the toolbar under the node?
         if (rect.top + rect.height +
-            this.nodeInfo.barHeight > this.win.innerHeight) {
+            this.nodeInfo.barHeight > winHeight) {
           // No. Let's move it inside.
           this.nodeInfo.container.style.top = rect.top + "px";
           this.nodeInfo.container.setAttribute("position", "overlap");
         } else {
           // Yes. Let's move it under the node.
           this.nodeInfo.container.style.top = rect.top + rect.height + "px";
           this.nodeInfo.container.setAttribute("position", "bottom");
         }
@@ -549,18 +559,18 @@ Highlighter.prototype = {
       let barWidth = this.nodeInfo.container.getBoundingClientRect().width;
       let left = rect.left + rect.width / 2 - barWidth / 2;
 
       // Make sure the whole infobar is visible
       if (left < 0) {
         left = 0;
         this.nodeInfo.container.setAttribute("hide-arrow", "true");
       } else {
-        if (left + barWidth > this.win.innerWidth) {
-          left = this.win.innerWidth - barWidth;
+        if (left + barWidth > winWidth) {
+          left = winWidth - barWidth;
           this.nodeInfo.container.setAttribute("hide-arrow", "true");
         } else {
           this.nodeInfo.container.removeAttribute("hide-arrow");
         }
       }
       this.nodeInfo.container.style.left = left + "px";
     } else {
       this.nodeInfo.container.style.left = "0";
@@ -633,16 +643,26 @@ Highlighter.prototype = {
   {
     if (aNode.nodeType != aNode.ELEMENT_NODE) {
       return false;
     }
     let nodeName = aNode.nodeName.toLowerCase();
     return !INSPECTOR_INVISIBLE_ELEMENTS[nodeName];
   },
 
+  /**
+   * Store page zoom factor.
+   */
+  computeZoomFactor: function Highlighter_computeZoomFactor() {
+    this.zoom =
+      this.win.QueryInterface(Components.interfaces.nsIInterfaceRequestor)
+      .getInterface(Components.interfaces.nsIDOMWindowUtils)
+      .screenPixelsPerCSSPixel;
+  },
+
   /////////////////////////////////////////////////////////////////////////
   //// Event Handling
 
   attachInspectListeners: function Highlighter_attachInspectListeners()
   {
     this.browser.addEventListener("mousemove", this, true);
     this.browser.addEventListener("click", this, true);
     this.browser.addEventListener("dblclick", this, true);
@@ -671,16 +691,17 @@ Highlighter.prototype = {
     switch (aEvent.type) {
       case "click":
         this.handleClick(aEvent);
         break;
       case "mousemove":
         this.handleMouseMove(aEvent);
         break;
       case "resize":
+        this.computeZoomFactor();
         this.brieflyDisableTransitions();
         this.handleResize(aEvent);
         break;
       case "dblclick":
       case "mousedown":
       case "mouseup":
         aEvent.stopPropagation();
         aEvent.preventDefault();

--- a/browser/devtools/highlighter/test/browser_inspector_highlighter.js
+++ b/browser/devtools/highlighter/test/browser_inspector_highlighter.js
@@ -148,39 +148,37 @@ function finishTestComparisons()
 
   is(veilBoxWidth, divWidth, "transparent veil box width matches dimensions of element (no zoom)");
   is(veilBoxHeight, divHeight, "transparent veil box height matches dimensions of element (no zoom)");
   // zoom the page by a factor of 2
   let contentViewer = InspectorUI.browser.docShell.contentViewer
                              .QueryInterface(Ci.nsIMarkupDocumentViewer);
   contentViewer.fullZoom = 2;
 
-  // check what zoom factor we're at, should be 2
-  let zoom =
-      InspectorUI.win.QueryInterface(Components.interfaces.nsIInterfaceRequestor)
-      .getInterface(Components.interfaces.nsIDOMWindowUtils)
-      .screenPixelsPerCSSPixel;
+  executeSoon(function() {
+    // check what zoom factor we're at, should be 2
+    let zoom = InspectorUI.highlighter.zoom;
+    is(zoom, 2, "zoom is 2?");
 
-  is(zoom, 2, "zoom is 2?");
+    // simulate the zoomed dimensions of the div element
+    let divDims = div.getBoundingClientRect();
+    let divWidth = divDims.width * zoom;
+    let divHeight = divDims.height * zoom;
 
-  // simulate the zoomed dimensions of the div element
-  let divDims = div.getBoundingClientRect();
-  let divWidth = divDims.width * zoom;
-  let divHeight = divDims.height * zoom;
+    // now zoomed, get new dimensions of transparent veil box over element
+    let veilBoxDims = InspectorUI.highlighter.veilTransparentBox.getBoundingClientRect();
+    let veilBoxWidth = veilBoxDims.width;
+    let veilBoxHeight = veilBoxDims.height;
 
-  // now zoomed, get new dimensions of transparent veil box over element
-  let veilBoxDims = InspectorUI.highlighter.veilTransparentBox.getBoundingClientRect();
-  let veilBoxWidth = veilBoxDims.width;
-  let veilBoxHeight = veilBoxDims.height;
+    is(veilBoxWidth, divWidth, "transparent veil box width matches width of element (2x zoom)");
+    is(veilBoxHeight, divHeight, "transparent veil box height matches width of element (2x zoom)");
 
-  is(veilBoxWidth, divWidth, "transparent veil box width matches width of element (2x zoom)");
-  is(veilBoxHeight, divHeight, "transparent veil box height matches width of element (2x zoom)");
-
-  doc = h1 = div = null;
-  executeSoon(finishUp);
+    doc = h1 = div = null;
+    executeSoon(finishUp);
+  });
 }
 
 function finishUp() {
   InspectorUI.closeInspectorUI();
   gBrowser.removeCurrentTab();
   finish();
 }
 

--- a/browser/devtools/highlighter/test/browser_inspector_infobar.js
+++ b/browser/devtools/highlighter/test/browser_inspector_infobar.js
@@ -12,28 +12,29 @@ function test()
 
   gBrowser.selectedTab = gBrowser.addTab();
   gBrowser.selectedBrowser.addEventListener("load", function onload() {
     gBrowser.selectedBrowser.removeEventListener("load", onload, true);
     doc = content.document;
     waitForFocus(setupInfobarTest, content);
   }, true);
 
-  let style = "body{width:100%;height: 100%} div {position: absolute;height: 100px;width: 500px}#bottom {bottom: 0px}#vertical {height: 100%}";
-  let html = "<style>" + style + "</style><div id=vertical></div><div id=top class='class1 class2'></div><div id=bottom></div>"
+  let style = "body{width:100%;height: 100%} div {position: absolute;height: 100px;width: 500px}#bottom {bottom: 0px}#vertical {height: 100%}#farbottom{bottom: -200px}";
+  let html = "<style>" + style + "</style><div id=vertical></div><div id=top class='class1 class2'></div><div id=bottom></div><div id=farbottom></div>"
 
   content.location = "data:text/html," + encodeURIComponent(html);
 
   function setupInfobarTest()
   {
     nodes = [
       {node: doc.querySelector("#top"), position: "bottom", tag: "DIV", id: "#top", classes: ".class1 .class2"},
       {node: doc.querySelector("#vertical"), position: "overlap", tag: "DIV", id: "#vertical", classes: ""},
       {node: doc.querySelector("#bottom"), position: "top", tag: "DIV", id: "#bottom", classes: ""},
       {node: doc.querySelector("body"), position: "overlap", tag: "BODY", id: "", classes: ""},
+      {node: doc.querySelector("#farbottom"), position: "top", tag: "DIV", id: "#farbottom", classes: ""},
     ]
 
     for (let i = 0; i < nodes.length; i++) {
       ok(nodes[i].node, "node " + i + " found");
     }
 
     Services.obs.addObserver(runTests,
       InspectorUI.INSPECTOR_NOTIFICATIONS.OPENED, false);
@@ -42,41 +43,38 @@ function test()
 
   function runTests()
   {
     Services.obs.removeObserver(runTests,
       InspectorUI.INSPECTOR_NOTIFICATIONS.OPENED);
 
     cursor = 0;
     executeSoon(function() {
-      Services.obs.addObserver(nodeSelected,
-        InspectorUI.INSPECTOR_NOTIFICATIONS.HIGHLIGHTING, false);
-
       InspectorUI.inspectNode(nodes[0].node);
+      nodeSelected();
     });
   }
 
   function nodeSelected()
   {
     executeSoon(function() {
       performTest();
       cursor++;
       if (cursor >= nodes.length) {
 
-        Services.obs.removeObserver(nodeSelected,
-          InspectorUI.INSPECTOR_NOTIFICATIONS.HIGHLIGHTING);
         Services.obs.addObserver(finishUp,
           InspectorUI.INSPECTOR_NOTIFICATIONS.CLOSED, false);
 
         executeSoon(function() {
           InspectorUI.closeInspectorUI();
         });
       } else {
         let node = nodes[cursor].node;
         InspectorUI.inspectNode(node);
+        nodeSelected();
       }
     });
   }
 
   function performTest()
   {
     let container = document.getElementById("highlighter-nodeinfobar-container");
     is(container.getAttribute("position"), nodes[cursor].position, "node " + cursor + ": position matches.");

--- a/browser/devtools/scratchpad/scratchpad.js
+++ b/browser/devtools/scratchpad/scratchpad.js
@@ -576,18 +576,22 @@ var Scratchpad = {
     let channel = NetUtil.newChannel(aFile);
     channel.contentType = "application/javascript";
 
     let self = this;
     NetUtil.asyncFetch(channel, function(aInputStream, aStatus) {
       let content = null;
 
       if (Components.isSuccessCode(aStatus)) {
+        let converter = Cc["@mozilla.org/intl/scriptableunicodeconverter"].
+                        createInstance(Ci.nsIScriptableUnicodeConverter);
+        converter.charset = "UTF-8";
         content = NetUtil.readInputStreamToString(aInputStream,
                                                   aInputStream.available());
+        content = converter.ConvertToUnicode(content);
         self.setText(content);
         self.editor.resetUndo();
       }
       else if (!aSilentError) {
         window.alert(self.strings.GetStringFromName("openFile.failed"));
       }
 
       if (aCallback) {

--- a/browser/devtools/styleeditor/styleeditor.css
+++ b/browser/devtools/styleeditor/styleeditor.css
@@ -84,26 +84,28 @@ li.error > .stylesheet-info > .styleshee
   display: -moz-box;
 }
 
 .stylesheet-saveButton {
   display: none;
 }
 
 .stylesheet-rule-count,
-li:hover > hgroup > .stylesheet-more > h3 >  .stylesheet-saveButton {
+li.splitview-active > hgroup > .stylesheet-more > h3 > .stylesheet-saveButton,
+li:hover > hgroup > .stylesheet-more > h3 > .stylesheet-saveButton {
   display: -moz-box;
 }
 
 .stylesheet-more > spacer {
   -moz-box-flex: 1;
 }
 
 /* portrait mode */
 @media (max-aspect-ratio: 5/3) {
+  li.splitview-active > hgroup > .stylesheet-more > .stylesheet-rule-count,
   li:hover > hgroup > .stylesheet-more > .stylesheet-rule-count {
     display: none;
   }
 
   .stylesheet-more {
     -moz-box-flex: 1;
     -moz-box-direction: reverse;
   }

--- a/browser/devtools/styleinspector/CssRuleView.jsm
+++ b/browser/devtools/styleinspector/CssRuleView.jsm
@@ -8,25 +8,26 @@
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
  *
  * Software distributed under the License is distributed on an "AS IS" basis,
  * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
  * for the specific language governing rights and limitations under the
  * License.
  *
- * The Original Code is the Mozilla Inspector Module.
+ * The Original Code is the Mozilla CSS Rule View.
  *
  * The Initial Developer of the Original Code is
  * The Mozilla Foundation.
  * Portions created by the Initial Developer are Copyright (C) 2011
  * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
- *   Dave Camp (dcamp@mozilla.com) (Original Author)
+ *   Dave Camp <dcamp@mozilla.com> (Original Author)
+ *   Rob Campbell <rcampbell@mozilla.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
  * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
  * in which case the provisions of the GPL or the LGPL are applicable instead
  * of those above. If you wish to allow use of your version of this file only
  * under the terms of either the GPL or the LGPL, and not to allow others to
  * use your version of this file under the terms of the MPL, indicate your
@@ -773,17 +774,26 @@ RuleEditor.prototype = {
     });
 
     let header = createChild(code, "div", {});
 
     let selectors = createChild(header, "span", {
       class: "ruleview-selector",
       textContent: this.rule.selectorText
     });
-    appendText(header, " {");
+
+    this.openBrace = createChild(header, "span", {
+      class: "ruleview-ruleopen",
+      tabindex: "0",
+      textContent: " {"
+    });
+
+    this.openBrace.addEventListener("click", function() {
+      this.newProperty();
+    }.bind(this), true);
 
     this.propertyList = createChild(code, "ul", {
       class: "ruleview-propertylist"
     });
 
     for each (let prop in this.rule.textProps) {
       let propEditor = new TextPropertyEditor(this, prop);
       this.propertyList.appendChild(propEditor.element);

--- a/browser/devtools/tilt/TiltVisualizer.jsm
+++ b/browser/devtools/tilt/TiltVisualizer.jsm
@@ -848,16 +848,17 @@ TiltVisualizer.Controller = function TV_
   aCanvas.addEventListener("mouseup", this.onMouseUp, false);
   aCanvas.addEventListener("click", this.onMouseClick, false);
   aCanvas.addEventListener("mousemove", this.onMouseMove, false);
   aCanvas.addEventListener("mouseover", this.onMouseOver, false);
   aCanvas.addEventListener("mouseout", this.onMouseOut, false);
   aCanvas.addEventListener("MozMousePixelScroll", this.onMozScroll, false);
   aCanvas.addEventListener("keydown", this.onKeyDown, false);
   aCanvas.addEventListener("keyup", this.onKeyUp, false);
+  aCanvas.addEventListener("blur", this.onBlur, false);
 
   // handle resize events to change the arcball dimensions
   aPresenter.contentWindow.addEventListener("resize", this.onResize, false);
 
   // attach this controller's update function to the presenter ondraw event
   aPresenter.ondraw = this.update;
 };
 
@@ -1004,16 +1005,23 @@ TiltVisualizer.Controller.prototype = {
     if (code === e.DOM_VK_ESCAPE) {
       this.presenter.tiltUI.destroy(this.presenter.tiltUI.currentWindowId);
       return;
     }
     this.arcball.keyUp(code);
   },
 
   /**
+   * Called when the canvas looses focus.
+   */
+  onBlur: function TVC_onBlur(e) {
+    this.arcball._keyCode = {};
+  },
+
+  /**
    * Called when the content window of the current browser is resized.
    */
   onResize: function TVC_onResize(e)
   {
     let width = e.target.innerWidth;
     let height = e.target.innerHeight;
 
     this.arcball.resize(width, height);
@@ -1044,16 +1052,17 @@ TiltVisualizer.Controller.prototype = {
     canvas.removeEventListener("mouseup", this.onMouseUp, false);
     canvas.removeEventListener("click", this.onMouseClick, false);
     canvas.removeEventListener("mousemove", this.onMouseMove, false);
     canvas.removeEventListener("mouseover", this.onMouseOver, false);
     canvas.removeEventListener("mouseout", this.onMouseOut, false);
     canvas.removeEventListener("MozMousePixelScroll", this.onMozScroll, false);
     canvas.removeEventListener("keydown", this.onKeyDown, false);
     canvas.removeEventListener("keyup", this.onKeyUp, false);
+    canvas.removeEventListener("blur", this.onBlur, false);
     presenter.contentWindow.removeEventListener("resize", this.onResize,false);
     presenter.ondraw = null;
   }
 };
 
 /**
  * This is a general purpose 3D rotation controller described by Ken Shoemake
  * in the Graphics Interface ’92 Proceedings. It features good behavior

--- a/browser/devtools/tilt/test/Makefile.in
+++ b/browser/devtools/tilt/test/Makefile.in
@@ -48,16 +48,17 @@ include $(topsrcdir)/config/rules.mk
 	head.js \
 	browser_tilt_01_lazy_getter.js \
 	browser_tilt_02_notifications.js \
 	browser_tilt_03_tab_switch.js \
 	browser_tilt_04_initialization.js \
 	browser_tilt_05_destruction-esc.js \
 	browser_tilt_05_destruction.js \
 	browser_tilt_arcball.js \
+	browser_tilt_controller.js \
 	browser_tilt_gl01.js \
 	browser_tilt_gl02.js \
 	browser_tilt_gl03.js \
 	browser_tilt_gl04.js \
 	browser_tilt_gl05.js \
 	browser_tilt_gl06.js \
 	browser_tilt_gl07.js \
 	browser_tilt_gl08.js \

new file mode 100644
--- /dev/null
+++ b/browser/devtools/tilt/test/browser_tilt_controller.js
@@ -0,0 +1,86 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+/*global ok, is, info, waitForExplicitFinish, finish, executeSoon, gBrowser */
+/*global isEqualVec, isTiltEnabled, isWebGLSupported, createTab, createTilt */
+/*global EventUtils, vec3, mat4, quat4 */
+"use strict";
+
+function test() {
+  if (!isTiltEnabled()) {
+    info("Skipping controller test because Tilt isn't enabled.");
+    return;
+  }
+  if (!isWebGLSupported()) {
+    info("Skipping controller test because WebGL isn't supported.");
+    return;
+  }
+
+  waitForExplicitFinish();
+
+  createTab(function() {
+    createTilt({
+      onTiltOpen: function(instance)
+      {
+        let canvas = instance.presenter.canvas;
+        let prev_tran = vec3.create([0, 0, 0]);
+        let prev_rot = quat4.create([0, 0, 0, 1]);
+
+        function tran() {
+          return instance.presenter.transforms.translation;
+        }
+
+        function rot() {
+          return instance.presenter.transforms.rotation;
+        }
+
+        function save() {
+          prev_tran = vec3.create(tran());
+          prev_rot = quat4.create(rot());
+        }
+
+        ok(isEqualVec(tran(), prev_tran),
+          "At init, the translation should be zero.");
+        ok(isEqualVec(rot(), prev_rot),
+          "At init, the rotation should be zero.");
+
+
+        EventUtils.synthesizeKey("VK_A", { type: "keydown" });
+        EventUtils.synthesizeKey("VK_LEFT", { type: "keydown" });
+        instance.controller.update();
+
+        ok(!isEqualVec(tran(), prev_tran),
+          "After a translation key is pressed, the vector should change.");
+        ok(!isEqualVec(rot(), prev_rot),
+          "After a rotation key is pressed, the quaternion should change.");
+
+        save();
+
+
+        gBrowser.selectedBrowser.contentWindow.focus();
+        instance.controller.update();
+
+        ok(!isEqualVec(tran(), prev_tran),
+          "Even if the canvas lost focus, the vector has some inertia.");
+        ok(!isEqualVec(rot(), prev_rot),
+          "Even if the canvas lost focus, the quaternion has some inertia.");
+
+        save();
+
+
+        while (!isEqualVec(tran(), prev_tran) || !isEqualVec(rot(), prev_rot)) {
+          instance.controller.update();
+          save();
+        }
+
+        ok(isEqualVec(tran(), prev_tran) && isEqualVec(rot(), prev_rot),
+          "After the focus is lost, the transforms inertia eventually stops.");
+      },
+      onEnd: function()
+      {
+        gBrowser.removeCurrentTab();
+        finish();
+      }
+    }, true);
+  });
+}

--- a/browser/devtools/tilt/test/head.js
+++ b/browser/devtools/tilt/test/head.js
@@ -64,16 +64,27 @@ function isApproxVec(vec1, vec2) {
   for (let i = 0, len = vec1.length; i < len; i++) {
     if (!isApprox(vec1[i], vec2[i])) {
       return false;
     }
   }
   return true;
 }
 
+function isEqualVec(vec1, vec2) {
+  if (vec1.length !== vec2.length) {
+    return false;
+  }
+  for (let i = 0, len = vec1.length; i < len; i++) {
+    if (vec1[i] !== vec2[i]) {
+      return false;
+    }
+  }
+  return true;
+}
 
 function createCanvas() {
   return document.createElementNS("http://www.w3.org/1999/xhtml", "canvas");
 }
 
 
 function createTab(callback, location) {
   let tab = gBrowser.selectedTab = gBrowser.addTab();

--- a/browser/installer/package-manifest.in
+++ b/browser/installer/package-manifest.in
@@ -133,16 +133,17 @@
 @BINPATH@/components/cookie.xpt
 @BINPATH@/components/directory.xpt
 @BINPATH@/components/docshell.xpt
 @BINPATH@/components/dom.xpt
 @BINPATH@/components/dom_apps.xpt
 @BINPATH@/components/dom_base.xpt
 #ifdef MOZ_B2G_RIL
 @BINPATH@/components/dom_telephony.xpt
+@BINPATH@/components/dom_wifi.xpt
 @BINPATH@/components/dom_system_b2g.xpt
 #endif
 @BINPATH@/components/dom_battery.xpt
 @BINPATH@/components/dom_canvas.xpt
 @BINPATH@/components/dom_core.xpt
 @BINPATH@/components/dom_css.xpt
 @BINPATH@/components/dom_events.xpt
 @BINPATH@/components/dom_geolocation.xpt
@@ -361,16 +362,18 @@
 @BINPATH@/components/contentSecurityPolicy.js
 @BINPATH@/components/contentAreaDropListener.manifest
 @BINPATH@/components/contentAreaDropListener.js
 #ifdef MOZ_B2G_RIL
 @BINPATH@/components/nsTelephonyWorker.manifest
 @BINPATH@/components/nsTelephonyWorker.js
 @BINPATH@/components/Telephony.manifest
 @BINPATH@/components/Telephony.js
+@BINPATH@/components/nsWifiWorker.js
+@BINPATH@/components/nsWifiWorker.manifest
 #endif
 @BINPATH@/components/BrowserProfileMigrators.manifest
 @BINPATH@/components/ChromeProfileMigrator.js
 #ifdef XP_MACOSX
 @BINPATH@/components/libalerts_s.dylib
 #endif
 #ifdef MOZ_ENABLE_DBUS
 @BINPATH@/components/@DLL_PREFIX@dbusservice@DLL_SUFFIX@

--- a/browser/installer/removed-files.in
+++ b/browser/installer/removed-files.in
@@ -65,16 +65,17 @@ components/nsExtensionManager.js
 components/nsInterfaceInfoToIDL.js
 components/nsScriptableIO.js
 components/nsUrlClassifierTable.js
 components/nsXmlRpcClient.js
 components/pluginGlue.js
 components/sidebar.xpt
 #ifdef MOZ_B2G_RIL
 components/dom_telephony.xpt
+components/dom_wifi.xpt
 components/dom_system_b2g.xpt
 #endif
 components/uconvd.dll
 components/WeaveCrypto.js
 components/WeaveCrypto.manifest
 components/xmlextras.xpt
 components/xpcom.xpt
 components/xpti.dat
@@ -917,16 +918,18 @@ xpicleanup@BIN_SUFFIX@
   components/PlacesProtocolHandler.js
   components/storage-Legacy.js
   components/storage-mozStorage.js
 #ifdef MOZ_B2G_RIL
   components/nsTelephonyWorker.manifest
   components/nsTelephonyWorker.js
   components/Telephony.manifest
   components/Telephony.js
+  components/nsWifiWorker.js
+  components/nsWifiWorker.manifest
 #endif
   components/txEXSLTRegExFunctions.js
   components/Weave.js
   components/WebContentConverter.js
   defaults/autoconfig/platform.js
   defaults/autoconfig/prefcalls.js
   defaults/pref/firefox-branding.js
   defaults/pref/firefox.js
@@ -1138,16 +1141,17 @@ xpicleanup@BIN_SUFFIX@
   components/cookie.xpt
   components/crashreporter.xpt
   components/directory.xpt
   components/docshell.xpt
   components/dom.xpt
   components/dom_base.xpt
 #ifdef MOZ_B2G_RIL
   components/dom_telephony.xpt
+  components/dom_wifi.xpt
   components/dom_system_b2g.xpt
 #endif
   components/dom_canvas.xpt
   components/dom_core.xpt
   components/dom_css.xpt
   components/dom_events.xpt
   components/dom_geolocation.xpt
   components/dom_html.xpt

--- a/browser/locales/en-US/chrome/browser/aboutDialog.dtd
+++ b/browser/locales/en-US/chrome/browser/aboutDialog.dtd
@@ -26,17 +26,17 @@
 <!-- LOCALIZATION NOTE (contribute.getInvolvedLink): This is a link title that links to http://www.mozilla.org/contribute/. -->
 <!ENTITY contribute.getInvolvedLink "Get involved!">
 <!ENTITY contribute.end             "">
 
 <!-- LOCALIZATION NOTE (bottomLinks.license): This is a link title that links to about:license. -->
 <!ENTITY bottomLinks.license        "Licensing Information">
 
 <!-- LOCALIZATION NOTE (bottomLinks.rights): This is a link title that links to about:rights. -->
-<!ENTITY bottomLinks.rights         "End User Rights">
+<!ENTITY bottomLinks.rights         "End-User Rights">
 
 <!-- LOCALIZATION NOTE (bottomLinks.privacy): This is a link title that links to http://www.mozilla.com/legal/privacy/. -->
 <!ENTITY bottomLinks.privacy        "Privacy Policy">
 
 <!-- LOCALIZATION NOTE (update.checkingForUpdates): try to make the localized text short (see bug 596813 for screenshots). -->
 <!ENTITY update.checkingForUpdates  "Checking for updates…">
 <!-- LOCALIZATION NOTE (update.checkingAddonCompat): try to make the localized text short (see bug 596813 for screenshots). -->
 <!ENTITY update.checkingAddonCompat "Checking Add-on compatibility…">

--- a/browser/themes/gnomestripe/browser.css
+++ b/browser/themes/gnomestripe/browser.css
@@ -143,19 +143,17 @@ toolbarbutton.bookmark-item[open="true"]
 }
 
 /* Dropmarker for folder bookmarks */
 .bookmark-item[container] > .toolbarbutton-menu-dropmarker {
   display: -moz-box !important;
 }
 
 #wrapper-personal-bookmarks[place="palette"] > .toolbarpaletteitem-box {
-  width: 16px;
-  height: 16px;
-  background: url("chrome://browser/skin/places/bookmarksToolbar.png") no-repeat;
+  background: url("chrome://browser/skin/places/bookmarksToolbar.png") no-repeat center;
 }
 
 .bookmarks-toolbar-customize {
   max-width: 15em !important;
   list-style-image: url("chrome://browser/skin/places/bookmarksToolbar.png") !important;
 }
 
 /* Bookmark menus */

--- a/browser/themes/gnomestripe/devtools/csshtmltree.css
+++ b/browser/themes/gnomestripe/devtools/csshtmltree.css
@@ -18,16 +18,17 @@
  * Portions created by the Initial Developer are Copyright (C) 2011
  * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
  *   Joe Walker <jwalker@mozilla.com> (original author)
  *   Mihai Șucan <mihai.sucan@gmail.com>
  *   Michael Ratcliffe <mratcliffe@mozilla.com>
  *   Dão Gottwald <dao@mozilla.com>
+ *   Rob Campbell <rcampbell@mozilla.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
  * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
  * in which case the provisions of the GPL or the LGPL are applicable instead
  * of those above. If you wish to allow use of your version of this file only
  * under the terms of either the GPL or the LGPL, and not to allow others to
  * use your version of this file under the terms of the MPL, indicate your
@@ -224,16 +225,20 @@
   background-color: -moz-dialog;
   padding: 2px 5px;
 }
 
 .ruleview-code {
   padding: 2px 5px;
 }
 
+.ruleview-ruleopen {
+  -moz-padding-end: 5px;
+}
+
 .ruleview-propertylist {
   list-style: none;
   padding: 0;
   margin: 0;
 }
 
 .ruleview-enableproperty {
   height: 10px;

--- a/browser/themes/pinstripe/browser.css
+++ b/browser/themes/pinstripe/browser.css
@@ -262,19 +262,17 @@ toolbarbutton.bookmark-item > menupopup 
 }
 
 .bookmark-item menuitem[openInTabs],
 .bookmark-item menuitem[siteURI] {
   list-style-image: none;
 }
 
 #wrapper-personal-bookmarks[place="palette"] > .toolbarpaletteitem-box {
-  width: 16px;
-  height: 16px;
-  background: url("chrome://browser/skin/places/bookmarksToolbar.png") no-repeat;
+  background: url("chrome://browser/skin/places/bookmarksToolbar.png") no-repeat center;
 }
 
 .bookmarks-toolbar-customize {
   max-width: 15em !important;
   list-style-image: url("chrome://browser/skin/places/bookmarksToolbar.png") !important;
 }
 
 /* ----- BOOKMARK MENUS ----- */

new file mode 100644
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..bde8d4683cb727d0739675de12e0f9a590ef0a51
GIT binary patch
literal 1131
zc$@)i1eE)UP)<h;3K|Lk000e1NJLTq0015U000~a1^@s6cK8pe00001b5ch_0Itp)
z=>Px#24YJ`L;(K){{a7>y{D4^000SaNLh0L01FcU01FcV0GgZ_00007bV*G`2ipu4
z5C%B|V}Kq200ZkuL_t(Y$8A@!P6Im-9A}?|(_j~LDV>rUAw_h#l>7&!Lk$Hj&X4d3
zX(%00Q>INvaY_?i6Tc#F{Pqk;r|8c1dObTcUSO@2Qi>R3q?95tMk%G#C#56+B*s|h
z0Fa!slv0H2yRH*sjC5UB$4V&@LKwvaARz<+H)Vi!bLX7ooa=Z9p^kN3Cm{q$Db*xW
zN@9$W5Q5~K>wM>2U1P14f7a_Y0ALsftX3=B-rfQL=JPrB`#t);2LPN-CwTAC_dTZ5
zDXy-ra6BGyKA!;qlgR|<^SS=&7~Xpvk4Jd#F$@D99v%R~$x~ZvCB`^{%orm%=ZXY?
ziVPv<srlrbC8Z=e=UN&)4>3lu)>cTJbEEgRj$PN)+B@eY#wgA?an4CfNn(r@-nN8H
zsFWgLT^Nj+aS~6-n(4qgDb|qdi3X9g)>b}*5H1@tkcNwsQ%a)e@R!8m283QSnkaC-
z{)MiubFOB|lky$FpY^OY`>*bL%v$?PT1<Qb0PpYbn9XJwh5_5{7TfK%vXbvHMtpsJ
zRmO6Bu~@)+k5UR&s}%sidta4se}9k7W`p&5jl<!9$H&LZVxH7FSH-QhNAk7g&~?@3
z&}yCK(A+V`T%aZ_#Gexw*cda~gqt&2e(SpK*F45;zk@H_tR;hHu1>~UD*&noa2?Sj
zZ^#uYhT{|OJtmV0uCK2#pU-RU-rnA7El;NtcDo%mn+*V9I-TP4^ApCHI_LTM8SC{L
zec$8e<_72U8K=_;-{0Tx-ea*?;N#;1cXxMqd3m`wmv$C?dY+6Y*3LzlQF85N!1>fP
z%M(JllqjV%l8=70h0^fpY??fO-AY>5v|PGfDdqnfv#za8^1JqDYi&h^#A)?Sr_-b&
zNv*YlRvx_4G*Or-zjKYYPi-W6TqiOrmocWEh5=%Xm907F3NvBTry$fsiOK3qhI|-l
zK7>#|QX;J>gb+rC&*VrPeWkVrqIIs(h1QwArT)6D=)FutCrks;TxsuU61kLesj<#R
z|B~$_iH1xECNC%}-M?`@55`yk@T*~KWkc&@?X;g$zbqL$4kp1`hY%|4&biBpb@$j3
ztwp3Y6K$>SqjjsvWv!L!T>7$a`>-l{b^8zz-R5Y&9&G}Q)R1$Q$$UOX&KUr(-|sP<
zP5}Ui!vV|X5>HQ07={4=5JJFix5LlR5Bk2x)zuXaheP#v{;@L!fZ1$@QVN#KW&QU0
z`U>d2iu!GDB{uXVo361wX^e4HF71Q>My(L^2KsK+nqz;Zn>o!|)|u<tc1Od{|4hKZ
x+>|oWogxE}^*ZwyW0f53QX@iy=#Vs;e*t^H?DDeC0m%RW002ovPDHLkV1n^E5@P@W

--- a/browser/themes/pinstripe/devtools/common.css
+++ b/browser/themes/pinstripe/devtools/common.css
@@ -38,17 +38,17 @@
 %include ../shared.inc
 
 /* Toolbar and Toolbar items */
 
 .devtools-toolbar {
   -moz-appearance: none;
   padding: 4px 3px;
   box-shadow: 0 1px 0 0 hsla(210, 16%, 76%, .2) inset;
-  background-image: -moz-linear-gradient(top, hsl(210,11%,36%), hsl(210,11%,18%));
+  background-image: url(background-noise-toolbar.png), -moz-linear-gradient(top, hsl(210,11%,36%), hsl(210,11%,18%));
 }
 
 .devtools-toolbarbutton {
   -moz-appearance: none;
   min-width: 78px;
   min-height: 22px;
   color: hsl(210,30%,85%);
   text-shadow: 0 -1px 0 hsla(210,8%,5%,.45);

--- a/browser/themes/pinstripe/devtools/csshtmltree.css
+++ b/browser/themes/pinstripe/devtools/csshtmltree.css
@@ -18,16 +18,17 @@
  * Portions created by the Initial Developer are Copyright (C) 2011
  * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
  *   Joe Walker <jwalker@mozilla.com> (original author)
  *   Mihai Șucan <mihai.sucan@gmail.com>
  *   Michael Ratcliffe <mratcliffe@mozilla.com>
  *   Dão Gottwald <dao@mozilla.com>
+ *   Rob Campbell <rcampbell@mozilla.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
  * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
  * in which case the provisions of the GPL or the LGPL are applicable instead
  * of those above. If you wish to allow use of your version of this file only
  * under the terms of either the GPL or the LGPL, and not to allow others to
  * use your version of this file under the terms of the MPL, indicate your
@@ -226,16 +227,20 @@
   background-color: -moz-dialog;
   padding: 2px 5px;
 }
 
 .ruleview-code {
   padding: 2px 5px;
 }
 
+.ruleview-ruleopen {
+  -moz-padding-end: 5px;
+}
+
 .ruleview-propertylist {
   list-style: none;
   padding: 0;
   margin: 0;
 }
 
 .ruleview-enableproperty {
   height: 10px;

--- a/browser/themes/pinstripe/jar.mn
+++ b/browser/themes/pinstripe/jar.mn
@@ -155,16 +155,17 @@ browser.jar:
   skin/classic/browser/devtools/breadcrumbs/rtl-start.png                    (devtools/breadcrumbs/rtl-start.png)
   skin/classic/browser/devtools/breadcrumbs/rtl-start-selected.png           (devtools/breadcrumbs/rtl-start-selected.png)
   skin/classic/browser/devtools/splitview.css               (devtools/splitview.css)
   skin/classic/browser/devtools/styleeditor.css             (devtools/styleeditor.css)
   skin/classic/browser/devtools/magnifying-glass.png	    (devtools/magnifying-glass.png)
   skin/classic/browser/devtools/itemToggle.png		    (devtools/itemToggle.png)
   skin/classic/browser/devtools/itemArrow-rtl.png	    (devtools/itemArrow-rtl.png)
   skin/classic/browser/devtools/itemArrow-ltr.png	    (devtools/itemArrow-ltr.png)
+  skin/classic/browser/devtools/background-noise-toolbar.png (devtools/background-noise-toolbar.png)
 #ifdef MOZ_SERVICES_SYNC
   skin/classic/browser/sync-throbber.png
   skin/classic/browser/sync-16.png
   skin/classic/browser/sync-32.png
   skin/classic/browser/sync-bg.png
   skin/classic/browser/sync-128.png
   skin/classic/browser/sync-desktopIcon.png
   skin/classic/browser/sync-mobileIcon.png

--- a/browser/themes/winstripe/browser-aero.css
+++ b/browser/themes/winstripe/browser-aero.css
@@ -289,31 +289,33 @@
   #tab-view:-moz-lwtheme {
     background-image: url("chrome://browser/skin/tabview/grain.png"),
                       -moz-linear-gradient(rgba(255,255,255,0), #CCD9EA 200px, #C7D5E7);
     background-attachment: fixed;
   }
 }
 
 @media not all and (-moz-windows-compositor) {
-  #main-window:-moz-system-metric(windows-default-theme) {
-    background-color: rgb(185,209,234);
-  }
-  #main-window:-moz-system-metric(windows-default-theme):-moz-window-inactive {
-    background-color: rgb(215,228,242);
-  }
+  @media (-moz-windows-default-theme) {
+    #main-window {
+      background-color: rgb(185,209,234);
+    }
+    #main-window:-moz-window-inactive {
+      background-color: rgb(215,228,242);
+    }
 
-  #toolbar-menubar:not([autohide=true]):not(:-moz-lwtheme):-moz-system-metric(windows-default-theme),
-  #TabsToolbar[tabsontop=true]:not(:-moz-lwtheme):-moz-system-metric(windows-default-theme),
-  #navigator-toolbox[tabsontop=false] > toolbar:not(#toolbar-menubar):not(:-moz-lwtheme):-moz-system-metric(windows-default-theme) {
-    -moz-binding: url("chrome://global/content/bindings/toolbar.xml#toolbar-drag");
-    background-color: transparent;
-  }
-  #toolbar-menubar[autohide=true]:-moz-system-metric(windows-default-theme) {
-    background-color: transparent;
+    #toolbar-menubar:not([autohide=true]):not(:-moz-lwtheme),
+    #TabsToolbar[tabsontop=true]:not(:-moz-lwtheme),
+    #navigator-toolbox[tabsontop=false] > toolbar:not(#toolbar-menubar):not(:-moz-lwtheme) {
+      -moz-binding: url("chrome://global/content/bindings/toolbar.xml#toolbar-drag");
+      background-color: transparent;
+    }
+    #toolbar-menubar[autohide=true] {
+      background-color: transparent !important;
+    }
   }
 
   #print-preview-toolbar:not(:-moz-lwtheme) {
     -moz-appearance: -moz-win-browsertabbar-toolbox;
   }
 }
 
 /* ::::: fullscreen window controls ::::: */

--- a/browser/themes/winstripe/browser.css
+++ b/browser/themes/winstripe/browser.css
@@ -558,19 +558,17 @@ toolbarbutton.bookmark-item[open="true"]
   display: -moz-box !important;
 }
 
 .bookmark-item > .toolbarbutton-menu-dropmarker {
   display: none;
 }
 
 #wrapper-personal-bookmarks[place="palette"] > .toolbarpaletteitem-box {
-  width: 16px;
-  height: 16px;
-  background: url("chrome://browser/skin/places/bookmarksToolbar.png") no-repeat;
+  background: url("chrome://browser/skin/places/bookmarksToolbar.png") no-repeat center;
 }
 
 .bookmarks-toolbar-customize {
   max-width: 15em !important;
   list-style-image: url("chrome://browser/skin/places/bookmarksToolbar.png") !important;
 }
 
 /* ::::: bookmark menus ::::: */
@@ -1546,19 +1544,21 @@ html|*.urlbar-input:-moz-lwtheme:-moz-pl
 }
 
 .ac-url-text,
 .ac-action-text {
   color: -moz-nativehyperlinktext;
 }
 
 %ifndef WINSTRIPE_AERO
-.ac-url-text:-moz-system-metric(windows-default-theme),
-.ac-action-text:-moz-system-metric(windows-default-theme) {
-  color: #006600;
+@media (-moz-windows-default-theme) {
+  .ac-url-text,
+  .ac-action-text {
+    color: #006600;
+  }
 }
 %endif
 
 richlistitem[type~="action"][actiontype="switchtab"] > .ac-url-box > .ac-action-icon {
   list-style-image: url("chrome://browser/skin/actionicon-tab.png");
 }
 
 .autocomplete-treebody::-moz-tree-cell-text(treecolAutoCompleteComment) {

--- a/browser/themes/winstripe/devtools/csshtmltree.css
+++ b/browser/themes/winstripe/devtools/csshtmltree.css
@@ -18,16 +18,17 @@
  * Portions created by the Initial Developer are Copyright (C) 2011
  * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
  *   Joe Walker <jwalker@mozilla.com> (original author)
  *   Mihai Șucan <mihai.sucan@gmail.com>
  *   Michael Ratcliffe <mratcliffe@mozilla.com>
  *   Dão Gottwald <dao@mozilla.com>
+ *   Rob Campbell <rcampbell@mozilla.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either the GNU General Public License Version 2 or later (the "GPL"), or
  * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
  * in which case the provisions of the GPL or the LGPL are applicable instead
  * of those above. If you wish to allow use of your version of this file only
  * under the terms of either the GPL or the LGPL, and not to allow others to
  * use your version of this file under the terms of the MPL, indicate your
@@ -225,16 +226,20 @@
   background-color: -moz-dialog;
   padding: 2px 5px;
 }
 
 .ruleview-code {
   padding: 2px 5px;
 }
 
+.ruleview-ruleopen {
+  -moz-padding-end: 5px;
+}
+
 .ruleview-propertylist {
   list-style: none;
   padding: 0;
   margin: 0;
 }
 
 .ruleview-enableproperty {
   height: 10px;

--- a/browser/themes/winstripe/places/places-aero.css
+++ b/browser/themes/winstripe/places/places-aero.css
@@ -1,12 +1,14 @@
 %include places.css
 
 /* Style Places sidebars as Vista media collection */
-#bookmarksPanel:-moz-system-metric(windows-default-theme),
-#history-panel:-moz-system-metric(windows-default-theme) {
-  background-color: #EEF3FA;
-}
+@media (-moz-windows-default-theme) {
+  #bookmarksPanel,
+  #history-panel {
+    background-color: #EEF3FA;
+  }
 
-.sidebar-placesTree:-moz-system-metric(windows-default-theme) {
-  background-color: transparent;
-  border-top: none;
+  .sidebar-placesTree {
+    background-color: transparent;
+    border-top: none;
+  }
 }

--- a/configure.in
+++ b/configure.in
@@ -1859,46 +1859,65 @@ if test "$GNU_CC"; then
     fi
     WARNINGS_AS_ERRORS='-Werror'
     DSO_CFLAGS=''
     DSO_PIC_CFLAGS='-fPIC'
     ASFLAGS="$ASFLAGS -fPIC"
     _MOZ_RTTI_FLAGS_ON=-frtti
     _MOZ_RTTI_FLAGS_OFF=-fno-rtti
 
-    # Turn on GNU specific features
-    # -Wall - turn on all warnings
-    # -pedantic - make compiler warn about non-ANSI stuff, and
-    #             be a little bit stricter
-    # -Wdeclaration-after-statement - MSVC doesn't like these
-    # Warnings slamm took out for now (these were giving more noise than help):
-    # -Wbad-function-cast - warns when casting a function to a new return type
-    # -Wshadow - removed because it generates more noise than help --pete
-    _WARNINGS_CFLAGS="${_WARNINGS_CFLAGS} -Wall -W -Wno-unused -Wpointer-arith -Wdeclaration-after-statement"
+    # Turn on GNU-specific warnings:
+    # -Wall - turn on a lot of warnings
+    # -pedantic - this is turned on below
+    # -Wpointer-arith - enabled with -pedantic, but good to have even if not
+    # -Werror=declaration-after-statement - MSVC doesn't like these
+    # -Wempty-body - catches bugs, e.g. "if (c); foo();", few false positives
+    #
+    _WARNINGS_CFLAGS="${_WARNINGS_CFLAGS} -Wall -Wpointer-arith -Wdeclaration-after-statement -Wempty-body"
+    
+    # Turn off the following warnings that -Wall/-pedantic turn on:
+    # -Woverlength-strings - we exceed the minimum maximum length all the time
+    #
+    _WARNINGS_CFLAGS="${_WARNINGS_CFLAGS} -Wno-overlength-strings"
+
     if test -z "$INTEL_CC" -a -z "$CLANG_CC"; then
        # Don't use -Wcast-align with ICC or clang
        case "$CPU_ARCH" in
            # And don't use it on hppa, ia64, sparc, arm, since it's noisy there
            hppa | ia64 | sparc | arm)
            ;;
            *)
         _WARNINGS_CFLAGS="${_WARNINGS_CFLAGS} -Wcast-align"
            ;;
        esac
     fi
 
     dnl Turn pedantic on but disable the warnings for long long
     _PEDANTIC=1
 
-    if test -z "$INTEL_CC"; then
-      _WARNINGS_CFLAGS="${_WARNINGS_CFLAGS} -W"
-    fi
-
     _DEFINES_CFLAGS='-include $(DEPTH)/mozilla-config.h -DMOZILLA_CLIENT'
     _USE_CPP_INCLUDE_FLAG=1
+
+    AC_CACHE_CHECK(whether the compiler supports -Wtype-limits,
+                   ac_cc_has_wtype_limits,
+        [
+            AC_LANG_SAVE
+            AC_LANG_C
+            _SAVE_CFLAGS="$CFLAGS"
+            CFLAGS="$CFLAGS -Wtype-limits"
+            AC_TRY_COMPILE([],
+                           [return(0);],
+                           ac_cc_has_wtype_limits="yes",
+                           ac_cc_has_wtype_limits="no")
+            CFLAGS="$_SAVE_CFLAGS"
+            AC_LANG_RESTORE
+        ])
+    if test "$ac_cc_has_wtype_limits" = "yes"; then
+        _WARNINGS_CFLAGS="${_WARNINGS_CFLAGS} -Wtype-limits"
+    fi
 elif test "$SOLARIS_SUNPRO_CC"; then
     DSO_CFLAGS=''
     if test "$CPU_ARCH" = "sparc"; then
         # for Sun Studio on Solaris/SPARC
         DSO_PIC_CFLAGS='-xcode=pic32'
     else
         DSO_PIC_CFLAGS='-KPIC'
     fi
@@ -1916,18 +1935,32 @@ else
     DSO_CFLAGS=''
     DSO_PIC_CFLAGS='-KPIC'
     _DEFINES_CFLAGS='$(ACDEFINES) -D_MOZILLA_CONFIG_H_ -DMOZILLA_CLIENT'
 fi
 
 if test "$GNU_CXX"; then
     # FIXME: Let us build with strict aliasing. bug 414641.
     CXXFLAGS="$CXXFLAGS -fno-exceptions -fno-strict-aliasing"
-    # Turn on GNU specific features
-    _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} -Wall -Wpointer-arith -Woverloaded-virtual -Wsynth -Wno-ctor-dtor-privacy -Wno-non-virtual-dtor"
+
+    # Turn on GNU-specific warnings:
+    # -Wall - turn on a lot of warnings
+    # -pedantic - this is turned on below
+    # -Wpointer-arith - enabled with -pedantic, but good to have even if not
+    # -Woverloaded-virtual - ???
+    # -Wempty-body - catches bugs, e.g. "if (c); foo();", few false positives
+    #
+    _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} -Wall -Wpointer-arith -Woverloaded-virtual -Wempty-body"
+
+    # Turn off the following warnings that -Wall/-pedantic turn on:
+    # -Woverlength-strings - we exceed the minimum maximum length all the time
+    # -Wctor-dtor-privacy - ???
+    #
+    _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} -Wno-overlength-strings -Wno-ctor-dtor-privacy"
+
     if test -z "$INTEL_CXX" -a -z "$CLANG_CXX"; then
        # Don't use -Wcast-align with ICC or clang
        case "$CPU_ARCH" in
            # And don't use it on hppa, ia64, sparc, arm, since it's noisy there
            hppa | ia64 | sparc | arm)
            ;;
            *)
         _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} -Wcast-align"
@@ -2018,16 +2051,34 @@ if test "$GNU_CXX"; then
                            ac_has_werror_return_type="no")
             CXXFLAGS="$_SAVE_CXXFLAGS"
             AC_LANG_RESTORE
         ])
     if test "$ac_has_werror_return_type" = "yes"; then
         _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} -Werror=return-type"
     fi
 
+    AC_CACHE_CHECK(whether the compiler supports -Wtype-limits,
+                   ac_has_wtype_limits,
+        [
+            AC_LANG_SAVE
+            AC_LANG_CPLUSPLUS
+            _SAVE_CXXFLAGS="$CXXFLAGS"
+            CXXFLAGS="$CXXFLAGS -Wtype-limits"
+            AC_TRY_COMPILE([],
+                           [return(0);],
+                           ac_has_wtype_limits="yes",
+                           ac_has_wtype_limits="no")
+            CXXFLAGS="$_SAVE_CXXFLAGS"
+            AC_LANG_RESTORE
+        ])
+    if test "$ac_has_wtype_limits" = "yes"; then
+        _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} -Wtype-limits"
+    fi
+
 else
     _DEFINES_CXXFLAGS='-DMOZILLA_CLIENT -D_MOZILLA_CONFIG_H_ $(ACDEFINES)'
 fi
 
 dnl gcc can come with its own linker so it is better to use the pass-thru calls
 dnl MKSHLIB_FORCE_ALL is used to force the linker to include all object
 dnl files present in an archive. MKSHLIB_UNFORCE_ALL reverts the linker to
 dnl normal behavior.

--- a/content/base/src/Makefile.in
+++ b/content/base/src/Makefile.in
@@ -189,16 +189,17 @@ include $(topsrcdir)/config/config.mk
 include $(topsrcdir)/ipc/chromium/chromium-config.mk
 include $(topsrcdir)/config/rules.mk
 
 INCLUDES	+= \
 		-I$(srcdir)/../../events/src \
 		-I$(srcdir)/../../xml/content/src \
 		-I$(srcdir)/../../../layout/xul/base/src \
 		-I$(srcdir)/../../xul/content/src \
+		-I$(srcdir)/../../xul/document/src \
 		-I$(srcdir)/../../html/content/src \
 		-I$(srcdir)/../../base/src \
 		-I$(srcdir)/../../xbl/src \
 		-I$(srcdir)/../../../layout/generic \
 		-I$(srcdir)/../../../layout/style \
 		-I$(srcdir)/../../../dom/base \
 		-I$(srcdir)/../../xml/document/src \
 		-I$(topsrcdir)/xpcom/io \

--- a/content/base/src/nsCCUncollectableMarker.cpp
+++ b/content/base/src/nsCCUncollectableMarker.cpp
@@ -52,16 +52,19 @@
 #include "nsIWindowWatcher.h"
 #include "mozilla/Services.h"
 #include "nsIXULWindow.h"
 #include "nsIAppShellService.h"
 #include "nsAppShellCID.h"
 
 static bool sInited = 0;
 PRUint32 nsCCUncollectableMarker::sGeneration = 0;
+#ifdef MOZ_XUL
+#include "nsXULPrototypeCache.h"
+#endif
 
 NS_IMPL_ISUPPORTS1(nsCCUncollectableMarker, nsIObserver)
 
 /* static */
 nsresult
 nsCCUncollectableMarker::Init()
 {
   if (sInited) {
@@ -242,11 +245,18 @@ nsCCUncollectableMarker::Observe(nsISupp
     if (hw) {
       nsCOMPtr<nsIDocShell> shell;
       hw->GetDocShell(getter_AddRefs(shell));
       nsCOMPtr<nsIDocShellTreeNode> shellTreeNode = do_QueryInterface(shell);
       MarkDocShell(shellTreeNode);
     }
   }
 
+#ifdef MOZ_XUL
+  nsXULPrototypeCache* xulCache = nsXULPrototypeCache::GetInstance();
+  if (xulCache) {
+    xulCache->MarkInCCGeneration(sGeneration);
+  }
+#endif
+
   return NS_OK;
 }
 

--- a/content/base/src/nsContentList.cpp
+++ b/content/base/src/nsContentList.cpp
@@ -42,19 +42,19 @@
  * getElementsByTagName, some properties on nsIDOMHTMLDocument, etc).
  */
 
 #include "nsContentList.h"
 #include "nsIContent.h"
 #include "nsIDOMNode.h"
 #include "nsIDocument.h"
 #include "nsGenericElement.h"
-
+#include "nsWrapperCacheInlines.h"
 #include "nsContentUtils.h"
-
+#include "nsCCUncollectableMarker.h"
 #include "nsGkAtoms.h"
 
 #include "dombindings.h"
 
 // Form related includes
 #include "nsIDOMHTMLFormElement.h"
 
 #include "pldhash.h"
@@ -75,18 +75,21 @@ nsBaseContentList::~nsBaseContentList()
 }
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsBaseContentList)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsBaseContentList)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSTARRAY(mElements)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsBaseContentList)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_SCRIPT_OBJECTS
+  if (nsCCUncollectableMarker::sGeneration && tmp->IsBlack()) {
+    return NS_SUCCESS_INTERRUPTED_TRAVERSE;
+  }
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSTARRAY_OF_NSCOMPTR(mElements)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_SCRIPT_OBJECTS
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(nsBaseContentList)
   NS_IMPL_CYCLE_COLLECTION_TRACE_PRESERVED_WRAPPER
 NS_IMPL_CYCLE_COLLECTION_TRACE_END
 
 #define NS_CONTENT_LIST_INTERFACES(_class)                                    \
     NS_INTERFACE_TABLE_ENTRY(_class, nsINodeList)                             \
     NS_INTERFACE_TABLE_ENTRY(_class, nsIDOMNodeList)

--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -188,30 +188,31 @@ static NS_DEFINE_CID(kXTFServiceCID, NS_
 
 // for ReportToConsole
 #include "nsIStringBundle.h"
 #include "nsIScriptError.h"
 #include "nsIConsoleService.h"
 
 #include "mozAutoDocUpdate.h"
 #include "imgICache.h"
-#include "xpcprivate.h"
+#include "xpcprivate.h" // nsXPConnect
 #include "nsScriptSecurityManager.h"
 #include "nsIChannelPolicy.h"
 #include "nsChannelPolicy.h"
 #include "nsIContentSecurityPolicy.h"
 #include "nsContentDLF.h"
 #ifdef MOZ_MEDIA
 #include "nsHTMLMediaElement.h"
 #endif
 #include "nsDOMTouchEvent.h"
 #include "nsIScriptElement.h"
 #include "nsIContentViewer.h"
 #include "nsIObjectLoadingContent.h"
 
+#include "mozilla/Base64.h"
 #include "mozilla/Preferences.h"
 
 #include "nsWrapperCacheInlines.h"
 
 using namespace mozilla::dom;
 using namespace mozilla::layers;
 using namespace mozilla::widget;
 using namespace mozilla;
@@ -628,29 +629,29 @@ nsresult
 nsContentUtils::Btoa(const nsAString& aBinaryData,
                      nsAString& aAsciiBase64String)
 {
   if (!Is8bit(aBinaryData)) {
     aAsciiBase64String.Truncate();
     return NS_ERROR_DOM_INVALID_CHARACTER_ERR;
   }
 
-  return nsXPConnect::Base64Encode(aBinaryData, aAsciiBase64String);
+  return Base64Encode(aBinaryData, aAsciiBase64String);
 }
 
 nsresult
 nsContentUtils::Atob(const nsAString& aAsciiBase64String,
                      nsAString& aBinaryData)
 {
   if (!Is8bit(aAsciiBase64String)) {
     aBinaryData.Truncate();
     return NS_ERROR_DOM_INVALID_CHARACTER_ERR;
   }
 
-  nsresult rv = nsXPConnect::Base64Decode(aAsciiBase64String, aBinaryData);
+  nsresult rv = Base64Decode(aAsciiBase64String, aBinaryData);
   if (NS_FAILED(rv) && rv == NS_ERROR_INVALID_ARG) {
     return NS_ERROR_DOM_INVALID_CHARACTER_ERR;
   }
   return rv;
 }
 
 bool
 nsContentUtils::IsAutocompleteEnabled(nsIDOMHTMLInputElement* aInput)

--- a/content/base/src/nsGenericElement.cpp
+++ b/content/base/src/nsGenericElement.cpp
@@ -1203,23 +1203,16 @@ nsINode::GetContextForEventHandlers(nsre
 /* static */
 void
 nsINode::Trace(nsINode *tmp, TraceCallback cb, void *closure)
 {
   nsContentUtils::TraceWrapper(tmp, cb, closure);
 }
 
 static bool
-IsBlackNode(nsINode* aNode)
-{
-  JSObject* o = aNode->GetWrapperPreserveColor();
-  return o && !xpc_IsGrayGCThing(o);
-}
-
-static bool
 IsXBL(nsINode* aNode)
 {
   return aNode->IsElement() &&
          aNode->AsElement()->IsInNamespace(kNameSpaceID_XBL);
 }
 
 /* static */
 bool
@@ -1228,36 +1221,36 @@ nsINode::Traverse(nsINode *tmp, nsCycleC
   nsIDocument *currentDoc = tmp->GetCurrentDoc();
   if (currentDoc &&
       nsCCUncollectableMarker::InGeneration(cb, currentDoc->GetMarkedCCGeneration())) {
     return false;
   }
 
   if (nsCCUncollectableMarker::sGeneration) {
     // If we're black no need to traverse.
-    if (IsBlackNode(tmp)) {
+    if (tmp->IsBlack()) {
       return false;
     }
 
     const PtrBits problematicFlags =
       (NODE_IS_ANONYMOUS |
        NODE_IS_IN_ANONYMOUS_SUBTREE |
        NODE_IS_NATIVE_ANONYMOUS_ROOT |
        NODE_MAY_BE_IN_BINDING_MNGR |
        NODE_IS_INSERTION_PARENT);
 
     if (!tmp->HasFlag(problematicFlags) && !IsXBL(tmp)) {
       // If we're in a black document, return early.
-      if ((currentDoc && IsBlackNode(currentDoc))) {
+      if ((currentDoc && currentDoc->IsBlack())) {
         return false;
       }
       // If we're not in anonymous content and we have a black parent,
       // return early.
       nsIContent* parent = tmp->GetParent();
-      if (parent && !IsXBL(parent) && IsBlackNode(parent)) {
+      if (parent && !IsXBL(parent) && parent->IsBlack()) {
         NS_ABORT_IF_FALSE(parent->IndexOf(tmp) >= 0, "Parent doesn't own us?");
         return false;
       }
     }
   }
 
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mNodeInfo)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_RAWPTR(GetParent())

--- a/content/canvas/src/nsCanvasRenderingContext2DAzure.cpp
+++ b/content/canvas/src/nsCanvasRenderingContext2DAzure.cpp
@@ -804,17 +804,17 @@ protected:
                                                 state.patternStyles[aStyle]->mForceWriteOnly,
                                                 state.patternStyles[aStyle]->mCORSUsed);
         }
 
         ExtendMode mode;
         if (state.patternStyles[aStyle]->mRepeat == nsCanvasPatternAzure::NOREPEAT) {
           mode = EXTEND_CLAMP;
         } else {
-          mode = EXTEND_WRAP;
+          mode = EXTEND_REPEAT;
         }
         mPattern = new (mSurfacePattern.addr())
           SurfacePattern(state.patternStyles[aStyle]->mSurface, mode);
       }
 
       return *mPattern;
     }
 

--- a/content/media/test/test_defaultMuted.html
+++ b/content/media/test/test_defaultMuted.html
@@ -1,55 +1,54 @@
 <!DOCTYPE HTML>
 <html>
 <head>
   <title>Media test: defaultMuted</title>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
   <script type="text/javascript" src="manifest.js"></script>
+  <script type="text/javascript" src="../../html/content/test/reflect.js"></script>
 </head>
 <body>
   <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=706731">Mozilla Bug 706731</a>
   <p id="display"></p>
   <div id="content" style="display: none"></div>
   <video id='v1'></video><audio id='a1'></audio>
   <video id='v2' muted></video><audio id='a2' muted></audio>
 <pre id="test">
 <script class="testbody" type="text/javascript">
+    reflectBoolean({
+      element: document.createElement("video"),
+      attribute: { content: "muted", idl: "defaultMuted" },
+    });
+
+    reflectBoolean({
+      element: document.createElement("audio"),
+      attribute: { content: "muted", idl: "defaultMuted" },
+    });
+
     var v1 = document.getElementById('v1');
     var a1 = document.getElementById('a1');
     var v2 = document.getElementById('v2');
     var a2 = document.getElementById('a2');
 
-    ok(!v1.defaultMuted, "v1.defaultMuted should be false by default");
-    ok(!a1.defaultMuted, "a1.defaultMuted should be false by default");
-    ok(v2.defaultMuted, "v2.defaultMuted should be true");
-    ok(a2.defaultMuted, "a2.defaultMuted should be true");
-
+    // Check that muted state correspond to the default value.
     is(v1.muted, false, "v1.muted should be false by default");
     is(a1.muted, false, "a1.muted should be false by default");
+    is(v2.muted, true, "v2.muted should be true by default");
+    is(a2.muted, true, "a2.muted should be true by default");
 
+    // Changing defaultMuted value should not change current muted state.
     v1.defaultMuted = true;
     a1.defaultMuted = true;
-    ok(!v1.muted, "v1.muted should be false");
-    ok(!a1.muted, "a1.muted should be false");
-    ok(v1.defaultMuted, "v1.defaultMuted should be true");
-    ok(a1.defaultMuted, "a1.defaultMuted should be true");
-    ok(v1.hasAttribute("muted"), "v1.hasAttribute(\"muted\") should be true");
-    ok(a1.hasAttribute("muted"), "a1.hasAttribute(\"muted\") should be true");
-
-    is(v2.muted, true, "v2.muted should be true");
-    is(a2.muted, true, "a2.muted should be true");
-
     v2.defaultMuted = false;
     a2.defaultMuted = false;
-    ok(!v2.defaultMuted, "v2.defaultMuted should be false");
-    ok(v2.muted, "v2.muted should be true");
-    ok(!a2.defaultMuted, "a2.defaultMuted should be false");
-    ok(a2.muted, "a2.muted should be true");
-    ok(!v2.hasAttribute("muted"), "v2.hasAttribute(\"muted\") should be false");
-    ok(!a2.hasAttribute("muted"), "a2.hasAttribute(\"muted\") should be false");
+
+    is(v1.muted, false, "v1.muted should not have changed");
+    is(a1.muted, false, "a1.muted should not have changed");
+    is(v2.muted, true, "v2.muted should not have changed");
+    is(a2.muted, true, "a2.muted should not have changed");
 
     mediaTestCleanup();
 </script>
 </pre>
 </body>
 </html>

--- a/content/xbl/src/nsXBLDocumentInfo.h
+++ b/content/xbl/src/nsXBLDocumentInfo.h
@@ -77,16 +77,23 @@ public:
   
   void FlushSkinStylesheets();
 
   bool IsChrome() { return mIsChrome; }
 
   // nsIScriptGlobalObjectOwner methods
   virtual nsIScriptGlobalObject* GetScriptGlobalObject();
 
+  void MarkInCCGeneration(PRUint32 aGeneration)
+  {
+    if (mDocument) {
+      mDocument->MarkUncollectableForCCGeneration(aGeneration);
+    }
+  }
+
   static nsresult ReadPrototypeBindings(nsIURI* aURI, nsXBLDocumentInfo** aDocInfo);
 
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_AMBIGUOUS(nsXBLDocumentInfo,
                                                          nsIScriptGlobalObjectOwner)
 
 private:
   nsCOMPtr<nsIDocument> mDocument;
   bool mScriptAccess;

--- a/content/xslt/src/base/txExpandedNameMap.h
+++ b/content/xslt/src/base/txExpandedNameMap.h
@@ -97,28 +97,26 @@ protected:
 
         bool next()
         {
             return ++mCurrentPos < mMap.mItems.Length();
         }
 
         const txExpandedName key()
         {
-            NS_ASSERTION(mCurrentPos >= 0 &&
-                         mCurrentPos < mMap.mItems.Length(),
+            NS_ASSERTION(mCurrentPos < mMap.mItems.Length(),
                          "invalid position in txExpandedNameMap::iterator");
             return txExpandedName(mMap.mItems[mCurrentPos].mNamespaceID,
                                   mMap.mItems[mCurrentPos].mLocalName);
         }
 
     protected:
         void* itemValue()
         {
-            NS_ASSERTION(mCurrentPos >= 0 &&
-                         mCurrentPos < mMap.mItems.Length(),
+            NS_ASSERTION(mCurrentPos < mMap.mItems.Length(),
                          "invalid position in txExpandedNameMap::iterator");
             return mMap.mItems[mCurrentPos].mValue;
         }
 
     private:
         txExpandedNameMap_base& mMap;
         PRUint32 mCurrentPos;
     };

--- a/content/xul/document/src/nsXULPrototypeCache.cpp
+++ b/content/xul/document/src/nsXULPrototypeCache.cpp
@@ -691,8 +691,33 @@ nsXULPrototypeCache::BeginCaching(nsIURI
 
     // Success!  Insert this URI into the mCacheURITable
     // and commit locals to globals.
     mCacheURITable.Put(aURI, 1);
 
     gStartupCache = startupCache;
     return NS_OK;
 }
+
+static PLDHashOperator
+MarkXBLInCCGeneration(nsIURI* aKey, nsRefPtr<nsXBLDocumentInfo> &aDocInfo,
+                      void* aClosure)
+{
+    PRUint32* gen = static_cast<PRUint32*>(aClosure);
+    aDocInfo->MarkInCCGeneration(*gen);
+    return PL_DHASH_NEXT;
+}
+
+static PLDHashOperator
+MarkXULInCCGeneration(nsIURI* aKey, nsRefPtr<nsXULPrototypeDocument> &aDoc,
+                      void* aClosure)
+{
+    PRUint32* gen = static_cast<PRUint32*>(aClosure);
+    aDoc->MarkInCCGeneration(*gen);
+    return PL_DHASH_NEXT;
+}
+
+void
+nsXULPrototypeCache::MarkInCCGeneration(PRUint32 aGeneration)
+{
+    mXBLDocTable.Enumerate(MarkXBLInCCGeneration, &aGeneration);
+    mPrototypeTable.Enumerate(MarkXULInCCGeneration, &aGeneration);
+}

--- a/content/xul/document/src/nsXULPrototypeCache.h
+++ b/content/xul/document/src/nsXULPrototypeCache.h
@@ -154,16 +154,17 @@ public:
 
     static nsXULPrototypeCache* GetInstance();
 
     static void ReleaseGlobals()
     {
         NS_IF_RELEASE(sInstance);
     }
 
+    void MarkInCCGeneration(PRUint32 aGeneration);
 protected:
     friend nsresult
     NS_NewXULPrototypeCache(nsISupports* aOuter, REFNSIID aIID, void** aResult);
 
     nsXULPrototypeCache();
     virtual ~nsXULPrototypeCache();
 
     static nsXULPrototypeCache* sInstance;

--- a/content/xul/document/src/nsXULPrototypeDocument.cpp
+++ b/content/xul/document/src/nsXULPrototypeDocument.cpp
@@ -154,17 +154,18 @@ JSClass nsXULPDGlobalObject::gSharedGlob
 
 //----------------------------------------------------------------------
 //
 // ctors, dtors, n' stuff
 //
 
 nsXULPrototypeDocument::nsXULPrototypeDocument()
     : mRoot(nsnull),
-      mLoaded(false)
+      mLoaded(false),
+      mCCGeneration(0)
 {
     ++gRefCnt;
 }
 
 
 nsresult
 nsXULPrototypeDocument::Init()
 {
@@ -190,16 +191,19 @@ nsXULPrototypeDocument::~nsXULPrototypeD
     }
 }
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsXULPrototypeDocument)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsXULPrototypeDocument)
     tmp->mPrototypeWaiters.Clear();
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsXULPrototypeDocument)
+    if (nsCCUncollectableMarker::InGeneration(cb, tmp->mCCGeneration)) {
+        return NS_SUCCESS_INTERRUPTED_TRAVERSE;
+    }
     NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NATIVE_MEMBER(mRoot,
                                                     nsXULPrototypeElement)
     NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mGlobalObject");
     cb.NoteXPCOMChild(static_cast<nsIScriptGlobalObject*>(tmp->mGlobalObject));
     NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NATIVE_MEMBER(mNodeInfoManager,
                                                     nsNodeInfoManager)
     for (PRUint32 i = 0; i < tmp->mPrototypeWaiters.Length(); ++i) {
         NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mPrototypeWaiters[i]");

--- a/content/xul/document/src/nsXULPrototypeDocument.h
+++ b/content/xul/document/src/nsXULPrototypeDocument.h
@@ -142,32 +142,39 @@ public:
      */
     nsresult NotifyLoadDone();
 
     nsNodeInfoManager *GetNodeInfoManager();
 
     // nsIScriptGlobalObjectOwner methods
     virtual nsIScriptGlobalObject* GetScriptGlobalObject();
 
+    void MarkInCCGeneration(PRUint32 aCCGeneration)
+    {
+        mCCGeneration = aCCGeneration;
+    }
+
     NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(nsXULPrototypeDocument,
                                              nsIScriptGlobalObjectOwner)
 
 protected:
     nsCOMPtr<nsIURI> mURI;
     nsRefPtr<nsXULPrototypeElement> mRoot;
     nsTArray<nsRefPtr<nsXULPrototypePI> > mProcessingInstructions;
     nsCOMArray<nsIURI> mStyleSheetReferences;
 
     nsRefPtr<nsXULPDGlobalObject> mGlobalObject;
 
     bool mLoaded;
     nsTArray< nsRefPtr<nsXULDocument> > mPrototypeWaiters;
 
     nsRefPtr<nsNodeInfoManager> mNodeInfoManager;
 
+    PRUint32 mCCGeneration;
+
     nsXULPrototypeDocument();
     virtual ~nsXULPrototypeDocument();
     nsresult Init();
 
     friend NS_IMETHODIMP
     NS_NewXULPrototypeDocument(nsXULPrototypeDocument** aResult);
 
     nsXULPDGlobalObject *NewXULPDGlobalObject();

--- a/docshell/test/unit/test_nsIDownloadHistory.js
+++ b/docshell/test/unit/test_nsIDownloadHistory.js
@@ -86,15 +86,18 @@ function run_test()
   try {
     Cc["@mozilla.org/browser/global-history;2"].
       getService(Ci.nsIGlobalHistory2);
   }
   catch (ex) {
     return;
   }
 
+  // Needed to properly setup and shutdown the profile.
+  do_get_profile();
+
   Services.prefs.setBoolPref("places.history.enabled", true);
 
   for (var i = 0; i < tests.length; i++)
     tests[i]();
 
   cleanup();
 }

--- a/dom/Makefile.in
+++ b/dom/Makefile.in
@@ -79,17 +79,20 @@ DIRS += \
   plugins/ipc \
   indexedDB \
   system \
   ipc \
   workers \
   $(NULL)
 
 ifdef MOZ_B2G_RIL #{
-DIRS += telephony
+DIRS += \
+  telephony \
+  wifi \
+  $(NULL)
 endif #}
 
 ifdef ENABLE_TESTS
 DIRS += tests
 ifneq (,$(filter gtk2 cocoa windows android qt os2,$(MOZ_WIDGET_TOOLKIT)))
 DIRS += plugins/test
 endif
 endif

--- a/dom/base/Navigator.cpp
+++ b/dom/base/Navigator.cpp
@@ -1030,16 +1030,24 @@ Navigator::SizeOf() const
   // TODO: add SizeOf() to nsGeolocation, bug 674115.
   size += mGeolocation ? sizeof(*mGeolocation.get()) : 0;
   // TODO: add SizeOf() to nsDesktopNotificationCenter, bug 674116.
   size += mNotification ? sizeof(*mNotification.get()) : 0;
 
   return size;
 }
 
+void
+Navigator::SetWindow(nsPIDOMWindow *aInnerWindow)
+{
+  NS_ASSERTION(aInnerWindow->IsInnerWindow(),
+               "Navigator must get an inner window!");
+  mWindow = do_GetWeakReference(aInnerWindow);
+}
+
 } // namespace dom
 } // namespace mozilla
 
 nsresult
 NS_GetNavigatorUserAgent(nsAString& aUserAgent)
 {
   nsresult rv;
 

--- a/dom/base/Navigator.h
+++ b/dom/base/Navigator.h
@@ -98,16 +98,21 @@ public:
   nsPIDOMWindow *GetWindow();
 
   void RefreshMIMEArray();
 
   static bool HasDesktopNotificationSupport();
 
   PRInt64 SizeOf() const;
 
+  /**
+   * For use during document.write where our inner window changes.
+   */
+  void SetWindow(nsPIDOMWindow *aInnerWindow);
+
 private:
   bool IsSmsAllowed() const;
   bool IsSmsSupported() const;
 
   nsRefPtr<nsMimeTypeArray> mMimeTypes;
   nsRefPtr<nsPluginArray> mPlugins;
   nsRefPtr<nsGeolocation> mGeolocation;
   nsRefPtr<nsDesktopNotificationCenter> mNotification;

--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -1674,16 +1674,35 @@ jsid nsDOMClassInfo::sWrappedJSObject_id
 jsid nsDOMClassInfo::sURL_id             = JSID_VOID;
 jsid nsDOMClassInfo::sKeyPath_id         = JSID_VOID;
 jsid nsDOMClassInfo::sAutoIncrement_id   = JSID_VOID;
 jsid nsDOMClassInfo::sUnique_id          = JSID_VOID;
 jsid nsDOMClassInfo::sMultiEntry_id      = JSID_VOID;
 jsid nsDOMClassInfo::sOnload_id          = JSID_VOID;
 jsid nsDOMClassInfo::sOnerror_id         = JSID_VOID;
 
+static const JSClass *sObjectClass = nsnull;
+
+/**
+ * Set our JSClass pointer for the Object class
+ */
+static void
+FindObjectClass(JSObject* aGlobalObject)
+{
+  NS_ASSERTION(!sObjectClass,
+               "Double set of sObjectClass");
+  JSObject *obj, *proto = aGlobalObject;
+  do {
+    obj = proto;
+    proto = js::GetObjectProto(obj);
+  } while (proto);
+
+  sObjectClass = js::GetObjectJSClass(obj);
+}
+
 static void
 PrintWarningOnConsole(JSContext *cx, const char *stringBundleProperty)
 {
   nsCOMPtr<nsIStringBundleService> stringService =
     mozilla::services::GetStringBundleService();
   if (!stringService) {
     return;
   }
@@ -4697,62 +4716,16 @@ GetExternalClassInfo(nsScriptNameSpaceMa
 static nsresult
 ResolvePrototype(nsIXPConnect *aXPConnect, nsGlobalWindow *aWin, JSContext *cx,
                  JSObject *obj, const PRUnichar *name,
                  const nsDOMClassInfoData *ci_data,
                  const nsGlobalNameStruct *name_struct,
                  nsScriptNameSpaceManager *nameSpaceManager,
                  JSObject *dot_prototype, bool install, bool *did_resolve);
 
-static nsresult
-LookupPrototypeProto(JSContext *cx, JSObject *winobj,
-                     const nsDOMClassInfoData *ci_data,
-                     const nsGlobalNameStruct *name_struct,
-                     JSObject **aProtoProto);
-
-
-static nsGlobalWindow*
-FindUsableInnerWindow(nsIXPConnect *xpc, JSContext *cx, JSObject *global)
-{
-  // Only do this if the global object is a window.
-  // XXX Is there a better way to check this?
-  nsISupports *globalNative = xpc->GetNativeOfWrapper(cx, global);
-  nsCOMPtr<nsPIDOMWindow> piwin = do_QueryInterface(globalNative);
-  if (!piwin) {
-    return nsnull;
-  }
-
-  nsGlobalWindow *win = nsGlobalWindow::FromSupports(globalNative);
-  if (win->IsClosedOrClosing()) {
-    return nsnull;
-  }
-  
-  // If the window is in a different compartment than the global object, then
-  // it's likely that global is a sandbox object whose prototype is a window.
-  // Don't do anything in this case.
-  if (win->FastGetGlobalJSObject() &&
-      js::GetObjectCompartment(global) != js::GetObjectCompartment(win->FastGetGlobalJSObject())) {
-    return nsnull;
-  }
-
-  if (win->IsOuterWindow()) {
-    // XXXjst: Do security checks here when we remove the security
-    // checks on the inner window.
-
-    win = win->GetCurrentInnerWindowInternal();
-
-    JSObject* global;
-    if (!win || !(global = win->GetGlobalJSObject()) ||
-        win->IsClosedOrClosing()) {
-      return nsnull;
-    }
-  }
-
-  return win;
-}
 
 NS_IMETHODIMP
 nsDOMClassInfo::PostCreatePrototype(JSContext * cx, JSObject * proto)
 {
   PRUint32 flags = (mData->mScriptableFlags & DONT_ENUM_STATIC_PROPS)
                    ? 0
                    : JSPROP_ENUMERATE;
 
@@ -4761,16 +4734,29 @@ nsDOMClassInfo::PostCreatePrototype(JSCo
     count++;
   }
 
   if (!sXPConnect->DefineDOMQuickStubs(cx, proto, flags,
                                        count, mData->mInterfaces)) {
     JS_ClearPendingException(cx);
   }
 
+  // This is called before any other location that requires
+  // sObjectClass, so compute it here. We assume that nobody has had a
+  // chance to monkey around with proto's prototype chain before this.
+  if (!sObjectClass) {
+    FindObjectClass(proto);
+    NS_ASSERTION(sObjectClass && !strcmp(sObjectClass->name, "Object"),
+                 "Incorrect object class!");
+  }
+
+  NS_ASSERTION(::JS_GetPrototype(cx, proto) &&
+               JS_GET_CLASS(cx, ::JS_GetPrototype(cx, proto)) == sObjectClass,
+               "Hmm, somebody did something evil?");
+
 #ifdef DEBUG
   if (mData->mHasClassInterface && mData->mProtoChainInterface &&
       mData->mProtoChainInterface != &NS_GET_IID(nsISupports)) {
     nsCOMPtr<nsIInterfaceInfoManager>
       iim(do_GetService(NS_INTERFACEINFOMANAGER_SERVICE_CONTRACTID));
 
     if (iim) {
       nsCOMPtr<nsIInterfaceInfo> if_info;
@@ -4788,22 +4774,48 @@ nsDOMClassInfo::PostCreatePrototype(JSCo
 #endif
 
   // Make prototype delegation work correctly. Consider if a site sets
   // HTMLElement.prototype.foopy = function () { ... } Now, calling
   // document.body.foopy() needs to ensure that looking up foopy on
   // document.body's prototype will find the right function.
   JSObject *global = ::JS_GetGlobalForObject(cx, proto);
 
-  nsGlobalWindow *win = FindUsableInnerWindow(XPConnect(), cx, global);
-  if (!win) {
+  // Only do this if the global object is a window.
+  // XXX Is there a better way to check this?
+  nsISupports *globalNative = XPConnect()->GetNativeOfWrapper(cx, global);
+  nsCOMPtr<nsPIDOMWindow> piwin = do_QueryInterface(globalNative);
+  if (!piwin) {
+    return NS_OK;
+  }
+
+  nsGlobalWindow *win = nsGlobalWindow::FromSupports(globalNative);
+  if (win->IsClosedOrClosing()) {
     return NS_OK;
   }
 
-  global = win->FastGetGlobalJSObject();
+  // If the window is in a different compartment than the global object, then
+  // it's likely that global is a sandbox object whose prototype is a window.
+  // Don't do anything in this case.
+  if (win->FastGetGlobalJSObject() &&
+      js::GetObjectCompartment(global) != js::GetObjectCompartment(win->FastGetGlobalJSObject())) {
+    return NS_OK;
+  }
+
+  if (win->IsOuterWindow()) {
+    // XXXjst: Do security checks here when we remove the security
+    // checks on the inner window.
+
+    win = win->GetCurrentInnerWindowInternal();
+
+    if (!win || !(global = win->GetGlobalJSObject()) ||
+        win->IsClosedOrClosing()) {
+      return NS_OK;
+    }
+  }
 
   // Don't overwrite a property set by content.
   JSBool found;
   if (!::JS_AlreadyHasOwnUCProperty(cx, global, reinterpret_cast<const jschar*>(mData->mNameUTF16),
                                     nsCRT::strlen(mData->mNameUTF16), &found)) {
     return NS_ERROR_FAILURE;
   }
 
@@ -4812,33 +4824,16 @@ nsDOMClassInfo::PostCreatePrototype(JSCo
   NS_ENSURE_TRUE(nameSpaceManager, NS_OK);
 
   bool unused;
   return ResolvePrototype(sXPConnect, win, cx, global, mData->mNameUTF16,
                           mData, nsnull, nameSpaceManager, proto, !found,
                           &unused);
 }
 
-NS_IMETHODIMP
-nsDOMClassInfo::PreCreatePrototype(JSContext * cx, JSObject * global,
-                                   JSObject **protoProto)
-{
-  *protoProto = nsnull;
-  
-  nsGlobalWindow *win = FindUsableInnerWindow(XPConnect(), cx, global);
-  if (!win) {
-    return NS_OK;
-  }
-
-  JSObject *winObj = win->FastGetGlobalJSObject();
-  
-  return LookupPrototypeProto(cx, winObj, mData, nsnull, protoProto);
-}
-
-
 // static
 nsIClassInfo *
 NS_GetDOMClassInfoInstance(nsDOMClassInfoID aID)
 {
   if (aID >= eDOMClassInfoIDCount) {
     NS_ERROR("Bad ID!");
 
     return nsnull;
@@ -5181,17 +5176,17 @@ nsWindowSH::InstallGlobalScopePolluter(J
   }
 
   JSObject *o = obj, *proto;
 
   // Find the place in the prototype chain where we want this global
   // scope polluter (right before Object.prototype).
 
   while ((proto = ::JS_GetPrototype(cx, o))) {
-    if (js::GetObjectClass(proto) == &js::ObjectClass) {
+    if (JS_GET_CLASS(cx, proto) == sObjectClass) {
       // Set the global scope polluters prototype to Object.prototype
       ::JS_SplicePrototype(cx, gsp, proto);
 
       break;
     }
 
     o = proto;
   }
@@ -6003,115 +5998,16 @@ GetXPCProto(nsIXPConnect *aXPConnect, JS
   if (!JS_WrapObject(cx, &proto_obj)) {
     return NS_ERROR_FAILURE;
   }
 
   NS_IF_RELEASE(*aProto);
   return aXPConnect->HoldObject(cx, proto_obj, aProto);
 }
 
-static nsresult
-LookupPrototypeProto(JSContext *cx, JSObject *winobj,
-                     const nsDOMClassInfoData *ci_data,
-                     const nsGlobalNameStruct *name_struct,
-                     JSObject **aProtoProto)
-{
-  NS_ASSERTION(ci_data ||
-               (name_struct &&
-                name_struct->mType == nsGlobalNameStruct::eTypeClassProto),
-               "Wrong type or missing ci_data!");
-
-  const nsIID *primary_iid = &NS_GET_IID(nsISupports);
-
-  if (!ci_data) {
-    primary_iid = &name_struct->mIID;
-  } else if (ci_data->mProtoChainInterface) {
-    primary_iid = ci_data->mProtoChainInterface;
-  }
-
-  if (primary_iid->Equals(NS_GET_IID(nsISupports))) {
-    *aProtoProto = nsnull;
-    return NS_OK;
-  }
-
-  nsCOMPtr<nsIInterfaceInfoManager>
-    iim(do_GetService(NS_INTERFACEINFOMANAGER_SERVICE_CONTRACTID));
-  NS_ENSURE_TRUE(iim, NS_ERROR_NOT_AVAILABLE);
-
-  nsCOMPtr<nsIInterfaceInfo> if_info;
-  iim->GetInfoForIID(primary_iid, getter_AddRefs(if_info));
-  NS_ENSURE_TRUE(if_info, NS_ERROR_UNEXPECTED);
-
-  const nsIID *iid = nsnull;
-
-  nsCOMPtr<nsIInterfaceInfo> parent;
-  if (ci_data && !ci_data->mHasClassInterface) {
-    if_info->GetIIDShared(&iid);
-  } else {
-    if_info->GetParent(getter_AddRefs(parent));
-    NS_ENSURE_TRUE(parent, NS_ERROR_UNEXPECTED);
-
-    parent->GetIIDShared(&iid);
-  }
-
-  if (!iid || iid->Equals(NS_GET_IID(nsISupports))) {
-    *aProtoProto = nsnull;
-    return NS_OK;
-  }
-
-  const char *class_parent_name = nsnull;
-  if (ci_data && !ci_data->mHasClassInterface) {
-    // If the class doesn't have a class interface the primary
-    // interface is the interface that should be
-    // constructor.prototype.__proto__.
-
-    if_info->GetNameShared(&class_parent_name);
-  } else {
-    // If the class does have a class interface (or there's no
-    // real class for this name) then the parent of the
-    // primary interface is what we want on
-    // constructor.prototype.__proto__.
-
-    NS_ASSERTION(parent, "Whoa, this is bad, null parent here!");
-
-    parent->GetNameShared(&class_parent_name);
-  }
-
-  JSObject *protoProto = nsnull;
-
-  // Get class_parent_name here
-  if (class_parent_name) {
-    jsval val;
-
-    JSAutoEnterCompartment ac;
-    if (!ac.enter(cx, winobj)) {
-      return NS_ERROR_UNEXPECTED;
-    }
-
-    if (!::JS_LookupProperty(cx, winobj, CutPrefix(class_parent_name), &val)) {
-      return NS_ERROR_UNEXPECTED;
-    }
-
-    JSObject *tmp = JSVAL_IS_OBJECT(val) ? JSVAL_TO_OBJECT(val) : nsnull;
-
-    if (tmp) {
-      if (!::JS_LookupProperty(cx, tmp, "prototype", &val)) {
-        return NS_ERROR_UNEXPECTED;
-      }
-
-      if (JSVAL_IS_OBJECT(val)) {
-        protoProto = JSVAL_TO_OBJECT(val);
-      }
-    }
-  }
-
-  *aProtoProto = protoProto;
-  return NS_OK;
-}
-
 // Either ci_data must be non-null or name_struct must be non-null and of type
 // eTypeClassProto.
 static nsresult
 ResolvePrototype(nsIXPConnect *aXPConnect, nsGlobalWindow *aWin, JSContext *cx,
                  JSObject *obj, const PRUnichar *name,
                  const nsDOMClassInfoData *ci_data,
                  const nsGlobalNameStruct *name_struct,
                  nsScriptNameSpaceManager *nameSpaceManager,
@@ -6147,16 +6043,20 @@ ResolvePrototype(nsIXPConnect *aXPConnec
 
   if (!ci_data) {
     primary_iid = &name_struct->mIID;
   }
   else if (ci_data->mProtoChainInterface) {
     primary_iid = ci_data->mProtoChainInterface;
   }
 
+  nsCOMPtr<nsIInterfaceInfo> if_info;
+  nsCOMPtr<nsIInterfaceInfo> parent;
+  const char *class_parent_name = nsnull;
+
   if (!primary_iid->Equals(NS_GET_IID(nsISupports))) {
     JSAutoEnterCompartment ac;
 
     if (!ac.enter(cx, class_obj)) {
       return NS_ERROR_FAILURE;
     }
 
     rv = DefineInterfaceConstants(cx, class_obj, primary_iid);
@@ -6170,36 +6070,98 @@ ResolvePrototype(nsIXPConnect *aXPConnec
       NS_ENSURE_SUCCESS(rv, rv);
     }
 
     // Special case for |IDBKeyRange| which gets funny "static" functions.
     if (primary_iid->Equals(NS_GET_IID(nsIIDBKeyRange)) &&
         !indexedDB::IDBKeyRange::DefineConstructors(cx, class_obj)) {
       return NS_ERROR_FAILURE;
     }
+
+    nsCOMPtr<nsIInterfaceInfoManager>
+      iim(do_GetService(NS_INTERFACEINFOMANAGER_SERVICE_CONTRACTID));
+    NS_ENSURE_TRUE(iim, NS_ERROR_NOT_AVAILABLE);
+
+    iim->GetInfoForIID(primary_iid, getter_AddRefs(if_info));
+    NS_ENSURE_TRUE(if_info, NS_ERROR_UNEXPECTED);
+
+    const nsIID *iid = nsnull;
+
+    if (ci_data && !ci_data->mHasClassInterface) {
+      if_info->GetIIDShared(&iid);
+    } else {
+      if_info->GetParent(getter_AddRefs(parent));
+      NS_ENSURE_TRUE(parent, NS_ERROR_UNEXPECTED);
+
+      parent->GetIIDShared(&iid);
+    }
+
+    if (iid) {
+      if (!iid->Equals(NS_GET_IID(nsISupports))) {
+        if (ci_data && !ci_data->mHasClassInterface) {
+          // If the class doesn't have a class interface the primary
+          // interface is the interface that should be
+          // constructor.prototype.__proto__.
+
+          if_info->GetNameShared(&class_parent_name);
+        } else {
+          // If the class does have a class interface (or there's no
+          // real class for this name) then the parent of the
+          // primary interface is what we want on
+          // constructor.prototype.__proto__.
+
+          NS_ASSERTION(parent, "Whoa, this is bad, null parent here!");
+
+          parent->GetNameShared(&class_parent_name);
+        }
+      }
+    }
   }
 
   {
     JSObject *winobj = aWin->FastGetGlobalJSObject();
 
-    JSObject *proto;
-    rv = LookupPrototypeProto(cx, winobj, ci_data, name_struct, &proto);
-    NS_ENSURE_SUCCESS(rv, rv);
+    JSObject *proto = nsnull;
+
+    if (class_parent_name) {
+      jsval val;
+
+      JSAutoEnterCompartment ac;
+      if (!ac.enter(cx, winobj)) {
+        return NS_ERROR_UNEXPECTED;
+      }
+
+      if (!::JS_LookupProperty(cx, winobj, CutPrefix(class_parent_name), &val)) {
+        return NS_ERROR_UNEXPECTED;
+      }
+
+      JSObject *tmp = JSVAL_IS_OBJECT(val) ? JSVAL_TO_OBJECT(val) : nsnull;
+
+      if (tmp) {
+        if (!::JS_LookupProperty(cx, tmp, "prototype", &val)) {
+          return NS_ERROR_UNEXPECTED;
+        }
+
+        if (JSVAL_IS_OBJECT(val)) {
+          proto = JSVAL_TO_OBJECT(val);
+        }
+      }
+    }
 
     if (dot_prototype) {
       JSAutoEnterCompartment ac;
       if (!ac.enter(cx, dot_prototype)) {
         return NS_ERROR_UNEXPECTED;
       }
 
       JSObject *xpc_proto_proto = ::JS_GetPrototype(cx, dot_prototype);
 
       if (proto &&
           (!xpc_proto_proto ||
-           js::GetObjectClass(xpc_proto_proto) == &js::ObjectClass)) {
+           JS_GET_CLASS(cx, xpc_proto_proto) == sObjectClass)) {
         if (!JS_WrapObject(cx, &proto) ||
             !JS_SetPrototype(cx, dot_prototype, proto)) {
           return NS_ERROR_UNEXPECTED;
         }
       }
     } else {
       JSAutoEnterCompartment ac;
       if (!ac.enter(cx, winobj)) {
@@ -9576,17 +9538,17 @@ nsHTMLPluginObjElementSH::SetupProtoChai
   rv = wrapper->GetJSObjectPrototype(&my_proto);
   NS_ENSURE_SUCCESS(rv, rv);
 
   // Set 'this.__proto__' to pi
   if (!::JS_SetPrototype(cx, obj, pi_obj)) {
     return NS_ERROR_UNEXPECTED;
   }
 
-  if (pi_proto && js::GetObjectClass(pi_proto) != &js::ObjectClass) {
+  if (pi_proto && JS_GET_CLASS(cx, pi_proto) != sObjectClass) {
     // The plugin wrapper has a proto that's not Object.prototype, set
     // 'pi.__proto__.__proto__' to the original 'this.__proto__'
     if (pi_proto != my_proto && !::JS_SetPrototype(cx, pi_proto, my_proto)) {
       return NS_ERROR_UNEXPECTED;
     }
   } else {
     // 'pi' didn't have a prototype, or pi's proto was
     // 'Object.prototype' (i.e. pi is an NPRuntime wrapped JS object)

--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -1983,17 +1983,17 @@ nsGlobalWindow::SetNewDocument(nsIDocume
     // instead.
     if (!JS_TransplantObject(cx, mJSObject, mJSObject)) {
       return NS_ERROR_FAILURE;
     }
   } else {
     if (aState) {
       newInnerWindow = wsh->GetInnerWindow();
       mInnerWindowHolder = wsh->GetInnerWindowHolder();
-      
+
       NS_ASSERTION(newInnerWindow, "Got a state without inner window");
     } else if (thisChrome) {
       newInnerWindow = new nsGlobalChromeWindow(this);
       isChrome = true;
     } else if (mIsModalContentWindow) {
       newInnerWindow = new nsGlobalModalWindow(this);
     } else {
       newInnerWindow = new nsGlobalWindow(this);
@@ -2033,16 +2033,25 @@ nsGlobalWindow::SetNewDocument(nsIDocume
 
       NS_ENSURE_SUCCESS(rv, rv);
     }
 
     if (currentInner && currentInner->mJSObject) {
       bool termFuncSet = false;
 
       if (oldDoc == aDocument) {
+        // Move the navigator from the old inner window to the new one since
+        // this is a document.write. This is safe from a same-origin point of
+        // view because document.write can only be used by the same origin.
+        newInnerWindow->mNavigator = currentInner->mNavigator;
+        currentInner->mNavigator = nsnull;
+        if (newInnerWindow->mNavigator) {
+          newInnerWindow->mNavigator->SetWindow(newInnerWindow);
+        }
+
         // Suspend the current context's request before Pop() resumes the old
         // context's request.
         JSAutoSuspendRequest asr(cx);
 
         // Pop our context here so that we get the correct one for the
         // termination function.
         cxPusher.Pop();
 

--- a/dom/base/nsStructuredCloneContainer.cpp
+++ b/dom/base/nsStructuredCloneContainer.cpp
@@ -40,17 +40,20 @@
 
 #include "nsCOMPtr.h"
 #include "nsIDocument.h"
 #include "nsIJSContextStack.h"
 #include "nsIScriptContext.h"
 #include "nsIVariant.h"
 #include "nsServiceManagerUtils.h"
 #include "nsContentUtils.h"
-#include "xpcprivate.h"
+
+#include "mozilla/Base64.h"
+
+using namespace mozilla;
 
 NS_IMPL_ADDREF(nsStructuredCloneContainer)
 NS_IMPL_RELEASE(nsStructuredCloneContainer)
 
 NS_INTERFACE_MAP_BEGIN(nsStructuredCloneContainer)
   NS_INTERFACE_MAP_ENTRY(nsIStructuredCloneContainer)
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
@@ -119,17 +122,17 @@ nsStructuredCloneContainer::InitFromBase
                                            PRUint32 aFormatVersion,
                                            JSContext *aCx)
 {
   NS_ENSURE_STATE(!mData);
 
   NS_ConvertUTF16toUTF8 data(aData);
 
   nsCAutoString binaryData;
-  nsresult rv = nsXPConnect::Base64Decode(data, binaryData);
+  nsresult rv = Base64Decode(data, binaryData);
   NS_ENSURE_SUCCESS(rv, rv);
 
   // Copy the string's data into our own buffer.
   mData = (PRUint64*) malloc(binaryData.Length());
   NS_ENSURE_STATE(mData);
   memcpy(mData, binaryData.get(), binaryData.Length());
 
   mSize = binaryData.Length();
@@ -166,17 +169,17 @@ nsStructuredCloneContainer::DeserializeT
 nsresult
 nsStructuredCloneContainer::GetDataAsBase64(nsAString &aOut)
 {
   NS_ENSURE_STATE(mData);
   aOut.Truncate();
 
   nsCAutoString binaryData(reinterpret_cast<char*>(mData), mSize);
   nsCAutoString base64Data;
-  nsresult rv = nsXPConnect::Base64Encode(binaryData, base64Data);
+  nsresult rv = Base64Encode(binaryData, base64Data);
   NS_ENSURE_SUCCESS(rv, rv);
 
   aOut.Assign(NS_ConvertASCIItoUTF16(base64Data));
   return NS_OK;
 }
 
 nsresult
 nsStructuredCloneContainer::GetSerializedNBytes(PRUint64 *aSize)

--- a/dom/base/nsWrapperCache.h
+++ b/dom/base/nsWrapperCache.h
@@ -185,16 +185,21 @@ public:
    */
   virtual JSObject* WrapObject(JSContext *cx, XPCWrappedNativeScope *scope,
                                bool *triedToWrap)
   {
     *triedToWrap = false;
     return nsnull;
   }
 
+  /**
+   * Returns true if the object has a non-gray wrapper.
+   */
+  bool IsBlack();
+
 private:
   // Only meant to be called by nsContentUtils.
   void SetPreservingWrapper(bool aPreserve)
   {
     if(aPreserve) {
       mWrapperPtrBits |= WRAPPER_BIT_PRESERVED;
     }
     else {

--- a/dom/base/nsWrapperCacheInlines.h
+++ b/dom/base/nsWrapperCacheInlines.h
@@ -134,9 +134,16 @@ nsWrapperCache::ClearWrapperIfProxy()
         return;
     }
 
     RemoveExpandoObject();
 
     SetWrapperBits(NULL);
 }
 
+inline bool
+nsWrapperCache::IsBlack()
+{
+  JSObject* o = GetWrapperPreserveColor();
+  return o && !xpc_IsGrayGCThing(o);
+}
+
 #endif /* nsWrapperCache_h___ */

--- a/dom/indexedDB/test/Makefile.in
+++ b/dom/indexedDB/test/Makefile.in
@@ -119,21 +119,22 @@ TEST_FILES = \
   test_transaction_lifetimes.html \
   test_transaction_lifetimes_nested.html \
   test_transaction_ordering.html \
   test_setVersion.html \
   test_setVersion_abort.html \
   test_setVersion_events.html \
   test_setVersion_exclusion.html \
   test_unique_index_update.html \
-  test_writer_starvation.html \
   third_party_iframe1.html \
   third_party_iframe2.html \
   $(NULL)
 
+#   test_writer_starvation.html  disabled for infinite loops, bug 595368
+
 ifeq (browser,$(MOZ_BUILD_APP))
 BROWSER_TEST_FILES = \
   browser_forgetThisSite.js \
   browser_forgetThisSiteAdd.html \
   browser_forgetThisSiteGet.html \
   browserHelpers.js \
   browser_permissionsPrompt.html \
   browser_permissionsPromptAllow.js \

--- a/dom/system/b2g/Makefile.in
+++ b/dom/system/b2g/Makefile.in
@@ -61,12 +61,13 @@ endif
 XPIDLSRCS = \
   nsIAudioManager.idl \
   nsIRadioWorker.idl \
   $(NULL)
 
 LOCAL_INCLUDES = \
   -I$(topsrcdir)/dom/base \
   -I$(topsrcdir)/dom/telephony \
+  -I$(topsrcdir)/dom/wifi \
   -I$(topsrcdir)/content/events/src \
   $(NULL)
 
 include $(topsrcdir)/config/rules.mk

--- a/dom/system/b2g/RadioManager.cpp
+++ b/dom/system/b2g/RadioManager.cpp
@@ -40,31 +40,36 @@
 #include "RadioManager.h"
 #include "nsIRadioWorker.h"
 #include "nsContentUtils.h"
 #include "nsIXPConnect.h"
 #include "nsIJSContextStack.h"
 #include "nsIObserverService.h"
 #include "mozilla/dom/workers/Workers.h"
 #include "jstypedarray.h"
+
 #include "nsTelephonyWorker.h"
+#include "nsITelephone.h"
+#include "nsWifiWorker.h"
+#include "nsIWifi.h"
 
 #include "nsThreadUtils.h"
 
 #if defined(MOZ_WIDGET_GONK)
 #include <android/log.h>
 #define LOG(args...)  __android_log_print(ANDROID_LOG_INFO, "Gonk", args)
 #else
 #define LOG(args...)  printf(args);
 #endif
 
 USING_WORKERS_NAMESPACE
 using namespace mozilla::ipc;
 
 static NS_DEFINE_CID(kTelephonyWorkerCID, NS_TELEPHONYWORKER_CID);
+static NS_DEFINE_CID(kWifiWorkerCID, NS_WIFIWORKER_CID);
 
 // Topic we listen to for shutdown.
 #define PROFILE_BEFORE_CHANGE_TOPIC "profile-before-change"
 
 USING_TELEPHONY_NAMESPACE
 
 namespace {
 
@@ -220,69 +225,41 @@ RadioManager::Init()
   if (!obs) {
     NS_WARNING("Failed to get observer service!");
     return NS_ERROR_FAILURE;
   }
 
   nsresult rv = obs->AddObserver(this, PROFILE_BEFORE_CHANGE_TOPIC, false);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  // The telephony worker component is a hack that gives us a global object for
-  // our own functions and makes creating the worker possible.
-  nsCOMPtr<nsIRadioWorker> worker(do_CreateInstance(kTelephonyWorkerCID));
-  NS_ENSURE_TRUE(worker, NS_ERROR_FAILURE);
-
-  jsval workerval;
-  rv = worker->GetWorker(&workerval);
-  NS_ENSURE_SUCCESS(rv, rv);
-  NS_ASSERTION(!JSVAL_IS_PRIMITIVE(workerval), "bad worker value");
-
   JSContext *cx;
   rv = nsContentUtils::ThreadJSContextStack()->GetSafeJSContext(&cx);
   NS_ENSURE_SUCCESS(rv, rv);
   nsCxPusher pusher;
   if (!cx || !pusher.Push(cx, false)) {
     return NS_ERROR_FAILURE;
   }
 
-  JSObject *workerobj = JSVAL_TO_OBJECT(workerval);
-
-  JSAutoRequest ar(cx);
-  JSAutoEnterCompartment ac;
-  if (!ac.enter(cx, workerobj)) {
-    return NS_ERROR_OUT_OF_MEMORY;
-  }
+  rv = InitTelephone(cx);
+  NS_ENSURE_SUCCESS(rv, rv);
 
-  WorkerCrossThreadDispatcher *wctd = GetWorkerCrossThreadDispatcher(cx, workerval);
-  if (!wctd) {
-    return NS_ERROR_FAILURE;
-  }
-
-  nsRefPtr<ConnectWorkerToRIL> connection = new ConnectWorkerToRIL();
-  if (!wctd->PostTask(connection)) {
-    return NS_ERROR_UNEXPECTED;
-  }
-
-  // Now that we're set up, connect ourselves to the RIL thread.
-  mozilla::RefPtr<RILReceiver> receiver = new RILReceiver(wctd);
-  StartRil(receiver);
-
-  mTelephone = do_QueryInterface(worker);
-  NS_ENSURE_TRUE(mTelephone, NS_ERROR_FAILURE);
+  rv = InitWifi(cx);
+  NS_ENSURE_SUCCESS(rv, rv);
 
   return NS_OK;
 }
 
 void
 RadioManager::Shutdown()
 {
   NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
 
   StopRil();
   mTelephone = nsnull;
+  mWifi = nsnull;
 
   mShutdown = true;
 }
 
 // static
 already_AddRefed<RadioManager>
 RadioManager::FactoryCreate()
 {
@@ -311,16 +288,69 @@ RadioManager::GetTelephone()
   if (gInstance) {
     nsCOMPtr<nsITelephone> retval = gInstance->mTelephone;
     return retval.forget();
   }
 
   return nsnull;
 }
 
+nsresult
+RadioManager::InitTelephone(JSContext *cx)
+{
+  // The telephony worker component is a hack that gives us a global object for
+  // our own functions and makes creating the worker possible.
+  nsCOMPtr<nsIRadioWorker> worker(do_CreateInstance(kTelephonyWorkerCID));
+  NS_ENSURE_TRUE(worker, NS_ERROR_FAILURE);
+
+  jsval workerval;
+  nsresult rv = worker->GetWorker(&workerval);
+  NS_ENSURE_SUCCESS(rv, rv);
+  NS_ASSERTION(!JSVAL_IS_PRIMITIVE(workerval), "bad worker value");
+
+  JSObject *workerobj = JSVAL_TO_OBJECT(workerval);
+
+  JSAutoRequest ar(cx);
+  JSAutoEnterCompartment ac;
+  if (!ac.enter(cx, workerobj)) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  WorkerCrossThreadDispatcher *wctd = GetWorkerCrossThreadDispatcher(cx, workerval);
+  if (!wctd) {
+    return NS_ERROR_FAILURE;
+  }
+
+  nsRefPtr<ConnectWorkerToRIL> connection = new ConnectWorkerToRIL();
+  if (!wctd->PostTask(connection)) {
+    return NS_ERROR_UNEXPECTED;
+  }
+
+  // Now that we're set up, connect ourselves to the RIL thread.
+  mozilla::RefPtr<RILReceiver> receiver = new RILReceiver(wctd);
+  StartRil(receiver);
+
+  mTelephone = do_QueryInterface(worker);
+  NS_ENSURE_TRUE(mTelephone, NS_ERROR_FAILURE);
+
+  return NS_OK;
+}
+
+nsresult
+RadioManager::InitWifi(JSContext *cx)
+{
+  nsCOMPtr<nsIRadioWorker> worker(do_CreateInstance(kWifiWorkerCID));
+  NS_ENSURE_TRUE(worker, NS_ERROR_FAILURE);
+
+  mWifi = do_QueryInterface(worker);
+  NS_ENSURE_TRUE(mWifi, NS_ERROR_FAILURE);
+
+  return NS_OK;
+}
+
 
 NS_IMPL_ISUPPORTS1(RadioManager, nsIObserver)
 
 NS_IMETHODIMP
 RadioManager::Observe(nsISupports* aSubject, const char* aTopic,
                       const PRUnichar* aData)
 {
   if (!strcmp(aTopic, PROFILE_BEFORE_CHANGE_TOPIC)) {

--- a/dom/system/b2g/RadioManager.h
+++ b/dom/system/b2g/RadioManager.h
@@ -43,17 +43,16 @@
 #include "jsapi.h"
 #include "nsComponentManagerUtils.h"
 #include "nsCOMPtr.h"
 #include "nsDebug.h"
 #include "nsServiceManagerUtils.h"
 
 #include "nsIObserver.h"
 #include "mozilla/ipc/Ril.h"
-#include "nsITelephone.h"
 
 #define TELEPHONYRADIO_CONTRACTID "@mozilla.org/telephony/radio;1"
 #define TELEPHONYRADIOINTERFACE_CONTRACTID "@mozilla.org/telephony/radio-interface;1"
 
 #define BEGIN_TELEPHONY_NAMESPACE \
   namespace mozilla { namespace dom { namespace telephony {
 #define END_TELEPHONY_NAMESPACE \
   } /* namespace telephony */ } /* namespace dom */ } /* namespace mozilla */
@@ -65,16 +64,18 @@
   {0xa5c3a6de, 0x84c4, 0x4b15, {0x86, 0x11, 0x8a, 0xeb, 0x8d, 0x97, 0xf8, 0xba}}
 
 // {a688f191-8ffc-47f3-8740-94a312cf59cb}}
 #define TELEPHONYRADIOINTERFACE_CID \
   {0xd66e7ece, 0x41b1, 0x4608, {0x82, 0x80, 0x72, 0x50, 0xa6, 0x44, 0xe6, 0x6f}}
 
 
 class nsIXPConnectJSObjectHolder;
+class nsITelephone;
+class nsIWifi;
 
 BEGIN_TELEPHONY_NAMESPACE
 
 class RadioManager : public nsIObserver
 {
 public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSIOBSERVER
@@ -87,15 +88,19 @@ public:
 
   static already_AddRefed<nsITelephone>
   GetTelephone();
 
 protected:
   RadioManager();
   ~RadioManager();
 
+  nsresult InitTelephone(JSContext *cx);
+  nsresult InitWifi(JSContext *cx);
+
   nsCOMPtr<nsITelephone> mTelephone;
+  nsCOMPtr<nsIWifi> mWifi;
   bool mShutdown;
 };
 
 END_TELEPHONY_NAMESPACE
 
 #endif // mozilla_dom_telephony_radio_h__

--- a/dom/tests/mochitest/bugs/Makefile.in
+++ b/dom/tests/mochitest/bugs/Makefile.in
@@ -147,12 +147,13 @@ include $(topsrcdir)/config/rules.mk
 		test_bug698551.html \
 		test_window_bar.html \
 		file_window_bar.html \
 		test_resize_move_windows.html \
 		test_devicemotion_multiple_listeners.html \
 		devicemotion_outer.html \
 		devicemotion_inner.html \
 		test_bug698061.html \
+		test_bug707749.html \
 		$(NULL)
 
 libs:: 	$(_TEST_FILES)
 	$(INSTALL) $(foreach f,$^,"$f") $(DEPTH)/_tests/testing/mochitest/tests/$(relativesrcdir)

new file mode 100644
--- /dev/null
+++ b/dom/tests/mochitest/bugs/test_bug707749.html
@@ -0,0 +1,34 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=707749
+-->
+<head>
+  <title>Test for Bug 707749</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=707749 ">Mozilla Bug 707749 </a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+
+/** Test for Bug 707749 **/
+SimpleTest.waitForExplicitFinish();
+function loaded() {
+    $('ifr').contentDocument.open();
+    $('ifr').contentDocument.close();
+    ok(true, "Don't throw an exception from contentDocument.open()");
+    SimpleTest.finish();
+}
+
+</script>
+<iframe id="ifr" onload="loaded()" src="data:text/html,<script>navigator</script>"></iframe>
+</pre>
+</body>
+</html>
+

--- a/dom/tests/mochitest/orientation/Makefile.in
+++ b/dom/tests/mochitest/orientation/Makefile.in
@@ -40,14 +40,15 @@ srcdir		= @srcdir@
 VPATH		= @srcdir@
 relativesrcdir	= dom/tests/mochitest/orientation
 
 include $(DEPTH)/config/autoconf.mk
 
 include $(topsrcdir)/config/rules.mk
 
 _TEST_FILES	= \
+		bug507902-frame.html \
 		test_bug507902.html \
 		$(NULL)
 
 libs:: 	$(_TEST_FILES)
 	$(INSTALL) $(foreach f,$^,"$f") $(DEPTH)/_tests/testing/mochitest/tests/$(relativesrcdir)
 

copy from dom/tests/mochitest/orientation/test_bug507902.html
copy to dom/tests/mochitest/orientation/bug507902-frame.html
--- a/dom/tests/mochitest/orientation/test_bug507902.html
+++ b/dom/tests/mochitest/orientation/bug507902-frame.html
@@ -1,38 +1,30 @@
 <!DOCTYPE HTML>
 <html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=507902
--->
 <head>
-  <title>Test for watchPosition </title>
+  <title>Frame for watchPosition </title>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 </head>
 <body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=507902">Mozilla Bug 507902</a>
-<p id="display"></p>
-<div id="content" style="display: none">
-  
-</div>
-<pre id="test">
-<script class="testbody" type="text/javascript">
+<script type="text/javascript">
+
+var ok = window.parent.ok;
+var SimpleTest = window.parent.SimpleTest;
 
 function boom()
 {
   window.addEventListener("unload", function(){}, false);
   window.addEventListener("devicemotion", function(){}, false);
   location = "data:text/html,2";
 
   ok(1, "leak will be at the end of mochitests. so pass.");
   SimpleTest.finish();
 }
 
 SimpleTest.waitForExplicitFinish();
 
 window.addEventListener("load", function() { setTimeout(boom, 0); }, false);
 
 </script>
-</pre>
 </body>
 </html>