Merge mozilla-central into Electrolysis
authorBenjamin Smedberg <benjamin@smedbergs.us>
Mon, 30 Nov 2009 12:59:43 -0500
changeset 36115 5e9d96f3be1c5bd1b61647c39b8acf08d0e9f12c
parent 36114 7515867b6cc569ea171f72ca2265de6c23d5b865 (current diff)
parent 35282 2bae3bbf866e7de2a4b2377e7c2f52cc9ac14a22 (diff)
child 36116 b0943d83c24fb8966fbb2c2b97fbc7a22bd4487c
push idunknown
push userunknown
push dateunknown
milestone1.9.3a1pre
Merge mozilla-central into Electrolysis
build/automation.py.in
configure.in
modules/plugin/base/src/nsNPAPIPlugin.cpp
widget/src/gtk2/nsWindow.cpp
widget/src/windows/nsWindow.cpp
--- a/accessible/src/xul/nsXULTreeAccessible.cpp
+++ b/accessible/src/xul/nsXULTreeAccessible.cpp
@@ -539,17 +539,17 @@ nsXULTreeAccessible::SelectAllSelection(
 // nsXULTreeAccessible: public implementation
 
 void
 nsXULTreeAccessible::GetTreeItemAccessible(PRInt32 aRow,
                                            nsIAccessible** aAccessible)
 {
   *aAccessible = nsnull;
 
-  if (aRow < 0)
+  if (aRow < 0 || IsDefunct())
     return;
 
   PRInt32 rowCount = 0;
   nsresult rv = mTreeView->GetRowCount(&rowCount);
   if (NS_FAILED(rv) || aRow >= rowCount)
     return;
 
   void *key = reinterpret_cast<void*>(aRow);
--- a/browser/base/content/baseMenuOverlay.xul
+++ b/browser/base/content/baseMenuOverlay.xul
@@ -78,17 +78,17 @@
       <menupopup id="menu_HelpPopup" onpopupshowing="buildHelpMenu();">
         <menuitem id="menu_openHelp"
                   oncommand="openHelpLink('firefox-help')"
                   label="&productHelp.label;"
                   accesskey="&productHelp.accesskey;"
 #ifdef XP_MACOSX
                   key="key_openHelpMac"/>
 #else
-                  key="key_openHelp"/>
+                  />
 #endif
 # Show IE Users menu item on Windows only
 #ifdef XP_WIN
         <menuitem label="&helpForIEUsers.label;"
                   accesskey="&helpForIEUsers.accesskey;"
                   oncommand="openHelpLink('ieusers');"/>
 #endif
         <menuitem id="troubleShooting"
@@ -127,20 +127,16 @@
              key="&preferencesCmdMac.commandkey;"
              modifiers="accel"/>
         <key id="key_hideThisAppCmdMac"
              key="&hideThisAppCmdMac.commandkey;"
              modifiers="accel"/>
         <key id="key_hideOtherAppsCmdMac"
              key="&hideOtherAppsCmdMac.commandkey;"
              modifiers="accel,alt"/>
-#else
-        <key id="key_openHelp"
-            oncommand="openHelpLink('firefox-f1');"
-            keycode="&openHelp.commandkey;"/>
 #endif
     </keyset>
 
     <stringbundleset id="stringbundleset">
         <stringbundle id="bundle_browser" src="chrome://browser/locale/browser.properties"/>
         <stringbundle id="bundle_browser_region" src="chrome://browser-region/locale/region.properties"/>
     </stringbundleset>
 </overlay>
--- a/browser/base/content/fullscreen-video.xhtml
+++ b/browser/base/content/fullscreen-video.xhtml
@@ -78,16 +78,20 @@ try {
 } catch (e) {}
 document.title = title;
 
 window.addEventListener("focus", function () {
   window.removeEventListener("focus", arguments.callee, false);
 
   window.fullScreen = true;
 
+  window.addEventListener("deactivate", function () {
+    window.close();
+  }, false);
+
   video = document.querySelector("video");
 
   video.addEventListener("loadeddata", function () {
     video.removeEventListener("loadeddata", arguments.callee, false);
     video.volume = contentVideo.volume;
     video.muted = contentVideo.muted;
     video.poster = contentVideo.poster;
 
@@ -133,20 +137,16 @@ window.addEventListener("unload", functi
     contentVideo.muted = video.muted;
     if (!video.paused && !video.ended) {
       video.pause();
       contentVideo.play();
     }
   }
 }, false);
 
-window.addEventListener("deactivate", function () {
-  window.close();
-}, false);
-
 window.addEventListener("keypress", function (event) {
   if (event.keyCode == event.DOM_VK_ESCAPE) {
     window.close();
     return;
   }
 
   resetIdleTimer();
 
--- a/browser/components/places/tests/browser/browser_bookmarksProperties.js
+++ b/browser/components/places/tests/browser/browser_bookmarksProperties.js
@@ -62,16 +62,19 @@ const ACTION_ADD = 1;
 
 // If action is ACTION_ADD, set type to one of those, to define what do you
 // want to create.
 const TYPE_FOLDER = 0;
 const TYPE_BOOKMARK = 1;
 
 const TEST_URL = "http://www.mozilla.org/";
 
+const DIALOG_URL = "chrome://browser/content/places/bookmarkProperties.xul";
+const DIALOG_URL_MINIMAL_UI = "chrome://browser/content/places/bookmarkProperties2.xul";
+
 var wm = Cc["@mozilla.org/appshell/window-mediator;1"].
          getService(Ci.nsIWindowMediator);
 var win = wm.getMostRecentWindow("navigator:browser");
 var ww = Cc["@mozilla.org/embedcomp/window-watcher;1"].
          getService(Ci.nsIWindowWatcher);
 
 function add_visit(aURI, aDate) {
   var visitId = PlacesUtils.history
@@ -219,17 +222,18 @@ gTests.push({
 
   run: function() {
     // open tags autocomplete and press enter
     var tagsField = this.window.document.getElementById("editBMPanel_tagsField");
     var self = this;
 
     var windowObserver = {
       observe: function(aSubject, aTopic, aData) {
-        if (aTopic === "domwindowclosed") {
+        if (aTopic === "domwindowclosed" &&
+            aSubject.QueryInterface(Ci.nsIDOMWindow).location == DIALOG_URL) {
           ww.unregisterNotification(this);
           tagsField.popup.removeEventListener("popuphidden", popupListener, true);
           ok(false, "Dialog window should not be closed by pressing Enter on the autocomplete popup");
           self.finish();
         }
       }
     };
 
@@ -377,17 +381,18 @@ gTests.push({
 
   run: function() {
     // open tags autocomplete and press enter
     var tagsField = this.window.document.getElementById("editBMPanel_tagsField");
     var self = this;
 
     var windowObserver = {
       observe: function(aSubject, aTopic, aData) {
-        if (aTopic === "domwindowclosed") {
+        if (aTopic === "domwindowclosed" &&
+            aSubject.QueryInterface(Ci.nsIDOMWindow).location == DIALOG_URL) {
           ww.unregisterNotification(this);
           tagsField.popup.removeEventListener("popuphidden", popupListener, true);
           ok(false, "Dialog window should not be closed by pressing Escape on the autocomplete popup");
           self.finish();
         }
       }
     };
 
@@ -478,17 +483,18 @@ gTests.push({
   run: function() {
     // Open folder selector.
     var foldersExpander = this.window.document.getElementById("editBMPanel_foldersExpander");
     var folderTree = this.window.document.getElementById("editBMPanel_folderTree");
     var self = this;
 
     var windowObserver = {
       observe: function(aSubject, aTopic, aData) {
-        if (aTopic === "domwindowclosed") {
+        if (aTopic === "domwindowclosed" &&
+            aSubject.QueryInterface(Ci.nsIDOMWindow).location == DIALOG_URL_MINIMAL_UI) {
           ww.unregisterNotification(this);
           ok(self._cleanShutdown,
              "Dialog window should not be closed by pressing ESC in folder name textbox");
           self.finish();
         }
       }
     };
     ww.registerNotification(windowObserver);
@@ -538,16 +544,19 @@ function test() {
   runNextTest();
 }
 
 function runNextTest() {
   // Cleanup from previous test.
   if (gCurrentTest) {
     gCurrentTest.cleanup();
     info("End of test: " + gCurrentTest.desc);
+    gCurrentTest = null;
+    executeSoon(runNextTest);
+    return;
   }
 
   if (gTests.length > 0) {
     // Goto next tests.
     gCurrentTest = gTests.shift();
     info("Start of test: " + gCurrentTest.desc);
     gCurrentTest.setup();
     execute_test_in_sidebar();
--- a/browser/components/places/tests/unit/test_browserGlue_corrupt.js
+++ b/browser/components/places/tests/unit/test_browserGlue_corrupt.js
@@ -71,26 +71,26 @@ function run_test() {
            getService(Ci.nsINavHistoryService);
   // Check the database was corrupt.
   // nsBrowserGlue uses databaseStatus to manage initialization.
   do_check_eq(hs.databaseStatus, hs.DATABASE_STATUS_CORRUPT);
 
   // Restore could take some time, usually less than 1s.
   // We will poll later in continue_test to be sure restore has finished.
   do_test_pending();
-  do_timeout(1000, "continue_test();");
+  do_timeout(1000, continue_test);
 }
 
 function continue_test() {
   let bs = Cc["@mozilla.org/browser/nav-bookmarks-service;1"].
            getService(Ci.nsINavBookmarksService);
 
   if (bs.getIdForItemAt(bs.toolbarFolder, 0) == -1) {
     // Not enough time to complete restore, poll again later.
-    do_timeout(1000, "continue_test();");
+    do_timeout(1000, continue_test);
     return;
   }
 
   // Check that JSON backup has been restored.
   let itemId = bs.getIdForItemAt(bs.toolbarFolder, SMART_BOOKMARKS_ON_TOOLBAR);
   do_check_eq(bs.getItemTitle(itemId), "examplejson");
 
   do_test_finished();
--- a/browser/components/places/tests/unit/test_browserGlue_distribution.js
+++ b/browser/components/places/tests/unit/test_browserGlue_distribution.js
@@ -51,17 +51,17 @@ const TOPIC_CUSTOMIZATION_COMPLETE = "di
 
 let os = Cc["@mozilla.org/observer-service;1"].
          getService(Ci.nsIObserverService);
 
 let observer = {
   observe: function(aSubject, aTopic, aData) {
     if (aTopic == TOPIC_CUSTOMIZATION_COMPLETE) {
       os.removeObserver(this, TOPIC_CUSTOMIZATION_COMPLETE);
-      do_timeout(0, "continue_test();");
+      do_timeout(0, continue_test);
     }
   }
 }
 os.addObserver(observer, TOPIC_CUSTOMIZATION_COMPLETE, false);
 
 function run_test() {
   // Copy distribution.ini file to our app dir.
   let distroDir = dirSvc.get("XCurProcD", Ci.nsIFile);
--- a/browser/components/places/tests/unit/test_browserGlue_migrate.js
+++ b/browser/components/places/tests/unit/test_browserGlue_migrate.js
@@ -85,17 +85,17 @@ function run_test() {
   // it. This will force browserGlue::_initPlaces().
   let os = Cc["@mozilla.org/observer-service;1"].
            getService(Ci.nsIObserverService);
   os.notifyObservers(null, TOPIC_PLACES_INIT_COMPLETE, null);
 
   // Import could take some time, usually less than 1s, but to be sure we will
   // check after 3s.
   do_test_pending();
-  do_timeout(3000, "continue_test();");
+  do_timeout(3000, continue_test);
 }
 
 function continue_test() {
   let bs = Cc["@mozilla.org/browser/nav-bookmarks-service;1"].
            getService(Ci.nsINavBookmarksService);
 
   // Check the created bookmarks still exist.
   let itemId = bs.getIdForItemAt(bs.bookmarksMenuFolder, 0);
--- a/browser/components/places/tests/unit/test_browserGlue_restore.js
+++ b/browser/components/places/tests/unit/test_browserGlue_restore.js
@@ -66,26 +66,26 @@ function run_test() {
            getService(Ci.nsINavHistoryService);
   // Check a new database has been created.
   // nsBrowserGlue uses databaseStatus to manage initialization.
   do_check_eq(hs.databaseStatus, hs.DATABASE_STATUS_CREATE);
 
   // Restore could take some time, usually less than 1s.
   // We will poll later in continue_test() to be sure restore has finished.
   do_test_pending();
-  do_timeout(1000, "continue_test();");
+  do_timeout(1000, continue_test);
 }
 
 function continue_test() {
   let bs = Cc["@mozilla.org/browser/nav-bookmarks-service;1"].
            getService(Ci.nsINavBookmarksService);
 
   if (bs.getIdForItemAt(bs.toolbarFolder, 0) == -1) {
     // Not enough time to complete restore, poll again later.
-    do_timeout(1000, "continue_test();");
+    do_timeout(1000, continue_test);
     return;
   }
 
   // Check that JSON backup has been restored.
   let itemId = bs.getIdForItemAt(bs.toolbarFolder, SMART_BOOKMARKS_ON_TOOLBAR);
   do_check_eq(bs.getItemTitle(itemId), "examplejson");
 
   do_test_finished();
--- a/browser/components/places/tests/unit/test_leftpane_corruption_handling.js
+++ b/browser/components/places/tests/unit/test_leftpane_corruption_handling.js
@@ -138,34 +138,34 @@ function run_test() {
 
   // Create the left pane, and store its current status, it will be used
   // as reference value.
   gLeftPaneFolderId = PlacesUIUtils.leftPaneFolderId;
   gReferenceJSON = folderToJSON(gLeftPaneFolderId);
 
   // Kick-off tests.
   do_test_pending();
-  do_timeout(0, "run_next_test();");
+  do_timeout(0, run_next_test);
 }
 
 function run_next_test() {
   if (gTests.length) {
     // Create corruption.
     let test = gTests.shift();
     test();
     // Regenerate getters.
     PlacesUIUtils.__defineGetter__("leftPaneFolderId", gLeftPaneFolderIdGetter);
     gLeftPaneFolderId = PlacesUIUtils.leftPaneFolderId;
     PlacesUIUtils.__defineGetter__("allBookmarksFolderId", gAllBookmarksFolderIdGetter);
     // Check the new left pane folder.
     let leftPaneJSON = folderToJSON(gLeftPaneFolderId);
     do_check_true(compareJSON(gReferenceJSON, leftPaneJSON));
     do_check_eq(PlacesUtils.bookmarks.getItemTitle(gFolderId), "test");
     // Go to next test.
-    do_timeout(0, "run_next_test();");
+    do_timeout(0, run_next_test);
   }
   else {
     // All tests finished.
     remove_all_bookmarks();
     do_test_finished();
   }
 }
 
--- a/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_certexceptionsui.js
+++ b/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_certexceptionsui.js
@@ -38,100 +38,84 @@
 // This test makes sure that certificate exceptions UI behaves correctly
 // inside the private browsing mode, based on whether it's opened from the prefs
 // window or from the SSL error page (see bug 461627).
 
 function test() {
   // initialization
   let pb = Cc["@mozilla.org/privatebrowsing;1"].
            getService(Ci.nsIPrivateBrowsingService);
-  let ww = Cc["@mozilla.org/embedcomp/window-watcher;1"].
-           getService(Ci.nsIWindowWatcher);
 
   const EXCEPTIONS_DLG_URL = 'chrome://pippki/content/exceptionDialog.xul';
-  const EXCEPTIONS_DLG_FEATURES = 'chrome,centerscreen,modal';
+  const EXCEPTIONS_DLG_FEATURES = 'chrome,centerscreen';
   const INVALID_CERT_LOCATION = 'https://nocert.example.com/';
   waitForExplicitFinish();
 
   // enter private browsing mode
   pb.privateBrowsingEnabled = true;
 
-  let testCheckbox;
-  let obs = {
-      observe: function(aSubject, aTopic, aData) {
-          // unregister ourself
-          ww.unregisterNotification(this);
-
-          let win = aSubject.QueryInterface(Ci.nsIDOMEventTarget);
-          win.addEventListener("load", function() {
-              win.removeEventListener("load", arguments.callee, false);
-              testCheckbox(win.document.defaultView);
-          }, false);
-      }
-  };
-
   step1();
 
   // Test the certificate exceptions dialog as it is invoked from about:certerror
   function step1() {
-    ww.registerNotification(obs);
     let params = {
       exceptionAdded : false,
       location: INVALID_CERT_LOCATION,
       handlePrivateBrowsing : true,
       prefetchCert: true,
     };
-    testCheckbox = function(win) {
+    function testCheckbox() {
       let obsSvc = Cc["@mozilla.org/observer-service;1"].
                    getService(Ci.nsIObserverService);
       obsSvc.addObserver({
         observe: function(aSubject, aTopic, aData) {
           obsSvc.removeObserver(this, "cert-exception-ui-ready", false);
           ok(win.gCert, "The certificate information should be available now");
 
           let checkbox = win.document.getElementById("permanent");
           ok(checkbox.hasAttribute("disabled"),
             "the permanent checkbox should be disabled when handling the private browsing mode");
           ok(!checkbox.hasAttribute("checked"),
             "the permanent checkbox should not be checked when handling the private browsing mode");
           win.close();
           step2();
         }
       }, "cert-exception-ui-ready", false);
-    };
-    window.openDialog(EXCEPTIONS_DLG_URL, '', EXCEPTIONS_DLG_FEATURES, params);
+    }
+    var win = openDialog(EXCEPTIONS_DLG_URL, "", EXCEPTIONS_DLG_FEATURES, params);
+    win.addEventListener("load", testCheckbox, false);
   }
 
   // Test the certificate excetions dialog as it is invoked from the Preferences dialog
   function step2() {
-    ww.registerNotification(obs);
     let params = {
       exceptionAdded : false,
       location: INVALID_CERT_LOCATION,
       prefetchCert: true,
     };
-    testCheckbox = function(win) {
+    function testCheckbox() {
       let obsSvc = Cc["@mozilla.org/observer-service;1"].
                    getService(Ci.nsIObserverService);
       obsSvc.addObserver({
         observe: function(aSubject, aTopic, aData) {
           obsSvc.removeObserver(this, "cert-exception-ui-ready", false);
           ok(win.gCert, "The certificate information should be available now");
 
           let checkbox = win.document.getElementById("permanent");
           ok(!checkbox.hasAttribute("disabled"),
             "the permanent checkbox should not be disabled when not handling the private browsing mode");
           ok(checkbox.hasAttribute("checked"),
             "the permanent checkbox should be checked when not handling the private browsing mode");
           win.close();
           cleanup();
         }
       }, "cert-exception-ui-ready", false);
-    };
-    window.openDialog(EXCEPTIONS_DLG_URL, '', EXCEPTIONS_DLG_FEATURES, params);
+    }
+    var win = openDialog(EXCEPTIONS_DLG_URL, "", EXCEPTIONS_DLG_FEATURES, params);
+    win.addEventListener("load", testCheckbox, false);
   }
 
   function cleanup() {
     // leave the private browsing mode
     pb.privateBrowsingEnabled = false;
     finish();
   }
 }
--- a/browser/components/sessionstore/test/browser/browser_491168.js
+++ b/browser/components/sessionstore/test/browser/browser_491168.js
@@ -51,18 +51,18 @@ function test() {
   is(browserWindowsCount(), 1, "Only one browser window should be open initially");
 
   // test setup
   let ss = Cc["@mozilla.org/browser/sessionstore;1"].getService(Ci.nsISessionStore);
   let ioService = Cc["@mozilla.org/network/io-service;1"].getService(Ci.nsIIOService);
 
   waitForExplicitFinish();
 
-  const REFERRER1 = "http://www.example.net/?" + Date.now();
-  const REFERRER2 = "http://www.example.net/?" + Math.random();
+  const REFERRER1 = "http://example.org/?" + Date.now();
+  const REFERRER2 = "http://example.org/?" + Math.random();
 
   let tab = gBrowser.addTab();
   gBrowser.selectedTab = tab;
 
   let browser = tab.linkedBrowser;
   browser.addEventListener("load", function() {
     browser.removeEventListener("load", arguments.callee, true);
 
@@ -87,10 +87,10 @@ function test() {
 
         is(browserWindowsCount(), 1, "Only one browser window should be open eventually");
         finish();
       }, true);
     }, true);
   },true);
 
   let referrerURI = ioService.newURI(REFERRER1, null, null);
-  browser.loadURI("http://www.example.net", referrerURI, null);
+  browser.loadURI("http://example.org", referrerURI, null);
 }
--- a/browser/locales/en-US/chrome/browser/baseMenuOverlay.dtd
+++ b/browser/locales/en-US/chrome/browser/baseMenuOverlay.dtd
@@ -11,17 +11,16 @@
 <!ENTITY helpMenuWin.label        "Help"> 
 <!ENTITY helpMenuWin.accesskey    "H">
 <!ENTITY aboutProduct.label       "About &brandShortName;">
 <!ENTITY aboutProduct.accesskey   "A">
 <!ENTITY productHelp.label        "&brandShortName; Help">
 <!ENTITY productHelp.accesskey    "H">
 <!ENTITY helpForIEUsers.label     "For Internet Explorer Users">
 <!ENTITY helpForIEUsers.accesskey "I">
-<!ENTITY openHelp.commandkey      "VK_F1">
 <!ENTITY helpMac.commandkey       "?">
 
 <!ENTITY helpReleaseNotes.label         "Release Notes">
 <!ENTITY helpReleaseNotes.accesskey     "N">
 
 <!ENTITY helpTroubleshootingInfo.label      "Troubleshooting Information">
 <!ENTITY helpTroubleshootingInfo.accesskey  "T">
 
--- a/build/automation.py.in
+++ b/build/automation.py.in
@@ -656,19 +656,19 @@ def runApp(testURL, env, app, profileDir
     if didTimeout:
       log.info("TEST-UNEXPECTED-FAIL | automation.py | application timed out after %d seconds with no output", int(timeout))
       triggerBreakpad(proc, utilityPath)
 
   status = proc.wait()
   if status != 0 and not didTimeout:
     log.info("TEST-UNEXPECTED-FAIL | automation.py | Exited with code %d during test run", status)
   if stackFixerProcess is not None:
-    status = stackFixerProcess.wait()
-    if status != 0 and not didTimeout:
-      log.info("TEST-UNEXPECTED-FAIL | automation.py | Stack fixer process exited with code %d during test run", status)
+    fixerStatus = stackFixerProcess.wait()
+    if fixerStatus != 0 and not didTimeout:
+      log.info("TEST-UNEXPECTED-FAIL | automation.py | Stack fixer process exited with code %d during test run", fixerStatus)
   log.info("INFO | automation.py | Application ran for: %s", str(datetime.now() - startTime))
 
   # Do a final check for zombie child processes.
   if not os.path.exists(processLog):
     log.info('INFO | automation.py | PID log not found: %s', processLog)
   else:
     log.info('INFO | automation.py | Reading PID log: %s', processLog)
     processList = []
index ed2a828a379d203dcf83e134b1a52f583c0e4fef..e2c9b351f819ff8eb8bd72ef5eee2a1bbf1d717e
GIT binary patch
literal 65536
zc%1Fsc|25W9{})kW^9o{wu<3OrLvrv(J+xEOIJ5(kx=Ol1|w!PGxm_N6Cx#TBrUkP
zTvW8-rmj@9T)ic&m+sqQX;D|jJ7c=xhI;$FAH9G4zCPzObIy6rbDrnS?>uwnkLL#w
zQ=lOTf<q9Is|aGoe~U~&5EKzEh{T6CxDT)R{@4Cp$P~f*ZOpKTh!F0>GUg=EZ*f)t
z0000000000000000000000000000000000000000000000N{T|19@%w(zMmIz?5U!
zXL8SEp9$Hd%;>ODgprd`3^ka#mTE~2GVnF9HkfA6MR`CerNmR-&)q!NoxG5Il9We^
zBQZ%W#I3{@Vjlni00000000000000000000000000000000000_-{$z1^=y42|@fk
zS?U}*JAlqsccZhp3=f7IjY~%mUj)Hn-b77ILkz!CL~7F1rEHc5!-uZE(4XN>cUQOb
z<1&01Av7+7#Uv_Yih@#-lP21-LKr?iG<ADAhs$7k61A`yf<5?2YW8$rKNg$D4pz4q
zIFGuyKi7-JW^jY?m?BXglM@z}q6g7@{e0-UZY*C39D*p1v=cW%^M&1;fFN{^8_kbS
z<8o<k>q-3HB8aSVxb4_>Y|7u&;3rKC3=GtDrMc^P`Um%S4n+_P5i=1poHQ~4<Kf0(
zJd~Y-$Duf!h<dz~GbSxIZg%YVv9G03R8$lh%XVV~C25R`k%@*Rj7*+ObXJlk4qnBy
zh%+$F{<_Ai3cJNzPZV?t`9~+Q$n3%WKt&OJWHN$9Cg36?k>8#io^F<cAm`VfDb~o4
zyR8*%b0IJJs=v2<k?v~0!y8&sZgi;{UOAr15G|@F_?PdI^m|e|xuo`wS2xA(T+*|;
zrEBTA&py4r<T@sP@VfP^WqTHHx_v@t;{1)&gyqJY%?`;ZN*Bo?)8w?5k@e?npH7>7
zaglKiDsnzw@m9|%$tWBiMbLj-W<0-LOXSYhACDHd&|VRPw_9?&glQihrqXjV;6}iW
zT*V6Wt~-C(2EBC+s-9Y%k=27+ot9L7#`)i3D{jY5<Tbv0@T$fm#H`_EgsW_C>508|
z*G&DMZOpEEYTDo?>-1++OyNp>k#>#PYdy*>_lu?@syi}WCiqWc&e(GM=0(}U%g;-l
zlLiMa5kdQdVGKY0VQ(N}{|z+OO~HS8qzT4~*<W59H?(uYK1(8qKa<P$=Wyxn2r?Bx
zBKX54ra+v8$qL&mxsth_$qHnuTbSc9bs_;%5pGxbc$n@#hA)lJ7sCylQ!pkt3dRJq
z43XlG2gUqlvT#g5{~4(xwClsYOC%97sy=D%T;aVtusYIVqur>5q3AN_pqHx8UqmQg
z%5UG|%O-^M5xmpOPl(C<>+*K3b=Vq=?5HtsC3-w8t)qa^T;(xy=Squ=H5CggQtJZ6
zUuoya7q}s7c6NI!zLB6DFFB`qnOpB@(-@&;@I67tGSk_RMKuxKKtFsvqwo8*i^AUg
zw5sxsgOzLJ(k4P2uC)I~-7kYpz{c|%t~yCX6vLxv-!QkXY`izS)<7@3`e2*;@?B`J
zb=u>)oY}Je(E)Cje=xkVa-zIyO_Nv&A_b<ei9ZqR!h5Zf7mQaCAtra#uGE@U*h@U2
z@^FhnN6p!twgwsT(}Hj1CFO?(ICG^|Zz)LJ%<ME2pP@UgPQLlTE}4k4_YVBrasTl#
zYn6bY$%m31+gyGaxS$CC0~`KQ3&KKagnhU{6@2`HKu`7u!*Txd-AKWpK~%>G!s?Vb
zbRQ2L4#Sf<G|q-b2GMXxWbjwNsE*OXB+tPwrdmejO<UCY2Q$r;nZ`Hk3Dk4iF)V}m
zK{(reRvpcLy|km%lqL%cr5}r@#Em~=xz)!g{$bi4`L?^oth>nXb3ES@XVE3rsaYHU
znHX(_UDjH1Y9s!_uYv4}m95cFZ%6)hI$y8nsH>0K_zaz-BI1;{;mYUT=1tRyczhan
zX{7Po@yzTQtrjn;vZCejX{{zI+lW7|EfG7_k}KQQ;CS>!jThn2Z$H0!W+PEL?$1V>
z@o3eeYcg~l>t_vza(j<lcdhisS?wX6-8+RC*7-xkd}ng=@2UocKBu{9A{#q4A8Tve
zI=yU(q%*ZetJFQX>w0c!(evD_KAqEhe3k?UM%ko$2(G2@QVN3N3$C&tLNvdmAZ}3A
zf^hj)|MLV5k>x*6tmTKxxsk$UtRE%}vAHA?hLQQNg0LIBI;L$IEqw1i*2+gWWVw1x
z@(b+hytL1+^59|00k+9g&!tA|*$*TXdz<cGn4?EqA#Wdg#97ltdQ+8XTbv1D+oh{h
zSn1Oio-2rYM%Y(m@p=<3F!<tG`9jg9DVy?hlCC{vTu|KU!Pt4Ex@*P5`db7};Q^mg
zrE1)-WfK-RU0xFX{DnzMh3+%qD90Zau!+J^P689-k8(H^878Jno3jIaqijwdHrnX0
z@GsY-N|i<NwV9{GI<Fn+IipvpMzFiQX3-B%TN5q)4eo5UHrLaPmOWkEKJU7&e`(<<
z-t^NUM^YJ5-6}uIiEU{<*|YmyVDII}P9@Ds7ejlBS`@aon?L5{lg^j#l`(uBUyjNb
ziQKL~leM!nLfMfe`}5%|f`@PJ$BXSo6GZk{KBI^s2t_bc9n&ZB14($$ELVR|eIl8P
zQFViuIyzoKG;dcgx+jSiLZ<ojZ}JYJ`S`i}_=$ZiX~q?vTGv<D6kQhEbKob$$6|sX
z7zkp(-~4qa<X1-+{hau(t5`5pP`>U^+|b@h@UNx=oz3BYLWmsFZW?APV;W;(Yock~
zXH;WUU=(8HVw6dZr+QMm4T~sdl&vHNX)Ed5<|zOG0000000000000000000000000
z00000000000RJZ>(2uhr@d=0$#>2;8JY4&S>20`gJ-v-eB$BAuT#_NVf37?>XmzCY
z1*1+yds==2a}T5J9sg#kTkL!N$#t<SFYf7yY2A3Ov%_}9Lht1K>nv`7#`~okY%SQn
z6J?E`${ue~BUs1DNz^U4m0i%=dhcNOu5*^!k%W1ny$2H)o%bkz>#)~JdwZ)#M`~l6
zla=v;_{dANVg+u8!Y<3;!q;<~Ufyvscdy^Z%k=PU5Kcwop~)BzP2evvf(dD|B0O{>
ze<g@FxF0-O!E7d??kAf_LpCXL{9TE<pB5e1{%LvA2<1t`lvicbH~90ny7@5ZOs-%;
z)2F)`Z2Abh)jl&-il^D%%+HmQ=g{4THkrlt<SFxy)%~!CG-Qwbuv-V0A5zmW(*QTk
z950QniWT2!bPt(aZM#`gDpGB?HDR}8Tfqvshue$VcDfznTxl>&Ra0-N)l7NRV;r?S
zebea@Rqput6#G*pi99ET>qqfEIhyDTHz|oLEn?+fQ)gEe?%rKzx295SCY^2nR$DJ!
zZl=xtsz2_&SK8xpZ*f52-PG6h2T6y_0?kIq!GVrx{*Zx88an-%G-mOGH2p&+jsBD$
z-+FZDPn|*1H`E`LNkh0gT7r;KM~DuwQpc#;`UwFyQk>28XeyPRTm2edo4KUVJ9Mb;
zuPGPL=-xhN@A#cbC!xlHk=5OvV`x6pMsuxe$UCvJcMhUYI?9mhho#egPL@8F|6q@0
z{RBUWl2v&XIrTAdCsrMnTD#cAx@>2?UHJ2`O^H|DF{j$SE;4G^A(f!;B(_4q%hOjl
zLTF>NF)iWP@ExYc`<QZpG;A)APs5j~o<Of&cBiB3LQc`?!1_m2#k-Q-1g8fF-;c9w
zUpL*RSi(Td)wFwI@yv!ixoy>wPU$lH-lWi8W!?X+>&k<?F4hL_(PhhjZz(!)S*>zg
z^?Gvh{bMP8>y)y}jHs(tY2C>7IG&|VDJOY*_?l*V*Lp`(rFdmlEnm-DdE}sp@pk;s
z6fx*n=Z6tY-c%Va1aLzeIFJ#b7?I=$`A_^s;X|PJr>gkxGenR{Lo!4NRzIJyV${e?
zH|u<Ua+wT;qURG35?T^2{fnk$4mMwP>k2JRtHbktpa<WPE;=zUpAw$BYj*Gzg>}IO
z%f*{?8kb#E-SXJF={w|k-ytRG`v%W$tPjs~3r!DU2JN!TW8ADWUdzf}xcJK2ioN@-
zvQm7B*1fruYTNY|6>A=aoxgyaW^5DREi-@rNLc_-SzaJ9JJr_sov)PtF>Ci(oMo3x
z--xq!RCl`IjGin|BIjByj@}qk_Rv4v?|G0{`w_hh4fQqB8evg?F1Qw)-08AI6i2?B
zAR(T3D*AxJsRA1<tw}E(C=b&`H42;2clO5aNww`^rTMYC=Q<bfsF|+5pBa}DQ=uQ4
zxZz%7MBG4@4|J5YBEqT1QV23A5d@+vn0Gu<8j{b{Gblp<GF?#57o-)ye^HVGelVH|
z{%{leM_oZcaz@HG@KqC(KV}Y~kT89WO!+%=z~8H1S?g%QTP`p1YgcY-;8c%Ij&X*X
z8qbUvRD-&V%ym8F)(tn+d**DG5+OCVU{TpGLl$m+YtdbDwx%g`Dd*mcH{!|BiX3!H
zZ-bKLoG4D@<VR^~N!n+n4wh)m?3lMi5?@{wRpJp-B-NSyTTaF=b^*^XbgCDNEKADE
zcoO$ADXAb;O@|#d+^`y{I_k{vVM0BvI<qc#AG-DEWG6T6#~ORjFZ7=u=J)Tbg`qe#
zhetBT*Ikml&aUQEY3JFU*cFw=duiC5kkG7?l3g3lIw9#Me$_GeMg~>JsV-4X=J@JW
zzeL)<P~JA9(a=e$xRHUoYrcL(R`hL)D^Wc$8Pjsx!drBn^=6K1nvz(vxI2<rDJn5^
zVmbPibLNF1EGx`YHYC@8AVb-hrW?SI^|yl0Se_8~$pwD@E%Va>000000000000000
h000000000000000000000000000000005xhe*o&Vop}HN
index 5309a0e32bf0eb696b431a0186a18fcbfd5186ff..e5823c24d994fadedc0cb86cf3dcbeec420f97ce
GIT binary patch
literal 57344
zc%1CqV~j0bz~K9~ZQHha+O}=mwr$(C-F@0NPn)N0ci;ETJo8~P_ddx@?wxlg>0eUG
zuDz38`^!J8YE`Wb0ETJ+00004006Q80D$lxF9Bcx00060+Xevf9~<yLJK+Cp|G5wH
z9~;?!zMo?2a{%z)0R8hBD8T<>5P<)ykND%qj~_pN{P^+X$B!RBe*B*W48R|L0!9)h
z84?9j7fc#V7i=CH8!`)G4OAVp5Xc{>5a|2IkN-lz0Du4tfk3qk6kyO)q2i&>uz)b2
zfWQoxASg)VF%$BI`HM4==cFfhM{TnbIO0HnfFOZD{(0>)x`&Zg&0)VwB4qFZupI-8
zSnM>>B<O)$zJ~c|9b7<<kYQso(L-9-xd*Ld>7+vbV3R1iG7zF)ks0wx!OsNEYp`Lh
zKH()#aUzZvG1a84A;pZyg#ZRGeJ`E=l3=T{q@?O1(VNxjR$2hjO?|dO#*A~l=Q!>A
zen!f_1to)=z%$Dp5R)fRoE2J?4Kf>cgIbX|X;#&^+)v|VhOA`11~R6R(l@RbiuIOV
zI2AyS=QF$15g^v8BVuLijHHq~;@+hQJ_Z@+;<<y~+TlntzfO_pY(ulT73W1R#W<2}
zY$BuEl^MhFU{QcPwD+*o^FFiWh$tdz*mYR{t-jfymyX0h&uvWMSQo!u{TfQsT`;fx
zi_vv#0pfb(HAuaZ@lS7z-cCEcr^;}#H0gn*@Eu~}0Zf#E#|r%2EmA@Go$hFg*aI*=
zUw<R#b~44JCCI3=ivNiBF(4)gK~!)weTvS;A7-I&ZX?E0AChv(r9t=gm65O%;0qD8
zuNo%R5K3Q$r89nfr{O%jwJ0Vf|GuHu&(Uvd`UGA!Jhf7yTLJpe(DtK-6miu{zisYJ
zmy6WM#NQzViqI<_g~Jdn&zP=MbtQK7j9SY!hsc8-mv<rC;(gLQCI{>+eeKA+DhLiN
z(s+Z6Bv4`1jfcq@+z%l~ZBRI3M7yY_8j@?(;>4u+PoMZGplFFlgetIqcO-Q>54|fM
zRFp5}xL<+=2HqAPqF9p*CzN>F<c+Ayb#L@0P9M(kzLoE>&JAVwbw`QG54;zx?;=86
zcO|jZmaoe$cND&zW-@(t#cPstl3t#X;O&`y{Q^!z3`cErpu4NUz-;_3TG@4qSB_5Q
z{(Zk3OLz!=aij+r5ljx3&bsPtH~>_Y6J_M}Alv&83HXt0Uf<#qzb`v$krpG-`~kiN
zWt)@bY=jYTZrO(zy`HB)hf_C>V*(66bc~XVt8dl4iBzUEnyR-0e>w!;)O%O_ixnyS
zh-m6_r#k_%Pd<K4lvJC$%=9|J)K&->0M5|GjD?YzlY!I7#L@ZxDWUK=**ad~Jm2Tx
zcwz;8PAfdCZ-{>q666~DWcyMKuh!Gehr708fkb$3VaJHltSPnRLgfnqp``Y5o90b1
z5kmuh;@_w2yTGr__a2ynM^b;?;$O{q{b-N+mv*Q5$#FA!jx+%7N8#1B_f^YLu*Uy6
zuqj;!UJj<Z)SrRBX!fHVKHZo8^s<4jcEpKAUeaJ?=hNQch;0kbx8-zIzuWPnWe>0~
zvhZ8ulwUX5kK3|gXcjV|$C<g&MtwM<5vBtx@swCUWmTVf;)6t};LajmA9D&jBxyoR
zs!Gynkow!q`xtW5D|L=W@kDcxbbfc5PBar%lT_{Tu_W)~pN~%|_XdW_B+D`yGu<j8
zv<nt(=Ac8bg-s(T4Vcv#Jx!Z<OT_bwXvF|btj<#4^PddoXCGexmrG~!psquhp=Std
zQy>-Bt+n(67tWfdv*CJP2@$S?EM`B&8!%1?A=i1S41Or)fD9{877E>iFCeGXu<M7e
zZ2g(vW5v@9S0Dv7kZJ8;EmJYvavkh1P(cY<kD1IT!kcknjkZt6d@6>uA>kSyuTu+7
z^GUkqnv7mhddj82NS@Eyw=;?fgD)e}{(xE7xD3DP*Bs7kDS3Vw{&;(nOpPGONaw4Z
zV(AZhS1c>fOFe&Izy(Y6%;nmTICbsM2_?JDlY)G=m%{>wi<<;b?M54hq>@hKn$y>6
zXix8DJGTy0zS#m%*k@3L4I4qVgx17Rq5)Nuu!tU9NNOiXkmKF<H6_DcK(%Z#X5^}Q
zY_Jm)orDq8Fa*(P{0xZhFi@MKs}&6=4qxDpzE5l1b61jWfGK|(!zG(-9=ggO&(V@X
z;iyhc&OWqS1Jykse=6#GI6?J&O||!kf_`9}ZjQi@OH_W>>E9CbyZdlvaA>~O9s^4+
zh!iIRHzqHPVQrwz5k+TZ(z9)Le>E;2mZ9QL0x73orbfEHAdKT~RX4ek;AJrl5FKl3
zqbCkFb9$xQ#o2e`-m_oValZy@QV$xQgmYbu)fA*R!0Eh6vY&kx&`snjEBk)Mn(Cw5
zYExDx<h#KeRJF)>y2|GeB$pu3G4%WZYyMCLJ-==S7&vGmu8V<ftJu#Go`kc9XizKe
z$e#=e>ryL+){)i~ZO)vO^S$%&kDULo#g==n<(^H4jzB#R?Laj*v-y{5*sdd+pIO1r
zu7SNlULLI}t{lG?{;8()7C;J47tAxDyWO9gWEp&MB0Me=hFW82oR4&QbhOK;6;)wX
zKo@q$zsOoc+gTqYOAYYXq7Z_RJh1+~lZ7uZQ@Hn=KY%ieM{$Lxhz-fQ3YRI@X8^~H
zwasxVQ&6Fj;ARjrpJ=8x>Ey3zX!<f6WG7+GhbP6%<i8vyKD!8Kiw`htptz-csNKVX
z$JFY*bsi2#@k`tI7(~A8O;~zuI>xhfh=zX}3E~||vr3wP(2jdp5eWmYlGM-o{<5R=
zJ=^tW)!$UzWPRkstdMAnGkXYywV)(Spf#a2cFM>Qj<oQTX_-1J!z|(%mN#;J({y!S
z-jj~NK3mp^-jCXluHgm6@JmJ`3ewPpMk0+A3zGFpN8b?lJLUT#lWINg?&26PBGYmr
zlI|@wa)-Cv=DtkLry>O$!fwhdd{|$JlES$i8g_3YBvar)zIgTL$MfoTJ}btjW7h}Y
z&3%EhaXb!hUoeB`Cx<&e)|hcVt}S6I>B|XKy|TTft@H0C<p%uzOxSKL9fwONpzU^K
zG<E)CMc-C`9+hUN{mDJr<pVS{ZSr?PfSF%*+&Xq<m>f3T|MI|aE*SDk=ZGNwoc;Ds
zbYQ4_c(7N!gHc=*se4B+rT-Gr?nol~f$~g>C=)t@bRXbT+>S+oLlCNY3PN@m`I{#w
z9zjT%@P?4__DA$RWS64j(nlX(EYq0kB0Ge_EIvZgsV4+&J~>qSRAZ#G<>xRp@JdaI
z4C4qa3{(|-F{hklQP>gl*vsVHV6@cxRF|3ICOp1z&Rn%Oh=fSGuq6{KM*G%!2`9e_
zI45hI3th->f7oq`*s^7M{QK_mTlK@U%wDTtibOH`Sx#wsBp)yYpz-t?PQuhno<Sw=
z>aqd~Yt)4HOzlf#JJ!j-2um*IM4-<!u|EUSX_t0LVaU_hun+u#FbiU|UH;`bat9q?
z#Ei=#noekFLxEhpumK`wPSd|_yUTpySz2%Ez+3VbMI}Xy92g+rMnV0~@mzk@ixBw1
z6+DhG|4TLX_z@ZF+yDzvWSfZ{L7|u!K8RZXR0Ex%S+|ukl#POtf4tK*+qJ2Fi!%sY
zhv(K)9Pj12vb;RF3d5##p*BK)V3p<4P!q^zL7wYM1gKM7vMuK6xI71dZ$@xsD5pH*
zrwrhDOsg1fi7K-=w*R8XZ2>wk@WS=dw-obgO_@b(M(@D&4DtG#MG-W{BOD{0@|;*R
zQo~x2MwV7({Ue}MlejZH8JlptAdnN|o{kvTUYu(k)Af!S6->2yLSPZ3tqKpGG-2?S
zh|$7J@iXsacw+yfipShD!B*5GMWavkh8RO2xeaR=ohJh^Q$^=qF_=?7P%N|LiMi5d
zx9@bds~S&Z<#scBuNk)V5gm(@zx=wip^I&y5xva3R9S#68<jpO-ip+#I-PB38-?)=
zx{bSyGi-P`R#Na(v8KGP+~dR|h%7}y5_&}QT20BCjr%FrC(=3b6OB>mka$iL3jafh
z_^yRRXE2X0!+<dlfbj(g)au|&oYUaiwqFM3%Af9H5%<!WSz(^kR>Tb?K80X{kHFyO
z@)!f~{E;d2_xS2y#qWWqQN*2t`Ra+AYrt~1cgV4kiqIQ9H+mWV$?~SKB#xz>D>d-^
zawFYjdXRAHLSa;-V+yi&`M)Nd=_(2vEBl-h=O5Eh+s9@f15)H-*7Bps19NCCo?T1p
zf`+<Flp59P?m~belDu`@3-~0X_L3MG0o6e^&wcIoDETSU5lF%-TFmZg{`d6Mm}QCD
zI1c6Yjg_M20+!*#AVUM@tnLb)MxXtPA8-#q@?4W$iWn*}7sK-e*KiDA8<m$^5s*4p
zdZ3UVQ56I6>dXaaub>c=%eq+uaHpv0*`T6-b$KpL`QNTyfk-xzQZS{^KRH);lN9wc
z`Em22f}+JB)65&z_^L5hqO-K>x(aj|er?~Yr_OHIPM$AH->&ABjd+use-^OC?8~yr
zA~3$(#K*_7CEQ!yDh^rUA0754GhttrBvJQKTRfU_Aad;3-T`j<63eNKU|AYyrTIN5
z%ik+&oo&?Bc61Hyu8_%+NK-=n57+<OpcKG>7ytlpz!bp$)iV=6e*Ev_Uq+W^cG*r_
zFAqtjZwCzE^ZJHQWtgLXMwjKi9Oy=Dn>qlGH9TpWQNk?k67UjK@3`x4S*RQB%*$LF
zVqUEvH*w{_u3&Esa8potVqFWyX_gf@kiGC1IZ4Ya=G0|t6E|%DZ6NY6v%n}$)ELjr
zoaC9DhP4x<cyjk$vO?*y^ETTBZ4ZsGKINWuZ~@MV_^eD{|7&_{O$&?bY+tBFBc{1u
zc&fgs9++=z2$(Cw{`#?!xnN<;4OTIw!RElhH^<|=*ck=hOn+rBxFi_^Tgpfo4~>v+
z^b^M{sf@{Dn>wUQu0ze~Owh;Bw}{(rapYjUb-9iP1v4Lu(Qorbwi;2y0-8mjja*Z_
zdf4TesS#B3z+htop>4a6>SH;OsIjE&PFPN09{q9X$&~cnwOqB3=hiWtPtWO%*OYIL
zlL0PLvxsOGYA$|Dh3(H@y1li8?fYp#K1C+St=@I#l8di*c%7gsF2gmujB?pAmd>-C
z`y1SZn#!d&yv`3QO|mMx0Zt^GyqMBgy^pi}g{0oSH^P~gPa}AmP*P{m2Iyv1KuO;h
z9x_!uM<c@OE;{&i>7boI6$Ul95A%RDWp;94<^<G8_n}Vlwn)m%CkBy|O9gOd9Z1NX
zdIi8^{BAx4o&rCH43@hU_#p2obn8_UY0)?W!*Q(gz;t%(^%SmuYUEVS;H@tRi7)T5
z{0GLMv)f7FM0rwb^q2Vw5!}NlgZBIhT$^hg$q5NHT^SY%T@-R9=2mo&FgzbX?Qa1F
zdkGFq1BC#|1%;(w+gQ;DSrnl68(wgZ*WMjm(@f7Z8k^=<p|$ikUzKnLzgU+AkX-N)
zX;UkA)&4>PZ}33AkdDEN+pjmrj?ZjHo%i6pK8qA>^UBjrh<_a2kqbT0z8Qkq^7n7?
z!8&mXZfW(X+zLXqLQ^%JJf3WyH6C}vgCNQ1r8J&SNAY6B5rj2^iElAjJE8RaJy+tt
z`NRxag*oqKbJS#@%Y1z};gw;h-b#6To?;@O@!Jqp^lXM_a{kCo_SrFc<aO78n~`DB
z$)NY!Z4a0Fmuk!!7l~y8ZHD??+pD}T8lK5au{8dvCUSIT_eOHNg4}}kS*<x@uIo!l
zuWfzYLjsjki56SnFP3M0u)0!$AMU(Z6F^b6N+c#cT!qBx@~n)@Drp{yznJ2Oi%5^k
z&S7Z3+{UN>D#(_S6d^jOy@>Bk-V4IttFO%VQ)u+S*cJo?VFP+__=7%g;oUSfMiF^l
zy=zDH{=-S7EjHcQEl8@M$6;$3&Wg5nv~G*9j(MirMUIERUYz4t`n5MJk_{E3%*^Q(
zPTMxo#gY4V7yHOC&}6?H`%*3;pB17C%?=eyXB>ySI32Td9A6<w*t!*TJ9am`Eawka
zXDd08Rg)5_fT8H_^K0QmuT${eX!UWI42LP3FeT+Sf1|I;C3q?wdqsMSMn8f7WpL?f
zIx3GN1mG$<e9{~$P<ng)I~R+=u|c`&uFi320|oSvu@ETTU)3){ey1|y(!lu*nCZ$4
zOOzyr4nsNv)7U@ci$;(%`PkPgCZX#tfde`*X-&<5;ulEx;fUVY6go8vH<1iM7o+uj
zL$yxWeQ_TtlH`fi;LHrqn*pV8$M#)>iwVkhIPpCPTjvM1cR-v%ixgjV|7OIenN^oC
zshOC2f+c(f0U<7AF9FsU{--Qk9S{5PiaE{^)BO<u=$h^&$QgJn!Jiw58Oka+_tKP0
z(x1cSy8uE$zN4dGXYdlJZ!%0s%U0zNw;IW&8&9RM&B!PtDH7U?LSeL-`2M@^S?kr6
zFa~F-US`U#F9e(I=6d2kyg_9V7Y#Q-{N6y*Cuz@HlP^NzBx}YD=G6J_RQ7hZatnk{
zwZ7e(FR?|$4Q>vpkIPDejIbLF?E4v}Guk23exu}Q=A>T8R76EHBBu(Ns(LCi14k$9
z*Sz0_Tp|bsJ#d$m8XMWs6?c@hMb<oGb{tc$9Sz*?i==Wv(ZoIFq_Mvf(Xg5E&^Giy
zv@;5E3R3&DqG(YNHcB;)=%>8}dppN)^A+Qj%ib>|opr@{4xd;QxHn-h`w6Vu=_@_=
z^^%4qtgw9u`eD6WFja9VPMaHQ^fLaXnst(M)al}AXu`bFyY{LUK4>}My??49A+vc!
zVs?lhKD!iu-TA!jR>8{}^{CMZTGKQmA7tpUzs)-%324zHRtjaL&FJH;icHPhDrlPY
zV%WzpdOi&X2m6zgchG};tl=*INV3%gOs=jTZ;jr<?FHKPLV@cq&Q*uAisbI=l+dTm
zgC!rJ>&ft&$ue;{HVQ?lLW1f5`ZwlQ{9uqG-qcFds}A~h4}%$TMl-1;II|(0#(P-E
zU$Lqr0K$CbhD6aWc*>GLJjUPp&y`tJz?a7_1EuiU+E_b4wk!$K&1C!hCY9`zLP#&}
zTryD<GC4etxk1*+{A2`QIild$IG)OKBU<qmbV^|6snEn-;@cpJ%|fe&UL3Pp^ybkc
zaU2DAr^c=k34j;st1<%TEXUSMN`@R<dHf+NlSY_3-zIg>$GyO1s^FH0q!IzF71c`#
zn?pob#ihF}hNqKLb{I3+Z^aa9EyK5$(@q25LxxD-3;e3Pe?o6q$x5Z5g<z2!Eii!f
zK;2VtEL;|)h=>{{7WK@S98{l9&xc@_(qRZq-tJsTtGT_n#srD7>%p~s90qegfiSUj
zYrMdJ>6&275iHYk=h`sh;O$%429KIE?&4k~0s@dr^Q6z&P$-RYL4aktxo(t2F(vK&
zJwEIWaq--9RxJo#-k*>HZ4b!>Wy8)z^+x(AcETrs^Ud{R1ki33=yz94c#s|On;Qq-
zY#8~4ZijPVxdVyyVJ7MmPgq^&Ou`M}^k5_Y6y@v5QGi=FnCM2qL9@r#aUCB4POWfS
z^JggX3sicrHx(k=wJByf4+Ibhog(+nAHq4=`6L*NPn?1xK<GFG{u*6jwEQ-h@G~=Z
z=5fMxj*62iZK7WA{lWWr6N?>p`x!*VR)lzn^GfcH>V_nTn~ykxoO7!`D;T*8hwhsy
zpZc+VqS4GMn(bH}4FQm6h4ZU=hImiyTx#rj3#MjXp%$`iei$J-75UpcW2-n~34b97
z%^VHxvj)&WZ+hAx>sb0|`e9Qc_l2czI~1D1*@tYw4)r3P^IxiQ$Gxiy>2_tI<@C$?
zgJVRGO{&59Pc^u#jTX*caK0R<jUnXO`ZC^N{Bu-Hmhig=!l5vl<2Y#wHApA3>YFYe
zzju1i2~5&AYY8-|Hxhh{9j}6_1KzGyI1lvwp(ERsH*6fAw07SZfp3ck6<ocgZv{m#
zde*dRt)7|Jf2(|CF*y)MM>T(yyxeD=*z8ozh-_)@!J^n(eZNAA(9yYYrbbat2Fr-8
zUV?B}KH=o97DS~h+brZ$3!kSNFE5Um33cDrL?oO<tp94_Amr~z@o0J6MuDNT65~w?
zTDO}U`|b=_5D|5?;5yi2bn6ybcWBmN^kOUV7|TwVAGV;-{g8FHGhYfdTPz0tWiq#1
zS#3Lc%->V%w$Z6Bis{X@CV_OoJww<6ghY2O>dlUw;wwdcE;Y&k2xmpMp6zv5xa6j;
z4DGu`S?qRN+ysvytT;%F?)PDK(h$L_2shC7nS`z1*yZo_0j_k?ml>&6MdVWsigD8~
z2ly!Qw^gu0h$QHZ*mv$}6W!Njj<&v^pd(Td*d6acp&A2=8cKMe%)!_zs2@9Gd$8|w
zZ<{!ZDDFT~zn-~H-5bD+TKv=i-p?{;P=);$KB_s(P;^`I#FA;Y=*D}@HLiYv@+U4V
zgdyrCeIs^vl7^MUwBJMy0AhlPuh}Cjo;Y?ef;NV=t@q=bgAI00b%f9~Rw)*H5x*)9
zl-SZVrAlIKFn<55c&NK1w_Df<64Ak3kmzi>DifNDi340PHL)Y#EK2Bf8izW=^HTK$
zbR6bR)FK{iRSj|&i?jggc*T=?ELYuEfO3RjJhZZ?A4Ac8$7dUhWE_@A1mMLan`o7w
z4N2PuAY-G_=P0x*BN74C{pI-#z(?=jXIby|im{_}I~~|OS^6!?sil#|M@e39f`J`)
zjbEPLcjk?hw&X@S3{x?fUVX`NQ%fiBj!Ne=Zv-pzW9Vh|c8A7I@~K&kw2sQ4{WQVn
zn>z`IO4)yO|60;7P-_p_7Dd&L5-d#@F*16r-lJ}hM<#CJWg9WNvV-1M1@z)zE|?U(
z{#W1L{qf_+j~_pN{P^+X$B!RBe*FLLe}4Y|zxo&b`0?Y%kN@-i+fy?^t};_*b^iL8
zUN*wZQM2S1qO1ShlhFj%@pfm^+6DL2wsr21K87`q|5Ctez#Mq{NQ!n4sK;ILqa%pt
zPe1gGa-MDls!<k2MB%UxWcWVJgPDXuPUKrq(__Q({FLmGu8pDf|9Y36fZS1V^dS*@
zcni>bI~N6e!2|Oggo-iX@^JR1%Rsw-kR0}R>OyS1iti!N4v-k`S@#es%g;Y(%Se?l
z-?>XMdHgWXBy7lccyHff*KzNr&wCI{?MOaiU>_<|!Q*v)^~C>RNR|I^ENfkg$KY_!
z5OL0-os*GN=Eo;c_>d?Y_1}a77&#+oM@;FNrXR#u!m~gb5wG{D`Mf}b<~7Jg`!Z}Q
zSGjF>YG<#?bjmh8HfROjB-=_!8iZl@?HlhWPJtLVA|G;_RMmnA^9k-58Di=EJMCoT
z5CmGHFdFG4oXB`JZK=Gf+2RXQ4JXvXFI%V@B{+-VeT^z(hTcv0r@*^OK2mu<kMv?T
z&w9A~=>$U&Af2cmRql1gy1f(t;cK_l%<v?z-VERMg(uE(vlr-@$;-fW$s|ZbLU@ql
zGDPD^=VA1<7@}4mSjBU1|JV2Z!V`6KC|wKoY&g$4n$D>P_Fa*+cfiS7b-0{<G>q$z
zb*+nR+n>Z<vah*(8Z1WQIl~H8R{qS7CC~m73o7iF47GXKt0_2ZuX8(RLmT`3V|ww$
zS5#nT7Th@&ljo#HiHw+?{H`p>=ht-M6)wm3)IT=iTUIQiQy$QH$vzIy)cf40i;Yg0
zNvcb^6yZrzK9mqv_`si6HfmO~s0`OUrEaIywd$B=H&~fwABvs2G_Cvs2;-O6hIte(
zC};e7?*0=~#Sk05Cwo>(ZzgFIPCL}Xp#ho9y^qH-S65E0*eO6)xZz14tMx-D=jE+5
zlQ(d9oZD$vBspK>jO@+61%~k~FGT?tC6tx*J<j<#zEbZP*A@*)QOm`0+r9^eBYAXa
zO&%E%%VPp6tGG31Nc9{iS|OM~&1x{MWtB+>vgFxdEY@zF@q-S2{lav>sq`18Gq#4M
z)k*(SjZP1Nu8*6Z<vx}&!C+_}8x(Gd<UiFcxq*_t%pXuCKJy7NgLYaBiC%n}mtxx@
zF%>;|8T%M17Wf=E2t0kujp@U{`ZZ0rwtVAI!XKePVqD8_z7}Soa%K_)dKSxl?N>ov
zL6z+3h<wb3b3*{3oZn?5Ta&e*oY5H&IibM6LrGC^i={Ja8TYk59Qnh`K+j`co=r=N
zfl=~VIGW@p1cc0+qB-Y^HfO@rb0pAbd!xgaKPORq>sBfjs8|<U+K^dM;PaJT*UTY6
zvONpw-akZ|>4k{A{|Uj(JCjGu#>i$iOBa5lq3*P{)_ttnDV1hm_=pp>&nQd8y3irR
zV*@ilc@+gw^knQCA=2xtg1uiQsIYAV^Q2q>RtCPO8)C3Rki>_>P>z?WKf_&90u5&z
z5Wu*hsr=1J-IySRRqc*L1m*}`D!5N<q1#y2TWo^xNEllbgi;Lj>AT#3*9f1nGgoQ?
zmGHtq5Abr!brVu4E7T*7nBHi!=<_WMduZZcygQID+hl{G%LUB*h4NBisS*S#Ys!W`
z@bpHT>(**yWAZ}OB!EdMX3i(79{1*GPG^dmLM%aadfT|PcIi~LO0@BtE^!(b8N(Uy
zt3g-tJXo;^@6Rz_L$r*9d5=?`{$*~V^6E|Bd5jzYDYPD?U6!@V7o^E*jp`CR^ae&r
z%3H`TD4z~@VGxZbqq>ki<=dkF&f5bY4pefcNIND6w3FNL`&Beoq3G-zQ?^#n$ID}Z
z0Hsk^h54S-n&Uvr^h&(m1m!_}eXCvfk$VNTGE?RK5M$c|uf1$8{H0<Dr$r0ax{K&)
z%oA)d4aFtKkud_TRv*re&M~Nu8WXiQ#IpajnlvJjFGAZW@LYnKPM=17XIz2y)qPaN
z#0AW${M<~9sbAGZ{d9R-!H|VJn&?Hw@928ZiJW4B?R<UeQ8!ORy`2r_fNS(!#!)Ap
z;IBeA)Z&k$lZ}*h{Qzg-BwpOngNEtsIex%9HOa%&3FpT186R)ud`h1)GgvHLnf`c1
z&dRx*6~RrcBPtDE9DBX4f2rm*VhN{6dnz^VnBUc+xV`-Bb_e#KYBtO{!YfOukuzEM
zs-G|AKrlh}gx7#UWqeZyO#@Zqt%!$rQ|h{@;+vB}(OBvFc?@W;qoib*ba4}C4KQVb
zbu9*2MkSsBrNt(`ap@>_&Qa}g@X6alh$*LLo#|P$<2`uZ=<3kidf~<DwPyrS#Y26>
zp%)XQl)07>-+&%BXV+}pVI3=N0C(3!BkN5jnP`;<b7E2$ZcmUWeR6RLtPnQ<lQiz7
zv}=yxF9q+9?PkREV~hN;OhrJ*#C)%f4KSR_GWS3#u?oO9YN!}$YbV@H-XD6x_`TG6
zx#c;b1*E?hhGU07jjtn`gmkgfn)65w3&rmqP#Fs{HcIrHqI1mWrIaI_IxH3G&V0(Q
zi!+8#cI^yvea54M4iK3_<TiCXNhE1w(e38{mgrYSC;idljtF*o!p<0ZN7x?}_wK(3
zTgpopeBlouVMkj@O|#9fOV3Yz;}_r)Wup;yio;ftK{H{R&YPj{^Fjt$pdp4=S`;eT
zJLHJM2gdOx#94)6xC*fKLCzL~uPM~QaoG6vUc_W1CdC7Fr@Ru9LqZwWH3LU07<-4t
z4Ie)`HA|xU1TW^vp^)xs+^UW4d&1`=tMfYFRD>xXw}`$kh0$JPf7PZ|95g+uF7|bA
z_@z)=jK1maY^8Y8bk;}hD*p#d*FZijF1?$IwN!Vq<kq|byJ1rbdy-ZR)20uR+1((V
zBx!0LpFv(5%EsLwLqa&<&l9CXRC~ejf)tD$U@NnSZ80mufdStlBfz4*cceXDaRO0&
z0`f2nFx)nbAi)Ynl)Wkg;`l{y<B})3l1RLKTHgSB89m~w>vdLvzH3<{jy2O`mg0Rv
zu)A}Eo^-Dx(b6l=z~HB-V3S#RTt__Apz5b}XRxSHmJkg8hR>VQB=KxLyq{SiNsJs9
zNQ8Sok+HUMYk`MZhF)0Z61i!CsSbz&=LIgIsf+8W^<Lq2>wC-Ai7!pcB(WlMDVU#u
zGsn60<36q(O(J?(3)JwPiw?bpo`3Kn8GJUA9XABPBm5q`0elq<HH-`7BLqJfB^W>0
zf3E-U1YHCDuReeL@#DvjAOCOtFIxZqFDG3Ay@O)wG=uI}P~(yr2UAH<+Hds#d~>vv
zEH*f5lHT9XdVXqS1{n3C#$%W#z1U~_{X*Jy?{Gvk2Rv(7OXUEX6R890WC{q-MMbnv
z1wgbg97hSrv){jibr+~G6hXEXI$m0|`nMdDg8c*<?@Oa}ayCGqp>eG+B&sn_c}Pyu
z4j7qLQjShB0|=ByB;y?0mV-o$JCHCD-71a?HO+}gu<?|_b<^sW(`y+{K(J4ym)mM%
zMp^>c!3V{Cq2*`#{C=H)O5vc6@$}CGIBOC*_fb&=5n*=S*QiSOEF)F!-;0vTna$IL
zQ_OOn_>VR>@3|vCm||>8H^q*D5gDK42jKXcmc$Q&v3RQE!&@B7H7%hMBj#-az|aNA
zQE^d`e9qT(>mjWMnHp<2z)u?QbU_aAHyQ2|MJ)6;+sKY3pxfV(44HmHZ<TehI4m~H
zvth~!=lc;tN3g@<UKbIkreSS|XhL5J#N(!HmxkmgDyr%D9nGrWJGRV)MefGqnCj~!
zuV?!K?fW%7C;<9@>8-I{a4u_1_rtC-uq`o-2`#PndsGNVsYC@P79ubp0~AUiueo2I
zu-N*Km^ylgx`@v}bNk~w0=tZF2U_Dv(V}I7TQE}p6<Ng(&=%Nod53SvY(k)~k5N4c
z`Gn!#)eQ|Ws5tcGVU#$eFkvXKHFyWeL%P%W>#HL14L_5UIx?%VbN~+EEJ_b(tz1=3
znK;3!u*>(Z$1X^Nu`8sty<WnFUzyAwcLK`dHEmG)Qb1RMAI2(^GAE?OIUzyrxP#MV
zXj;YH<m3*91HNTuY{IObB~BnwEq2A#lP|()j-yVay~iiQ8dJ>HjZT~2+e0Q@!$?Sy
z`>mzQjU1gyM%$|>UR`w2vdUoW!<Gy4f^8J~$$~i^sxp=H7INghcyleIBxV^?v1I4$
zO7to3AS2{x1CPjaf!O{BA5Sz431a-$MqcID(QfHe)`&1o03MguS81f=sA<c)YOV%N
z>XGSn+}yE-2+yzZfN6tzROf5dEMbqTXV#U6Z4E)=$&|n}Q?uEBsU~62CuV8H%Z}~J
z^{H<sCsz^T8|9yB#7XN@TC*)oy=cvXQG@W+XWUNt=gE+h*h?17Hwo6;1>phxQk9u9
z59}-fG8|hk+H|tX;gG(!Hb&%Z8)a&l07!RCSwb9A=}UTS*_M+>&XocNHBT8awnwR!
z9sGKmf4M^R%v~Gxo-o*ZrJlFx;l_Hw7W5=!tDhaDXq7^8B-CX=7lO2mAD*DBlqHUG
z4zpCqzO+aB(<Wr+j(HjF))WpWpn3TZ+skAvc8BBweG`q%B+5B}oql^H7RtlEI;yYq
z)SQKYi?6v|`a2DjjOCdZbQ3l+2&ND9=i#k7&MB&UjL39Bm*w?UE4+-$Nk^`q>|x?N
z9FA+kr1PC~LM_!1wV&Z<@^RQG+K;@dfoE3o-JQ(|xAJ=6QA!HmOSx^NQ<u*B0Gy2Z
z)Cuoz@wTC>=c@Qh=zi$2BJZgPw2kI0k~1|3t?1USAFy;k1Qn#n%at8n7p;zDrlv7V
zb(^%H{yp(#GO@3b1(3BR<kA0fFfVm4m;!Dan@>;DoxHe-c`l3Rs1h9J=WU@|o5A>%
z-CV@O@1(E;Q2~8EJ*rC|m^9eYmU>|$D&f~a`$kgDj(^FlBxJyz1)cRMbh=Y|#R?^m
zjsHDGs1yrs<|zAFAtoUMxveLVuGkPRc{&m9NMeFSuEP3o@XDuRE@b$ae<=F+8xp03
z$`=W(dkn`BhQxUwN7XUzmS>@p$!}azEPeZXaHJ2Yc=XWTFzwg2;|InIQ`zr38*G|U
zB=E&@sp}kLHw3ekv4(U;u7GamryaR7`!?EQj>Np-NA+Ocjk2(XfiVZK?q2?omuy@s
z_Zpbutp*0TVo6~&nt)qTj962&X=yzpNCNAx+7=0+$uGUoUT`##Su=vK5jS3L71aK^
z80qu;k(pXx%fnVM+1owc;8|3$<`}=rY_iPNl9oUP{7zNGL?-F>LCvMdZ_WJbprO8s
zJa#+5!rnXF8zm|xF(NQ>zPU0%S`p$MoR6&>0cU{oyHbf!_i9tJH{zsw3qkj~<=2^@
z&wr`L+3^u#^$dV=dg*=I9H>vBt=p>LpK9=QLZB4bnQnOef@zQ*2?KYyfzP2BO)P-U
zHd61WHo@o9+c1#X!^)O%`(|qvU17mZ5Y^?Ei>^cobZm|a5m^QZ!YM|a<9q$8F63(?
zMyljK?NQSNQ6ZON9e8ee<(shQKvTIvEBd&aQSRrVq`;JJILG%%wdu1}e#J)RYnCgc
zCXYKZqM6Pdb!=V4uVCg1^BTP@!OHzvCSp*mKfdvbw{zqACMKv;2c=4Ikg~x{Kn?T;
zn90>CpN1(om8vPCD&mcjKz78nd?gA-2Y$XS%Y04nVgdEp{?!@Wu5x6Y%=WZMN-Ylb
zyEOx}gsrZ+rBy(gA^09kekU`(RJeMX`g^WJfa3N8sKUxU=1`MQ9}}<LWfsCU@zcP(
z4-D*kS-2~GVt3<cgFw`=Y>)pv{TZdUg9e7gaJG;a6EhiU4VI$D=@L-kmkodvVpZOW
zA9<E16s3%5$@vqajop^>AVq2Jw5ohzF~CXC#?$LkIr&97sAlh{0I3V+*DNNzt#6rj
zip}<NKoUaTge~{ZYs8V-jeWAlSU@A9N?tJBd9P7i^`VF0OTK>xldIAwgxIr(M8(LM
zA-xF3#x5+>K?B1w1)g<8n~<}ejn0}DT_;#cAVyUtoeZw>{aeyb!`qx<3R)HOq{c}g
zn3fKy($maNidJ4>*Fx&s%OlJ9Py&z7wds_AN0If;9%9@y#i!tHRLH>Zog+FXeBk06
zttdZvY=2~ds4NcBTl_*2!!}jkl)r*;xySMtmcUZ4ChFBsP|Yslu|1t>{>m(5PB)6I
zsO$xn(<&>u7WXT!6`>tC=c-Jz*d4cM642n8dy6yN$&_~{i;2nwir+M2N>5J4nkm+A
z_<Q=$TuV?k-W~M_^alJ?v~uV!TE+OZq>|TRO2w(G>UTo&FB2=tnlhqixxWT-H*bb|
zEi0x1)&1zv)N^=S#39Np>4|jwtzb#;6=`ot6ileB;XHEnV>EGu6vcp3T{c83I1k6q
zo&E&748|IDhDL|QX2;`BC(Fn(EgA9ZrUOBS5Rj@?XJ0j#S=$*JSkpQgSUdmE>;HlN
zS^xiEeFppE$NxV5ZA~U0<OtcBBmqJO;?p4z8yB?A%YR?VY<9vVik9Lws}n7Uwp*}(
zW%d&K*0&)OqbPr`Vis2oT*JFE1|ls}w5$#clxyC|i<}K}IRj%5BN9j9s_=}Wn+CwZ
z7*YjgN}ZvXN{ZTu5fN**{uI%x7&bdRYn4+akI{UBA`nScEpHhS1Bp{gkW}K@ud(`B
zy})p0$omP8-cz<NuS?K61W3wP3Z6;)^b~3yS||@kjtzo<dloA#jJEDwC!2J~XrVZ3
zAS4gRp1Y5`Z(7E4Lq#bT9G!XByvPkvLn3H*<mh5lvVJ<LazGe>)M#bI2X|P5e3$Jz
z@j`1r$Ao@eqCMzZQ~0}PcqKSdTmw(;Hpd6`QmO6~ZMz}8<PYV&>*8x57$3<Wdy3Xc
zyJD4r8RI|W4G~{4n5wLM19TSK>X7mKI#H;7!rMrmS`eqKXo?9p%>>IODj$+lPk{2j
z#p8lj`AeMhSj|0osU=_VOpZUjL||K`^%*QVAA_(wfk6PV@H4px+R-z@Q!f<|B<m6E
z_m54n;Lt}xvJm!`z%h@BgT%+c!&eeZE`H0^8&H_{&HQ!-4tRDE?$2FZSAlkzd7fCu
zc|y7xc9Mj%G9A_uzb#?hP(%b1(y+MoM|H<KxPabU-O_bPb)hE5erQM<O<Zzry`413
z>XKe`%PeYwH@1+)^LmYmTchMhd618p_1Nrk5?^3BpEQi&A`#ma@ngpa{L1zDGdDnf
z`B*z5W`7G3O~Dsg<oNZ0GD-q(N@#-=ex?5~Qa?!d*C0PILSvD@el?8q8{Y3|dINav
z<$mtLDIGWb^V2q_Wt1(z-G%4x>5L*5xKo!w%mBT=JB3g-+^9V(-=74%l=Lxbz-aWs
zrN9O0N0Zt#XOJ;{;`*bu2#C=}WW~1M3Q$lC{3=fkJaJLKcUPvePMcXmN~Q>Kj0)&$
zFUvfD2Wf!wK<k~t8mf0$u0s3gI5Z0<TH!Uz6sFGdn@}Iqs)<D->B#8FJXus*vOqp0
zRGe4SnkutHtH$D7mBalC{hG@K!jEOOgiQXW8qDRUeY;`e_3o;Ti5V-{^rv?I?0>3h
zmA!-Y4?^1Pz;|B<OGNiX`5w;1@WE;Pt&(=xo$@&s50>Q6EbhZp4x~JBUlQN$o;B&+
z4X7l|<~%#>?%nZ{^(?xPlU|a4Wr<2S|93FU-DIEwoW31LJyebKSlJLBI3b<;l|z0I
zYYi{<cf!#O{u$MMD1oXX;9xyTErN3?VFjxsohR?vrv;rP?YBtX(ic#OmF|gMb!#oi
z2vA0z_vCAHAio<(W_@6;u?YAgGAPms6SBF3Sd7Y--1V3*th$^e1}SwcRS&n;$y5_9
z1POnL-vF9wS<lpb?I=%2R=p7!=Y|SH>8+9I?xSpE^!EHW6&345U=i(W0ctJDIB5!!
z1Y>jSM)Kb@#y<&8Q|5PPBP+h20l!!_@R%CTiln>7%T+l&MC&koPI{`%?N6!ekfo8;
z0uq~upYIA5O4SD_N_N4N<t?mUt~jW-R4t?1)B|W-3i(QL{qpzhv}9KzN-<21d}4rE
zDl%lrr8{o=Ab?c0_>x|Fc_bGG$SYeV3_aL%(%qEM1{hrI>@u^%TUV(uu&qdfzUoka
zQ)B=L4is-&Jq;^&+HCkGo~$miez+ACBd37Vr%hf(PK=g1Xt@Od%pNY5y?Qcd;*YRY
ze(J@9CpvyY)j;J>O?SF9><^5F*g9Gwh`KyZld+r<G6Rmt$Lx_|ka-r2DwbbILzz33
zh25R^g9t^qu8QZ#J{~nWT&WSK8TD;HWtmU~nQ5=(Dl(cj(SMF*<YkfG4A3tR3fKUk
zO&Q8OdD0-XLec{a@y5gveM%lXun$$;)RkoOk1r%g6fbk7b8)Wa^S*GolR4H)?AZ=Z
zS8FU5ydcC`iNS^fXGJYl4z5=as)6<)ptUowdBuHD=lvz!OA>MGt48(%X@Ht1^hL#l
zjBG<9CH5tu2qOY8#0qI1z81!*p$p#tWR}Q}=IF75Q6)Vy(f@;IEFauMuEgm-s-ZOF
z4Etd7`3<q3WPdP*1=~MDfIh-R03(~|o6JuC78YW+U(!Qr)1Y`&@h{cfHo4CtFMpU(
z5^kk+*lrijim;RZQ_W?}>`?H@2UkQaA$#A!NnMgLH)nk(Ek4mozV(ZqbM`Y)fv5K+
z<NAR_09PGTGz=76B<V>VFqoLWGEgxmXE3y)@n1W>dD9THIrsAJyng-6jqhk(5qh>Y
zd)qA?f9-vGUR9>?sg0dtRGcV}EIHd(ble_NTjof=81PO80t624t;2(aBJ@1QoK%<M
ziL3+Edy4imYy)oVD$rlr1@R`k(t@5bTWRX7y{>Zzd2rWQL$(~|&|<D#P*i^SJR9wW
zOdX)Enpeaq9p{v2M_s|C%oScXZisf(5~q<C9Lx0BL)MGl#3|Hdu%!wr>DVk7UztE8
zBfHD-(_>aFk3vo9`yj>^1B+-@$4D+>wM{qs3ceve-Jx;%w#U^wxeoZOIRvL+vTTx3
zP`uh_oWNl3l)O=Bk-o{mFsfbfixpwhi;vZ_EQi1v@&R+qf40B%N)R8&zohuA&WpLr
z2MP3ZyUG~VofnW2cGlkns~jcX52B?KkWzqYCAgR=6`nM~3c^#y=0Q=I3?ddik#&`i
zAgpGwLue`!tpQiMaM3eHQRg?>zQIVzTjyy>L7y-F5(E7b4GI$4;xWKBq8P=uu+~c6
z0f7hJS4JA;BqT($X3Uz;k+v(3|CoqP9YK&*1v|xL(AU4z5#$Pwl*8HC3)1*r&Pq%%
zDKis4QkSw>PLT8gg0O$m7_tS9kMjxH5knL_3gT+jd=}X6BfH@oVeia?oX8|#QEg_?
zhemNrU0E@fNU1$UrKe(L)gHYbg6+&E4RgwJSzsnLzYgR1?U*z?F36O+#ZMG-Ckmy|
zC6sk_Y>)#Zu1Q?rU4tZ37#;O72rjv>2)pvT`xT~`uNy6lO#c^xEacs@{F1R;fY&M7
z$G)0Pibb`KinOi0xr{}MMvP$OvVf(~@4w)f@fHA`lhkfa(Hh{EQPaKXdlcrb85aew
zR?Lap>OlzOM}K45NcobSEs|x88H*ij-U=Ug`zbRQiqT*c2IT4v1%i$=H+Svh=r4#D
zl2+~hrJ8ONaiN6HJS5)|kDlx2U&Z^p1@iw?le5*S6y*ZI6-cbCssa?}Rd)mAZ8IDG
zQWF`ktXsNkg&5Rkdi<c!jF`AJ<KgS>2WaeJ7lb)RoT?`;Ft_>UT|pqM*GG)!=rs?G
zeFs)KwCWjZYg4eJKeEVq)}WrbVZH<sC%%2Va3D1&Jv=YKBVZg$xwMF0>;D4#roQP@
zf9zA-D54o?)}5Q%C-CypQ=*)I#T%o35)&NshBx2KJD#IG*TOKug*3b}M!$R*&BY~;
z5}GQt0;X_vNPoV~CX{wdI9KPjF$~S$@)CGJm%Pi%Hi!>K{>gT*YuTfppya#n@!d5`
zUuXc9jUv@Dn8E-%*apFgi;`d-9hs>ye>5vk4et<QUILd;RHyYYm2Ze3<UUVP)#lX@
zqnb+%RnY3U6Gs4lyG<-&1j?f#yh31l%Er1%h%4JWtTWJsErrl4U@l0T(-UrJDq2T)
z2$TWt=XuY+k7w-Yxq;ekG@`dk4HskV#?YpjcJc7ns4W2%<!oT~jQ~m2DtQ<yQrmdv
z@FN)7gOfkf3Xek7cVSFeFn#v(8;IA9Dhxsi1Yrr&`o2Tk9v$W2bwasiSQR8*jfyA>
zLT9T|^5_Z-XxISv{%i25+XS0stELr7sdHQp82B%i+vfIT?sHRYjWgQhr{l?K@#e>L
zj5b+V06!W5Vnk}zSS4+manpKd8Nh1!wpa6mTW;IX!v&D|8QDrPpA@aPH`i0>TeKpT
zj4T8pR#MpNF_=TfTGNguQ03rI{|Fo4y)KmtDj73|dL7~%nRQZ<C$27Gud5?O!iSL5
zU!CFM&Y{QMt<UCDHbcQhL9--bWUzp7dd7AGuA&h`JQVhm3<+hA?mvP)r^`;$cg&4m
z;e6o=lt2@Tu&B8q2eUAD@62Ukg0OWJ{!rhUq<>IA)jcG^qb1wAcx5BhitxZndw=!V
zll7REFw*SuHe8MSgOh^g&${ofWk5dTJ{hpz{)wf&QRy5j^g-yeLU|t*G(~(5(9~xb
zbq%?cFJ)HxvWfv`de|I%fd0R^{)hOv{{QjgfAlY-3$l|=ICZj$A75)Z&9*M;zya2L
z>OZ3khV@43J{Q>x?%yHM#TRq)02LTHX4!YWMLs&8&iqL0v6;k+n#OTMl*mwuapdw_
zTJk~BVa^$76S2x-j;0dYtBY*m9gfl`P8dVPg#~b;!D*UwOLP2w;Ok`B_i#PyfIAbA
zD;&rc4%kScwK;WB3|aMRu7jdzi^$T4LLLOXaF5mX;^;|qi3QFtwRSPN>Ayb1b#o~&
zx|9nPQ)@uQDU!SOf;c8%`D`<rfh5}{cO`Nr%aZAs`fePPznjNZ<)OU7)!ptpb^6%4
z8m^PddDNYf(p}zj8Qz#HbTzJs(vcSL`qEcpnR?nUI9{qYkpu=%HwKC>6xR8aFs86W
zo4zI7rNDi5CpQDBhg2S)b8mL}b?pmdvLj5iG>>HPO(T&Mt-p8sOCISF7NC#c`am(J
zB#7`+0^a$RXS>1$X%+%O7d||W1_=WE_6{Z{ZG&5l(qwt^;)k}vcD!wiU<bQQoX*_d
z*~!%#CwiP@;K8vI3|)E{sKx|N@@-s+L)`=%X9&{u@Rf^_toE}+b}bFNizwo?qf%7=
z+J1E9-`l8UbKdDOT_-SQy)YRI<gX8X*l&AQ1AIt=&34Ts#zXK1>I^!v%c(gtP7Vei
zOGLvJn$}iH;F5j%uXW|R>jE1)F30lfIxHJtL-RSC@@0uw!q+Bt8jNQHin6sFx)M#t
z(k=b+x<WmBZ@(0LFd5M@Jk*OlLv#U$Jcy+!)_Zt==mTqm2Ke1-m^NvgQb_94l@s1v
z$v9?YO^=tOP;&96tY`zM&+})Q`}Z@sPKfAg)MuXP_yJ>oq}i=PmKwl2Xhs)62m+h|
zT@s0rq`azJGSdLCGms$UBVAzx(?Ua9wNbRO<`~3$0-0%ZDVA6@3&LHcGl-M!y<F}i
zQE;!G5g;~#r>zd_5=$MOt`FK&oahqDpG2Qc1pvK>dQXWb%?@AYE$k_@M}F6a;%4CI
zDGm;V;!6Lrzr^{dpkXZG-PhPq-8TWqOLF-1Q$9{Nd<Hbu;}V4Z>@w<i?Eg|t<C;b!
zbH7gAsERka+5(tzZkOtR|JO{rFbd4F`l>cdy(N5W3otPCRKe>)UjGds;uYQl?Z=>M
z=hj)jPX99WD*#<G$Cc)}?YxES1Fnd&T6x-?L?+{3c*}OK<awd75a<Pz2E~bt;#1L@
zcEJJjsk9z^v9eQss==R%4)rwqh{Ot=b^t2sFq*{eHsn}0GG%<Q5Ey6v&6<dcHtFDT
zY$mI931oXTh3AHXRJ!2$T(qcSevH1Kn^bW72FV=oXlm|`3&^ME@&YQB9t?N-=*ME|
zXKDn5ZD5)$i6cVd1m0tixcCSKuy?N>Fjs%=%DjNdIvOlpt}h8os|=3KFud=2u5mGE
z0F8Uq!h67MGI%`Kd7&Q|+RSI=wu;}FBQ;_gO;$8MZADne*gr`O)M9+{wwf<gV@pg+
zQWisdg6sX?{b}T)pOv!Jne~mEUCi9)lnQ4`Jj7TwN$hPR2=~|nM&%f~(u$Wrrt``6
zffk}LX?n7Tk{~?}ib4Ym)ZR!H7IM$PR?H63rkq8#j>Bnynf8#fSL~vJE}h#m)=ZF4
zbQ4NpspgZcW|MP@-5`&tTYHEJ>@9dDPMH?6Ypkw3w$R5RSNa0IYfqpbR_^gYfQ9uk
z`S^#D&I&k<%4k(0NoJWzd9Vu+90l$m2fp7eg5*hXW>1kn2OyT#s1fd;N1&bOE;z7P
z88{1CZ$RKx(VB8xtXnkJ%$f-#QZ|P0EotqheCYLgvX9}#4{fPzod^`T4P5EswaosS
zAL6HrEu+-vpRn(4pZbH^ZbLTHVskul-r$6p{&`8!#n;nRY@~e#bqha;9ny>;=A78?
z%v=;CyMK)HmYF48`@0JFregEuzXj4&J;s=BSXMUdt^-xy-zcU09Eb@7VX^B}2XX|i
zplgb;%gubLi8_|ERs<#NaCfe&at5sfA(l2kaG(Nvx3HXnwX-@+&sUy)9EQQJw3sc)
ztvc3WT-Dc3o(YP7k7Ox9{RI%o!9vPW1EElQ2xbQmFRWAWDc^yW-A!zss(3F0Q*&Wu
z=-ihqI2By<GuQkx*Zecr{Qu!xGdt(lu7lb$W8P75K2+B)>zX@@n18C71n^27IlFB-
zxbqXI<KWVMDA>-+TpzNT^>}-M*CR8nYy`0b+-B2<kRLiPQ$O_yvpQ<h7=Pxt+3X0I
zYZ1vzO9{Xg4jpl8lDUA|gTBiZ(n$VI;(xL$Rvc@zeN2@uf(M)@;j0&pbN#se;1(=t
z_3Yva^_vi)l8XDWF4Z@sbz-iuhf2f0xq#Cwl2@T5of-gdtwFz?>+8hzE#)efiEGHn
zyk_l<5B>ens&20M5yTyOr*sX(dsgLUObhArwvwR)kpI2?|7!1@e?wuTHr=}2wQbwB
zZQHhO+qP}nw!7<H+wHE~`Q`m4lbJd1moGUvCz<K>KU`VQ%9DHD0|!jrIki4`$wqbX
zDD-INvcQ!~+oGsRg{8d0L&A*iuq?8*mIPTSrZ<QPYJ*qcna$u9KF{cmlrqf;;bOv4
zj3lP=P>ZQV-?vT;04+BQyl$^}2Wo0q<!+xveyoHdI$HEQJoe7NBr6jv1*>#$_FZYt
zt^#Ej;;ofNW;ohcY6z^<99UDRGhAOr^)psYtWxlT7zt|<T;0$wX6bRT*%dquLfhu+
z^sHmi_bX$Ik4dj^rjF&*0cI-lui09I9J@OAlf28E=W3Mqm?vCd1cAlZ=uYJpa-O{$
zJEGctDI~#57N{=(ilxc;gEMJ7?jHo27Mp?Ds2%}_>Vp^Gr>uGqKR<aS0`9CO2o#k$
zUMYtmU@U@>%I41S6FIn1BpX>}iXu2=2BcO7W{nxcP=8egPXJDmM1KKsdE8{`5u;$9
zC^4olAgsSguhO4zJyfrl@S?<_ohB89=gf|Zdl5N>*{0YS<f=NgzuBwkeokXof$HIf
z`RtrzIXD26LICfy;z`j&+o%2okq`nc#_=SYC%2_0iCH>=x?QLK8ym9v7LvVni@xTq
z3?j{TTXW<*ieiWb+iwz79XdB0z7>Iw`Rkw_qzH8(=oHv7`LgZd3pXNn-fdu!Z1lZn
zB9w-v7jEd!*XtebanS=J-n(pr*9>W@e}b7+es9S)oiTFKX0P?}i%g_8x~X9_XWFzU
zy&trGg<V30x%9@;IJUwT8maox2_M`;vjc{C+7o&6vVQtd3&j7j|0DkF{y+TiKk+Zq
zB@qJZF-;2~4L-NIaZZlWp*-l*`Jd_19TpqL>7vRBu)SzuPiC-EZkM9+<m`q_K|8BF
zI#Rm}b9{KMF!GxR^3?MC*E%xXg6n3FF4XYtc?;!6y1Dc@sJW*4x^k6?fO6M4iuF+Q
zfR8T&;lsN&whVkFFs(`b>1Q$(^MwTSf#r+{Beh<anP(V)4A~I6J%z(pEtGxls@PzJ
zO{i}tOdQV+$Cni;(DBp@vGWLoAgEIQz!6>vlXdzmCQ4`d^K^4^tp<9_f*K3?bhIyg
zEhX6LvN+N--~n@`1}w*)slz*v=9vWir#$Y)Z_Q&Z$^1+NWSgS}*j`+0=}B{^EWVw3
zMwn?MeH6fX-_np&WLdv-BYpoVw;X!b4{Gwl;Zn&W?7q{N2%Tdomrblx2RjcQk-CNW
zMgckONF~qXnWDy{=nVI$Z`-*l>P0$VxCoDPW0%f|0HLXY-x@xlf?h{^F9}{EntyQ8
z#dPS{`z!2fa2WgV|2R0(?gS<t>bo4{g%bL*6IWPKj0kx0D1p=lpJ>$n9?y&d<0VD1
z!tkpgNxk@Zgx*nuO9$U<x5>1`UETCfX1|=QhrFynOUB-tdeO^aU;!pGxQmyY$G4lH
z72xi(u`f}d!``5_0gnj=B+!)$47gm7OHha|!19Te87L9lgXZoEr}^89d$x_(Qamwm
z#OE0jtHK2i@R*$c_cbDuc7uq73LvIa=m1e$M_G4pI)$G$#*6!N4_yf`*9WY5)FOqh
z*knowNo)~Q09#wsk?;ybJNvCuix(9~6XQF=LvZ8>DlwJoNr9KYrV;S#1xU0qzlT^Z
zV)&~7JTgf{vg{<GU><&@&SK%HCUzB7aaWJQV$~GO3b&dn6W$^>Zdz&1zf&IJ-X*f;
zem%^>R51b<#iKxDmQCwDU}>EF3vpcG)0ML?F2K+ns+Xz<yjnj|Tr@(z9F0$H{e<jX
zEZa$;?}=`3Q$2zdN?FT2{V(-g|NXTCySWrl*b$@zFY($D9mDIN_3NQjoDswEkILba
zAuqxa1S7&&iu0i4e~Sk!eeK8w1eTFHqTvK@GCyS-EnH0hW6k0KM$i2VtwVmC(<&!F
zZbvl+1GH#NP?hj3wfzp8qSw7^m#7_*?MnK9*Hnz~8O;trbjNlxc>)<SJUMthc*cPC
z?M(`X3aLm1lYf$%W~_8#UAY&@HxHS)ZNVhE5^_G;?X6h{TLhV}ahlIWU|SbMUl?84
z0h$dK7q>8N7BT$W&iS3YCvax}T4SqGez{rM!!X9GC{tVmY^a0FIq@tSo$5yJW8LsH
zTE%g;+s>4|L@!j6ee)yn+#tqTw_3f9DdF2Aq_3oidj@o`@)I{}xkeicQ8}QT8K|0@
z!)y5`2&F9|dtS72WmFq3-Zj01nG{9x_y!kETcvRPRx6GhExm%3yVgxGNAS?;?wcdP
znWS(F1^l&BIx7Ox0{pOG!tM#ev3Qo-becWX-zJD|k%>p&6+ZM^vu3C1Q{66BJ{nEi
z+(>pS!&l*|&rgJ|%T<~zLCIDs8+yC>gbhJc&_2Ph3&AaKqp0EmP{YQr{J@pBMB|T7
z=s6Z7C2HbFjL-nbZD@EzCiKi;hIz=fFP3V6dLhIDnM&2OK=%x|>LdEya-_^gCR1U}
zDDcMt*7s_ZaM`Hb0r`kK<fa!darTRqQB`i!Y&d^=Xx;5w^<>#LPm#Te{%OK5PuaU*
zeUY$NnH}VbXuE*ko^t8Nml!`D-;G*~&{WlTBNQU{AwuxRg12?R_Gz~rA7e2F2>$+o
z-+j63CUtt8--*Jr0(j4-kUbJ8g%*i+7x>^xmTK8?<r(iUn+^oZLWs?o3`hvLd6`BL
ztpWF|gFEDKu-}Rh+YzgVA)!>v(Gys-?%6fb?q{NORY~a1H0Hh$kO@?1IAF1pmqnfV
z7Y0?3uX)ADCs#Xx`(H1<ZjVfxt~1oL6(Mb+IMAkXAF4pL*g(A1u{s7_L7_m^G329y
zTU3&1neT+ItVy+J%R+~j`iTP|V{#}jzRECwNwbh<8DZ;(6)QxOQ(ubpe=V1on%GZ_
zUBbU*Ft3x*6x`A|022{2r7@Nj_+}z4O~C)f8pe6Wk}!437N^B|V{d<&aG*8f(0{Di
zJH5O&TDc<{YBvSKvVIT<)*;dp&@{e|=)o+)m5IQV#p<8ZG)w0|v7Qbtelp#F4ODu$
z`Q0j%OUwkg1A7LuCpDYJq$h8iL8b$BTosi^#zuOW-0-YZ(G^<rMxE!RLhAYZW?Hh>
z1wY_-R-bvBWe6#Wtj3_ux&9T)YI8l#_>;q<5^UVEX3SB|25zSPL;k4}!C1l{_M~Zl
zMmC!5nptQhxPE?2yWs#gOQpZDxK4%j*4Nnnv<WuYMzDBq?D6RY&n`KWRie*WMqk<-
zER{;iMHLD1@sZ;+4Y8Ys4CZrOaj2>NwskzTa;z$SO1SQCww;zb@3X&<``^q%yQa(?
z<bFR2+2e+Y{q2^XzTA)$v}Hlh&8KQwi0Lth2#y2XF||}>%9*ED@|oFic?ZTm038NZ
z<z$d-^Hpdt?K%^ZWQ_Ww34&I>5?7!iR6~kG%;{=bu-Gqf0T9s9bQrp9YEE*a#Gp!r
zUYZzL9^D@wWcz!yhBvH<R5<&u-c@tBm(LDdO61CJax54$huSNZ3KH&xwoY*dGR9(E
zY_uOO<Y!n6IO$CMKq1xL{>dc3kU96()rGH{-=S;GO8C3d`<*_a)FY4A%;#Xk@1}w^
z8(|~vH5lUl==xVVnY_{^NoM6jVRwc?S2nyrrV%Vd0C{l3+q(%U+C9He##a+{k((<f
zs9_5rLL~(1lsQ&k{kV7vUCa%kDihS*F^Fd`_N}@jJQg8V>>i}@Db`|*geZayz6JkH
z{FO<XagT-}TVnxpuBvKULp-{uRLZh!&mM!syja?gA<*HpfFr{Ao0!|PEE)Bd`|O$T
zk^~bVA*;t=aGEv}b#vwB;4!vHY0vqSqD!%iRlmkF2U<#46|cU1e=tiLx=W%DvV9lH
zFuSB{N;WXbB);$vvN5+<Zr_JTuz+Ng@5dLr!z6t>36=2F;$%@-oZX<)nSRItmCf7(
z{Vhc5`tH|tJ@#Y5xU9_zvnavhNGm~vKxFDaDl}kypn-P|aloE~13x{{KRwYuJ<<Qw
zp6H+b|A!y`bN*$zT$t(?4j3fP<LkdnxMSwDosZ$1{WD!)z%*#%_zhSp+ajjjdn7<G
zYdET~?+W>Xx;g21`-&Ao&^(Rhrmo`X;&Xhpa8v+8FIr1j*C~4qlmx!^@i$~URzHQb
zFCDH&r?!wXm@YBk-A24z8%>*4Ou@nn!qNt-YZxiD?7Wbb8@uOQswp3$?;l@Gs>=!;
z6ALd689WtMO~&@rn#zE&`y%F84c|y~on2(s;?m$dvE4L{GBgOn_AsjSAy|OR98?>M
zR9G#X1UrzZyli3>Qemm2vHWp#T=;i*58DZ_UW52)H-+`yy#lQSGmAiFCF~0Ff;$k}
z#=aTd@`H<1S2s|-MwuJ>>_ONDBjbbRx@&6X7JkhqhUG8b@;ywj-)R>!;_>L~wF1Aq
zbZebMpo!#lrQ$_^h$8i5EL@Ns-4t`x3bl6fV}U5BnY~>~`m8Rlo#I%@%t70XB#GF!
z4V#7CBUid6VeX@>C1qT2(H)wNnSSOGf}2PUQg=rzsrOffjSFfHD=+3sEQni^dDtEp
zUCy&tX&RE2h$x-w+j%@h$*o#A!A|wx!uN8ojxOyET7D~)mRrT-{4V7{I>)R%eYDh9
zJKFweb8wI25`Wdr427Uh@R7)Y(AtlQ;e_zi$JoyUa$bwsY!{`c#3k$f0#&lu=P8II
zU_2s-mP~XE<C_Nz*#*KtP@h3Fs=E{LHkaPTM0*_2u=f-uN02oCO-JRbGMk9m(MY;O
zYSsz0`#8>E%>0lo8d){asP7vRo*>*`IAOWFN+fvBa!?US!7}v#A#l}_!RoS0N_<Mt
z{a52I59hb;(+Pk{lK9DF;G7t`8)7o%vnBYr3WPo-!gNOg*b0!LBerJcDV$c^$z<HX
zI8MVl`Dl2Fe5UZPbc*>HHJ7O(j5u%S3Cididt7WPoJ~$@K*mfq90I=Q2J;p9UD1K%
zr)pBDDoV_+G%FBMazV<~+JtFdHzM`&4~QU_*j<-03bmyKo8l5}X9l3xzWWJJ7iACD
zAW5cAK|t_V|4OD)O6QCf4~=djPABH7f3fDxkbtvK&rLjS2_3LpP8oovj<xPT?*E;S
z0acRnnb;x@i!Cql!Z)wff4q%>Gu-DiL`Db16y;wIvOKO{kb4+I-z6eDAU~Cz@55Br
z&wQGZrw-1hHY#$pXzRF>Y-F#m8>g{X*wo3F=s)^VhS-{{b9shLQ{om?CXGH5%r!FA
zXMWd~-=}wrAejr~L@W3b8hp!#l8%I*TQNm8D}tv>%rEtUlW5;M;JiOeP2*}Yd?%Q!
zkb~%hX!N~U2FDCJeMs)LF%ZVoDt><kJExf^GJ#;@Zgs04e_Gea!>c0raDjfmixdJc
zR2m;saUDsu%r?J?_ZTy*OlcJKGXnYCJ&Dp+gR3=P?dvnQLm|+p*C4+?M!_!inx0c;
zv74J`w~h(22zHvrydV+m`Seb~gN!?{(aJqFkeeIk5WY>$hSQJIF4vgahv^ruVMJ!j
zl!_Of$N4VFJ17#ZkJbpxQvjLK-4GPJ2X8b-%z3DD^uk+;_6;;kAw=uXfff3O0wnIG
z5tdmNOQEfi1pE!TeIUtMP$&gaSz{<?_*{Qg4u(W1%0vR?-*zM#I1)oLT2u3$x#{85
zZF{)TB#Ty5>(yg5W&WT$Nhv}ZH6_yds4_o-34s6z0+}J3Kl2-F$B^V$6mui}RS@ho
zWFn$2y<BG#THo%6%pV5jjnfYm1gyEA)09g!NIV<HMWmyTRAhuOo`NxSES9VE261=g
zBbRJ9a3k6=xA0xPosaaYgV|3Xe{F#~uhbqEO>QW9s}N({$D9x!ygwZunYmjvnix7~
zoIq5r5K*lG*3;}9Fl4rJ%E;kICFanbTwc<9PkLF*Lqs~B-?^p`YvB0`qg9+#VnyhR
zha|Vqc{vg-qg=h`HQ8N1Ix2qO3sZ*#3XaNs17i(?xVNJncTCSmg9q~BCwkGznBS>x
zJ@nXU{&on-1J2Tmv7(~j3(Bh5B9?+9nLkcee&Q0;^r+zD3P@cyeKTttsCm%}5>txF
z&A4R`8nMPMM1Fx-chbOaUh11YB&77JbFkwg?mJ>4$o@{d{BJ**F&eUxep##OItwB5
z*$d>V7tw{d|5!t!(=fv)mz|0|B~U<^IJ5@s)yZT5A5R|-EEBXV9>22Z;{ZTHnR$y_
z8&{5gXuhiqVeHhJ!Z9EVJL@B#9RVptEC8M=9L-r5_u`<k$;O0km%K^%hDD9JD-<pL
zj7M-}Q8b;O?_eWpn_YNG_*r`=PSr%Tpa!V#bNjV$=p@KS(V#;H+a5IAU_;ne^-Qup
z2^IX^%(|0j>_yspHhpVTp&&>N{To=5$=YpRa9VD_d~dkVLrd871cM8Z0{N4V$^>G$
zuhmOzNOQ!S`*Riux1wnP0qx+`CwafpjJF>58a(jfni0QmazfiE%opy1K~797Gaq1h
ztiIdEOvEMy5it)<eG9KH<rSbP!FiNkBL8ph=iU*mxU=qK=6PKiJMC#-CoXSA?wrx9
zc8gFNJ)>wCjlqE$ASic6d932|rqFC0#k_^crRJ{rJUlWehIudsHBvU57%OuO!By$a
zF`xDmK3x^?#<iP^XSl@7gJR@+5xWD{-X`8XhJ#ew-m1(4hr`o7V4%Wj%#!R#DF1=>
zHO<1r0x#@>b}lj(KXw+73QYym2(H1g9e#p#Bd0aUIv4j8HgS6x$~;rtbkCoNNg_-B
zQE@jen{$~O6gpMn*&9V7z=-6t`*an5cKqh-WvCCJ4VZCEQBI2%C}e4%>08iYS14^B
zbo`cUObWtCVq$%(=k<hG=&0FT^!!dxq3i}e+O|^`@jot{4~UqzoW3Z#_ouVJs)vD2
z3)>6!eYhwpoc2*A1cl!=&5FF#G>M76X+TshhK-i$-x7uJs1R#l=8hgQ-cybq1!JkO
z3M0=#A7n>e&qrQ~hrNPVtWUV{O$D@as*bZq0B(jlW*xA>bdP}CKt$PPp);$2Tj`%?
zrv&`T7ww!WJ&Ng!O+5e~IN|!P5*EEogV7)Fx1kOd%CZuPM&Z8cws^CGQ_()EfU{eg
zOHY0^eYzcDSrz#<dMF}*a)mT?&F|k8n443zQpf3kGHh9UK+km=>`xe!6NU<iOlSYw
z)y#C(Zv(~mSnsT&8VdW>`hz=w_OO4fc~BxA9n><RfSADd5^lXVJUAx3mBWCuBaW?A
zMOovs1ZvGYfbk*fO|Wy!)Rx<8|74~ypFd^4IB?eb26vRQ9sdhNepM#d3Qag(v{B-$
z*Ku|s7#r~X5mBBZpTskp0M5L}8E6HusqpSTFA{(ANDa#aU(i1SFW<^Y?<<NtH)n!^
z!jl&E+RjjcO#{S-R&Z|s*vl(Hq##jnhz33vxZk(wOiV5hW|QPrEx!jA@7iQTk~O_1
zb0)eN-w1TTjou6~cdGe0D-LCXRwuQie?oF70)<oTczFUO&pFb`S*+~mS2hM4EQH71
zrjW0>*_lC%J7t^o3=MG^DMk*$u1oYNmyv4b^4-sEa#+c-Gx_a2NSHV4W2@W@kAq2`
zmcY+y-O5Swtr*BqJ~%mE#3?&-kzshn;E?R01>;}*(b4{hgt_Dx?&4IXlY*{-$<2<#
z(>=J1I@R3j?|psJKAY|It-xGSWpfQ6C4l&{L_=id3}iPwxR;&d>BAW0k9@l(x501Q
z2u?tnfq`}tQ|*34h*Gr5Xg8#6(0MEWN)6hsASJIPVfXn)@o|T-dorQPU`ik6B1abh
zyok0A+?+ce+XS?ci~%dDFb)?po(zZ(!^8#Bcif_B9^(?YRc8q@{_?H2vqs>awZ;Q8
zpJ-QF@TdQYOoov=`vWA!`^xvyHe-Lvf3;W12RRwz*yN46(@GXvm?&5h@zO1*h#59h
z#lMvXCS{swbja?5z%B%jR<XhQEA4j($Dv`7Gm~kU!A60wJTP-S&DdMoRR-8TBS*Ft
zaZ{E9hd;(RvtzaGm%)Mer@0fKrWoig8l%>(zJ$36SGr(Z-NLhI&Q#BZm90(<jP~xU
ziqcEs#FS`>`(8FFS$aNW+QDbxJICcC|IJr0OYL^f6Do&Bp8BUriVhy*n%~T8yR0bL
z%CRgA|A=uXwBTq^?Qu|mN=n$$ef`UV#@ya=r7~W=vZ^$~cbp;vy;JdMuh8)VupU4N
zGv(f0WwDM{Y5yf>7$m?e+zZ?}Tq_(aoIUg{6wR+1h-c7k(C44qe?R>2!w>%_@-L62
z@hJEWv>Yk>vgfljqLYxErQn0B|A-j>9z0Q+TpWa@`QY;xN%9>y+$c<_@CN}UA4O-0
z7wuo<ABOn24it|<tv-dw{k7izxSmY#dIzkf5UUfwi>ISC@8Ne0VTb;$I&Wb-@&_Pr
zDG0)5GpRwgJ`m07mh8JEq0zifPuWFy0dnfNS+278GtUfd^gH8C2juG1exQAbX32|3
zanE3a72c7?MVjz5ngvk42?jVGD1(AoOdwMKyUwOIOW3%a33?%io!rTgrwYN*w2y_4
zf*w@w5Ul9?I1usjCb63D4bWZ-HcZ*>1(g7(Uf_hc$D<~oroHWR0W^<t=#xBUxYq-v
zr9w`P_!AYi(p^A%Vmq5g7ZyUl1XMRy%Rw(p?k_v~9TYdUPbIKHHD!{ImH|f=v1aEg
zBrfD$IwhH9qUPh1Tm??NdVJv!5(>U$-0K7tQdX~Oo^rrdF@6aSSqcZMBt}nYajS+Y
z<XWtP{r7hthxpZ53U^u!p|mw-8VzVJ5rqV&wzbvMBy5s=OJYg7s=Msh7RB8<JHW8W
z>k=TqK3La%vujs6dyf}`c5wQ>A42-V#Mcd9UcNmKeyF9_FS@)|2R$Lc9b?-b+Q#2Z
zm{DO#a07bf_)f*$vklQKMYviQ_h#Po_p_t%=8vtMM2%Z1H=-CS(OZ3oYXZMmYTZM9
zblsXEswYDsw9R|?5CT$IUgFTkWc*$sR66L;76ZTi-~&1s+wnhcjO367-fG2!Z|FHk
z6PofUS@H-xp@fV3cKk0QCnAGzv<@A-%Rg6j`Y=t3CN{+Gs~qM~cw{$h`+Oa<qM5Iz
zpA3fqwcgbRt5yK%&uCEU^@suXw{$T)GF~PG)W9Ae&=hXu%1F?vyZ{w6-5+u8AN){f
zDz4*g9C1CraV-;Dy1?Ln&!&>=(QDH)sS|Rl0Ji%i+*Dd@_M4Jrst6@(cL;XGO}K$S
zQRgF98Ubi${<TDXfnaTK7$u%{o>G^X_akQ$$E6WY(`2{f;01LsDPK<h7T1yVd8t<G
z+)))VoR?q44FhWW|LCaZ3{Q%Q7%K2zzI}?mOT5~A?}2GJMD^D#zO|g!kM<~Iz#Xk<
z^W<#XP0LUvU3!i6EF6Y%7-^9gA)w`l=MAn-xj#G7ElaO;JB@YS^BWUgP&XmA0CKGW
zW!+oL#BQQdhK9WApE$>6-{;(ayf$4dedt}0vfQ{erQnPR9D<!Ycu}_45<E4zT{d@4
zu1e!S@#c{<#emdlVlVYbn+0^T|0cQ8ncR?pr5sj{yf*}mSE8TYdqQjEWoT~P2&=^D
zdn9J$Gvg1jGoa^*gi*WM=Mu0;&HW-I?2n9f*9_JG$d>F)SjFXiRe*a4W3+Bfp|1eB
z2>4BOspIysm5LI+g;Hs%s$SB2l8@`VHQ+C^$M2)P#MbEz9mqs~*EBmL5=24H+09D=
zt#tJCPzo0J?g(HOi*T{iH8g^5%S>SrWVF)OtWp@u=Ixpwe`raGKt#pdm`?UhVv{zM
zKv{F!VB(CKs2J8aY#xera~c5c=ZW^-2kejCu{}jw_g0N>USX<#*zE-a6PbFQ5r*!S
z7w$*z+K~C&>fN9$s1*z$A|h0AvQdSXslWPIB3C(nGzE*7A1Q5j>>5*!_<Q|!YR_ut
z6qyh#>oVk4L#zPU!$4!)TU0*Z4Y3j9&2#3am+SQcVGY<_Wm_I&gY}|?&1ZQ<kQiu~
z*pPr^<bq=-i4gxm-td(B*BPoISiD6#&p@^H%E_dANPd#yJJeX}mNeJ<7uIl#A%vc*
z{1nsSYP6N3^SXH{p@`5M4vtywJAm}BfoBO@?U91f+Q|=RqOxD7@1!a5Q4H%w$t}nr
zLwAKoZdj)N>S64}gjZY^9BdQGX?kx=M-J=wZ&cAxAdK_d^g(%#o?_AOLVp{E2Uor1
zo&G$$fX4)*IswLi&7nb31vv#^oFpVfQ4d3vHjtCuaLPggxAX@!n1<9s-R6zwCpXHu
z-cR1**MlfT6(?VWJw`=U#^KR81_1*g*qhnmJDb?p+c_FIdf*!w{6AR)m0a_8S7VBl
zOU;PU`6lfkxTZSqAB(gm-xFz$)kt<<ebWF-+zHHbC_A~Ig)ip2!S7>q*2v)R_AuDn
zlCM`<iR#+Wu<vKp4%88(_GJ(lLFSE_q%ma}_1}J%fhYCo$-{)s)q<|E909)U(wZd1
z*zjQ=BUU)CQ}g)eab$_&C@;lJ`!0fL)rvPW9h9#dlPSxVK)x<vgNcIQz_E6-O~X<;
zybzdc`-Hii@hYsQE_^Kl$f4nurLKPyc=LvlC!vB$`aFp@6k(CEDNj80e>?zZ;Z2pm
zO}{Nvjhhsy8$l9H$ZL9FpRLh%2@9^<7<<t-6-mg7w#RH2fO1toxl;}3pelLbodu@A
zkw*4Egh%PQ%*>-td`_ofS$R2_bCeOFK6)C7lg;nJaIlQ(Ve%6<xh&cx&Fy__A%u3_
z!3YUfO-LJ|9F!<y3B|ZW6{t-`Yz|1SO*rcLk)0uPBC|#Tdfn^v5Bf~5s}19I#q@3s
z=LyUX{IOI#sO<QY9R;k)4A4G~$(A-%aUF#XMrwvF(qjv`ebl46J%dec0Os{lx)bv(
zNM>wVKX>Ff0#X0*31-e1>+2MA|C^p!x;GEmo=Sm=cN>4hm)_bYWvodRjzn3$<0F)h
zBG7(zi*rGau6=I2tMvkp(8OCT!Xf{I5)@0GGB_i9#Q6c>B*KJz*ZdB&1P8*%MGs%g
zfo!fZdzBG38F6>NZvvF5tC?TQxz%`C-={jOQs{QP1%dA`6XI;+Z{2SJq)QG0hxp4}
zBcaib+pt{K*MPC93;{q?cLM#2&6A!ff1TeaSoO;Dp$m-Kj)Ll$99u<<{>H>Q><fsy
zJs&WK73^sb%xC*SXBm<Wi09CX`4mCYq=KUw!;d?E&dDnP9Wo5fk?h^>Zf6SYJ4?%1
zOB{JG&E&bP9QPqmzgG7qspt%pkd?h^G>LU#{QE(V!+3F1W)?B+5{bk{D}%0Z3u=X)
z{ej#(riYQMK;>ioEApe3E-fZeGfgcrYX<I=4yHD6ovKQ#o6rV;hMHleS7&8|?;m($
zJ7}+fkpVS2`-M(FK2^e?r!hJru|v&2?g#+>M}=4+a72PDgL#FV5|(X(h->T(oSfY3
z9F1v=%uS4}fK^Q#oh<BZfBye}_~Ae2r<3WYlj*0E>Hoz}rl0)(PyYWW|Nmdj|NkVJ
zf0E2UN#_4;lKEe(Y28Md7i2gSeCXiTZf-G9!(!l)`NtYOS`V${AoqPOr_(@PWwvyV
zz4*a1kQ|0JFHUf5!+C()h|Yu_)vAo3uecbb1qV!dXV(L?w@Dvp@#K~>NA$rK+w>KA
z;@hLNXw74KXT;g}wM;p4D9p5(_7B%6f<(+b7r?Qx;xlIZLBZV^gLo+9P`@|gRm>1_
z@}saJfm+&>+n942To1v+RD^L&A*jGqAe`@WuNxr!m@HlUo`_>_PydGzJj8`8G49In
zes-RT8QAY{bLo;lYx#vEyBqC#ytG)C3#h8DDQs*K^P?pl@FjoW?n;04_lFGU?6>f#
zV*sMFww@sex{wN!;JQBD)D4pDpgf-&-+TnL4|NYIB-}2ZSZqRbZwz{TFQSKFwWtxU
zd|{9)Y=@_yN9F`}u&UoOml}>Jpz^tOcQ8v@C30GHnQlC#%=z)5_u4|XmZ?o1x7__s
zb7QDxjx+?<cTN^S$U}shHrguG*laxPt<NR8`$#P*-)^N8aurA1VVz#Eaxag3HA8)$
z3~5fimvlOm$;#qc4a?wSJ0{b09Cj@c|0`9HWyeqk4IJCR0tx3Q;GpP$qc{qqerOQZ
zrh5HYQ8B@=UR`wJJp_^?y$7^`9~Bw0E@STtF}urpaPZ4bGYT`;LGsmg6W~vYXrM|3
z=<rINc@i=Ni3OneQM!=?NzK}#+VlAV^K+>kk=!i(8$fMq(ieP|#zaOI--BWn?XINL
zh$Z!)e~Gh?VN*<VeOwAuaMjAWi;+?Y`UT>h8GAJMp$RQ{d%NQa9;NQ=^}4d)WY>K;
zRU^V|AkK5)%=5A3Rri^$M0=)-pb*ByO~A>YH>^+1sf*}z#5Oc(V<+>M6{B+9>HWb!
zjqM5Y356I04)J<QRXl|{6TL!ig^h9y2671R+<nB`BOdRhDsHB3E|c|p1a+OGLWEeg
zTVY(1P1qTU#CS$)_DlU%n4C2u;{FM?qNCEi`u#)LaIiUkT?-U-P11{dE({u1h({i1
zj=iC<E4npkDmCJF`tGRCG)bB_lJi+gApd>;5B-(=>;La9>xUnH_~C~ie)!@4PX1++
zxt@Hvz^U>#>EjxkM2=U3bvKYH`)88@7UmnhxL&rRbZUi}r(3?OQT$`sMKUg>0cnRM
z?|@6&ho>mT)mn|wcD@4)ghC+qZdGCwn>K$j=6@Mjijed7zQgR7d4u9xzhM>!n|vHk
z6o%)=EZ%6}5GKly2(;P?<0U;^@r6Yne!Jl&-nMpQHLa`E4s*Q!_9;R@&1)@DeUgE7
zU)C+>*ypx1s9W~cslsJsPta~fZ%_}RG_2;LebC%7YQaNd3H1E7GKD#b{b)%guBt0T
zDEphCC4Yvaxb9hB`3ImYBxJWzrF6NqFq0bDUbFY~tVAHfFs__m?jY2Bb`HMDeKPZb
z^mD-sz=HL83C!%L53dyH&=>c0ZK|gEXr|X%*Z@A4f1}Q^xtJvs>m_$$<*#IDG7Q$q
zJi}h~i9HQ^K<OMhpiw3b-|7L9-Ig;pK9;rg7obTn5#ac=mRY78mkc?Z7%Yjm+}P{p
z+`oLNy>&EI2TrYkbZtEZo)@$z><J9U>qRHZRP5z?WOrNwSW~}2#gn0NTiK`L9T~A@
z+ap`KAjU+Ppz`=JsHK8z<5IPv!$E$9wLaW**y#snlgnXsu@@Xd%pn;Pw+qIN`gXnz
zM&OG?=D4mNav~Ib1j5`tmB>SddwfkyPJhFhOw~n~6td@*i0bqb8k0AHG#W`_0*73)
zA2cxZBtCzZ0%pxWEvnAHK{#!aYCO>s%Luf-0`3X|PKy=z^A{2GIjQ7hIWmHITF2Jf
zPhg4q`<omJQ#<zwecdu&WH61=>1dk0=tEr_eb*ze8ejp?E+tm<o2eqv8+v-XPX3DB
z+_rN)jMF;F8b3TzD+tRPQOO-SxX*pp*G#YNfHeAbsby`Z8mj?yF@8}_!XFC&Fs9R2
zPne9jMIJ0MSsb(IVu@T!t7TvAupPU0hr_<m9%lhsJB91gk^^af(S*@3a`?0kwlhN~
zvOz0sR-l|X)v!ztUb-wwp^zi(ztu$p$K%Zrp~xN0Uj~l~Q;P^dgh;Kx#7vb+Vn8`9
z$vp@NGFE}Q@zw(w^e@&t5wWZMQnyCgyQ;`iVE!;}M+yA=#~MXgnAf8<&)}fsV!kqf
zItl=&t*WcG)nwM?)uX{{AMrFBC-IqO3=QTg=$i=cM?);CkCIkP558-4>4N!PV8Ln^
z*5V<FMvHQWn~jIYz6)h=8&wdGYzm+4PykIEDYer{;j44c$Nsa7z*Jj#5E#ukCX{?%
zY^;T_iNsmboNTv*Hqv-GP?)?+QyLCWuVb-4Dihnr5TNixAAE?L`5vgW$RNa`j&yIn
zeUvLX^!l*dG|A8d(8T?@3L=6fz>E+2Rpf)EINQiHqGQK#{q^k+ZTl^8JYRF3AO{Ux
zAgoE8*mj6RnZRa(eF0^|*90zdw?-GboeBX^S9X%k&Zy^-5zfH(5DGMmU<{whC4}s>
zG}V00q$}gUi{HT#^no4_!zY-71KA3_FKCelMh_XUP7T|3iV$PXC+&(=SKpI*H1B?O
z4Imo8Z3n^RK#KBS+uo_j<t}LI3nqHf_#Vw}QLD8bLd$CuORFN=i*<kj#pJ2<3A!K6
z-pbWum@)#F#5A6|_~@q_Qct3}P;xn|%B|+?#p?KvM~Jb=CLjEDE78y0(^f*_Bwacd
zShEdl&Jlknaj-ef)eo7xho#r>RYH#%H!S?d0k~G@CBB-<7pC6xYM5^nyWM6su7cnQ
zXr;Cy7OP_;L&MQ+rKzM(am!#z*vYC_d)5d9Jc}l>)3b0LW<-$PP>;%*d?p_N(>DA@
z`sJ$ljE|jei7&!tw?3ih733TqdOjThHLi}V4#AB2$e7XmR|A=nmnac%kTseWS+4hy
zn90$V6EG5PoFe@krm-t=PAl*vap_~#foBgo((jP)-og83rnIr$SI)^UhOxEgs8;!|
z7C@+2)jnhZ9{c4uXl$QM0Ns{*eF~Rjlsd$YjmI5Gra<Io)Bek#b%1qMNC-{89y1KO
zPdLe%EBqiK2l;rn-fkCQh05%cfx-kr4^Nc)G%{F(ewJLe#~XNZ$jz}s<tX@aE8w-a
zg6^%=&>9aqnI@{10rTA#eawiHh{o@{7ii|^|Nn;{{&W7VU8ZU;On&3Mrow)YECjsM
ziw8p`{GaKPfjkDQKQgrWiW5cIhiNy22vNFhFgC`e(Q5{H6K7b`1Y5yW{#ilx>o43J
z0wkyuPWp&4AljfTDZ_kvQdt2qSOrY3%e=zK>N)eo&8%X|4E@Y9_QG?O^>(YoZA+Ug
z47_=&dy5uLqYJW+AOhw043~E(WQ9(M_T;geK9D7ie5-$LI?3fWXj#n4@+<TLxdHHK
z|ID2knTv~vpcw$-_1aKrr=@^8cO`~9@tapcIc%V$YgXYmZy`Jw$;-0ITlYk({tP(%
zhz>XjK@O(7E0Yyy(_p_)joQrQJeq>^AsyaTE_@5>SYtQ;c)DJbZ-R7>B2!-~D%Sd^
z+_Sk8^3~RCG<xHT*-3bd11(+Jf#+_Wbo-v@)*27~y*+}6;}VIFaL3@_Fh3OF8@Hl(
zi(<SES&Xubt32^2Pv`lN-S>W}bT<wMN!0IE=)`Pe%6Pax=r%dOO53-ZZV_F=pc@LL
z>{RKVOrmw3`)AhS-mEITkRFpOz!7fgR4=@!RpQjg2w}1}^?)N6oZq_zv<vU<srXkQ
zg!a<cdOH-6Kw~-bouCrYhB!Ll(dPWAT>7jC)j#Eu4*MhVNMo0}s}LhReL4@K36WtZ
z_?R}{MofD9x+%FQ_%9Y)Nk53pimqRRo6=G_Opk)H>c~yTC*I_oppr=VrryrwK9I-^
z&9=TNSUExFTC-)4J_YTCuTusb9?;oa{jXEC*vJ|8wpoRJ+n7*kpN}$H97z3=I-!+`
z4*r~4lL>Yb>TkC8n&+}9WB(dma}x(&Y7y(myUKbhP7iFAX|dkbMj%K6>L|eKv*yDD
zPw3igFmU(z&?_cc#{JVxb{79+vO*tkk;s30->m@8%1USL>gm<s3)4s}oKMe#lcYpW
zEK<%XW#X{|Q`^N^!Ri~AMd`7CqUXV;2);@)uP}`he=fR80C4|Zh6c08cC}{ZTWsW&
z=xOVoC0A^*KEbVHmnSB@pwp3CB$5$p!yx)q$T}cnCDfsP;xjf0M8qu-{uiF--+nTi
zgIr~%&FcL1F}!SqSEA;~E=AY=BmWPs<L%C>^#|Nj+t#^5`WVJM{!0O~0b}6pBPrT}
zzaD4Rj}||kFa6Ln%6X<0s76^70h!%CkpBBH4|)n3DUo+kO^+4R^HZ`%x;BQ!|La|P
z^4G3{qYtsz<6D5<+l46D3oe-FAY_aIr-!pQZ3gPYqvVLcQx`(xb$k!Lc7Vi4&$@?D
zS$_UOTSlsc`R;v+$<v2<CP72K!+ZNKn~r-oUEZTuYDe-BJ=;*33NDZHt0&$EeX9J2
zV_EBRJUY93hKO?x&Ag1HG9Mnk!iPlJnExguz~~u%J3>m&4Ba65GOh*ksCd0k&F3X5
z6pukJ>X%_txyoI;Q#)H#rc<`*u|X^FCh1m6(jYXOZ{I{eQ3}L_5!sO2l&Tg)m``xe
z=n!-7`HYj1Ll9_*!dRr2a3aI?jHU9LW{WRKHLOqzpKPIOl)xOk_YI1S8Co~(c7b=3
ze5CSz9?9igp7lug-xG92fONus6uH+`>-JIr_^&^uW`-w$^=5dkFWhmKo4r8Kj9vz&
z%O*i062gP*S0NgIbsooFiy><DfmJ;B_65Hm7XMN;htjrS&4qKXqw1V$VBHs4dk38S
zt`3*ekA`*~vaWTJZQD-lCH<Pur^aL;nm4RqVd2aCSoZ8cv7p3y$xvH>xt@l#_PVfh
zHng$dKc*93dPM<dV#b+gHhE5Jl*owL&F{+k_57MHyvphLp1N%lzGcNcHthkGm+a#J
zMYYd$y42`|k)*nuOCFvy?Lz@!g$Mk3ZKGx-i$Z_HUFvpPU8{~^c8i&5_MzCROWn%H
z4?l5rW0*(&f_%oO=k7l_T@10|d$MPx^k$Ma>9k8F92$_x)cbTSbA9d9ij@L%jT4>(
zvQ|HYd{N#?J#`C<%dwMoO`P*J!NAt+TVNQ^{8AKfSwc}+-{YL0<16)!eq+&)6tz+;
zx8r+YIGRU`+T@WTu`<rDvW8Q0hFH&jq7{Mx)T{>GT2`5KAWN1F#%%4@89(UY*Dp*9
zoJx0jI%{iKTK#WH=GTa2>>};y)VO0lSBv8I^0T{Ln18I<FlP_1ETuxqWZA2JzLEpM
z0NE4%4Gb#dn>uJ3s2XoYH1a2<uA4HxIT;j{g|?sDfaWGjN`_GvCxONQLnc_)Vvu=E
z;u%m{Z1Nk2mVEaD#U2}vtUZK?VtUS*j#)e2gZquP4%Mv}POM&gmLEkt)JGg@DKSc!
za|PiI=xKBAw~afDW2Ft?pWmX9^(Iq{G|GcHF)8$SCrDF1xj6V%2pfP&8V^$1HOFvQ
z0uRS_vts(OMgEwkA|Rw<zBk4O=uTysdmxpV1>hSsl=QW=lWr#Ok3C_0UTVEu@*Gh7
z(%*|Cu|uH7HxW%jx>#w=dBlf>;`fgz3<Vh*CHhU#Ipzye$`MW-mWs4zK4mw>86ziu
z><n{#CZdB55Ew(`Hg!9RC23;O>=w>T^sAziwzaq-f}Q?iWsJVV?+=Q5_dkFw=cNn0
z@C6XFp{}N;+2+@!=cm5$@$-tZQj0sqVJXR=nlR4f&C>OGA%QGX6TvAh36<;}vPa<o
zV|x=|uR+pZ2iW=`WsAYp6zX6*YzV#=F&c?UaYNoKuZH9hQ-pQR!qN!D-lKBC#g9$T
z5v%@%6Z2$ONOv`E)kgC@;dPSLd0l8K!jO+!Lfe-@Z?CbxZc{4`ni*3U`+6|^Qm8FP
z+jMufQaouo>!Wg&-^SE6kPnMX@1|ra)txH2Gq1pE*p$MWq7lQe=|f<0HwY(AnqJ4F
zm)C~0aW}}25DwV>OW_dJUNEvK1#Jh|%H&~N%tC))z`Mi%u%z!DX^&f+Kv<uEGy)9_
zy8|tNze*luuS$<FaT(mW?1`o%5-*?DH^5d#hw$oplU1PaTGohd&G?k1_>d6n?%bd!
z-RnrW{K`Er_$eyTWELLR5f3@2`f1%6EGm>G1kJbM^QJUKG*=JjXI4lYBgY96;oeVZ
ztZm#{;9-`b7go7UW?EpX1ERoji9=xO;(BVmSGd#q-m-P#OPw-Bq{vhX=4ar{eqsHz
qk7Gxjh*s7DIdbo!L#LtVAG|~gm(6I$_0!Pw)6n$O(DYwzX!>tqm}yx6
--- a/configure.in
+++ b/configure.in
@@ -4785,16 +4785,17 @@ cairo-windows)
 cairo-gtk2|cairo-gtk2-x11)
     MOZ_WIDGET_TOOLKIT=gtk2
     MOZ_ENABLE_GTK2=1
     MOZ_ENABLE_XREMOTE=1
     MOZ_WEBGL=1
 
     AC_DEFINE(MOZ_X11)
     MOZ_X11=1
+    USE_FC_FREETYPE=1
 
     TK_CFLAGS='$(MOZ_GTK2_CFLAGS)'
     TK_LIBS='$(MOZ_GTK2_LIBS)'
     AC_DEFINE(MOZ_WIDGET_GTK2)
     ;;
 
 cairo-gtk2-dfb)
     MOZ_WIDGET_TOOLKIT=gtk2
@@ -4817,30 +4818,33 @@ cairo-qt)
     MOZ_WIDGET_TOOLKIT=qt
     MOZ_ENABLE_QT=1
     MOZ_ENABLE_XREMOTE=1
     USE_ELF_DYNSTR_GC=
     NS_PRINTING=
 
     AC_DEFINE(MOZ_X11)
     MOZ_X11=1
+    USE_FC_FREETYPE=1
 
     TK_CFLAGS='$(MOZ_QT_CFLAGS)'
     TK_LIBS='$(MOZ_QT_LIBS)'
     AC_DEFINE(MOZ_WIDGET_QT)
     ;;
 
 cairo-beos)
     MOZ_WIDGET_TOOLKIT=beos
+    USE_FC_FREETYPE=1
     TK_CFLAGS='$(MOZ_CAIRO_CFLAGS)'
     TK_LIBS='$(MOZ_CAIRO_LIBS)'
     ;;
 
 cairo-os2)
     MOZ_WIDGET_TOOLKIT=os2
+    USE_FC_FREETYPE=1
     TK_CFLAGS='$(MOZ_CAIRO_CFLAGS)'
     TK_LIBS='$(MOZ_CAIRO_LIBS)'
     ;;
 
 cairo-cocoa)
     MOZ_WIDGET_TOOLKIT=cocoa
     AC_DEFINE(MOZ_WIDGET_COCOA)
     MOZ_USER_DIR="Mozilla"
@@ -7524,17 +7528,16 @@ if test "$MOZ_TREE_CAIRO"; then
 
     # Define macros for cairo-features.h
     if test "$MOZ_X11"; then
         XLIB_SURFACE_FEATURE="#define CAIRO_HAS_XLIB_SURFACE 1"
         XLIB_XRENDER_SURFACE_FEATURE="#define CAIRO_HAS_XLIB_XRENDER_SURFACE 1"
         PS_SURFACE_FEATURE="#define CAIRO_HAS_PS_SURFACE 1"
         PDF_SURFACE_FEATURE="#define CAIRO_HAS_PDF_SURFACE 1"
         FT_FONT_FEATURE="#define CAIRO_HAS_FT_FONT 1"
-        FC_FONT_FEATURE="#define CAIRO_HAS_FC_FONT 1"
         MOZ_ENABLE_CAIRO_FT=1
         CAIRO_FT_CFLAGS="$FT2_CFLAGS"
     fi
     if test "$MOZ_WIDGET_TOOLKIT" = "qt"; then
         QT_SURFACE_FEATURE="#define CAIRO_HAS_QT_SURFACE 1"
     fi
     if test "$MOZ_WIDGET_TOOLKIT" = "cocoa"; then
         QUARTZ_SURFACE_FEATURE="#define CAIRO_HAS_QUARTZ_SURFACE 1"
@@ -7574,28 +7577,29 @@ if test "$MOZ_TREE_CAIRO"; then
             fi
         fi
 
         PDF_SURFACE_FEATURE="#define CAIRO_HAS_PDF_SURFACE 1"
     fi
     if test "$MOZ_WIDGET_TOOLKIT" = "os2"; then
         OS2_SURFACE_FEATURE="#define CAIRO_HAS_OS2_SURFACE 1"
         FT_FONT_FEATURE="#define CAIRO_HAS_FT_FONT 1"
-        FC_FONT_FEATURE="#define CAIRO_HAS_FC_FONT 1"
         PDF_SURFACE_FEATURE="#define CAIRO_HAS_PDF_SURFACE 1"
         MOZ_ENABLE_CAIRO_FT=1
         CAIRO_FT_CFLAGS="-I${MZFTCFGFT2}/include"
         CAIRO_FT_LIBS="-L${MZFTCFGFT2}/lib -lmozft -lmzfntcfg"
     fi
     if test "$MOZ_WIDGET_TOOLKIT" = "beos"; then
         PKG_CHECK_MODULES(CAIRO_FT, fontconfig freetype2)
         BEOS_SURFACE_FEATURE="#define CAIRO_HAS_BEOS_SURFACE 1"
         FT_FONT_FEATURE="#define CAIRO_HAS_FT_FONT 1"
+        MOZ_ENABLE_CAIRO_FT=1
+    fi
+    if test "$USE_FC_FREETYPE"; then
         FC_FONT_FEATURE="#define CAIRO_HAS_FC_FONT 1"
-        MOZ_ENABLE_CAIRO_FT=1
     fi
     AC_SUBST(MOZ_ENABLE_CAIRO_FT)
     AC_SUBST(CAIRO_FT_CFLAGS)
     AC_SUBST(HAS_OGLES)
 
     if test "$MOZ_DEBUG"; then
       SANITY_CHECKING_FEATURE="#define CAIRO_DO_SANITY_CHECKING 1"
     else
@@ -8142,16 +8146,28 @@ if test -n "$MOZ_WEBGL"; then
         AC_CHECK_HEADER(GL/glx.h)
         if test "$ac_cv_header_GL_glx_h" != "yes"; then
             AC_MSG_ERROR([Can't find header GL/glx.h for WebGL (install mesa-common-dev (Ubuntu), mesa-libGL-devel (Fedora), or Mesa (SuSE))])
         fi
     fi
 fi # MOZ_WEBGL
 fi # COMPILE_ENVIRONMENT
 
+if test "$USE_FC_FREETYPE"; then
+    if test "$COMPILE_ENVIRONMENT"; then
+    	_SAVE_CPPFLAGS="$CPPFLAGS"
+    	CPPFLAGS="$CPPFLAGS $FT2_CFLAGS"
+        AC_CHECK_HEADERS(fontconfig/fcfreetype.h, , 
+            [AC_MSG_ERROR(Can't find header fontconfig/fcfreetype.h.)])
+    	CPPFLAGS="$_SAVE_CPPFLAGS"
+    else
+        AC_DEFINE(HAVE_FONTCONFIG_FCFREETYPE_H)
+    fi
+fi
+
 dnl Set various defines and substitutions
 dnl ========================================================
 
 if test "$OS_ARCH" = "BeOS"; then
   AC_DEFINE(XP_BEOS)
   MOZ_MOVEMAIL=1
 elif test "$OS_ARCH" = "Darwin"; then
   AC_DEFINE(XP_UNIX)
--- a/content/base/public/nsContentUtils.h
+++ b/content/base/public/nsContentUtils.h
@@ -1158,24 +1158,33 @@ public:
   /**
    * Drop the JS objects held by aScriptObjectHolder.
    *
    * @param aScriptObjectHolder the object that holds JS objects that we want to
    *                            drop
    */
   static nsresult DropJSObjects(void* aScriptObjectHolder);
 
+#ifdef DEBUG
+  static void CheckCCWrapperTraversal(nsISupports* aScriptObjectHolder,
+                                      nsWrapperCache* aCache);
+#endif
+
   static void PreserveWrapper(nsISupports* aScriptObjectHolder,
                               nsWrapperCache* aCache)
   {
     if (!aCache->PreservingWrapper()) {
       nsXPCOMCycleCollectionParticipant* participant;
       CallQueryInterface(aScriptObjectHolder, &participant);
       HoldJSObjects(aScriptObjectHolder, participant);
       aCache->SetPreservingWrapper(PR_TRUE);
+#ifdef DEBUG
+      // Make sure the cycle collector will be able to traverse to the wrapper.
+      CheckCCWrapperTraversal(aScriptObjectHolder, aCache);
+#endif
     }
   }
   static void ReleaseWrapper(nsISupports* aScriptObjectHolder,
                              nsWrapperCache* aCache)
   {
     if (aCache->PreservingWrapper()) {
       DropJSObjects(aScriptObjectHolder);
       aCache->SetPreservingWrapper(PR_FALSE);
--- a/content/base/public/nsIDOMFileError.idl
+++ b/content/base/public/nsIDOMFileError.idl
@@ -39,14 +39,14 @@
 
 [scriptable, uuid(4BDAFB64-15E2-49C1-A090-4315A7884A56)]
 interface nsIDOMFileError : nsISupports
 {
   //File error codes
   const unsigned short NOT_FOUND_ERR = 8;
   const unsigned short NOT_READABLE_ERR = 24;
   const unsigned short SECURITY_ERR = 18;
-  const unsigned short ABORT_ERR = 25;
+  const unsigned short ABORT_ERR = 20;
   const unsigned short ENCODING_ERR = 26;
 
   readonly attribute unsigned short code;
 };
 
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -5169,16 +5169,94 @@ nsContentUtils::WrapNative(JSContext *cx
 
   if (push) {
     sThreadJSContextStack->Pop(nsnull);
   }
 
   return rv;
 }
 
+#ifdef DEBUG
+class DebugWrapperTraversalCallback : public nsCycleCollectionTraversalCallback
+{
+public:
+  DebugWrapperTraversalCallback(void* aWrapper) : mFound(PR_FALSE),
+                                                  mWrapper(aWrapper)
+  {
+    mFlags = WANT_ALL_TRACES;
+  }
+
+  NS_IMETHOD_(void) DescribeNode(CCNodeType type,
+                                 nsrefcnt refcount,
+                                 size_t objsz,
+                                 const char* objname)
+  {
+  }
+  NS_IMETHOD_(void) NoteXPCOMRoot(nsISupports *root)
+  {
+  }
+  NS_IMETHOD_(void) NoteRoot(PRUint32 langID, void* root,
+                             nsCycleCollectionParticipant* helper)
+  {
+  }
+  NS_IMETHOD_(void) NoteScriptChild(PRUint32 langID, void* child)
+  {
+    if (langID == nsIProgrammingLanguage::JAVASCRIPT) {
+      mFound = child == mWrapper;
+    }
+  }
+  NS_IMETHOD_(void) NoteXPCOMChild(nsISupports *child)
+  {
+  }
+  NS_IMETHOD_(void) NoteNativeChild(void* child,
+                                    nsCycleCollectionParticipant* helper)
+  {
+  }
+
+  NS_IMETHOD_(void) NoteNextEdgeName(const char* name)
+  {
+  }
+
+  PRBool mFound;
+
+private:
+  void* mWrapper;
+};
+
+static void
+DebugWrapperTraceCallback(PRUint32 langID, void *p, void *closure)
+{
+  DebugWrapperTraversalCallback* callback =
+    static_cast<DebugWrapperTraversalCallback*>(closure);
+  callback->NoteScriptChild(langID, p);
+}
+
+// static
+void
+nsContentUtils::CheckCCWrapperTraversal(nsISupports* aScriptObjectHolder,
+                                        nsWrapperCache* aCache)
+{
+  nsXPCOMCycleCollectionParticipant* participant;
+  CallQueryInterface(aScriptObjectHolder, &participant);
+
+  DebugWrapperTraversalCallback callback(aCache->GetWrapper());
+
+  participant->Traverse(aScriptObjectHolder, callback);
+  NS_ASSERTION(callback.mFound,
+               "Cycle collection participant didn't traverse to preserved "
+               "wrapper! This will probably crash.");
+
+  callback.mFound = PR_FALSE;
+  participant->Trace(aScriptObjectHolder, DebugWrapperTraceCallback, &callback);
+  NS_ASSERTION(callback.mFound,
+               "Cycle collection participant didn't trace preserved wrapper! "
+               "This will probably crash.");
+}
+#endif
+
 mozAutoRemovableBlockerRemover::mozAutoRemovableBlockerRemover(nsIDocument* aDocument)
 {
   mNestingLevel = nsContentUtils::GetRemovableScriptBlockerLevel();
   mDocument = aDocument;
   nsISupports* sink = aDocument ? aDocument->GetCurrentContentSink() : nsnull;
   mObserver = do_QueryInterface(sink);
   for (PRUint32 i = 0; i < mNestingLevel; ++i) {
     if (mObserver) {
--- a/content/base/src/nsDOMFileReader.cpp
+++ b/content/base/src/nsDOMFileReader.cpp
@@ -118,20 +118,16 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_
   NS_INTERFACE_MAP_ENTRY(nsITimerCallback)
   NS_INTERFACE_MAP_ENTRY(nsICharsetDetectionObserver)
   NS_INTERFACE_MAP_ENTRY_CONTENT_CLASSINFO(FileReader)
 NS_INTERFACE_MAP_END_INHERITING(nsXHREventTarget)
 
 NS_IMPL_ADDREF_INHERITED(nsDOMFileReader, nsXHREventTarget)
 NS_IMPL_RELEASE_INHERITED(nsDOMFileReader, nsXHREventTarget)
 
-static const PRUint32 FILE_AS_BINARY   = 1;
-static const PRUint32 FILE_AS_TEXT     = 2;
-static const PRUint32 FILE_AS_DATAURL  = 3;
-
 NS_IMETHODIMP
 nsDOMFileReader::GetOnloadend(nsIDOMEventListener** aOnloadend)
 {
   return GetInnerEventListener(mOnLoadEndListener, aOnloadend);
 }
 
 NS_IMETHODIMP
 nsDOMFileReader::SetOnloadend(nsIDOMEventListener* aOnloadend)
@@ -148,17 +144,17 @@ nsDOMFileReader::Notify(const char *aCha
   CopyASCIItoUTF16(aCharset, mCharset);
   return NS_OK;
 }
 
 //nsDOMFileReader constructors/initializers
 
 nsDOMFileReader::nsDOMFileReader()
   : mFileData(nsnull),
-    mDataLen(0), mDataFormat(0),
+    mDataLen(0), mDataFormat(FILE_AS_BINARY),
     mReadyState(nsIDOMFileReader::EMPTY),
     mProgressEventWasDelayed(PR_FALSE),
     mTimerIsActive(PR_FALSE),
     mReadTotal(0), mReadTransferred(0)
 {
   nsLayoutStatics::AddRef();
 }
 
@@ -449,46 +445,49 @@ nsDOMFileReader::OnStopRequest(nsIReques
 
   //Set the status field as appropriate
   if (NS_FAILED(aStatus)) {
     FreeFileData();
     DispatchError(aStatus);
     return NS_OK;
   }
 
-  nsresult rv;
+  nsresult rv = NS_OK;
   switch (mDataFormat) {
     case FILE_AS_BINARY:
       break; //Already accumulated mResult
     case FILE_AS_TEXT:
       rv = GetAsText(mCharset, mFileData, mDataLen, mResult);
       break;
     case FILE_AS_DATAURL:
       rv = GetAsDataURL(mFile, mFileData, mDataLen, mResult);
       break;
-    default:
-     return NS_ERROR_FAILURE;
   }
 
   FreeFileData();
 
+  if (NS_FAILED(rv)) {
+    DispatchError(rv);
+    return NS_OK;
+  }
+
   //Dispatch load event to signify end of a successful load
   DispatchProgressEvent(NS_LITERAL_STRING(LOAD_STR));
   DispatchProgressEvent(NS_LITERAL_STRING(LOADEND_STR));
 
-  return rv;
+  return NS_OK;
 }
 
 // Helper methods
 
 nsresult
 nsDOMFileReader::ReadFileContent(nsIDOMFile* aFile,
                                  const nsAString &aCharset,
-                                 PRUint32 aDataFormat)
-{ 
+                                 eDataFormat aDataFormat)
+{
   NS_ENSURE_TRUE(aFile, NS_ERROR_NULL_POINTER);
 
   //Implicit abort to clear any other activity going on
   Abort();
   mError = nsnull;
   SetDOMStringToNull(mResult);
   mReadTransferred = 0;
   mReadTotal = 0;
--- a/content/base/src/nsDOMFileReader.h
+++ b/content/base/src/nsDOMFileReader.h
@@ -106,17 +106,23 @@ public:
   // nsICharsetDetectionObserver
   NS_IMETHOD Notify(const char *aCharset, nsDetectionConfident aConf);
 
   void DispatchProgressEvent(const nsAString& aType);
 
   nsresult Init();
 
 protected:
-  nsresult ReadFileContent(nsIDOMFile *aFile, const nsAString &aCharset, PRUint32 aDataFormat); 
+  enum eDataFormat {
+    FILE_AS_BINARY,
+    FILE_AS_TEXT,
+    FILE_AS_DATAURL
+  };
+
+  nsresult ReadFileContent(nsIDOMFile *aFile, const nsAString &aCharset, eDataFormat aDataFormat); 
   nsresult GetAsText(const nsAString &aCharset,
                      const char *aFileData, PRUint32 aDataLen, nsAString &aResult);
   nsresult GetAsDataURL(nsIFile *aFile, const char *aFileData, PRUint32 aDataLen, nsAString &aResult); 
   nsresult GuessCharset(const char *aFileData, PRUint32 aDataLen, nsACString &aCharset); 
   nsresult ConvertStream(const char *aFileData, PRUint32 aDataLen, const char *aCharset, nsAString &aResult); 
   void DispatchError(nsresult rv);
   void StartProgressEventTimer();
 
@@ -125,17 +131,18 @@ protected:
     mFileData = nsnull;
     mDataLen = 0;
   }
 
   char *mFileData;
   nsCOMPtr<nsIFile> mFile;
   nsString mCharset;
   PRUint32 mDataLen;
-  PRUint32 mDataFormat;
+
+  eDataFormat mDataFormat;
 
   nsString mResult;
   PRUint16 mReadyState;
 
   PRBool mProgressEventWasDelayed;
   PRBool mTimerIsActive;
   nsCOMPtr<nsIDOMFileError> mError;
 
--- a/content/base/test/unit/test_error_codes.js
+++ b/content/base/test/unit/test_error_codes.js
@@ -53,17 +53,17 @@ var asyncXHR = {
     var request = event.target.channel.QueryInterface(Components.interfaces.nsIRequest);
     do_check_eq(request.status, gExpectedStatus);
     gNextTestFunc();
   }
 }
 
 function run_test() {
   do_test_pending();
-  do_timeout(0, "run_test_pt1()");
+  do_timeout(0, run_test_pt1);
 }
 
 // network offline
 function run_test_pt1() {
   var ioService = Components.classes["@mozilla.org/network/io-service;1"]
                             .getService(Components.interfaces.nsIIOService);
 
   try {
--- a/content/events/src/nsContentEventHandler.cpp
+++ b/content/events/src/nsContentEventHandler.cpp
@@ -225,17 +225,19 @@ static nsresult GenerateFlatTextContent(
   NS_ASSERTION(iter, "NS_NewContentIterator succeeded, but the result is null");
   nsCOMPtr<nsIDOMRange> domRange(do_QueryInterface(aRange));
   NS_ASSERTION(domRange, "aRange doesn't have nsIDOMRange!");
   iter->Init(domRange);
 
   NS_ASSERTION(aString.IsEmpty(), "aString must be empty string");
 
   nsINode* startNode = aRange->GetStartParent();
+  NS_ENSURE_TRUE(startNode, NS_ERROR_FAILURE);
   nsINode* endNode = aRange->GetEndParent();
+  NS_ENSURE_TRUE(endNode, NS_ERROR_FAILURE);
 
   if (startNode == endNode && startNode->IsNodeOfType(nsINode::eTEXT)) {
     nsIContent* content = static_cast<nsIContent*>(startNode);
     AppendSubString(aString, content, aRange->StartOffset(),
                     aRange->EndOffset() - aRange->StartOffset());
     ConvertToNativeNewlines(aString);
     return NS_OK;
   }
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -1762,23 +1762,30 @@ nsDOMClassInfo::~nsDOMClassInfo()
 {
   if (IS_EXTERNAL(mData->mCachedClassInfo)) {
     // Some compilers don't like delete'ing a const nsDOMClassInfo*
     nsDOMClassInfoData* data = const_cast<nsDOMClassInfoData*>(mData);
     delete static_cast<nsExternalDOMClassInfoData*>(data);
   }
 }
 
+NS_DEFINE_STATIC_IID_ACCESSOR(nsDOMClassInfo, NS_DOMCLASSINFO_IID)
+
 NS_IMPL_ADDREF(nsDOMClassInfo)
 NS_IMPL_RELEASE(nsDOMClassInfo)
 
 NS_INTERFACE_MAP_BEGIN(nsDOMClassInfo)
   NS_INTERFACE_MAP_ENTRY(nsIXPCScriptable)
   NS_INTERFACE_MAP_ENTRY(nsIClassInfo)
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIXPCScriptable)
+  if (aIID.Equals(NS_GET_IID(nsDOMClassInfo))) {
+    *aInstancePtr = static_cast<nsIXPCScriptable*>(this);
+    return NS_OK;
+  }
+  else
 NS_INTERFACE_MAP_END
 
 
 static JSClass sDOMConstructorProtoClass = {
   "DOM Constructor.prototype", 0,
   JS_PropertyStub, JS_PropertyStub, JS_PropertyStub, JS_PropertyStub,
   JS_EnumerateStub, JS_ResolveStub, JS_ConvertStub, nsnull
 };
@@ -4449,20 +4456,23 @@ nsDOMClassInfo::GetClassInfoInstance(nsD
 
   return GET_CLEAN_CI_PTR(aData->mCachedClassInfo);
 }
 
 // static
 void
 nsDOMClassInfo::PreserveNodeWrapper(nsIXPConnectWrappedNative *aWrapper)
 {
-  nsWrapperCache* cache = nsnull;
-  CallQueryInterface(aWrapper->Native(), &cache);
-  if (cache) {
-    nsContentUtils::PreserveWrapper(aWrapper->Native(), cache);
+  nsCOMPtr<nsIClassInfo> ci = do_QueryInterface(aWrapper->Native());
+  if (ci) {
+    nsDOMClassInfo* domci = nsnull;
+    CallQueryInterface(ci, &domci);
+    if (domci) {
+      domci->PreserveWrapper(aWrapper->Native());
+    }
   }
 }
 
 
 // static
 void
 nsDOMClassInfo::ShutDown()
 {
@@ -7231,36 +7241,34 @@ nsNodeSH::PreCreate(nsISupports *nativeO
     NS_SUCCESS_CHROME_ACCESS_ONLY :
     (slimWrappers ? NS_SUCCESS_ALLOW_SLIM_WRAPPERS : NS_OK);
 }
 
 NS_IMETHODIMP
 nsNodeSH::AddProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                       JSObject *obj, jsval id, jsval *vp, PRBool *_retval)
 {
-  nsINode* node = static_cast<nsINode*>(GetNative(wrapper, obj));
-  nsContentUtils::PreserveWrapper(node, node);
+  nsNodeSH::PreserveWrapper(GetNative(wrapper, obj));
   return nsEventReceiverSH::AddProperty(wrapper, cx, obj, id, vp, _retval);
 }
 
 NS_IMETHODIMP
 nsNodeSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                      JSObject *obj, jsval id, PRUint32 flags,
                      JSObject **objp, PRBool *_retval)
 {
   if ((id == sBaseURIObject_id || id == sNodePrincipal_id) &&
       IsPrivilegedScript()) {
     return DefineVoidProp(cx, obj, id, objp);
   }
 
   if (id == sOnload_id || id == sOnerror_id) {
     // Make sure that this node can't go away while waiting for a
     // network load that could fire an event handler.
-    nsINode* node = static_cast<nsINode*>(GetNative(wrapper, obj));
-    nsContentUtils::PreserveWrapper(node, node);
+    nsNodeSH::PreserveWrapper(GetNative(wrapper, obj));
   }
 
   return nsEventReceiverSH::NewResolve(wrapper, cx, obj, id, flags, objp,
                                        _retval);
 }
 
 NS_IMETHODIMP
 nsNodeSH::GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
@@ -7321,16 +7329,23 @@ nsNodeSH::SetProperty(nsIXPConnectWrappe
 NS_IMETHODIMP
 nsNodeSH::GetFlags(PRUint32 *aFlags)
 {
   *aFlags = DOMCLASSINFO_STANDARD_FLAGS | nsIClassInfo::CONTENT_NODE;
 
   return NS_OK;
 }
 
+void
+nsNodeSH::PreserveWrapper(nsISupports *aNative)
+{
+  nsINode *node = static_cast<nsINode*>(aNative);
+  nsContentUtils::PreserveWrapper(aNative, node);
+}
+
 // EventReceiver helper
 
 // static
 PRBool
 nsEventReceiverSH::ReallyIsEventName(jsval id, jschar aFirstChar)
 {
   // I wonder if this is faster than using a hash...
 
@@ -7689,23 +7704,28 @@ nsEventTargetSH::NewResolve(nsIXPConnect
 NS_IMETHODIMP
 nsEventTargetSH::AddProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                              JSObject *obj, jsval id, jsval *vp, PRBool *_retval)
 {
   if (id == sAddEventListener_id) {
     return NS_OK;
   }
 
-  nsISupports *target = GetNative(wrapper, obj);
-  nsContentUtils::PreserveWrapper(target,
-                                  nsXHREventTarget::FromSupports(target));
+  nsEventTargetSH::PreserveWrapper(GetNative(wrapper, obj));
 
   return NS_OK;
 }
 
+void
+nsEventTargetSH::PreserveWrapper(nsISupports *aNative)
+{
+  nsXHREventTarget *target = nsXHREventTarget::FromSupports(aNative);
+  nsContentUtils::PreserveWrapper(aNative, target);
+}
+
 
 // Element helper
 
 static PRBool
 GetBindingURL(nsIContent *aContent, nsIDocument *aDocument,
               nsCSSValue::URL **aResult)
 {
   // If we have a frame the frame has already loaded the binding.  And
--- a/dom/base/nsDOMClassInfo.h
+++ b/dom/base/nsDOMClassInfo.h
@@ -97,20 +97,26 @@ typedef PRUptrdiff PtrBits;
 // To be used with the nsDOMClassInfoData::mCachedClassInfo pointer.
 // The low bit is set when we created a generic helper for an external
 // (which holds on to the nsDOMClassInfoData).
 #define GET_CLEAN_CI_PTR(_ptr) (nsIClassInfo*)(PtrBits(_ptr) & ~0x1)
 #define MARK_EXTERNAL(_ptr) (nsIClassInfo*)(PtrBits(_ptr) | 0x1)
 #define IS_EXTERNAL(_ptr) (PtrBits(_ptr) & 0x1)
 
 
+#define NS_DOMCLASSINFO_IID   \
+{ 0x7da6858c, 0x5c12, 0x4588, \
+ { 0x82, 0xbe, 0x01, 0xa2, 0x45, 0xc5, 0xc0, 0xb0 } }
+
 class nsDOMClassInfo : public nsIXPCScriptable,
                        public nsIClassInfo
 {
 public:
+  NS_DECLARE_STATIC_IID_ACCESSOR(NS_DOMCLASSINFO_IID)
+
   nsDOMClassInfo(nsDOMClassInfoData* aData);
   virtual ~nsDOMClassInfo();
 
   NS_DECL_NSIXPCSCRIPTABLE
 
   NS_DECL_ISUPPORTS
 
   NS_DECL_NSICLASSINFO
@@ -212,16 +218,20 @@ public:
     return sXPConnect;
   }
 
 protected:
   friend nsIClassInfo* NS_GetDOMClassInfoInstance(nsDOMClassInfoID aID);
 
   const nsDOMClassInfoData* mData;
 
+  virtual void PreserveWrapper(nsISupports *aNative)
+  {
+  }
+
   static nsresult Init();
   static nsresult RegisterClassName(PRInt32 aDOMClassInfoID);
   static nsresult RegisterClassProtos(PRInt32 aDOMClassInfoID);
   static nsresult RegisterExternalClasses();
   nsresult ResolveConstructor(JSContext *cx, JSObject *obj,
                               JSObject **objp);
 
   // Checks if id is a number and returns the number, if aIsNumber is
@@ -470,16 +480,18 @@ public:
   NS_IMETHOD PreCreate(nsISupports *nativeObj, JSContext *cx,
                        JSObject *globalObj, JSObject **parentObj);
   NS_IMETHOD NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                         JSObject *obj, jsval id, PRUint32 flags,
                         JSObject **objp, PRBool *_retval);
   NS_IMETHOD AddProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                          JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
 
+  virtual void PreserveWrapper(nsISupports *aNative);
+
   static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
   {
     return new nsEventTargetSH(aData);
   }
 };
 
 // Window scriptable helper
 
@@ -653,16 +665,18 @@ public:
                         JSObject *obj, jsval id, PRUint32 flags,
                         JSObject **objp, PRBool *_retval);
   NS_IMETHOD GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                          JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
   NS_IMETHOD SetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                          JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
   NS_IMETHOD GetFlags(PRUint32 *aFlags);
 
+  virtual void PreserveWrapper(nsISupports *aNative);
+
   static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
   {
     return new nsNodeSH(aData);
   }
 };
 
 
 // Element helper
--- a/dom/interfaces/geolocation/nsIDOMGeoPositionAddress.idl
+++ b/dom/interfaces/geolocation/nsIDOMGeoPositionAddress.idl
@@ -32,21 +32,21 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 
 #include "domstubs.idl"
 
-[scriptable, uuid(98808DEB-C8E4-422C-BA97-08BF2031464C)]
+[scriptable, uuid(0DF49C5C-9845-42F9-A76C-62E09C110986)]
 interface nsIDOMGeoPositionAddress : nsISupports
 {
-  readonly attribute string streetNumber;
-  readonly attribute string street;
-  readonly attribute string premises;
-  readonly attribute string city;
-  readonly attribute string county;
-  readonly attribute string region;
-  readonly attribute string country;
-  readonly attribute string countryCode;
-  readonly attribute string postalCode;
+  readonly attribute DOMString streetNumber;
+  readonly attribute DOMString street;
+  readonly attribute DOMString premises;
+  readonly attribute DOMString city;
+  readonly attribute DOMString county;
+  readonly attribute DOMString region;
+  readonly attribute DOMString country;
+  readonly attribute DOMString countryCode;
+  readonly attribute DOMString postalCode;
 };
--- a/editor/idl/nsIPlaintextEditor.idl
+++ b/editor/idl/nsIPlaintextEditor.idl
@@ -51,16 +51,17 @@ interface nsIPlaintextEditor : nsISuppor
   const long eEditorDisabledMask        = 0x0010; /* all events are disabled (like scrolling).  Editor will not accept focus. */
   const long eEditorFilterInputMask     = 0x0020; /* text input is limited to certain character types, use mFilter */
   const long eEditorMailMask            = 0x0040; /* use mail-compose editing rules */
   const long eEditorUseAsyncUpdatesMask = 0x0080; /* prevent immediate reflows and view refreshes */
   const long eEditorEnableWrapHackMask  = 0x0100; /* allow the editor to set font: monospace on the root node */
   const long eEditorWidgetMask          = 0x0200; /* bit for widgets */
   const long eEditorNoCSSMask           = 0x0400; /* this HTML editor should not create css styles */
   const long eEditorAllowInteraction    = 0x0800; /*  */
+  const long eEditorDontEchoPassword    = 0x1000;
 
   /*
    * The valid values for newlines handling.
    * Can't change the values unless we remove
    * use of the pref.
    */
   const long eNewlinesPasteIntact                = 0;
   const long eNewlinesPasteToFirst               = 1;
--- a/editor/libeditor/text/nsTextEditRules.cpp
+++ b/editor/libeditor/text/nsTextEditRules.cpp
@@ -515,16 +515,48 @@ nsTextEditRules::DidInsertBreak(nsISelec
     if (NS_FAILED(res)) return res;
     selPrivate->SetInterlinePosition(PR_TRUE);
     res = aSelection->Collapse(selNode, selOffset);
     if (NS_FAILED(res)) return res;
   }
   return res;
 }
 
+static inline already_AddRefed<nsIDOMNode>
+GetTextNode(nsISelection *selection, nsEditor *editor) {
+  PRInt32 selOffset;
+  nsCOMPtr<nsIDOMNode> selNode;
+  nsresult res = editor->GetStartNodeAndOffset(selection, address_of(selNode), &selOffset);
+  if (NS_FAILED(res)) return nsnull;
+  if (!editor->IsTextNode(selNode)) {
+    // Get an nsINode from the nsIDOMNode
+    nsCOMPtr<nsINode> node = do_QueryInterface(selNode);
+    // if node is null, return it to indicate there's no text
+    if (!node) return nsnull;
+    // This should be the root node, walk the tree looking for text nodes
+    nsNodeIterator iter(node, nsIDOMNodeFilter::SHOW_TEXT, nsnull, PR_TRUE);
+    while (!editor->IsTextNode(selNode)) {
+      if (NS_FAILED(res = iter.NextNode(getter_AddRefs(selNode))) || !selNode) {
+        return nsnull;
+      }
+    }
+  }
+  return selNode.forget();
+}
+#ifdef DEBUG
+#define ASSERT_PASSWORD_LENGTHS_EQUAL()                                \
+  if (mFlags & nsIPlaintextEditor::eEditorPasswordMask) {              \
+    PRInt32 txtLen;                                                    \
+    mEditor->GetTextLength(&txtLen);                                   \
+    NS_ASSERTION(mPasswordText.Length() == txtLen,                     \
+                 "password length not equal to number of asterisks");  \
+  }
+#else
+#define ASSERT_PASSWORD_LENGTHS_EQUAL()
+#endif
 
 nsresult
 nsTextEditRules::WillInsertText(PRInt32          aAction,
                                 nsISelection *aSelection, 
                                 PRBool          *aCancel,
                                 PRBool          *aHandled,
                                 const nsAString *inString,
                                 nsAString *outString,
@@ -667,20 +699,19 @@ nsTextEditRules::WillInsertText(PRInt32 
   }
 
   if (mFlags & nsIPlaintextEditor::eEditorPasswordMask)
   {
     // manage the password buffer
     mPasswordText.Insert(*outString, start);
 
     nsCOMPtr<nsILookAndFeel> lookAndFeel = do_GetService(kLookAndFeelCID);
-    if (lookAndFeel->GetEchoPassword()) {
-      if (mPasswordText.Length() > outString->Length()) {
-        HideLastPWInput();
-      }
+    if (lookAndFeel->GetEchoPassword() && 
+        !(mFlags & nsIPlaintextEditor::eEditorDontEchoPassword)) {
+      HideLastPWInput();
       mLastStart = start;
       mLastLength = outString->Length();
       if (mTimer)
       {
         mTimer->Cancel();
       }
       else
       {
@@ -857,16 +888,17 @@ nsTextEditRules::WillInsertText(PRInt32 
       
       // Make the caret attach to the inserted text, unless this text ends with a LF, 
       // in which case make the caret attach to the next line.
       PRBool endsWithLF = !tString.IsEmpty() && tString.get()[tString.Length() - 1] == nsCRT::LF;
       nsCOMPtr<nsISelectionPrivate>selPrivate(do_QueryInterface(aSelection));
       selPrivate->SetInterlinePosition(endsWithLF);
     }
   }
+  ASSERT_PASSWORD_LENGTHS_EQUAL()
   return res;
 }
 
 nsresult
 nsTextEditRules::DidInsertText(nsISelection *aSelection, 
                                nsresult aResult)
 {
   return DidInsert(aSelection, aResult);
@@ -937,16 +969,28 @@ nsTextEditRules::WillDeleteSelection(nsI
   {
     res = mEditor->ExtendSelectionForDelete(aSelection, &aCollapsedAction);
     NS_ENSURE_SUCCESS(res, res);
 
     // manage the password buffer
     PRUint32 start, end;
     mEditor->GetTextSelectionOffsets(aSelection, start, end);
     NS_ENSURE_SUCCESS(res, res);
+    nsCOMPtr<nsILookAndFeel> lookAndFeel = do_GetService(kLookAndFeelCID);
+
+    if (lookAndFeel->GetEchoPassword()) {
+      HideLastPWInput();
+      mLastStart = start;
+      mLastLength = 0;
+      if (mTimer)
+      {
+        mTimer->Cancel();
+      }
+    }
+
     if (end == start)
     { // collapsed selection
       if (nsIEditor::ePrevious==aCollapsedAction && 0<start) { // del back
         mPasswordText.Cut(start-1, 1);
       }
       else if (nsIEditor::eNext==aCollapsedAction) {      // del forward
         mPasswordText.Cut(start, 1);
       }
@@ -978,16 +1022,17 @@ nsTextEditRules::WillDeleteSelection(nsI
     res = mEditor->ExtendSelectionForDelete(aSelection, &aCollapsedAction);
     NS_ENSURE_SUCCESS(res, res);
   }
 
   res = mEditor->DeleteSelectionImpl(aCollapsedAction);
   NS_ENSURE_SUCCESS(res, res);
 
   *aHandled = PR_TRUE;
+  ASSERT_PASSWORD_LENGTHS_EQUAL()
   return NS_OK;
 }
 
 nsresult
 nsTextEditRules::DidDeleteSelection(nsISelection *aSelection, 
                                     nsIEditor::EDirection aCollapsedAction, 
                                     nsresult aResult)
 {
@@ -1396,48 +1441,46 @@ nsTextEditRules::RemoveIMETextFromPWBuf(
     aStart = mPasswordIMEIndex;
   }
 
   mPasswordIMEText.Assign(*aIMEString);
   return NS_OK;
 }
 
 NS_IMETHODIMP nsTextEditRules::Notify(class nsITimer *) {
-  return HideLastPWInput();
+  nsresult res = HideLastPWInput();
+  ASSERT_PASSWORD_LENGTHS_EQUAL();
+  mLastLength = 0;
+  return res;
 }
 
 nsresult nsTextEditRules::HideLastPWInput() {
-  nsCOMPtr<nsIDOMNode> selNode;
+  if (!mLastLength) {
+    // Special case, we're trying to replace a range that no longer exists
+    return NS_OK;
+  }
+
+  nsAutoString hiddenText;
+  FillBufWithPWChars(&hiddenText, mLastLength);
+
   nsCOMPtr<nsISelection> selection;
-  PRInt32 selOffset;
   PRUint32 start, end;
   nsresult res = mEditor->GetSelection(getter_AddRefs(selection));
   if (NS_FAILED(res)) return res;
   res = mEditor->GetTextSelectionOffsets(selection, start, end);
   if (NS_FAILED(res)) return res;
-  res = mEditor->GetStartNodeAndOffset(selection, address_of(selNode), &selOffset);
-  if (NS_FAILED(res)) return res;
-  if (!mEditor->IsTextNode(selNode)) {
-    // Get an nsINode from the nsIDOMNode
-    nsCOMPtr<nsINode> node = do_QueryInterface(selNode);
-    // if node is null, return NS_OK because there's no text to hide
-    if (!node) return NS_OK;
-    // This should be the root node, walk the tree looking for text nodes
-    nsNodeIterator iter(node, nsIDOMNodeFilter::SHOW_TEXT, nsnull, PR_TRUE);
-    while (!mEditor->IsTextNode(selNode)) {
-      if (NS_FAILED(res = iter.NextNode(getter_AddRefs(selNode))) || 
-          selNode == nsnull) {
-        return NS_SUCCEEDED(res) ? NS_ERROR_NULL_POINTER : res;
-      }
-    }
-  }
+
+  nsCOMPtr<nsIDOMNode> selNode = GetTextNode(selection, mEditor);
+  if (!selNode)
+    return NS_OK;
+  
   nsCOMPtr<nsIDOMCharacterData> nodeAsText(do_QueryInterface(selNode));
-  if (!nodeAsText) return NS_ERROR_FAILURE;
-  nsAutoString hiddenText;
-  FillBufWithPWChars(&hiddenText, mLastLength);
+  if (!nodeAsText)
+    return NS_OK;
+  
   nodeAsText->ReplaceData(mLastStart, mLastLength, hiddenText);
   selection->Collapse(selNode, start);
   if (start != end)
     selection->Extend(selNode, end);
   return NS_OK;
 }
 
 nsresult
--- a/extensions/cookie/test/unit/test_permmanager_expiration.js
+++ b/extensions/cookie/test/unit/test_permmanager_expiration.js
@@ -27,25 +27,25 @@ function run_test() {
   pm.add(permURI, "test/expiration-perm-nexp", 1, pm.EXPIRE_NEVER, 0);
 
   // check that the second two haven't expired yet
   do_check_eq(1, pm.testPermission(permURI, "test/expiration-perm-exp3"));
   do_check_eq(1, pm.testPermission(permURI, "test/expiration-perm-nexp"));
 
   // ... and the first one has
   do_test_pending();
-  do_timeout(10, "verifyFirstExpiration();");
+  do_timeout(10, verifyFirstExpiration);
 
   // ... and that the short-term one will
   do_test_pending();
-  do_timeout(200, "verifyExpiration();");
+  do_timeout(200, verifyExpiration);
 
   // clean up
   do_test_pending();
-  do_timeout(300, "end_test();");
+  do_timeout(300, end_test);
 }
 
 function verifyFirstExpiration() { 
   do_check_eq(0, pm.testPermission(permURI, "test/expiration-perm-exp"));
   do_test_finished();
 }
 
 function verifyExpiration() { 
--- a/extensions/cookie/test/unit/test_permmanager_notifications.js
+++ b/extensions/cookie/test/unit/test_permmanager_notifications.js
@@ -109,14 +109,14 @@ function run_test() {
   pm.add(permURI, "test/permission-notify", pm.DENY_ACTION);
 
   do_test_pending(); // for 'deleted' notification
   pm.remove(permURI.asciiHost, "test/permission-notify");
 
   do_test_pending(); // for 'cleared' notification
   pm.removeAll();
 
-  do_timeout(100, "cleanup();");
+  do_timeout(100, cleanup);
 }
 
 function cleanup() {
   obs.removeObserver(observer, "perm-changed");
 }
--- a/gfx/src/thebes/nsSystemFontsGTK2.cpp
+++ b/gfx/src/thebes/nsSystemFontsGTK2.cpp
@@ -216,17 +216,17 @@ nsSystemFontsGTK2::GetSystemFontInfo(Gtk
     aFontStyle->stretch = NS_FONT_STRETCH_NORMAL;
 
     float size = float(pango_font_description_get_size(desc)) / PANGO_SCALE;
 
     // |size| is now either pixels or pango-points (not Mozilla-points!)
 
     if (!MOZ_pango_font_description_get_size_is_absolute(desc)) {
         // |size| is in pango-points, so convert to pixels.
-        size *= float(gfxPlatformGtk::GetPlatformDPI()) / POINTS_PER_INCH_FLOAT;
+        size *= float(gfxPlatform::GetDPI()) / POINTS_PER_INCH_FLOAT;
     }
 
     // |size| is now pixels
 
     aFontStyle->size = size;
   
     pango_font_description_free(desc);
 
--- a/gfx/src/thebes/nsSystemFontsQt.cpp
+++ b/gfx/src/thebes/nsSystemFontsQt.cpp
@@ -74,17 +74,17 @@ nsSystemFontsQt::GetSystemFontInfo(const
     aFontStyle->style = FONT_STYLE_NORMAL;
     aFontStyle->systemFont = PR_TRUE;
     NS_NAMED_LITERAL_STRING(quote, "\"");
     nsString family((PRUnichar*)qFont.family().data());
     *aFontName = quote + family + quote;
     aFontStyle->weight = qFont.weight();
     // FIXME: Set aFontStyle->stretch correctly!
     aFontStyle->stretch = NS_FONT_STRETCH_NORMAL;
-    aFontStyle->size = qFont.pointSizeF() * float(gfxQtPlatform::GetPlatformDPI()) / 72.0f;
+    aFontStyle->size = qFont.pointSizeF() * float(gfxPlatform::GetDPI()) / 72.0f;
     return NS_OK;
 }
 
 
 nsresult
 nsSystemFontsQt::GetSystemFont(nsSystemFontID anID, nsString *aFontName,
                                  gfxFontStyle *aFontStyle) const
 {
--- a/gfx/thebes/public/gfxPlatformGtk.h
+++ b/gfx/thebes/public/gfxPlatformGtk.h
@@ -124,41 +124,18 @@ public:
 #ifndef MOZ_PANGO
     FT_Library GetFTLibrary();
 #endif
 
     void SetGdkDrawable(gfxASurface *target,
                         GdkDrawable *drawable);
     GdkDrawable *GetGdkDrawable(gfxASurface *target);
 
-    static PRInt32 GetPlatformDPI() {
-        if (sPlatformDPI < 0) {
-            gfxPlatformGtk::GetPlatform()->InitDisplayCaps();
-        }
-        NS_ASSERTION(sPlatformDPI > 0, "Something is wrong");
-        return sPlatformDPI;
-    }
-
-#ifdef MOZ_PLATFORM_HILDON
-    static PRInt32 GetMaemoClassic() {
-        if (sMaemoClassic < 0) {
-            gfxPlatformGtk::GetPlatform()->InitDisplayCaps();
-        }
-        NS_ASSERTION(sMaemoClassic > 0, "Something is wrong");
-        return sMaemoClassic == 1;
-    }
-#endif
-
 protected:
     void InitDisplayCaps();
 
-    static PRInt32 sPlatformDPI;
     static gfxFontconfigUtils *sFontconfigUtils;
 
-#ifdef MOZ_PLATFORM_HILDON
-    static PRInt32 sMaemoClassic;
-#endif
-
 private:
     virtual qcms_profile *GetPlatformCMSOutputProfile();
 };
 
 #endif /* GFX_PLATFORM_GTK_H */
--- a/gfx/thebes/public/gfxQtPlatform.h
+++ b/gfx/thebes/public/gfxQtPlatform.h
@@ -80,20 +80,16 @@ public:
     FontFamily *FindFontFamily(const nsAString& aName);
     FontEntry *FindFontEntry(const nsAString& aFamilyName, const gfxFontStyle& aFontStyle);
     already_AddRefed<gfxFont> FindFontForChar(PRUint32 aCh, gfxFont *aFont);
     PRBool GetPrefFontEntries(const nsCString& aLangGroup, nsTArray<nsRefPtr<FontEntry> > *aFontEntryList);
     void SetPrefFontEntries(const nsCString& aLangGroup, nsTArray<nsRefPtr<FontEntry> >& aFontEntryList);
 
     FT_Library GetFTLibrary();
 
-    static PRInt32 GetPlatformDPI() {
-        return 96;
-    }
-
 protected:
     static gfxFontconfigUtils *sFontconfigUtils;
 
 private:
     virtual qcms_profile *GetPlatformCMSOutputProfile();
 };
 
 #endif /* GFX_PLATFORM_QT_H */
--- a/gfx/thebes/src/gfxFT2Utils.cpp
+++ b/gfx/thebes/src/gfxFT2Utils.cpp
@@ -40,17 +40,17 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "gfxFT2FontBase.h"
 #include "gfxFT2Utils.h"
 #include FT_TRUETYPE_TAGS_H
 #include FT_TRUETYPE_TABLES_H
 
-#ifdef CAIRO_HAS_FC_FONT
+#ifdef HAVE_FONTCONFIG_FCFREETYPE_H
 #include <fontconfig/fcfreetype.h>
 #endif
 
 // aScale is intended for a 16.16 x/y_scale of an FT_Size_Metrics
 static inline FT_Long
 ScaleRoundDesignUnits(FT_Short aDesignMetric, FT_Fixed aScale)
 {
     FT_Long fixed26dot6 = FT_MulFix(aDesignMetric, aScale);
@@ -300,17 +300,17 @@ gfxFT2LockedFace::GetMetrics(gfxFont::Me
 }
 
 PRUint32
 gfxFT2LockedFace::GetGlyph(PRUint32 aCharCode)
 {
     if (NS_UNLIKELY(!mFace))
         return 0;
 
-#ifdef CAIRO_HAS_FC_FONT
+#ifdef HAVE_FONTCONFIG_FCFREETYPE_H
     // FcFreeTypeCharIndex will search starting from the most recently
     // selected charmap.  This can cause non-determistic behavior when more
     // than one charmap supports a character but with different glyphs, as
     // with older versions of MS Gothic, for example.  Always prefer a Unicode
     // charmap, if there is one.  (FcFreeTypeCharIndex usually does the
     // appropriate Unicode conversion, but some fonts have non-Roman glyphs
     // for FT_ENCODING_APPLE_ROMAN characters.)
     if (!mFace->charmap || mFace->charmap->encoding != FT_ENCODING_UNICODE) {
--- a/gfx/thebes/src/gfxPangoFonts.cpp
+++ b/gfx/thebes/src/gfxPangoFonts.cpp
@@ -704,17 +704,17 @@ gfx_pango_fc_font_describe(PangoFont *fo
     gfxPangoFcFont *self = GFX_PANGO_FC_FONT(font);
     PangoFcFont *fcFont = &self->parent_instance;
     PangoFontDescription *result =
         pango_font_description_copy(fcFont->description);
 
     gfxFcFont *gfxFont = gfxPangoFcFont::GfxFont(self);
     if (gfxFont) {
         double pixelsize = gfxFont->GetStyle()->size;
-        double dpi = gfxPlatformGtk::GetPlatformDPI();
+        double dpi = gfxPlatform::GetDPI();
         gint size = moz_pango_units_from_double(pixelsize * dpi / 72.0);
         pango_font_description_set_size(result, size);
     }
     return result;
 }
 
 static PangoFontDescription *
 gfx_pango_fc_font_describe_absolute(PangoFont *font)
@@ -1701,18 +1701,18 @@ gfx_pango_font_map_load_fontset(PangoFon
     return gfxPangoFontset::NewFontset(fontGroup, language);
 }
 
 static double
 gfx_pango_font_map_get_resolution(PangoFcFontMap *fcfontmap,
                                   PangoContext *context)
 {
     // This merely enables the FC_SIZE field of the pattern to be accurate.
-    // We use gfxPlatformGtk::GetPlatformDPI() much of the time...
-    return gfxPlatformGtk::GetPlatformDPI();
+    // We use gfxPlatform::GetDPI() much of the time...
+    return gfxPlatform::GetDPI();
 }
 
 #ifdef MOZ_WIDGET_GTK2
 static void ApplyGdkScreenFontOptions(FcPattern *aPattern);
 #endif
 
 // Apply user settings and defaults to pattern in preparation for matching.
 static void
--- a/gfx/thebes/src/gfxPlatformGtk.cpp
+++ b/gfx/thebes/src/gfxPlatformGtk.cpp
@@ -86,22 +86,16 @@
 
 #define GDK_PIXMAP_SIZE_MAX 32767
 
 #ifndef MOZ_PANGO
 #include <ft2build.h>
 #include FT_FREETYPE_H
 #endif
 
-#ifdef MOZ_PLATFORM_HILDON
-#include "nsIPropertyBag2.h"
-PRInt32 gfxPlatformGtk::sMaemoClassic = -1;
-#endif
-
-PRInt32 gfxPlatformGtk::sPlatformDPI = -1;
 gfxFontconfigUtils *gfxPlatformGtk::sFontconfigUtils = nsnull;
 
 #ifndef MOZ_PANGO
 typedef nsDataHashtable<nsStringHashKey, nsRefPtr<FontFamily> > FontTable;
 typedef nsDataHashtable<nsCStringHashKey, nsTArray<nsRefPtr<FontEntry> > > PrefFontTable;
 static FontTable *gPlatformFonts = NULL;
 static FontTable *gPlatformFontAliases = NULL;
 static PrefFontTable *gPrefFonts = NULL;
@@ -524,51 +518,20 @@ gfxPlatformGtk::CreateFontGroup(const ns
     return new gfxFT2FontGroup(aFamilies, aStyle);
 }
 
 #endif
 
 void
 gfxPlatformGtk::InitDisplayCaps()
 {
+    // Make sure init is run so we have a resolution
     GdkScreen *screen = gdk_screen_get_default();
-    gtk_settings_get_for_screen(screen); // Make sure init is run so we have a resolution
-    gfxPlatformGtk::sPlatformDPI = PRInt32(round(gdk_screen_get_resolution(screen)));
-
-    if (gfxPlatformGtk::sPlatformDPI <= 0) {
-        // Fall back to something sane
-        gfxPlatformGtk::sPlatformDPI = 96;
-    }
-
-#ifdef MOZ_PLATFORM_HILDON
-    // Check the cached value
-    if (gfxPlatform::sDPI == -1) {
-        nsresult rv;
-        nsCOMPtr<nsIPropertyBag2> infoService = do_GetService("@mozilla.org/system-info;1", &rv);
-        if (NS_FAILED(rv)) {
-            NS_ASSERTION(infoService, "Could not find a system info service");
-            return;
-        }
-        nsCString deviceType;
-        rv = infoService->GetPropertyAsACString(NS_LITERAL_STRING("device"), deviceType);
-        if (NS_SUCCEEDED(rv)) {
-          if (deviceType.EqualsLiteral("Nokia N900")) {
-              gfxPlatform::sDPI = 265; // It's an N900
-              gfxPlatformGtk::sMaemoClassic = 0;
-          }
-          else if (deviceType.EqualsLiteral("Nokia N8xx")) {
-              gfxPlatform::sDPI = 225; // It's an N810/N800
-              gfxPlatformGtk::sMaemoClassic = 1;
-          }
-        }
-    }
-#else
-    gfxPlatform::sDPI = gfxPlatformGtk::sPlatformDPI;
-#endif
-
+    gtk_settings_get_for_screen(screen);
+    gfxPlatform::sDPI = PRInt32(round(gdk_screen_get_resolution(screen)));
     if (gfxPlatform::sDPI <= 0) {
         // Fall back to something sane
         gfxPlatform::sDPI = 96;
     } else {
         // Minimum DPI is 96
         gfxPlatform::sDPI = PR_MAX(sDPI, 96);
     }
 }
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -2580,17 +2580,17 @@ AssertValidPropertyCacheHit(JSContext *c
     } else if (PCVAL_IS_SPROP(entry->vword)) {
         JS_ASSERT(PCVAL_TO_SPROP(entry->vword) == sprop);
         JS_ASSERT_IF(sprop->isMethod(),
                      sprop->methodValue() == LOCKED_OBJ_GET_SLOT(pobj, sprop->slot));
     } else {
         jsval v;
         JS_ASSERT(PCVAL_IS_OBJECT(entry->vword));
         JS_ASSERT(entry->vword != PCVAL_NULL);
-        JS_ASSERT(OBJ_SCOPE(pobj)->branded() || OBJ_SCOPE(pobj)->hasMethodBarrier());
+        JS_ASSERT(OBJ_SCOPE(pobj)->brandedOrHasMethodBarrier());
         JS_ASSERT(SPROP_HAS_STUB_GETTER_OR_IS_METHOD(sprop));
         JS_ASSERT(SPROP_HAS_VALID_SLOT(sprop, OBJ_SCOPE(pobj)));
         v = LOCKED_OBJ_GET_SLOT(pobj, sprop->slot);
         JS_ASSERT(VALUE_IS_FUNCTION(cx, v));
         JS_ASSERT(PCVAL_TO_OBJECT(entry->vword) == JSVAL_TO_OBJECT(v));
 
         if (sprop->isMethod()) {
             JS_ASSERT(js_CodeSpec[*regs.pc].format & JOF_CALLOP);
--- a/js/src/jsops.cpp
+++ b/js/src/jsops.cpp
@@ -624,17 +624,17 @@ END_CASE(JSOP_PICK)
         }                                                                     \
     JS_END_MACRO
 
 #define NATIVE_SET(cx,obj,sprop,entry,vp)                                     \
     JS_BEGIN_MACRO                                                            \
         TRACE_2(SetPropHit, entry, sprop);                                    \
         if (SPROP_HAS_STUB_SETTER(sprop) &&                                   \
             (sprop)->slot != SPROP_INVALID_SLOT &&                            \
-            !OBJ_SCOPE(obj)->branded()) {                                     \
+            !OBJ_SCOPE(obj)->brandedOrHasMethodBarrier()) {                   \
             /* Fast path for, e.g., plain Object instance properties. */      \
             LOCKED_OBJ_SET_SLOT(obj, (sprop)->slot, *vp);                     \
         } else {                                                              \
             if (!js_NativeSet(cx, obj, sprop, false, vp))                     \
                 goto error;                                                   \
         }                                                                     \
     JS_END_MACRO
 
@@ -3252,17 +3252,17 @@ BEGIN_CASE(JSOP_LAMBDA)
     LOAD_FUNCTION(0);
     obj = FUN_OBJECT(fun);
 
     /* do-while(0) so we can break instead of using a goto. */
     do {
         if (FUN_NULL_CLOSURE(fun)) {
             parent = fp->scopeChain;
 
-            if (0 && OBJ_GET_PARENT(cx, obj) == parent) {
+            if (OBJ_GET_PARENT(cx, obj) == parent) {
                 op = JSOp(regs.pc[JSOP_LAMBDA_LENGTH]);
 
                 /*
                  * Optimize ({method: function () { ... }, ...}) and
                  * this.method = function () { ... }; bytecode sequences.
                  */
                 if (op == JSOP_SETMETHOD) {
 #ifdef DEBUG
--- a/js/src/jsscope.h
+++ b/js/src/jsscope.h
@@ -382,16 +382,25 @@ struct JSScope : public JSObjectMap
      *
      * The BRANDED write barrier, JSScope::methodWriteBarrer, must check for
      * METHOD_BARRIER too, and regenerate this scope's shape if the method's
      * value is in fact changing.
      */
     bool hasMethodBarrier()     { return flags & METHOD_BARRIER; }
     void setMethodBarrier()     { flags |= METHOD_BARRIER; }
 
+    /*
+     * Test whether this scope may be branded due to method calls, which means
+     * any assignment to a function-valued property must regenerate shape; else
+     * test whether this scope has method properties, which require a method
+     * write barrier.
+     */
+    bool
+    brandedOrHasMethodBarrier() { return flags & (BRANDED | METHOD_BARRIER); }
+
     bool owned()                { return object != NULL; }
 };
 
 struct JSEmptyScope : public JSScope
 {
     JSClass * const clasp;
 
     explicit JSEmptyScope(const JSObjectOps *ops, JSClass *clasp)
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -11177,17 +11177,17 @@ TraceRecorder::setProp(jsval &l, JSPropC
     JS_ASSERT_IF(obj2 != obj, sprop->attrs & JSPROP_SHARED);
 
     /*
      * Setting a function-valued property might need to rebrand the object, so
      * we emit a call to the method write barrier. There's no need to guard on
      * this, because functions have distinct trace-type from other values and
      * branded-ness is implied by the shape, which we've already guarded on.
      */
-    if (scope->branded() && VALUE_IS_FUNCTION(cx, v) && entry->directHit()) {
+    if (scope->brandedOrHasMethodBarrier() && VALUE_IS_FUNCTION(cx, v) && entry->directHit()) {
         if (obj == globalObj)
             RETURN_STOP("can't trace function-valued property set in branded global scope");
 
         enterDeepBailCall();
         LIns* args[] = { v_ins, INS_CONSTSPROP(sprop), obj_ins, cx_ins };
         LIns* ok_ins = lir->insCall(&MethodWriteBarrier_ci, args);
         guard(false, lir->ins_eq0(ok_ins), OOM_EXIT);
         leaveDeepBailCall();
--- a/layout/base/crashtests/123946-1.html
+++ b/layout/base/crashtests/123946-1.html
@@ -1,1 +1,10 @@
-<html><head>
<title>test</title></head>
<body>
<div id="test" style="position: absolute;">test</div>
<script type="application/x-javascript">document.getElementById("test").style.position = "fixed";</script>
</body>
</html>
\ No newline at end of file
+<html>
+<head>
+<title>test</title>
+</head>
+
+<body>
+<div id="test" style="position: absolute;">test</div>
+<script type="application/x-javascript">document.getElementById("test").style.position = "fixed";</script>
+</body>
+</html>
--- a/layout/base/nsPresArena.cpp
+++ b/layout/base/nsPresArena.cpp
@@ -175,43 +175,48 @@ ARENA_POISON_init()
     // code is compiled in 32-bit mode, although it is never executed there.
     ARENA_POISON =
       (((PRUword(0x7FFFFFFFu) << 31) << 1 | PRUword(0xF0DEAFFFu))
        & ~(rgnsize-1))
       + rgnsize/2 - 1;
     return PR_SUCCESS;
 
   } else {
-    // Probe 1024 pages (four megabytes, typically) in both directions from
-    // the baseline address before giving up.
+    // First see if we can allocate the preferred poison address from the OS.
     PRUword candidate = (0xF0DEAFFF & ~(rgnsize-1));
-    PRUword step = rgnsize;
-    int direction = +1;
-    PRUword limit = candidate + 1024*rgnsize;
-    while (candidate < limit) {
-      void *result = ReserveRegion(candidate, rgnsize);
-      if (result == (void *)candidate) {
-        // success - inaccessible page allocated
-        ARENA_POISON = candidate + rgnsize/2 - 1;
-        return PR_SUCCESS;
+    void *result = ReserveRegion(candidate, rgnsize);
+    if (result == (void *)candidate) {
+      // success - inaccessible page allocated
+      ARENA_POISON = candidate + rgnsize/2 - 1;
+      return PR_SUCCESS;
+    }
 
-      } else {
-        if (result != RESERVE_FAILED)
-          ReleaseRegion(result, rgnsize);
+    // That didn't work, so see if the preferred address is within a range
+    // of permanently inacessible memory.
+    if (ProbeRegion(candidate, rgnsize)) {
+      // success - selected page cannot be usable memory
+      ARENA_POISON = candidate + rgnsize/2 - 1;
+      if (result != RESERVE_FAILED)
+        ReleaseRegion(result, rgnsize);
+      return PR_SUCCESS;
+    }
 
-        if (ProbeRegion(candidate, rgnsize)) {
-          // success - selected page cannot be usable memory
-          ARENA_POISON = candidate + rgnsize/2 - 1;
-          return PR_SUCCESS;
-        }
-      }
+    // The preferred address is already in use.  Did the OS give us a
+    // consolation prize?
+    if (result != RESERVE_FAILED) {
+      ARENA_POISON = PRUword(result) + rgnsize/2 - 1;
+      return PR_SUCCESS;
+    }
 
-      candidate += step*direction;
-      step = step + rgnsize;
-      direction = -direction;
+    // It didn't, so try to allocate again, without any constraint on
+    // the address.
+    result = ReserveRegion(0, rgnsize);
+    if (result != RESERVE_FAILED) {
+      ARENA_POISON = PRUword(result) + rgnsize/2 - 1;
+      return PR_SUCCESS;
     }
 
     NS_RUNTIMEABORT("no usable poison region identified");
     return PR_FAILURE;
   }
 }
 
 
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -1895,16 +1895,18 @@ PresShell::Destroy()
 
   mCurrentEventFrame = nsnull;
 
   PRInt32 i, count = mCurrentEventFrameStack.Length();
   for (i = 0; i < count; i++) {
     mCurrentEventFrameStack[i] = nsnull;
   }
 
+  mFramesToDirty.Clear();
+
   if (mViewManager) {
     // Clear the view manager's weak pointer back to |this| in case it
     // was leaked.
     mViewManager->SetViewObserver(nsnull);
     mViewManager = nsnull;
   }
 
   mStyleSet->BeginShutdown(mPresContext);
@@ -2857,16 +2859,39 @@ PresShell::NotifyDestroyingFrame(nsIFram
       }
     }
 
     // Notify the frame manager
     FrameManager()->NotifyDestroyingFrame(aFrame);
 
     // Remove frame properties
     mPresContext->PropertyTable()->DeleteAllPropertiesFor(aFrame);
+
+    if (aFrame == mCurrentEventFrame) {
+      mCurrentEventContent = aFrame->GetContent();
+      mCurrentEventFrame = nsnull;
+    }
+  
+  #ifdef NS_DEBUG
+    if (aFrame == mDrawEventTargetFrame) {
+      mDrawEventTargetFrame = nsnull;
+    }
+  #endif
+  
+    for (unsigned int i=0; i < mCurrentEventFrameStack.Length(); i++) {
+      if (aFrame == mCurrentEventFrameStack.ElementAt(i)) {
+        //One of our stack frames was deleted.  Get its content so that when we
+        //pop it we can still get its new frame from its content
+        nsIContent *currentEventContent = aFrame->GetContent();
+        mCurrentEventContentStack.ReplaceObjectAt(currentEventContent, i);
+        mCurrentEventFrameStack[i] = nsnull;
+      }
+    }
+  
+    mFramesToDirty.RemoveEntry(aFrame);
   }
 
   return NS_OK;
 }
 
 // note that this can return a null caret, but NS_OK
 NS_IMETHODIMP PresShell::GetCaret(nsCaret **outCaret)
 {
@@ -3628,39 +3653,16 @@ nsIPresShell::RestyleForAnimation(nsICon
   FrameConstructor()->PostAnimationRestyleEvent(aContent, eReStyle_Self,
                                                 NS_STYLE_HINT_NONE);
 }
 
 NS_IMETHODIMP
 PresShell::ClearFrameRefs(nsIFrame* aFrame)
 {
   mPresContext->EventStateManager()->ClearFrameRefs(aFrame);
-  
-  if (aFrame == mCurrentEventFrame) {
-    mCurrentEventContent = aFrame->GetContent();
-    mCurrentEventFrame = nsnull;
-  }
-
-#ifdef NS_DEBUG
-  if (aFrame == mDrawEventTargetFrame) {
-    mDrawEventTargetFrame = nsnull;
-  }
-#endif
-
-  for (unsigned int i=0; i < mCurrentEventFrameStack.Length(); i++) {
-    if (aFrame == mCurrentEventFrameStack.ElementAt(i)) {
-      //One of our stack frames was deleted.  Get its content so that when we
-      //pop it we can still get its new frame from its content
-      nsIContent *currentEventContent = aFrame->GetContent();
-      mCurrentEventContentStack.ReplaceObjectAt(currentEventContent, i);
-      mCurrentEventFrameStack[i] = nsnull;
-    }
-  }
-
-  mFramesToDirty.RemoveEntry(aFrame);
 
   nsWeakFrame* weakFrame = mWeakFrames;
   while (weakFrame) {
     nsWeakFrame* prev = weakFrame->GetPreviousWeakFrame();
     if (weakFrame->GetFrame() == aFrame) {
       // This removes weakFrame from mWeakFrames.
       weakFrame->Clear(this);
     }
--- a/layout/base/tests/TestPoisonArea.cpp
+++ b/layout/base/tests/TestPoisonArea.cpp
@@ -298,45 +298,52 @@ ReservePoisonArea()
     // We have to avoid 64-bit constants and shifts by 32 bits, since this
     // code is compiled in 32-bit mode, although it is never executed there.
     uintptr_t result = (((uintptr_t(0x7FFFFFFFu) << 31) << 1 |
                          uintptr_t(0xF0DEAFFFu)) &
                         ~uintptr_t(PAGESIZE-1));
     printf("INFO | poison area assumed at 0x%.*"PRIxPTR"\n", SIZxPTR, result);
     return result;
   } else {
-    // Probe 1024 pages (four megabytes, typically) in both directions from
-    // the baseline address before giving up.
-    uintptr_t candidate = (0xF0DEAFFF & ~(uintptr_t)(PAGESIZE-1));
-    uintptr_t step = PAGESIZE;
-    intptr_t direction = +1;
-    uintptr_t limit = candidate + 1024*PAGESIZE;
-    while (candidate < limit) {
-      void *result = ReserveRegion(candidate, false);
-      if (result == (void *)candidate) {
-        // success - inaccessible page allocated
-        printf("INFO | poison area allocated at 0x%.*"PRIxPTR"\n",
-               SIZxPTR, (uintptr_t)result);
-        return candidate;
+    // First see if we can allocate the preferred poison address from the OS.
+    uintptr_t candidate = (0xF0DEAFFF & ~(PAGESIZE-1));
+    void *result = ReserveRegion(candidate, false);
+    if (result == (void *)candidate) {
+      // success - inaccessible page allocated
+      printf("INFO | poison area allocated at 0x%.*"PRIxPTR
+             " (preferred addr)\n", SIZxPTR, (uintptr_t)result);
+      return candidate;
+    }
 
-      } else {
-        if (result != MAP_FAILED)
-          ReleaseRegion(result);
+    // That didn't work, so see if the preferred address is within a range
+    // of permanently inacessible memory.
+    if (ProbeRegion(candidate)) {
+      // success - selected page cannot be usable memory
+      if (result != MAP_FAILED)
+        ReleaseRegion(result);
+      printf("INFO | poison area assumed at 0x%.*"PRIxPTR
+             " (preferred addr)\n", SIZxPTR, candidate);
+      return candidate;
+    }
 
-        if (ProbeRegion(candidate)) {
-          // success - selected page cannot be usable memory
-          printf("INFO | poison area probed at 0x%.*"PRIxPTR" | %s\n",
-                 SIZxPTR, candidate, LastErrMsg());
-          return candidate;
-        }
-      }
+    // The preferred address is already in use.  Did the OS give us a
+    // consolation prize?
+    if (result != MAP_FAILED) {
+      printf("INFO | poison area allocated at 0x%.*"PRIxPTR
+             " (consolation prize)\n", SIZxPTR, (uintptr_t)result);
+      return (uintptr_t)result;
+    }
 
-      candidate += step*direction;
-      step = step + PAGESIZE;
-      direction = -direction;
+    // It didn't, so try to allocate again, without any constraint on
+    // the address.
+    result = ReserveRegion(0, false);
+    if (result != MAP_FAILED) {
+      printf("INFO | poison area allocated at 0x%.*"PRIxPTR
+             " (fallback)\n", SIZxPTR, (uintptr_t)result);
+      return (uintptr_t)result;
     }
 
     printf("ERROR | no usable poison area found\n");
     return 0;
   }
 }
 
 /* The "positive control" area confirms that we can allocate a page with the
--- a/layout/forms/nsTextControlFrame.cpp
+++ b/layout/forms/nsTextControlFrame.cpp
@@ -2670,16 +2670,17 @@ nsTextControlFrame::SetValue(const nsASt
         // get the flags, remove readonly and disabled, set the value,
         // restore flags
         PRUint32 flags, savedFlags;
         editor->GetFlags(&savedFlags);
         flags = savedFlags;
         flags &= ~(nsIPlaintextEditor::eEditorDisabledMask);
         flags &= ~(nsIPlaintextEditor::eEditorReadonlyMask);
         flags |= nsIPlaintextEditor::eEditorUseAsyncUpdatesMask;
+        flags |= nsIPlaintextEditor::eEditorDontEchoPassword;
         editor->SetFlags(flags);
 
         // Also don't enforce max-length here
         PRInt32 savedMaxLength;
         plaintextEditor->GetMaxTextLength(&savedMaxLength);
         plaintextEditor->SetMaxTextLength(-1);
 
         if (currentValue.Length() < 1)
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -2213,23 +2213,30 @@ NS_IMETHODIMP nsFrame::HandleDrag(nsPres
   PRInt32 contentOffset;
   PRInt32 target;
   nsMouseEvent *me = (nsMouseEvent *)aEvent;
   nsresult result;
   result = GetDataForTableSelection(frameselection, presShell, me,
                                     getter_AddRefs(parentContent),
                                     &contentOffset, &target);      
 
+  nsWeakFrame weakThis = this;
   if (NS_SUCCEEDED(result) && parentContent) {
     frameselection->HandleTableSelection(parentContent, contentOffset, target, me);
   } else {
     nsPoint pt = nsLayoutUtils::GetEventCoordinatesRelativeTo(aEvent, this);
     frameselection->HandleDrag(this, pt);
   }
 
+  // The frameselection object notifies selection listeners synchronously above
+  // which might have killed us.
+  if (!weakThis.IsAlive()) {
+    return NS_OK;
+  }
+
   // get the nearest scrollframe
   nsIFrame* checkFrame = this;
   nsIScrollableFrame *scrollFrame = nsnull;
   while (checkFrame) {
     scrollFrame = do_QueryFrame(checkFrame);
     if (scrollFrame) {
       break;
     }
--- a/layout/generic/nsObjectFrame.cpp
+++ b/layout/generic/nsObjectFrame.cpp
@@ -2103,16 +2103,22 @@ GetMIMEType(nsIPluginInstance *aPluginIn
   }
   return "";
 }
 #endif
 
 static PRBool
 DoDelayedStop(nsPluginInstanceOwner *aInstanceOwner, PRBool aDelayedStop)
 {
+#ifdef MOZ_PLATFORM_HILDON
+  // Don't delay stop on Maemo/Hildon (bug 530739).
+  if (aDelayedStop && aInstanceOwner->MatchPluginName("Shockwave Flash"))
+    return PR_FALSE;
+#endif
+
   // Don't delay stopping QuickTime (bug 425157), Flip4Mac (bug 426524),
   // XStandard (bug 430219), CMISS Zinc (bug 429604).
   if (aDelayedStop
 #if !(defined XP_WIN || defined MOZ_X11)
       && !aInstanceOwner->MatchPluginName("QuickTime")
       && !aInstanceOwner->MatchPluginName("Flip4Mac")
       && !aInstanceOwner->MatchPluginName("XStandard plugin")
       && !aInstanceOwner->MatchPluginName("CMISS Zinc Plugin")
@@ -5783,14 +5789,14 @@ nsPluginInstanceOwner::SetAbsoluteScreen
   UpdateVisibility();
 
   if (!mInstance)
     return NS_OK;
 
   PRBool simpleImageRender = PR_FALSE;
   mInstance->GetValueFromPlugin(NPPVpluginWindowlessLocalBool,
                                 &simpleImageRender);
-  if (mInstance)
+  if (simpleImageRender)
     NativeImageDraw();
   return NS_OK;
 }
 #endif
 
--- a/layout/inspector/src/inDOMUtils.cpp
+++ b/layout/inspector/src/inDOMUtils.cpp
@@ -159,17 +159,18 @@ inDOMUtils::GetCSSStyleRules(nsIDOMEleme
                              nsISupportsArray **_retval)
 {
   NS_ENSURE_ARG_POINTER(aElement);
 
   *_retval = nsnull;
 
   nsRuleNode* ruleNode = nsnull;
   nsCOMPtr<nsIContent> content = do_QueryInterface(aElement);
-  GetRuleNodeForContent(content, &ruleNode);
+  nsRefPtr<nsStyleContext> styleContext;
+  GetRuleNodeForContent(content, getter_AddRefs(styleContext), &ruleNode);
   if (!ruleNode) {
     // This can fail for content nodes that are not in the document or
     // if the document they're in doesn't have a presshell.  Bail out.
     return NS_OK;
   }
 
   nsCOMPtr<nsISupportsArray> rules;
   NS_NewISupportsArray(getter_AddRefs(rules));
@@ -266,23 +267,27 @@ inDOMUtils::GetContentState(nsIDOMElemen
   
     return esm->GetContentState(content, *aState);
   }
 
   return NS_ERROR_FAILURE;
 }
 
 /* static */ nsresult
-inDOMUtils::GetRuleNodeForContent(nsIContent* aContent, nsRuleNode** aRuleNode)
+inDOMUtils::GetRuleNodeForContent(nsIContent* aContent,
+                                  nsStyleContext** aStyleContext,
+                                  nsRuleNode** aRuleNode)
 {
   *aRuleNode = nsnull;
+  *aStyleContext = nsnull;
 
   nsIDocument* doc = aContent->GetDocument();
   NS_ENSURE_TRUE(doc, NS_ERROR_UNEXPECTED);
 
   nsIPresShell *presShell = doc->GetPrimaryShell();
   NS_ENSURE_TRUE(presShell, NS_ERROR_UNEXPECTED);
 
   nsRefPtr<nsStyleContext> sContext =
     nsComputedDOMStyle::GetStyleContextForContent(aContent, nsnull, presShell);
   *aRuleNode = sContext->GetRuleNode();
+  sContext.forget(aStyleContext);
   return NS_OK;
 }
--- a/layout/inspector/src/inDOMUtils.h
+++ b/layout/inspector/src/inDOMUtils.h
@@ -39,28 +39,31 @@
 #define __inDOMUtils_h__
 
 #include "inIDOMUtils.h"
 
 #include "nsIEventStateManager.h"
 #include "nsISupportsArray.h"
 
 class nsRuleNode;
+class nsStyleContext;
 
 class inDOMUtils : public inIDOMUtils
 {
 public:
   NS_DECL_ISUPPORTS
   NS_DECL_INIDOMUTILS
 
   inDOMUtils();
   virtual ~inDOMUtils();
 
 private:
+  // aStyleContext must be released by the caller once he's done with aRuleNode.
   static nsresult GetRuleNodeForContent(nsIContent* aContent,
+                                        nsStyleContext** aStyleContext,
                                         nsRuleNode** aRuleNode);
 };
 
 // {40B22006-5DD5-42f2-BFE7-7DBF0757AB8B}
 #define IN_DOMUTILS_CID \
 { 0x40b22006, 0x5dd5, 0x42f2, { 0xbf, 0xe7, 0x7d, 0xbf, 0x7, 0x57, 0xab, 0x8b } }
 
 #endif // __inDOMUtils_h__
--- a/layout/style/nsComputedDOMStyle.cpp
+++ b/layout/style/nsComputedDOMStyle.cpp
@@ -134,45 +134,31 @@ nsComputedDOMStyle::nsComputedDOMStyle()
   : mDocumentWeak(nsnull), mOuterFrame(nsnull),
     mInnerFrame(nsnull), mPresShell(nsnull), mAppUnitsPerInch(0)
 {
 }
 
 
 nsComputedDOMStyle::~nsComputedDOMStyle()
 {
-  ClearWrapper();
 }
 
 void
 nsComputedDOMStyle::Shutdown()
 {
   // We want to de-allocate without calling the dtor since we
   // already did that manually in doDestroyComputedDOMStyle(),
   // so cast our cached object to something that doesn't know
   // about our dtor.
   delete reinterpret_cast<char*>(sCachedComputedDOMStyle);
   sCachedComputedDOMStyle = nsnull;
 }
 
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsComputedDOMStyle)
-NS_IMPL_CYCLE_COLLECTION_ROOT_BEGIN(nsComputedDOMStyle)
-  NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER
-NS_IMPL_CYCLE_COLLECTION_ROOT_END
-NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsComputedDOMStyle)
-  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mContent)
-NS_IMPL_CYCLE_COLLECTION_UNLINK_END
-NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(nsComputedDOMStyle)
-  NS_IMPL_CYCLE_COLLECTION_TRACE_PRESERVED_WRAPPER
-NS_IMPL_CYCLE_COLLECTION_TRACE_END
-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsComputedDOMStyle)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_SCRIPT_OBJECTS
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mContent)
-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+NS_IMPL_CYCLE_COLLECTION_1(nsComputedDOMStyle, mContent)
 
 // QueryInterface implementation for nsComputedDOMStyle
 NS_INTERFACE_TABLE_HEAD(nsComputedDOMStyle)
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_OFFSET_AND_INTERFACE_TABLE_BEGIN(nsComputedDOMStyle)
     NS_INTERFACE_TABLE_ENTRY(nsComputedDOMStyle, nsICSSDeclaration)
     NS_INTERFACE_TABLE_ENTRY(nsComputedDOMStyle,
                              nsIDOMCSSStyleDeclaration)
--- a/layout/style/nsComputedDOMStyle.h
+++ b/layout/style/nsComputedDOMStyle.h
@@ -56,17 +56,17 @@
 #include "nsAutoPtr.h"
 #include "nsStyleStruct.h"
 
 class nsComputedDOMStyle : public nsICSSDeclaration,
                            public nsWrapperCache
 {
 public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
-  NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(nsComputedDOMStyle)
+  NS_DECL_CYCLE_COLLECTION_CLASS(nsComputedDOMStyle)
 
   NS_IMETHOD Init(nsIDOMElement *aElement,
                   const nsAString& aPseudoElt,
                   nsIPresShell *aPresShell);
 
   NS_DECL_NSICSSDECLARATION
 
   NS_DECL_NSIDOMCSSSTYLEDECLARATION
--- a/layout/style/nsDOMCSSAttrDeclaration.cpp
+++ b/layout/style/nsDOMCSSAttrDeclaration.cpp
@@ -67,34 +67,17 @@ nsDOMCSSAttributeDeclaration::nsDOMCSSAt
                "Inline style for non-element content?");
 }
 
 nsDOMCSSAttributeDeclaration::~nsDOMCSSAttributeDeclaration()
 {
   MOZ_COUNT_DTOR(nsDOMCSSAttributeDeclaration);
 }
 
-NS_IMPL_CYCLE_COLLECTION_CLASS(nsDOMCSSAttributeDeclaration)
-
-NS_IMPL_CYCLE_COLLECTION_ROOT_BEGIN(nsDOMCSSAttributeDeclaration)
-  NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER
-NS_IMPL_CYCLE_COLLECTION_ROOT_END
-
-NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsDOMCSSAttributeDeclaration)
-  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mContent)
-NS_IMPL_CYCLE_COLLECTION_UNLINK_END
-
-NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(nsDOMCSSAttributeDeclaration)
-  NS_IMPL_CYCLE_COLLECTION_TRACE_PRESERVED_WRAPPER
-NS_IMPL_CYCLE_COLLECTION_TRACE_END
-
-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsDOMCSSAttributeDeclaration)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_SCRIPT_OBJECTS
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mContent)
-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+NS_IMPL_CYCLE_COLLECTION_1(nsDOMCSSAttributeDeclaration, mContent)
 
 NS_INTERFACE_MAP_BEGIN(nsDOMCSSAttributeDeclaration)
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRIES_CYCLE_COLLECTION(nsDOMCSSAttributeDeclaration)
 NS_IMPL_QUERY_TAIL_INHERITING(nsDOMCSSDeclaration)
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsDOMCSSAttributeDeclaration)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsDOMCSSAttributeDeclaration)
--- a/layout/style/nsDOMCSSAttrDeclaration.h
+++ b/layout/style/nsDOMCSSAttrDeclaration.h
@@ -56,17 +56,17 @@ public:
   nsDOMCSSAttributeDeclaration(nsIContent *aContent
 #ifdef MOZ_SMIL
                                , PRBool aIsSMILOverride
 #endif // MOZ_SMIL
                                );
   ~nsDOMCSSAttributeDeclaration();
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
-  NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(nsDOMCSSAttributeDeclaration)
+  NS_DECL_CYCLE_COLLECTION_CLASS(nsDOMCSSAttributeDeclaration)
 
   // If GetCSSDeclaration returns non-null, then the decl it returns
   // is owned by our current style rule.
   virtual nsresult GetCSSDeclaration(nsCSSDeclaration **aDecl,
                                      PRBool aAllocate);
   virtual nsresult GetCSSParsingEnvironment(nsIURI** aSheetURI,
                                             nsIURI** aBaseURI,
                                             nsIPrincipal** aSheetPrincipal,
--- a/modules/plugin/base/src/nsNPAPIPlugin.cpp
+++ b/modules/plugin/base/src/nsNPAPIPlugin.cpp
@@ -2104,19 +2104,27 @@ NPError NP_CALLBACK
     inst->GetDOMElement(getter_AddRefs(e));
     if (e) {
       NS_ADDREF(*(nsIDOMElement**)result = e.get());
       return NPERR_NO_ERROR;
     }
 
     return NPERR_GENERIC_ERROR;
   }
+#else
+  case NPNVDOMElement:
+    // fall through
+  case NPNVDOMWindow:
+    // fall through
 #endif /* WINCE */
-
-  case NPNVserviceManager: // old XPCOM object, no longer supported
+  case NPNVserviceManager:
+    // old XPCOM objects, no longer supported, but null out the out
+    // param to avoid crashing plugins that still try to use this.
+    *(nsISupports**)result = nsnull;
+    // fall through
   default:
     return NPERR_GENERIC_ERROR;
   }
 }
 
 NPError NP_CALLBACK
 _setvalue(NPP npp, NPPVariable variable, void *result)
 {
@@ -2471,19 +2479,19 @@ NPError NP_CALLBACK
 
       // Make an nsURI from the url argument
       nsCOMPtr<nsIURI> uri;
       if (NS_FAILED(NS_NewURI(getter_AddRefs(uri), nsDependentCString(url)))) {
         return NPERR_GENERIC_ERROR;
       }
 
       nsXPIDLCString cookieStr;
-      if (NS_FAILED(cookieService->GetCookieString(uri, nsnull,
-                                                   getter_Copies(cookieStr))) ||
-          !cookieStr) {
+      nsresult cookieReturn = cookieService->GetCookieString(uri, nsnull,
+                                                             getter_Copies(cookieStr));
+      if (NS_FAILED(cookieReturn) || !cookieStr) {
         return NPERR_GENERIC_ERROR;
       }
 
       *value = PL_strndup(cookieStr, cookieStr.Length());
 
       if (*value) {
         *len = cookieStr.Length();
 
--- a/netwerk/test/unit/test_bug203271.js
+++ b/netwerk/test/unit/test_bug203271.js
@@ -116,17 +116,17 @@ function triggerNextTest() {
 
 function checkValueAndTrigger(request, data, ctx) {
     logit(index, data, ctx);
     do_check_eq(tests[index].expected, data);
 
     if (index < tests.length - 1) {
         var delay = tests[index++].delay;
         if (delay) {
-            do_timeout(delay, "triggerNextTest()");
+            do_timeout(delay, triggerNextTest);
         } else {
             triggerNextTest();
         }
     } else {
         httpserver.stop(do_test_finished);
     }
 }
 
--- a/netwerk/test/unit/test_bug369787.js
+++ b/netwerk/test/unit/test_bug369787.js
@@ -16,17 +16,17 @@ function change_content_type() {
 function TestListener() {
 }
 TestListener.prototype.onStartRequest = function(request, context) {
   change_content_type();
 }
 TestListener.prototype.onStopRequest = function(request, context, status) {
   change_content_type();
 
-  do_timeout(0, "after_channel_closed()");
+  do_timeout(0, after_channel_closed);
 }
 
 function after_channel_closed() {
   try {
     change_content_type();
   } finally {
     server.stop(do_test_finished);
   }
--- a/netwerk/test/unit/test_bug470716.js
+++ b/netwerk/test/unit/test_bug470716.js
@@ -54,17 +54,17 @@ var copyObserver =
     try {
       pipe1.outputStream.write("closedSourceTest", 16);
       do_check_false(test_source_closed);
     }
     catch (ex) {
       do_check_true(test_source_closed);
     }
 
-    do_timeout(0, "do_test();");
+    do_timeout(0, do_test);
   },
 
   QueryInterface: function(aIID)
   {
     if (aIID.equals(Ci.nsIRequestObserver) ||
         aIID.equals(Ci.nsISupports))
       return this;
 
@@ -114,18 +114,19 @@ function do_test() {
 
     test_source_closed = ((test_nr-1)>>1 != 0);
     test_sink_closed = ((test_nr-1)%2 != 0);
 
     startCopier(test_source_closed, test_sink_closed);
     pipe1.outputStream.write(test_content, test_content.length);
     pipe1.outputStream.flush();
     do_timeout(20,
-               "copier.cancel(test_result);" +
-               "pipe1.outputStream.write(\"a\", 1);");
+		function(){
+               copier.cancel(test_result);
+               pipe1.outputStream.write("a", 1);});
     break;
   case 5:
   case 6: // close sink
   case 7: // close source
   case 8: // close both
     // test copying with EOF on source
     test_result = 0;
 
@@ -151,24 +152,26 @@ function do_test() {
     test_sink_closed = ((test_nr-9)%2 != 0);
 
     startCopier(test_source_closed, test_sink_closed);
     pipe1.outputStream.write(test_content, test_content.length);
     pipe1.outputStream.flush();
     // we will close the sink
     test_sink_closed = true;
     do_timeout(20,
-               "pipe2.outputStream" +
-               "     .QueryInterface(Ci.nsIAsyncOutputStream)" +
-               "     .closeWithStatus(test_result);" +
-               "pipe1.outputStream.write(\"a\", 1);");
+		function()
+		{
+               pipe2.outputStream
+                    .QueryInterface(Ci.nsIAsyncOutputStream)
+                    .closeWithStatus(test_result);
+               pipe1.outputStream.write("a", 1);});
     break;
   case 13:
     do_test_finished();
     break;
   }
 }
 
 function run_test() {
   test_nr = 0;
-  do_timeout(0, "do_test();");
+  do_timeout(0, do_test);
   do_test_pending();
 }
--- a/netwerk/test/unit/test_bug482601.js
+++ b/netwerk/test/unit/test_bug482601.js
@@ -30,17 +30,17 @@ var listener = {
   onDataAvailable: function (request, ctx, stream, offset, count) {
     buffer = buffer.concat(read_stream(stream, count));
   },
 
   onStopRequest: function (request, ctx, status) {
     do_check_eq(buffer, "0123456789");
     do_check_eq(observers_called, results[test_nr]);
     test_nr++;
-    do_timeout(0, "do_test();");
+    do_timeout(0, do_test);
   }
 };
 
 function run_test() {
   httpserv = new nsHttpServer();
   httpserv.registerPathHandler("/bug482601/nocache", bug482601_nocache);
   httpserv.registerPathHandler("/bug482601/partial", bug482601_partial);
   httpserv.registerPathHandler("/bug482601/cached", bug482601_cached);
@@ -48,17 +48,17 @@ function run_test() {
   httpserv.start(4444);
 
   var obs = Cc["@mozilla.org/observer-service;1"].getService();
   obs = obs.QueryInterface(Ci.nsIObserverService);
   obs.addObserver(observer, "http-on-examine-response", false);
   obs.addObserver(observer, "http-on-examine-merged-response", false);
   obs.addObserver(observer, "http-on-examine-cached-response", false);
 
-  do_timeout(0, "do_test();");
+  do_timeout(0, do_test);
   do_test_pending();
 }
 
 function do_test() {
   if (test_nr < tests.length) {
     tests[test_nr]();
   }
   else {
--- a/netwerk/test/unit/test_bug490095.js
+++ b/netwerk/test/unit/test_bug490095.js
@@ -67,17 +67,17 @@ function triggerNextTest() {
 function checkValueAndTrigger(request, data, ctx) {
     logit(index, data);
     do_check_eq(tests[index].expected, data);
 
     if (index < tests.length-1) {
         index++;
         // this call happens in onStopRequest from the channel, and opening a
         // new channel to the same url here is no good idea...  post it instead
-        do_timeout(1, "triggerNextTest();");
+        do_timeout(1, triggerNextTest);
     } else {
         httpserver.stop(do_test_finished);
     }
 }
 
 function run_test() {
     httpserver.registerPathHandler("/freshness", handler);
     httpserver.start(4444);
--- a/netwerk/test/unit/test_cacheflags.js
+++ b/netwerk/test/unit/test_cacheflags.js
@@ -52,17 +52,17 @@ Test.prototype = {
     this._buffer = this._buffer.concat(read_stream(stream, count));
   },
 
   onStopRequest: function(request, context, status) {
     do_check_eq(Components.isSuccessCode(status), this.expectSuccess);
     do_check_eq(this._isFromCache, this.readFromCache);
     do_check_eq(gHitServer, this.hitServer);
 
-    do_timeout(0, "run_next_test();");
+    do_timeout(0, run_next_test);
   },
 
   run: function() {
     dump("Running:" +
          "\n  " + this.path +
          "\n  " + this.flags +
          "\n  " + this.expectSuccess +
          "\n  " + this.readFromCache +
--- a/netwerk/test/unit/test_reopen.js
+++ b/netwerk/test/unit/test_reopen.js
@@ -72,17 +72,17 @@ var listener = {
     new BinaryInputStream(inputStream).readByteArray(count); // required by API
     check_async_open_throws(NS_ERROR_IN_PROGRESS);
   },
 
   onStopRequest: function test_onStopR(request, ctx, status) {
     // Once onStopRequest is reached, the channel is marked as having been
     // opened
     check_async_open_throws(NS_ERROR_ALREADY_OPENED);
-    do_timeout(0, "after_channel_closed()");
+    do_timeout(0, after_channel_closed);
   }
 };
 
 function after_channel_closed() {
   check_async_open_throws(NS_ERROR_ALREADY_OPENED);
 
   run_next_test();
 }
--- a/testing/xpcshell/example/unit/test_sample.js
+++ b/testing/xpcshell/example/unit/test_sample.js
@@ -44,10 +44,10 @@
  * http://developer.mozilla.org/en/docs/Writing_xpcshell-based_unit_tests
  */
 function run_test() {
   do_check_eq(57, 57)
   do_check_neq(1, 2)
   do_check_true(true);
 
   do_test_pending();
-  do_timeout(100, "do_test_finished();");
+  do_timeout(100, do_test_finished);
 }
--- a/testing/xpcshell/head.js
+++ b/testing/xpcshell/head.js
@@ -70,34 +70,34 @@ if ("@mozilla.org/toolkit/crash-reporter
         .getService(Components.interfaces.nsICrashReporter)) {
     crashReporter.enabled = true;
     crashReporter.minidumpPath = do_get_cwd();
   }
 }
 
 
 function _TimerCallback(expr, timer) {
-  this._expr = expr;
+  this._func = typeof expr === "function"
+             ? expr
+             : function() { eval(expr); };
   // Keep timer alive until it fires
   _pendingCallbacks.push(timer);
 }
 _TimerCallback.prototype = {
-  _expr: "",
-
   QueryInterface: function(iid) {
     if (iid.Equals(Components.interfaces.nsITimerCallback) ||
         iid.Equals(Components.interfaces.nsISupports))
       return this;
 
     throw Components.results.NS_ERROR_NO_INTERFACE;
   },
 
   notify: function(timer) {
     _pendingCallbacks.splice(_pendingCallbacks.indexOf(timer), 1);
-    eval(this._expr);
+    this._func.call(null);
   }
 };
 
 function _do_main() {
   if (_quit)
     return;
 
   dump("TEST-INFO | (xpcshell/head.js) | running event loop\n");
--- a/toolkit/components/downloads/src/nsDownloadManager.h
+++ b/toolkit/components/downloads/src/nsDownloadManager.h
@@ -86,16 +86,19 @@ public:
   nsresult Init();
 
   static nsDownloadManager *GetSingleton();
 
   virtual ~nsDownloadManager();
   nsDownloadManager() :
       mDBType(DATABASE_DISK)
     , mInPrivateBrowsing(PR_FALSE)
+#ifdef DOWNLOAD_SCANNER
+    , mScanner(nsnull)
+#endif
   {
   }
 
 protected:
   enum DatabaseType
   {
     DATABASE_DISK = 0, // default
     DATABASE_MEMORY
--- a/toolkit/components/downloads/test/unit/test_bug_401430.js
+++ b/toolkit/components/downloads/test/unit/test_bug_401430.js
@@ -53,33 +53,33 @@ const POLL_REGISTRY_MAX_LOOPS = 25;
 
 function checkResult() {
   // delete the saved file (this doesn't affect the "recent documents" list)
   var resultFile = do_get_file(resultFileName);
   resultFile.remove(false);
 
   // Need to poll RecentDocs value because the SHAddToRecentDocs call
   // doesn't update the registry immediately.
-  do_timeout(POLL_REGISTRY_TIMEOUT, "pollRecentDocs();");
+  do_timeout(POLL_REGISTRY_TIMEOUT, pollRecentDocs);
 }
 
 var gPollsCount = 0;
 function pollRecentDocs() {
   if (++gPollsCount > POLL_REGISTRY_MAX_LOOPS) {
     do_throw("Maximum time elapsed while polling RecentDocs.");
     do_test_finished();
     return;
   }
 
   if (checkRecentDocsFor(resultFileName)) {
     print("Document found in RecentDocs");
     do_test_finished();
   }
   else
-    do_timeout(POLL_REGISTRY_TIMEOUT, "pollRecentDocs();");
+    do_timeout(POLL_REGISTRY_TIMEOUT, pollRecentDocs);
 }
 
 function checkRecentDocsFor(aFileName) {
   var recentDocsKey = Cc["@mozilla.org/windows-registry-key;1"].
                         createInstance(Ci.nsIWindowsRegKey);
   var recentDocsPath =
         "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs";
   recentDocsKey.open(Ci.nsIWindowsRegKey.ROOT_KEY_CURRENT_USER,
--- a/toolkit/components/places/tests/bookmarks/test_388695.js
+++ b/toolkit/components/places/tests/bookmarks/test_388695.js
@@ -58,25 +58,25 @@ function run_test() {
   // test getBookmarkIdsForURI
   // getBookmarkIdsForURI sorts by the most recently added/modified (descending)
   //
   // we cannot rely on dateAdded growing when doing so in a simple iteration,
   // see PR_Now() documentation
   do_test_pending();
 
   gItemId1 = bmsvc.insertBookmark(gTestRoot, gURI, bmsvc.DEFAULT_INDEX, "");
-  do_timeout(100, "phase2();");
+  do_timeout(100, phase2);
 }
 
 function phase2() {
   gItemId2 = bmsvc.insertBookmark(gTestRoot, gURI, bmsvc.DEFAULT_INDEX, "");  
   var b = bmsvc.getBookmarkIdsForURI(gURI);
   do_check_eq(b[0], gItemId2);
   do_check_eq(b[1], gItemId1);
-  do_timeout(100, "phase3();");
+  do_timeout(100, phase3);
 }
 
 function phase3() {
   // trigger last modified change
   bmsvc.setItemTitle(gItemId1, "");
   var b = bmsvc.getBookmarkIdsForURI(gURI);
   do_check_eq(b[0], gItemId1);
   do_check_eq(b[1], gItemId2);
--- a/toolkit/components/places/tests/queries/head_queries.js
+++ b/toolkit/components/places/tests/queries/head_queries.js
@@ -562,15 +562,17 @@ function flush_main_thread_events()
   while (tm.mainThread.hasPendingEvents())
     tm.mainThread.processNextEvent(false);
 }
 
 // These tests are known to randomly fail due to bug 507790 when database
 // flushes are active, so we turn off syncing for them.
 let randomFailingSyncTests = [
   "test_results-as-visit.js",
+  "test_sorting.js",
+  "test_redirectsMode.js",
 ];
 let currentTestFilename = do_get_file(_TEST_FILE[0], true).leafName;
 if (randomFailingSyncTests.indexOf(currentTestFilename) != -1) {
   print("Test " + currentTestFilename + " is known random due to bug 507790, disabling PlacesDBFlush component.");
   let sync = Cc["@mozilla.org/places/sync;1"].getService(Ci.nsIObserver);
   sync.observe(null, "places-debug-stop-sync", null);
 }
--- a/toolkit/components/places/tests/sync/test_database_sync_after_shutdown_with_removeAllPages.js
+++ b/toolkit/components/places/tests/sync/test_database_sync_after_shutdown_with_removeAllPages.js
@@ -92,31 +92,31 @@ var observer = {
 
       // Visit id must be valid.
       do_check_neq(historyObserver.visitId, -1);
       // History must have been cleared.
       do_check_true(historyObserver.cleared);
 
       // The database connection will be closed after this sync, but we can't
       // know how much time it will take, so we use a polling strategy.
-      do_timeout(POLLING_TIMEOUT_MS, "check_results();");
+      do_timeout(POLLING_TIMEOUT_MS, check_results);
     }
   }
 }
 os.addObserver(observer, TOPIC_SYNC_FINISHED, false);
 
 var gPasses = 0;
 function check_results() {
     if (++gPasses >= POLLING_MAX_PASSES) {
       do_throw("Maximum time elapsdes waiting for Places database connection to close");
       do_test_finished();
     }
 
     if (hs.QueryInterface(Ci.nsPIPlacesDatabase).DBConnection.connectionReady) {
-      do_timeout(POLLING_TIMEOUT_MS, "check_results();");
+      do_timeout(POLLING_TIMEOUT_MS, check_results);
       return;
     }
 
     let dbConn = DBConn();
     do_check_neq(dbConn, null);
     do_check_true(dbConn.connectionReady);
 
     // Check that frecency for not cleared items (bookmarks) has been
--- a/toolkit/components/places/tests/unit/head_bookmarks.js
+++ b/toolkit/components/places/tests/unit/head_bookmarks.js
@@ -300,15 +300,17 @@ function flush_main_thread_events()
 // These tests are known to randomly fail due to bug 507790 when database
 // flushes are active, so we turn off syncing for them.
 let randomFailingSyncTests = [
   "test_annotations.js",
   "test_multi_word_tags.js",
   "test_removeVisitsByTimeframe.js",
   "test_tagging.js",
   "test_utils_getURLsForContainerNode.js",
+  "test_exclude_livemarks.js",
+  "test_402799.js",
 ];
 let currentTestFilename = do_get_file(_TEST_FILE[0], true).leafName;
 if (randomFailingSyncTests.indexOf(currentTestFilename) != -1) {
   print("Test " + currentTestFilename + " is known random due to bug 507790, disabling PlacesDBFlush component.");
   let sync = Cc["@mozilla.org/places/sync;1"].getService(Ci.nsIObserver);
   sync.observe(null, "places-debug-stop-sync", null);
 }
--- a/toolkit/components/places/tests/unit/test_399606.js
+++ b/toolkit/components/places/tests/unit/test_399606.js
@@ -80,17 +80,17 @@ histsvc.addObserver(observer, false);
 
 // main
 function run_test() {
   var now = Date.now();
   var testURI = uri("http://fez.com");
   ghist.addURI(testURI, false, true, null);
   ghist.addURI(testURI, false, true, testURI);
   // lazy message timer is 3000, see LAZY_MESSAGE_TIMEOUT
-  do_timeout(3500, "confirm_results();");
+  do_timeout(3500, confirm_results);
 }
 
 function confirm_results() {
   var options = histsvc.getNewQueryOptions();
   options.resultType = options.RESULTS_AS_VISIT;
   options.includeHidden = true;
   var query = histsvc.getNewQuery();
   var result = histsvc.executeQuery(query, options);
--- a/toolkit/components/places/tests/unit/test_451499.js
+++ b/toolkit/components/places/tests/unit/test_451499.js
@@ -119,17 +119,17 @@ function run_test() {
 
   // We set a favicon on testURI while the container is open.
   // This favicon should be setup only for this website, not for the containing
   // query, this will be checked by the viewer
   iconsvc.setFaviconUrlForPage(testURI, iconURI);
 
   do_test_pending();
   // lazy timeout is 3s and favicons are lazy added
-  do_timeout(3500, "end_test();");
+  do_timeout(3500, end_test);
 }
 
 function end_test() {
   var root = result.root;
   root.containerOpen = false;
   result.viewer = null;
 
   do_test_finished();
--- a/toolkit/components/places/tests/unit/test_bookmark_catobs.js
+++ b/toolkit/components/places/tests/unit/test_bookmark_catobs.js
@@ -72,10 +72,10 @@ function run_test() {
   os.addObserver(observer, "dummy-observer-created", true);
   os.addObserver(observer, "dummy-observer-item-added", true);
 
   // Add a bookmark
   bs.insertBookmark(bs.unfiledBookmarksFolder, uri("http://typed.mozilla.org"),
                     bs.DEFAULT_INDEX, "bookmark");
 
   do_test_pending();
-  do_timeout(1000, "verify();");
+  do_timeout(1000, verify);
 }
--- a/toolkit/components/places/tests/unit/test_expiration.js
+++ b/toolkit/components/places/tests/unit/test_expiration.js
@@ -522,17 +522,17 @@ function startExpireNeither() {
   // set date minimum to 2
   prefs.setIntPref("browser.history_expire_days_min", 2);
   // set date maximum to 3
   prefs.setIntPref("browser.history_expire_days", 3);
 
   // Changing expiration preferences triggers partial expiration.
 
   // Check results.
-  do_timeout(600, "checkExpireNeither();");
+  do_timeout(600, checkExpireNeither);
 }
 
 function checkExpireNeither() {
   dump("checkExpireNeither()\n");
   try {
     do_check_eq(observer.expiredURI, null);
     do_check_eq(annosvc.getPageAnnotationNames(testURI).length, 1);
     do_check_eq(annosvc.getPageAnnotationNames(triggerURI).length, 1);
@@ -583,17 +583,17 @@ function startExpireDaysOnly() {
   // set date minimum to 2 (also not an expiration criteria)
   prefs.setIntPref("browser.history_expire_days_min", 2);
   // set date maximum to 3
   prefs.setIntPref("browser.history_expire_days", 3);
 
   // Changing expiration preferences triggers partial expiration.
 
   // Check results.
-  do_timeout(600, "checkExpireDaysOnly();");
+  do_timeout(600, checkExpireDaysOnly);
 }
 
 function checkExpireDaysOnly() {
   try {
     // test expired record
     do_check_eq(observer.expiredURI, testURI.spec);
     do_check_eq(annosvc.getPageAnnotationNames(testURI).length, 0);
 
@@ -653,17 +653,17 @@ function startExpireBoth() {
   // set date max to 3
   prefs.setIntPref("browser.history_expire_days", 3);
   // set date minimum to 1
   prefs.setIntPref("browser.history_expire_days_min", 1);
 
   // Changing expiration preferences triggers partial expiration.
 
   // Check results.
-  do_timeout(600, "checkExpireBoth();"); // incremental expiration timer is 3500
+  do_timeout(600, checkExpireBoth); // incremental expiration timer is 3500
 }
 
 function checkExpireBoth() {
   try {
     do_check_eq(observer.expiredURI, testURI.spec);
     do_check_eq(annosvc.getPageAnnotationNames(testURI).length, 0);
     do_check_eq(annosvc.getPageAnnotationNames(triggerURI).length, 1);
   } catch(ex) {}
@@ -711,17 +711,17 @@ function startExpireNeitherOver() {
   // set date minimum to 2
   prefs.setIntPref("browser.history_expire_days_min", 2);
   // set date maximum to 3
   prefs.setIntPref("browser.history_expire_days", 3);
 
   // Changing expiration preferences triggers partial expiration.
 
   // Check results.
-  do_timeout(600, "checkExpireNeitherOver();");
+  do_timeout(600, checkExpireNeitherOver);
 }
 
 function checkExpireNeitherOver() {
   dump("checkExpireNeitherOver()\n");
   try {
     do_check_eq(observer.expiredURI, null);
     do_check_eq(annosvc.getPageAnnotationNames(testURI).length, 1);
     do_check_eq(annosvc.getPageAnnotationNames(triggerURI).length, 1);
@@ -760,17 +760,17 @@ function startExpireHistoryDisabled() {
   annosvc.setPageAnnotation(testURI, testAnnoName, testAnnoVal, 0, annosvc.EXPIRE_NEVER);
 
   // set date maximum to 0
   prefs.setIntPref("browser.history_expire_days", 0);
 
   // Changing expiration preferences triggers partial expiration.
 
   // Check results.
-  do_timeout(600, "checkExpireHistoryDisabled();");
+  do_timeout(600, checkExpireHistoryDisabled);
 }
 
 function checkExpireHistoryDisabled() {
   dump("checkExpireHistoryDisabled()\n");
   try {
     do_check_eq(observer.expiredURI, testURI.spec);
     do_check_eq(annosvc.getPageAnnotationNames(testURI).length, 0);
   } catch(ex) {
@@ -812,17 +812,17 @@ function startExpireBadPrefs() {
   // set date minimum to 20
   prefs.setIntPref("browser.history_expire_days_min", 20);
   // set date maximum to 1
   prefs.setIntPref("browser.history_expire_days", 1);
 
   // Changing expiration preferences triggers partial expiration.
 
   // Check results.
-  do_timeout(600, "checkExpireBadPrefs();");
+  do_timeout(600, checkExpireBadPrefs);
 }
 
 function checkExpireBadPrefs() {
   dump("checkExpireBadPrefs()\n");
   try {
     do_check_eq(observer.expiredURI, null);
     do_check_eq(annosvc.getPageAnnotationNames(testURI).length, 1);
   } catch(ex) {
--- a/toolkit/components/places/tests/unit/test_history_catobs.js
+++ b/toolkit/components/places/tests/unit/test_history_catobs.js
@@ -72,10 +72,10 @@ function run_test() {
   os.addObserver(observer, "dummy-observer-created", true);
   os.addObserver(observer, "dummy-observer-visited", true);
 
   // Add a visit
   hs.addVisit(uri("http://typed.mozilla.org"), Date.now(), null,
               hs.TRANSITION_TYPED, false, 0);
 
   do_test_pending();
-  do_timeout(1000, "verify();");
+  do_timeout(1000, verify);
 }
--- a/toolkit/components/satchel/test/unit/test_db_update_v1.js
+++ b/toolkit/components/satchel/test/unit/test_db_update_v1.js
@@ -128,17 +128,17 @@ function run_test()
   do_check_true(is_about_now(firstUsed));
 
   // The next test adds the entry again, and check to see that the lastUsed
   // field is updated. Unfortunately, on Windows PR_Now() is granular
   // (robarnold says usually 16.5ms, sometimes 10ms), so if we execute the
   // test too soon the timestamp will be the same! So, we'll wait a short
   // period of time to make sure the timestamp will differ.
   do_test_pending();
-  do_timeout(50, "delayed_test()");
+  do_timeout(50, delayed_test);
 
   } catch (e) {
     throw "FAILED in test #" + testnum + " -- " + e;
   }
 }
 
 function delayed_test() {
   try {
--- a/toolkit/components/search/nsSearchService.js
+++ b/toolkit/components/search/nsSearchService.js
@@ -1214,17 +1214,20 @@ Engine.prototype = {
               getService(Ci.nsIStringBundleService);
     var stringBundle = sbs.createBundle(SEARCH_BUNDLE);
     var titleMessage = stringBundle.GetStringFromName("addEngineConfirmTitle");
 
     // Display only the hostname portion of the URL.
     var dialogMessage =
         stringBundle.formatStringFromName("addEngineConfirmation",
                                           [this._name, this._uri.host], 2);
-    var checkboxMessage = stringBundle.GetStringFromName("addEngineUseNowText");
+    var checkboxMessage = null;
+    if (!getBoolPref(BROWSER_SEARCH_PREF + "noCurrentEngine", false))
+      checkboxMessage = stringBundle.GetStringFromName("addEngineUseNowText");
+
     var addButtonLabel =
         stringBundle.GetStringFromName("addEngineAddButtonLabel");
 
     var ps = Cc["@mozilla.org/embedcomp/prompt-service;1"].
              getService(Ci.nsIPromptService);
     var buttonFlags = (ps.BUTTON_TITLE_IS_STRING * ps.BUTTON_POS_0) +
                       (ps.BUTTON_TITLE_CANCEL    * ps.BUTTON_POS_1) +
                        ps.BUTTON_POS_0_DEFAULT;
--- a/toolkit/content/LightweightThemeConsumer.jsm
+++ b/toolkit/content/LightweightThemeConsumer.jsm
@@ -37,35 +37,35 @@
 let EXPORTED_SYMBOLS = ["LightweightThemeConsumer"];
 
 function LightweightThemeConsumer(aDocument) {
   this._doc = aDocument;
   this._footerId = aDocument.documentElement.getAttribute("lightweightthemesfooter");
 
   Components.classes["@mozilla.org/observer-service;1"]
             .getService(Components.interfaces.nsIObserverService)
-            .addObserver(this, "lightweight-theme-changed", false);
+            .addObserver(this, "lightweight-theme-styling-update", false);
 
   var temp = {};
   Components.utils.import("resource://gre/modules/LightweightThemeManager.jsm", temp);
   this._update(temp.LightweightThemeManager.currentThemeForDisplay);
 }
 
 LightweightThemeConsumer.prototype = {
   observe: function (aSubject, aTopic, aData) {
-    if (aTopic != "lightweight-theme-changed")
+    if (aTopic != "lightweight-theme-styling-update")
       return;
 
     this._update(JSON.parse(aData));
   },
 
   destroy: function () {
     Components.classes["@mozilla.org/observer-service;1"]
               .getService(Components.interfaces.nsIObserverService)
-              .removeObserver(this, "lightweight-theme-changed");
+              .removeObserver(this, "lightweight-theme-styling-update");
 
     this._doc = null;
   },
 
   _update: function (aData) {
     if (!aData)
       aData = { headerURL: "", footerURL: "", textcolor: "", accentcolor: "" };
 
--- a/toolkit/content/tests/widgets/Makefile.in
+++ b/toolkit/content/tests/widgets/Makefile.in
@@ -45,16 +45,17 @@ include $(DEPTH)/config/autoconf.mk
 include $(topsrcdir)/config/rules.mk
 
 _TEST_FILES = 	test_bug360220.xul \
 		test_bug359754.xul \
 		test_bug365773.xul \
 		test_bug382990.xul \
 		test_bug457632.xul \
 		test_bug460942.xul \
+		test_bug509732.xul \
 		test_button.xul \
 		test_closemenu_attribute.xul \
 		test_colorpicker_popup.xul \
 		test_deck.xul \
 		test_menulist_keynav.xul \
 		test_menulist_null_value.xul \
 		test_popup_coords.xul \
 		test_popup_recreate.xul \
new file mode 100644
--- /dev/null
+++ b/toolkit/content/tests/widgets/test_bug509732.xul
@@ -0,0 +1,54 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="/tests/SimpleTest/test.css" type="text/css"?>
+<!--
+  XUL Widget Test for bug 509732
+  -->
+<window title="Bug 509732" width="500" height="600"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>  
+
+    <notificationbox id="nb" hidden="true"/>
+
+  <!-- test results are displayed in the html:body -->
+  <body xmlns="http://www.w3.org/1999/xhtml" style="height: 300px; overflow: auto;"
+        onload="test()"/>
+
+  <!-- test code goes here -->
+<script type="application/javascript">
+<![CDATA[
+var gNotificationBox;
+
+// Tests that a notification that is added in an hidden box didn't throw the animation
+function test() {
+  SimpleTest.waitForExplicitFinish();
+  gNotificationBox = document.getElementById("nb");
+
+  is(gNotificationBox.allNotifications.length, 0, "There should be no initial notifications");
+
+  gNotificationBox.appendNotification("Test notification",
+                                      "notification1", null,
+                                      gNotificationBox.PRIORITY_INFO_LOW,
+                                      null);
+
+  is(gNotificationBox.allNotifications.length, 1, "Notification exists");
+  is(gNotificationBox._timer, null, "Notification timer should be null");
+
+  test1();
+}
+
+// Tests that a notification that is removed from an hidden box didn't throw the animation
+function test1() {
+  let notification = gNotificationBox.getNotificationWithValue("notification1");
+  gNotificationBox.removeNotification(notification);
+  ok(!gNotificationBox.currentNotification, "Test 1 should show no current animation");
+  is(gNotificationBox._timer, null, "Notification timer should be null");
+  is(gNotificationBox.allNotifications.length, 0, "Test 1 should show no notifications present");
+
+  SimpleTest.finish();
+}
+]]>
+</script>
+
+</window>
--- a/toolkit/content/widgets/notification.xml
+++ b/toolkit/content/widgets/notification.xml
@@ -59,17 +59,17 @@
       </property>
 
       <method name="getNotificationWithValue">
         <parameter name="aValue"/>
         <body>
           <![CDATA[
             var notifications = this.allNotifications;
             for (var n = notifications.length - 1; n >= 0; n--) {
-              if (aValue == notifications[n].value)
+              if (aValue == notifications[n].getAttribute("value"))
                 return notifications[n];
             }
             return null;
           ]]>
         </body>
       </method>
 
       <method name="appendNotification">
@@ -215,39 +215,51 @@
               if (this._closedNotification) {
                 this.removeChild(this._closedNotification);
                 this._closedNotification = null;
               }
               this._setBlockingState(this.currentNotification);
             }
 
             var height = aNotification.boxObject.height;
+            var skipAnimation = (height == 0);
             var change = height / this.slideSteps;
             var margin;
             if (aSlideIn) {
               if (this.currentNotification &&
                   this.currentNotification.boxObject.height > height)
                 height = this.currentNotification.boxObject.height;
 
               this.currentNotification = aNotification;
               aNotification.style.removeProperty("position");
               aNotification.style.removeProperty("top");
+
+              if (skipAnimation) {
+                this._setBlockingState(this.currentNotification);
+                return;
+              }
+
               aNotification.style.marginTop = -height + "px";
               aNotification.style.opacity = 0;
               margin = -height;
             }
             else {
               change = -change;
               this._closedNotification = aNotification;
               var notifications = this.allNotifications;
               var idx = notifications.length - 1;
-              if (idx >= 0)
-                this.currentNotification = notifications[idx];
-              else
-                this.currentNotification = null;
+              this.currentNotification = (idx >= 0) ? notifications[idx] : null;
+
+              if (skipAnimation) {
+                this.removeChild(this._closedNotification);
+                this._closedNotification = null;
+                this._setBlockingState(this.currentNotification);
+                return;
+              }
+
               var style = window.getComputedStyle(aNotification, null);
               margin = style.getPropertyCSSValue("margin-top").
                          getFloatValue(CSSPrimitiveValue.CSS_PX);
             }
             var opacitychange = change / height;
             const FRAME_LENGTH = 50;
 
             function slide(self, args, off) {
--- a/toolkit/content/widgets/textbox.xml
+++ b/toolkit/content/widgets/textbox.xml
@@ -166,19 +166,19 @@
               !this.value &&
               this.emptyText) {
 
             if (!this.hasAttribute("isempty")) {
               this.setAttribute("isempty", "true");
 
               // Hide the emptytext for a bit, in case the textbox will be focused subsequently
               this.inputField.setAttribute("emptytextdelay", "true");
-              setTimeout(function (textbox) {
-                textbox.inputField.removeAttribute("emptytextdelay");
-              }, 100, this);
+              setTimeout(function (input) {
+                input.removeAttribute("emptytextdelay");
+              }, 100, this.inputField);
 
               try {
                 this.editor.transactionManager.beginBatch();
               } catch (e) {}
             }
 
             this.inputField.value = this.emptyText;
           }
--- a/toolkit/mozapps/extensions/src/LightweightThemeManager.jsm
+++ b/toolkit/mozapps/extensions/src/LightweightThemeManager.jsm
@@ -128,16 +128,17 @@ var LightweightThemeManager = {
 
     if (_previewTimer) {
       _previewTimer.cancel();
       _previewTimer = null;
     }
 
     _prefs.setBoolPref("isThemeSelected", aData != null);
     _notifyWindows(aData);
+    _observerService.notifyObservers(null, "lightweight-theme-changed", null);
 
     if (PERSIST_ENABLED && aData)
       _persistImages(aData);
 
     return aData;
   },
 
   getUsedTheme: function (aId) {
@@ -277,17 +278,17 @@ function _updateUsedThemes(aList) {
     aList.length = MAX_USED_THEMES_COUNT;
 
   _prefs.setCharPref("usedThemes", JSON.stringify(aList));
 
   _observerService.notifyObservers(null, "lightweight-theme-list-changed", null);
 }
 
 function _notifyWindows(aThemeData) {
-  _observerService.notifyObservers(null, "lightweight-theme-changed",
+  _observerService.notifyObservers(null, "lightweight-theme-styling-update",
                                    JSON.stringify(aThemeData));
 }
 
 var _previewTimer;
 var _previewTimerCallback = {
   notify: function () {
     LightweightThemeManager.resetPreview();
   }
--- a/toolkit/mozapps/extensions/test/unit/test_bug299716.js
+++ b/toolkit/mozapps/extensions/test/unit/test_bug299716.js
@@ -357,17 +357,17 @@ function run_test() {
     gEM.installItemFromFile(do_get_addon(ADDONS[i].addon),
                             NS_INSTALL_LOCATION_APPPROFILE);
   }
   dump("\n\n*** DONE INSTALLING NEW ITEMS\n\n");
 
   do_test_pending();
 
   // Give time for phone home to complete.
-  do_timeout(DELAY, "run_test_pt2()");
+  do_timeout(DELAY, run_test_pt2);
 }
 
 /**
  * Check the versions of all items, and ask the extension manager to find updates.
  */
 function run_test_pt2() {
   dump("\n\n*** RESTARTING EXTENSION MANAGER\n\n");
   restartEM();
--- a/toolkit/mozapps/extensions/test/unit/test_bug449027.js
+++ b/toolkit/mozapps/extensions/test/unit/test_bug449027.js
@@ -432,17 +432,17 @@ var WindowWatcher = {
     var args = arguments.wrappedJSObject;
 
     gNewBlocks = [];
     var list = args.list;
     for (var i = 0; i < list.length; i++)
       gNewBlocks.push(list[i].name + " " + list[i].version);
 
     // Call the callback after the blocklist has finished up
-    do_timeout(0, "gCallback()");
+    do_timeout(0, gCallback);
   },
 
   QueryInterface: function(iid) {
     if (iid.equals(Components.interfaces.nsIWindowWatcher)
      || iid.equals(Components.interfaces.nsISupports))
       return this;
 
     throw Components.results.NS_ERROR_NO_INTERFACE;
--- a/toolkit/mozapps/extensions/test/unit/test_bug455906.js
+++ b/toolkit/mozapps/extensions/test/unit/test_bug455906.js
@@ -169,17 +169,17 @@ var WindowWatcher = {
     do_check_eq(url, URI_EXTENSION_BLOCKLIST_DIALOG);
 
     if (gNotificationCheck) {
       var args = arguments.wrappedJSObject;
       gNotificationCheck(args);
     }
 
     // Call the next test after the blocklist has finished up
-    do_timeout(0, "gTestCheck()");
+    do_timeout(0, gTestCheck);
   },
 
   QueryInterface: function(iid) {
     if (iid.equals(Ci.nsIWindowWatcher)
      || iid.equals(Ci.nsISupports))
       return this;
 
     throw Cr.NS_ERROR_NO_INTERFACE;
--- a/toolkit/mozapps/extensions/test/unit/test_bug514327_3.js
+++ b/toolkit/mozapps/extensions/test/unit/test_bug514327_3.js
@@ -102,17 +102,17 @@ var WindowWatcher = {
     // Should only include one item
     do_check_eq(arguments.wrappedJSObject.list.length, 1);
     // And that item should be the blocked plugin, not the outdated one
     var item = arguments.wrappedJSObject.list[0];
     do_check_true(item.item instanceof Ci.nsIPluginTag);
     do_check_neq(item.name, "test_bug514327_outdated");
 
     // Call the next test after the blocklist has finished up
-    do_timeout(0, "gNextTestPart()");
+    do_timeout(0, gNextTestPart);
   },
 
   QueryInterface: function(iid) {
     if (iid.equals(Ci.nsIWindowWatcher)
      || iid.equals(Ci.nsISupports))
       return this;
 
     throw Cr.NS_ERROR_NO_INTERFACE;
--- a/toolkit/mozapps/installer/wince/nsInstallerDlg.cpp
+++ b/toolkit/mozapps/installer/wince/nsInstallerDlg.cpp
@@ -340,18 +340,20 @@ BOOL nsInstallerDlg::SilentFirstRun()
 
   WCHAR sCmdLine[MAX_PATH];
   _snwprintf(sCmdLine, MAX_PATH, L"%s\\%s.exe", m_sInstallPath, Strings.GetString(StrID_AppShortName));
   PROCESS_INFORMATION pi;
   BOOL bResult = CreateProcess(sCmdLine, L"-silent -nosplash",
                                NULL, NULL, FALSE, 0, NULL, NULL, NULL, &pi);
   if (bResult)
   {
-    // Wait for it to finish
-    WaitForSingleObject(pi.hProcess, INFINITE);
+    // Wait for it to finish (since the system is likely to be busy
+    // while it launches anyways). The process may never terminate
+    // if FastStart is enabled, so don't wait longer than 10 seconds.
+    WaitForSingleObject(pi.hProcess, 10000);
   }
   SetWindowText(GetDlgItem(m_hDlg, IDC_STATUS_TEXT), L"");
   return bResult;
 }
 
 void nsInstallerDlg::AddErrorMsg(WCHAR* sErr)
 {
   WCHAR sMsg[c_nMaxErrorLen];
--- a/toolkit/mozapps/update/test/unit/head_update.js.in
+++ b/toolkit/mozapps/update/test/unit/head_update.js.in
@@ -598,17 +598,17 @@ xhr.prototype = {
     gXHR.channel.originalURI = AUS_Cc["@mozilla.org/network/io-service;1"].
                                getService(AUS_Ci.nsIIOService).
                                newURI(url, null, null);
     gXHR._method = method; gXHR._url = url;
   },
   responseXML: null,
   responseText: null,
   send: function(body) {
-    do_timeout(0, "gXHRCallback()"); // Use a timeout so the XHR completes
+    do_timeout(0, gXHRCallback); // Use a timeout so the XHR completes
   },
   _onprogress: null,
   set onprogress(val) { gXHR._onprogress = val; },
   get onprogress() { return gXHR._onprogress; },
   _onerror: null,
   set onerror(val) { gXHR._onerror = val; },
   get onerror() { return gXHR._onerror; },
   _onload: null,
@@ -651,28 +651,28 @@ const updateCheckListener = {
     gRequestURL = request.channel.originalURI.spec;
     gUpdateCount = updateCount;
     gUpdates = updates;
     dump("onError: url = " + gRequestURL + ", " +
          "request.status = " + request.status + ", " +
          "update.statusText = " + request.statusText + ", " +
          "updateCount = " + updateCount + "\n");
     // Use a timeout to allow the XHR to complete
-    do_timeout(0, "gCheckFunc()");
+    do_timeout(0, gCheckFunc);
   },
 
   onError: function(request, update) {
     gRequestURL = request.channel.originalURI.spec;
     gStatusCode = request.status;
     gStatusText = update.statusText;
     dump("onError: url = " + gRequestURL + ", " +
          "request.status = " + gStatusCode + ", " +
          "update.statusText = " + gStatusText + "\n");
     // Use a timeout to allow the XHR to complete
-    do_timeout(0, "gCheckFunc()");
+    do_timeout(0, gCheckFunc);
   },
 
   QueryInterface: function(aIID) {
     if (!aIID.equals(AUS_Ci.nsIUpdateCheckListener) &&
         !aIID.equals(AUS_Ci.nsISupports))
       throw AUS_Cr.NS_ERROR_NO_INTERFACE;
     return this;
   }
--- a/toolkit/mozapps/update/test/unit/test_0020_general.js
+++ b/toolkit/mozapps/update/test/unit/test_0020_general.js
@@ -47,17 +47,17 @@ function run_test() {
   var pb = getPrefBranch();
   pb.setCharPref(PREF_APP_UPDATE_URL_OVERRIDE, URL_HOST + "update.xml");
   var defaults = pb.QueryInterface(AUS_Ci.nsIPrefService).getDefaultBranch(null);
   defaults.setCharPref("app.update.channel", "bogus_channel");
   // The mock XMLHttpRequest is MUCH faster
   overrideXHR(callHandleEvent);
   startAUS();
   startUpdateChecker();
-  do_timeout(0, "run_test_pt1()");
+  do_timeout(0, run_test_pt1);
 }
 
 function end_test() {
   do_test_finished();
   cleanUp();
 }
 
 // Helper function for testing update counts returned from an update xml
--- a/toolkit/mozapps/update/test/unit/test_0030_general.js
+++ b/toolkit/mozapps/update/test/unit/test_0030_general.js
@@ -47,17 +47,17 @@ function run_test() {
   removeUpdateDirsAndFiles();
   // The mock XMLHttpRequest is MUCH faster
   getPrefBranch().setCharPref(PREF_APP_UPDATE_URL_OVERRIDE, URL_HOST + "update.xml");
   overrideXHR(callHandleEvent);
   startAUS();
   startUpdateChecker();
   // The HTTP server is only used for the mar file downloads which is slow
   start_httpserver(DIR_DATA);
-  do_timeout(0, "run_test_pt1()");
+  do_timeout(0, run_test_pt1);
 }
 
 function end_test() {
   stop_httpserver(do_test_finished);
   cleanUp();
 }
 
 // Callback function used by the custom XMLHttpRequest implementation to
@@ -213,17 +213,17 @@ const downloadListener = {
   },
 
   onStatus: function(request, context, status, statusText) {
   },
 
   onStopRequest: function(request, context, status) {
     gStatusResult = status;
     // Use a timeout to allow the request to complete
-    do_timeout(0, "gCheckFunc()");
+    do_timeout(0, gCheckFunc);
   },
 
   QueryInterface: function(iid) {
     if (!iid.equals(AUS_Ci.nsIRequestObserver) &&
         !iid.equals(AUS_Ci.nsIProgressEventSink) &&
         !iid.equals(AUS_Ci.nsISupports))
       throw AUS_Cr.NS_ERROR_NO_INTERFACE;
     return this;
--- a/toolkit/mozapps/update/test/unit/test_0040_general.js
+++ b/toolkit/mozapps/update/test/unit/test_0040_general.js
@@ -52,17 +52,17 @@ function run_test() {
   removeUpdateDirsAndFiles();
   // The mock XMLHttpRequest is MUCH faster
   overrideXHR(callHandleEvent);
   startAUS();
   startUpdateChecker();
   gAppInfo = AUS_Cc["@mozilla.org/xre/app-info;1"].
              getService(AUS_Ci.nsIXULAppInfo).
              QueryInterface(AUS_Ci.nsIXULRuntime);
-  do_timeout(0, "run_test_pt1()");
+  do_timeout(0, run_test_pt1);
 }
 
 function end_test() {
   do_test_finished();
   cleanUp();
 }
 
 // Callback function used by the custom XMLHttpRequest implementation to
--- a/toolkit/mozapps/update/test/unit/test_0050_general.js
+++ b/toolkit/mozapps/update/test/unit/test_0050_general.js
@@ -51,17 +51,17 @@ var gExpectedStatusText;
 function run_test() {
   do_test_pending();
   removeUpdateDirsAndFiles();
   startAUS();
   startUpdateChecker();
   getPrefBranch().setCharPref(PREF_APP_UPDATE_URL_OVERRIDE,
                               URL_HOST + "update.xml");
   overrideXHR(callHandleEvent);
-  do_timeout(0, "run_test_pt1()");
+  do_timeout(0, run_test_pt1);
 }
 
 function end_test() {
   do_test_finished();
   cleanUp();
 }
 
 // Callback function used by the custom XMLHttpRequest implementation to
--- a/toolkit/mozapps/update/test/unit/test_bug497578.js
+++ b/toolkit/mozapps/update/test/unit/test_bug497578.js
@@ -67,17 +67,17 @@ function run_test() {
   pb.setBoolPref("app.update.enabled", true);
   pb.setBoolPref("browser.privatebrowsing.autostart", true);
 
   var defaults = pb.QueryInterface(AUS_Ci.nsIPrefService).getDefaultBranch(null);
   defaults.setCharPref("app.update.channel", "bogus_channel");
 
   createAppInfo("xpcshell@tests.mozilla.org", "XPCShell", "1.0", "2.0");
   setDefaultPrefs();
-  do_timeout(0, "run_test_pt1()");
+  do_timeout(0, run_test_pt1);
 }
 
 function end_test() {
   do_test_finished();
   cleanUp();
 }
 
 function run_test_pt1() {
@@ -106,17 +106,17 @@ function run_test_pt1() {
   privBrowsing.observe(null, "profile-after-change", "");
   dump("Testing: private mode should be entered automatically\n");
   do_check_true(privBrowsing.privateBrowsingEnabled);
 
   dump("Testing: private browsing is auto-started\n");
   do_check_true(privBrowsing.autoStarted);
 
   // Use a timeout to give private browsing time to reset necko.
-  do_timeout(0, "run_test_pt2()");
+  do_timeout(0, run_test_pt2);
 }
 function run_test_pt2() {
   dump("Testing: update count should equal 1\n");
   do_check_eq(gUpdateManager.updateCount, 1);
   dump("Testing: activeUpdate should not equal null\n");
   do_check_neq(gUpdateManager.activeUpdate, null);
   dump("Testing: activeUpdate.state should not equal null\n");
   do_check_neq(gUpdateManager.activeUpdate.state, null);
--- a/toolkit/mozapps/update/test_timermanager/unit/test_0010_timermanager.js
+++ b/toolkit/mozapps/update/test_timermanager/unit/test_0010_timermanager.js
@@ -156,17 +156,17 @@ function run_test() {
 }
 
 function end_test() {
   gUTM.observe(null, "xpcom-shutdown", "");
   do_test_finished();
 }
 
 function run_test1thru6() {
-  gNextFunc = "check_test1thru6()";
+  gNextFunc = check_test1thru6;
   // bogus default interval
   gCompReg.registerFactory(TESTS[0].classID, TESTS[0].desc,
                            TESTS[0].contractID, gTest1Factory);
   gCatMan.addCategoryEntry(CATEGORY_UPDATE_TIMER, TESTS[0].desc,
                            [TESTS[0].contractID, TESTS[0].method,
                             TESTS[0].timerID, TESTS[0].prefInterval,
                             TESTS[0].defaultInterval].join(","), false, true);
 
@@ -266,21 +266,21 @@ function check_test1thru6() {
     let entry = entries.getNext().QueryInterface(Ci.nsISupportsCString).data;
     gCatMan.deleteCategoryEntry(CATEGORY_UPDATE_TIMER, entry, false);
     count++;
   }
   dump("Testing: no " + CATEGORY_UPDATE_TIMER + " categories are still " +
        "registered\n");
   do_check_eq(count, 0);
 
-  do_timeout(0, "run_test7()");
+  do_timeout(0, run_test7());
 }
 
 function run_test7() {
-  gNextFunc = "check_test7()";
+  gNextFunc = check_test7;
   gPref.setIntPref(PREF_BRANCH_LAST_UPDATE_TIME + TESTS[6].timerID, 1);
   gCompReg.registerFactory(TESTS[6].classID, TESTS[6].desc,
                            TESTS[6].contractID, gTest7Factory);
   gUTM.registerTimer(TESTS[6].timerID, gTest7TimerCallback,
                      TESTS[6].defaultInterval);
 }
 
 function check_test7() {
@@ -381,17 +381,17 @@ var gTest6Factory = {
       return gTest6TimerCallback.QueryInterface(iid);
     throw Cr.NS_ERROR_NO_AGGREGATION;
   }
 };
 
 var gTest7TimerCallback = {
   notify: function T7CB_notify(aTimer) {
     TESTS[6].notified = true;
-    do_timeout(0, "check_test7()");
+    do_timeout(0, check_test7);
   },
   QueryInterface: XPCOMUtils.generateQI([Ci.nsITimerCallback])
 };
 
 var gTest7Factory = {
   createInstance: function (outer, iid) {
     if (outer == null)
       return gTest7TimerCallback.QueryInterface(iid);
--- a/uriloader/exthandler/tests/unit/test_punycodeURIs.js
+++ b/uriloader/exthandler/tests/unit/test_punycodeURIs.js
@@ -53,17 +53,17 @@ function checkFile() {
 
   if (!tempFile.exists()) {
     if (gCheckExistsAttempts >= kMaxCheckExistAttempts) {
       do_throw("Expected File " + tempFile.path + " does not exist after " +
 	       kMaxCheckExistAttempts + " seconds");
     }
     else {
       // Wait a bit longer then try again
-      do_timeout(1000, "checkFile()");
+      do_timeout(1000, checkFile);
     }
   }
 
   // Now read it
   var fstream = Components.classes["@mozilla.org/network/file-input-stream;1"].
     createInstance(Components.interfaces.nsIFileInputStream);
   var sstream = Components.classes["@mozilla.org/scriptableinputstream;1"].
     createInstance(Components.interfaces.nsIScriptableInputStream);
@@ -150,10 +150,10 @@ function run_test() {
   // Just check we've got these matching, if we haven't there's a problem
   // with ascii spec or our test case.
   do_check_eq(uri.asciiSpec, kExpectedURI);
 
   localHandler.executable = exe;
   localHandler.launchWithURI(uri);
 
   do_test_pending();
-  do_timeout(1000, "checkFile()");
+  do_timeout(1000, checkFile);
 }
--- a/widget/src/gtk2/gtk2drawing.c
+++ b/widget/src/gtk2/gtk2drawing.c
@@ -985,17 +985,18 @@ moz_gtk_button_paint(GdkDrawable* drawab
                                           &default_bottom, &default_right);
         x += default_left;
         y += default_top;
         width -= (default_left + default_right);
         height -= (default_top + default_bottom);
     }
  
     if (relief != GTK_RELIEF_NONE || state->depressed ||
-        button_state == GTK_STATE_PRELIGHT) {
+        (button_state != GTK_STATE_NORMAL &&
+         button_state != GTK_STATE_INSENSITIVE)) {
         TSOffsetStyleGCs(style, x, y);
         /* the following line can trigger an assertion (Crux theme)
            file ../../gdk/gdkwindow.c: line 1846 (gdk_window_clear_area):
            assertion `GDK_IS_WINDOW (window)' failed */
         gtk_paint_box(style, drawable, button_state, shadow_type, cliprect,
                       widget, "button", x, y, width, height);
     }
 
--- a/widget/src/gtk2/nsClipboard.cpp
+++ b/widget/src/gtk2/nsClipboard.cpp
@@ -41,45 +41,45 @@
 #include "nsString.h"
 #include "nsReadableUtils.h"
 #include "nsXPIDLString.h"
 #include "nsPrimitiveHelpers.h"
 #include "nsICharsetConverterManager.h"
 #include "nsIServiceManager.h"
 #include "nsImageToPixbuf.h"
 #include "nsStringStream.h"
+#include "nsIObserverService.h"
 
 #include "imgIContainer.h"
 
 #include <gtk/gtk.h>
 
 // For manipulation of the X event queue
 #include <X11/Xlib.h>
 #include <gdk/gdkx.h>
 #include <sys/time.h>
 #include <sys/types.h>
 #include <unistd.h>
 
 #ifdef POLL_WITH_XCONNECTIONNUMBER
 #include <poll.h>
 #endif
 
-// Callback when someone asks us for the selection
+// Callback when someone asks us for the data
 void
-invisible_selection_get_cb (GtkWidget          *aWidget,
-                            GtkSelectionData   *aSelectionData,
-                            guint               aTime,
-                            guint               aInfo,
-                            nsClipboard        *aClipboard);
+clipboard_get_cb(GtkClipboard *aGtkClipboard,
+                 GtkSelectionData *aSelectionData,
+                 guint info,
+                 gpointer user_data);
 
-gboolean
-selection_clear_event_cb   (GtkWidget          *aWidget,
-                            GdkEventSelection  *aEvent,
-                            nsClipboard        *aClipboard);
-
+// Callback when someone asks us to clear a clipboard
+void
+clipboard_clear_cb(GtkClipboard *aGtkClipboard,
+                   gpointer user_data);
+                   
 static void
 ConvertHTMLtoUCS2          (guchar             *data,
                             PRInt32             dataLength,
                             PRUnichar         **unicodeData,
                             PRInt32            &outUnicodeLen);
 
 static void
 GetHTMLCharset             (guchar * data, PRInt32 dataLength, nsCString& str);
@@ -116,43 +116,56 @@ clipboard_contents_received(GtkClipboard
                             gpointer          data);
 
 static void
 clipboard_text_received(GtkClipboard *clipboard,
                         const gchar  *text,
                         gpointer      data);
 
 nsClipboard::nsClipboard()
-{
-    mWidget = nsnull;
+{    
 }
 
 nsClipboard::~nsClipboard()
 {
-    if (mWidget)
-        gtk_widget_destroy(mWidget);
 }
 
 NS_IMPL_ISUPPORTS1(nsClipboard, nsIClipboard)
 
 nsresult
 nsClipboard::Init(void)
-{
-    mWidget = gtk_invisible_new();
-    if (!mWidget)
-        return NS_ERROR_FAILURE;
+{    
+    nsresult rv;
+    nsCOMPtr<nsIObserverService> os
+      (do_GetService("@mozilla.org/observer-service;1", &rv));
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    os->AddObserver(this, "quit-application", PR_FALSE);
+
+    return NS_OK;
+}
 
-    g_signal_connect(G_OBJECT(mWidget), "selection_get",
-                     G_CALLBACK(invisible_selection_get_cb), this);
+NS_IMETHODIMP
+nsClipboard::Observe(nsISupports *aSubject, const char *aTopic, const PRUnichar *aData)
+{
+    if (strcmp(aTopic, "quit-application") == 0) {
+        // application is going to quit, save clipboard content
+        Store();
+    }
+    return NS_OK;
+}
 
-    g_signal_connect(G_OBJECT(mWidget), "selection_clear_event",
-                     G_CALLBACK(selection_clear_event_cb), this);
-
-    // XXX make sure to set up the selection_clear event
-
+nsresult
+nsClipboard::Store(void)
+{
+    // Ask the clipboard manager to store the current clipboard content
+    if (mGlobalTransferable) {
+        GtkClipboard *clipboard = gtk_clipboard_get(GDK_SELECTION_CLIPBOARD);
+        gtk_clipboard_store(clipboard);
+    }
     return NS_OK;
 }
 
 NS_IMETHODIMP
 nsClipboard::SetData(nsITransferable *aTransferable,
                      nsIClipboardOwner *aOwner, PRInt32 aWhichClipboard)
 {
     // See if we can short cut
@@ -171,93 +184,101 @@ nsClipboard::SetData(nsITransferable *aT
         NS_ENSURE_SUCCESS(rv, rv);
     }
     rv = mPrivacyHandler->PrepareDataForClipboard(aTransferable);
     NS_ENSURE_SUCCESS(rv, rv);
 
     // Clear out the clipboard in order to set the new data
     EmptyClipboard(aWhichClipboard);
 
-    if (aWhichClipboard == kSelectionClipboard) {
-        mSelectionOwner = aOwner;
-        mSelectionTransferable = aTransferable;
-    }
-    else {
-        mGlobalOwner = aOwner;
-        mGlobalTransferable = aTransferable;
-    }
-
-    // Which selection are we about to claim, CLIPBOARD or PRIMARY?
-    GdkAtom selectionAtom = GetSelectionAtom(aWhichClipboard);
-
-    // Make ourselves the owner.  If we fail to, return.
-    if (!gtk_selection_owner_set(mWidget, selectionAtom, GDK_CURRENT_TIME))
-        return NS_ERROR_FAILURE;
-
-    // Clear the old selection target list.
-    gtk_selection_clear_targets(mWidget, selectionAtom);
+    // List of suported targets
+    GtkTargetList *list = gtk_target_list_new(NULL, 0);
 
     // Get the types of supported flavors
     nsCOMPtr<nsISupportsArray> flavors;
 
     rv = aTransferable->FlavorsTransferableCanExport(getter_AddRefs(flavors));
     if (!flavors || NS_FAILED(rv))
         return NS_ERROR_FAILURE;
 
     // Add all the flavors to this widget's supported type.
-    gint nImageTargets = 0;
+    PRBool imagesAdded = PR_FALSE;
     PRUint32 count;
     flavors->Count(&count);
     for (PRUint32 i=0; i < count; i++) {
         nsCOMPtr<nsISupports> tastesLike;
         flavors->GetElementAt(i, getter_AddRefs(tastesLike));
         nsCOMPtr<nsISupportsCString> flavor = do_QueryInterface(tastesLike);
 
         if (flavor) {
             nsXPIDLCString flavorStr;
             flavor->ToString(getter_Copies(flavorStr));
 
             // special case text/unicode since we can handle all of
             // the string types
             if (!strcmp(flavorStr, kUnicodeMime)) {
-                AddTarget(gdk_atom_intern("UTF8_STRING", FALSE),
-                          selectionAtom);
-                AddTarget(gdk_atom_intern("COMPOUND_TEXT", FALSE),
-                          selectionAtom);
-                AddTarget(gdk_atom_intern("TEXT", FALSE), selectionAtom);
-                AddTarget(GDK_SELECTION_TYPE_STRING, selectionAtom);
-                // next loop iteration
+                gtk_target_list_add(list, gdk_atom_intern("UTF8_STRING", FALSE), 0, 0);
+                gtk_target_list_add(list, gdk_atom_intern("COMPOUND_TEXT", FALSE), 0, 0);
+                gtk_target_list_add(list, gdk_atom_intern("TEXT", FALSE), 0, 0);
+                gtk_target_list_add(list, GDK_SELECTION_TYPE_STRING, 0, 0);
                 continue;
             }
 
             if (flavorStr.EqualsLiteral(kNativeImageMime) ||
                 flavorStr.EqualsLiteral(kPNGImageMime) ||
                 flavorStr.EqualsLiteral(kJPEGImageMime) ||
                 flavorStr.EqualsLiteral(kGIFImageMime)) {
                 // don't bother adding image targets twice
-                if (!nImageTargets) {
+                if (!imagesAdded) {
                     // accept any writable image type
-                    GtkTargetList *list = gtk_target_list_new(NULL, 0);
                     gtk_target_list_add_image_targets(list, 0, TRUE);
-                    GtkTargetEntry *targets = gtk_target_table_new_from_list(list, &nImageTargets);
-                    gtk_selection_add_targets(mWidget, selectionAtom, targets, nImageTargets);
-                    gtk_target_table_free(targets, nImageTargets);
-                    gtk_target_list_unref(list);
+                    imagesAdded = PR_TRUE;
                 }
-                // next loop iteration
                 continue;
             }
 
             // Add this to our list of valid targets
             GdkAtom atom = gdk_atom_intern(flavorStr, FALSE);
-            AddTarget(atom, selectionAtom);
+            gtk_target_list_add(list, atom, 0, 0);
         }
     }
+    
+    // Get GTK clipboard (CLIPBOARD or PRIMARY)
+    GtkClipboard *gtkClipboard = gtk_clipboard_get(GetSelectionAtom(aWhichClipboard));
+  
+    gint numTargets;
+    GtkTargetEntry *gtkTargets = gtk_target_table_new_from_list(list, &numTargets);
+          
+    // Set getcallback and request to store data after an application exit
+    if (gtk_clipboard_set_with_data(gtkClipboard, gtkTargets, numTargets, 
+                                    clipboard_get_cb, clipboard_clear_cb, this))
+    {
+        // We managed to set-up the clipboard so update internal state
+        // We have to set it now because gtk_clipboard_set_with_data() calls clipboard_clear_cb()
+        // which reset our internal state 
+        if (aWhichClipboard == kSelectionClipboard) {
+            mSelectionOwner = aOwner;
+            mSelectionTransferable = aTransferable;
+        }
+        else {
+            mGlobalOwner = aOwner;
+            mGlobalTransferable = aTransferable;
+            gtk_clipboard_set_can_store(gtkClipboard, gtkTargets, numTargets);
+        }
 
-    return NS_OK;
+        rv = NS_OK;
+    }
+    else {  
+        rv = NS_ERROR_FAILURE;
+    }
+
+    gtk_target_table_free(gtkTargets, numTargets);
+    gtk_target_list_unref(list);
+  
+    return rv;
 }
 
 NS_IMETHODIMP
 nsClipboard::GetData(nsITransferable *aTransferable, PRInt32 aWhichClipboard)
 {
     if (!aTransferable)
         return NS_ERROR_FAILURE;
 
@@ -426,16 +447,19 @@ nsClipboard::HasDataMatchingFlavors(cons
         if (!strcmp(aFlavorList[i], kUnicodeMime) && 
             gtk_selection_data_targets_include_text(selection_data)) {
             *_retval = PR_TRUE;
             break;
         }
 
         for (PRInt32 j = 0; j < n_targets; j++) {
             gchar *atom_name = gdk_atom_name(targets[j]);
+            if (!atom_name)
+                continue;
+
             if (!strcmp(atom_name, aFlavorList[i]))
                 *_retval = PR_TRUE;
 
             // X clipboard wants image/jpeg, not image/jpg
             if (!strcmp(aFlavorList[i], kJPEGImageMime) && !strcmp(atom_name, "image/jpeg"))
                 *_retval = PR_TRUE;
 
             g_free(atom_name);
@@ -484,25 +508,18 @@ nsClipboard::GetTransferable(PRInt32 aWh
         retval = mSelectionTransferable.get();
     else
         retval = mGlobalTransferable.get();
         
     return retval;
 }
 
 void
-nsClipboard::AddTarget(GdkAtom aName, GdkAtom aClipboard)
-{
-    gtk_selection_add_target(mWidget, aClipboard, aName, 0);
-}
-
-void
-nsClipboard::SelectionGetEvent (GtkWidget        *aWidget,
-                                GtkSelectionData *aSelectionData,
-                                guint             aTime)
+nsClipboard::SelectionGetEvent(GtkClipboard     *aClipboard,
+                               GtkSelectionData *aSelectionData)
 {
     // Someone has asked us to hand them something.  The first thing
     // that we want to do is see if that something includes text.  If
     // it does, try to give it text/unicode after converting it to
     // utf-8.
 
     PRInt32 whichClipboard;
 
@@ -510,17 +527,25 @@ nsClipboard::SelectionGetEvent (GtkWidge
     if (aSelectionData->selection == GDK_SELECTION_PRIMARY)
         whichClipboard = kSelectionClipboard;
     else if (aSelectionData->selection == GDK_SELECTION_CLIPBOARD)
         whichClipboard = kGlobalClipboard;
     else
         return; // THAT AIN'T NO CLIPBOARD I EVER HEARD OF
 
     nsCOMPtr<nsITransferable> trans = GetTransferable(whichClipboard);
-    
+    if (!trans) {
+      // We have nothing to serve
+#ifdef DEBUG_CLIPBOARD
+      printf("nsClipboard::SelectionGetEvent() - %s clipboard is empty!\n",
+             whichClipboard == kSelectionClipboard ? "Selection" : "Global");
+#endif
+      return;
+    }
+
     nsresult rv;
     nsCOMPtr<nsISupports> item;
     PRUint32 len;
 
     // Check to see if the selection data includes any of the string
     // types that we support.
     if (aSelectionData->target == gdk_atom_intern ("STRING", FALSE) ||
         aSelectionData->target == gdk_atom_intern ("TEXT", FALSE) ||
@@ -627,49 +652,47 @@ nsClipboard::SelectionGetEvent (GtkWidge
         nsMemory::Free(primitive_data);
     }
 
     g_free(target_name);
                            
 }
 
 void
-nsClipboard::SelectionClearEvent (GtkWidget         *aWidget,
-                                  GdkEventSelection *aEvent)
+nsClipboard::SelectionClearEvent(GtkClipboard *aGtkClipboard)
 {
     PRInt32 whichClipboard;
 
     // which clipboard?
-    if (aEvent->selection == GDK_SELECTION_PRIMARY)
+    if (aGtkClipboard == gtk_clipboard_get(GDK_SELECTION_PRIMARY))
         whichClipboard = kSelectionClipboard;
-    else if (aEvent->selection == GDK_SELECTION_CLIPBOARD)
+    else if (aGtkClipboard == gtk_clipboard_get(GDK_SELECTION_CLIPBOARD))
         whichClipboard = kGlobalClipboard;
     else
         return; // THAT AIN'T NO CLIPBOARD I EVER HEARD OF
 
     EmptyClipboard(whichClipboard);
 }
 
 void
-invisible_selection_get_cb (GtkWidget          *aWidget,
-                            GtkSelectionData   *aSelectionData,
-                            guint               aTime,
-                            guint               aInfo,
-                            nsClipboard        *aClipboard)
+clipboard_get_cb(GtkClipboard *aGtkClipboard,
+                 GtkSelectionData *aSelectionData,
+                 guint info,
+                 gpointer user_data)
 {
-    aClipboard->SelectionGetEvent(aWidget, aSelectionData, aTime);
+    nsClipboard *aClipboard = static_cast<nsClipboard *>(user_data);
+    aClipboard->SelectionGetEvent(aGtkClipboard, aSelectionData);
 }
 
-gboolean
-selection_clear_event_cb   (GtkWidget          *aWidget,
-                            GdkEventSelection  *aEvent,
-                            nsClipboard        *aClipboard)
+void
+clipboard_clear_cb(GtkClipboard *aGtkClipboard,
+                   gpointer user_data)
 {
-    aClipboard->SelectionClearEvent(aWidget, aEvent);
-    return TRUE;
+    nsClipboard *aClipboard = static_cast<nsClipboard *>(user_data);
+    aClipboard->SelectionClearEvent(aGtkClipboard);
 }
 
 /*
  * when copy-paste, mozilla wants data encoded using UCS2,
  * other app such as StarOffice use "text/html"(RFC2854).
  * This function convert data(got from GTK clipboard)
  * to data mozilla wanted.
  *
--- a/widget/src/gtk2/nsClipboard.h
+++ b/widget/src/gtk2/nsClipboard.h
@@ -39,52 +39,49 @@
 #ifndef __nsClipboard_h_
 #define __nsClipboard_h_
 
 #include "nsIClipboard.h"
 #include "nsClipboardPrivacyHandler.h"
 #include "nsAutoPtr.h"
 #include <gtk/gtk.h>
 
-class nsClipboard : public nsIClipboard
+class nsClipboard : public nsIClipboard,
+                    public nsIObserver
 {
 public:
     nsClipboard();
     virtual ~nsClipboard();
     
     NS_DECL_ISUPPORTS
     
     NS_DECL_NSICLIPBOARD
+    NS_DECL_NSIOBSERVER
 
     // Make sure we are initialized, called from the factory
     // constructor
-    nsresult  Init                (void);
-    // Someone requested the selection from the hidden widget
-    void      SelectionGetEvent   (GtkWidget         *aWidget,
-                                   GtkSelectionData  *aSelectionData,
-                                   guint              aTime);
-    void      SelectionClearEvent (GtkWidget         *aWidget,
-                                   GdkEventSelection *aEvent);
+    nsresult  Init              (void);
 
+    // Someone requested the selection
+    void   SelectionGetEvent    (GtkClipboard     *aGtkClipboard,
+                                 GtkSelectionData *aSelectionData);
+    void   SelectionClearEvent  (GtkClipboard     *aGtkClipboard);
 
 private:
     // Utility methods
     static GdkAtom               GetSelectionAtom (PRInt32 aWhichClipboard);
     static GtkSelectionData     *GetTargets       (GdkAtom aWhichClipboard);
 
+    // Save global clipboard content to gtk
+    nsresult                     Store            (void);
+
     // Get our hands on the correct transferable, given a specific
     // clipboard
     nsITransferable             *GetTransferable  (PRInt32 aWhichClipboard);
 
-    // Add a target type to the hidden widget
-    void                         AddTarget        (GdkAtom aName,
-                                                   GdkAtom aClipboard);
-
-    // The hidden widget where we do all of our operations
-    GtkWidget                   *mWidget;
     // Hang on to our owners and transferables so we can transfer data
     // when asked.
     nsCOMPtr<nsIClipboardOwner>  mSelectionOwner;
     nsCOMPtr<nsIClipboardOwner>  mGlobalOwner;
     nsCOMPtr<nsITransferable>    mSelectionTransferable;
     nsCOMPtr<nsITransferable>    mGlobalTransferable;
     nsRefPtr<nsClipboardPrivacyHandler> mPrivacyHandler;
 
--- a/widget/src/gtk2/nsDragService.cpp
+++ b/widget/src/gtk2/nsDragService.cpp
@@ -976,17 +976,17 @@ nsDragService::IsTargetContextList(void)
 
     // walk the list of context targets and see if one of them is a list
     // of items.
     for (tmp = mTargetDragContext->targets; tmp; tmp = tmp->next) {
         /* Bug 331198 */
         GdkAtom atom = GDK_POINTER_TO_ATOM(tmp->data);
         gchar *name = NULL;
         name = gdk_atom_name(atom);
-        if (strcmp(name, gMimeListType) == 0)
+        if (name && strcmp(name, gMimeListType) == 0)
             retval = PR_TRUE;
         g_free(name);
         if (retval)
             break;
     }
     return retval;
 }
 
--- a/widget/src/gtk2/nsLookAndFeel.cpp
+++ b/widget/src/gtk2/nsLookAndFeel.cpp
@@ -39,17 +39,19 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsLookAndFeel.h"
 #include <gtk/gtk.h>
 
 #include "gtkdrawing.h"
 
 #ifdef MOZ_PLATFORM_HILDON
-#include "gfxPlatformGtk.h"
+#include "nsIServiceManager.h"
+#include "nsIPropertyBag2.h"
+#include "nsLiteralString.h"
 #endif
 
 #define GDK_COLOR_TO_NS_RGB(c) \
     ((nscolor) NS_RGB(c.red>>8, c.green>>8, c.blue>>8))
 
 nscolor   nsLookAndFeel::sInfoText = 0;
 nscolor   nsLookAndFeel::sInfoBackground = 0;
 nscolor   nsLookAndFeel::sMenuBarText = 0;
@@ -585,17 +587,29 @@ NS_IMETHODIMP nsLookAndFeel::GetMetric(c
         aMetric = 1;
 #else
         aMetric = 0;
         res = NS_ERROR_NOT_IMPLEMENTED;
 #endif
         break;
     case eMetric_MaemoClassic:
 #ifdef MOZ_PLATFORM_HILDON
-        aMetric = gfxPlatformGtk::GetMaemoClassic();
+        {
+            aMetric = 0;
+            nsCOMPtr<nsIPropertyBag2> infoService(do_GetService("@mozilla.org/system-info;1"));
+            if (infoService) {
+                nsCString deviceType;
+                nsresult rv = infoService->GetPropertyAsACString(NS_LITERAL_STRING("device"),
+                                                                 deviceType);
+                if (NS_SUCCEEDED(rv)) {
+                    if (deviceType.EqualsLiteral("Nokia N8xx"))
+                        aMetric = 1;
+                }
+            }
+        }
 #else
         aMetric = 0;
         res = NS_ERROR_NOT_IMPLEMENTED;
 #endif
         break;
     case eMetric_MacGraphiteTheme:
         aMetric = 0;
         res = NS_ERROR_NOT_IMPLEMENTED;
--- a/widget/src/gtk2/nsWindow.cpp
+++ b/widget/src/gtk2/nsWindow.cpp
@@ -1712,28 +1712,72 @@ nsWindow::Scroll(const nsIntPoint& aDelt
         if (w->mIsShown &&
             (configuration.mClipRegion.IsEmpty() ||
              configuration.mBounds != w->mBounds)) {
             w->NativeShow(PR_FALSE);
             windowsToShow.AppendElement(w);
         }
     }
 
-    // gdk_window_move_region, up to GDK 2.16 at least, has a ghastly bug
-    // where it doesn't restrict blitting to the given region, and blits
-    // its full bounding box. So we have to work around that by
-    // blitting one rectangle at a time.
+    // The parts of source regions not covered by their destination get marked
+    // invalid (by GDK).  This is necessary (until covered by another blit)
+    // because GDK translates any pending expose events to the destination,
+    // and so doesn't know whether an expose event might have been due on the
+    // source.
+    //
+    // However, GDK 2.18 does not subtract the invalid regions at the
+    // destinations from the update_area, so the seams between different moves
+    // remain invalid.  GDK 2.18 also delays and queues move operations.  If
+    // gdk_window_process_updates is called before the moves are flushed, GDK
+    // 2.18 removes the invalid seams from the move regions, so the seams are
+    // left with their old content until they get redrawn.  Therefore, the
+    // subtraction of destination invalid regions is performed here.
+    GdkRegion* updateArea = gdk_window_get_update_area(mGdkWindow);
+    if (!updateArea) {
+        updateArea = gdk_region_new(); // Aborts on OOM.
+    }
+
+    // gdk_window_move_region, up to GDK 2.16, has a ghastly bug where it
+    // doesn't restrict blitting to the given region, and blits its full
+    // bounding box. So we have to work around that by blitting one rectangle
+    // at a time.
     for (PRUint32 i = 0; i < aDestRects.Length(); ++i) {
         const nsIntRect& r = aDestRects[i];
         GdkRectangle gdkSource =
             { r.x - aDelta.x, r.y - aDelta.y, r.width, r.height };
-        GdkRegion* region = gdk_region_rectangle(&gdkSource);
-        gdk_window_move_region(GDK_WINDOW(mGdkWindow), region, aDelta.x, aDelta.y);
-        gdk_region_destroy(region);
-    }
+        GdkRegion* rectRegion = gdk_region_rectangle(&gdkSource);
+        gdk_window_move_region(GDK_WINDOW(mGdkWindow), rectRegion,
+                               aDelta.x, aDelta.y);
+
+        // The part of the old invalid region that is moving.
+        GdkRegion* updateChanges = gdk_region_copy(rectRegion);
+        gdk_region_intersect(updateChanges, updateArea);
+        gdk_region_offset(updateChanges, aDelta.x, aDelta.y);
+
+        // Make |rectRegion| the destination
+        gdk_region_offset(rectRegion, aDelta.x, aDelta.y);
+        // Remove any old invalid areas covered at the destination.
+        gdk_region_subtract(updateArea, rectRegion);
+        gdk_region_destroy(rectRegion);
+
+        // The update_area from the move_region contains:
+        // 1. The part of the source region not covered by the destination.
+        // 2. Any destination regions for which the source was obscured by
+        //    parent window clips or child windows.
+        GdkRegion* newUpdates = gdk_window_get_update_area(mGdkWindow);
+        if (newUpdates) {
+            gdk_region_union(updateChanges, newUpdates);
+            gdk_region_destroy(newUpdates);
+        }
+        gdk_region_union(updateArea, updateChanges);
+        gdk_region_destroy(updateChanges);
+    }
+
+    gdk_window_invalidate_region(mGdkWindow, updateArea, FALSE);
+    gdk_region_destroy(updateArea);
 
     ConfigureChildren(aConfigurations);
 
     for (PRUint32 i = 0; i < windowsToShow.Length(); ++i) {
         windowsToShow[i]->NativeShow(PR_TRUE);
     }
 }
 
@@ -5741,26 +5785,26 @@ hierarchy_changed_cb (GtkWidget *widget,
     GdkEventWindowState event;
 
     event.new_window_state = GDK_WINDOW_STATE_WITHDRAWN;
 
     if (GTK_IS_WINDOW(previous_toplevel)) {
         g_signal_handlers_disconnect_by_func(previous_toplevel,
                                              FuncToGpointer(window_state_event_cb),
                                              widget);
-        if (widget->window) {
-            old_window_state = gdk_window_get_state(widget->window);
+        if (previous_toplevel->window) {
+            old_window_state = gdk_window_get_state(previous_toplevel->window);
         }
     }
 
     if (GTK_IS_WINDOW(toplevel)) {
         g_signal_connect_swapped(toplevel, "window-state-event",
                                  G_CALLBACK(window_state_event_cb), widget);
-        if (widget->window) {
-            event.new_window_state = gdk_window_get_state(widget->window);
+        if (toplevel->window) {
+            event.new_window_state = gdk_window_get_state(toplevel->window);
         }
     }
 
     event.changed_mask = static_cast<GdkWindowState>
         (old_window_state ^ event.new_window_state);
 
     if (event.changed_mask) {
         event.type = GDK_WINDOW_STATE;
--- a/widget/src/windows/nsWindow.cpp
+++ b/widget/src/windows/nsWindow.cpp
@@ -2250,24 +2250,36 @@ nsWindow::Scroll(const nsIntPoint& aDelt
     NS_ASSERTION(w->GetParent() == this,
                  "Configured widget is not a child");
     if (configuration.mBounds == w->mBounds + aDelta) {
       scrolledWidgets.PutEntry(w);
     }
     w->SetWindowClipRegion(configuration.mClipRegion, PR_TRUE);
   }
 
+  // Create temporary regions
+  HRGN updateRgn = ::CreateRectRgn(0, 0, 0, 0);
+  if (!updateRgn) {
+    // OOM?
+    return;
+  }
+  HRGN destRgn = ::CreateRectRgn(0, 0, 0, 0);
+  if (!destRgn) {
+    // OOM?
+    ::DeleteObject((HGDIOBJ)updateRgn);
+    return;
+  }
+
   DWORD ourThreadID = GetWindowThreadProcessId(mWnd, NULL);
 
   for (PRUint32 i = 0; i < aDestRects.Length(); ++i) {
+    const nsIntRect& destRect = aDestRects[i];
     nsIntRect affectedRect;
-    affectedRect.UnionRect(aDestRects[i], aDestRects[i] - aDelta);
-    // We pass SW_INVALIDATE because areas that get scrolled into view
-    // from offscreen (but inside the scroll area) need to be repainted.
-    UINT flags = SW_SCROLLCHILDREN | SW_INVALIDATE;
+    affectedRect.UnionRect(destRect, destRect - aDelta);
+    UINT flags = SW_SCROLLCHILDREN;
     // Now check if any of our children would be affected by
     // SW_SCROLLCHILDREN but not supposed to scroll.
     for (nsWindow* w = static_cast<nsWindow*>(GetFirstChild()); w;
          w = static_cast<nsWindow*>(w->GetNextSibling())) {
       if (w->mBounds.Intersects(affectedRect)) {
         // This child will be affected
         nsPtrHashKey<nsWindow>* entry = scrolledWidgets.GetEntry(w);
         if (entry) {
@@ -2330,18 +2342,40 @@ nsWindow::Scroll(const nsIntPoint& aDelt
            w = static_cast<nsWindow*>(w->GetNextSibling())) {
         if (w->mBounds.Intersects(affectedRect)) {
           w->mBounds += aDelta;
         }
       }
     }
 
     RECT clip = { affectedRect.x, affectedRect.y, affectedRect.XMost(), affectedRect.YMost() };
-    ::ScrollWindowEx(mWnd, aDelta.x, aDelta.y, &clip, &clip, NULL, NULL, flags);
-  }
+    ::ScrollWindowEx(mWnd, aDelta.x, aDelta.y, &clip, &clip, updateRgn, NULL, flags);
+
+    // Areas that get scrolled into view from offscreen or under another
+    // window (but inside the scroll area) need to be repainted.
+    // ScrollWindowEx returns those areas in updateRgn, but also includes
+    // the area of the source that isn't covered by the destination.
+    // ScrollWindowEx will refuse to blit into an area that's already
+    // invalid. When we're blitting multiple adjacent rectangles, we have
+    // a problem where the source area of rectangle A overlaps the
+    // destination area of a subsequent rectangle B; the first ScrollWindowEx
+    // invalidates the source area of A that's outside of the destination
+    // area of A, and then the ScrollWindowEx for B will refuse to fully
+    // blit into B's destination. This produces nasty temporary glitches.
+    // We combat this by having ScrollWindowEx not invalidate directly,
+    // but give us back the region that needs to be invalidated,
+    // and restricting that region to the destination before invalidating
+    // it.
+    ::SetRectRgn(destRgn, destRect.x, destRect.y, destRect.XMost(), destRect.YMost());
+    ::CombineRgn(updateRgn, updateRgn, destRgn, RGN_AND);
+    ::InvalidateRgn(mWnd, updateRgn, FALSE);
+  }
+
+  ::DeleteObject((HGDIOBJ)updateRgn);
+  ::DeleteObject((HGDIOBJ)destRgn);
 
   // Now make sure all children actually get positioned, sized and clipped
   // correctly. If SW_SCROLLCHILDREN already moved widgets to their correct
   // locations, then the SetWindowPos calls this triggers will just be
   // no-ops.
   ConfigureChildren(aConfigurations);
 }
 
--- a/xpcom/glue/nsCategoryCache.cpp
+++ b/xpcom/glue/nsCategoryCache.cpp
@@ -140,16 +140,24 @@ nsCategoryObserver::Observe(nsISupports*
     return NS_OK;
 
   nsCAutoString str;
   nsCOMPtr<nsISupportsCString> strWrapper(do_QueryInterface(aSubject));
   if (strWrapper)
     strWrapper->GetData(str);
 
   if (strcmp(aTopic, NS_XPCOM_CATEGORY_ENTRY_ADDED_OBSERVER_ID) == 0) {
+    // We may get an add notification even when we already have an entry. This
+    // is due to the notification happening asynchronously, so if the entry gets
+    // added and an nsCategoryObserver gets instantiated before events get
+    // processed, we'd get the notification for an existing entry.
+    // Do nothing in that case.
+    if (mHash.Get(str, nsnull))
+      return NS_OK;
+
     nsCOMPtr<nsICategoryManager> catMan =
       do_GetService(NS_CATEGORYMANAGER_CONTRACTID);
     if (!catMan)
       return NS_OK;
 
     nsCString entryValue;
     catMan->GetCategoryEntry(mCategory.get(),
                              str.get(),