merge m-c into fx-team
authorMargaret Leibovic <margaret.leibovic@gmail.com>
Sun, 11 Sep 2011 20:13:59 -0400
changeset 78259 993cc334fab30991f80b02a071ffcc519ae91433
parent 78258 43f1efa4b17d442d0cd3c3867ed452431828f9e3 (current diff)
parent 78190 569a45bfb71c61e16a9c1f9162dd5355a7a374e2 (diff)
child 78260 8ef08b003e21acccdc421a590a50173023d14536
push id78
push userclegnitto@mozilla.com
push dateFri, 16 Dec 2011 17:32:24 +0000
treeherdermozilla-release@79d24e644fdd [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone9.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
merge m-c into fx-team
content/canvas/test/webgl/crossorigin/image-allow-credentials.png
content/canvas/test/webgl/crossorigin/image-allow-credentials.png^headers^
content/canvas/test/webgl/crossorigin/image-allow-star.png
content/canvas/test/webgl/crossorigin/image-allow-star.png^headers^
content/canvas/test/webgl/crossorigin/image.png
content/canvas/test/webgl/crossorigin/test_webgl_crossorigin_textures.html
widget/public/nsILookAndFeel.h
--- a/accessible/src/xul/nsXULMenuAccessible.cpp
+++ b/accessible/src/xul/nsXULMenuAccessible.cpp
@@ -49,27 +49,24 @@
 #include "nsIDOMXULContainerElement.h"
 #include "nsIDOMXULSelectCntrlItemEl.h"
 #include "nsIDOMXULMultSelectCntrlEl.h"
 #include "nsIDOMKeyEvent.h"
 #include "nsIServiceManager.h"
 #include "nsIPresShell.h"
 #include "nsIContent.h"
 #include "nsGUIEvent.h"
-#include "nsILookAndFeel.h"
-#include "nsWidgetsCID.h"
 
 #include "mozilla/Preferences.h"
+#include "mozilla/LookAndFeel.h"
 #include "mozilla/dom/Element.h"
 
 using namespace mozilla;
 using namespace mozilla::a11y;
 
-static NS_DEFINE_CID(kLookAndFeelCID, NS_LOOKANDFEEL_CID);
-
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULSelectableAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULSelectableAccessible::
   nsXULSelectableAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
   nsAccessibleWrap(aContent, aShell)
 {
@@ -355,20 +352,18 @@ nsXULMenuitemAccessible::NativeState()
       } // isCollapsed
     } // isSelected
   } // ROLE_COMBOBOX_OPTION
 
   // Set focusable and selectable for items that are available
   // and whose metric setting does allow disabled items to be focused.
   if (state & states::UNAVAILABLE) {
     // Honour the LookAndFeel metric.
-    nsCOMPtr<nsILookAndFeel> lookNFeel(do_GetService(kLookAndFeelCID));
-    PRInt32 skipDisabledMenuItems = 0;
-    lookNFeel->GetMetric(nsILookAndFeel::eMetric_SkipNavigatingDisabledMenuItem,
-                         skipDisabledMenuItems);
+    PRInt32 skipDisabledMenuItems =
+      LookAndFeel::GetInt(LookAndFeel::eIntID_SkipNavigatingDisabledMenuItem);
     // We don't want the focusable and selectable states for combobox items,
     // so exclude them here as well.
     if (skipDisabledMenuItems || isComboboxOption) {
       return state;
     }
   }
   state |= (states::FOCUSABLE | states::SELECTABLE);
 
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -729,29 +729,21 @@ pref("urlclassifier.gethashnoise", 4);
 // The list of tables that use the gethash request to confirm partial results.
 pref("urlclassifier.gethashtables", "goog-phish-shavar,goog-malware-shavar");
 
 // If an urlclassifier table has not been updated in this number of seconds,
 // a gethash request will be forced to check that the result is still in
 // the database.
 pref("urlclassifier.confirm-age", 2700);
 
-#ifdef MOZ_WIDGET_GTK2
-#define RESTRICT_CACHEMAX
-#endif
-#ifdef XP_OS2
-#define RESTRICT_CACHEMAX
-#endif
+// Maximum size of the sqlite3 cache during an update, in bytes
+pref("urlclassifier.updatecachemax", 41943040);
 
-// Maximum size of the sqlite3 cache during an update, in bytes
-#ifdef RESTRICT_CACHEMAX
-pref("urlclassifier.updatecachemax", 104857600);
-#else
-pref("urlclassifier.updatecachemax", -1);
-#endif
+// Maximum size of the sqlite3 cache for lookups, in bytes
+pref("urlclassifier.lookupcachemax", 1048576);
 
 // URL for checking the reason for a malware warning.
 pref("browser.safebrowsing.malware.reportURL", "http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=%NAME%&hl=%LOCALE%&site=");
 
 #endif
 
 pref("browser.EULA.version", 3);
 pref("browser.rights.version", 3);
--- a/browser/components/feeds/src/nsFeedSniffer.cpp
+++ b/browser/components/feeds/src/nsFeedSniffer.cpp
@@ -124,61 +124,28 @@ nsFeedSniffer::ConvertEncodedData(nsIReq
 template<int N>
 static PRBool
 StringBeginsWithLowercaseLiteral(nsAString& aString,
                                  const char (&aSubstring)[N])
 {
   return StringHead(aString, N).LowerCaseEqualsLiteral(aSubstring);
 }
 
-// XXXsayrer put this in here to get on the branch with minimal delay.
-// Trunk really needs to factor this out. This is the third usage.
 PRBool
 HasAttachmentDisposition(nsIHttpChannel* httpChannel)
 {
   if (!httpChannel)
     return PR_FALSE;
-  
-  nsCAutoString contentDisposition;
-  nsresult rv = 
-    httpChannel->GetResponseHeader(NS_LITERAL_CSTRING("content-disposition"),
-                                   contentDisposition);
-  
-  if (NS_SUCCEEDED(rv) && !contentDisposition.IsEmpty()) {
-    nsCOMPtr<nsIURI> uri;
-    httpChannel->GetURI(getter_AddRefs(uri));
-    nsCOMPtr<nsIMIMEHeaderParam> mimehdrpar =
-      do_GetService(NS_MIMEHEADERPARAM_CONTRACTID, &rv);
-    if (NS_SUCCEEDED(rv))
-    {
-      nsCAutoString fallbackCharset;
-      if (uri)
-        uri->GetOriginCharset(fallbackCharset);
-      nsAutoString dispToken;
-      // Get the disposition type
-      rv = mimehdrpar->GetParameter(contentDisposition, "", fallbackCharset,
-                                    PR_TRUE, nsnull, dispToken);
-      // RFC 2183, section 2.8 says that an unknown disposition
-      // value should be treated as "attachment"
-      // XXXbz this code is duplicated in GetFilenameAndExtensionFromChannel in
-      // nsExternalHelperAppService.  Factor it out!
-      if (NS_FAILED(rv) || 
-          (!dispToken.IsEmpty() &&
-           !StringBeginsWithLowercaseLiteral(dispToken, "inline") &&
-           // Broken sites just send
-           // Content-Disposition: filename="file"
-           // without a disposition token... screen those out.
-           !StringBeginsWithLowercaseLiteral(dispToken, "filename") &&
-           // Also in use is Content-Disposition: name="file"
-           !StringBeginsWithLowercaseLiteral(dispToken, "name")))
-        // We have a content-disposition of "attachment" or unknown
-        return PR_TRUE;
-    }
-  } 
-  
+
+  PRUint32 disp;
+  nsresult rv = httpChannel->GetContentDisposition(&disp);
+
+  if (NS_SUCCEEDED(rv) && disp == nsIChannel::DISPOSITION_ATTACHMENT)
+    return PR_TRUE;
+
   return PR_FALSE;
 }
 
 /**
  * @return the first occurrence of a character within a string buffer,
  *         or nsnull if not found
  */
 static const char*
--- a/browser/components/preferences/main.xul
+++ b/browser/components/preferences/main.xul
@@ -143,17 +143,17 @@
       </hbox>
       <hbox align="center" pack="end">
         <button label="" accesskey="&useCurrentPage.accesskey;"
                 label1="&useCurrentPage.label;"
                 label2="&useMultiple.label;"
                 oncommand="gMainPane.setHomePageToCurrent();"
                 id="useCurrent"
                 preference="pref.browser.homepage.disable_button.current_page"/>
-        <button label="&useBookmark.label;" accesskey="&useBookmark.accesskey;"
+        <button label="&chooseBookmark.label;" accesskey="&chooseBookmark.accesskey;"
                 oncommand="gMainPane.setHomePageToBookmark();"
                 id="useBookmark"
                 preference="pref.browser.homepage.disable_button.bookmark_page"/>
         <button label="&restoreDefault.label;" accesskey="&restoreDefault.accesskey;"
                 oncommand="gMainPane.restoreDefaultHomePage();"
                 id="restoreDefaultHomePage"
                 preference="pref.browser.homepage.disable_button.restore_default"/>
       </hbox>
--- a/browser/locales/en-US/chrome/browser/preferences/main.dtd
+++ b/browser/locales/en-US/chrome/browser/preferences/main.dtd
@@ -8,18 +8,18 @@
 <!ENTITY restoreOnDemand.label     "Don’t load tabs until selected">
 <!ENTITY restoreOnDemand.accesskey "l">
 
 <!ENTITY homepage.label            "Home Page:">
 <!ENTITY homepage.accesskey        "P">
 <!ENTITY useCurrentPage.label      "Use Current Page">
 <!ENTITY useCurrentPage.accesskey  "C">
 <!ENTITY useMultiple.label         "Use Current Pages">
-<!ENTITY useBookmark.label         "Use Bookmark">
-<!ENTITY useBookmark.accesskey     "B">
+<!ENTITY chooseBookmark.label      "Use Bookmark…">
+<!ENTITY chooseBookmark.accesskey  "B">
 <!ENTITY restoreDefault.label      "Restore to Default">
 <!ENTITY restoreDefault.accesskey  "R">
 
 <!ENTITY downloads.label     "Downloads">
 
 <!ENTITY showWhenDownloading.label     "Show the Downloads window when downloading a file">
 <!ENTITY showWhenDownloading.accesskey "D">
 <!ENTITY closeWhenDone.label "Close it when all downloads are finished">
--- a/build/automation.py.in
+++ b/build/automation.py.in
@@ -787,20 +787,21 @@ user_pref("camino.use_system_proxy_setti
       fixerStatus = stackFixerProcess.wait()
       if fixerStatus != 0 and not didTimeout and not hitMaxTime:
         self.log.info("TEST-UNEXPECTED-FAIL | automation.py | Stack fixer process exited with code %d during test run", fixerStatus)
     return status
 
   def buildCommandLine(self, app, debuggerInfo, profileDir, testURL, extraArgs):
     """ build the application command line """
 
-    cmd = app
-    if self.IS_MAC and not self.IS_CAMINO and not cmd.endswith("-bin"):
+    cmd = os.path.abspath(app)
+    if self.IS_MAC and not self.IS_CAMINO and os.path.exists(cmd + "-bin"):
+      # Prefer 'app-bin' in case 'app' is a shell script.
+      # We can remove this hack once bug 673899 etc are fixed.
       cmd += "-bin"
-    cmd = os.path.abspath(cmd)
 
     args = []
 
     if debuggerInfo:
       args.extend(debuggerInfo["args"])
       args.append(cmd)
       cmd = os.path.abspath(debuggerInfo["path"])
 
--- a/chrome/src/nsChromeRegistryChrome.cpp
+++ b/chrome/src/nsChromeRegistryChrome.cpp
@@ -53,41 +53,41 @@
 #include "nsArrayEnumerator.h"
 #include "nsAppDirectoryServiceDefs.h"
 #include "nsComponentManager.h"
 #include "nsEnumeratorUtils.h"
 #include "nsNetUtil.h"
 #include "nsStringEnumerator.h"
 #include "nsTextFormatter.h"
 #include "nsUnicharUtils.h"
-#include "nsWidgetsCID.h"
 #include "nsXPCOMCIDInternal.h"
 #include "nsZipArchive.h"
 
+#include "mozilla/LookAndFeel.h"
+
 #include "nsICommandLine.h"
 #include "nsILocaleService.h"
 #include "nsILocalFile.h"
-#include "nsILookAndFeel.h"
 #include "nsIObserverService.h"
 #include "nsIPrefBranch2.h"
 #include "nsIPrefService.h"
 #include "nsIResProtocolHandler.h"
 #include "nsIScriptError.h"
 #include "nsIVersionComparator.h"
 #include "nsIXPConnect.h"
 #include "nsIXULAppInfo.h"
 #include "nsIXULRuntime.h"
 
 #define UILOCALE_CMD_LINE_ARG "UILocale"
 
 #define MATCH_OS_LOCALE_PREF "intl.locale.matchOS"
 #define SELECTED_LOCALE_PREF "general.useragent.locale"
 #define SELECTED_SKIN_PREF   "general.skins.selectedSkin"
 
-static NS_DEFINE_CID(kLookAndFeelCID, NS_LOOKANDFEEL_CID);
+using namespace mozilla;
 
 static PLDHashOperator
 RemoveAll(PLDHashTable *table, PLDHashEntryHdr *entry, PRUint32 number, void *arg)
 {
   return (PLDHashOperator) (PL_DHASH_NEXT | PL_DHASH_REMOVE);
 }
 
 // We use a "best-fit" algorithm for matching locales and themes. 
@@ -205,36 +205,29 @@ nsChromeRegistryChrome::Init()
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsChromeRegistryChrome::CheckForOSAccessibility()
 {
-  nsresult rv;
-
-  nsCOMPtr<nsILookAndFeel> lookAndFeel (do_GetService(kLookAndFeelCID));
-  if (lookAndFeel) {
-    PRInt32 useAccessibilityTheme = 0;
-
-    rv = lookAndFeel->GetMetric(nsILookAndFeel::eMetric_UseAccessibilityTheme,
-                                useAccessibilityTheme);
+  PRInt32 useAccessibilityTheme =
+    LookAndFeel::GetInt(LookAndFeel::eIntID_UseAccessibilityTheme, 0);
 
-    if (NS_SUCCEEDED(rv) && useAccessibilityTheme) {
-      /* Set the skin to classic and remove pref observers */
-      if (!mSelectedSkin.EqualsLiteral("classic/1.0")) {
-        mSelectedSkin.AssignLiteral("classic/1.0");
-        RefreshSkins();
-      }
+  if (useAccessibilityTheme) {
+    /* Set the skin to classic and remove pref observers */
+    if (!mSelectedSkin.EqualsLiteral("classic/1.0")) {
+      mSelectedSkin.AssignLiteral("classic/1.0");
+      RefreshSkins();
+    }
 
-      nsCOMPtr<nsIPrefBranch2> prefs (do_GetService(NS_PREFSERVICE_CONTRACTID));
-      if (prefs) {
-        prefs->RemoveObserver(SELECTED_SKIN_PREF, this);
-      }
+    nsCOMPtr<nsIPrefBranch2> prefs (do_GetService(NS_PREFSERVICE_CONTRACTID));
+    if (prefs) {
+      prefs->RemoveObserver(SELECTED_SKIN_PREF, this);
     }
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsChromeRegistryChrome::GetLocalesForPackage(const nsACString& aPackage,
--- a/configure.in
+++ b/configure.in
@@ -1277,17 +1277,17 @@ if test -n "$CROSS_COMPILE"; then
     OS_TARGET="${target_os}"
     OS_ARCH=`echo $target_os | sed -e 's|/|_|g'`
     OS_RELEASE=
     case "${target_os}" in
         linux*)       OS_ARCH=Linux OS_TARGET=Linux ;;
         kfreebsd*-gnu) OS_ARCH=GNU_kFreeBSD OS_TARGET=GNU_kFreeBSD ;;
         gnu*)         OS_ARCH=GNU ;;
         solaris*)     OS_ARCH=SunOS OS_RELEASE=5 ;;
-        mingw*)       OS_ARCH=WINNT ;;
+        mingw*)       OS_ARCH=WINNT OS_TARGET=WINNT ;;
         darwin*)      OS_ARCH=Darwin OS_TARGET=Darwin ;;
     esac
     case "${target}" in
         *-android*|*-linuxandroid*) OS_ARCH=Linux OS_TARGET=Android ;;
     esac
 else
     OS_TARGET=`uname -s`
     OS_ARCH=`uname -s | sed -e 's|/|_|g'`
@@ -5827,16 +5827,20 @@ if test -n "$MOZ_CRASHREPORTER"; then
   if (test "$OS_TARGET" = "Linux" -o "$OS_ARCH" = "SunOS") && \
     test -z "$SKIP_LIBRARY_CHECKS"; then
     PKG_CHECK_MODULES(MOZ_GTHREAD, gthread-2.0)
     AC_SUBST(MOZ_GTHREAD_CFLAGS)
     AC_SUBST(MOZ_GTHREAD_LIBS)
 
     MOZ_CHECK_HEADERS([curl/curl.h], [], [AC_MSG_ERROR([Couldn't find curl/curl.h which is required for the crash reporter.  Use --disable-crashreporter to disable the crash reporter.])])
   fi
+
+  if (test "$OS_ARCH" != "$HOST_OS_ARCH"); then
+    AC_MSG_ERROR([Breakpad tools do not support compiling on $HOST_OS_ARCH while targeting $OS_ARCH.  Use --disable-crashreporter.])
+  fi
 fi
 
 MOZ_ARG_WITH_STRING(crashreporter-enable-percent,
 [  --with-crashreporter-enable-percent=NN
                           Enable sending crash reports by default on NN% of users. (default=100)],
 [ val=`echo $withval | sed 's/[^0-9]//g'`
     MOZ_CRASHREPORTER_ENABLE_PERCENT="$val"])
 
new file mode 100644
--- /dev/null
+++ b/content/base/crashtests/679459.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var t = document.createTextNode("a");
+  document.body.appendChild(t);
+  var r1 = document.createRange();
+  r1.setEnd(t, 1);
+  var r2 = document.createRange();
+  r2.setEnd(t, 0);
+  r2.deleteContents();
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@@ -88,9 +88,10 @@ load 610571-1.html
 load 604262-1.html
 load 628599-1.html
 load 637214-1.svg
 load 637214-2.svg
 load 642022-1.html
 load 646184.html
 load 658845-1.svg
 load 667336-1.html
+load 679459.html
 load 679689-1.html
--- a/content/base/public/nsINode.h
+++ b/content/base/public/nsINode.h
@@ -50,16 +50,17 @@
 #include "nsDOMString.h"
 #include "jspubtd.h"
 #include "nsDOMMemoryReporter.h"
 
 class nsIContent;
 class nsIDocument;
 class nsIDOMEvent;
 class nsIDOMNode;
+class nsIDOMElement;
 class nsIDOMNodeList;
 class nsINodeList;
 class nsIPresShell;
 class nsEventChainVisitor;
 class nsEventChainPreVisitor;
 class nsEventChainPostVisitor;
 class nsEventListenerManager;
 class nsIPrincipal;
@@ -702,16 +703,25 @@ public:
    * Get the parent nsINode for this node. This can be either an nsIContent,
    * an nsIDocument or an nsIAttribute.
    * @return the parent node
    */
   nsINode* GetNodeParent() const
   {
     return mParent;
   }
+  
+  /**
+   * Get the parent nsINode for this node if it is an Element.
+   * @return the parent node
+   */
+  nsINode* GetElementParent() const
+  {
+    return mParent && mParent->IsElement() ? mParent : nsnull;
+  }
 
   /**
    * See nsIDOMEventTarget
    */
   NS_DECL_NSIDOMEVENTTARGET
   using nsIDOMEventTarget::AddEventListener;
 
   /**
@@ -1278,16 +1288,17 @@ protected:
 
 #ifdef DEBUG
   // Note: virtual so that IsInNativeAnonymousSubtree can be called accross
   // module boundaries.
   virtual void CheckNotNativeAnonymous() const;
 #endif
 
   nsresult GetParentNode(nsIDOMNode** aParentNode);
+  nsresult GetParentElement(nsIDOMElement** aParentElement);
   nsresult GetChildNodes(nsIDOMNodeList** aChildNodes);
   nsresult GetFirstChild(nsIDOMNode** aFirstChild);
   nsresult GetLastChild(nsIDOMNode** aLastChild);
   nsresult GetPreviousSibling(nsIDOMNode** aPrevSibling);
   nsresult GetNextSibling(nsIDOMNode** aNextSibling);
   nsresult GetOwnerDocument(nsIDOMDocument** aOwnerDocument);
 
   nsresult ReplaceOrInsertBefore(PRBool aReplace, nsIDOMNode *aNewChild,
--- a/content/base/src/nsDOMAttribute.cpp
+++ b/content/base/src/nsDOMAttribute.cpp
@@ -359,16 +359,23 @@ nsDOMAttribute::GetParentNode(nsIDOMNode
     document->WarnOnceAbout(nsIDocument::eParentNode);
   }
 
   *aParentNode = nsnull;
   return NS_OK;
 }
 
 NS_IMETHODIMP
+nsDOMAttribute::GetParentElement(nsIDOMElement** aParentElement)
+{
+  *aParentElement = nsnull;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
 nsDOMAttribute::GetChildNodes(nsIDOMNodeList** aChildNodes)
 {
   nsIDocument* document = GetOwnerDoc();
   if (document) {
     document->WarnOnceAbout(nsIDocument::eChildNodes);
   }
 
   return nsINode::GetChildNodes(aChildNodes);
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -2873,17 +2873,17 @@ nsDocument::NodesFromRectHelper(float aX
   nsIPresShell *ps = GetShell();
   NS_ENSURE_STATE(ps);
   nsIFrame *rootFrame = ps->GetRootFrame();
 
   // XUL docs, unlike HTML, have no frame tree until everything's done loading
   if (!rootFrame)
     return NS_OK; // return nothing to premature XUL callers as a reminder to wait
 
-  nsTArray<nsIFrame*> outFrames;
+  nsAutoTArray<nsIFrame*,8> outFrames;
   nsLayoutUtils::GetFramesForArea(rootFrame, rect, outFrames,
                                   PR_TRUE, aIgnoreRootScrollFrame);
 
   PRInt32 length = outFrames.Length();
   if (!length)
     return NS_OK;
 
   // Used to filter out repeated elements in sequence.
@@ -5665,16 +5665,23 @@ NS_IMETHODIMP
 nsDocument::GetParentNode(nsIDOMNode** aParentNode)
 {
   *aParentNode = nsnull;
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
+nsDocument::GetParentElement(nsIDOMElement** aParentElement)
+{
+  *aParentElement = nsnull;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
 nsDocument::GetChildNodes(nsIDOMNodeList** aChildNodes)
 {
   return nsINode::GetChildNodes(aChildNodes);
 }
 
 NS_IMETHODIMP
 nsDocument::HasChildNodes(PRBool* aHasChildNodes)
 {
@@ -6744,24 +6751,21 @@ nsDocument::RetrieveRelevantHeaders(nsIC
 
         if (NS_SUCCEEDED(rv)) {
           PRInt64 intermediateValue;
           LL_I2L(intermediateValue, PR_USEC_PER_MSEC);
           LL_MUL(modDate, msecs, intermediateValue);
         }
       }
     } else {
-      nsCOMPtr<nsIMultiPartChannel> partChannel = do_QueryInterface(aChannel);
-      if (partChannel) {
-        nsCAutoString contentDisp;
-        rv = partChannel->GetContentDisposition(contentDisp);
-        if (NS_SUCCEEDED(rv) && !contentDisp.IsEmpty()) {
-          SetHeaderData(nsGkAtoms::headerContentDisposition,
-                        NS_ConvertASCIItoUTF16(contentDisp));
-        }
+      nsCAutoString contentDisp;
+      rv = aChannel->GetContentDispositionHeader(contentDisp);
+      if (NS_SUCCEEDED(rv)) {
+        SetHeaderData(nsGkAtoms::headerContentDisposition,
+                      NS_ConvertASCIItoUTF16(contentDisp));
       }
     }
   }
 
   if (LL_IS_ZERO(modDate)) {
     // We got nothing from our attempt to ask nsIFileChannel and
     // nsIHttpChannel for the last modified time. Return the current
     // time.
--- a/content/base/src/nsGenericDOMDataNode.cpp
+++ b/content/base/src/nsGenericDOMDataNode.cpp
@@ -323,22 +323,23 @@ nsGenericDOMDataNode::SetTextInternal(PR
       endOffset,
       aLength,
       aDetails
     };
     nsNodeUtils::CharacterDataWillChange(this, &info);
   }
 
   if (aOffset == 0 && endOffset == textLength) {
-    // Replacing whole text or old text was empty
-    mText.SetTo(aBuffer, aLength);
+    // Replacing whole text or old text was empty.  Don't bother to check for
+    // bidi in this string if the document already has bidi enabled.
+    mText.SetTo(aBuffer, aLength, !document || !document->GetBidiEnabled());
   }
   else if (aOffset == textLength) {
     // Appending to existing
-    mText.Append(aBuffer, aLength);
+    mText.Append(aBuffer, aLength, !document || !document->GetBidiEnabled());
   }
   else {
     // Merging old and new
 
     // Allocate new buffer
     PRInt32 newLength = textLength - aCount + aLength;
     PRUnichar* to = new PRUnichar[newLength];
     NS_ENSURE_TRUE(to, NS_ERROR_OUT_OF_MEMORY);
@@ -350,22 +351,26 @@ nsGenericDOMDataNode::SetTextInternal(PR
     if (aLength) {
       memcpy(to + aOffset, aBuffer, aLength * sizeof(PRUnichar));
     }
     if (endOffset != textLength) {
       mText.CopyTo(to + aOffset + aLength, endOffset, textLength - endOffset);
     }
 
     // XXX Add OOM checking to this
-    mText.SetTo(to, newLength);
+    mText.SetTo(to, newLength, !document || !document->GetBidiEnabled());
 
     delete [] to;
   }
 
-  UpdateBidiStatus(aBuffer, aLength);
+  if (document && mText.IsBidi()) {
+    // If we found bidi characters in mText.SetTo() above, indicate that the
+    // document contains bidi characters.
+    document->SetBidiEnabled();
+  }
 
   // Notify observers
   if (aNotify) {
     CharacterDataChangeInfo info = {
       aOffset == textLength,
       aOffset,
       endOffset,
       aLength,
@@ -743,17 +748,18 @@ nsGenericDOMDataNode::SplitData(PRUint32
   if (!newContent) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
   newContent->SetText(cutText, PR_TRUE); // XXX should be PR_FALSE?
 
   CharacterDataChangeInfo::Details details = {
     CharacterDataChangeInfo::Details::eSplit, newContent
   };
-  rv = SetTextInternal(cutStartOffset, cutLength, nsnull, 0, PR_TRUE, &details);
+  rv = SetTextInternal(cutStartOffset, cutLength, nsnull, 0, PR_TRUE,
+                       aCloneAfterOriginal ? &details : nsnull);
   if (NS_FAILED(rv)) {
     return rv;
   }
 
   nsCOMPtr<nsINode> parent = GetNodeParent();
   if (parent) {
     PRInt32 insertionIndex = parent->IndexOf(this);
     if (aCloneAfterOriginal) {
@@ -965,31 +971,16 @@ nsGenericDOMDataNode::TextIsOnlyWhitespa
 }
 
 void
 nsGenericDOMDataNode::AppendTextTo(nsAString& aResult)
 {
   mText.AppendTo(aResult);
 }
 
-void nsGenericDOMDataNode::UpdateBidiStatus(const PRUnichar* aBuffer, PRUint32 aLength)
-{
-  nsIDocument *document = GetCurrentDoc();
-  if (document && document->GetBidiEnabled()) {
-    // OK, we already know it's Bidi, so we won't test again
-    return;
-  }
-
-  mText.UpdateBidiFlag(aBuffer, aLength);
-
-  if (document && mText.IsBidi()) {
-    document->SetBidiEnabled();
-  }
-}
-
 already_AddRefed<nsIAtom>
 nsGenericDOMDataNode::GetCurrentValueAtom()
 {
   nsAutoString val;
   GetData(val);
   return NS_NewAtom(val);
 }
 
--- a/content/base/src/nsGenericDOMDataNode.h
+++ b/content/base/src/nsGenericDOMDataNode.h
@@ -359,14 +359,12 @@ protected:
    * @return the clone
    */
   virtual nsGenericDOMDataNode *CloneDataNode(nsINodeInfo *aNodeInfo,
                                               PRBool aCloneText) const = 0;
 
   nsTextFragment mText;
 
 private:
-  void UpdateBidiStatus(const PRUnichar* aBuffer, PRUint32 aLength);
-
   already_AddRefed<nsIAtom> GetCurrentValueAtom();
 };
 
 #endif /* nsGenericDOMDataNode_h___ */
--- a/content/base/src/nsGenericElement.cpp
+++ b/content/base/src/nsGenericElement.cpp
@@ -430,16 +430,24 @@ nsINode::GetParentNode(nsIDOMNode** aPar
   *aParentNode = nsnull;
 
   nsINode *parent = GetNodeParent();
 
   return parent ? CallQueryInterface(parent, aParentNode) : NS_OK;
 }
 
 nsresult
+nsINode::GetParentElement(nsIDOMElement** aParentElement)
+{
+  *aParentElement = nsnull;
+  nsINode* parent = GetElementParent();
+  return parent ? CallQueryInterface(parent, aParentElement) : NS_OK;
+}
+
+nsresult
 nsINode::GetChildNodes(nsIDOMNodeList** aChildNodes)
 {
   *aChildNodes = GetChildNodesList();
   if (!*aChildNodes) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
   NS_ADDREF(*aChildNodes);
--- a/content/base/src/nsTextFragment.cpp
+++ b/content/base/src/nsTextFragment.cpp
@@ -112,16 +112,17 @@ nsTextFragment::~nsTextFragment()
 void
 nsTextFragment::ReleaseText()
 {
   if (mState.mLength && m1b && mState.mInHeap) {
     nsMemory::Free(m2b); // m1b == m2b as far as nsMemory is concerned
   }
 
   m1b = nsnull;
+  mState.mIsBidi = PR_FALSE;
 
   // Set mState.mIs2b, mState.mInHeap, and mState.mLength = 0 with mAllBits;
   mAllBits = 0;
 }
 
 nsTextFragment&
 nsTextFragment::operator=(const nsTextFragment& aOther)
 {
@@ -140,18 +141,18 @@ nsTextFragment::operator=(const nsTextFr
     if (m1b) {
       mAllBits = aOther.mAllBits;
     }
   }
 
   return *this;
 }
 
-static inline PRBool
-Is8BitUnvectorized(const PRUnichar *str, const PRUnichar *end)
+static inline PRInt32
+FirstNon8BitUnvectorized(const PRUnichar *str, const PRUnichar *end)
 {
 #if PR_BYTES_PER_WORD == 4
   const size_t mask = 0xff00ff00;
   const PRUint32 alignMask = 0x3;
   const PRUint32 numUnicharsPerWord = 2;
 #elif PR_BYTES_PER_WORD == 8
   const size_t mask = 0xff00ff00ff00ff00;
   const PRUint32 alignMask = 0x7;
@@ -163,58 +164,65 @@ Is8BitUnvectorized(const PRUnichar *str,
   const PRInt32 len = end - str;
   PRInt32 i = 0;
 
   // Align ourselves to a word boundary.
   PRInt32 alignLen =
     NS_MIN(len, PRInt32(((-NS_PTR_TO_INT32(str)) & alignMask) / sizeof(PRUnichar)));
   for (; i < alignLen; i++) {
     if (str[i] > 255)
-      return PR_FALSE;
+      return i;
   }
 
   // Check one word at a time.
   const PRInt32 wordWalkEnd = ((len - i) / numUnicharsPerWord) * numUnicharsPerWord;
   for (; i < wordWalkEnd; i += numUnicharsPerWord) {
     const size_t word = *reinterpret_cast<const size_t*>(str + i);
     if (word & mask)
-      return PR_FALSE;
+      return i;
   }
 
   // Take care of the remainder one character at a time.
   for (; i < len; i++) {
     if (str[i] > 255)
-      return PR_FALSE;
+      return i;
   }
 
-  return PR_TRUE;
+  return -1;
 }
 
 #ifdef MOZILLA_MAY_SUPPORT_SSE2
 namespace mozilla {
   namespace SSE2 {
-    PRBool Is8Bit(const PRUnichar *str, const PRUnichar *end);
+    PRInt32 FirstNon8Bit(const PRUnichar *str, const PRUnichar *end);
   }
 }
 #endif
 
-static inline PRBool
-Is8Bit(const PRUnichar *str, const PRUnichar *end)
+/*
+ * This function returns -1 if all characters in str are 8 bit characters.
+ * Otherwise, it returns a value less than or equal to the index of the first
+ * non-8bit character in str. For example, if first non-8bit character is at
+ * position 25, it may return 25, or for example 24, or 16. But it guarantees
+ * there is no non-8bit character before returned value.
+ */
+static inline PRInt32
+FirstNon8Bit(const PRUnichar *str, const PRUnichar *end)
 {
 #ifdef MOZILLA_MAY_SUPPORT_SSE2
   if (mozilla::supports_sse2()) {
-    return mozilla::SSE2::Is8Bit(str, end);
+    return mozilla::SSE2::FirstNon8Bit(str, end);
   }
 #endif
 
-  return Is8BitUnvectorized(str, end);
+  return FirstNon8BitUnvectorized(str, end);
 }
 
 void
-nsTextFragment::SetTo(const PRUnichar* aBuffer, PRInt32 aLength)
+nsTextFragment::SetTo(const PRUnichar* aBuffer, PRInt32 aLength, PRBool aUpdateBidi)
 {
   ReleaseText();
 
   if (aLength == 0) {
     return;
   }
   
   PRUnichar firstChar = *aBuffer;
@@ -263,41 +271,47 @@ nsTextFragment::SetTo(const PRUnichar* a
       mState.mIs2b = PR_FALSE;
       mState.mLength = aLength;
 
       return;        
     }
   }
 
   // See if we need to store the data in ucs2 or not
-  PRBool need2 = !Is8Bit(ucp, uend);
+  PRInt32 first16bit = FirstNon8Bit(ucp, uend);
 
-  if (need2) {
+  if (first16bit != -1) { // aBuffer contains no non-8bit character
     // Use ucs2 storage because we have to
     m2b = (PRUnichar *)nsMemory::Clone(aBuffer,
                                        aLength * sizeof(PRUnichar));
     if (!m2b) {
       return;
     }
+
+    mState.mIs2b = PR_TRUE;
+    if (aUpdateBidi) {
+      UpdateBidiFlag(aBuffer + first16bit, aLength - first16bit);
+    }
+
   } else {
     // Use 1 byte storage because we can
     char* buff = (char *)nsMemory::Alloc(aLength * sizeof(char));
     if (!buff) {
       return;
     }
 
     // Copy data
     LossyConvertEncoding16to8 converter(buff);
     copy_string(aBuffer, aBuffer+aLength, converter);
     m1b = buff;
+    mState.mIs2b = PR_FALSE;
   }
 
   // Setup our fields
   mState.mInHeap = PR_TRUE;
-  mState.mIs2b = need2;
   mState.mLength = aLength;
 }
 
 void
 nsTextFragment::CopyTo(PRUnichar *aDest, PRInt32 aOffset, PRInt32 aCount)
 {
   NS_ASSERTION(aOffset >= 0, "Bad offset passed to nsTextFragment::CopyTo()!");
   NS_ASSERTION(aCount >= 0, "Bad count passed to nsTextFragment::CopyTo()!");
@@ -318,69 +332,77 @@ nsTextFragment::CopyTo(PRUnichar *aDest,
       const char *end = cp + aCount;
       LossyConvertEncoding8to16 converter(aDest);
       copy_string(cp, end, converter);
     }
   }
 }
 
 void
-nsTextFragment::Append(const PRUnichar* aBuffer, PRUint32 aLength)
+nsTextFragment::Append(const PRUnichar* aBuffer, PRUint32 aLength, PRBool aUpdateBidi)
 {
   // This is a common case because some callsites create a textnode
   // with a value by creating the node and then calling AppendData.
   if (mState.mLength == 0) {
-    SetTo(aBuffer, aLength);
+    SetTo(aBuffer, aLength, aUpdateBidi);
 
     return;
   }
 
   // Should we optimize for aData.Length() == 0?
 
   if (mState.mIs2b) {
     // Already a 2-byte string so the result will be too
     PRUnichar* buff = (PRUnichar*)nsMemory::Realloc(m2b, (mState.mLength + aLength) * sizeof(PRUnichar));
     if (!buff) {
       return;
     }
-    
+
     memcpy(buff + mState.mLength, aBuffer, aLength * sizeof(PRUnichar));
     mState.mLength += aLength;
     m2b = buff;
 
+    if (aUpdateBidi) {
+      UpdateBidiFlag(aBuffer, aLength);
+    }
+
     return;
   }
 
   // Current string is a 1-byte string, check if the new data fits in one byte too.
+  PRInt32 first16bit = FirstNon8Bit(aBuffer, aBuffer + aLength);
 
-  if (!Is8Bit(aBuffer, aBuffer + aLength)) {
+  if (first16bit != -1) { // aBuffer contains no non-8bit character
     // The old data was 1-byte, but the new is not so we have to expand it
     // all to 2-byte
     PRUnichar* buff = (PRUnichar*)nsMemory::Alloc((mState.mLength + aLength) *
                                                   sizeof(PRUnichar));
     if (!buff) {
       return;
     }
 
     // Copy data into buff
     LossyConvertEncoding8to16 converter(buff);
     copy_string(m1b, m1b+mState.mLength, converter);
 
     memcpy(buff + mState.mLength, aBuffer, aLength * sizeof(PRUnichar));
-
     mState.mLength += aLength;
     mState.mIs2b = PR_TRUE;
 
     if (mState.mInHeap) {
       nsMemory::Free(m2b);
     }
     m2b = buff;
 
     mState.mInHeap = PR_TRUE;
 
+    if (aUpdateBidi) {
+      UpdateBidiFlag(aBuffer + first16bit, aLength - first16bit);
+    }
+
     return;
   }
 
   // The new and the old data is all 1-byte
   char* buff;
   if (mState.mInHeap) {
     buff = (char*)nsMemory::Realloc(const_cast<char*>(m1b),
                                     (mState.mLength + aLength) * sizeof(char));
--- a/content/base/src/nsTextFragment.h
+++ b/content/base/src/nsTextFragment.h
@@ -1,9 +1,8 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
  *
@@ -109,18 +108,18 @@ public:
    */
   PRBool Is2b() const
   {
     return mState.mIs2b;
   }
 
   /**
    * Return PR_TRUE if this fragment contains Bidi text
-   * For performance reasons this flag is not set automatically, but
-   * requires an explicit call to UpdateBidiFlag()
+   * For performance reasons this flag is only set if explicitely requested (by
+   * setting the aUpdateBidi argument on SetTo or Append to true).
    */
   PRBool IsBidi() const
   {
     return mState.mIsBidi;
   }
 
   /**
    * Get a pointer to constant PRUnichar data.
@@ -151,24 +150,27 @@ public:
 
   PRBool CanGrowBy(size_t n) const
   {
     return n < (1 << 29) && mState.mLength + n < (1 << 29);
   }
 
   /**
    * Change the contents of this fragment to be a copy of the given
-   * buffer.
+   * buffer. If aUpdateBidi is true, contents of the fragment will be scanned,
+   * and mState.mIsBidi will be turned on if it includes any Bidi characters.
    */
-  void SetTo(const PRUnichar* aBuffer, PRInt32 aLength);
+  void SetTo(const PRUnichar* aBuffer, PRInt32 aLength, PRBool aUpdateBidi);
 
   /**
-   * Append aData to the end of this fragment.
+   * Append aData to the end of this fragment. If aUpdateBidi is true, contents
+   * of the fragment will be scanned, and mState.mIsBidi will be turned on if
+   * it includes any Bidi characters.
    */
-  void Append(const PRUnichar* aBuffer, PRUint32 aLength);
+  void Append(const PRUnichar* aBuffer, PRUint32 aLength, PRBool aUpdateBidi);
 
   /**
    * Append the contents of this string fragment to aString
    */
   void AppendTo(nsAString& aString) const {
     if (mState.mIs2b) {
       aString.Append(m2b, mState.mLength);
     } else {
@@ -203,22 +205,16 @@ public:
    * index. This always returns a PRUnichar.
    */
   PRUnichar CharAt(PRInt32 aIndex) const
   {
     NS_ASSERTION(PRUint32(aIndex) < mState.mLength, "bad index");
     return mState.mIs2b ? m2b[aIndex] : static_cast<unsigned char>(m1b[aIndex]);
   }
 
-  /**
-   * Scan the contents of the fragment and turn on mState.mIsBidi if it
-   * includes any Bidi characters.
-   */
-  void UpdateBidiFlag(const PRUnichar* aBuffer, PRUint32 aLength);
-
   struct FragmentBits {
     // PRUint32 to ensure that the values are unsigned, because we
     // want 0/1, not 0/-1!
     // Making these PRPackedBool causes Windows to not actually pack them,
     // which causes crashes because we assume this structure is no more than
     // 32 bits!
     PRUint32 mInHeap : 1;
     PRUint32 mIs2b : 1;
@@ -235,16 +231,22 @@ public:
     PRInt64 size = sizeof(*this);
     size += GetLength() * Is2b() ? sizeof(*m2b) : sizeof(*m1b);
     return size;
   }
 
 private:
   void ReleaseText();
 
+  /**
+   * Scan the contents of the fragment and turn on mState.mIsBidi if it
+   * includes any Bidi characters.
+   */
+  void UpdateBidiFlag(const PRUnichar* aBuffer, PRUint32 aLength);
+ 
   union {
     PRUnichar *m2b;
     const char *m1b; // This is const since it can point to shared data
   };
 
   union {
     PRUint32 mAllBits;
     FragmentBits mState;
--- a/content/base/src/nsTextFragmentSSE2.cpp
+++ b/content/base/src/nsTextFragmentSSE2.cpp
@@ -10,18 +10,18 @@ namespace SSE2 {
 
 static inline bool
 is_zero (__m128i x)
 {
   return
     _mm_movemask_epi8(_mm_cmpeq_epi8(x, _mm_setzero_si128())) == 0xffff;
 }
 
-PRBool
-Is8Bit(const PRUnichar *str, const PRUnichar *end)
+PRInt32
+FirstNon8Bit(const PRUnichar *str, const PRUnichar *end)
 {
   const PRUint32 numUnicharsPerVector = 8;
 
 #if PR_BYTES_PER_WORD == 4
   const size_t mask = 0xff00ff00;
   const PRUint32 numUnicharsPerWord = 2;
 #elif PR_BYTES_PER_WORD == 8
   const size_t mask = 0xff00ff00ff00ff00;
@@ -34,40 +34,40 @@ Is8Bit(const PRUnichar *str, const PRUni
   PRInt32 i = 0;
 
   // Align ourselves to a 16-byte boundary, as required by _mm_load_si128
   // (i.e. MOVDQA).
   PRInt32 alignLen =
     NS_MIN(len, PRInt32(((-NS_PTR_TO_INT32(str)) & 0xf) / sizeof(PRUnichar)));
   for (; i < alignLen; i++) {
     if (str[i] > 255)
-      return PR_FALSE;
+      return i;
   }
 
   // Check one XMM register (16 bytes) at a time.
   const PRInt32 vectWalkEnd = ((len - i) / numUnicharsPerVector) * numUnicharsPerVector;
   __m128i vectmask = _mm_set1_epi16(0xff00);
   for(; i < vectWalkEnd; i += numUnicharsPerVector) {
     const __m128i vect = *reinterpret_cast<const __m128i*>(str + i);
     if (!is_zero(_mm_and_si128(vect, vectmask)))
-      return PR_FALSE;
+      return i;
   }
 
   // Check one word at a time.
   const PRInt32 wordWalkEnd = ((len - i) / numUnicharsPerWord) * numUnicharsPerWord;
   for(; i < wordWalkEnd; i += numUnicharsPerWord) {
     const size_t word = *reinterpret_cast<const size_t*>(str + i);
     if (word & mask)
-      return PR_FALSE;
+      return i;
   }
 
   // Take care of the remainder one character at a time.
   for (; i < len; i++) {
     if (str[i] > 255) {
-      return PR_FALSE;
+      return i;
     }
   }
 
-  return PR_TRUE;
+  return -1;
 }
 
 } // namespace SSE2
 } // namespace mozilla
--- a/content/base/src/nsXMLHttpRequest.cpp
+++ b/content/base/src/nsXMLHttpRequest.cpp
@@ -421,17 +421,18 @@ nsXMLHttpRequest::nsXMLHttpRequest()
   : mResponseType(XML_HTTP_RESPONSE_TYPE_DEFAULT),
     mRequestObserver(nsnull), mState(XML_HTTP_REQUEST_UNSENT),
     mUploadTransferred(0), mUploadTotal(0), mUploadComplete(PR_TRUE),
     mUploadProgress(0), mUploadProgressMax(0),
     mErrorLoad(PR_FALSE), mTimerIsActive(PR_FALSE),
     mProgressEventWasDelayed(PR_FALSE),
     mLoadLengthComputable(PR_FALSE), mLoadTotal(0),
     mFirstStartRequestSeen(PR_FALSE),
-    mResultArrayBuffer(nsnull) 
+    mResultArrayBuffer(nsnull),
+    mResultJSON(JSVAL_VOID)
 {
   mResponseBodyUnicode.SetIsVoid(PR_TRUE);
   nsLayoutStatics::AddRef();
 }
 
 nsXMLHttpRequest::~nsXMLHttpRequest()
 {
   if (mListenerManager) {
@@ -579,16 +580,17 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_
 
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR_AMBIGUOUS(mUpload,
                                                        nsIXMLHttpRequestUpload)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsXMLHttpRequest,
                                                 nsXHREventTarget)
   tmp->mResultArrayBuffer = nsnull;
+  tmp->mResultJSON = JSVAL_VOID;
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mContext)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mChannel)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mReadRequest)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mResponseXML)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mCORSPreflightChannel)
 
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mOnUploadProgressListener)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mOnReadystatechangeListener)
@@ -602,16 +604,20 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_IN
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN_INHERITED(nsXMLHttpRequest,
                                                nsXHREventTarget)
   if(tmp->mResultArrayBuffer) {
     NS_IMPL_CYCLE_COLLECTION_TRACE_JS_CALLBACK(tmp->mResultArrayBuffer,
                                                "mResultArrayBuffer")
   }
+  if (JSVAL_IS_GCTHING(tmp->mResultJSON)) {
+    void *gcThing = JSVAL_TO_GCTHING(tmp->mResultJSON);
+    NS_IMPL_CYCLE_COLLECTION_TRACE_JS_CALLBACK(gcThing, "mResultJSON")
+  }
 NS_IMPL_CYCLE_COLLECTION_TRACE_END
 
 DOMCI_DATA(XMLHttpRequest, nsXMLHttpRequest)
 
 // QueryInterface implementation for nsXMLHttpRequest
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(nsXMLHttpRequest)
   NS_INTERFACE_MAP_ENTRY(nsIXMLHttpRequest)
   NS_INTERFACE_MAP_ENTRY(nsIJSXMLHttpRequest)
@@ -849,20 +855,40 @@ NS_IMETHODIMP nsXMLHttpRequest::GetRespo
   if (mState & (XML_HTTP_REQUEST_DONE |
                 XML_HTTP_REQUEST_LOADING)) {
     rv = ConvertBodyToText(aResponseText);
   }
 
   return rv;
 }
 
-nsresult nsXMLHttpRequest::CreateResponseArrayBuffer(JSContext *aCx)
+nsresult
+nsXMLHttpRequest::CreateResponseParsedJSON(JSContext* aCx)
 {
-  if (!aCx)
+  if (!aCx) {
+    return NS_ERROR_FAILURE;
+  }
+
+  nsString bodyString;
+  ConvertBodyToText(bodyString);
+  if (!JS_ParseJSON(aCx,
+                    (jschar*)PromiseFlatString(bodyString).get(),
+                    bodyString.Length(), &mResultJSON)) {
     return NS_ERROR_FAILURE;
+  }
+
+  return NS_OK;
+}
+
+nsresult
+nsXMLHttpRequest::CreateResponseArrayBuffer(JSContext *aCx)
+{
+  if (!aCx){
+    return NS_ERROR_FAILURE;
+  }
 
   PRInt32 dataLen = mResponseBody.Length();
   RootResultArrayBuffer();
   mResultArrayBuffer = js_CreateArrayBuffer(aCx, dataLen);
   if (!mResultArrayBuffer) {
     return NS_ERROR_FAILURE;
   }
 
@@ -889,16 +915,19 @@ NS_IMETHODIMP nsXMLHttpRequest::GetRespo
     aResponseType.AssignLiteral("blob");
     break;
   case XML_HTTP_RESPONSE_TYPE_DOCUMENT:
     aResponseType.AssignLiteral("document");
     break;
   case XML_HTTP_RESPONSE_TYPE_TEXT:
     aResponseType.AssignLiteral("text");
     break;
+  case XML_HTTP_RESPONSE_TYPE_JSON:
+    aResponseType.AssignLiteral("moz-json");
+    break;
   default:
     NS_ERROR("Should not happen");
   }
 
   return NS_OK;
 }
 
 /* attribute AString responseType; */
@@ -916,16 +945,18 @@ NS_IMETHODIMP nsXMLHttpRequest::SetRespo
   } else if (aResponseType.EqualsLiteral("arraybuffer")) {
     mResponseType = XML_HTTP_RESPONSE_TYPE_ARRAYBUFFER;
   } else if (aResponseType.EqualsLiteral("blob")) {
     mResponseType = XML_HTTP_RESPONSE_TYPE_BLOB;
   } else if (aResponseType.EqualsLiteral("document")) {
     mResponseType = XML_HTTP_RESPONSE_TYPE_DOCUMENT;
   } else if (aResponseType.EqualsLiteral("text")) {
     mResponseType = XML_HTTP_RESPONSE_TYPE_TEXT;
+  } else if (aResponseType.EqualsLiteral("moz-json")) {
+    mResponseType = XML_HTTP_RESPONSE_TYPE_JSON;
   }
   // If the given value is not the empty string, "arraybuffer",
   // "blob", "document", or "text" terminate these steps.
 
   // If the state is OPENED, SetCacheAsFile would have no effect here
   // because the channel hasn't initialized the cache entry yet.
   // SetCacheAsFile will be called from OnStartRequest.
   // If the state is HEADERS_RECEIVED, however, we need to call
@@ -957,17 +988,17 @@ NS_IMETHODIMP nsXMLHttpRequest::GetRespo
       if (buf) {
         str.ForgetSharedBuffer();
       }
     }
     break;
 
   case XML_HTTP_RESPONSE_TYPE_ARRAYBUFFER:
     if (mState & XML_HTTP_REQUEST_DONE) {
-      if (!mResultArrayBuffer) {  
+      if (!mResultArrayBuffer) {
          rv = CreateResponseArrayBuffer(aCx);
          NS_ENSURE_SUCCESS(rv, rv);
       }
       *aResult = OBJECT_TO_JSVAL(mResultArrayBuffer);
     } else {
       *aResult = JSVAL_NULL;
     }
     break;
@@ -987,16 +1018,31 @@ NS_IMETHODIMP nsXMLHttpRequest::GetRespo
       JSObject* scope = JS_GetScopeChain(aCx);
       rv = nsContentUtils::WrapNative(aCx, scope, mResponseXML, aResult,
                                       nsnull, PR_TRUE);
     } else {
       *aResult = JSVAL_NULL;
     }
     break;
 
+  case XML_HTTP_RESPONSE_TYPE_JSON:
+    if (mState & XML_HTTP_REQUEST_DONE) {
+      if (mResultJSON == JSVAL_VOID) {
+        rv = CreateResponseParsedJSON(aCx);
+        NS_ENSURE_SUCCESS(rv, rv);
+
+        mResponseBody.Truncate();
+        mResponseBodyUnicode.SetIsVoid(PR_TRUE);
+      }
+      *aResult = mResultJSON;
+    } else {
+      *aResult = JSVAL_NULL;
+    }
+    break;
+
   default:
     NS_ERROR("Should not happen");
   }
 
   return rv;
 }
 
 /* readonly attribute unsigned long status; */
@@ -1081,16 +1127,17 @@ nsXMLHttpRequest::Abort()
   }
   mResponseXML = nsnull;
   PRUint32 responseLength = mResponseBody.Length();
   mResponseBody.Truncate();
   mResponseBodyUnicode.SetIsVoid(PR_TRUE);
   mResponseBlob = nsnull;
   mState |= XML_HTTP_REQUEST_ABORTED;
   mResultArrayBuffer = nsnull;
+  mResultJSON = JSVAL_VOID;
   
   if (!(mState & (XML_HTTP_REQUEST_UNSENT |
                   XML_HTTP_REQUEST_OPENED |
                   XML_HTTP_REQUEST_DONE))) {
     ChangeState(XML_HTTP_REQUEST_DONE, PR_TRUE);
   }
 
   if (!(mState & XML_HTTP_REQUEST_SYNCLOOPING)) {
@@ -2078,16 +2125,38 @@ GetRequestBody(nsIVariant* aBody, nsIInp
       return NS_OK;
     }
 
     // nsIXHRSendable?
     nsCOMPtr<nsIXHRSendable> sendable = do_QueryInterface(supports);
     if (sendable) {
       return sendable->GetSendInfo(aResult, aContentType, aCharset);
     }
+
+    // ArrayBuffer?
+    jsval realVal;
+    JSObject* obj;
+    nsresult rv = aBody->GetAsJSVal(&realVal);
+    if (NS_SUCCEEDED(rv) && !JSVAL_IS_PRIMITIVE(realVal) &&
+        (obj = JSVAL_TO_OBJECT(realVal)) &&
+        (js_IsArrayBuffer(obj))) {
+
+      aContentType.SetIsVoid(PR_TRUE);
+      PRInt32 abLength = JS_GetArrayBufferByteLength(obj);
+      char* data = (char*)JS_GetArrayBufferData(obj);
+
+      nsCOMPtr<nsIInputStream> stream;
+      nsresult rv = NS_NewByteInputStream(getter_AddRefs(stream), data,
+                                          abLength, NS_ASSIGNMENT_COPY);
+      NS_ENSURE_SUCCESS(rv, rv);
+      stream.forget(aResult);
+      aCharset.Truncate();
+
+      return NS_OK;
+    }
   }
   else if (dataType == nsIDataType::VTYPE_VOID ||
            dataType == nsIDataType::VTYPE_EMPTY) {
     // Makes us act as if !aBody, don't upload anything
     return NS_OK;
   }
 
   PRUnichar* data = nsnull;
--- a/content/base/src/nsXMLHttpRequest.h
+++ b/content/base/src/nsXMLHttpRequest.h
@@ -204,16 +204,17 @@ protected:
   nsresult DetectCharset(nsACString& aCharset);
   nsresult ConvertBodyToText(nsAString& aOutBuffer);
   static NS_METHOD StreamReaderFunc(nsIInputStream* in,
                 void* closure,
                 const char* fromRawSegment,
                 PRUint32 toOffset,
                 PRUint32 count,
                 PRUint32 *writeCount);
+  nsresult CreateResponseParsedJSON(JSContext* aCx);
   nsresult CreateResponseArrayBuffer(JSContext* aCx);
   void CreateResponseBlob(nsIRequest *request);
   // Change the state of the object with this. The broadcast argument
   // determines if the onreadystatechange listener should be called.
   nsresult ChangeState(PRUint32 aState, PRBool aBroadcast = PR_TRUE);
   already_AddRefed<nsILoadGroup> GetLoadGroup() const;
   nsIURI *GetBaseURI();
 
@@ -277,17 +278,18 @@ protected:
   // will cause us to clear the cached value anyway.
   nsString mResponseBodyUnicode;
 
   enum {
     XML_HTTP_RESPONSE_TYPE_DEFAULT,
     XML_HTTP_RESPONSE_TYPE_ARRAYBUFFER,
     XML_HTTP_RESPONSE_TYPE_BLOB,
     XML_HTTP_RESPONSE_TYPE_DOCUMENT,
-    XML_HTTP_RESPONSE_TYPE_TEXT
+    XML_HTTP_RESPONSE_TYPE_TEXT,
+    XML_HTTP_RESPONSE_TYPE_JSON
   } mResponseType;
 
   nsCOMPtr<nsIDOMBlob> mResponseBlob;
 
   nsCString mOverrideMimeType;
 
   /**
    * The notification callbacks the channel had when Send() was
@@ -323,16 +325,17 @@ protected:
   PRUint64 mLoadTotal; // 0 if not known.
   nsCOMPtr<nsITimer> mProgressNotifier;
 
   PRPackedBool mFirstStartRequestSeen;
   
   nsCOMPtr<nsIAsyncVerifyRedirectCallback> mRedirectCallback;
   nsCOMPtr<nsIChannel> mNewRedirectChannel;
   
+  jsval mResultJSON;
   JSObject* mResultArrayBuffer;
 
   struct RequestHeader
   {
     nsCString header;
     nsCString value;
   };
   nsTArray<RequestHeader> mModifiedRequestHeaders;
--- a/content/base/test/Makefile.in
+++ b/content/base/test/Makefile.in
@@ -63,17 +63,19 @@ XPCSHELL_TESTS = \
 ifneq ($(OS_ARCH),Darwin)
 XPCSHELL_TESTS += unit_ipc
 endif
 
 include $(topsrcdir)/config/rules.mk
 
 # Split files arbitrarily in two groups to not run into too-long command lines
 # which break on Windows (see bug 563151)
-_TEST_FILES1 = 	test_bug5141.html \
+_TEST_FILES1 = \
+		responseIdentical.sjs \
+		test_bug5141.html \
 		test_bug51034.html \
 		test_bug166235.html \
 		test_bug199959.html \
 		test_bug218236.html \
 		file_bug218236_multipart.txt \
 		file_bug218236_multipart.txt^headers^ \
 		test_bug218277.html \
 		test_bug238409.html \
@@ -499,16 +501,20 @@ include $(topsrcdir)/config/rules.mk
 		somedatas.resource \
 		somedatas.resource^headers^ \
 		delayedServerEvents.sjs \
 		test_bug664916.html \
 		test_bug666604.html \
 		test_bug675121.html \
 		file_bug675121.sjs \
 		test_bug654352.html \
+		test_bug682592.html \
+		bug682592-subframe.html \
+		bug682592-subframe-ref.html \
+		test_bug685798.html \
 		$(NULL)
 
 _CHROME_FILES =	\
 		test_bug357450.js \
 		$(NULL)
 
 # This test fails on the Mac for some reason
 ifneq (,$(filter gtk2 windows,$(MOZ_WIDGET_TOOLKIT)))
new file mode 100644
--- /dev/null
+++ b/content/base/test/bug682592-subframe-ref.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" >
+    <title></title>
+</head>
+<body>
+<p id="content"></p>
+</body>
+</html>
+
new file mode 100644
--- /dev/null
+++ b/content/base/test/bug682592-subframe.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" >
+    <title></title>
+</head>
+<body>
+<p id="content"></p>
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/content/base/test/responseIdentical.sjs
@@ -0,0 +1,17 @@
+const CC = Components.Constructor;
+const BinaryInputStream = CC("@mozilla.org/binaryinputstream;1",
+                             "nsIBinaryInputStream",
+                             "setInputStream");
+
+// Simply sending back the same data that is received
+function handleRequest(request, response)
+{
+  var body = "";
+  var bodyStream = new BinaryInputStream(request.bodyInputStream);
+  var bytes = [], avail = 0;
+  while ((avail = bodyStream.available()) > 0)
+    body += String.fromCharCode.apply(String, bodyStream.readByteArray(avail));
+
+  response.setHeader("Content-Type", "application/octet-stream", false);
+  response.write(body);
+}
--- a/content/base/test/test_XHR.html
+++ b/content/base/test/test_XHR.html
@@ -9,16 +9,51 @@
 <p id="display"></p>
 <div id="content" style="display: none">
   
 </div>
 <pre id="test">
 <script class="testbody" type="text/javascript">
 SimpleTest.waitForExplicitFinish();
 
+// test receiving as JSON
+function testJSON(aJsonStr, invalid) {
+  var errorThrown = false;
+  var anotherErrorThrown = false;
+  var xhr = new XMLHttpRequest();
+  
+  var didthrow = false;
+  try { xhr.responseType = 'moz-json'; } catch (e) { didthrow = true; }
+  ok(didthrow, 
+     "should have thrown when setting responseType to moz-json before open");
+
+  xhr.open("POST", 'responseIdentical.sjs', false);
+  xhr.responseType = 'moz-json';
+  xhr.send(aJsonStr);
+
+  if (!invalid) {
+    is(JSON.stringify(xhr.response), aJsonStr);
+    is(xhr.response, xhr.response, "returning the same object on each access");
+  }
+  else {
+    var didThrow = false;
+    try { xhr.response } catch(ex) { didThrow = true; }
+    ok(didThrow, "accessing response should throw");
+
+    didThrow = false;
+    try { xhr.response } catch(ex) { didThrow = true; }
+    ok(didThrow, "accessing response should throw");
+  } 
+}
+
+var jsonStr = '{"title":"aBook","author":"john"}';
+testJSON(jsonStr, false);
+var invalidJson = '{ "abc": }'
+testJSON(invalidJson, true);
+
 var path = "/tests/content/base/test/";
 
 var passFiles = [['file_XHR_pass1.xml', 'GET'],
                  ['file_XHR_pass2.txt', 'GET'],
                  ['file_XHR_pass3.txt', 'GET'],
                  ];
 
 var failFiles = [['//example.com' + path + 'file_XHR_pass1.xml', 'GET'],
--- a/content/base/test/test_XHRSendData.html
+++ b/content/base/test/test_XHRSendData.html
@@ -35,16 +35,27 @@ is(testDoc2.inputEncoding, null, "wrong 
 netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
 
 var testData = "blahblahblahblahblahblahblaaaaaaaah. blah.";
 var extensions = [".txt",".png",".jpg",".gif",".xml", "noext"];
 var fileTypes = ["text/plain", "image/png", "image/jpeg", "image/gif", "text/xml", null];
 var testFiles = new Array;
 var testDOMFiles = new Array;
 
+// arraybuffer test objects
+var shortArray = new ArrayBuffer(1);
+var shortInt8View = new Uint8Array(shortArray);
+shortInt8View[0] = 3;
+
+var longArray = new ArrayBuffer(512);
+var longInt8View = new Uint8Array(longArray);
+for (var i = 0; i < longInt8View.length; i++) {
+  longInt8View[i] = i % 255;
+}
+
 extensions.forEach(
     function (extension) {
       var testFile = createFileWithDataExt(testData, extension);
       testFiles.push(testFile);
 
       var fileList = document.getElementById('fileList');
       fileList.value = testFile.path;
       testDOMFiles.push(fileList.files[0]);
@@ -139,47 +150,60 @@ tests = [{ body: null,
            contentType: "foo/bar; charset=uTf-8",
            resBody: "<!-- doc 2 -->\n<res>text</res>",
            resContentType: "foo/bar; charset=uTf-8",
          },
          { //will trigger a redirect test server-side
            body: ("TEST_REDIRECT_STR&url=" + window.location.host + window.location.pathname),
            redirect: true,
          },
+         { body: shortArray,
+           resBody: shortArray,
+           resType: "arraybuffer"
+         },
+         { body: longArray,
+           resBody: longArray,
+           resType: "arraybuffer"
+         },
          ];
 
 for (var i = 0; i < testDOMFiles.length; i++) {
   tests.push({ body: testDOMFiles[i],
                resBody: testData,
                resContentType: fileTypes[i],
                resContentLength: testData.length,
               });
 }
 
 try {
   for each(test in tests) {
     xhr = new XMLHttpRequest;
     xhr.open("POST", "file_XHRSendData.sjs", false);
     if (test.contentType)
       xhr.setRequestHeader("Content-Type", test.contentType);
+    if (test.resType)
+      xhr.responseType = test.resType;
     xhr.send(test.body);
 
     if (test.resContentType) {
       is(xhr.getResponseHeader("Result-Content-Type"), test.resContentType,
          "Wrong Content-Type sent");
     }
     else {
       is(xhr.getResponseHeader("Result-Content-Type"), null);
     }
 
     if (test.resContentLength) {
       is(xhr.getResponseHeader("Result-Content-Length"), test.resContentLength, "Wrong Content-Length sent");
     }
 
-    if (test.body instanceof Document) {
+    if (test.resType == "arraybuffer") {
+      is_identical_arraybuffer(xhr.response, test.resBody);
+    }
+    else if (test.body instanceof Document) {
       is(xhr.responseText.replace("\r\n", "\n"), test.resBody, "Wrong body");
     }
     else if (!test.redirect) {
       is(xhr.responseText, test.resBody, "Wrong body");
     }
     else {
       // If we're testing redirect, determine whether the body is
       // this document by looking for the relevant bug url
@@ -197,12 +221,20 @@ function cleanUpData() {
       function (testFile) {
         try {
           testFile.remove(false);
         } catch (e) {}
       }
   );
 }
 
+function is_identical_arraybuffer(ab1, ab2) {
+  is(ab1.byteLength, ab2.byteLength, "arraybuffer byteLengths not equal");
+  u8v1 = new Uint8Array(ab1);
+  u8v2 = new Uint8Array(ab2);
+  is(String.fromCharCode.apply(String, u8v1),
+     String.fromCharCode.apply(String, u8v2), "arraybuffer values not equal");
+}
+
 </script>
 </pre>
 </body>
 </html>
new file mode 100644
--- /dev/null
+++ b/content/base/test/test_bug682592.html
@@ -0,0 +1,170 @@
+<!DOCTYPE html>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=682592
+-->
+<head>
+    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" >
+    <title>Test for bug 682592</title>
+    <script type="text/javascript" src="/tests/SimpleTest/WindowSnapshot.js"></script>
+    <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+    <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<p id="display"></p>
+<div id="content">
+<iframe id="iframe-ref" src="bug682592-subframe-ref.html"></iframe>
+<iframe id="iframe-test"></iframe>
+</div>
+<pre id="test">
+<script class="testbody" type="text/javascript;version=1.7">
+/** Test for Bug 682592 **/
+
+/* 
+   We want to check that bidi is detected correctly. So, we have a reference
+   document where ltr is set explicitely with <bdo> element. Then, we compare
+   it with test document.
+
+   In mozilla, once bidi has been detected in a document, document always
+   consider it's in bidi mode. So, if one fragment enables bidi correctly, and
+   we create or update a fragment in the same document, that operation may not
+   enable bidi by itself, but it will not be detected. So, we need to have new
+   document for each test.
+
+   So, instead of many diferent reftests, this mochitest implements a
+   reftest-like. It creates reference text fragments in reference iframe, test
+   text fragments in test iframe, and compare the documents. Then, it reloads
+   test iframe. Reference iframe does not need to be reloaded between tests.
+   It's ok (and maybe, desired) to keep bidi always enabled in that document. 
+*/
+
+SimpleTest.waitForExplicitFinish();
+var refFrame = document.getElementById("iframe-ref")
+var testFrame = document.getElementById("iframe-test");
+
+refFrame.addEventListener("load", function() {
+  testFrame.addEventListener("load", function() {
+    try {
+      tests.next();
+      ok(compareSnapshots(snapshotWindow(testFrame.contentWindow), 
+                          snapshotWindow(refFrame.contentWindow), true)[0], 
+         "bidi is not detected correctly");
+
+      testFrame.contentWindow.location.reload();
+    } catch (err if err instanceof StopIteration) {
+      SimpleTest.finish();
+    }
+  }, false);
+  testFrame.src = "bug682592-subframe.html"
+}, false);
+
+var rtl = "עִבְרִית";
+var non8bit =  "ʃ";
+var is8bit = "a";
+
+// concats aStr aNumber of times
+function strMult(aStr, aNumber) {
+  if (aNumber === 0) {
+    return "";
+  }
+  return strMult(aStr, aNumber - 1) + aStr;
+}
+
+function runTests () {
+  var ltr = "", prefix = null;
+  var refContainer = refFrame.contentDocument.getElementById('content');
+  var testContainer, textNode;
+  var i = 0;
+
+  // 8bit chars + bidi
+  for (i = 0; i <= 16; i++) {
+    ltr = strMult(is8bit, i);
+    refContainer.innerHTML = ltr + '<bdo dir="rtl">' + rtl + '</bdo>';
+    testContainer = testFrame.contentDocument.getElementById('content');
+    testContainer.innerHTML = ltr + rtl;
+    yield;
+  }
+
+  // non-8bit char + 8bit chars + bidi
+  for (i = 0; i <= 16; i++) {
+    ltr = non8bit + strMult(is8bit, i);
+    refContainer.innerHTML = ltr + '<bdo dir="rtl">' + rtl + '</bdo>';
+    testContainer = testFrame.contentDocument.getElementById('content');
+    testContainer.innerHTML = ltr + rtl;
+    yield;
+  }
+
+  // appendData
+  for (i = 0; i <= 16; i++) {
+    ltr = strMult(is8bit, i);
+    refContainer.innerHTML = ltr + '<bdo dir="rtl">' + rtl + '</bdo>';
+    testContainer = testFrame.contentDocument.getElementById('content');
+    textNode = document.createTextNode("");
+    testContainer.appendChild(textNode);
+    textNode.appendData(ltr + rtl);
+    yield;
+  }
+
+  for (i = 0; i <= 16; i++) {
+    ltr = non8bit + strMult(is8bit, i);
+    refContainer.innerHTML = ltr + '<bdo dir="rtl">' + rtl + '</bdo>';
+    testContainer = testFrame.contentDocument.getElementById('content');
+    textNode = document.createTextNode("");
+    testContainer.appendChild(textNode);
+    textNode.appendData(ltr + rtl);
+    yield;
+  }
+
+  // appendData with 8bit prefix
+  for (i = 0; i <= 16; i++) {
+    prefix = is8bit;
+    ltr = strMult(is8bit, i);
+    refContainer.innerHTML = prefix + ltr + '<bdo dir="rtl">' + rtl + '</bdo>';
+    testContainer = testFrame.contentDocument.getElementById('content');
+    textNode = document.createTextNode(prefix);
+    testContainer.appendChild(textNode);
+    textNode.appendData(ltr + rtl);
+    yield;
+  }
+
+  for (i = 0; i <= 16; i++) {
+    prefix = is8bit;
+    ltr = non8bit + strMult(is8bit, i);
+    refContainer.innerHTML = prefix + ltr + '<bdo dir="rtl">' + rtl + '</bdo>';
+    testContainer = testFrame.contentDocument.getElementById('content');
+    textNode = document.createTextNode(prefix);
+    testContainer.appendChild(textNode);
+    textNode.appendData(ltr + rtl);
+    yield;
+  }
+
+  // appendData with non-8bit prefix
+  for (i = 0; i <= 16; i++) {
+    prefix = non8bit;
+    ltr = strMult(is8bit, i);
+    refContainer.innerHTML = prefix + ltr + '<bdo dir="rtl">' + rtl + '</bdo>';
+    testContainer = testFrame.contentDocument.getElementById('content');
+    textNode = document.createTextNode(prefix);
+    testContainer.appendChild(textNode);
+    textNode.appendData(ltr + rtl);
+    yield;
+  }
+
+  for (i = 0; i <= 16; i++) {
+    prefix = non8bit;
+    ltr = non8bit + strMult(is8bit, i);
+    refContainer.innerHTML = prefix + ltr + '<bdo dir="rtl">' + rtl + '</bdo>';
+    testContainer = testFrame.contentDocument.getElementById('content');
+    textNode = document.createTextNode(prefix);
+    testContainer.appendChild(textNode);
+    textNode.appendData(ltr + rtl);
+    yield;
+  }
+};
+
+var tests = runTests();
+
+</script>
+</pre>
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/content/base/test/test_bug685798.html
@@ -0,0 +1,45 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=685798
+-->
+<head>
+  <title>Test for Bug 685798</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=685798">Mozilla Bug 685798</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 685798 **/
+
+
+is(document.parentElement, null,
+   "Document shouldn't have parentElement.");
+is(document.documentElement.parentElement, null,
+   "DocumentElement shouldn't have parentElement.");
+is(document.documentElement.firstChild.parentElement, document.documentElement,
+   "DocumentElement's child should have DocumentElement as parent.");
+
+var df = document.createRange().createContextualFragment("<div>foo</div>");
+is(df.parentElement, null,
+   "DocumentFragment should be null.");
+is(df.firstChild.parentElement, null, 
+   "DocumentFragment's child shouldn't have parentElement");
+is(df.firstChild.firstChild.parentElement, df.firstChild,
+   "Text node's parent should be element.");
+
+is(document.createTextNode("foo").parentElement, null,
+   "Text node shouldn't have parent element.");
+
+
+</script>
+</pre>
+</body>
+</html>
--- a/content/canvas/src/CanvasUtils.cpp
+++ b/content/canvas/src/CanvasUtils.cpp
@@ -60,17 +60,18 @@
 #include "mozilla/gfx/Matrix.h"
 
 namespace mozilla {
 namespace CanvasUtils {
 
 void
 DoDrawImageSecurityCheck(nsHTMLCanvasElement *aCanvasElement,
                          nsIPrincipal *aPrincipal,
-                         PRBool forceWriteOnly)
+                         PRBool forceWriteOnly,
+                         PRBool CORSUsed)
 {
     // Callers should ensure that mCanvasElement is non-null before calling this
     if (!aCanvasElement) {
         NS_WARNING("DoDrawImageSecurityCheck called without canvas element!");
         return;
     }
 
     if (aCanvasElement->IsWriteOnly())
@@ -80,16 +81,20 @@ DoDrawImageSecurityCheck(nsHTMLCanvasEle
     if (forceWriteOnly) {
         aCanvasElement->SetWriteOnly();
         return;
     }
 
     if (aPrincipal == nsnull)
         return;
 
+    // No need to do a security check if the image used CORS for the load
+    if (CORSUsed)
+        return;
+
     PRBool subsumes;
     nsresult rv =
         aCanvasElement->NodePrincipal()->Subsumes(aPrincipal, &subsumes);
 
     if (NS_SUCCEEDED(rv) && subsumes) {
         // This canvas has access to that image anyway
         return;
     }
--- a/content/canvas/src/CanvasUtils.h
+++ b/content/canvas/src/CanvasUtils.h
@@ -69,17 +69,18 @@ inline PRBool CheckSaneSubrectSize(PRInt
         checked_ymost.value() <= realHeight;
 }
 
 // Flag aCanvasElement as write-only if drawing an image with aPrincipal
 // onto it would make it such.
 
 void DoDrawImageSecurityCheck(nsHTMLCanvasElement *aCanvasElement,
                               nsIPrincipal *aPrincipal,
-                              PRBool forceWriteOnly);
+                              PRBool forceWriteOnly,
+                              PRBool CORSUsed);
 
 void LogMessage (const nsCString& errorString);
 void LogMessagef (const char *fmt, ...);
 
 // Make a double out of |v|, treating undefined values as 0.0 (for
 // the sake of sparse arrays).  Return true iff coercion
 // succeeded.
 bool CoerceDouble(jsval v, double* d);
--- a/content/canvas/src/WebGLContext.h
+++ b/content/canvas/src/WebGLContext.h
@@ -497,17 +497,19 @@ protected:
     PRBool ValidateFaceEnum(WebGLenum face, const char *info);
     PRBool ValidateBufferUsageEnum(WebGLenum target, const char *info);
     PRBool ValidateTexFormatAndType(WebGLenum format, WebGLenum type, int jsArrayType,
                                       PRUint32 *texelSize, const char *info);
     PRBool ValidateDrawModeEnum(WebGLenum mode, const char *info);
     PRBool ValidateAttribIndex(WebGLuint index, const char *info);
     PRBool ValidateStencilParamsForDrawCall();
     
-    bool  ValidateGLSLIdentifier(const nsAString& name, const char *info);
+    bool ValidateGLSLVariableName(const nsAString& name, const char *info);
+    bool ValidateGLSLCharacter(PRUnichar c);
+    bool ValidateGLSLString(const nsAString& string, const char *info);
 
     static PRUint32 GetTexelSize(WebGLenum format, WebGLenum type);
 
     void Invalidate();
     void DestroyResourcesAndContext();
 
     void MakeContextCurrent() { gl->MakeCurrent(); }
 
@@ -808,37 +810,41 @@ public:
     void SetByteLength(GLuint byteLength) { mByteLength = byteLength; }
     void SetTarget(GLenum target) { mTarget = target; }
 
     // element array buffers are the only buffers for which we need to keep a copy of the data.
     // this method assumes that the byte length has previously been set by calling SetByteLength.
     PRBool CopyDataIfElementArray(const void* data) {
         if (mTarget == LOCAL_GL_ELEMENT_ARRAY_BUFFER) {
             mData = realloc(mData, mByteLength);
-            if (!mData)
+            if (!mData) {
+                mByteLength = 0;
                 return PR_FALSE;
+            }
             memcpy(mData, data, mByteLength);
         }
         return PR_TRUE;
     }
 
     // same comments as for CopyElementArrayData
     PRBool ZeroDataIfElementArray() {
         if (mTarget == LOCAL_GL_ELEMENT_ARRAY_BUFFER) {
             mData = realloc(mData, mByteLength);
-            if (!mData)
+            if (!mData) {
+                mByteLength = 0;
                 return PR_FALSE;
+            }
             memset(mData, 0, mByteLength);
         }
         return PR_TRUE;
     }
 
     // same comments as for CopyElementArrayData
     void CopySubDataIfElementArray(GLuint byteOffset, GLuint byteLength, const void* data) {
-        if (mTarget == LOCAL_GL_ELEMENT_ARRAY_BUFFER) {
+        if (mTarget == LOCAL_GL_ELEMENT_ARRAY_BUFFER && mByteLength) {
             memcpy((void*) (size_t(mData)+byteOffset), data, byteLength);
         }
     }
 
     // this method too is only for element array buffers. It returns the maximum value in the part of
     // the buffer starting at given offset, consisting of given count of elements. The type T is the type
     // to interprete the array elements as, must be GLushort or GLubyte.
     template<typename T>
@@ -1040,20 +1046,16 @@ protected:
     }
 
     PRBool CheckFloatTextureFilterParams() const {
         // Without OES_texture_float_linear, only NEAREST and NEAREST_MIMPAMP_NEAREST are supported
         return (mMagFilter == LOCAL_GL_NEAREST) &&
             (mMinFilter == LOCAL_GL_NEAREST || mMinFilter == LOCAL_GL_NEAREST_MIPMAP_NEAREST);
     }
 
-    PRBool DoesMinFilterRequireMipmap() const {
-        return !(mMinFilter == LOCAL_GL_NEAREST || mMinFilter == LOCAL_GL_LINEAR);
-    }
-
     PRBool AreBothWrapModesClampToEdge() const {
         return mWrapS == LOCAL_GL_CLAMP_TO_EDGE && mWrapT == LOCAL_GL_CLAMP_TO_EDGE;
     }
 
     PRBool DoesTexture2DMipmapHaveAllLevelsConsistentlyDefined(size_t face) const {
         if (mHaveGeneratedMipmap)
             return PR_TRUE;
 
@@ -1147,16 +1149,22 @@ public:
     void SetWrapS(WebGLenum aWrapS) {
         mWrapS = aWrapS;
         SetDontKnowIfNeedFakeBlack();
     }
     void SetWrapT(WebGLenum aWrapT) {
         mWrapT = aWrapT;
         SetDontKnowIfNeedFakeBlack();
     }
+    
+    WebGLenum MinFilter() const { return mMinFilter; }
+
+    PRBool DoesMinFilterRequireMipmap() const {
+        return !(mMinFilter == LOCAL_GL_NEAREST || mMinFilter == LOCAL_GL_LINEAR);
+    }
 
     void SetGeneratedMipmap() {
         if (!mHaveGeneratedMipmap) {
             mHaveGeneratedMipmap = PR_TRUE;
             SetDontKnowIfNeedFakeBlack();
         }
     }
 
@@ -1361,44 +1369,44 @@ public:
     PRBool Deleted() { return mDeleted && mAttachCount == 0; }
     WebGLuint GLName() { return mName; }
     WebGLenum ShaderType() { return mType; }
 
     PRUint32 AttachCount() { return mAttachCount; }
     void IncrementAttachCount() { mAttachCount++; }
     void DecrementAttachCount() { mAttachCount--; }
 
-    void SetSource(const nsCString& src) {
+    void SetSource(const nsAString& src) {
         // XXX do some quick gzip here maybe -- getting this will be very rare
         mSource.Assign(src);
     }
 
-    const nsCString& Source() const { return mSource; }
+    const nsString& Source() const { return mSource; }
 
     void SetNeedsTranslation() { mNeedsTranslation = true; }
     bool NeedsTranslation() const { return mNeedsTranslation; }
 
     void SetTranslationSuccess() {
         mTranslationLog.SetIsVoid(PR_TRUE);
         mNeedsTranslation = false;
     }
 
     void SetTranslationFailure(const nsCString& msg) {
-        mTranslationLog.Assign(msg);
+        mTranslationLog.Assign(msg); 
     }
 
     const nsCString& TranslationLog() const { return mTranslationLog; }
 
     NS_DECL_ISUPPORTS
     NS_DECL_NSIWEBGLSHADER
 protected:
     WebGLuint mName;
     PRBool mDeleted;
     WebGLenum mType;
-    nsCString mSource;
+    nsString mSource;
     nsCString mTranslationLog;
     bool mNeedsTranslation;
     PRUint32 mAttachCount;
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(WebGLShader, WEBGLSHADER_PRIVATE_IID)
 
 #define WEBGLPROGRAM_PRIVATE_IID \
--- a/content/canvas/src/WebGLContextGL.cpp
+++ b/content/canvas/src/WebGLContextGL.cpp
@@ -57,16 +57,17 @@
 #include "jstypedarray.h"
 
 #if defined(USE_ANGLE)
 // shader translator
 #include "angle/ShaderLang.h"
 #endif
 
 #include "WebGLTexelConversions.h"
+#include "WebGLValidateStrings.h"
 
 using namespace mozilla;
 
 static PRBool BaseTypeAndSizeFromUniformType(WebGLenum uType, WebGLenum *baseType, WebGLint *unitSize);
 static WebGLenum InternalFormatForFormatAndType(WebGLenum format, WebGLenum type, bool isGLES2);
 
 /* Helper macros for when we're just wrapping a gl method, so that
  * we can avoid having to type this 500 times.  Note that these MUST
@@ -177,18 +178,18 @@ WebGLContext::AttachShader(nsIWebGLProgr
 
 NS_IMETHODIMP
 WebGLContext::BindAttribLocation(nsIWebGLProgram *pobj, WebGLuint location, const nsAString& name)
 {
     WebGLuint progname;
     if (!GetGLName<WebGLProgram>("bindAttribLocation: program", pobj, &progname))
         return NS_OK;
 
-    if (name.IsEmpty())
-        return ErrorInvalidValue("BindAttribLocation: name can't be null or empty");
+    if (!ValidateGLSLVariableName(name, "bindAttribLocation"))
+        return NS_OK;
 
     if (!ValidateAttribIndex(location, "bindAttribLocation"))
         return NS_OK;
 
     MakeContextCurrent();
 
     gl->fBindAttribLocation(progname, location, NS_LossyConvertUTF16toASCII(name).get());
 
@@ -1745,17 +1746,38 @@ WebGLContext::GenerateMipmap(WebGLenum t
 
     if (!tex->AreAllLevel0ImageInfosEqual()) {
         return ErrorInvalidOperation("generateMipmap: the six faces of this cube map have different dimensions, format, or type.");
     }
 
     tex->SetGeneratedMipmap();
 
     MakeContextCurrent();
+
+#ifdef XP_MACOSX
+    // On Mac, glGenerateMipmap on a texture whose minification filter does NOT require a mipmap at the time of the call,
+    // will happily grab random video memory into certain mipmap levels. See bug 684882. Also, this is Apple bug 9129398.
+    // Thanks to Kenneth Russell / Google for figuring this out.
+    // So we temporarily spoof the minification filter, call glGenerateMipmap,
+    // and restore it. If that turned out to not be enough, we would have to avoid calling glGenerateMipmap altogether and
+    // emulate it.
+    if (tex->DoesMinFilterRequireMipmap()) {
+        gl->fGenerateMipmap(target);
+    } else {
+        // spoof the min filter as something that requires a mipmap. The particular choice of a filter doesn't matter as
+        // we're not rendering anything here. Since LINEAR_MIPMAP_LINEAR is by far the most common use case, and we're trying
+        // to work around a bug triggered by "unexpected" min filters, it seems to be the safest choice.
+        gl->fTexParameteri(target, LOCAL_GL_TEXTURE_MIN_FILTER, LOCAL_GL_LINEAR_MIPMAP_LINEAR);
+        gl->fGenerateMipmap(target);
+        gl->fTexParameteri(target, LOCAL_GL_TEXTURE_MIN_FILTER, tex->MinFilter());
+    }
+#else
     gl->fGenerateMipmap(target);
+#endif
+    
     return NS_OK;
 }
 
 NS_IMETHODIMP
 WebGLContext::GetActiveUniform(nsIWebGLProgram *pobj, PRUint32 index, nsIWebGLActiveInfo **retval)
 {
     *retval = nsnull;
 
@@ -1851,17 +1873,17 @@ WebGLContext::GetAttribLocation(nsIWebGL
                                 PRInt32 *retval)
 {
     *retval = 0;
 
     WebGLuint progname;
     if (!GetGLName<WebGLProgram>("getAttribLocation: program", pobj, &progname))
         return NS_OK;
 
-    if (!ValidateGLSLIdentifier(name, "getAttribLocation"))
+    if (!ValidateGLSLVariableName(name, "getAttribLocation"))
         return NS_OK; 
 
     MakeContextCurrent();
     *retval = gl->fGetAttribLocation(progname, NS_LossyConvertUTF16toASCII(name).get());
     return NS_OK;
 }
 
 NS_IMETHODIMP
@@ -2666,17 +2688,17 @@ WebGLContext::GetUniformLocation(nsIWebG
 {
     *retval = nsnull;
 
     WebGLuint progname;
     WebGLProgram *prog;
     if (!GetConcreteObjectAndGLName("getUniformLocation: program", pobj, &prog, &progname))
         return NS_OK;
 
-    if (!ValidateGLSLIdentifier(name, "getUniformLocation"))
+    if (!ValidateGLSLVariableName(name, "getUniformLocation"))
         return NS_OK; 
 
     MakeContextCurrent();
 
     GLint intlocation = gl->fGetUniformLocation(progname, NS_LossyConvertUTF16toASCII(name).get());
 
     nsRefPtr<nsIWebGLUniformLocation> loc = prog->GetUniformLocationObject(intlocation);
     *retval = loc.forget().get();
@@ -3579,29 +3601,23 @@ WebGLContext::DOMElementToImageSurface(n
     // To prevent a loophole where a Canvas2D would be used as a proxy to load
     // cross-domain textures, we also disallow loading textures from write-only
     // Canvas2D's.
 
     // part 1: check that the DOM element is same-origin, or has otherwise been
     // validated for cross-domain use.
     // if res.mPrincipal == null, no need for the origin check. See DoDrawImageSecurityCheck.
     // this case happens in the mochitest for images served from mochi.test:8888
-    if (res.mPrincipal) {
+    if (res.mPrincipal && !res.mCORSUsed) {
         PRBool subsumes;
         nsresult rv = HTMLCanvasElement()->NodePrincipal()->Subsumes(res.mPrincipal, &subsumes);
         if (NS_FAILED(rv) || !subsumes) {
-            PRInt32 corsmode;
-            if (!res.mImageRequest || NS_FAILED(res.mImageRequest->GetCORSMode(&corsmode))) {
-                corsmode = imgIRequest::CORS_NONE;
-            }
-            if (corsmode == imgIRequest::CORS_NONE) {
-                LogMessageIfVerbose("It is forbidden to load a WebGL texture from a cross-domain element that has not been validated with CORS. "
-                                    "See https://developer.mozilla.org/en/WebGL/Cross-Domain_Textures");
-                return NS_ERROR_DOM_SECURITY_ERR;
-            }
+            LogMessageIfVerbose("It is forbidden to load a WebGL texture from a cross-domain element that has not been validated with CORS. "
+                                "See https://developer.mozilla.org/en/WebGL/Cross-Domain_Textures");
+            return NS_ERROR_DOM_SECURITY_ERR;
         }
     }
 
     // part 2: if the DOM element is a canvas, check that it's not write-only. That would indicate a tainted canvas,
     // i.e. a canvas that could contain cross-domain image data.
     nsCOMPtr<nsIContent> maybeDOMCanvas = do_QueryInterface(imageOrCanvas);
     if (maybeDOMCanvas && maybeDOMCanvas->IsHTML(nsGkAtoms::canvas)) {
         nsHTMLCanvasElement *canvas = static_cast<nsHTMLCanvasElement*>(maybeDOMCanvas.get());
@@ -3971,18 +3987,35 @@ WebGLContext::CompileShader(nsIWebGLShad
         resources.MaxFragmentUniformVectors = mGLMaxFragmentUniformVectors;
         resources.MaxDrawBuffers = 1;
 
         compiler = ShConstructCompiler((ShShaderType) shader->ShaderType(),
                                        SH_WEBGL_SPEC,
                                        gl->IsGLES2() ? SH_ESSL_OUTPUT : SH_GLSL_OUTPUT,
                                        &resources);
 
-        nsPromiseFlatCString src(shader->Source());
-        const char *s = src.get();
+        // We're storing an actual instance of StripComments because, if we don't, the 
+        // cleanSource nsAString instance will be destroyed before the reference is
+        // actually used.
+        StripComments stripComments(shader->Source());
+        const nsAString& cleanSource = nsString(stripComments.result().Elements(), stripComments.length());
+        if (!ValidateGLSLString(cleanSource, "compileShader"))
+            return NS_OK;
+
+        const nsPromiseFlatString& flatSource = PromiseFlatString(cleanSource);
+
+        // shaderSource() already checks that the source stripped of comments is in the
+        // 7-bit ASCII range, so we can skip the NS_IsAscii() check.
+        const nsCString& sourceCString = NS_LossyConvertUTF16toASCII(flatSource);
+    
+        const PRUint32 maxSourceLength = (PRUint32(1)<<18) - 1;
+        if (sourceCString.Length() > maxSourceLength)
+            return ErrorInvalidValue("compileShader: source has more than %d characters", maxSourceLength);
+
+        const char *s = sourceCString.get();
 
         if (!ShCompile(compiler, &s, 1, SH_OBJECT_CODE)) {
             int len = 0;
             ShGetInfo(compiler, SH_INFO_LOG_LENGTH, &len);
 
             if (len) {
                 nsCAutoString info;
                 info.SetLength(len);
@@ -4013,25 +4046,20 @@ WebGLContext::CompileShader(nsIWebGLShad
             gl->fShaderSource(shadername, 1, &ts, NULL);
         } else {
             gl->fShaderSource(shadername, 1, &s, NULL);
         }
 
         shader->SetTranslationSuccess();
 
         ShDestruct(compiler);
-    } else
+
+        gl->fCompileShader(shadername);
+    }
 #endif
-    {
-        const char *s = nsDependentCString(shader->Source()).get();
-        gl->fShaderSource(shadername, 1, &s, NULL);
-        shader->SetTranslationSuccess();
-    }
-
-    gl->fCompileShader(shadername);
 
     return NS_OK;
 }
 
 
 NS_IMETHODIMP
 WebGLContext::GetShaderParameter(nsIWebGLShader *sobj, WebGLenum pname, nsIVariant **retval)
 {
@@ -4120,41 +4148,38 @@ WebGLContext::GetShaderInfoLog(nsIWebGLS
 NS_IMETHODIMP
 WebGLContext::GetShaderSource(nsIWebGLShader *sobj, nsAString& retval)
 {
     WebGLShader *shader;
     WebGLuint shadername;
     if (!GetConcreteObjectAndGLName("getShaderSource: shader", sobj, &shader, &shadername))
         return NS_OK;
 
-    CopyASCIItoUTF16(shader->Source(), retval);
+    retval.Assign(shader->Source());
 
     return NS_OK;
 }
 
 NS_IMETHODIMP
 WebGLContext::ShaderSource(nsIWebGLShader *sobj, const nsAString& source)
 {
     WebGLShader *shader;
     WebGLuint shadername;
     if (!GetConcreteObjectAndGLName("shaderSource: shader", sobj, &shader, &shadername))
         return NS_OK;
-    
-    const nsPromiseFlatString& flatSource = PromiseFlatString(source);
-
-    if (!NS_IsAscii(flatSource.get()))
-        return ErrorInvalidValue("shaderSource: non-ascii characters found in source");
-
-    const nsCString& sourceCString = NS_LossyConvertUTF16toASCII(flatSource);
-    
-    const PRUint32 maxSourceLength = (PRUint32(1)<<18) - 1;
-    if (sourceCString.Length() > maxSourceLength)
-        return ErrorInvalidValue("shaderSource: source has more than %d characters", maxSourceLength);
-    
-    shader->SetSource(sourceCString);
+
+    // We're storing an actual instance of StripComments because, if we don't, the 
+    // cleanSource nsAString instance will be destroyed before the reference is
+    // actually used.
+    StripComments stripComments(source);
+    const nsAString& cleanSource = nsString(stripComments.result().Elements(), stripComments.length());
+    if (!ValidateGLSLString(cleanSource, "compileShader"))
+        return NS_OK;
+
+    shader->SetSource(source);
 
     shader->SetNeedsTranslation();
 
     return NS_OK;
 }
 
 NS_IMETHODIMP
 WebGLContext::VertexAttribPointer(WebGLuint index, WebGLint size, WebGLenum type,
--- a/content/canvas/src/WebGLContextValidate.cpp
+++ b/content/canvas/src/WebGLContextValidate.cpp
@@ -323,24 +323,41 @@ PRBool WebGLContext::ValidateDrawModeEnu
         case LOCAL_GL_LINES:
             return PR_TRUE;
         default:
             ErrorInvalidEnumInfo(info, mode);
             return PR_FALSE;
     }
 }
 
-bool WebGLContext::ValidateGLSLIdentifier(const nsAString& name, const char *info)
+bool WebGLContext::ValidateGLSLVariableName(const nsAString& name, const char *info)
 {
-    const PRUint32 maxSize = 4095;
+    const PRUint32 maxSize = 255;
     if (name.Length() > maxSize) {
         ErrorInvalidValue("%s: identifier is %d characters long, exceeds the maximum allowed length of %d characters",
                           info, name.Length(), maxSize);
         return false;
     }
+
+    if (!ValidateGLSLString(name, info)) {
+        return false;
+    }
+
+    return true;
+}
+
+bool WebGLContext::ValidateGLSLString(const nsAString& string, const char *info)
+{
+    for (PRUint32 i = 0; i < string.Length(); ++i) {
+        if (!ValidateGLSLCharacter(string.CharAt(i))) {
+             ErrorInvalidValue("%s: string contains the illegal character '%d'", info, string.CharAt(i));
+             return false;
+        }
+    }
+
     return true;
 }
 
 PRUint32 WebGLContext::GetTexelSize(WebGLenum format, WebGLenum type)
 {
     if (type == LOCAL_GL_UNSIGNED_BYTE || type == LOCAL_GL_FLOAT) {
         int multiplier = type == LOCAL_GL_FLOAT ? 4 : 1;
         switch (format) {
new file mode 100644
--- /dev/null
+++ b/content/canvas/src/WebGLValidateStrings.h
@@ -0,0 +1,251 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Mozilla Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WEBGLVALIDATESTRINGS_H_
+#define WEBGLVALIDATESTRINGS_H_
+
+#include "WebGLContext.h"
+
+namespace mozilla {
+
+// The following code was taken from the WebKit WebGL implementation,
+// which can be found here:
+// http://trac.webkit.org/browser/trunk/Source/WebCore/html/canvas/WebGLRenderingContext.cpp?rev=93625#L121
+// Note that some modifications were done to adapt it to Mozilla.
+/****** BEGIN CODE TAKEN FROM WEBKIT ******/
+    bool WebGLContext::ValidateGLSLCharacter(PRUnichar c)
+    {
+        // Printing characters are valid except " $ ` @ \ ' DEL.
+        if (c >= 32 && c <= 126 &&
+            c != '"' && c != '$' && c != '`' && c != '@' && c != '\\' && c != '\'')
+        {
+             return true;
+        }
+
+        // Horizontal tab, line feed, vertical tab, form feed, carriage return are also valid.
+        if (c >= 9 && c <= 13) {
+             return true;
+        }
+
+        return false;
+    }
+
+    // Strips comments from shader text. This allows non-ASCII characters
+    // to be used in comments without potentially breaking OpenGL
+    // implementations not expecting characters outside the GLSL ES set.
+    class StripComments {
+    public:
+        StripComments(const nsAString& str)
+            : m_parseState(BeginningOfLine)
+            , m_end(str.EndReading())
+            , m_current(str.BeginReading())
+            , m_position(0)
+        {
+            m_result.SetLength(str.Length());
+            parse();
+        }
+
+        const nsTArray<PRUnichar>& result()
+        {
+            return m_result;
+        }
+
+        size_t length()
+        {
+            return m_position;
+        }
+
+    private:
+        bool hasMoreCharacters()
+        {
+            return (m_current < m_end);
+        }
+
+        void parse()
+        {
+            while (hasMoreCharacters()) {
+                process(current());
+                // process() might advance the position.
+                if (hasMoreCharacters())
+                    advance();
+            }
+        }
+
+        void process(PRUnichar);
+
+        bool peek(PRUnichar& character)
+        {
+            if (m_current + 1 >= m_end)
+                return false;
+            character = *(m_current + 1);
+            return true;
+        }
+
+        PRUnichar current()
+        {
+            //ASSERT(m_position < m_length);
+            return *m_current;
+        }
+
+        void advance()
+        {
+            ++m_current;
+        }
+
+        bool isNewline(PRUnichar character)
+        {
+            // Don't attempt to canonicalize newline related characters.
+            return (character == '\n' || character == '\r');
+        }
+
+        void emit(PRUnichar character)
+        {
+            m_result[m_position++] = character;
+        }
+
+        enum ParseState {
+            // Have not seen an ASCII non-whitespace character yet on
+            // this line. Possible that we might see a preprocessor
+            // directive.
+            BeginningOfLine,
+
+            // Have seen at least one ASCII non-whitespace character
+            // on this line.
+            MiddleOfLine,
+
+            // Handling a preprocessor directive. Passes through all
+            // characters up to the end of the line. Disables comment
+            // processing.
+            InPreprocessorDirective,
+
+            // Handling a single-line comment. The comment text is
+            // replaced with a single space.
+            InSingleLineComment,
+
+            // Handling a multi-line comment. Newlines are passed
+            // through to preserve line numbers.
+            InMultiLineComment
+        };
+
+        ParseState m_parseState;
+        const PRUnichar* m_end;
+        const PRUnichar* m_current;
+        size_t m_position;
+        nsTArray<PRUnichar> m_result;
+    };
+
+    void StripComments::process(PRUnichar c)
+    {
+        if (isNewline(c)) {
+            // No matter what state we are in, pass through newlines
+            // so we preserve line numbers.
+            emit(c);
+
+            if (m_parseState != InMultiLineComment)
+                m_parseState = BeginningOfLine;
+
+            return;
+        }
+
+        PRUnichar temp = 0;
+        switch (m_parseState) {
+        case BeginningOfLine:
+            // If it's an ASCII space.
+            if (c <= ' ' && (c == ' ' || (c <= 0xD && c >= 0x9))) {
+                emit(c);
+                break;
+            }
+
+            if (c == '#') {
+                m_parseState = InPreprocessorDirective;
+                emit(c);
+                break;
+            }
+
+            // Transition to normal state and re-handle character.
+            m_parseState = MiddleOfLine;
+            process(c);
+            break;
+
+        case MiddleOfLine:
+            if (c == '/' && peek(temp)) {
+                if (temp == '/') {
+                    m_parseState = InSingleLineComment;
+                    emit(' ');
+                    advance();
+                    break;
+                }
+
+                if (temp == '*') {
+                    m_parseState = InMultiLineComment;
+                    // Emit the comment start in case the user has
+                    // an unclosed comment and we want to later
+                    // signal an error.
+                    emit('/');
+                    emit('*');
+                    advance();
+                    break;
+                }
+            }
+
+            emit(c);
+            break;
+
+        case InPreprocessorDirective:
+            // No matter what the character is, just pass it
+            // through. Do not parse comments in this state. This
+            // might not be the right thing to do long term, but it
+            // should handle the #error preprocessor directive.
+            emit(c);
+            break;
+
+        case InSingleLineComment:
+            // The newline code at the top of this function takes care
+            // of resetting our state when we get out of the
+            // single-line comment. Swallow all other characters.
+            break;
+
+        case InMultiLineComment:
+            if (c == '*' && peek(temp) && temp == '/') {
+                emit('*');
+                emit('/');
+                m_parseState = MiddleOfLine;
+                advance();
+                break;
+            }
+
+            // Swallow all other characters. Unclear whether we may
+            // want or need to just emit a space per character to try
+            // to preserve column numbers for debugging purposes.
+            break;
+        }
+    }
+
+/****** END CODE TAKEN FROM WEBKIT ******/
+
+} // end namespace mozilla
+
+#endif // WEBGLVALIDATESTRINGS_H_
--- a/content/canvas/src/nsCanvasRenderingContext2D.cpp
+++ b/content/canvas/src/nsCanvasRenderingContext2D.cpp
@@ -241,36 +241,40 @@ NS_INTERFACE_MAP_END
     { 0xb85c6c8a, 0x0624, 0x4530, { 0xb8, 0xee, 0xff, 0xdf, 0x42, 0xe8, 0x21, 0x6d } }
 class nsCanvasPattern : public nsIDOMCanvasPattern
 {
 public:
     NS_DECLARE_STATIC_IID_ACCESSOR(NS_CANVASPATTERN_PRIVATE_IID)
 
     nsCanvasPattern(gfxPattern* pat,
                     nsIPrincipal* principalForSecurityCheck,
-                    PRBool forceWriteOnly)
+                    PRBool forceWriteOnly,
+                    PRBool CORSUsed)
         : mPattern(pat),
           mPrincipal(principalForSecurityCheck),
-          mForceWriteOnly(forceWriteOnly)
+          mForceWriteOnly(forceWriteOnly),
+          mCORSUsed(CORSUsed)
     {
     }
 
-    gfxPattern* GetPattern() {
+    gfxPattern* GetPattern() const {
         return mPattern;
     }
 
-    nsIPrincipal* Principal() { return mPrincipal; }
-    PRBool GetForceWriteOnly() { return mForceWriteOnly; }
+    nsIPrincipal* Principal() const { return mPrincipal; }
+    PRBool GetForceWriteOnly() const { return mForceWriteOnly; }
+    PRBool GetCORSUsed() const { return mCORSUsed; }
 
     NS_DECL_ISUPPORTS
 
 protected:
     nsRefPtr<gfxPattern> mPattern;
     nsCOMPtr<nsIPrincipal> mPrincipal;
-    PRPackedBool mForceWriteOnly;
+    const PRPackedBool mForceWriteOnly;
+    const PRPackedBool mCORSUsed;
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsCanvasPattern, NS_CANVASPATTERN_PRIVATE_IID)
 
 NS_IMPL_ADDREF(nsCanvasPattern)
 NS_IMPL_RELEASE(nsCanvasPattern)
 
 DOMCI_DATA(CanvasPattern, nsCanvasPattern)
@@ -989,17 +993,18 @@ nsCanvasRenderingContext2D::ApplyStyle(S
         mDirtyStyle[aWhichStyle] = PR_FALSE;
     mLastStyle = aWhichStyle;
 
     nsCanvasPattern* pattern = CurrentState().patternStyles[aWhichStyle];
     if (pattern) {
         if (mCanvasElement)
             CanvasUtils::DoDrawImageSecurityCheck(HTMLCanvasElement(),
                                                   pattern->Principal(),
-                                                  pattern->GetForceWriteOnly());
+                                                  pattern->GetForceWriteOnly(),
+                                                  pattern->GetCORSUsed());
 
         gfxPattern* gpat = pattern->GetPattern();
 
         if (CurrentState().imageSmoothingEnabled)
             gpat->SetFilter(gfxPattern::FILTER_GOOD);
         else
             gpat->SetFilter(gfxPattern::FILTER_NEAREST);
 
@@ -1837,17 +1842,18 @@ nsCanvasRenderingContext2D::CreatePatter
     if (!res.mSurface)
         return NS_ERROR_NOT_AVAILABLE;
 
     nsRefPtr<gfxPattern> thebespat = new gfxPattern(res.mSurface);
 
     thebespat->SetExtend(extend);
 
     nsRefPtr<nsCanvasPattern> pat = new nsCanvasPattern(thebespat, res.mPrincipal,
-                                                        res.mIsWriteOnly);
+                                                        res.mIsWriteOnly,
+                                                        res.mCORSUsed);
     if (!pat)
         return NS_ERROR_OUT_OF_MEMORY;
 
     *_retval = pat.forget().get();
     return NS_OK;
 }
 
 //
@@ -3433,17 +3439,19 @@ nsCanvasRenderingContext2D::DrawImage(ns
                 return NS_ERROR_NOT_AVAILABLE;
         }
 
         imgsurf = res.mSurface.forget();
         imgSize = res.mSize;
 
         if (mCanvasElement) {
             CanvasUtils::DoDrawImageSecurityCheck(HTMLCanvasElement(),
-                                                  res.mPrincipal, res.mIsWriteOnly);
+                                                  res.mPrincipal,
+                                                  res.mIsWriteOnly,
+                                                  res.mCORSUsed);
         }
 
         if (res.mImageRequest) {
             CanvasImageCache::NotifyDrawImage(imgElt, HTMLCanvasElement(),
                                               res.mImageRequest, imgsurf, imgSize);
         }
     }
 
--- a/content/canvas/src/nsCanvasRenderingContext2DAzure.cpp
+++ b/content/canvas/src/nsCanvasRenderingContext2DAzure.cpp
@@ -301,30 +301,33 @@ public:
     REPEATX,
     REPEATY,
     NOREPEAT
   };
 
   nsCanvasPatternAzure(SourceSurface* aSurface,
                        RepeatMode aRepeat,
                        nsIPrincipal* principalForSecurityCheck,
-                       PRBool forceWriteOnly)
+                       PRBool forceWriteOnly,
+                       PRBool CORSUsed)
     : mSurface(aSurface)
     , mRepeat(aRepeat)
     , mPrincipal(principalForSecurityCheck)
     , mForceWriteOnly(forceWriteOnly)
+    , mCORSUsed(CORSUsed)
   {
   }
 
   NS_DECL_ISUPPORTS
 
   RefPtr<SourceSurface> mSurface;
-  RepeatMode mRepeat;
+  const RepeatMode mRepeat;
   nsCOMPtr<nsIPrincipal> mPrincipal;
-  PRPackedBool mForceWriteOnly;
+  const PRPackedBool mForceWriteOnly;
+  const PRPackedBool mCORSUsed;
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsCanvasPatternAzure, NS_CANVASPATTERNAZURE_PRIVATE_IID)
 
 NS_IMPL_ADDREF(nsCanvasPatternAzure)
 NS_IMPL_RELEASE(nsCanvasPatternAzure)
 
 // XXX
@@ -793,17 +796,18 @@ protected:
 
         mPattern = new (mRadialGradientPattern.addr())
           RadialGradientPattern(gradient->mCenter1, gradient->mCenter2, gradient->mRadius1,
                                 gradient->mRadius2, gradient->GetGradientStopsForTarget(aRT));
       } else if (state.patternStyles[aStyle]) {
         if (aCtx->mCanvasElement) {
           CanvasUtils::DoDrawImageSecurityCheck(aCtx->HTMLCanvasElement(),
                                                 state.patternStyles[aStyle]->mPrincipal,
-                                                state.patternStyles[aStyle]->mForceWriteOnly);
+                                                state.patternStyles[aStyle]->mForceWriteOnly,
+                                                state.patternStyles[aStyle]->mCORSUsed);
         }
 
         ExtendMode mode;
         if (state.patternStyles[aStyle]->mRepeat == nsCanvasPatternAzure::NOREPEAT) {
           mode = EXTEND_CLAMP;
         } else {
           mode = EXTEND_WRAP;
         }
@@ -1907,27 +1911,26 @@ nsCanvasRenderingContext2DAzure::CreateP
   if (canvas) {
     nsIntSize size = canvas->GetSize();
     if (size.width == 0 || size.height == 0) {
       return NS_ERROR_DOM_INVALID_STATE_ERR;
     }
   }
 
   // Special case for Canvas, which could be an Azure canvas!
-  nsCOMPtr<nsINode> node = do_QueryInterface(image);
-  if (canvas && node) {
+  if (canvas) {
     if (canvas->CountContexts() == 1) {
       nsICanvasRenderingContextInternal *srcCanvas = canvas->GetContextAtIndex(0);
 
       // This might not be an Azure canvas!
       if (srcCanvas) {
         RefPtr<SourceSurface> srcSurf = srcCanvas->GetSurfaceSnapshot();
 
         nsRefPtr<nsCanvasPatternAzure> pat =
-          new nsCanvasPatternAzure(srcSurf, repeatMode, node->NodePrincipal(), canvas->IsWriteOnly());
+          new nsCanvasPatternAzure(srcSurf, repeatMode, content->NodePrincipal(), canvas->IsWriteOnly(), PR_FALSE);
 
         *_retval = pat.forget().get();
         return NS_OK;
       }
     }
   }
 
   // The canvas spec says that createPattern should use the first frame
@@ -1944,17 +1947,18 @@ nsCanvasRenderingContext2DAzure::CreateP
   if (!res.mSurface->CairoSurface()) {
     return NS_OK;
   }
 
   RefPtr<SourceSurface> srcSurf =
     gfxPlatform::GetPlatform()->GetSourceSurfaceForSurface(mTarget, res.mSurface);
 
   nsRefPtr<nsCanvasPatternAzure> pat =
-    new nsCanvasPatternAzure(srcSurf, repeatMode, res.mPrincipal, res.mIsWriteOnly);
+    new nsCanvasPatternAzure(srcSurf, repeatMode, res.mPrincipal,
+                             res.mIsWriteOnly, res.mCORSUsed);
 
   *_retval = pat.forget().get();
   return NS_OK;
 }
 
 //
 // shadows
 //
@@ -3695,17 +3699,18 @@ nsCanvasRenderingContext2DAzure::DrawIma
       return NS_OK;
     }
 
     imgsurf = res.mSurface.forget();
     imgSize = res.mSize;
 
     if (mCanvasElement) {
       CanvasUtils::DoDrawImageSecurityCheck(HTMLCanvasElement(),
-                                            res.mPrincipal, res.mIsWriteOnly);
+                                            res.mPrincipal, res.mIsWriteOnly,
+                                            res.mCORSUsed);
     }
 
     if (res.mImageRequest) {
       CanvasImageCache::NotifyDrawImage(imgElt, HTMLCanvasElement(),
                                         res.mImageRequest, imgsurf, imgSize);
     }
 
     srcSurf = gfxPlatform::GetPlatform()->GetSourceSurfaceForSurface(mTarget, imgsurf);
--- a/content/canvas/test/Makefile.in
+++ b/content/canvas/test/Makefile.in
@@ -36,17 +36,17 @@
 #
 # ***** END LICENSE BLOCK *****
 
 DEPTH		= ../../..
 topsrcdir	= @top_srcdir@
 srcdir		= @srcdir@
 VPATH		= @srcdir@
 relativesrcdir  = content/canvas/test
-DIRS		+= webgl
+DIRS		+= webgl crossorigin
 
 include $(DEPTH)/config/autoconf.mk
 include $(topsrcdir)/config/rules.mk
 _TEST_FILES_0 = \
 	test_canvas.html \
 	image_transparent50.png \
 	image_redtransparent.png \
 	image_yellow.png \
new file mode 100644
--- /dev/null
+++ b/content/canvas/test/crossorigin/Makefile.in
@@ -0,0 +1,57 @@
+#
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is mozilla.org code.
+#
+# The Initial Developer of the Original Code is
+# Mozilla Corporation.
+# Portions created by the Initial Developer are Copyright (C) 2010
+# the Initial Developer. All Rights Reserved.
+#
+# Contributor(s):
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either of the GNU General Public License Version 2 or later (the "GPL"),
+# or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+
+DEPTH		= ../../../..
+topsrcdir	= @top_srcdir@
+srcdir		= @srcdir@
+VPATH		= @srcdir@
+relativesrcdir  = content/canvas/test/crossorigin
+
+include $(DEPTH)/config/autoconf.mk
+include $(topsrcdir)/config/rules.mk
+_TEST_FILES = \
+	image-allow-credentials.png \
+	image-allow-credentials.png^headers^ \
+	image-allow-star.png \
+	image-allow-star.png^headers^ \
+	image.png \
+	test_canvas2d_crossorigin.html \
+	test_webgl_crossorigin_textures.html \
+	$(NULL)
+
+libs:: $(_TEST_FILES)
+	$(INSTALL) $(foreach f,$^,"$f") $(DEPTH)/_tests/testing/mochitest/tests/$(relativesrcdir)
rename from content/canvas/test/webgl/crossorigin/image-allow-credentials.png
rename to content/canvas/test/crossorigin/image-allow-credentials.png
rename from content/canvas/test/webgl/crossorigin/image-allow-credentials.png^headers^
rename to content/canvas/test/crossorigin/image-allow-credentials.png^headers^
rename from content/canvas/test/webgl/crossorigin/image-allow-star.png
rename to content/canvas/test/crossorigin/image-allow-star.png
rename from content/canvas/test/webgl/crossorigin/image-allow-star.png^headers^
rename to content/canvas/test/crossorigin/image-allow-star.png^headers^
rename from content/canvas/test/webgl/crossorigin/image.png
rename to content/canvas/test/crossorigin/image.png
new file mode 100644
--- /dev/null
+++ b/content/canvas/test/crossorigin/test_canvas2d_crossorigin.html
@@ -0,0 +1,197 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=685518
+-->
+<head>
+  <title>Test for Bug 685518</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=685518">Mozilla Bug 685518</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 685518 **/
+
+SimpleTest.waitForExplicitFinish();
+
+const SECURITY_ERR = 0x805303e8;
+const BAD_URI_ERR = 0x805303f4;
+const OK = 0;
+
+function nameForErrorCode(code) {
+  switch(code) {
+    case OK: return "no error";
+    case SECURITY_ERR: return "security error";
+    case BAD_URI_ERR: return "bad URI error"
+  }
+  return "unexpected error (" + code + ")";
+}
+
+function verifyError(actual_error, expected_error, message) {
+  ok(actual_error == expected_error,
+     message + ": expected " + nameForErrorCode(expected_error)
+             + ", got " + nameForErrorCode(actual_error));
+}
+
+var number_of_tests_live = 0;
+
+function testDone() {
+  number_of_tests_live--;
+        
+  if (number_of_tests_live == 0)
+    SimpleTest.finish();
+}
+
+function testImage(url, crossOriginAttribute, expected_result) {
+  ++number_of_tests_live;
+  var image;
+  if (crossOriginAttribute == "just-crossOrigin-without-value") {
+    var div = document.createElement('div');
+    div.innerHTML="<img crossOrigin>";
+    image = div.children[0];
+  }
+  else {
+    image = new Image();
+    if (crossOriginAttribute != "missing-value-default") {
+      image.crossOrigin = crossOriginAttribute;
+    }
+  }
+
+  image.onload = function() {
+    var c = document.createElement("canvas");
+    c.width = this.width;
+    c.height = this.height;
+    var ctx = c.getContext("2d");
+    ctx.drawImage(this, 0, 0);
+
+    var data;
+    var actual_result;
+    try {
+      data = ctx.getImageData(0, 0, 1, 1);
+      actual_result = OK;
+    } catch (e) {
+      actual_result = e.result;
+    }
+
+    verifyError(actual_result, expected_result,
+                "drawImage then get image data on " + url +
+                " with crossOrigin=" + this.crossOrigin);
+
+    // Now test patterns
+    c = document.createElement("canvas");
+    c.width = this.width;
+    c.height = this.height;
+    ctx = c.getContext("2d");
+    ctx.fillStyle = ctx.createPattern(this, "");
+    ctx.fillRect(0, 0, c.width, c.height);
+    try {
+      data = ctx.getImageData(0, 0, 1, 1);
+      actual_result = OK;
+    } catch (e) {
+      actual_result = e.result;
+    }
+
+    verifyError(actual_result, expected_result,
+                "createPattern+fill then get image data on " + url +
+                " with crossOrigin=" + this.crossOrigin);
+
+    testDone();
+  };
+
+  image.onerror = function(event) {
+    verifyError(BAD_URI_ERR, expected_result,
+                "image error handler for " + url +
+                " with crossOrigin=" + this.crossOrigin);
+
+    testDone();
+  }
+
+  image.src = url;
+}
+
+// Now kick off the tests.
+const testPath = "/tests/content/canvas/test/crossorigin/"
+
+// First column is image file, second column is what CORS headers the server sends
+const imageFiles = [
+ [ "image.png", "none" ],
+ [ "image-allow-star.png", "allow-all-anon" ],
+ [ "image-allow-credentials.png", "allow-single-server-creds" ]
+];
+
+const hostnames = [
+  [ "mochi.test:8888", "same-origin" ],
+  [ "example.com", "cross-origin" ]
+];
+
+// First column is the value; second column is the expected resulting CORS mode
+const attrValues = [
+  [ "missing-value-default", "none" ],
+  [ "", "anonymous" ],
+  [ "just-crossOrigin-without-value", "anonymous" ],
+  [ "anonymous", "anonymous" ],
+  [ "use-credentials", "use-credentials" ],
+  [ "foobar", "anonymous" ]
+];
+
+for (var imgIdx = 0; imgIdx < imageFiles.length; ++imgIdx) {
+  for (var hostnameIdx = 0; hostnameIdx < hostnames.length; ++hostnameIdx) {
+    var hostnameData = hostnames[hostnameIdx];
+    var url = "http://" + hostnameData[0] + testPath + imageFiles[imgIdx][0];
+    for (var attrValIdx = 0; attrValIdx < attrValues.length; ++attrValIdx) {
+      var attrValData = attrValues[attrValIdx];
+      // Now compute the expected result
+      var expected_result;
+      if (hostnameData[1] == "same-origin") {
+        // Same-origin; these should all Just Work
+        expected_result = OK;
+      } else {
+        // Cross-origin
+        is(hostnameData[1], "cross-origin",
+           "what sort of host is " + hostnameData[0]);
+        var CORSMode = attrValData[1];
+        if (CORSMode == "none") {
+          // Doesn't matter what headers the server sends; we're not
+          // using CORS on our end.
+          expected_result = SECURITY_ERR;
+        } else {
+          // Check whether the server will let us talk to them
+          var CORSHeaders = imageFiles[imgIdx][1];
+          // We're going to look for CORS headers from the server
+          if (CORSHeaders == "none") {
+            // No CORS headers from server; load will fail.
+            expected_result = BAD_URI_ERR;
+          } else if (CORSHeaders == "allow-all-anon") {
+            // Server only allows anonymous requests
+            if (CORSMode == "anonymous") {
+              expected_result = OK;
+            } else {
+              is(CORSMode, "use-credentials",
+                 "What other CORS modes are there?");
+              // A load with credentials against a server that only
+              // allows anonymous loads will fail.
+              expected_result = BAD_URI_ERR;
+            }
+          } else {
+            is(CORSHeaders, "allow-single-server-creds",
+               "What other CORS headers could there be?");
+            // Our server should allow both anonymous and non-anonymous requests
+            expected_result = OK;
+          }
+        }
+      }
+      testImage(url, attrValData[0], expected_result);
+    }
+  }
+}
+</script>
+</pre>
+</body>
+</html>
rename from content/canvas/test/webgl/crossorigin/test_webgl_crossorigin_textures.html
rename to content/canvas/test/crossorigin/test_webgl_crossorigin_textures.html
--- a/content/canvas/test/webgl/crossorigin/test_webgl_crossorigin_textures.html
+++ b/content/canvas/test/crossorigin/test_webgl_crossorigin_textures.html
@@ -79,76 +79,76 @@
     try {
       gl = canvas.getContext("experimental-webgl");
     } catch (e) {
       SimpleTest.finish();
       return;
     }
 
 
-    testTexture("http://mochi.test:8888/tests/content/canvas/test/webgl/crossorigin/image.png",
+    testTexture("http://mochi.test:8888/tests/content/canvas/test/crossorigin/image.png",
                 "missing-value-default",
                 OK);
-    testTexture("http://mochi.test:8888/tests/content/canvas/test/webgl/crossorigin/image.png",
+    testTexture("http://mochi.test:8888/tests/content/canvas/test/crossorigin/image.png",
                 "",
                 OK);
-    testTexture("http://mochi.test:8888/tests/content/canvas/test/webgl/crossorigin/image.png",
+    testTexture("http://mochi.test:8888/tests/content/canvas/test/crossorigin/image.png",
                 "just-crossOrigin-without-value",
                 OK);
-    testTexture("http://example.com/tests/content/canvas/test/webgl/crossorigin/image.png",
+    testTexture("http://example.com/tests/content/canvas/test/crossorigin/image.png",
                 "missing-value-default",
                 SECURITY_ERR);
-    testTexture("http://example.com/tests/content/canvas/test/webgl/crossorigin/image.png",
+    testTexture("http://example.com/tests/content/canvas/test/crossorigin/image.png",
                 "",
                 SECURITY_ERR);
-    testTexture("http://example.com/tests/content/canvas/test/webgl/crossorigin/image.png",
+    testTexture("http://example.com/tests/content/canvas/test/crossorigin/image.png",
                 "just-crossOrigin-without-value",
                 SECURITY_ERR);
 
-    testTexture("http://example.com/tests/content/canvas/test/webgl/crossorigin/image-allow-star.png",
+    testTexture("http://example.com/tests/content/canvas/test/crossorigin/image-allow-star.png",
                 "missing-value-default",
                 SECURITY_ERR);
-    testTexture("http://example.com/tests/content/canvas/test/webgl/crossorigin/image-allow-star.png",
+    testTexture("http://example.com/tests/content/canvas/test/crossorigin/image-allow-star.png",
                 "",
                 OK);
-    testTexture("http://example.com/tests/content/canvas/test/webgl/crossorigin/image-allow-star.png",
+    testTexture("http://example.com/tests/content/canvas/test/crossorigin/image-allow-star.png",
                 "just-crossOrigin-without-value",
                 OK);
-    testTexture("http://example.com/tests/content/canvas/test/webgl/crossorigin/image-allow-star.png",
+    testTexture("http://example.com/tests/content/canvas/test/crossorigin/image-allow-star.png",
                 "anonymous",
                 OK);
-    testTexture("http://example.com/tests/content/canvas/test/webgl/crossorigin/image-allow-star.png",
+    testTexture("http://example.com/tests/content/canvas/test/crossorigin/image-allow-star.png",
                 "use-credentials",
                 SECURITY_ERR);
 
-    testTexture("http://example.com/tests/content/canvas/test/webgl/crossorigin/image-allow-credentials.png",
+    testTexture("http://example.com/tests/content/canvas/test/crossorigin/image-allow-credentials.png",
                 "missing-value-default",
                 SECURITY_ERR);
-    testTexture("http://example.com/tests/content/canvas/test/webgl/crossorigin/image-allow-credentials.png",
+    testTexture("http://example.com/tests/content/canvas/test/crossorigin/image-allow-credentials.png",
                 "",
                 OK);
-    testTexture("http://example.com/tests/content/canvas/test/webgl/crossorigin/image-allow-credentials.png",
+    testTexture("http://example.com/tests/content/canvas/test/crossorigin/image-allow-credentials.png",
                 "just-crossOrigin-without-value",
                 OK);
-    testTexture("http://example.com/tests/content/canvas/test/webgl/crossorigin/image-allow-credentials.png",
+    testTexture("http://example.com/tests/content/canvas/test/crossorigin/image-allow-credentials.png",
                 "anonymous",
                 OK);
-    testTexture("http://example.com/tests/content/canvas/test/webgl/crossorigin/image-allow-credentials.png",
+    testTexture("http://example.com/tests/content/canvas/test/crossorigin/image-allow-credentials.png",
                 "use-credentials",
                 OK);
 
     // Test that bad values for crossorigin="..." are interpreted as invalid-value-default which is "anonymous".
-    testTexture("http://mochi.test:8888/tests/content/canvas/test/webgl/crossorigin/image.png",
+    testTexture("http://mochi.test:8888/tests/content/canvas/test/crossorigin/image.png",
                 "foobar",
                 OK);
-    testTexture("http://example.com/tests/content/canvas/test/webgl/crossorigin/image.png",
+    testTexture("http://example.com/tests/content/canvas/test/crossorigin/image.png",
                 "foobar",
                 SECURITY_ERR);
-    testTexture("http://example.com/tests/content/canvas/test/webgl/crossorigin/image-allow-star.png",
+    testTexture("http://example.com/tests/content/canvas/test/crossorigin/image-allow-star.png",
                 "foobar",
                 OK);
-    testTexture("http://example.com/tests/content/canvas/test/webgl/crossorigin/image-allow-credentials.png",
+    testTexture("http://example.com/tests/content/canvas/test/crossorigin/image-allow-credentials.png",
                 "foobar",
                 OK);
 
     all_tests_started = true;
   });
 </script>
--- a/content/canvas/test/test_mozGetAsFile.html
+++ b/content/canvas/test/test_mozGetAsFile.html
@@ -2,26 +2,30 @@
 <title>Canvas test: mozGetAsFile</title>
 <script src="/MochiKit/MochiKit.js"></script>
 <script src="/tests/SimpleTest/SimpleTest.js"></script>
 <link rel="stylesheet" href="/tests/SimpleTest/test.css">
 <body>
 <canvas id="c" width="100" height="50"><p class="fallback">FAIL (fallback content)</p></canvas>
 <script>
 
+var gCompares = 0;
+
 function compareAsync(file, canvas, type)
 {
-  SimpleTest.waitForExplicitFinish();
+  ++gCompares;
 
   var reader = new FileReader();
   reader.onload = 
     function(e) {
       is(e.target.result, canvas.toDataURL(type),
  "<canvas>.mozGetAsFile().getAsDataURL() should equal <canvas>.toDataURL()");
-      SimpleTest.finish();
+      if (--gCompares == 0) {
+        SimpleTest.finish();
+      }
     };
   reader.readAsDataURL(file);
 }
 
 SimpleTest.waitForExplicitFinish();
 addLoadEvent(function () {
 
 var canvas = document.getElementById('c');
@@ -35,14 +39,12 @@ compareAsync(pngfile, canvas, "image/png
 is(pngfile.name, "foo.png", "File name should be what we passed in");
 
 var jpegfile = canvas.mozGetAsFile("bar.jpg", "image/jpeg");
 is(jpegfile.type, "image/jpeg",
    "When a valid type is specified that should be returned");
 compareAsync(jpegfile, canvas, "image/jpeg");
 is(jpegfile.name, "bar.jpg", "File name should be what we passed in");
 
-SimpleTest.finish();
-
 });
 </script>
 <img src="image_yellow75.png" id="yellow75.png" class="resource">
 
--- a/content/canvas/test/webgl/Makefile.in
+++ b/content/canvas/test/webgl/Makefile.in
@@ -51,10 +51,9 @@ include $(topsrcdir)/config/rules.mk
   failing_tests_mac.txt \
   $(NULL)
 
 libs:: $(_TEST_FILES)
 	$(INSTALL) $(foreach f,$^,"$f") $(DEPTH)/_tests/testing/mochitest/tests/$(relativesrcdir)
 	$(TAR) -cf - -C $(srcdir) \
 	  resources \
 	  conformance \
-          crossorigin \
 	  | $(TAR) -xf - -C $(DEPTH)/_tests/testing/mochitest/tests/$(relativesrcdir)
--- a/content/canvas/test/webgl/failing_tests_linux.txt
+++ b/content/canvas/test/webgl/failing_tests_linux.txt
@@ -3,21 +3,19 @@ conformance/drawingbuffer-test.html
 conformance/framebuffer-object-attachment.html
 conformance/shaders/glsl-features/../../glsl-features.html?feature=abs-frag&reffs=shaders/glsl-features/abs-ref.frag&testfs=shaders/glsl-features/abs.frag
 conformance/shaders/glsl-features/../../glsl-features.html?feature=abs-vert-vec2&refvs=shaders/glsl-features/abs-vec2-ref.vert&testvs=shaders/glsl-features/abs-vec2.vert
 conformance/shaders/glsl-features/../../glsl-features.html?feature=abs-vert-vec3&refvs=shaders/glsl-features/abs-vec3-ref.vert&testvs=shaders/glsl-features/abs-vec3.vert
 conformance/shaders/glsl-features/../../glsl-features.html?feature=abs-vert-vec4&refvs=shaders/glsl-features/abs-vec4-ref.vert&testvs=shaders/glsl-features/abs-vec4.vert
 conformance/shaders/glsl-features/../../glsl-features.html?feature=sign-frag-vec4&reffs=shaders/glsl-features/sign-vec4-ref.frag&testfs=shaders/glsl-features/sign-vec4.frag
 conformance/shaders/glsl-features/../../glsl-features.html?feature=sign-vert-vec4&refvs=shaders/glsl-features/sign-vec4-ref.vert&testvs=shaders/glsl-features/sign-vec4.vert
 conformance/gl-get-active-attribute.html
-conformance/gl-getshadersource.html
 conformance/gl-uniform-bool.html
 conformance/glsl-conformance.html
 conformance/glsl-long-variable-names.html
-conformance/invalid-passed-params.html
 conformance/premultiplyalpha-test.html
 conformance/read-pixels-test.html
 conformance/uninitialized-test.html
 conformance/more/conformance/quickCheckAPI.html
 conformance/more/functions/copyTexImage2D.html
 conformance/more/functions/copyTexSubImage2D.html
 conformance/more/functions/deleteBufferBadArgs.html
 conformance/more/functions/uniformfArrayLen1.html
--- a/content/canvas/test/webgl/failing_tests_mac.txt
+++ b/content/canvas/test/webgl/failing_tests_mac.txt
@@ -1,17 +1,15 @@
 conformance/context-attributes-alpha-depth-stencil-antialias.html
 conformance/drawingbuffer-static-canvas-test.html
 conformance/drawingbuffer-test.html
 conformance/framebuffer-object-attachment.html
-conformance/gl-getshadersource.html
 conformance/gl-object-get-calls.html
 conformance/glsl-conformance.html
 conformance/glsl-long-variable-names.html
-conformance/invalid-passed-params.html
 conformance/premultiplyalpha-test.html
 conformance/program-test.html
 conformance/read-pixels-test.html
 conformance/tex-input-validation.html
 conformance/texture-npot.html
 conformance/more/conformance/quickCheckAPI.html
 conformance/more/functions/copyTexImage2D.html
 conformance/more/functions/copyTexSubImage2D.html
--- a/content/canvas/test/webgl/failing_tests_windows.txt
+++ b/content/canvas/test/webgl/failing_tests_windows.txt
@@ -1,14 +1,12 @@
 conformance/drawingbuffer-static-canvas-test.html
 conformance/drawingbuffer-test.html
 conformance/framebuffer-object-attachment.html
-conformance/gl-getshadersource.html
 conformance/glsl-conformance.html
 conformance/glsl-long-variable-names.html
-conformance/invalid-passed-params.html
 conformance/premultiplyalpha-test.html
 conformance/read-pixels-test.html
 conformance/more/conformance/quickCheckAPI.html
 conformance/more/functions/copyTexImage2D.html
 conformance/more/functions/copyTexSubImage2D.html
 conformance/more/functions/deleteBufferBadArgs.html
 conformance/more/functions/uniformfArrayLen1.html
--- a/content/events/src/nsEventStateManager.cpp
+++ b/content/events/src/nsEventStateManager.cpp
@@ -99,18 +99,16 @@
 #include "nsIDOMMouseScrollEvent.h"
 #include "nsIDOMDragEvent.h"
 #include "nsIDOMEventTarget.h"
 #include "nsIDOMUIEvent.h"
 #include "nsDOMDragEvent.h"
 #include "nsIDOMNSEditableElement.h"
 
 #include "nsCaret.h"
-#include "nsILookAndFeel.h"
-#include "nsWidgetsCID.h"
 
 #include "nsSubDocumentFrame.h"
 #include "nsIFrameTraversal.h"
 #include "nsLayoutCID.h"
 #include "nsLayoutUtils.h"
 #include "nsIInterfaceRequestorUtils.h"
 #include "nsUnicharUtils.h"
 #include "nsContentUtils.h"
@@ -133,32 +131,31 @@
 #endif
 #include "nsIController.h"
 #include "nsICommandParams.h"
 #include "mozilla/Services.h"
 #include "mozAutoDocUpdate.h"
 #include "nsHTMLLabelElement.h"
 
 #include "mozilla/Preferences.h"
+#include "mozilla/LookAndFeel.h"
 
 #ifdef XP_MACOSX
 #import <ApplicationServices/ApplicationServices.h>
 #endif
 
 using namespace mozilla;
 using namespace mozilla::dom;
 
 //#define DEBUG_DOCSHELL_FOCUS
 
 #define NS_USER_INTERACTION_INTERVAL 5000 // ms
 
 static NS_DEFINE_CID(kFrameTraversalCID, NS_FRAMETRAVERSAL_CID);
 
-static NS_DEFINE_CID(kLookAndFeelCID, NS_LOOKANDFEEL_CID);
-
 static PRBool sLeftClickOnly = PR_TRUE;
 static PRBool sKeyCausesActivation = PR_TRUE;
 static PRUint32 sESMInstanceCount = 0;
 static PRInt32 sChromeAccessModifier = 0, sContentAccessModifier = 0;
 PRInt32 nsEventStateManager::sUserInputEventDepth = 0;
 PRBool nsEventStateManager::sNormalLMouseEventInProcess = PR_FALSE;
 nsEventStateManager* nsEventStateManager::sActiveESM = nsnull;
 nsIDocument* nsEventStateManager::sMouseOverDocument = nsnull;
@@ -2045,19 +2042,20 @@ nsEventStateManager::GenerateDragGesture
       StopTrackingDragGesture();
       return;
     }
 
     static PRInt32 pixelThresholdX = 0;
     static PRInt32 pixelThresholdY = 0;
 
     if (!pixelThresholdX) {
-      nsILookAndFeel *lf = aPresContext->LookAndFeel();
-      lf->GetMetric(nsILookAndFeel::eMetric_DragThresholdX, pixelThresholdX);
-      lf->GetMetric(nsILookAndFeel::eMetric_DragThresholdY, pixelThresholdY);
+      pixelThresholdX =
+        LookAndFeel::GetInt(LookAndFeel::eIntID_DragThresholdX, 0);
+      pixelThresholdY =
+        LookAndFeel::GetInt(LookAndFeel::eIntID_DragThresholdY, 0);
       if (!pixelThresholdX)
         pixelThresholdX = 5;
       if (!pixelThresholdY)
         pixelThresholdY = 5;
     }
 
     // fire drag gesture if mouse has moved enough
     nsIntPoint pt = aEvent->refPoint + aEvent->widget->WidgetToScreenOffset();
new file mode 100644
--- /dev/null
+++ b/content/html/content/crashtests/682058.xhtml
@@ -0,0 +1,11 @@
+<?xml version="1.0"?>
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <body onload="test()">
+    <script>
+      function test() {
+        document.body.innerHTML = "Foobar";
+      }
+      document.addEventListener("DOMNodeRemoved", function() {});
+    </script>
+  </body>
+</html>
--- a/content/html/content/crashtests/crashtests.list
+++ b/content/html/content/crashtests/crashtests.list
@@ -24,9 +24,10 @@ load 604807.html
 load 605264.html
 load 606430-1.html
 load 602117.html
 load 613027.html
 load 614279.html
 load 614988-1.html
 load 620078-1.html
 load 620078-2.html
+load 682058.xhtml
 load 682460.html
--- a/content/html/content/src/nsGenericHTMLElement.cpp
+++ b/content/html/content/src/nsGenericHTMLElement.cpp
@@ -780,16 +780,21 @@ nsGenericHTMLElement::SetInnerHTML(const
     // HTML5 parser has notified, but not fired mutation events.
     FireMutationEventsForDirectParsing(doc, this, oldChildCount);
   } else {
     rv = nsContentUtils::CreateContextualFragment(this, aInnerHTML,
                                                   PR_TRUE,
                                                   getter_AddRefs(df));
     nsCOMPtr<nsINode> fragment = do_QueryInterface(df);
     if (NS_SUCCEEDED(rv)) {
+      // Suppress assertion about node removal mutation events that can't have
+      // listeners anyway, because no one has had the chance to register mutation
+      // listeners on the fragment that comes from the parser.
+      nsAutoScriptBlockerSuppressNodeRemoved scriptBlocker;
+
       static_cast<nsINode*>(this)->AppendChild(fragment, &rv);
     }
   }
 
   return rv;
 }
 
 enum nsAdjacentPosition {
--- a/content/html/content/src/nsHTMLInputElement.cpp
+++ b/content/html/content/src/nsHTMLInputElement.cpp
@@ -80,18 +80,16 @@
 #include "nsIDOMNSEvent.h"
 #include "nsIDOMNodeList.h"
 #include "nsIDOMHTMLCollection.h"
 #include "nsLinebreakConverter.h" //to strip out carriage returns
 #include "nsReadableUtils.h"
 #include "nsUnicharUtils.h"
 #include "nsEventDispatcher.h"
 #include "nsLayoutUtils.h"
-#include "nsWidgetsCID.h"
-#include "nsILookAndFeel.h"
 
 #include "nsIDOMMutationEvent.h"
 #include "nsIDOMEventTarget.h"
 #include "nsMutationEvent.h"
 #include "nsEventListenerManager.h"
 
 #include "nsRuleData.h"
 
@@ -113,22 +111,24 @@
 #include "nsImageLoadingContent.h"
 
 #include "mozAutoDocUpdate.h"
 #include "nsContentCreatorFunctions.h"
 #include "nsCharSeparatedTokenizer.h"
 #include "nsContentUtils.h"
 #include "nsRadioVisitor.h"
 
+#include "mozilla/LookAndFeel.h"
+
+using namespace mozilla;
 using namespace mozilla::dom;
 
 // XXX align=left, hspace, vspace, border? other nav4 attrs
 
 static NS_DEFINE_CID(kXULControllersCID,  NS_XULCONTROLLERS_CID);
-static NS_DEFINE_CID(kLookAndFeelCID, NS_LOOKANDFEEL_CID);
 
 // First bits are needed for the control type.
 #define NS_OUTER_ACTIVATE_EVENT   (1 << 9)
 #define NS_ORIGINAL_CHECKED_VALUE (1 << 10)
 #define NS_NO_CONTENT_DISPATCH    (1 << 11)
 #define NS_ORIGINAL_INDETERMINATE_VALUE (1 << 12)
 #define NS_CONTROL_TYPE(bits)  ((bits) & ~( \
   NS_OUTER_ACTIVATE_EVENT | NS_ORIGINAL_CHECKED_VALUE | NS_NO_CONTENT_DISPATCH | \
@@ -1918,26 +1918,25 @@ nsHTMLInputElement::PreHandleEvent(nsEve
 
   return nsGenericHTMLFormElement::PreHandleEvent(aVisitor);
 }
 
 static PRBool
 SelectTextFieldOnFocus()
 {
   if (!gSelectTextFieldOnFocus) {
-    nsCOMPtr<nsILookAndFeel> lookNFeel(do_GetService(kLookAndFeelCID));
-    if (lookNFeel) {
-      PRInt32 selectTextfieldsOnKeyFocus = -1;
-      lookNFeel->GetMetric(nsILookAndFeel::eMetric_SelectTextfieldsOnKeyFocus,
-                           selectTextfieldsOnKeyFocus);
+    PRInt32 selectTextfieldsOnKeyFocus = -1;
+    nsresult rv =
+      LookAndFeel::GetInt(LookAndFeel::eIntID_SelectTextfieldsOnKeyFocus,
+                          &selectTextfieldsOnKeyFocus);
+    if (NS_FAILED(rv)) {
+      gSelectTextFieldOnFocus = -1;
+    } else {
       gSelectTextFieldOnFocus = selectTextfieldsOnKeyFocus != 0 ? 1 : -1;
     }
-    else {
-      gSelectTextFieldOnFocus = -1;
-    }
   }
 
   return gSelectTextFieldOnFocus == 1;
 }
 
 nsresult
 nsHTMLInputElement::PostHandleEvent(nsEventChainPostVisitor& aVisitor)
 {
--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@@ -270,29 +270,31 @@ NS_IMPL_CYCLE_COLLECTION_CLASS(nsHTMLDoc
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsHTMLDocument, nsDocument)
   NS_ASSERTION(!nsCCUncollectableMarker::InGeneration(cb, tmp->GetMarkedCCGeneration()),
                "Shouldn't traverse nsHTMLDocument!");
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mImages)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mApplets)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mEmbeds)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mLinks)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mAnchors)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mScripts)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR_AMBIGUOUS(mForms, nsIDOMNodeList)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR_AMBIGUOUS(mFormControls,
                                                        nsIDOMNodeList)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mWyciwygChannel)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mMidasCommandManager)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsHTMLDocument, nsDocument)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mImages)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mApplets)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mEmbeds)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mLinks)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mAnchors)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mScripts)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mForms)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mFormControls)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mWyciwygChannel)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mMidasCommandManager)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_IMPL_ADDREF_INHERITED(nsHTMLDocument, nsDocument)
 NS_IMPL_RELEASE_INHERITED(nsHTMLDocument, nsDocument)
@@ -343,16 +345,17 @@ nsHTMLDocument::ResetToURI(nsIURI *aURI,
 
   nsDocument::ResetToURI(aURI, aLoadGroup, aPrincipal);
 
   mImages = nsnull;
   mApplets = nsnull;
   mEmbeds = nsnull;
   mLinks = nsnull;
   mAnchors = nsnull;
+  mScripts = nsnull;
 
   mForms = nsnull;
 
   NS_ASSERTION(!mWyciwygChannel,
                "nsHTMLDocument::Reset() - Wyciwyg Channel  still exists!");
 
   mWyciwygChannel = nsnull;
 
@@ -1439,16 +1442,29 @@ nsHTMLDocument::GetAnchors(nsIDOMHTMLCol
 
   *aAnchors = mAnchors;
   NS_ADDREF(*aAnchors);
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
+nsHTMLDocument::GetScripts(nsIDOMHTMLCollection** aScripts)
+{
+  if (!mScripts) {
+    mScripts = new nsContentList(this, kNameSpaceID_XHTML, nsGkAtoms::script, nsGkAtoms::script);
+  }
+
+  *aScripts = mScripts;
+  NS_ADDREF(*aScripts);
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
 nsHTMLDocument::GetCookie(nsAString& aCookie)
 {
   aCookie.Truncate(); // clear current cookie in case service fails;
                       // no cookie isn't an error condition.
 
   if (mDisableCookieAccess) {
     return NS_OK;
   }
--- a/content/html/document/src/nsHTMLDocument.h
+++ b/content/html/document/src/nsHTMLDocument.h
@@ -242,16 +242,17 @@ protected:
     return kNameSpaceID_XHTML;
   }
 
   nsCOMPtr<nsIDOMHTMLCollection> mImages;
   nsCOMPtr<nsIDOMHTMLCollection> mApplets;
   nsCOMPtr<nsIDOMHTMLCollection> mEmbeds;
   nsCOMPtr<nsIDOMHTMLCollection> mLinks;
   nsCOMPtr<nsIDOMHTMLCollection> mAnchors;
+  nsCOMPtr<nsIDOMHTMLCollection> mScripts;
   nsRefPtr<nsContentList> mForms;
   nsRefPtr<nsContentList> mFormControls;
 
   /** # of forms in the document, synchronously set */
   PRInt32 mNumForms;
 
   static PRUint32 gWyciwygSessionCnt;
 
--- a/content/xslt/src/xslt/txMozillaStylesheetCompiler.cpp
+++ b/content/xslt/src/xslt/txMozillaStylesheetCompiler.cpp
@@ -493,17 +493,17 @@ txCompileObserver::startLoad(nsIURI* aUr
 
     channel->SetLoadGroup(mLoadGroup);
 
     channel->SetContentType(NS_LITERAL_CSTRING("text/xml"));
 
     nsCOMPtr<nsIHttpChannel> httpChannel(do_QueryInterface(channel));
     if (httpChannel) {
         httpChannel->SetRequestHeader(NS_LITERAL_CSTRING("Accept"),
-                                      NS_LITERAL_CSTRING("text/xml,application/xml,application/xhtml+xml,application/xslt+xml,*/*;q=0.1"),
+                                      NS_LITERAL_CSTRING("*/*"),
                                       PR_FALSE);
 
         nsCOMPtr<nsIURI> referrerURI;
         aReferrerPrincipal->GetURI(getter_AddRefs(referrerURI));
         if (referrerURI) {
             httpChannel->SetReferrer(referrerURI);
         }
     }
--- a/content/xul/content/src/nsXULPopupListener.cpp
+++ b/content/xul/content/src/nsXULPopupListener.cpp
@@ -79,17 +79,17 @@
 #include "nsPIDOMWindow.h"
 #include "nsIViewManager.h"
 #include "nsDOMError.h"
 
 using namespace mozilla;
 
 // on win32 and os/2, context menus come up on mouse up. On other platforms,
 // they appear on mouse down. Certain bits of code care about this difference.
-#if !defined(XP_WIN) && !defined(XP_OS2)
+#if defined(XP_WIN) || defined(XP_OS2)
 #define NS_CONTEXT_MENU_IS_MOUSEUP 1
 #endif
 
 nsXULPopupListener::nsXULPopupListener(nsIDOMElement *aElement, PRBool aIsContext)
   : mElement(aElement), mPopupContent(nsnull), mIsContext(aIsContext)
 {
 }
 
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -514,19 +514,19 @@ static const char kDOMStringBundleURL[] 
 
 // NOTE: DEFAULT_SCRIPTABLE_FLAGS and DOM_DEFAULT_SCRIPTABLE_FLAGS
 //       are defined in nsIDOMClassInfo.h.
 
 #define WINDOW_SCRIPTABLE_FLAGS                                               \
  (nsIXPCScriptable::WANT_GETPROPERTY |                                        \
   nsIXPCScriptable::WANT_PRECREATE |                                          \
   nsIXPCScriptable::WANT_FINALIZE |                                           \
-  nsIXPCScriptable::WANT_EQUALITY |                                           \
   nsIXPCScriptable::WANT_ENUMERATE |                                          \
   nsIXPCScriptable::DONT_ENUM_QUERY_INTERFACE |                               \
+  nsIXPCScriptable::USE_STUB_EQUALITY_HOOK |                                  \
   nsIXPCScriptable::WANT_OUTER_OBJECT)
 
 #define NODE_SCRIPTABLE_FLAGS                                                 \
  ((DOM_DEFAULT_SCRIPTABLE_FLAGS |                                             \
    nsIXPCScriptable::USE_STUB_EQUALITY_HOOK |                                 \
    nsIXPCScriptable::WANT_GETPROPERTY |                                       \
    nsIXPCScriptable::WANT_ADDPROPERTY |                                       \
    nsIXPCScriptable::WANT_SETPROPERTY) &                                      \
@@ -6915,47 +6915,16 @@ nsWindowSH::Finalize(nsIXPConnectWrapped
   NS_ENSURE_TRUE(sgo, NS_ERROR_UNEXPECTED);
 
   sgo->OnFinalize(obj);
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsWindowSH::Equality(nsIXPConnectWrappedNative *wrapper, JSContext * cx,
-                     JSObject * obj, const jsval &val, PRBool *bp)
-{
-  *bp = PR_FALSE;
-
-  if (JSVAL_IS_PRIMITIVE(val)) {
-    return NS_OK;
-  }
-
-  nsCOMPtr<nsIXPConnectWrappedNative> other_wrapper;
-  nsContentUtils::XPConnect()->
-    GetWrappedNativeOfJSObject(cx, JSVAL_TO_OBJECT(val),
-                               getter_AddRefs(other_wrapper));
-  if (!other_wrapper) {
-    // Not equal.
-
-    return NS_OK;
-  }
-
-  nsGlobalWindow *win = nsGlobalWindow::FromWrapper(wrapper);
-
-  nsCOMPtr<nsPIDOMWindow> other = do_QueryWrappedNative(other_wrapper);
-
-  if (other) {
-    *bp = win->GetOuterWindow() == other->GetOuterWindow();
-  }
-
-  return NS_OK;
-}
-
-NS_IMETHODIMP
 nsWindowSH::OuterObject(nsIXPConnectWrappedNative *wrapper, JSContext * cx,
                         JSObject * obj, JSObject * *_retval)
 {
   nsGlobalWindow *origWin = nsGlobalWindow::FromWrapper(wrapper);
   nsGlobalWindow *win = origWin->GetOuterWindowInternal();
 
   if (!win) {
     // If we no longer have an outer window. No code should ever be
--- a/dom/base/nsDOMClassInfo.h
+++ b/dom/base/nsDOMClassInfo.h
@@ -409,18 +409,16 @@ public:
                          JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
   NS_IMETHOD Enumerate(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                        JSObject *obj, PRBool *_retval);
   NS_IMETHOD NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                         JSObject *obj, jsid id, PRUint32 flags,
                         JSObject **objp, PRBool *_retval);
   NS_IMETHOD Finalize(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                       JSObject *obj);
-  NS_IMETHOD Equality(nsIXPConnectWrappedNative *wrapper, JSContext * cx,
-                      JSObject * obj, const jsval &val, PRBool *bp);
   NS_IMETHOD OuterObject(nsIXPConnectWrappedNative *wrapper, JSContext * cx,
                          JSObject * obj, JSObject * *_retval);
 
   static JSBool GlobalScopePolluterNewResolve(JSContext *cx, JSObject *obj,
                                               jsid id, uintN flags,
                                               JSObject **objp);
   static JSBool GlobalScopePolluterGetProperty(JSContext *cx, JSObject *obj,
                                                jsid id, jsval *vp);
--- a/dom/base/nsFocusManager.cpp
+++ b/dom/base/nsFocusManager.cpp
@@ -67,29 +67,28 @@
 #include "nsIContentViewer.h"
 #include "nsFrameTraversal.h"
 #include "nsObjectFrame.h"
 #include "nsEventDispatcher.h"
 #include "nsEventStateManager.h"
 #include "nsIMEStateManager.h"
 #include "nsIWebNavigation.h"
 #include "nsCaret.h"
-#include "nsWidgetsCID.h"
-#include "nsILookAndFeel.h"
 #include "nsIWidget.h"
 #include "nsIBaseWindow.h"
 #include "nsIViewManager.h"
 #include "nsFrameSelection.h"
 #include "nsXULPopupManager.h"
 #include "nsIDOMNodeFilter.h"
 #include "nsIScriptObjectPrincipal.h"
 #include "nsIPrincipal.h"
 #include "mozilla/dom/Element.h"
 #include "mozAutoDocUpdate.h"
 #include "mozilla/Preferences.h"
+#include "mozilla/LookAndFeel.h"
 
 #ifdef MOZ_XUL
 #include "nsIDOMXULTextboxElement.h"
 #include "nsIDOMXULMenuListElement.h"
 #endif
 
 using namespace mozilla;
 using namespace mozilla::dom;
@@ -150,18 +149,16 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mActiveWindow)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mFocusedWindow)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mFocusedContent)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mFirstBlurEvent)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mFirstFocusEvent)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mWindowBeingLowered)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
-static NS_DEFINE_CID(kLookAndFeelCID, NS_LOOKANDFEEL_CID);
-
 nsFocusManager* nsFocusManager::sInstance = nsnull;
 PRBool nsFocusManager::sMouseFocusesFormControl = PR_FALSE;
 
 static const char* kObservedPrefs[] = {
   "accessibility.browsewithcaret",
   "accessibility.tabfocus_applies_to_xul",
   "accessibility.mouse_focuses_formcontrol",
   NULL
@@ -2288,19 +2285,18 @@ nsFocusManager::DetermineElementToMoveFo
   nsCOMPtr<nsIDocument> doc;
   if (startContent)
     doc = startContent->GetCurrentDoc();
   else
     doc = do_QueryInterface(aWindow->GetExtantDocument());
   if (!doc)
     return NS_OK;
 
-  nsCOMPtr<nsILookAndFeel> lookNFeel(do_GetService(kLookAndFeelCID));
-  lookNFeel->GetMetric(nsILookAndFeel::eMetric_TabFocusModel,
-                       nsIContent::sTabFocusModel);
+  LookAndFeel::GetInt(LookAndFeel::eIntID_TabFocusModel,
+                      &nsIContent::sTabFocusModel);
 
   if (aType == MOVEFOCUS_ROOT) {
     NS_IF_ADDREF(*aNextContent = GetRootForFocus(aWindow, doc, PR_FALSE, PR_FALSE));
     return NS_OK;
   }
   if (aType == MOVEFOCUS_FORWARDDOC) {
     NS_IF_ADDREF(*aNextContent = GetNextTabbableDocument(PR_TRUE));
     return NS_OK;
--- a/dom/interfaces/core/nsIDOMAttr.idl
+++ b/dom/interfaces/core/nsIDOMAttr.idl
@@ -43,17 +43,17 @@
  * The nsIDOMAttr interface represents an attribute in an "Element" object. 
  * Typically the allowable values for the attribute are defined in a document 
  * type definition.
  * 
  * For more information on this interface please see 
  * http://www.w3.org/TR/DOM-Level-2-Core/
  */
 
-[scriptable, uuid(6bdedbc5-681e-4570-a3dc-3685ed8d6e1e)]
+[scriptable, uuid(03da4bc9-1b9a-41dc-a1a4-32414d48d704)]
 interface nsIDOMAttr : nsIDOMNode
 {
   readonly attribute DOMString            name;
   readonly attribute boolean              specified;
            attribute DOMString            value;
                                             // raises(DOMException) on setting
 
   // Introduced in DOM Level 2:
--- a/dom/interfaces/core/nsIDOMCDATASection.idl
+++ b/dom/interfaces/core/nsIDOMCDATASection.idl
@@ -44,12 +44,12 @@
  * that would otherwise be regarded as markup.
  * Their primary purpose is for including material such as XML fragments, 
  * without needing to escape all the delimiters.
  * 
  * For more information on this interface please see 
  * http://www.w3.org/TR/DOM-Level-2-Core/
  */
 
-[scriptable, uuid(f1eea89d-8af3-4c2a-90df-6c3a75cb5005)]
+[scriptable, uuid(08a05c75-23de-4937-a45b-89bdcbe4f467)]
 interface nsIDOMCDATASection : nsIDOMText
 {
 };
--- a/dom/interfaces/core/nsIDOMCharacterData.idl
+++ b/dom/interfaces/core/nsIDOMCharacterData.idl
@@ -42,17 +42,17 @@
 /**
  * The nsIDOMCharacterData interface extends nsIDOMNode with a set of 
  * attributes and methods for accessing character data in the DOM.
  * 
  * For more information on this interface please see 
  * http://www.w3.org/TR/DOM-Level-2-Core/
  */
 
-[scriptable, uuid(6ce64178-d600-4e5e-a33a-5bde69f05bd5)]
+[scriptable, uuid(cb75c251-afc7-444f-b2d6-b9635555f3ed)]
 interface nsIDOMCharacterData : nsIDOMNode
 {
            attribute DOMString            data;
                                   // raises(DOMException) on setting
                                   // raises(DOMException) on retrieval
 
   readonly attribute unsigned long        length;
   DOMString                 substringData(in unsigned long offset, 
--- a/dom/interfaces/core/nsIDOMComment.idl
+++ b/dom/interfaces/core/nsIDOMComment.idl
@@ -43,12 +43,12 @@
  * The nsIDOMComment interface inherits from nsIDOMCharacterData and represents 
  * the content of a comment, i.e., all the characters between the starting 
  * '<!--' and ending '-->'.
  * 
  * For more information on this interface please see 
  * http://www.w3.org/TR/DOM-Level-2-Core/
  */
 
-[scriptable, uuid(eaf04950-d409-41a0-a99d-2e4e43c1e33d)]
+[scriptable, uuid(cea49a35-dac9-4c4d-9830-4660abb3b6bc)]
 interface nsIDOMComment : nsIDOMCharacterData
 {
 };
--- a/dom/interfaces/core/nsIDOMDocument.idl
+++ b/dom/interfaces/core/nsIDOMDocument.idl
@@ -58,17 +58,17 @@ interface nsIDOMCaretPosition;
  * cannot exist outside the context of a Document, the nsIDOMDocument 
  * interface also contains the factory methods needed to create these 
  * objects.
  *
  * For more information on this interface please see 
  * http://dvcs.w3.org/hg/domcore/raw-file/tip/Overview.html
  */
 
-[scriptable, uuid(903493d3-72b6-4416-b930-fbfc17ef1d87)]
+[scriptable, uuid(48ef69c6-844f-41ba-af66-17b338177a8b)]
 interface nsIDOMDocument : nsIDOMNode
 {
   readonly attribute nsIDOMDocumentType         doctype;
   readonly attribute nsIDOMDOMImplementation    implementation;
   readonly attribute nsIDOMElement              documentElement;
   nsIDOMElement                 createElement(in DOMString tagName)
                                   raises(DOMException);
   nsIDOMDocumentFragment        createDocumentFragment();
--- a/dom/interfaces/core/nsIDOMDocumentFragment.idl
+++ b/dom/interfaces/core/nsIDOMDocumentFragment.idl
@@ -43,12 +43,12 @@
  * DocumentFragment is a "lightweight" or "minimal" Document object.
  * nsIDOMDocumentFragment is used in situations where the Document
  * interface can potentially be a heavyweight interface.
  *
  * For more information on this interface please see 
  * http://www.w3.org/TR/DOM-Level-2-Core/
  */
 
-[scriptable, uuid(06376ec5-7c91-45ad-a346-30a06a125935)]
+[scriptable, uuid(4a15eb0c-d5bc-4902-9d50-21b12cab47e7)]
 interface nsIDOMDocumentFragment : nsIDOMNode
 {
 };
--- a/dom/interfaces/core/nsIDOMDocumentType.idl
+++ b/dom/interfaces/core/nsIDOMDocumentType.idl
@@ -44,16 +44,16 @@
  * or a DocumentType object. 
  * The nsIDOMDocumentType interface in the DOM Core provides an 
  * interface to the list of entities that are defined for the document.
  *
  * For more information on this interface please see 
  * http://www.w3.org/TR/DOM-Level-2-Core/
  */
 
-[scriptable, uuid(bfd028d4-fbbd-4d69-8899-dbee1778dde2)]
+[scriptable, uuid(ac5fd4c5-6c5d-4dfc-878c-7d661aa676de)]
 interface nsIDOMDocumentType : nsIDOMNode
 {
   readonly attribute  DOMString            name;
   readonly attribute  DOMString            publicId;
   readonly attribute  DOMString            systemId;
   readonly attribute  DOMString            internalSubset;
 };
--- a/dom/interfaces/core/nsIDOMElement.idl
+++ b/dom/interfaces/core/nsIDOMElement.idl
@@ -42,17 +42,17 @@
 /**
  * The nsIDOMElement interface represents an element in an HTML or 
  * XML document. 
  *
  * For more information on this interface please see 
  * http://www.w3.org/TR/DOM-Level-2-Core/
  */
 
-[scriptable, uuid(f220e259-5c41-4cca-a38b-7267ffa874aa)]
+[scriptable, uuid(56aaaf03-f8f1-4c06-9cb5-f3e33a39e5c3)]
 interface nsIDOMElement : nsIDOMNode
 {
   readonly attribute DOMString        tagName;
   DOMString          getAttribute(in DOMString name);
   void               setAttribute(in DOMString name, 
                                   in DOMString value)
                                         raises(DOMException);
   void               removeAttribute(in DOMString name)
--- a/dom/interfaces/core/nsIDOMNode.idl
+++ b/dom/interfaces/core/nsIDOMNode.idl
@@ -47,17 +47,17 @@ interface nsIDOMUserDataHandler;
  * The nsIDOMNode interface is the primary datatype for the entire 
  * Document Object Model.
  * It represents a single node in the document tree.
  *
  * For more information on this interface please see 
  * http://dvcs.w3.org/hg/domcore/raw-file/tip/Overview.html
  */
 
-[scriptable, uuid(af9b19f7-7c88-4d16-9a3a-97390f824c58)]
+[scriptable, uuid(c8ac3f81-63e1-4c31-8543-70a656642789)]
 interface nsIDOMNode : nsISupports
 {
   const unsigned short      ELEMENT_NODE       = 1;
   const unsigned short      ATTRIBUTE_NODE     = 2;
   const unsigned short      TEXT_NODE          = 3;
   const unsigned short      CDATA_SECTION_NODE = 4;
   const unsigned short      ENTITY_REFERENCE_NODE = 5;
   const unsigned short      ENTITY_NODE        = 6;
@@ -69,16 +69,17 @@ interface nsIDOMNode : nsISupports
   const unsigned short      NOTATION_NODE      = 12;
 
   readonly attribute DOMString        nodeName;
            attribute DOMString        nodeValue;
                                           // raises(DOMException) on setting
                                           // raises(DOMException) on retrieval
   readonly attribute unsigned short   nodeType;
   readonly attribute nsIDOMNode       parentNode;
+  readonly attribute nsIDOMElement    parentElement;
   readonly attribute nsIDOMNodeList   childNodes;
   readonly attribute nsIDOMNode       firstChild;
   readonly attribute nsIDOMNode       lastChild;
   readonly attribute nsIDOMNode       previousSibling;
   readonly attribute nsIDOMNode       nextSibling;
   readonly attribute nsIDOMNamedNodeMap attributes;
   // Modified in DOM Level 2:
   readonly attribute nsIDOMDocument   ownerDocument;
--- a/dom/interfaces/core/nsIDOMProcessingInstruction.idl
+++ b/dom/interfaces/core/nsIDOMProcessingInstruction.idl
@@ -43,15 +43,15 @@
  * The nsIDOMProcessingInstruction interface represents a 
  * "processing instruction", used in XML as a way to keep processor-specific 
  * information in the text of the document.
  *
  * For more information on this interface please see 
  * http://www.w3.org/TR/DOM-Level-2-Core/
  */
 
-[scriptable, uuid(1c3118cc-4d21-40cc-96c4-9d46facee5d1)]
+[scriptable, uuid(5964f639-1183-487d-a87d-4c93111eae85)]
 interface nsIDOMProcessingInstruction : nsIDOMNode
 {
   readonly attribute DOMString        target;
            attribute DOMString        data;
                                        // raises(DOMException) on setting
 };
--- a/dom/interfaces/core/nsIDOMText.idl
+++ b/dom/interfaces/core/nsIDOMText.idl
@@ -42,17 +42,17 @@
 /**
  * The nsIDOMText interface inherits from nsIDOMCharacterData and represents 
  * the textual content (termed character data in XML) of an Element or Attr.
  *
  * For more information on this interface please see 
  * http://dvcs.w3.org/hg/domcore/raw-file/tip/Overview.html
  */
 
-[scriptable, uuid(04a1ec2b-491f-4a80-8db4-694c37e31a6f)]
+[scriptable, uuid(92b0df87-78a1-4e3b-a23c-d0c5bb2b83f9)]
 interface nsIDOMText : nsIDOMCharacterData
 {
   nsIDOMText                      splitText(in unsigned long offset)
                                        raises(DOMException);
 
   /**
    * Indicates whether this text node contains element content whitespace.
    * A text node is element content whitespace if it contains only XML
--- a/dom/interfaces/core/nsIDOMXMLDocument.idl
+++ b/dom/interfaces/core/nsIDOMXMLDocument.idl
@@ -33,17 +33,17 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMDocument.idl"
 
-[scriptable, uuid(f97b36ff-425f-4c87-b6dc-fcfcfb4d5c77)]
+[scriptable, uuid(e788e37b-9a89-4b3e-9593-c598e50695eb)]
 interface nsIDOMXMLDocument : nsIDOMDocument
 {
   // DOM Level 3 Load & Save, DocumentLS
   // http://www.w3.org/TR/DOM-Level-3-LS/load-save.html#LS-DocumentLS
   /**
    * Whether to load synchronously or asynchronously.
    * The default is async==true.
    */
--- a/dom/interfaces/html/nsIDOMHTMLAnchorElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLAnchorElement.idl
@@ -45,17 +45,17 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(768bfb39-f0ce-4f17-bad7-f0f722dc293a)]
+[scriptable, uuid(dfcf9a0b-2bc4-465b-b007-9c0e26aabc17)]
 interface nsIDOMHTMLAnchorElement : nsIDOMHTMLElement
 {
            attribute DOMString        href;
            attribute DOMString        target;
 
            attribute DOMString        ping;
 
            attribute DOMString        rel;
--- a/dom/interfaces/html/nsIDOMHTMLAppletElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLAppletElement.idl
@@ -45,17 +45,17 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(1840a15d-618e-4e22-a53e-56a3624b8ae3)]
+[scriptable, uuid(fe7107a3-d8ea-4ef5-a5b0-c358767ca243)]
 interface nsIDOMHTMLAppletElement : nsIDOMHTMLElement
 {
            attribute DOMString        align;
            attribute DOMString        alt;
            attribute DOMString        archive;
            attribute DOMString        code;
            attribute DOMString        codeBase;
            attribute DOMString        height;
--- a/dom/interfaces/html/nsIDOMHTMLAreaElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLAreaElement.idl
@@ -45,17 +45,17 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(eeae849e-d9f6-4e66-a838-44deb9594bc1)]
+[scriptable, uuid(59e6d277-5468-4ff2-bc98-adecaf4e0aa8)]
 interface nsIDOMHTMLAreaElement : nsIDOMHTMLElement
 {
            attribute DOMString        alt;
            attribute DOMString        coords;
            attribute DOMString        shape;
            attribute DOMString        href;
            attribute DOMString        target;
 
--- a/dom/interfaces/html/nsIDOMHTMLAudioElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLAudioElement.idl
@@ -47,17 +47,17 @@
  * <audio> element.
  *
  * For more information on this interface, please see
  * http://www.whatwg.org/specs/web-apps/current-work/#audio
  *
  * @status UNDER_DEVELOPMENT
  */
 
-[scriptable, uuid(f0d4977c-9632-4fab-bc9b-91c250a6ef96)]
+[scriptable, uuid(4b832a46-8c9d-4dda-aaa3-8ebeece2b13a)]
 interface nsIDOMHTMLAudioElement : nsIDOMHTMLMediaElement
 {
   // Setup the audio stream for writing
   void mozSetup(in PRUint32 channels, in PRUint32 rate);
 
   // Write audio to the audio stream
   [implicit_jscontext]
   unsigned long mozWriteAudio(in jsval data);
--- a/dom/interfaces/html/nsIDOMHTMLBRElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLBRElement.idl
@@ -45,13 +45,13 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(e8252870-aa63-4eaf-9d59-5e5ea014fdf3)]
+[scriptable, uuid(a348b00a-7e0e-4f61-97f8-9798d1c73971)]
 interface nsIDOMHTMLBRElement : nsIDOMHTMLElement
 {
            attribute DOMString        clear;
 };
--- a/dom/interfaces/html/nsIDOMHTMLBaseElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLBaseElement.idl
@@ -45,14 +45,14 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(84ee3ce6-ea9c-4443-93a2-359c259ef218)]
+[scriptable, uuid(7549715a-0931-4fbd-a0b9-5a99f7a8d7f1)]
 interface nsIDOMHTMLBaseElement : nsIDOMHTMLElement
 {
            attribute DOMString        href;
            attribute DOMString        target;
 };
--- a/dom/interfaces/html/nsIDOMHTMLBodyElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLBodyElement.idl
@@ -49,17 +49,17 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(9569e420-137a-4c7e-a880-288a81f78308)]
+[scriptable, uuid(6954f803-fc81-4300-bcad-e0854ef9a142)]
 interface nsIDOMHTMLBodyElement : nsIDOMHTMLElement
 {
            attribute DOMString        aLink;
            attribute DOMString        background;
            attribute DOMString        bgColor;
            attribute DOMString        link;
            attribute DOMString        text;
            attribute DOMString        vLink;
--- a/dom/interfaces/html/nsIDOMHTMLButtonElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLButtonElement.idl
@@ -47,17 +47,17 @@
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 interface nsIDOMValidityState;
 
-[scriptable, uuid(7a40902e-d0ce-41f2-bc46-e247e9662ea8)]
+[scriptable, uuid(a7740abf-dbef-4a5e-a8a8-be5809c5d851)]
 interface nsIDOMHTMLButtonElement : nsIDOMHTMLElement
 {
            attribute boolean               autofocus;
            attribute boolean               disabled;
   readonly attribute nsIDOMHTMLFormElement form;
            attribute DOMString             formAction;
            attribute DOMString             formEnctype;
            attribute DOMString             formMethod;
--- a/dom/interfaces/html/nsIDOMHTMLCanvasElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLCanvasElement.idl
@@ -50,17 +50,17 @@
  * http://www.whatwg.org/specs/web-apps/current-work/#graphics
  *
  * @status UNDER_DEVELOPMENT
  */
 
 interface nsIDOMFile;
 interface nsIVariant;
 
-[scriptable, uuid(010d8e6f-86ba-47ad-a04f-1a4d75f1caf8)]
+[scriptable, uuid(b00ad90f-b83a-400d-87b8-704503a65061)]
 interface nsIDOMHTMLCanvasElement : nsIDOMHTMLElement
 {
   attribute unsigned long width;
   attribute unsigned long height;
   attribute boolean mozOpaque;
 
   nsISupports getContext(in DOMString contextId,
                          [optional] in jsval contextOptions);
--- a/dom/interfaces/html/nsIDOMHTMLCommandElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLCommandElement.idl
@@ -41,17 +41,17 @@
  * <command> element.
  *
  * For more information on this interface, please see
  * http://www.whatwg.org/specs/web-apps/current-work/#the-command-element
  *
  * @status UNDER_DEVELOPMENT
  */
 
-[scriptable, uuid(df4a19b4-81f1-412e-a971-fcbe7312a9b6)]
+[scriptable, uuid(c09f7b23-199c-4e5e-a8c1-48640725b8a2)]
 interface nsIDOMHTMLCommandElement : nsIDOMHTMLElement
 {
            attribute DOMString        type;
            attribute DOMString        label;
            attribute DOMString        icon;
            attribute boolean          disabled;
            attribute boolean          defaultChecked;
            attribute boolean          checked;
--- a/dom/interfaces/html/nsIDOMHTMLDListElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLDListElement.idl
@@ -45,13 +45,13 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(8c2e26d3-8ed4-4e13-abc8-46d7d2f7d300)]
+[scriptable, uuid(fe0a4ba1-99d4-4a22-87ad-f9f5e5ebc0b4)]
 interface nsIDOMHTMLDListElement : nsIDOMHTMLElement
 {
            attribute boolean          compact;
 };
--- a/dom/interfaces/html/nsIDOMHTMLDataListElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLDataListElement.idl
@@ -44,14 +44,14 @@
  * For more information on this interface, please see
  * http://www.whatwg.org/specs/web-apps/current-work/#the-datalist-element
  *
  * @status UNDER_DEVELOPMENT
  */
 
 interface nsIDOMHTMLCollection;
 
-[scriptable, uuid(11dacc1f-4abc-44a5-9c57-c0c3e833e387)]
+[scriptable, uuid(0ed2f7db-83ed-44a9-aeca-4995d0a39898)]
 interface nsIDOMHTMLDataListElement : nsIDOMHTMLElement
 {
   readonly attribute nsIDOMHTMLCollection options;
 };
 
--- a/dom/interfaces/html/nsIDOMHTMLDirectoryElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLDirectoryElement.idl
@@ -45,13 +45,13 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(3531a90c-cd39-4619-abad-71a961a58c54)]
+[scriptable, uuid(a7ce62d2-7b08-4289-a044-2aa568f03c75)]
 interface nsIDOMHTMLDirectoryElement : nsIDOMHTMLElement
 {
            attribute boolean          compact;
 };
--- a/dom/interfaces/html/nsIDOMHTMLDivElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLDivElement.idl
@@ -45,13 +45,13 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(616223f7-014d-4805-b524-ad6cf8536ac0)]
+[scriptable, uuid(2a2bbe83-9faf-460b-8fbe-e37630c6ca7f)]
 interface nsIDOMHTMLDivElement : nsIDOMHTMLElement
 {
            attribute DOMString        align;
 };
--- a/dom/interfaces/html/nsIDOMHTMLDocument.idl
+++ b/dom/interfaces/html/nsIDOMHTMLDocument.idl
@@ -42,17 +42,17 @@
 /**
  * The nsIDOMHTMLDocument interface is the interface to a [X]HTML
  * document object.
  *
  * @see <http://www.whatwg.org/html/>
  */
 interface nsISelection;
 
-[scriptable, uuid(3ab3e856-361d-435a-8a4d-b462799945cd)]
+[scriptable, uuid(7587ce39-e939-4b86-838d-a1d04e4e04c0)]
 interface nsIDOMHTMLDocument : nsIDOMDocument
 {
   readonly attribute DOMString            URL;
            attribute DOMString            domain;
            attribute DOMString            cookie;
   // returns "BackCompat" if we're in quirks mode,
   // or "CSS1Compat" if we're in strict mode
   readonly attribute DOMString            compatMode;
@@ -61,16 +61,17 @@ interface nsIDOMHTMLDocument : nsIDOMDoc
            attribute nsIDOMHTMLElement    body;
 
   readonly attribute nsIDOMHTMLCollection images;
   readonly attribute nsIDOMHTMLCollection embeds;
   // mapped to attribute embeds for NS4 compat
   readonly attribute nsIDOMHTMLCollection plugins;
   readonly attribute nsIDOMHTMLCollection links;
   readonly attribute nsIDOMHTMLCollection forms;
+  readonly attribute nsIDOMHTMLCollection scripts;
   nsIDOMNodeList            getElementsByName(in DOMString elementName);
 
   // If aContentType is not something supported by nsHTMLDocument and
   // the HTML content sink, trying to write to the document will
   // probably throw.
   // Pass aReplace = true to trigger a replacement of the previous
   // document in session history; pass false for normal history handling.
   [implicit_jscontext, optional_argc]
--- a/dom/interfaces/html/nsIDOMHTMLElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLElement.idl
@@ -46,17 +46,17 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(c6e10ab6-ecf4-48e4-aeaa-37724307dfd5)]
+[scriptable, uuid(6ecb115c-8a7b-495b-958e-2ef5d8a50244)]
 interface nsIDOMHTMLElement : nsIDOMElement
 {
            attribute DOMString        id;
            attribute DOMString        title;
            attribute DOMString        lang;
            attribute DOMString        dir;
            attribute DOMString        className;
 
--- a/dom/interfaces/html/nsIDOMHTMLEmbedElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLEmbedElement.idl
@@ -42,17 +42,17 @@
 /**
  * The nsIDOMHTMLEmbedElement interface is the interface to a [X]HTML
  * embed element.
  *
  * For more information on this interface, please see
  * http://www.whatwg.org/specs/web-apps/current-work/#the-embed-element
  */
 
-[scriptable, uuid(dec16079-b0e7-46b9-aafa-c7f0ebc9abc1)]
+[scriptable, uuid(b93fec38-9436-49c2-95ec-77cf1de8c38f)]
 interface nsIDOMHTMLEmbedElement : nsIDOMHTMLElement
 {
            attribute DOMString        align;
            attribute DOMString        height;
            attribute DOMString        name;
            attribute DOMString        src;
            attribute DOMString        type;
            attribute DOMString        width;
--- a/dom/interfaces/html/nsIDOMHTMLFieldSetElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLFieldSetElement.idl
@@ -47,17 +47,17 @@
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 interface nsIDOMValidityState;
 
-[scriptable, uuid(c989a733-40a6-4712-b0f0-944dd5ec4344)]
+[scriptable, uuid(95fce971-83b5-4f03-9dfd-4ef07306fa2a)]
 interface nsIDOMHTMLFieldSetElement : nsIDOMHTMLElement
 {
            attribute boolean                disabled;
   readonly attribute nsIDOMHTMLFormElement  form;
            attribute DOMString              name;
 
   readonly attribute DOMString              type;
 
--- a/dom/interfaces/html/nsIDOMHTMLFontElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLFontElement.idl
@@ -45,15 +45,15 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(99875201-4f50-4e8a-a58e-dd39b9ff51e1)]
+[scriptable, uuid(e6b3c397-8227-4de2-bd7f-cd59aef8af9b)]
 interface nsIDOMHTMLFontElement : nsIDOMHTMLElement
 {
            attribute DOMString        color;
            attribute DOMString        face;
            attribute DOMString        size;
 };
--- a/dom/interfaces/html/nsIDOMHTMLFormElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLFormElement.idl
@@ -45,17 +45,17 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(b7892cbf-a23b-460a-817a-798d490b12df)]
+[scriptable, uuid(7b859d90-6b01-4208-8922-7999653c7491)]
 interface nsIDOMHTMLFormElement : nsIDOMHTMLElement
 {
            attribute DOMString            acceptCharset;
            attribute DOMString            action;
            attribute DOMString            autocomplete;
            attribute DOMString            enctype;
            attribute DOMString            encoding;
            attribute DOMString            method;
--- a/dom/interfaces/html/nsIDOMHTMLFrameElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLFrameElement.idl
@@ -45,17 +45,17 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(e3f42587-847f-4743-8891-490b2066493d)]
+[scriptable, uuid(c5e51cd2-f862-4440-90da-dee5bf84cc2e)]
 interface nsIDOMHTMLFrameElement : nsIDOMHTMLElement
 {
            attribute DOMString        frameBorder;
            attribute DOMString        longDesc;
            attribute DOMString        marginHeight;
            attribute DOMString        marginWidth;
            attribute DOMString        name;
            attribute boolean          noResize;
--- a/dom/interfaces/html/nsIDOMHTMLFrameSetElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLFrameSetElement.idl
@@ -49,17 +49,17 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(d6872633-0f1c-4110-bf49-88713a3cad86)]
+[scriptable, uuid(0d6d7deb-4e8b-40fc-acf0-5f0f862d20e6)]
 interface nsIDOMHTMLFrameSetElement : nsIDOMHTMLElement
 {
            attribute DOMString        cols;
            attribute DOMString        rows;
 
            [implicit_jscontext] attribute jsval            onafterprint;
            [implicit_jscontext] attribute jsval            onbeforeprint;
            [implicit_jscontext] attribute jsval            onbeforeunload;
--- a/dom/interfaces/html/nsIDOMHTMLHRElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLHRElement.idl
@@ -46,17 +46,17 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(32342e24-b209-4f50-8518-f7af339d4ae2)]
+[scriptable, uuid(48d708c2-48ef-42c3-9101-8b2a68e42ace)]
 interface nsIDOMHTMLHRElement : nsIDOMHTMLElement
 {
            attribute DOMString        align;
            attribute boolean          noShade;
            attribute DOMString        size;
            attribute DOMString        width;
            attribute DOMString        color;
 };
--- a/dom/interfaces/html/nsIDOMHTMLHeadElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLHeadElement.idl
@@ -45,12 +45,12 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(1be0672a-edfd-49b8-81e3-e68641029133)]
+[scriptable, uuid(5e62e47c-264e-47b4-aa8c-84a1d37238b9)]
 interface nsIDOMHTMLHeadElement : nsIDOMHTMLElement
 {
 };
--- a/dom/interfaces/html/nsIDOMHTMLHeadingElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLHeadingElement.idl
@@ -45,13 +45,13 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(0515a456-2545-4865-9a5b-f744a8e16101)]
+[scriptable, uuid(c8fe0b12-e8c2-45ab-9831-fae7c54ba4cb)]
 interface nsIDOMHTMLHeadingElement : nsIDOMHTMLElement
 {
            attribute DOMString        align;
 };
--- a/dom/interfaces/html/nsIDOMHTMLHtmlElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLHtmlElement.idl
@@ -45,13 +45,13 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(a8500f4c-3314-4049-bb79-f782663e7273)]
+[scriptable, uuid(eaee35a4-12af-4db2-8177-131ee690baa0)]
 interface nsIDOMHTMLHtmlElement : nsIDOMHTMLElement
 {
            attribute DOMString        version;
 };
--- a/dom/interfaces/html/nsIDOMHTMLIFrameElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLIFrameElement.idl
@@ -45,17 +45,17 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(31969911-36fb-42ee-9a00-018c3ff78cfb)]
+[scriptable, uuid(1c4174d0-8e24-407a-b527-fb78c23c801f)]
 interface nsIDOMHTMLIFrameElement : nsIDOMHTMLElement
 {
            attribute DOMString        align;
            attribute DOMString        frameBorder;
            attribute DOMString        height;
            attribute DOMString        longDesc;
            attribute DOMString        marginHeight;
            attribute DOMString        marginWidth;
--- a/dom/interfaces/html/nsIDOMHTMLImageElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLImageElement.idl
@@ -45,17 +45,17 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(ce760602-0528-493d-966d-65d4ee52347d)]
+[scriptable, uuid(db167ea6-b7f6-4eb3-aa34-705f436f8525)]
 interface nsIDOMHTMLImageElement : nsIDOMHTMLElement
 {
            attribute DOMString        alt;
            attribute DOMString        src;
            attribute DOMString        crossOrigin;
            attribute DOMString        useMap;
            attribute boolean          isMap;
            attribute unsigned long    width;
--- a/dom/interfaces/html/nsIDOMHTMLInputElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLInputElement.idl
@@ -49,17 +49,17 @@ interface nsIDOMValidityState;
   *
   * This interface is trying to follow the DOM Level 2 HTML specification:
   * http://www.w3.org/TR/DOM-Level-2-HTML/
   *
   * with changes from the work-in-progress WHATWG HTML specification:
   * http://www.whatwg.org/specs/web-apps/current-work/
   */
 
-[scriptable, uuid(66819eba-89b5-4db4-8d27-6368c70761e8)]
+[scriptable, uuid(90fa1822-deca-4732-bc50-0b5393ffd129)]
 interface nsIDOMHTMLInputElement : nsIDOMHTMLElement
 {
            attribute DOMString             accept;
            attribute DOMString             alt;
 
            attribute DOMString             autocomplete;
            attribute boolean               autofocus;
            attribute boolean               defaultChecked;
--- a/dom/interfaces/html/nsIDOMHTMLLIElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLLIElement.idl
@@ -45,14 +45,14 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(9c31bd99-1412-49a2-954c-6c1be575decc)]
+[scriptable, uuid(cfc33c89-1a7e-4798-a09a-73d28073c1f7)]
 interface nsIDOMHTMLLIElement : nsIDOMHTMLElement
 {
            attribute DOMString           type;
            attribute long                value;
 };
--- a/dom/interfaces/html/nsIDOMHTMLLabelElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLLabelElement.idl
@@ -45,15 +45,15 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(0b4f3766-e6e8-4578-9d4e-f1fb4861c956)]
+[scriptable, uuid(3581e396-92ba-4696-83b4-e633de8fec00)]
 interface nsIDOMHTMLLabelElement : nsIDOMHTMLElement
 {
   readonly attribute nsIDOMHTMLFormElement form;
            attribute DOMString             htmlFor;
   readonly attribute nsIDOMHTMLElement     control;
 };
--- a/dom/interfaces/html/nsIDOMHTMLLegendElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLLegendElement.idl
@@ -45,14 +45,14 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(d84fcdd0-5962-42aa-ab83-dc92321553aa)]
+[scriptable, uuid(e32bab6d-2640-47df-8053-803bb29c69ec)]
 interface nsIDOMHTMLLegendElement : nsIDOMHTMLElement
 {
   readonly attribute nsIDOMHTMLFormElement form;
            attribute DOMString             align;
 };
--- a/dom/interfaces/html/nsIDOMHTMLLinkElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLLinkElement.idl
@@ -45,17 +45,17 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(b60dc7dd-30d1-40aa-a306-02a2ebb30f12)]
+[scriptable, uuid(442dddcc-cdc3-4385-946d-9d6b8b4eb927)]
 interface nsIDOMHTMLLinkElement : nsIDOMHTMLElement
 {
            attribute boolean          disabled;
            attribute DOMString        charset;
            attribute DOMString        href;
            attribute DOMString        hreflang;
            attribute DOMString        media;
            attribute DOMString        rel;
--- a/dom/interfaces/html/nsIDOMHTMLMapElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLMapElement.idl
@@ -45,14 +45,14 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(1fe0dac9-564d-4f20-9933-e77bef7853cc)]
+[scriptable, uuid(0ca121ce-2e78-4c13-8fd3-fea07a1a9225)]
 interface nsIDOMHTMLMapElement : nsIDOMHTMLElement
 {
   readonly attribute nsIDOMHTMLCollection areas;
            attribute DOMString            name;
 };
--- a/dom/interfaces/html/nsIDOMHTMLMediaElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLMediaElement.idl
@@ -52,17 +52,17 @@
 
 // undef the GetCurrentTime macro defined in WinBase.h from the MS Platform SDK
 %{C++
 #ifdef GetCurrentTime
 #undef GetCurrentTime
 #endif
 %}
 
-[scriptable, uuid(16b81ded-30cb-427d-831d-1635dc68d346)]
+[scriptable, uuid(1b38c0a1-e532-41f1-9ec8-c76236d42cb7)]
 interface nsIDOMHTMLMediaElement : nsIDOMHTMLElement
 {
   // error state
   readonly attribute nsIDOMMediaError error;
 
   // network state
            attribute DOMString src;
   readonly attribute DOMString currentSrc;
--- a/dom/interfaces/html/nsIDOMHTMLMenuElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLMenuElement.idl
@@ -45,16 +45,16 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(43aa6818-f67f-420c-a400-59a2668e9fe5)]
+[scriptable, uuid(a9dce2dd-e46a-4e34-ab54-84ed2b4ea338)]
 interface nsIDOMHTMLMenuElement : nsIDOMHTMLElement
 {
            attribute boolean          compact;
 
            attribute DOMString        type;
            attribute DOMString        label;
 };
--- a/dom/interfaces/html/nsIDOMHTMLMenuItemElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLMenuItemElement.idl
@@ -38,12 +38,12 @@
 
 /**
  * The nsIDOMHTMLMenuItemElement interface is the interface to a HTML
  * <menuitem> element.
  *
  * @status UNDER_DEVELOPMENT
  */
 
-[scriptable, uuid(613f28ee-01f5-42dc-8224-161f85f0f20b)]
+[scriptable, uuid(eb28f8a2-047c-4317-bb96-a8c3b8b2047f)]
 interface nsIDOMHTMLMenuItemElement : nsIDOMHTMLCommandElement
 {
 };
--- a/dom/interfaces/html/nsIDOMHTMLMetaElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLMetaElement.idl
@@ -45,16 +45,16 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(43232acb-397c-46ce-8cd7-7fb2c286e851)]
+[scriptable, uuid(9f576967-dfaf-4651-920c-3890bde7629a)]
 interface nsIDOMHTMLMetaElement : nsIDOMHTMLElement
 {
            attribute DOMString        content;
            attribute DOMString        httpEquiv;
            attribute DOMString        name;
            attribute DOMString        scheme;
 };
--- a/dom/interfaces/html/nsIDOMHTMLModElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLModElement.idl
@@ -45,14 +45,14 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(9ee75a83-0acb-42e4-8fe7-dac88fcec547)]
+[scriptable, uuid(19d1a727-9a87-4f3a-985b-15fc7eb99634)]
 interface nsIDOMHTMLModElement : nsIDOMHTMLElement
 {
            attribute DOMString        cite;
            attribute DOMString        dateTime;
 };
--- a/dom/interfaces/html/nsIDOMHTMLOListElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLOListElement.idl
@@ -45,15 +45,15 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(e0bc10a7-46c7-4d6a-99a7-621827594efe)]
+[scriptable, uuid(c162aed0-002d-438b-8fe4-c25043be33f3)]
 interface nsIDOMHTMLOListElement : nsIDOMHTMLElement
 {
            attribute boolean          compact;
            attribute long             start;
            attribute DOMString        type;
 };
--- a/dom/interfaces/html/nsIDOMHTMLObjectElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLObjectElement.idl
@@ -47,17 +47,17 @@
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 interface nsIDOMValidityState;
 
-[scriptable, uuid(700d3c7b-cbc2-4ab4-9aa3-fedd0b09fe89)]
+[scriptable, uuid(f4778b38-f925-4c30-8c4d-9d73e28d74f0)]
 interface nsIDOMHTMLObjectElement : nsIDOMHTMLElement
 {
   readonly attribute nsIDOMHTMLFormElement form;
            attribute DOMString             code;
            attribute DOMString             align;
            attribute DOMString             archive;
            attribute DOMString             border;
            attribute DOMString             codeBase;
--- a/dom/interfaces/html/nsIDOMHTMLOptGroupElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLOptGroupElement.idl
@@ -45,14 +45,14 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(98694f29-5a2a-4da3-8a0f-3351bafe1fea)]
+[scriptable, uuid(4cfc7664-e974-4f80-bb71-5a9878324ff3)]
 interface nsIDOMHTMLOptGroupElement : nsIDOMHTMLElement
 {
            attribute boolean          disabled;
            attribute DOMString        label;
 };
--- a/dom/interfaces/html/nsIDOMHTMLOptionElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLOptionElement.idl
@@ -45,17 +45,17 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(f289fdb9-fe0f-41d3-bbdb-5c4e21f0a4d2)]
+[scriptable, uuid(a36a1710-7684-4fb7-a401-ccbf442064c1)]
 interface nsIDOMHTMLOptionElement : nsIDOMHTMLElement
 {
            attribute boolean               disabled;
   readonly attribute nsIDOMHTMLFormElement form;
            attribute DOMString             label;
            attribute boolean               defaultSelected;
            attribute boolean               selected;
            attribute DOMString             value;
--- a/dom/interfaces/html/nsIDOMHTMLOutputElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLOutputElement.idl
@@ -45,17 +45,17 @@
  * http://www.whatwg.org/specs/web-apps/current-work/#the-output-element
  *
  * @status UNDER_DEVELOPMENT
  */
 
 interface nsIDOMDOMSettableTokenList;
 interface nsIDOMValidityState;
 
-[scriptable, uuid(546ce012-e7ce-4490-8530-75f2b1b135b6)]
+[scriptable, uuid(a930fee7-dd3a-4d57-9ea7-79cfba343fde)]
 interface nsIDOMHTMLOutputElement : nsIDOMHTMLElement
 {
   readonly attribute nsIDOMDOMSettableTokenList htmlFor;
   readonly attribute nsIDOMHTMLFormElement      form;
            attribute DOMString                  name;
 
   readonly attribute DOMString                  type;
            attribute DOMString                  defaultValue;
--- a/dom/interfaces/html/nsIDOMHTMLParagraphElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLParagraphElement.idl
@@ -45,13 +45,13 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(7a324f4d-c264-4978-9d0c-5fdaac33a3ee)]
+[scriptable, uuid(fcc41020-196a-49c4-a73b-b38cbe7c0a8b)]
 interface nsIDOMHTMLParagraphElement : nsIDOMHTMLElement
 {
            attribute DOMString        align;
 };
--- a/dom/interfaces/html/nsIDOMHTMLParamElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLParamElement.idl
@@ -45,16 +45,16 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(20ac93e9-4ac8-40b0-a1f3-38948f6ca6ab)]
+[scriptable, uuid(e7e2ac93-7a44-4c9d-bf4a-4b7231b6e9a8)]
 interface nsIDOMHTMLParamElement : nsIDOMHTMLElement
 {
            attribute DOMString        name;
            attribute DOMString        type;
            attribute DOMString        value;
            attribute DOMString        valueType;
 };
--- a/dom/interfaces/html/nsIDOMHTMLPreElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLPreElement.idl
@@ -45,13 +45,13 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(3459e9d4-40a0-4b55-a018-db287561feab)]
+[scriptable, uuid(ae2ae9b9-86f1-4230-88dc-3317bcb8a375)]
 interface nsIDOMHTMLPreElement : nsIDOMHTMLElement
 {
            attribute long             width;
 };
--- a/dom/interfaces/html/nsIDOMHTMLProgressElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLProgressElement.idl
@@ -42,17 +42,17 @@
  * <progress> element.
  *
  * For more information on this interface, please see
  * http://www.whatwg.org/specs/web-apps/current-work/#the-progress-element
  *
  * @status UNDER_DEVELOPMENT
  */
 
-[scriptable, uuid(d14250f5-3176-4244-8085-1d0a532ce44c)]
+[scriptable, uuid(80f0f2f7-d1f0-457f-b80f-f6d78c8efafc)]
 interface nsIDOMHTMLProgressElement : nsIDOMHTMLElement
 {
            attribute double value;
            attribute double max;
   readonly attribute double position;
   readonly attribute nsIDOMHTMLFormElement form;
   /**
    * The labels attribute will be done with bug 567740.
--- a/dom/interfaces/html/nsIDOMHTMLQuoteElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLQuoteElement.idl
@@ -45,13 +45,13 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(c9c87e61-dc16-47b9-acdd-641dd220557b)]
+[scriptable, uuid(6b53a7c3-8c6e-4a7d-80ac-5241ce8b62f6)]
 interface nsIDOMHTMLQuoteElement : nsIDOMHTMLElement
 {
            attribute DOMString        cite;
 };
--- a/dom/interfaces/html/nsIDOMHTMLScriptElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLScriptElement.idl
@@ -45,17 +45,17 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(c623ecc4-381b-4fa7-9016-a29f0a06230b)]
+[scriptable, uuid(9956c866-08da-45f6-bf9e-6b5d09ce879d)]
 interface nsIDOMHTMLScriptElement : nsIDOMHTMLElement
 {
            attribute DOMString        src;
            attribute boolean          async;
            attribute boolean          defer;
            attribute DOMString        type;
            attribute DOMString        charset;
            attribute DOMString        text;
--- a/dom/interfaces/html/nsIDOMHTMLSelectElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLSelectElement.idl
@@ -48,17 +48,17 @@
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
 interface nsIDOMValidityState;
 
-[scriptable, uuid(069bc0d8-d16d-406a-8555-2f84384c9b3b)]
+[scriptable, uuid(f6e68b8c-58cf-49dd-8d70-de8768ac5bac)]
 interface nsIDOMHTMLSelectElement : nsIDOMHTMLElement
 {
            attribute boolean                     autofocus;
            attribute boolean                     disabled;
   readonly attribute nsIDOMHTMLFormElement       form;
            attribute boolean                     multiple;
            attribute DOMString                   name;
            attribute long                        size;
--- a/dom/interfaces/html/nsIDOMHTMLSourceElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLSourceElement.idl
@@ -43,14 +43,14 @@
  * <source> element.
  *
  * For more information on this interface, please see
  * http://www.whatwg.org/specs/web-apps/current-work/#source
  *
  * @status UNDER_DEVELOPMENT
  */
 
-[scriptable, uuid(ee69ccd4-5216-46cc-bfb4-b612d197ce29)]
+[scriptable, uuid(d2c8c680-d3e7-4306-bced-4cddcbae4485)]
 interface nsIDOMHTMLSourceElement : nsIDOMHTMLElement
 {
            attribute DOMString src;
            attribute DOMString type;
 };
--- a/dom/interfaces/html/nsIDOMHTMLStyleElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLStyleElement.idl
@@ -45,15 +45,15 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(675aff34-07c5-491f-b92f-ccaf616ef8b3)]
+[scriptable, uuid(f456b94c-d1e5-454e-99f1-30099d91c965)]
 interface nsIDOMHTMLStyleElement : nsIDOMHTMLElement
 {
            attribute boolean          disabled;
            attribute DOMString        media;
            attribute DOMString        type;
 };
--- a/dom/interfaces/html/nsIDOMHTMLTableCaptionElem.idl
+++ b/dom/interfaces/html/nsIDOMHTMLTableCaptionElem.idl
@@ -45,13 +45,13 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(0e843cc7-ff12-49b5-8c8d-939dc5b66b6b)]
+[scriptable, uuid(2e8ef4c4-b34b-48ad-937b-9c9a219fa19f)]
 interface nsIDOMHTMLTableCaptionElement : nsIDOMHTMLElement
 {
            attribute DOMString        align;
 };
--- a/dom/interfaces/html/nsIDOMHTMLTableCellElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLTableCellElement.idl
@@ -45,17 +45,17 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(042957a7-8680-4ed4-9a45-40108e73701b)]
+[scriptable, uuid(a3a038e3-9c6e-4a27-bdec-8bfcb968fd94)]
 interface nsIDOMHTMLTableCellElement : nsIDOMHTMLElement
 {
   readonly attribute long             cellIndex;
            attribute DOMString        abbr;
            attribute DOMString        align;
            attribute DOMString        axis;
            attribute DOMString        bgColor;
            attribute DOMString        ch;
--- a/dom/interfaces/html/nsIDOMHTMLTableColElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLTableColElement.idl
@@ -45,17 +45,17 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(b0c8daa0-6b74-4436-b1ca-2de5d6d3fe33)]
+[scriptable, uuid(1baa218e-f772-492c-a286-7c3680e221b3)]
 interface nsIDOMHTMLTableColElement : nsIDOMHTMLElement
 {
            attribute DOMString        align;
            attribute DOMString        ch;
            attribute DOMString        chOff;
            attribute long             span;
            attribute DOMString        vAlign;
            attribute DOMString        width;
--- a/dom/interfaces/html/nsIDOMHTMLTableElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLTableElement.idl
@@ -45,17 +45,17 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(1927df94-db16-4e28-a491-4279eccc539d)]
+[scriptable, uuid(b5211d09-aeec-4dca-a676-c7d4376ab115)]
 interface nsIDOMHTMLTableElement : nsIDOMHTMLElement
 {
   // Modified in DOM Level 2:
            attribute nsIDOMHTMLTableCaptionElement caption;
                                              // raises(DOMException) on setting
 
   // Modified in DOM Level 2:
            attribute nsIDOMHTMLTableSectionElement tHead;
--- a/dom/interfaces/html/nsIDOMHTMLTableRowElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLTableRowElement.idl
@@ -45,17 +45,17 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(0f614ba0-5ee1-494b-ade8-14c29f416798)]
+[scriptable, uuid(637b44fe-229c-4a72-a9e9-ccdb265821ed)]
 interface nsIDOMHTMLTableRowElement : nsIDOMHTMLElement
 {
   // Modified in DOM Level 2:
   readonly attribute long                 rowIndex;
   // Modified in DOM Level 2:
   readonly attribute long                 sectionRowIndex;
   // Modified in DOM Level 2:
   readonly attribute nsIDOMHTMLCollection cells;
--- a/dom/interfaces/html/nsIDOMHTMLTableSectionElem.idl
+++ b/dom/interfaces/html/nsIDOMHTMLTableSectionElem.idl
@@ -45,17 +45,17 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(76400ad3-725a-45c1-bb98-5a6cdb91af11)]
+[scriptable, uuid(698f916c-329e-4aa4-8007-0e1ea708fd8d)]
 interface nsIDOMHTMLTableSectionElement : nsIDOMHTMLElement
 {
            attribute DOMString            align;
            attribute DOMString            ch;
            attribute DOMString            chOff;
            attribute DOMString            vAlign;
   readonly attribute nsIDOMHTMLCollection rows;
   // Modified in DOM Level 2:
--- a/dom/interfaces/html/nsIDOMHTMLTextAreaElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLTextAreaElement.idl
@@ -48,17 +48,17 @@ interface nsIDOMValidityState;
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(43e99aee-e41f-4935-a87d-f2dbafdbfddb)]
+[scriptable, uuid(3fa5ddd0-060e-4de7-835d-0c02cb3f6e79)]
 interface nsIDOMHTMLTextAreaElement : nsIDOMHTMLElement
 {
            attribute boolean               autofocus;
            attribute unsigned long         cols;
            attribute boolean               disabled;
   readonly attribute nsIDOMHTMLFormElement form;
            attribute long                  maxLength;
            attribute DOMString             name;
--- a/dom/interfaces/html/nsIDOMHTMLTitleElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLTitleElement.idl
@@ -45,13 +45,13 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(487748c0-31c0-4985-93c6-588b64f8ed2d)]
+[scriptable, uuid(77e6df52-a4b5-4113-b293-fbceb1be718d)]
 interface nsIDOMHTMLTitleElement : nsIDOMHTMLElement
 {
            attribute DOMString        text;
 };
--- a/dom/interfaces/html/nsIDOMHTMLUListElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLUListElement.idl
@@ -45,14 +45,14 @@
  *
  * This interface is trying to follow the DOM Level 2 HTML specification:
  * http://www.w3.org/TR/DOM-Level-2-HTML/
  *
  * with changes from the work-in-progress WHATWG HTML specification:
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(49610fd6-bf9e-4a13-beb3-09ac74540077)]
+[scriptable, uuid(8a64c035-b4aa-4b6c-b907-eba752e754e3)]
 interface nsIDOMHTMLUListElement : nsIDOMHTMLElement
 {
            attribute boolean          compact;
            attribute DOMString        type;
 };
--- a/dom/interfaces/html/nsIDOMHTMLUnknownElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLUnknownElement.idl
@@ -38,12 +38,12 @@
 #include "nsIDOMHTMLElement.idl"
 
 /**
  * The nsIDOMHTMLUnknownElement interface is the interface to an unknown HTML
  * element.
  *
  * @see <http://www.whatwg.org/html/#htmlunknownelement>
  */
-[scriptable, uuid(9d094117-9937-4ae4-a325-1761d7a9f3bc)]
+[scriptable, uuid(45dfc97e-4ade-41be-b83e-5074003c042c)]
 interface nsIDOMHTMLUnknownElement : nsIDOMHTMLElement
 {
 };
--- a/dom/interfaces/html/nsIDOMHTMLVideoElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLVideoElement.idl
@@ -43,17 +43,17 @@
  * <video> element.
  *
  * For more information on this interface, please see
  * http://www.whatwg.org/specs/web-apps/current-work/#video
  *
  * @status UNDER_DEVELOPMENT
  */
 
-[scriptable, uuid(00c757ec-db7b-477e-95cd-b2a03b0f8634)]
+[scriptable, uuid(bebdbca4-05be-480a-bfb9-949fc7ff793f)]
 interface nsIDOMHTMLVideoElement : nsIDOMHTMLMediaElement
 {
            attribute long width; 
            attribute long height;
   readonly attribute unsigned long videoWidth;
   readonly attribute unsigned long videoHeight;
            attribute DOMString poster;
            
--- a/dom/interfaces/svg/nsIDOMSVGAElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGAElement.idl
@@ -39,17 +39,17 @@
 
 /**
  * For more information on this interface please see
  * http://www.w3.org/TR/SVG/linking.html#AElement
  */
 
 interface nsIDOMSVGAnimatedString;
 
-[scriptable, uuid(4b1c2d6b-71c2-4dd0-96fc-84c1872786ce)]
+[scriptable, uuid(139491ec-3bc2-490e-bce6-ec1b1b5aeaf9)]
 interface nsIDOMSVGAElement
   : nsIDOMSVGElement
 /*
   The SVG DOM makes use of multiple interface inheritance.
   Since XPCOM only supports single interface inheritance,
   the best thing that we can do is to promise that whenever
   an object implements _this_ interface it will also
   implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGAltGlyphElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGAltGlyphElement.idl
@@ -30,17 +30,17 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGTextPositionElem.idl"
 
-[scriptable, uuid(f624c6ea-ced6-404a-b8a0-5f67a4d86bce)]
+[scriptable, uuid(9cfd33f4-0720-4e9f-977e-7a1fe72d23c9)]
 interface nsIDOMSVGAltGlyphElement : nsIDOMSVGTextPositioningElement
 /*
         The SVG DOM makes use of multiple interface inheritance.
         Since XPCOM only supports single interface inheritance,
         the best thing that we can do is to promise that whenever
         an object implements _this_ interface it will also
         implement the following interfaces. (We then have to QI to
         hop between them.)
--- a/dom/interfaces/svg/nsIDOMSVGAnimateElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGAnimateElement.idl
@@ -32,10 +32,10 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGAnimationElement.idl"
 
-[scriptable, uuid(0c4297e8-68d0-471d-a933-64132ccc5b97)]
+[scriptable, uuid(fb2484e8-3d50-471b-87dd-3aa70a436b71)]
 interface nsIDOMSVGAnimateElement : nsIDOMSVGAnimationElement {};
--- a/dom/interfaces/svg/nsIDOMSVGAnimateMotionElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGAnimateMotionElement.idl
@@ -32,10 +32,10 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGAnimationElement.idl"
 
-[scriptable, uuid(8ac8b152-a44f-4456-bda5-b004f8148a93)]
+[scriptable, uuid(2216f319-1bea-489c-b025-2e1f5217f0cd)]
 interface nsIDOMSVGAnimateMotionElement : nsIDOMSVGAnimationElement { };
--- a/dom/interfaces/svg/nsIDOMSVGAnimateTransformElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGAnimateTransformElement.idl
@@ -32,10 +32,10 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGAnimationElement.idl"
 
-[scriptable, uuid(735e0f75-c6aa-4aee-bcd2-46426d6ac90c)]
+[scriptable, uuid(381c61a0-3af4-46be-99c4-db5253efccd9)]
 interface nsIDOMSVGAnimateTransformElement : nsIDOMSVGAnimationElement {};
--- a/dom/interfaces/svg/nsIDOMSVGAnimationElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGAnimationElement.idl
@@ -32,17 +32,17 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGElement.idl"
 
-[scriptable, uuid(4e04c285-80c2-42a2-979f-3786ba42acf5)]
+[scriptable, uuid(ed76a4bc-7817-4724-b89c-1a06ca36dc08)]
 interface nsIDOMSVGAnimationElement
   : nsIDOMSVGElement
 /*
         The SVG DOM makes use of multiple interface inheritance.
         Since XPCOM only supports single interface inheritance,
         the best thing that we can do is to promise that whenever
         an object implements _this_ interface it will also
         implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGCircleElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGCircleElement.idl
@@ -35,17 +35,17 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGElement.idl"
 
 interface nsIDOMSVGAnimatedLength;
 
-[scriptable, uuid(db2ba352-d0b2-49fd-859e-64624ad557bc)]
+[scriptable, uuid(eea07241-beed-442e-ba0d-9a8f534a70e8)]
 interface nsIDOMSVGCircleElement
   : nsIDOMSVGElement
 /*
         The SVG DOM makes use of multiple interface inheritance.
         Since XPCOM only supports single interface inheritance,
         the best thing that we can do is to promise that whenever
         an object implements _this_ interface it will also
         implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGClipPathElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGClipPathElement.idl
@@ -42,17 +42,17 @@
  *
  * For more information on this interface please see
  * http://www.w3.org/TR/SVG11/masking.html
  *
  */
 
 interface nsIDOMSVGAnimatedEnumeration;
 
-[scriptable, uuid(3dd19de9-deee-4105-9c5c-c51c68b31326)]
+[scriptable, uuid(91147786-14f3-4567-b926-7e69e0228c03)]
 interface nsIDOMSVGClipPathElement
   : nsIDOMSVGElement
 /*
   The SVG DOM makes use of multiple interface inheritance.
   Since XPCOM only supports single interface inheritance,
   the best thing that we can do is to promise that whenever
   an object implements _this_ interface it will also
   implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGDefsElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGDefsElement.idl
@@ -33,17 +33,17 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGElement.idl"
 
-[scriptable, uuid(649d4045-57d0-4937-a19b-e9d52e306a2b)]
+[scriptable, uuid(26d55016-c8a7-428b-ad39-61d1597b5df7)]
 interface nsIDOMSVGDefsElement
   : nsIDOMSVGElement
 /*
   The SVG DOM makes use of multiple interface inheritance.
   Since XPCOM only supports single interface inheritance,
   the best thing that we can do is to promise that whenever
   an object implements _this_ interface it will also
   implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGDescElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGDescElement.idl
@@ -33,17 +33,17 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGElement.idl"
 
-[scriptable, uuid(6c867f82-13b5-4237-a653-d4a21d5d3d0b)]
+[scriptable, uuid(ade2ccfe-2858-46ed-b8a4-bc302d226c5c)]
 interface nsIDOMSVGDescElement
   : nsIDOMSVGElement
 /*
   The SVG DOM makes use of multiple interface inheritance.
   Since XPCOM only supports single interface inheritance,
   the best thing that we can do is to promise that whenever
   an object implements _this_ interface it will also
   implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGDocument.idl
+++ b/dom/interfaces/svg/nsIDOMSVGDocument.idl
@@ -34,15 +34,15 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMDocument.idl"
 
 interface nsIDOMSVGSVGElement;
 
-[scriptable, uuid(880e6976-844c-4614-99db-a580790231eb)]
+[scriptable, uuid(4ac55dee-ce7f-465d-a27c-ecc293ae35db)]
 interface nsIDOMSVGDocument : nsIDOMDocument
 {
   readonly attribute DOMString domain;
   readonly attribute DOMString URL;
   readonly attribute nsIDOMSVGSVGElement rootElement;
 };
--- a/dom/interfaces/svg/nsIDOMSVGElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGElement.idl
@@ -35,16 +35,16 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMElement.idl"
 
 interface nsIDOMSVGSVGElement;
 
-[scriptable, uuid(c358d048-be72-4d39-93dc-0e85b8c9f07b)]
+[scriptable, uuid(aee43575-391a-4b3f-81ce-7283d228a6c3)]
 interface nsIDOMSVGElement : nsIDOMElement 
 { 
   attribute DOMString id;
             // raises DOMException on setting
   readonly attribute nsIDOMSVGSVGElement ownerSVGElement;
   readonly attribute nsIDOMSVGElement    viewportElement;
 };
--- a/dom/interfaces/svg/nsIDOMSVGEllipseElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGEllipseElement.idl
@@ -35,17 +35,17 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGElement.idl"
 
 interface nsIDOMSVGAnimatedLength;
 
-[scriptable, uuid(2e1af4ae-5d46-4b0c-8d69-624eca05c831)]
+[scriptable, uuid(ffe5fe9f-0dbd-457a-898a-bc0b0d0de923)]
 interface nsIDOMSVGEllipseElement
   : nsIDOMSVGElement
 /*
         The SVG DOM makes use of multiple interface inheritance.
         Since XPCOM only supports single interface inheritance,
         the best thing that we can do is to promise that whenever
         an object implements _this_ interface it will also
         implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGFilterElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGFilterElement.idl
@@ -35,17 +35,17 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGElement.idl"
 
 interface nsIDOMSVGAnimatedLength;
 interface nsIDOMSVGAnimatedEnumeration;
 interface nsIDOMSVGAnimatedInteger;
 
-[scriptable, uuid(56606fdd-9b9e-4b91-a34a-9504af3139dd)]
+[scriptable, uuid(65f0b91a-13c3-44a8-aa97-6d80c788c5af)]
 interface nsIDOMSVGFilterElement
   : nsIDOMSVGElement
 /*
         The SVG DOM makes use of multiple interface inheritance.
         Since XPCOM only supports single interface inheritance,
         the best thing that we can do is to promise that whenever
         an object implements _this_ interface it will also
         implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGFilters.idl
+++ b/dom/interfaces/svg/nsIDOMSVGFilters.idl
@@ -40,63 +40,63 @@
 interface nsIDOMSVGAnimatedLength;
 interface nsIDOMSVGAnimatedString;
 interface nsIDOMSVGAnimatedNumber;
 interface nsIDOMSVGAnimatedEnumeration;
 interface nsIDOMSVGAnimatedNumberList;
 interface nsIDOMSVGAnimatedInteger;
 interface nsIDOMSVGAnimatedBoolean;
 
-[scriptable, uuid(8ec9c323-10dd-45ef-a301-4ecb9ec414dd)]
+[scriptable, uuid(e5ed442b-a208-41cd-8494-9670d9a19023)]
 interface nsIDOMSVGFilterPrimitiveStandardAttributes : nsIDOMSVGElement
 { 
     readonly attribute nsIDOMSVGAnimatedLength      x;
     readonly attribute nsIDOMSVGAnimatedLength      y;
     readonly attribute nsIDOMSVGAnimatedLength      width;
     readonly attribute nsIDOMSVGAnimatedLength      height;
     readonly attribute nsIDOMSVGAnimatedString      result;
 };
 
-[scriptable, uuid(1644ea2b-8fdb-492d-a858-850b7bb570ed)]
+[scriptable, uuid(e3538ea5-625d-485e-a902-ea6b60d47047)]
 interface nsIDOMSVGFEBlendElement : nsIDOMSVGFilterPrimitiveStandardAttributes
 {
     const unsigned short SVG_MODE_UNKNOWN   = 0;
     const unsigned short SVG_MODE_NORMAL    = 1;
     const unsigned short SVG_MODE_MULTIPLY  = 2;
     const unsigned short SVG_MODE_SCREEN    = 3;
     const unsigned short SVG_MODE_DARKEN    = 4;
     const unsigned short SVG_MODE_LIGHTEN   = 5;
 
     readonly attribute nsIDOMSVGAnimatedString        in1;
     readonly attribute nsIDOMSVGAnimatedString        in2;
     readonly attribute nsIDOMSVGAnimatedEnumeration   mode;
 };
 
-[scriptable, uuid(94d552df-87ea-4eaf-8618-5de29a7a9dbe)]
+[scriptable, uuid(67415934-e859-4408-aec7-e3bccf3a85c5)]
 interface nsIDOMSVGFEColorMatrixElement : nsIDOMSVGFilterPrimitiveStandardAttributes
 {
     // Color Matrix Types
     const unsigned short SVG_FECOLORMATRIX_TYPE_UNKNOWN            = 0;
     const unsigned short SVG_FECOLORMATRIX_TYPE_MATRIX             = 1;
     const unsigned short SVG_FECOLORMATRIX_TYPE_SATURATE           = 2;
     const unsigned short SVG_FECOLORMATRIX_TYPE_HUE_ROTATE         = 3;
     const unsigned short SVG_FECOLORMATRIX_TYPE_LUMINANCE_TO_ALPHA = 4;
 
     readonly attribute nsIDOMSVGAnimatedString in1;
     readonly attribute nsIDOMSVGAnimatedEnumeration type;
     readonly attribute nsIDOMSVGAnimatedNumberList  values;
 };
 
-[scriptable, uuid(2871a5c9-d4e5-420c-910c-c98fc2e8cad1)]
+[scriptable, uuid(75159f44-2f78-4d4d-8136-a6c23070f187)]
 interface nsIDOMSVGFEComponentTransferElement : nsIDOMSVGFilterPrimitiveStandardAttributes
 {
     readonly attribute nsIDOMSVGAnimatedString in1;
 };
 
-[scriptable, uuid(1620e78a-cb9d-44ad-99f3-732168a403e6)]
+[scriptable, uuid(819d470b-9d0d-40c6-8379-acaa026bdbac)]
 interface nsIDOMSVGComponentTransferFunctionElement : nsIDOMSVGElement
 {
     // Component Transfer Types
     const unsigned short SVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN  = 0;
     const unsigned short SVG_FECOMPONENTTRANSFER_TYPE_IDENTITY = 1;
     const unsigned short SVG_FECOMPONENTTRANSFER_TYPE_TABLE    = 2;
     const unsigned short SVG_FECOMPONENTTRANSFER_TYPE_DISCRETE = 3;
     const unsigned short SVG_FECOMPONENTTRANSFER_TYPE_LINEAR   = 4;
@@ -106,17 +106,17 @@ interface nsIDOMSVGComponentTransferFunc
     readonly attribute nsIDOMSVGAnimatedNumberList  tableValues;
     readonly attribute nsIDOMSVGAnimatedNumber      slope;
     readonly attribute nsIDOMSVGAnimatedNumber      intercept;
     readonly attribute nsIDOMSVGAnimatedNumber      amplitude;
     readonly attribute nsIDOMSVGAnimatedNumber      exponent;
     readonly attribute nsIDOMSVGAnimatedNumber      offset;
 };
 
-[scriptable, uuid(12c63fba-b0f9-41ee-ad57-573650ebde89)]
+[scriptable, uuid(5566215e-fbbd-4a65-975b-32f900ff593e)]
 interface nsIDOMSVGFECompositeElement : nsIDOMSVGFilterPrimitiveStandardAttributes
 {
     // Operator Types
     const unsigned short SVG_OPERATOR_UNKNOWN    = 0;
     const unsigned short SVG_OPERATOR_OVER       = 1;
     const unsigned short SVG_OPERATOR_IN         = 2;
     const unsigned short SVG_OPERATOR_OUT        = 3;
     const unsigned short SVG_OPERATOR_ATOP       = 4;
@@ -130,75 +130,75 @@ interface nsIDOMSVGFECompositeElement : 
     readonly attribute nsIDOMSVGAnimatedNumber  k3;
     readonly attribute nsIDOMSVGAnimatedNumber  k4;
     readonly attribute nsIDOMSVGAnimatedEnumeration operator;
     
     void setK ( in float k1, in float k2, in float k3, in float k4 );
 
 };
 
-[scriptable, uuid(f13456d1-04b9-45cb-9fbf-fc733d6a0279)]
+[scriptable, uuid(652da357-e3e3-4398-bc08-8dedd24fafba)]
 interface nsIDOMSVGFEFuncRElement : nsIDOMSVGComponentTransferFunctionElement
 {
 };
 
-[scriptable, uuid(05709de9-e3a9-43c1-a820-585c3f4694be)]
+[scriptable, uuid(d525c67b-0b22-4037-936c-477d0cba2279)]
 interface nsIDOMSVGFEFuncGElement : nsIDOMSVGComponentTransferFunctionElement
 {
 };
 
-[scriptable, uuid(7ed53e92-f831-4e5c-bdd4-ab769e27587e)]
+[scriptable, uuid(157a90f8-018e-4f6c-afed-4083f1062643)]
 interface nsIDOMSVGFEFuncBElement : nsIDOMSVGComponentTransferFunctionElement
 {
 };
 
-[scriptable, uuid(30893867-f167-4238-bec2-fb0a65cdf779)]
+[scriptable, uuid(8b3f860a-3cdc-4495-87fe-99adb5845a91)]
 interface nsIDOMSVGFEFuncAElement : nsIDOMSVGComponentTransferFunctionElement
 {
 };
 
-[scriptable, uuid(66a74ea4-5504-4a8b-9c3a-b0438615f15e)]
+[scriptable, uuid(c0dba6ef-014a-4b90-9f57-f6b52a624738)]
 interface nsIDOMSVGFEGaussianBlurElement : nsIDOMSVGFilterPrimitiveStandardAttributes
 { 
     readonly attribute nsIDOMSVGAnimatedString in1;
     readonly attribute nsIDOMSVGAnimatedNumber stdDeviationX;
     readonly attribute nsIDOMSVGAnimatedNumber stdDeviationY;
 
     void setStdDeviation ( in float stdDeviationX, in float stdDeviationY );
 };
 
-[scriptable, uuid(9932eb32-dee0-4848-b0a5-a6c0dfd21182)]
+[scriptable, uuid(147077be-9b75-487f-9c6a-b941d797dc6d)]
 interface nsIDOMSVGFEMergeElement : nsIDOMSVGFilterPrimitiveStandardAttributes
 {
 };
 
-[scriptable, uuid(695a89c2-8eab-4ddd-94e7-509bf2a4f6e8)]
+[scriptable, uuid(ca45efa5-f3d5-4160-ae5e-8c6a6c80b308)]
 interface nsIDOMSVGFEMergeNodeElement : nsIDOMSVGElement { 
     readonly attribute nsIDOMSVGAnimatedString in1;
 };
 
-[scriptable, uuid(15acdbf5-6203-4167-b7c1-c746f5dd2478)]
+[scriptable, uuid(5ce4bdf0-6ef5-41b8-8be6-d936c88dfbb5)]
 interface nsIDOMSVGFEOffsetElement : nsIDOMSVGFilterPrimitiveStandardAttributes { 
     readonly attribute nsIDOMSVGAnimatedString in1;
     readonly attribute nsIDOMSVGAnimatedNumber dx;
     readonly attribute nsIDOMSVGAnimatedNumber dy;
 };
 
-[scriptable, uuid(cf267d0d-813a-4c67-be8e-e65937afba21)]
+[scriptable, uuid(74c74158-4feb-4a8a-8c6e-f986dd46ae97)]
 interface nsIDOMSVGFEFloodElement : nsIDOMSVGFilterPrimitiveStandardAttributes
 {
 };
 
-[scriptable, uuid(380da0f2-f2f5-457e-a79d-7fab3da1eefb)]
+[scriptable, uuid(40b9b789-b852-4297-8fc7-f9e9f1be1cbc)]
 interface nsIDOMSVGFETileElement : nsIDOMSVGFilterPrimitiveStandardAttributes
 {
     readonly attribute nsIDOMSVGAnimatedString in1;
 };
 
-[scriptable, uuid(20d41b65-e433-4742-b9e1-08238b139285)]
+[scriptable, uuid(6afc9962-fcba-4300-9dde-89faad74f2e9)]
 interface nsIDOMSVGFETurbulenceElement : nsIDOMSVGFilterPrimitiveStandardAttributes
 { 
     // Turbulence Types
     const unsigned short SVG_TURBULENCE_TYPE_UNKNOWN      = 0;
     const unsigned short SVG_TURBULENCE_TYPE_FRACTALNOISE = 1;
     const unsigned short SVG_TURBULENCE_TYPE_TURBULENCE   = 2;
     // Stitch Options
     const unsigned short SVG_STITCHTYPE_UNKNOWN  = 0;
@@ -208,33 +208,33 @@ interface nsIDOMSVGFETurbulenceElement :
     readonly attribute nsIDOMSVGAnimatedNumber      baseFrequencyX;
     readonly attribute nsIDOMSVGAnimatedNumber      baseFrequencyY;
     readonly attribute nsIDOMSVGAnimatedInteger     numOctaves;
     readonly attribute nsIDOMSVGAnimatedNumber      seed;
     readonly attribute nsIDOMSVGAnimatedEnumeration stitchTiles;
     readonly attribute nsIDOMSVGAnimatedEnumeration type;
 };
 
-[scriptable, uuid(83508db0-be38-4929-8e91-7cfddb921f4a)]
+[scriptable, uuid(1aa777de-4dbb-4cf7-820e-46b2bbadeaa2)]
 interface nsIDOMSVGFEMorphologyElement : nsIDOMSVGFilterPrimitiveStandardAttributes
 { 
     // Operator Types
     const unsigned short SVG_OPERATOR_UNKNOWN  = 0;
     const unsigned short SVG_OPERATOR_ERODE    = 1;
     const unsigned short SVG_OPERATOR_DILATE   = 2;
 
     readonly attribute nsIDOMSVGAnimatedString      in1;
     readonly attribute nsIDOMSVGAnimatedNumber      radiusX;
     readonly attribute nsIDOMSVGAnimatedNumber      radiusY;
     readonly attribute nsIDOMSVGAnimatedEnumeration operator;
     
     void setRadius ( in float rx, in float ry );
 };
 
-[scriptable, uuid(5232e1f6-6845-4c29-9677-93852228ab2f)]
+[scriptable, uuid(db6b7ac9-1511-452c-8575-8d87b995c97f)]
 interface nsIDOMSVGFEConvolveMatrixElement : nsIDOMSVGFilterPrimitiveStandardAttributes
 { 
     // Edge Mode Values
     const unsigned short SVG_EDGEMODE_UNKNOWN   = 0;
     const unsigned short SVG_EDGEMODE_DUPLICATE = 1;
     const unsigned short SVG_EDGEMODE_WRAP      = 2;
     const unsigned short SVG_EDGEMODE_NONE      = 3;
 
@@ -247,73 +247,73 @@ interface nsIDOMSVGFEConvolveMatrixEleme
     readonly attribute nsIDOMSVGAnimatedInteger     targetX;
     readonly attribute nsIDOMSVGAnimatedInteger     targetY;
     readonly attribute nsIDOMSVGAnimatedEnumeration edgeMode;
     readonly attribute nsIDOMSVGAnimatedNumber      kernelUnitLengthX;
     readonly attribute nsIDOMSVGAnimatedNumber      kernelUnitLengthY;
     readonly attribute nsIDOMSVGAnimatedBoolean     preserveAlpha;
 };
 
-[scriptable, uuid(3834f5f7-bb9b-4ba4-9de5-6b12bca6fb46)]
+[scriptable, uuid(ab84cbd9-bb0f-447b-a3a5-0a149bed151d)]
 interface nsIDOMSVGFEDiffuseLightingElement :  nsIDOMSVGFilterPrimitiveStandardAttributes
 { 
   readonly attribute nsIDOMSVGAnimatedString in1;
   readonly attribute nsIDOMSVGAnimatedNumber surfaceScale;
   readonly attribute nsIDOMSVGAnimatedNumber diffuseConstant;
   readonly attribute nsIDOMSVGAnimatedNumber kernelUnitLengthX;
   readonly attribute nsIDOMSVGAnimatedNumber kernelUnitLengthY;
 };
 
-[scriptable, uuid(3e60f5df-f77a-4fe2-bcad-881865cfc21f)]
+[scriptable, uuid(088715b7-7592-47d1-a838-d4b98d349554)]
 interface nsIDOMSVGFESpecularLightingElement : nsIDOMSVGFilterPrimitiveStandardAttributes
 { 
   readonly attribute nsIDOMSVGAnimatedString in1;
   readonly attribute nsIDOMSVGAnimatedNumber surfaceScale;
   readonly attribute nsIDOMSVGAnimatedNumber specularConstant;
   readonly attribute nsIDOMSVGAnimatedNumber specularExponent;
   readonly attribute nsIDOMSVGAnimatedNumber kernelUnitLengthX;
   readonly attribute nsIDOMSVGAnimatedNumber kernelUnitLengthY;
 };
 
-[scriptable, uuid(02141672-7f2c-412a-a7d7-4caa194842e9)]
+[scriptable, uuid(2a3d954d-bc5a-4732-8f72-5030dae9de48)]
 interface nsIDOMSVGFEDistantLightElement : nsIDOMSVGElement { 
   readonly attribute nsIDOMSVGAnimatedNumber azimuth;
   readonly attribute nsIDOMSVGAnimatedNumber elevation;
 };
 
-[scriptable, uuid(557f128a-026b-4fa8-a44c-605df7bfd62e)]
+[scriptable, uuid(b225e777-d585-4a15-a40d-856d9d3afcfd)]
 interface nsIDOMSVGFEPointLightElement : nsIDOMSVGElement { 
   readonly attribute nsIDOMSVGAnimatedNumber x;
   readonly attribute nsIDOMSVGAnimatedNumber y;
   readonly attribute nsIDOMSVGAnimatedNumber z;
 };
 
-[scriptable, uuid(5515dd05-3d9d-4d6c-8460-a04aaf5afe15)]
+[scriptable, uuid(d7a342bf-ad29-46d0-bc50-43d4ee1202a9)]
 interface nsIDOMSVGFESpotLightElement : nsIDOMSVGElement { 
   readonly attribute nsIDOMSVGAnimatedNumber x;
   readonly attribute nsIDOMSVGAnimatedNumber y;
   readonly attribute nsIDOMSVGAnimatedNumber z;
   readonly attribute nsIDOMSVGAnimatedNumber pointsAtX;
   readonly attribute nsIDOMSVGAnimatedNumber pointsAtY;
   readonly attribute nsIDOMSVGAnimatedNumber pointsAtZ;
   readonly attribute nsIDOMSVGAnimatedNumber specularExponent;
   readonly attribute nsIDOMSVGAnimatedNumber limitingConeAngle;
 };
 
-[scriptable, uuid(d36089cf-ade0-48e8-9540-40ee35838f88)]
+[scriptable, uuid(4ffbfc41-92e8-467e-b63e-8a998f31a5e6)]
 interface nsIDOMSVGFEImageElement : nsIDOMSVGFilterPrimitiveStandardAttributes
 /*
   nsIDOMSVGURIReference,
   nsIDOMSVGLangSpace,
   nsIDOMSVGExternalResourcesRequired
 */
 {
 };
 
-[scriptable, uuid(821533e9-9da9-4ea4-8d53-5fb9170fa952)]
+[scriptable, uuid(bdda2dda-14d1-4c97-a1d6-95558d50d902)]
 interface nsIDOMSVGFEDisplacementMapElement : nsIDOMSVGFilterPrimitiveStandardAttributes
 {
   // Channel Selectors
   const unsigned short SVG_CHANNEL_UNKNOWN = 0;
   const unsigned short SVG_CHANNEL_R       = 1;
   const unsigned short SVG_CHANNEL_G       = 2;
   const unsigned short SVG_CHANNEL_B       = 3;
   const unsigned short SVG_CHANNEL_A       = 4;
--- a/dom/interfaces/svg/nsIDOMSVGForeignObjectElem.idl
+++ b/dom/interfaces/svg/nsIDOMSVGForeignObjectElem.idl
@@ -35,17 +35,17 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGElement.idl"
 
 interface nsIDOMSVGAnimatedLength;
 
-[scriptable, uuid(a093460b-e3d0-4914-aa60-a4b31aa53276)]
+[scriptable, uuid(e8560e00-3833-4afd-aee9-13dae48ccb25)]
 interface nsIDOMSVGForeignObjectElement
   : nsIDOMSVGElement
 /*
   The SVG DOM makes use of multiple interface inheritance.
   Since XPCOM only supports single interface inheritance,
   the best thing that we can do is to promise that whenever
   an object implements _this_ interface it will also
   implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGGElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGGElement.idl
@@ -33,17 +33,17 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGElement.idl"
 
-[scriptable, uuid(86317234-cf55-4ff0-8fed-de48557ae82e)]
+[scriptable, uuid(3bc7b279-d21a-4d04-acb0-d68331924a8c)]
 interface nsIDOMSVGGElement
   : nsIDOMSVGElement
 /*
   The SVG DOM makes use of multiple interface inheritance.
   Since XPCOM only supports single interface inheritance,
   the best thing that we can do is to promise that whenever
   an object implements _this_ interface it will also
   implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGGradientElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGGradientElement.idl
@@ -45,17 +45,17 @@
  * For more information on this interface please see
  * http://www.w3.org/TR/SVG11/pservers.html
  *
  */
 
 interface nsIDOMSVGAnimatedEnumeration;
 interface nsIDOMSVGAnimatedTransformList;
 
-[scriptable, uuid(8114186f-29ef-4642-b4e2-762f331661e5)]
+[scriptable, uuid(5b227fb5-1f03-4490-bafe-a3c3037e3165)]
 interface nsIDOMSVGGradientElement
   : nsIDOMSVGElement
 /*
         The SVG DOM makes use of multiple interface inheritance.
         Since XPCOM only supports single interface inheritance,
         the best thing that we can do is to promise that whenever
         an object implements _this_ interface it will also
         implement the following interfaces. (We then have to QI to
@@ -83,17 +83,17 @@ interface nsIDOMSVGGradientElement
  * For more information on this interface please see
  * http://www.w3.org/TR/SVG11/pservers.html
  *
  */
 
 // Linear gradient
 interface nsIDOMSVGAnimatedLength;
 
-[scriptable, uuid(44e59baf-4ca5-48af-9749-69b30be11917)]
+[scriptable, uuid(d6a1bf9f-80e8-4110-9dcd-50ecf0c3f120)]
 interface nsIDOMSVGLinearGradientElement
   : nsIDOMSVGGradientElement
 { 
   readonly attribute nsIDOMSVGAnimatedLength x1;
   readonly attribute nsIDOMSVGAnimatedLength y1;
   readonly attribute nsIDOMSVGAnimatedLength x2;
   readonly attribute nsIDOMSVGAnimatedLength y2;
 };
@@ -105,17 +105,17 @@ interface nsIDOMSVGLinearGradientElement
  * For more information on this interface please see
  * http://www.w3.org/TR/SVG11/pservers.html
  *
  */
 
 // Radial gradient
 interface nsIDOMSVGAnimatedLength;
 
-[scriptable, uuid(67d79c33-76b6-421a-a7ff-bb6793a4fd46)]
+[scriptable, uuid(e2bedf79-8eed-4884-9c16-c0efe03dc087)]
 interface nsIDOMSVGRadialGradientElement
   : nsIDOMSVGGradientElement
 { 
   readonly attribute nsIDOMSVGAnimatedLength cx;
   readonly attribute nsIDOMSVGAnimatedLength cy;
   readonly attribute nsIDOMSVGAnimatedLength r;
   readonly attribute nsIDOMSVGAnimatedLength fx;
   readonly attribute nsIDOMSVGAnimatedLength fy;
--- a/dom/interfaces/svg/nsIDOMSVGImageElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGImageElement.idl
@@ -36,17 +36,17 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGElement.idl"
 
 interface nsIDOMSVGAnimatedLength;
 interface nsIDOMSVGAnimatedPreserveAspectRatio;
 
-[scriptable, uuid(aaf4a4a5-7016-47ca-b61d-47ec9152fc14)]
+[scriptable, uuid(5898ffca-d692-46ca-ae23-3c8bd2c86f89)]
 interface nsIDOMSVGImageElement
   : nsIDOMSVGElement
 /*
         The SVG DOM makes use of multiple interface inheritance.
         Since XPCOM only supports single interface inheritance,
         the best thing that we can do is to promise that whenever
         an object implements _this_ interface it will also
         implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGLineElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGLineElement.idl
@@ -35,17 +35,17 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGElement.idl"
 
 interface nsIDOMSVGAnimatedLength;
 
-[scriptable, uuid(edee1921-78ca-49b7-94f8-261942bf320d)]
+[scriptable, uuid(c0642946-2144-4d4d-a0ff-07fffb4e69be)]
 interface nsIDOMSVGLineElement
   : nsIDOMSVGElement
 /*
         The SVG DOM makes use of multiple interface inheritance.
         Since XPCOM only supports single interface inheritance,
         the best thing that we can do is to promise that whenever
         an object implements _this_ interface it will also
         implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGMarkerElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGMarkerElement.idl
@@ -46,17 +46,17 @@ interface nsIDOMSVGMatrix;
 /**
  * The nsIDOMSVGMarker interface is the interface to an SVG marker element.
  *
  * For more information on this interface please see
  * http://www.w3.org/TR/SVG11/painting.html#InterfaceSVGMarkerElement
  *
  */
 
-[scriptable, uuid(12e79be1-eac1-49b8-b644-d617445ae2b1)]
+[scriptable, uuid(7e1bea71-de48-4cba-850f-9bfb13d9a5ed)]
 interface nsIDOMSVGMarkerElement
   : nsIDOMSVGElement
 /*
         The SVG DOM makes use of multiple interface inheritance.
         Since XPCOM only supports single interface inheritance,
         the best thing that we can do is to promise that whenever
         an object implements _this_ interface it will also
         implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGMaskElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGMaskElement.idl
@@ -34,17 +34,17 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGElement.idl"
 
 interface nsIDOMSVGAnimatedLength;
 interface nsIDOMSVGAnimatedEnumeration;
 
-[scriptable, uuid(9ec463fe-84d5-404b-9078-2e693e183b48)]
+[scriptable, uuid(00e0d565-8af2-4e68-a582-e71b5143b96f)]
 interface nsIDOMSVGMaskElement
   : nsIDOMSVGElement
 /*
         The SVG DOM makes use of multiple interface inheritance.
         Since XPCOM only supports single interface inheritance,
         the best thing that we can do is to promise that whenever
         an object implements _this_ interface it will also
         implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGMetadataElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGMetadataElement.idl
@@ -33,13 +33,13 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGElement.idl"
 
-[scriptable, uuid(a772c8e6-2755-4864-b249-b4a03c7554b4)]
+[scriptable, uuid(f7db9b55-68f6-44c6-89f0-d1190117bf56)]
 interface nsIDOMSVGMetadataElement
   : nsIDOMSVGElement
 {
 };
--- a/dom/interfaces/svg/nsIDOMSVGMpathElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGMpathElement.idl
@@ -38,17 +38,17 @@
 
 #include "nsIDOMSVGElement.idl"
 
 /**
  * For more information on this interface please see
  * http://www.w3.org/TR/SVG/animate.html#mpathElement
  */
 
-[scriptable, uuid(39b7550c-26f7-475b-9ac5-a013935d0e60)]
+[scriptable, uuid(4e082ca3-3b06-4996-9e91-dca422f98473)]
 interface nsIDOMSVGMpathElement
   : nsIDOMSVGElement
 /*
   The SVG DOM makes use of multiple interface inheritance.
   Since XPCOM only supports single interface inheritance,
   the best thing that we can do is to promise that whenever
   an object implements _this_ interface it will also
   implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGPathElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGPathElement.idl
@@ -55,17 +55,17 @@ interface nsIDOMSVGPathSegLinetoHorizont
 interface nsIDOMSVGPathSegLinetoHorizontalRel;
 interface nsIDOMSVGPathSegLinetoVerticalAbs;
 interface nsIDOMSVGPathSegLinetoVerticalRel;
 interface nsIDOMSVGPathSegCurvetoCubicSmoothAbs;
 interface nsIDOMSVGPathSegCurvetoCubicSmoothRel;
 interface nsIDOMSVGPathSegCurvetoQuadraticSmoothAbs;
 interface nsIDOMSVGPathSegCurvetoQuadraticSmoothRel;
 
-[scriptable, uuid(d1a8894f-9fb1-43e8-b0a0-f8e4a416a505)]
+[scriptable, uuid(bb09822e-c8a7-4a76-b282-b9609a8c5bdd)]
 interface nsIDOMSVGPathElement
   : nsIDOMSVGElement
 /*
         The SVG DOM makes use of multiple interface inheritance.
         Since XPCOM only supports single interface inheritance,
         the best thing that we can do is to promise that whenever
         an object implements _this_ interface it will also
         implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGPatternElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGPatternElement.idl
@@ -46,17 +46,17 @@
  * http://www.w3.org/TR/SVG11/pservers.html
  *
  */
 
 interface nsIDOMSVGAnimatedEnumeration;
 interface nsIDOMSVGAnimatedTransformList;
 interface nsIDOMSVGAnimatedLength;
 
-[scriptable, uuid(962bbf20-7925-4e24-9ae5-ce3a5a39a191)]
+[scriptable, uuid(43f2f26b-0831-441d-b3c7-29f6234fc26a)]
 interface nsIDOMSVGPatternElement 
   : nsIDOMSVGElement
 /*
         The SVG DOM makes use of multiple interface inheritance.
         Since XPCOM only supports single interface inheritance,
         the best thing that we can do is to promise that whenever
         an object implements _this_ interface it will also
         implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGPolygonElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGPolygonElement.idl
@@ -34,17 +34,17 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 
 #include "nsIDOMSVGElement.idl"
 
-[scriptable, uuid(4d43668c-de35-4da7-a565-a5f929ae30af)]
+[scriptable, uuid(13df3abe-8ce8-4c54-ad62-a18f62126793)]
 interface nsIDOMSVGPolygonElement
   : nsIDOMSVGElement
 /*
         The SVG DOM makes use of multiple interface inheritance.
         Since XPCOM only supports single interface inheritance,
         the best thing that we can do is to promise that whenever
         an object implements _this_ interface it will also
         implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGPolylineElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGPolylineElement.idl
@@ -33,17 +33,17 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGElement.idl"
 
-[scriptable, uuid(3f1c450e-3125-4098-9b4c-69d6befd8abf)]
+[scriptable, uuid(805ed2e7-3c94-421a-aa6b-14c21dc1ecd3)]
 interface nsIDOMSVGPolylineElement
   : nsIDOMSVGElement
 /*
         The SVG DOM makes use of multiple interface inheritance.
         Since XPCOM only supports single interface inheritance,
         the best thing that we can do is to promise that whenever
         an object implements _this_ interface it will also
         implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGRectElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGRectElement.idl
@@ -35,17 +35,17 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGElement.idl"
 
 interface nsIDOMSVGAnimatedLength;
 
-[scriptable, uuid(6b4696b6-dd54-4a13-9291-f58f1f1d5567)]
+[scriptable, uuid(c9979c6e-cd30-4e67-b8cc-50cd21a1c518)]
 interface nsIDOMSVGRectElement
   : nsIDOMSVGElement
 /*
         The SVG DOM makes use of multiple interface inheritance.
         Since XPCOM only supports single interface inheritance,
         the best thing that we can do is to promise that whenever
         an object implements _this_ interface it will also
         implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGSVGElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGSVGElement.idl
@@ -50,17 +50,17 @@ interface nsIDOMSVGTransform;
 
 // undef the GetCurrentTime macro defined in WinBase.h from the MS Platform SDK
 %{C++
 #ifdef GetCurrentTime
 #undef GetCurrentTime
 #endif
 %}
 
-[scriptable, uuid(aecf2c1a-065e-432f-9aeb-c3715246281e)]
+[scriptable, uuid(4de866e9-f937-41ab-bb78-4b50584437e4)]
 interface nsIDOMSVGSVGElement
   : nsIDOMSVGElement
 /*
         The SVG DOM makes use of multiple interface inheritance.
         Since XPCOM only supports single interface inheritance,
         the best thing that we can do is to promise that whenever
         an object implements _this_ interface it will also
         implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGScriptElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGScriptElement.idl
@@ -33,17 +33,17 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGElement.idl"
 
-[scriptable, uuid(26525c48-f1fa-453b-b19a-6586b2d88e1d)]
+[scriptable, uuid(84d1d020-0a2b-403e-8b81-fa51af1c3d52)]
 interface nsIDOMSVGScriptElement
   : nsIDOMSVGElement
 /*
         The SVG DOM makes use of multiple interface inheritance.
         Since XPCOM only supports single interface inheritance,
         the best thing that we can do is to promise that whenever
         an object implements _this_ interface it will also
         implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGSetElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGSetElement.idl
@@ -32,10 +32,10 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGAnimationElement.idl"
 
-[scriptable, uuid(b6c27cdc-4d8b-4343-8ccb-3b68adb1052a)]
+[scriptable, uuid(5d6ccb41-3bac-4842-96a1-8150091acb05)]
 interface nsIDOMSVGSetElement : nsIDOMSVGAnimationElement {};
--- a/dom/interfaces/svg/nsIDOMSVGStopElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGStopElement.idl
@@ -44,17 +44,17 @@
  *
  * For more information on this interface please see
  * http://www.w3.org/TR/SVG11/pservers.html
  *
  */
 
 interface nsIDOMSVGAnimatedNumber;
 
-[scriptable, uuid(5e345b97-b718-4deb-a879-bbeb27ba7497)]
+[scriptable, uuid(296682ac-e8e6-40c5-a8d0-31b904ec1b13)]
 interface nsIDOMSVGStopElement
   : nsIDOMSVGElement
 /*
         The SVG DOM makes use of multiple interface inheritance.
         Since XPCOM only supports single interface inheritance,
         the best thing that we can do is to promise that whenever
         an object implements _this_ interface it will also
         implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGStyleElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGStyleElement.idl
@@ -33,17 +33,17 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGElement.idl"
 
-[scriptable, uuid(2ce28aa9-3b6c-4eb6-a42a-4c00dd7406f3)]
+[scriptable, uuid(9ce8621b-b838-4d9a-8a74-59df65a62cf3)]
 interface nsIDOMSVGStyleElement
   : nsIDOMSVGElement
 {
   attribute DOMString         xmlspace;
                        // raises DOMException on setting
   attribute DOMString         type;
                        // raises DOMException on setting
   attribute DOMString         media;
--- a/dom/interfaces/svg/nsIDOMSVGSwitchElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGSwitchElement.idl
@@ -31,17 +31,17 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGElement.idl"
 
-[scriptable, uuid(fb52b73c-3908-44c7-a390-2d40f8e8499c)]
+[scriptable, uuid(dd194cc5-1319-4b54-ac1d-87e41092b278)]
 interface nsIDOMSVGSwitchElement
   : nsIDOMSVGElement
 /*
   The SVG DOM makes use of multiple interface inheritance.
   Since XPCOM only supports single interface inheritance,
   the best thing that we can do is to promise that whenever
   an object implements _this_ interface it will also
   implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGSymbolElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGSymbolElement.idl
@@ -31,17 +31,17 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGElement.idl"
 
-[scriptable, uuid(0e272bde-2660-49c9-a2d3-4652346e0ff6)]
+[scriptable, uuid(baa7b70f-badd-40eb-8c68-2376a09e8ad9)]
 interface nsIDOMSVGSymbolElement
   : nsIDOMSVGElement
 /*
   The SVG DOM makes use of multiple interface inheritance.
   Since XPCOM only supports single interface inheritance,
   the best thing that we can do is to promise that whenever
   an object implements _this_ interface it will also
   implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGTSpanElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGTSpanElement.idl
@@ -33,12 +33,12 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGTextPositionElem.idl"
 
-[scriptable, uuid(99131b84-1858-4fbf-826e-35d5135ce6c3)]
+[scriptable, uuid(129c1e5d-8ff2-4c65-b2f7-a09e209fb0ac)]
 interface nsIDOMSVGTSpanElement : nsIDOMSVGTextPositioningElement
 { 
 };
--- a/dom/interfaces/svg/nsIDOMSVGTextContentElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGTextContentElement.idl
@@ -39,17 +39,17 @@
 #include "nsIDOMSVGElement.idl"
 
 interface nsIDOMSVGAnimatedLength;
 interface nsIDOMSVGAnimatedEnumeration;
 interface nsIDOMSVGPoint;
 interface nsIDOMSVGRect;
 
 
-[scriptable, uuid(2dc007ee-b5f4-44e7-a516-9512d88f6347)]
+[scriptable, uuid(0a719b38-d8ea-4b62-83d9-ed9d76dbe111)]
 interface nsIDOMSVGTextContentElement
   : nsIDOMSVGElement
 /*
         The SVG DOM makes use of multiple interface inheritance.
         Since XPCOM only supports single interface inheritance,
         the best thing that we can do is to promise that whenever
         an object implements _this_ interface it will also
         implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGTextElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGTextElement.idl
@@ -33,17 +33,17 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGTextPositionElem.idl"
 
-[scriptable, uuid(774d0445-e3c9-46c4-a1ac-347a6d34a308)]
+[scriptable, uuid(96a1df7f-856e-4671-97cf-7264c60f0271)]
 interface nsIDOMSVGTextElement : nsIDOMSVGTextPositioningElement
 /*
         The SVG DOM makes use of multiple interface inheritance.
         Since XPCOM only supports single interface inheritance,
         the best thing that we can do is to promise that whenever
         an object implements _this_ interface it will also
         implement the following interfaces. (We then have to QI to
         hop between them.)
--- a/dom/interfaces/svg/nsIDOMSVGTextPathElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGTextPathElement.idl
@@ -34,17 +34,17 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGTextContentElement.idl"
 
 interface nsIDOMSVGAnimatedLength;
 interface nsIDOMSVGAnimatedEnumeration;
 
-[scriptable, uuid(55c2dbe7-c3e2-4e45-aeb1-b81802ceec48)]
+[scriptable, uuid(fcea5b44-d1c4-49a6-9f90-477c61029e5e)]
 interface nsIDOMSVGTextPathElement
   : nsIDOMSVGTextContentElement
 /*
         The SVG DOM makes use of multiple interface inheritance.
         Since XPCOM only supports single interface inheritance,
         the best thing that we can do is to promise that whenever
         an object implements _this_ interface it will also
         implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGTextPositionElem.idl
+++ b/dom/interfaces/svg/nsIDOMSVGTextPositionElem.idl
@@ -36,17 +36,17 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGTextContentElement.idl"
 
 interface nsIDOMSVGAnimatedLengthList;
 interface nsIDOMSVGAnimatedNumberList;
 
-[scriptable, uuid(92b911b3-d822-4805-b6a3-7a698f88e720)]
+[scriptable, uuid(9e91bf1d-c1ae-468d-9053-fa683e713beb)]
 interface nsIDOMSVGTextPositioningElement : nsIDOMSVGTextContentElement
 { 
   readonly attribute nsIDOMSVGAnimatedLengthList x;
   readonly attribute nsIDOMSVGAnimatedLengthList y;
   readonly attribute nsIDOMSVGAnimatedLengthList dx;
   readonly attribute nsIDOMSVGAnimatedLengthList dy;
   readonly attribute nsIDOMSVGAnimatedNumberList rotate;
 };
--- a/dom/interfaces/svg/nsIDOMSVGTitleElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGTitleElement.idl
@@ -33,17 +33,17 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGElement.idl"
 
-[scriptable, uuid(ade32154-08ad-4575-9f15-47840700af90)]
+[scriptable, uuid(f9763c34-58d1-4934-997e-cffd59ba9aa8)]
 interface nsIDOMSVGTitleElement
   : nsIDOMSVGElement
 /*
   The SVG DOM makes use of multiple interface inheritance.
   Since XPCOM only supports single interface inheritance,
   the best thing that we can do is to promise that whenever
   an object implements _this_ interface it will also
   implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/svg/nsIDOMSVGUseElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGUseElement.idl
@@ -33,17 +33,17 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMSVGElement.idl"
 
 interface nsIDOMSVGAnimatedLength;
 
-[scriptable, uuid(686a8d0b-e0d7-4443-970e-22e22018f4f1)]
+[scriptable, uuid(f6c4180c-2a97-4d71-abdd-7a291b57daed)]
 interface nsIDOMSVGUseElement
   : nsIDOMSVGElement
 /*
   The SVG DOM makes use of multiple interface inheritance.
   Since XPCOM only supports single interface inheritance,
   the best thing that we can do is to promise that whenever
   an object implements _this_ interface it will also
   implement the following interfaces. (We then have to QI to
--- a/dom/interfaces/xpath/nsIDOMXPathNamespace.idl
+++ b/dom/interfaces/xpath/nsIDOMXPathNamespace.idl
@@ -37,16 +37,16 @@
  * ***** END LICENSE BLOCK ***** */
 
 /**
  * Corresponds to http://www.w3.org/TR/2002/WD-DOM-Level-3-XPath-20020208
  */
 
 #include "nsIDOMNode.idl"
 
-[scriptable, uuid(978f4c11-3b29-40af-8c29-a4e0689f2776)]
+[scriptable, uuid(47836446-3c3d-440f-99f6-984d8a2f2e04)]
 interface nsIDOMXPathNamespace : nsIDOMNode
 {
   // XPathNodeType
   const unsigned short      XPATH_NAMESPACE_NODE           = 13;
 
   readonly attribute nsIDOMElement          ownerElement;
 };
--- a/dom/interfaces/xul/nsIDOMXULButtonElement.idl
+++ b/dom/interfaces/xul/nsIDOMXULButtonElement.idl
@@ -33,17 +33,17 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMXULLabeledControlEl.idl"
 
-[scriptable, uuid(761e4742-e1c2-4d0d-91fe-cc11c4e6b1ad)]
+[scriptable, uuid(ebf2741a-9e4a-4c40-82da-886c46f8632f)]
 interface nsIDOMXULButtonElement : nsIDOMXULLabeledControlElement {
   const short CHECKSTATE_UNCHECKED = 0;
   const short CHECKSTATE_CHECKED = 1;
   const short CHECKSTATE_MIXED = 2;
 
   attribute DOMString type;
   attribute DOMString dlgType;
 
--- a/dom/interfaces/xul/nsIDOMXULCheckboxElement.idl
+++ b/dom/interfaces/xul/nsIDOMXULCheckboxElement.idl
@@ -35,17 +35,17 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMElement.idl"
 #include "nsIDOMXULLabeledControlEl.idl"
 
-[scriptable, uuid(6713cd76-65ef-4883-bb58-31b2e400bb78)]
+[scriptable, uuid(f678191a-9d88-4567-a45e-8835883cb9a7)]
 interface nsIDOMXULCheckboxElement : nsIDOMXULLabeledControlElement {
   const short CHECKSTATE_UNCHECKED = 0;
   const short CHECKSTATE_CHECKED = 1;
   const short CHECKSTATE_MIXED = 2;
 
   attribute boolean checked;
   attribute long checkState;
   attribute boolean autoCheck;
--- a/dom/interfaces/xul/nsIDOMXULContainerElement.idl
+++ b/dom/interfaces/xul/nsIDOMXULContainerElement.idl
@@ -34,26 +34,26 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMXULElement.idl"
 interface nsIDOMXULContainerElement;
 
-[scriptable, uuid(608d604f-79b4-4fe0-8a2c-49a007496642)]
+[scriptable, uuid(e5457dc5-878b-4587-9b90-428303408df4)]
 interface nsIDOMXULContainerItemElement : nsIDOMXULElement
 {
   /**
    * Returns the parent container if any.
    */
   readonly attribute nsIDOMXULContainerElement parentContainer;
 };
 
-[scriptable, uuid(73acdda3-c6a5-4a89-a01a-0f776eba870d)]
+[scriptable, uuid(1ab35621-3a7f-4aa8-b9b8-222dea0b0536)]
 interface nsIDOMXULContainerElement : nsIDOMXULContainerItemElement
 {
   /**
    * Creates an item for the given label and value and appends it to the
    * container.
    *
    * @param aLabel - the label for the new item
    * @param aValue - the value of the new item
--- a/dom/interfaces/xul/nsIDOMXULControlElement.idl
+++ b/dom/interfaces/xul/nsIDOMXULControlElement.idl
@@ -37,17 +37,17 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMElement.idl"
 #include "nsIDOMXULElement.idl"
 
 interface nsIControllers;
 
-[scriptable, uuid(eb90ef16-4d66-4fbe-941d-814a183a0e88)]
+[scriptable, uuid(73c5fcd3-9404-4458-a158-44fc3a32bc1c)]
 interface nsIDOMXULControlElement : nsIDOMXULElement {
   attribute boolean disabled;
   attribute long tabIndex;
   
 // XXX defined in XULElement, but should be defined here
 //  readonly attribute nsIControllers controllers;
   
 //  void focus();
--- a/dom/interfaces/xul/nsIDOMXULDescriptionElement.idl
+++ b/dom/interfaces/xul/nsIDOMXULDescriptionElement.idl
@@ -35,15 +35,15 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMXULElement.idl"
 
-[scriptable, uuid(de87d3ef-8780-40e9-8af1-593bc7a24d77)]
+[scriptable, uuid(46ea9e4b-c253-4fec-aac7-8bb840a7237c)]
 interface nsIDOMXULDescriptionElement : nsIDOMXULElement {
   attribute boolean disabled;
   attribute boolean crop;
   attribute DOMString value;
 };
 
--- a/dom/interfaces/xul/nsIDOMXULImageElement.idl
+++ b/dom/interfaces/xul/nsIDOMXULImageElement.idl
@@ -32,13 +32,13 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMElement.idl"
 #include "nsIDOMXULElement.idl"
 
-[scriptable, uuid(02faa23e-71f3-436a-8a13-9dc709af9997)]
+[scriptable, uuid(b2affc89-de29-4b79-a88d-3dcf462ce120)]
 interface nsIDOMXULImageElement : nsIDOMXULElement {
   attribute DOMString src;
 };
 
--- a/dom/interfaces/xul/nsIDOMXULLabelElement.idl
+++ b/dom/interfaces/xul/nsIDOMXULLabelElement.idl
@@ -34,14 +34,14 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMXULDescriptionElement.idl"
 
-[scriptable, uuid(db431786-d23a-4ee2-a8b4-f952c6f2fa6e)]
+[scriptable, uuid(0f36a6e1-714e-49fa-80d2-9777a6e8682b)]
 interface nsIDOMXULLabelElement : nsIDOMXULDescriptionElement {
   attribute DOMString accessKey;
   attribute DOMString control;
 };
 
--- a/dom/interfaces/xul/nsIDOMXULLabeledControlEl.idl
+++ b/dom/interfaces/xul/nsIDOMXULLabeledControlEl.idl
@@ -35,17 +35,17 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMElement.idl"
 #include "nsIDOMXULControlElement.idl"
 
-[scriptable, uuid(bbdbd28d-dc31-4933-be99-de33569ed7d9)]
+[scriptable, uuid(6134f667-5832-4a0e-a81d-bec5d1fe723f)]
 interface nsIDOMXULLabeledControlElement : nsIDOMXULControlElement {
   attribute DOMString crop;
   attribute DOMString image;
   attribute DOMString label;
   attribute DOMString accessKey;
   attribute DOMString command;
 
 //  void doCommand();
--- a/dom/interfaces/xul/nsIDOMXULMenuListElement.idl
+++ b/dom/interfaces/xul/nsIDOMXULMenuListElement.idl
@@ -35,17 +35,17 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMXULSelectCntrlEl.idl"
 interface nsIDOMXULTextBoxElement;
 
-[scriptable, uuid(8be387a6-ac10-4cd9-acac-bd61c78e7513)]
+[scriptable, uuid(17d51428-e177-4cba-895a-7a005790f119)]
 interface nsIDOMXULMenuListElement : nsIDOMXULSelectControlElement {
   attribute boolean editable;
   attribute boolean open;
   
   // label of selected option or value of textfield for editable menu lists
   readonly attribute DOMString label;
 
   attribute DOMString crop;
--- a/dom/interfaces/xul/nsIDOMXULMultSelectCntrlEl.idl
+++ b/dom/interfaces/xul/nsIDOMXULMultSelectCntrlEl.idl
@@ -34,17 +34,17 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMXULSelectCntrlEl.idl"
 
-[scriptable, uuid(a197ad4e-127d-477a-a069-400b3b32fee9)]
+[scriptable, uuid(71629b83-3523-4184-960a-876fc3b452aa)]
 interface nsIDOMXULMultiSelectControlElement : nsIDOMXULSelectControlElement
 {
   attribute DOMString selType;
 
   attribute nsIDOMXULSelectControlItemElement currentItem;
   attribute long currentIndex;
 
   readonly attribute nsIDOMNodeList selectedItems;
--- a/dom/interfaces/xul/nsIDOMXULPopupElement.idl
+++ b/dom/interfaces/xul/nsIDOMXULPopupElement.idl
@@ -34,17 +34,17 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMElement.idl"
 #include "nsIDOMXULElement.idl"
 
-[scriptable, uuid(d647cb9a-aa67-4549-9219-b0345fcefe67)]
+[scriptable, uuid(1d2d498a-3e3b-45dd-a55a-e707ae4c6e89)]
 interface nsIDOMXULPopupElement : nsIDOMXULElement {
   const unsigned short      BEFORE_START                   = 1;
   const unsigned short      BEFORE_END                     = 2;
   const unsigned short      AFTER_START                    = 3;
   const unsigned short      AFTER_END                      = 4;
   const unsigned short      START_BEFORE                   = 5;
   const unsigned short      START_AFTER                    = 6;
   const unsigned short      END_BEFORE                     = 7;
--- a/dom/interfaces/xul/nsIDOMXULSelectCntrlEl.idl
+++ b/dom/interfaces/xul/nsIDOMXULSelectCntrlEl.idl
@@ -34,17 +34,17 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMXULControlElement.idl"
 interface nsIDOMXULSelectControlItemElement;
 
-[scriptable, uuid(919D9808-8937-4CEC-9390-91225EB8864B)]
+[scriptable, uuid(d38dba00-7cb7-4349-a857-7172f8a5c07a)]
 interface nsIDOMXULSelectControlElement : nsIDOMXULControlElement {
   attribute nsIDOMXULSelectControlItemElement selectedItem;
   attribute long selectedIndex;
 
   attribute DOMString value;
   
   nsIDOMXULSelectControlItemElement appendItem(in DOMString label, in DOMString value);
   nsIDOMXULSelectControlItemElement insertItemAt(in long index, in DOMString label, in DOMString value);
--- a/dom/interfaces/xul/nsIDOMXULSelectCntrlItemEl.idl
+++ b/dom/interfaces/xul/nsIDOMXULSelectCntrlItemEl.idl
@@ -34,17 +34,17 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMXULElement.idl"
 interface nsIDOMXULSelectControlElement;
 
-[scriptable, uuid(79585939-115c-4727-9743-a42baf7173b0)]
+[scriptable, uuid(4fb442d0-fc50-476c-bd56-efa215188b72)]
 interface nsIDOMXULSelectControlItemElement : nsIDOMXULElement {
   attribute boolean disabled;
   attribute DOMString crop;
   attribute DOMString image;
   attribute DOMString label;
   attribute DOMString accessKey;
   attribute DOMString command;
   
--- a/dom/interfaces/xul/nsIDOMXULTextboxElement.idl
+++ b/dom/interfaces/xul/nsIDOMXULTextboxElement.idl
@@ -34,17 +34,17 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsIDOMXULLabeledControlEl.idl"
 interface nsIDOMHTMLInputElement;
 
-[scriptable, uuid(806a706e-2bae-4aec-a53e-5432eb4a7025)]
+[scriptable, uuid(741d87d2-2495-4a5c-9460-1e7d1128586d)]
 interface nsIDOMXULTextBoxElement : nsIDOMXULControlElement
 {
   // inputField may be any type of editable field, such as an
   // HTML <input type="text"> or <textarea>
   readonly attribute nsIDOMNode inputField;
 
   readonly attribute long textLength;
   attribute long maxLength;
--- a/dom/src/jsurl/nsJSProtocolHandler.cpp
+++ b/dom/src/jsurl/nsJSProtocolHandler.cpp
@@ -1023,16 +1023,34 @@ nsJSChannel::GetContentCharset(nsACStrin
 
 NS_IMETHODIMP
 nsJSChannel::SetContentCharset(const nsACString &aContentCharset)
 {
     return mStreamChannel->SetContentCharset(aContentCharset);
 }
 
 NS_IMETHODIMP
+nsJSChannel::GetContentDisposition(PRUint32 *aContentDisposition)
+{
+    return mStreamChannel->GetContentDisposition(aContentDisposition);
+}
+
+NS_IMETHODIMP
+nsJSChannel::GetContentDispositionFilename(nsAString &aContentDispositionFilename)
+{
+    return mStreamChannel->GetContentDispositionFilename(aContentDispositionFilename);
+}
+
+NS_IMETHODIMP
+nsJSChannel::GetContentDispositionHeader(nsACString &aContentDispositionHeader)
+{
+    return mStreamChannel->GetContentDispositionHeader(aContentDispositionHeader);
+}
+
+NS_IMETHODIMP
 nsJSChannel::GetContentLength(PRInt32 *aContentLength)
 {
     return mStreamChannel->GetContentLength(aContentLength);
 }
 
 NS_IMETHODIMP
 nsJSChannel::SetContentLength(PRInt32 aContentLength)
 {
--- a/dom/tests/mochitest/whatwg/Makefile.in
+++ b/dom/tests/mochitest/whatwg/Makefile.in
@@ -75,16 +75,17 @@ include $(topsrcdir)/config/rules.mk
 		postMessage_closed_helper.html \
 		test_postMessage_jar.html \
 		postMessage.jar \
 		postMessage.jar^headers^ \
 		test_bug477323.html \
 		test_bug500328.html \
 		file_bug500328_1.html \
 		file_bug500328_2.html \
+		test_document_scripts.html \
 		test_postMessage_structured_clone.html \
 		postMessage_structured_clone_helper.js \
 		postMessage_structured_clone_helper.html \
 		$(NULL)
 
 _CHROME_FILES	= \
 		test_postMessage_chrome.html \
 		$(NULL)		
new file mode 100644
--- /dev/null
+++ b/dom/tests/mochitest/whatwg/test_document_scripts.html
@@ -0,0 +1,55 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=685774
+-->
+<head>
+  <title>Test for document.scripts (Bug 685774)</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=685774">Mozilla Bug 685774</a>
+<script type="application/javascript">
+
+/** Test for Bug 685774 **/
+
+function testSameCollection(a, b, c) {
+  is(a.length, c, "unexpected count of script elements");
+  is(b.length, c, "unexpected count of script elements");
+  for (var i = 0; i < a.length; i++) {
+    is(a[i], b[i], "document.scripts is not supported");
+  }
+}
+
+SimpleTest.waitForExplicitFinish();
+
+testSameCollection(document.scripts, document.getElementsByTagName("script"), 3);
+
+</script>
+<script type="application/javascript">
+
+testSameCollection(document.scripts, document.getElementsByTagName("script"), 4);
+
+function start() {
+  testSameCollection(document.scripts, document.getElementsByTagName("script"), 5);
+
+  var e = document.createElement("script");
+  testSameCollection(document.scripts, document.getElementsByTagName("script"), 5);
+  document.body.appendChild(e);
+  testSameCollection(document.scripts, document.getElementsByTagName("script"), 6);
+
+  SimpleTest.finish();
+}
+
+addLoadEvent(start);
+
+</script>
+<script type="application/javascript">
+
+testSameCollection(document.scripts, document.getElementsByTagName("script"), 5);
+
+</script>
+</body>
+</html>
--- a/dom/tests/unit/xpcshell.ini
+++ b/dom/tests/unit/xpcshell.ini
@@ -1,8 +1,10 @@
 [DEFAULT]
 head = 
 tail = 
 
 [test_bug319968.js]
 [test_bug465752.js]
 [test_domstorage_aboutpages.js]
 [test_geolocation_provider.js]
+# Bug 684962: test hangs consistently on Android
+skip-if = os == "android"
--- a/editor/libeditor/base/nsEditor.cpp
+++ b/editor/libeditor/base/nsEditor.cpp
@@ -1959,17 +1959,17 @@ nsEditor::GetWidget(nsIWidget **aWidget)
 
 NS_IMETHODIMP
 nsEditor::ForceCompositionEnd()
 {
 
 // We can test mInIMEMode and do some optimization for Mac and Window
 // Howerver, since UNIX support over-the-spot, we cannot rely on that 
 // flag for Unix.
-// We should use nsILookAndFeel to resolve this
+// We should use LookAndFeel to resolve this
 
 #if defined(XP_MACOSX) || defined(XP_WIN) || defined(XP_OS2)
   // XXXmnakano see bug 558976, ResetInputState() has two meaning which are
   // "commit the composition" and "cursor is moved".  This method name is
   // "ForceCompositionEnd", so, ResetInputState() should be used only for the
   // former here.  However, ResetInputState() is also used for the latter here
   // because even if we don't have composition, we call ResetInputState() on
   // Linux.  Currently, nsGtkIMModule can know the timing of the cursor move,
--- a/editor/libeditor/base/nsEditorEventListener.cpp
+++ b/editor/libeditor/base/nsEditorEventListener.cpp
@@ -48,17 +48,16 @@
 #include "nsIDocument.h"
 #include "nsIPresShell.h"
 #include "nsISelection.h"
 #include "nsISelectionController.h"
 #include "nsIDOMKeyEvent.h"
 #include "nsIDOMMouseEvent.h"
 #include "nsIPrivateTextEvent.h"
 #include "nsIEditorMailSupport.h"
-#include "nsILookAndFeel.h"
 #include "nsFocusManager.h"
 #include "nsEventListenerManager.h"
 #include "mozilla/Preferences.h"
 
 // Drag & Drop, Clipboard
 #include "nsIServiceManager.h"
 #include "nsIClipboard.h"
 #include "nsIDragService.h"
new file mode 100644
--- /dev/null
+++ b/editor/libeditor/html/crashtests/682650-1.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function repeatChar(s, n)
+{
+  while (s.length < n)
+    s += s;
+  return s.substr(0, n);
+}
+
+function boom()
+{
+  document.documentElement.contentEditable = "true";
+  document.execCommand("inserthtml", false, "<button><\/button>");
+  document.execCommand("inserthtml", false, repeatChar("i", 34646));
+  document.execCommand("contentReadOnly", false, null);
+  document.execCommand("removeformat", false, null);
+  document.execCommand("hilitecolor", false, "red");
+  document.execCommand("inserthtml", false, "a");
+  document.execCommand("delete", false, null);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+
+</html>
--- a/editor/libeditor/html/crashtests/crashtests.list
+++ b/editor/libeditor/html/crashtests/crashtests.list
@@ -17,8 +17,9 @@ load 503709-1.xhtml
 load 513375-1.xhtml
 load 535632-1.xhtml
 load 574558-1.xhtml
 load 582138-1.xhtml
 load 612565-1.html
 asserts(0-6) load 615015-1.html # Bug 439258
 load 615450-1.html
 load 643786-1.html
+load 682650-1.html
--- a/editor/libeditor/html/nsHTMLObjectResizer.cpp
+++ b/editor/libeditor/html/nsHTMLObjectResizer.cpp
@@ -57,25 +57,22 @@
 #include "nsEditorUtils.h"
 #include "nsHTMLEditUtils.h"
 
 #include "nsPoint.h"
 
 #include "nsIServiceManager.h"
 #include "mozilla/Preferences.h"
 
-#include "nsILookAndFeel.h"
-#include "nsWidgetsCID.h"
+#include "mozilla/LookAndFeel.h"
 
 using namespace mozilla;
 
 class nsHTMLEditUtils;
 
-static NS_DEFINE_CID(kLookAndFeelCID, NS_LOOKANDFEEL_CID);
-
 // ==================================================================
 // DocumentResizeEventListener
 // ==================================================================
 NS_IMPL_ISUPPORTS1(DocumentResizeEventListener, nsIDOMEventListener)
 
 DocumentResizeEventListener::DocumentResizeEventListener(nsIHTMLEditor * aEditor) 
 {
   mEditor = do_GetWeakReference(aEditor);
@@ -890,22 +887,20 @@ nsHTMLEditor::MouseMove(nsIDOMEvent* aMo
   }
 
   if (mGrabberClicked) {
     nsCOMPtr<nsIDOMMouseEvent> mouseEvent ( do_QueryInterface(aMouseEvent) );
     PRInt32 clientX, clientY;
     mouseEvent->GetClientX(&clientX);
     mouseEvent->GetClientY(&clientY);
 
-    nsCOMPtr<nsILookAndFeel> look = do_GetService(kLookAndFeelCID);
-    NS_ASSERTION(look, "Look and feel service must be implemented for this toolkit");
-
-    PRInt32 xThreshold=1, yThreshold=1;
-    look->GetMetric(nsILookAndFeel::eMetric_DragThresholdX, xThreshold);
-    look->GetMetric(nsILookAndFeel::eMetric_DragThresholdY, yThreshold);
+    PRInt32 xThreshold =
+      LookAndFeel::GetInt(LookAndFeel::eIntID_DragThresholdX, 1);
+    PRInt32 yThreshold =
+      LookAndFeel::GetInt(LookAndFeel::eIntID_DragThresholdY, 1);
 
     if (NS_ABS(clientX - mOriginalX ) * 2 >= xThreshold ||
         NS_ABS(clientY - mOriginalY ) * 2 >= yThreshold) {
       mGrabberClicked = PR_FALSE;
       StartMoving(nsnull);
     }
   }
   if (mIsMoving) {
--- a/editor/libeditor/html/nsWSRunObject.h
+++ b/editor/libeditor/html/nsWSRunObject.h
@@ -224,19 +224,19 @@ class NS_STACK_CLASS nsWSRunObject
     // WSPoint struct ------------------------------------------------------------
     // A WSPoint struct represents a unique location within the ws run.  It is 
     // always within a textnode that is one of the nodes stored in the list
     // in the wsRunObject.  For convenience, the character at that point is also 
     // stored in the struct.
     struct NS_STACK_CLASS WSPoint
     {
       nsCOMPtr<nsIContent> mTextNode;
-      PRInt16 mOffset;
+      PRUint32 mOffset;
       PRUnichar mChar;
-      
+
       WSPoint() : mTextNode(0),mOffset(0),mChar(0) {}
       WSPoint(nsIDOMNode *aNode, PRInt32 aOffset, PRUnichar aChar) : 
                      mTextNode(do_QueryInterface(aNode)),mOffset(aOffset),mChar(aChar)
       {
         if (!mTextNode->IsNodeOfType(nsINode::eDATA_NODE)) {
           // Not sure if this is needed, but it'll maintain the same
           // functionality
           mTextNode = nsnull;
--- a/editor/libeditor/text/nsTextEditRules.cpp
+++ b/editor/libeditor/text/nsTextEditRules.cpp
@@ -54,31 +54,28 @@
 #include "nsIDOMNSRange.h"
 #include "nsIDOMCharacterData.h"
 #include "nsIContent.h"
 #include "nsIContentIterator.h"
 #include "nsEditorUtils.h"
 #include "EditTxn.h"
 #include "nsEditProperty.h"
 #include "nsUnicharUtils.h"
-#include "nsILookAndFeel.h"
-#include "nsWidgetsCID.h"
 #include "DeleteTextTxn.h"
 #include "nsNodeIterator.h"
 #include "nsIDOMNodeFilter.h"
 
 // for IBMBIDI
 #include "nsFrameSelection.h"
 
 #include "mozilla/Preferences.h"
+#include "mozilla/LookAndFeel.h"
 
 using namespace mozilla;
 
-static NS_DEFINE_CID(kLookAndFeelCID, NS_LOOKANDFEEL_CID);
-
 #define CANCEL_OPERATION_IF_READONLY_OR_DISABLED \
   if (IsReadonly() || IsDisabled()) \
   {                     \
     *aCancel = PR_TRUE; \
     return NS_OK;       \
   };
 
 
@@ -677,18 +674,17 @@ nsTextEditRules::WillInsertText(PRInt32 
     outString->Assign(tString);
   }
 
   if (IsPasswordEditor())
   {
     // manage the password buffer
     mPasswordText.Insert(*outString, start);
 
-    nsCOMPtr<nsILookAndFeel> lookAndFeel = do_GetService(kLookAndFeelCID);
-    if (lookAndFeel->GetEchoPassword() && !DontEchoPassword()) {
+    if (LookAndFeel::GetEchoPassword() && !DontEchoPassword()) {
       HideLastPWInput();
       mLastStart = start;
       mLastLength = outString->Length();
       if (mTimer)
       {
         mTimer->Cancel();
       }
       else
@@ -827,19 +823,18 @@ nsTextEditRules::WillDeleteSelection(nsI
   {
     res = mEditor->ExtendSelectionForDelete(aSelection, &aCollapsedAction);
     NS_ENSURE_SUCCESS(res, res);
 
     // manage the password buffer
     PRUint32 start, end;
     mEditor->GetTextSelectionOffsets(aSelection, start, end);
     NS_ENSURE_SUCCESS(res, res);
-    nsCOMPtr<nsILookAndFeel> lookAndFeel = do_GetService(kLookAndFeelCID);
 
-    if (lookAndFeel->GetEchoPassword()) {
+    if (LookAndFeel::GetEchoPassword()) {
       HideLastPWInput();
       mLastStart = start;
       mLastLength = 0;
       if (mTimer)
       {
         mTimer->Cancel();
       }
     }
@@ -1333,22 +1328,17 @@ nsresult nsTextEditRules::HideLastPWInpu
 
 // static
 nsresult
 nsTextEditRules::FillBufWithPWChars(nsAString *aOutString, PRInt32 aLength)
 {
   if (!aOutString) {return NS_ERROR_NULL_POINTER;}
 
   // change the output to the platform password character
-  PRUnichar passwordChar = PRUnichar('*');
-  nsCOMPtr<nsILookAndFeel> lookAndFeel = do_GetService(kLookAndFeelCID);
-  if (lookAndFeel)
-  {
-    passwordChar = lookAndFeel->GetPasswordCharacter();
-  }
+  PRUnichar passwordChar = LookAndFeel::GetPasswordCharacter();
 
   PRInt32 i;
   aOutString->Truncate();
   for (i=0; i < aLength; i++)
     aOutString->Append(passwordChar);
 
   return NS_OK;
 }
--- a/embedding/android/resources/layout/notification_icon_text.xml
+++ b/embedding/android/resources/layout/notification_icon_text.xml
@@ -10,25 +10,25 @@
         android:layout_height="wrap_content"
         android:orientation="horizontal"
         >
         <ImageView android:id="@+id/notificationImage"
             android:layout_width="25dp"
             android:layout_height="25dp"
             android:scaleType="fitCenter" />
         <TextView android:id="@+id/notificationTitle"
+            android:textAppearance="@android:style/TextAppearance.StatusBar.EventContent.Title"
             android:layout_width="fill_parent"
             android:layout_height="wrap_content"
             android:layout_weight="1"
             android:singleLine="true"
             android:ellipsize="marquee"
             android:fadingEdge="horizontal"
-            android:textStyle="bold"
-            android:textSize="18sp"
             android:paddingLeft="4dp"
-            android:textColor="#ff000000" />
+            />
     </LinearLayout>
     <TextView android:id="@+id/notificationText"
+          android:textAppearance="@android:style/TextAppearance.StatusBar.EventContent"
 	      android:layout_width="fill_parent"
 	      android:layout_height="wrap_content"
 	      android:paddingLeft="4dp"
-	      android:textColor="#ff000000" />
+	      />
 </LinearLayout>
--- a/embedding/android/resources/layout/notification_progress.xml
+++ b/embedding/android/resources/layout/notification_progress.xml
@@ -11,38 +11,38 @@
         android:layout_height="wrap_content"
         android:orientation="horizontal"
         >
         <ImageView android:id="@+id/notificationImage"
             android:layout_width="25dp"
             android:layout_height="25dp"
             android:scaleType="fitCenter" />
         <TextView android:id="@+id/notificationTitle"
+            android:textAppearance="@android:style/TextAppearance.StatusBar.EventContent.Title"
             android:layout_width="fill_parent"
             android:layout_height="wrap_content"
             android:layout_weight="1"
             android:singleLine="true"
             android:ellipsize="marquee"
             android:fadingEdge="horizontal"
-            android:textStyle="bold"
-            android:textSize="18sp"
             android:paddingLeft="10dp"
-            android:textColor="#ff000000" />
+            />
     </LinearLayout>
 
     <LinearLayout
         android:layout_width="fill_parent"
         android:layout_height="wrap_content"
         android:orientation="horizontal"
         >
         <TextView android:id="@+id/notificationText"
+            android:textAppearance="@android:style/TextAppearance.StatusBar.EventContent"
             android:layout_width="wrap_content"
             android:layout_height="wrap_content"
             android:paddingLeft="3dp"
-            android:textColor="#ff000000" />
+            />
 
         <ProgressBar android:id="@+id/notificationProgressbar"
             style="?android:attr/progressBarStyleHorizontal"
             android:layout_width="fill_parent"
             android:layout_height="wrap_content"
             android:layout_marginTop="1dip"
             android:layout_marginBottom="1dip"
             android:layout_marginLeft="4dip"
--- a/embedding/android/resources/layout/notification_progress_text.xml
+++ b/embedding/android/resources/layout/notification_progress_text.xml
@@ -10,37 +10,37 @@
         android:layout_height="wrap_content"
         android:orientation="horizontal"
         >
         <ImageView android:id="@+id/notificationImage"
             android:layout_width="25dp"
             android:layout_height="25dp"
             android:scaleType="fitCenter" />
         <TextView android:id="@+id/notificationTitle"
+            android:textAppearance="@android:style/TextAppearance.StatusBar.EventContent.Title"
             android:layout_width="fill_parent"
             android:layout_height="wrap_content"
             android:layout_weight="1"
             android:singleLine="true"
             android:ellipsize="marquee"
             android:fadingEdge="horizontal"
-            android:textStyle="bold"
-            android:textSize="18sp"
             android:paddingLeft="4dp"
-            android:textColor="#ff000000" />
+            />
     </LinearLayout>
 
     <ProgressBar android:id="@+id/notificationProgressbar"
         style="?android:attr/progressBarStyleHorizontal"
         android:layout_width="fill_parent"
         android:layout_height="16dip"
         android:layout_marginTop="1dip"
         android:layout_marginBottom="1dip"
         android:layout_marginLeft="10dip"
         android:layout_marginRight="10dip"
         android:layout_centerHorizontal="true" />
 
     <TextView android:id="@+id/notificationText"
+        android:textAppearance="@android:style/TextAppearance.StatusBar.EventContent"
         android:layout_width="fill_parent"
         android:layout_height="wrap_content"
         android:paddingLeft="4dp"
-        android:textColor="#ff000000" />
+        />
 
 </LinearLayout>
--- a/embedding/browser/webBrowser/nsWebBrowser.cpp
+++ b/embedding/browser/webBrowser/nsWebBrowser.cpp
@@ -70,33 +70,33 @@
 #include "nsCWebBrowserPersist.h"
 #include "nsIServiceManager.h"
 #include "nsAutoPtr.h"
 #include "nsFocusManager.h"
 #include "Layers.h"
 #include "gfxContext.h"
 
 // for painting the background window
-#include "nsILookAndFeel.h"
+#include "mozilla/LookAndFeel.h"
 
 // Printing Includes
 #ifdef NS_PRINTING
 #include "nsIWebBrowserPrint.h"
 #include "nsIContentViewer.h"
 #endif
 
 // PSM2 includes
 #include "nsISecureBrowserUI.h"
 #include "nsXULAppAPI.h"
 
+using namespace mozilla;
 using namespace mozilla::layers;
 
 static NS_DEFINE_IID(kWindowCID, NS_WINDOW_CID);
 static NS_DEFINE_CID(kChildCID, NS_CHILD_CID);
-static NS_DEFINE_CID(kLookAndFeelCID, NS_LOOKANDFEEL_CID);
 
 
 //*****************************************************************************
 //***    nsWebBrowser: Object Management
 //*****************************************************************************
 
 nsWebBrowser::nsWebBrowser() : mDocShellTreeOwner(nsnull), 
    mInitInfo(nsnull),
@@ -1159,22 +1159,19 @@ NS_IMETHODIMP nsWebBrowser::Create()
                               nsnull, nsnull, nsnull, &widgetInit);  
       }
 
     nsCOMPtr<nsIDocShell> docShell(do_CreateInstance("@mozilla.org/docshell;1", &rv));
     NS_ENSURE_SUCCESS(rv, rv);
     rv = SetDocShell(docShell);
     NS_ENSURE_SUCCESS(rv, rv);
 
-   // get the system default window background colour
-   {
-      nsCOMPtr<nsILookAndFeel> laf = do_GetService(kLookAndFeelCID);
-        if (laf)
-      laf->GetColor(nsILookAndFeel::eColor_WindowBackground, mBackgroundColor);
-   }
+    // get the system default window background colour
+    LookAndFeel::GetColor(LookAndFeel::eColorID_WindowBackground,
+                          &mBackgroundColor);
 
    // the docshell has been set so we now have our listener registrars.
    if (mListenerArray) {
       // we had queued up some listeners, let's register them now.
       PRUint32 count = mListenerArray->Length();
       PRUint32 i = 0;
       NS_ASSERTION(count > 0, "array construction problem");
       while (i < count) {
--- a/gfx/angle/Makefile.in
+++ b/gfx/angle/Makefile.in
@@ -123,16 +123,18 @@ CSRCS   = \
         memory.c \
         scanner.c \
         symbols.c \
         tokens.c \
 	$(NULL)
 
 DEFINES += -DANGLE_USE_NSPR -DANGLE_BUILD
 
+EXTRA_DSO_LDOPTS = $(MOZALLOC_LIB)
+
 ifdef MOZ_ANGLE
 
 # libEGL depends on (links against!) libGLESv2!
 DIRS = src/libGLESv2 src/libEGL
 
 libs::
 	expand "$(MOZ_D3DX9_CAB)" -F:$(MOZ_D3DX9_DLL) "$(DIST)/bin"
 	expand "$(MOZ_D3DCOMPILER_CAB)" -F:$(MOZ_D3DCOMPILER_DLL) "$(DIST)/bin"
--- a/gfx/angle/README.mozilla
+++ b/gfx/angle/README.mozilla
@@ -4,16 +4,17 @@ Current revision: r740
 
 == Applied local patches ==
 
 In this order:
   angle-nspr-misc.patch - don't bother with ANGLE_OS detection with NSPR
   angle-renaming.patch - rename debug.h to compilerdebug.h to avoid conflict in our makefiles
   angle-intrinsic-msvc2005.patch - work around a MSVC 2005 compile error
   angle-limit-identifiers-to-250-chars.patch - see bug 675625
+  angle-use-xmalloc.patch - see bug 680840. Can drop this patch whenever the new preprocessor lands.
 
 In addition to these patches, the Makefile.in files are ours, they're not present in upsteam ANGLE.
 
 == How to update this ANGLE copy ==
 
 1. Unapply patches
 2. Apply diff with new ANGLE version
 3. Reapply patches.
--- a/gfx/angle/src/compiler/preprocessor/atom.c
+++ b/gfx/angle/src/compiler/preprocessor/atom.c
@@ -48,16 +48,18 @@ NVIDIA HAS BEEN ADVISED OF THE POSSIBILI
 
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
 
 #include "compiler/compilerdebug.h"
 #include "compiler/preprocessor/slglobals.h"
 
+#include "../../../../../memory/mozalloc/mozalloc.h"
+
 #undef malloc
 #undef realloc
 #undef free
 
 ///////////////////////////////////////////////////////////////////////////////////////////////
 ////////////////////////////////////////// String table: //////////////////////////////////////
 ///////////////////////////////////////////////////////////////////////////////////////////////
 
@@ -318,31 +320,23 @@ static int AddAtomFixed(AtomTable *atabl
  */
 
 static int GrowAtomTable(AtomTable *atable, int size)
 {
     int *newmap, *newrev;
 
     if (atable->size < size) {
         if (atable->amap) {
-            newmap = realloc(atable->amap, sizeof(int)*size);
-            newrev = realloc(atable->arev, sizeof(int)*size);
+            newmap = moz_xrealloc(atable->amap, sizeof(int)*size);
+            newrev = moz_xrealloc(atable->arev, sizeof(int)*size);
         } else {
-            newmap = malloc(sizeof(int)*size);
-            newrev = malloc(sizeof(int)*size);
+            newmap = moz_xmalloc(sizeof(int)*size);
+            newrev = moz_xmalloc(sizeof(int)*size);
             atable->size = 0;
         }
-        if (!newmap || !newrev) {
-            /* failed to grow -- error */
-            if (newmap)
-                atable->amap = newmap;
-            if (newrev)
-                atable->arev = newrev;
-            return -1;
-        }
         memset(&newmap[atable->size], 0, (size - atable->size) * sizeof(int));
         memset(&newrev[atable->size], 0, (size - atable->size) * sizeof(int));
         atable->amap = newmap;
         atable->arev = newrev;
         atable->size = size;
     }
     return 0;
 } // GrowAtomTable
--- a/gfx/angle/src/libEGL/Makefile.in
+++ b/gfx/angle/src/libEGL/Makefile.in
@@ -150,8 +150,10 @@ RCFILE = $(srcdir)/libEGL.rc
 include $(topsrcdir)/config/rules.mk
 
 EXTRA_DSO_LDOPTS = "$(MOZ_DIRECTX_SDK_PATH)/lib/$(MOZ_DIRECTX_SDK_CPU_SUFFIX)/d3d9.lib" \
                    "$(MOZ_DIRECTX_SDK_PATH)/lib/$(MOZ_DIRECTX_SDK_CPU_SUFFIX)/dxguid.lib" \
 		   "$(DIST)/lib/libGLESv2.lib" \
 		   dwmapi.lib \
 		   delayimp.lib \
 		   /delayload:dwmapi.dll
+
+EXTRA_DSO_LDOPTS += $(MOZALLOC_LIB)
--- a/gfx/angle/src/libGLESv2/Makefile.in
+++ b/gfx/angle/src/libGLESv2/Makefile.in
@@ -159,8 +159,10 @@ CPPSRCS	+= \
 DEFFILE = $(srcdir)/libGLESv2.def
 RCFILE = $(srcdir)/libGLESv2.rc
 
 include $(topsrcdir)/config/rules.mk
 
 EXTRA_DSO_LDOPTS = "$(MOZ_DIRECTX_SDK_PATH)/lib/$(MOZ_DIRECTX_SDK_CPU_SUFFIX)/d3d9.lib" \
                    "$(MOZ_DIRECTX_SDK_PATH)/lib/$(MOZ_DIRECTX_SDK_CPU_SUFFIX)/d3dx9.lib" \
 		   "$(MOZ_DIRECTX_SDK_PATH)/lib/$(MOZ_DIRECTX_SDK_CPU_SUFFIX)/D3DCompiler.lib"
+
+EXTRA_DSO_LDOPTS += $(MOZALLOC_LIB)
--- a/gfx/layers/opengl/LayerManagerOGL.cpp
+++ b/gfx/layers/opengl/LayerManagerOGL.cpp
@@ -1013,23 +1013,23 @@ LayerManagerOGL::CopyToTarget()
 
   nsRefPtr<gfxImageSurface> imageSurface =
     new gfxImageSurface(gfxIntSize(width, height),
                         gfxASurface::ImageFormatARGB32);
 
   mGLContext->fBindFramebuffer(LOCAL_GL_FRAMEBUFFER,
                                mGLContext->IsDoubleBuffered() ? 0 : mBackBufferFBO);
 
+#ifndef USE_GLES2
+  // GLES2 promises that binding to any custom FBO will attach
+  // to GL_COLOR_ATTACHMENT0 attachment point.
   if (mGLContext->IsDoubleBuffered()) {
     mGLContext->fReadBuffer(LOCAL_GL_BACK);
   }
-#ifndef USE_GLES2
   else {
-  // GLES2 promises that binding to any custom FBO will attach
-  // to GL_COLOR_ATTACHMENT0 attachment point.
     mGLContext->fReadBuffer(LOCAL_GL_COLOR_ATTACHMENT0);
   }
 #endif
 
   GLenum format = LOCAL_GL_RGBA;
   if (mHasBGRA)
     format = LOCAL_GL_BGRA;
 
--- a/gfx/thebes/GLContext.cpp
+++ b/gfx/thebes/GLContext.cpp
@@ -431,16 +431,17 @@ static const char *sExtensionNames[] = {
     "GL_IMG_read_format",
     "GL_EXT_read_format_bgra",
     "GL_APPLE_client_storage",
     "GL_ARB_texture_non_power_of_two",
     "GL_ARB_pixel_buffer_object",
     "GL_ARB_ES2_compatibility",
     "GL_OES_texture_float",
     "GL_ARB_texture_float",
+    "GL_EXT_unpack_subimage",
     NULL
 };
 
 void
 GLContext::InitExtensions()
 {
     MakeCurrent();
     const GLubyte *extensions = fGetString(LOCAL_GL_EXTENSIONS);
@@ -1834,19 +1835,33 @@ GLContext::TexImage2D(GLenum target, GLi
                       GLint pixelsize, GLint border, GLenum format, 
                       GLenum type, const GLvoid *pixels)
 {
     fPixelStorei(LOCAL_GL_UNPACK_ALIGNMENT, 
                  NS_MIN(GetAddressAlignment((ptrdiff_t)pixels),
                         GetAddressAlignment((ptrdiff_t)stride)));
 
 #ifndef USE_GLES2
-    fPixelStorei(LOCAL_GL_UNPACK_ROW_LENGTH, stride/pixelsize);
+    bool useUnpackRowLength = true;
 #else
-    if (stride != width * pixelsize) {
+    // A Khronos extension, GL_EXT_unpack_subimage, that restores support
+    // for GL_UNPACK_ROW_LENGTH, GL_UNPACK_SKIP_ROWS and GL_UNPACK_SKIP_PIXELS
+    // exists on Tegra 2 (and possibly other chipsets)
+    bool useUnpackRowLength = IsExtensionSupported(EXT_unpack_subimage);
+#endif
+
+    // Don't use UNPACK_ROW_LENGTH if the length would be greater than the
+    // maximum texture size
+    int rowLength = stride/pixelsize;
+    if (rowLength > mMaxTextureSize)
+      useUnpackRowLength = false;
+
+    if (useUnpackRowLength)
+        fPixelStorei(LOCAL_GL_UNPACK_ROW_LENGTH, rowLength);
+    else if (stride != width * pixelsize) {
         // Not using the whole row of texture data and GLES doesn't 
         // support GL_UNPACK_ROW_LENGTH. We need to upload each row
         // separately.
         fTexImage2D(target,
                     border,
                     internalformat,
                     width,
                     height,
@@ -1868,31 +1883,29 @@ GLContext::TexImage2D(GLenum target, GLi
                            row);
 
             row += stride;
         }
 
         fPixelStorei(LOCAL_GL_UNPACK_ALIGNMENT, 4);
         return;
     }
-#endif
 
     fTexImage2D(target,
                 level,
                 internalformat,
                 width,
                 height,
                 border,
                 format,
                 type,
                 pixels);
 
-#ifndef USE_GLES2
-    fPixelStorei(LOCAL_GL_UNPACK_ROW_LENGTH, 0);
-#endif
+    if (useUnpackRowLength)
+        fPixelStorei(LOCAL_GL_UNPACK_ROW_LENGTH, 0);
     fPixelStorei(LOCAL_GL_UNPACK_ALIGNMENT, 4);
 }
 
 void
 GLContext::TexSubImage2D(GLenum target, GLint level, 
                          GLint xoffset, GLint yoffset, 
                          GLsizei width, GLsizei height, GLsizei stride,
                          GLint pixelsize, GLenum format, 
--- a/gfx/thebes/GLContext.h
+++ b/gfx/thebes/GLContext.h
@@ -975,16 +975,17 @@ public:
         IMG_read_format,
         EXT_read_format_bgra,
         APPLE_client_storage,
         ARB_texture_non_power_of_two,
         ARB_pixel_buffer_object,
         ARB_ES2_compatibility,
         OES_texture_float,
         ARB_texture_float,
+        EXT_unpack_subimage,
         Extensions_Max
     };
 
     PRBool IsExtensionSupported(GLExtensions aKnownExtension) {
         return mAvailableExtensions[aKnownExtension];
     }
 
     // for unknown extensions
--- a/intl/uconv/tests/unit/xpcshell.ini
+++ b/intl/uconv/tests/unit/xpcshell.ini
@@ -106,18 +106,16 @@ tail =
 [test_encode_CP1255.js]
 [test_encode_CP1256.js]
 [test_encode_CP1257.js]
 [test_encode_CP1258.js]
 [test_encode_CP850.js]
 [test_encode_CP852.js]
 [test_encode_CP855.js]
 [test_encode_CP857.js]
-# Bug 676958: test consistently hangs on Android
-skip-if = os == "android"
 [test_encode_CP862.js]
 [test_encode_CP864.js]
 [test_encode_CP874.js]
 [test_encode_armscii.js]
 [test_encode_geostd8.js]
 [test_encode_gbk.js]
 [test_encode_tcvn5712.js]
 [test_encode_utf-7_internal.js]
--- a/js/ductwork/debugger/tests/xpcshell.ini
+++ b/js/ductwork/debugger/tests/xpcshell.ini
@@ -1,5 +1,7 @@
 [DEFAULT]
 head = head_dbg.js
 tail =
 
 [test_nativewrappers.js]
+# Bug 685068
+fail-if = os == "android"
--- a/js/jsd/jsd_xpc.cpp
+++ b/js/jsd/jsd_xpc.cpp
@@ -55,19 +55,16 @@
 #include "jsdebug.h"
 #include "nsReadableUtils.h"
 #include "nsCRT.h"
 
 /* XXX DOM dependency */
 #include "nsIScriptContext.h"
 #include "nsIJSContextStack.h"
 
-/* XXX private JS headers. */
-#include "jscompartment.h"
-
 /*
  * defining CAUTIOUS_SCRIPTHOOK makes jsds disable GC while calling out to the
  * script hook.  This was a hack to avoid some js engine problems that should
  * be fixed now (see Mozilla bug 77636).
  */
 #undef CAUTIOUS_SCRIPTHOOK
 
 #ifdef DEBUG_verbose
--- a/js/src/Makefile.in
+++ b/js/src/Makefile.in
@@ -187,17 +187,16 @@ INSTALLED_HEADERS = \
 		jsdhash.h \
 		jsemit.h \
 		jsfun.h \
 		jsfriendapi.h \
 		jsgc.h \
 		jscell.h \
 		jsgcchunk.h \
 		jsgcstats.h \
-		jscompartment.h \
 		jshash.h \
 		jsinfer.h \
 		jsinferinlines.h \
 		jsinterp.h \
 		jsinttypes.h \
 		jsiter.h \
 		jslock.h \
 		jsobj.h \
@@ -387,32 +386,30 @@ CPPSRCS += 	checks.cc \
 		platform.cc \
 		utils.cc \
 		$(NONE)
 
 #
 # END enclude sources for V8 dtoa
 #############################################
 
+# For architectures without YARR JIT, PCRE is faster than the YARR
+# interpreter (bug 684559).
+
 ifeq (,$(filter arm% sparc %86 x86_64,$(TARGET_CPU)))
 
-VPATH +=	$(srcdir)/assembler \
-		$(srcdir)/assembler/wtf \
-		$(srcdir)/yarr\
+VPATH +=        $(srcdir)/yarr/pcre \
 		$(NULL)
 
 CPPSRCS += \
-		Assertions.cpp \
-		OSAllocatorOS2.cpp \
-		OSAllocatorPosix.cpp \
-		OSAllocatorWin.cpp \
-		PageBlock.cpp \
-		YarrInterpreter.cpp \
-		YarrPattern.cpp \
-		YarrSyntaxChecker.cpp \
+                pcre_compile.cpp \
+                pcre_exec.cpp \
+                pcre_tables.cpp \
+                pcre_xclass.cpp \
+                pcre_ucp_searchfuncs.cpp \
 		$(NULL)
 else
 
 ###############################################
 # BEGIN include sources for the Nitro assembler
 #
 
 ENABLE_YARR_JIT = 1
--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -1258,17 +1258,17 @@ if test -n "$CROSS_COMPILE"; then
     OS_TARGET="${target_os}"
     OS_ARCH=`echo $target_os | sed -e 's|/|_|g'`
     OS_RELEASE=
     case "${target_os}" in
         linux*)       OS_ARCH=Linux OS_TARGET=Linux ;;
         kfreebsd*-gnu) OS_ARCH=GNU_kFreeBSD OS_TARGET=GNU_kFreeBSD ;;
         gnu*)         OS_ARCH=GNU ;;
         solaris*)     OS_ARCH=SunOS OS_RELEASE=5 ;;
-        mingw*)       OS_ARCH=WINNT ;;
+        mingw*)       OS_ARCH=WINNT OS_TARGET=WINNT ;;
         darwin*)      OS_ARCH=Darwin OS_TARGET=Darwin ;;
     esac
     case "${target}" in
         *-android*|*-linuxandroid*) OS_ARCH=Linux OS_TARGET=Android ;;
     esac
 else
     OS_TARGET=`uname -s`
     OS_ARCH=`uname -s | sed -e 's|/|_|g'`
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -1643,17 +1643,16 @@ static JSStdName standard_class_names[] 
 
 #if JS_HAS_XML_SUPPORT
     {js_InitXMLClass,           LAZY_ATOM(XMLList), CLASP(XML)},
     {js_InitXMLClass,           LAZY_ATOM(isXMLName), CLASP(XML)},
 #endif
 
 #if JS_HAS_GENERATORS
     {js_InitIteratorClasses,    EAGER_ATOM_AND_CLASP(Iterator)},
-    {js_InitIteratorClasses,    EAGER_ATOM_AND_CLASP(Generator)},
 #endif
 
     /* Typed Arrays */
     {js_InitTypedArrayClasses,  EAGER_CLASS_ATOM(ArrayBuffer),  &ArrayBufferClass},
     {js_InitTypedArrayClasses,  EAGER_CLASS_ATOM(Int8Array),    TYPED_ARRAY_CLASP(TYPE_INT8)},
     {js_InitTypedArrayClasses,  EAGER_CLASS_ATOM(Uint8Array),   TYPED_ARRAY_CLASP(TYPE_UINT8)},
     {js_InitTypedArrayClasses,  EAGER_CLASS_ATOM(Int16Array),   TYPED_ARRAY_CLASP(TYPE_INT16)},
     {js_InitTypedArrayClasses,  EAGER_CLASS_ATOM(Uint16Array),  TYPED_ARRAY_CLASP(TYPE_UINT16)},
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -2047,17 +2047,17 @@ struct JSClass {
  * member initial value.  The "original ... value" verbiage is there because
  * in ECMA-262, global properties naming class objects are read/write and
  * deleteable, for the most part.
  *
  * Implementing this efficiently requires that global objects have classes
  * with the following flags. Failure to use JSCLASS_GLOBAL_FLAGS was
  * prevously allowed, but is now an ES5 violation and thus unsupported.
  */
-#define JSCLASS_GLOBAL_SLOT_COUNT      (JSProto_LIMIT * 3 + 7)
+#define JSCLASS_GLOBAL_SLOT_COUNT      (JSProto_LIMIT * 3 + 8)
 #define JSCLASS_GLOBAL_FLAGS                                                  \
     (JSCLASS_IS_GLOBAL | JSCLASS_HAS_RESERVED_SLOTS(JSCLASS_GLOBAL_SLOT_COUNT))
 
 /* Fast access to the original value of each standard class's prototype. */
 #define JSCLASS_CACHED_PROTO_SHIFT      (JSCLASS_HIGH_FLAGS_SHIFT + 8)
 #define JSCLASS_CACHED_PROTO_WIDTH      8
 #define JSCLASS_CACHED_PROTO_MASK       JS_BITMASK(JSCLASS_CACHED_PROTO_WIDTH)
 #define JSCLASS_HAS_CACHED_PROTO(key)   ((key) << JSCLASS_CACHED_PROTO_SHIFT)
--- a/js/src/jsfriendapi.cpp
+++ b/js/src/jsfriendapi.cpp
@@ -39,16 +39,17 @@
 
 #include "jscntxt.h"
 #include "jscompartment.h"
 #include "jsfriendapi.h"
 
 #include "jsobjinlines.h"
 
 using namespace js;
+using namespace JS;
 
 JS_FRIEND_API(JSString *)
 JS_GetAnonymousString(JSRuntime *rt)
 {
     JS_ASSERT(rt->state == JSRTS_UP);
     return rt->atomState.anonymousAtom;
 }
 
@@ -107,16 +108,63 @@ JS_NewObjectWithUniqueType(JSContext *cx
 JS_FRIEND_API(uint32)
 JS_ObjectCountDynamicSlots(JSObject *obj)
 {
     if (obj->hasSlotsArray())
         return obj->numDynamicSlots(obj->numSlots());
     return 0;
 }
 
+JS_FRIEND_API(JSPrincipals *)
+JS_GetCompartmentPrincipals(JSCompartment *compartment)
+{
+    return compartment->principals;
+}
+
+JS_FRIEND_API(JSBool)
+JS_WrapPropertyDescriptor(JSContext *cx, js::PropertyDescriptor *desc)
+{
+    return cx->compartment->wrap(cx, desc);
+}
+
+AutoPreserveCompartment::AutoPreserveCompartment(JSContext *cx
+                                                 JS_GUARD_OBJECT_NOTIFIER_PARAM_NO_INIT)
+  : cx(cx), oldCompartment(cx->compartment)
+{
+    JS_GUARD_OBJECT_NOTIFIER_INIT;
+}
+
+AutoPreserveCompartment::~AutoPreserveCompartment()
+{
+    /* The old compartment may have been destroyed, so we can't use cx->setCompartment. */
+    cx->compartment = oldCompartment;
+}
+
+AutoSwitchCompartment::AutoSwitchCompartment(JSContext *cx, JSCompartment *newCompartment
+                                             JS_GUARD_OBJECT_NOTIFIER_PARAM_NO_INIT)
+  : cx(cx), oldCompartment(cx->compartment)
+{
+    JS_GUARD_OBJECT_NOTIFIER_INIT;
+    cx->setCompartment(newCompartment);
+}
+
+AutoSwitchCompartment::AutoSwitchCompartment(JSContext *cx, JSObject *target
+                                             JS_GUARD_OBJECT_NOTIFIER_PARAM_NO_INIT)
+  : cx(cx), oldCompartment(cx->compartment)
+{
+    JS_GUARD_OBJECT_NOTIFIER_INIT;
+    cx->setCompartment(target->compartment());
+}
+
+AutoSwitchCompartment::~AutoSwitchCompartment()
+{
+    /* The old compartment may have been destroyed, so we can't use cx->setCompartment. */
+    cx->compartment = oldCompartment;
+}
+
 /*
  * The below code is for temporary telemetry use. It can be removed when
  * sufficient data has been harvested.
  */
 
 extern size_t sE4XObjectsCreated;
 
 JS_FRIEND_API(size_t)
--- a/js/src/jsfriendapi.h
+++ b/js/src/jsfriendapi.h
@@ -88,11 +88,50 @@ typedef struct TypeInferenceMemoryStats
 extern JS_FRIEND_API(void)
 JS_GetTypeInferenceMemoryStats(JSContext *cx, JSCompartment *compartment,
                                TypeInferenceMemoryStats *stats);
 
 extern JS_FRIEND_API(void)
 JS_GetTypeInferenceObjectStats(/*TypeObject*/ void *object,
                                TypeInferenceMemoryStats *stats);
 
+extern JS_FRIEND_API(JSPrincipals *)
+JS_GetCompartmentPrincipals(JSCompartment *compartment);
+
+#ifdef __cplusplus
+
+extern JS_FRIEND_API(JSBool)
+JS_WrapPropertyDescriptor(JSContext *cx, js::PropertyDescriptor *desc);
+
+#endif
+
 JS_END_EXTERN_C
 
+#ifdef __cplusplus
+
+namespace JS {
+
+class JS_FRIEND_API(AutoPreserveCompartment) {
+  private:
+    JSContext *cx;
+    JSCompartment *oldCompartment;
+  public:
+    AutoPreserveCompartment(JSContext *cx JS_GUARD_OBJECT_NOTIFIER_PARAM);
+    ~AutoPreserveCompartment();
+    JS_DECL_USE_GUARD_OBJECT_NOTIFIER
+};
+
+class JS_FRIEND_API(AutoSwitchCompartment) {
+  private:
+    JSContext *cx;
+    JSCompartment *oldCompartment;
+  public:
+    AutoSwitchCompartment(JSContext *cx, JSCompartment *newCompartment
+                          JS_GUARD_OBJECT_NOTIFIER_PARAM);
+    AutoSwitchCompartment(JSContext *cx, JSObject *target JS_GUARD_OBJECT_NOTIFIER_PARAM);
+    ~AutoSwitchCompartment();
+    JS_DECL_USE_GUARD_OBJECT_NOTIFIER
+};
+
+}
+#endif
+
 #endif /* jsfriendapi_h___ */
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -2255,17 +2255,17 @@ MarkAndSweep(JSContext *cx, JSCompartmen
     MarkRuntime(&gcmarker);
     gcmarker.drainMarkStack();
 
     /*
      * Mark weak roots.
      */
     while (WatchpointMap::markAllIteratively(&gcmarker) ||
            WeakMapBase::markAllIteratively(&gcmarker) ||
-           Debugger::markAllIteratively(&gcmarker, gckind))
+           Debugger::markAllIteratively(&gcmarker))
     {
         gcmarker.drainMarkStack();
     }
 
     rt->gcMarkingTracer = NULL;
 
     if (rt->gcCallback)
         (void) rt->gcCallback(cx, JSGC_MARK_END);
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -3962,17 +3962,20 @@ ScriptAnalysis::analyzeTypesBytecode(JSC
 
       case JSOP_UNBRAND:
         poppedTypes(pc, 0)->addSubset(cx, &pushed[0]);
         break;
 
       case JSOP_GENERATOR:
         if (script->hasFunction) {
             if (script->hasGlobal()) {
-                TypeObject *object = TypeScript::StandardType(cx, script, JSProto_Generator);
+                JSObject *proto = script->global()->getOrCreateGeneratorPrototype(cx);
+                if (!proto)
+                    return false;
+                TypeObject *object = proto->getNewType(cx);
                 if (!object)
                     return false;
                 TypeScript::ReturnTypes(script)->addType(cx, Type::ObjectType(object));
             } else {
                 TypeScript::ReturnTypes(script)->addType(cx, Type::UnknownType());
             }
         }
         break;
--- a/js/src/jsiter.cpp
+++ b/js/src/jsiter.cpp
@@ -1106,19 +1106,18 @@ generator_trace(JSTracer *trc, JSObject 
      * this code and save someone an hour later.
      */
     MarkStackRangeConservatively(trc, gen->floatingStack, fp->formalArgsEnd());
     js_TraceStackFrame(trc, fp);
     MarkStackRangeConservatively(trc, fp->slots(), gen->regs.sp);
 }
 
 Class js::GeneratorClass = {
-    js_Generator_str,
-    JSCLASS_HAS_PRIVATE | JSCLASS_HAS_CACHED_PROTO(JSProto_Generator) |
-    JSCLASS_IS_ANONYMOUS,
+    "Generator",
+    JSCLASS_HAS_PRIVATE,
     PropertyStub,         /* addProperty */
     PropertyStub,         /* delProperty */
     PropertyStub,         /* getProperty */
     StrictPropertyStub,   /* setProperty */
     EnumerateStub,
     ResolveStub,
     ConvertStub,
     generator_finalize,
@@ -1144,25 +1143,29 @@ Class js::GeneratorClass = {
  * JSGenerator object, which contains its own StackFrame that we populate
  * from *fp.  We know that upon return, the JSOP_GENERATOR opcode will return
  * from the activation in fp, so we can steal away fp->callobj and fp->argsobj
  * if they are non-null.
  */
 JS_REQUIRES_STACK JSObject *
 js_NewGenerator(JSContext *cx)
 {
-    JSObject *obj = NewBuiltinClassInstance(cx, &GeneratorClass);
-    if (!obj)
-        return NULL;
-
     FrameRegs &stackRegs = cx->regs();
     StackFrame *stackfp = stackRegs.fp();
     JS_ASSERT(stackfp->base() == cx->regs().sp);
     JS_ASSERT(stackfp->actualArgs() <= stackfp->formalArgs());
 
+    GlobalObject *global = stackfp->scopeChain().getGlobal();
+    JSObject *proto = global->getOrCreateGeneratorPrototype(cx);
+    if (!proto)
+        return NULL;
+    JSObject *obj = NewNonFunction<WithProto::Given>(cx, &GeneratorClass, proto, global);
+    if (!obj)
+        return NULL;
+
     /* Load and compute stack slot counts. */
     Value *stackvp = stackfp->actualArgs() - 2;
     uintN vplen = stackfp->formalArgsEnd() - stackvp;
 
     /* Compute JSGenerator size. */
     uintN nbytes = sizeof(JSGenerator) +
                    (-1 + /* one Value included in JSGenerator */
                     vplen +
@@ -1438,32 +1441,26 @@ InitIteratorClass(JSContext *cx, GlobalO
         return false;
 
     if (!DefinePropertiesAndBrand(cx, iteratorProto, NULL, iterator_methods))
         return false;
 
     return DefineConstructorAndPrototype(cx, global, JSProto_Iterator, ctor, iteratorProto);
 }
 
-static bool
-InitGeneratorClass(JSContext *cx, GlobalObject *global)
+bool
+GlobalObject::initGeneratorClass(JSContext *cx)
 {
 #if JS_HAS_GENERATORS
-    JSObject *proto = global->createBlankPrototype(cx, &GeneratorClass);
-    if (!proto)
-        return false;
-
-    if (!DefinePropertiesAndBrand(cx, proto, NULL, generator_methods))
+    JSObject *proto = createBlankPrototype(cx, &GeneratorClass);
+    if (!proto || !DefinePropertiesAndBrand(cx, proto, NULL, generator_methods))
         return false;
-
-    /* This should use a non-JSProtoKey'd slot, but this is easier for now. */
-    return DefineConstructorAndPrototype(cx, global, JSProto_Generator, proto, proto);
-#else
+    setReservedSlot(GENERATOR_PROTO, ObjectValue(*proto));
+#endif
     return true;
-#endif
 }
 
 static JSObject *
 InitStopIterationClass(JSContext *cx, GlobalObject *global)
 {
     JSObject *proto = global->createBlankPrototype(cx, &StopIterationClass);
     if (!proto || !proto->freeze(cx))
         return NULL;
@@ -1491,12 +1488,12 @@ js_InitIteratorClasses(JSContext *cx, JS
      * Iterator class a second time will assert.
      */
     JSObject *iter;
     if (!js_GetClassObject(cx, global, JSProto_Iterator, &iter))
         return NULL;
     if (iter)
         return iter;
 
-    if (!InitIteratorClass(cx, global) || !InitGeneratorClass(cx, global))
+    if (!InitIteratorClass(cx, global) || !global->initGeneratorClass(cx))
         return NULL;
     return InitStopIterationClass(cx, global);
 }
--- a/js/src/jsparse.h
+++ b/js/src/jsparse.h
@@ -1057,21 +1057,21 @@ struct JSFunctionBoxQueue {
     size_t count()  { return head - tail; }
     size_t length() { return lengthMask + 1; }
 
     JSFunctionBoxQueue()
       : vector(NULL), head(0), tail(0), lengthMask(0) { }
 
     bool init(uint32 count) {
         lengthMask = JS_BITMASK(JS_CeilingLog2(count));
-        vector = js::OffTheBooks::array_new<JSFunctionBox*>(length());
+        vector = (JSFunctionBox **) js::OffTheBooks::malloc_(sizeof(JSFunctionBox) * length());
         return !!vector;
     }
 
-    ~JSFunctionBoxQueue() { js::UnwantedForeground::array_delete(vector); }
+    ~JSFunctionBoxQueue() { js::UnwantedForeground::free_(vector); }
 
     void push(JSFunctionBox *funbox) {
         if (!funbox->queued) {
             JS_ASSERT(count() < length());
             vector[head++ & lengthMask] = funbox;
             funbox->queued = true;
         }
     }
--- a/js/src/jsproto.tbl
+++ b/js/src/jsproto.tbl
@@ -45,22 +45,16 @@
 # define XMLFILTER_INIT                 js_InitXMLFilterClass
 #else
 # define XML_INIT                       js_InitNullClass
 # define NAMESPACE_INIT                 js_InitNullClass
 # define QNAME_INIT                     js_InitNullClass
 # define XMLFILTER_INIT                 js_InitNullClass
 #endif
 
-#if JS_HAS_GENERATORS
-# define GENERATOR_INIT                 js_InitIteratorClasses
-#else
-# define GENERATOR_INIT                 js_InitNullClass
-#endif
-
 /*
  * Enumerator codes in the second column must not change -- they are part of
  * the JS XDR API.  Client modules including jsproto.tbl should consider
  * wrapping the inclusion with JS_BEGIN_EXTERN_C and JS_END_EXTERN_C.
  */
 JS_PROTO(Null,                   0,     js_InitNullClass)
 JS_PROTO(Object,                 1,     js_InitFunctionAndObjectClasses)
 JS_PROTO(Function,               2,     js_InitFunctionAndObjectClasses)
@@ -78,29 +72,27 @@ JS_PROTO(QName,                 13,     
 JS_PROTO(Error,                 14,     js_InitExceptionClasses)
 JS_PROTO(InternalError,         15,     js_InitExceptionClasses)
 JS_PROTO(EvalError,             16,     js_InitExceptionClasses)
 JS_PROTO(RangeError,            17,     js_InitExceptionClasses)
 JS_PROTO(ReferenceError,        18,     js_InitExceptionClasses)
 JS_PROTO(SyntaxError,           19,     js_InitExceptionClasses)
 JS_PROTO(TypeError,             20,     js_InitExceptionClasses)
 JS_PROTO(URIError,              21,     js_InitExceptionClasses)
-JS_PROTO(Generator,             22,     GENERATOR_INIT)
-JS_PROTO(Iterator,              23,     js_InitIteratorClasses)
-JS_PROTO(StopIteration,         24,     js_InitIteratorClasses)
-JS_PROTO(ArrayBuffer,           25,     js_InitTypedArrayClasses)
-JS_PROTO(Int8Array,             26,     js_InitTypedArrayClasses)
-JS_PROTO(Uint8Array,            27,     js_InitTypedArrayClasses)
-JS_PROTO(Int16Array,            28,     js_InitTypedArrayClasses)
-JS_PROTO(Uint16Array,           29,     js_InitTypedArrayClasses)
-JS_PROTO(Int32Array,            30,     js_InitTypedArrayClasses)
-JS_PROTO(Uint32Array,           31,     js_InitTypedArrayClasses)
-JS_PROTO(Float32Array,          32,     js_InitTypedArrayClasses)
-JS_PROTO(Float64Array,          33,     js_InitTypedArrayClasses)
-JS_PROTO(Uint8ClampedArray,     34,     js_InitTypedArrayClasses)
-JS_PROTO(Proxy,                 35,     js_InitProxyClass)
-JS_PROTO(AnyName,               36,     js_InitNullClass)
-JS_PROTO(WeakMap,               37,     js_InitWeakMapClass)
+JS_PROTO(Iterator,              22,     js_InitIteratorClasses)
+JS_PROTO(StopIteration,         23,     js_InitIteratorClasses)
+JS_PROTO(ArrayBuffer,           24,     js_InitTypedArrayClasses)
+JS_PROTO(Int8Array,             25,     js_InitTypedArrayClasses)
+JS_PROTO(Uint8Array,            26,     js_InitTypedArrayClasses)
+JS_PROTO(Int16Array,            27,     js_InitTypedArrayClasses)
+JS_PROTO(Uint16Array,           28,     js_InitTypedArrayClasses)
+JS_PROTO(Int32Array,            29,     js_InitTypedArrayClasses)
+JS_PROTO(Uint32Array,           30,     js_InitTypedArrayClasses)
+JS_PROTO(Float32Array,          31,     js_InitTypedArrayClasses)
+JS_PROTO(Float64Array,          32,     js_InitTypedArrayClasses)
+JS_PROTO(Uint8ClampedArray,     33,     js_InitTypedArrayClasses)
+JS_PROTO(Proxy,                 34,     js_InitProxyClass)
+JS_PROTO(AnyName,               35,     js_InitNullClass)
+JS_PROTO(WeakMap,               36,     js_InitWeakMapClass)
 
 #undef XML_INIT
 #undef NAMESPACE_INIT
 #undef QNAME_INIT
-#undef GENERATOR_INIT
--- a/js/src/jsprvtd.h
+++ b/js/src/jsprvtd.h
@@ -179,16 +179,17 @@ class HashSet;
 
 template <typename K,
           typename V,
           size_t InlineElems>
 class InlineMap;
 
 class PropertyCache;
 struct PropertyCacheEntry;
+struct PropertyDescriptor;
 
 struct Shape;
 struct EmptyShape;
 class Bindings;
 
 class MultiDeclRange;
 class ParseMapPool;
 class DefnOrHeader;
--- a/js/src/jsregexp.cpp
+++ b/js/src/jsregexp.cpp
@@ -189,16 +189,50 @@ js_ObjectIsRegExp(JSObject *obj)
 {
     return obj->isRegExp();
 }
 
 /*
  * js::RegExp
  */
 
+#if !ENABLE_YARR_JIT
+void
+RegExp::reportPCREError(JSContext *cx, int error)
+{
+#define REPORT(msg_) \
+    JS_ReportErrorFlagsAndNumberUC(cx, JSREPORT_ERROR, js_GetErrorMessage, NULL, msg_); \
+    return
+    switch (error) {
+      case -2: REPORT(JSMSG_REGEXP_TOO_COMPLEX);
+      case 0: JS_NOT_REACHED("Precondition violation: an error must have occurred."); 
+      case 1: REPORT(JSMSG_TRAILING_SLASH);
+      case 2: REPORT(JSMSG_TRAILING_SLASH); 
+      case 3: REPORT(JSMSG_REGEXP_TOO_COMPLEX);
+      case 4: REPORT(JSMSG_BAD_QUANTIFIER);
+      case 5: REPORT(JSMSG_BAD_QUANTIFIER);
+      case 6: REPORT(JSMSG_BAD_CLASS_RANGE);
+      case 7: REPORT(JSMSG_REGEXP_TOO_COMPLEX);
+      case 8: REPORT(JSMSG_BAD_CLASS_RANGE);
+      case 9: REPORT(JSMSG_BAD_QUANTIFIER);
+      case 10: REPORT(JSMSG_UNMATCHED_RIGHT_PAREN);
+      case 11: REPORT(JSMSG_REGEXP_TOO_COMPLEX);
+      case 12: REPORT(JSMSG_UNMATCHED_RIGHT_PAREN);
+      case 13: REPORT(JSMSG_REGEXP_TOO_COMPLEX);
+      case 14: REPORT(JSMSG_MISSING_PAREN);
+      case 15: REPORT(JSMSG_BAD_BACKREF);
+      case 16: REPORT(JSMSG_REGEXP_TOO_COMPLEX);
+      case 17: REPORT(JSMSG_REGEXP_TOO_COMPLEX);
+      default:
+        JS_NOT_REACHED("Precondition violation: unknown PCRE error code.");
+    }
+#undef REPORT
+}
+#endif
+
 void
 RegExp::reportYarrError(JSContext *cx, TokenStream *ts, JSC::Yarr::ErrorCode error)
 {
     switch (error) {
       case JSC::Yarr::NoError:
         JS_NOT_REACHED("Called reportYarrError with value for no error");
         return;
 #define COMPILE_EMSG(__code, __msg)                                                              \
--- a/js/src/jsregexpinlines.h
+++ b/js/src/jsregexpinlines.h
@@ -50,16 +50,18 @@
 
 #include "methodjit/MethodJIT.h"
 #include "assembler/wtf/Platform.h"
 #include "yarr/BumpPointerAllocator.h"
 
 #include "yarr/Yarr.h"
 #if ENABLE_YARR_JIT
 #include "yarr/YarrJIT.h"
+#else
+#include "yarr/pcre/pcre.h"
 #endif
 
 namespace js {
 
 /*
  * res = RegExp statics.
  */
 
@@ -93,53 +95,64 @@ regexp_statics_construct(JSContext *cx, 
  * Note: refCount cannot overflow because that would require more referring
  * regexp objects than there is space for in addressable memory.
  */
 class RegExp
 {
 #if ENABLE_YARR_JIT
     /* native code is valid only if codeBlock.isFallBack() == false */
     JSC::Yarr::YarrCodeBlock    codeBlock;
+    JSC::Yarr::BytecodePattern  *byteCode;
+#else
+    JSRegExp                    *compiled;
 #endif
-    JSC::Yarr::BytecodePattern  *byteCode;
     JSLinearString              *source;
     size_t                      refCount;
     unsigned                    parenCount; /* Must be |unsigned| to interface with YARR. */
     uint32                      flags;
 #ifdef DEBUG
   public:
     JSCompartment               *compartment;
 
   private:
 #endif
 
     RegExp(JSLinearString *source, uint32 flags, JSCompartment *compartment)
       :
 #if ENABLE_YARR_JIT
         codeBlock(),
+        byteCode(NULL),
+#else
+        compiled(NULL),
 #endif
-        byteCode(NULL), source(source), refCount(1), parenCount(0), flags(flags)
+        source(source), refCount(1), parenCount(0), flags(flags)
 #ifdef DEBUG
         , compartment(compartment)
 #endif
     { }
 
     JS_DECLARE_ALLOCATION_FRIENDS_FOR_PRIVATE_CONSTRUCTOR;
 
     ~RegExp() {
 #if ENABLE_YARR_JIT
         codeBlock.release();
-#endif
         if (byteCode)
             Foreground::delete_<JSC::Yarr::BytecodePattern>(byteCode);
+#else
+        if (compiled)
+            jsRegExpFree(compiled);
+#endif
     }
 
     bool compileHelper(JSContext *cx, JSLinearString &pattern, TokenStream *ts);
     bool compile(JSContext *cx, TokenStream *ts);
     static const uint32 allFlags = JSREG_FOLD | JSREG_GLOB | JSREG_MULTILINE | JSREG_STICKY;
+#if !ENABLE_YARR_JIT
+    void reportPCREError(JSContext *cx, int error);
+#endif
     void reportYarrError(JSContext *cx, TokenStream *ts, JSC::Yarr::ErrorCode error);
     static inline bool initArena(JSContext *cx);
     static inline void checkMatchPairs(JSString *input, int *buf, size_t matchItemCount);
     static JSObject *createResult(JSContext *cx, JSString *input, int *buf, size_t matchItemCount);
     inline bool executeInternal(JSContext *cx, RegExpStatics *res, JSString *input,
                                 size_t *lastIndex, bool test, Value *rval);
 
   public:
@@ -365,23 +378,30 @@ RegExp::executeInternal(JSContext *cx, R
 
     int result;
 #if ENABLE_YARR_JIT
     if (!codeBlock.isFallBack())
         result = JSC::Yarr::execute(codeBlock, chars, *lastIndex - inputOffset, len, buf);
     else
         result = JSC::Yarr::interpret(byteCode, chars, *lastIndex - inputOffset, len, buf);
 #else
-    result = JSC::Yarr::interpret(byteCode, chars, *lastIndex - inputOffset, len, buf);
+    result = jsRegExpExecute(cx, compiled, chars, len, *lastIndex - inputOffset, buf, bufCount);
 #endif
     if (result == -1) {
         *rval = NullValue();
         return true;
     }
 
+#if !ENABLE_YARR_JIT
+    if (result < 0) {
+        reportPCREError(cx, result);
+        return false;
+    }
+#endif
+
     /* 
      * Adjust buf for the inputOffset. Use of sticky is rare and the matchItemCount is small, so
      * just do another pass.
      */
     if (JS_UNLIKELY(inputOffset)) {
         for (size_t i = 0; i < matchItemCount; ++i)
             buf[i] = buf[i] < 0 ? -1 : buf[i] + inputOffset;
     }
@@ -467,42 +487,52 @@ EnableYarrJIT(JSContext *cx)
 #else
     return true;
 #endif
 }
 
 inline bool
 RegExp::compileHelper(JSContext *cx, JSLinearString &pattern, TokenStream *ts)
 {
+#if ENABLE_YARR_JIT
     JSC::Yarr::ErrorCode yarrError;
     JSC::Yarr::YarrPattern yarrPattern(pattern, ignoreCase(), multiline(), &yarrError);
     if (yarrError) {
         reportYarrError(cx, ts, yarrError);
         return false;
     }
     parenCount = yarrPattern.m_numSubpatterns;
 
-#if ENABLE_YARR_JIT && defined(JS_METHODJIT)
+#if defined(JS_METHODJIT)
     if (EnableYarrJIT(cx) && !yarrPattern.m_containsBackreferences) {
         bool ok = cx->compartment->ensureJaegerCompartmentExists(cx);
         if (!ok)
             return false;
         JSC::Yarr::JSGlobalData globalData(cx->compartment->jaegerCompartment()->execAlloc());
         JSC::Yarr::jitCompile(yarrPattern, &globalData, codeBlock);
         if (!codeBlock.isFallBack())
             return true;
     }
 #endif
 
-#if ENABLE_YARR_JIT
     codeBlock.setFallBack(true);
+    byteCode = JSC::Yarr::byteCompile(yarrPattern, cx->compartment->regExpAllocator).get();
+    return true;
+#else
+    int error = 0;
+    compiled = jsRegExpCompile(pattern.chars(), pattern.length(),
+        ignoreCase() ? JSRegExpIgnoreCase : JSRegExpDoNotIgnoreCase,
+        multiline() ? JSRegExpMultiline : JSRegExpSingleLine,
+        &parenCount, &error);
+    if (error) {
+        reportPCREError(cx, error);
+        return false;
+    }
+    return true;
 #endif
-    byteCode = JSC::Yarr::byteCompile(yarrPattern, cx->compartment->regExpAllocator).get();
-
-    return true;
 }
 
 inline bool
 RegExp::compile(JSContext *cx, TokenStream *ts)
 {
     /* Flatten source early for the rest of compilation. */
     if (!source->ensureLinear(cx))
         return false;
--- a/js/src/jsxdrapi.h
+++ b/js/src/jsxdrapi.h
@@ -217,17 +217,17 @@ JS_XDRFindClassById(JSXDRState *xdr, uin
  * Bytecode version number. Increment the subtrahend whenever JS bytecode
  * changes incompatibly.
  *
  * This version number should be XDR'ed once near the front of any file or
  * larger storage unit containing XDR'ed bytecode and other data, and checked
  * before deserialization of bytecode.  If the saved version does not match
  * the current version, abort deserialization and invalidate the file.
  */
-#define JSXDR_BYTECODE_VERSION      (0xb973c0de - 93)
+#define JSXDR_BYTECODE_VERSION      (0xb973c0de - 94)
 
 /*
  * Library-private functions.
  */
 extern JSBool
 js_XDRAtom(JSXDRState *xdr, JSAtom **atomp);
 
 JS_END_EXTERN_C
--- a/js/src/tests/js1_8_5/extensions/findReferences-01.js
+++ b/js/src/tests/js1_8_5/extensions/findReferences-01.js
@@ -5,17 +5,17 @@
 if (typeof findReferences == "function") {
     function C() {}
     var o = new C;
     o.x = {};               // via ordinary property
     o[42] = {};             // via numeric property
     o.myself = o;           // self-references should be reported
     o.alsoMyself = o;       // multiple self-references should all be reported
 
-    assertEq(referencesVia(o, 'type_proto', C.prototype), true);
+    assertEq(referencesVia(o, 'type; type_proto', C.prototype), true);
     assertEq(referencesVia(o, 'parent', this), true);
     assertEq(referencesVia(o, 'x', o.x), true);
     assertEq(referencesVia(o, '42', o[42]), true);
     assertEq(referencesVia(o, 'myself', o), true);
     assertEq(referencesVia(o, 'alsoMyself', o), true);
 
     function g() { return 42; }
     function s(v) { }
--- a/js/src/tests/js1_8_5/extensions/findReferences-02.js
+++ b/js/src/tests/js1_8_5/extensions/findReferences-02.js
@@ -15,14 +15,14 @@ if (typeof findReferences == "function")
     function returnHeavy(y) { eval(''); return function heavy() { return y; }; }
     assertEq(referencesVia(returnHeavy(o), 'parent; y', o), true);
     assertEq(referencesVia(returnHeavy(o), 'parent; parent', this), true);
 
     function returnBlock(z) { eval(''); let(w = z) { return function block() { return w; }; }; }
     assertEq(referencesVia(returnBlock(o), 'parent; w', o), true);
 
     function returnWithObj(v) { with(v) return function withObj() { return u; }; }
-    assertEq(referencesVia(returnWithObj(o), 'parent; type_proto', o), true);
+    assertEq(referencesVia(returnWithObj(o), 'parent; type; type_proto', o), true);
 
     reportCompare(true, true);
 } else {
     reportCompare(true, true, "test skipped: findReferences is not a function");
 }
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -1079,17 +1079,17 @@ Debugger::markCrossCompartmentDebuggerOb
  *      may yet be called.
  *   2. Mark breakpoint handlers.
  *
  * This happens during the iterative part of the GC mark phase. This method
  * returns true if it has to mark anything; GC calls it repeatedly until it
  * returns false.
  */
 bool
-Debugger::markAllIteratively(GCMarker *trc, JSGCInvocationKind gckind)
+Debugger::markAllIteratively(GCMarker *trc)
 {
     bool markedAny = false;
 
     /*
      * Find all Debugger objects in danger of GC. This code is a little
      * convoluted since the easiest way to find them is via their debuggees.
      */
     JSContext *cx = trc->context;
--- a/js/src/vm/Debugger.h
+++ b/js/src/vm/Debugger.h
@@ -288,17 +288,17 @@ class Debugger {
      *       - it has a breakpoint set on a live script
      *       - it has a watchpoint set on a live object.
      *
      * Debugger::markAllIteratively handles the last case. If it finds any
      * Debugger objects that are definitely live but not yet marked, it marks
      * them and returns true. If not, it returns false.
      */
     static void markCrossCompartmentDebuggerObjectReferents(JSTracer *tracer);
-    static bool markAllIteratively(GCMarker *trc, JSGCInvocationKind gckind);
+    static bool markAllIteratively(GCMarker *trc);
     static void sweepAll(JSContext *cx);
     static void detachAllDebuggersFromGlobal(JSContext *cx, GlobalObject *global,
                                              GlobalObjectSet::Enum *compartmentEnum);
 
     static inline void onEnterFrame(JSContext *cx);
     static inline void onLeaveFrame(JSContext *cx);
     static inline JSTrapStatus onDebuggerStatement(JSContext *cx, js::Value *vp);
     static inline JSTrapStatus onExceptionUnwind(JSContext *cx, js::Value *vp);
--- a/js/src/vm/GlobalObject.h
+++ b/js/src/vm/GlobalObject.h
@@ -37,16 +37,17 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef GlobalObject_h___
 #define GlobalObject_h___
 
 #include "jsfun.h"
+#include "jsiter.h"
 #include "jsvector.h"
 
 extern JSObject *
 js_InitFunctionAndObjectClasses(JSContext *cx, JSObject *obj);
 
 namespace js {
 
 class Debugger;
@@ -82,17 +83,18 @@ class GlobalObject : public ::JSObject {
     /*
      * Count of slots to store built-in constructors, prototypes, and initial
      * visible properties for the constructors.
      */
     static const uintN STANDARD_CLASS_SLOTS  = JSProto_LIMIT * 3;
 
     /* One-off properties stored after slots for built-ins. */
     static const uintN THROWTYPEERROR          = STANDARD_CLASS_SLOTS;
-    static const uintN REGEXP_STATICS          = THROWTYPEERROR + 1;
+    static const uintN GENERATOR_PROTO         = THROWTYPEERROR + 1;
+    static const uintN REGEXP_STATICS          = GENERATOR_PROTO + 1;
     static const uintN FUNCTION_NS             = REGEXP_STATICS + 1;
     static const uintN RUNTIME_CODEGEN_ENABLED = FUNCTION_NS + 1;
     static const uintN EVAL                    = RUNTIME_CODEGEN_ENABLED + 1;
     static const uintN FLAGS                   = EVAL + 1;
     static const uintN DEBUGGERS               = FLAGS + 1;
 
     /* Total reserved-slot count for global objects. */
     static const uintN RESERVED_SLOTS = DEBUGGERS + 1;
@@ -145,16 +147,24 @@ class GlobalObject : public ::JSObject {
         // JS_ASSERT(getSlot(THROWTYPEERROR).isUndefined());
         setSlot(THROWTYPEERROR, ObjectValue(*fun));
     }
 
     JSObject *getThrowTypeError() const {
         return &getSlot(THROWTYPEERROR).toObject();
     }
 
+    JSObject *getOrCreateGeneratorPrototype(JSContext *cx) {
+        Value &v = getSlotRef(GENERATOR_PROTO);
+        if (!v.isObject() && !js_InitIteratorClasses(cx, this))
+            return NULL;
+        JS_ASSERT(v.toObject().isGenerator());
+        return &v.toObject();
+    }
+
     Value getRegExpStatics() const {
         return getSlot(REGEXP_STATICS);
     }
 
     void clear(JSContext *cx);
 
     bool isCleared() const {
         return getSlot(FLAGS).toInt32() & FLAGS_CLEARED;
@@ -171,16 +181,17 @@ class GlobalObject : public ::JSObject {
         // confidently assert this.
         // JS_ASSERT(v.isUndefined());
         // JS_ASSERT(getSlot(EVAL).isUndefined());
         setSlot(EVAL, ObjectValue(*evalobj));
     }
 
     bool getFunctionNamespace(JSContext *cx, Value *vp);
 
+    bool initGeneratorClass(JSContext *cx);
     bool initStandardClasses(JSContext *cx);
 
     typedef js::Vector<js::Debugger *, 0, js::SystemAllocPolicy> DebuggerVector;
 
     /*
      * The collection of Debugger objects debugging this global. If this global
      * is not a debuggee, this returns either NULL or an empty vector.
      */
--- a/js/src/xpconnect/loader/mozJSComponentLoader.cpp
+++ b/js/src/xpconnect/loader/mozJSComponentLoader.cpp
@@ -69,17 +69,16 @@
 #include "nsString.h"
 #include "nsIScriptSecurityManager.h"
 #include "nsIURI.h"
 #include "nsIFileURL.h"
 #include "nsIJARURI.h"
 #include "nsNetUtil.h"
 #include "nsDOMFile.h"
 #include "jsxdrapi.h"
-#include "jscompartment.h"
 #include "jsprf.h"
 // For reporting errors with the console service
 #include "nsIScriptError.h"
 #include "nsIConsoleService.h"
 #include "nsIStorageStream.h"
 #include "nsIStringStream.h"
 #include "prmem.h"
 #if defined(XP_WIN)
@@ -747,18 +746,18 @@ mozJSComponentLoader::GlobalForLocation(
                                         jsval *exception)
 {
     nsresult rv;
 
     JSPrincipals* jsPrincipals = nsnull;
     JSCLContextHelper cx(this);
 
     // preserve caller's compartment
-    js::PreserveCompartment pc(cx);
-    
+    JS::AutoPreserveCompartment pc(cx);
+
     rv = mSystemPrincipal->GetJSPrincipals(cx, &jsPrincipals);
     NS_ENSURE_SUCCESS(rv, rv);
 
     JSPrincipalsHolder princHolder(mContext, jsPrincipals);
 
     nsCOMPtr<nsIXPCScriptable> backstagePass;
     rv = mRuntimeService->GetBackstagePass(getter_AddRefs(backstagePass));
     NS_ENSURE_SUCCESS(rv, rv);
--- a/js/src/xpconnect/shell/xpcshell.cpp
+++ b/js/src/xpconnect/shell/xpcshell.cpp
@@ -1963,16 +1963,21 @@ main(int argc, char **argv, char **envp)
         JS_BeginRequest(cx);
         {
             JSAutoEnterCompartment ac;
             if (!ac.enter(cx, glob)) {
                 JS_EndRequest(cx);
                 return 1;
             }
 
+            if (!JS_InitReflect(cx, glob)) {
+                JS_EndRequest(cx);
+                return 1;
+            }
+
             if (!JS_DefineFunctions(cx, glob, glob_functions) ||
                 !JS_DefineProfilingFunctions(cx, glob)) {
                 JS_EndRequest(cx);
                 return 1;
             }
 
             envobj = JS_DefineObject(cx, glob, "environment", &env_class, NULL, 0);
             if (!envobj || !JS_SetPrivate(cx, envobj, envp)) {
--- a/js/src/xpconnect/src/dom_quickstubs.qsconf
+++ b/js/src/xpconnect/src/dom_quickstubs.qsconf
@@ -592,16 +592,21 @@ customMethodCalls = {
         'code': '    nsIDocument *result = self->GetOwnerDocument();',
         'canFail': False
         },
     'nsIDOMNode_GetParentNode': {
         'thisType': 'nsINode',
         'code': '    nsINode *result = self->GetNodeParent();',
         'canFail': False
         },
+    'nsIDOMNode_GetParentElement': {
+        'thisType': 'nsINode',
+        'code': '    nsINode *result = self->GetElementParent();',
+        'canFail': False
+        },
     'nsIDOMNode_InsertBefore': {
         'thisType': 'nsINode',
         'arg0Type': 'nsINode',
         'arg1Type': 'nsINode',
         'code': '    nsINode *result = self->InsertBefore(arg0, arg1, &rv);\n'
                 '    if(NS_FAILED(rv))\n'
                 '        result = nsnull;'
         },
--- a/js/src/xpconnect/src/nsXPConnect.cpp
+++ b/js/src/xpconnect/src/nsXPConnect.cpp
@@ -1056,17 +1056,17 @@ CreateNewCompartment(JSContext *cx, JSCl
         JSPRINCIPALS_DROP(cx, principals);
 
     if(!tempGlobal)
         return false;
 
     *global = tempGlobal;
     *compartment = tempGlobal->compartment();
 
-    js::SwitchToCompartment sc(cx, *compartment);
+    JS::AutoSwitchCompartment sc(cx, *compartment);
     JS_SetCompartmentPrivate(cx, *compartment, priv_holder.forget());
     return true;
 }
 
 nsresult
 xpc_CreateGlobalObject(JSContext *cx, JSClass *clasp,
                        nsIPrincipal *principal, nsISupports *ptr,
                        bool wantXrays, JSObject **global,
@@ -1088,17 +1088,17 @@ xpc_CreateGlobalObject(JSContext *cx, JS
         {
             return UnexpectedFailure(NS_ERROR_FAILURE);
         }
 
         map.Put(&key, *compartment);
     }
     else
     {
-        js::SwitchToCompartment sc(cx, *compartment);
+        JS::AutoSwitchCompartment sc(cx, *compartment);
 
         JSObject *tempGlobal = JS_NewGlobalObject(cx, clasp);
         if(!tempGlobal)
             return UnexpectedFailure(NS_ERROR_FAILURE);
         *global = tempGlobal;
     }
 
     return NS_OK;
@@ -1125,17 +1125,17 @@ xpc_CreateMTGlobalObject(JSContext *cx, 
         {
             return UnexpectedFailure(NS_ERROR_UNEXPECTED);
         }
 
         map.Put(ptr, *compartment);
     }
     else
     {
-        js::SwitchToCompartment sc(cx, *compartment);
+        JS::AutoSwitchCompartment sc(cx, *compartment);
 
         JSObject *tempGlobal = JS_NewGlobalObject(cx, clasp);
         if(!tempGlobal)
             return UnexpectedFailure(NS_ERROR_FAILURE);
         *global = tempGlobal;
     }
 
     return NS_OK;
@@ -2546,17 +2546,17 @@ nsXPConnect::CheckForDebugMode(JSRuntime
             AutoDestroyContext(JSContext *cx) : cx(cx) {}
             ~AutoDestroyContext() { JS_DestroyContext(cx); }
         } adc(cx);
         JSAutoRequest ar(cx);
 
         js::CompartmentVector &vector = rt->compartments;
         for (JSCompartment **p = vector.begin(); p != vector.end(); ++p) {
             JSCompartment *comp = *p;
-            if (!comp->principals) {
+            if (!JS_GetCompartmentPrincipals(comp)) {
                 /* Ignore special compartments (atoms, JSD compartments) */
                 continue;
             }
 
             /* ParticipatesInCycleCollection means "on the main thread" */
             if (xpc::CompartmentParticipatesInCycleCollection(cx, comp)) {
                 if (!JS_SetDebugModeForCompartment(cx, comp, gDesiredDebugMode))
                     goto fail;
--- a/js/src/xpconnect/src/xpcjsruntime.cpp
+++ b/js/src/xpconnect/src/xpcjsruntime.cpp
@@ -100,18 +100,18 @@ WrappedJSDyingJSObjectFinder(JSDHashTabl
     nsXPCWrappedJS* wrapper = ((JSObject2WrappedJSMap::Entry*)hdr)->value;
     NS_ASSERTION(wrapper, "found a null JS wrapper!");
 
     // walk the wrapper chain and find any whose JSObject is to be finalized
     while(wrapper)
     {
         if(wrapper->IsSubjectToFinalization())
         {
-            js::SwitchToCompartment sc(data->cx,
-                                       wrapper->GetJSObjectPreserveColor());
+            JS::AutoSwitchCompartment sc(data->cx,
+                                         wrapper->GetJSObjectPreserveColor());
             if(JS_IsAboutToBeFinalized(data->cx,
                                        wrapper->GetJSObjectPreserveColor()))
                 data->array->AppendElement(wrapper);
         }
         wrapper = wrapper->GetNextWrapper();
     }
     return JS_DHASH_NEXT;
 }
--- a/js/src/xpconnect/src/xpcprivate.h
+++ b/js/src/xpconnect/src/xpcprivate.h
@@ -53,18 +53,18 @@
 #include "xpcpublic.h"
 #include "jsapi.h"
 #include "jsdhash.h"
 #include "jsprf.h"
 #include "prprf.h"
 #include "jsinterp.h"
 #include "jscntxt.h"
 #include "jsdbgapi.h"
+#include "jsfriendapi.h"
 #include "jsgc.h"
-#include "jscompartment.h"
 #include "nscore.h"
 #include "nsXPCOM.h"
 #include "nsAutoPtr.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsCycleCollector.h"
 #include "nsDebug.h"
 #include "nsISupports.h"
 #include "nsIServiceManager.h"
--- a/js/src/xpconnect/src/xpcwrappednativescope.cpp
+++ b/js/src/xpconnect/src/xpcwrappednativescope.cpp
@@ -437,17 +437,17 @@ XPCWrappedNativeScope::FinishedMarkPhase
 
     XPCWrappedNativeScope* prev = nsnull;
     XPCWrappedNativeScope* cur = gScopes;
 
     while(cur)
     {
         XPCWrappedNativeScope* next = cur->mNext;
 
-        js::SwitchToCompartment sc(cx, cur->mGlobalJSObject);
+        JS::AutoSwitchCompartment sc(cx, cur->mGlobalJSObject);
 
         if(cur->mGlobalJSObject &&
            JS_IsAboutToBeFinalized(cx, cur->mGlobalJSObject))
         {
             cur->mGlobalJSObject = nsnull;
             cur->mScriptObjectPrincipal = nsnull;
             // Move this scope from the live list to the dying list.
             if(prev)
new file mode 100644
--- /dev/null
+++ b/js/src/xpconnect/tests/unit/test_reflect_parse.js
@@ -0,0 +1,59 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Test Reflect.parse in xpcshell.
+ *
+ * The Initial Developer of the Original Code is
+ * Alexander J. Vincent <ajvincent@gmail.com>.
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+/*
+({
+  loc:{start:{line:1, column:0}, end:{line:1, column:12}, source:null},
+  type:"Program",
+  body:[
+    {
+      loc:{start:{line:1, column:0}, end:{line:1, column:12}, source:null},
+      type:"ExpressionStatement",
+      expression:{
+        loc:{start:{line:1, column:0}, end:{line:1, column:12}, source:null},
+        type:"Literal",
+        value:"use strict"
+      }
+    }
+  ]
+})
+*/
+
+function run_test() {
+  // Reflect.parse is better tested in js shell; this basically tests its presence.
+  var parseData = Reflect.parse('"use strict"');
+  do_check_eq(parseData.body[0].expression.value, "use strict");
+}
--- a/js/src/xpconnect/tests/unit/xpcshell.ini
+++ b/js/src/xpconnect/tests/unit/xpcshell.ini
@@ -9,14 +9,15 @@ tail =
 [test_bug604362.js]
 [test_bug608142.js]
 [test_bug641378.js]
 [test_bug677864.js]
 [test_bug_442086.js]
 [test_file.js]
 [test_import.js]
 [test_js_weak_references.js]
+[test_reflect_parse.js]
 [test_localeCompare.js]
 # Bug 676965: test fails consistently on Android
 fail-if = os == "android"
 [test_recursive_import.js]
 [test_xpcomutils.js]
 [test_unload.js]
--- a/js/src/xpconnect/wrappers/AccessCheck.cpp
+++ b/js/src/xpconnect/wrappers/AccessCheck.cpp
@@ -48,20 +48,21 @@
 #include "XrayWrapper.h"
 #include "FilteringWrapper.h"
 #include "WrapperFactory.h"
 
 #include "jsfriendapi.h"
 
 namespace xpc {
 
-static nsIPrincipal *
+nsIPrincipal *
 GetCompartmentPrincipal(JSCompartment *compartment)
 {
-    return compartment->principals ? static_cast<nsJSPrincipals *>(compartment->principals)->nsIPrincipalPtr : 0;
+    JSPrincipals *prin = JS_GetCompartmentPrincipals(compartment);
+    return prin ? static_cast<nsJSPrincipals *>(prin)->nsIPrincipalPtr : nsnull;
 }
 
 bool
 AccessCheck::isSameOrigin(JSCompartment *a, JSCompartment *b)
 {
     nsIPrincipal *aprin = GetCompartmentPrincipal(a);
     nsIPrincipal *bprin = GetCompartmentPrincipal(b);
 
--- a/js/src/xpconnect/wrappers/AccessCheck.h
+++ b/js/src/xpconnect/wrappers/AccessCheck.h
@@ -39,16 +39,19 @@
 
 #include "jsapi.h"
 #include "jswrapper.h"
 
 class nsIPrincipal;
 
 namespace xpc {
 
+nsIPrincipal *
+GetCompartmentPrincipal(JSCompartment *compartment);
+
 class AccessCheck {
   public:
     static bool isSameOrigin(JSCompartment *a, JSCompartment *b);
     static bool isChrome(JSCompartment *compartment);
     static nsIPrincipal *getPrincipal(JSCompartment *compartment);
     static bool isCrossOriginAccessPermitted(JSContext *cx, JSObject *obj, jsid id,
                                              JSWrapper::Action act);
     static bool isSystemOnlyAccessPermitted(JSContext *cx);
--- a/js/src/xpconnect/wrappers/CrossOriginWrapper.cpp
+++ b/js/src/xpconnect/wrappers/CrossOriginWrapper.cpp
@@ -37,16 +37,17 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsJSPrincipals.h"
 
 #include "XPCWrapper.h"
 
 #include "CrossOriginWrapper.h"
+#include "AccessCheck.h"
 #include "WrapperFactory.h"
 
 namespace xpc {
 
 NoWaiverWrapper::NoWaiverWrapper(uintN flags) : JSCrossCompartmentWrapper(flags)
 {
 }
 
@@ -57,22 +58,16 @@ NoWaiverWrapper::~NoWaiverWrapper()
 CrossOriginWrapper::CrossOriginWrapper(uintN flags) : NoWaiverWrapper(flags)
 {
 }
 
 CrossOriginWrapper::~CrossOriginWrapper()
 {
 }
 
-static nsIPrincipal *
-GetCompartmentPrincipal(JSCompartment *compartment)
-{
-    return static_cast<nsJSPrincipals *>(compartment->principals)->nsIPrincipalPtr;
-}
-
 bool
 CrossOriginWrapper::getPropertyDescriptor(JSContext *cx, JSObject *wrapper, jsid id,
                                           bool set, js::PropertyDescriptor *desc)
 {
     return JSCrossCompartmentWrapper::getPropertyDescriptor(cx, wrapper, id, set, desc) &&
            WrapperFactory::WaiveXrayAndWrap(cx, js::Jsvalify(&desc->value));
 }
 
--- a/js/src/xpconnect/wrappers/WrapperFactory.cpp
+++ b/js/src/xpconnect/wrappers/WrapperFactory.cpp
@@ -260,17 +260,18 @@ WrapperFactory::Rewrap(JSContext *cx, JS
                  "wrapped object passed to rewrap");
     NS_ASSERTION(JS_GET_CLASS(cx, obj) != &XrayUtils::HolderClass, "trying to wrap a holder");
 
     JSCompartment *origin = obj->compartment();
     JSCompartment *target = cx->compartment;
     JSObject *xrayHolder = nsnull;
 
     JSWrapper *wrapper;
-    CompartmentPrivate *targetdata = static_cast<CompartmentPrivate *>(target->data);
+    CompartmentPrivate *targetdata =
+        static_cast<CompartmentPrivate *>(JS_GetCompartmentPrivate(cx, target));
     if (AccessCheck::isChrome(target)) {
         if (AccessCheck::isChrome(origin)) {
             wrapper = &JSCrossCompartmentWrapper::singleton;
         } else {
             bool isSystem;
             {
                 JSAutoEnterCompartment ac;
                 if (!ac.enter(cx, obj))
--- a/js/src/xpconnect/wrappers/XrayWrapper.cpp
+++ b/js/src/xpconnect/wrappers/XrayWrapper.cpp
@@ -551,17 +551,17 @@ XrayWrapper<Base>::getPropertyDescriptor
             if (!JS_GetPropertyDescriptorById(cx, wnObject, id,
                                               (set ? JSRESOLVE_ASSIGNING : 0) | JSRESOLVE_QUALIFIED,
                                               desc))
                 return false;
         }
 
         if (desc->obj)
             desc->obj = wrapper;
-        return cx->compartment->wrap(cx, desc_in);
+        return JS_WrapPropertyDescriptor(cx, desc_in);
     }
 
     if (!this->resolveOwnProperty(cx, wrapper, id, set, desc_in))
         return false;
 
     if (desc->obj)
         return true;
 
@@ -622,17 +622,17 @@ XrayWrapper<Base>::getOwnPropertyDescrip
             if (!JS_GetPropertyDescriptorById(cx, wnObject, id,
                                               (set ? JSRESOLVE_ASSIGNING : 0) | JSRESOLVE_QUALIFIED,
                                               desc)) {
                 return false;
             }
         }
 
         desc->obj = (desc->obj == wnObject) ? wrapper : nsnull;
-        return cx->compartment->wrap(cx, desc_in);
+        return JS_WrapPropertyDescriptor(cx, desc_in);
     }
 
     return this->resolveOwnProperty(cx, wrapper, id, set, desc_in);
 }
 
 template <typename Base>
 bool
 XrayWrapper<Base>::defineProperty(JSContext *cx, JSObject *wrapper, jsid id,
@@ -644,17 +644,17 @@ XrayWrapper<Base>::defineProperty(JSCont
     // Redirect access straight to the wrapper if we should be transparent.
     if (Transparent(cx, wrapper)) {
         JSObject *wnObject = GetWrappedNativeObjectFromHolder(holder);
 
         JSAutoEnterCompartment ac;
         if (!ac.enter(cx, wnObject))
             return false;
 
-        if (!cx->compartment->wrap(cx, desc))
+        if (!JS_WrapPropertyDescriptor(cx, desc))
             return false;
 
         return JS_DefinePropertyById(cx, wnObject, id, jsdesc->value, jsdesc->getter, jsdesc->setter,
                                      jsdesc->attrs);
     }
 
     PropertyDescriptor existing_desc;
     if (!getOwnPropertyDescriptor(cx, wrapper, id, true, &existing_desc))
new file mode 100644
--- /dev/null
+++ b/js/src/yarr/pcre/AUTHORS
@@ -0,0 +1,12 @@
+Originally written by:  Philip Hazel
+Email local part:       ph10
+Email domain:           cam.ac.uk
+
+University of Cambridge Computing Service,
+Cambridge, England. Phone: +44 1223 334714.
+
+Copyright (c) 1997-2005 University of Cambridge. All rights reserved.
+
+Adapted for JavaScriptCore and WebKit by Apple Inc.
+
+Copyright (c) 2005, 2006, 2007 Apple Inc. All rights reserved.
new file mode 100644
--- /dev/null
+++ b/js/src/yarr/pcre/COPYING
@@ -0,0 +1,35 @@
+PCRE is a library of functions to support regular expressions whose syntax
+and semantics are as close as possible to those of the Perl 5 language.
+
+This is JavaScriptCore's variant of the PCRE library. While this library
+started out as a copy of PCRE, many of the features of PCRE have been
+removed.
+
+Copyright (c) 1997-2005 University of Cambridge. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+    * Redistributions of source code must retain the above copyright notice,
+      this list of conditions and the following disclaimer.
+
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+
+    * Neither the name of the University of Cambridge nor the name of Apple
+      Inc. nor the names of their contributors may be used to endorse or
+      promote products derived from this software without specific prior
+      written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.
new file mode 100644
--- /dev/null
+++ b/js/src/yarr/pcre/chartables.c
@@ -0,0 +1,96 @@
+/*************************************************
+*      Perl-Compatible Regular Expressions       *
+*************************************************/
+
+/* This file is automatically written by the dftables auxiliary 
+program. If you edit it by hand, you might like to edit the Makefile to 
+prevent its ever being regenerated.
+
+This file contains the default tables for characters with codes less than
+128 (ASCII characters). These tables are used when no external tables are
+passed to PCRE. */
+
+const unsigned char jsc_pcre_default_tables[480] = {
+
+/* This table is a lower casing table. */
+
+  0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 
+  0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 
+  0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 
+  0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 
+  0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 
+  0x28, 0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 
+  0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 
+  0x38, 0x39, 0x3A, 0x3B, 0x3C, 0x3D, 0x3E, 0x3F, 
+  0x40, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 
+  0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E, 0x6F, 
+  0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 
+  0x78, 0x79, 0x7A, 0x5B, 0x5C, 0x5D, 0x5E, 0x5F, 
+  0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 
+  0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E, 0x6F, 
+  0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 
+  0x78, 0x79, 0x7A, 0x7B, 0x7C, 0x7D, 0x7E, 0x7F,
+
+/* This table is a case flipping table. */
+
+  0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 
+  0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 
+  0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 
+  0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 
+  0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 
+  0x28, 0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 
+  0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 
+  0x38, 0x39, 0x3A, 0x3B, 0x3C, 0x3D, 0x3E, 0x3F, 
+  0x40, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 
+  0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E, 0x6F, 
+  0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 
+  0x78, 0x79, 0x7A, 0x5B, 0x5C, 0x5D, 0x5E, 0x5F, 
+  0x60, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 
+  0x48, 0x49, 0x4A, 0x4B, 0x4C, 0x4D, 0x4E, 0x4F, 
+  0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 
+  0x58, 0x59, 0x5A, 0x7B, 0x7C, 0x7D, 0x7E, 0x7F,
+
+/* This table contains bit maps for various character classes.
+Each map is 32 bytes long and the bits run from the least
+significant end of each byte. The classes are: space, digit, word. */
+
+  0x00, 0x3E, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0x03, 
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0x03, 
+  0xFE, 0xFF, 0xFF, 0x87, 0xFE, 0xFF, 0xFF, 0x07, 
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+
+/* This table identifies various classes of character by individual bits:
+  0x01   white space character
+  0x08   hexadecimal digit
+  0x10   alphanumeric or '_'
+*/
+
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  /*   0-  7 */
+  0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 0x00,  /*   8- 15 */
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  /*  16- 23 */
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  /*  24- 31 */
+  0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  /*    - '  */
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  /*  ( - /  */
+  0x18, 0x18, 0x18, 0x18, 0x18, 0x18, 0x18, 0x18,  /*  0 - 7  */
+  0x18, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  /*  8 - ?  */
+  0x00, 0x18, 0x18, 0x18, 0x18, 0x18, 0x18, 0x10,  /*  @ - G  */
+  0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10,  /*  H - O  */
+  0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10,  /*  P - W  */
+  0x10, 0x10, 0x10, 0x00, 0x00, 0x00, 0x00, 0x10,  /*  X - _  */
+  0x00, 0x18, 0x18, 0x18, 0x18, 0x18, 0x18, 0x10,  /*  ` - g  */
+  0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10,  /*  h - o  */
+  0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10,  /*  p - w  */
+  0x10, 0x10, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00}; /*  x -127 */
+
+
+/* End of chartables.c */
new file mode 100644
--- /dev/null
+++ b/js/src/yarr/pcre/dftables
@@ -0,0 +1,273 @@
+#!/usr/bin/perl -w
+#
+# This is JavaScriptCore's variant of the PCRE library. While this library
+# started out as a copy of PCRE, many of the features of PCRE have been
+# removed. This library now supports only the regular expression features
+# required by the JavaScript language specification, and has only the functions
+# needed by JavaScriptCore and the rest of WebKit.
+# 
+#                  Originally written by Philip Hazel
+#            Copyright (c) 1997-2006 University of Cambridge
+#  Copyright (C) 2002, 2004, 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.
+# 
+# -----------------------------------------------------------------------------
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+#     * Redistributions of source code must retain the above copyright notice,
+#       this list of conditions and the following disclaimer.
+# 
+#     * Redistributions in binary form must reproduce the above copyright
+#       notice, this list of conditions and the following disclaimer in the
+#       documentation and/or other materials provided with the distribution.
+# 
+#     * Neither the name of the University of Cambridge nor the names of its
+#       contributors may be used to endorse or promote products derived from
+#       this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+# POSSIBILITY OF SUCH DAMAGE.
+# -----------------------------------------------------------------------------
+
+# This is a freestanding support program to generate a file containing
+# character tables. The tables are built according to the default C
+# locale.
+
+use strict;
+
+use File::Basename;
+use File::Spec;
+use File::Temp qw(tempfile);
+use Getopt::Long;
+
+sub readHeaderValues();
+
+my %pcre_internal;
+
+if (scalar(@ARGV) < 1) {
+    print STDERR "Usage: ", basename($0), " [--preprocessor=program] output-file\n";
+    exit 1;
+}
+
+my $outputFile;
+my $preprocessor;
+GetOptions('preprocessor=s' => \$preprocessor);
+if (not $preprocessor) {
+    $preprocessor = "cpp";
+}
+
+$outputFile = $ARGV[0];
+die('Must specify output file.') unless defined($outputFile);
+
+readHeaderValues();
+
+open(OUT, ">", $outputFile) or die "$!";
+binmode(OUT);
+
+printf(OUT
+    "/*************************************************\n" .
+    "*      Perl-Compatible Regular Expressions       *\n" .
+    "*************************************************/\n\n" .
+    "/* This file is automatically written by the dftables auxiliary \n" .
+    "program. If you edit it by hand, you might like to edit the Makefile to \n" .
+    "prevent its ever being regenerated.\n\n");
+printf(OUT
+    "This file contains the default tables for characters with codes less than\n" .
+    "128 (ASCII characters). These tables are used when no external tables are\n" .
+    "passed to PCRE. */\n\n" .
+    "const unsigned char jsc_pcre_default_tables[%d] = {\n\n" .
+    "/* This table is a lower casing table. */\n\n", $pcre_internal{tables_length});
+
+if ($pcre_internal{lcc_offset} != 0) {
+    die "lcc_offset != 0";
+}
+
+printf(OUT "  ");
+for (my $i = 0; $i < 128; $i++) {
+    if (($i & 7) == 0 && $i != 0) {
+        printf(OUT "\n  ");
+    }
+    printf(OUT "0x%02X", ord(lc(chr($i))));
+    if ($i != 127) {
+        printf(OUT ", ");
+    }
+}
+printf(OUT ",\n\n");
+
+printf(OUT "/* This table is a case flipping table. */\n\n");
+
+if ($pcre_internal{fcc_offset} != 128) {
+  die "fcc_offset != 128";
+}
+
+printf(OUT "  ");
+for (my $i = 0; $i < 128; $i++) {
+    if (($i & 7) == 0 && $i != 0) {
+        printf(OUT "\n  ");
+    }
+    my $c = chr($i);
+    printf(OUT "0x%02X", $c =~ /[[:lower:]]/ ? ord(uc($c)) : ord(lc($c)));
+    if ($i != 127) {
+        printf(OUT ", ");
+    }
+}
+printf(OUT ",\n\n");
+
+printf(OUT
+    "/* This table contains bit maps for various character classes.\n" .
+    "Each map is 32 bytes long and the bits run from the least\n" .
+    "significant end of each byte. The classes are: space, digit, word. */\n\n");
+
+if ($pcre_internal{cbits_offset} != $pcre_internal{fcc_offset} + 128) {
+    die "cbits_offset != fcc_offset + 128";
+}
+
+my @cbit_table = (0) x $pcre_internal{cbit_length};
+for (my $i = ord('0'); $i <= ord('9'); $i++) {
+    $cbit_table[$pcre_internal{cbit_digit} + $i / 8] |= 1 << ($i & 7);
+}
+$cbit_table[$pcre_internal{cbit_word} + ord('_') / 8] |= 1 << (ord('_') & 7);
+for (my $i = 0; $i < 128; $i++) {
+    my $c = chr($i);
+    if ($c =~ /[[:alnum:]]/) {
+        $cbit_table[$pcre_internal{cbit_word} + $i / 8] |= 1 << ($i & 7);
+    }
+    if ($c =~ /[[:space:]]/) {
+        $cbit_table[$pcre_internal{cbit_space} + $i / 8] |= 1 << ($i & 7);
+    }
+}
+
+printf(OUT "  ");
+for (my $i = 0; $i < $pcre_internal{cbit_length}; $i++) {
+    if (($i & 7) == 0 && $i != 0) {
+        if (($i & 31) == 0) {
+            printf(OUT "\n");
+        }
+        printf(OUT "\n  ");
+    }
+    printf(OUT "0x%02X", $cbit_table[$i]);
+    if ($i != $pcre_internal{cbit_length} - 1) {
+        printf(OUT ", ");
+    }
+}
+printf(OUT ",\n\n");
+
+printf(OUT
+    "/* This table identifies various classes of character by individual bits:\n" .
+    "  0x%02x   white space character\n" .
+    "  0x%02x   hexadecimal digit\n" .
+    "  0x%02x   alphanumeric or '_'\n*/\n\n",
+    $pcre_internal{ctype_space}, $pcre_internal{ctype_xdigit}, $pcre_internal{ctype_word});
+
+if ($pcre_internal{ctypes_offset} != $pcre_internal{cbits_offset} + $pcre_internal{cbit_length}) {
+    die "ctypes_offset != cbits_offset + cbit_length";
+}
+
+printf(OUT "  ");
+for (my $i = 0; $i < 128; $i++) {
+    my $x = 0;
+    my $c = chr($i);
+    if ($c =~ /[[:space:]]/) {
+        $x += $pcre_internal{ctype_space};
+    }
+    if ($c =~ /[[:xdigit:]]/) {
+        $x += $pcre_internal{ctype_xdigit};
+    }
+    if ($c =~ /[[:alnum:]_]/) {
+        $x += $pcre_internal{ctype_word};
+    }
+    printf(OUT "0x%02X", $x);
+    if ($i != 127) {
+        printf(OUT ", ");
+    } else {
+        printf(OUT "};");
+    }
+    if (($i & 7) == 7) {
+        printf(OUT " /* ");
+        my $d = chr($i - 7);
+        if ($d =~ /[[:print:]]/) {
+            printf(OUT " %c -", $i - 7);
+        } else {
+            printf(OUT "%3d-", $i - 7);
+        }
+        if ($c =~ m/[[:print:]]/) {
+            printf(OUT " %c ", $i);
+        } else {
+            printf(OUT "%3d", $i);
+        }
+        printf(OUT " */\n");
+        if ($i != 127) {
+            printf(OUT "  ");
+        }
+    }
+}
+
+if ($pcre_internal{tables_length} != $pcre_internal{ctypes_offset} + 128) {
+    die "tables_length != ctypes_offset + 128";
+}
+
+printf(OUT "\n\n/* End of chartables.c */\n");
+
+close(OUT);
+
+exit 0;
+
+sub readHeaderValues()
+{
+    my @variables = qw(
+        cbit_digit
+        cbit_length
+        cbit_space
+        cbit_word
+        cbits_offset
+        ctype_space
+        ctype_word
+        ctype_xdigit
+        ctypes_offset
+        fcc_offset
+        lcc_offset
+        tables_length
+    );
+
+    local $/ = undef;
+
+    my $headerPath = File::Spec->catfile(dirname($0), "pcre_internal.h");
+ 
+    my ($fh, $tempFile) = tempfile(
+        basename($0) . "-XXXXXXXX",
+        DIR => File::Spec->tmpdir(),
+        SUFFIX => ".in",
+        UNLINK => 0,
+    );
+
+    print $fh "#define DFTABLES\n\n";
+
+    open(HEADER, "<", $headerPath) or die "$!";
+    print $fh <HEADER>;
+    close(HEADER);
+
+    print $fh "\n\n";
+
+    for my $v (@variables) {
+        print $fh "\$pcre_internal{\"$v\"} = $v;\n";
+    }
+
+    close($fh);
+
+    open(CPP, "$preprocessor \"$tempFile\" |") or die "$!";
+    my $content = <CPP>;
+    close(CPP);
+    
+    eval $content;
+    die "$@" if $@;
+    unlink $tempFile;
+}
new file mode 100644
--- /dev/null
+++ b/js/src/yarr/pcre/pcre.h
@@ -0,0 +1,76 @@
+/* This is the public header file for JavaScriptCore's variant of the PCRE
+library. While this library started out as a copy of PCRE, many of the
+features of PCRE have been removed. This library now supports only the
+regular expression features required by the JavaScript language
+specification, and has only the functions needed by JavaScriptCore and the
+rest of WebKit.
+
+           Copyright (c) 1997-2005 University of Cambridge
+    Copyright (C) 2002, 2004, 2006, 2007 Apple Inc. All rights reserved.
+
+-----------------------------------------------------------------------------
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+    * Redistributions of source code must retain the above copyright notice,
+      this list of conditions and the following disclaimer.
+
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+
+    * Neither the name of the University of Cambridge nor the names of its
+      contributors may be used to endorse or promote products derived from
+      this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.
+-----------------------------------------------------------------------------
+*/
+
+// FIXME: This file needs to be renamed to JSRegExp.h; it's no longer PCRE.
+
+#ifndef JSRegExp_h
+#define JSRegExp_h
+
+// Last remnants from the JSWTFBridge.
+#include "assembler/wtf/Platform.h"
+#include "jsstr.h"
+#include "jsprvtd.h"
+#include "jstl.h"
+
+typedef jschar UChar;
+typedef JSLinearString UString;
+
+struct JSRegExp;
+struct JSContext;
+
+enum JSRegExpIgnoreCaseOption { JSRegExpDoNotIgnoreCase, JSRegExpIgnoreCase };
+enum JSRegExpMultilineOption { JSRegExpSingleLine, JSRegExpMultiline };
+
+/* jsRegExpExecute error codes */
+const int JSRegExpErrorNoMatch = -1;
+const int JSRegExpErrorHitLimit = -2;
+const int JSRegExpErrorInternal = -4;
+
+JSRegExp* jsRegExpCompile(
+const UChar* pattern, int patternLength,
+    JSRegExpIgnoreCaseOption, JSRegExpMultilineOption,
+    unsigned* numSubpatterns, int *error);
+
+int jsRegExpExecute(JSContext *, const JSRegExp*,
+    const UChar* subject, int subjectLength, int startOffset,
+    int* offsetsVector, int offsetsVectorLength);
+
+void jsRegExpFree(JSRegExp*);
+
+#endif
new file mode 100644
--- /dev/null
+++ b/js/src/yarr/pcre/pcre.pri
@@ -0,0 +1,12 @@
+# Perl Compatible Regular Expressions - Qt4 build info
+VPATH += $$PWD
+INCLUDEPATH += $$PWD $$OUTPUT_DIR/JavaScriptCore/tmp
+DEPENDPATH += $$PWD
+
+SOURCES += \
+    pcre_compile.cpp \
+    pcre_exec.cpp \
+    pcre_tables.cpp \
+    pcre_ucp_searchfuncs.cpp \
+    pcre_xclass.cpp
+
new file mode 100644
--- /dev/null
+++ b/js/src/yarr/pcre/pcre_compile.cpp
@@ -0,0 +1,2702 @@
+/* This is JavaScriptCore's variant of the PCRE library. While this library
+started out as a copy of PCRE, many of the features of PCRE have been
+removed. This library now supports only the regular expression features
+required by the JavaScript language specification, and has only the functions
+needed by JavaScriptCore and the rest of WebKit.
+
+                 Originally written by Philip Hazel
+           Copyright (c) 1997-2006 University of Cambridge
+    Copyright (C) 2002, 2004, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+    Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+
+-----------------------------------------------------------------------------
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+    * Redistributions of source code must retain the above copyright notice,
+      this list of conditions and the following disclaimer.
+
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+
+    * Neither the name of the University of Cambridge nor the names of its
+      contributors may be used to endorse or promote products derived from
+      this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.
+-----------------------------------------------------------------------------
+*/
+
+/* This module contains the external function jsRegExpExecute(), along with
+supporting internal functions that are not used by other modules. */
+
+#include "pcre_internal.h"
+
+#include <string.h>
+#include "yarr/ASCIICType.h"
+#include "jsvector.h"
+
+using namespace WTF;
+
+/* Negative values for the firstchar and reqchar variables */
+
+#define REQ_UNSET (-2)
+#define REQ_NONE  (-1)
+
+/*************************************************
+*      Code parameters and static tables         *
+*************************************************/
+
+/* Maximum number of items on the nested bracket stacks at compile time. This
+applies to the nesting of all kinds of parentheses. It does not limit
+un-nested, non-capturing parentheses. This number can be made bigger if
+necessary - it is used to dimension one int and one unsigned char vector at
+compile time. */
+
+#define BRASTACK_SIZE 200
+
+/* Table for handling escaped characters in the range '0'-'z'. Positive returns
+are simple data values; negative values are for special things like \d and so
+on. Zero means further processing is needed (for things like \x), or the escape
+is invalid. */
+
+static const short escapes[] = {
+     0,      0,      0,      0,      0,      0,      0,      0,   /* 0 - 7 */
+     0,      0,    ':',    ';',    '<',    '=',    '>',    '?',   /* 8 - ? */
+   '@',      0, -ESC_B,      0, -ESC_D,      0,      0,      0,   /* @ - G */
+     0,      0,      0,      0,      0,      0,      0,      0,   /* H - O */
+     0,      0,      0, -ESC_S,      0,      0,      0, -ESC_W,   /* P - W */
+     0,      0,      0,    '[',   '\\',    ']',    '^',    '_',   /* X - _ */
+   '`',      7, -ESC_b,      0, -ESC_d,      0,   '\f',      0,   /* ` - g */
+     0,      0,      0,      0,      0,      0,   '\n',      0,   /* h - o */
+     0,      0,    '\r', -ESC_s,   '\t',      0,  '\v', -ESC_w,   /* p - w */
+     0,      0,      0                                            /* x - z */
+};
+static const unsigned OPCODE_LEN = 1;
+static const unsigned BRAZERO_LEN = OPCODE_LEN;
+static const unsigned BRA_NEST_SIZE = 2;
+static const unsigned BRA_LEN = OPCODE_LEN + LINK_SIZE + BRA_NEST_SIZE;
+static const unsigned KET_LEN = OPCODE_LEN + LINK_SIZE;
+
+/* Error code numbers. They are given names so that they can more easily be
+tracked. */
+
+enum ErrorCode {
+    ERR0, ERR1, ERR2, ERR3, ERR4, ERR5, ERR6, ERR7, ERR8, ERR9,
+    ERR10, ERR11, ERR12, ERR13, ERR14, ERR15, ERR16, ERR17
+};
+
+/* These are the error texts that correspond to the above error codes:
+      // 1
+      "\\ at end of pattern\0"
+      "\\c at end of pattern\0"
+      "character value in \\x{...} sequence is too large\0"
+      "numbers out of order in {} quantifier\0"
+      // 5
+      "number too big in {} quantifier\0"
+      "missing terminating ] for character class\0"
+      "internal error: code overflow\0"
+      "range out of order in character class\0"
+      "nothing to repeat\0"
+      // 10
+      "unmatched parentheses\0"
+      "internal error: unexpected repeat\0"
+      "unrecognized character after (?\0"
+      "failed to get memory\0"
+      "missing )\0"
+      // 15
+      "reference to non-existent subpattern\0"
+      "regular expression too large\0"
+      "parentheses nested too deeply" */
+
+/* Structure for passing "static" information around between the functions
+doing the compiling. */
+
+struct CompileData {
+    CompileData() {
+        topBackref = 0;
+        backrefMap = 0;
+        reqVaryOpt = 0;
+        needOuterBracket = false;
+        numCapturingBrackets = 0;
+    }
+    int topBackref;            /* Maximum back reference */
+    unsigned backrefMap;       /* Bitmap of low back refs */
+    int reqVaryOpt;            /* "After variable item" flag for reqByte */
+    bool needOuterBracket;
+    int numCapturingBrackets;
+};
+
+/* Definitions to allow mutual recursion */
+
+static bool compileBracket(int, int*, unsigned char**, const UChar**, const UChar*, ErrorCode*, int, int*, int*, CompileData&);
+static bool bracketIsAnchored(const unsigned char* code);
+static bool bracketNeedsLineStart(const unsigned char* code, unsigned captureMap, unsigned backrefMap);
+static int bracketFindFirstAssertedCharacter(const unsigned char* code, bool inassert);
+
+/*************************************************
+*            Handle escapes                      *
+*************************************************/
+
+/* This function is called when a \ has been encountered. It either returns a
+positive value for a simple escape such as \n, or a negative value which
+encodes one of the more complicated things such as \d. When UTF-8 is enabled,
+a positive value greater than 255 may be returned. On entry, ptr is pointing at
+the \. On exit, it is on the final character of the escape sequence.
+
+Arguments:
+  ptrPtr         points to the pattern position pointer
+  errorCodePtr   points to the errorcode variable
+  bracount       number of previous extracting brackets
+  options        the options bits
+  isClass        true if inside a character class
+
+Returns:         zero or positive => a data character
+                 negative => a special escape sequence
+                 on error, error is set
+*/
+
+static int checkEscape(const UChar** ptrPtr, const UChar* patternEnd, ErrorCode* errorCodePtr, int bracount, bool isClass)
+{
+    const UChar* ptr = *ptrPtr + 1;
+
+    /* If backslash is at the end of the pattern, it's an error. */
+    if (ptr == patternEnd) {
+        *errorCodePtr = ERR1;
+        *ptrPtr = ptr;
+        return 0;
+    }
+    
+    int c = *ptr;
+    
+    /* Non-alphamerics are literals. For digits or letters, do an initial lookup in
+     a table. A non-zero result is something that can be returned immediately.
+     Otherwise further processing may be required. */
+    
+    if (c < '0' || c > 'z') { /* Not alphameric */
+    } else if (int escapeValue = escapes[c - '0']) {
+        c = escapeValue;
+        if (isClass) {
+            if (-c == ESC_b)
+                c = '\b'; /* \b is backslash in a class */
+            else if (-c == ESC_B)
+                c = 'B'; /* and \B is a capital B in a class (in browsers event though ECMAScript 15.10.2.19 says it raises an error) */
+        }
+    /* Escapes that need further processing, or are illegal. */
+    
+    } else {
+        switch (c) {
+            case '1':
+            case '2':
+            case '3':
+            case '4':
+            case '5':
+            case '6':
+            case '7':
+            case '8':
+            case '9':
+                /* Escape sequences starting with a non-zero digit are backreferences,
+                 unless there are insufficient brackets, in which case they are octal
+                 escape sequences. Those sequences end on the first non-octal character
+                 or when we overflow 0-255, whichever comes first. */
+                
+                if (!isClass) {
+                    const UChar* oldptr = ptr;
+                    c -= '0';
+                    while ((ptr + 1 < patternEnd) && isASCIIDigit(ptr[1]) && c <= bracount)
+                        c = c * 10 + *(++ptr) - '0';
+                    if (c <= bracount) {
+                        c = -(ESC_REF + c);
+                        break;
+                    }
+                    ptr = oldptr;      /* Put the pointer back and fall through */
+                }
+                
+                /* Handle an octal number following \. If the first digit is 8 or 9,
+                 this is not octal. */
+                
+                if ((c = *ptr) >= '8') {
+                    c = '\\';
+                    ptr -= 1;
+                    break;
+                }
+
+            /* \0 always starts an octal number, but we may drop through to here with a
+             larger first octal digit. */
+
+            case '0': {
+                c -= '0';
+                int i;
+                for (i = 1; i <= 2; ++i) {
+                    if (ptr + i >= patternEnd || ptr[i] < '0' || ptr[i] > '7')
+                        break;
+                    int cc = c * 8 + ptr[i] - '0';
+                    if (cc > 255)
+                        break;
+                    c = cc;
+                }
+                ptr += i - 1;
+                break;
+            }
+
+            case 'x': {
+                c = 0;
+                int i;
+                for (i = 1; i <= 2; ++i) {
+                    if (ptr + i >= patternEnd || !isASCIIHexDigit(ptr[i])) {
+                        c = 'x';
+                        i = 1;
+                        break;
+                    }
+                    int cc = ptr[i];
+                    if (cc >= 'a')
+                        cc -= 32;             /* Convert to upper case */
+                    c = c * 16 + cc - ((cc < 'A') ? '0' : ('A' - 10));
+                }
+                ptr += i - 1;
+                break;
+            }
+
+            case 'u': {
+                c = 0;
+                int i;
+                for (i = 1; i <= 4; ++i) {
+                    if (ptr + i >= patternEnd || !isASCIIHexDigit(ptr[i])) {
+                        c = 'u';
+                        i = 1;
+                        break;
+                    }
+                    int cc = ptr[i];
+                    if (cc >= 'a')
+                        cc -= 32;             /* Convert to upper case */
+                    c = c * 16 + cc - ((cc < 'A') ? '0' : ('A' - 10));
+                }
+                ptr += i - 1;
+                break;
+            }
+
+            case 'c':
+                if (++ptr == patternEnd) {
+                    *errorCodePtr = ERR2;
+                    return 0;
+                }
+                
+                c = *ptr;
+
+                /* To match Firefox, inside a character class, we also accept
+                   numbers and '_' as control characters */
+                if ((!isClass && !isASCIIAlpha(c)) || (!isASCIIAlphanumeric(c) && c != '_')) {
+                    c = '\\';
+                    ptr -= 2;
+                    break;
+                }
+
+                /* A letter is upper-cased; then the 0x40 bit is flipped. This coding
+                 is ASCII-specific, but then the whole concept of \cx is ASCII-specific. */
+                c = toASCIIUpper(c) ^ 0x40;
+                break;
+            }
+    }
+    
+    *ptrPtr = ptr;
+    return c;
+}
+
+/*************************************************
+*            Check for counted repeat            *
+*************************************************/
+
+/* This function is called when a '{' is encountered in a place where it might
+start a quantifier. It looks ahead to see if it really is a quantifier or not.
+It is only a quantifier if it is one of the forms {ddd} {ddd,} or {ddd,ddd}
+where the ddds are digits.
+
+Arguments:
+  p         pointer to the first char after '{'
+
+Returns:    true or false
+*/
+
+static bool isCountedRepeat(const UChar* p, const UChar* patternEnd)
+{
+    if (p >= patternEnd || !isASCIIDigit(*p))
+        return false;
+    p++;
+    while (p < patternEnd && isASCIIDigit(*p))
+        p++;
+    if (p < patternEnd && *p == '}')
+        return true;
+    
+    if (p >= patternEnd || *p++ != ',')
+        return false;
+    if (p < patternEnd && *p == '}')
+        return true;
+    
+    if (p >= patternEnd || !isASCIIDigit(*p))
+        return false;
+    p++;
+    while (p < patternEnd && isASCIIDigit(*p))
+        p++;
+    
+    return (p < patternEnd && *p == '}');
+}
+
+/*************************************************
+*         Read repeat counts                     *
+*************************************************/
+
+/* Read an item of the form {n,m} and return the values. This is called only
+after isCountedRepeat() has confirmed that a repeat-count quantifier exists,
+so the syntax is guaranteed to be correct, but we need to check the values.
+
+Arguments:
+  p              pointer to first char after '{'
+  minp           pointer to int for min
+  maxp           pointer to int for max
+                 returned as -1 if no max
+  errorCodePtr   points to error code variable
+
+Returns:         pointer to '}' on success;
+                 current ptr on error, with errorCodePtr set non-zero
+*/
+
+static const UChar* readRepeatCounts(const UChar* p, int* minp, int* maxp, ErrorCode* errorCodePtr)
+{
+    int min = 0;
+    int max = -1;
+    
+    /* Read the minimum value and do a paranoid check: a negative value indicates
+     an integer overflow. */
+    
+    while (isASCIIDigit(*p))
+        min = min * 10 + *p++ - '0';
+    if (min < 0 || min > 65535) {
+        *errorCodePtr = ERR5;
+        return p;
+    }
+    
+    /* Read the maximum value if there is one, and again do a paranoid on its size.
+     Also, max must not be less than min. */
+    
+    if (*p == '}')
+        max = min;
+    else {
+        if (*(++p) != '}') {
+            max = 0;
+            while (isASCIIDigit(*p))
+                max = max * 10 + *p++ - '0';
+            if (max < 0 || max > 65535) {
+                *errorCodePtr = ERR5;
+                return p;
+            }
+            if (max < min) {
+                *errorCodePtr = ERR4;
+                return p;
+            }
+        }
+    }
+    
+    /* Fill in the required variables, and pass back the pointer to the terminating
+     '}'. */
+    
+    *minp = min;
+    *maxp = max;
+    return p;
+}
+
+/*************************************************
+*      Find first significant op code            *
+*************************************************/
+
+/* This is called by several functions that scan a compiled expression looking
+for a fixed first character, or an anchoring op code etc. It skips over things
+that do not influence this.
+
+Arguments:
+  code         pointer to the start of the group
+Returns:       pointer to the first significant opcode
+*/
+
+static const unsigned char* firstSignificantOpcode(const unsigned char* code)
+{
+    while (*code == OP_BRANUMBER)
+        code += 3;
+    return code;
+}
+
+static const unsigned char* firstSignificantOpcodeSkippingAssertions(const unsigned char* code)
+{
+    while (true) {
+        switch (*code) {
+            case OP_ASSERT_NOT:
+                advanceToEndOfBracket(code);
+                code += 1 + LINK_SIZE;
+                break;
+            case OP_WORD_BOUNDARY:
+            case OP_NOT_WORD_BOUNDARY:
+                ++code;
+                break;
+            case OP_BRANUMBER:
+                code += 3;
+                break;
+            default:
+                return code;
+        }
+    }
+}
+
+/*************************************************
+*           Get othercase range                  *
+*************************************************/
+
+/* This function is passed the start and end of a class range, in UTF-8 mode
+with UCP support. It searches up the characters, looking for internal ranges of
+characters in the "other" case. Each call returns the next one, updating the
+start address.
+
+Arguments:
+  cptr        points to starting character value; updated
+  d           end value
+  ocptr       where to put start of othercase range
+  odptr       where to put end of othercase range
+
+Yield:        true when range returned; false when no more
+*/
+
+static bool getOthercaseRange(int* cptr, int d, int* ocptr, int* odptr)
+{
+    int c, othercase = 0;
+    
+    for (c = *cptr; c <= d; c++) {
+        if ((othercase = jsc_pcre_ucp_othercase(c)) >= 0)
+            break;
+    }
+    
+    if (c > d)
+        return false;
+    
+    *ocptr = othercase;
+    int next = othercase + 1;
+    
+    for (++c; c <= d; c++) {
+        if (jsc_pcre_ucp_othercase(c) != next)
+            break;
+        next++;
+    }
+    
+    *odptr = next - 1;
+    *cptr = c;
+    
+    return true;
+}
+
+/*************************************************
+ *       Convert character value to UTF-8         *
+ *************************************************/
+
+/* This function takes an integer value in the range 0 - 0x7fffffff
+ and encodes it as a UTF-8 character in 0 to 6 bytes.
+ 
+ Arguments:
+ cvalue     the character value
+ buffer     pointer to buffer for result - at least 6 bytes long
+ 
+ Returns:     number of characters placed in the buffer
+ */
+
+static int encodeUTF8(int cvalue, unsigned char *buffer)
+{
+    int i;
+    for (i = 0; i < jsc_pcre_utf8_table1_size; i++)
+        if (cvalue <= jsc_pcre_utf8_table1[i])
+            break;
+    buffer += i;
+    for (int j = i; j > 0; j--) {
+        *buffer-- = 0x80 | (cvalue & 0x3f);
+        cvalue >>= 6;
+    }
+    *buffer = jsc_pcre_utf8_table2[i] | cvalue;
+    return i + 1;
+}
+
+/*************************************************
+*           Compile one branch                   *
+*************************************************/
+
+/* Scan the pattern, compiling it into the code vector.
+
+Arguments:
+  options        the option bits
+  brackets       points to number of extracting brackets used
+  codePtr        points to the pointer to the current code point
+  ptrPtr         points to the current pattern pointer
+  errorCodePtr   points to error code variable
+  firstbyteptr   set to initial literal character, or < 0 (REQ_UNSET, REQ_NONE)
+  reqbyteptr     set to the last literal character required, else < 0
+  cd             contains pointers to tables etc.
+
+Returns:         true on success
+                 false, with *errorCodePtr set non-zero on error
+*/
+
+static inline bool safelyCheckNextChar(const UChar* ptr, const UChar* patternEnd, UChar expected)
+{
+    return ((ptr + 1 < patternEnd) && ptr[1] == expected);
+}
+
+static bool
+compileBranch(int options, int* brackets, unsigned char** codePtr,
+               const UChar** ptrPtr, const UChar* patternEnd, ErrorCode* errorCodePtr, int *firstbyteptr,
+               int* reqbyteptr, CompileData& cd)
+{
+    int repeatType, opType;
+    int repeatMin = 0, repeat_max = 0;      /* To please picky compilers */
+    int bravalue = 0;
+    int reqvary, tempreqvary;
+    int c;
+    unsigned char* code = *codePtr;
+    unsigned char* tempcode;
+    bool didGroupSetFirstByte = false;
+    const UChar* ptr = *ptrPtr;
+    const UChar* tempptr;
+    unsigned char* previous = NULL;
+    unsigned char classbits[32];
+    
+    bool class_utf8;
+    unsigned char* class_utf8data;
+    unsigned char utf8_char[6];
+    
+    /* Initialize no first byte, no required byte. REQ_UNSET means "no char
+     matching encountered yet". It gets changed to REQ_NONE if we hit something that
+     matches a non-fixed char first char; reqByte just remains unset if we never
+     find one.
+     
+     When we hit a repeat whose minimum is zero, we may have to adjust these values
+     to take the zero repeat into account. This is implemented by setting them to
+     zeroFirstByte and zeroReqByte when such a repeat is encountered. The individual
+     item types that can be repeated set these backoff variables appropriately. */
+    
+    int firstByte = REQ_UNSET;
+    int reqByte = REQ_UNSET;
+    int zeroReqByte = REQ_UNSET;
+    int zeroFirstByte = REQ_UNSET;
+    
+    /* The variable reqCaseOpt contains either the REQ_IGNORE_CASE value or zero,
+     according to the current setting of the ignores-case flag. REQ_IGNORE_CASE is a bit
+     value > 255. It is added into the firstByte or reqByte variables to record the
+     case status of the value. This is used only for ASCII characters. */
+    
+    int reqCaseOpt = (options & IgnoreCaseOption) ? REQ_IGNORE_CASE : 0;
+    
+    /* Switch on next character until the end of the branch */
+    
+    for (;; ptr++) {
+        bool negateClass;
+        bool shouldFlipNegation; /* If a negative special such as \S is used, we should negate the whole class to properly support Unicode. */
+        int classCharCount;
+        int classLastChar;
+        int skipBytes;
+        int subReqByte;
+        int subFirstByte;
+        int mcLength;
+        unsigned char mcbuffer[8];
+        
+        /* Next byte in the pattern */
+        
+        c = ptr < patternEnd ? *ptr : 0;
+        
+        /* Fill in length of a previous callout, except when the next thing is
+         a quantifier. */
+        
+        bool isQuantifier = c == '*' || c == '+' || c == '?' || (c == '{' && isCountedRepeat(ptr + 1, patternEnd));
+        
+        switch (c) {
+            /* The branch terminates at end of string, |, or ). */
+                
+            case 0:
+                if (ptr < patternEnd)
+                    goto NORMAL_CHAR;
+                // End of string; fall through
+            case '|':
+            case ')':
+                *firstbyteptr = firstByte;
+                *reqbyteptr = reqByte;
+                *codePtr = code;
+                *ptrPtr = ptr;
+                return true;
+                
+            /* Handle single-character metacharacters. In multiline mode, ^ disables
+             the setting of any following char as a first character. */
+
+            case '^':
+                if (options & MatchAcrossMultipleLinesOption) {
+                    if (firstByte == REQ_UNSET)
+                        firstByte = REQ_NONE;
+                    *code++ = OP_BOL;
+                } else
+                    *code++ = OP_CIRC;
+                previous = NULL;
+                break;
+
+            case '$':
+                previous = NULL;
+                if (options & MatchAcrossMultipleLinesOption)
+                  *code++ = OP_EOL;
+                else
+                  *code++ = OP_DOLL;
+                break;
+
+            /* There can never be a first char if '.' is first, whatever happens about
+             repeats. The value of reqByte doesn't change either. */
+
+            case '.':
+                if (firstByte == REQ_UNSET)
+                    firstByte = REQ_NONE;
+                zeroFirstByte = firstByte;
+                zeroReqByte = reqByte;
+                previous = code;
+                *code++ = OP_NOT_NEWLINE;
+                break;
+                
+            /* Character classes. If the included characters are all < 256, we build a
+             32-byte bitmap of the permitted characters, except in the special case
+             where there is only one such character. For negated classes, we build the
+             map as usual, then invert it at the end. However, we use a different opcode
+             so that data characters > 255 can be handled correctly.
+             
+             If the class contains characters outside the 0-255 range, a different
+             opcode is compiled. It may optionally have a bit map for characters < 256,
+             but those above are are explicitly listed afterwards. A flag byte tells
+             whether the bitmap is present, and whether this is a negated class or not.
+             */
+                
+            case '[': {
+                previous = code;
+                shouldFlipNegation = false;
+                
+                /* PCRE supports POSIX class stuff inside a class. Perl gives an error if
+                 they are encountered at the top level, so we'll do that too. */
+                
+                /* If the first character is '^', set the negation flag and skip it. */
+
+                if (ptr + 1 >= patternEnd) {
+                    *errorCodePtr = ERR6;
+                    return false;
+                }
+
+                if (ptr[1] == '^') {
+                    negateClass = true;
+                    ++ptr;
+                } else
+                    negateClass = false;
+                
+                /* Keep a count of chars with values < 256 so that we can optimize the case
+                 of just a single character (as long as it's < 256). For higher valued UTF-8
+                 characters, we don't yet do any optimization. */
+                
+                classCharCount = 0;
+                classLastChar = -1;
+                
+                class_utf8 = false;                       /* No chars >= 256 */
+                class_utf8data = code + LINK_SIZE + 34;   /* For UTF-8 items */
+                
+                /* Initialize the 32-char bit map to all zeros. We have to build the
+                 map in a temporary bit of store, in case the class contains only 1
+                 character (< 256), because in that case the compiled code doesn't use the
+                 bit map. */
+                
+                memset(classbits, 0, 32 * sizeof(unsigned char));
+                
+                /* Process characters until ] is reached. The first pass
+                 through the regex checked the overall syntax, so we don't need to be very
+                 strict here. At the start of the loop, c contains the first byte of the
+                 character. */
+
+                while ((++ptr < patternEnd) && (c = *ptr) != ']') {
+                    /* Backslash may introduce a single character, or it may introduce one
+                     of the specials, which just set a flag. Escaped items are checked for
+                     validity in the pre-compiling pass. The sequence \b is a special case.
+                     Inside a class (and only there) it is treated as backspace. Elsewhere
+                     it marks a word boundary. Other escapes have preset maps ready to
+                     or into the one we are building. We assume they have more than one
+                     character in them, so set classCharCount bigger than one. */
+                    
+                    if (c == '\\') {
+                        c = checkEscape(&ptr, patternEnd, errorCodePtr, cd.numCapturingBrackets, true);
+                        if (c < 0) {
+                            classCharCount += 2;     /* Greater than 1 is what matters */
+                            switch (-c) {
+                                case ESC_d:
+                                    for (c = 0; c < 32; c++)
+                                        classbits[c] |= classBitmapForChar(c + cbit_digit);
+                                    continue;
+                                    
+                                case ESC_D:
+                                    shouldFlipNegation = true;
+                                    for (c = 0; c < 32; c++)
+                                        classbits[c] |= ~classBitmapForChar(c + cbit_digit);
+                                    continue;
+                                    
+                                case ESC_w:
+                                    for (c = 0; c < 32; c++)
+                                        classbits[c] |= classBitmapForChar(c + cbit_word);
+                                    continue;
+                                    
+                                case ESC_W:
+                                    shouldFlipNegation = true;
+                                    for (c = 0; c < 32; c++)
+                                        classbits[c] |= ~classBitmapForChar(c + cbit_word);
+                                    continue;
+                                    
+                                case ESC_s:
+                                    for (c = 0; c < 32; c++)
+                                         classbits[c] |= classBitmapForChar(c + cbit_space);
+                                    continue;
+                                    
+                                case ESC_S:
+                                    shouldFlipNegation = true;
+                                    for (c = 0; c < 32; c++)
+                                         classbits[c] |= ~classBitmapForChar(c + cbit_space);
+                                    continue;
+                                    
+                                    /* Unrecognized escapes are faulted if PCRE is running in its
+                                     strict mode. By default, for compatibility with Perl, they are
+                                     treated as literals. */
+                                    
+                                default:
+                                    c = *ptr;              /* The final character */
+                                    classCharCount -= 2;  /* Undo the default count from above */
+                            }
+                        }
+                        
+                        /* Fall through if we have a single character (c >= 0). This may be
+                         > 256 in UTF-8 mode. */
+                        
+                    }   /* End of backslash handling */
+                    
+                    /* A single character may be followed by '-' to form a range. However,
+                     Perl does not permit ']' to be the end of the range. A '-' character
+                     here is treated as a literal. */
+                    
+                    if ((ptr + 2 < patternEnd)