Merge from mozilla-central.
authorDavid Anderson <danderson@mozilla.com>
Fri, 27 Jan 2012 15:49:15 -0800
changeset 106338 5f86dd728a3c9935f95b0e1a3cde2de68a346af3
parent 106337 b128d6be96527a1abdf6c0fd66715c1412193134 (current diff)
parent 85822 8a59519e137ec6ed458b54834c544d3f4d7262c0 (diff)
child 106339 9ce84d24bb04e3d0edfd4219f39f0803068235c6
push idunknown
push userunknown
push dateunknown
milestone12.0a1
Merge from mozilla-central.
accessible/src/base/nsAccessNode.h
accessible/src/base/nsAccessibilityService.cpp
accessible/src/base/nsAccessible.cpp
accessible/src/base/nsAccessible.h
accessible/src/mac/nsAccessibleWrap.mm
accessible/tests/mochitest/Makefile.in
accessible/tests/mochitest/events.js
accessible/tests/mochitest/events/Makefile.in
accessible/tests/mochitest/events/docload_wnd.xul
accessible/tests/mochitest/states.js
browser/base/content/syncSetup.xul
browser/components/preferences/permissionsutils.js
configure.in
content/base/public/nsIXMLHttpRequest.idl
content/base/src/nsXMLHttpRequest.cpp
content/base/src/nsXMLHttpRequest.h
content/base/test/Makefile.in
content/canvas/src/nsCanvasRenderingContext2D.cpp
content/svg/content/src/DOMSVGAnimatedLengthList.h
content/svg/content/src/DOMSVGAnimatedNumberList.h
content/svg/content/src/DOMSVGAnimatedTransformList.h
content/svg/content/src/DOMSVGLength.h
content/svg/content/src/DOMSVGLengthList.h
content/svg/content/src/DOMSVGMatrix.h
content/svg/content/src/DOMSVGNumber.h
content/svg/content/src/DOMSVGNumberList.h
content/svg/content/src/DOMSVGPathSeg.cpp
content/svg/content/src/DOMSVGPathSeg.h
content/svg/content/src/DOMSVGPathSegList.cpp
content/svg/content/src/DOMSVGPathSegList.h
content/svg/content/src/DOMSVGPoint.h
content/svg/content/src/DOMSVGPointList.h
content/svg/content/src/DOMSVGTransform.h
content/svg/content/src/DOMSVGTransformList.h
content/svg/content/src/SVGAnimatedLengthList.h
content/svg/content/src/SVGAnimatedNumberList.h
content/svg/content/src/SVGAnimatedPathSegList.h
content/svg/content/src/SVGAnimatedPointList.h
content/svg/content/src/SVGAnimatedPreserveAspectRatio.h
content/svg/content/src/SVGAnimatedTransformList.h
content/svg/content/src/SVGIntegerPairSMILType.h
content/svg/content/src/SVGLength.h
content/svg/content/src/SVGLengthList.h
content/svg/content/src/SVGMotionSMILAnimationFunction.h
content/svg/content/src/SVGMotionSMILAttr.h
content/svg/content/src/SVGMotionSMILPathUtils.cpp
content/svg/content/src/SVGMotionSMILPathUtils.h
content/svg/content/src/SVGMotionSMILType.h
content/svg/content/src/SVGNumberList.h
content/svg/content/src/SVGNumberPairSMILType.h
content/svg/content/src/SVGOrientSMILType.h
content/svg/content/src/SVGPathData.h
content/svg/content/src/SVGPathSegListSMILType.cpp
content/svg/content/src/SVGPathSegUtils.h
content/svg/content/src/SVGPoint.h
content/svg/content/src/SVGPointList.h
content/svg/content/src/SVGTransform.h
content/svg/content/src/SVGTransformList.h
content/svg/content/src/SVGViewBoxSMILType.h
content/svg/content/src/nsSVGAElement.h
content/svg/content/src/nsSVGAngle.h
content/svg/content/src/nsSVGAnimateMotionElement.h
content/svg/content/src/nsSVGAnimationElement.h
content/svg/content/src/nsSVGAttrTearoffTable.h
content/svg/content/src/nsSVGBoolean.h
content/svg/content/src/nsSVGClass.h
content/svg/content/src/nsSVGDataParser.h
content/svg/content/src/nsSVGElement.cpp
content/svg/content/src/nsSVGElement.h
content/svg/content/src/nsSVGEnum.h
content/svg/content/src/nsSVGFilterElement.h
content/svg/content/src/nsSVGFilters.h
content/svg/content/src/nsSVGForeignObjectElement.h
content/svg/content/src/nsSVGGraphicElement.h
content/svg/content/src/nsSVGImageElement.h
content/svg/content/src/nsSVGInteger.h
content/svg/content/src/nsSVGIntegerPair.h
content/svg/content/src/nsSVGLength2.h
content/svg/content/src/nsSVGMarkerElement.h
content/svg/content/src/nsSVGMaskElement.h
content/svg/content/src/nsSVGMpathElement.cpp
content/svg/content/src/nsSVGNumber2.cpp
content/svg/content/src/nsSVGNumber2.h
content/svg/content/src/nsSVGNumberPair.h
content/svg/content/src/nsSVGPathDataParser.cpp
content/svg/content/src/nsSVGPathDataParser.h
content/svg/content/src/nsSVGPathElement.cpp
content/svg/content/src/nsSVGPathElement.h
content/svg/content/src/nsSVGPathGeometryElement.h
content/svg/content/src/nsSVGPatternElement.h
content/svg/content/src/nsSVGPolyElement.h
content/svg/content/src/nsSVGRect.h
content/svg/content/src/nsSVGSVGElement.h
content/svg/content/src/nsSVGString.h
content/svg/content/src/nsSVGSwitchElement.h
content/svg/content/src/nsSVGTextPathElement.h
content/svg/content/src/nsSVGUseElement.h
content/svg/content/src/nsSVGViewBox.h
dom/base/nsGlobalWindow.cpp
dom/base/nsHistory.cpp
dom/locales/en-US/chrome/dom/dom.properties
extensions/spellcheck/hunspell/src/mozHunspell.cpp
gfx/angle/Makefile.in
gfx/angle/README.mozilla
gfx/angle/angle-intrinsic-msvc2005.patch
gfx/angle/angle-limit-identifiers-to-250-chars.patch
gfx/angle/angle-renaming-debug.patch
gfx/angle/include/GLSLANG/ResourceLimits.h
gfx/angle/samples/translator/translator.cpp
gfx/angle/src/common/version.h
gfx/angle/src/compiler/Compiler.cpp
gfx/angle/src/compiler/Link.cpp
gfx/angle/src/compiler/MapLongVariableNames.cpp
gfx/angle/src/compiler/MapLongVariableNames.h
gfx/angle/src/compiler/MozAngleLink.cpp
gfx/angle/src/compiler/OutputHLSL.cpp
gfx/angle/src/compiler/OutputHLSL.h
gfx/angle/src/compiler/ParseHelper.cpp
gfx/angle/src/compiler/ShHandle.h
gfx/angle/src/compiler/generate_glslang_lexer.sh
gfx/angle/src/compiler/generate_glslang_parser.sh
gfx/angle/src/compiler/osinclude.h
gfx/angle/src/compiler/unistd.h
gfx/angle/src/libEGL/Display.cpp
gfx/angle/src/libEGL/Display.h
gfx/angle/src/libEGL/Makefile.in
gfx/angle/src/libGLESv2/Context.cpp
gfx/angle/src/libGLESv2/Context.h
gfx/angle/src/libGLESv2/Makefile.in
gfx/angle/src/libGLESv2/Program.cpp
gfx/angle/src/libGLESv2/RefCountObject.cpp
gfx/angle/src/libGLESv2/RefCountObject.h
gfx/angle/src/libGLESv2/libGLESv2.cpp
gfx/gl/GLContext.cpp
gfx/gl/GLContext.h
gfx/graphite2/src/CachedFace.h
gfx/graphite2/src/CharInfo.h
gfx/graphite2/src/CmapCache.h
gfx/graphite2/src/Code.h
gfx/graphite2/src/Endian.h
gfx/graphite2/src/Face.h
gfx/graphite2/src/FeatureMap.h
gfx/graphite2/src/FeatureVal.h
gfx/graphite2/src/Font.h
gfx/graphite2/src/GlyphFace.h
gfx/graphite2/src/GlyphFaceCache.h
gfx/graphite2/src/List.h
gfx/graphite2/src/Machine.h
gfx/graphite2/src/Main.h
gfx/graphite2/src/NameTable.h
gfx/graphite2/src/Pass.h
gfx/graphite2/src/Position.h
gfx/graphite2/src/Rule.h
gfx/graphite2/src/SegCache.h
gfx/graphite2/src/SegCacheEntry.h
gfx/graphite2/src/SegCacheStore.h
gfx/graphite2/src/Segment.h
gfx/graphite2/src/Silf.h
gfx/graphite2/src/Slot.h
gfx/graphite2/src/Sparse.h
gfx/graphite2/src/TtfTypes.h
gfx/graphite2/src/TtfUtil.h
gfx/graphite2/src/UtfCodec.h
gfx/graphite2/src/XmlTraceLog.h
gfx/graphite2/src/XmlTraceLogTags.h
gfx/graphite2/src/locale2lcid.h
gfx/graphite2/src/opcode_table.h
gfx/graphite2/src/opcodes.h
gfx/graphite2/src/processUTF.h
gfx/layers/basic/BasicLayers.cpp
gfx/src/nsFontMetrics.cpp
gfx/thebes/gfxFont.cpp
gfx/thebes/gfxFont.h
image/src/RasterImage.cpp
image/src/RasterImage.h
image/test/mochitest/Makefile.in
intl/chardet/public/nsXMLEncodingCID.h
js/src/MemoryMetrics.cpp
js/src/configure.in
js/src/jscntxt.cpp
js/src/jsinfer.cpp
js/src/jsobj.cpp
js/src/jsobjinlines.h
js/src/jsproxy.cpp
js/src/jsscript.cpp
js/src/jsscript.h
js/src/shell/js.cpp
js/src/vm/String.cpp
js/xpconnect/src/XPCJSRuntime.cpp
js/xpconnect/src/XPCMaps.cpp
js/xpconnect/src/XPCWrappedNativeInfo.cpp
js/xpconnect/src/XPCWrappedNativeScope.cpp
js/xpconnect/src/xpcpublic.h
layout/base/nsCSSFrameConstructor.cpp
layout/base/nsPresArena.cpp
layout/base/nsPresContext.h
layout/base/nsPresShell.h
layout/generic/nsTextFrameThebes.cpp
layout/generic/nsTextRunTransformations.cpp
layout/reftests/text/reftest.list
layout/style/AnimationCommon.cpp
layout/style/nsAnimationManager.cpp
layout/style/nsCSSRuleProcessor.cpp
layout/style/nsHTMLCSSStyleSheet.cpp
layout/style/nsStyleSet.cpp
layout/style/nsTransitionManager.cpp
layout/svg/base/src/nsSVGGlyphFrame.cpp
layout/svg/base/src/nsSVGGlyphFrame.h
layout/tables/crashtests/crashtests.list
mobile/android/base/GeckoApp.java
mobile/xul/app/mobile.js
netwerk/base/src/nsSocketTransport2.cpp
netwerk/base/src/nsSocketTransport2.h
netwerk/cache/nsCacheEntry.cpp
netwerk/cache/nsCacheEntryDescriptor.h
netwerk/cache/nsDiskCacheBinding.cpp
netwerk/cache/nsDiskCacheMap.cpp
netwerk/cache/nsDiskCacheStreams.cpp
netwerk/cache/nsDiskCacheStreams.h
parser/html/nsHtml5TreeOpExecutor.cpp
services/sync/tests/unit/head_http_server.js
services/sync/tests/unit/test_clients_engine.js
services/sync/tests/unit/test_syncengine_sync.js
startupcache/StartupCache.cpp
startupcache/StartupCache.h
testing/testsuite-targets.mk
toolkit/components/aboutmemory/content/aboutMemory.js
toolkit/components/autocomplete/nsAutoCompleteController.cpp
toolkit/components/places/History.cpp
toolkit/components/telemetry/TelemetryHistograms.h
toolkit/components/url-classifier/nsUrlClassifierPrefixSet.cpp
toolkit/content/widgets/videocontrols.xml
toolkit/mozapps/installer/packager.mk
toolkit/themes/pinstripe/global/media/videocontrols.css
toolkit/themes/winstripe/global/media/videocontrols.css
xpcom/base/nsStackWalk.cpp
xpcom/build/nsXPComInit.cpp
xpcom/ds/nsAtomTable.cpp
xpcom/glue/nsTArray.h
xpcom/glue/pldhash.cpp
xpcom/string/src/nsSubstring.cpp
xpcom/tests/TestTArray.cpp
--- a/.gitignore
+++ b/.gitignore
@@ -18,17 +18,17 @@ ID
 /configure
 /config.cache
 /config.log
 
 # Empty marker file that's generated when we check out NSS
 security/manager/.nss.checkout
 
 # Build directories
-obj*/
+/obj*/
 
 # Build directories for js shell
 */_DBG.OBJ/
 */_OPT.OBJ/
 
 # SpiderMonkey configury
 js/src/configure
 js/src/autom4te.cache
--- a/accessible/src/base/nsAccessNode.h
+++ b/accessible/src/base/nsAccessNode.h
@@ -190,22 +190,16 @@ public:
    * Return true if the accessible is primary accessible for the given DOM node.
    *
    * Accessible hierarchy may be complex for single DOM node, in this case
    * these accessibles share the same DOM node. The primary accessible "owns"
    * that DOM node in terms it gets stored in the accessible to node map.
    */
   virtual bool IsPrimaryForNode() const;
 
-  /**
-   * Return the string bundle
-   */
-  static nsIStringBundle* GetStringBundle()
-    { return gStringBundle; }
-
 protected:
     nsPresContext* GetPresContext();
 
     void LastRelease();
 
   nsCOMPtr<nsIContent> mContent;
   nsCOMPtr<nsIWeakReference> mWeakShell;
 
--- a/accessible/src/base/nsAccessibilityService.cpp
+++ b/accessible/src/base/nsAccessibilityService.cpp
@@ -390,17 +390,17 @@ nsAccessibilityService::CreateHTMLObject
 
 #elif MOZ_ACCESSIBILITY_ATK
     if (!AtkSocketAccessible::gCanEmbed)
       return nsnull;
 
     nsCString plugId;
     nsresult rv = pluginInstance->GetValueFromPlugin(
       NPPVpluginNativeAccessibleAtkPlugId, &plugId);
-    if (NS_SUCCEEDED(rv) && !plugId.IsVoid()) {
+    if (NS_SUCCEEDED(rv) && !plugId.IsEmpty()) {
       AtkSocketAccessible* socketAccessible =
         new AtkSocketAccessible(aContent, weakShell, plugId);
 
       NS_IF_ADDREF(socketAccessible);
       return socketAccessible;
     }
 #endif
   }
--- a/accessible/src/base/nsAccessible.cpp
+++ b/accessible/src/base/nsAccessible.cpp
@@ -574,26 +574,23 @@ NS_IMETHODIMP
 nsAccessible::GetIndexInParent(PRInt32 *aIndexInParent)
 {
   NS_ENSURE_ARG_POINTER(aIndexInParent);
 
   *aIndexInParent = IndexInParent();
   return *aIndexInParent != -1 ? NS_OK : NS_ERROR_FAILURE;
 }
 
-nsresult nsAccessible::GetTranslatedString(const nsAString& aKey, nsAString& aStringOut)
+void 
+nsAccessible::TranslateString(const nsAString& aKey, nsAString& aStringOut)
 {
   nsXPIDLString xsValue;
 
-  if (!gStringBundle || 
-    NS_FAILED(gStringBundle->GetStringFromName(PromiseFlatString(aKey).get(), getter_Copies(xsValue)))) 
-    return NS_ERROR_FAILURE;
-
+  gStringBundle->GetStringFromName(PromiseFlatString(aKey).get(), getter_Copies(xsValue));
   aStringOut.Assign(xsValue);
-  return NS_OK;
 }
 
 PRUint64
 nsAccessible::VisibilityState()
 {
   PRUint64 vstates = states::INVISIBLE | states::OFFSCREEN;
 
   // We need to check the parent chain for visibility.
@@ -1891,17 +1888,18 @@ nsAccessible::GetActionName(PRUint8 aInd
 NS_IMETHODIMP
 nsAccessible::GetActionDescription(PRUint8 aIndex, nsAString& aDescription)
 {
   // default to localized action name.
   nsAutoString name;
   nsresult rv = GetActionName(aIndex, name);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  return GetTranslatedString(name, aDescription);
+  TranslateString(name, aDescription);
+  return NS_OK;
 }
 
 // void doAction(in PRUint8 index)
 NS_IMETHODIMP
 nsAccessible::DoAction(PRUint8 aIndex)
 {
   if (aIndex != 0)
     return NS_ERROR_INVALID_ARG;
--- a/accessible/src/base/nsAccessible.h
+++ b/accessible/src/base/nsAccessible.h
@@ -606,16 +606,21 @@ public:
    */
   virtual void SetCurrentItem(nsAccessible* aItem);
 
   /**
    * Return container widget this accessible belongs to.
    */
   virtual nsAccessible* ContainerWidget() const;
 
+  /**
+   * Return the localized string for the given key.
+   */
+  static void TranslateString(const nsAString& aKey, nsAString& aStringOut);
+
 protected:
 
   //////////////////////////////////////////////////////////////////////////////
   // Initializing, cache and tree traverse methods
 
   /**
    * Cache accessible children.
    */
@@ -698,17 +703,16 @@ protected:
 
   /**
    * Compute the name for XUL node.
    */
   nsresult GetXULName(nsAString& aName);
 
   // helper method to verify frames
   static nsresult GetFullKeyName(const nsAString& aModifierName, const nsAString& aKeyName, nsAString& aStringOut);
-  static nsresult GetTranslatedString(const nsAString& aKey, nsAString& aStringOut);
 
   /**
    * Return an accessible for the given DOM node, or if that node isn't
    * accessible, return the accessible for the next DOM node which has one
    * (based on forward depth first search).
    *
    * @param  aStartNode  [in] the DOM node to start from
    * @return              the resulting accessible
new file mode 100644
--- /dev/null
+++ b/accessible/src/mac/MacUtils.h
@@ -0,0 +1,60 @@
+/* -*- Mode: Objective-C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2012
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Original Author: Hubert Figuiere <hub@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef _MacUtils_H_
+#define _MacUtils_H_
+
+@class NSString;
+class nsString;
+
+namespace mozilla {
+namespace a11y {
+namespace utils {
+
+/**
+ * Get a localized string from the string bundle.
+ * Return nil if not found.
+ */
+NSString* LocalizedString(const nsString& aString);
+
+}
+}
+}
+
+#endif
new file mode 100644
--- /dev/null
+++ b/accessible/src/mac/MacUtils.mm
@@ -0,0 +1,66 @@
+/* -*- Mode: Objective-C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2012
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Original Author: Hubert Figuiere <hub@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#import "MacUtils.h"
+
+#include "nsAccessible.h"
+
+#include "nsCocoaUtils.h"
+
+namespace mozilla {
+namespace a11y {
+namespace utils {
+
+/**
+ * Get a localized string from the a11y string bundle.
+ * Return nil if not found.
+ */
+NSString* 
+LocalizedString(const nsString& aString)
+{
+  nsString text;
+  
+  nsAccessible::TranslateString(aString, text);
+  
+  return text.IsEmpty() ? nil : nsCocoaUtils::ToNSString(text);
+}
+
+}
+}
+}
--- a/accessible/src/mac/Makefile.in
+++ b/accessible/src/mac/Makefile.in
@@ -52,18 +52,19 @@ CMMSRCS = nsAccessNodeWrap.mm \
           nsDocAccessibleWrap.mm \
           nsRootAccessibleWrap.mm \
           nsAccessibleWrap.mm \
           mozAccessible.mm \
           mozDocAccessible.mm \
           mozActionElements.mm \
           mozTextAccessible.mm \
           mozHTMLAccessible.mm \
+          MacUtils.mm \
           $(NULL)
-          
+
 
 EXPORTS = \
   nsAccessNodeWrap.h \
   nsTextAccessibleWrap.h \
   nsAccessibleWrap.h \
   nsARIAGridAccessibleWrap.h \
   nsDocAccessibleWrap.h \
   nsRootAccessibleWrap.h \
--- a/accessible/src/mac/mozAccessible.mm
+++ b/accessible/src/mac/mozAccessible.mm
@@ -33,17 +33,17 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
  
 #import "mozAccessible.h"
 
-// to get the mozView formal protocol, that all gecko's ChildViews implement.
+#import "MacUtils.h"
 #import "mozView.h"
 #import "nsRoleMap.h"
 
 #include "nsRect.h"
 #include "nsCocoaUtils.h"
 #include "nsCoord.h"
 #include "nsObjCExceptions.h"
 
@@ -122,34 +122,16 @@ GetNativeFromGeckoAccessible(nsIAccessib
 
   mozAccessible *native = nil;
   anAccessible->GetNativeInterface ((void**)&native);
   return native;
 
   NS_OBJC_END_TRY_ABORT_BLOCK_NSNULL;
 }
 
-/**
- * Get a localized string from the string bundle.
- * Return nil is not found.
- */
-static NSString* 
-GetLocalizedString(const nsString& aString)
-{
-  if (!nsAccessNode::GetStringBundle())
-    return nil;
-
-  nsXPIDLString text;
-  nsresult rv = nsAccessNode::GetStringBundle()->GetStringFromName(aString.get(),
-                                 getter_Copies(text));
-  NS_ENSURE_SUCCESS(rv, nil);
-
-  return !text.IsEmpty() ? nsCocoaUtils::ToNSString(text) : nil;
-}
-
 #pragma mark -
 
 @implementation mozAccessible
  
 - (id)initWithAccessible:(nsAccessibleWrap*)geckoAccessible
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
 
@@ -214,30 +196,38 @@ GetLocalizedString(const nsString& aStri
                                                            NSAccessibilityEnabledAttribute,
                                                            NSAccessibilitySizeAttribute,
                                                            NSAccessibilityWindowAttribute,
                                                            NSAccessibilityFocusedAttribute,
                                                            NSAccessibilityHelpAttribute,
                                                            NSAccessibilityTitleUIElementAttribute,
                                                            NSAccessibilityTopLevelUIElementAttribute,
                                                            NSAccessibilityDescriptionAttribute,
+#if DEBUG
+                                                           @"AXMozDescription",
+#endif
                                                            nil];
   }
 
   return generalAttributes;
 
   NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
 }
 
 - (id)accessibilityAttributeValue:(NSString*)attribute
 {  
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
 
   if (mIsExpired)
     return nil;
+
+#if DEBUG
+  if ([attribute isEqualToString:@"AXMozDescription"])
+    return [NSString stringWithFormat:@"role = %u", mRole];
+#endif
   
   if ([attribute isEqualToString:NSAccessibilityChildrenAttribute])
     return [self children];
   if ([attribute isEqualToString:NSAccessibilityParentAttribute]) 
     return [self parent];
   
 #ifdef DEBUG_hakan
   NSLog (@"(%@ responding to attr %@)", self, attribute);
@@ -249,18 +239,18 @@ GetLocalizedString(const nsString& aStri
     return [self position];
   if ([attribute isEqualToString:NSAccessibilitySubroleAttribute])
     return [self subrole];
   if ([attribute isEqualToString:NSAccessibilityEnabledAttribute])
     return [NSNumber numberWithBool:[self isEnabled]];
   if ([attribute isEqualToString:NSAccessibilityValueAttribute])
     return [self value];
   if ([attribute isEqualToString:NSAccessibilityRoleDescriptionAttribute]) {
-    if (mRole == roles::INTERNAL_FRAME || mRole == roles::DOCUMENT_FRAME)
-      return GetLocalizedString(NS_LITERAL_STRING("htmlContent")) ? : @"HTML Content";
+    if (mRole == roles::DOCUMENT)
+      return utils::LocalizedString(NS_LITERAL_STRING("htmlContent"));
 
     return NSAccessibilityRoleDescription([self role], nil);
   }
   
   if ([attribute isEqualToString:NSAccessibilityDescriptionAttribute])
     return [self customDescription];
   if ([attribute isEqualToString:NSAccessibilityFocusedAttribute])
     return [NSNumber numberWithBool:[self isFocused]];
--- a/accessible/src/mac/mozActionElements.h
+++ b/accessible/src/mac/mozActionElements.h
@@ -38,18 +38,27 @@
 
 #import <Cocoa/Cocoa.h>
 #import "mozAccessible.h"
 
 /* Simple subclasses for things like checkboxes, buttons, etc. */
 
 @interface mozButtonAccessible : mozAccessible
 - (void)click;
+- (BOOL)isTab;
 @end
 
 @interface mozCheckboxAccessible : mozButtonAccessible
 // returns one of the constants defined in CheckboxValue
 - (int)isChecked;
 @end
 
 /* Used for buttons that may pop up a menu. */
 @interface mozPopupButtonAccessible : mozButtonAccessible
 @end
+
+/* Class for tabs - not individual tabs */
+@interface mozTabsAccessible : mozAccessible
+{
+  NSMutableArray* mTabs;
+}
+-(id)tabs;
+@end
--- a/accessible/src/mac/mozActionElements.mm
+++ b/accessible/src/mac/mozActionElements.mm
@@ -32,17 +32,21 @@
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #import "mozActionElements.h"
+
+#import "MacUtils.h"
+
 #import "nsIAccessible.h"
+#import "nsXULTabAccessible.h"
 
 #include "nsObjCExceptions.h"
 
 using namespace mozilla::a11y;
 
 enum CheckboxValue {
   // these constants correspond to the values in the OS
   kUnchecked = 0,
@@ -55,16 +59,17 @@ enum CheckboxValue {
 - (NSArray*)accessibilityAttributeNames
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
 
   static NSArray *attributes = nil;
   if (!attributes) {
     attributes = [[NSArray alloc] initWithObjects:NSAccessibilityParentAttribute, // required
                                                   NSAccessibilityRoleAttribute, // required
+                                                  NSAccessibilityRoleDescriptionAttribute,
                                                   NSAccessibilityPositionAttribute, // required
                                                   NSAccessibilitySizeAttribute, // required
                                                   NSAccessibilityWindowAttribute, // required
                                                   NSAccessibilityPositionAttribute, // required
                                                   NSAccessibilityTopLevelUIElementAttribute, // required
                                                   NSAccessibilityHelpAttribute,
                                                   NSAccessibilityEnabledAttribute, // required
                                                   NSAccessibilityFocusedAttribute, // required
@@ -78,16 +83,23 @@ enum CheckboxValue {
 }
 
 - (id)accessibilityAttributeValue:(NSString *)attribute
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
 
   if ([attribute isEqualToString:NSAccessibilityChildrenAttribute])
     return nil;
+  if ([attribute isEqualToString:NSAccessibilityRoleDescriptionAttribute]) {
+    if ([self isTab])
+      return utils::LocalizedString(NS_LITERAL_STRING("tab"));
+    
+    return NSAccessibilityRoleDescription([self role], nil);
+  }
+  
   return [super accessibilityAttributeValue:attribute];
 
   NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
 }
 
 - (BOOL)accessibilityIsIgnored
 {
   return mIsExpired;
@@ -104,19 +116,23 @@ enum CheckboxValue {
 
   NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
 }
 
 - (NSString*)accessibilityActionDescription:(NSString*)action 
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
 
-  if ([action isEqualToString:NSAccessibilityPressAction])
+  if ([action isEqualToString:NSAccessibilityPressAction]) {
+    if ([self isTab])
+      return utils::LocalizedString(NS_LITERAL_STRING("switch"));
+  
     return @"press button"; // XXX: localize this later?
-    
+  }
+  
   return nil;
 
   NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
 }
 
 - (void)accessibilityPerformAction:(NSString*)action 
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
@@ -129,16 +145,21 @@ enum CheckboxValue {
 
 - (void)click
 {
   // both buttons and checkboxes have only one action. we should really stop using arbitrary
   // arrays with actions, and define constants for these actions.
   mGeckoAccessible->DoAction(0);
 }
 
+- (BOOL)isTab
+{
+  return (mGeckoAccessible && (mGeckoAccessible->Role() == roles::PAGETAB));
+}
+
 @end
 
 @implementation mozCheckboxAccessible
 
 - (NSString*)accessibilityActionDescription:(NSString*)action 
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
 
@@ -253,8 +274,90 @@ enum CheckboxValue {
     //       the action needed to show the menu.
     [super click];
   }
 
   NS_OBJC_END_TRY_ABORT_BLOCK;
 }
 
 @end
+
+@implementation mozTabsAccessible
+
+- (void)dealloc
+{
+  [mTabs release];
+
+  [super dealloc];
+}
+
+- (NSArray*)accessibilityAttributeNames
+{
+  // standard attributes that are shared and supported by root accessible (AXMain) elements.
+  static NSMutableArray* attributes = nil;
+  
+  if (!attributes) {
+    attributes = [[super accessibilityAttributeNames] mutableCopy];
+    [attributes addObject:NSAccessibilityContentsAttribute];
+    [attributes addObject:NSAccessibilityTabsAttribute];
+  }
+  
+  return attributes;  
+}
+
+- (id)accessibilityAttributeValue:(NSString *)attribute
+{  
+  if ([attribute isEqualToString:NSAccessibilityContentsAttribute])
+    return [super children];
+  if ([attribute isEqualToString:NSAccessibilityTabsAttribute])
+    return [self tabs];
+  
+  return [super accessibilityAttributeValue:attribute];  
+}
+
+/**
+ * Returns the selected tab (the mozAccessible)
+ */
+- (id)value
+{
+  if (!mGeckoAccessible)
+    return nil;
+    
+  nsAccessible* accessible = mGeckoAccessible->GetSelectedItem(0);
+  if (!accessible)
+    return nil;
+
+  mozAccessible* nativeAcc = nil;
+  nsresult rv = accessible->GetNativeInterface((void**)&nativeAcc);
+  NS_ENSURE_SUCCESS(rv, nil);
+  
+  return nativeAcc;
+}
+
+/**
+ * Return the mozAccessibles that are the tabs.
+ */
+- (id)tabs
+{
+  if (mTabs)
+    return mTabs;
+
+  NSArray* children = [self children];
+  NSEnumerator* enumerator = [children objectEnumerator];
+  mTabs = [[NSMutableArray alloc] init];
+  
+  id obj;
+  while ((obj = [enumerator nextObject]))
+    if ([obj isTab])
+      [mTabs addObject:obj];
+
+  return mTabs;
+}
+
+- (void)invalidateChildren
+{
+  [super invalidateChildren];
+
+  [mTabs release];
+  mTabs = nil;
+}
+
+@end
--- a/accessible/src/mac/nsAccessibleWrap.mm
+++ b/accessible/src/mac/nsAccessibleWrap.mm
@@ -99,25 +99,31 @@ nsAccessibleWrap::GetNativeType ()
     case roles::SPLITBUTTON:
     case roles::TOGGLE_BUTTON:
     {
       // if this button may show a popup, let's make it of the popupbutton type.
       return HasPopup() ? [mozPopupButtonAccessible class] : 
              [mozButtonAccessible class];
     }
     
+    case roles::PAGETAB:
+      return [mozButtonAccessible class];
+
     case roles::CHECKBUTTON:
       return [mozCheckboxAccessible class];
       
     case roles::AUTOCOMPLETE:
       return [mozComboboxAccessible class];
 
     case roles::HEADING:
       return [mozHeadingAccessible class];
 
+    case roles::PAGETABLIST:
+      return [mozTabsAccessible class];
+      
     case roles::ENTRY:
     case roles::STATICTEXT:
     case roles::LABEL:
     case roles::CAPTION:
     case roles::ACCEL_LABEL:
     case roles::TEXT_LEAF:
       // normal textfield (static or editable)
       return [mozTextAccessible class]; 
--- a/accessible/src/mac/nsRoleMap.h
+++ b/accessible/src/mac/nsRoleMap.h
@@ -47,22 +47,22 @@ static const NSString* AXRoles [] = {
   NSAccessibilityMenuBarRole,                   // ROLE_MENUBAR. (irrelevant on OS X; the menubar will always be native and on the top of the screen.)
   NSAccessibilityScrollBarRole,                 // ROLE_SCROLLBAR. we might need to make this its own mozAccessible, to support the children objects (valueindicator, down/up buttons).
   NSAccessibilitySplitterRole,                  // ROLE_GRIP
   NSAccessibilityUnknownRole,                   // ROLE_SOUND. unused on OS X
   NSAccessibilityUnknownRole,                   // ROLE_CURSOR. unused on OS X
   NSAccessibilityUnknownRole,                   // ROLE_CARET. unused on OS X
   NSAccessibilityWindowRole,                    // ROLE_ALERT
   NSAccessibilityWindowRole,                    // ROLE_WINDOW. irrelevant on OS X; all window a11y is handled by the system.
-  @"AXWebArea",                                 // ROLE_INTERNAL_FRAME
+  NSAccessibilityScrollAreaRole,                // ROLE_INTERNAL_FRAME
   NSAccessibilityMenuRole,                      // ROLE_MENUPOPUP. the parent of menuitems
   NSAccessibilityMenuItemRole,                  // ROLE_MENUITEM.
   @"AXHelpTag",                                 // ROLE_TOOLTIP. 10.4+ only, so we re-define the constant.
   NSAccessibilityGroupRole,                     // ROLE_APPLICATION. unused on OS X. the system will take care of this.
-  NSAccessibilityGroupRole,                     // ROLE_DOCUMENT
+  @"AXWebArea",                                 // ROLE_DOCUMENT
   NSAccessibilityGroupRole,                     // ROLE_PANE
   NSAccessibilityUnknownRole,                   // ROLE_CHART
   NSAccessibilityWindowRole,                    // ROLE_DIALOG. there's a dialog subrole.
   NSAccessibilityUnknownRole,                   // ROLE_BORDER. unused on OS X
   NSAccessibilityGroupRole,                     // ROLE_GROUPING
   NSAccessibilityUnknownRole,                   // ROLE_SEPARATOR
   NSAccessibilityToolbarRole,                   // ROLE_TOOLBAR
   NSAccessibilityUnknownRole,                   // ROLE_STATUSBAR. doesn't exist on OS X (a status bar is its parts; a progressbar, a label, etc.)
@@ -74,17 +74,17 @@ static const NSString* AXRoles [] = {
   NSAccessibilityGroupRole,                     // ROLE_CELL
   @"AXLink",                                    // ROLE_LINK. 10.4+ the attr first define in SDK 10.4, so we define it here too. ROLE_LINK
   @"AXHelpTag",                                 // ROLE_HELPBALLOON
   NSAccessibilityUnknownRole,                   // ROLE_CHARACTER. unused on OS X
   NSAccessibilityListRole,                      // ROLE_LIST
   NSAccessibilityRowRole,                       // ROLE_LISTITEM
   NSAccessibilityOutlineRole,                   // ROLE_OUTLINE
   NSAccessibilityRowRole,                       // ROLE_OUTLINEITEM. XXX: use OutlineRow as subrole.
-  NSAccessibilityGroupRole,                     // ROLE_PAGETAB
+  NSAccessibilityRadioButtonRole,               // ROLE_PAGETAB
   NSAccessibilityGroupRole,                     // ROLE_PROPERTYPAGE
   NSAccessibilityUnknownRole,                   // ROLE_INDICATOR
   NSAccessibilityImageRole,                     // ROLE_GRAPHIC
   NSAccessibilityStaticTextRole,                // ROLE_STATICTEXT
   NSAccessibilityStaticTextRole,                // ROLE_TEXT_LEAF
   NSAccessibilityButtonRole,                    // ROLE_PUSHBUTTON
   NSAccessibilityCheckBoxRole,                  // ROLE_CHECKBUTTON
   NSAccessibilityRadioButtonRole,               // ROLE_RADIOBUTTON
@@ -97,17 +97,17 @@ static const NSString* AXRoles [] = {
   NSAccessibilityIncrementorRole,               // ROLE_SPINBUTTON. subroles: Increment/Decrement.
   NSAccessibilityUnknownRole,                   // ROLE_DIAGRAM
   NSAccessibilityUnknownRole,                   // ROLE_ANIMATION
   NSAccessibilityUnknownRole,                   // ROLE_EQUATION
   NSAccessibilityPopUpButtonRole,               // ROLE_BUTTONDROPDOWN.
   NSAccessibilityMenuButtonRole,                // ROLE_BUTTONMENU
   NSAccessibilityGroupRole,                     // ROLE_BUTTONDROPDOWNGRID
   NSAccessibilityUnknownRole,                   // ROLE_WHITESPACE
-  NSAccessibilityGroupRole,                     // ROLE_PAGETABLIST
+  NSAccessibilityTabGroupRole,                  // ROLE_PAGETABLIST
   NSAccessibilityUnknownRole,                   // ROLE_CLOCK. unused on OS X
   NSAccessibilityButtonRole,                    // ROLE_SPLITBUTTON
   NSAccessibilityUnknownRole,                   // ROLE_IPADDRESS
   NSAccessibilityStaticTextRole,                // ROLE_ACCEL_LABEL
   NSAccessibilityUnknownRole,                   // ROLE_ARROW
   NSAccessibilityImageRole,                     // ROLE_CANVAS
   NSAccessibilityMenuItemRole,                  // ROLE_CHECK_MENU_ITEM
   NSAccessibilityColorWellRole,                 // ROLE_COLOR_CHOOSER
@@ -141,19 +141,19 @@ static const NSString* AXRoles [] = {
   NSAccessibilityGroupRole,                     // ROLE_HEADER
   NSAccessibilityGroupRole,                     // ROLE_FOOTER
   NSAccessibilityGroupRole,                     // ROLE_PARAGRAPH
   @"AXRuler",                                   // ROLE_RULER. 10.4+ only, so we re-define the constant.
   NSAccessibilityComboBoxRole,                  // ROLE_AUTOCOMPLETE
   NSAccessibilityTextFieldRole,                 // ROLE_EDITBAR
   NSAccessibilityTextFieldRole,                 // ROLE_ENTRY
   NSAccessibilityStaticTextRole,                // ROLE_CAPTION
-  @"AXWebArea",                                 // ROLE_DOCUMENT_FRAME
+  NSAccessibilityScrollAreaRole,                // ROLE_DOCUMENT_FRAME
   @"AXHeading",                                 // ROLE_HEADING
-  NSAccessibilityGroupRole,                     // ROLE_PAGE
+  NSAccessibilityGroupRole,                     // ROLE_PAG
   NSAccessibilityGroupRole,                     // ROLE_SECTION
   NSAccessibilityUnknownRole,                   // ROLE_REDUNDANT_OBJECT
   NSAccessibilityGroupRole,                     // ROLE_FORM
   NSAccessibilityUnknownRole,                   // ROLE_IME
   NSAccessibilityUnknownRole,                   // ROLE_APP_ROOT. unused on OS X
   NSAccessibilityMenuItemRole,                  // ROLE_PARENT_MENUITEM
   NSAccessibilityGroupRole,                     // ROLE_CALENDAR
   NSAccessibilityMenuRole,                      // ROLE_COMBOBOX_LIST
--- a/accessible/tests/mochitest/Makefile.in
+++ b/accessible/tests/mochitest/Makefile.in
@@ -70,16 +70,17 @@ include $(topsrcdir)/config/rules.mk
 		formimage.png \
 		letters.gif \
 		moz.png \
 		$(topsrcdir)/content/media/test/bug461281.ogg \
 		longdesc_src.html \
 		actions.js \
 		attributes.js \
 		autocomplete.js \
+		browser.js \
 		common.js \
 		events.js \
 		grid.js \
 		layout.js \
 		name.js \
 		relations.js \
 		role.js \
 		selectable.js \
new file mode 100644
--- /dev/null
+++ b/accessible/tests/mochitest/browser.js
@@ -0,0 +1,96 @@
+/**
+ * Load the browser with the given url and then invokes the given function.
+ */
+function openBrowserWindow(aFunc, aURL)
+{
+  gBrowserContext.testFunc = aFunc;
+  gBrowserContext.startURL = aURL;
+
+  addLoadEvent(openBrowserWindowIntl);
+}
+
+/**
+ * Close the browser window.
+ */
+function closeBrowserWindow()
+{
+  gBrowserContext.browserWnd.close();
+}
+
+/**
+ * Return the browser window object.
+ */
+function browserWindow()
+{
+  return gBrowserContext.browserWnd;
+}
+
+/**
+ * Return tab browser object.
+ */
+function tabBrowser()
+{
+  return browserWindow().gBrowser;
+}
+
+/**
+ * Return browser element of the current tab.
+ */
+function currentBrowser()
+{
+  return tabBrowser().selectedBrowser;
+}
+
+/**
+ * Return DOM document of the current tab.
+ */
+function currentTabDocument()
+{
+  return currentBrowser().contentDocument;
+}
+
+/**
+ * Return input element of address bar.
+ */
+function urlbarInput()
+{
+  return browserWindow().document.getElementById("urlbar").inputField;
+}
+
+/**
+ * Return reload button.
+ */
+function reloadButton()
+{
+  return browserWindow().document.getElementById("urlbar-reload-button");
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// private section
+
+Components.utils.import("resource://gre/modules/Services.jsm");
+
+var gBrowserContext =
+{
+  browserWnd: null,
+  testFunc: null,
+  startURL: ""
+};
+
+function openBrowserWindowIntl()
+{
+  gBrowserContext.browserWnd =
+    window.openDialog(Services.prefs.getCharPref("browser.chromeURL"),
+                      "_blank", "chrome,all,dialog=no",
+                      gBrowserContext.startURL);
+
+  addA11yLoadEvent(startBrowserTests, browserWindow());
+}
+
+function startBrowserTests()
+{
+  if (gBrowserContext.startURL) // wait for load
+    addA11yLoadEvent(gBrowserContext.testFunc, currentBrowser().contentWindow);
+  else
+    gBrowserContext.testFunc();
+}
--- a/accessible/tests/mochitest/events.js
+++ b/accessible/tests/mochitest/events.js
@@ -169,17 +169,17 @@ const DO_NOT_FINISH_TEST = 1;
  *     //
  *     //   * DOM node or accessible. *
  *     //   target getter: function() {},
  *     //
  *     //   * DOM event phase (false - bubbling). *
  *     //   phase getter: function() {},
  *     //
  *     //   * Callback, called to match handled event. *
- *     //   match : function() {},
+ *     //   match : function(aEvent) {},
  *     //
  *     //   * Callback, called when event is handled
  *     //   check: function(aEvent) {},
  *     //
  *     //   * Checker ID *
  *     //   getID: function() {},
  *     //
  *     //   * Event that don't have predefined order relative other events. *
@@ -1335,20 +1335,20 @@ function caretMoveChecker(aCaretOffset, 
        "Wrong caret offset for " + prettyName(aEvent.accessible));
   }
 }
 
 /**
  * State change checker.
  */
 function stateChangeChecker(aState, aIsExtraState, aIsEnabled,
-                            aTargetOrFunc, aTargetFuncArg)
+                            aTargetOrFunc, aTargetFuncArg, aIsAsync)
 {
   this.__proto__ = new invokerChecker(EVENT_STATE_CHANGE, aTargetOrFunc,
-                                      aTargetFuncArg);
+                                      aTargetFuncArg, aIsAsync);
 
   this.check = function stateChangeChecker_check(aEvent)
   {
     var event = null;
     try {
       var event = aEvent.QueryInterface(nsIAccessibleStateChangeEvent);
     } catch (e) {
       ok(false, "State change event was expected");
@@ -1365,16 +1365,32 @@ function stateChangeChecker(aState, aIsE
       "Wrong state of statechange event state");
 
     var state = aIsEnabled ? (aIsExtraState ? 0 : aState) : 0;
     var extraState = aIsEnabled ? (aIsExtraState ? aState : 0) : 0;
     var unxpdState = aIsEnabled ? 0 : (aIsExtraState ? 0 : aState);
     var unxpdExtraState = aIsEnabled ? 0 : (aIsExtraState ? aState : 0);
     testStates(event.accessible, state, extraState, unxpdState, unxpdExtraState);
   }
+
+  this.match = function stateChangeChecker_match(aEvent)
+  {
+    if (aEvent instanceof nsIAccessibleStateChangeEvent) {
+      var scEvent = aEvent.QueryInterface(nsIAccessibleStateChangeEvent);
+      return aEvent.accessible = this.target && scEvent.state == aState;
+    }
+    return false;
+  }
+}
+
+function asyncStateChangeChecker(aState, aIsExtraState, aIsEnabled,
+                                 aTargetOrFunc, aTargetFuncArg)
+{
+  this.__proto__ = new stateChangeChecker(aState, aIsExtraState, aIsEnabled,
+                                          aTargetOrFunc, aTargetFuncArg, true);
 }
 
 /**
  * Expanded state change checker.
  */
 function expandedStateChecker(aIsEnabled, aTargetOrFunc, aTargetFuncArg)
 {
   this.__proto__ = new invokerChecker(EVENT_STATE_CHANGE, aTargetOrFunc,
--- a/accessible/tests/mochitest/events/Makefile.in
+++ b/accessible/tests/mochitest/events/Makefile.in
@@ -40,32 +40,33 @@ DEPTH		= ../../../..
 topsrcdir	= @top_srcdir@
 srcdir		= @srcdir@
 VPATH		= @srcdir@
 relativesrcdir  = accessible/events
 
 include $(DEPTH)/config/autoconf.mk
 include $(topsrcdir)/config/rules.mk
 
-# test_docload.xul, docload_wnd.xul, test_scroll.xul disabled for misusing <tabbrowser> (bug 715857)
+# test_scroll.xul disabled for misusing <tabbrowser> (bug 715857)
 
 _TEST_FILES =\
 		docload_wnd.html \
 		focus.html \
 		scroll.html \
 		test_aria_alert.html \
 		test_aria_menu.html \
 		test_aria_objattr.html \
 		test_aria_statechange.html \
 		test_attrs.html \
 		test_caretmove.html \
 		test_caretmove.xul \
 		test_coalescence.html \
 		test_contextmenu.html \
 		test_docload.html \
+		test_docload.xul \
 		test_dragndrop.html \
 		test_flush.html \
 		test_focus_aria_activedescendant.html \
 		test_focus_autocomplete.xul \
 		test_focus_browserui.xul \
 		test_focus_contextmenu.xul \
 		test_focus_controls.html \
 		test_focus_dialog.html \
deleted file mode 100644
--- a/accessible/tests/mochitest/events/docload_wnd.xul
+++ /dev/null
@@ -1,275 +0,0 @@
-<?xml version="1.0"?>
-<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
-
-<!-- Firefox tabbrowser -->
-<?xml-stylesheet href="chrome://browser/content/browser.css"
-                 type="text/css"?>
-<!-- SeaMonkey tabbrowser -->
-<?xml-stylesheet href="chrome://navigator/content/navigator.css"
-                 type="text/css"?>
-
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-
-  <script type="application/javascript"
-          src="chrome://mochikit/content/tests/SimpleTest/EventUtils.js"/>
-
-  <script type="application/javascript">
-  <![CDATA[
-    ////////////////////////////////////////////////////////////////////////////
-    // SimpleTest stuffs
-
-    var gOpenerWnd = window.opener.wrappedJSObject;
-
-    function ok(aCond, aMsg) {
-      gOpenerWnd.SimpleTest.ok(aCond, aMsg);
-    }
-
-    function is(aExpected, aActual, aMsg) {
-      gOpenerWnd.SimpleTest.is(aExpected, aActual, aMsg);
-    }
-
-    function testStates(aAccOrElmOrID, aState, aExtraState, aAbsentState,
-                        aAbsentExtraState)
-    {
-      gOpenerWnd.testStates(aAccOrElmOrID, aState, aExtraState, aAbsentState,
-                            aAbsentExtraState);
-    }
-
-    var invokerChecker = gOpenerWnd.invokerChecker;
-    var asyncInvokerChecker = gOpenerWnd.asyncInvokerChecker;
-
-    const STATE_BUSY = gOpenerWnd.STATE_BUSY;
-    const EVENT_DOCUMENT_LOAD_COMPLETE =
-      gOpenerWnd.EVENT_DOCUMENT_LOAD_COMPLETE;
-    const EVENT_DOCUMENT_RELOAD = gOpenerWnd.EVENT_DOCUMENT_RELOAD;
-    const EVENT_DOCUMENT_LOAD_STOPPED =
-      gOpenerWnd.EVENT_DOCUMENT_LOAD_STOPPED;
-    const EVENT_REORDER = gOpenerWnd.EVENT_REORDER;
-    const EVENT_STATE_CHANGE = gOpenerWnd.EVENT_STATE_CHANGE;
-    const nsIAccessibleStateChangeEvent =
-      gOpenerWnd.nsIAccessibleStateChangeEvent;
-
-    //gOpenerWnd.gA11yEventDumpToConsole = true; // debug
-
-    ////////////////////////////////////////////////////////////////////////////
-    // Hacks to make xul:tabbrowser work.
-
-    var handleDroppedLink = null; // needed for tabbrowser usage
-
-    Components.utils.import("resource://gre/modules/Services.jsm");
-    var XULBrowserWindow = {
-      isBusy: false,
-      setOverLink: function (link, b) {
-      }
-    };
-
-    gFindBarInitialized = false;
-
-    ////////////////////////////////////////////////////////////////////////////
-    // Helpers.
-
-    function getContainer()
-    {
-      var idx = gTabBrowser.tabContainer.selectedIndex;
-      return gTabBrowser.getBrowserAtIndex(idx);
-    }
-
-    function getDocument()
-    {
-      return getContainer().contentDocument;
-    }
-
-    ////////////////////////////////////////////////////////////////////////////
-    // Invoker checkers.
-    function stateBusyChecker(aIsEnabled)
-    {
-      this.type = EVENT_STATE_CHANGE;
-      this.__defineGetter__("target", getDocument);
-
-      this.check = function stateBusyChecker_check(aEvent)
-      {
-        var event = null;
-        try {
-          var event = aEvent.QueryInterface(nsIAccessibleStateChangeEvent);
-        } catch (e) {
-          ok(false, "State change event was expected");
-        }
-
-        if (!event)
-          return;
-
-        is(event.state, STATE_BUSY, "Wrong state of statechange event.");
-        is(event.isEnabled(), aIsEnabled,
-           "Wrong value of state of statechange event");
-
-        testStates(event.accessible, (aIsEnabled ? STATE_BUSY : 0), 0,
-                   (aIsEnabled ? 0 : STATE_BUSY), 0);
-      }
-    }
-
-    function documentReloadChecker(aIsFromUserInput)
-    {
-      this.type = EVENT_DOCUMENT_RELOAD;
-      this.__defineGetter__("target", getDocument);
-
-      this.check = function documentReloadChecker_check(aEvent)
-      {
-        is(aEvent.isFromUserInput, aIsFromUserInput,
-           "Wrong value of isFromUserInput");
-      }
-    }
-
-    ////////////////////////////////////////////////////////////////////////////
-    // Invokers.
-
-    /**
-     * Load URI.
-     */
-    function loadURIInvoker(aURI)
-    {
-      this.invoke = function loadURIInvoker_invoke()
-      {
-        gTabBrowser.loadURI(aURI);
-      }
-
-      this.eventSeq = [
-        // We don't expect state change event for busy true since things happen
-        // quickly and it's coalesced.
-        new asyncInvokerChecker(EVENT_REORDER, getContainer),
-        new invokerChecker(EVENT_DOCUMENT_LOAD_COMPLETE, getDocument),
-        new stateBusyChecker(false)
-      ];
-
-      this.getID = function loadURIInvoker_getID()
-      {
-        return "load uri " + aURI;
-      }
-    }
-
-    /**
-     * Click reload page button.
-     */
-    function clickReloadBtnInvoker()
-    {
-      this.invoke = function clickReloadBtnInvoker_invoke()
-      {
-        synthesizeMouse(document.getElementById("reloadbtn"), 5, 5, {});
-      }
-
-      this.eventSeq = [
-        new documentReloadChecker(true),
-        new asyncInvokerChecker(EVENT_REORDER, getContainer),
-        new invokerChecker(EVENT_DOCUMENT_LOAD_COMPLETE, getDocument),
-        new stateBusyChecker(false)
-      ];
-
-      this.getID = function reloadInvoker_getID()
-      {
-        return "click reload page button";
-      }
-    }
-
-    /**
-     * Reload the page.
-     */
-    function reloadInvoker()
-    {
-      this.invoke = function reloadInvoker_invoke()
-      {
-        gTabBrowser.reload();
-      }
-
-      this.eventSeq = [
-        new documentReloadChecker(false),
-        new asyncInvokerChecker(EVENT_REORDER, getContainer),
-        new invokerChecker(EVENT_DOCUMENT_LOAD_COMPLETE, getDocument),
-        new stateBusyChecker(false)
-      ];
-
-      this.getID = function reloadInvoker_getID()
-      {
-        return "reload page";
-      }
-    }
-
-    /**
-     * Load wrong URI what results in error page loading.
-     */
-    function loadErrorPageInvoker(aURL, aURLDescr)
-    {
-      this.invoke = function loadErrorPageInvoker_invoke()
-      {
-        gTabBrowser.loadURI(aURL);
-      }
-
-      this.eventSeq = [
-        // We don't expect state change for busy true, load stopped events since
-        // things happen quickly and it's coalesced.
-        new asyncInvokerChecker(EVENT_REORDER, getContainer),
-        new invokerChecker(EVENT_DOCUMENT_LOAD_COMPLETE, getDocument),
-        new stateBusyChecker(false)
-      ];
-
-      this.getID = function loadErrorPageInvoker_getID()
-      {
-        return "load error page: '" + aURLDescr + "'";
-      }
-    }
-
-    ////////////////////////////////////////////////////////////////////////////
-    // Tests
-
-    var gQueue = null;
-
-    const Ci = Components.interfaces;
-
-    var gTabBrowser = null;
-    function doTest()
-    {
-      gTabBrowser = document.getElementById("content");
-
-      gQueue = new gOpenerWnd.eventQueue();
-      gQueue.push(new loadURIInvoker("about:"));
-      gQueue.push(new clickReloadBtnInvoker());
-      gQueue.push(new loadURIInvoker("about:mozilla"));
-      gQueue.push(new reloadInvoker());
-      gQueue.push(new loadErrorPageInvoker("www.wronguri.wronguri",
-                                           "Server not found"));
-      gQueue.push(new loadErrorPageInvoker("https://nocert.example.com:443",
-                                          "Untrusted Connection"));
-
-      gQueue.onFinish = function() { window.close(); }
-      gQueue.invoke();
-    }
-
-    gOpenerWnd.addA11yLoadEvent(doTest);
-  ]]>
-  </script>
-
-  <!-- Hack to make xul:tabbrowser work -->
-  <menubar>
-    <menu label="menu">
-      <menupopup>
-        <menuitem label="close window hook" id="menu_closeWindow"/>
-        <menuitem label="close hook" id="menu_close"/>
-      </menupopup>
-    </menu>
-  </menubar>
-
-  <button id="reloadbtn" label="reload page"
-          oncommand="gTabBrowser.reload();"/>
-
-  <toolbar>
-    <tabs id="tabbrowser-tabs" class="tabbrowser-tabs"
-          tabbrowser="content"
-          flex="1"
-          setfocus="false">
-      <tab class="tabbrowser-tab" selected="true"/>
-    </tabs>
-  </toolbar>
-  <tabbrowser id="content"
-              type="content-primary"
-              tabcontainer="tabbrowser-tabs"
-              flex="1"/>
-
-</window>
--- a/accessible/tests/mochitest/events/test_docload.xul
+++ b/accessible/tests/mochitest/events/test_docload.xul
@@ -14,30 +14,182 @@
   <script type="application/javascript"
           src="../common.js"></script>
   <script type="application/javascript"
           src="../role.js"></script>
   <script type="application/javascript"
           src="../states.js"></script>
   <script type="application/javascript"
           src="../events.js"></script>
+  <script type="application/javascript"
+          src="../browser.js"></script>
 
   <script type="application/javascript">
   <![CDATA[
-    // var gA11yEventDumpID = "eventdump"; // debug stuff
+    ////////////////////////////////////////////////////////////////////////////
+    // Invoker checkers.
+    function stateBusyChecker(aIsEnabled)
+    {
+      this.type = EVENT_STATE_CHANGE;
+      this.__defineGetter__("target", currentTabDocument);
+
+      this.check = function stateBusyChecker_check(aEvent)
+      {
+        var event = null;
+        try {
+          var event = aEvent.QueryInterface(nsIAccessibleStateChangeEvent);
+        } catch (e) {
+          ok(false, "State change event was expected");
+        }
+
+        if (!event)
+          return;
+
+        is(event.state, STATE_BUSY, "Wrong state of statechange event.");
+        is(event.isEnabled(), aIsEnabled,
+           "Wrong value of state of statechange event");
+
+        testStates(event.accessible, (aIsEnabled ? STATE_BUSY : 0), 0,
+                   (aIsEnabled ? 0 : STATE_BUSY), 0);
+      }
+    }
+
+    function documentReloadChecker(aIsFromUserInput)
+    {
+      this.type = EVENT_DOCUMENT_RELOAD;
+      this.__defineGetter__("target", currentTabDocument);
 
-    function doTest()
+      this.check = function documentReloadChecker_check(aEvent)
+      {
+        is(aEvent.isFromUserInput, aIsFromUserInput,
+           "Wrong value of isFromUserInput");
+      }
+    }
+
+    ////////////////////////////////////////////////////////////////////////////
+    // Invokers.
+
+    /**
+     * Load URI.
+     */
+    function loadURIInvoker(aURI)
+    {
+      this.invoke = function loadURIInvoker_invoke()
+      {
+        tabBrowser().loadURI(aURI);
+      }
+
+      this.eventSeq = [
+        // We don't expect state change event for busy true since things happen
+        // quickly and it's coalesced.
+        new asyncInvokerChecker(EVENT_REORDER, currentBrowser),
+        new invokerChecker(EVENT_DOCUMENT_LOAD_COMPLETE, currentTabDocument),
+        new stateBusyChecker(false)
+      ];
+
+      this.getID = function loadURIInvoker_getID()
+      {
+        return "load uri " + aURI;
+      }
+    }
+
+    /**
+     * Reload the page by F5 (isFromUserInput flag is true).
+     */
+    function userReloadInvoker()
     {
-      var w = window.openDialog("../events/docload_wnd.xul",
-                                "docload_test",
-                                "chrome,width=600,height=600");
+      this.invoke = function userReloadInvoker_invoke()
+      {
+        synthesizeKey("VK_F5", {}, browserWindow());
+      }
+
+      this.eventSeq = [
+        new documentReloadChecker(true),
+        new asyncInvokerChecker(EVENT_REORDER, currentBrowser),
+        new invokerChecker(EVENT_DOCUMENT_LOAD_COMPLETE, currentTabDocument),
+        new stateBusyChecker(false)
+      ];
+
+      this.getID = function userReloadInvoker_getID()
+      {
+        return "user reload page";
+      }
+    }
+
+    /**
+     * Reload the page (isFromUserInput flag is false).
+     */
+    function reloadInvoker()
+    {
+      this.invoke = function reloadInvoker_invoke()
+      {
+        tabBrowser().reload();
+      }
+
+      this.eventSeq = [
+        new documentReloadChecker(false),
+        new asyncInvokerChecker(EVENT_REORDER, currentBrowser),
+        new invokerChecker(EVENT_DOCUMENT_LOAD_COMPLETE, currentTabDocument),
+        new stateBusyChecker(false)
+      ];
+
+      this.getID = function reloadInvoker_getID()
+      {
+        return "reload page";
+      }
+    }
+
+    /**
+     * Load wrong URI what results in error page loading.
+     */
+    function loadErrorPageInvoker(aURL, aURLDescr)
+    {
+      this.invoke = function loadErrorPageInvoker_invoke()
+      {
+        tabBrowser().loadURI(aURL);
+      }
+
+      this.eventSeq = [
+        // We don't expect state change for busy true, load stopped events since
+        // things happen quickly and it's coalesced.
+        new asyncInvokerChecker(EVENT_REORDER, currentBrowser),
+        new invokerChecker(EVENT_DOCUMENT_LOAD_COMPLETE, currentTabDocument),
+        new stateBusyChecker(false)
+      ];
+
+      this.getID = function loadErrorPageInvoker_getID()
+      {
+        return "load error page: '" + aURLDescr + "'";
+      }
+    }
+
+    ////////////////////////////////////////////////////////////////////////////
+    // Tests
+
+    gA11yEventDumpToConsole = true; // debug
+
+    var gQueue = null;
+    function doTests()
+    {
+      gQueue = new eventQueue();
+      gQueue.push(new loadURIInvoker("about:"));
+      gQueue.push(new userReloadInvoker());
+      gQueue.push(new loadURIInvoker("about:mozilla"));
+      gQueue.push(new reloadInvoker());
+      gQueue.push(new loadErrorPageInvoker("www.wronguri.wronguri",
+                                           "Server not found"));
+      gQueue.push(new loadErrorPageInvoker("https://nocert.example.com:443",
+                                          "Untrusted Connection"));
+
+      gQueue.onFinish = function() { closeBrowserWindow(); }
+      gQueue.invoke();
     }
 
     SimpleTest.waitForExplicitFinish();
-    addLoadEvent(doTest);
+    openBrowserWindow(doTests);
   ]]>
   </script>
 
   <vbox flex="1" style="overflow: auto;">
   <body xmlns="http://www.w3.org/1999/xhtml">
     <a target="_blank"
        href="https://bugzilla.mozilla.org/show_bug.cgi?id=566103"
        title=" reorganize accessible document handling">
--- a/accessible/tests/mochitest/events/test_focus_browserui.xul
+++ b/accessible/tests/mochitest/events/test_focus_browserui.xul
@@ -14,50 +14,30 @@
   <script type="application/javascript"
           src="../common.js"></script>
   <script type="application/javascript"
           src="../role.js"></script>
   <script type="application/javascript"
           src="../states.js"></script>
   <script type="application/javascript"
           src="../events.js"></script>
+  <script type="application/javascript"
+          src="../browser.js"></script>
 
   <script type="application/javascript">
   <![CDATA[
-    Components.utils.import("resource://gre/modules/Services.jsm");
-
     ////////////////////////////////////////////////////////////////////////////
     // Helpers
 
-    function tabBrowser()
-    {
-      return gBrowserWnd.gBrowser;
-    }
-
-    function currentBrowser()
-    {
-      return tabBrowser().selectedBrowser;
-    }
-
-    function currentTabDocument()
-    {
-      return currentBrowser().contentDocument;
-    }
-
     function inputInDocument()
     {
       var tabdoc = currentTabDocument();
       return tabdoc.getElementById("input");
     }
 
-    function urlbarInput()
-    {
-      return gBrowserWnd.document.getElementById("urlbar").inputField;
-    }
-
     ////////////////////////////////////////////////////////////////////////////
     // Invokers
 
     function loadURI(aURI)
     {
       this.invoke = function loadURI_invoke()
       {
         tabBrowser().loadURI(aURI);
@@ -91,68 +71,53 @@
     }
 
     ////////////////////////////////////////////////////////////////////////////
     // Testing
 
     var gInputDocURI = "data:text/html,<html><input id='input'></html>";
     var gButtonDocURI = "data:text/html,<html><input id='input' type='button' value='button'></html>";
 
-    var gBrowserWnd = null;
-    function loadBrowser()
-    {
-      gBrowserWnd = window.openDialog(Services.prefs.getCharPref("browser.chromeURL"),
-                                      "_blank", "chrome,all,dialog=no", gInputDocURI);
-
-      addA11yLoadEvent(startTests, gBrowserWnd);
-    }
-
-    function startTests()
-    {
-      // Wait for tab load.
-      var browser = gBrowserWnd.gBrowser.selectedBrowser;
-      addA11yLoadEvent(doTests, browser.contentWindow);
-    }
-
     //gA11yEventDumpToConsole = true; // debug
 
     var gQueue = null;
     function doTests()
     {
       gQueue = new eventQueue();
 
       var tabDocument = currentTabDocument();
       var input = inputInDocument();
 
       // move focus to input inside tab document
-      gQueue.push(new synthTab(tabDocument, new focusChecker(input), gBrowserWnd));
+      gQueue.push(new synthTab(tabDocument, new focusChecker(input),
+                               browserWindow()));
 
       // open new url, focus moves to new document
       gQueue.push(new loadURI(gButtonDocURI));
 
       // back one page in history, moves moves on input of tab document
       gQueue.push(new goBack());
 
       // open new tab, focus moves to urlbar
-      gQueue.push(new synthKey(tabDocument, "t", { ctrlKey: true, window: gBrowserWnd },
+      gQueue.push(new synthKey(tabDocument, "t", { ctrlKey: true, window: browserWindow() },
                                new focusChecker(urlbarInput)));
 
       // close open tab, focus goes on input of tab document
-      gQueue.push(new synthKey(tabDocument, "w", { ctrlKey: true, window: gBrowserWnd },
+      gQueue.push(new synthKey(tabDocument, "w", { ctrlKey: true, window: browserWindow() },
                                new focusChecker(inputInDocument)));
 
       gQueue.onFinish = function()
       {
-        gBrowserWnd.close();
+        closeBrowserWindow();
       }
       gQueue.invoke();
     }
 
     SimpleTest.waitForExplicitFinish();
-    addLoadEvent(loadBrowser);
+    openBrowserWindow(doTests, gInputDocURI);
   ]]>
   </script>
 
   <vbox flex="1" style="overflow: auto;">
   <body xmlns="http://www.w3.org/1999/xhtml">
     <a target="_blank"
        href="https://bugzilla.mozilla.org/show_bug.cgi?id=644452"
        title="Focus not set when switching to cached document with back or forward if anything other than the document was last focused">
--- a/accessible/tests/mochitest/states.js
+++ b/accessible/tests/mochitest/states.js
@@ -32,19 +32,21 @@ const STATE_REQUIRED = nsIAccessibleStat
 const STATE_SELECTABLE = nsIAccessibleStates.STATE_SELECTABLE;
 const STATE_SELECTED = nsIAccessibleStates.STATE_SELECTED;
 const STATE_TRAVERSED = nsIAccessibleStates.STATE_TRAVERSED;
 const STATE_UNAVAILABLE = nsIAccessibleStates.STATE_UNAVAILABLE;
 
 const EXT_STATE_ACTIVE = nsIAccessibleStates.EXT_STATE_ACTIVE;
 const EXT_STATE_DEFUNCT = nsIAccessibleStates.EXT_STATE_DEFUNCT;
 const EXT_STATE_EDITABLE = nsIAccessibleStates.EXT_STATE_EDITABLE;
+const EXT_STATE_ENABLED = nsIAccessibleStates.EXT_STATE_ENABLED;
 const EXT_STATE_EXPANDABLE = nsIAccessibleStates.EXT_STATE_EXPANDABLE;
 const EXT_STATE_HORIZONTAL = nsIAccessibleStates.EXT_STATE_HORIZONTAL;
 const EXT_STATE_MULTI_LINE = nsIAccessibleStates.EXT_STATE_MULTI_LINE;
+const EXT_STATE_SENSITIVE = nsIAccessibleStates.EXT_STATE_SENSITIVE;
 const EXT_STATE_SINGLE_LINE = nsIAccessibleStates.EXT_STATE_SINGLE_LINE;
 const EXT_STATE_STALE = nsIAccessibleStates.EXT_STATE_STALE;
 const EXT_STATE_SUPPORTS_AUTOCOMPLETION =
   nsIAccessibleStates.EXT_STATE_SUPPORTS_AUTOCOMPLETION;
 const EXT_STATE_VERTICAL = nsIAccessibleStates.EXT_STATE_VERTICAL;
 
 const kOrdinalState = 0;
 const kExtraState = 1;
--- a/browser/base/content/pageinfo/pageInfo.js
+++ b/browser/base/content/pageinfo/pageInfo.js
@@ -37,27 +37,28 @@
 # decision by deleting the provisions above and replace them with the notice
 # and other provisions required by the GPL or the LGPL. If you do not delete
 # the provisions above, a recipient may use your version of this file under
 # the terms of any one of the MPL, the GPL or the LGPL.
 #
 # ***** END LICENSE BLOCK *****
 
 //******** define a js object to implement nsITreeView
-function pageInfoTreeView(copycol)
+function pageInfoTreeView(treeid, copycol)
 {
   // copycol is the index number for the column that we want to add to
   // the copy-n-paste buffer when the user hits accel-c
+  this.treeid = treeid;
   this.copycol = copycol;
   this.rows = 0;
   this.tree = null;
   this.data = [ ];
   this.selection = null;
-  this.sortcol = null;
-  this.sortdir = 0;
+  this.sortcol = -1;
+  this.sortdir = false;
 }
 
 pageInfoTreeView.prototype = {
   set rowCount(c) { throw "rowCount is a readonly property"; },
   get rowCount() { return this.rows; },
 
   setTree: function(tree)
   {
@@ -116,16 +117,35 @@ pageInfoTreeView.prototype = {
   performActionOnRow: function(action, row)
   {
     if (action == "copy") {
       var data = this.handleCopy(row)
       this.tree.treeBody.parentNode.setAttribute("copybuffer", data);
     }
   },
 
+  onPageMediaSort : function(columnname)
+  {
+    var tree = document.getElementById(this.treeid);
+    var treecol = tree.columns.getNamedColumn(columnname);
+
+    this.sortdir =
+      gTreeUtils.sort(
+        tree,
+        this,
+        this.data,
+        treecol.index,
+        function textComparator(a, b) { return a.toLowerCase().localeCompare(b.toLowerCase()); },
+        this.sortcol,
+        this.sortdir
+      );
+
+    this.sortcol = treecol.index;
+  },
+
   getRowProperties: function(row, prop) { },
   getCellProperties: function(row, column, prop) { },
   getColumnProperties: function(column, prop) { },
   isContainer: function(index) { return false; },
   isContainerOpen: function(index) { return false; },
   isSeparator: function(index) { return false; },
   isSorted: function() { },
   canDrop: function(index, orientation) { return false; },
@@ -161,19 +181,18 @@ const COL_IMAGE_NODE    = 5;
 const COL_IMAGE_BG      = 6;
 
 // column number to copy from, second argument to pageInfoTreeView's constructor
 const COPYCOL_NONE = -1;
 const COPYCOL_META_CONTENT = 1;
 const COPYCOL_IMAGE = COL_IMAGE_ADDRESS;
 
 // one nsITreeView for each tree in the window
-var gMetaView = new pageInfoTreeView(COPYCOL_META_CONTENT);
-var gImageView = new pageInfoTreeView(COPYCOL_IMAGE);
-
+var gMetaView = new pageInfoTreeView('metatree', COPYCOL_META_CONTENT);
+var gImageView = new pageInfoTreeView('imagetree', COPYCOL_IMAGE);
 
 var atomSvc = Components.classes["@mozilla.org/atom-service;1"]
                         .getService(Components.interfaces.nsIAtomService);
 gImageView._ltrAtom = atomSvc.getAtom("ltr");
 gImageView._brokenAtom = atomSvc.getAtom("broken");
 
 gImageView.getCellProperties = function(row, col, props) {
   var data = gImageView.data[row];
@@ -182,16 +201,54 @@ gImageView.getCellProperties = function(
       item instanceof HTMLEmbedElement ||
       (item instanceof HTMLObjectElement && !/^image\//.test(item.type)))
     props.AppendElement(this._brokenAtom);
 
   if (col.element.id == "image-address")
     props.AppendElement(this._ltrAtom);
 };
 
+gImageView.getCellText = function(row, column) {
+  var value = this.data[row][column.index];
+  if (column.index == COL_IMAGE_SIZE) {
+    if (value == -1) {
+      return gStrings.unknown;
+    } else {
+      var kbSize = Number(Math.round(value / 1024 * 100) / 100);
+      return gBundle.getFormattedString("mediaFileSize", [kbSize]);
+    }
+  }
+  return value || "";
+};
+
+gImageView.onPageMediaSort = function(columnname) {
+  var tree = document.getElementById(this.treeid);
+  var treecol = tree.columns.getNamedColumn(columnname);
+
+  var comparator;
+  if (treecol.index == COL_IMAGE_SIZE) {
+    comparator = function numComparator(a, b) { return a - b; };
+  } else {
+    comparator = function textComparator(a, b) { return a.toLowerCase().localeCompare(b.toLowerCase()); };
+  }
+
+  this.sortdir =
+    gTreeUtils.sort(
+      tree,
+      this,
+      this.data,
+      treecol.index,
+      comparator,
+      this.sortcol,
+      this.sortdir
+    );
+
+  this.sortcol = treecol.index;
+};
+
 var gImageHash = { };
 
 // localized strings (will be filled in when the document is loaded)
 // this isn't all of them, these are just the ones that would otherwise have been loaded inside a loop
 var gStrings = { };
 var gBundle;
 
 const PERMISSION_CONTRACTID     = "@mozilla.org/permissionmanager;1";
@@ -580,25 +637,18 @@ function addImage(url, type, alt, elem, 
     catch(ex) {
       try {
         // open for READ, in non-blocking mode
         cacheEntryDescriptor = ftpCacheSession.openCacheEntry(url, ACCESS_READ, false);
       }
       catch(ex2) { }
     }
 
-    var sizeText;
-    if (cacheEntryDescriptor) {
-      var pageSize = cacheEntryDescriptor.dataSize;
-      var kbSize = formatNumber(Math.round(pageSize / 1024 * 100) / 100);
-      sizeText = gBundle.getFormattedString("mediaFileSize", [kbSize]);
-    }
-    else
-      sizeText = gStrings.unknown;
-    gImageView.addRow([url, type, sizeText, alt, 1, elem, isBg]);
+    var dataSize = (cacheEntryDescriptor) ? cacheEntryDescriptor.dataSize : -1;
+    gImageView.addRow([url, type, dataSize, alt, 1, elem, isBg]);
 
     // Add the observer, only once.
     if (gImageView.data.length == 1) {
       document.getElementById("mediaTab").hidden = false;
       Components.classes["@mozilla.org/observer-service;1"]
                 .getService(Components.interfaces.nsIObserverService)
                 .addObserver(imagePermissionObserver, "perm-changed", false);
     }
@@ -695,17 +745,20 @@ function onBeginLinkDrag(event,urlField,
 
 //******** Image Stuff
 function getSelectedImage(tree)
 {
   if (!gImageView.rowCount)
     return null;
 
   // Only works if only one item is selected
-  var clickedRow = tree.currentIndex;
+  var clickedRow = tree.view.selection.currentIndex;
+  if (clickedRow == -1)
+    return null;
+
   // image-node
   return gImageView.data[clickedRow][COL_IMAGE_NODE];
 }
 
 function selectSaveFolder()
 {
   const nsILocalFile = Components.interfaces.nsILocalFile;
   const nsIFilePicker = Components.interfaces.nsIFilePicker;
--- a/browser/base/content/pageinfo/pageInfo.xul
+++ b/browser/base/content/pageinfo/pageInfo.xul
@@ -61,16 +61,17 @@
   onunload="onUnloadPageInfo()"
   align="stretch"
   screenX="10" screenY="10"
   width="&pageInfoWindow.width;" height="&pageInfoWindow.height;"
   persist="screenX screenY width height sizemode">
 
   <script type="application/javascript" src="chrome://global/content/globalOverlay.js"/>
   <script type="application/javascript" src="chrome://global/content/contentAreaUtils.js"/>
+  <script type="application/javascript" src="chrome://global/content/treeUtils.js"/>
   <script type="application/javascript" src="chrome://browser/content/pageinfo/pageInfo.js"/>
   <script type="application/javascript" src="chrome://browser/content/pageinfo/feeds.js"/>
   <script type="application/javascript" src="chrome://browser/content/pageinfo/permissions.js"/>
   <script type="application/javascript" src="chrome://browser/content/pageinfo/security.js"/>
   <script type="application/javascript" src="chrome://browser/content/utilityOverlay.js"/>
 
   <stringbundleset id="pageinfobundleset">
     <stringbundle id="pageinfobundle" src="chrome://browser/locale/pageInfo.properties"/>
@@ -187,20 +188,22 @@
         </rows>
       </grid>
       <separator class="thin"/>
       <groupbox id="metaTags" flex="1" class="collapsable treebox">
         <caption id="metaTagsCaption" onclick="toggleGroupbox('metaTags');"/>
         <tree id="metatree" flex="1" hidecolumnpicker="true" contextmenu="picontext">
           <treecols>
             <treecol id="meta-name"    label="&generalMetaName;"
-                     persist="width" flex="1"/>
+                     persist="width" flex="1"
+                     onclick="gMetaView.onPageMediaSort('meta-name');"/>
             <splitter class="tree-splitter"/>
             <treecol id="meta-content" label="&generalMetaContent;"
-                     persist="width" flex="4"/>
+                     persist="width" flex="4"
+                     onclick="gMetaView.onPageMediaSort('meta-content');"/>
           </treecols>
           <treechildren flex="1"/>
         </tree>        
       </groupbox>
       <groupbox id="securityBox">
         <caption id="securityBoxCaption" label="&securityHeader;"/>
         <description id="general-security-identity" class="header"/>
         <description id="general-security-privacy"  class="header"/>
@@ -213,29 +216,34 @@
     </vbox>
 
     <!-- Media information -->
     <vbox id="mediaPanel">
       <tree id="imagetree" onselect="onImageSelect();" contextmenu="picontext"
             ondragstart="onBeginLinkDrag(event,'image-address','image-alt')">
         <treecols>
           <treecol sortSeparators="true" primary="true" persist="width" flex="10"
-                        width="10" id="image-address" label="&mediaAddress;"/>
+                        width="10" id="image-address" label="&mediaAddress;"
+                        onclick="gImageView.onPageMediaSort('image-address');"/>
           <splitter class="tree-splitter"/>
           <treecol sortSeparators="true" persist="hidden width" flex="2"
-                        width="2"  id="image-type"    label="&mediaType;"/>
+                        width="2"  id="image-type"    label="&mediaType;"
+                        onclick="gImageView.onPageMediaSort('image-type');"/>
           <splitter class="tree-splitter"/>
           <treecol sortSeparators="true" hidden="true" persist="hidden width" flex="2"
-                        width="2"  id="image-size"    label="&mediaSize;"/>
+                        width="2"  id="image-size"  label="&mediaSize;" value="size"
+                        onclick="gImageView.onPageMediaSort('image-size');"/>
           <splitter class="tree-splitter"/>
           <treecol sortSeparators="true" hidden="true" persist="hidden width" flex="4"
-                        width="4"  id="image-alt"    label="&mediaAltHeader;"/>
+                        width="4"  id="image-alt"    label="&mediaAltHeader;"
+                        onclick="gImageView.onPageMediaSort('image-alt');"/>
           <splitter class="tree-splitter"/>
           <treecol sortSeparators="true" hidden="true" persist="hidden width" flex="1"
-                        width="1"  id="image-count"    label="&mediaCount;"/>
+                        width="1"  id="image-count"    label="&mediaCount;"
+                        onclick="gImageView.onPageMediaSort('image-count');"/>
         </treecols>
         <treechildren flex="1"/>
       </tree>
       <splitter orient="vertical" id="mediaSplitter"/>
       <vbox flex="1" id="mediaPreviewBox" collapsed="true">
         <grid id="mediaGrid">
           <columns>
             <column id="mediaLabelColumn"/>
--- a/browser/base/content/syncSetup.xul
+++ b/browser/base/content/syncSetup.xul
@@ -255,33 +255,34 @@
               onextra1="gSyncSetup.onSyncOptions()"
               onpageshow="gSyncSetup.onPageShow()">
     <description>
       &pairDevice.setup.description.label;
       <label class="text-link"
              value="&addDevice.showMeHow.label;"
              href="https://services.mozilla.com/sync/help/easy-setup"/>
     </description>
-    <description>&addDevice.setup.enterCode.label;</description>
+    <label value="&addDevice.setup.enterCode.label;"
+           control="easySetupPIN1"/>
     <spacer flex="1"/>
     <vbox align="center" flex="1">
       <textbox id="easySetupPIN1"
                class="pin"
                value=""
-               disabled="true"
+               readonly="true"
                />
       <textbox id="easySetupPIN2"
                class="pin"
                value=""
-               disabled="true"
+               readonly="true"
                />
       <textbox id="easySetupPIN3"
                class="pin"
                value=""
-               disabled="true"
+               readonly="true"
                />
     </vbox>
     <spacer flex="3"/>
     <label class="text-link"
            value="&addDevice.dontHaveDevice.label;"
            onclick="gSyncSetup.manualSetup();"/>
   </wizardpage>
 
--- a/browser/components/preferences/cookies.xul
+++ b/browser/components/preferences/cookies.xul
@@ -47,17 +47,17 @@
         class="windowDialog" title="&window.title;"
         xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
         style="width: &window.width;;"
         onload="gCookiesWindow.init();"
         onunload="gCookiesWindow.uninit();"
         persist="screenX screenY width height"
         onkeypress="gCookiesWindow.onWindowKeyPress(event);">
 
-  <script src="chrome://browser/content/preferences/permissionsutils.js"/>
+  <script src="chrome://global/content/treeUtils.js"/>
   <script src="chrome://browser/content/preferences/cookies.js"/>
 
   <stringbundle id="bundlePreferences"
                 src="chrome://browser/locale/preferences/preferences.properties"/>
 
   <keyset>
     <key key="&windowClose.key;" modifiers="accel" oncommand="window.close();"/>
     <key key="&focusSearch1.key;" modifiers="accel" oncommand="gCookiesWindow.focusFilterBox();"/>
--- a/browser/components/preferences/jar.mn
+++ b/browser/components/preferences/jar.mn
@@ -22,17 +22,16 @@ browser.jar:
 *   content/browser/preferences/handlers.xml
 *   content/browser/preferences/handlers.css
 *   content/browser/preferences/languages.xul
 *   content/browser/preferences/languages.js
 *   content/browser/preferences/main.xul
 *   content/browser/preferences/main.js
 *   content/browser/preferences/permissions.xul
 *   content/browser/preferences/permissions.js
-*   content/browser/preferences/permissionsutils.js
 *   content/browser/preferences/preferences.xul
 *   content/browser/preferences/privacy.xul
 *   content/browser/preferences/privacy.js
 *   content/browser/preferences/sanitize.xul
 *   content/browser/preferences/security.xul
 *   content/browser/preferences/security.js
 *   content/browser/preferences/selectBookmark.xul
 *   content/browser/preferences/selectBookmark.js
--- a/browser/components/preferences/permissions.js
+++ b/browser/components/preferences/permissions.js
@@ -234,32 +234,34 @@ var gPermissionManager = {
   {
     if (aTopic == "perm-changed") {
       var permission = aSubject.QueryInterface(Components.interfaces.nsIPermission);
       if (aData == "added") {
         this._addPermissionToList(permission);
         ++this._view._rowCount;
         this._tree.treeBoxObject.rowCountChanged(this._view.rowCount - 1, 1);        
         // Re-do the sort, since we inserted this new item at the end. 
-        gTreeUtils.sort(this._tree, this._view, this._permissions, 
+        gTreeUtils.sort(this._tree, this._view, this._permissions,
+                        this._permissionsComparator,
                         this._lastPermissionSortColumn, 
                         this._lastPermissionSortAscending);        
       }
       else if (aData == "changed") {
         for (var i = 0; i < this._permissions.length; ++i) {
           if (this._permissions[i].host == permission.host) {
             this._permissions[i].capability = this._getCapabilityString(permission.capability);
             break;
           }
         }
         // Re-do the sort, if the status changed from Block to Allow
         // or vice versa, since if we're sorted on status, we may no
         // longer be in order. 
         if (this._lastPermissionSortColumn.id == "statusCol") {
-          gTreeUtils.sort(this._tree, this._view, this._permissions, 
+          gTreeUtils.sort(this._tree, this._view, this._permissions,
+                          this._permissionsComparator,
                           this._lastPermissionSortColumn, 
                           this._lastPermissionSortAscending);
         }
         this._tree.treeBoxObject.invalidate();
       }
       // No UI other than this window causes this method to be sent a "deleted"
       // notification, so we don't need to implement it since Delete is handled
       // directly by the Permission Removal handlers. If that ever changes, those
@@ -306,23 +308,29 @@ var gPermissionManager = {
   onPermissionKeyPress: function (aEvent)
   {
     if (aEvent.keyCode == 46)
       this.onPermissionDeleted();
   },
   
   _lastPermissionSortColumn: "",
   _lastPermissionSortAscending: false,
+  _permissionsComparator : function (a, b)
+  {
+    return a.toLowerCase().localeCompare(b.toLowerCase());
+  },
+
   
   onPermissionSort: function (aColumn)
   {
     this._lastPermissionSortAscending = gTreeUtils.sort(this._tree, 
                                                         this._view, 
                                                         this._permissions,
-                                                        aColumn, 
+                                                        aColumn,
+                                                        this._permissionsComparator,
                                                         this._lastPermissionSortColumn, 
                                                         this._lastPermissionSortAscending);
     this._lastPermissionSortColumn = aColumn;
   },
   
   _loadPermissions: function ()
   {
     this._tree = document.getElementById("permissionsTree");
--- a/browser/components/preferences/permissions.xul
+++ b/browser/components/preferences/permissions.xul
@@ -49,17 +49,17 @@
         title="&window.title;"
         xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
         style="width: &window.width;;"
         onload="gPermissionManager.onLoad();"
         onunload="gPermissionManager.uninit();"
         persist="screenX screenY width height"
         onkeypress="gPermissionManager.onWindowKeyPress(event);">
 
-  <script src="chrome://browser/content/preferences/permissionsutils.js"/>
+  <script src="chrome://global/content/treeUtils.js"/>
   <script src="chrome://browser/content/preferences/permissions.js"/>
 
   <stringbundle id="bundlePreferences"
                 src="chrome://browser/locale/preferences/preferences.properties"/>
 
   <keyset>
     <key key="&windowClose.key;" modifiers="accel" oncommand="window.close();"/>
   </keyset>
deleted file mode 100644
--- a/browser/components/preferences/permissionsutils.js
+++ /dev/null
@@ -1,102 +0,0 @@
-# -*- Mode: Java; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
-# ***** BEGIN LICENSE BLOCK *****
-# Version: MPL 1.1/GPL 2.0/LGPL 2.1
-#
-# The contents of this file are subject to the Mozilla Public License Version
-# 1.1 (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-# http://www.mozilla.org/MPL/
-#
-# Software distributed under the License is distributed on an "AS IS" basis,
-# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
-# for the specific language governing rights and limitations under the
-# License.
-#
-# The Original Code is the Firefox Preferences System.
-#
-# The Initial Developer of the Original Code is
-# Ben Goodger.
-# Portions created by the Initial Developer are Copyright (C) 2005
-# the Initial Developer. All Rights Reserved.
-#
-# Contributor(s):
-#   Ben Goodger <ben@mozilla.org>
-#
-# Alternatively, the contents of this file may be used under the terms of
-# either the GNU General Public License Version 2 or later (the "GPL"), or
-# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
-# in which case the provisions of the GPL or the LGPL are applicable instead
-# of those above. If you wish to allow use of your version of this file only
-# under the terms of either the GPL or the LGPL, and not to allow others to
-# use your version of this file under the terms of the MPL, indicate your
-# decision by deleting the provisions above and replace them with the notice
-# and other provisions required by the GPL or the LGPL. If you do not delete
-# the provisions above, a recipient may use your version of this file under
-# the terms of any one of the MPL, the GPL or the LGPL.
-#
-# ***** END LICENSE BLOCK *****
-
-var gTreeUtils = {
-  deleteAll: function (aTree, aView, aItems, aDeletedItems)
-  {
-    for (var i = 0; i < aItems.length; ++i)
-      aDeletedItems.push(aItems[i]);
-    aItems.splice(0, aItems.length);
-    var oldCount = aView.rowCount;
-    aView._rowCount = 0;
-    aTree.treeBoxObject.rowCountChanged(0, -oldCount);
-  },
-  
-  deleteSelectedItems: function (aTree, aView, aItems, aDeletedItems)
-  {
-    var selection = aTree.view.selection;
-    selection.selectEventsSuppressed = true;
-    
-    var rc = selection.getRangeCount();
-    for (var i = 0; i < rc; ++i) {
-      var min = { }; var max = { };
-      selection.getRangeAt(i, min, max);
-      for (var j = min.value; j <= max.value; ++j) {
-        aDeletedItems.push(aItems[j]);
-        aItems[j] = null;
-      }
-    }
-    
-    var nextSelection = 0;
-    for (i = 0; i < aItems.length; ++i) {
-      if (!aItems[i]) {
-        var j = i;
-        while (j < aItems.length && !aItems[j])
-          ++j;
-        aItems.splice(i, j - i);
-        nextSelection = j < aView.rowCount ? j - 1 : j - 2;
-        aView._rowCount -= j - i;
-        aTree.treeBoxObject.rowCountChanged(i, i - j);
-      }
-    }
-
-    if (aItems.length) {
-      selection.select(nextSelection);
-      aTree.treeBoxObject.ensureRowIsVisible(nextSelection);
-      aTree.focus();
-    }
-    selection.selectEventsSuppressed = false;
-  },
-  
-  sort: function (aTree, aView, aDataSet, aColumn, 
-                  aLastSortColumn, aLastSortAscending) 
-  {
-    var ascending = (aColumn == aLastSortColumn) ? !aLastSortAscending : true;
-    aDataSet.sort(function (a, b) { return a[aColumn].toLowerCase().localeCompare(b[aColumn].toLowerCase()); });
-    if (!ascending)
-      aDataSet.reverse();
-    
-    aTree.view.selection.select(-1);
-    aTree.view.selection.select(0);
-    aTree.treeBoxObject.invalidate();
-    aTree.treeBoxObject.ensureRowIsVisible(0);
-    
-    return ascending;
-  }
-};
-
--- a/browser/components/sessionstore/test/browser_477657.js
+++ b/browser/components/sessionstore/test/browser_477657.js
@@ -59,40 +59,40 @@ function test() {
     let uniqueKey = "bug 477657";
     let uniqueValue = "unik" + Date.now();
 
     ss.setWindowValue(newWin, uniqueKey, uniqueValue);
     is(ss.getWindowValue(newWin, uniqueKey), uniqueValue,
        "window value was set before the window was overwritten");
     ss.setWindowState(newWin, JSON.stringify(newState), true);
 
-    // use setTimeout(..., 0) to mirror sss_restoreWindowFeatures
-    setTimeout(function() {
+    // use newWin.setTimeout(..., 0) to mirror sss_restoreWindowFeatures
+    newWin.setTimeout(function() {
       is(ss.getWindowValue(newWin, uniqueKey), "",
          "window value was implicitly cleared");
 
       is(newWin.windowState, newWin.STATE_MAXIMIZED,
          "the window was maximized");
 
       is(JSON.parse(ss.getClosedTabData(newWin)).length, 1,
          "the closed tab was added before the window was overwritten");
       delete newState.windows[0]._closedTabs;
       delete newState.windows[0].sizemode;
       ss.setWindowState(newWin, JSON.stringify(newState), true);
 
-      setTimeout(function() {
+      newWin.setTimeout(function() {
         is(JSON.parse(ss.getClosedTabData(newWin)).length, 0,
            "closed tabs were implicitly cleared");
 
         is(newWin.windowState, newWin.STATE_MAXIMIZED,
            "the window remains maximized");
         newState.windows[0].sizemode = "normal";
         ss.setWindowState(newWin, JSON.stringify(newState), true);
 
-        setTimeout(function() {
+        newWin.setTimeout(function() {
           isnot(newWin.windowState, newWin.STATE_MAXIMIZED,
                 "the window was explicitly unmaximized");
 
           newWin.close();
           finish();
         }, 0);
       }, 0);
     }, 0);
--- a/browser/devtools/shared/SplitView.jsm
+++ b/browser/devtools/shared/SplitView.jsm
@@ -36,17 +36,17 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 "use strict";
 
 const EXPORTED_SYMBOLS = ["SplitView"];
 
 /* this must be kept in sync with CSS (ie. splitview.css) */
-const LANDSCAPE_MEDIA_QUERY = "(min-aspect-ratio: 5/3)";
+const LANDSCAPE_MEDIA_QUERY = "(min-width: 551px)";
 
 const BINDING_USERDATA = "splitview-binding";
 
 
 /**
  * SplitView constructor
  *
  * Initialize the split view UI on an existing DOM element.
@@ -166,17 +166,16 @@ SplitView.prototype = {
     aSummary.classList.add("splitview-active");
     binding._details.classList.add("splitview-active");
 
     this._activeSummary = aSummary;
 
     if (binding.onShow) {
       binding.onShow(aSummary, binding._details, binding.data);
     }
-    aSummary.scrollIntoView();
   },
 
   /**
     * Retrieve the active item's details element or null if there is none.
     * @return DOMElement
     */
   get activeDetails()
   {
--- a/browser/devtools/shared/splitview.css
+++ b/browser/devtools/shared/splitview.css
@@ -75,17 +75,17 @@ box,
   display: -moz-box;
 }
 
 .splitview-landscape-resizer {
   cursor: ew-resize;
 }
 
 /* this is to keep in sync with SplitView.jsm's LANDSCAPE_MEDIA_QUERY */
-@media (min-aspect-ratio: 5/3) {
+@media (min-width: 551px) {
   .splitview-root {
     -moz-box-orient: horizontal;
   }
   .splitview-controller {
     max-height: none;
   }
   .splitview-details {
     display: none;
@@ -111,17 +111,17 @@ ol.splitview-nav > li.splitview-filtered
   display: -moz-box;
 }
 
 .splitview-portrait-resizer {
   display: none;
 }
 
 /* portrait mode */
-@media (max-aspect-ratio: 5/3) {
+@media (max-width: 550px) {
   #splitview-details-toolbar {
     display: none;
   }
 
   .splitview-portrait-resizer {
     display: -moz-box;
   }
 
--- a/browser/devtools/styleeditor/StyleEditor.jsm
+++ b/browser/devtools/styleeditor/StyleEditor.jsm
@@ -353,17 +353,16 @@ StyleEditor.prototype = {
    * Load style sheet source into the editor, asynchronously.
    * "Load" handler triggers when complete.
    *
    * @see addActionListener
    */
   load: function SE_load()
   {
     if (!this._styleSheet) {
-      this._flags.push(StyleEditorFlags.NEW);
       this._appendNewStyleSheet();
     }
     this._loadSource();
   },
 
   /**
    * Get a user-friendly name for the style sheet.
    *
@@ -863,19 +862,22 @@ StyleEditor.prototype = {
     let style = document.createElement("style");
     style.setAttribute("type", "text/css");
     if (aText) {
       style.appendChild(document.createTextNode(aText));
     }
     parent.appendChild(style);
 
     this._styleSheet = document.styleSheets[document.styleSheets.length - 1];
-    this._flags.push(aText ? StyleEditorFlags.IMPORTED : StyleEditorFlags.NEW);
     if (aText) {
       this._onSourceLoad(aText);
+      this._flags.push(StyleEditorFlags.IMPORTED);
+    } else {
+      this._flags.push(StyleEditorFlags.NEW);
+      this._flags.push(StyleEditorFlags.UNSAVED);
     }
   },
 
   /**
    * Signal an error to the user.
    *
    * @param string aErrorCode
    *        String name for the localized error property in the string bundle.
--- a/browser/devtools/styleeditor/styleeditor.css
+++ b/browser/devtools/styleeditor/styleeditor.css
@@ -59,21 +59,18 @@ li.error > .stylesheet-info > .styleshee
   -moz-box-orient: vertical;
   -moz-box-flex: 1;
 }
 
 .stylesheet-info > h1 {
   -moz-box-flex: 1;
 }
 
-.stylesheet-name {
-  outline: none;
-}
-
 .stylesheet-name > label {
+  display: inline;
   cursor: pointer;
 }
 
 .splitview-nav > li > hgroup.stylesheet-info {
   -moz-box-pack: center;
 }
 
 .stylesheet-enabled {
@@ -90,17 +87,17 @@ li:hover > hgroup > .stylesheet-more > h
   display: -moz-box;
 }
 
 .stylesheet-more > spacer {
   -moz-box-flex: 1;
 }
 
 /* portrait mode */
-@media (max-aspect-ratio: 5/3) {
+@media (max-width: 550px) {
   li.splitview-active > hgroup > .stylesheet-more > .stylesheet-rule-count,
   li:hover > hgroup > .stylesheet-more > .stylesheet-rule-count {
     display: none;
   }
 
   .stylesheet-more {
     -moz-box-flex: 1;
     -moz-box-pack: end;
--- a/browser/devtools/styleeditor/test/browser_styleeditor_new.js
+++ b/browser/devtools/styleeditor/test/browser_styleeditor_new.js
@@ -56,18 +56,18 @@ function testEditorAdded(aChrome, aEdito
 
   let listener = {
     onAttach: function (aEditor) {
       waitForFocus(function () {
         ok(aEditor.isLoaded,
            "new editor is loaded when attached");
         ok(aEditor.hasFlag("new"),
            "new editor has NEW flag");
-        ok(!aEditor.hasFlag("unsaved"),
-           "new editor does not have UNSAVED flag");
+        ok(aEditor.hasFlag("unsaved"),
+           "new editor has UNSAVED flag");
 
         ok(aEditor.inputElement,
            "new editor has an input element attached");
 
         ok(aEditor.sourceEditor.hasFocus(),
            "new editor has focus");
 
         let summary = aChrome.getSummaryElementForEditor(aEditor);
--- a/browser/installer/package-manifest.in
+++ b/browser/installer/package-manifest.in
@@ -36,40 +36,43 @@
 @BINPATH@/dictionaries/*
 @BINPATH@/hyphenation/*
 #ifdef XP_WIN32
 @BINPATH@/uninstall/helper.exe
 #endif
 
 [xpcom]
 @BINPATH@/dependentlibs.list
-#ifndef MOZ_STATIC_JS
-@BINPATH@/@DLL_PREFIX@mozjs@DLL_SUFFIX@
+#ifdef XP_WIN32
+@BINPATH@/@DLL_PREFIX@gkmedias@DLL_SUFFIX@
 #endif
-@BINPATH@/@DLL_PREFIX@plc4@DLL_SUFFIX@
-@BINPATH@/@DLL_PREFIX@plds4@DLL_SUFFIX@
-@BINPATH@/@DLL_PREFIX@xpcom@DLL_SUFFIX@
-@BINPATH@/@DLL_PREFIX@nspr4@DLL_SUFFIX@
 @BINPATH@/@DLL_PREFIX@mozalloc@DLL_SUFFIX@
 #ifdef MOZ_SHARED_MOZGLUE
 @BINPATH@/@DLL_PREFIX@mozglue@DLL_SUFFIX@
 #endif
+#ifndef MOZ_STATIC_JS
+@BINPATH@/@DLL_PREFIX@mozjs@DLL_SUFFIX@
+#endif
+@BINPATH@/@DLL_PREFIX@nspr4@DLL_SUFFIX@
+@BINPATH@/@DLL_PREFIX@plc4@DLL_SUFFIX@
+@BINPATH@/@DLL_PREFIX@plds4@DLL_SUFFIX@
+@BINPATH@/@DLL_PREFIX@xpcom@DLL_SUFFIX@
 #ifdef XP_MACOSX
 @BINPATH@/XUL
 #else
 @BINPATH@/@DLL_PREFIX@xul@DLL_SUFFIX@
 #endif
 #ifdef XP_MACOSX
 @BINPATH@/@MOZ_CHILD_PROCESS_NAME@.app/
 @BINPATH@/@DLL_PREFIX@plugin_child_interpose@DLL_SUFFIX@
 #else
 @BINPATH@/@MOZ_CHILD_PROCESS_NAME@
 #endif
 #ifdef XP_WIN32
-@BINPATH@/@DLL_PREFIX@gkmedias@DLL_SUFFIX@
+#ifndef MOZ_DEBUG
 #if _MSC_VER == 1400
 @BINPATH@/Microsoft.VC80.CRT.manifest
 @BINPATH@/msvcm80.dll
 @BINPATH@/msvcp80.dll
 @BINPATH@/msvcr80.dll
 #elif _MSC_VER == 1500
 @BINPATH@/Microsoft.VC90.CRT.manifest
 @BINPATH@/msvcm90.dll
@@ -77,17 +80,17 @@
 @BINPATH@/msvcr90.dll
 #elif _MSC_VER == 1600
 @BINPATH@/msvcp100.dll
 @BINPATH@/msvcr100.dll
 #elif _MSC_VER == 1700
 @BINPATH@/msvcp110.dll
 @BINPATH@/msvcr110.dll
 #endif
-
+#endif
 #endif
 
 [browser]
 ; [Base Browser Files]
 #ifndef XP_UNIX
 @BINPATH@/@MOZ_APP_NAME@.exe
 #else
 @BINPATH@/@MOZ_APP_NAME@-bin
--- a/browser/themes/gnomestripe/devtools/splitview.css
+++ b/browser/themes/gnomestripe/devtools/splitview.css
@@ -155,21 +155,8 @@
   background-size: 10px 2px, 100% 12px;
   background-clip: content-box, border-box;
   background-repeat: repeat-y, no-repeat;
   background-position: center center;
   padding: 2px 0;
   border-top: 1px solid hsla(210,8%,5%,.5);
   border-bottom: 1px solid hsla(210,8%,5%,.5);
 }
-
-/* limited width mode (hide search unless it has focus [search-on-type]) */
-@media (max-width: 250px) {
-  .splitview-filter {
-    max-width: none;
-    position: fixed;
-    margin: 0;
-    bottom: -4em;
-  }
-  .splitview-filter[focused="true"] {
-    bottom: 0;
-  }
-}
--- a/browser/themes/gnomestripe/devtools/styleeditor.css
+++ b/browser/themes/gnomestripe/devtools/styleeditor.css
@@ -130,17 +130,17 @@ h2,
 h3 {
   font-size: inherit;
   font-weight: normal;
   margin: 0;
   padding: 0;
 }
 
 /* portrait mode */
-@media (max-aspect-ratio: 5/3) {
+@media (max-width: 550px) {
   .splitview-nav {
     box-shadow: none;
   }
 
   .splitview-nav > li.splitview-active {
     background-size: 0 0, 0 0, auto;
   }
 
--- a/browser/themes/pinstripe/devtools/splitview.css
+++ b/browser/themes/pinstripe/devtools/splitview.css
@@ -155,21 +155,8 @@
   background-size: 10px 2px, 100% 12px;
   background-clip: content-box, border-box;
   background-repeat: repeat-y, no-repeat;
   background-position: center center;
   padding: 2px 0;
   border-top: 1px solid hsla(210,8%,5%,.5);
   border-bottom: 1px solid hsla(210,8%,5%,.5);
 }
-
-/* limited width mode (hide search unless it has focus [search-on-type]) */
-@media (max-width: 250px) {
-  .splitview-filter {
-    max-width: none;
-    position: fixed;
-    margin: 0;
-    bottom: -4em;
-  }
-  .splitview-filter[focused="true"] {
-    bottom: 0;
-  }
-}
--- a/browser/themes/pinstripe/devtools/styleeditor.css
+++ b/browser/themes/pinstripe/devtools/styleeditor.css
@@ -130,17 +130,17 @@ h2,
 h3 {
   font-size: inherit;
   font-weight: normal;
   margin: 0;
   padding: 0;
 }
 
 /* portrait mode */
-@media (max-aspect-ratio: 5/3) {
+@media (max-width: 550px) {
   .splitview-nav {
     box-shadow: none;
   }
 
   .splitview-nav > li.splitview-active {
     background-size: 0 0, 0 0, auto;
   }
 
--- a/browser/themes/winstripe/devtools/splitview.css
+++ b/browser/themes/winstripe/devtools/splitview.css
@@ -155,21 +155,8 @@
   background-size: 10px 2px, 100% 12px;
   background-clip: content-box, border-box;
   background-repeat: repeat-y, no-repeat;
   background-position: center center;
   padding: 2px 0;
   border-top: 1px solid hsla(210,8%,5%,.5);
   border-bottom: 1px solid hsla(210,8%,5%,.5);
 }
-
-/* limited width mode (hide search unless it has focus [search-on-type]) */
-@media (max-width: 250px) {
-  .splitview-filter {
-    max-width: none;
-    position: fixed;
-    margin: 0;
-    bottom: -4em;
-  }
-  .splitview-filter[focused="true"] {
-    bottom: 0;
-  }
-}
--- a/browser/themes/winstripe/devtools/styleeditor.css
+++ b/browser/themes/winstripe/devtools/styleeditor.css
@@ -130,17 +130,17 @@ h2,
 h3 {
   font-size: inherit;
   font-weight: normal;
   margin: 0;
   padding: 0;
 }
 
 /* portrait mode */
-@media (max-aspect-ratio: 5/3) {
+@media (max-width: 550px) {
   .splitview-nav {
     box-shadow: none;
   }
 
   .splitview-nav > li.splitview-active {
     background-size: 0 0, 0 0, auto;
   }
 
--- a/build/mobile/devicemanager.py
+++ b/build/mobile/devicemanager.py
@@ -61,20 +61,20 @@ class DMError(Exception):
   def __str__(self):
     return self.msg
 
 
 def abstractmethod(method):
   line = method.func_code.co_firstlineno
   filename = method.func_code.co_filename
   def not_implemented(*args, **kwargs):
-    raise NotImplementedError('Abstract method %s at File "%s", line %s \
-                              should be implemented by a concrete class' %
+    raise NotImplementedError('Abstract method %s at File "%s", line %s '
+                              'should be implemented by a concrete class' %
                               (repr(method), filename,line))
-    return not_implemented
+  return not_implemented
   
 class DeviceManager:
   
   @abstractmethod
   def pushFile(self, localname, destname):
     """
     external function
     returns:
@@ -231,24 +231,24 @@ class DeviceManager:
     #ex: '"name=value;name2=value2;etc=..." process args' -> 'process args'
     parts = appname.split('"')
     if (len(parts) > 2):
       appname = ' '.join(parts[2:]).strip()
   
     pieces = appname.split(' ')
     parts = pieces[0].split('/')
     app = parts[-1]
-    procre = re.compile('.*' + app + '.*')
 
     procList = self.getProcessList()
     if (procList == []):
       return None
       
     for proc in procList:
-      if (procre.match(proc[1])):
+      procName = proc[1].split('/')[-1]
+      if (procName == app):
         pid = proc[0]
         break
     return pid
 
 
   @abstractmethod
   def killProcess(self, appname):
     """
@@ -352,68 +352,49 @@ class DeviceManager:
       if not data:
         break
       mdsum.update(data)
 
     file.close()
     hexval = mdsum.hexdigest()
     if (self.debug >= 3): print "local hash returned: '" + hexval + "'"
     return hexval
-  
+
   @abstractmethod
   def getDeviceRoot(self):
     """
     Gets the device root for the testing area on the device
     For all devices we will use / type slashes and depend on the device-agent
     to sort those out.  The agent will return us the device location where we
     should store things, we will then create our /tests structure relative to
     that returned path.
     Structure on the device is as follows:
     /tests
           /<fennec>|<firefox>  --> approot
           /profile
           /xpcshell
           /reftest
           /mochitest
-    external 
+    external
     returns:
     success: path for device root
     failure: None
     """
-  
+
+  @abstractmethod
   def getAppRoot(self):
     """
     Either we will have /tests/fennec or /tests/firefox but we will never have
     both.  Return the one that exists
     TODO: ensure we can support org.mozilla.firefox
     external function
     returns:
     success: path for app root
     failure: None
     """
-    
-    devroot = self.getDeviceRoot()
-    if (devroot == None):
-      return None
-
-    if (self.dirExists(devroot + '/fennec')):
-      return devroot + '/fennec'
-    elif (self.dirExists(devroot + '/firefox')):
-      return devroot + '/firefox'
-    elif (self.dirExsts('/data/data/org.mozilla.fennec')):
-      return 'org.mozilla.fennec'
-    elif (self.dirExists('/data/data/org.mozilla.firefox')):
-      return 'org.mozilla.firefox'
-    elif (self.dirExists('/data/data/org.mozilla.fennec_aurora')):
-      return 'org.mozilla.fennec_aurora'
-    elif (self.dirExists('/data/data/org.mozilla.firefox_beta')):
-      return 'org.mozilla.firefox_beta'
-
-    # Failure (either not installed or not a recognized platform)
-    return None
 
   def getTestRoot(self, type):
     """
     Gets the directory location on the device for a specific test type
     Type is one of: xpcshell|reftest|mochitest
     external function
     returns:
     success: path for test root
@@ -509,17 +490,17 @@ class DeviceManager:
   @abstractmethod
   def installApp(self, appBundlePath, destPath=None):
     """
     external function
     returns:
     success: output from agent for inst command
     failure: None
     """
-    
+
   @abstractmethod
   def uninstallAppAndReboot(self, appName, installPath=None):
     """
     external function
     returns:
     success: True
     failure: None
     """
@@ -537,17 +518,17 @@ class DeviceManager:
   @abstractmethod
   def getCurrentTime(self):
     """
     external function
     returns:
     success: time in ms
     failure: None
     """
-
+    
 class NetworkTools:
   def __init__(self):
     pass
 
   # Utilities to get the local ip address
   def getInterfaceIp(self, ifname):
     if os.name != "nt":
       import fcntl
@@ -557,17 +538,20 @@ class NetworkTools:
                               s.fileno(),
                               0x8915,  # SIOCGIFADDR
                               struct.pack('256s', ifname[:15])
                               )[20:24])
     else:
       return None
 
   def getLanIp(self):
-    ip = socket.gethostbyname(socket.gethostname())
+    try:
+      ip = socket.gethostbyname(socket.gethostname())
+    except socket.gaierror:
+      ip = socket.gethostbyname(socket.gethostname() + ".local") # for Mac OS X
     if ip.startswith("127.") and os.name != "nt":
       interfaces = ["eth0","eth1","eth2","wlan0","wlan1","wifi0","ath0","ath1","ppp0"]
       for ifname in interfaces:
         try:
           ip = self.getInterfaceIp(ifname)
           break;
         except IOError:
           pass
--- a/build/unix/build-toolchain/build-gcc.py
+++ b/build/unix/build-toolchain/build-gcc.py
@@ -40,19 +40,43 @@ def build_package(package_source_dir, pa
     run_in(package_build_dir, ["make", "-j8"])
     run_in(package_build_dir, ["make", "install"])
 
 def build_tar(base_dir, tar_inst_dir):
     tar_build_dir = base_dir + '/tar_build'
     build_package(tar_source_dir, tar_build_dir,
                   ["--prefix=%s" % tar_inst_dir])
 
-def build_one_stage(env, stage_dir):
+def with_env(env, f):
     old_env = os.environ.copy()
     os.environ.update(env)
+    f()
+    os.environ.clear()
+    os.environ.update(old_env)
+
+def build_glibc(env, stage_dir, inst_dir):
+    def f():
+        build_glibc_aux(stage_dir, inst_dir)
+    with_env(env, f)
+
+def build_glibc_aux(stage_dir, inst_dir):
+    glibc_build_dir = stage_dir + '/glibc'
+    build_package(glibc_source_dir, glibc_build_dir,
+                  ["--disable-profile",
+                   "--enable-add-ons=nptl",
+                   "--without-selinux",
+                   "--enable-kernel=2.6.18",
+                   "--prefix=%s" % inst_dir])
+
+def build_one_stage(env, stage_dir, is_stage_one):
+    def f():
+        build_one_stage_aux(stage_dir, is_stage_one)
+    with_env(env, f)
+
+def build_one_stage_aux(stage_dir, is_stage_one):
     os.mkdir(stage_dir)
 
     lib_inst_dir = stage_dir + '/libinst'
 
     gmp_build_dir = stage_dir + '/gmp'
     build_package(gmp_source_dir, gmp_build_dir,
                   ["--prefix=%s" % lib_inst_dir, "--disable-shared"])
     mpfr_build_dir = stage_dir + '/mpfr'
@@ -66,35 +90,32 @@ def build_one_stage(env, stage_dir):
                    "--with-mpfr=%s" % lib_inst_dir])
 
     tool_inst_dir = stage_dir + '/inst'
 
     binutils_build_dir = stage_dir + '/binutils'
     build_package(binutils_source_dir, binutils_build_dir,
                   ["--prefix=%s" % tool_inst_dir])
 
-    glibc_build_dir = stage_dir + '/glibc'
-    build_package(glibc_source_dir, glibc_build_dir,
-                  ["--disable-profile",
-                   "--enable-add-ons=nptl",
-                   "--without-selinux",
-                   "--enable-kernel=2.6.25",
-                   "--prefix=%s" % tool_inst_dir])
+    gcc_build_dir = stage_dir + '/gcc'
+    gcc_configure_args = ["--prefix=%s" % tool_inst_dir,
+                          "--enable-__cxa_atexit",
+                          "--with-gmp=%s" % lib_inst_dir,
+                          "--with-mpfr=%s" % lib_inst_dir,
+                          "--with-mpc=%s" % lib_inst_dir,
+                          "--disable-bootstrap"]
+    if is_stage_one:
+        gcc_configure_args.append("--enable-languages=c")
+    else:
+        gcc_configure_args.append("--enable-languages=c,c++")
 
-    gcc_build_dir = stage_dir + '/gcc'
-    build_package(gcc_source_dir, gcc_build_dir,
-                  ["--prefix=%s" % tool_inst_dir,
-                   "--enable-__cxa_atexit",
-                   "--with-gmp=%s" % lib_inst_dir,
-                   "--with-mpfr=%s" % lib_inst_dir,
-                   "--with-mpc=%s" % lib_inst_dir,
-                   "--enable-languages=c,c++",
-                   "--disable-bootstrap"])
-    os.environ.clear()
-    os.environ.update(old_env)
+    build_package(gcc_source_dir, gcc_build_dir, gcc_configure_args)
+    build_glibc({"CC"  : tool_inst_dir + "/bin/gcc",
+                 "CXX" : tool_inst_dir + "/bin/g++"},
+                stage_dir, tool_inst_dir)
 
 def build_tar_package(tar, name, base, directory):
     name = os.path.realpath(name)
     run_in(base, [tar, "-cf", name, "--mtime=2012-01-01", "--owner=root",
                   directory])
 
 ##############################################
 
@@ -166,20 +187,20 @@ if not os.path.exists(source_dir):
 if os.path.exists(build_dir):
     shutil.rmtree(build_dir)
 os.makedirs(build_dir)
 
 tar_inst_dir = build_dir + '/tar_inst'
 build_tar(build_dir, tar_inst_dir)
 
 stage1_dir = build_dir + '/stage1'
-build_one_stage({"CC": "gcc", "CXX" : "g++"}, stage1_dir)
+build_one_stage({"CC": "gcc", "CXX" : "g++"}, stage1_dir, True)
 
 stage1_tool_inst_dir = stage1_dir + '/inst'
 stage2_dir = build_dir + '/stage2'
 build_one_stage({"CC"     : stage1_tool_inst_dir + "/bin/gcc",
                  "CXX"    : stage1_tool_inst_dir + "/bin/g++",
                  "AR"     : stage1_tool_inst_dir + "/bin/ar",
                  "RANLIB" : "true" },
-                stage2_dir)
+                stage2_dir, False)
 
 build_tar_package(tar_inst_dir + "/bin/tar",
                   "toolchain.tar", stage2_dir, "inst")
--- a/configure.in
+++ b/configure.in
@@ -664,39 +664,30 @@ dnl Special win32 checks
 dnl ========================================================
 WINVER=502
 dnl Target the Windows 7 SDK by default
 WINSDK_TARGETVER=601
 
 MOZ_ARG_WITH_STRING(windows-version,
 [  --with-windows-version=WINSDK_TARGETVER
                           Highest Windows version to target using this SDK
-                              502: Windows Server 2003
-                              600: Windows Vista
                               601: Windows 7],
   WINSDK_TARGETVER=$withval)
 
 case "$WINSDK_TARGETVER" in
-502|600|601)
+601)
     MOZ_WINSDK_TARGETVER=0${WINSDK_TARGETVER}0000
     ;;
 
 *)
-    AC_MSG_ERROR([Invalid value for --with-windows-version ($WINSDK_TARGETVER), must be 502, 600 or 601]);
+    AC_MSG_ERROR([Invalid value for --with-windows-version ($WINSDK_TARGETVER), must be 601]);
     ;;
 
 esac
 
-if test -n "$COMPILE_ENVIRONMENT"; then
-if test "$MOZ_WINSDK_TARGETVER" -lt "06000000"; then
-    # We can't build parental controls either
-    MOZ_DISABLE_PARENTAL_CONTROLS=1
-fi
-fi
-
 case "$target" in
 *-mingw*)
     if test "$GCC" != "yes"; then
         # Check to see if we are really running in a msvc environemnt
         _WIN32_MSVC=1
         AC_CHECK_PROGS(MIDL, midl)
 
         # Make sure compilers are valid
@@ -847,25 +838,18 @@ case "$target" in
 
 WINSDK_MAXVER
 EOF
                             ac_cv_winsdk_maxver=`$CPP conftest.h 2>/dev/null | tail -n1`
                             rm -f conftest.h
                            ])
             MOZ_WINSDK_MAXVER=${ac_cv_winsdk_maxver}
         else
-            # The Vista SDK is the only one to have sdkddkver.h but not
-            # WinSDKVer.h
-            MOZ_CHECK_HEADERS([sdkddkver.h])
-            if test "$ac_cv_header_sdkddkver_h" = "yes"; then
-                MOZ_WINSDK_MAXVER=0x06000000
-            else
-                # Assume the Server 2003 Platform SDK
-                MOZ_WINSDK_MAXVER=0x05020000
-            fi
+            # Any SDK which doesn't have WinSDKVer.h is too old.
+            AC_MSG_ERROR([Your SDK does not have WinSDKVer.h. It is probably too old. Please upgrade to a newer SDK or try running the Windows SDK Configuration Tool and selecting a newer SDK. See https://developer.mozilla.org/En/Windows_SDK_versions for more details on fixing this.])
         fi
 
         unset _MSVC_VER_FILTER
 
         AC_CACHE_CHECK(for std::_Throw, ac_cv_have_std__Throw,
             [
                 AC_LANG_SAVE
                 AC_LANG_CPLUSPLUS
@@ -1834,19 +1818,16 @@ fi
 if test -n "$CLANG_CXX"; then
     _WARNINGS_CXXFLAGS="-Qunused-arguments ${_WARNINGS_CXXFLAGS}"
 fi
 
 dnl ========================================================
 dnl GNU specific defaults
 dnl ========================================================
 if test "$GNU_CC"; then
-    # Per bug 719659 comment 2, some of the headers on ancient build machines
-    # require gnu89 inline semantics.  But otherwise, we use C99.
-    CFLAGS="$CFLAGS -std=gnu99 -fgnu89-inline"
     # FIXME: Let us build with strict aliasing. bug 414641.
     CFLAGS="$CFLAGS -fno-strict-aliasing"
     MKSHLIB='$(CXX) $(CXXFLAGS) $(DSO_PIC_CFLAGS) $(DSO_LDOPTS) -Wl,-h,$@ -o $@'
     MKCSHLIB='$(CC) $(CFLAGS) $(DSO_PIC_CFLAGS) $(DSO_LDOPTS) -Wl,-h,$@ -o $@'
     DSO_LDOPTS='-shared'
     if test "$GCC_USE_GNU_LD"; then
         # Don't allow undefined symbols in libraries
         DSO_LDOPTS="$DSO_LDOPTS -Wl,-z,defs"
@@ -4644,39 +4625,32 @@ MOZ_DISABLE_DOMCRYPTO=
 NSS_DISABLE_DBM=
 NECKO_WIFI=1
 NECKO_COOKIES=1
 NECKO_PROTOCOLS_DEFAULT="about data file ftp http res viewsource websocket wyciwyg device"
 USE_ARM_KUSER=
 BUILD_CTYPES=1
 MOZ_USE_NATIVE_POPUP_WINDOWS=
 MOZ_ANDROID_HISTORY=
-MOZ_WEBSMS_BACKEND=1
+MOZ_WEBSMS_BACKEND=
 MOZ_GRAPHITE=1
 
 case "${target}" in
 *darwin*)
     ACCESSIBILITY=
     ;;
 *)
     ACCESSIBILITY=1
     ;;
 esac
 
 case "$target_os" in
     mingw*)
         NS_ENABLE_TSF=1
-        if test -z "$GNU_CC"; then
-            if test "$MOZ_WINSDK_TARGETVER" -lt "06000000"; then
-                NS_ENABLE_TSF=
-            fi
-        fi
-        if test -n "$NS_ENABLE_TSF"; then
-            AC_DEFINE(NS_ENABLE_TSF)
-        fi
+        AC_DEFINE(NS_ENABLE_TSF)
         ;;
 esac
 
 case "${target}" in
     *-android*|*-linuxandroid*)
         if test "$CPU_ARCH" = "arm" ; then
           USE_ARM_KUSER=1
         fi
@@ -7341,29 +7315,26 @@ MOZ_ARG_DISABLE_BOOL(gcincremental,
 if test -n "$JSGC_INCREMENTAL"; then
     AC_DEFINE(JSGC_INCREMENTAL)
 fi
 
 dnl ========================================================
 dnl ETW - Event Tracing for Windows
 dnl ========================================================
 MOZ_ARG_ENABLE_BOOL(ETW,
-[  --enable-ETW            Enable ETW (Event Tracing for Windows) event reporting
-                          (needs Windows Vista+ SDK)],
+[  --enable-ETW            Enable ETW (Event Tracing for Windows) event reporting],
     MOZ_ETW=1,
     MOZ_ETW= )
 if test -n "$MOZ_ETW"; then
     AC_DEFINE(MOZ_ETW)
 fi
 
 if test -n "$MOZ_ETW"; then
     if test -z "$MOZ_WINSDK_TARGETVER"; then
         AC_MSG_ERROR([--enable-ETW is only valid on Windows])
-    elif test "$MOZ_WINSDK_TARGETVER" -lt "06000000"; then
-        AC_MSG_ERROR([--enable-ETW requires the Windows Vista SDK or newer])
     fi
 fi
 
 dnl ========================================================
 dnl Zealous JavaScript GC
 dnl ========================================================
 MOZ_ARG_ENABLE_BOOL(gczeal,
 [  --enable-gczeal         Enable zealous JavaScript GCing],
--- a/content/base/public/nsIXMLHttpRequest.idl
+++ b/content/base/public/nsIXMLHttpRequest.idl
@@ -48,28 +48,29 @@ interface nsPIDOMWindow;
 interface nsIInputStream;
 interface nsIDOMBlob;
 
 %{C++
 // for jsval
 #include "jsapi.h"
 %}
 
-[scriptable, builtinclass, uuid(e2b59e48-3655-4429-a94c-b4332c346ba2)]
+[scriptable, builtinclass, uuid(5e346bf8-7083-4ef8-b9b9-736a1b5aa7ab)]
 interface nsIXMLHttpRequestEventTarget : nsIDOMEventTarget {
   // event handler attributes
   attribute nsIDOMEventListener onabort;
   attribute nsIDOMEventListener onerror;
   attribute nsIDOMEventListener onload;
   attribute nsIDOMEventListener onloadstart;
   attribute nsIDOMEventListener onprogress;
+  attribute nsIDOMEventListener ontimeout;
   attribute nsIDOMEventListener onloadend;
 };
 
-[scriptable, builtinclass, uuid(db9357fc-edf7-42b2-aab2-c24ab19ece20)]
+[scriptable, builtinclass, uuid(8dbd2448-740a-412c-b314-434f24a1c510)]
 interface nsIXMLHttpRequestUpload : nsIXMLHttpRequestEventTarget {
   // for future use
 };
 
 /**
  * Mozilla's XMLHttpRequest is modelled after Microsoft's IXMLHttpRequest
  * object. The goal has been to make Mozilla's version match Microsoft's
  * version as closely as possible, but there are bound to be some differences.
@@ -105,17 +106,17 @@ interface nsIXMLHttpRequestUpload : nsIX
  *   The 'onload', 'onerror', and 'onreadystatechange' attributes moved to
  *   nsIJSXMLHttpRequest, but if you're coding in C++ you should avoid using
  *   those.
  *
  * Conclusion: Do not use event listeners on XMLHttpRequest from C++, unless
  * you're aware of all the security implications.  And then think twice about
  * it.
  */
-[scriptable, uuid(5cf8d518-51d0-4cd6-a69a-c3674c2de599)]
+[scriptable, uuid(88ffc45a-22e2-44f4-9a6e-f4586fbde376)]
 interface nsIXMLHttpRequest : nsISupports
 {
   /**
    * The request uses a channel in order to perform the
    * request.  This attribute represents the channel used
    * for the request.  NULL if the channel has not yet been
    * created.
    *
@@ -274,16 +275,22 @@ interface nsIXMLHttpRequest : nsISupport
    * before setting the request headers.
    *
    * @param header The name of the header to set in the request.
    * @param value The body of the header.
    */
   void   setRequestHeader(in AUTF8String header, in AUTF8String value);
 
   /**
+   * The amount of milliseconds a request can take before being terminated.
+   * Initially zero. Zero means there is no timeout.
+   */
+  attribute unsigned long timeout;
+
+  /**
    * The state of the request.
    *
    * Possible values:
    *   0 UNSENT   open() has not been called yet.
    *   1 OPENED   send() has not been called yet.
    *   2 HEADERS_RECEIVED
    *              send() has been called, headers and status are available.
    *   3 LOADING  Downloading, responseText holds the partial data.
--- a/content/base/src/nsXMLHttpRequest.cpp
+++ b/content/base/src/nsXMLHttpRequest.cpp
@@ -107,16 +107,17 @@
 #include "sampler.h"
 #include "nsWrapperCacheInlines.h"
 
 using namespace mozilla;
 
 #define LOAD_STR "load"
 #define ERROR_STR "error"
 #define ABORT_STR "abort"
+#define TIMEOUT_STR "timeout"
 #define LOADSTART_STR "loadstart"
 #define PROGRESS_STR "progress"
 #define UPLOADPROGRESS_STR "uploadprogress"
 #define READYSTATE_STR "readystatechange"
 #define LOADEND_STR "loadend"
 
 // CIDs
 
@@ -138,16 +139,17 @@ using namespace mozilla;
 #define XML_HTTP_REQUEST_GOT_FINAL_STOP (1 << 12) // Internal
 #define XML_HTTP_REQUEST_BACKGROUND     (1 << 13) // Internal
 // This is set when we've got the headers for a multipart XMLHttpRequest,
 // but haven't yet started to process the first part.
 #define XML_HTTP_REQUEST_MPART_HEADERS  (1 << 14) // Internal
 #define XML_HTTP_REQUEST_USE_XSITE_AC   (1 << 15) // Internal
 #define XML_HTTP_REQUEST_NEED_AC_PREFLIGHT (1 << 16) // Internal
 #define XML_HTTP_REQUEST_AC_WITH_CREDENTIALS (1 << 17) // Internal
+#define XML_HTTP_REQUEST_TIMED_OUT (1 << 18) // Internal
 
 #define XML_HTTP_REQUEST_LOADSTATES         \
   (XML_HTTP_REQUEST_UNSENT |                \
    XML_HTTP_REQUEST_OPENED |                \
    XML_HTTP_REQUEST_HEADERS_RECEIVED |      \
    XML_HTTP_REQUEST_LOADING |               \
    XML_HTTP_REQUEST_DONE |                  \
    XML_HTTP_REQUEST_SENT |                  \
@@ -300,26 +302,28 @@ NS_IMPL_CYCLE_COLLECTION_CLASS(nsXHREven
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsXHREventTarget,
                                                   nsDOMEventTargetWrapperCache)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mOnLoadListener)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mOnErrorListener)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mOnAbortListener)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mOnLoadStartListener)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mOnProgressListener)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mOnLoadendListener)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mOnTimeoutListener)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsXHREventTarget,
                                                 nsDOMEventTargetWrapperCache)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mOnLoadListener)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mOnErrorListener)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mOnAbortListener)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mOnLoadStartListener)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mOnProgressListener)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mOnLoadendListener)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mOnTimeoutListener)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(nsXHREventTarget)
   NS_INTERFACE_MAP_ENTRY(nsIXMLHttpRequestEventTarget)
 NS_INTERFACE_MAP_END_INHERITING(nsDOMEventTargetWrapperCache)
 
 NS_IMPL_ADDREF_INHERITED(nsXHREventTarget, nsDOMEventTargetWrapperCache)
 NS_IMPL_RELEASE_INHERITED(nsXHREventTarget, nsDOMEventTargetWrapperCache)
@@ -384,16 +388,29 @@ nsXHREventTarget::GetOnprogress(nsIDOMEv
 
 NS_IMETHODIMP
 nsXHREventTarget::SetOnprogress(nsIDOMEventListener* aOnprogress)
 {
   return RemoveAddEventListener(NS_LITERAL_STRING(PROGRESS_STR),
                                 mOnProgressListener, aOnprogress);
 }
 
+/* attribute nsIDOMEventListener ontimeout; */
+NS_IMETHODIMP
+nsXHREventTarget::GetOntimeout(nsIDOMEventListener * *aOntimeout)
+{
+  return GetInnerEventListener(mOnTimeoutListener, aOntimeout);
+}
+NS_IMETHODIMP
+nsXHREventTarget::SetOntimeout(nsIDOMEventListener *aOntimeout)
+{
+  return RemoveAddEventListener(NS_LITERAL_STRING(TIMEOUT_STR),
+                                mOnTimeoutListener, aOntimeout);
+}
+
 NS_IMETHODIMP
 nsXHREventTarget::GetOnloadend(nsIDOMEventListener** aOnLoadend)
 {
   return GetInnerEventListener(mOnLoadendListener, aOnLoadend);
 }
 
 NS_IMETHODIMP
 nsXHREventTarget::SetOnloadend(nsIDOMEventListener* aOnLoadend)
@@ -421,23 +438,23 @@ NS_IMPL_RELEASE_INHERITED(nsXMLHttpReque
 
 nsXMLHttpRequest::nsXMLHttpRequest()
   : mResponseBodyDecodedPos(0),
     mResponseType(XML_HTTP_RESPONSE_TYPE_DEFAULT),
     mRequestObserver(nsnull), mState(XML_HTTP_REQUEST_UNSENT),
     mUploadTransferred(0), mUploadTotal(0), mUploadComplete(true),
     mProgressSinceLastProgressEvent(false),
     mUploadProgress(0), mUploadProgressMax(0),
-    mErrorLoad(false), mTimerIsActive(false),
+    mRequestSentTime(0), mTimeoutMilliseconds(0),
+    mErrorLoad(false), mProgressTimerIsActive(false),
     mProgressEventWasDelayed(false),
-    mLoadLengthComputable(false),
     mIsHtml(false),
     mWarnAboutMultipartHtml(false),
     mWarnAboutSyncHtml(false),
-    mLoadTotal(0),
+    mLoadLengthComputable(false), mLoadTotal(0),
     mFirstStartRequestSeen(false),
     mInLoadProgressEvent(false),
     mResultJSON(JSVAL_VOID),
     mResultArrayBuffer(nsnull)
 {
   nsLayoutStatics::AddRef();
 }
 
@@ -1188,59 +1205,67 @@ nsXMLHttpRequest::GetStatusText(nsACStri
     }
 
     httpChannel->GetResponseStatusText(aStatusText);
   }
 
   return NS_OK;
 }
 
-/* void abort (); */
-NS_IMETHODIMP
-nsXMLHttpRequest::Abort()
+void
+nsXMLHttpRequest::CloseRequestWithError(const nsAString& aType,
+                                        const PRUint32 aFlag)
 {
   if (mReadRequest) {
     mReadRequest->Cancel(NS_BINDING_ABORTED);
   }
   if (mChannel) {
     mChannel->Cancel(NS_BINDING_ABORTED);
   }
   if (mCORSPreflightChannel) {
     mCORSPreflightChannel->Cancel(NS_BINDING_ABORTED);
   }
+  if (mTimeoutTimer) {
+    mTimeoutTimer->Cancel();
+  }
   PRUint32 responseLength = mResponseBody.Length();
   ResetResponse();
-  mState |= XML_HTTP_REQUEST_ABORTED;
+  mState |= aFlag;
   
   if (!(mState & (XML_HTTP_REQUEST_UNSENT |
                   XML_HTTP_REQUEST_OPENED |
                   XML_HTTP_REQUEST_DONE))) {
     ChangeState(XML_HTTP_REQUEST_DONE, true);
 
     if (!(mState & XML_HTTP_REQUEST_SYNCLOOPING)) {
-      NS_NAMED_LITERAL_STRING(abortStr, ABORT_STR);
-      DispatchProgressEvent(this, abortStr, mLoadLengthComputable, responseLength,
+      DispatchProgressEvent(this, aType, mLoadLengthComputable, responseLength,
                             mLoadTotal);
       if (mUpload && !mUploadComplete) {
         mUploadComplete = true;
-        DispatchProgressEvent(mUpload, abortStr, true, mUploadTransferred,
+        DispatchProgressEvent(mUpload, aType, true, mUploadTransferred,
                               mUploadTotal);
       }
     }
   }
 
   // The ChangeState call above calls onreadystatechange handlers which
   // if they load a new url will cause nsXMLHttpRequest::Open to clear
   // the abort state bit. If this occurs we're not uninitialized (bug 361773).
   if (mState & XML_HTTP_REQUEST_ABORTED) {
     ChangeState(XML_HTTP_REQUEST_UNSENT, false);  // IE seems to do it
   }
 
   mState &= ~XML_HTTP_REQUEST_SYNCLOOPING;
-
+}
+
+/* void abort (); */
+NS_IMETHODIMP
+nsXMLHttpRequest::Abort()
+{
+  CloseRequestWithError(NS_LITERAL_STRING(ABORT_STR), XML_HTTP_REQUEST_ABORTED);
   return NS_OK;
 }
 
 /* string getAllResponseHeaders (); */
 NS_IMETHODIMP
 nsXMLHttpRequest::GetAllResponseHeaders(char **_retval)
 {
   NS_ENSURE_ARG_POINTER(_retval);
@@ -1408,16 +1433,17 @@ nsXMLHttpRequest::DispatchProgressEvent(
   if (NS_FAILED(CheckInnerWindowCorrectness()) ||
       (!AllowUploadProgress() &&
        (aTarget == mUpload || aType.EqualsLiteral(UPLOADPROGRESS_STR)))) {
     return;
   }
 
   bool dispatchLoadend = aType.EqualsLiteral(LOAD_STR) ||
                            aType.EqualsLiteral(ERROR_STR) ||
+                           aType.EqualsLiteral(TIMEOUT_STR) ||
                            aType.EqualsLiteral(ABORT_STR);
   
   nsCOMPtr<nsIDOMEvent> event;
   nsresult rv = nsEventDispatcher::CreateEvent(nsnull, nsnull,
                                                NS_LITERAL_STRING("ProgressEvent"),
                                                getter_AddRefs(event));
   if (NS_FAILED(rv)) {
     return;
@@ -1539,53 +1565,50 @@ nsXMLHttpRequest::Open(const nsACString&
       method.LowerCaseEqualsLiteral("track")) {
     return NS_ERROR_INVALID_ARG;
   }
 
   // sync request is not allowed using withCredential or responseType
   // in window context
   if (!async && mOwner &&
       (mState & XML_HTTP_REQUEST_AC_WITH_CREDENTIALS ||
+       mTimeoutMilliseconds ||
        mResponseType != XML_HTTP_RESPONSE_TYPE_DEFAULT)) {
     if (mState & XML_HTTP_REQUEST_AC_WITH_CREDENTIALS) {
       LogMessage("WithCredentialsSyncXHRWarning", mOwner);
     }
+    if (mTimeoutMilliseconds) {
+      LogMessage("TimeoutSyncXHRWarning", mOwner);
+    }
     if (mResponseType != XML_HTTP_RESPONSE_TYPE_DEFAULT) {
       LogMessage("ResponseTypeSyncXHRWarning", mOwner);
     }
     return NS_ERROR_DOM_INVALID_ACCESS_ERR;
   }
 
   nsresult rv;
   nsCOMPtr<nsIURI> uri;
-  bool authp = false;
 
   if (mState & (XML_HTTP_REQUEST_OPENED |
                 XML_HTTP_REQUEST_HEADERS_RECEIVED |
                 XML_HTTP_REQUEST_LOADING |
                 XML_HTTP_REQUEST_SENT |
                 XML_HTTP_REQUEST_STOPPED)) {
     // IE aborts as well
     Abort();
 
     // XXX We should probably send a warning to the JS console
     //     that load was aborted and event listeners were cleared
     //     since this looks like a situation that could happen
     //     by accident and you could spend a lot of time wondering
     //     why things didn't work.
   }
 
-  if (mState & XML_HTTP_REQUEST_ABORTED) {
-    // Something caused this request to abort (e.g the current request
-    // was caceled, channels closed etc), most likely the abort()
-    // function was called by script. Unset our aborted state, and
-    // proceed as normal
-
-    mState &= ~XML_HTTP_REQUEST_ABORTED;
-  }
+  // Unset any pre-existing aborted and timed-out states.
+  mState &= ~XML_HTTP_REQUEST_ABORTED & ~XML_HTTP_REQUEST_TIMED_OUT;
 
   if (async) {
     mState |= XML_HTTP_REQUEST_ASYNC;
   } else {
     mState &= ~XML_HTTP_REQUEST_ASYNC;
   }
 
   mState &= ~XML_HTTP_REQUEST_MPART_HEADERS;
@@ -1627,17 +1650,16 @@ nsXMLHttpRequest::Open(const nsACString&
   if (!user.IsEmpty()) {
     nsCAutoString userpass;
     CopyUTF16toUTF8(user, userpass);
     if (!password.IsEmpty()) {
       userpass.Append(':');
       AppendUTF16toUTF8(password, userpass);
     }
     uri->SetUserPass(userpass);
-    authp = true;
   }
 
   // When we are called from JS we can find the load group for the page,
   // and add ourselves to it. This way any pending requests
   // will be automatically aborted if the user leaves the page.
   nsCOMPtr<nsILoadGroup> loadGroup = GetLoadGroup();
 
   // get Content Security Policy from principal to pass into channel
@@ -1856,22 +1878,29 @@ nsXMLHttpRequest::OnStartRequest(nsIRequ
   if (!IsSameOrBaseChannel(request, mChannel)) {
     return NS_OK;
   }
 
   // Don't do anything if we have been aborted
   if (mState & XML_HTTP_REQUEST_UNSENT)
     return NS_OK;
 
+  /* Apparently, Abort() should set XML_HTTP_REQUEST_UNSENT.  See bug 361773.
+     XHR2 spec says this is correct. */
   if (mState & XML_HTTP_REQUEST_ABORTED) {
     NS_ERROR("Ugh, still getting data on an aborted XMLHttpRequest!");
 
     return NS_ERROR_UNEXPECTED;
   }
 
+  // Don't do anything if we have timed out.
+  if (mState & XML_HTTP_REQUEST_TIMED_OUT) {
+    return NS_OK;
+  }
+
   nsCOMPtr<nsIChannel> channel(do_QueryInterface(request));
   NS_ENSURE_TRUE(channel, NS_ERROR_UNEXPECTED);
 
   nsCOMPtr<nsIPrincipal> documentPrincipal;
   if (IsSystemXHR()) {
     // Don't give this document the system principal.  We need to keep track of
     // mPrincipal being system because we use it for various security checks
     // that should be passing, but the document data shouldn't get a system
@@ -1886,18 +1915,18 @@ nsXMLHttpRequest::OnStartRequest(nsIRequ
   channel->SetOwner(documentPrincipal);
 
   nsresult status;
   request->GetStatus(&status);
   mErrorLoad = mErrorLoad || NS_FAILED(status);
 
   if (mUpload && !mUploadComplete && !mErrorLoad &&
       (mState & XML_HTTP_REQUEST_ASYNC)) {
-    if (mTimerIsActive) {
-      mTimerIsActive = false;
+    if (mProgressTimerIsActive) {
+      mProgressTimerIsActive = false;
       mProgressNotifier->Cancel();
     }
     MaybeDispatchProgressEvents(true);
     mUploadComplete = true;
     DispatchProgressEvent(mUpload, NS_LITERAL_STRING(LOAD_STR),
                           true, mUploadTotal, mUploadTotal);
   }
 
@@ -2074,17 +2103,19 @@ nsXMLHttpRequest::OnStopRequest(nsIReque
   if (mRequestObserver && mState & XML_HTTP_REQUEST_GOT_FINAL_STOP) {
     NS_ASSERTION(mFirstStartRequestSeen, "Inconsistent state!");
     mFirstStartRequestSeen = false;
     mRequestObserver->OnStopRequest(request, ctxt, status);
   }
 
   // make sure to notify the listener if we were aborted
   // XXX in fact, why don't we do the cleanup below in this case??
-  if (mState & XML_HTTP_REQUEST_UNSENT) {
+  // XML_HTTP_REQUEST_UNSENT is for abort calls.  See OnStartRequest above.
+  if ((mState & XML_HTTP_REQUEST_UNSENT) ||
+      (mState & XML_HTTP_REQUEST_TIMED_OUT)) {
     if (mXMLParserStreamListener)
       (void) mXMLParserStreamListener->OnStopRequest(request, ctxt, status);
     return NS_OK;
   }
 
   // Is this good enough here?
   if (mState & XML_HTTP_REQUEST_PARSEBODY && mXMLParserStreamListener) {
     mXMLParserStreamListener->OnStopRequest(request, ctxt, status);
@@ -2183,17 +2214,21 @@ nsXMLHttpRequest::OnStopRequest(nsIReque
 void
 nsXMLHttpRequest::ChangeStateToDone()
 {
   if (mIsHtml) {
     // In the HTML case, this has to be deferred, because the parser doesn't
     // do it's job synchronously.
     MaybeDispatchProgressEvents(true);
   }
+
   ChangeState(XML_HTTP_REQUEST_DONE, true);
+  if (mTimeoutTimer) {
+    mTimeoutTimer->Cancel();
+  }
 
   NS_NAMED_LITERAL_STRING(errorStr, ERROR_STR);
   NS_NAMED_LITERAL_STRING(loadStr, LOAD_STR);
   DispatchProgressEvent(this,
                         mErrorLoad ? errorStr : loadStr,
                         !mErrorLoad,
                         mLoadTransferred,
                         mErrorLoad ? 0 : mLoadTransferred);
@@ -2649,16 +2684,20 @@ nsXMLHttpRequest::Send(nsIVariant *aBody
         nsICachingChannel::LOAD_BYPASS_LOCAL_CACHE_IF_BUSY);
   }
 
   // Since we expect XML data, set the type hint accordingly
   // This means that we always try to parse local files as XML
   // ignoring return value, as this is not critical
   mChannel->SetContentType(NS_LITERAL_CSTRING("application/xml"));
 
+  // We're about to send the request.  Start our timeout.
+  mRequestSentTime = PR_Now();
+  StartTimeoutTimer();
+
   // Set up the preflight if needed
   if (mState & XML_HTTP_REQUEST_NEED_AC_PREFLIGHT) {
     // Check to see if this initial OPTIONS request has already been cached
     // in our special Access Control Cache.
 
     rv = NS_StartCORSPreflight(mChannel, listener,
                                mPrincipal, withCredentials,
                                mCORSUnsafeHeaders,
@@ -2840,16 +2879,70 @@ nsXMLHttpRequest::SetRequestHeader(const
       nsCString(header), nsCString(value)
     };
     mModifiedRequestHeaders.AppendElement(reqHeader);
   }
 
   return rv;
 }
 
+/* attribute unsigned long timeout; */
+NS_IMETHODIMP
+nsXMLHttpRequest::GetTimeout(PRUint32 *aTimeout)
+{
+  *aTimeout = mTimeoutMilliseconds;
+  return NS_OK;
+}
+NS_IMETHODIMP
+nsXMLHttpRequest::SetTimeout(PRUint32 aTimeout)
+{
+  if ((mState & (XML_HTTP_REQUEST_ASYNC | XML_HTTP_REQUEST_UNSENT)) || !mOwner) {
+    mTimeoutMilliseconds = aTimeout;
+    if (mRequestSentTime) {
+      StartTimeoutTimer();
+    }
+    return NS_OK;
+  }
+
+  /* Timeout is not supported for synchronous requests with an owning window,
+     per XHR2 spec. */
+  LogMessage("TimeoutSyncXHRWarning", mOwner);
+  return NS_ERROR_DOM_INVALID_ACCESS_ERR;
+}
+
+void
+nsXMLHttpRequest::StartTimeoutTimer()
+{
+  NS_ABORT_IF_FALSE(mRequestSentTime,
+                    "StartTimeoutTimer mustn't be called before the request was sent!");
+  if (mState & XML_HTTP_REQUEST_DONE) {
+    // do nothing!
+    return;
+  }
+
+  if (mTimeoutTimer) {
+    mTimeoutTimer->Cancel();
+  }
+
+  if (!mTimeoutMilliseconds) {
+    return;
+  }
+
+  if (!mTimeoutTimer) {
+    mTimeoutTimer = do_CreateInstance(NS_TIMER_CONTRACTID);
+  }
+  PRUint32 elapsed =
+    (PRUint32)((PR_Now() - mRequestSentTime) / PR_USEC_PER_MSEC);
+  mTimeoutTimer->InitWithCallback(
+    this,
+    mTimeoutMilliseconds > elapsed ? mTimeoutMilliseconds - elapsed : 0,
+    nsITimer::TYPE_ONE_SHOT
+  );
+}
+
 /* readonly attribute long readyState; */
 NS_IMETHODIMP
 nsXMLHttpRequest::GetReadyState(PRUint16 *aState)
 {
   NS_ENSURE_ARG_POINTER(aState);
   // Translate some of our internal states for external consumers
   if (mState & XML_HTTP_REQUEST_UNSENT) {
     *aState = UNSENT;
@@ -2982,17 +3075,17 @@ nsXMLHttpRequest::ChangeState(PRUint32 a
   if (aState & XML_HTTP_REQUEST_LOADSTATES) {
     mState &= ~XML_HTTP_REQUEST_LOADSTATES;
   }
   mState |= aState;
   nsresult rv = NS_OK;
 
   if (mProgressNotifier &&
       !(aState & (XML_HTTP_REQUEST_HEADERS_RECEIVED | XML_HTTP_REQUEST_LOADING))) {
-    mTimerIsActive = false;
+    mProgressTimerIsActive = false;
     mProgressNotifier->Cancel();
   }
 
   if ((aState & XML_HTTP_REQUEST_LOADSTATES) && // Broadcast load states only
       aBroadcast &&
       (mState & XML_HTTP_REQUEST_ASYNC ||
        aState & XML_HTTP_REQUEST_OPENED ||
        aState & XML_HTTP_REQUEST_DONE)) {
@@ -3133,22 +3226,22 @@ nsXMLHttpRequest::OnRedirectVerifyCallba
 
 /////////////////////////////////////////////////////
 // nsIProgressEventSink methods:
 //
 
 void
 nsXMLHttpRequest::MaybeDispatchProgressEvents(bool aFinalProgress)
 {
-  if (aFinalProgress && mTimerIsActive) {
-    mTimerIsActive = false;
+  if (aFinalProgress && mProgressTimerIsActive) {
+    mProgressTimerIsActive = false;
     mProgressNotifier->Cancel();
   }
 
-  if (mTimerIsActive ||
+  if (mProgressTimerIsActive ||
       !mProgressSinceLastProgressEvent ||
       mErrorLoad ||
       !(mState & XML_HTTP_REQUEST_ASYNC)) {
     return;
   }
 
   if (!aFinalProgress) {
     StartProgressEventTimer();
@@ -3336,36 +3429,65 @@ nsXMLHttpRequest::GetUpload(nsIXMLHttpRe
   if (!mUpload) {
     mUpload = new nsXMLHttpRequestUpload(mOwner, scriptContext);
     NS_ENSURE_TRUE(mUpload, NS_ERROR_OUT_OF_MEMORY);
   }
   NS_ADDREF(*aUpload = mUpload);
   return NS_OK;
 }
 
+void
+nsXMLHttpRequest::HandleTimeoutCallback()
+{
+  if (mState & XML_HTTP_REQUEST_DONE) {
+    NS_NOTREACHED("nsXMLHttpRequest::HandleTimeoutCallback with completed request");
+    // do nothing!
+    return;
+  }
+
+  CloseRequestWithError(NS_LITERAL_STRING(TIMEOUT_STR),
+                        XML_HTTP_REQUEST_TIMED_OUT);
+}
+
 NS_IMETHODIMP
 nsXMLHttpRequest::Notify(nsITimer* aTimer)
 {
-  mTimerIsActive = false;
+  if (mProgressNotifier == aTimer) {
+    HandleProgressTimerCallback();
+    return NS_OK;
+  }
+
+  if (mTimeoutTimer == aTimer) {
+    HandleTimeoutCallback();
+    return NS_OK;
+  }
+
+  // Just in case some JS user wants to QI to nsITimerCallback and play with us...
+  NS_WARNING("Unexpected timer!");
+  return NS_ERROR_INVALID_POINTER;
+}
+
+void
+nsXMLHttpRequest::HandleProgressTimerCallback()
+{
+  mProgressTimerIsActive = false;
   if (!(XML_HTTP_REQUEST_MPART_HEADERS & mState)) {
     MaybeDispatchProgressEvents(false);
   }
-
-  return NS_OK;
 }
 
 void
 nsXMLHttpRequest::StartProgressEventTimer()
 {
   if (!mProgressNotifier) {
     mProgressNotifier = do_CreateInstance(NS_TIMER_CONTRACTID);
   }
   if (mProgressNotifier) {
     mProgressEventWasDelayed = false;
-    mTimerIsActive = true;
+    mProgressTimerIsActive = true;
     mProgressNotifier->Cancel();
     mProgressNotifier->InitWithCallback(this, NS_PROGRESS_EVENT_INTERVAL,
                                         nsITimer::TYPE_ONE_SHOT);
   }
 }
 
 NS_IMPL_ISUPPORTS1(nsXMLHttpRequest::nsHeaderVisitor, nsIHttpHeaderVisitor)
 
--- a/content/base/src/nsXMLHttpRequest.h
+++ b/content/base/src/nsXMLHttpRequest.h
@@ -83,16 +83,17 @@ public:
 
 protected:
   nsRefPtr<nsDOMEventListenerWrapper> mOnLoadListener;
   nsRefPtr<nsDOMEventListenerWrapper> mOnErrorListener;
   nsRefPtr<nsDOMEventListenerWrapper> mOnAbortListener;
   nsRefPtr<nsDOMEventListenerWrapper> mOnLoadStartListener;
   nsRefPtr<nsDOMEventListenerWrapper> mOnProgressListener;
   nsRefPtr<nsDOMEventListenerWrapper> mOnLoadendListener;
+  nsRefPtr<nsDOMEventListenerWrapper> mOnTimeoutListener;
 };
 
 class nsXMLHttpRequestUpload : public nsXHREventTarget,
                                public nsIXMLHttpRequestUpload
 {
 public:
   nsXMLHttpRequestUpload(nsPIDOMWindow* aOwner,
                          nsIScriptContext* aScriptContext)
@@ -338,27 +339,45 @@ protected:
   PRUint64 mUploadTransferred;
   PRUint64 mUploadTotal;
   bool mUploadLengthComputable;
   bool mUploadComplete;
   bool mProgressSinceLastProgressEvent;
   PRUint64 mUploadProgress; // For legacy
   PRUint64 mUploadProgressMax; // For legacy
 
+  // Timeout support
+  PRTime mRequestSentTime;
+  PRUint32 mTimeoutMilliseconds;
+  nsCOMPtr<nsITimer> mTimeoutTimer;
+  void StartTimeoutTimer();
+  void HandleTimeoutCallback();
+
   bool mErrorLoad;
 
-  bool mTimerIsActive;
+  bool mProgressTimerIsActive;
   bool mProgressEventWasDelayed;
-  bool mLoadLengthComputable;
   bool mIsHtml;
   bool mWarnAboutMultipartHtml;
   bool mWarnAboutSyncHtml;
+  bool mLoadLengthComputable;
   PRUint64 mLoadTotal; // 0 if not known.
   PRUint64 mLoadTransferred;
   nsCOMPtr<nsITimer> mProgressNotifier;
+  void HandleProgressTimerCallback();
+
+  /**
+   * Close the XMLHttpRequest's channels and dispatch appropriate progress
+   * events.
+   *
+   * @param aType The progress event type.
+   * @param aFlag A XML_HTTP_REQUEST_* state flag defined in
+   *              nsXMLHttpRequest.cpp.
+   */
+  void CloseRequestWithError(const nsAString& aType, const PRUint32 aFlag);
 
   bool mFirstStartRequestSeen;
   bool mInLoadProgressEvent;
   
   nsCOMPtr<nsIAsyncVerifyRedirectCallback> mRedirectCallback;
   nsCOMPtr<nsIChannel> mNewRedirectChannel;
   
   jsval mResultJSON;
--- a/content/base/test/Makefile.in
+++ b/content/base/test/Makefile.in
@@ -524,30 +524,33 @@ include $(topsrcdir)/config/rules.mk
 		test_bug684671.html \
 		test_bug685798.html \
 		test_bug686449.xhtml \
 		test_bug690056.html \
 		test_bug692434.html \
 		file_bug692434.xml \
 		test_bug693615.html \
 		test_bug693875.html \
+		test_bug698384.html \
 		test_nodelist_holes.html \
 		test_xhr_abort_after_load.html \
 		test_bug702439.html \
 		test_bug702439.html^headers^ \
 		file_bug702439.html \
 		test_bug707142.html \
 		file_bug707142_baseline.json \
 		file_bug707142_bom.json \
 		file_bug707142_utf-16.json \
 		test_reentrant_flush.html \
 		test_bug708620.html \
 		file_bug708620.html \
 		file_bug708620-2.html \
-		test_bug698384.html \
+		test_XHR_timeout.html \
+		test_XHR_timeout.js \
+		file_XHR_timeout.sjs \
 		$(NULL)
 
 _CHROME_FILES =	\
 		test_bug357450.js \
 		$(NULL)
 
 # This test fails on the Mac for some reason
 ifneq (,$(filter gtk2 windows,$(MOZ_WIDGET_TOOLKIT)))
new file mode 100644
--- /dev/null
+++ b/content/base/test/file_XHR_timeout.sjs
@@ -0,0 +1,15 @@
+var timer = null;
+
+function handleRequest(request, response)
+{
+  response.processAsync();
+  timer = Components.classes["@mozilla.org/timer;1"]
+                    .createInstance(Components.interfaces.nsITimer);
+  timer.initWithCallback(function()
+  {
+    response.setStatusLine(null, 200, "OK");
+    response.setHeader("Content-Type", "text/plain", false);
+    response.write("hello");
+    response.finish();
+  }, 3000 /* milliseconds */, Components.interfaces.nsITimer.TYPE_ONE_SHOT);
+}
new file mode 100644
--- /dev/null
+++ b/content/base/test/test_XHR_timeout.html
@@ -0,0 +1,31 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=525816
+-->
+<head>
+  <title>Test for Bug 525816</title>
+  <script type="application/javascript"
+          src="/MochiKit/MochiKit.js"></script>
+  <script type="application/javascript"
+          src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet"
+        type="text/css"
+        href="/tests/SimpleTest/test.css">
+</head>
+<body>
+
+<a target="_blank"
+   href="https://bugzilla.mozilla.org/show_bug.cgi?id=525816"
+  >Mozilla Bug 525816 (XMLHttpRequest timeout)</a>
+<p id="display"></p>
+<div id="content">
+  This test takes over 1 minute to run, probably over 2 minutes.
+</div>
+<pre id="test">
+<script class="testbody"
+        type="text/javascript"
+        src="test_XHR_timeout.js"></script>
+</pre>
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/content/base/test/test_XHR_timeout.js
@@ -0,0 +1,290 @@
+/* Notes:
+   - All times are expressed in milliseconds in this test suite.
+   - Test harness code is at the end of this file.
+   - We generate only one request at a time, to avoid overloading the HTTP
+   request handlers.
+ */
+
+/**
+ * Generate and track results from a XMLHttpRequest with regards to timeouts.
+ *
+ * @param {String} id         The test description.
+ * @param {Number} timeLimit  The initial setting for the request timeout.
+ * @param {Number} resetAfter (Optional) The time after sending the request, to
+ *                            reset the timeout.
+ * @param {Number} resetTo    (Optional) The delay to reset the timeout to.
+ *
+ * @note The actual testing takes place in handleEvent(event).
+ * The requests are generated in startXHR().
+ *
+ * @note If resetAfter and resetTo are omitted, only the initial timeout setting
+ * applies.
+ *
+ * @constructor
+ * @implements DOMEventListener
+ */
+function RequestTracker(id, timeLimit /*[, resetAfter, resetTo]*/) {
+  this.id = id;
+  this.timeLimit = timeLimit;
+
+  if (arguments.length > 2) {
+    this.mustReset  = true;
+    this.resetAfter = arguments[2];
+    this.resetTo    = arguments[3];
+  }
+
+  this.hasFired = false;
+}
+RequestTracker.prototype = {
+  /**
+   * Start the XMLHttpRequest!
+   */
+  startXHR: function() {
+    var req = new XMLHttpRequest();
+    this.request = req;
+    req.open("GET", "file_XHR_timeout.sjs");
+    req.onerror   = this;
+    req.onload    = this;
+    req.onabort   = this;
+    req.ontimeout = this;
+
+    req.timeout = this.timeLimit;
+    
+    if (this.mustReset) {
+      var resetTo = this.resetTo;
+      window.setTimeout(function() {
+        req.timeout = resetTo;
+      }, this.resetAfter);
+    }
+
+    req.send(null);
+  },
+
+  /**
+   * Get a message describing this test.
+   *
+   * @returns {String} The test description.
+   */
+  getMessage: function() {
+    var rv = this.id + ", ";
+    if (this.mustReset) {
+      rv += "original timeout at " + this.timeLimit + ", ";
+      rv += "reset at " + this.resetAfter + " to " + this.resetTo;
+    }
+    else {
+      rv += "timeout scheduled at " + this.timeLimit;
+    }
+    return rv;
+  },
+
+  /**
+   * Check the event received, and if it's the right (and only) one we get.
+   *
+   * @param {DOMProgressEvent} evt An event of type "load" or "timeout".
+   */
+  handleEvent: function(evt) {
+    if (this.hasFired) {
+      ok(false, "Only one event should fire: " + this.getMessage());
+      return;
+    }
+    this.hasFired = true;
+
+    var type = evt.type, expectedType;
+    // The XHR responds after 3000 milliseconds with a load event.
+    var timeLimit = this.mustReset && (this.resetAfter < Math.min(3000, this.timeLimit)) ?
+                    this.resetTo :
+                    this.timeLimit;
+    if ((timeLimit == 0) || (timeLimit >= 3000)) {
+      expectedType = "load";
+    }
+    else {
+      expectedType = "timeout";
+    }
+    is(type, expectedType, this.getMessage());
+    TestCounter.testComplete();
+  }
+};
+
+/**
+ * Generate and track XMLHttpRequests which will have abort() called on.
+ *
+ * @param shouldAbort {Boolean} True if we should call abort at all.
+ * @param abortDelay  {Number}  The time in ms to wait before calling abort().
+ */
+function AbortedRequest(shouldAbort, abortDelay) {
+  this.shouldAbort = shouldAbort;
+  this.abortDelay  = abortDelay;
+  this.hasFired    = false;
+}
+AbortedRequest.prototype = {
+  /**
+   * Start the XMLHttpRequest!
+   */
+  startXHR: function() {
+    var req = new XMLHttpRequest();
+    this.request = req;
+    req.open("GET", "file_XHR_timeout.sjs");
+    req.onerror   = this;
+    req.onload    = this;
+    req.onabort   = this;
+    req.ontimeout = this;
+
+    req.timeout = 2000;
+    var _this = this;
+
+    function abortReq() {
+      req.abort();
+    }
+
+    if (!this.shouldAbort) {
+      window.setTimeout(function() {
+        try {
+          _this.noEventsFired();
+        }
+        catch (e) {
+          ok(false, "Unexpected error: " + e);
+          TestCounter.testComplete();
+        }
+      }, 5000);
+    }
+    else {
+      // Abort events can only be triggered on sent requests.
+      req.send();
+      if (this.abortDelay == -1) {
+        abortReq();
+      }
+      else {
+        window.setTimeout(abortReq, this.abortDelay);
+      }
+    }
+  },
+
+  /**
+   * Ensure that no events fired at all, especially not our timeout event.
+   */
+  noEventsFired: function() {
+    ok(!this.hasFired, "No events should fire for an unsent, unaborted request");
+    // We're done; if timeout hasn't fired by now, it never will.
+    TestCounter.testComplete();
+  },
+
+  /**
+   * Get a message describing this test.
+   *
+   * @returns {String} The test description.
+   */
+  getMessage: function() {
+    return "time to abort is " + this.abortDelay + ", timeout set at 2000";
+  },
+
+  /**
+   * Check the event received, and if it's the right (and only) one we get.
+   *
+   * @param {DOMProgressEvent} evt An event of type "load" or "timeout".
+   */
+  handleEvent: function(evt) {
+    if (this.hasFired) {
+      ok(false, "Only abort event should fire: " + this.getMessage());
+      return;
+    }
+    this.hasFired = true;
+
+    var expectedEvent = (this.abortDelay >= 2000) ? "timeout" : "abort";
+    is(evt.type, expectedEvent, this.getMessage());
+    TestCounter.testComplete();
+  }
+};
+
+var SyncRequestSettingTimeoutAfterOpen = {
+  startXHR: function() {
+    var pass = false;
+    var req = new XMLHttpRequest();
+    req.open("GET", "file_XHR_timeout.sjs", false);
+    try {
+      req.timeout = 1000;
+    }
+    catch (e) {
+      pass = true;
+    }
+    ok(pass, "Synchronous XHR must not allow a timeout to be set");
+    TestCounter.testComplete();
+  }
+};
+
+var SyncRequestSettingTimeoutBeforeOpen = {
+  startXHR: function() {
+    var pass = false;
+    var req = new XMLHttpRequest();
+    req.timeout = 1000;
+    try {
+      req.open("GET", "file_XHR_timeout.sjs", false);
+    }
+    catch (e) {
+      pass = true;
+    }
+    ok(pass, "Synchronous XHR must not allow a timeout to be set");
+    TestCounter.testComplete();
+  }
+};
+
+var TestRequests = [
+  // Simple timeouts.
+  new RequestTracker("no time out scheduled, load fires normally", 0),
+  new RequestTracker("load fires normally", 5000),
+  new RequestTracker("timeout hit before load", 2000),
+
+  // Timeouts reset after a certain delay.
+  new RequestTracker("load fires normally with no timeout set, twice", 0, 2000, 0),
+  new RequestTracker("load fires normally with same timeout set twice", 5000, 2000, 5000),
+  new RequestTracker("timeout fires normally with same timeout set twice", 2000, 1000, 2000),
+
+  new RequestTracker("timeout disabled after initially set", 5000, 2000, 0),
+  new RequestTracker("timeout overrides load after a delay", 5000, 1000, 2000),
+  new RequestTracker("timeout enabled after initially disabled", 0, 2000, 5000),
+
+  new RequestTracker("timeout set to expiring value after load fires", 5000, 4000, 1000),
+  new RequestTracker("timeout set to expired value before load fires", 5000, 2000, 1000),
+  new RequestTracker("timeout set to non-expiring value after timeout fires", 1000, 2000, 5000),
+
+  // Aborted requests.
+  new AbortedRequest(false),
+  new AbortedRequest(true, -1),
+  new AbortedRequest(true, 0),
+  new AbortedRequest(true, 1000),
+  new AbortedRequest(true, 5000),
+
+  // Synchronous requests.
+  SyncRequestSettingTimeoutAfterOpen,
+  SyncRequestSettingTimeoutBeforeOpen
+];
+
+// This code controls moving from one test to another.
+var TestCounter = {
+  testComplete: function() {
+    // Allow for the possibility there are other events coming.
+    window.setTimeout(function() {
+      TestCounter.next();
+    }, 5000);
+  },
+
+  next: function() {
+    var test = TestRequests.shift();
+
+    if (test) {
+      test.startXHR();
+    }
+    else {
+      SimpleTest.finish();
+    }
+  }
+};
+
+// Final test harness setup and launch.
+(function() {
+  SimpleTest.waitForExplicitFinish();
+  SimpleTest.requestLongerTimeout(TestRequests.length);
+  var msg = "This test will take approximately " + (TestRequests.length * 10)
+  msg += " seconds to complete, at most.";
+  document.getElementById("content").firstChild.nodeValue = msg;
+  TestCounter.next();
+})();
--- a/content/canvas/src/nsCanvasRenderingContext2D.cpp
+++ b/content/canvas/src/nsCanvasRenderingContext2D.cpp
@@ -2785,32 +2785,24 @@ struct NS_STACK_CLASS nsCanvasBidiProces
                                       nsnull);
             point.x += textRunMetrics.mAdvanceWidth;
             // old code was:
             //   point.x += width * mAppUnitsPerDevPixel;
             // TODO: restore this if/when we move to fractional coords
             // throughout the text layout process
         }
 
-        // stroke or fill the text depending on operation
-        if (mOp == nsCanvasRenderingContext2D::TEXT_DRAW_OPERATION_STROKE)
-            mTextRun->DrawToPath(mThebes,
-                                 point,
-                                 0,
-                                 mTextRun->GetLength(),
-                                 nsnull,
-                                 nsnull);
-        else
-            // mOp == TEXT_DRAW_OPERATION_FILL
-            mTextRun->Draw(mThebes,
-                           point,
-                           0,
-                           mTextRun->GetLength(),
-                           nsnull,
-                           nsnull);
+        mTextRun->Draw(mThebes,
+                       point,
+                       mOp == nsCanvasRenderingContext2D::TEXT_DRAW_OPERATION_STROKE ?
+                                    gfxFont::GLYPH_STROKE : gfxFont::GLYPH_FILL,
+                       0,
+                       mTextRun->GetLength(),
+                       nsnull,
+                       nsnull);
     }
 
     // current text run
     nsAutoPtr<gfxTextRun> mTextRun;
 
     // pointer to the context, may not be the canvas's context
     // if an intermediate surface is being used
     gfxContext* mThebes;
@@ -2882,20 +2874,21 @@ nsCanvasRenderingContext2D::DrawOrMeasur
         if (!canvasStyle)
             return NS_ERROR_FAILURE;
         isRTL = canvasStyle->GetStyleVisibility()->mDirection ==
             NS_STYLE_DIRECTION_RTL;
     } else {
       isRTL = GET_BIDI_OPTION_DIRECTION(document->GetBidiOptions()) == IBMBIDI_TEXTDIRECTION_RTL;
     }
 
-    // don't need to take care of these with stroke since Stroke() does that
-    bool doDrawShadow = aOp == TEXT_DRAW_OPERATION_FILL && NeedToDrawShadow();
-    bool doUseIntermediateSurface = aOp == TEXT_DRAW_OPERATION_FILL &&
-        (NeedToUseIntermediateSurface() || NeedIntermediateSurfaceToHandleGlobalAlpha(STYLE_FILL));
+    Style style = aOp == TEXT_DRAW_OPERATION_FILL ? STYLE_FILL : STYLE_STROKE;
+
+    bool doDrawShadow = NeedToDrawShadow();
+    bool doUseIntermediateSurface = NeedToUseIntermediateSurface()
+        || NeedIntermediateSurfaceToHandleGlobalAlpha(style);
 
     // Clear the surface if we need to simulate unbounded SOURCE operator
     ClearSurfaceForUnboundedSource();
 
     nsCanvasBidiProcessor processor;
 
     GetAppUnitsValues(&processor.mAppUnitsPerDevPixel, NULL);
     processor.mPt = gfxPoint(aX, aY);
@@ -3022,16 +3015,17 @@ nsCanvasRenderingContext2D::DrawOrMeasur
         // this is unnecessarily big is max-width scaling is involved, but it
         // will still produce correct output
         gfxRect drawExtents = mThebes->UserToDevice(processor.mBoundingBox);
         gfxAlphaBoxBlur blur;
 
         gfxContext* ctx = ShadowInitialize(drawExtents, blur);
 
         if (ctx) {
+            ApplyStyle(style, false);
             CopyContext(ctx, mThebes);
             ctx->SetOperator(gfxContext::OPERATOR_SOURCE);
             processor.mThebes = ctx;
 
             rv = nsBidiPresUtils::ProcessText(textToDraw.get(),
                                               textToDraw.Length(),
                                               isRTL ? NSBIDI_RTL : NSBIDI_LTR,
                                               presShell->GetPresContext(),
@@ -3047,32 +3041,24 @@ nsCanvasRenderingContext2D::DrawOrMeasur
             ShadowFinalize(blur);
         }
 
         processor.mThebes = mThebes;
     }
 
     gfxContextPathAutoSaveRestore pathSR(mThebes, false);
 
-    // back up and clear path if stroking
-    if (aOp == nsCanvasRenderingContext2D::TEXT_DRAW_OPERATION_STROKE) {
-        pathSR.Save();
-        mThebes->NewPath();
+    if (doUseIntermediateSurface) {
+        mThebes->PushGroup(gfxASurface::CONTENT_COLOR_ALPHA);
+
+        // don't want operators to be applied twice
+        mThebes->SetOperator(gfxContext::OPERATOR_SOURCE);
     }
-    // doUseIntermediateSurface is mutually exclusive to op == STROKE
-    else {
-        if (doUseIntermediateSurface) {
-            mThebes->PushGroup(gfxASurface::CONTENT_COLOR_ALPHA);
-
-            // don't want operators to be applied twice
-            mThebes->SetOperator(gfxContext::OPERATOR_SOURCE);
-        }
-
-        ApplyStyle(STYLE_FILL);
-    }
+
+    ApplyStyle(style);
 
     rv = nsBidiPresUtils::ProcessText(textToDraw.get(),
                                       textToDraw.Length(),
                                       isRTL ? NSBIDI_RTL : NSBIDI_LTR,
                                       presShell->GetPresContext(),
                                       processor,
                                       nsBidiPresUtils::MODE_DRAW,
                                       nsnull,
@@ -3084,23 +3070,18 @@ nsCanvasRenderingContext2D::DrawOrMeasur
     if (doUseIntermediateSurface) {
         mThebes->PopGroupToSource();
         DirtyAllStyles();
     }
 
     if (NS_FAILED(rv))
         return rv;
 
-    if (aOp == nsCanvasRenderingContext2D::TEXT_DRAW_OPERATION_STROKE) {
-        // DrawPath takes care of all shadows and composite oddities
-        rv = DrawPath(STYLE_STROKE);
-        if (NS_FAILED(rv))
-            return rv;
-    } else if (doUseIntermediateSurface)
-        mThebes->Paint(CurrentState().StyleIsColor(STYLE_FILL) ? 1.0 : CurrentState().globalAlpha);
+    if (doUseIntermediateSurface)
+        mThebes->Paint(CurrentState().StyleIsColor(style) ? 1.0 : CurrentState().globalAlpha);
 
     if (aOp == nsCanvasRenderingContext2D::TEXT_DRAW_OPERATION_FILL && !doDrawShadow)
         return RedrawUser(boundingBox);
 
     return Redraw();
 }
 
 NS_IMETHODIMP
--- a/content/canvas/test/webgl/failing_tests_linux.txt
+++ b/content/canvas/test/webgl/failing_tests_linux.txt
@@ -6,8 +6,9 @@ conformance/misc/uninitialized-test.html
 conformance/programs/gl-get-active-attribute.html
 conformance/textures/texture-mips.html
 conformance/uniforms/gl-uniform-bool.html
 conformance/more/conformance/quickCheckAPI-S_V.html
 conformance/more/functions/uniformfArrayLen1.html
 conformance/glsl/misc/attrib-location-length-limits.html
 conformance/glsl/misc/uniform-location-length-limits.html
 conformance/renderbuffers/framebuffer-object-attachment.html
+conformance/glsl/misc/struct-nesting-exceeds-maximum.html
--- a/content/canvas/test/webgl/failing_tests_mac.txt
+++ b/content/canvas/test/webgl/failing_tests_mac.txt
@@ -2,9 +2,10 @@ conformance/context/premultiplyalpha-tes
 conformance/glsl/misc/glsl-function-nodes.html
 conformance/glsl/misc/glsl-long-variable-names.html
 conformance/glsl/misc/shader-with-256-character-identifier.frag.html
 conformance/glsl/misc/shader-with-long-line.html
 conformance/more/conformance/quickCheckAPI-S_V.html
 conformance/more/functions/uniformfBadArgs.html
 conformance/more/functions/uniformiBadArgs.html
 conformance/glsl/misc/attrib-location-length-limits.html
-conformance/glsl/misc/uniform-location-length-limits.html
\ No newline at end of file
+conformance/glsl/misc/uniform-location-length-limits.html
+conformance/glsl/misc/struct-nesting-exceeds-maximum.html
--- a/content/canvas/test/webgl/failing_tests_windows.txt
+++ b/content/canvas/test/webgl/failing_tests_windows.txt
@@ -3,9 +3,10 @@ conformance/glsl/functions/glsl-function
 conformance/glsl/functions/glsl-function-atan-xy.html
 conformance/glsl/misc/glsl-long-variable-names.html
 conformance/glsl/misc/shader-with-256-character-identifier.frag.html
 conformance/glsl/misc/shader-with-long-line.html
 conformance/more/conformance/quickCheckAPI-S_V.html
 conformance/more/functions/uniformfArrayLen1.html
 conformance/glsl/misc/attrib-location-length-limits.html
 conformance/glsl/misc/struct-nesting-under-maximum.html
-conformance/glsl/misc/uniform-location-length-limits.html
\ No newline at end of file
+conformance/glsl/misc/uniform-location-length-limits.html
+conformance/glsl/misc/struct-nesting-exceeds-maximum.html
--- a/content/html/content/src/nsGenericHTMLFrameElement.cpp
+++ b/content/html/content/src/nsGenericHTMLFrameElement.cpp
@@ -6,16 +6,17 @@
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsGenericHTMLFrameElement.h"
 #include "nsIWebProgress.h"
 #include "nsIPrivateDOMEvent.h"
 #include "nsIDOMCustomEvent.h"
 #include "nsIVariant.h"
 #include "nsIInterfaceRequestorUtils.h"
+#include "nsWeakPtr.h"
 #include "nsVariant.h"
 #include "nsContentUtils.h"
 #include "nsDOMMemoryReporter.h"
 #include "nsEventDispatcher.h"
 #include "nsContentUtils.h"
 #include "nsAsyncDOMEvent.h"
 #include "mozilla/Preferences.h"
 
@@ -32,20 +33,23 @@ NS_INTERFACE_TABLE_HEAD(nsGenericHTMLFra
   NS_INTERFACE_TABLE_INHERITED3(nsGenericHTMLFrameElement,
                                 nsIFrameLoaderOwner,
                                 nsIDOMMozBrowserFrame,
                                 nsIWebProgressListener)
   NS_INTERFACE_TABLE_TO_MAP_SEGUE_CYCLE_COLLECTION(nsGenericHTMLFrameElement)
 NS_INTERFACE_MAP_END_INHERITING(nsGenericHTMLElement)
 
 NS_IMPL_INT_ATTR(nsGenericHTMLFrameElement, TabIndex, tabindex)
-NS_IMPL_BOOL_ATTR(nsGenericHTMLFrameElement, Mozbrowser, mozbrowser)
 
 nsGenericHTMLFrameElement::~nsGenericHTMLFrameElement()
 {
+  if (mTitleChangedListener) {
+    mTitleChangedListener->Unregister();
+  }
+
   if (mFrameLoader) {
     mFrameLoader->Destroy();
   }
 }
 
 nsresult
 nsGenericHTMLFrameElement::GetContentDocument(nsIDOMDocument** aContentDocument)
 {
@@ -107,27 +111,17 @@ nsGenericHTMLFrameElement::EnsureFrameLo
 
   mFrameLoader = nsFrameLoader::Create(this, mNetworkCreated);
   if (!mFrameLoader) {
     // Strangely enough, this method doesn't actually ensure that the
     // frameloader exists.  It's more of a best-effort kind of thing.
     return NS_OK;
   }
 
-  // Register ourselves as a web progress listener on the frameloader's
-  // docshell.
-  nsCOMPtr<nsIDocShell> docShell;
-  mFrameLoader->GetDocShell(getter_AddRefs(docShell));
-  nsCOMPtr<nsIWebProgress> webProgress = do_QueryInterface(docShell);
-  NS_ENSURE_TRUE(webProgress, NS_OK);
-
-  // This adds a weak ref, so we don't have to worry about unregistering.
-  webProgress->AddProgressListener(this,
-    nsIWebProgress::NOTIFY_LOCATION |
-    nsIWebProgress::NOTIFY_STATE_WINDOW);
+  MaybeEnsureBrowserFrameListenersRegistered();
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsGenericHTMLFrameElement::GetFrameLoader(nsIFrameLoader **aFrameLoader)
 {
   NS_IF_ADDREF(*aFrameLoader = mFrameLoader);
@@ -280,16 +274,94 @@ nsGenericHTMLFrameElement::SizeOf() cons
 {
   PRInt64 size = MemoryReporter::GetBasicSize<nsGenericHTMLFrameElement,
                                               nsGenericHTMLElement>(this);
   // TODO: need to implement SizeOf() in nsFrameLoader, bug 672539.
   size += mFrameLoader ? sizeof(*mFrameLoader.get()) : 0;
   return size;
 }
 
+NS_IMETHODIMP
+nsGenericHTMLFrameElement::GetMozbrowser(bool *aValue)
+{
+  return GetBoolAttr(nsGkAtoms::mozbrowser, aValue);
+}
+
+NS_IMETHODIMP
+nsGenericHTMLFrameElement::SetMozbrowser(bool aValue)
+{
+  nsresult rv = SetBoolAttr(nsGkAtoms::mozbrowser, aValue);
+  if (NS_SUCCEEDED(rv)) {
+    MaybeEnsureBrowserFrameListenersRegistered();
+  }
+  return rv;
+}
+
+/*
+ * If this frame element is allowed to be a browser frame (because it passes
+ * BrowserFrameSecurityCheck()), then make sure that it has the appropriate
+ * event listeners enabled.
+ */
+void
+nsGenericHTMLFrameElement::MaybeEnsureBrowserFrameListenersRegistered()
+{
+  if (mBrowserFrameListenersRegistered) {
+    return;
+  }
+
+  // If this frame passes the browser frame security check, ensure that its
+  // listeners are active.
+  if (!BrowserFrameSecurityCheck()) {
+    return;
+  }
+
+  // Not much we can do without a frameLoader.  But EnsureFrameLoader will call
+  // this function, so we'll get a chance to pass this test.
+  if (!mFrameLoader) {
+    return;
+  }
+
+  mBrowserFrameListenersRegistered = true;
+
+  // Register ourselves as a web progress listener on the frameloader's
+  // docshell.
+  nsCOMPtr<nsIDocShell> docShell;
+  mFrameLoader->GetDocShell(getter_AddRefs(docShell));
+  nsCOMPtr<nsIWebProgress> webProgress = do_QueryInterface(docShell);
+
+  // This adds a weak ref, so we don't have to worry about unregistering.
+  if (webProgress) {
+    webProgress->AddProgressListener(this,
+      nsIWebProgress::NOTIFY_LOCATION |
+      nsIWebProgress::NOTIFY_STATE_WINDOW);
+  }
+
+  // Register a listener for DOMTitleChanged on the window's chrome event
+  // handler.  The chrome event handler outlives this iframe, so we'll have to
+  // unregister when the iframe is destroyed.
+
+  nsCOMPtr<nsPIDOMWindow> window = do_GetInterface(docShell);
+  if (!window) {
+    return;
+  }
+  MOZ_ASSERT(window->IsOuterWindow());
+
+  nsIDOMEventTarget *chromeHandler = window->GetChromeEventHandler();
+  if (!chromeHandler) {
+    return;
+  }
+
+  MOZ_ASSERT(!mTitleChangedListener);
+  mTitleChangedListener = new TitleChangedListener(this, chromeHandler);
+  chromeHandler->AddSystemEventListener(NS_LITERAL_STRING("DOMTitleChanged"),
+                                        mTitleChangedListener,
+                                        /* useCapture = */ false,
+                                        /* wantsUntrusted = */ false);
+}
+
 /**
  * Return true if this frame element has permission to send mozbrowser
  * events, and false otherwise.
  */
 bool
 nsGenericHTMLFrameElement::BrowserFrameSecurityCheck()
 {
   // Fail if browser frames are globally disabled.
@@ -444,8 +516,82 @@ nsGenericHTMLFrameElement::OnStatusChang
 
 NS_IMETHODIMP
 nsGenericHTMLFrameElement::OnSecurityChange(nsIWebProgress *aWebProgress,
                                             nsIRequest *aRequest,
                                             PRUint32 state)
 {
   return NS_OK;
 }
+
+NS_IMPL_ISUPPORTS1(nsGenericHTMLFrameElement::TitleChangedListener,
+                   nsIDOMEventListener)
+
+nsGenericHTMLFrameElement::TitleChangedListener::TitleChangedListener(
+  nsGenericHTMLFrameElement *aElement,
+  nsIDOMEventTarget *aChromeHandler)
+{
+  mElement =
+    do_GetWeakReference(NS_ISUPPORTS_CAST(nsIDOMMozBrowserFrame*, aElement));
+  mChromeHandler = do_GetWeakReference(aChromeHandler);
+}
+
+NS_IMETHODIMP
+nsGenericHTMLFrameElement::TitleChangedListener::HandleEvent(nsIDOMEvent *aEvent)
+{
+#ifdef DEBUG
+  {
+    nsString eventType;
+    aEvent->GetType(eventType);
+    MOZ_ASSERT(eventType.EqualsLiteral("DOMTitleChanged"));
+  }
+#endif
+
+  nsCOMPtr<nsIDOMMozBrowserFrame> element = do_QueryReferent(mElement);
+  if (!element) {
+    // Hm, our element is gone, but somehow we weren't unregistered?
+    Unregister();
+    return NS_OK;
+  }
+
+  nsGenericHTMLFrameElement* frameElement =
+    static_cast<nsGenericHTMLFrameElement*>(element.get());
+
+  nsCOMPtr<nsIDOMDocument> frameDocument;
+  frameElement->GetContentDocument(getter_AddRefs(frameDocument));
+  NS_ENSURE_STATE(frameDocument);
+
+  nsCOMPtr<nsIDOMEventTarget> target;
+  aEvent->GetTarget(getter_AddRefs(target));
+  nsCOMPtr<nsIDOMDocument> targetDocument = do_QueryInterface(target);
+  NS_ENSURE_STATE(targetDocument);
+
+  if (frameDocument != targetDocument) {
+    // This is a titlechange event for the wrong document!
+    return NS_OK;
+  }
+
+  nsString newTitle;
+  nsresult rv = targetDocument->GetTitle(newTitle);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  frameElement->MaybeFireBrowserEvent(
+    NS_LITERAL_STRING("titlechange"),
+    NS_LITERAL_STRING("customevent"),
+    newTitle);
+
+  return NS_OK;
+}
+
+void
+nsGenericHTMLFrameElement::TitleChangedListener::Unregister()
+{
+  nsCOMPtr<nsIDOMEventTarget> chromeHandler = do_QueryReferent(mChromeHandler);
+  if (!chromeHandler) {
+    return;
+  }
+
+  chromeHandler->RemoveSystemEventListener(NS_LITERAL_STRING("DOMTitleChanged"),
+                                           this, /* useCapture = */ false);
+
+  // Careful; the call above may have removed the last strong reference to this
+  // class, so don't dereference |this| here.
+}
--- a/content/html/content/src/nsGenericHTMLFrameElement.h
+++ b/content/html/content/src/nsGenericHTMLFrameElement.h
@@ -3,33 +3,36 @@
 
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsGenericHTMLElement.h"
 #include "nsIDOMHTMLFrameElement.h"
 #include "nsIDOMMozBrowserFrame.h"
+#include "nsIDOMEventListener.h"
 #include "nsIWebProgressListener.h"
 
 /**
  * A helper class for frame elements
  */
 class nsGenericHTMLFrameElement : public nsGenericHTMLElement,
                                   public nsIFrameLoaderOwner,
                                   public nsIDOMMozBrowserFrame,
                                   public nsIWebProgressListener
 {
 public:
   nsGenericHTMLFrameElement(already_AddRefed<nsINodeInfo> aNodeInfo,
                             mozilla::dom::FromParser aFromParser)
     : nsGenericHTMLElement(aNodeInfo)
+    , mNetworkCreated(aFromParser == mozilla::dom::FROM_PARSER_NETWORK)
+    , mBrowserFrameListenersRegistered(false)
   {
-    mNetworkCreated = aFromParser == mozilla::dom::FROM_PARSER_NETWORK;
   }
+
   virtual ~nsGenericHTMLFrameElement();
 
   NS_IMETHOD QueryInterface(REFNSIID aIID, void** aInstancePtr);
   NS_DECL_NSIFRAMELOADEROWNER
   NS_DECL_NSIDOMMOZBROWSERFRAME
   NS_DECL_NSIWEBPROGRESSLISTENER
   NS_DECL_DOM_MEMORY_REPORTER_SIZEOF
 
@@ -55,26 +58,53 @@ public:
   // nsIDOMHTMLElement
   NS_IMETHOD GetTabIndex(PRInt32 *aTabIndex);
   NS_IMETHOD SetTabIndex(PRInt32 aTabIndex);
 
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED_NO_UNLINK(nsGenericHTMLFrameElement,
                                                      nsGenericHTMLElement)
 
 protected:
+  /**
+   * Listens to titlechanged events from the document inside the iframe and
+   * forwards them along to the iframe so it can fire a mozbrowsertitlechange
+   * event if appropriate.
+   */
+  class TitleChangedListener : public nsIDOMEventListener
+  {
+  public:
+    TitleChangedListener(nsGenericHTMLFrameElement *aElement,
+                         nsIDOMEventTarget *aChromeHandler);
+
+    /* Unregister this listener. */
+    void Unregister();
+
+    NS_DECL_ISUPPORTS
+    NS_DECL_NSIDOMEVENTLISTENER
+
+  private:
+    nsWeakPtr mElement; /* nsGenericHTMLFrameElement */
+    nsWeakPtr mChromeHandler; /* nsIDOMEventTarget */
+  };
+
   // This doesn't really ensure a frame loade in all cases, only when
   // it makes sense.
   nsresult EnsureFrameLoader();
   nsresult LoadSrc();
   nsresult GetContentDocument(nsIDOMDocument** aContentDocument);
   nsresult GetContentWindow(nsIDOMWindow** aContentWindow);
 
+  void MaybeEnsureBrowserFrameListenersRegistered();
   bool BrowserFrameSecurityCheck();
   nsresult MaybeFireBrowserEvent(const nsAString &aEventName,
                                  const nsAString &aEventType,
                                  const nsAString &aValue = EmptyString());
 
   nsRefPtr<nsFrameLoader> mFrameLoader;
+  nsRefPtr<TitleChangedListener> mTitleChangedListener;
+
   // True when the element is created by the parser
   // using NS_FROM_PARSER_NETWORK flag.
   // If the element is modified, it may lose the flag.
   bool                    mNetworkCreated;
+
+  bool                    mBrowserFrameListenersRegistered;
 };
--- a/content/svg/content/src/DOMSVGAnimatedLengthList.h
+++ b/content/svg/content/src/DOMSVGAnimatedLengthList.h
@@ -32,22 +32,21 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_DOMSVGANIMATEDLENGTHLIST_H__
 #define MOZILLA_DOMSVGANIMATEDLENGTHLIST_H__
 
-#include "nsIDOMSVGAnimatedLengthList.h"
+#include "nsAutoPtr.h"
+#include "nsCOMPtr.h"
 #include "nsCycleCollectionParticipant.h"
-#include "nsAutoPtr.h"
-#include "nsTArray.h"
-
-class nsSVGElement;
+#include "nsIDOMSVGAnimatedLengthList.h"
+#include "nsSVGElement.h"
 
 namespace mozilla {
 
 class SVGAnimatedLengthList;
 class SVGLengthList;
 class DOMSVGLengthList;
 
 /**
--- a/content/svg/content/src/DOMSVGAnimatedNumberList.h
+++ b/content/svg/content/src/DOMSVGAnimatedNumberList.h
@@ -32,28 +32,27 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_DOMSVGANIMATEDNUMBERLIST_H__
 #define MOZILLA_DOMSVGANIMATEDNUMBERLIST_H__
 
-#include "nsIDOMSVGAnimatedNumberList.h"
+#include "nsAutoPtr.h"
+#include "nsCOMPtr.h"
 #include "nsCycleCollectionParticipant.h"
-#include "nsAutoPtr.h"
-#include "nsTArray.h"
-
-class nsSVGElement;
+#include "nsIDOMSVGAnimatedNumberList.h"
+#include "nsSVGElement.h"
 
 namespace mozilla {
 
+class DOMSVGNumberList;
 class SVGAnimatedNumberList;
 class SVGNumberList;
-class DOMSVGNumberList;
 
 /**
  * Class DOMSVGAnimatedNumberList
  *
  * This class is used to create the DOM tearoff objects that wrap internal
  * SVGAnimatedNumberList objects.
  *
  * See the architecture comment in DOMSVGAnimatedLengthList.h (that's
--- a/content/svg/content/src/DOMSVGAnimatedTransformList.h
+++ b/content/svg/content/src/DOMSVGAnimatedTransformList.h
@@ -35,28 +35,26 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_DOMSVGANIMATEDTRANSFORMLIST_H__
 #define MOZILLA_DOMSVGANIMATEDTRANSFORMLIST_H__
 
-#include "nsIDOMSVGAnimTransformList.h"
+#include "nsAutoPtr.h"
+#include "nsCOMPtr.h"
 #include "nsCycleCollectionParticipant.h"
-#include "nsAutoPtr.h"
-#include "nsTArray.h"
-
-class nsSVGElement;
+#include "nsIDOMSVGAnimTransformList.h"
+#include "nsSVGElement.h"
 
 namespace mozilla {
 
+class DOMSVGTransformList;
 class SVGAnimatedTransformList;
-class SVGTransformList;
-class DOMSVGTransformList;
 
 /**
  * Class DOMSVGAnimatedTransformList
  *
  * This class is used to create the DOM tearoff objects that wrap internal
  * SVGAnimatedTransformList objects.
  *
  * See the architecture comment in DOMSVGAnimatedLengthList.h (that's
--- a/content/svg/content/src/DOMSVGLength.h
+++ b/content/svg/content/src/DOMSVGLength.h
@@ -32,21 +32,23 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_DOMSVGLENGTH_H__
 #define MOZILLA_DOMSVGLENGTH_H__
 
+#include "DOMSVGLengthList.h"
+#include "nsAutoPtr.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsDebug.h"
 #include "nsIDOMSVGLength.h"
-#include "DOMSVGLengthList.h"
+#include "nsTArray.h"
 #include "SVGLength.h"
-#include "nsCycleCollectionParticipant.h"
-#include "nsAutoPtr.h"
 
 class nsSVGElement;
 
 // We make DOMSVGLength a pseudo-interface to allow us to QI to it in order to
 // check that the objects that scripts pass to DOMSVGLengthList methods are our
 // *native* length objects.
 //
 // {A8468350-7F7B-4976-9A7E-3765A1DADF9A}
--- a/content/svg/content/src/DOMSVGLengthList.h
+++ b/content/svg/content/src/DOMSVGLengthList.h
@@ -32,23 +32,25 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_DOMSVGLENGTHLIST_H__
 #define MOZILLA_DOMSVGLENGTHLIST_H__
 
+#include "DOMSVGAnimatedLengthList.h"
+#include "nsAutoPtr.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsDebug.h"
 #include "nsIDOMSVGLengthList.h"
+#include "nsTArray.h"
 #include "SVGLengthList.h"
-#include "SVGLength.h"
-#include "DOMSVGAnimatedLengthList.h"
-#include "nsCOMArray.h"
-#include "nsAutoPtr.h"
 
+class nsIDOMSVGLength;
 class nsSVGElement;
 
 namespace mozilla {
 
 class DOMSVGLength;
 
 /**
  * Class DOMSVGLengthList
--- a/content/svg/content/src/DOMSVGMatrix.h
+++ b/content/svg/content/src/DOMSVGMatrix.h
@@ -66,21 +66,21 @@
  * Pre-multiplying may look wrong if you're only familiar with the SVG
  * convention, but in that case hopefully the above explanation clears things
  * up.
  */
 
 #ifndef MOZILLA_DOMSVGMATRIX_H__
 #define MOZILLA_DOMSVGMATRIX_H__
 
-#include "nsIDOMSVGMatrix.h"
 #include "DOMSVGTransform.h"
 #include "gfxMatrix.h"
 #include "nsAutoPtr.h"
 #include "nsCycleCollectionParticipant.h"
+#include "nsIDOMSVGMatrix.h"
 
 // We make DOMSVGMatrix a pseudo-interface to allow us to QI to it in order
 // to check that the objects that scripts pass in are our *native* matrix
 // objects.
 //
 // {633419E5-7E88-4C3E-8A9A-856F635E90A3}
 #define MOZILLA_DOMSVGMATRIX_IID \
   { 0x633419E5, 0x7E88, 0x4C3E, \
--- a/content/svg/content/src/DOMSVGNumber.h
+++ b/content/svg/content/src/DOMSVGNumber.h
@@ -32,20 +32,21 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_DOMSVGNUMBER_H__
 #define MOZILLA_DOMSVGNUMBER_H__
 
+#include "DOMSVGNumberList.h"
+#include "nsAutoPtr.h"
+#include "nsCycleCollectionParticipant.h"
 #include "nsIDOMSVGNumber.h"
-#include "DOMSVGNumberList.h"
-#include "nsCycleCollectionParticipant.h"
-#include "nsAutoPtr.h"
+#include "nsTArray.h"
 
 class nsSVGElement;
 
 // We make DOMSVGNumber a pseudo-interface to allow us to QI to it in order to
 // check that the objects that scripts pass to DOMSVGNumberList methods are our
 // *native* number objects.
 //
 // {2CA92412-2E1F-4DDB-A16C-52B3B582270D}
--- a/content/svg/content/src/DOMSVGNumberList.h
+++ b/content/svg/content/src/DOMSVGNumberList.h
@@ -32,21 +32,23 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_DOMSVGNUMBERLIST_H__
 #define MOZILLA_DOMSVGNUMBERLIST_H__
 
+#include "DOMSVGAnimatedNumberList.h"
+#include "nsAutoPtr.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsDebug.h"
 #include "nsIDOMSVGNumberList.h"
+#include "nsTArray.h"
 #include "SVGNumberList.h"
-#include "DOMSVGAnimatedNumberList.h"
-#include "nsCOMArray.h"
-#include "nsAutoPtr.h"
 
 class nsSVGElement;
 
 namespace mozilla {
 
 class DOMSVGNumber;
 
 /**
--- a/content/svg/content/src/DOMSVGPathSeg.cpp
+++ b/content/svg/content/src/DOMSVGPathSeg.cpp
@@ -38,16 +38,17 @@
 
 #include "DOMSVGPathSeg.h"
 #include "DOMSVGPathSegList.h"
 #include "SVGPathSegUtils.h"
 #include "SVGAnimatedPathSegList.h"
 #include "nsSVGElement.h"
 #include "nsIDOMSVGPathSeg.h"
 #include "nsDOMError.h"
+#include "nsContentUtils.h"
 
 // See the architecture comment in DOMSVGPathSegList.h.
 
 using namespace mozilla;
 
 // We could use NS_IMPL_CYCLE_COLLECTION_1, except that in Unlink() we need to
 // clear our list's weak ref to us to be safe. (The other option would be to
 // not unlink and rely on the breaking of the other edges in the cycle, as
--- a/content/svg/content/src/DOMSVGPathSeg.h
+++ b/content/svg/content/src/DOMSVGPathSeg.h
@@ -32,21 +32,20 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_DOMSVGPATHSEG_H__
 #define MOZILLA_DOMSVGPATHSEG_H__
 
+#include "DOMSVGPathSegList.h"
+#include "nsAutoPtr.h"
+#include "nsCycleCollectionParticipant.h"
 #include "nsIDOMSVGPathSeg.h"
-#include "DOMSVGPathSegList.h"
-#include "SVGPathSegUtils.h"
-#include "nsCycleCollectionParticipant.h"
-#include "nsAutoPtr.h"
 
 class nsSVGElement;
 
 // We make DOMSVGPathSeg a pseudo-interface to allow us to QI to it in order to
 // check that the objects that scripts pass to DOMSVGPathSegList methods are
 // our *native* path seg objects.
 //
 // {494A7566-DC26-40C8-9122-52ABD76870C4}
--- a/content/svg/content/src/DOMSVGPathSegList.cpp
+++ b/content/svg/content/src/DOMSVGPathSegList.cpp
@@ -36,16 +36,17 @@
 
 #include "nsSVGElement.h"
 #include "DOMSVGPathSegList.h"
 #include "DOMSVGPathSeg.h"
 #include "nsDOMError.h"
 #include "SVGAnimatedPathSegList.h"
 #include "nsCOMPtr.h"
 #include "nsSVGAttrTearoffTable.h"
+#include "SVGPathSegUtils.h"
 
 // See the comment in this file's header.
 
 namespace mozilla {
 
 static nsSVGAttrTearoffTable<void, DOMSVGPathSegList>
   sSVGPathSegListTearoffTable;
 
--- a/content/svg/content/src/DOMSVGPathSegList.h
+++ b/content/svg/content/src/DOMSVGPathSegList.h
@@ -32,23 +32,26 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_DOMSVGPATHSEGLIST_H__
 #define MOZILLA_DOMSVGPATHSEGLIST_H__
 
+#include "nsAutoPtr.h"
+#include "nsCOMPtr.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsDebug.h"
 #include "nsIDOMSVGPathSegList.h"
-#include "SVGPathData.h"
-#include "SVGPathSegUtils.h"
-#include "nsCOMArray.h"
-#include "nsAutoPtr.h"
+#include "nsSVGElement.h"
+#include "nsTArray.h"
+#include "SVGPathData.h" // IWYU pragma: keep
 
-class nsSVGElement;
+class nsIDOMSVGPathSeg;
 
 namespace mozilla {
 
 class DOMSVGPathSeg;
 class SVGAnimatedPathSegList;
 
 /**
  * Class DOMSVGPathSegList
--- a/content/svg/content/src/DOMSVGPoint.h
+++ b/content/svg/content/src/DOMSVGPoint.h
@@ -32,23 +32,24 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_DOMSVGPOINT_H__
 #define MOZILLA_DOMSVGPOINT_H__
 
-#include "nsIDOMSVGPoint.h"
 #include "DOMSVGPointList.h"
-#include "SVGPoint.h"
 #include "gfxPoint.h"
+#include "nsAutoPtr.h"
 #include "nsCycleCollectionParticipant.h"
-#include "nsAutoPtr.h"
-#include "nsMathUtils.h"
+#include "nsDebug.h"
+#include "nsIDOMSVGPoint.h"
+#include "nsTArray.h"
+#include "SVGPoint.h"
 
 class nsSVGElement;
 
 // We make DOMSVGPoint a pseudo-interface to allow us to QI to it in order to
 // check that the objects that scripts pass to DOMSVGPointList methods are
 // our *native* point objects.
 //
 // {d6b6c440-af8d-40ee-856b-02a317cab275}
--- a/content/svg/content/src/DOMSVGPointList.h
+++ b/content/svg/content/src/DOMSVGPointList.h
@@ -32,23 +32,26 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_DOMSVGPOINTLIST_H__
 #define MOZILLA_DOMSVGPOINTLIST_H__
 
+#include "nsAutoPtr.h"
+#include "nsCOMPtr.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsDebug.h"
 #include "nsIDOMSVGPointList.h"
-#include "SVGPointList.h"
-#include "SVGPoint.h"
-#include "nsCOMArray.h"
-#include "nsAutoPtr.h"
+#include "nsSVGElement.h"
+#include "nsTArray.h"
+#include "SVGPointList.h" // IWYU pragma: keep
 
-class nsSVGElement;
+class nsIDOMSVGPoint;
 
 namespace mozilla {
 
 class DOMSVGPoint;
 class SVGAnimatedPointList;
 
 /**
  * Class DOMSVGPointList
--- a/content/svg/content/src/DOMSVGStringList.h
+++ b/content/svg/content/src/DOMSVGStringList.h
@@ -33,22 +33,21 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_DOMSVGSTRINGLIST_H__
 #define MOZILLA_DOMSVGSTRINGLIST_H__
 
-#include "nsIDOMSVGStringList.h"
+#include "nsAutoPtr.h"
+#include "nsCOMPtr.h"
 #include "nsCycleCollectionParticipant.h"
-#include "nsCOMArray.h"
-#include "nsAutoPtr.h"
-
-class nsSVGElement;
+#include "nsIDOMSVGStringList.h"
+#include "nsSVGElement.h"
 
 namespace mozilla {
 
 class SVGStringList;
 
 /**
  * Class DOMSVGStringList
  *
--- a/content/svg/content/src/DOMSVGTests.h
+++ b/content/svg/content/src/DOMSVGTests.h
@@ -34,18 +34,27 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_DOMSVGTESTS_H__
 #define MOZILLA_DOMSVGTESTS_H__
 
 #include "nsIDOMSVGTests.h"
+#include "nsStringFwd.h"
 #include "SVGStringList.h"
 
+class nsAttrValue;
+class nsIAtom;
+class nsString;
+
+namespace mozilla {
+class DOMSVGStringList;
+}
+
 class DOMSVGTests : public nsIDOMSVGTests
 {
 public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSIDOMSVGTESTS
 
   friend class mozilla::DOMSVGStringList;
   typedef mozilla::SVGStringList SVGStringList;
--- a/content/svg/content/src/DOMSVGTransform.h
+++ b/content/svg/content/src/DOMSVGTransform.h
@@ -36,21 +36,28 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_DOMSVGTRANSFORM_H__
 #define MOZILLA_DOMSVGTRANSFORM_H__
 
+#include "DOMSVGTransformList.h"
+#include "nsAutoPtr.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsDebug.h"
+#include "nsID.h"
 #include "nsIDOMSVGTransform.h"
-#include "DOMSVGTransformList.h"
+#include "nsTArray.h"
 #include "SVGTransform.h"
-#include "nsCycleCollectionParticipant.h"
-#include "nsAutoPtr.h"
+
+class nsSVGElement;
+
+struct gfxMatrix;
 
 // We make DOMSVGTransform a pseudo-interface to allow us to QI to it in order
 // to check that the objects that scripts pass in are our our *native* transform
 // objects.
 //
 // {0A799862-9469-41FE-B4CD-2019E65D8DA6}
 #define MOZILLA_DOMSVGTRANSFORM_IID \
   { 0x0A799862, 0x9469, 0x41FE, \
--- a/content/svg/content/src/DOMSVGTransformList.h
+++ b/content/svg/content/src/DOMSVGTransformList.h
@@ -36,22 +36,25 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_DOMSVGTRANSFORMLIST_H__
 #define MOZILLA_DOMSVGTRANSFORMLIST_H__
 
+#include "DOMSVGAnimatedTransformList.h"
+#include "nsAutoPtr.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsDebug.h"
 #include "nsIDOMSVGTransformList.h"
+#include "nsTArray.h"
 #include "SVGTransformList.h"
-#include "DOMSVGAnimatedTransformList.h"
-#include "nsCOMArray.h"
-#include "nsAutoPtr.h"
 
+class nsIDOMSVGTransform;
 class nsSVGElement;
 
 namespace mozilla {
 
 class DOMSVGTransform;
 
 /**
  * Class DOMSVGTransformList
--- a/content/svg/content/src/SVGAnimatedLengthList.h
+++ b/content/svg/content/src/SVGAnimatedLengthList.h
@@ -32,22 +32,24 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_SVGANIMATEDLENGTHLIST_H__
 #define MOZILLA_SVGANIMATEDLENGTHLIST_H__
 
+#include "nsAutoPtr.h"
+#include "nsISMILAttr.h"
 #include "SVGLengthList.h"
 
+class nsISMILAnimationElement;
+class nsSMILValue;
 class nsSVGElement;
 
-#include "nsISMILAttr.h"
-
 namespace mozilla {
 
 /**
  * Class SVGAnimatedLengthList
  *
  * This class is very different to the SVG DOM interface of the same name found
  * in the SVG specification. This is a lightweight internal class - see
  * DOMSVGAnimatedLengthList for the heavier DOM class that wraps instances of
--- a/content/svg/content/src/SVGAnimatedNumberList.h
+++ b/content/svg/content/src/SVGAnimatedNumberList.h
@@ -32,22 +32,24 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_SVGANIMATEDNUMBERLIST_H__
 #define MOZILLA_SVGANIMATEDNUMBERLIST_H__
 
+#include "nsAutoPtr.h"
+#include "nsISMILAttr.h"
 #include "SVGNumberList.h"
 
+class nsISMILAnimationElement;
+class nsSMILValue;
 class nsSVGElement;
 
-#include "nsISMILAttr.h"
-
 namespace mozilla {
 
 /**
  * Class SVGAnimatedNumberList
  *
  * This class is very different to the SVG DOM interface of the same name found
  * in the SVG specification. This is a lightweight internal class - see
  * DOMSVGAnimatedNumberList for the heavier DOM class that wraps instances of
--- a/content/svg/content/src/SVGAnimatedPathSegList.h
+++ b/content/svg/content/src/SVGAnimatedPathSegList.h
@@ -32,22 +32,24 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_SVGANIMATEDPATHSEGLIST_H__
 #define MOZILLA_SVGANIMATEDPATHSEGLIST_H__
 
+#include "nsAutoPtr.h"
+#include "nsISMILAttr.h"
 #include "SVGPathData.h"
 
+class nsISMILAnimationElement;
+class nsSMILValue;
 class nsSVGElement;
 
-#include "nsISMILAttr.h"
-
 namespace mozilla {
 
 /**
  * Class SVGAnimatedPathSegList
  *
  * Despite the fact that no SVGAnimatedPathSegList interface or objects exist
  * in the SVG specification (unlike e.g. SVGAnimated*Length*List), we
  * nevertheless have this internal class. (Note that there is an
--- a/content/svg/content/src/SVGAnimatedPointList.h
+++ b/content/svg/content/src/SVGAnimatedPointList.h
@@ -32,22 +32,24 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_SVGANIMATEDPOINTLIST_H__
 #define MOZILLA_SVGANIMATEDPOINTLIST_H__
 
+#include "nsAutoPtr.h"
+#include "nsISMILAttr.h"
 #include "SVGPointList.h"
 
+class nsISMILAnimationElement;
+class nsSMILValue;
 class nsSVGElement;
 
-#include "nsISMILAttr.h"
-
 namespace mozilla {
 
 /**
  * Class SVGAnimatedPointList
  *
  * Despite the fact that no SVGAnimatedPointList interface or objects exist
  * in the SVG specification (unlike e.g. SVGAnimated*Length*List), we
  * nevertheless have this internal class. (Note that there is an
--- a/content/svg/content/src/SVGAnimatedPreserveAspectRatio.h
+++ b/content/svg/content/src/SVGAnimatedPreserveAspectRatio.h
@@ -34,20 +34,27 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_SVGANIMATEDPRESERVEASPECTRATIO_H__
 #define MOZILLA_SVGANIMATEDPRESERVEASPECTRATIO_H__
 
-#include "nsIDOMSVGPresAspectRatio.h"
+#include "nsAutoPtr.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsDOMError.h"
+#include "nsError.h"
 #include "nsIDOMSVGAnimPresAspRatio.h"
+#include "nsIDOMSVGPresAspectRatio.h"
+#include "nsISMILAttr.h"
 #include "nsSVGElement.h"
-#include "nsDOMError.h"
+
+class nsISMILAnimationElement;
+class nsSMILValue;
 
 namespace mozilla {
 
 class SVGAnimatedPreserveAspectRatio;
 
 class SVGPreserveAspectRatio
 {
   friend class SVGAnimatedPreserveAspectRatio;
--- a/content/svg/content/src/SVGAnimatedTransformList.h
+++ b/content/svg/content/src/SVGAnimatedTransformList.h
@@ -34,22 +34,25 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_SVGANIMATEDTRANSFORMLIST_H__
 #define MOZILLA_SVGANIMATEDTRANSFORMLIST_H__
 
+#include "nsAutoPtr.h"
+#include "nsISMILAttr.h"
 #include "SVGTransformList.h"
 
+class nsIAtom;
+class nsISMILAnimationElement;
+class nsSMILValue;
 class nsSVGElement;
 
-#include "nsISMILAttr.h"
-
 namespace mozilla {
 
 /**
  * Class SVGAnimatedTransformList
  *
  * This class is very different to the SVG DOM interface of the same name found
  * in the SVG specification. This is a lightweight internal class - see
  * DOMSVGAnimatedTransformList for the heavier DOM class that wraps instances of
--- a/content/svg/content/src/SVGIntegerPairSMILType.h
+++ b/content/svg/content/src/SVGIntegerPairSMILType.h
@@ -34,16 +34,18 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_SVGINTEGERPAIRSMILTYPE_H_
 #define MOZILLA_SVGINTEGERPAIRSMILTYPE_H_
 
 #include "nsISMILType.h"
 
+class nsSMILValue;
+
 namespace mozilla {
 
 class SVGIntegerPairSMILType : public nsISMILType
 {
 public:
   // Singleton for nsSMILValue objects to hold onto.
   static SVGIntegerPairSMILType sSingleton;
 
--- a/content/svg/content/src/SVGLength.h
+++ b/content/svg/content/src/SVGLength.h
@@ -32,19 +32,18 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_SVGLENGTH_H__
 #define MOZILLA_SVGLENGTH_H__
 
+#include "nsDebug.h"
 #include "nsIDOMSVGLength.h"
-#include "nsIContent.h"
-#include "nsAString.h"
 #include "nsMathUtils.h"
 
 class nsSVGElement;
 
 namespace mozilla {
 
 /**
  * This SVGLength class is currently used for SVGLength *list* attributes only.
--- a/content/svg/content/src/SVGLengthList.h
+++ b/content/svg/content/src/SVGLengthList.h
@@ -32,20 +32,24 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_SVGLENGTHLIST_H__
 #define MOZILLA_SVGLENGTHLIST_H__
 
-#include "SVGLength.h"
+#include "nsCOMPtr.h"
+#include "nsDebug.h"
+#include "nsIContent.h"
+#include "nsINode.h"
+#include "nsIWeakReferenceUtils.h"
+#include "nsSVGElement.h"
 #include "nsTArray.h"
-#include "nsSVGElement.h"
-#include "nsIWeakReferenceUtils.h"
+#include "SVGLength.h"
 
 namespace mozilla {
 
 /**
  * ATTENTION! WARNING! WATCH OUT!!
  *
  * Consumers that modify objects of this type absolutely MUST keep the DOM
  * wrappers for those lists (if any) in sync!! That's why this class is so
--- a/content/svg/content/src/SVGMotionSMILAnimationFunction.h
+++ b/content/svg/content/src/SVGMotionSMILAnimationFunction.h
@@ -33,20 +33,27 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_SVGMOTIONSMILANIMATIONFUNCTION_H_
 #define MOZILLA_SVGMOTIONSMILANIMATIONFUNCTION_H_
 
+#include "gfxPath.h"  // for gfxFlattenedPath
+#include "nsAutoPtr.h"
 #include "nsSMILAnimationFunction.h"
-#include "SVGMotionSMILType.h" // for RotateType
-#include "gfxPath.h"  // for gfxFlattenedPath
+#include "nsTArray.h"
+#include "SVGMotionSMILType.h"  // for RotateType
 
+class nsAttrValue;
+class nsIAtom;
+class nsIContent;
+class nsISMILAttr;
+class nsSMILValue;
 class nsSVGMpathElement;
 
 namespace mozilla {
 
 //----------------------------------------------------------------------
 // SVGMotionSMILAnimationFunction
 //
 // Subclass of nsSMILAnimationFunction to support a few extra features offered
--- a/content/svg/content/src/SVGMotionSMILAttr.h
+++ b/content/svg/content/src/SVGMotionSMILAttr.h
@@ -36,16 +36,20 @@
  * ***** END LICENSE BLOCK ***** */
 
 /* representation of a dummy attribute targeted by <animateMotion> element */
 
 #ifndef MOZILLA_SVGMOTIONSMILATTR_H_
 #define MOZILLA_SVGMOTIONSMILATTR_H_
 
 #include "nsISMILAttr.h"
+
+class nsIContent;
+class nsISMILAnimationElement;
+class nsSMILValue;
 class nsSVGElement;
 
 namespace mozilla {
 
 /**
  * SVGMotionSMILAttr: Implements the nsISMILAttr interface for SMIL animations
  * from <animateMotion>.
  *
--- a/content/svg/content/src/SVGMotionSMILPathUtils.cpp
+++ b/content/svg/content/src/SVGMotionSMILPathUtils.cpp
@@ -36,16 +36,17 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "SVGMotionSMILPathUtils.h"
 #include "nsSVGElement.h"
 #include "SVGLength.h"
 #include "nsContentCreatorFunctions.h" // For NS_NewSVGElement
 #include "nsCharSeparatedTokenizer.h"
 #include "nsContentUtils.h"
+#include "nsSVGUtils.h"
 
 namespace mozilla {
 
 //----------------------------------------------------------------------
 // PathGenerator methods
 
 // For the dummy 'from' value used in pure by-animation & to-animation
 void
--- a/content/svg/content/src/SVGMotionSMILPathUtils.h
+++ b/content/svg/content/src/SVGMotionSMILPathUtils.h
@@ -36,28 +36,26 @@
  * ***** END LICENSE BLOCK ***** */
 
 /* Helper class to help with generating anonymous path elements for
    <animateMotion> elements to use. */
 
 #ifndef MOZILLA_SVGMOTIONSMILPATHUTILS_H_
 #define MOZILLA_SVGMOTIONSMILPATHUTILS_H_
 
-#include "nsSMILParserUtils.h"
-#include "nsAutoPtr.h"
-#include "nsTArray.h"
+#include "gfxContext.h"
+#include "gfxPlatform.h"
+#include "nsCOMPtr.h"
 #include "nsDebug.h"
-#include "gfxContext.h"
-#include "nsSVGUtils.h"
-#include "gfxPlatform.h"
+#include "nsSMILParserUtils.h"
+#include "nsTArray.h"
 
+class gfxFlattenedPath;
+class nsAString;
 class nsSVGElement;
-class nsIContent;
-class nsIDocument;
-class nsAString;
 
 namespace mozilla {
 
 class SVGMotionSMILPathUtils {
 public:
   // Class to assist in generating a gfxFlattenedPath, based on
   // coordinates in the <animateMotion> from/by/to/values attributes.
   class PathGenerator {
--- a/content/svg/content/src/SVGMotionSMILType.h
+++ b/content/svg/content/src/SVGMotionSMILType.h
@@ -35,22 +35,21 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 /* implementation of nsISMILType for use by <animateMotion> element */
 
 #ifndef MOZILLA_SVGMOTIONSMILTYPE_H_
 #define MOZILLA_SVGMOTIONSMILTYPE_H_
 
+#include "gfxMatrix.h"
 #include "nsISMILType.h"
-#include "gfxMatrix.h"
-#include "nsTArray.h"
-class nsSVGPathElement;
+
+class gfxFlattenedPath;
 class nsSMILValue;
-class gfxFlattenedPath;
 
 namespace mozilla {
 
 /**
  * MotionRotateType: Enum to indicate the type of our "rotate" attribute.
  */
 enum RotateType {
   eRotateType_Explicit,     // for e.g. rotate="45"/"45deg"/"0.785rad"
--- a/content/svg/content/src/SVGNumberList.h
+++ b/content/svg/content/src/SVGNumberList.h
@@ -32,18 +32,23 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_SVGNUMBERLIST_H__
 #define MOZILLA_SVGNUMBERLIST_H__
 
+#include "nsCOMPtr.h"
+#include "nsDebug.h"
+#include "nsIContent.h"
+#include "nsINode.h"
+#include "nsIWeakReferenceUtils.h"
+#include "nsSVGElement.h"
 #include "nsTArray.h"
-#include "nsSVGElement.h"
 
 namespace mozilla {
 
 /**
  * ATTENTION! WARNING! WATCH OUT!!
  *
  * Consumers that modify objects of this type absolutely MUST keep the DOM
  * wrappers for those lists (if any) in sync!! That's why this class is so
--- a/content/svg/content/src/SVGNumberPairSMILType.h
+++ b/content/svg/content/src/SVGNumberPairSMILType.h
@@ -34,16 +34,18 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_SVGNUMBERPAIRSMILTYPE_H_
 #define MOZILLA_SVGNUMBERPAIRSMILTYPE_H_
 
 #include "nsISMILType.h"
 
+class nsSMILValue;
+
 namespace mozilla {
 
 class SVGNumberPairSMILType : public nsISMILType
 {
 public:
   // Singleton for nsSMILValue objects to hold onto.
   static SVGNumberPairSMILType sSingleton;
 
--- a/content/svg/content/src/SVGOrientSMILType.h
+++ b/content/svg/content/src/SVGOrientSMILType.h
@@ -34,16 +34,18 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_SVGORIENTSMILTYPE_H_
 #define MOZILLA_SVGORIENTSMILTYPE_H_
 
 #include "nsISMILType.h"
 
+class nsSMILValue;
+
 /**
  * This nsISMILType class is a special case for the 'orient' attribute on SVG's
  * 'marker' element.
  *
  *   orient = "auto | <angle>"
  *
  * Unusually, this attribute doesn't have just a single corresponding DOM
  * property, but rather is split into two properties: 'orientType' (of type
--- a/content/svg/content/src/SVGPathData.h
+++ b/content/svg/content/src/SVGPathData.h
@@ -32,25 +32,31 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_SVGPATHDATA_H__
 #define MOZILLA_SVGPATHDATA_H__
 
-#include "SVGPathSegUtils.h"
+#include "nsCOMPtr.h"
+#include "nsDebug.h"
+#include "nsIContent.h"
+#include "nsINode.h"
+#include "nsIWeakReferenceUtils.h"
+#include "nsSVGElement.h"
 #include "nsTArray.h"
-#include "nsSVGElement.h"
-#include "nsIWeakReferenceUtils.h"
+
+#include <string.h>
 
 class gfxContext;
+class gfxFlattenedPath;
+class nsSVGPathDataParserToInternal; // IWYU pragma: keep
+
 struct gfxMatrix;
-class gfxFlattenedPath;
-class nsSVGPathDataParserToInternal;
 struct nsSVGMark;
 
 namespace mozilla {
 
 /**
  * ATTENTION! WARNING! WATCH OUT!!
  *
  * Consumers that modify objects of this type absolutely MUST keep the DOM
--- a/content/svg/content/src/SVGPathSegListSMILType.cpp
+++ b/content/svg/content/src/SVGPathSegListSMILType.cpp
@@ -31,16 +31,17 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "SVGPathSegListSMILType.h"
 #include "nsSMILValue.h"
+#include "SVGPathSegUtils.h"
 #include "SVGPathData.h"
 #include "mozilla/Util.h"
 #include <math.h>
 
 // Indices of boolean flags within 'arc' segment chunks in path-data arrays
 // (where '0' would correspond to the index of the encoded segment type):
 #define LARGE_ARC_FLAG_IDX 4
 #define SWEEP_FLAG_IDX     5
--- a/content/svg/content/src/SVGPathSegUtils.h
+++ b/content/svg/content/src/SVGPathSegUtils.h
@@ -32,21 +32,20 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_SVGPATHSEGUTILS_H__
 #define MOZILLA_SVGPATHSEGUTILS_H__
 
+#include "gfxPoint.h"
+#include "nsDebug.h"
 #include "nsIDOMSVGPathSeg.h"
-#include "nsIContent.h"
-#include "nsAString.h"
-#include "nsContentUtils.h"
-#include "gfxPoint.h"
+#include "nsMemory.h"
 
 #define NS_SVG_PATH_SEG_MAX_ARGS         7
 #define NS_SVG_PATH_SEG_FIRST_VALID_TYPE nsIDOMSVGPathSeg::PATHSEG_CLOSEPATH
 #define NS_SVG_PATH_SEG_LAST_VALID_TYPE  nsIDOMSVGPathSeg::PATHSEG_CURVETO_QUADRATIC_SMOOTH_REL
 #define NS_SVG_PATH_SEG_TYPE_COUNT       (NS_SVG_PATH_SEG_LAST_VALID_TYPE + 1)
 
 namespace mozilla {
 
--- a/content/svg/content/src/SVGPoint.h
+++ b/content/svg/content/src/SVGPoint.h
@@ -34,17 +34,16 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_SVGPOINT_H__
 #define MOZILLA_SVGPOINT_H__
 
 #include "nsDebug.h"
 #include "gfxPoint.h"
-#include "nsMathUtils.h"
 
 namespace mozilla {
 
 /**
  * This class is currently used for point list attributes.
  *
  * The DOM wrapper class for this class is DOMSVGPoint.
  */
--- a/content/svg/content/src/SVGPointList.h
+++ b/content/svg/content/src/SVGPointList.h
@@ -32,20 +32,26 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_SVGPOINTLIST_H__
 #define MOZILLA_SVGPOINTLIST_H__
 
-#include "SVGPoint.h"
+#include "nsCOMPtr.h"
+#include "nsDebug.h"
+#include "nsIContent.h"
+#include "nsINode.h"
+#include "nsIWeakReferenceUtils.h"
+#include "nsSVGElement.h"
 #include "nsTArray.h"
-#include "nsSVGElement.h"
-#include "nsIWeakReferenceUtils.h"
+#include "SVGPoint.h"
+
+#include <string.h>
 
 namespace mozilla {
 
 /**
  * ATTENTION! WARNING! WATCH OUT!!
  *
  * Consumers that modify objects of this type absolutely MUST keep the DOM
  * wrappers for those lists (if any) in sync!! That's why this class is so
--- a/content/svg/content/src/SVGStringList.h
+++ b/content/svg/content/src/SVGStringList.h
@@ -33,18 +33,19 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_SVGSTRINGLIST_H__
 #define MOZILLA_SVGSTRINGLIST_H__
 
+#include "nsDebug.h"
 #include "nsTArray.h"
-#include "nsSVGElement.h"
+#include "nsString.h" // IWYU pragma: keep
 
 namespace mozilla {
 
 /**
  *
  * The DOM wrapper class for this class is DOMSVGStringList.
  */
 class SVGStringList
--- a/content/svg/content/src/SVGTransform.h
+++ b/content/svg/content/src/SVGTransform.h
@@ -35,16 +35,17 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_SVGTRANSFORM_H__
 #define MOZILLA_SVGTRANSFORM_H__
 
 #include "gfxMatrix.h"
+#include "nsDebug.h"
 #include "nsIDOMSVGTransform.h"
 
 namespace mozilla {
 
 /*
  * The DOM wrapper class for this class is DOMSVGTransformMatrix.
  */
 class SVGTransform
--- a/content/svg/content/src/SVGTransformList.cpp
+++ b/content/svg/content/src/SVGTransformList.cpp
@@ -33,16 +33,18 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "SVGTransformList.h"
 #include "SVGTransformListParser.h"
+#include "nsString.h"
+#include "nsDOMError.h"
 
 namespace mozilla {
 
 gfxMatrix
 SVGTransformList::GetConsolidationMatrix() const
 {
   // To benefit from Return Value Optimization and avoid copy constructor calls
   // due to our use of return-by-value, we must return the exact same object
--- a/content/svg/content/src/SVGTransformList.h
+++ b/content/svg/content/src/SVGTransformList.h
@@ -34,19 +34,20 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_SVGTRANSFORMLIST_H__
 #define MOZILLA_SVGTRANSFORMLIST_H__
 
-#include "SVGTransform.h"
+#include "gfxMatrix.h"
+#include "nsDebug.h"
 #include "nsTArray.h"
-#include "nsSVGElement.h"
+#include "SVGTransform.h"
 
 namespace mozilla {
 
 /**
  * ATTENTION! WARNING! WATCH OUT!!
  *
  * Consumers that modify objects of this type absolutely MUST keep the DOM
  * wrappers for those lists (if any) in sync!! That's why this class is so
--- a/content/svg/content/src/SVGViewBoxSMILType.h
+++ b/content/svg/content/src/SVGViewBoxSMILType.h
@@ -34,16 +34,18 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef MOZILLA_SVGVIEWBOXSMILTYPE_H_
 #define MOZILLA_SVGVIEWBOXSMILTYPE_H_
 
 #include "nsISMILType.h"
 
+class nsSMILValue;
+
 namespace mozilla {
 
 class SVGViewBoxSMILType : public nsISMILType
 {
 public:
   // Singleton for nsSMILValue objects to hold onto.
   static SVGViewBoxSMILType sSingleton;
 
--- a/content/svg/content/src/nsDOMSVGEvent.h
+++ b/content/svg/content/src/nsDOMSVGEvent.h
@@ -33,18 +33,21 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGEVENT_H__
 #define __NS_SVGEVENT_H__
 
+#include "nsDOMEvent.h"
 #include "nsIDOMSVGEvent.h"
-#include "nsDOMEvent.h"
+
+class nsEvent;
+class nsPresContext;
 
 class nsDOMSVGEvent : public nsDOMEvent,
                       public nsIDOMSVGEvent
 {
 public:
   nsDOMSVGEvent(nsPresContext* aPresContext, nsEvent* aEvent);
 
   // nsISupports interface:
--- a/content/svg/content/src/nsDOMSVGZoomEvent.h
+++ b/content/svg/content/src/nsDOMSVGZoomEvent.h
@@ -33,19 +33,22 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGZOOMEVENT_H__
 #define __NS_SVGZOOMEVENT_H__
 
-#include "nsIDOMSVGZoomEvent.h"
+#include "nsAutoPtr.h"
 #include "nsDOMUIEvent.h"
-#include "nsIDOMSVGSVGElement.h"
+#include "nsIDOMSVGZoomEvent.h"
+
+class nsGUIEvent;
+class nsPresContext;
 
 namespace mozilla {
 class DOMSVGPoint;
 }
 
 class nsDOMSVGZoomEvent : public nsDOMUIEvent,
                           public nsIDOMSVGZoomEvent
 {
--- a/content/svg/content/src/nsSVGAElement.h
+++ b/content/svg/content/src/nsSVGAElement.h
@@ -33,24 +33,23 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef NS_SVGAELEMENT_H_
 #define NS_SVGAELEMENT_H_
 
-#include "nsSVGGraphicElement.h"
+#include "DOMSVGTests.h"
+#include "Link.h"
 #include "nsIDOMSVGAElement.h"
 #include "nsIDOMSVGURIReference.h"
 #include "nsILink.h"
+#include "nsSVGGraphicElement.h"
 #include "nsSVGString.h"
-#include "DOMSVGTests.h"
-
-#include "Link.h"
 
 typedef nsSVGGraphicElement nsSVGAElementBase;
 
 class nsSVGAElement : public nsSVGAElementBase,
                       public nsIDOMSVGAElement,
                       public DOMSVGTests,
                       public nsIDOMSVGURIReference,
                       public nsILink,
--- a/content/svg/content/src/nsSVGAngle.h
+++ b/content/svg/content/src/nsSVGAngle.h
@@ -32,21 +32,27 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGANGLE_H__
 #define __NS_SVGANGLE_H__
 
+#include "nsAutoPtr.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsDOMError.h"
+#include "nsError.h"
 #include "nsIDOMSVGAngle.h"
 #include "nsIDOMSVGAnimatedAngle.h"
+#include "nsISMILAttr.h"
 #include "nsSVGElement.h"
-#include "nsDOMError.h"
 
+class nsISMILAnimationElement;
+class nsSMILValue;
 class nsSVGOrientType;
 
 class nsSVGAngle
 {
   friend class DOMSVGAngle;
 
 public:
   void Init(PRUint8 aAttrEnum = 0xff,
--- a/content/svg/content/src/nsSVGAnimateMotionElement.h
+++ b/content/svg/content/src/nsSVGAnimateMotionElement.h
@@ -33,18 +33,18 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef NS_SVGANIMATEMOTIONELEMENT_H_
 #define NS_SVGANIMATEMOTIONELEMENT_H_
 
+#include "nsIDOMSVGAnimateMotionElement.h"
 #include "nsSVGAnimationElement.h"
-#include "nsIDOMSVGAnimateMotionElement.h"
 #include "nsSVGEnum.h"
 #include "SVGMotionSMILAnimationFunction.h"
 
 typedef nsSVGAnimationElement nsSVGAnimateMotionElementBase;
 
 class nsSVGAnimateMotionElement : public nsSVGAnimateMotionElementBase,
                                   public nsIDOMSVGAnimateMotionElement
 {
--- a/content/svg/content/src/nsSVGAnimationElement.h
+++ b/content/svg/content/src/nsSVGAnimationElement.h
@@ -34,24 +34,23 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef NS_SVGANIMATIONELEMENT_H_
 #define NS_SVGANIMATIONELEMENT_H_
 
-#include "nsSVGElement.h"
-#include "nsAutoPtr.h"
-#include "nsReferencedElement.h"
-#include "nsIDOMSVGAnimationElement.h"
 #include "DOMSVGTests.h"
 #include "nsIDOMElementTimeControl.h"
+#include "nsIDOMSVGAnimationElement.h"
 #include "nsISMILAnimationElement.h"
+#include "nsReferencedElement.h"
 #include "nsSMILTimedElement.h"
+#include "nsSVGElement.h"
 
 typedef nsSVGElement nsSVGAnimationElementBase;
 
 class nsSVGAnimationElement : public nsSVGAnimationElementBase,
                               public DOMSVGTests,
                               public nsISMILAnimationElement,
                               public nsIDOMElementTimeControl
 {
--- a/content/svg/content/src/nsSVGAttrTearoffTable.h
+++ b/content/svg/content/src/nsSVGAttrTearoffTable.h
@@ -30,16 +30,18 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef NS_SVGATTRTEAROFFTABLE_H_
 #define NS_SVGATTRTEAROFFTABLE_H_
 
 #include "nsDataHashtable.h"
+#include "nsDebug.h"
+#include "nsHashKeys.h"
 
 /**
  * Global hashmap to associate internal SVG data types (e.g. nsSVGLength2) with
  * DOM tear-off objects (e.g. nsIDOMSVGLength). This allows us to always return
  * the same object for subsequent requests for DOM objects.
  *
  * We don't keep an owning reference to the tear-off objects so they are
  * responsible for removing themselves from this table when they die.
--- a/content/svg/content/src/nsSVGBoolean.h
+++ b/content/svg/content/src/nsSVGBoolean.h
@@ -32,19 +32,26 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGBOOLEAN_H__
 #define __NS_SVGBOOLEAN_H__
 
+#include "nsAutoPtr.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsError.h"
 #include "nsIDOMSVGAnimatedBoolean.h"
+#include "nsISMILAttr.h"
+#include "nsISupportsImpl.h"
 #include "nsSVGElement.h"
-#include "nsDOMError.h"
+
+class nsISMILAnimationElement;
+class nsSMILValue;
 
 class nsSVGBoolean
 {
 
 public:
   void Init(PRUint8 aAttrEnum = 0xff, bool aValue = false) {
     mAnimVal = mBaseVal = aValue;
     mAttrEnum = aAttrEnum;
--- a/content/svg/content/src/nsSVGClass.h
+++ b/content/svg/content/src/nsSVGClass.h
@@ -32,23 +32,22 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGCLASS_H__
 #define __NS_SVGCLASS_H__
 
-#include "nsIDOMSVGAnimatedString.h"
 #include "nsAutoPtr.h"
 #include "nsCycleCollectionParticipant.h"
+#include "nsDOMError.h"
+#include "nsIDOMSVGAnimatedString.h"
+#include "nsISMILAttr.h"
 #include "nsString.h"
-#include "nsDOMError.h"
-
-#include "nsISMILAttr.h"
 
 class nsSVGStylableElement;
 
 class nsSVGClass
 {
 
 public:
   void Init() {
--- a/content/svg/content/src/nsSVGClipPathElement.h
+++ b/content/svg/content/src/nsSVGClipPathElement.h
@@ -32,21 +32,21 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGCLIPPATHELEMENT_H__
 #define __NS_SVGCLIPPATHELEMENT_H__
 
-#include "nsSVGGraphicElement.h"
+#include "DOMSVGTests.h"
 #include "nsIDOMSVGClipPathElement.h"
 #include "nsIDOMSVGUnitTypes.h"
-#include "DOMSVGTests.h"
 #include "nsSVGEnum.h"
+#include "nsSVGGraphicElement.h"
 
 typedef nsSVGGraphicElement nsSVGClipPathElementBase;
 
 class nsSVGClipPathElement : public nsSVGClipPathElementBase,
                              public nsIDOMSVGClipPathElement,
                              public DOMSVGTests,
                              public nsIDOMSVGUnitTypes
 {
--- a/content/svg/content/src/nsSVGDataParser.h
+++ b/content/svg/content/src/nsSVGDataParser.h
@@ -33,17 +33,19 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGDATAPARSER_H__
 #define __NS_SVGDATAPARSER_H__
 
-#include "nsCOMPtr.h"
+#include "nsError.h"
+
+class nsAString;
 
 //----------------------------------------------------------------------
 // helper macros
 #define ENSURE_MATCHED(exp) { nsresult rv = exp; if (NS_FAILED(rv)) return rv; }
 
 ////////////////////////////////////////////////////////////////////////
 // nsSVGDataParser: a simple abstract class for parsing values
 // for path and transform values.
--- a/content/svg/content/src/nsSVGElement.cpp
+++ b/content/svg/content/src/nsSVGElement.cpp
@@ -31,19 +31,20 @@
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
+#include "nsSVGElement.h"
+
 #include "mozilla/Util.h"
 
-#include "nsSVGElement.h"
 #include "nsSVGSVGElement.h"
 #include "nsIDocument.h"
 #include "nsRange.h"
 #include "nsIDOMAttr.h"
 #include "nsIDOMEventTarget.h"
 #include "nsIDOMMutationEvent.h"
 #include "nsMutationEvent.h"
 #include "nsXBLPrototypeBinding.h"
--- a/content/svg/content/src/nsSVGElement.h
+++ b/content/svg/content/src/nsSVGElement.h
@@ -39,52 +39,57 @@
 #ifndef __NS_SVGELEMENT_H__
 #define __NS_SVGELEMENT_H__
 
 /*
   nsSVGElement is the base class for all SVG content elements.
   It implements all the common DOM interfaces and handles attributes.
 */
 
-#include "nsString.h"
+#include "mozilla/css/StyleRule.h"
+#include "nsAutoPtr.h"
+#include "nsChangeHint.h"
 #include "nsCOMPtr.h"
-#include "nsIDOMSVGElement.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsDOMMemoryReporter.h"
+#include "nsError.h"
 #include "nsGenericElement.h"
+#include "nsISupportsImpl.h"
 #include "nsStyledElement.h"
-#include "mozilla/css/StyleRule.h"
 
-#include "nsISMILAttr.h"
-#include "nsSMILAnimationController.h"
-
-class nsSVGSVGElement;
+class nsIDOMSVGElement;
+class nsIDOMSVGSVGElement;
+class nsSVGAngle;
+class nsSVGBoolean;
+class nsSVGEnum;
+class nsSVGInteger;
+class nsSVGIntegerPair;
 class nsSVGLength2;
 class nsSVGNumber2;
 class nsSVGNumberPair;
-class nsSVGInteger;
-class nsSVGIntegerPair;
-class nsSVGAngle;
-class nsSVGBoolean;
-class nsSVGEnum;
-struct nsSVGEnumMapping;
+class nsSVGString;
+class nsSVGSVGElement;
 class nsSVGViewBox;
-class nsSVGString;
-struct gfxMatrix;
+
 namespace mozilla {
 class SVGAnimatedNumberList;
 class SVGNumberList;
 class SVGAnimatedLengthList;
 class SVGUserUnitList;
 class SVGAnimatedPointList;
 class SVGAnimatedPathSegList;
 class SVGAnimatedPreserveAspectRatio;
 class SVGAnimatedTransformList;
 class SVGStringList;
 class DOMSVGStringList;
 }
 
+struct gfxMatrix;
+struct nsSVGEnumMapping;
+
 typedef nsStyledElementNotElementCSSInlineStyle nsSVGElementBase;
 
 class nsSVGElement : public nsSVGElementBase    // nsIContent
 {
 protected:
   nsSVGElement(already_AddRefed<nsINodeInfo> aNodeInfo);
   nsresult Init();
   virtual ~nsSVGElement(){}
--- a/content/svg/content/src/nsSVGEnum.h
+++ b/content/svg/content/src/nsSVGEnum.h
@@ -32,19 +32,26 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGENUM_H__
 #define __NS_SVGENUM_H__
 
+#include "nsAutoPtr.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsError.h"
 #include "nsIDOMSVGAnimatedEnum.h"
+#include "nsISMILAttr.h"
 #include "nsSVGElement.h"
-#include "nsDOMError.h"
+
+class nsIAtom;
+class nsISMILAnimationElement;
+class nsSMILValue;
 
 typedef PRUint8 nsSVGEnumValue;
 
 struct nsSVGEnumMapping {
   nsIAtom **mKey;
   nsSVGEnumValue mVal;
 };
 
--- a/content/svg/content/src/nsSVGFilterElement.h
+++ b/content/svg/content/src/nsSVGFilterElement.h
@@ -32,24 +32,24 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGFILTERELEMENT_H__
 #define __NS_SVGFILTERELEMENT_H__
 
-#include "nsSVGGraphicElement.h"
+#include "DOMSVGTests.h"
 #include "nsIDOMSVGFilterElement.h"
-#include "nsIDOMSVGURIReference.h"
 #include "nsIDOMSVGUnitTypes.h"
-#include "DOMSVGTests.h"
+#include "nsIDOMSVGURIReference.h"
+#include "nsSVGEnum.h"
+#include "nsSVGGraphicElement.h"
+#include "nsSVGIntegerPair.h"
 #include "nsSVGLength2.h"
-#include "nsSVGIntegerPair.h"
-#include "nsSVGEnum.h"
 #include "nsSVGString.h"
 
 typedef nsSVGGraphicElement nsSVGFilterElementBase;
 
 class nsSVGFilterElement : public nsSVGFilterElementBase,
                            public nsIDOMSVGFilterElement,
                            public DOMSVGTests,
                            public nsIDOMSVGURIReference,
--- a/content/svg/content/src/nsSVGFilters.h
+++ b/content/svg/content/src/nsSVGFilters.h
@@ -32,30 +32,30 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGFILTERSELEMENT_H__
 #define __NS_SVGFILTERSELEMENT_H__
 
-#include "nsSVGStylableElement.h"
+#include "gfxImageSurface.h"
+#include "gfxRect.h"
+#include "nsIDOMSVGFilters.h"
+#include "nsIDOMSVGURIReference.h"
+#include "nsIFrame.h"
+#include "nsImageLoadingContent.h"
 #include "nsSVGLength2.h"
 #include "nsSVGString.h"
-#include "nsIFrame.h"
-#include "gfxRect.h"
-#include "gfxImageSurface.h"
-#include "nsIDOMSVGFilters.h"
-#include "nsImageLoadingContent.h"
-#include "nsIDOMSVGURIReference.h"
+#include "nsSVGStylableElement.h"
 #include "SVGAnimatedPreserveAspectRatio.h"
 
+class nsSVGFilterInstance;
 class nsSVGFilterResource;
 class nsSVGNumberPair;
-class nsSVGFilterInstance;
 
 struct nsSVGStringInfo {
   nsSVGStringInfo(const nsSVGString* aString,
                   nsSVGElement *aElement) :
     mString(aString), mElement(aElement) {}
 
   const nsSVGString* mString;
   nsSVGElement* mElement;
--- a/content/svg/content/src/nsSVGForeignObjectElement.h
+++ b/content/svg/content/src/nsSVGForeignObjectElement.h
@@ -34,19 +34,19 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGFOREIGNOBJECTELEMENT_H__
 #define __NS_SVGFOREIGNOBJECTELEMENT_H__
 
-#include "nsSVGGraphicElement.h"
+#include "DOMSVGTests.h"
 #include "nsIDOMSVGForeignObjectElem.h"
-#include "DOMSVGTests.h"
+#include "nsSVGGraphicElement.h"
 #include "nsSVGLength2.h"
 
 typedef nsSVGGraphicElement nsSVGForeignObjectElementBase;
 
 class nsSVGForeignObjectElement : public nsSVGForeignObjectElementBase,
                                   public nsIDOMSVGForeignObjectElement,
                                   public DOMSVGTests
 {
--- a/content/svg/content/src/nsSVGGraphicElement.h
+++ b/content/svg/content/src/nsSVGGraphicElement.h
@@ -34,21 +34,21 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGGRAPHICELEMENT_H__
 #define __NS_SVGGRAPHICELEMENT_H__
 
-#include "nsSVGStylableElement.h"
+#include "gfxMatrix.h"
 #include "nsIDOMSVGLocatable.h"
 #include "nsIDOMSVGTransformable.h"
+#include "nsSVGStylableElement.h"
 #include "SVGAnimatedTransformList.h"
-#include "gfxMatrix.h"
 
 typedef nsSVGStylableElement nsSVGGraphicElementBase;
 
 class nsSVGGraphicElement : public nsSVGGraphicElementBase,
                             public nsIDOMSVGTransformable // : nsIDOMSVGLocatable
 {
 protected:
   nsSVGGraphicElement(already_AddRefed<nsINodeInfo> aNodeInfo);
--- a/content/svg/content/src/nsSVGImageElement.h
+++ b/content/svg/content/src/nsSVGImageElement.h
@@ -34,22 +34,22 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGIMAGEELEMENT_H__
 #define __NS_SVGIMAGEELEMENT_H__
 
-#include "nsSVGPathGeometryElement.h"
 #include "nsIDOMSVGImageElement.h"
 #include "nsIDOMSVGURIReference.h"
 #include "nsImageLoadingContent.h"
+#include "nsSVGLength2.h"
+#include "nsSVGPathGeometryElement.h"
 #include "nsSVGString.h"
-#include "nsSVGLength2.h"
 #include "SVGAnimatedPreserveAspectRatio.h"
 
 typedef nsSVGPathGeometryElement nsSVGImageElementBase;
 
 class nsSVGImageElement : public nsSVGImageElementBase,
                           public nsIDOMSVGImageElement,
                           public nsIDOMSVGURIReference,
                           public nsImageLoadingContent
--- a/content/svg/content/src/nsSVGInteger.h
+++ b/content/svg/content/src/nsSVGInteger.h
@@ -32,19 +32,25 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGINTEGER_H__
 #define __NS_SVGINTEGER_H__
 
+#include "nsAutoPtr.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsError.h"
 #include "nsIDOMSVGAnimatedInteger.h"
+#include "nsISMILAttr.h"
 #include "nsSVGElement.h"
-#include "nsDOMError.h"
+
+class nsISMILAnimationElement;
+class nsSMILValue;
 
 class nsSVGInteger
 {
 
 public:
   void Init(PRUint8 aAttrEnum = 0xff, PRInt32 aValue = 0) {
     mAnimVal = mBaseVal = aValue;
     mAttrEnum = aAttrEnum;
--- a/content/svg/content/src/nsSVGIntegerPair.h
+++ b/content/svg/content/src/nsSVGIntegerPair.h
@@ -32,23 +32,25 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGINTEGERPAIR_H__
 #define __NS_SVGINTEGERPAIR_H__
 
+#include "nsAutoPtr.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsError.h"
 #include "nsIDOMSVGAnimatedInteger.h"
+#include "nsISMILAttr.h"
 #include "nsSVGElement.h"
-#include "nsDOMError.h"
 
-#include "nsISMILAttr.h"
+class nsISMILAnimationElement;
 class nsSMILValue;
-class nsISMILType;
 
 class nsSVGIntegerPair
 {
 
 public:
   enum PairIndex {
     eFirst,
     eSecond
--- a/content/svg/content/src/nsSVGLength2.h
+++ b/content/svg/content/src/nsSVGLength2.h
@@ -32,28 +32,32 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGLENGTH2_H__
 #define __NS_SVGLENGTH2_H__
 
-#include "nsIDOMSVGLength.h"
-#include "nsIDOMSVGAnimatedLength.h"
-#include "nsSVGUtils.h"
-#include "nsSVGElement.h"
+#include "nsAutoPtr.h"
+#include "nsCoord.h"
+#include "nsCycleCollectionParticipant.h"
 #include "nsDOMError.h"
-#include "nsMathUtils.h"
-
+#include "nsError.h"
+#include "nsIDOMSVGAnimatedLength.h"
+#include "nsIDOMSVGLength.h"
 #include "nsISMILAttr.h"
-class nsSMILValue;
-class nsISMILType;
+#include "nsMathUtils.h"
+#include "nsSVGElement.h"
+#include "nsSVGUtils.h"
 
 class nsIFrame;
+class nsISMILAnimationElement;
+class nsSMILValue;
+class nsSVGSVGElement;
 
 class nsSVGLength2
 {
 
 public:
   void Init(PRUint8 aCtxType = nsSVGUtils::XY,
             PRUint8 aAttrEnum = 0xff,
             float aValue = 0,
--- a/content/svg/content/src/nsSVGMarkerElement.h
+++ b/content/svg/content/src/nsSVGMarkerElement.h
@@ -32,25 +32,25 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGMARKERELEMENT_H__
 #define __NS_SVGMARKERELEMENT_H__
 
-#include "nsSVGGraphicElement.h"
-#include "nsIDOMSVGMarkerElement.h"
+#include "gfxMatrix.h"
 #include "nsIDOMSVGFitToViewBox.h"
-#include "nsSVGLength2.h"
+#include "nsIDOMSVGMarkerElement.h"
+#include "nsSVGAngle.h"
 #include "nsSVGEnum.h"
-#include "nsSVGAngle.h"
+#include "nsSVGGraphicElement.h"
+#include "nsSVGLength2.h"
 #include "nsSVGViewBox.h"
 #include "SVGAnimatedPreserveAspectRatio.h"
-#include "gfxMatrix.h"
 
 class nsSVGOrientType
 {
 public:
   nsSVGOrientType()
    : mAnimVal(nsIDOMSVGMarkerElement::SVG_MARKER_ORIENT_ANGLE),
      mBaseVal(nsIDOMSVGMarkerElement::SVG_MARKER_ORIENT_ANGLE) {}
 
--- a/content/svg/content/src/nsSVGMaskElement.h
+++ b/content/svg/content/src/nsSVGMaskElement.h
@@ -32,22 +32,22 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGMASKELEMENT_H__
 #define __NS_SVGMASKELEMENT_H__
 
-#include "nsSVGStylableElement.h"
+#include "DOMSVGTests.h"
 #include "nsIDOMSVGMaskElement.h"
-#include "DOMSVGTests.h"
 #include "nsIDOMSVGUnitTypes.h"
+#include "nsSVGEnum.h"
 #include "nsSVGLength2.h"
-#include "nsSVGEnum.h"
+#include "nsSVGStylableElement.h"
 
 //--------------------- Masks ------------------------
 
 typedef nsSVGStylableElement nsSVGMaskElementBase;
 
 class nsSVGMaskElement : public nsSVGMaskElementBase,
                          public nsIDOMSVGMaskElement,
                          public DOMSVGTests,
--- a/content/svg/content/src/nsSVGMpathElement.cpp
+++ b/content/svg/content/src/nsSVGMpathElement.cpp
@@ -37,16 +37,17 @@
 
 #include "mozilla/Util.h"
 
 #include "nsSVGMpathElement.h"
 #include "nsAutoPtr.h"
 #include "nsDebug.h"
 #include "nsSVGPathElement.h"
 #include "nsSVGAnimateMotionElement.h"
+#include "nsContentUtils.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
 
 nsSVGElement::StringInfo nsSVGMpathElement::sStringInfo[1] =
 {
   { &nsGkAtoms::href, kNameSpaceID_XLink, false }
 };
--- a/content/svg/content/src/nsSVGNumber2.cpp
+++ b/content/svg/content/src/nsSVGNumber2.cpp
@@ -37,16 +37,17 @@
 #include "nsSVGNumber2.h"
 #include "nsSVGUtils.h"
 #include "nsTextFormatter.h"
 #include "prdtoa.h"
 #include "nsMathUtils.h"
 #include "nsContentUtils.h" // NS_ENSURE_FINITE
 #include "nsSMILValue.h"
 #include "nsSMILFloatType.h"
+#include "nsIDOMSVGNumber.h"
 
 class DOMSVGNumber : public nsIDOMSVGNumber
 {
 public:
   NS_DECL_ISUPPORTS
 
   DOMSVGNumber() 
     : mVal(0) {}
--- a/content/svg/content/src/nsSVGNumber2.h
+++ b/content/svg/content/src/nsSVGNumber2.h
@@ -32,25 +32,26 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGNUMBER2_H__
 #define __NS_SVGNUMBER2_H__
 
-#include "nsIDOMSVGNumber.h"
+#include "nsAutoPtr.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsError.h"
 #include "nsIDOMSVGAnimatedNumber.h"
-#include "nsSVGElement.h"
-#include "nsDOMError.h"
+#include "nsISMILAttr.h"
 #include "nsMathUtils.h"
+#include "nsSVGElement.h"
 
-#include "nsISMILAttr.h"
+class nsISMILAnimationElement;
 class nsSMILValue;
-class nsISMILType;
 
 class nsSVGNumber2
 {
 
 public:
   void Init(PRUint8 aAttrEnum = 0xff, float aValue = 0) {
     mAnimVal = mBaseVal = aValue;
     mAttrEnum = aAttrEnum;
--- a/content/svg/content/src/nsSVGNumberPair.h
+++ b/content/svg/content/src/nsSVGNumberPair.h
@@ -32,25 +32,26 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGNUMBERPAIR_H__
 #define __NS_SVGNUMBERPAIR_H__
 
-#include "nsIDOMSVGNumber.h"
+#include "nsAutoPtr.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsError.h"
 #include "nsIDOMSVGAnimatedNumber.h"
-#include "nsSVGElement.h"
-#include "nsDOMError.h"
+#include "nsISMILAttr.h"
 #include "nsMathUtils.h"
+#include "nsSVGElement.h"
 
-#include "nsISMILAttr.h"
+class nsISMILAnimationElement;
 class nsSMILValue;
-class nsISMILType;
 
 class nsSVGNumberPair
 {
 
 public:
   enum PairIndex {
     eFirst,
     eSecond
--- a/content/svg/content/src/nsSVGPathDataParser.cpp
+++ b/content/svg/content/src/nsSVGPathDataParser.cpp
@@ -36,16 +36,17 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsSVGPathDataParser.h"
 #include "nsSVGDataParser.h"
 #include "nsSVGPathElement.h"
 #include "prdtoa.h"
 #include "nsSVGUtils.h"
+#include "nsIDOMSVGPathSeg.h"
 #include <stdlib.h>
 #include <math.h>
 
 using namespace mozilla;
 
 nsresult nsSVGPathDataParser::Match()
 {
   return MatchSvgPath();
--- a/content/svg/content/src/nsSVGPathDataParser.h
+++ b/content/svg/content/src/nsSVGPathDataParser.h
@@ -34,24 +34,18 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGPATHDATAPARSER_H__
 #define __NS_SVGPATHDATAPARSER_H__
 
+#include "gfxPoint.h"
 #include "nsSVGDataParser.h"
-#include "nsCOMPtr.h"
-#include "nsCOMArray.h"
-#include "nsIDOMSVGPathSeg.h"
-#include "nsTArray.h"
-#include "gfxPoint.h"
-
-class nsSVGPathList;
 
 namespace mozilla {
 class SVGPathData;
 }
 
 ////////////////////////////////////////////////////////////////////////
 // nsSVGPathDataParser: a simple recursive descent parser that builds
 // nsIDOMSVGPathSegs from path data strings. The grammar for path data
--- a/content/svg/content/src/nsSVGPathElement.cpp
+++ b/content/svg/content/src/nsSVGPathElement.cpp
@@ -39,16 +39,17 @@
 #include "mozilla/Util.h"
 
 #include "nsGkAtoms.h"
 #include "nsIDOMSVGPathSeg.h"
 #include "DOMSVGPathSeg.h"
 #include "DOMSVGPathSegList.h"
 #include "nsCOMPtr.h"
 #include "nsIFrame.h"
+#include "nsContentUtils.h"
 #include "nsSVGPathDataParser.h"
 #include "nsSVGPathElement.h"
 #include "nsSVGUtils.h"
 #include "DOMSVGPoint.h"
 #include "gfxContext.h"
 #include "gfxPlatform.h"
 
 using namespace mozilla;
--- a/content/svg/content/src/nsSVGPathElement.h
+++ b/content/svg/content/src/nsSVGPathElement.h
@@ -34,22 +34,21 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGPATHELEMENT_H__
 #define __NS_SVGPATHELEMENT_H__
 
-#include "nsSVGPathGeometryElement.h"
+#include "nsIDOMSVGAnimatedPathData.h"
 #include "nsIDOMSVGPathElement.h"
-#include "nsIDOMSVGAnimatedPathData.h"
 #include "nsSVGNumber2.h"
+#include "nsSVGPathGeometryElement.h"
 #include "SVGAnimatedPathSegList.h"
-#include "gfxPath.h"
 
 class gfxContext;
 
 typedef nsSVGPathGeometryElement nsSVGPathElementBase;
 
 class nsSVGPathElement : public nsSVGPathElementBase,
                          public nsIDOMSVGPathElement,
                          public nsIDOMSVGAnimatedPathData
--- a/content/svg/content/src/nsSVGPathGeometryElement.h
+++ b/content/svg/content/src/nsSVGPathGeometryElement.h
@@ -32,21 +32,20 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGPATHGEOMETRYELEMENT_H__
 #define __NS_SVGPATHGEOMETRYELEMENT_H__
 
+#include "DOMSVGTests.h"
+#include "gfxMatrix.h"
 #include "nsSVGGraphicElement.h"
-#include "DOMSVGTests.h"
 #include "nsTArray.h"
-#include "gfxPath.h"
-#include "gfxMatrix.h"
 
 struct nsSVGMark {
   float x, y, angle;
   nsSVGMark(float aX, float aY, float aAngle) :
     x(aX), y(aY), angle(aAngle) {}
 };
 
 class gfxContext;
--- a/content/svg/content/src/nsSVGPatternElement.h
+++ b/content/svg/content/src/nsSVGPatternElement.h
@@ -34,25 +34,25 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGPATTERNELEMENT_H__
 #define __NS_SVGPATTERNELEMENT_H__
 
-#include "nsSVGStylableElement.h"
-#include "nsIDOMSVGURIReference.h"
+#include "DOMSVGTests.h"
 #include "nsIDOMSVGFitToViewBox.h"
 #include "nsIDOMSVGPatternElement.h"
-#include "DOMSVGTests.h"
 #include "nsIDOMSVGUnitTypes.h"
+#include "nsIDOMSVGURIReference.h"
+#include "nsSVGEnum.h"
 #include "nsSVGLength2.h"
-#include "nsSVGEnum.h"
 #include "nsSVGString.h"
+#include "nsSVGStylableElement.h"
 #include "nsSVGViewBox.h"
 #include "SVGAnimatedPreserveAspectRatio.h"
 #include "SVGAnimatedTransformList.h"
 
 //--------------------- Patterns ------------------------
 
 typedef nsSVGStylableElement nsSVGPatternElementBase;
 
--- a/content/svg/content/src/nsSVGPolyElement.h
+++ b/content/svg/content/src/nsSVGPolyElement.h
@@ -32,18 +32,18 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef NS_SVGPOLYELEMENT_H_
 #define NS_SVGPOLYELEMENT_H_
 
+#include "nsIDOMSVGAnimatedPoints.h"
 #include "nsSVGPathGeometryElement.h"
-#include "nsIDOMSVGAnimatedPoints.h"
 #include "SVGAnimatedPointList.h"
 
 typedef nsSVGPathGeometryElement nsSVGPolyElementBase;
 
 class gfxContext;
 
 class nsSVGPolyElement : public nsSVGPolyElementBase,
                          public nsIDOMSVGAnimatedPoints
--- a/content/svg/content/src/nsSVGRect.h
+++ b/content/svg/content/src/nsSVGRect.h
@@ -35,18 +35,18 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGRECT_H__
 #define __NS_SVGRECT_H__
 
+#include "gfxRect.h"
 #include "nsIDOMSVGRect.h"
-#include "gfxRect.h"
 
 nsresult
 NS_NewSVGRect(nsIDOMSVGRect** result,
               float x=0.0f, float y=0.0f,
               float width=0.0f, float height=0.0f);
 
 nsresult
 NS_NewSVGRect(nsIDOMSVGRect** result, const gfxRect& rect);
--- a/content/svg/content/src/nsSVGSVGElement.h
+++ b/content/svg/content/src/nsSVGSVGElement.h
@@ -35,30 +35,30 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGSVGELEMENT_H__
 #define __NS_SVGSVGELEMENT_H__
 
-#include "nsSVGStylableElement.h"
-#include "nsIDOMSVGSVGElement.h"
 #include "DOMSVGTests.h"
+#include "mozilla/dom/FromParser.h"
 #include "nsIDOMSVGFitToViewBox.h"
 #include "nsIDOMSVGLocatable.h"
+#include "nsIDOMSVGPoint.h"
+#include "nsIDOMSVGSVGElement.h"
 #include "nsIDOMSVGZoomAndPan.h"
-#include "nsIDOMSVGMatrix.h"
-#include "nsIDOMSVGPoint.h"
+#include "nsSVGEnum.h"
 #include "nsSVGLength2.h"
-#include "nsSVGEnum.h"
+#include "nsSVGStylableElement.h"
 #include "nsSVGViewBox.h"
 #include "SVGAnimatedPreserveAspectRatio.h"
-#include "mozilla/dom/FromParser.h"
 
+class nsIDOMSVGMatrix;
 class nsSMILTimeContainer;
 
 typedef nsSVGStylableElement nsSVGSVGElementBase;
 
 class nsSVGSVGElement;
 
 class nsSVGTranslatePoint {
 public:
--- a/content/svg/content/src/nsSVGString.h
+++ b/content/svg/content/src/nsSVGString.h
@@ -32,19 +32,19 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGSTRING_H__
 #define __NS_SVGSTRING_H__
 
+#include "nsDOMError.h"
 #include "nsIDOMSVGAnimatedString.h"
 #include "nsSVGElement.h"
-#include "nsDOMError.h"
 
 class nsSVGString
 {
 
 public:
   void Init(PRUint8 aAttrEnum) {
     mAnimVal = nsnull;
     mAttrEnum = aAttrEnum;
--- a/content/svg/content/src/nsSVGStylableElement.h
+++ b/content/svg/content/src/nsSVGStylableElement.h
@@ -34,20 +34,20 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGSTYLABLEELEMENT_H__
 #define __NS_SVGSTYLABLEELEMENT_H__
 
-#include "nsSVGElement.h"
+#include "nsAutoPtr.h"
 #include "nsIDOMSVGStylable.h"
 #include "nsSVGClass.h"
-#include "nsAutoPtr.h"
+#include "nsSVGElement.h"
 
 typedef nsSVGElement nsSVGStylableElementBase;
 
 class nsSVGStylableElement : public nsSVGStylableElementBase,
                              public nsIDOMSVGStylable
 {
 protected:
   nsSVGStylableElement(already_AddRefed<nsINodeInfo> aNodeInfo);
--- a/content/svg/content/src/nsSVGSwitchElement.h
+++ b/content/svg/content/src/nsSVGSwitchElement.h
@@ -34,19 +34,19 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGSWITCHELEMENT_H__
 #define __NS_SVGSWITCHELEMENT_H__
 
-#include "nsSVGGraphicElement.h"
+#include "DOMSVGTests.h"
 #include "nsIDOMSVGSwitchElement.h"
-#include "DOMSVGTests.h"
+#include "nsSVGGraphicElement.h"
 
 typedef nsSVGGraphicElement nsSVGSwitchElementBase;
 
 class nsSVGSwitchElement : public nsSVGSwitchElementBase,
                            public nsIDOMSVGSwitchElement,
                            public DOMSVGTests
 {
   friend class nsSVGSwitchFrame;
--- a/content/svg/content/src/nsSVGTextContentElement.h
+++ b/content/svg/content/src/nsSVGTextContentElement.h
@@ -34,20 +34,20 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGTEXTCONTENTELEMENTBASE_H__
 #define __NS_SVGTEXTCONTENTELEMENTBASE_H__
 
+#include "DOMSVGTests.h"
 #include "nsIDOMSVGTextContentElement.h"
+#include "nsSVGStylableElement.h"
 #include "nsSVGTextContainerFrame.h"
-#include "nsSVGStylableElement.h"
-#include "DOMSVGTests.h"
 
 typedef nsSVGStylableElement nsSVGTextContentElementBase;
 
 /**
  * Note that nsSVGTextElement does not inherit nsSVGTextPositioningElement, or
  * this class - it reimplements us instead (see its documenting comment). The
  * upshot is that any changes to this class also need to be made in
  * nsSVGTextElement.
--- a/content/svg/content/src/nsSVGTextPathElement.h
+++ b/content/svg/content/src/nsSVGTextPathElement.h
@@ -33,21 +33,33 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGTEXTPATHELEMENT_H__
 #define __NS_SVGTEXTPATHELEMENT_H__
 
+#include "nsIDOMElement.h"
+#include "nsIDOMNode.h"
+#include "nsIDOMSVGElement.h"
+#include "nsIDOMSVGTextContentElement.h"
+#include "nsIDOMSVGTextPathElement.h"
+#include "nsIDOMSVGURIReference.h"
 #include "nsSVGEnum.h"
 #include "nsSVGLength2.h"
 #include "nsSVGString.h"
 #include "nsSVGTextContentElement.h"
 
+class nsIAtom;
+class nsIContent;
+class nsINode;
+class nsINodeInfo;
+class nsXPCClassInfo;
+
 typedef nsSVGTextContentElement nsSVGTextPathElementBase;
 
 class nsSVGTextPathElement : public nsSVGTextPathElementBase, // = nsIDOMSVGTextContentElement
                              public nsIDOMSVGTextPathElement,
                              public nsIDOMSVGURIReference
 {
 friend class nsSVGTextPathFrame;
 
--- a/content/svg/content/src/nsSVGTextPositioningElement.h
+++ b/content/svg/content/src/nsSVGTextPositioningElement.h
@@ -33,18 +33,18 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGTEXTPOSITIONINGELEMENTBASE_H__
 #define __NS_SVGTEXTPOSITIONINGELEMENTBASE_H__
 
 #include "nsIDOMSVGTextPositionElem.h"
 #include "nsSVGTextContentElement.h"
+#include "SVGAnimatedLengthList.h"
 #include "SVGAnimatedNumberList.h"
-#include "SVGAnimatedLengthList.h"
 
 class nsSVGElement;
 
 namespace mozilla {
 class SVGAnimatedLengthList;
 }
 
 typedef nsSVGTextContentElement nsSVGTextPositioningElementBase;
--- a/content/svg/content/src/nsSVGUseElement.h
+++ b/content/svg/content/src/nsSVGUseElement.h
@@ -32,27 +32,26 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGUSEELEMENT_H__
 #define __NS_SVGUSEELEMENT_H__
 
-#include "nsIDOMSVGAnimatedString.h"
+#include "DOMSVGTests.h"
+#include "mozilla/dom/FromParser.h"
 #include "nsIDOMSVGURIReference.h"
 #include "nsIDOMSVGUseElement.h"
-#include "DOMSVGTests.h"
+#include "nsReferencedElement.h"
 #include "nsStubMutationObserver.h"
 #include "nsSVGGraphicElement.h"
 #include "nsSVGLength2.h"
 #include "nsSVGString.h"
 #include "nsTArray.h"
-#include "nsReferencedElement.h"
-#include "mozilla/dom/FromParser.h"
 
 class nsIContent;
 class nsINodeInfo;
 
 #define NS_SVG_USE_ELEMENT_IMPL_CID \
 { 0x55fb86fe, 0xd81f, 0x4ae4, \
   { 0x80, 0x3f, 0xeb, 0x90, 0xfe, 0xe0, 0x7a, 0xe9 } }
 
--- a/content/svg/content/src/nsSVGViewBox.h
+++ b/content/svg/content/src/nsSVGViewBox.h
@@ -34,20 +34,27 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __NS_SVGVIEWBOX_H__
 #define __NS_SVGVIEWBOX_H__
 
-#include "nsIDOMSVGRect.h"
+#include "nsAutoPtr.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsDOMError.h"
+#include "nsError.h"
 #include "nsIDOMSVGAnimatedRect.h"
+#include "nsIDOMSVGRect.h"
+#include "nsISMILAttr.h"
 #include "nsSVGElement.h"
-#include "nsDOMError.h"
+
+class nsISMILAnimationElement;
+class nsSMILValue;
 
 struct nsSVGViewBoxRect
 {
   float x, y;
   float width, height;
 
   nsSVGViewBoxRect() : x(0), y(0), width(0), height(0) {}
   nsSVGViewBoxRect(float aX, float aY, float aWidth, float aHeight) :
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -4574,17 +4574,17 @@ nsGlobalWindow::Dump(const nsAString& aS
     if (*c == '\r')
       *c = '\n';
     c++;
   }
 #endif
 
   if (cstr) {
 #ifdef ANDROID
-    __android_log_print(ANDROID_LOG_INFO, "Gecko", cstr);
+    __android_log_write(ANDROID_LOG_INFO, "GeckoDump", cstr);
 #endif
     FILE *fp = gDumpFile ? gDumpFile : stdout;
     fputs(cstr, fp);
     fflush(fp);
     nsMemory::Free(cstr);
   }
 
   return NS_OK;
--- a/dom/base/nsHistory.cpp
+++ b/dom/base/nsHistory.cpp
@@ -168,16 +168,19 @@ nsHistory::GetPrevious(nsAString& aPrevi
   CopyUTF8toUTF16(prevURL, aPrevious);
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsHistory::GetNext(nsAString& aNext)
 {
+  if (!nsContentUtils::IsCallerTrustedForRead())
+    return NS_ERROR_DOM_SECURITY_ERR;
+
   PRInt32 curIndex;
   nsCAutoString nextURL;
   nsCOMPtr<nsISHistory>  sHistory;
 
   // Get session History from docshell
   GetSessionHistoryFromDocShell(GetDocShell(), getter_AddRefs(sHistory));
   NS_ENSURE_TRUE(sHistory, NS_ERROR_FAILURE);
 
--- a/dom/locales/en-US/chrome/accessibility/mac/accessible.properties
+++ b/dom/locales/en-US/chrome/accessibility/mac/accessible.properties
@@ -11,8 +11,10 @@ collapse=       Collapse
 expand  =       Expand
 activate=       Activate
 cycle   =       Cycle
 
 # Universal Access API support
 # (Mac Only)
 # The Role Description for AXWebArea (the web widget). Like in Safari.
 htmlContent = HTML Content
+# The Role Description for the Tab button.
+tab     =       tab
--- a/dom/locales/en-US/chrome/dom/dom.properties
+++ b/dom/locales/en-US/chrome/dom/dom.properties
@@ -130,16 +130,17 @@ FullScreenDeniedNotDescendant=Request fo
 FullScreenDeniedNotFocusedTab=Request for full-screen was denied because requesting element is not in the currently focused tab.
 RemovedFullScreenElement=Exited full-screen because full-screen element was removed from document.
 FocusedWindowedPluginWhileFullScreen=Exited full-screen because windowed plugin was focused.
 HTMLMultipartXHRWarning=HTML parsing in XMLHttpRequest is not supported for multipart responses.
 HTMLSyncXHRWarning=HTML parsing in XMLHttpRequest is not supported in the synchronous mode.
 InvalidRedirectChannelWarning=Unable to redirect to %S because the channel doesn't implement nsIWritablePropertyBag2.
 ResponseTypeSyncXHRWarning=Use of XMLHttpRequest's responseType attribute is no longer supported in the synchronous mode in window context.
 WithCredentialsSyncXHRWarning=Use of XMLHttpRequest's withCredentials attribute is no longer supported in the synchronous mode in window context.
+TimeoutSyncXHRWarning=Use of XMLHttpRequest's timeout attribute is not supported in the synchronous mode in window context.
 JSONCharsetWarning=An attempt was made to declare a non-UTF-8 encoding for JSON retrieved using XMLHttpRequest. Only UTF-8 is supported for decoding JSON.
 MediaLoadExhaustedCandidates=All candidate resources failed to load. Media load paused.
 MediaLoadSourceMissingSrc=<source> element has no "src" attribute. Media resource load failed.
 # LOCALIZATION NOTE: %1$S is the Http error code the server returned (e.g. 404, 500, etc), %2$S is the URL of the media resource which failed to load.
 MediaLoadHttpError=HTTP load failed with status %1$S. Load of media resource %2$S failed.
 # LOCALIZATION NOTE: %S is the URL of the media resource which failed to load.
 MediaLoadInvalidURI=Invalid URI. Load of media resource %S failed.
 # LOCALIZATION NOTE: %1$S is the media resource's format/codec type (basically equivalent to the file type, e.g. MP4,AVI,WMV,MOV etc), %2$S is the URL of the media resource which failed to load.
--- a/dom/tests/mochitest/bugs/Makefile.in
+++ b/dom/tests/mochitest/bugs/Makefile.in
@@ -138,16 +138,17 @@ include $(topsrcdir)/config/rules.mk
 		test_bug617296.html \
 		test_bug620947.html \
 		test_bug622361.html \
 		test_bug633133.html \
 		test_bug641552.html \
 		test_bug642026.html \
 		test_bug648465.html \
 		test_bug654137.html \
+		test_bug664737.html \
 		test_bug684544.html \
 		test_bug698551.html \
 		test_window_bar.html \
 		file_window_bar.html \
 		test_resize_move_windows.html \
 		test_devicemotion_multiple_listeners.html \
 		devicemotion_outer.html \
 		devicemotion_inner.html \
new file mode 100644
--- /dev/null
+++ b/dom/tests/mochitest/bugs/test_bug664737.html
@@ -0,0 +1,39 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=664737
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 664737</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=664737">Mozilla Bug 664737</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 664737 **/
+function shouldfail(name) {
+    try {
+        var rv = history[name];
+        fail(false, "able to access history." + name);
+    } catch (e) {
+        ok(e.message.indexOf("Permission denied") >= 0, "cannot access history." + name);
+    }
+}
+
+shouldfail("current");
+shouldfail("previous");
+shouldfail("next");
+
+
+</script>
+</pre>
+</body>
+</html>
--- a/dom/tests/mochitest/general/Makefile.in
+++ b/dom/tests/mochitest/general/Makefile.in
@@ -75,16 +75,17 @@ include $(topsrcdir)/config/rules.mk
 		file_moving_xhr.html \
 		test_vibrator.html \
 		browserFrameHelpers.js \
 		test_browserFrame1.html \
 		test_browserFrame2.html \
 		test_browserFrame3.html \
 		test_browserFrame4.html \
 		test_browserFrame5.html \
+		test_browserFrame6.html \
 		$(NULL)
 
 _CHROME_FILES = \
 		test_innerScreen.xul \
 		test_offsets.xul \
 		test_offsets.js \
 		$(NULL)
 
--- a/dom/tests/mochitest/general/test_browserFrame2.html
+++ b/dom/tests/mochitest/general/test_browserFrame2.html
@@ -20,29 +20,30 @@ https://bugzilla.mozilla.org/show_bug.cg
 <script type="application/javascript;version=1.7">
 "use strict";
 
 SimpleTest.waitForExplicitFinish();
 
 function runTest() {
   browserFrameHelpers.setEnabledPref(false);
 
-  var iframe = document.getElementById('iframe');
+  var iframe = document.createElement('iframe');
+  iframe.mozbrowser = true;
+  document.body.appendChild(iframe);
+
   iframe.addEventListener('mozbrowserloadstart', function() {
     ok(false, 'Should not send mozbrowserloadstart event.');
   });
 
   iframe.addEventListener('load', function() {
     ok(true, 'Got iframe load event.');
     SimpleTest.finish();
   });
 
   iframe.src = 'http://example.com';
 }
 
 addEventListener('load', function() { SimpleTest.executeSoon(runTest); });
 
 </script>
 
-<iframe id='iframe' mozbrowser></iframe>
-
 </body>
 </html>
--- a/dom/tests/mochitest/general/test_browserFrame3.html
+++ b/dom/tests/mochitest/general/test_browserFrame3.html
@@ -21,29 +21,30 @@ https://bugzilla.mozilla.org/show_bug.cg
 "use strict";
 
 SimpleTest.waitForExplicitFinish();
 
 function runTest() {
   browserFrameHelpers.setEnabledPref(true);
   browserFrameHelpers.setWhitelistPref(' http://foobar.com');
 
-  var iframe = document.getElementById('iframe');
+  var iframe = document.createElement('iframe');
+  iframe.mozbrowser = true;
+  document.body.appendChild(iframe);
+
   iframe.addEventListener('mozbrowserloadstart', function() {
     ok(false, 'Should not send mozbrowserloadstart event.');
   });
 
   iframe.addEventListener('load', function() {
     ok(true, 'Got iframe load event.');
     SimpleTest.finish();
   });
 
   iframe.src = 'http://example.com';
 }
 
 addEventListener('load', function() { SimpleTest.executeSoon(runTest); });
 
 </script>
 
-<iframe id='iframe' mozbrowser></iframe>
-
 </body>
 </html>
--- a/dom/tests/mochitest/general/test_browserFrame4.html
+++ b/dom/tests/mochitest/general/test_browserFrame4.html
@@ -13,31 +13,46 @@ https://bugzilla.mozilla.org/show_bug.cg
 <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=710231">Mozilla Bug 710231</a>
 
 <!--
   Test that an iframe with the |mozbrowser| attribute emits
   mozbrowserX events when this page is in the whitelist.
 -->
 
 <script type="application/javascript;version=1.7">
-"use strict";
 
 SimpleTest.waitForExplicitFinish();
 
 var seenLoadStart = false;
 var seenLoad = false;
 var seenLoadEnd = false;
 var seenLocationChange = false;
 
 function runTest() {
   browserFrameHelpers.setEnabledPref(true);
   browserFrameHelpers.addToWhitelist();
 
+  // Load example.org into the iframe, wait for that to load, then call
+  // runTest2.  This would *almost* work if we just had a <iframe mozbrowser>
+  // in the HTML, except that we have to set the prefs before we create the
+  // iframe!
+
+  var iframe = document.createElement('iframe');
+  iframe.id = 'iframe';
+  document.body.appendChild(iframe);
+  iframe.src = 'data:text/html,1';
+  iframe.addEventListener('load', function() {
+    iframe.removeEventListener('load', arguments.callee);
+    SimpleTest.executeSoon(runTest2);
+  });
+}
+
+function runTest2() {
   var iframe = document.getElementById('iframe');
-
+  iframe.mozbrowser = true;
   iframe.addEventListener('mozbrowserloadstart', function() {
     ok(!seenLoadStart, 'Just one loadstart event.');
     seenLoadStart = true;
     ok(!seenLoad, 'Got mozbrowserloadstart event before load.');
     ok(!seenLoadEnd, 'Got mozbrowserloadstart before loadend.');
     ok(!seenLocationChange, 'Got mozbrowserloadstart before locationchange.');
   });
 
@@ -77,12 +92,10 @@ function waitForAllCallbacks() {
 
   SimpleTest.finish();
 }
 
 addEventListener('load', function() { SimpleTest.executeSoon(runTest); });
 
 </script>
 
-<iframe id='iframe' mozbrowser></iframe>
-
 </body>
 </html>
--- a/dom/tests/mochitest/general/test_browserFrame5.html
+++ b/dom/tests/mochitest/general/test_browserFrame5.html
@@ -12,45 +12,74 @@ https://bugzilla.mozilla.org/show_bug.cg
 <body>
 <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=720157">Mozilla Bug 720157</a>
 
 <!--
   Test that data: URIs work with mozbrowserlocationchange events.
 -->
 
 <script type="application/javascript;version=1.7">
-"use strict";
 
 SimpleTest.waitForExplicitFinish();
 
 function runTest() {
   browserFrameHelpers.setEnabledPref(true);
   browserFrameHelpers.addToWhitelist();
 
-  var iframe = document.getElementById('iframe');
+  var iframe1 = document.createElement('iframe');
+  document.body.appendChild(iframe1);
+  iframe1.id = 'iframe1';
+  iframe1.addEventListener('load', function() {
+    iframe1.removeEventListener('load', arguments.callee);
+    SimpleTest.executeSoon(runTest2);
+  });
+  iframe1.src = 'http://example.org';
+}
+  
+function runTest2() {
+  var iframe1 = document.getElementById('iframe1');
+  iframe1.mozbrowser = true;
+
+  var iframe2 = document.getElementById('iframe2');
+
   var sawLoad = false;
   var sawLocationChange = false;
 
-  iframe.addEventListener('mozbrowserlocationchange', function(e) {
+  iframe1.addEventListener('mozbrowserlocationchange', function(e) {
     ok(!sawLocationChange, 'Just one locationchange event.');
     ok(!sawLoad, 'locationchange before load.');
     is(e.detail, 'data:text/html,1', "event's reported location");
     sawLocationChange = true;
   });
 
-  iframe.addEventListener('load', function() {
+  iframe1.addEventListener('load', function() {
     ok(sawLocationChange, 'Load after locationchange.');
     ok(!sawLoad, 'Just one load event.');
     sawLoad = true;
-    SimpleTest.finish();
   });
 
-  iframe.src = 'data:text/html,1';
+  function iframe2Load() {
+    if (!sawLoad || !sawLocationChange) {
+      // Spin if iframe1 hasn't loaded yet.
+      SimpleTest.executeSoon(iframe2Load);
+      return;
+    }
+    ok(true, 'Got iframe2 load.');
+    SimpleTest.finish();
+  }
+  iframe2.addEventListener('load', iframe2Load);
+
+
+  iframe1.src = 'data:text/html,1';
+
+  // Load something into iframe2 to check that it doesn't trigger a
+  // locationchange for our iframe1 listener.
+  iframe2.src = 'http://example.com';
 }
 
 addEventListener('load', function() { SimpleTest.executeSoon(runTest); });
 
 </script>
 
-<iframe id='iframe' mozbrowser></iframe>
+<iframe id='iframe2'></iframe>
 
 </body>
 </html>
new file mode 100644
--- /dev/null
+++ b/dom/tests/mochitest/general/test_browserFrame6.html
@@ -0,0 +1,72 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=720157
+-->
+<head>
+  <title>Test for Bug 720157</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="browserFrameHelpers.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=720157">Mozilla Bug 720157</a>
+
+<!--
+  Test that the onmozbrowsertitlechange event works.
+-->
+
+<script type="application/javascript;version=1.7">
+"use strict";
+
+SimpleTest.waitForExplicitFinish();
+
+function runTest() {
+  browserFrameHelpers.setEnabledPref(true);
+  browserFrameHelpers.addToWhitelist();
+
+  var iframe1 = document.createElement('iframe');
+  iframe1.mozbrowser = true;
+  document.body.appendChild(iframe1);
+
+  // iframe2 is a red herring; we modify its title but don't listen for
+  // titlechanges; we want to make sure that its titlechange events aren't
+  // picked up by the listener on iframe1.
+  var iframe2 = document.createElement('iframe');
+  iframe2.mozbrowser = true;
+  document.body.appendChild(iframe2);
+
+  var numTitleChanges = 0;
+
+  iframe1.addEventListener('mozbrowsertitlechange', function(e) {
+    numTitleChanges++;
+
+    if (numTitleChanges == 1) {
+      is(e.detail, 'Title');
+      iframe1.contentDocument.title = 'New title';
+      iframe2.contentDocument.title = 'BAD TITLE 2';
+    }
+    else if (numTitleChanges == 2) {
+      is(e.detail, 'New title');
+      iframe1.src = 'data:text/html,<html><head><title>Title 3</title></head><body></body></html>';
+    }
+    else if (numTitleChanges == 3) {
+      is(e.detail, 'Title 3');
+      SimpleTest.finish();
+    }
+    else {
+      ok(false, 'Too many titlechange events.');
+    }
+  });
+
+  iframe1.src = 'data:text/html,<html><head><title>Title</title></head><body></body></html>';
+  iframe2.src = 'data:text/html,<html><head><title>BAD TITLE</title></head><body></body></html>';
+}
+
+addEventListener('load', function() { SimpleTest.executeSoon(runTest); });
+
+</script>
+
+</body>
+</html>
+
--- a/extensions/spellcheck/hunspell/src/mozHunspell.cpp
+++ b/extensions/spellcheck/hunspell/src/mozHunspell.cpp
@@ -97,22 +97,20 @@ NS_IMPL_CYCLE_COLLECTION_3(mozHunspell,
 
 // Memory reporting stuff.
 static PRInt64 gHunspellAllocatedSize = 0;
 
 NS_MEMORY_REPORTER_MALLOC_SIZEOF_FUN(HunspellMallocSizeOfForCounterInc, "hunspell")
 NS_MEMORY_REPORTER_MALLOC_SIZEOF_FUN_UN(HunspellMallocSizeOfForCounterDec)
 
 void HunspellReportMemoryAllocation(void* ptr) {
-  // |computedSize| is zero because we don't know what it is.
-  gHunspellAllocatedSize += HunspellMallocSizeOfForCounterInc(ptr, 0);
+  gHunspellAllocatedSize += HunspellMallocSizeOfForCounterInc(ptr);
 }
 void HunspellReportMemoryDeallocation(void* ptr) {
-  // |computedSize| is zero because we don't know what it is.
-  gHunspellAllocatedSize -= HunspellMallocSizeOfForCounterDec(ptr, 0);
+  gHunspellAllocatedSize -= HunspellMallocSizeOfForCounterDec(ptr);
 }
 static PRInt64 HunspellGetCurrentAllocatedSize() {
   return gHunspellAllocatedSize;
 }
 
 NS_MEMORY_REPORTER_IMPLEMENT(Hunspell,
     "explicit/spell-check",
     KIND_HEAP,
--- a/gfx/angle/CONTRIBUTORS
+++ b/gfx/angle/CONTRIBUTORS
@@ -26,16 +26,17 @@ Google Inc.
  Alok Priyadarshi
  Kenneth Russell
  Brian Salomon
  Ben Vanik
  Adrienne Walker
 
 Mozilla Corp.
  Ehsan Akhgari
+ Mike Hommey
  Benoit Jacob
  Makoto Kato
  Vladimir Vukicevic
 
 Apple Inc.
  David Kilzer
 
 Aitor Moreno <aitormoreno at gmail.com>
--- a/gfx/angle/Makefile.in
+++ b/gfx/angle/Makefile.in
@@ -48,17 +48,16 @@ LIBXUL_LIBRARY  = 1
 ifeq (WINNT,$(OS_TARGET))
 VISIBILITY_FLAGS =
 endif
 
 EXPORTS_NAMESPACES = angle
 
 EXPORTS_angle = \
 	include/GLSLANG/ShaderLang.h \
-	include/GLSLANG/ResourceLimits.h \
 	$(NULL)
 
 LOCAL_INCLUDES += -I$(srcdir)/include -I$(srcdir)/src
 
 VPATH += $(srcdir)/src
 VPATH += $(srcdir)/src/compiler
 VPATH += $(srcdir)/src/compiler/preprocessor
 
@@ -66,17 +65,16 @@ CPPSRCS = \
 	Compiler.cpp \
         DetectRecursion.cpp \
         InfoSink.cpp \
         Initialize.cpp \
         InitializeDll.cpp \
         Intermediate.cpp \
         intermOut.cpp \
         IntermTraverse.cpp \
-        MozAngleLink.cpp \
         parseConst.cpp \
         ParseHelper.cpp \
         PoolAlloc.cpp \
         QualifierAlive.cpp \
         RemoveTree.cpp \
         ShaderLang.cpp \
         SymbolTable.cpp \
         VariableInfo.cpp \
--- a/gfx/angle/README.mozilla
+++ b/gfx/angle/README.mozilla
@@ -1,11 +1,11 @@
 This is the ANGLE project, from http://code.google.com/p/angleproject/
 
-Current revision: r930
+Current revision: r963
 
 == Applied local patches ==
 
 In this order:
   angle-renaming-debug.patch - rename debug.h to compilerdebug.h to avoid conflict in our makefiles
   angle-intrinsic-msvc2005.patch - work around a MSVC 2005 compile error
   angle-limit-identifiers-to-250-chars.patch - see bug 675625
   angle-use-xmalloc.patch - see bug 680840. Can drop this patch whenever the new preprocessor lands.
--- a/gfx/angle/angle-intrinsic-msvc2005.patch
+++ b/gfx/angle/angle-intrinsic-msvc2005.patch
@@ -1,10 +1,10 @@
 # HG changeset patch
-# Parent 2cefa41bd95ba8875964dde3829559fd70b8101d
+# Parent 6ee54a11fd135a2b594db77f7eaf83f06ee7b1d8
 diff --git a/gfx/angle/src/libGLESv2/Texture.cpp b/gfx/angle/src/libGLESv2/Texture.cpp
 --- a/gfx/angle/src/libGLESv2/Texture.cpp
 +++ b/gfx/angle/src/libGLESv2/Texture.cpp
 @@ -8,16 +8,22 @@
  // Texture2D and TextureCubeMap. Implements GL texture objects and related
  // functionality. [OpenGL ES 2.0.24] section 3.7 page 63.
  
  #include "libGLESv2/Texture.h"
--- a/gfx/angle/angle-limit-identifiers-to-250-chars.patch
+++ b/gfx/angle/angle-limit-identifiers-to-250-chars.patch
@@ -1,10 +1,10 @@
 # HG changeset patch
-# Parent 60ae9443af647dc56c76bf9c7a5958f2ff176fb8
+# Parent 761ca19e4ce1afe03e58beaea20149ba1ef243c4
 diff --git a/gfx/angle/src/compiler/preprocessor/length_limits.h b/gfx/angle/src/compiler/preprocessor/length_limits.h
 --- a/gfx/angle/src/compiler/preprocessor/length_limits.h
 +++ b/gfx/angle/src/compiler/preprocessor/length_limits.h
 @@ -10,12 +10,14 @@
  
  #if !defined(__LENGTH_LIMITS_H)
  #define __LENGTH_LIMITS_H 1
  
--- a/gfx/angle/angle-renaming-debug.patch
+++ b/gfx/angle/angle-renaming-debug.patch
@@ -1,11 +1,10 @@
 # HG changeset patch
-# Parent 7e7cd80ef724c094b88ed8bb35f3af0ce9a9cfee
-
+# Parent 326590fb862cf7e277487f48c7a434bde3566ea0
 diff --git a/gfx/angle/Makefile.in b/gfx/angle/Makefile.in
 --- a/gfx/angle/Makefile.in
 +++ b/gfx/angle/Makefile.in
 @@ -75,17 +75,17 @@ CPPSRCS = \
          parseConst.cpp \
          ParseHelper.cpp \
          PoolAlloc.cpp \
          QualifierAlive.cpp \
@@ -18,61 +17,16 @@ diff --git a/gfx/angle/Makefile.in b/gfx
          ossource_nspr.cpp \
          util.cpp \
          ValidateLimitations.cpp \
          ForLoopUnroll.cpp \
          MapLongVariableNames.cpp \
          BuiltInFunctionEmulator.cpp \
          $(NULL)
  
-diff --git a/gfx/angle/angle-renaming-debug.patch b/gfx/angle/angle-renaming-debug.patch
---- a/gfx/angle/angle-renaming-debug.patch
-+++ b/gfx/angle/angle-renaming-debug.patch
-@@ -1,14 +1,14 @@
- # HG changeset patch
--# Parent b6f65ca6027d397ca50783d7164a6a8fa59eef4c
-+# Parent 1879d857ef07dc5797704516caea99b231d7590a
- diff --git a/gfx/angle/Makefile.in b/gfx/angle/Makefile.in
- --- a/gfx/angle/Makefile.in
- +++ b/gfx/angle/Makefile.in
--@@ -73,17 +73,17 @@ CPPSRCS = \
-+@@ -75,17 +75,17 @@ CPPSRCS = \
-          parseConst.cpp \
-          ParseHelper.cpp \
-          PoolAlloc.cpp \
-          QualifierAlive.cpp \
-          RemoveTree.cpp \
-          ShaderLang.cpp \
-          SymbolTable.cpp \
-          VariableInfo.cpp \
-@@ -163,22 +163,22 @@ diff --git a/gfx/angle/src/compiler/prep
-  #include <stdlib.h>
-  #include <stdio.h>
-  #include <string.h>
-  
- -#include "compiler/debug.h"
- +#include "compiler/compilerdebug.h"
-  #include "compiler/preprocessor/slglobals.h"
-  
-+ #include "../../../../../memory/mozalloc/mozalloc.h"
-+ 
-  #undef malloc
-  #undef realloc
-  #undef free
-  
-- ///////////////////////////////////////////////////////////////////////////////////////////////
-- ////////////////////////////////////////// String table: //////////////////////////////////////
- diff --git a/gfx/angle/src/compiler/preprocessor/tokens.c b/gfx/angle/src/compiler/preprocessor/tokens.c
- --- a/gfx/angle/src/compiler/preprocessor/tokens.c
- +++ b/gfx/angle/src/compiler/preprocessor/tokens.c
- @@ -45,17 +45,17 @@ NVIDIA HAS BEEN ADVISED OF THE POSSIBILI
-  // tokens.c
-  //
-  
-  #include <stdlib.h>
 diff --git a/gfx/angle/src/compiler/OutputGLSLBase.cpp b/gfx/angle/src/compiler/OutputGLSLBase.cpp
 --- a/gfx/angle/src/compiler/OutputGLSLBase.cpp
 +++ b/gfx/angle/src/compiler/OutputGLSLBase.cpp
 @@ -1,16 +1,16 @@
  //
  // Copyright (c) 2002-2011 The ANGLE Project Authors. All rights reserved.
  // Use of this source code is governed by a BSD-style license that can be
  // found in the LICENSE file.
@@ -174,17 +128,17 @@ diff --git a/gfx/angle/src/compiler/comp
  
  #include <assert.h>
  
  #ifdef _DEBUG
  #define TRACE_ENABLED  // define to enable debug message tracing
 diff --git a/gfx/angle/src/compiler/osinclude.h b/gfx/angle/src/compiler/osinclude.h
 --- a/gfx/angle/src/compiler/osinclude.h
 +++ b/gfx/angle/src/compiler/osinclude.h
-@@ -30,17 +30,17 @@
+@@ -31,17 +31,17 @@
  #include <windows.h>
  #elif defined(ANGLE_OS_POSIX)
  #include <pthread.h>
  #include <semaphore.h>
  #include <errno.h>
  #endif  // ANGLE_USE_NSPR
  
  
--- a/gfx/angle/angle-use-xmalloc.patch
+++ b/gfx/angle/angle-use-xmalloc.patch
@@ -1,11 +1,10 @@
 # HG changeset patch
-# Parent bc7188c29ec5b942046c0589ce959d7985f7ad6e
-
+# Parent 93033f21b121382b50e5bc9787edf704d6906508
 diff --git a/gfx/angle/Makefile.in b/gfx/angle/Makefile.in
 --- a/gfx/angle/Makefile.in
 +++ b/gfx/angle/Makefile.in
 @@ -129,16 +129,18 @@ CSRCS   = \
  	$(NULL)
  
  DEFINES += -DANGLE_USE_NSPR -DANGLE_BUILD -DCOMPILER_IMPLEMENTATION
  
@@ -18,85 +17,16 @@ diff --git a/gfx/angle/Makefile.in b/gfx
  ifdef MOZ_ANGLE
  
  # libEGL depends on (links against!) libGLESv2!
  DIRS = src/libGLESv2 src/libEGL
  
  libs::
  	expand "$(MOZ_D3DX9_CAB)" -F:$(MOZ_D3DX9_DLL) "$(DIST)/bin"
  	expand "$(MOZ_D3DCOMPILER_CAB)" -F:$(MOZ_D3DCOMPILER_DLL) "$(DIST)/bin"
-diff --git a/gfx/angle/angle-use-xmalloc.patch b/gfx/angle/angle-use-xmalloc.patch
---- a/gfx/angle/angle-use-xmalloc.patch
-+++ b/gfx/angle/angle-use-xmalloc.patch
-@@ -1,14 +1,14 @@
- # HG changeset patch
--# Parent 31d1c6ebb61eb118868ca924769a2fa3a50d54ef
-+# Parent 6a1ee30b3a60564c165795ecf79e9c2081ee80ab
- diff --git a/gfx/angle/Makefile.in b/gfx/angle/Makefile.in
- --- a/gfx/angle/Makefile.in
- +++ b/gfx/angle/Makefile.in
--@@ -127,16 +127,18 @@ CSRCS   = \
-+@@ -129,16 +129,18 @@ CSRCS   = \
-  	$(NULL)
-  
-  DEFINES += -DANGLE_USE_NSPR -DANGLE_BUILD -DCOMPILER_IMPLEMENTATION
-  
-  #these defines are from ANGLE's build_angle.gyp
-  DEFINES += -DANGLE_DISABLE_TRACE
-  DEFINES += -DANGLE_COMPILE_OPTIMIZATION_LEVEL=D3DCOMPILE_OPTIMIZATION_LEVEL0
-  
-@@ -17,47 +17,26 @@ diff --git a/gfx/angle/Makefile.in b/gfx
-  ifdef MOZ_ANGLE
-  
-  # libEGL depends on (links against!) libGLESv2!
-  DIRS = src/libGLESv2 src/libEGL
-  
-  libs::
-  	expand "$(MOZ_D3DX9_CAB)" -F:$(MOZ_D3DX9_DLL) "$(DIST)/bin"
-  	expand "$(MOZ_D3DCOMPILER_CAB)" -F:$(MOZ_D3DCOMPILER_DLL) "$(DIST)/bin"
--diff --git a/gfx/angle/README.mozilla b/gfx/angle/README.mozilla
----- a/gfx/angle/README.mozilla
--+++ b/gfx/angle/README.mozilla
--@@ -3,16 +3,17 @@ This is the ANGLE project, from http://c
-- Current revision: r885
-- 
-- == Applied local patches ==
-- 
-- In this order:
--   angle-renaming-debug.patch - rename debug.h to compilerdebug.h to avoid conflict in our makefiles
--   angle-intrinsic-msvc2005.patch - work around a MSVC 2005 compile error
--   angle-limit-identifiers-to-250-chars.patch - see bug 675625
--+  angle-use-xmalloc.patch - see bug 680840. Can drop this patch whenever the new preprocessor lands.
-- 
-- In addition to these patches, the Makefile.in files are ours, they're not present in upsteam ANGLE.
-- 
-- == How to update this ANGLE copy ==
-- 
-- 1. Unapply patches
-- 2. Apply diff with new ANGLE version
-- 3. Reapply patches.
- diff --git a/gfx/angle/src/compiler/preprocessor/atom.c b/gfx/angle/src/compiler/preprocessor/atom.c
- --- a/gfx/angle/src/compiler/preprocessor/atom.c
- +++ b/gfx/angle/src/compiler/preprocessor/atom.c
- @@ -48,16 +48,18 @@ NVIDIA HAS BEEN ADVISED OF THE POSSIBILI
-  
-  #include <stdlib.h>
-  #include <stdio.h>
-  #include <string.h>
-  
-- #include "compiler/compilerdebug.h"
-+ #include "compiler/debug.h"
-  #include "compiler/preprocessor/slglobals.h"
-  
- +#include "../../../../../memory/mozalloc/mozalloc.h"
- +
-  #undef malloc
-  #undef realloc
-  #undef free
-  
 diff --git a/gfx/angle/src/compiler/preprocessor/atom.c b/gfx/angle/src/compiler/preprocessor/atom.c
 --- a/gfx/angle/src/compiler/preprocessor/atom.c
 +++ b/gfx/angle/src/compiler/preprocessor/atom.c
 @@ -48,16 +48,18 @@ NVIDIA HAS BEEN ADVISED OF THE POSSIBILI
  
  #include <stdlib.h>
  #include <stdio.h>
  #include <string.h>
--- a/gfx/angle/build/common.gypi
+++ b/gfx/angle/build/common.gypi
@@ -3,16 +3,28 @@
 # found in the LICENSE file.
 
 {
   'variables': {
     'component%': 'static_library',
   },
   'target_defaults': {
     'default_configuration': 'Debug',
+    'variables': {
+      'warn_as_error%': 1,
+    },
+    'target_conditions': [
+      ['warn_as_error == 1', {
+        'msvs_settings': {
+          'VCCLCompilerTool': {
+            'WarnAsError': 'true',
+          },
+        },
+      }],
+    ],
     'configurations': {
       'Common': {
         'abstract': 1,
         'msvs_configuration_attributes': {
           'OutputDirectory': '$(SolutionDir)$(ConfigurationName)',
           'IntermediateDirectory': '$(OutDir)\\obj\\$(ProjectName)',
           'CharacterSet': '1',  # UNICODE
         },
--- a/gfx/angle/extensions/EGL_ANGLE_query_surface_pointer.txt
+++ b/gfx/angle/extensions/EGL_ANGLE_query_surface_pointer.txt
@@ -21,17 +21,17 @@ Status
     Implemented (ANGLE r558)
 
 Version
 
     Version 3, February 11, 2011
 
 Number
 
-    EGL Extension #??
+    EGL Extension #28
 
 Dependencies
 
     This extension is written against the wording of the EGL 1.4
     Specification. 
 
 Overview
 
--- a/gfx/angle/extensions/EGL_ANGLE_surface_d3d_texture_2d_share_handle.txt
+++ b/gfx/angle/extensions/EGL_ANGLE_surface_d3d_texture_2d_share_handle.txt
@@ -21,17 +21,17 @@ Status
     Implemented (ANGLE r558)
 
 Version
 
     Version 2, December 21, 2010
 
 Number
 
-    EGL Extension #??
+    EGL Extension #29
 
 Dependencies
 
     Requires the EGL_ANGLE_query_surface_pointer extension.
 
     This extension is written against the wording of the EGL 1.4
     Specification.
 
--- a/gfx/angle/extensions/EGL_EXT_create_context_robustness.txt
+++ b/gfx/angle/extensions/EGL_EXT_create_context_robustness.txt
@@ -20,17 +20,17 @@ Status
     Complete.
 
 Version
 
     Version 3, 2011/10/31
 
 Number
 
-    TBD
+    EGL Extension #37
 
 Dependencies
 
     Requires EGL 1.4
 
     Written against the EGL 1.4 specification.
 
     An OpenGL implementation supporting GL_ARB_robustness, an OpenGL ES
--- a/gfx/angle/extensions/EXT_robustness.txt
+++ b/gfx/angle/extensions/EXT_robustness.txt
@@ -21,17 +21,17 @@ Status
     Complete.
 
 Version
 
     Version 3, 2011/10/31
 
 Number
 
-    TBD
+    OpenGL ES Extension #107
 
 Dependencies
 
     This extension is written against the OpenGL ES 2.0 Specification
     but can apply to OpenGL ES 1.1 and up.
 
     EGL_EXT_create_context_robustness is used to determine if a context
     implementing this extension supports robust buffer access, and if it
--- a/gfx/angle/extensions/EXT_texture_storage.txt
+++ b/gfx/angle/extensions/EXT_texture_storage.txt
@@ -30,17 +30,17 @@ Status
 
 Version
 
     Last Modified Date: November 11, 2011
     Author Revision: 24
 
 Number
 
-    XXX - not assigned yet
+    OpenGL ES Extension #108
 
 Dependencies
 
     OpenGL ES 1.0, OpenGL ES 2.0 or OpenGL 1.2 is required.
 
     OES_texture_npot, OES_texture_cube_map, OES_texture_3D,
     OES_depth_texture, OES_packed_depth_stencil,
     OES_compressed_paletted_texture, OES_texture_float, OES_texture_half_float
--- a/gfx/angle/include/EGL/eglext.h
+++ b/gfx/angle/include/EGL/eglext.h
@@ -1,17 +1,17 @@
 #ifndef __eglext_h_
 #define __eglext_h_
 
 #ifdef __cplusplus
 extern "C" {
 #endif
 
 /*
-** Copyright (c) 2007-2010 The Khronos Group Inc.
+** Copyright (c) 2007-2012 The Khronos Group Inc.
 **
 ** Permission is hereby granted, free of charge, to any person obtaining a
 ** copy of this software and/or associated documentation files (the
 ** "Materials"), to deal in the Materials without restriction, including
 ** without limitation the rights to use, copy, modify, merge, publish,
 ** distribute, sublicense, and/or sell copies of the Materials, and to
 ** permit persons to whom the Materials are furnished to do so, subject to
 ** the following conditions:
@@ -29,18 +29,18 @@ extern "C" {
 */
 
 #include <EGL/eglplatform.h>
 
 /*************************************************************/
 
 /* Header file version number */
 /* Current version at http://www.khronos.org/registry/egl/ */
-/* $Revision: 15052 $ on $Date: 2011-07-06 17:43:46 -0700 (Wed, 06 Jul 2011) $ */
-#define EGL_EGLEXT_VERSION 10
+/* $Revision: 16473 $ on $Date: 2012-01-04 02:20:48 -0800 (Wed, 04 Jan 2012) $ */
+#define EGL_EGLEXT_VERSION 11
 
 #ifndef EGL_KHR_config_attribs
 #define EGL_KHR_config_attribs 1
 #define EGL_CONFORMANT_KHR			0x3042	/* EGLConfig attribute */
 #define EGL_VG_COLORSPACE_LINEAR_BIT_KHR	0x0020	/* EGL_SURFACE_TYPE bitfield */
 #define EGL_VG_ALPHA_FORMAT_PRE_BIT_KHR		0x0040	/* EGL_SURFACE_TYPE bitfield */
 #endif
 
@@ -173,25 +173,25 @@ typedef EGLBoolean (EGLAPIENTRYP PFNEGLG
 
 #ifndef EGL_KHR_lock_surface2
 #define EGL_KHR_lock_surface2 1
 #define EGL_BITMAP_PIXEL_SIZE_KHR		0x3110
 #endif
 
 #ifndef EGL_NV_coverage_sample
 #define EGL_NV_coverage_sample 1
-#define EGL_COVERAGE_BUFFERS_NV 0x30E0
-#define EGL_COVERAGE_SAMPLES_NV 0x30E1
+#define EGL_COVERAGE_BUFFERS_NV			0x30E0
+#define EGL_COVERAGE_SAMPLES_NV			0x30E1
 #endif
 
 #ifndef EGL_NV_depth_nonlinear
 #define EGL_NV_depth_nonlinear 1
-#define EGL_DEPTH_ENCODING_NV 0x30E2
+#define EGL_DEPTH_ENCODING_NV			0x30E2
 #define EGL_DEPTH_ENCODING_NONE_NV 0
-#define EGL_DEPTH_ENCODING_NONLINEAR_NV 0x30E3
+#define EGL_DEPTH_ENCODING_NONLINEAR_NV		0x30E3
 #endif
 
 #if KHRONOS_SUPPORT_INT64   /* EGLTimeNV requires 64-bit uint support */
 #ifndef EGL_NV_sync
 #define EGL_NV_sync 1
 #define EGL_SYNC_PRIOR_COMMANDS_COMPLETE_NV	0x30E6
 #define EGL_SYNC_STATUS_NV			0x30E7
 #define EGL_SIGNALED_NV				0x30E8
@@ -296,53 +296,53 @@ typedef EGLBoolean (EGLAPIENTRYP PFNEGLP
 #ifndef EGL_ANGLE_query_surface_pointer
 #define EGL_ANGLE_query_surface_pointer 1
 #ifdef EGL_EGLEXT_PROTOTYPES
 EGLAPI EGLBoolean eglQuerySurfacePointerANGLE(EGLDisplay dpy, EGLSurface surface, EGLint attribute, void **value);
 #endif
 typedef EGLBoolean (EGLAPIENTRYP PFNEGLQUERYSURFACEPOINTERANGLEPROC) (EGLDisplay dpy, EGLSurface surface, EGLint attribute, void **value);
 #endif
 
+#ifndef EGL_ANGLE_software_display
+#define EGL_ANGLE_software_display 1
+#define EGL_SOFTWARE_DISPLAY_ANGLE ((EGLNativeDisplayType)-1)
+#endif
+
 #ifndef EGL_ANGLE_surface_d3d_texture_2d_share_handle
 #define EGL_ANGLE_surface_d3d_texture_2d_share_handle 1
 #define EGL_D3D_TEXTURE_2D_SHARE_HANDLE_ANGLE	0x3200
 #endif
 
-#ifndef EGL_ANGLE_software_display
-#define EGL_ANGLE_software_display 1
-#define EGL_SOFTWARE_DISPLAY_ANGLE ((EGLNativeDisplayType)-1)
-#endif
-
 #ifndef EGL_NV_coverage_sample_resolve
 #define EGL_NV_coverage_sample_resolve 1
 #define EGL_COVERAGE_SAMPLE_RESOLVE_NV		0x3131
 #define EGL_COVERAGE_SAMPLE_RESOLVE_DEFAULT_NV	0x3132
 #define EGL_COVERAGE_SAMPLE_RESOLVE_NONE_NV	0x3133
 #endif
 
-#ifndef EGL_EXT_create_context_robustness
-#define EGL_EXT_create_context_robustness 1
-#define EGL_CONTEXT_OPENGL_ROBUST_ACCESS_EXT                0x30BF
-#define EGL_CONTEXT_OPENGL_RESET_NOTIFICATION_STRATEGY_EXT  0x3138
-#define EGL_NO_RESET_NOTIFICATION_EXT                       0x31BE
-#define EGL_LOSE_CONTEXT_ON_RESET_EXT                       0x31BF
-#endif
-
 #if KHRONOS_SUPPORT_INT64   /* EGLTimeKHR requires 64-bit uint support */
 #ifndef EGL_NV_system_time
 #define EGL_NV_system_time 1
 
 typedef khronos_utime_nanoseconds_t EGLuint64NV;
 
 #ifdef EGL_EGLEXT_PROTOTYPES
 EGLAPI EGLuint64NV EGLAPIENTRY eglGetSystemTimeFrequencyNV(void);
 EGLAPI EGLuint64NV EGLAPIENTRY eglGetSystemTimeNV(void);
 #endif /* EGL_EGLEXT_PROTOTYPES */
 typedef EGLuint64NV (EGLAPIENTRYP PFNEGLGETSYSTEMTIMEFREQUENCYNVPROC) (void);
 typedef EGLuint64NV (EGLAPIENTRYP PFNEGLGETSYSTEMTIMENVPROC) (void);
 #endif
 #endif
 
+#ifndef EGL_EXT_create_context_robustness
+#define EGL_EXT_create_context_robustness 1
+#define EGL_CONTEXT_OPENGL_ROBUST_ACCESS_EXT	0x30BF
+#define EGL_CONTEXT_OPENGL_RESET_NOTIFICATION_STRATEGY_EXT 0x3138
+#define EGL_NO_RESET_NOTIFICATION_EXT		0x31BE
+#define EGL_LOSE_CONTEXT_ON_RESET_EXT		0x31BF
+#endif
+
 #ifdef __cplusplus
 }
 #endif
 
 #endif
--- a/gfx/angle/include/GLES2/gl2ext.h
+++ b/gfx/angle/include/GLES2/gl2ext.h
@@ -1,12 +1,12 @@
 #ifndef __gl2ext_h_
 #define __gl2ext_h_
 
-/* $Revision: 15049 $ on $Date:: 2011-07-06 17:28:16 -0700 #$ */
+/* $Revision: 16482 $ on $Date:: 2012-01-04 13:44:55 -0500 #$ */
 
 #ifdef __cplusplus
 extern "C" {
 #endif
 
 /*
  * This document is licensed under the SGI Free Software B License Version
  * 2.0. For details, see http://oss.sgi.com/projects/FreeB/ .
@@ -282,101 +282,171 @@ typedef void* GLeglImageOES;
  *------------------------------------------------------------------------*/
 
 /* GL_EXT_blend_minmax */
 #ifndef GL_EXT_blend_minmax
 #define GL_MIN_EXT                                              0x8007
 #define GL_MAX_EXT                                              0x8008
 #endif
 
+/* GL_EXT_color_buffer_half_float */
+#ifndef GL_EXT_color_buffer_half_float
+#define GL_RGBA16F_EXT                                          0x881A
+#define GL_RGB16F_EXT                                           0x881B
+#define GL_RG16F_EXT                                            0x822F
+#define GL_R16F_EXT                                             0x822D
+#define GL_FRAMEBUFFER_ATTACHMENT_COMPONENT_TYPE_EXT            0x8211
+#define GL_UNSIGNED_NORMALIZED_EXT                              0x8C17
+#endif
+
+/* GL_EXT_debug_label */
+#ifndef GL_EXT_debug_label
+#define GL_PROGRAM_PIPELINE_OBJECT_EXT                          0x8A4F
+#define GL_PROGRAM_OBJECT_EXT                                   0x8B40
+#define GL_SHADER_OBJECT_EXT                                    0x8B48
+#define GL_BUFFER_OBJECT_EXT                                    0x9151
+#define GL_QUERY_OBJECT_EXT                                     0x9153
+#define GL_VERTEX_ARRAY_OBJECT_EXT                              0x9154
+#endif
+
+/* GL_EXT_debug_marker */
+/* No new tokens introduced by this extension. */
+
 /* GL_EXT_discard_framebuffer */
 #ifndef GL_EXT_discard_framebuffer
 #define GL_COLOR_EXT                                            0x1800
 #define GL_DEPTH_EXT                                            0x1801
 #define GL_STENCIL_EXT                                          0x1802
 #endif
 
+/* GL_EXT_multisampled_render_to_texture */
+#ifndef GL_EXT_multisampled_render_to_texture
+#define GL_FRAMEBUFFER_ATTACHMENT_TEXTURE_SAMPLES_EXT           0x8D6C
+#define GL_RENDERBUFFER_SAMPLES_EXT                             0x9133
+#define GL_FRAMEBUFFER_INCOMPLETE_MULTISAMPLE_EXT               0x9134
+#define GL_MAX_SAMPLES_EXT                                      0x9135
+#endif
+
 /* GL_EXT_multi_draw_arrays */
 /* No new tokens introduced by this extension. */
 
+/* GL_EXT_occlusion_query_boolean */
+#ifndef GL_EXT_occlusion_query_boolean
+#define GL_ANY_SAMPLES_PASSED_EXT                               0x8C2F
+#define GL_ANY_SAMPLES_PASSED_CONSERVATIVE_EXT                  0x8D6A
+#define GL_CURRENT_QUERY_EXT                                    0x8865
+#define GL_QUERY_RESULT_EXT                                     0x8866
+#define GL_QUERY_RESULT_AVAILABLE_EXT                           0x8867
+#endif
+
 /* GL_EXT_read_format_bgra */
 #ifndef GL_EXT_read_format_bgra
 #define GL_BGRA_EXT                                             0x80E1
 #define GL_UNSIGNED_SHORT_4_4_4_4_REV_EXT                       0x8365
 #define GL_UNSIGNED_SHORT_1_5_5_5_REV_EXT                       0x8366
 #endif
 
+/* GL_EXT_robustness */
+#ifndef GL_EXT_robustness
+/* reuse GL_NO_ERROR */
+#define GL_GUILTY_CONTEXT_RESET_EXT                             0x8253
+#define GL_INNOCENT_CONTEXT_RESET_EXT                           0x8254
+#define GL_UNKNOWN_CONTEXT_RESET_EXT                            0x8255
+#define GL_CONTEXT_ROBUST_ACCESS_EXT                            0x90F3
+#define GL_RESET_NOTIFICATION_STRATEGY_EXT                      0x8256
+#define GL_LOSE_CONTEXT_ON_RESET_EXT                            0x8252
+#define GL_NO_RESET_NOTIFICATION_EXT                            0x8261
+#endif
+
+/* GL_EXT_separate_shader_objects */
+#ifndef GL_EXT_separate_shader_objects
+#define GL_VERTEX_SHADER_BIT_EXT                                0x00000001
+#define GL_FRAGMENT_SHADER_BIT_EXT                              0x00000002
+#define GL_ALL_SHADER_BITS_EXT                                  0xFFFFFFFF
+#define GL_PROGRAM_SEPARABLE_EXT                                0x8258
+#define GL_ACTIVE_PROGRAM_EXT                                   0x8259
+#define GL_PROGRAM_PIPELINE_BINDING_EXT                         0x825A
+#endif
+
 /* GL_EXT_shader_texture_lod */
 /* No new tokens introduced by this extension. */
 
+/* GL_EXT_shadow_samplers */
+#ifndef GL_EXT_shadow_samplers
+#define GL_TEXTURE_COMPARE_MODE_EXT                             0x884C
+#define GL_TEXTURE_COMPARE_FUNC_EXT                             0x884D
+#define GL_COMPARE_REF_TO_TEXTURE_EXT                           0x884E
+#endif
+
+/* GL_EXT_sRGB */
+#ifndef GL_EXT_sRGB
+#define GL_SRGB_EXT                                             0x8C40
+#define GL_SRGB_ALPHA_EXT                                       0x8C42
+#define GL_SRGB8_ALPHA8_EXT                                     0x8C43
+#define GL_FRAMEBUFFER_ATTACHMENT_COLOR_ENCODING_EXT            0x8210
+#endif
+
+/* GL_EXT_texture_compression_dxt1 */
+#ifndef GL_EXT_texture_compression_dxt1
+#define GL_COMPRESSED_RGB_S3TC_DXT1_EXT                         0x83F0
+#define GL_COMPRESSED_RGBA_S3TC_DXT1_EXT                        0x83F1
+#endif
+
 /* GL_EXT_texture_filter_anisotropic */
 #ifndef GL_EXT_texture_filter_anisotropic
 #define GL_TEXTURE_MAX_ANISOTROPY_EXT                           0x84FE
 #define GL_MAX_TEXTURE_MAX_ANISOTROPY_EXT                       0x84FF
 #endif
 
 /* GL_EXT_texture_format_BGRA8888 */
 #ifndef GL_EXT_texture_format_BGRA8888
 #define GL_BGRA_EXT                                             0x80E1
 #endif
 
+/* GL_EXT_texture_rg */
+#ifndef GL_EXT_texture_rg
+#define GL_RED_EXT                                              0x1903
+#define GL_RG_EXT                                               0x8227
+#define GL_R8_EXT                                               0x8229
+#define GL_RG8_EXT                                              0x822B
+#endif
+
+/* GL_EXT_texture_storage */
+#ifndef GL_EXT_texture_storage
+#define GL_TEXTURE_IMMUTABLE_FORMAT_EXT                         0x912F
+#define GL_ALPHA8_EXT                                           0x803C  
+#define GL_LUMINANCE8_EXT                                       0x8040
+#define GL_LUMINANCE8_ALPHA8_EXT                                0x8045
+#define GL_RGBA32F_EXT                                          0x8814  
+#define GL_RGB32F_EXT                                           0x8815
+#define GL_ALPHA32F_EXT                                         0x8816
+#define GL_LUMINANCE32F_EXT                                     0x8818
+#define GL_LUMINANCE_ALPHA32F_EXT                               0x8819
+/* reuse GL_RGBA16F_EXT */
+#define GL_RGB16F_EXT                                           0x881B
+#define GL_ALPHA16F_EXT                                         0x881C
+#define GL_LUMINANCE16F_EXT                                     0x881E
+#define GL_LUMINANCE_ALPHA16F_EXT                               0x881F
+#define GL_RGB10_A2_EXT                                         0x8059  
+#define GL_RGB10_EXT                                            0x8052
+#define GL_BGRA8_EXT                                            0x93A1
+#endif
+
 /* GL_EXT_texture_type_2_10_10_10_REV */
 #ifndef GL_EXT_texture_type_2_10_10_10_REV
 #define GL_UNSIGNED_INT_2_10_10_10_REV_EXT                      0x8368
 #endif
 
-/* GL_EXT_texture_compression_dxt1 */
-#ifndef GL_EXT_texture_compression_dxt1
-#define GL_COMPRESSED_RGB_S3TC_DXT1_EXT                         0x83F0
-#define GL_COMPRESSED_RGBA_S3TC_DXT1_EXT                        0x83F1
-#endif
-
 /* GL_EXT_unpack_subimage */
 #ifndef GL_EXT_unpack_subimage
 #define GL_UNPACK_ROW_LENGTH                                    0x0CF2
 #define GL_UNPACK_SKIP_ROWS                                     0x0CF3
 #define GL_UNPACK_SKIP_PIXELS                                   0x0CF4
 #endif
 
-/* GL_EXT_robustness */
-#ifndef GL_EXT_robustness
-#define GL_GUILTY_CONTEXT_RESET_EXT                             0x8253
-#define GL_INNOCENT_CONTEXT_RESET_EXT                           0x8254
-#define GL_UNKNOWN_CONTEXT_RESET_EXT                            0x8255
-#define GL_CONTEXT_ROBUST_ACCESS_EXT                            0x90F3
-#define GL_RESET_NOTIFICATION_STRATEGY_EXT                      0x8256
-#define GL_LOSE_CONTEXT_ON_RESET_EXT                            0x8252
-#define GL_NO_RESET_NOTIFICATION_EXT                            0x8261
-#endif
-
-/* GL_EXT_texture_storage */
-#ifndef GL_EXT_texture_storage
-#define GL_TEXTURE_IMMUTABLE_FORMAT_EXT                         0x912F
-#define GL_ALPHA8_EXT                                           0x803C
-#define GL_LUMINANCE8_EXT                                       0x8040
-#define GL_LUMINANCE8_ALPHA8_EXT                                0x8045
-/* OES_texture_float dependent internal formats */
-#define GL_RGBA32F_EXT                                          0x8814  /* reuse tokens from ARB_texture_float */
-#define GL_RGB32F_EXT                                           0x8815
-#define GL_ALPHA32F_EXT                                         0x8816
-#define GL_LUMINANCE32F_EXT                                     0x8818
-#define GL_LUMINANCE_ALPHA32F_EXT                               0x8819
-/* OES_texture_half_float dependent internal formats */
-#define GL_RGBA16F_EXT                                          0x881A /* reuse tokens from ARB_texture_float */
-#define GL_RGB16F_EXT                                           0x881B
-#define GL_ALPHA16F_EXT                                         0x881C
-#define GL_LUMINANCE16F_EXT                                     0x881E
-#define GL_LUMINANCE_ALPHA16F_EXT                               0x881F
-/* EXT_texture_type_2_10_10_10_REV dependent internal formats */
-#define GL_RGB10_A2_EXT                                         0x8059  /* reuse tokens from EXT_texture */
-#define GL_RGB10_EXT                                            0x8052
-/* EXT_texture_format_BGRA8888 dependent internal formats */
-#define GL_BGRA8_EXT                                            0x93A1
-#endif
-
 /*------------------------------------------------------------------------*
  * DMP extension tokens
  *------------------------------------------------------------------------*/
 
 /* GL_DMP_shader_binary */
 #ifndef GL_DMP_shader_binary
 #define GL_SHADER_BINARY_DMP                                    0x9250
 #endif
@@ -929,92 +999,245 @@ typedef void (GL_APIENTRYP PFNGLRESOLVEM
  * EXT extension functions
  *------------------------------------------------------------------------*/
 
 /* GL_EXT_blend_minmax */
 #ifndef GL_EXT_blend_minmax
 #define GL_EXT_blend_minmax 1
 #endif
 
+/* GL_EXT_color_buffer_half_float */