diff --git a/browser/config/version.txt b/browser/config/version.txt
index f05312117..1f17334ff 100644
--- a/browser/config/version.txt
+++ b/browser/config/version.txt
@@ -1 +1 @@
-26.4.1
\ No newline at end of file
+26.5.0
\ No newline at end of file
diff --git a/config/milestone.txt b/config/milestone.txt
index 516402155..4b81f51db 100644
--- a/config/milestone.txt
+++ b/config/milestone.txt
@@ -8,4 +8,4 @@
 # Referenced by milestone.pl.
 #--------------------------------------------------------
 
-2.1.1
+2.2.0
diff --git a/content/base/src/DirectionalityUtils.cpp b/content/base/src/DirectionalityUtils.cpp
index 6e2c52a94..65ef7c9c1 100644
--- a/content/base/src/DirectionalityUtils.cpp
+++ b/content/base/src/DirectionalityUtils.cpp
@@ -510,6 +510,12 @@ private:
                                                         oldTextNode);
     }
     if (newTextNode) {
+      nsINode* oldDirAutoSetBy = 
+        static_cast<nsTextNode*>(rootNode->GetProperty(nsGkAtoms::dirAutoSetBy));
+      if (oldDirAutoSetBy == newTextNode) {
+        // We're already registered.
+        return PL_DHASH_NEXT;
+      }
       nsTextNodeDirectionalityMap::AddEntryToMap(newTextNode, rootNode);
     } else {
       rootNode->ClearHasDirAutoSet();
@@ -693,7 +699,9 @@ WalkDescendantsResetAutoDirection(Element* aElement)
 
     if (child->HasTextNodeDirectionalityMap()) {
       nsTextNodeDirectionalityMap::ResetTextNodeDirection(child, NULL);
-      nsTextNodeDirectionalityMap::EnsureMapIsClearFor(child);
+      // Don't call nsTextNodeDirectionalityMap::EnsureMapIsClearFor(child)
+      // since ResetTextNodeDirection may have kept elements in child's
+      // DirectionalityMap.
     }
     child = child->GetNextNode(aElement);
   }
diff --git a/content/base/src/nsNodeUtils.cpp b/content/base/src/nsNodeUtils.cpp
index 70870b9ad..579c607d0 100644
--- a/content/base/src/nsNodeUtils.cpp
+++ b/content/base/src/nsNodeUtils.cpp
@@ -537,7 +537,7 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNode, bool aClone, bool aDeep,
           }
         }
         if (NS_FAILED(rv)) {
-          aNode->mNodeInfo.swap(nodeInfo);
+          aNode->mNodeInfo.swap(newNodeInfo);
 
           return rv;
         }
diff --git a/content/canvas/src/CanvasRenderingContext2D.cpp b/content/canvas/src/CanvasRenderingContext2D.cpp
index 46a2d229b..40f62f385 100644
--- a/content/canvas/src/CanvasRenderingContext2D.cpp
+++ b/content/canvas/src/CanvasRenderingContext2D.cpp
@@ -1048,8 +1048,11 @@ CanvasRenderingContext2D::GetInputStream(const char *aMimeType,
     // so always 4-value pixels.
     // GetImageBuffer => SurfaceToPackedBGRA [=> ConvertBGRXToBGRA]
     int32_t dataSize = mWidth * mHeight * 4;
+#if defined(_MSC_VER)
+// Parallelizing pragmas are MSVC-only
 #pragma loop(ivdep)
 #pragma loop(hint_parallel(0))
+#endif
     for (int32_t j = 0; j < dataSize; ++j) {
       if (imageBuffer[j] !=0 && imageBuffer[j] != 255)
         imageBuffer[j] += rand() % 3 - 1;
diff --git a/image/decoders/nsPNGDecoder.cpp b/image/decoders/nsPNGDecoder.cpp
index 3b2e4c6b4..6c13234b6 100644
--- a/image/decoders/nsPNGDecoder.cpp
+++ b/image/decoders/nsPNGDecoder.cpp
@@ -664,6 +664,15 @@ nsPNGDecoder::info_callback(png_structp png_ptr, png_infop info_ptr)
     }
   }
 
+#ifdef PNG_APNG_SUPPORTED
+  /* Reject any ancillary chunk after IDAT with a bad CRC.
+   * This may cause issues with poorly encoded PNG files with CRC errors
+   * in chunks but implements the strong recommendation for APNGs to
+   * reject files with such errors, following the spec.
+   */
+  png_set_crc_action(png_ptr, PNG_CRC_NO_CHANGE, PNG_CRC_ERROR_QUIT);
+#endif
+
   if (decoder->NeedsNewFrame()) {
     /* We know that we need a new frame, so pause input so the decoder
      * infrastructure can give it to us.
@@ -828,6 +837,15 @@ nsPNGDecoder::frame_info_callback(png_structp png_ptr, png_uint_32 frame_num)
   width = png_get_next_frame_width(png_ptr, decoder->mInfo);
   height = png_get_next_frame_height(png_ptr, decoder->mInfo);
 
+  if (width == 0) {
+    PR_LOG(GetPNGLog(), PR_LOG_ERROR, ("libpng error: Frame width must not be 0\n"));
+    longjmp(png_jmpbuf(png_ptr), 1);
+  }
+  if (height == 0) {
+    PR_LOG(GetPNGLog(), PR_LOG_ERROR, ("libpng error: Frame height must not be 0\n"));
+    longjmp(png_jmpbuf(png_ptr), 1);
+  }
+
   decoder->CreateFrame(x_offset, y_offset, width, height, decoder->format);
 
   if (decoder->NeedsNewFrame()) {
diff --git a/image/src/imgFrame.cpp b/image/src/imgFrame.cpp
index 3efa74227..7bb9bdcda 100644
--- a/image/src/imgFrame.cpp
+++ b/image/src/imgFrame.cpp
@@ -169,10 +169,11 @@ nsresult imgFrame::Init(int32_t aX, int32_t aY, int32_t aWidth, int32_t aHeight,
       return NS_ERROR_FAILURE;
     }
 
-    // Use the fallible allocator here
-    mPalettedImageData = (uint8_t*)moz_malloc(PaletteDataLength() + GetImageDataLength());
+    // Use the fallible allocator here.
+    size_t dataSize = PaletteDataLength() + GetImageDataLength();
+    mPalettedImageData = (uint8_t*)moz_calloc(dataSize, sizeof(uint8_t));
     if (!mPalettedImageData)
-      NS_WARNING("moz_malloc for paletted image data should succeed");
+      NS_WARNING("Call to moz_calloc for paletted image data should succeed");
     NS_ENSURE_TRUE(mPalettedImageData, NS_ERROR_OUT_OF_MEMORY);
   } else {
     // For Windows, we must create the device surface first (if we're
diff --git a/js/src/config/milestone.txt b/js/src/config/milestone.txt
index 516402155..4b81f51db 100644
--- a/js/src/config/milestone.txt
+++ b/js/src/config/milestone.txt
@@ -8,4 +8,4 @@
 # Referenced by milestone.pl.
 #--------------------------------------------------------
 
-2.1.1
+2.2.0
diff --git a/layout/base/nsDisplayItemTypesList.h b/layout/base/nsDisplayItemTypesList.h
index 87ca0c602..3b039f7f4 100644
--- a/layout/base/nsDisplayItemTypesList.h
+++ b/layout/base/nsDisplayItemTypesList.h
@@ -36,6 +36,7 @@ DECLARE_DISPLAY_ITEM_TYPE(PLUGIN)
 DECLARE_DISPLAY_ITEM_TYPE(PLUGIN_READBACK)
 DECLARE_DISPLAY_ITEM_TYPE(PLUGIN_VIDEO)
 DECLARE_DISPLAY_ITEM_TYPE(PRINT_PLUGIN)
+DECLARE_DISPLAY_ITEM_TYPE(RANGE_FOCUS_RING)
 DECLARE_DISPLAY_ITEM_TYPE(REMOTE)
 DECLARE_DISPLAY_ITEM_TYPE(REMOTE_SHADOW)
 DECLARE_DISPLAY_ITEM_TYPE(SCROLL_LAYER)
diff --git a/layout/forms/nsRangeFrame.cpp b/layout/forms/nsRangeFrame.cpp
index 437b6acee..82c57edf6 100644
--- a/layout/forms/nsRangeFrame.cpp
+++ b/layout/forms/nsRangeFrame.cpp
@@ -173,7 +173,7 @@ public:
 #endif
   
   virtual void Paint(nsDisplayListBuilder* aBuilder, nsRenderingContext* aCtx) MOZ_OVERRIDE;
-  NS_DISPLAY_DECL_NAME("RangeFocusRing", TYPE_OUTLINE)
+  NS_DISPLAY_DECL_NAME("RangeFocusRing", TYPE_RANGE_FOCUS_RING)
 };
 
 void